react-native-update 10.55.0 → 10.56.0

package/src/client.ts

@@ -20,7 +20,7 @@ import {
 } from './core';
 import { dedupeEndpoints, executeEndpointFallback } from './endpoint';
 import {
-  asUpdateErrorCode,
+  readErrorCode,
   toUpdateError,
   UpdateError,
   type UpdateErrorCode,
@@ -65,6 +65,7 @@ import {
   log,
   noop,
   promiseAny,
+  setDebugLogging,
   testUrls,
   warn,
 } from './utils';
@@ -105,10 +106,13 @@ const cloneServerConfig = (server: UpdateServerConfig): UpdateServerConfig => ({
   queryUrls: server.queryUrls ? [...server.queryUrls] : undefined,
 });
 
-// Persist an object (rather than an empty string) so every native bridge keeps
-// accepting the payload while the orchestrators read `disabled` and skip the
-// cold-start check entirely.
-const NATIVE_CONFIG_DISABLED_JSON = '{"disabled":true}';
+// How long after a resolved reloadUpdate the process may still be alive before
+// the switch is considered not to have restarted the app (see switchVersion).
+const RELOAD_WATCHDOG_MS = 5000;
+
+// Non-2xx check responses are usually HTML error pages; keep only the head
+// for the error message (it can end up in an alert) and the logger.
+const MAX_HTTP_ERROR_TEXT = 200;
 
 const excludeConfiguredEndpoints = (
   endpoints: string[],
@@ -153,6 +157,59 @@ export const sharedState: {
   applyingUpdate: false,
 };
 
+// A reset/new switch invalidates ownership of older async completions and
+// watchdogs before the process-wide applyingUpdate flag can be reused.
+let applyingUpdateGeneration = 0;
+let reloadWatchdogTimer: ReturnType<typeof setTimeout> | undefined;
+
+const clearReloadWatchdog = () => {
+  if (reloadWatchdogTimer !== undefined) {
+    clearTimeout(reloadWatchdogTimer);
+    reloadWatchdogTimer = undefined;
+  }
+};
+
+const beginApplyingUpdate = (): number => {
+  clearReloadWatchdog();
+  sharedState.applyingUpdate = true;
+  return ++applyingUpdateGeneration;
+};
+
+const ownsApplyingUpdate = (generation: number): boolean =>
+  generation === applyingUpdateGeneration && sharedState.applyingUpdate;
+
+const finishApplyingUpdate = (generation: number): boolean => {
+  if (!ownsApplyingUpdate(generation)) {
+    return false;
+  }
+  clearReloadWatchdog();
+  sharedState.applyingUpdate = false;
+  return true;
+};
+
+const invalidateApplyingUpdate = () => {
+  applyingUpdateGeneration++;
+  clearReloadWatchdog();
+  sharedState.applyingUpdate = false;
+};
+
+const armReloadWatchdog = (generation: number, onTimeout: () => void) => {
+  if (!ownsApplyingUpdate(generation)) {
+    return;
+  }
+  clearReloadWatchdog();
+  const timer = setTimeout(() => {
+    // A cancelled callback may already be queued; both identities must match.
+    if (reloadWatchdogTimer !== timer || !ownsApplyingUpdate(generation)) {
+      return;
+    }
+    reloadWatchdogTimer = undefined;
+    sharedState.applyingUpdate = false;
+    onTimeout();
+  }, RELOAD_WATCHDOG_MS);
+  reloadWatchdogTimer = timer;
+};
+
 // The SDK is a process-level singleton: module-level sharedState, the global
 // i18n locale and the native update state are all per-process, so a second
 // client would silently share (and fight over) them. Constructing one is a
@@ -226,13 +283,11 @@ export class Pushy {
       options.locale ?? (this.clientType === 'Pushy' ? 'zh' : 'en')
     );
 
-    if (Platform.OS === 'ios' || Platform.OS === 'android') {
-      if (!options.appKey) {
-        throw new UpdateError(
-          i18n.t('error_appkey_required'),
-          'APPKEY_REQUIRED'
-        );
-      }
+    // Every native platform (Harmony included) needs the appKey; without it
+    // the check URL is `/checkUpdate/` and the failure would surface as an
+    // opaque 404 instead of this explicit code.
+    if (Platform.OS !== 'web' && !options.appKey) {
+      throw new UpdateError(i18n.t('error_appkey_required'), 'APPKEY_REQUIRED');
     }
 
     this.setOptions(options);
@@ -276,8 +331,15 @@ export class Pushy {
         if (key === 'logger') {
           this.loggerPromise.resolve();
         }
+        if (key === 'locale') {
+          // The constructor applies the initial locale; a runtime switch (or
+          // the fast-refresh re-creation path, which only goes through here)
+          // must apply just the same.
+          i18n.setLocale(value as 'zh' | 'en');
+        }
       }
     }
+    setDebugLogging(!!this.options.debug);
     this.optionsVersion++;
     for (const listener of this.optionsListeners) {
       try {
@@ -424,8 +486,16 @@ export class Pushy {
     ) {
       return;
     }
-    const configJson =
-      this.getNativeConfigJson() ?? NATIVE_CONFIG_DISABLED_JSON;
+    const configJson = this.getNativeConfigJson();
+    if (!configJson) {
+      // No usable config (empty appKey / no endpoints) is almost always a
+      // transient state while options are being assembled. Persisting a
+      // disabled config over the last good one would switch off the
+      // cold-start rescue for every later launch, so keep what native has.
+      // (Web and older natives never reach this point — no method.)
+      log('native check config unusable, keeping the last synced config');
+      return;
+    }
     // Always record the latest desired value, even when it matches the last
     // completed write. Example: A synced -> B in flight -> options revert to
     // A. Comparing only with synced(A) would drop the revert and leave native
@@ -661,10 +731,14 @@ export class Pushy {
       // report fires in the constructor before the user configures one), but
       // give up after a bound instead of retaining the closure forever when
       // no logger is ever provided.
+      let timer: ReturnType<typeof setTimeout> | undefined;
       await Promise.race([
         this.loggerPromise.promise,
-        new Promise((resolve) => setTimeout(resolve, 10 * 1000)),
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, 10 * 1000);
+        }),
       ]);
+      clearTimeout(timer);
     }
     const { logger = noop, appKey } = this.options;
     const overridePackageVersion = this.options.overridePackageVersion;
@@ -850,23 +924,39 @@ export class Pushy {
       return [];
     }
     try {
-      const resp = await promiseAny(
-        server.queryUrls.map((queryUrl) =>
-          fetchWithTimeout(queryUrl, {}, DEFAULT_FETCH_TIMEOUT_MS)
-        )
+      // Race the parsed lists, not the raw responses: fetch resolves for
+      // 404/403/5xx and anti-bot HTML too, and this path only runs once the
+      // main endpoints are already failing — a mirror that answers first
+      // with an error page must not beat the healthy one.
+      const remoteEndpoints = await promiseAny(
+        server.queryUrls.map(async (queryUrl) => {
+          const resp = await fetchWithTimeout(
+            queryUrl,
+            {},
+            DEFAULT_FETCH_TIMEOUT_MS
+          );
+          if (!resp.ok) {
+            throw Error(`${queryUrl}: ${resp.status}`);
+          }
+          const list: unknown = await resp.json();
+          if (!Array.isArray(list)) {
+            throw Error(`${queryUrl}: not an endpoint list`);
+          }
+          return list;
+        })
       );
-      const remoteEndpoints = await resp.json();
       log('fetch endpoints:', remoteEndpoints);
-      if (Array.isArray(remoteEndpoints)) {
-        return excludeConfiguredEndpoints(
-          dedupeEndpoints(
-            remoteEndpoints.filter(
-              (endpoint): endpoint is string => typeof endpoint === 'string'
-            )
-          ),
-          this.getConfiguredCheckEndpoints()
-        );
-      }
+      return excludeConfiguredEndpoints(
+        dedupeEndpoints(
+          remoteEndpoints.filter(
+            // The list is fetched from a public mirror; it may add
+            // endpoints but never move the check outside TLS.
+            (endpoint): endpoint is string =>
+              typeof endpoint === 'string' && /^https:\/\//i.test(endpoint)
+          )
+        ),
+        this.getConfiguredCheckEndpoints()
+      );
     } catch (e) {
       log('failed to fetch endpoints from: ', server.queryUrls, e);
     }
@@ -884,7 +974,7 @@ export class Pushy {
     );
 
     if (!resp.ok) {
-      const respText = await resp.text();
+      const respText = (await resp.text()).slice(0, MAX_HTTP_ERROR_TEXT);
       throw new UpdateError(
         this.t('error_http_status', {
           status: resp.status,
@@ -977,12 +1067,14 @@ export class Pushy {
       if (ageSeconds < 0 || ageSeconds > 120) {
         return undefined;
       }
-      const result = JSON.parse(entry.body);
-      if (!result || typeof result !== 'object') {
+      const result: unknown = JSON.parse(entry.body);
+      // Same schema gate as the network path: a native old enough to have
+      // cached a 200 `{"error": ...}` must not turn it into "no update".
+      if (!isValidCheckResult(result)) {
         return undefined;
       }
       log('reusing native check response cache');
-      return result as CheckResult;
+      return result;
     } catch {
       return undefined;
     }
@@ -1017,42 +1109,69 @@ export class Pushy {
       this.report({ type: 'crashRescue' });
     }
   };
-  switchVersion = async (hash: string) => {
+  /**
+   * Reload into a downloaded version. Resolves true once the native reload
+   * was requested, false when the call was ignored (not the downloaded hash,
+   * a switch already in progress, beforeReload declined, dev without debug).
+   */
+  switchVersion = async (hash: string): Promise<boolean> => {
     if (!this.assertDebug('switchVersion()')) {
-      return;
+      return false;
     }
-    if (assertHash(hash) && !sharedState.applyingUpdate) {
-      log(`switchVersion: ${hash}`);
-      sharedState.applyingUpdate = true;
-      try {
-        if (!(await this.runBeforeReload({ type: 'switchVersion', hash }))) {
-          sharedState.applyingUpdate = false;
-          return;
-        }
-      } catch (e) {
-        sharedState.applyingUpdate = false;
-        // A throw from the user's beforeReload hook is business-code failure,
-        // not an update-pipeline one: give it a distinct code so telemetry
-        // excludes it from the server-side patch-health stats.
-        const err = toUpdateError(e, 'USER_HOOK_ERROR');
-        this.emitError(err, 'errorSwitchVersion', {
-          data: { newVersion: hash },
-        });
-        throw err;
-      }
-      try {
-        return await PushyModule.reloadUpdate({ hash });
-      } catch (e) {
-        // reloadUpdate can reject (e.g. bundle missing); reset the flag so a
-        // later retry is not permanently blocked by a stuck applyingUpdate.
-        sharedState.applyingUpdate = false;
-        const err = toUpdateError(e, 'SWITCH_VERSION_FAILED');
-        this.emitError(err, 'errorSwitchVersion', {
-          data: { newVersion: hash },
-        });
-        throw err;
+    if (!assertHash(hash)) {
+      return false;
+    }
+    if (sharedState.applyingUpdate) {
+      log(`switchVersion: ${hash} ignored, a switch is already in progress`);
+      return false;
+    }
+    log(`switchVersion: ${hash}`);
+    const applyingGeneration = beginApplyingUpdate();
+    try {
+      if (!(await this.runBeforeReload({ type: 'switchVersion', hash }))) {
+        finishApplyingUpdate(applyingGeneration);
+        return false;
       }
+    } catch (e) {
+      finishApplyingUpdate(applyingGeneration);
+      // A throw from the user's beforeReload hook is business-code failure,
+      // not an update-pipeline one: give it a distinct code so telemetry
+      // excludes it from the server-side patch-health stats.
+      const err = toUpdateError(e, 'USER_HOOK_ERROR');
+      this.emitError(err, 'errorSwitchVersion', {
+        data: { newVersion: hash },
+      });
+      throw err;
+    }
+    // resetToPackagedBundle may have completed while beforeReload awaited.
+    if (!ownsApplyingUpdate(applyingGeneration)) {
+      return false;
     }
+    try {
+      await PushyModule.reloadUpdate({ hash });
+    } catch (e) {
+      // Do not let a superseded rejection clear a newer switch.
+      finishApplyingUpdate(applyingGeneration);
+      const err = toUpdateError(e, 'SWITCH_VERSION_FAILED');
+      this.emitError(err, 'errorSwitchVersion', {
+        data: { newVersion: hash },
+      });
+      throw err;
+    }
+    // A resolved reloadUpdate normally tears this JS context down right away.
+    // iOS has been seen resolving without restarting (89c638e); a stuck
+    // applyingUpdate would then silently swallow every later switchVersion,
+    // so release it once the process has outlived the reload and tell the
+    // logger (RESTART_FAILED: restart mechanics, not patch health).
+    armReloadWatchdog(applyingGeneration, () => {
+      this.report({
+        type: 'errorSwitchVersion',
+        code: 'RESTART_FAILED',
+        message: 'reloadUpdate resolved but the app did not restart',
+        data: { newVersion: hash },
+      });
+    });
+    return true;
   };
 
   switchVersionLater = async (hash: string) => {
@@ -1153,6 +1272,7 @@ export class Pushy {
       },
       body,
     };
+    let respJsonPromise: Promise<CheckResult> | undefined;
     try {
       this.report({
         type: 'checking',
@@ -1162,7 +1282,7 @@ export class Pushy {
       // (§10.3); reuse it instead of re-checking. The read happens INSIDE
       // the promise so no await lands between the dedup window above and the
       // lastRespJson assignment below (the JS2-1 double-send lesson).
-      const respJsonPromise = (async (): Promise<CheckResult> => {
+      respJsonPromise = (async (): Promise<CheckResult> => {
         // While bundleHash prefetch is still pending, the JS request omits
         // that key whereas the native request always includes its synchronously
         // computed value. That narrow first-launch window intentionally misses
@@ -1190,9 +1310,12 @@ export class Pushy {
       return result;
     } catch (e: any) {
       // A failed check must not keep vouching for an older response: clear
-      // the dedup slot so the next call re-asks the server.
-      this.lastRespJson = undefined;
-      this.lastCheckFingerprint = undefined;
+      // the dedup slot so the next call re-asks the server — unless a newer
+      // check already owns the slot, which this failure says nothing about.
+      if (this.lastRespJson === respJsonPromise) {
+        this.lastRespJson = undefined;
+        this.lastCheckFingerprint = undefined;
+      }
       const err = toUpdateError(e, 'CHECK_FAILED');
       this.emitError(err, 'errorChecking', {
         message: err.message || this.t('error_cannot_connect_server'),
@@ -1291,6 +1414,14 @@ export class Pushy {
   ) => {
     const { name, description = '', metaInfo } = updateInfo;
     const { hash, attempts, devNoop } = plan;
+    if (devNoop) {
+      // Dev without a full package URL: nothing can be fetched, let alone
+      // installed. Say so and deliver nothing — faking a success here used to
+      // hand the caller a hash whose switchVersion the native side (rightly)
+      // rejects with SWITCH_VERSION_FAILED.
+      log(this.t('dev_incremental_update_disabled'));
+      return;
+    }
     const patchStartTime = Date.now();
     // One native listener per hash dispatching to a callback set, so
     // concurrent callers deduped onto this task can each observe progress
@@ -1342,8 +1473,17 @@ export class Pushy {
     }
     const maxRetries = Math.max(0, Math.floor(this.options.maxRetries ?? 3));
     let succeeded = '';
-    let lastError: any;
+    let lastError: UpdateError | undefined;
     const errorMessages: string[] = [];
+    // A strategy whose bytes arrived but could not be applied fails the same
+    // way on every retry (same artifact, same base): remember it — with its
+    // message, so the final report still names it — and skip it on later
+    // attempts instead of downloading and patching it again.
+    const exhaustedStrategies = new Map<DownloadStrategyType, string>();
+    // Whether any strategy, in any attempt, failed at the patch stage. The
+    // downloadFallback report carries that as its code even when a later,
+    // unrelated transport failure happened to be the last error seen.
+    let patchFailed = false;
 
     // The ordered attempts come from decideDownload (the pure decision layer);
     // this side only executes them: probe candidate URLs, run the matching
@@ -1386,6 +1526,7 @@ export class Pushy {
         log(`retry attempt ${attempt}/${maxRetries}, waiting ${backoffMs}ms`);
         await new Promise((r) => setTimeout(r, backoffMs));
         errorMessages.length = 0;
+        errorMessages.push(...exhaustedStrategies.values());
         lastError = undefined;
         succeeded = '';
       }
@@ -1396,14 +1537,13 @@ export class Pushy {
           attempt,
         },
       });
-      if (devNoop) {
-        log(this.t('dev_incremental_update_disabled'));
-        succeeded = 'full';
-      }
       for (const { type, urls } of attempts) {
         if (succeeded) {
           break;
         }
+        if (exhaustedStrategies.has(type)) {
+          continue;
+        }
         // The HEAD race only ranks mirrors; it is not proof that a mirror can
         // serve the whole artifact (CDNs answer HEAD and GET differently, and
         // a transfer can die mid-stream). Every mirror of the same artifact
@@ -1416,30 +1556,43 @@ export class Pushy {
             await runners[type](url);
             succeeded = type;
             break;
-          } catch (e: any) {
+          } catch (e: unknown) {
+            // The native rejection's stable code (e.g. PATCH_FAILED vs
+            // DOWNLOAD_FAILED — telemetry classifies on it) may sit on the
+            // `code` property or, from bridges that cannot set it, as a
+            // `[CODE] ` message prefix. Either way it survives into the
+            // i18n-wrapped error together with the original as cause.
+            const { code, message } = readErrorCode(e);
             const errorMessage = this.t(errorKeys[type], {
-              message: e.message,
+              message: message || String(e ?? ''),
             });
             errorMessages.push(errorMessage);
-            // Keep the i18n message for display, but preserve the native
-            // rejection's stable code (e.g. PATCH_FAILED vs DOWNLOAD_FAILED —
-            // telemetry classifies on it) and the original error as cause.
             lastError = new UpdateError(
               errorMessage,
-              asUpdateErrorCode(e?.code) ?? 'DOWNLOAD_FAILED',
-              { cause: e }
+              code ?? 'DOWNLOAD_FAILED',
+              {
+                cause: e,
+              }
             );
             log(errorMessage);
+            if (lastError.code === 'PATCH_FAILED') {
+              patchFailed = true;
+            }
             if (!isMirrorRetryableCode(lastError.code)) {
               // The bytes arrived but could not be applied (patch/manifest
               // mismatch): every mirror serves the same artifact, so move
               // on to the next strategy instead of re-downloading it.
+              exhaustedStrategies.set(type, errorMessage);
               break;
             }
           }
         }
       }
-      if (succeeded) {
+      if (
+        succeeded ||
+        attempts.every(({ type }) => exhaustedStrategies.has(type))
+      ) {
+        // Nothing left that a retry could change.
         break;
       }
     }
@@ -1455,9 +1608,10 @@ export class Pushy {
       // platform that incremental delivery is failing for this binary.
       this.report({
         type: 'downloadFallback',
-        // UpdateError.code already carries the classified native rejection
-        // code (PATCH_FAILED vs DOWNLOAD_FAILED).
-        code: lastError?.code,
+        // The patch-health signal wins over whatever transport failure
+        // happened to come last (diff PATCH_FAILED, then pdiff network
+        // error, then full succeeded is still a patch_fail server-side).
+        code: patchFailed ? 'PATCH_FAILED' : lastError?.code,
         data: {
           newVersion: hash,
           succeeded,
@@ -1643,6 +1797,10 @@ export class Pushy {
     sharedState.downloadedHash = undefined;
     sharedState.toHash = undefined;
     sharedState.marked = false;
+    // Invalidate the private owner too: old promises/timers must not touch
+    // a switch that starts after this reset.
+    invalidateApplyingUpdate();
+    sharedState.apkStatus = null;
     this.report({ type: 'reset' });
     if (options?.restart) {
       try {

package/src/context.ts

@@ -1,35 +1,27 @@
 import { createContext, useContext, useMemo } from 'react';
 import type { Cresc, Pushy } from './client';
 import i18n from './i18n';
-import type { CheckResult, ProgressData } from './type';
+import type { CheckResult, ProgressData, UpdateTestPayload } from './type';
 
 const noop = () => {};
 const asyncNoop = () => Promise.resolve(undefined);
 
-export const defaultContext = {
-  checkUpdate: asyncNoop,
-  switchVersion: asyncNoop,
-  switchVersionLater: asyncNoop,
-  markSuccess: noop,
-  dismissError: noop,
-  downloadUpdate: asyncNoop,
-  downloadAndInstallApk: asyncNoop,
-  restartApp: asyncNoop,
-  resetToPackagedBundle: asyncNoop,
-  getCurrentVersionInfo: () => Promise.resolve({}),
-  parseTestQrCode: () => false,
-  currentHash: '',
-  packageVersion: '',
-  currentVersionInfo: {},
-};
-
-export const UpdateContext = createContext<{
-  checkUpdate: () => Promise<undefined | CheckResult>;
-  switchVersion: () => Promise<void>;
-  switchVersionLater: () => Promise<void>;
-  markSuccess: () => void;
+/**
+ * What UpdateProvider puts into UpdateContext (and useUpdate() returns, plus
+ * `progress`). The signatures mirror the provider's callbacks: the `info`
+ * parameters default to the last check result, `checkUpdate` accepts request
+ * extras, and the mutations resolve once the client is done.
+ */
+export interface UpdateContextValue {
+  checkUpdate: (params?: {
+    extra?: Partial<{ toHash: string }>;
+  }) => Promise<undefined | CheckResult>;
+  /** Resolves true once the native reload was requested; false when skipped. */
+  switchVersion: (info?: CheckResult) => Promise<boolean | undefined>;
+  switchVersionLater: (info?: CheckResult) => Promise<void>;
+  markSuccess: () => Promise<void>;
   dismissError: () => void;
-  downloadUpdate: () => Promise<boolean | undefined>;
+  downloadUpdate: (info?: CheckResult) => Promise<boolean | undefined>;
   downloadAndInstallApk: (url: string) => Promise<void>;
   // @deprecated use currentVersionInfo instead
   getCurrentVersionInfo: () => Promise<{
@@ -42,7 +34,7 @@ export const UpdateContext = createContext<{
     description?: string;
     metaInfo?: string;
   } | null;
-  parseTestQrCode: (code: string) => boolean;
+  parseTestQrCode: (code: string | UpdateTestPayload) => boolean;
   restartApp: () => Promise<void>;
   resetToPackagedBundle: (options?: {
     restart?: boolean;
@@ -52,7 +44,26 @@ export const UpdateContext = createContext<{
   client?: Pushy | Cresc;
   updateInfo?: CheckResult;
   lastError?: Error;
-}>(defaultContext);
+}
+
+export const defaultContext: UpdateContextValue = {
+  checkUpdate: asyncNoop,
+  switchVersion: asyncNoop,
+  switchVersionLater: asyncNoop,
+  markSuccess: asyncNoop,
+  dismissError: noop,
+  downloadUpdate: asyncNoop,
+  downloadAndInstallApk: asyncNoop,
+  restartApp: asyncNoop,
+  resetToPackagedBundle: asyncNoop,
+  getCurrentVersionInfo: () => Promise.resolve({}),
+  parseTestQrCode: () => false,
+  currentHash: '',
+  packageVersion: '',
+  currentVersionInfo: {},
+};
+
+export const UpdateContext = createContext<UpdateContextValue>(defaultContext);
 
 // Download progress ticks at high frequency, so it lives in its own context;
 // otherwise every tick would re-render all useUpdate() consumers even when
@@ -68,7 +79,9 @@ export const ProgressContext = createContext<ProgressData | undefined>(
  */
 export const useUpdateProgress = () => useContext(ProgressContext);
 
-export const useUpdate = () => {
+export const useUpdate = (): UpdateContextValue & {
+  progress?: ProgressData;
+} => {
   const context = useContext(UpdateContext);
   const progress = useContext(ProgressContext);