react-native-update 10.55.1 → 10.56.1

package/cpp/patch_core/update_core_android.cpp

@@ -1,5 +1,6 @@
 #include <jni.h>
 
+#include <exception>
 #include <string>
 #include <vector>
 
@@ -306,12 +307,22 @@ Java_cn_reactnative_modules_update_UpdateContext_syncStateWithBinaryVersion(
     jstring package_version,
     jstring build_time,
     jobject state_result) {
-  pushy::state::State state = ReadStateFromResult(env, state_result);
-  pushy::state::BinaryVersionSyncResult result = pushy::state::SyncBinaryVersion(
-      state,
-      JStringToString(env, package_version),
-      JStringToString(env, build_time));
-  return MakeStateResult(env, result.state, result.changed);
+  // C++ exceptions (bad_alloc/length_error from input-proportional STL
+  // allocations) must not unwind through the JNI boundary: convert them to a
+  // Java RuntimeException like every other failure of these entry points.
+  try {
+    pushy::state::State state = ReadStateFromResult(env, state_result);
+    pushy::state::BinaryVersionSyncResult result = pushy::state::SyncBinaryVersion(
+        state,
+        JStringToString(env, package_version),
+        JStringToString(env, build_time));
+    return MakeStateResult(env, result.state, result.changed);
+  } catch (const std::exception& error) {
+    ThrowRuntimeException(env, error.what());
+  } catch (...) {
+    ThrowRuntimeException(env, "Unexpected native exception in syncStateWithBinaryVersion");
+  }
+  return nullptr;
 }
 
 extern "C" JNIEXPORT jobject JNICALL
@@ -323,46 +334,52 @@ Java_cn_reactnative_modules_update_UpdateContext_runStateCore(
     jstring string_arg,
     jboolean flag_a,
     jboolean flag_b) {
-  const pushy::state::State state = ReadStateFromResult(env, state_result);
-  switch (static_cast<StateOperation>(operation)) {
-    case StateOperation::kSwitchVersion:
-      return MakeStateResult(
-          env,
-          pushy::state::SwitchVersion(state, JStringToString(env, string_arg)));
-    case StateOperation::kMarkSuccess: {
-      const pushy::state::MarkSuccessResult result =
-          pushy::state::MarkSuccess(state);
-      return MakeStateResult(
-          env,
-          result.state,
-          false,
-          result.stale_version_to_delete);
-    }
-    case StateOperation::kRollback: {
-      const pushy::state::State next = pushy::state::Rollback(state);
-      return MakeStateResult(
-          env, next, false, std::string(), next.current_version, true);
-    }
-    case StateOperation::kClearFirstTime:
-      return MakeStateResult(env, pushy::state::ClearFirstTime(state));
-    case StateOperation::kClearRollbackMark:
-      return MakeStateResult(env, pushy::state::ClearRollbackMark(state));
-    case StateOperation::kResolveLaunch: {
-      const pushy::state::LaunchDecision decision =
-          pushy::state::ResolveLaunchState(
-              state, flag_a == JNI_TRUE, flag_b == JNI_TRUE);
-      return MakeStateResult(
-          env,
-          decision.state,
-          false,
-          std::string(),
-          decision.load_version,
-          decision.did_rollback,
-          decision.consumed_first_time);
+  try {
+    const pushy::state::State state = ReadStateFromResult(env, state_result);
+    switch (static_cast<StateOperation>(operation)) {
+      case StateOperation::kSwitchVersion:
+        return MakeStateResult(
+            env,
+            pushy::state::SwitchVersion(state, JStringToString(env, string_arg)));
+      case StateOperation::kMarkSuccess: {
+        const pushy::state::MarkSuccessResult result =
+            pushy::state::MarkSuccess(state);
+        return MakeStateResult(
+            env,
+            result.state,
+            false,
+            result.stale_version_to_delete);
+      }
+      case StateOperation::kRollback: {
+        const pushy::state::State next = pushy::state::Rollback(state);
+        return MakeStateResult(
+            env, next, false, std::string(), next.current_version, true);
+      }
+      case StateOperation::kClearFirstTime:
+        return MakeStateResult(env, pushy::state::ClearFirstTime(state));
+      case StateOperation::kClearRollbackMark:
+        return MakeStateResult(env, pushy::state::ClearRollbackMark(state));
+      case StateOperation::kResolveLaunch: {
+        const pushy::state::LaunchDecision decision =
+            pushy::state::ResolveLaunchState(
+                state, flag_a == JNI_TRUE, flag_b == JNI_TRUE);
+        return MakeStateResult(
+            env,
+            decision.state,
+            false,
+            std::string(),
+            decision.load_version,
+            decision.did_rollback,
+            decision.consumed_first_time);
+      }
     }
-  }
 
-  ThrowRuntimeException(env, "Unknown state operation");
+    ThrowRuntimeException(env, "Unknown state operation");
+  } catch (const std::exception& error) {
+    ThrowRuntimeException(env, error.what());
+  } catch (...) {
+    ThrowRuntimeException(env, "Unexpected native exception in runStateCore");
+  }
   return nullptr;
 }
 
@@ -375,32 +392,39 @@ Java_cn_reactnative_modules_update_DownloadTask_buildArchivePatchPlan(
     jobjectArray copy_froms,
     jobjectArray copy_tos,
     jobjectArray deletes) {
-  const std::vector<std::string> from_values = JArrayToVector(env, copy_froms);
-  const std::vector<std::string> to_values = JArrayToVector(env, copy_tos);
-  if (from_values.size() != to_values.size()) {
-    ThrowRuntimeException(env, "copy_froms and copy_tos length mismatch");
-    return nullptr;
-  }
+  try {
+    const std::vector<std::string> from_values = JArrayToVector(env, copy_froms);
+    const std::vector<std::string> to_values = JArrayToVector(env, copy_tos);
+    if (from_values.size() != to_values.size()) {
+      ThrowRuntimeException(env, "copy_froms and copy_tos length mismatch");
+      return nullptr;
+    }
 
-  pushy::patch::PatchManifest manifest =
-      BuildManifest(from_values, to_values, JArrayToVector(env, deletes));
-  pushy::archive_patch::ArchivePatchType archive_type;
-  if (!ToArchivePatchType(patch_type, &archive_type)) {
-    ThrowRuntimeException(env, "Unknown archive patch type");
-    return nullptr;
-  }
-  pushy::archive_patch::ArchivePatchPlan plan;
-  pushy::patch::Status status = pushy::archive_patch::BuildArchivePatchPlan(
-      archive_type,
-      manifest,
-      JArrayToVector(env, entry_names),
-      &plan);
-  if (!status.ok) {
-    ThrowRuntimeException(env, status.message);
-    return nullptr;
-  }
+    pushy::patch::PatchManifest manifest =
+        BuildManifest(from_values, to_values, JArrayToVector(env, deletes));
+    pushy::archive_patch::ArchivePatchType archive_type;
+    if (!ToArchivePatchType(patch_type, &archive_type)) {
+      ThrowRuntimeException(env, "Unknown archive patch type");
+      return nullptr;
+    }
+    pushy::archive_patch::ArchivePatchPlan plan;
+    pushy::patch::Status status = pushy::archive_patch::BuildArchivePatchPlan(
+        archive_type,
+        manifest,
+        JArrayToVector(env, entry_names),
+        &plan);
+    if (!status.ok) {
+      ThrowRuntimeException(env, status.message);
+      return nullptr;
+    }
 
-  return NewArchivePatchPlanResult(env, plan);
+    return NewArchivePatchPlanResult(env, plan);
+  } catch (const std::exception& error) {
+    ThrowRuntimeException(env, error.what());
+  } catch (...) {
+    ThrowRuntimeException(env, "Unexpected native exception in buildArchivePatchPlan");
+  }
+  return nullptr;
 }
 
 extern "C" JNIEXPORT jobjectArray JNICALL
@@ -409,45 +433,52 @@ Java_cn_reactnative_modules_update_DownloadTask_buildCopyGroups(
     jclass,
     jobjectArray copy_froms,
     jobjectArray copy_tos) {
-  const std::vector<std::string> from_values = JArrayToVector(env, copy_froms);
-  const std::vector<std::string> to_values = JArrayToVector(env, copy_tos);
-  if (from_values.size() != to_values.size()) {
-    ThrowRuntimeException(env, "copy_froms and copy_tos length mismatch");
-    return nullptr;
-  }
+  try {
+    const std::vector<std::string> from_values = JArrayToVector(env, copy_froms);
+    const std::vector<std::string> to_values = JArrayToVector(env, copy_tos);
+    if (from_values.size() != to_values.size()) {
+      ThrowRuntimeException(env, "copy_froms and copy_tos length mismatch");
+      return nullptr;
+    }
 
-  pushy::patch::PatchManifest manifest = BuildManifest(
-      from_values, to_values, std::vector<std::string>());
-  std::vector<pushy::archive_patch::CopyGroup> groups;
-  pushy::patch::Status status =
-      pushy::archive_patch::BuildCopyGroups(manifest, &groups);
-  if (!status.ok) {
-    ThrowRuntimeException(env, status.message);
-    return nullptr;
-  }
+    pushy::patch::PatchManifest manifest = BuildManifest(
+        from_values, to_values, std::vector<std::string>());
+    std::vector<pushy::archive_patch::CopyGroup> groups;
+    pushy::patch::Status status =
+        pushy::archive_patch::BuildCopyGroups(manifest, &groups);
+    if (!status.ok) {
+      ThrowRuntimeException(env, status.message);
+      return nullptr;
+    }
 
-  jclass result_class =
-      env->FindClass("cn/reactnative/modules/update/CopyGroupResult");
-  if (result_class == nullptr) {
-    return nullptr;
-  }
+    jclass result_class =
+        env->FindClass("cn/reactnative/modules/update/CopyGroupResult");
+    if (result_class == nullptr) {
+      return nullptr;
+    }
 
-  jclass string_class = env->FindClass("java/lang/String");
-  if (string_class == nullptr) {
-    return nullptr;
-  }
+    jclass string_class = env->FindClass("java/lang/String");
+    if (string_class == nullptr) {
+      return nullptr;
+    }
 
-  jobjectArray result = env->NewObjectArray(
-      static_cast<jsize>(groups.size()), result_class, nullptr);
-  if (result == nullptr) {
-    return nullptr;
-  }
+    jobjectArray result = env->NewObjectArray(
+        static_cast<jsize>(groups.size()), result_class, nullptr);
+    if (result == nullptr) {
+      return nullptr;
+    }
 
-  for (jsize index = 0; index < static_cast<jsize>(groups.size()); ++index) {
-    jobject group = NewCopyGroupResult(env, result_class, string_class, groups[index]);
-    env->SetObjectArrayElement(result, index, group);
-    env->DeleteLocalRef(group);
+    for (jsize index = 0; index < static_cast<jsize>(groups.size()); ++index) {
+      jobject group = NewCopyGroupResult(env, result_class, string_class, groups[index]);
+      env->SetObjectArrayElement(result, index, group);
+      env->DeleteLocalRef(group);
+    }
+    env->DeleteLocalRef(string_class);
+    return result;
+  } catch (const std::exception& error) {
+    ThrowRuntimeException(env, error.what());
+  } catch (...) {
+    ThrowRuntimeException(env, "Unexpected native exception in buildCopyGroups");
   }
-  env->DeleteLocalRef(string_class);
-  return result;
+  return nullptr;
 }

package/cpp/update_flow_core/flow_json.cpp

@@ -1,8 +1,8 @@
 #include "flow_json.h"
 
 #include <cmath>
+#include <cstdint>
 #include <cstdio>
-#include <cstdlib>
 
 namespace flowjson {
 
@@ -127,18 +127,41 @@ void AppendEscaped(const std::string& s, std::string* out) {
 }
 
 void AppendNumber(double n, std::string* out) {
+  // JSON.stringify prints non-finite numbers as null.
+  if (!std::isfinite(n)) {
+    out->append("null");
+    return;
+  }
   // The decision layer only ever emits integral numbers (hashes, counters,
   // rollout percentages); print them the way JSON.stringify does. The %.17g
   // fallback exists so an unexpected fractional value surfaces as a vector
   // mismatch instead of silent truncation.
-  if (std::isfinite(n) && n == std::floor(n) && std::fabs(n) <= 9007199254740992.0) {
+  if (n == std::floor(n) && std::fabs(n) <= 9007199254740992.0) {
     char buf[32];
     std::snprintf(buf, sizeof(buf), "%lld", static_cast<long long>(n));
     out->append(buf);
-  } else {
-    char buf[40];
-    std::snprintf(buf, sizeof(buf), "%.17g", n);
-    out->append(buf);
+    return;
+  }
+  char buf[40];
+  const int len = std::snprintf(buf, sizeof(buf), "%.17g", n);
+  if (len <= 0) {
+    out->append("null");
+    return;
+  }
+  // %g writes the LC_NUMERIC decimal point ("," — or a multibyte sequence in
+  // some locales). Everything else it can produce for a finite value is
+  // [0-9eE+-], so normalize whatever else appears back to '.' instead of
+  // depending on the process locale.
+  bool point_written = false;
+  for (int i = 0; i < len && i < static_cast<int>(sizeof(buf)); i++) {
+    const char c = buf[i];
+    if ((c >= '0' && c <= '9') || c == '-' || c == '+' || c == 'e' ||
+        c == 'E') {
+      out->push_back(c);
+    } else if (!point_written) {
+      out->push_back('.');
+      point_written = true;
+    }
   }
 }
 
@@ -206,9 +229,102 @@ namespace {
 
 // The parser also consumes server checkUpdate responses, so hostile input
 // must fail cleanly: nesting is capped to keep recursive descent off the
-// stack limit. Real responses nest ~4 levels.
+// stack limit (size and node count are capped in flow_json.h). Real
+// responses nest ~4 levels.
 constexpr int kMaxDepth = 64;
 
+// Locale-independent decimal -> double. strtod() honours LC_NUMERIC, so a
+// host process that called setlocale() into a comma-decimal locale would stop
+// at the '.' of every fractional literal and reject the whole response. The
+// token has already been validated against the JSON number grammar.
+// Correctly rounded whenever the significand fits in 53 bits and the decimal
+// exponent is within +-22 (exact double powers of ten) or the value is an
+// integer below 2^53 x 10^15 — which covers everything the decision layer
+// handles (hashes, counters, rollout percentages, timestamps). Anything more
+// exotic is computed as significand x 10^exponent in double arithmetic and
+// may differ from JSON.parse by an ulp; extreme exponents saturate to
+// infinity / zero like JS.
+double DecimalToDouble(const std::string& token) {
+  size_t i = 0;
+  bool negative = false;
+  if (i < token.size() && token[i] == '-') {
+    negative = true;
+    i++;
+  }
+  uint64_t significand = 0;
+  int digits = 0;    // significant digits folded into `significand`
+  int exponent = 0;  // decimal exponent applied to `significand`
+  bool fraction = false;
+  for (; i < token.size(); i++) {
+    const char c = token[i];
+    if (c == '.') {
+      fraction = true;
+      continue;
+    }
+    if (c == 'e' || c == 'E') {
+      break;
+    }
+    const int digit = c - '0';
+    if (significand == 0 && digit == 0) {
+      if (fraction) {
+        exponent--;  // leading zeros after the point only shift the scale
+      }
+      continue;
+    }
+    if (digits < 19) {
+      significand = significand * 10 + static_cast<uint64_t>(digit);
+      digits++;
+      if (fraction) {
+        exponent--;
+      }
+    } else if (!fraction) {
+      exponent++;  // beyond 19 digits: keep the magnitude, drop precision
+    }
+  }
+  if (i < token.size()) {  // exponent part
+    i++;
+    bool exp_negative = false;
+    if (i < token.size() && (token[i] == '+' || token[i] == '-')) {
+      exp_negative = token[i] == '-';
+      i++;
+    }
+    int exp_value = 0;
+    for (; i < token.size(); i++) {
+      if (exp_value < 100000) {  // saturate: the result is inf/0 anyway
+        exp_value = exp_value * 10 + (token[i] - '0');
+      }
+    }
+    exponent += exp_negative ? -exp_value : exp_value;
+  }
+
+  double result = 0.0;
+  if (significand != 0) {
+    static const double kPow10[] = {
+        1e0,  1e1,  1e2,  1e3,  1e4,  1e5,  1e6,  1e7,  1e8,  1e9,  1e10, 1e11,
+        1e12, 1e13, 1e14, 1e15, 1e16, 1e17, 1e18, 1e19, 1e20, 1e21, 1e22};
+    static const uint64_t kPow10Int[] = {
+        1ull,           10ull,           100ull,           1000ull,
+        10000ull,       100000ull,       1000000ull,       10000000ull,
+        100000000ull,   1000000000ull,   10000000000ull,   100000000000ull,
+        1000000000000ull, 10000000000000ull, 100000000000000ull,
+        1000000000000000ull};
+    const uint64_t kExact = 1ull << 53;
+    if (significand <= kExact && exponent >= -22 && exponent <= 22) {
+      result = exponent >= 0
+                   ? static_cast<double>(significand) * kPow10[exponent]
+                   : static_cast<double>(significand) / kPow10[-exponent];
+    } else if (significand <= kExact && exponent > 22 && exponent <= 22 + 15 &&
+               significand <= kExact / kPow10Int[exponent - 22]) {
+      result = static_cast<double>(significand * kPow10Int[exponent - 22]) *
+               kPow10[22];
+    } else {
+      result = static_cast<double>(significand) *
+               std::pow(10.0, static_cast<double>(exponent));
+    }
+  }
+  return negative ? -result : result;
+}
+
 class Parser {
  public:
   Parser(const std::string& text) : text_(text) {}
@@ -260,6 +376,10 @@ class Parser {
       ok_ = false;
       return Value::Undefined();
     }
+    if (++nodes_ > kMaxNodes) {
+      ok_ = false;
+      return Value::Undefined();
+    }
     char c = text_[pos_];
     switch (c) {
       case '{':
@@ -376,17 +496,32 @@ class Parser {
           break;
         case 'u': {
           unsigned code = ParseHex4();
-          // BMP code point to UTF-8 (surrogate pairs are combined).
+          if (!ok_) {
+            return out;
+          }
+          // A high surrogate combines with an immediately following low
+          // surrogate escape into one supplementary code point.
           if (code >= 0xd800 && code <= 0xdbff &&
               text_.compare(pos_, 2, "\\u") == 0) {
+            const size_t escape_start = pos_;
             pos_ += 2;
             unsigned low = ParseHex4();
+            if (!ok_) {
+              return out;
+            }
             if (low >= 0xdc00 && low <= 0xdfff) {
               code = 0x10000 + ((code - 0xd800) << 10) + (low - 0xdc00);
             } else {
-              ok_ = false;
+              pos_ = escape_start;  // the loop re-reads that escape on its own
             }
           }
+          // JSON.parse accepts a lone surrogate, but it has no UTF-8 form:
+          // emitting one byte-encoded (ED A0 80..) would push invalid UTF-8
+          // into napi_create_string_utf8 / NewString. Decode it to U+FFFD,
+          // the way TextEncoder serializes such a JS string.
+          if (code >= 0xd800 && code <= 0xdfff) {
+            code = 0xfffd;
+          }
           AppendUtf8(code, &out);
           break;
         }
@@ -496,25 +631,23 @@ class Parser {
       }
     }
 
-    char* end = nullptr;
-    std::string token = text_.substr(start, pos_ - start);
-    double n = std::strtod(token.c_str(), &end);
-    if (end == nullptr || *end != '\0') {
-      ok_ = false;
-      return Value::Undefined();
-    }
-    return Value::Number(n);
+    return Value::Number(DecimalToDouble(text_.substr(start, pos_ - start)));
   }
 
   const std::string& text_;
   size_t pos_ = 0;
   int depth_ = 0;
+  size_t nodes_ = 0;
   bool ok_ = true;
 };
 
 }  // namespace
 
 Value Parse(const std::string& text, bool* ok) {
+  if (text.size() > kMaxInputBytes) {
+    *ok = false;
+    return Value::Undefined();
+  }
   Parser parser(text);
   return parser.Run(ok);
 }

package/cpp/update_flow_core/flow_json.h

@@ -96,9 +96,21 @@ class Value {
 // equal.
 std::string Stringify(const Value& v);
 
+// Hard limits for Parse. The TS reference has none (JSON.parse is unbounded)
+// and the divergence is deliberate: this parser runs inside the native
+// orchestrators on the raw checkUpdate body, and with sizeof(Value) ~ 96 a
+// 1 MB "[0,0,...]" balloons to ~100 MB of heap. A response over either cap is
+// treated as malformed (HandleCheckResponse -> invalidResponse). Real
+// responses are a few KB and a few hundred nodes.
+constexpr size_t kMaxInputBytes = 1024 * 1024;
+constexpr size_t kMaxNodes = 65536;
+
 // Strict JSON parser (the vectors file and checkUpdate responses). Returns
 // Undefined and sets *ok to false on malformed input; nesting beyond 64
-// levels is rejected so hostile server data cannot exhaust the stack.
+// levels, more than kMaxInputBytes of text or more than kMaxNodes values are
+// rejected so hostile server data cannot exhaust the stack or the heap.
+// Number parsing/printing is locale-independent (never strtod/LC_NUMERIC).
+// Lone surrogate escapes decode to U+FFFD so the output is always valid UTF-8.
 Value Parse(const std::string& text, bool* ok);
 
 }  // namespace flowjson

package/cpp/update_flow_core/update_flow_core.cpp

@@ -6,19 +6,83 @@ namespace updateflow {
 
 using flowjson::Value;
 
+namespace {
+
+// The low byte of every UTF-16 code unit of `utf8`, which is exactly what the
+// TS reference hashes (`key.charCodeAt(i) & 0xff` over `key.length` units).
+// Identity for ASCII; an astral code point contributes its two surrogate
+// units. Accepts the JNI modified-UTF-8 forms too (C0 80 for U+0000 and
+// byte-encoded surrogates count as one unit each, as charCodeAt would see
+// them); malformed bytes decode to U+FFFD.
+std::vector<unsigned char> Utf16LowBytes(const std::string& utf8) {
+  std::vector<unsigned char> units;
+  units.reserve(utf8.size());
+  size_t i = 0;
+  while (i < utf8.size()) {
+    const unsigned char first = static_cast<unsigned char>(utf8[i]);
+    uint32_t codePoint = 0xfffd;
+    size_t width = 1;
+    if (first < 0x80) {
+      codePoint = first;
+    } else if (first >= 0xc2 && first <= 0xdf && i + 1 < utf8.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(utf8[i + 1]);
+      if ((b1 & 0xc0) == 0x80) {
+        codePoint = ((first & 0x1f) << 6) | (b1 & 0x3f);
+        width = 2;
+      }
+    } else if (first == 0xc0 && i + 1 < utf8.size() &&
+               static_cast<unsigned char>(utf8[i + 1]) == 0x80) {
+      codePoint = 0;
+      width = 2;
+    } else if (first >= 0xe0 && first <= 0xef && i + 2 < utf8.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(utf8[i + 1]);
+      const unsigned char b2 = static_cast<unsigned char>(utf8[i + 2]);
+      if ((b1 & 0xc0) == 0x80 && (b2 & 0xc0) == 0x80 &&
+          !(first == 0xe0 && b1 < 0xa0)) {
+        codePoint = ((first & 0x0f) << 12) | ((b1 & 0x3f) << 6) | (b2 & 0x3f);
+        width = 3;
+      }
+    } else if (first >= 0xf0 && first <= 0xf4 && i + 3 < utf8.size()) {
+      const unsigned char b1 = static_cast<unsigned char>(utf8[i + 1]);
+      const unsigned char b2 = static_cast<unsigned char>(utf8[i + 2]);
+      const unsigned char b3 = static_cast<unsigned char>(utf8[i + 3]);
+      if ((b1 & 0xc0) == 0x80 && (b2 & 0xc0) == 0x80 &&
+          (b3 & 0xc0) == 0x80 && !(first == 0xf0 && b1 < 0x90) &&
+          !(first == 0xf4 && b1 > 0x8f)) {
+        codePoint = ((first & 0x07) << 18) | ((b1 & 0x3f) << 12) |
+                    ((b2 & 0x3f) << 6) | (b3 & 0x3f);
+        width = 4;
+      }
+    }
+    i += width;
+    if (codePoint <= 0xffff) {
+      units.push_back(static_cast<unsigned char>(codePoint & 0xff));
+    } else {
+      codePoint -= 0x10000;
+      units.push_back(static_cast<unsigned char>((0xd800 + (codePoint >> 10)) & 0xff));
+      units.push_back(static_cast<unsigned char>((0xdc00 + (codePoint & 0x3ff)) & 0xff));
+    }
+  }
+  return units;
+}
+
+}  // namespace
+
 uint32_t Murmur3_32(const std::string& key, uint32_t seed) {
   // The TS reference emulates 32-bit multiplication with 16-bit halves;
   // native uint32_t arithmetic is exactly (x * y) mod 2^32, so the halved
-  // dance collapses to plain multiplies. Bytes are read as charCodeAt & 0xff,
-  // which is identical for the ASCII inputs this layer handles (uuids, keys).
+  // dance collapses to plain multiplies. Input bytes are the low byte of each
+  // UTF-16 code unit (charCodeAt & 0xff), not the UTF-8 bytes: hashing UTF-8
+  // would bucket non-ASCII keys differently from the TS reference.
   const uint32_t c1 = 0xcc9e2d51;
   const uint32_t c2 = 0x1b873593;
-  const size_t len = key.size();
+  const std::vector<unsigned char> units = Utf16LowBytes(key);
+  static const unsigned char kEmpty = 0;
+  const unsigned char* data = units.empty() ? &kEmpty : units.data();
+  const size_t len = units.size();
   const size_t nblocks = len / 4;
   uint32_t h1 = seed;
 
-  const unsigned char* data =
-      reinterpret_cast<const unsigned char*>(key.data());
   for (size_t i = 0; i < nblocks; i++) {
     uint32_t k1 = static_cast<uint32_t>(data[i * 4]) |
                   (static_cast<uint32_t>(data[i * 4 + 1]) << 8) |
@@ -62,6 +126,10 @@ bool IsInRollout(double rollout, const std::string& uuid) {
   return static_cast<double>(Murmur3_32(uuid) % 100) < rollout;
 }
 
+bool IsMirrorRetryableCode(const std::string& code) {
+  return code != "PATCH_FAILED";
+}
+
 namespace {
 
 // ^[a-z][a-z0-9+.-]*:\/\/ (case-insensitive)
@@ -114,7 +182,9 @@ Value OrderEndpointCandidates(const Value& endpoints, double randomSample) {
     }
     bool seen = false;
     for (const auto& kept : deduped.elements()) {
-      if (kept.AsString() == endpoint.AsString()) {
+      // Set membership is ===: a stray non-string entry (a number, `true`)
+      // dedupes against equal primitives only, never against strings.
+      if (Value::StrictEquals(kept, endpoint)) {
         seen = true;
         break;
       }
@@ -247,8 +317,8 @@ Value DeclineDownload(const char* reason) {
 Value DecideDownload(const Value& info, const Value& identity, bool isDev) {
   const Value& hash = info.Get("hash");
   Value paths = info.Get("paths");
-  if (paths.IsUndefined()) {
-    paths = Value::Array();  // const { paths = [] } — undefined only
+  if (paths.IsUndefined() || paths.kind() == Value::Kind::Null) {
+    paths = Value::Array();  // info.paths ?? [] — a server `null` too
   }
   if (!info.Get("update").Truthy() || !hash.Truthy()) {
     return DeclineDownload("noUpdate");