react-native-update 10.59.2 → 10.61.0

package/harmony/pushy/src/main/ets/DownloadTask.ts

@@ -4,7 +4,12 @@ import common from '@ohos.app.ability.common';
 import { zlib } from '@kit.BasicServicesKit';
 import { EventHub } from './EventHub';
 import { DownloadTaskParams } from './DownloadTaskParams';
-import { saveFileToSandbox } from './SaveFile';
+import {
+  saveFileToSandbox,
+  unlinkIfExists,
+  withRawFd,
+  writeFully,
+} from './SaveFile';
 import { util } from '@kit.ArkTS';
 import NativePatchCore, {
   ARCHIVE_PATCH_TYPE_FROM_PACKAGE,
@@ -16,16 +21,16 @@ import logger from './Logger';
 import {
   MAX_ARCHIVE_BYTES,
   MAX_MANIFEST_BYTES,
-  UNKNOWN_LENGTH_FREE_SPACE_PROBE_BYTES,
+  checkExtractedDirectory,
+  checkOriginalSize,
   checkUncompressedSize,
   ensureFreeSpace,
-  measureExtractedDirectory,
 } from './ArchiveLimits';
 import {
   HARMONY_BUNDLE_FILE_NAME,
-  buildInstallRecord,
+  promoteStaging,
+  sealInstallRecord,
   stagingDirectoryFor,
-  writeInstallRecord,
 } from './InstallRecord';
 import {
   ERROR_DOWNLOAD_FAILED,
@@ -38,141 +43,45 @@ import {
 } from './ErrorCodes';
 import { BUNDLE_DELTA_ENTRY } from './Texts';
 
+// 连接超时,与 Android DownloadTask 的 connectTimeout(15s)一致。
+const CONNECT_TIMEOUT_MS = 15000;
 const TAG = 'DownloadTask';
 
-export interface PatchManifestArrays {
-  copyFroms: string[];
-  copyTos: string[];
-  // 与 copyFroms/copyTos 逐位对齐的 copiesCrc(CLI >= 2.21.2 的 pdiff
-  // manifest 携带,键是 to);无声明时为 null。拷贝前用它校验包内资源内容,
-  // 不符则整次 patch 失败落 full——重打包二进制不能静默拷出漂移的资源。
-  copyCrcs: (number | null)[];
-  deletes: string[];
-  // __diff.json 中对应 bundle patch 条目的 hbcTransform 元数据(原始 JSON
-  // 字符串);为空时 native 走现状路径
-  hbcTransformMeta: string;
-}
-
-export function parseManifestToArrays(
-  manifest: Record<string, any>,
-  normalizeResourceCopies: boolean,
-): PatchManifestArrays {
-  const copyFroms: string[] = [];
-  const copyTos: string[] = [];
-  const copyCrcs: (number | null)[] = [];
-  const deletesValue = manifest.deletes;
-  const deletes = Array.isArray(deletesValue)
-    ? deletesValue.map(item => String(item))
-    : deletesValue && typeof deletesValue === 'object'
-      ? Object.keys(deletesValue)
-      : [];
-
-  const copies = (manifest.copies || {}) as Record<string, string>;
-  const copiesCrcValue = manifest.copiesCrc;
-  const copiesCrc =
-    copiesCrcValue && typeof copiesCrcValue === 'object'
-      ? (copiesCrcValue as Record<string, number>)
-      : ({} as Record<string, number>);
-  for (const to of Object.keys(copies)) {
-    const rawFrom = copies[to];
-    let from = String(rawFrom || '');
-    if (normalizeResourceCopies) {
-      from = from.replace('resources/rawfile/', '');
-      if (!from) {
-        from = to;
-      }
-    }
-    copyFroms.push(from);
-    copyTos.push(to);
-    const crc = copiesCrc[to];
-    copyCrcs.push(typeof crc === 'number' && Number.isFinite(crc) ? crc : null);
-  }
-
-  const hbcTransform = manifest.hbcTransform as
-    | Record<string, object>
-    | undefined;
-  const hbcTransformEntry =
-    hbcTransform && typeof hbcTransform === 'object'
-      ? hbcTransform[BUNDLE_DELTA_ENTRY]
-      : undefined;
-  const hbcTransformMeta =
-    hbcTransformEntry && typeof hbcTransformEntry === 'object'
-      ? JSON.stringify(hbcTransformEntry)
-      : '';
-
-  return {
-    copyFroms,
-    copyTos,
-    copyCrcs,
-    deletes,
-    hbcTransformMeta,
-  };
-}
-
+// staging 目录里的条目名 + __diff.json 原文:由原生内核统一校验与解析
+// (cpp/patch_core/patch_manifest.h),这里不解析 manifest。
 interface DeltaInputs {
   entryNames: string[];
-  manifestArrays: PatchManifestArrays;
-}
-
-function toArrayBufferSlice(
-  payload: Uint8Array,
-  offset: number,
-  length: number,
-): ArrayBuffer {
-  return (payload.buffer as ArrayBuffer).slice(
-    payload.byteOffset + offset,
-    payload.byteOffset + offset + length,
-  );
+  manifestJson: string;
 }
 
+// 包内 rawfile 在 HAP 中的路径前缀:pdiff 的拷贝源按 HAP 路径命名,
+// resourceManager 按去掉前缀后的路径读取。原生解析时只剥开头一次。
+const RAWFILE_COPY_SOURCE_PREFIX = 'resources/rawfile/';
 const DIFF_MANIFEST_ENTRY = '__diff.json';
-const TEMP_ORIGIN_BUNDLE_ENTRY = '.origin.bundle.harmony.js';
-const FILE_COPY_BUFFER_SIZE = 64 * 1024;
+const TEMP_ORIGIN_BUNDLE_ENTRY = `.origin.${HARMONY_BUNDLE_FILE_NAME}`;
 const DOWNLOAD_CALL_TIMEOUT_MS = 10 * 60 * 1000;
 
 // 断点续传 sidecar(NATIVE_CHECKUPDATE_DESIGN §11.4):记录 partial 属于
 // 哪个 url、验证器与总长。归档与 sidecar 同生共死;有归档无 sidecar(或
-// url 不符)一律视为不可信,删掉重来。
-interface ResumeMeta {
-  url: string;
-  etag?: string;
-  lastModified?: string;
+// url 不符)一律视为不可信,删掉重来。续传的所有判定(读 sidecar、发不发
+// Range、响应怎么处理、写什么 sidecar)都在共享内核
+// cpp/patch_core/resume_plan.h,与 Android/iOS 同一份实现,这里只做 IO。
+const MAX_SIDECAR_BYTES = 64 * 1024;
+
+interface ResumeRequestPlan {
+  action: string;
   total?: number;
+  offset?: number;
+  headers?: Record<string, string>;
 }
 
-// "bytes <start>-<end>/<total>"。返回总长(“*”记 0);缺失/畸形/起点与
-// 本地 partial 不符、或 range 与 total 自相矛盾(end 在 start 之前、数值
-// total 不大于 end)返回 -1——那样追加的字节不可信。RFC 9110 §14.4 要求
-// 完整长度必须大于 last-pos。
-export function parseContentRangeTotal(
-  header: string,
-  expectedStart: number,
-): number {
-  if (!header.startsWith('bytes ')) {
-    return -1;
-  }
-  const range = header.substring('bytes '.length).trim();
-  const slash = range.indexOf('/');
-  const dash = range.indexOf('-');
-  if (slash < 0 || dash < 0 || dash > slash) {
-    return -1;
-  }
-  const start = parseInt(range.substring(0, dash).trim(), 10);
-  const end = parseInt(range.substring(dash + 1, slash).trim(), 10);
-  if (
-    Number.isNaN(start) ||
-    Number.isNaN(end) ||
-    start !== expectedStart ||
-    end < start
-  ) {
-    return -1;
-  }
-  const totalPart = range.substring(slash + 1).trim();
-  if (totalPart === '*') {
-    return 0;
-  }
-  const total = parseInt(totalPart, 10);
-  return Number.isNaN(total) || total <= end ? -1 : total;
+interface ResumeResponseDecision {
+  action: string;
+  total?: number;
+  append?: boolean;
+  base?: number;
+  encoded?: boolean;
+  persistSidecar?: boolean;
 }
 
 export class DownloadTask {
@@ -194,23 +103,12 @@ export class DownloadTask {
 
   private async promoteStaging(params: DownloadTaskParams): Promise<void> {
     const work = this.stagingDirectory(params);
-    const bundlePath = `${work}/${HARMONY_BUNDLE_FILE_NAME}`;
-    if (!fileIo.accessSync(bundlePath)) {
-      throw createPushyError(
-        ERROR_DELTA_FAILED,
-        `bundle missing after install: ${bundlePath}`,
-      );
-    }
-    // 整 bundle 几十 MB:摘要在 native 工作线程算,不冻结 UI 线程。
-    const bundleSha256 = await NativePatchCore.sha256HexFileAsync(bundlePath);
-    await writeInstallRecord(
-      work,
-      buildInstallRecord(params.hash, bundleSha256, this.artifactSha256),
-    );
+    // 整 bundle 几十 MB:摘要与记录写入在 native 工作线程完成,不冻结 UI 线程。
+    await sealInstallRecord(work, params.hash, this.artifactSha256);
     if (fileIo.accessSync(params.unzipDirectory)) {
       await this.removeDirectory(params.unzipDirectory);
     }
-    await fileIo.rename(work, params.unzipDirectory);
+    await promoteStaging(work, params.unzipDirectory);
   }
 
   constructor(context: common.Context) {
@@ -222,33 +120,33 @@ export class DownloadTask {
     return `${targetFile}.resume`;
   }
 
-  private async readResumeMeta(
-    targetFile: string,
-    url: string,
-  ): Promise<ResumeMeta | null> {
+  // sidecar 原文;不存在、超过 sidecar 应有的大小或读失败时为 ""
+  // (共享内核把这些都当作“没有可信的 partial”)。
+  private async readSidecarText(targetFile: string): Promise<string> {
     const sidecar = this.resumeSidecarPath(targetFile);
-    if (!fileIo.accessSync(sidecar)) {
-      return null;
-    }
     try {
-      const meta = this.parseJsonEntry(
-        await this.readFileContent(sidecar),
-      ) as ResumeMeta;
-      if (meta && meta.url === url) {
-        return meta;
+      if (!fileIo.accessSync(sidecar)) {
+        return '';
+      }
+      const stat = await fileIo.stat(sidecar);
+      if (stat.size > MAX_SIDECAR_BYTES) {
+        return '';
       }
+      return new util.TextDecoder().decodeToString(
+        new Uint8Array(await this.readFileContent(sidecar)),
+      );
     } catch (e) {
       // 坏 sidecar 只意味着“无法续传”。
+      return '';
     }
-    return null;
   }
 
-  private async writeResumeMeta(
+  private async writeSidecarText(
     targetFile: string,
-    meta: ResumeMeta,
+    text: string,
   ): Promise<void> {
     try {
-      const encoded = new util.TextEncoder().encodeInto(JSON.stringify(meta));
+      const encoded = new util.TextEncoder().encodeInto(text);
       await this.writeFileContent(this.resumeSidecarPath(targetFile), encoded);
     } catch (e) {
       // 非致命:没有 sidecar,下次从零开始。
@@ -258,10 +156,7 @@ export class DownloadTask {
 
   private async deleteResumeSidecar(targetFile: string): Promise<void> {
     try {
-      const sidecar = this.resumeSidecarPath(targetFile);
-      if (fileIo.accessSync(sidecar)) {
-        await fileIo.unlink(sidecar);
-      }
+      await unlinkIfExists(this.resumeSidecarPath(targetFile));
     } catch (e) {
       logger.error(TAG, `Failed to delete resume sidecar: ${getErrorMessage(e)}`);
     }
@@ -270,9 +165,7 @@ export class DownloadTask {
   // 归档连同 sidecar 一起删除(被消费或被判定有毒)。
   private async deleteArchiveAndSidecar(targetFile: string): Promise<void> {
     try {
-      if (fileIo.accessSync(targetFile)) {
-        await fileIo.unlink(targetFile);
-      }
+      await unlinkIfExists(targetFile);
     } catch (e) {
       logger.error(TAG, `Failed to delete archive: ${getErrorMessage(e)}`);
     }
@@ -328,35 +221,37 @@ export class DownloadTask {
 
   /**
    * 解压前读取归档解压后的总字节数(zlib.getOriginalSize,API 12——RNOH 的
-   * 最低 API 已覆盖)。读不到就拒绝归档:zlib.decompressFile 没有逐条钩子,
-   * 不知道展开量就放行等于允许一个 20MB 的归档在 measureExtractedDirectory
-   * 跑到之前先把磁盘写满。
+   * 最低 API 已覆盖)。读不到就拒绝归档(checkOriginalSize):zlib.decompressFile
+   * 没有逐条钩子,不知道展开量就放行等于允许一个 20MB 的归档在
+   * checkExtractedDirectory 跑到之前先把磁盘写满。拒绝带专属错误细节
+   * (ORIGINAL_SIZE_UNAVAILABLE)并单独记日志,与"超限"拒绝可区分。
    */
   private async readOriginalSize(archiveFile: string): Promise<number> {
     let size: number | undefined;
+    let failure: string | undefined;
     try {
       size = await zlib.getOriginalSize(archiveFile);
     } catch (e) {
-      throw createPushyError(
-        ERROR_DELTA_FAILED,
-        `cannot determine archive expansion size: ${getErrorMessage(e)}`,
-      );
+      failure = getErrorMessage(e);
     }
-    if (typeof size !== 'number' || !Number.isFinite(size) || size < 0) {
-      throw createPushyError(
-        ERROR_DELTA_FAILED,
-        `cannot determine archive expansion size: ${String(size)}`,
+    try {
+      return checkOriginalSize(size, failure);
+    } catch (error) {
+      logger.error(
+        TAG,
+        `Refusing archive, expansion size unknown: ${getErrorMessage(error)}`,
       );
+      throw error;
     }
-    return size;
   }
 
   /**
    * 解压 + 资源上限(cpp/patch_core/archive_limits.h)。zlib.decompressFile
    * 没有逐条钩子:解压前用 getOriginalSize 把总解压量与整包压缩比挡在
    * 上限内(20MB 归档 100:1 的 2GB 载荷不会先解出来再量),按已知解压量查
-   * 磁盘,解压量未知直接拒绝;解压后再统计条目数/单条大小/总字节数并拒绝
-   * 任意深度的 `.pushy-` 保留条目(超限即失败,staging 目录由失败清理删除)。
+   * 磁盘,解压量未知直接拒绝;解压后再逐条核对条目数/单条大小/总字节数,
+   * 拒绝任意深度的 `.pushy-` 保留条目与符号链接(规则见
+   * cpp/patch_core/archive_limits.h;超限即失败,staging 目录由失败清理删除)。
    */
   private async extractArchive(
     archiveFile: string,
@@ -371,13 +266,13 @@ export class DownloadTask {
     }
     const originalSize = await this.readOriginalSize(archiveFile);
     checkUncompressedSize(archiveStat.size, originalSize);
-    await ensureFreeSpace(unzipDirectory, originalSize);
+    await ensureFreeSpace(unzipDirectory, originalSize, ERROR_DELTA_FAILED);
     try {
       await zlib.decompressFile(archiveFile, unzipDirectory);
     } catch (e) {
       throw toPushyError(e, ERROR_DELTA_FAILED);
     }
-    await measureExtractedDirectory(unzipDirectory);
+    await checkExtractedDirectory(unzipDirectory, archiveStat.size);
   }
 
   private async recreateDirectory(path: string): Promise<void> {
@@ -415,33 +310,26 @@ export class DownloadTask {
   ): Promise<void> {
     const payload =
       content instanceof Uint8Array ? content : new Uint8Array(content);
+    // writeFully writes from the start of its buffer: a view into a larger
+    // buffer at a non-zero offset needs its own copy.
+    const bytes =
+      payload.byteOffset === 0
+        ? (payload.buffer as ArrayBuffer)
+        : (payload.buffer as ArrayBuffer).slice(
+            payload.byteOffset,
+            payload.byteOffset + payload.byteLength,
+          );
     await this.ensureParentDirectory(targetFile);
-    if (fileIo.accessSync(targetFile)) {
-      await fileIo.unlink(targetFile);
-    }
+    await unlinkIfExists(targetFile);
 
-    let writer: fileIo.File | null = null;
+    const writer = await fileIo.open(
+      targetFile,
+      fileIo.OpenMode.CREATE | fileIo.OpenMode.WRITE_ONLY,
+    );
     try {
-      writer = await fileIo.open(
-        targetFile,
-        fileIo.OpenMode.CREATE | fileIo.OpenMode.WRITE_ONLY,
-      );
-      const chunkSize = FILE_COPY_BUFFER_SIZE;
-      let bytesWritten = 0;
-
-      while (bytesWritten < payload.byteLength) {
-        const chunkLength = Math.min(
-          chunkSize,
-          payload.byteLength - bytesWritten,
-        );
-        const chunk = toArrayBufferSlice(payload, bytesWritten, chunkLength);
-        await fileIo.write(writer.fd, chunk);
-        bytesWritten += chunkLength;
-      }
+      await writeFully(writer.fd, bytes, payload.byteLength);
     } finally {
-      if (writer) {
-        await fileIo.close(writer);
-      }
+      await fileIo.close(writer);
     }
   }
 
@@ -451,19 +339,11 @@ export class DownloadTask {
     ) as Record<string, any>;
   }
 
-  private async readManifestArrays(
-    directory: string,
-    normalizeResourceCopies: boolean,
-  ): Promise<PatchManifestArrays> {
+  // __diff.json 原文;归档里没有时为空串(原生内核报 "diff.json not found")。
+  private async readManifestJson(directory: string): Promise<string> {
     const manifestPath = `${directory}/${DIFF_MANIFEST_ENTRY}`;
     if (!fileIo.accessSync(manifestPath)) {
-      return {
-        copyFroms: [],
-        copyTos: [],
-        copyCrcs: [],
-        deletes: [],
-        hbcTransformMeta: '',
-      };
+      return '';
     }
 
     const manifestStat = await fileIo.stat(manifestPath);
@@ -473,34 +353,39 @@ export class DownloadTask {
         `delta manifest too large: ${manifestStat.size} bytes`,
       );
     }
-    return parseManifestToArrays(
-      this.parseJsonEntry(await this.readFileContent(manifestPath)),
-      normalizeResourceCopies,
+    return new util.TextDecoder().decodeToString(
+      new Uint8Array(await this.readFileContent(manifestPath)),
     );
   }
 
-
-  private async applyBundlePatchFromFileSource(
-    originContent: ArrayBuffer,
-    workingDirectory: string,
-    bundleDeltaPath: string,
-    outputFile: string,
-    hbcTransformMeta = '',
-  ): Promise<void> {
-    const originBundlePath = `${workingDirectory}/${TEMP_ORIGIN_BUNDLE_ENTRY}`;
+  /**
+   * pdiff:hpatch 需要文件源,先把二进制内嵌的 bundle 从 rawfile descriptor
+   * 异步流式拷到 staging 里的临时文件(不整包读进内存、不在 UI 线程同步
+   * IO),原生内核只重建 bundle,拷贝分组交回由 copyFromResource 完成。
+   */
+  private async applyPatchFromEmbeddedBundle(
+    work: string,
+    inputs: DeltaInputs,
+  ): Promise<CopyGroupResult[]> {
+    const originBundlePath = `${work}/${TEMP_ORIGIN_BUNDLE_ENTRY}`;
     try {
-      await this.writeFileContent(originBundlePath, originContent);
-      await NativePatchCore.applyDeltaFromSource({
-        copyFroms: [],
-        copyTos: [],
-        deletes: [],
-        sourceRoot: workingDirectory,
-        targetRoot: workingDirectory,
+      await withRawFd(
+        this.context.resourceManager,
+        HARMONY_BUNDLE_FILE_NAME,
+        descriptor => saveFileToSandbox(descriptor, originBundlePath),
+      );
+      return await NativePatchCore.applyArchiveDelta({
+        archiveType: ARCHIVE_PATCH_TYPE_FROM_PACKAGE,
+        entryNames: inputs.entryNames,
+        manifestJson: inputs.manifestJson,
+        bundleDeltaEntry: BUNDLE_DELTA_ENTRY,
+        copySourcePrefix: RAWFILE_COPY_SOURCE_PREFIX,
+        sourceRoot: work,
+        targetRoot: work,
         originBundlePath,
-        bundleDeltaPath,
-        bundleOutputPath: outputFile,
-        enableMerge: false,
-        bundleHbcTransformMeta: hbcTransformMeta,
+        bundleDeltaPath: `${work}/${BUNDLE_DELTA_ENTRY}`,
+        bundleOutputPath: `${work}/${HARMONY_BUNDLE_FILE_NAME}`,
+        hostCopiesResources: true,
       });
     } catch (error) {
       throw createPushyError(
@@ -508,56 +393,18 @@ export class DownloadTask {
         `Failed to process bundle delta: ${getErrorMessage(error)}`,
       );
     } finally {
-      if (fileIo.accessSync(originBundlePath)) {
-        await fileIo.unlink(originBundlePath);
-      }
+      await unlinkIfExists(originBundlePath);
     }
   }
 
+  // 沙箱内文件复制(同一 rawfile 落到多个目标时,首个之外的目标从首个复制)。
+  // fileIo.copyFile 在工作线程整文件复制并覆盖目标,无需逐块搬运。
   private async copySandboxFile(
     sourceFile: string,
     targetFile: string,
   ): Promise<void> {
-    let reader: fileIo.File | null = null;
-    let writer: fileIo.File | null = null;
-    const buffer = new ArrayBuffer(FILE_COPY_BUFFER_SIZE);
-    let offset = 0;
-
-    try {
-      reader = await fileIo.open(sourceFile, fileIo.OpenMode.READ_ONLY);
-      await this.ensureParentDirectory(targetFile);
-      if (fileIo.accessSync(targetFile)) {
-        await fileIo.unlink(targetFile);
-      }
-      writer = await fileIo.open(
-        targetFile,
-        fileIo.OpenMode.CREATE | fileIo.OpenMode.WRITE_ONLY,
-      );
-
-      while (true) {
-        const readLength = await fileIo.read(reader.fd, buffer, {
-          offset,
-          length: FILE_COPY_BUFFER_SIZE,
-        });
-        if (readLength <= 0) {
-          break;
-        }
-
-        await fileIo.write(writer.fd, buffer.slice(0, readLength));
-        offset += readLength;
-
-        if (readLength < FILE_COPY_BUFFER_SIZE) {
-          break;
-        }
-      }
-    } finally {
-      if (reader) {
-        await fileIo.close(reader);
-      }
-      if (writer) {
-        await fileIo.close(writer);
-      }
-    }
+    await this.ensureParentDirectory(targetFile);
+    await fileIo.copyFile(sourceFile, targetFile);
   }
 
   private async downloadFile(params: DownloadTaskParams): Promise<void> {
@@ -613,32 +460,36 @@ export class DownloadTask {
       );
     }
 
-    // 续传状态盘点:有匹配的 sidecar 且 partial 未收齐才发 Range。
-    let resumeMeta: ResumeMeta | null = allowResume
-      ? await this.readResumeMeta(params.targetFile, params.url)
-      : null;
-    let resumeOffset = 0;
-    if (resumeMeta && fileIo.accessSync(params.targetFile)) {
-      const stat = await fileIo.stat(params.targetFile);
-      const knownTotal = resumeMeta.total ?? 0;
-      if (stat.size > 0 && knownTotal > 0 && stat.size === knownTotal) {
-        // 上次尝试已收齐(进程死在下载结束与解压之间):无需再传。
-        httpRequest.destroy();
-        this.onProgressUpdate(knownTotal, knownTotal);
-        return 'done';
-      }
-      if (stat.size > 0 && (knownTotal <= 0 || stat.size < knownTotal)) {
-        resumeOffset = stat.size;
-      }
+    // 续传状态盘点(共享内核决定):已收齐 / 带 Range 续传 / 从零开始。
+    let sidecarText = allowResume
+      ? await this.readSidecarText(params.targetFile)
+      : '';
+    const partialSize = fileIo.accessSync(params.targetFile)
+      ? (await fileIo.stat(params.targetFile)).size
+      : 0;
+    const plan = JSON.parse(
+      NativePatchCore.resumePlanRequest(sidecarText, params.url, partialSize),
+    ) as ResumeRequestPlan;
+    if (plan.action === 'complete') {
+      // 上次尝试已收齐(进程死在下载结束与解压之间):无需再传。
+      httpRequest.destroy();
+      const knownTotal = plan.total ?? 0;
+      this.onProgressUpdate(knownTotal, knownTotal);
+      return 'done';
     }
-    if (resumeOffset === 0) {
+    let resumeOffset = 0;
+    let resumeHeaders: Record<string, string> = {};
+    if (plan.action === 'resume') {
+      resumeOffset = plan.offset ?? 0;
+      resumeHeaders = plan.headers ?? {};
+    } else {
       if (fileIo.accessSync(params.targetFile)) {
         await fileIo.unlink(params.targetFile);
       } else {
         await this.ensureParentDirectory(params.targetFile);
       }
       await this.deleteResumeSidecar(params.targetFile);
-      resumeMeta = null;
+      sidecarText = '';
     }
 
     // 响应体在状态码判定前一律只进内存缓冲:416/5xx 的错误体若被追加进
@@ -651,6 +502,17 @@ export class DownloadTask {
       authorize = resolve;
     });
 
+    // 本 url 的 sidecar 原文:验证器优先取本次响应头,缺失时沿用上次的;
+    // 总长未知(0)时不写(共享内核)。
+    const sidecarFor = (total: number): string =>
+      NativePatchCore.resumeSidecar(
+        params.url,
+        etagHeader,
+        lastModifiedHeader,
+        sidecarText,
+        total,
+      );
+
     const reportProgress = () => {
       const overall = baseOffset + received;
       const overallTotal = totalAll > 0
@@ -684,31 +546,35 @@ export class DownloadTask {
       received += data.byteLength;
       if (!writeError && baseOffset + received > MAX_ARCHIVE_BYTES) {
         // 未知长度/分块传输的兜底:超过上限即停写,请求在下面结算时失败。
+        // 下载阶段:与 Android/iOS 一样归为 DOWNLOAD_FAILED。
         writeError = createPushyError(
-          ERROR_DELTA_FAILED,
+          ERROR_DOWNLOAD_FAILED,
           `archive too large: exceeded ${MAX_ARCHIVE_BYTES}`,
         );
       }
-      // 未知长度:响应到达时只能预留安全余量,所以任何会写过已预留字节数的
-      // 写入之前先探测,每次至少预留接下来的 PROBE 字节(单个 chunk 更大时按
-      // chunk 算)——任何写入都吃不到余量(归档上限本身远大于余量)。失败保留
-      // partial 供下次续传。
-      const writtenBefore = received - data.byteLength;
-      const probeFreeSpace = totalAll <= 0 && received > freeSpaceReservedUntil;
-      const reserve = Math.max(
-        UNKNOWN_LENGTH_FREE_SPACE_PROBE_BYTES,
+      // 未知长度:响应到达时只能预留安全余量,任何会写过已预留位置的写入
+      // 之前都要探测(archive_limits::PlanUnknownLengthFreeSpaceProbe)。
+      // 失败保留 partial 供下次续传。
+      const plan = NativePatchCore.planFreeSpaceProbe(
+        totalAll,
+        received - data.byteLength,
         data.byteLength,
+        freeSpaceReservedUntil,
       );
-      if (probeFreeSpace) {
-        freeSpaceReservedUntil = writtenBefore + reserve;
-      }
+      freeSpaceReservedUntil = plan.reservedUntil;
+      const probeFreeSpace = plan.probe;
+      const reserve = plan.reserve;
       writeQueue = writeQueue.then(async () => {
         if (!writer || writeError) {
           return;
         }
         try {
           if (probeFreeSpace) {
-            await ensureFreeSpace(params.targetFile, reserve);
+            await ensureFreeSpace(
+              params.targetFile,
+              reserve,
+              ERROR_DOWNLOAD_FAILED,
+            );
           }
           await fileIo.write(writer.fd, data);
         } catch (error) {
@@ -838,17 +704,10 @@ export class DownloadTask {
       const requestHeader: Record<string, string> = {
         'Content-Type': 'application/octet-stream',
       };
-      if (resumeOffset > 0) {
-        // 只有续传请求钉死编码:Range 偏移必须与盘上字节一一对应。
-        // 全新下载保留平台默认的压缩处理,与引入续传前的行为一致。
-        requestHeader['Accept-Encoding'] = 'identity';
-        requestHeader.Range = `bytes=${resumeOffset}-`;
-        const validator = resumeMeta?.etag || resumeMeta?.lastModified;
-        if (validator) {
-          // 带验证器时文件已变更的服务端会退回完整 200,而不是把不匹配
-          // 的字节接上来。
-          requestHeader['If-Range'] = validator;
-        }
+      // 续传请求的 Range / Accept-Encoding: identity / If-Range(共享内核
+      // 给出);全新下载不带,保留平台默认的压缩处理。
+      for (const name of Object.keys(resumeHeaders)) {
+        requestHeader[name] = resumeHeaders[name];
       }
 
       const remainingMs = Math.max(1, deadlineUptimeMs - monotonicNowMs());
@@ -863,44 +722,20 @@ export class DownloadTask {
         }, remainingMs);
       });
       // netstack 把 readTimeout 交给 libcurl 的 CURLOPT_TIMEOUT_MS(整次传输
-      // 总时长)而非空闲超时:固定 60s 会让慢网上的大全量包次次失败。两个
-      // 超时都取剩余 deadline;卡死由下面的 60s 不活动看门狗负责——两种
-      // 语义下都正确。
+      // 总时长)而非空闲超时:固定 60s 会让慢网上的大全量包次次失败。所以
+      // readTimeout 取剩余 deadline,卡死由下面的 60s 不活动看门狗负责——
+      // 两种语义下都正确。connectTimeout 没有这个问题,与 Android 一样
+      // 15s:连不上的镜像不该吃掉整个阶段预算,下一个镜像还要用。
       const responseCode = await Promise.race([
         httpRequest.requestInStream(params.url, {
           method: http.RequestMethod.GET,
           readTimeout: remainingMs,
-          connectTimeout: remainingMs,
+          connectTimeout: Math.min(CONNECT_TIMEOUT_MS, remainingMs),
           header: requestHeader,
         }),
         deadlinePromise,
       ]);
 
-      if (responseCode === 416) {
-        discardBody = true;
-        pendingChunks = null;
-        const knownTotal = resumeMeta?.total ?? 0;
-        if (knownTotal > 0 && fileIo.accessSync(params.targetFile)) {
-          const stat = await fileIo.stat(params.targetFile);
-          if (stat.size === knownTotal) {
-            // partial 实际上就是完整文件。
-            this.onProgressUpdate(knownTotal, knownTotal);
-            return 'done';
-          }
-        }
-        return 'staleRange';
-      }
-      if (responseCode > 299) {
-        // 响应体从未落盘,partial + sidecar 原样保留——那就是续传状态。
-        discardBody = true;
-        pendingChunks = null;
-        throw createPushyError(
-          ERROR_DOWNLOAD_FAILED,
-          `Server error: ${responseCode}`,
-        );
-      }
-
-      let encodedBody = false;
       if (resumeOffset > 0 && responseCode === 206) {
         // Content-Range 只能从 headersReceive 拿到,而它与 promise 的先后
         // 顺序不保证——等头到达(dataEnd 前必到,兜底 5s)再判定。
@@ -912,33 +747,57 @@ export class DownloadTask {
           }),
         ]);
         clearTimeout(headersTimer);
-        encodedBody =
-          !!contentEncodingHeader &&
-          contentEncodingHeader.toLowerCase() !== 'identity';
-        const parsedTotal = encodedBody
-          ? -1
-          : parseContentRangeTotal(contentRangeHeader, resumeOffset);
-        if (parsedTotal < 0) {
-          // 编码过的 range 字节、或 Content-Range 缺失/畸形/起点不符:
-          // 追加不可信。按“partial 已过期”处理(删掉、干净地重来一次),
-          // 而不是抛错——抛错会保留 partial,之后每次都撞同一堵墙。
-          discardBody = true;
-          pendingChunks = null;
-          return 'staleRange';
-        }
-        baseOffset = resumeOffset;
-        totalAll = parsedTotal;
+      }
+      // 这个响应怎么处理由共享内核决定(与 Android/iOS 同一份)。
+      const partialNow = fileIo.accessSync(params.targetFile)
+        ? (await fileIo.stat(params.targetFile)).size
+        : 0;
+      const decision = JSON.parse(
+        NativePatchCore.resumeClassifyResponse(
+          responseCode,
+          resumeOffset,
+          contentRangeHeader,
+          contentEncodingHeader,
+          contentLength > 0 ? contentLength : -1,
+          sidecarText,
+          params.url,
+          partialNow,
+        ),
+      ) as ResumeResponseDecision;
+      if (decision.action !== 'write') {
+        // 响应体从未落盘,partial + sidecar 原样保留,除非下面判定要重来。
+        discardBody = true;
+        pendingChunks = null;
+      }
+      if (decision.action === 'complete') {
+        // 416 且 partial 实际上就是完整文件。
+        const knownTotal = decision.total ?? 0;
+        this.onProgressUpdate(knownTotal, knownTotal);
+        return 'done';
+      }
+      if (decision.action === 'restart') {
+        // 过期的 416、编码过的 range 字节、或 Content-Range 缺失/畸形/
+        // 起点不符:追加不可信。按“partial 已过期”处理(删掉、干净地
+        // 重来一次),而不是抛错——抛错会保留 partial,之后每次都撞同一堵墙。
+        return 'staleRange';
+      }
+      if (decision.action !== 'write') {
+        // 其余非 2xx:partial + sidecar 原样保留——那就是续传状态。
+        throw createPushyError(
+          ERROR_DOWNLOAD_FAILED,
+          `Server error: ${responseCode}`,
+        );
+      }
+      baseOffset = decision.base ?? 0;
+      totalAll = decision.total ?? 0;
+      if (decision.append) {
         writer = await fileIo.open(
           params.targetFile,
           fileIo.OpenMode.WRITE_ONLY | fileIo.OpenMode.APPEND,
         );
       } else {
         // 服务端忽略了 Range(或本就没发):从零开始。
-        if (fileIo.accessSync(params.targetFile)) {
-          await fileIo.unlink(params.targetFile);
-        }
-        baseOffset = 0;
-        totalAll = contentLength > 0 ? contentLength : 0;
+        await unlinkIfExists(params.targetFile);
         writer = await fileIo.open(
           params.targetFile,
           fileIo.OpenMode.CREATE | fileIo.OpenMode.WRITE_ONLY,
@@ -946,7 +805,7 @@ export class DownloadTask {
       }
       if (totalAll > MAX_ARCHIVE_BYTES) {
         writeError = createPushyError(
-          ERROR_DELTA_FAILED,
+          ERROR_DOWNLOAD_FAILED,
           `archive too large: ${totalAll} bytes`,
         );
         throw writeError;
@@ -954,21 +813,15 @@ export class DownloadTask {
       await ensureFreeSpace(
         params.targetFile,
         totalAll > 0 ? totalAll - baseOffset : 0,
+        ERROR_DOWNLOAD_FAILED,
       );
-      // 先落 sidecar 再放行写入,流中崩溃才有得续。
-      const meta: ResumeMeta = { url: params.url };
-      const etag = etagHeader || resumeMeta?.etag;
-      const lastModified = lastModifiedHeader || resumeMeta?.lastModified;
-      if (etag) {
-        meta.etag = etag;
-      }
-      if (lastModified) {
-        meta.lastModified = lastModified;
-      }
-      if (totalAll > 0) {
-        meta.total = totalAll;
+      if (decision.persistSidecar) {
+        // 先落 sidecar 再放行写入,流中崩溃才有得续。
+        await this.writeSidecarText(params.targetFile, sidecarFor(totalAll));
+      } else {
+        // 编码传输不可续传:偏移会落在编码后的表示上。
+        await this.deleteResumeSidecar(params.targetFile);
       }
-      await this.writeResumeMeta(params.targetFile, meta);
 
       // 鉴权通过:回放缓冲,之后的数据直写。
       const buffered = pendingChunks ?? [];
@@ -1010,15 +863,7 @@ export class DownloadTask {
         }
         // 用最终观测值刷新 sidecar:首次写入可能因头部竞态缺 total/验证器,
         // 补齐后“下载完、解压前死”的窗口才能被 complete 检测覆盖。
-        const finalMeta: ResumeMeta = { url: params.url, total: stats.size };
-        if (etagHeader || resumeMeta?.etag) {
-          finalMeta.etag = etagHeader || resumeMeta?.etag;
-        }
-        if (lastModifiedHeader || resumeMeta?.lastModified) {
-          finalMeta.lastModified =
-            lastModifiedHeader || resumeMeta?.lastModified;
-        }
-        await this.writeResumeMeta(params.targetFile, finalMeta);
+        await this.writeSidecarText(params.targetFile, sidecarFor(stats.size));
       } else {
         // 编码传输不可续传:盘上是解码后的字节,编码域的长度与偏移都失效。
         await this.deleteResumeSidecar(params.targetFile);
@@ -1074,16 +919,12 @@ export class DownloadTask {
     return work;
   }
 
-  /** 解压目录里的条目名 + __diff.json 解析结果,供 patch plan 使用。 */
-  private async readDeltaInputs(
-    work: string,
-    normalizeResourceCopies: boolean,
-  ): Promise<DeltaInputs> {
+  private async readDeltaInputs(work: string): Promise<DeltaInputs> {
     const results = await Promise.all([
       this.listEntryNames(work),
-      this.readManifestArrays(work, normalizeResourceCopies),
+      this.readManifestJson(work),
     ]);
-    return { entryNames: results[0], manifestArrays: results[1] };
+    return { entryNames: results[0], manifestJson: results[1] };
   }
 
   private async doFullPatch(params: DownloadTaskParams): Promise<void> {
@@ -1093,78 +934,27 @@ export class DownloadTask {
 
   private async doPatchFromApp(params: DownloadTaskParams): Promise<void> {
     const work = await this.downloadAndExtract(params);
-    const inputs = await this.readDeltaInputs(work, true);
-    const manifestArrays = inputs.manifestArrays;
-
-    NativePatchCore.buildArchivePlan(
-      ARCHIVE_PATCH_TYPE_FROM_PACKAGE,
-      inputs.entryNames,
-      manifestArrays.copyFroms,
-      manifestArrays.copyTos,
-      manifestArrays.deletes,
-      BUNDLE_DELTA_ENTRY,
-    );
-
-    const bundleDeltaPath = `${work}/${BUNDLE_DELTA_ENTRY}`;
-    if (!fileIo.accessSync(bundleDeltaPath)) {
-      throw createPushyError(ERROR_DELTA_FAILED, 'bundle delta not found');
-    }
-    const resourceManager = this.context.resourceManager;
-    const originContent = await resourceManager.getRawFileContent(
-      'bundle.harmony.js',
-    );
-    await this.applyBundlePatchFromFileSource(
-      originContent.buffer as ArrayBuffer,
+    const copyGroups = await this.applyPatchFromEmbeddedBundle(
       work,
-      bundleDeltaPath,
-      `${work}/${HARMONY_BUNDLE_FILE_NAME}`,
-      manifestArrays.hbcTransformMeta,
-    );
-    // 组按 from 聚合;同一 from 的内容必然一致,所以每组一个 CRC 即可
-    // (与 manifest 逐位对齐的 copyCrcs 里取第一个非空值)。
-    const crcByFrom = new Map<string, number>();
-    manifestArrays.copyFroms.forEach((from, index) => {
-      const crc = manifestArrays.copyCrcs[index];
-      if (crc !== null && !crcByFrom.has(from)) {
-        crcByFrom.set(from, crc);
-      }
-    });
-    await this.copyFromResource(
-      NativePatchCore.buildCopyGroups(
-        manifestArrays.copyFroms,
-        manifestArrays.copyTos,
-      ),
-      work,
-      crcByFrom,
+      await this.readDeltaInputs(work),
     );
+    await this.copyFromResource(copyGroups, work);
     await this.deleteArchiveAndSidecar(params.targetFile);
   }
 
   private async doPatchFromPpk(params: DownloadTaskParams): Promise<void> {
     const work = await this.downloadAndExtract(params);
-    const inputs = await this.readDeltaInputs(work, false);
-    const manifestArrays = inputs.manifestArrays;
-
-    const plan = NativePatchCore.buildArchivePlan(
-      ARCHIVE_PATCH_TYPE_FROM_PPK,
-      inputs.entryNames,
-      manifestArrays.copyFroms,
-      manifestArrays.copyTos,
-      manifestArrays.deletes,
-      BUNDLE_DELTA_ENTRY,
-    );
-    await NativePatchCore.applyDeltaFromSource({
-      copyFroms: manifestArrays.copyFroms,
-      copyTos: manifestArrays.copyTos,
-      deletes: manifestArrays.deletes,
+    const inputs = await this.readDeltaInputs(work);
+    await NativePatchCore.applyArchiveDelta({
+      archiveType: ARCHIVE_PATCH_TYPE_FROM_PPK,
+      entryNames: inputs.entryNames,
+      manifestJson: inputs.manifestJson,
+      bundleDeltaEntry: BUNDLE_DELTA_ENTRY,
       sourceRoot: params.originDirectory,
       targetRoot: work,
-      originBundlePath: `${params.originDirectory}/bundle.harmony.js`,
+      originBundlePath: `${params.originDirectory}/${HARMONY_BUNDLE_FILE_NAME}`,
       bundleDeltaPath: `${work}/${BUNDLE_DELTA_ENTRY}`,
       bundleOutputPath: `${work}/${HARMONY_BUNDLE_FILE_NAME}`,
-      mergeSourceSubdir: plan.mergeSourceSubdir,
-      enableMerge: plan.enableMerge,
-      bundleHbcTransformMeta: manifestArrays.hbcTransformMeta,
     });
     logger.info(TAG, 'Delta from PPK completed');
     await this.deleteArchiveAndSidecar(params.targetFile);
@@ -1173,7 +963,6 @@ export class DownloadTask {
   private async copyFromResource(
     copyGroups: CopyGroupResult[],
     targetRoot: string,
-    crcByFrom?: Map<string, number>,
   ): Promise<void> {
     let currentFrom = '';
     try {
@@ -1185,7 +974,7 @@ export class DownloadTask {
         if (targets.length === 0) {
           continue;
         }
-        const expectedCrc = crcByFrom?.get(currentFrom);
+        const expectedCrc = group.expectedCrc;
 
         if (currentFrom.startsWith('resources/base/media/')) {
           // Strip only the final extension: 'icon.round.png' -> 'icon.round',
@@ -1218,28 +1007,15 @@ export class DownloadTask {
           continue;
         }
 
-        const fromContent = await resourceManager.getRawFd(currentFrom);
-        try {
-          const firstTarget = targets[0];
-          const restTargets = targets.slice(1);
-          await this.ensureParentDirectories(targets);
-          if (fileIo.accessSync(firstTarget)) {
-            await fileIo.unlink(firstTarget);
-          }
-          saveFileToSandbox(fromContent, firstTarget);
-          await Promise.all(
-            restTargets.map(target => this.copySandboxFile(firstTarget, target)),
-          );
-        } finally {
-          try {
-            await resourceManager.closeRawFd(currentFrom);
-          } catch (closeError) {
-            logger.error(
-              TAG,
-              `Failed to close raw fd for ${currentFrom}: ${getErrorMessage(closeError)}`,
-            );
-          }
-        }
+        const firstTarget = targets[0];
+        const restTargets = targets.slice(1);
+        await this.ensureParentDirectories(targets);
+        await withRawFd(resourceManager, currentFrom, descriptor =>
+          saveFileToSandbox(descriptor, firstTarget),
+        );
+        await Promise.all(
+          restTargets.map(target => this.copySandboxFile(firstTarget, target)),
+        );
       }
     } catch (error) {
       const coded = toPushyError(error, ERROR_DELTA_FAILED);
@@ -1282,25 +1058,7 @@ export class DownloadTask {
     }
   }
 
-  private async doCleanUp(params: DownloadTaskParams): Promise<void> {
-    try {
-      await NativePatchCore.cleanupOldEntries(
-        params.unzipDirectory,
-        [params.hash, params.originHash].filter(name => !!name),
-        3,
-      );
-    } catch (error) {
-      const message = `Cleanup failed: ${getErrorMessage(error)}`;
-      logger.error(TAG, message);
-      throw createPushyError(ERROR_FILE_OPERATION_FAILED, message);
-    }
-  }
-
   public async execute(params: DownloadTaskParams): Promise<void> {
-    const isPatchTask =
-      params.type === DownloadTaskParams.TASK_TYPE_PATCH_FULL ||
-      params.type === DownloadTaskParams.TASK_TYPE_PATCH_FROM_APP ||
-      params.type === DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK;
     try {
       switch (params.type) {
         case DownloadTaskParams.TASK_TYPE_PATCH_FULL:
@@ -1312,24 +1070,13 @@ export class DownloadTask {
         case DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK:
           await this.doPatchFromPpk(params);
           break;
-        case DownloadTaskParams.TASK_TYPE_CLEANUP:
-          await this.doCleanUp(params);
-          break;
-        case DownloadTaskParams.TASK_TYPE_PLAIN_DOWNLOAD:
-          await this.downloadFile(params);
-          // 文件在完成时即是最终产物——残留的 sidecar 会让下次同 URL 的
-          // 下载不发请求直接返回这份旧字节。
-          await this.deleteResumeSidecar(params.targetFile);
-          break;
         default:
           throw createPushyError(
             ERROR_INVALID_OPTIONS,
             `Unknown task type: ${params.type}`,
           );
       }
-      if (isPatchTask) {
-        await this.promoteStaging(params);
-      }
+      await this.promoteStaging(params);
     } catch (rawError) {
       // 稳定错误码:下载阶段的失败是 DOWNLOAD_FAILED;归档收齐之后的失败
       // (解压/hpatch/资源拷贝含 copiesCrc 校验/完成记录)一律 PATCH_FAILED,
@@ -1340,29 +1087,22 @@ export class DownloadTask {
         this.downloadPhaseCompleted ? ERROR_DELTA_FAILED : ERROR_DOWNLOAD_FAILED,
       );
       logger.error(TAG, `Task execution failed: ${error.message}`);
-      if (params.type !== DownloadTaskParams.TASK_TYPE_CLEANUP) {
-        try {
-          if (params.type === DownloadTaskParams.TASK_TYPE_PLAIN_DOWNLOAD) {
-            await fileIo.unlink(params.targetFile);
-            await this.deleteResumeSidecar(params.targetFile);
-          } else {
-            // Only the staging directory is ours to drop: the final version
-            // directory is never touched by a failed install, so a failed
-            // duplicate task cannot remove an earlier task's install.
-            await this.removeDirectory(this.stagingDirectory(params));
-            if (this.downloadPhaseCompleted) {
-              // 收齐后才失败的是解压/patch 失败:归档有毒,续传只会撞上
-              // 同一个失败。下载阶段的失败则保留 partial + sidecar——那
-              // 就是续传状态。
-              await this.deleteArchiveAndSidecar(params.targetFile);
-            }
-          }
-        } catch (cleanupError) {
-          logger.error(
-            TAG,
-            `Cleanup after error failed: ${getErrorMessage(cleanupError)}`,
-          );
+      try {
+        // Only the staging directory is ours to drop: the final version
+        // directory is never touched by a failed install, so a failed
+        // duplicate task cannot remove an earlier task's install.
+        await this.removeDirectory(this.stagingDirectory(params));
+        if (this.downloadPhaseCompleted) {
+          // 收齐后才失败的是解压/patch 失败:归档有毒,续传只会撞上
+          // 同一个失败。下载阶段的失败则保留 partial + sidecar——那
+          // 就是续传状态。
+          await this.deleteArchiveAndSidecar(params.targetFile);
         }
+      } catch (cleanupError) {
+        logger.error(
+          TAG,
+          `Cleanup after error failed: ${getErrorMessage(cleanupError)}`,
+        );
       }
       throw error;
     }