pulse-updates 1.4.0 → 1.4.1

package/android/src/main/java/app/pulse/updates/PulseController.kt

@@ -40,6 +40,25 @@ internal fun pulseLogError(tag: String, message: String) {
     println("[$tag] ERROR: $message")
 }
 
+/**
+ * Streaming sha256 of a file, lowercase hex.
+ *
+ * File-level because the asset store is content-addressed, so both halves of this file need it:
+ * PulseRemoteLoader to check what it just downloaded, PulseController to check what it is about to
+ * launch. It used to be private to the loader, which is why nothing verified the launch path.
+ */
+internal fun sha256Hex(file: File): String {
+    val digest = MessageDigest.getInstance("SHA-256")
+    file.inputStream().use { fis ->
+        val buffer = ByteArray(8192)
+        var bytesRead: Int
+        while (fis.read(buffer).also { bytesRead = it } != -1) {
+            digest.update(buffer, 0, bytesRead)
+        }
+    }
+    return digest.digest().joinToString("") { "%02x".format(it) }
+}
+
 /**
  * PulseUpdates Controller
  * Based on expo-updates AppController
@@ -373,10 +392,34 @@ class PulseController private constructor() {
                 pulseLog(TAG, "selectBestUpdateSync: using embedded bundle (default RN loading)")
             } else if (selectedUpdate.bundleHash != null) {
                 val bundlePath = File(directory, "assets/sha256/${selectedUpdate.bundleHash.lowercase()}")
-                val exists = bundlePath.exists()
-                pulseLog(TAG, "selectBestUpdateSync: bundlePath exists=$exists")
-
-                if (exists) {
+                // Hash it on the launches that can actually be holding a broken file: one that has
+                // never started successfully. A download cut short is broken from the moment it
+                // lands, so the first launch is where the check pays; after an update has run once
+                // the bytes were proven good, and re-hashing megabytes on every cold start after
+                // that would be a startup cost with nothing to find.
+                val usable = if (selectedUpdate.successfulLaunchCount > 0) {
+                    bundlePath.isFile && bundlePath.length() > 0L
+                } else {
+                    isBundleIntact(bundlePath, selectedUpdate.bundleHash)
+                }
+                pulseLog(TAG, "selectBestUpdateSync: bundlePath usable=$usable")
+
+                if (!usable) {
+                    // A bundle that is present but not intact is worse than a missing one: it
+                    // passes an existence check, reaches JSBundleLoader.createFileLoader(), and
+                    // React Native throws out of loadJSBundleFromFile() before any JS runs — so
+                    // nothing marks the launch failed and the same file is chosen again on every
+                    // start. That is a permanently unlaunchable app, fixable only by reinstalling.
+                    // Retire the update instead: 'failed' is excluded from launchableUpdates(), so
+                    // the next selection falls through to the embedded bundle.
+                    pulseLogError(
+                        TAG,
+                        "selectBestUpdateSync: bundle for ${selectedUpdate.updateId} is missing or " +
+                            "corrupt, marking failed and falling back to the embedded bundle"
+                    )
+                    db.recordFailedLaunch(selectedUpdate.updateId)
+                    db.setStatus(selectedUpdate.updateId, PulseUpdateStatus.FAILED)
+                } else {
                     launchAssetFile = bundlePath
                     isEmbeddedLaunch = false
 
@@ -625,13 +668,53 @@ class PulseController private constructor() {
         // For embedded bundles, return null to let React Native use its default mechanism
         // This ensures images from drawable folders work correctly
         val launchFile = launchAssetFile
-        if (launchFile != null && launchFile.exists()) {
+        // exists() is not enough here — an empty or truncated file exists. Handing one to
+        // JSBundleLoader.createFileLoader() throws out of ReactInstance.loadJSBundleFromFile()
+        // before JS starts, which no recovery path can catch. Returning null costs the OTA
+        // update; returning a broken path costs the app.
+        if (launchFile != null && launchFile.isFile && launchFile.length() > 0L) {
             return launchFile
         }
+        if (launchFile != null) {
+            pulseLogError(TAG, "getBundleFile: ${launchFile.absolutePath} is not a usable bundle, using the embedded one")
+        }
         // Return null to use default bundle loading (from APK assets)
         return null
     }
 
+    // Remembers the verdict for a bundle file so a relaunch (jsBundleLoader is re-queried on every
+    // reload) does not re-hash several megabytes on the launch path. Keyed by identity AND by the
+    // file's size and mtime, so a file replaced underneath us is hashed again.
+    private var intactBundleKey: String? = null
+
+    /**
+     * Whether [file] is a bundle we can actually hand to React Native.
+     *
+     * The store is content-addressed — the file name IS the sha256 of the bytes — so an exact
+     * check is available and cheap, and nothing was doing it. A download interrupted by a kill or
+     * a full disk leaves a short file at the right path; it satisfies exists(), and every launch
+     * afterwards dies in loadJSBundleFromFile().
+     */
+    private fun isBundleIntact(file: File, expectedHash: String): Boolean {
+        if (!file.isFile || file.length() == 0L) return false
+
+        val key = "${file.absolutePath}:${file.length()}:${file.lastModified()}"
+        if (key == intactBundleKey) return true
+
+        val actual = try {
+            sha256Hex(file)
+        } catch (e: Exception) {
+            pulseLogError(TAG, "isBundleIntact: could not read ${file.absolutePath}: ${e.message}")
+            return false
+        }
+        if (!actual.equals(expectedHash, ignoreCase = true)) {
+            pulseLogError(TAG, "isBundleIntact: ${file.name} hashes to $actual, expected $expectedHash")
+            return false
+        }
+        intactBundleKey = key
+        return true
+    }
+
     // True when the host app is built debuggable. This is the runtime equivalent of iOS #if DEBUG:
     // this module is an android-library, so its own BuildConfig.DEBUG reflects the library build
     // type, not the host app. FLAG_DEBUGGABLE on the host context is authoritative.
@@ -1721,18 +1804,6 @@ object PulseRemoteLoader {
         }
     }
 
-    private fun sha256Hex(file: File): String {
-        val digest = MessageDigest.getInstance("SHA-256")
-        file.inputStream().use { fis ->
-            val buffer = ByteArray(8192)
-            var bytesRead: Int
-            while (fis.read(buffer).also { bytesRead = it } != -1) {
-                digest.update(buffer, 0, bytesRead)
-            }
-        }
-        return digest.digest().joinToString("") { "%02x".format(it) }
-    }
-
     // MARK: - Signature Verification
 
     private fun verifyManifestSignature(

package/android/src/main/java/app/pulse/updates/launcher/PulseAppLauncher.kt

@@ -122,10 +122,13 @@ class PulseAppLauncher(
 
             if (assets.isEmpty()) {
                 // No assets to verify, just find the bundle
+                var intact = false
                 update.bundleHash?.let { hash ->
                     launchAssetFile = bundleStorePath(hash)
+                    intact = bundleIsIntact(launchAssetFile, hash)
                 }
-                callback(launchAssetFile?.exists() == true, if (launchAssetFile?.exists() != true) LauncherException("Bundle not found") else null)
+                if (!intact) launchAssetFile = null
+                callback(intact, if (intact) null else LauncherException("Bundle missing or corrupt"))
                 return
             }
 
@@ -165,8 +168,9 @@ class PulseAppLauncher(
                 // All assets accounted for, but we need the bundle
                 update.bundleHash?.let { hash ->
                     launchAssetFile = bundleStorePath(hash)
-                    if (launchAssetFile?.exists() != true) {
-                        callback(false, LauncherException("Bundle not found"))
+                    if (!bundleIsIntact(launchAssetFile, hash)) {
+                        launchAssetFile = null
+                        callback(false, LauncherException("Bundle missing or corrupt"))
                         return
                     }
                 }
@@ -328,6 +332,25 @@ class PulseAppLauncher(
         return File(directory, "assets/sha256/${hash.lowercase()}")
     }
 
+    /**
+     * Whether the launch bundle is not just present but whole.
+     *
+     * exists() says a file is there, not that it is the file we downloaded. A write cut short by a
+     * kill or a full disk leaves a short one at the right path, and React Native does not survive
+     * being handed it: loadJSBundleFromFile() throws before any JS runs, so no recovery hook fires
+     * and the same file is picked again on the next launch. The store is content-addressed, so the
+     * name is the answer — compare it.
+     */
+    private fun bundleIsIntact(file: File?, expectedHash: String): Boolean {
+        if (file == null || !file.isFile || file.length() == 0L) return false
+        return try {
+            sha256Hex(file).equals(expectedHash, ignoreCase = true)
+        } catch (e: Exception) {
+            pulseLogError(TAG, "Could not hash ${file.absolutePath}: ${e.message}")
+            false
+        }
+    }
+
     // MARK: - Embedded Assets Map
 
     private fun buildEmbeddedAssetsMap(): Map<String, String> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Pulse app-experience SDK for React Native: updates, config, experiments, events, decisions and first-party links",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",