pulse-updates 1.5.1 → 1.5.2

package/ios/PulseUpdates/AppLauncher/PulseAppLauncher.swift

@@ -3,6 +3,7 @@
 // Handles launching updates with asset fallback support
 
 import Foundation
+import CryptoKit
 
 // MARK: - Launcher Protocol
 
@@ -132,7 +133,8 @@ final class PulseAppLauncher {
             if assets.isEmpty {
                 // No assets to verify, just find the bundle
                 if let bundleHash = update.bundleHash {
-                    launchAssetUrl = bundleStorePath(hash: bundleHash)
+                    let candidate = bundleStorePath(hash: bundleHash)
+                    launchAssetUrl = bundleIsIntact(at: candidate, expectedHash: bundleHash) ? candidate : nil
                 }
                 completion(launchAssetUrl != nil, launchAssetUrl == nil ? PulseLauncherError.bundleNotFound : nil)
                 return
@@ -171,7 +173,8 @@ final class PulseAppLauncher {
                 // All assets accounted for, but we need the bundle
                 if let bundleHash = update.bundleHash {
                     launchAssetUrl = bundleStorePath(hash: bundleHash)
-                    if !FileManager.default.fileExists(atPath: launchAssetUrl!.path) {
+                    if !bundleIsIntact(at: launchAssetUrl, expectedHash: bundleHash) {
+                        launchAssetUrl = nil
                         completion(false, PulseLauncherError.bundleNotFound)
                         return
                     }
@@ -374,6 +377,34 @@ final class PulseAppLauncher {
             .appendingPathComponent(hash.lowercased())
     }
 
+    /// Whether the launch bundle is not just present but whole.
+    ///
+    /// `fileExists` says a file is there, not that it is the file we downloaded. A write cut short
+    /// by a kill or a full disk leaves a short one at the right path, and React Native does not
+    /// survive being handed it: it throws while loading the bundle before any JS runs, so no
+    /// recovery hook fires and the same file is picked again on the next launch. The store is
+    /// content-addressed — the name IS the sha256 of the bytes — so compare it.
+    ///
+    /// `PulseController.selectBestUpdateSync` already does this on the primary launch path; this
+    /// closes the same gap here, and matches `PulseAppLauncher.bundleIsIntact` on Android.
+    private func bundleIsIntact(at url: URL?, expectedHash: String) -> Bool {
+        guard let url, let handle = try? FileHandle(forReadingFrom: url) else { return false }
+        defer { try? handle.close() }
+
+        var hasher = SHA256()
+        var sawBytes = false
+        while true {
+            let chunk = try? handle.read(upToCount: 1024 * 1024)
+            guard let data = chunk, !data.isEmpty else { break }
+            sawBytes = true
+            hasher.update(data: data)
+        }
+        guard sawBytes else { return false }
+
+        let actual = hasher.finalize().map { String(format: "%02x", $0) }.joined()
+        return actual == expectedHash.lowercased()
+    }
+
     private func bundleStorePath(hash: String) -> URL {
         // Bundle is stored in assets directory (same location as other assets)
         return directory

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Pulse app-experience SDK for React Native: updates, config, experiments, events, decisions and first-party links",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",