react-native-update 10.49.0 → 10.50.0

package/harmony/pushy/src/main/ets/DownloadTask.ts

@@ -15,6 +15,10 @@ import NativePatchCore, {
 export interface PatchManifestArrays {
   copyFroms: string[];
   copyTos: string[];
+  // 与 copyFroms/copyTos 逐位对齐的 copiesCrc(CLI >= 2.21.2 的 pdiff
+  // manifest 携带,键是 to);无声明时为 null。拷贝前用它校验包内资源内容,
+  // 不符则整次 patch 失败落 full——重打包二进制不能静默拷出漂移的资源。
+  copyCrcs: (number | null)[];
   deletes: string[];
   // __diff.json 中对应 bundle patch 条目的 hbcTransform 元数据(原始 JSON
   // 字符串);为空时 native 走现状路径
@@ -27,6 +31,7 @@ export function parseManifestToArrays(
 ): PatchManifestArrays {
   const copyFroms: string[] = [];
   const copyTos: string[] = [];
+  const copyCrcs: (number | null)[] = [];
   const deletesValue = manifest.deletes;
   const deletes = Array.isArray(deletesValue)
     ? deletesValue.map(item => String(item))
@@ -35,6 +40,11 @@ export function parseManifestToArrays(
       : [];
 
   const copies = (manifest.copies || {}) as Record<string, string>;
+  const copiesCrcValue = manifest.copiesCrc;
+  const copiesCrc =
+    copiesCrcValue && typeof copiesCrcValue === 'object'
+      ? (copiesCrcValue as Record<string, number>)
+      : ({} as Record<string, number>);
   for (const [to, rawFrom] of Object.entries(copies)) {
     let from = String(rawFrom || '');
     if (normalizeResourceCopies) {
@@ -45,6 +55,8 @@ export function parseManifestToArrays(
     }
     copyFroms.push(from);
     copyTos.push(to);
+    const crc = copiesCrc[to];
+    copyCrcs.push(typeof crc === 'number' && Number.isFinite(crc) ? crc : null);
   }
 
   const hbcTransform = manifest.hbcTransform as
@@ -62,6 +74,7 @@ export function parseManifestToArrays(
   return {
     copyFroms,
     copyTos,
+    copyCrcs,
     deletes,
     hbcTransformMeta,
   };
@@ -229,6 +242,7 @@ export class DownloadTask {
       return {
         copyFroms: [],
         copyTos: [],
+        copyCrcs: [],
         deletes: [],
         hbcTransformMeta: '',
       };
@@ -534,6 +548,20 @@ export class DownloadTask {
 
   private async doPatchFromApp(params: DownloadTaskParams): Promise<void> {
     await this.downloadFile(params);
+    try {
+      await this.doPatchFromAppAfterDownload(params);
+    } catch (error: any) {
+      // 下载已完成,之后的失败都是 patch 应用失败(解压/hpatch/资源拷贝,
+      // 含 copiesCrc 校验)。打上稳定码,JS 层遥测按 patch_fail 归类,
+      // 而不是混进网络失败。
+      error.code = 'PATCH_FAILED';
+      throw error;
+    }
+  }
+
+  private async doPatchFromAppAfterDownload(
+    params: DownloadTaskParams,
+  ): Promise<void> {
     await this.recreateDirectory(params.unzipDirectory);
 
     await zlib.decompressFile(params.targetFile, params.unzipDirectory);
@@ -566,12 +594,22 @@ export class DownloadTask {
       `${params.unzipDirectory}/bundle.harmony.js`,
       manifestArrays.hbcTransformMeta,
     );
+    // 组按 from 聚合;同一 from 的内容必然一致,所以每组一个 CRC 即可
+    // (与 manifest 逐位对齐的 copyCrcs 里取第一个非空值)。
+    const crcByFrom = new Map<string, number>();
+    manifestArrays.copyFroms.forEach((from, index) => {
+      const crc = manifestArrays.copyCrcs[index];
+      if (crc !== null && !crcByFrom.has(from)) {
+        crcByFrom.set(from, crc);
+      }
+    });
     await this.copyFromResource(
       NativePatchCore.buildCopyGroups(
         manifestArrays.copyFroms,
         manifestArrays.copyTos,
       ),
       params.unzipDirectory,
+      crcByFrom,
     );
     try {
       if (fileIo.accessSync(params.targetFile)) {
@@ -584,6 +622,18 @@ export class DownloadTask {
 
   private async doPatchFromPpk(params: DownloadTaskParams): Promise<void> {
     await this.downloadFile(params);
+    try {
+      await this.doPatchFromPpkAfterDownload(params);
+    } catch (error: any) {
+      // 同 doPatchFromApp:下载完成后的失败按 patch 失败归类。
+      error.code = 'PATCH_FAILED';
+      throw error;
+    }
+  }
+
+  private async doPatchFromPpkAfterDownload(
+    params: DownloadTaskParams,
+  ): Promise<void> {
     await this.recreateDirectory(params.unzipDirectory);
 
     await zlib.decompressFile(params.targetFile, params.unzipDirectory);
@@ -626,6 +676,7 @@ export class DownloadTask {
   private async copyFromResource(
     copyGroups: CopyGroupResult[],
     targetRoot: string,
+    crcByFrom?: Map<string, number>,
   ): Promise<void> {
     let currentFrom = '';
     try {
@@ -637,6 +688,7 @@ export class DownloadTask {
         if (targets.length === 0) {
           continue;
         }
+        const expectedCrc = crcByFrom?.get(currentFrom);
 
         if (currentFrom.startsWith('resources/base/media/')) {
           // Strip only the final extension: 'icon.round.png' -> 'icon.round',
@@ -645,6 +697,7 @@ export class DownloadTask {
             .replace('resources/base/media/', '')
             .replace(/\.[^.]+$/, '');
           const mediaBuffer = await resourceManager.getMediaByName(mediaName);
+          this.verifyCopySourceCrc(mediaBuffer, expectedCrc, currentFrom);
           const parentDirs = [
             ...new Set(
               targets.map(t => t.substring(0, t.lastIndexOf('/'))).filter(Boolean),
@@ -658,6 +711,22 @@ export class DownloadTask {
           );
           continue;
         }
+
+        if (expectedCrc !== undefined) {
+          // 声明了 CRC 的条目改走字节路径:读出内容先校验再落盘。
+          // 重打包的二进制里同名 rawfile 内容可能已漂移,fd 直拷会把
+          // 错误字节静默装进版本目录。
+          const rawContent =
+            await resourceManager.getRawFileContent(currentFrom);
+          this.verifyCopySourceCrc(rawContent, expectedCrc, currentFrom);
+          const [firstTarget, ...restTargets] = targets;
+          await this.writeFileContent(firstTarget, rawContent);
+          await Promise.all(
+            restTargets.map(target => this.copySandboxFile(firstTarget, target)),
+          );
+          continue;
+        }
+
         const fromContent = await resourceManager.getRawFd(currentFrom);
         try {
           const [firstTarget, ...restTargets] = targets;
@@ -697,6 +766,22 @@ export class DownloadTask {
     }
   }
 
+  // pdiff 拷贝源内容校验(__diff.json copiesCrc):不符即抛错,整次 patch
+  // 失败后 JS 策略链自动回退 full,绝不把漂移的资源装进版本目录。
+  private verifyCopySourceCrc(
+    content: Uint8Array,
+    expectedCrc: number | undefined,
+    from: string,
+  ): void {
+    if (expectedCrc === undefined) {
+      return;
+    }
+    const actualCrc = NativePatchCore.crc32(content);
+    if (actualCrc !== expectedCrc) {
+      throw new Error(`resource content mismatch (crc32): ${from}`);
+    }
+  }
+
   private async doCleanUp(params: DownloadTaskParams): Promise<void> {
     try {
       await NativePatchCore.cleanupOldEntries(

package/harmony/pushy/src/main/ets/NativePatchCore.ts

@@ -82,6 +82,8 @@ interface NativePatchCoreBindings {
   ): Promise<void>;
   /** sha256(小写 hex)。同步:输入是已在内存的 rawfile bundle,哈希毫秒级 */
   sha256Hex(data: Uint8Array): string;
+  /** CRC32(zip/zlib 多项式)。pdiff 拷贝前与 copiesCrc 比对用 */
+  crc32(data: Uint8Array | ArrayBuffer): number;
   /** 原生 patch 内核可消费的 diff 轨道版本(2 = hdiffv2 轨道) */
   getSupportedDiffVersion(): number;
 }

package/harmony/pushy/src/main/ets/UpdateContext.ts

@@ -20,6 +20,27 @@ type FlushablePreferences = preferences.Preferences & {
   flushSync?: () => void;
 };
 
+// 服务端下发的 hash/originHash/fileName 会拼进 rootDir 作为子路径；凡是可能
+// 逃出 rootDir 的值（路径分隔符、".."、"."）必须在触碰文件系统前拒绝。
+export function isSafePathComponent(name: string): boolean {
+  return (
+    typeof name === 'string' &&
+    name.length > 0 &&
+    name !== '.' &&
+    name !== '..' &&
+    !name.includes('/') &&
+    !name.includes('\\') &&
+    !name.includes('\0')
+  );
+}
+
+function assertSafePathComponent(name: string): string {
+  if (!isSafePathComponent(name)) {
+    throw Error(`Invalid path component: ${name}`);
+  }
+  return name;
+}
+
 export class UpdateContext {
   private context: common.UIAbilityContext;
   private rootDir: string;
@@ -296,7 +317,7 @@ export class UpdateContext {
     const params = new DownloadTaskParams();
     params.type = type;
     params.url = url;
-    params.hash = hash;
+    params.hash = assertSafePathComponent(hash);
     return params;
   }
 
@@ -474,7 +495,7 @@ export class UpdateContext {
       url,
       hash,
     );
-    params.targetFile = this.rootDir + '/' + fileName;
+    params.targetFile = this.rootDir + '/' + assertSafePathComponent(fileName);
     await this.executeTask(params);
   }
 
@@ -488,7 +509,7 @@ export class UpdateContext {
       url,
       hash,
     );
-    params.originHash = originHash;
+    params.originHash = assertSafePathComponent(originHash);
     params.targetFile = `${this.rootDir}/${originHash}_${hash}.ppk.patch`;
     params.unzipDirectory = `${this.rootDir}/${hash}`;
     params.originDirectory = `${this.rootDir}/${params.originHash}`;
@@ -516,7 +537,7 @@ export class UpdateContext {
 
   public switchVersion(hash: string): void {
     try {
-      const bundlePath = this.getBundlePath(hash);
+      const bundlePath = this.getBundlePath(assertSafePathComponent(hash));
       if (!fileIo.accessSync(bundlePath)) {
         throw Error(`Bundle version ${hash} not found.`);
       }

package/ios/RCTPushy/RCTPushy.mm

@@ -139,6 +139,25 @@ static BOOL PushyStringIsBlank(NSString *value) {
     return [[value stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] length] == 0;
 }
 
+// Server-provided identifiers (hash/originHash) are used as child names under
+// the download root; anything that could resolve outside of it (path
+// separators, "..", ".") must be rejected before touching the filesystem.
+static BOOL PushyIsSafePathComponent(NSString *value) {
+    if (PushyStringIsBlank(value)) {
+        return NO;
+    }
+    if ([value isEqualToString:@"."] || [value isEqualToString:@".."]) {
+        return NO;
+    }
+    if ([value containsString:@"/"] || [value containsString:@"\\"]) {
+        return NO;
+    }
+    if ([value rangeOfString:@"\0"].location != NSNotFound) {
+        return NO;
+    }
+    return YES;
+}
+
 static void PushyRejectError(RCTPromiseRejectBlock reject, NSError *error) {
     // Prefer the stable cross-platform code (error_codes.h); fall back to the
     // numeric NSError code for system errors that were not classified.
@@ -162,15 +181,28 @@ static pushy::patch::PatchManifest PushyPatchManifestFromJson(NSDictionary *json
     pushy::patch::PatchManifest manifest;
 
     NSDictionary *copies = json[@"copies"];
+    // Content checksum per copy target ("copiesCrc", pdiff manifests from
+    // CLI >= 2.21.2). The patch core verifies the copy source against it and
+    // fails the patch on mismatch, so the JS strategy chain falls back to the
+    // full package instead of copying drifted bytes from a rebuilt binary.
+    NSDictionary *copiesCrc = json[@"copiesCrc"];
+    if (![copiesCrc isKindOfClass:[NSDictionary class]]) {
+        copiesCrc = nil;
+    }
     for (NSString *to in copies) {
         NSString *from = copies[to];
         if (from.length <= 0) {
             from = to;
         }
-        manifest.copies.push_back(pushy::patch::CopyOperation{
-            PushyToStdString(from),
-            PushyToStdString(to),
-        });
+        pushy::patch::CopyOperation operation;
+        operation.from = PushyToStdString(from);
+        operation.to = PushyToStdString(to);
+        NSNumber *expectedCrc = copiesCrc[to];
+        if ([expectedCrc isKindOfClass:[NSNumber class]]) {
+            operation.has_expected_crc = true;
+            operation.expected_crc = (uint32_t)[expectedCrc unsignedLongLongValue];
+        }
+        manifest.copies.push_back(operation);
     }
 
     NSDictionary *deletes = json[@"deletes"];
@@ -248,6 +280,7 @@ static void PushyApplyStateToDefaults(NSUserDefaults *defaults, const pushy::sta
                  callback:(void (^)(NSError *error))callback;
 - (BOOL)switchVersion:(NSString *)hash error:(NSError **)error;
 - (BOOL)ensureDirectoryExistsAtPath:(NSString *)path;
++ (void)excludeFromBackup:(NSString *)path;
 - (void)unzipFileAtPath:(NSString *)path
           toDestination:(NSString *)destination
       completionHandler:(void (^)(NSError *error))completionHandler;
@@ -694,12 +727,12 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
     NSString *updateUrl = PushyOptionString(options, @"updateUrl");
     NSString *hash = PushyOptionString(options, @"hash");
 
-    if (PushyStringIsBlank(updateUrl) || PushyStringIsBlank(hash)) {
+    if (PushyStringIsBlank(updateUrl) || !PushyIsSafePathComponent(hash)) {
         callback(PushyErrorWithCode(pushy::error_codes::kInvalidOptions, ERROR_OPTIONS));
         return;
     }
     NSString *originHash = PushyOptionString(options, @"originHash");
-    if (type == PushyTypePatchFromPpk && PushyStringIsBlank(originHash)) {
+    if (type == PushyTypePatchFromPpk && !PushyIsSafePathComponent(originHash)) {
         callback(PushyErrorWithCode(pushy::error_codes::kInvalidOptions, ERROR_OPTIONS));
         return;
     }
@@ -893,7 +926,7 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
 
 - (BOOL)switchVersion:(NSString *)hash error:(NSError **)error
 {
-    if (PushyStringIsBlank(hash)) {
+    if (!PushyIsSafePathComponent(hash)) {
         if (error != NULL) {
             *error = PushyErrorWithCode(pushy::error_codes::kInvalidOptions, ERROR_OPTIONS);
         }
@@ -922,6 +955,10 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
     NSFileManager *fileManager = [NSFileManager defaultManager];
     BOOL isDirectory = NO;
     if ([fileManager fileExistsAtPath:path isDirectory:&isDirectory]) {
+        if (isDirectory) {
+            // Directories created by older versions never got the flag.
+            [RCTPushy excludeFromBackup:path];
+        }
         return isDirectory;
     }
 
@@ -933,10 +970,27 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
     if (!success && error != nil) {
         RCTLogWarn(@"Pushy create directory error: %@", error.localizedDescription);
     }
+    if (success) {
+        [RCTPushy excludeFromBackup:path];
+    }
 
     return success;
 }
 
+// Everything under rctpushy is re-downloadable, and Application Support is
+// backed up to iCloud by default — Apple requires such content to be
+// excluded from backups.
++ (void)excludeFromBackup:(NSString *)path
+{
+    NSURL *url = [NSURL fileURLWithPath:path isDirectory:YES];
+    NSError *error = nil;
+    if (![url setResourceValue:@YES
+                        forKey:NSURLIsExcludedFromBackupKey
+                         error:&error]) {
+        RCTLogWarn(@"Pushy exclude from backup error: %@", error.localizedDescription);
+    }
+}
+
 - (void)unzipFileAtPath:(NSString *)path
           toDestination:(NSString *)destination
       completionHandler:(void (^)(NSError *error))completionHandler

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "10.49.0",
+  "version": "10.50.0",
   "description": "react-native hot update",
   "main": "src/index",
   "types": "src/index.ts",

package/src/client.ts

@@ -133,6 +133,13 @@ export const sharedState: {
   applyingUpdate: false,
 };
 
+// The SDK is a process-level singleton: module-level sharedState, the global
+// i18n locale and the native update state are all per-process, so a second
+// client would silently share (and fight over) them. Constructing one is a
+// hard integration error, except for the idempotent re-creation of the same
+// client (same type + appKey), which dev fast-refresh triggers legitimately.
+let activeClient: Pushy | undefined;
+
 const assertHash = (hash: string) => {
   if (!sharedState.downloadedHash) {
     log(`no downloaded hash yet, ignore switch to ${hash}`);
@@ -169,6 +176,23 @@ export class Pushy {
 
   constructor(options: ClientOptions, clientType?: 'Pushy' | 'Cresc') {
     this.clientType = clientType || 'Pushy';
+    if (activeClient) {
+      if (
+        activeClient.clientType === this.clientType &&
+        activeClient.options.appKey === options.appKey
+      ) {
+        // Same client re-created (e.g. fast refresh re-running the module
+        // that builds it): apply the latest options and hand back the
+        // existing instance instead of forking process-level state.
+        activeClient.setOptions(options);
+        // biome-ignore lint/correctness/noConstructorReturn: intentional singleton — identical re-creation must yield the existing instance
+        return activeClient;
+      }
+      throw new UpdateError(
+        i18n.t('error_client_singleton'),
+        'SINGLETON_VIOLATION'
+      );
+    }
     this.options.server = cloneServerConfig(SERVER_PRESETS[this.clientType]);
 
     i18n.setLocale(
@@ -193,8 +217,28 @@ export class Pushy {
         },
       });
     }
+    activeClient = this;
   }
 
+  /**
+   * Bumped on every setOptions call. `options` is mutated in place (its
+   * identity never changes), so reactive consumers (the UpdateProvider)
+   * subscribe via onOptionsChange and re-read using this version as the
+   * change signal.
+   */
+  optionsVersion = 0;
+  private optionsListeners = new Set<() => void>();
+  /**
+   * Subscribe to option changes (any setOptions call). Returns an
+   * unsubscribe function.
+   */
+  onOptionsChange = (listener: () => void) => {
+    this.optionsListeners.add(listener);
+    return () => {
+      this.optionsListeners.delete(listener);
+    };
+  };
+
   setOptions = (options: Partial<ClientOptions>) => {
     for (const [key, value] of Object.entries(options)) {
       if (value !== undefined) {
@@ -207,6 +251,34 @@ export class Pushy {
         }
       }
     }
+    this.optionsVersion++;
+    for (const listener of this.optionsListeners) {
+      try {
+        listener();
+      } catch (e: any) {
+        log('onOptionsChange listener error:', e?.message || e);
+      }
+    }
+  };
+
+  private providerMounted = false;
+  /**
+   * Called by UpdateProvider on mount. A second concurrently mounted
+   * provider is the same integration error as a second client — fail hard
+   * instead of double-subscribing app-state listeners and update checks.
+   * Returns the release function used on unmount.
+   */
+  claimProviderMount = () => {
+    if (this.providerMounted) {
+      throw new UpdateError(
+        this.t('error_provider_singleton'),
+        'SINGLETON_VIOLATION'
+      );
+    }
+    this.providerMounted = true;
+    return () => {
+      this.providerMounted = false;
+    };
   };
 
   /**
@@ -452,11 +524,12 @@ export class Pushy {
   };
   requestCheckResult = async (
     endpoint: string,
-    fetchPayload: Parameters<typeof fetch>[1]
+    fetchPayload: Parameters<typeof fetch>[1],
+    signal?: AbortSignal
   ) => {
     const resp = await fetchWithTimeout(
       this.getCheckUrl(endpoint),
-      fetchPayload,
+      signal ? { ...fetchPayload, signal } : fetchPayload,
       DEFAULT_FETCH_TIMEOUT_MS
     );
 
@@ -478,9 +551,13 @@ export class Pushy {
     const { endpoint, value } = await executeEndpointFallback<CheckResult>({
       configuredEndpoints: this.getConfiguredCheckEndpoints(),
       getRemoteEndpoints: this.getRemoteEndpoints,
-      tryEndpoint: async (currentEndpoint) => {
+      tryEndpoint: async (currentEndpoint, signal) => {
         try {
-          return await this.requestCheckResult(currentEndpoint, fetchPayload);
+          return await this.requestCheckResult(
+            currentEndpoint,
+            fetchPayload,
+            signal
+          );
         } catch (e) {
           log('check endpoint failed', currentEndpoint, e);
           throw e;
@@ -904,6 +981,23 @@ export class Pushy {
       delete sharedState.progressHandlers[hash];
     }
     delete sharedState.progressCallbacks[hash];
+    if (succeeded && errorMessages.length > 0) {
+      // An earlier strategy failed and a later one rescued the download
+      // (e.g. pdiff copiesCrc mismatch on a rebuilt binary → full). Surface
+      // the degradation: it is invisible to the end user but tells the
+      // platform that incremental delivery is failing for this binary.
+      this.report({
+        type: 'downloadFallback',
+        // UpdateError.code already carries the classified native rejection
+        // code (PATCH_FAILED vs DOWNLOAD_FAILED).
+        code: lastError?.code,
+        data: {
+          newVersion: hash,
+          succeeded,
+        },
+        message: errorMessages.join(';'),
+      });
+    }
     if (!succeeded) {
       const message = errorMessages.join(';');
       if (lastError) {