react-native-update 10.53.1 → 10.54.0

package/src/NativePushy.ts

@@ -12,6 +12,12 @@ export interface Spec extends TurboModule {
     isUsingBundleUrl: boolean;
     currentVersionInfo: string;
     supportedDiffVersion: number;
+    /**
+     * SHA-256 of the running hot-update bundle as recorded by the install
+     * (cpp/patch_core/install_record.h); '' for the embedded bundle, legacy
+     * installs, or older native modules.
+     */
+    currentBundleSha256?: string;
   };
   setLocalHashInfo(hash: string, info: string): Promise<void>;
   getLocalHashInfo(hash: string): Promise<string>;
@@ -30,6 +36,13 @@ export interface Spec extends TurboModule {
    * an empty string when absent; never rejects.
    */
   getNativeCheckCache(): Promise<string>;
+  /**
+   * JS obtained a valid check response in this process for `config` (the
+   * same JSON syncNativeConfig persists). The delayed cold-start round skips
+   * its own request when its persisted config matches; a crash-rescue round
+   * is unaffected (§10.3). Older native modules lack this method.
+   */
+  markJsCheckCompleted(config: string): Promise<void>;
   reloadUpdate(options: { hash: string }): Promise<void>;
   restartApp(): Promise<void>;
   setNeedUpdate(options: { hash: string }): Promise<void>;

package/src/client.ts

@@ -41,10 +41,13 @@ import type {
   UpdateServerConfig,
 } from './type';
 import {
+  buildCheckFingerprint,
   buildCheckRequestBody,
   type DownloadPlan,
   type DownloadStrategyType,
   decideDownload,
+  isMirrorRetryableCode,
+  isValidCheckResult,
 } from './updateFlowCore';
 import {
   assertWeb,
@@ -171,6 +174,7 @@ export class Pushy {
   clientType: 'Pushy' | 'Cresc' = 'Pushy';
   lastChecking?: number;
   lastRespJson?: Promise<CheckResult>;
+  lastCheckFingerprint?: string;
   // Endpoint that most recently served a successful checkUpdate; telemetry
   // reuses it instead of re-running the fallback race.
   private lastWorkingEndpoint?: string;
@@ -369,6 +373,35 @@ export class Pushy {
       });
   };
 
+  /**
+   * Tell the native cold-start orchestrator that this process already holds a
+   * valid check response for the current config, so its delayed round (5s
+   * after launch) does not repeat the request. Fire-and-forget: a failure
+   * costs one duplicate check. Never called on a failed check — the native
+   * rescue must keep running when JS could not reach the server.
+   */
+  private markJsCheckCompleted = () => {
+    if (
+      Platform.OS === 'web' ||
+      typeof PushyModule.markJsCheckCompleted !== 'function'
+    ) {
+      return;
+    }
+    const configJson = this.getNativeConfigJson();
+    if (!configJson) {
+      return;
+    }
+    try {
+      Promise.resolve(PushyModule.markJsCheckCompleted(configJson)).catch(
+        (e: any) => {
+          log('markJsCheckCompleted failed:', e?.message || e);
+        }
+      );
+    } catch (e: any) {
+      log('markJsCheckCompleted failed:', e?.message || e);
+    }
+  };
+
   private syncNativeConfig = () => {
     if (
       Platform.OS === 'web' ||
@@ -738,7 +771,17 @@ export class Pushy {
       );
     }
 
-    return (await resp.json()) as CheckResult;
+    const result: unknown = await resp.json();
+    if (!isValidCheckResult(result)) {
+      // A 2xx that is not a verdict (`{"error": ...}`, a captive-portal page
+      // that parsed, ...) is a failed endpoint: throwing keeps the fallback
+      // moving to the next one instead of treating it as "no update".
+      throw new UpdateError(
+        this.t('error_invalid_check_response'),
+        'INVALID_RESPONSE'
+      );
+    }
+    return result;
   };
   fetchCheckResult = async (fetchPayload: Parameters<typeof fetch>[1]) => {
     const { endpoint, value } = await executeEndpointFallback<CheckResult>({
@@ -927,10 +970,33 @@ export class Pushy {
     // buildTime 启发式),下一次检查自然带上——绝不为它 await、拖慢或复杂化
     // 检查流程。
     const bundleHash = __DEV__ ? '' : getBundleHash();
+    const fetchBody = buildCheckRequestBody({
+      packageVersion: this.getEffectivePackageVersion(),
+      currentVersion,
+      buildTime,
+      cInfo,
+      supportedDiffVersion,
+      bundleHash,
+      isDev: __DEV__,
+      extra,
+    });
+    const stringifyBody = JSON.stringify(fetchBody);
+    // Identity of this check: only a check with the exact same request (same
+    // extra / test hash / bundleHash / binary identity) against the same
+    // endpoint set may share an in-flight or just-settled response. Two
+    // checks 2s apart with different `extra` are different questions.
+    const fingerprint = buildCheckFingerprint({
+      appKey: this.options.appKey,
+      endpoints: this.options.server?.main,
+      queryUrls: this.options.server?.queryUrls,
+      // The client uuid travels inside cInfo, i.e. inside `body`.
+      body: stringifyBody,
+    });
     const now = Date.now();
     if (
       this.lastRespJson &&
       this.lastChecking &&
+      this.lastCheckFingerprint === fingerprint &&
       now - this.lastChecking < 1000 * 5
     ) {
       try {
@@ -949,17 +1015,7 @@ export class Pushy {
       }
     }
     this.lastChecking = now;
-    const fetchBody = buildCheckRequestBody({
-      packageVersion: this.getEffectivePackageVersion(),
-      currentVersion,
-      buildTime,
-      cInfo,
-      supportedDiffVersion,
-      bundleHash,
-      isDev: __DEV__,
-      extra,
-    });
-    const stringifyBody = JSON.stringify(fetchBody);
+    this.lastCheckFingerprint = fingerprint;
     // harmony fetch body is not string
     let body: any = fetchBody;
     if (Platform.OS === 'ios' || Platform.OS === 'android') {
@@ -973,7 +1029,6 @@ export class Pushy {
       },
       body,
     };
-    const previousRespJson = this.lastRespJson;
     try {
       this.report({
         type: 'checking',
@@ -1007,19 +1062,25 @@ export class Pushy {
       }
 
       this.notifyAfterCheckUpdate({ status: 'completed', result });
+      this.markJsCheckCompleted();
       return result;
     } catch (e: any) {
-      this.lastRespJson = previousRespJson;
+      // A failed check must not keep vouching for an older response: clear
+      // the dedup slot so the next call re-asks the server.
+      this.lastRespJson = undefined;
+      this.lastCheckFingerprint = undefined;
       const err = toUpdateError(e, 'CHECK_FAILED');
       this.emitError(err, 'errorChecking', {
         message: err.message || this.t('error_cannot_connect_server'),
       });
       this.notifyAfterCheckUpdate({ status: 'error', error: err });
       this.throwIfEnabled(err);
-      // Fall back to the previous successful response if we have one; otherwise
-      // return undefined so callers can distinguish "check failed" from a real
-      // empty result and avoid overwriting the last good updateInfo.
-      return previousRespJson ? await previousRespJson : undefined;
+      // No silent fallback to a previous successful response: a stale result
+      // would let a server outage look like "still updatable" and drive the
+      // provider's auto-download off it. Return undefined so callers can
+      // distinguish "check failed" from a real empty result and keep their
+      // last good updateInfo.
+      return undefined;
     }
   };
   downloadUpdate = async (
@@ -1077,6 +1138,28 @@ export class Pushy {
       delete sharedState.downloadingTasks[hash];
     }
   };
+  /**
+   * Orders candidate mirrors for one artifact: the HEAD-race winner first
+   * (its post-redirect URL), then the remaining mirrors in configured order.
+   * Empty when there is nothing to try.
+   */
+  private rankDownloadUrls = async (urls?: string[]): Promise<string[]> => {
+    if (!urls?.length) {
+      return [];
+    }
+    const winner = await testUrls(urls);
+    const ordered: string[] = [];
+    const push = (url?: string | null) => {
+      if (url && !ordered.includes(url)) {
+        ordered.push(url);
+      }
+    };
+    push(winner);
+    for (const url of urls) {
+      push(url);
+    }
+    return ordered;
+  };
   private performDownload = async (
     updateInfo: CheckResult,
     plan: DownloadPlan,
@@ -1103,7 +1186,13 @@ export class Pushy {
         progress: computeProgress(data.received, data.total),
       };
       callbacks.forEach((callback) => {
-        callback(payload);
+        // One subscriber throwing must not starve the others or abort the
+        // download: business callbacks are isolated, the error is logged.
+        try {
+          callback(payload);
+        } catch (e) {
+          warn('onDownloadProgress callback threw', e);
+        }
       });
     };
     // RN >= 0.87 types native event listeners as `(...args: readonly Object[])`,
@@ -1164,7 +1253,12 @@ export class Pushy {
 
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       if (attempt > 0) {
-        const backoffMs = Math.min(1000 * 2 ** (attempt - 1), 10000);
+        // Exponential backoff with jitter: a bad CDN edge otherwise gets
+        // every client back at the same 1/2/4s marks.
+        const backoffMs = Math.round(
+          Math.min(1000 * 2 ** (attempt - 1), 10000) *
+            (0.75 + Math.random() * 0.5)
+        );
         log(`retry attempt ${attempt}/${maxRetries}, waiting ${backoffMs}ms`);
         await new Promise((r) => setTimeout(r, backoffMs));
         errorMessages.length = 0;
@@ -1186,28 +1280,39 @@ export class Pushy {
         if (succeeded) {
           break;
         }
-        const url = await testUrls(urls);
-        if (!url) {
-          continue;
-        }
-        log(`downloading ${type}`);
-        try {
-          await runners[type](url);
-          succeeded = type;
-        } catch (e: any) {
-          const errorMessage = this.t(errorKeys[type], {
-            message: e.message,
-          });
-          errorMessages.push(errorMessage);
-          // Keep the i18n message for display, but preserve the native
-          // rejection's stable code (e.g. PATCH_FAILED vs DOWNLOAD_FAILED —
-          // telemetry classifies on it) and the original error as cause.
-          lastError = new UpdateError(
-            errorMessage,
-            asUpdateErrorCode(e?.code) ?? 'DOWNLOAD_FAILED',
-            { cause: e }
-          );
-          log(errorMessage);
+        // The HEAD race only ranks mirrors; it is not proof that a mirror can
+        // serve the whole artifact (CDNs answer HEAD and GET differently, and
+        // a transfer can die mid-stream). Every mirror of the same artifact
+        // gets a real download attempt before the strategy is abandoned —
+        // the native cold-start path already behaves this way.
+        const orderedUrls = await this.rankDownloadUrls(urls);
+        for (const url of orderedUrls) {
+          log(`downloading ${type} from ${url}`);
+          try {
+            await runners[type](url);
+            succeeded = type;
+            break;
+          } catch (e: any) {
+            const errorMessage = this.t(errorKeys[type], {
+              message: e.message,
+            });
+            errorMessages.push(errorMessage);
+            // Keep the i18n message for display, but preserve the native
+            // rejection's stable code (e.g. PATCH_FAILED vs DOWNLOAD_FAILED —
+            // telemetry classifies on it) and the original error as cause.
+            lastError = new UpdateError(
+              errorMessage,
+              asUpdateErrorCode(e?.code) ?? 'DOWNLOAD_FAILED',
+              { cause: e }
+            );
+            log(errorMessage);
+            if (!isMirrorRetryableCode(lastError.code)) {
+              // The bytes arrived but could not be applied (patch/manifest
+              // mismatch): every mirror serves the same artifact, so move
+              // on to the next strategy instead of re-downloading it.
+              break;
+            }
+          }
         }
       }
       if (succeeded) {
@@ -1278,7 +1383,19 @@ export class Pushy {
     if (sharedState.toHash === hash) {
       hashInfo.debugChannel = true;
     }
-    setLocalHashInfo(hash, hashInfo);
+    // The version is "downloaded" only once its metadata is persisted: a
+    // lost hash-info write would leave the next launch with a nameless
+    // version and a switchVersion that the native side may refuse.
+    try {
+      await setLocalHashInfo(hash, hashInfo);
+    } catch (e: any) {
+      const err = toUpdateError(e, 'FILE_OPERATION_FAILED');
+      this.emitError(err, 'errorUpdate', {
+        message: err.message,
+        data: { newVersion: hash },
+      });
+      throw err;
+    }
     sharedState.downloadedHash = hash;
     return hash;
   };

package/src/core.ts

@@ -36,8 +36,15 @@ export const downloadRootDir: string = PushyConstants.downloadRootDir;
 export const packageVersion: string = PushyConstants.packageVersion;
 export const currentVersion: string = PushyConstants.currentVersion;
 
-export function setLocalHashInfo(hash: string, info: Record<string, any>) {
-  PushyModule.setLocalHashInfo(hash, JSON.stringify(info));
+export function setLocalHashInfo(
+  hash: string,
+  info: Record<string, any>
+): Promise<void> {
+  // Always a promise so callers can await native persistence (the legacy
+  // bridge returns undefined when no promise is exposed).
+  return Promise.resolve(
+    PushyModule.setLocalHashInfo(hash, JSON.stringify(info))
+  );
 }
 
 const currentVersionInfoString: string = PushyConstants.currentVersionInfo;
@@ -49,7 +56,9 @@ if (currentVersionInfoString) {
     if (_currentVersionInfo.debugChannel) {
       isDebugChannel = true;
       delete _currentVersionInfo.debugChannel;
-      setLocalHashInfo(currentVersion, _currentVersionInfo);
+      setLocalHashInfo(currentVersion, _currentVersionInfo).catch((e) => {
+        error('failed to persist version info', e);
+      });
     }
   } catch {
     error(
@@ -58,6 +67,11 @@ if (currentVersionInfoString) {
   }
 }
 export const currentVersionInfo = _currentVersionInfo;
+/** SHA-256 of the running hot-update bundle from its install record; '' when unknown. */
+export const currentBundleSha256: string =
+  typeof PushyConstants.currentBundleSha256 === 'string'
+    ? PushyConstants.currentBundleSha256
+    : '';
 
 export const isFirstTime: boolean = PushyConstants.isFirstTime;
 export const isFirstTimeDebug: boolean = isFirstTime && isDebugChannel;

package/src/error.ts

@@ -13,6 +13,8 @@ export type UpdateErrorCode =
   | 'APPKEY_REQUIRED'
   | 'NO_ENDPOINTS'
   | 'HTTP_STATUS'
+  // A 2xx check response that is not a check verdict (schema gate).
+  | 'INVALID_RESPONSE'
   | 'CHECK_FAILED'
   | 'DOWNLOAD_FAILED'
   | 'SWITCH_VERSION_FAILED'
@@ -43,6 +45,7 @@ const KNOWN_CODES = new Set<string>([
   'APPKEY_REQUIRED',
   'NO_ENDPOINTS',
   'HTTP_STATUS',
+  'INVALID_RESPONSE',
   'CHECK_FAILED',
   'DOWNLOAD_FAILED',
   'SWITCH_VERSION_FAILED',

package/src/index.ts

@@ -10,4 +10,12 @@ export {
 export { PushyModule, UpdateModule } from './core';
 export type { UpdateErrorCode } from './error';
 export { UpdateError } from './error';
+export type { CrashReporterLike, UpdateMetadata } from './metadata';
+export {
+  attachToCrashlytics,
+  attachToSentry,
+  attachUpdateMetadata,
+  getUpdateMetadata,
+  updateMetadataTags,
+} from './metadata';
 export { PushyProvider, UpdateProvider } from './provider';

package/src/locales/en.ts

@@ -61,6 +61,9 @@ export default {
   error_all_promises_rejected: 'All promises were rejected',
   error_ping_failed: 'Ping failed',
   error_ping_timeout: 'Ping timeout',
+  error_insecure_redirect:
+    'Request was redirected from https to plaintext http',
+  error_invalid_check_response: 'Update check response is not a valid verdict',
   error_http_status: '{{status}} {{statusText}}',
   error_apk_pending_install:
     'The APK has been downloaded, please complete the installation in the system installer',

package/src/locales/zh.ts

@@ -58,6 +58,8 @@ export default {
   error_all_promises_rejected: '所有请求都被拒绝',
   error_ping_failed: 'Ping 失败',
   error_ping_timeout: 'Ping 超时',
+  error_insecure_redirect: '请求被从 https 重定向到明文 http',
+  error_invalid_check_response: '更新检查响应不是有效结果',
   error_http_status: '{{status}} {{statusText}}',
   error_apk_pending_install: '安装包已下载完成，请在系统安装界面完成安装',
   error_storage_permission_rejected: '存储权限被拒绝，无法下载安装包',

package/src/metadata.ts

@@ -0,0 +1,166 @@
+import {
+  buildTime,
+  cInfo,
+  currentBundleSha256,
+  currentVersion,
+  currentVersionInfo,
+  getBundleHash,
+  isFirstTime,
+  isRolledBack,
+  packageVersion,
+  rolledBackVersion,
+} from './core';
+
+/**
+ * Everything a crash report needs to be mapped back to the exact JS bundle
+ * that was running: attach it as tags/context in Sentry, Crashlytics, Bugly…
+ * The `currentVersion` hash (empty = the binary's embedded bundle) is the
+ * key that selects the matching source map on the update platform.
+ */
+export interface UpdateMetadata {
+  /** react-native-update SDK version. */
+  sdkVersion: string;
+  /** Native binary version the update decision is keyed on. */
+  packageVersion: string;
+  /** Build time of the native binary (empty in debug). */
+  buildTime: string;
+  /** Hash of the running hot-update version; '' when the embedded bundle runs. */
+  currentVersion: string;
+  /** Publisher-facing name/description/metaInfo of the running version. */
+  versionName: string;
+  versionDescription: string;
+  metaInfo: string;
+  /** SHA-256 of the embedded bundle; '' until computed / unavailable. */
+  bundleHash: string;
+  /**
+   * SHA-256 of the running hot-update bundle from its install record
+   * (matches the `bundleSha256` the CLI archives with the source map); ''
+   * for the embedded bundle or a legacy install.
+   */
+  bundleSha256: string;
+  /** First launch of `currentVersion` (crash protection still armed). */
+  isFirstTime: boolean;
+  /** This launch is the result of a rollback; `rolledBackVersion` names the culprit. */
+  isRolledBack: boolean;
+  rolledBackVersion: string;
+  /**
+   * How the running version got activated when not by the JS flow:
+   * 'forceBoot' — the server's per-version override applied by the native
+   * cold-start check; 'crashRescue' — activated by the crash-time rescue.
+   */
+  rescueSource: 'forceBoot' | 'crashRescue' | null;
+  /** Stable per-install client id (gray-release bucketing key). */
+  uuid: string;
+  os: string;
+}
+
+export function getUpdateMetadata(): UpdateMetadata {
+  const info = currentVersionInfo || {};
+  return {
+    sdkVersion: cInfo.rnu,
+    packageVersion,
+    buildTime,
+    currentVersion: currentVersion || '',
+    versionName: typeof info.name === 'string' ? info.name : '',
+    versionDescription:
+      typeof info.description === 'string' ? info.description : '',
+    metaInfo: typeof info.metaInfo === 'string' ? info.metaInfo : '',
+    bundleHash: getBundleHash(),
+    bundleSha256: currentBundleSha256 || '',
+    isFirstTime,
+    isRolledBack,
+    rolledBackVersion: rolledBackVersion || '',
+    rescueSource: info.forceBootRescue
+      ? 'forceBoot'
+      : info.crashRescue
+        ? 'crashRescue'
+        : null,
+    uuid: cInfo.uuid,
+    os: cInfo.os,
+  };
+}
+
+/**
+ * The duck-typed surface of a crash reporter. Sentry exposes setTag/setContext,
+ * Firebase Crashlytics setAttributes/setAttribute; any object with one of
+ * those works.
+ */
+export interface CrashReporterLike {
+  setTag?: (key: string, value: string) => unknown;
+  setContext?: (
+    name: string,
+    context: Record<string, unknown> | null
+  ) => unknown;
+  setAttributes?: (attributes: Record<string, string>) => unknown;
+  setAttribute?: (key: string, value: string) => unknown;
+}
+
+/** Flat string tags (`pushy.currentVersion` …) for the running update. */
+export function updateMetadataTags(
+  metadata: UpdateMetadata = getUpdateMetadata(),
+  prefix = 'pushy.'
+): Record<string, string> {
+  const tags: Record<string, string> = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    tags[`${prefix}${key}`] =
+      value === null || value === undefined ? '' : String(value);
+  }
+  return tags;
+}
+
+/**
+ * Attach the running update's metadata to a crash reporter so every event can
+ * be mapped to the exact bundle (and source map) it came from. Call once after
+ * the reporter is initialised; safe to call again (e.g. after markSuccess).
+ * Every reporter method is optional and failures are swallowed — a reporting
+ * hiccup must never break the app.
+ */
+export function attachUpdateMetadata(
+  reporter: CrashReporterLike,
+  options: { prefix?: string; contextName?: string | null } = {}
+): UpdateMetadata {
+  const metadata = getUpdateMetadata();
+  const tags = updateMetadataTags(metadata, options.prefix ?? 'pushy.');
+  const swallow = (fn: () => unknown) => {
+    try {
+      const result = fn();
+      if (result && typeof (result as Promise<unknown>).catch === 'function') {
+        (result as Promise<unknown>).catch(() => {});
+      }
+    } catch {
+      // never let a reporter failure propagate
+    }
+  };
+  if (typeof reporter.setTag === 'function') {
+    for (const [key, value] of Object.entries(tags)) {
+      swallow(() => reporter.setTag?.(key, value));
+    }
+  } else if (typeof reporter.setAttributes === 'function') {
+    swallow(() => reporter.setAttributes?.(tags));
+  } else if (typeof reporter.setAttribute === 'function') {
+    for (const [key, value] of Object.entries(tags)) {
+      swallow(() => reporter.setAttribute?.(key, value));
+    }
+  }
+  if (
+    options.contextName !== null &&
+    typeof reporter.setContext === 'function'
+  ) {
+    swallow(() =>
+      reporter.setContext?.(options.contextName ?? 'pushy', { ...metadata })
+    );
+  }
+  return metadata;
+}
+
+/** `attachUpdateMetadata` for `@sentry/react-native` (tags + a `pushy` context). */
+export function attachToSentry(sentry: CrashReporterLike): UpdateMetadata {
+  return attachUpdateMetadata(sentry, { contextName: 'pushy' });
+}
+
+/** `attachUpdateMetadata` for `@react-native-firebase/crashlytics` (custom keys). */
+export function attachToCrashlytics(
+  crashlytics: CrashReporterLike
+): UpdateMetadata {
+  return attachUpdateMetadata(crashlytics, { contextName: null });
+}