react-native-bspatch 1.1.3 → 2.0.0

package/README.md

@@ -17,7 +17,6 @@ Premium OTA update solution for React Native using **TurboModules** + **bsdiff b
 - **Crash detection + auto-rollback** — native-side protection runs **before** JS boots; if the updated bundle crashes, the app automatically rolls back to the previous version
 - **Integrity verification** — SHA-256 hash check on both source bundle and result bundle
 - **Disk Garbage Collection** — automatically removes obsolete bundle versions and dangling temporary files
-- **Gzip decompression** — native 64KB-buffered gzip decompression on both Android and iOS
 - **Content-addressed asset store** — images/assets downloaded per-version and redirected via `setCustomSourceTransformer`
 - **Structured telemetry** — all OTA events forwarded to your analytics via `onEvent` callback
 - **New Architecture ready** — built with TurboModules (no legacy Bridge)
@@ -71,12 +70,9 @@ const config = {
   updateMode: OtaUpdateMode.BACKGROUND_DOWNLOAD, // Silent download without interrupting user
   allowDebugUpdates: false,   // default: OTA is blocked in __DEV__
   customServer: {
-    baseUrl: 'https://ota.yourcompany.com',
-    username: 'your-user',
-    password: 'your-pass',
+    baseUrl: 'https://raw.githubusercontent.com/<owner>/<storage-repo>/main',
     channel: 'production',
-    baseFolder: 'bspatch',
-    useMinio: false,
+    baseFolder: 'ota',
   },
 };
 
@@ -176,22 +172,20 @@ type OtaConfig = {
   onEvent?: (entry: OtaLogEntry) => void;
 
   /**
-   * Base64-encoded public key for HMAC-SHA256 patch signature verification.
+   * SPKI public key (PEM or base64, RSA or EC P-256) for signature verification.
+   * When set, unsigned or wrongly signed patches/bundles are rejected.
    * Recommended for production to prevent MITM attacks.
    */
   publicKey?: string;
 
-  /** Custom storage provider. Omit to use CustomStorageProvider. */
+  /** Custom storage provider. Omit to use GitHubRawStorageProvider. */
   storage?: OtaStorageProvider;
 
-  /** Custom server configuration (used by CustomStorageProvider) */
+  /** Static storage layout read by GITHUB_RAW (public, read-only — no credentials) */
   customServer?: {
-    baseUrl: string;
-    username: string;
-    password: string;
+    baseUrl: string;      // https://raw.githubusercontent.com/<owner>/<repo>/<branch>
     channel: string;
-    baseFolder?: string;  // default: 'bspatch'
-    useMinio?: boolean;
+    baseFolder?: string;  // default: 'ota'
   };
 };
 ```
@@ -254,7 +248,6 @@ Your OTA server must expose a `ota_registry.json` at the configured path (e.g. `
               "baseHash": "sha256_of_v1_bundle",
               "bundleHash": "sha256_of_v2_bundle",
               "platform": "android",
-              "compressed": false,
               "mandatory": false,
               "fullBundleUrl": "v2-full.zip"
             }
@@ -292,7 +285,7 @@ This means crash protection is **native-side and zero-cost** — it doesn't requ
 
 ## Custom Storage Provider
 
-The library ships with `CustomStorageProvider` for MinIO-based private servers. To use a different backend, implement the interface:
+The library ships with `GitHubRawStorageProvider` (default). To use a different backend (e.g. Cloudflare), implement the interface:
 
 ```ts
 interface OtaStorageProvider {
@@ -363,6 +356,7 @@ Add these to your `package.json` (or use the existing ones in this project):
     "react-native-bspatch": "bash ./src/native_modules/react-native-bspatch/tools/build_ota.sh",
     "ota:setup":   "yarn react-native-bspatch setup",
     "ota:init":    "yarn react-native-bspatch base",
+    "ota:seed":    "yarn react-native-bspatch seed",
     "ota:build":   "yarn react-native-bspatch",
     "ota:clean":   "yarn react-native-bspatch reset"
   }
@@ -372,22 +366,19 @@ Add these to your `package.json` (or use the existing ones in this project):
 ### Workflow
 
 ```
-ota:setup ──► ota:init ──► ota:build ──► (ota:build ◄── repeat for each release)
-   │             │            │
-   │             │            └── 1. Bundle JS → Hermes bytecode (.hbc)
-   │             │                2. Compare assets → generate asset-manifest-{ver}.json
-   │             │                3. bsdiff against previous bundle → .patch files
-   │             │                4. Upload to server + update ota_registry.json
-   │             │                5. Write otaPatches.generated.ts for bundled patches fallback
-   │             │
-   │             └── First build only: creates base bundle from APK/IPA.
-   │                                Stores base asset manifest so subsequent builds know
-   │                                which assets are already in the APK and skip them.
+ota:setup ──► (Build Release APK/IPA) ──► ota:build ──► (repeat for each OTA update)
+   │                  │                       │
+   │                  │                       └── Incremental patch from Base Bundle v1
+   │                  │
+   │                  └── Automatic Base Capture (Gradle & Xcode):
+   │                      Each release build automatically saves `bundle_{appVersion}_v1_{platform}.hbc`.
+   │                      No manual `ota:init` is required!
    │
    └── Patches native integration into project files:
          • iOS: AppDelegate.swift — adds bundleURL() override
-         • iOS: project.pbxproj — adds build-phase script to sync bundle → ios/output/
+         • iOS: project.pbxproj — syncs and auto-captures base bundle on Release archive
          • Android: MainApplication.kt — adds OtaBundleResolver.resolve() call
+         • Android: app/build.gradle — auto-captures base bundle upon assembleRelease / bundleRelease
          Idempotent: safe to run multiple times; skips already-patched files.
 ```
 
@@ -395,14 +386,22 @@ ota:setup ──► ota:init ──► ota:build ──► (ota:build ◄──
 
 | Command | Action |
 |---|---|
-| `yarn ota:setup` | Inject OTA integration into AppDelegate.swift, MainApplication.kt, project.pbxproj. Run once per project. |
-| `yarn ota:init` | First release: build base APK/IPA + bundle + base asset manifest. Creates `ota_registry.json`. |
-| `yarn ota:build` | Subsequent releases: generate incremental .patch from previous bundle, upload to server, update registry. |
+| `yarn ota:setup` | Inject OTA integration into AppDelegate.swift, MainApplication.kt, project.pbxproj, and app/build.gradle. |
+| `yarn ota:build` | Generate incremental `.patch` from previous bundle, upload to server, update registry. |
+| `yarn ota:seed --apk <path>` | **Zero Mismatch Recovery:** Seed base bundle directly from an existing release APK/AAB. |
+| `yarn ota:seed --ipa <path>` | **Zero Mismatch Recovery:** Seed base bundle directly from an existing release IPA. |
+| `yarn ota:init` | Manual first release: build base APK/IPA + bundle + base asset manifest. Creates `ota_registry.json`. |
 | `yarn ota:build --platform android` | Build Android only |
 | `yarn ota:build --platform ios` | Build iOS only |
 | `yarn ota:build --flavor staging` | Build with flavor "staging" (default: "dev") |
 | `yarn ota:clean` | Wipe `ota_registry.json` + output files. Preserves base asset manifests so `ota:build` still works after clean. |
 
+> [!TIP]
+> **Zero Mismatch & Fail-Safe Protection:**
+> 1. **Auto-Capture:** When you build a Release APK/AAB or Archive on Xcode, the bundle is automatically captured into `output/` as Base Bundle v1.
+> 2. **Seed Binary:** If you forgot to capture the base bundle and already submitted your APK/IPA to the Store, run `yarn ota:seed --apk ./app-release.apk`. It extracts the exact byte-for-byte bundle directly from the release binary, guaranteeing 100% hash match.
+> 3. **Fail-Safe Guard:** `ota:build` will refuse to generate an update if no authentic Base Bundle v1 is found, preventing corrupt patches that trigger full-bundle fallback downloads.
+
 ### How It Works
 
 1. **Bundle** — `npx react-native bundle` generates Hermes bytecode (`.hbc`). iOS base build uses the Xcode-compiled bundle to guarantee byte-exact match with the IPA.
@@ -417,11 +416,10 @@ ota:setup ──► ota:init ──► ota:build ──► (ota:build ◄──
 # 1. Add the npm scripts to package.json (or run directly)
 bash ./src/native_modules/react-native-bspatch/tools/build_ota.sh setup
 
-# 2. Initialize the first release (creates base APK + registry)
-yarn ota:init
-# Or per platform:
-yarn ota:init --platform android   # Android only
-yarn ota:init --platform ios       # iOS only
+# 2. Build your app normally for App Store / Google Play
+# Gradle and Xcode will automatically capture the base bundle (v1)!
+# OR seed from an existing release binary:
+yarn ota:seed --apk ./release.apk
 
 # 3. For each subsequent release:
 yarn ota:build
@@ -429,7 +427,7 @@ yarn ota:build
 
 ### Environment Variables
 
-The build script requires server credentials. You can provide them via:
+Builds publish to a GitHub storage repository. Authentication uses `gh auth token` (or `GH_TOKEN` / `GITHUB_TOKEN`), so run `gh auth login` once.
 
 **Option 1: `.env` file (recommended)**
 
@@ -437,8 +435,8 @@ Create a `.env` file in your **React Native project root** (not in the module di
 
 ```bash
 # In your project root (e.g., /path/to/YourApp/)
-OTA_USER=your-username
-OTA_PASSWORD=your-password
+OTA_BASE_URL=https://raw.githubusercontent.com/<owner>/<storage-repo>/main
+OTA_FOLDER=ota
 ```
 
 The build script automatically loads `.env` from the project root.
@@ -446,17 +444,15 @@ The build script automatically loads `.env` from the project root.
 **Option 2: Export environment variables**
 
 ```bash
-export OTA_USER="your-username"
-export OTA_PASSWORD="your-password"
+export OTA_BASE_URL="https://raw.githubusercontent.com/<owner>/<storage-repo>/main"
 yarn ota:build
 ```
 
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
-| `OTA_USER` | Yes | - | Server username |
-| `OTA_PASSWORD` | Yes | - | Server password |
-| `OTA_BASE_URL` | No | `https://sync-server.osp.com.vn` | Server base URL |
-| `OTA_FOLDER` | No | `congplqg` | Base folder path |
+| `OTA_BASE_URL` | Yes | - | `https://raw.githubusercontent.com/<owner>/<repo>/<branch>` |
+| `OTA_FOLDER` | No | `ota` | Base folder in the storage repo |
+| `OTA_PRIVATE_KEY` | No | - | PEM private key (or `ota_private_key.pem` in project root) |
 
 > **Security Warning:** Never commit credentials to source control. The `.env` file is gitignored.
 
@@ -492,12 +488,12 @@ const otaConfig: OtaConfig = {
 
 ### 2. Automated Signing at Build Time
 
-When you run `tools/build_ota.sh`, it automatically searches for `ota_private_key.pem` (or the `OTA_PRIVATE_KEY` environment variable). If found, it **cryptographically signs each binary patch file using SHA-256** and injects the signatures into `ota_registry.json`.
+When you run `tools/build_ota.sh`, it automatically searches for `ota_private_key.pem` (or the `OTA_PRIVATE_KEY` environment variable). If found, it **signs each patch (`signature`) and the resulting bundle (`bundleSignature`) with SHA-256** and injects the signatures into `ota_registry.json`. The bundle signature is checked on both the patch path and the full-bundle fallback. If the key is present but a file can't be signed, the build fails.
 
 On the client device:
 - **Android**: Uses Android Security Provider (`SHA256withRSA` / `SHA256withECDSA`).
 - **iOS**: Uses Apple Security framework (`SecKeyVerifySignature`).
-- **Backward Compatibility**: Automatically falls back to HMAC-SHA256 if a symmetric key is passed.
+- **Fail closed**: when `publicKey` is set, a missing or invalid signature rejects the update. HMAC/symmetric keys are no longer supported (the public key ships in the app, so it can't be a secret).
 
 ---
 
@@ -542,7 +538,7 @@ When executing `tools/build_ota.sh`, the script auto-detects the version from `b
 
 - **POSIX `mmap()` Zero-Copy Patching**: Unlike standard bspatch which allocates heap memory with `malloc()`, `react-native-bspatch` memory-maps the input and output files using `mmap()` and `MADV_SEQUENTIAL`. Memory overhead is reduced by **~85–90%**, virtually eliminating out-of-memory crashes on low-end devices.
 - **SIMD Vectorization**: The inner patching loop includes `#pragma clang loop vectorize(enable)` for Clang ARM NEON 128-bit vectorization.
-- **64KB Streaming Buffers**: File hashing, gzip decompression, and stream copying are upgraded to 64KB chunk sizes across Android and iOS.
+- **64KB Streaming Buffers**: File hashing and stream copying are upgraded to 64KB chunk sizes across Android and iOS.
 - **Disk Garbage Collection**: Calling `markHealthy()` automatically deletes obsolete bundle versions and dangling `.tmp` files from disk, keeping app storage minimal.
 - **HTTP 304 ETag Caching**: Registry queries send `If-None-Match`. On `304 Not Modified`, cached patches are returned instantly with zero JSON parsing overhead.
 
@@ -561,13 +557,12 @@ src/native_modules/react-native-bspatch/
 │       ├── OtaProvider.tsx           # React Context provider + auto-update logic
 │       ├── types.ts                  # All TypeScript type definitions
 │       └── storage/
-│           ├── CustomStorage.ts        # MinIO-based storage implementation
-│           └── GitHubReleaseStorage.ts # GitHub Releases storage (public / token-auth)
+│           └── GitHubRawStorage.ts     # GitHub raw repository storage (default)
 ├── android/src/main/java/vn/reactnativebspatch/
-│   ├── BsPatchModule.kt             # Native: applyPatch, unzip, extract, gzip
+│   ├── BsPatchModule.kt             # Native: applyPatch, extract, verifySignature
 │   └── OtaBundleResolver.kt         # Native: bundle resolution + rollback
 ├── ios/
-│   ├── RNBsPatch.mm                # Native iOS bridge + gzip decompress
+│   ├── RNBsPatch.mm                # Native iOS bridge + signature verify
 │   └── OtaBundleResolver.swift      # Native iOS bundle resolution + rollback
 ├── cpp/
 │   ├── CMakeLists.txt               # CMake build for bspatch C library

package/android/src/main/java/vn/reactnativebspatch/BsPatchModule.kt

@@ -11,8 +11,6 @@ import java.io.FileInputStream
 import java.io.FileOutputStream
 import java.io.BufferedInputStream
 import java.io.BufferedOutputStream
-import java.util.zip.ZipInputStream
-import java.util.zip.GZIPInputStream
 import java.util.concurrent.Executors
 
 class BsPatchModule(private val reactContext: ReactApplicationContext) : NativeBsPatchSpec(reactContext) {
@@ -44,36 +42,6 @@ class BsPatchModule(private val reactContext: ReactApplicationContext) : NativeB
         }
     }
 
-    override fun unzip(source: String, targetDir: String, promise: Promise) {
-        backgroundExecutor.execute {
-            try {
-                val sourceFile = File(source)
-                val destDir = File(targetDir)
-                if (!destDir.exists()) destDir.mkdirs()
-
-                ZipInputStream(BufferedInputStream(FileInputStream(sourceFile), IO_BUFFER_SIZE)).use { zis ->
-                    var entry = zis.nextEntry
-                    while (entry != null) {
-                        val file = File(destDir, entry.name)
-                        if (entry.isDirectory) {
-                            file.mkdirs()
-                        } else {
-                            file.parentFile?.mkdirs()
-                            BufferedOutputStream(FileOutputStream(file), IO_BUFFER_SIZE).use { bos ->
-                                zis.copyTo(bos, bufferSize = IO_BUFFER_SIZE)
-                            }
-                        }
-                        zis.closeEntry()
-                        entry = zis.nextEntry
-                    }
-                }
-                promise.resolve(true)
-            } catch (e: Exception) {
-                promise.reject("ERR_UNZIP", e.message, e)
-            }
-        }
-    }
-
     /**
      * Extracts the JS bundle from APK assets using Android AssetManager.
      * Guarantees byte-exact copy — RNFS.copyFileAssets can produce different
@@ -119,25 +87,6 @@ class BsPatchModule(private val reactContext: ReactApplicationContext) : NativeB
         android.util.Log.d("JS-OTA", message ?: "")
     }
 
-    override fun decompressGzip(sourcePath: String, destPath: String, promise: Promise) {
-        backgroundExecutor.execute {
-            try {
-                val source = File(sourcePath)
-                val dest = File(destPath)
-                dest.parentFile?.mkdirs()
-
-                GZIPInputStream(BufferedInputStream(FileInputStream(source), IO_BUFFER_SIZE), IO_BUFFER_SIZE).use { gis ->
-                    BufferedOutputStream(FileOutputStream(dest), IO_BUFFER_SIZE).use { bos ->
-                        gis.copyTo(bos, bufferSize = IO_BUFFER_SIZE)
-                    }
-                }
-                promise.resolve(true)
-            } catch (e: Exception) {
-                promise.reject("ERR_GZIP_DECOMPRESS", e.message, e)
-            }
-        }
-    }
-
     override fun verifySignature(filePath: String, signature: String, publicKey: String, promise: Promise) {
         backgroundExecutor.execute {
             try {
@@ -157,65 +106,29 @@ class BsPatchModule(private val reactContext: ReactApplicationContext) : NativeB
                 val keyBytes = android.util.Base64.decode(cleanKey, android.util.Base64.DEFAULT)
                 val expectedSigBytes = android.util.Base64.decode(signature.trim(), android.util.Base64.DEFAULT)
 
-                // 1. Try RSA Public Key (SHA256withRSA)
-                try {
-                    val keySpec = java.security.spec.X509EncodedKeySpec(keyBytes)
-                    val keyFactory = java.security.KeyFactory.getInstance("RSA")
-                    val pubKey = keyFactory.generatePublic(keySpec)
-                    val sig = java.security.Signature.getInstance("SHA256withRSA")
-                    sig.initVerify(pubKey)
-
-                    val buffer = ByteArray(IO_BUFFER_SIZE)
-                    FileInputStream(file).use { fis ->
-                        var read: Int
-                        while (fis.read(buffer).also { read = it } != -1) {
-                            sig.update(buffer, 0, read)
-                        }
-                    }
-                    val isValid = sig.verify(expectedSigBytes)
-                    promise.resolve(isValid)
-                    return@execute
-                } catch (rsaEx: Exception) {
-                    // Not RSA, continue
+                // Pick the algorithm from the key itself; never fall back to another scheme
+                val keySpec = java.security.spec.X509EncodedKeySpec(keyBytes)
+                val pubKey = try {
+                    java.security.KeyFactory.getInstance("RSA").generatePublic(keySpec)
+                } catch (e: Exception) {
+                    java.security.KeyFactory.getInstance("EC").generatePublic(keySpec)
                 }
-
-                // 2. Try ECDSA Public Key (SHA256withECDSA)
-                try {
-                    val keySpec = java.security.spec.X509EncodedKeySpec(keyBytes)
-                    val keyFactory = java.security.KeyFactory.getInstance("EC")
-                    val pubKey = keyFactory.generatePublic(keySpec)
-                    val sig = java.security.Signature.getInstance("SHA256withECDSA")
-                    sig.initVerify(pubKey)
-
-                    val buffer = ByteArray(IO_BUFFER_SIZE)
-                    FileInputStream(file).use { fis ->
-                        var read: Int
-                        while (fis.read(buffer).also { read = it } != -1) {
-                            sig.update(buffer, 0, read)
-                        }
-                    }
-                    val isValid = sig.verify(expectedSigBytes)
-                    promise.resolve(isValid)
-                    return@execute
-                } catch (ecEx: Exception) {
-                    // Not EC, continue
-                }
-
-                // 3. Fallback: HMAC-SHA256
-                val mac = javax.crypto.Mac.getInstance("HmacSHA256")
-                val secretKey = javax.crypto.spec.SecretKeySpec(keyBytes, "HmacSHA256")
-                mac.init(secretKey)
+                val sig = java.security.Signature.getInstance(
+                    if (pubKey.algorithm == "RSA") "SHA256withRSA" else "SHA256withECDSA"
+                )
+                sig.initVerify(pubKey)
 
                 val buffer = ByteArray(IO_BUFFER_SIZE)
                 FileInputStream(file).use { fis ->
                     var read: Int
                     while (fis.read(buffer).also { read = it } != -1) {
-                        mac.update(buffer, 0, read)
+                        sig.update(buffer, 0, read)
                     }
                 }
-                val computedSigBytes = mac.doFinal()
-                val isValid = java.security.MessageDigest.isEqual(expectedSigBytes, computedSigBytes)
-                promise.resolve(isValid)
+                promise.resolve(sig.verify(expectedSigBytes))
+            } catch (e: java.security.GeneralSecurityException) {
+                // Malformed key/signature → invalid (fail closed)
+                promise.resolve(false)
             } catch (e: Exception) {
                 promise.reject("ERR_VERIFY_SIG", e.message, e)
             }

package/android/src/main/java/vn/reactnativebspatch/OtaBundleResolver.kt

@@ -55,6 +55,18 @@ object OtaBundleResolver {
             }
 
             var metadata = JSONObject(metadataFile.readText())
+
+            // ── Step 0: Store update → OTA bundles were built for another native version ──
+            val otaAppVersion = metadata.optString("appVersion", "")
+            val installedAppVersion = context.packageManager
+                .getPackageInfo(context.packageName, 0).versionName ?: ""
+            if (otaAppVersion.isNotEmpty() && otaAppVersion != installedAppVersion) {
+                Log.i(TAG, "Native app $otaAppVersion → $installedAppVersion: discarding OTA state")
+                // JS bootstrap deletes ota_trash_* in the background
+                otaDir.renameTo(File(context.filesDir, "ota_trash_${System.currentTimeMillis()}"))
+                return null
+            }
+
             val currentVersion = metadata.optInt("currentVersion", baseVersion)
             val lastLaunchOk = metadata.optBoolean("lastLaunchSuccessful", true)
             val rollbackCount = metadata.optInt("rollbackCount", 0)
@@ -62,7 +74,12 @@ object OtaBundleResolver {
             // ── Step 1: Crash detection & rollback ──────────────────────────
             if (!lastLaunchOk && currentVersion > baseVersion) {
                 Log.w(TAG, "Previous launch failed! Rolling back from V$currentVersion...")
+                // Remember the crashing version so JS never re-applies it
+                val failed = metadata.optJSONArray("failedVersions") ?: JSONArray()
+                failed.put(currentVersion)
                 metadata = performRollback(metadata, baseVersion, rollbackCount, otaDir)
+                metadata.put("failedVersions", failed)
+                metadata.put("appVersion", otaAppVersion)
                 writeMetadata(metadataFile, metadata)
 
                 val newVersion = metadata.optInt("currentVersion", baseVersion)
@@ -219,7 +236,10 @@ object OtaBundleResolver {
     private fun writeMetadata(file: File, metadata: JSONObject) {
         try {
             file.parentFile?.mkdirs()
-            file.writeText(metadata.toString(2))
+            // Write-then-rename: a crash mid-write never leaves truncated JSON
+            val tmp = File(file.parentFile, "${file.name}.tmp")
+            tmp.writeText(metadata.toString(2))
+            if (!tmp.renameTo(file)) throw java.io.IOException("rename failed")
         } catch (e: Exception) {
             Log.e(TAG, "Failed to write metadata: ${e.message}")
         }

package/cpp/bsdiff/bspatch.c

@@ -65,6 +65,7 @@ int bspatch(const uint8_t* old, int64_t oldsize, uint8_t* new, int64_t newsize,
 		/* Sanity-check */
 		if (ctrl[0]<0 || ctrl[0]>INT_MAX ||
 			ctrl[1]<0 || ctrl[1]>INT_MAX ||
+			ctrl[2]<-INT_MAX || ctrl[2]>INT_MAX ||
 			newpos+ctrl[0]>newsize)
 			return -1;
 

package/ios/OtaBundleResolver.swift

@@ -62,6 +62,17 @@ public class OtaBundleResolver: NSObject {
                 return nil
             }
 
+            // ── Step 0: Store update → OTA bundles were built for another native version ──
+            let otaAppVersion = metadata["appVersion"] as? String ?? ""
+            let installedAppVersion = Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? ""
+            if !otaAppVersion.isEmpty && otaAppVersion != installedAppVersion {
+                NSLog("[OtaBundleResolver] Native app \(otaAppVersion) → \(installedAppVersion): discarding OTA state")
+                // JS bootstrap deletes ota_trash_* in the background
+                let trash = documentsDir.appendingPathComponent("ota_trash_\(Int(Date().timeIntervalSince1970 * 1000))")
+                try? FileManager.default.moveItem(at: otaDir, to: trash)
+                return nil
+            }
+
             let currentVersion = metadata["currentVersion"] as? Int ?? baseVersion
             let lastLaunchOk = metadata["lastLaunchSuccessful"] as? Bool ?? true
             let rollbackCount = metadata["rollbackCount"] as? Int ?? 0
@@ -70,7 +81,11 @@ public class OtaBundleResolver: NSObject {
             if !lastLaunchOk && currentVersion > baseVersion {
                 NSLog("[OtaBundleResolver] Previous launch failed! Rolling back from V\(currentVersion)...")
                 
+                // Remember the crashing version so JS never re-applies it
+                let failed = (metadata["failedVersions"] as? [Int] ?? []) + [currentVersion]
                 metadata = performRollback(metadata: metadata, baseVersion: baseVersion, currentRollbackCount: rollbackCount, otaDir: otaDir)
+                metadata["failedVersions"] = failed
+                metadata["appVersion"] = otaAppVersion
                 writeMetadata(url: metadataURL, metadata: metadata)
 
                 let newVersion = metadata["currentVersion"] as? Int ?? baseVersion
@@ -233,7 +248,7 @@ public class OtaBundleResolver: NSObject {
     private static func writeMetadata(url: URL, metadata: [String: Any]) {
         do {
             let data = try JSONSerialization.data(withJSONObject: metadata, options: .prettyPrinted)
-            try data.write(to: url)
+            try data.write(to: url, options: .atomic)
         } catch {
             NSLog("[OtaBundleResolver] Failed to write metadata: \(error.localizedDescription)")
         }