react-native-update 10.49.0 → 10.51.0

package/cpp/update_flow_core/update_flow_jni.cpp

@@ -0,0 +1,121 @@
+// JNI surface of the update-flow decision layer for the Android orchestrator
+// (NativeCheckOrchestrator.java). Pure string-in/string-out: every payload is
+// JSON, matching the decision layer's own boundary. A null return means
+// "input did not parse" and the caller skips the check round.
+#include <jni.h>
+
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <vector>
+
+#include "../patch_core/jni_util.h"
+#include "flow_json.h"
+#include "update_flow_core.h"
+
+namespace {
+
+jstring ToJString(JNIEnv* env, const std::string& value) {
+  // flow_json emits standard UTF-8, while NewStringUTF expects JNI's modified
+  // UTF-8 and corrupts supplementary code points. Decode explicitly and pass
+  // UTF-16 code units to NewString. Accept encoded surrogate code points too:
+  // strings originating in Java may have entered through modified UTF-8.
+  std::vector<jchar> utf16;
+  utf16.reserve(value.size());
+  size_t i = 0;
+  while (i < value.size()) {
+    const unsigned char first = static_cast<unsigned char>(value[i]);
+    uint32_t codePoint = 0xfffd;
+    size_t width = 1;
+    if (first < 0x80) {
+      codePoint = first;
+    } else if (first >= 0xc2 && first <= 0xdf && i + 1 < value.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(value[i + 1]);
+      if ((b1 & 0xc0) == 0x80) {
+        codePoint = ((first & 0x1f) << 6) | (b1 & 0x3f);
+        width = 2;
+      }
+    } else if (first == 0xc0 && i + 1 < value.size() &&
+               static_cast<unsigned char>(value[i + 1]) == 0x80) {
+      codePoint = 0;  // modified UTF-8 encoding of U+0000
+      width = 2;
+    } else if (first >= 0xe0 && first <= 0xef && i + 2 < value.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(value[i + 1]);
+      const unsigned char b2 = static_cast<unsigned char>(value[i + 2]);
+      if ((b1 & 0xc0) == 0x80 && (b2 & 0xc0) == 0x80 &&
+          !(first == 0xe0 && b1 < 0xa0)) {
+        codePoint = ((first & 0x0f) << 12) | ((b1 & 0x3f) << 6) |
+                    (b2 & 0x3f);
+        width = 3;
+      }
+    } else if (first >= 0xf0 && first <= 0xf4 && i + 3 < value.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(value[i + 1]);
+      const unsigned char b2 = static_cast<unsigned char>(value[i + 2]);
+      const unsigned char b3 = static_cast<unsigned char>(value[i + 3]);
+      if ((b1 & 0xc0) == 0x80 && (b2 & 0xc0) == 0x80 &&
+          (b3 & 0xc0) == 0x80 && !(first == 0xf0 && b1 < 0x90) &&
+          !(first == 0xf4 && b1 > 0x8f)) {
+        codePoint = ((first & 0x07) << 18) | ((b1 & 0x3f) << 12) |
+                    ((b2 & 0x3f) << 6) | (b3 & 0x3f);
+        width = 4;
+      }
+    }
+    i += width;
+    if (codePoint <= 0xffff) {
+      utf16.push_back(static_cast<jchar>(codePoint));
+    } else {
+      codePoint -= 0x10000;
+      utf16.push_back(static_cast<jchar>(0xd800 + (codePoint >> 10)));
+      utf16.push_back(static_cast<jchar>(0xdc00 + (codePoint & 0x3ff)));
+    }
+  }
+  if (utf16.size() > static_cast<size_t>(std::numeric_limits<jsize>::max())) {
+    return nullptr;
+  }
+  return env->NewString(utf16.empty() ? nullptr : utf16.data(),
+                        static_cast<jsize>(utf16.size()));
+}
+
+}  // namespace
+
+extern "C" JNIEXPORT jstring JNICALL
+Java_cn_reactnative_modules_update_NativeUpdateFlow_buildCheckRequestBody(
+    JNIEnv* env, jclass, jstring inputJson) {
+  bool ok = false;
+  flowjson::Value input = flowjson::Parse(
+      pushy::jni_util::JStringToString(env, inputJson), &ok);
+  if (!ok || !input.IsObject()) {
+    return nullptr;
+  }
+  return ToJString(
+      env, flowjson::Stringify(updateflow::BuildCheckRequestBody(input)));
+}
+
+extern "C" JNIEXPORT jstring JNICALL
+Java_cn_reactnative_modules_update_NativeUpdateFlow_orderEndpointCandidates(
+    JNIEnv* env, jclass, jstring endpointsJson, jdouble randomSample) {
+  bool ok = false;
+  flowjson::Value endpoints = flowjson::Parse(
+      pushy::jni_util::JStringToString(env, endpointsJson), &ok);
+  if (!ok || !endpoints.IsArray()) {
+    return nullptr;
+  }
+  return ToJString(env, flowjson::Stringify(updateflow::OrderEndpointCandidates(
+                            endpoints, randomSample)));
+}
+
+extern "C" JNIEXPORT jstring JNICALL
+Java_cn_reactnative_modules_update_NativeUpdateFlow_handleCheckResponse(
+    JNIEnv* env, jclass, jstring responseText, jstring identityJson,
+    jstring afterDownload) {
+  bool ok = false;
+  flowjson::Value identity = flowjson::Parse(
+      pushy::jni_util::JStringToString(env, identityJson), &ok);
+  if (!ok || !identity.IsObject()) {
+    return nullptr;
+  }
+  return ToJString(env, flowjson::Stringify(updateflow::HandleCheckResponse(
+                            pushy::jni_util::JStringToString(env, responseText),
+                            identity, false,
+                            pushy::jni_util::JStringToString(env, afterDownload))));
+}

package/harmony/pushy/src/main/cpp/CMakeLists.txt

@@ -17,6 +17,10 @@ set(PATCH_CORE_DIR ${REPO_ROOT}/cpp/patch_core)
 if(NOT EXISTS ${PATCH_CORE_DIR}/patch_core.cpp)
     set(PATCH_CORE_DIR ${STAGED_NATIVE_DIR}/patch_core)
 endif()
+set(UPDATE_FLOW_CORE_DIR ${REPO_ROOT}/cpp/update_flow_core)
+if(NOT EXISTS ${UPDATE_FLOW_CORE_DIR}/update_flow_core.cpp)
+    set(UPDATE_FLOW_CORE_DIR ${STAGED_NATIVE_DIR}/update_flow_core)
+endif()
 
 # Always compile from source. A prebuilt-import branch used to live here, but
 # it had no symbol verification: a stale libs/<abi>/librnupdate.so missing a
@@ -32,6 +36,8 @@ set(HDP_SOURCES
      ${PATCH_CORE_DIR}/hbc_transform_wire.cpp
      ${PATCH_CORE_DIR}/patch_core.cpp
      ${PATCH_CORE_DIR}/state_core.cpp
+     ${UPDATE_FLOW_CORE_DIR}/flow_json.cpp
+     ${UPDATE_FLOW_CORE_DIR}/update_flow_core.cpp
      ${ANDROID_JNI_DIR}/hpatch.c
      ${HDIFFPATCH_DIR}/libHDiffPatch/HPatch/patch.c
      ${HDIFFPATCH_DIR}/file_for_patch.c
@@ -46,6 +52,7 @@ add_library(rnupdate SHARED
 target_include_directories(rnupdate PRIVATE
      ${CMAKE_CURRENT_SOURCE_DIR}
      ${PATCH_CORE_DIR}
+     ${UPDATE_FLOW_CORE_DIR}
      ${ANDROID_JNI_DIR}
      ${HDIFFPATCH_DIR}
      ${HDIFFPATCH_DIR}/libHDiffPatch/HPatch

package/harmony/pushy/src/main/cpp/pushy.cpp

@@ -1,4 +1,7 @@
 #include <napi/native_api.h>
+
+#include "flow_json.h"
+#include "update_flow_core.h"
 #include <js_native_api.h>
 #include <js_native_api_types.h>
 
@@ -936,6 +939,52 @@ static napi_value Sha256Hex(napi_env env, napi_callback_info info) {
   return result;
 }
 
+// CRC32(zip/zlib 多项式)。同步:输入是已在内存的 rawfile 资源字节,用于
+// pdiff 拷贝前与 __diff.json copiesCrc 比对(不符则整次 patch 失败落 full)。
+static napi_value Crc32(napi_env env, napi_callback_info info) {
+  size_t argc = 1;
+  napi_value args[1] = {nullptr};
+  if (!GetArgCount(env, info, &argc, args) || argc < 1) {
+    ThrowError(env, "crc32: missing data argument");
+    return nullptr;
+  }
+
+  void* data = nullptr;
+  size_t length = 0;
+  bool is_typedarray = false;
+  napi_is_typedarray(env, args[0], &is_typedarray);
+  if (is_typedarray) {
+    napi_typedarray_type type;
+    napi_value arraybuffer = nullptr;
+    size_t offset = 0;
+    if (napi_get_typedarray_info(
+            env, args[0], &type, &length, &data, &arraybuffer, &offset) !=
+        napi_ok) {
+      ThrowError(env, "crc32: cannot read typed array");
+      return nullptr;
+    }
+  } else {
+    bool is_arraybuffer = false;
+    napi_is_arraybuffer(env, args[0], &is_arraybuffer);
+    if (!is_arraybuffer ||
+        napi_get_arraybuffer_info(env, args[0], &data, &length) != napi_ok) {
+      ThrowError(env, "crc32: expected Uint8Array or ArrayBuffer");
+      return nullptr;
+    }
+  }
+
+  pushy::digest::Crc32 crc;
+  if (length > 0) {
+    crc.Update(static_cast<const uint8_t*>(data), length);
+  }
+
+  napi_value result = nullptr;
+  // CRC32 fits a double exactly (32-bit unsigned), matching the JSON number
+  // representation in the manifest.
+  napi_create_double(env, static_cast<double>(crc.Value()), &result);
+  return result;
+}
+
 // 原生 patch 内核可消费的 diff 轨道版本(2 = hdiffv2 轨道)
 static napi_value GetSupportedDiffVersion(napi_env env, napi_callback_info) {
   napi_value result = nullptr;
@@ -946,6 +995,102 @@ static napi_value GetSupportedDiffVersion(napi_env env, napi_callback_info) {
   return result;
 }
 
+// ---- update-flow decision layer (NATIVE_CHECKUPDATE_DESIGN §10) ----
+// String-in/string-out JSON, matching the decision layer's own boundary.
+// Returning undefined (nullptr without a pending exception) means "input did
+// not parse"; the ArkTS orchestrator skips the check round.
+
+static napi_value MakeUtf8String(napi_env env, const std::string& value) {
+  napi_value result = nullptr;
+  if (napi_create_string_utf8(env, value.c_str(), value.size(), &result) !=
+      napi_ok) {
+    ThrowError(env, "Failed to create string");
+    return nullptr;
+  }
+  return result;
+}
+
+static napi_value FlowBuildCheckRequestBody(napi_env env,
+                                            napi_callback_info info) {
+  size_t argc = 1;
+  napi_value args[1] = {nullptr};
+  if (!GetArgCount(env, info, &argc, args) || argc < 1) {
+    ThrowError(env, "buildCheckRequestBody: missing input argument");
+    return nullptr;
+  }
+  bool ok = false;
+  std::string input_json = GetString(env, args[0], &ok);
+  if (!ok) {
+    return nullptr;
+  }
+  bool parsed = false;
+  flowjson::Value input = flowjson::Parse(input_json, &parsed);
+  if (!parsed || !input.IsObject()) {
+    return nullptr;
+  }
+  return MakeUtf8String(
+      env, flowjson::Stringify(updateflow::BuildCheckRequestBody(input)));
+}
+
+static napi_value FlowOrderEndpointCandidates(napi_env env,
+                                              napi_callback_info info) {
+  size_t argc = 2;
+  napi_value args[2] = {nullptr, nullptr};
+  if (!GetArgCount(env, info, &argc, args) || argc < 2) {
+    ThrowError(env, "orderEndpointCandidates: missing arguments");
+    return nullptr;
+  }
+  bool ok = false;
+  std::string endpoints_json = GetString(env, args[0], &ok);
+  if (!ok) {
+    return nullptr;
+  }
+  double sample = 0;
+  if (napi_get_value_double(env, args[1], &sample) != napi_ok) {
+    ThrowError(env, "orderEndpointCandidates: expected number sample");
+    return nullptr;
+  }
+  bool parsed = false;
+  flowjson::Value endpoints = flowjson::Parse(endpoints_json, &parsed);
+  if (!parsed || !endpoints.IsArray()) {
+    return nullptr;
+  }
+  return MakeUtf8String(env,
+                        flowjson::Stringify(updateflow::OrderEndpointCandidates(
+                            endpoints, sample)));
+}
+
+static napi_value FlowHandleCheckResponse(napi_env env,
+                                          napi_callback_info info) {
+  size_t argc = 3;
+  napi_value args[3] = {nullptr, nullptr, nullptr};
+  if (!GetArgCount(env, info, &argc, args) || argc < 3) {
+    ThrowError(env, "handleCheckResponse: missing arguments");
+    return nullptr;
+  }
+  bool ok = false;
+  std::string response_text = GetString(env, args[0], &ok);
+  if (!ok) {
+    return nullptr;
+  }
+  std::string identity_json = GetString(env, args[1], &ok);
+  if (!ok) {
+    return nullptr;
+  }
+  std::string after_download = GetString(env, args[2], &ok);
+  if (!ok) {
+    return nullptr;
+  }
+  bool parsed = false;
+  flowjson::Value identity = flowjson::Parse(identity_json, &parsed);
+  if (!parsed || !identity.IsObject()) {
+    return nullptr;
+  }
+  return MakeUtf8String(env,
+                        flowjson::Stringify(updateflow::HandleCheckResponse(
+                            response_text, identity, false, after_download)));
+}
+
 napi_value Init(napi_env env, napi_value exports) {
   if (!ExportFunction(env, exports, "syncStateWithBinaryVersion", SyncStateWithBinaryVersion) ||
       !ExportFunction(env, exports, "runStateCore", RunStateCore) ||
@@ -954,7 +1099,11 @@ napi_value Init(napi_env env, napi_value exports) {
       !ExportFunction(env, exports, "applyPatchFromFileSource", ApplyPatchFromFileSource) ||
       !ExportFunction(env, exports, "cleanupOldEntries", CleanupOldEntries) ||
       !ExportFunction(env, exports, "sha256Hex", Sha256Hex) ||
-      !ExportFunction(env, exports, "getSupportedDiffVersion", GetSupportedDiffVersion)) {
+      !ExportFunction(env, exports, "crc32", Crc32) ||
+      !ExportFunction(env, exports, "getSupportedDiffVersion", GetSupportedDiffVersion) ||
+      !ExportFunction(env, exports, "buildCheckRequestBody", FlowBuildCheckRequestBody) ||
+      !ExportFunction(env, exports, "orderEndpointCandidates", FlowOrderEndpointCandidates) ||
+      !ExportFunction(env, exports, "handleCheckResponse", FlowHandleCheckResponse)) {
     return nullptr;
   }
   return exports;

package/harmony/pushy/src/main/ets/DownloadTask.ts

@@ -11,10 +11,17 @@ import NativePatchCore, {
   ARCHIVE_PATCH_TYPE_FROM_PPK,
   CopyGroupResult,
 } from './NativePatchCore';
+import { monotonicNowMs } from './MonotonicClock';
+
+export const VERSION_COMPLETE_FILE_NAME = '.pushy-complete';
 
 export interface PatchManifestArrays {
   copyFroms: string[];
   copyTos: string[];
+  // 与 copyFroms/copyTos 逐位对齐的 copiesCrc(CLI >= 2.21.2 的 pdiff
+  // manifest 携带,键是 to);无声明时为 null。拷贝前用它校验包内资源内容,
+  // 不符则整次 patch 失败落 full——重打包二进制不能静默拷出漂移的资源。
+  copyCrcs: (number | null)[];
   deletes: string[];
   // __diff.json 中对应 bundle patch 条目的 hbcTransform 元数据(原始 JSON
   // 字符串);为空时 native 走现状路径
@@ -27,6 +34,7 @@ export function parseManifestToArrays(
 ): PatchManifestArrays {
   const copyFroms: string[] = [];
   const copyTos: string[] = [];
+  const copyCrcs: (number | null)[] = [];
   const deletesValue = manifest.deletes;
   const deletes = Array.isArray(deletesValue)
     ? deletesValue.map(item => String(item))
@@ -35,6 +43,11 @@ export function parseManifestToArrays(
       : [];
 
   const copies = (manifest.copies || {}) as Record<string, string>;
+  const copiesCrcValue = manifest.copiesCrc;
+  const copiesCrc =
+    copiesCrcValue && typeof copiesCrcValue === 'object'
+      ? (copiesCrcValue as Record<string, number>)
+      : ({} as Record<string, number>);
   for (const [to, rawFrom] of Object.entries(copies)) {
     let from = String(rawFrom || '');
     if (normalizeResourceCopies) {
@@ -45,6 +58,8 @@ export function parseManifestToArrays(
     }
     copyFroms.push(from);
     copyTos.push(to);
+    const crc = copiesCrc[to];
+    copyCrcs.push(typeof crc === 'number' && Number.isFinite(crc) ? crc : null);
   }
 
   const hbcTransform = manifest.hbcTransform as
@@ -62,6 +77,7 @@ export function parseManifestToArrays(
   return {
     copyFroms,
     copyTos,
+    copyCrcs,
     deletes,
     hbcTransformMeta,
   };
@@ -82,6 +98,7 @@ const DIFF_MANIFEST_ENTRY = '__diff.json';
 const HARMONY_BUNDLE_PATCH_ENTRY = 'bundle.harmony.js.patch';
 const TEMP_ORIGIN_BUNDLE_ENTRY = '.origin.bundle.harmony.js';
 const FILE_COPY_BUFFER_SIZE = 64 * 1024;
+const DOWNLOAD_CALL_TIMEOUT_MS = 10 * 60 * 1000;
 
 export class DownloadTask {
   private context: common.Context;
@@ -229,6 +246,7 @@ export class DownloadTask {
       return {
         copyFroms: [],
         copyTos: [],
+        copyCrcs: [],
         deletes: [],
         hbcTransformMeta: '',
       };
@@ -329,6 +347,12 @@ export class DownloadTask {
     let writeQueue = Promise.resolve();
     let lastReportedPercentage = -1;
     let lastReportedBytes = 0;
+    const deadlineUptimeMs = params.deadlineUptimeMs > 0
+      ? params.deadlineUptimeMs
+      : monotonicNowMs() + DOWNLOAD_CALL_TIMEOUT_MS;
+    if (deadlineUptimeMs <= monotonicNowMs()) {
+      throw Error('Download deadline expired before start');
+    }
 
     // Emit at most one progress event per whole-percent change (or per 256KB
     // when the total is unknown), and only from the dataReceive handler, so the
@@ -360,6 +384,7 @@ export class DownloadTask {
     // Promise (and the JS caller) forever.
     const INACTIVITY_TIMEOUT_MS = 60000;
     let watchdogTimer: number | null = null;
+    let deadlineTimer: number | null = null;
     let inactivityReject: ((error: Error) => void) | null = null;
     const clearWatchdog = () => {
       if (watchdogTimer !== null) {
@@ -468,14 +493,22 @@ export class DownloadTask {
         },
       );
 
-      const responseCode = await httpRequest.requestInStream(params.url, {
-        method: http.RequestMethod.GET,
-        readTimeout: 60000,
-        connectTimeout: 60000,
-        header: {
-          'Content-Type': 'application/octet-stream',
-        },
+      const deadlinePromise = new Promise<never>((_, reject) => {
+        deadlineTimer = setTimeout(() => {
+          reject(Error('Download exceeded its whole-call deadline'));
+        }, Math.max(1, deadlineUptimeMs - monotonicNowMs()));
       });
+      const responseCode = await Promise.race([
+        httpRequest.requestInStream(params.url, {
+          method: http.RequestMethod.GET,
+          readTimeout: 60000,
+          connectTimeout: 60000,
+          header: {
+            'Content-Type': 'application/octet-stream',
+          },
+        }),
+        deadlinePromise,
+      ]);
       if (responseCode > 299) {
         throw Error(`Server error: ${responseCode}`);
       }
@@ -485,7 +518,7 @@ export class DownloadTask {
       // 时 reject（unhandled rejection），且 promise 一经 reject 无法复活——
       // 即使随后数据正常流入，race 也必然以 "Download stalled" 失败。
       refreshWatchdog();
-      await Promise.race([dataEndPromise, inactivityPromise]);
+      await Promise.race([dataEndPromise, inactivityPromise, deadlinePromise]);
       const stats = await fileIo.stat(params.targetFile);
       const fileSize = stats.size;
       if (contentLength > 0 && fileSize !== contentLength) {
@@ -498,6 +531,9 @@ export class DownloadTask {
       throw error;
     } finally {
       clearWatchdog();
+      if (deadlineTimer !== null) {
+        clearTimeout(deadlineTimer);
+      }
       try {
         await closeWriter();
       } catch (closeError) {
@@ -534,6 +570,20 @@ export class DownloadTask {
 
   private async doPatchFromApp(params: DownloadTaskParams): Promise<void> {
     await this.downloadFile(params);
+    try {
+      await this.doPatchFromAppAfterDownload(params);
+    } catch (error: any) {
+      // 下载已完成,之后的失败都是 patch 应用失败(解压/hpatch/资源拷贝,
+      // 含 copiesCrc 校验)。打上稳定码,JS 层遥测按 patch_fail 归类,
+      // 而不是混进网络失败。
+      error.code = 'PATCH_FAILED';
+      throw error;
+    }
+  }
+
+  private async doPatchFromAppAfterDownload(
+    params: DownloadTaskParams,
+  ): Promise<void> {
     await this.recreateDirectory(params.unzipDirectory);
 
     await zlib.decompressFile(params.targetFile, params.unzipDirectory);
@@ -566,12 +616,22 @@ export class DownloadTask {
       `${params.unzipDirectory}/bundle.harmony.js`,
       manifestArrays.hbcTransformMeta,
     );
+    // 组按 from 聚合;同一 from 的内容必然一致,所以每组一个 CRC 即可
+    // (与 manifest 逐位对齐的 copyCrcs 里取第一个非空值)。
+    const crcByFrom = new Map<string, number>();
+    manifestArrays.copyFroms.forEach((from, index) => {
+      const crc = manifestArrays.copyCrcs[index];
+      if (crc !== null && !crcByFrom.has(from)) {
+        crcByFrom.set(from, crc);
+      }
+    });
     await this.copyFromResource(
       NativePatchCore.buildCopyGroups(
         manifestArrays.copyFroms,
         manifestArrays.copyTos,
       ),
       params.unzipDirectory,
+      crcByFrom,
     );
     try {
       if (fileIo.accessSync(params.targetFile)) {
@@ -584,6 +644,18 @@ export class DownloadTask {
 
   private async doPatchFromPpk(params: DownloadTaskParams): Promise<void> {
     await this.downloadFile(params);
+    try {
+      await this.doPatchFromPpkAfterDownload(params);
+    } catch (error: any) {
+      // 同 doPatchFromApp:下载完成后的失败按 patch 失败归类。
+      error.code = 'PATCH_FAILED';
+      throw error;
+    }
+  }
+
+  private async doPatchFromPpkAfterDownload(
+    params: DownloadTaskParams,
+  ): Promise<void> {
     await this.recreateDirectory(params.unzipDirectory);
 
     await zlib.decompressFile(params.targetFile, params.unzipDirectory);
@@ -626,6 +698,7 @@ export class DownloadTask {
   private async copyFromResource(
     copyGroups: CopyGroupResult[],
     targetRoot: string,
+    crcByFrom?: Map<string, number>,
   ): Promise<void> {
     let currentFrom = '';
     try {
@@ -637,6 +710,7 @@ export class DownloadTask {
         if (targets.length === 0) {
           continue;
         }
+        const expectedCrc = crcByFrom?.get(currentFrom);
 
         if (currentFrom.startsWith('resources/base/media/')) {
           // Strip only the final extension: 'icon.round.png' -> 'icon.round',
@@ -645,6 +719,7 @@ export class DownloadTask {
             .replace('resources/base/media/', '')
             .replace(/\.[^.]+$/, '');
           const mediaBuffer = await resourceManager.getMediaByName(mediaName);
+          this.verifyCopySourceCrc(mediaBuffer, expectedCrc, currentFrom);
           const parentDirs = [
             ...new Set(
               targets.map(t => t.substring(0, t.lastIndexOf('/'))).filter(Boolean),
@@ -658,6 +733,22 @@ export class DownloadTask {
           );
           continue;
         }
+
+        if (expectedCrc !== undefined) {
+          // 声明了 CRC 的条目改走字节路径:读出内容先校验再落盘。
+          // 重打包的二进制里同名 rawfile 内容可能已漂移,fd 直拷会把
+          // 错误字节静默装进版本目录。
+          const rawContent =
+            await resourceManager.getRawFileContent(currentFrom);
+          this.verifyCopySourceCrc(rawContent, expectedCrc, currentFrom);
+          const [firstTarget, ...restTargets] = targets;
+          await this.writeFileContent(firstTarget, rawContent);
+          await Promise.all(
+            restTargets.map(target => this.copySandboxFile(firstTarget, target)),
+          );
+          continue;
+        }
+
         const fromContent = await resourceManager.getRawFd(currentFrom);
         try {
           const [firstTarget, ...restTargets] = targets;
@@ -697,6 +788,22 @@ export class DownloadTask {
     }
   }
 
+  // pdiff 拷贝源内容校验(__diff.json copiesCrc):不符即抛错,整次 patch
+  // 失败后 JS 策略链自动回退 full,绝不把漂移的资源装进版本目录。
+  private verifyCopySourceCrc(
+    content: Uint8Array,
+    expectedCrc: number | undefined,
+    from: string,
+  ): void {
+    if (expectedCrc === undefined) {
+      return;
+    }
+    const actualCrc = NativePatchCore.crc32(content);
+    if (actualCrc !== expectedCrc) {
+      throw new Error(`resource content mismatch (crc32): ${from}`);
+    }
+  }
+
   private async doCleanUp(params: DownloadTaskParams): Promise<void> {
     try {
       await NativePatchCore.cleanupOldEntries(
@@ -713,6 +820,10 @@ export class DownloadTask {
   }
 
   public async execute(params: DownloadTaskParams): Promise<void> {
+    const isPatchTask =
+      params.type === DownloadTaskParams.TASK_TYPE_PATCH_FULL ||
+      params.type === DownloadTaskParams.TASK_TYPE_PATCH_FROM_APP ||
+      params.type === DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK;
     try {
       switch (params.type) {
         case DownloadTaskParams.TASK_TYPE_PATCH_FULL:
@@ -733,13 +844,26 @@ export class DownloadTask {
         default:
           throw Error(`Unknown task type: ${params.type}`);
       }
+      if (isPatchTask) {
+        await this.writeFileContent(
+          `${params.unzipDirectory}/${VERSION_COMPLETE_FILE_NAME}`,
+          new Uint8Array(0),
+        );
+      }
     } catch (error: any) {
       console.error('Task execution failed:', error.message);
       if (params.type !== DownloadTaskParams.TASK_TYPE_CLEANUP) {
         try {
           if (params.type === DownloadTaskParams.TASK_TYPE_PLAIN_DOWNLOAD) {
             await fileIo.unlink(params.targetFile);
-          } else {
+          } else if (
+            !fileIo.accessSync(
+              `${params.unzipDirectory}/${VERSION_COMPLETE_FILE_NAME}`,
+            ) ||
+            !fileIo.accessSync(`${params.unzipDirectory}/bundle.harmony.js`)
+          ) {
+            // Never let a failed duplicate task remove an install already
+            // handed off by an earlier task via marker + bundle.
             await this.removeDirectory(params.unzipDirectory);
           }
         } catch (cleanupError: any) {

package/harmony/pushy/src/main/ets/DownloadTaskParams.ts

@@ -16,4 +16,7 @@ export class DownloadTaskParams {
   targetFile: string = ''; // 目标文件路径
   unzipDirectory: string = ''; // 解压目录路径
   originDirectory: string = ''; // 原始文件目录路径
+  // Native cold-start orchestrator's absolute monotonic-uptime deadline. Zero
+  // uses the normal public download API's 10-minute whole-call cap.
+  deadlineUptimeMs: number = 0;
 }

package/harmony/pushy/src/main/ets/MonotonicClock.ts

@@ -0,0 +1,13 @@
+import { systemDateTime } from '@kit.BasicServicesKit';
+
+// Absolute deadlines must not use Date.now(): automatic time synchronization
+// can move the wall clock while the cold-start rescue round is running.
+//
+// TimeType.ACTIVE (not STARTUP) is the semantic match for the other two
+// platforms: iOS NSProcessInfo.systemUptime and Android System.nanoTime both
+// stop during deep sleep, so a device that sleeps mid-download resumes with
+// its budget intact. STARTUP keeps counting through sleep and would abort a
+// rescue that the same network completes on iOS/Android.
+export function monotonicNowMs(): number {
+  return systemDateTime.getUptime(systemDateTime.TimeType.ACTIVE);
+}