react-native-update 10.59.2 → 10.61.0

package/android/src/main/java/cn/reactnative/modules/update/PushyRuntime.java

@@ -7,8 +7,6 @@ import android.util.Log;
 import androidx.annotation.Nullable;
 import org.json.JSONObject;
 import java.util.concurrent.Executor;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ThreadFactory;
 
 /** Bridge-free native configuration and update APIs. */
 public final class PushyRuntime {
@@ -17,16 +15,12 @@ public final class PushyRuntime {
         void onComplete(BundlePreparationResult result);
     }
 
-    // A single waiting worker, not one thread per caller. The actual round is
-    // shared with cold start and crash rescue by SyncCoordinator.
-    private static final Executor WORKER = Executors.newSingleThreadExecutor(new ThreadFactory() {
-        @Override
-        public Thread newThread(Runnable runnable) {
-            Thread thread = new Thread(runnable, "pushy-host-sync");
-            thread.setDaemon(true);
-            return thread;
-        }
-    });
+    // Waiting threads, reused while idle. Not a single worker: each caller's
+    // wait is bounded by its own timeout, which a queue behind another
+    // caller's longer wait would break (iOS waits on a concurrent queue too).
+    // The actual round is shared with cold start and crash rescue by
+    // SyncCoordinator, on its own thread.
+    private static final Executor WORKER = Threads.cached("pushy-host-sync");
 
     public interface ConfigurationCallback {
         /** Main thread; null means configuration was persisted successfully. */
@@ -34,14 +28,7 @@ public final class PushyRuntime {
     }
 
     // Configuration must not wait behind a network round that it invalidates.
-    private static final Executor CONFIG_WORKER = Executors.newSingleThreadExecutor(new ThreadFactory() {
-        @Override
-        public Thread newThread(Runnable runnable) {
-            Thread thread = new Thread(runnable, "pushy-host-config");
-            thread.setDaemon(true);
-            return thread;
-        }
-    });
+    private static final Executor CONFIG_WORKER = Threads.single("pushy-host-config", true);
 
     /**
      * Validate and persist a complete configuration, even before JS or bundle
@@ -56,26 +43,22 @@ public final class PushyRuntime {
         final Context applicationContext = context.getApplicationContext();
         // Snapshot caller-owned JSON before dispatch, not minutes later on a worker.
         final String snapshot = options.toString();
-        CONFIG_WORKER.execute(new Runnable() {
-            @Override
-            public void run() {
-                Exception failure = null;
-                try {
-                    String config = PushyConfiguration.normalize(snapshot);
-                    UpdateContext.getInstance(applicationContext).setNativeConfig(config);
-                } catch (Exception e) {
-                    failure = e;
-                } catch (LinkageError e) {
-                    failure = new IllegalStateException("Native configuration failed", e);
+        CONFIG_WORKER.execute(() -> {
+            Exception failure = null;
+            try {
+                NativeCore.ensureLoaded();
+                String config = FlowBridge.normalizeConfiguration(snapshot);
+                if (config == null) {
+                    throw new IllegalStateException("Native configuration failed");
                 }
-                final Exception error = failure;
-                new Handler(Looper.getMainLooper()).post(new Runnable() {
-                    @Override
-                    public void run() {
-                        callback.onComplete(error);
-                    }
-                });
+                UpdateContext.getInstance(applicationContext).setNativeConfig(config);
+            } catch (Exception e) {
+                failure = e;
+            } catch (LinkageError e) {
+                failure = new IllegalStateException("Native configuration failed", e);
             }
+            final Exception error = failure;
+            new Handler(Looper.getMainLooper()).post(() -> callback.onComplete(error));
         });
     }
 
@@ -90,38 +73,46 @@ public final class PushyRuntime {
      * UpdateContext.getBundleUrl. Do not resolve the bundle again just to call
      * this method: bundle resolution consumes first-load/rollback markers.
      * Missing persisted configuration and debug builds are reported as skipped.
+     *
+     * Waits at most 30 minutes for the round (longer than any round takes).
      */
     public static void prepareBundle(Context context, final Callback callback) {
+        prepareBundle(context, SyncCoordinator.DEFAULT_PREPARE_TIMEOUT_MS, callback);
+    }
+
+    /**
+     * Same as prepareBundle(Context, Callback), but the callback runs after at
+     * most timeoutMillis. On expiry the result is status failed, reason
+     * timeout; the round keeps running in the background and its result still
+     * applies to the next launch.
+     */
+    public static void prepareBundle(
+        Context context,
+        final long timeoutMillis,
+        final Callback callback
+    ) {
         if (context == null || callback == null) {
             throw new IllegalArgumentException("context and callback are required");
         }
         final Context applicationContext = context.getApplicationContext();
-        WORKER.execute(new Runnable() {
-            @Override
-            public void run() {
-                BundlePreparationResult outcome;
-                try {
-                    if (BuildConfig.DEBUG) {
-                        outcome = BundlePreparationResult.of(BundlePreparationResult.SKIPPED, "debug");
-                    } else {
-                        outcome = SyncCoordinator.prepareBundle(
-                            UpdateContext.getInstance(applicationContext));
-                    }
-                } catch (InterruptedException e) {
-                    Thread.currentThread().interrupt();
-                    outcome = BundlePreparationResult.of(BundlePreparationResult.CANCELLED, "interrupted");
-                } catch (Exception | LinkageError e) {
-                    Log.w(Texts.LOG_TAG, "native host sync failed", e);
-                    outcome = BundlePreparationResult.of(BundlePreparationResult.FAILED, "internal_error");
+        WORKER.execute(() -> {
+            BundlePreparationResult outcome;
+            try {
+                if (BuildConfig.DEBUG) {
+                    outcome = BundlePreparationResult.of(BundlePreparationResult.SKIPPED, "debug");
+                } else {
+                    outcome = SyncCoordinator.prepareBundle(
+                        UpdateContext.getInstance(applicationContext), timeoutMillis);
                 }
-                final BundlePreparationResult result = outcome;
-                new Handler(Looper.getMainLooper()).post(new Runnable() {
-                    @Override
-                    public void run() {
-                        callback.onComplete(result);
-                    }
-                });
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                outcome = BundlePreparationResult.of(BundlePreparationResult.CANCELLED, "interrupted");
+            } catch (Exception | LinkageError e) {
+                Log.w(Texts.LOG_TAG, "native host sync failed", e);
+                outcome = BundlePreparationResult.of(BundlePreparationResult.FAILED, "internal_error");
             }
+            final BundlePreparationResult result = outcome;
+            new Handler(Looper.getMainLooper()).post(() -> callback.onComplete(result));
         });
     }
 }

package/android/src/main/java/cn/reactnative/modules/update/ReactReloadManager.java

@@ -19,22 +19,7 @@ final class ReactReloadManager {
     }
 
     /**
-     * First half of a restart, for the state serial thread: activate the
-     * requested version (bundle digest + commit) and resolve the bundle to
-     * load. Nothing here touches React, so nothing here needs the UI thread
-     * (CODE_AUDIT 2.2). Returns the bundle path, or null for the packaged
-     * bundle.
-     */
-    @Nullable
-    static String prepareRestart(UpdateContext updateContext, @Nullable String hash) {
-        if (hash != null) {
-            updateContext.switchVersion(hash);
-        }
-        return updateContext.getBundleUrl();
-    }
-
-    /**
-     * Second half, for the UI thread: point the running React instance at
+     * For the UI thread: point the running React instance at
      * {@code updateBundlePath} and reload it. Throws when no supported
      * injection worked — the caller rejects RESTART_FAILED. There is
      * deliberately no Activity.recreate() fallback: it would reload the
@@ -241,18 +226,18 @@ final class ReactReloadManager {
         reactHostDelegateField.setAccessible(true);
         Object reactHostDelegate = reactHostDelegateField.get(reactHost);
 
-        String bundleFieldName = "jsBundleLoader";
-        if ("expo.modules.ExpoReactHostFactory.ExpoReactHostDelegate".equals(
-            reactHostDelegate.getClass().getCanonicalName()
-        )) {
-            bundleFieldName = "_jsBundleLoader";
+        // DefaultReactHostDelegate stores the loader in jsBundleLoader; Expo's
+        // ExpoReactHostDelegate computes that property from _jsBundleLoader.
+        Field jsBundleLoaderField;
+        try {
+            jsBundleLoaderField = reactHostDelegate.getClass().getDeclaredField("jsBundleLoader");
+        } catch (NoSuchFieldException e) {
+            jsBundleLoaderField = reactHostDelegate.getClass().getDeclaredField("_jsBundleLoader");
         }
-
-        Field jsBundleLoaderField = reactHostDelegate.getClass().getDeclaredField(bundleFieldName);
         jsBundleLoaderField.setAccessible(true);
         jsBundleLoaderField.set(reactHostDelegate, loader);
 
-        Method reloadMethod = reactHost.getClass().getMethod(Texts.reveal("2812f8deaf8f"), String.class);
+        Method reloadMethod = reactHost.getClass().getMethod(Texts.RELOAD_METHOD, String.class);
         reloadMethod.invoke(reactHost, Texts.LOG_TAG);
     }
 

package/android/src/main/java/cn/reactnative/modules/update/ResumePlan.java

@@ -0,0 +1,31 @@
+package cn.reactnative.modules.update;
+
+/**
+ * The resumable-download decisions (cpp/patch_core/resume_plan.h): what to
+ * request for a partial archive and its sidecar, what to do with the
+ * response, and the sidecar text to persist. JSON text out; null only when
+ * the native core failed (memory ran out). DownloadTask keeps the IO.
+ */
+final class ResumePlan {
+    static {
+        NativeCore.ensureLoaded();
+    }
+
+    private ResumePlan() {
+    }
+
+    static native String planRequest(String sidecar, String url, long partialSize);
+
+    static native String classifyResponse(
+        int status,
+        long resumeOffset,
+        String contentRange,
+        String contentEncoding,
+        long contentLength,
+        String sidecar,
+        String url,
+        long partialSize);
+
+    static native String sidecar(
+        String url, String etag, String lastModified, String previousSidecar, long total);
+}

package/android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -1,11 +1,14 @@
 package cn.reactnative.modules.update;
 
-import java.io.BufferedInputStream;
-import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
+import java.security.DigestOutputStream;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.Collections;
 import java.util.Enumeration;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
@@ -17,73 +20,30 @@ public class SafeZipFile extends ZipFile {
         super(file);
     }
 
-    private static final int BUFFER_SIZE = 8192;
-
-    // Bytes written by unzipToFile across the archive: the sum of the central
-    // directory's declared sizes is checked up front (inspect), the actual
+    // Bytes written by unzipToFile across the archive: the central
+    // directory's declared sizes are checked up front (inspect), the actual
     // stream is re-checked here — headers can lie.
     private long totalWritten = 0;
 
-    static final class Inspection {
-        long entries;
-        long totalUncompressed;
-    }
-
     /**
-     * Walks the central directory once, enforcing the archive_limits caps
-     * (entry count, per-entry size, total size, compression ratio) and the
-     * reserved-name / traversal rules, before a single byte is extracted.
+     * Walks the central directory once and hands it to the shared accounting
+     * (ArchiveLimits.checkEntries: entry count, per-entry and total size,
+     * compression ratios, reserved `.pushy-` names) before a single byte is
+     * extracted. Returns the total uncompressed size.
      */
-    Inspection inspect() throws IOException {
-        Inspection result = new Inspection();
-        Enumeration<? extends ZipEntry> entries = entries();
-        while (entries.hasMoreElements()) {
-            ZipEntry entry = entries.nextElement();
-            result.entries++;
-            if (result.entries > ArchiveLimits.MAX_ENTRIES) {
-                throw new IOException(
-                    "archive has too many entries (> " + ArchiveLimits.MAX_ENTRIES + ")");
-            }
-            long size = entry.getSize();
-            long compressed = entry.getCompressedSize();
-            if (size > ArchiveLimits.MAX_ENTRY_BYTES) {
-                throw new IOException(
-                    "archive entry too large: " + entry.getName() + " (" + size + " bytes)");
-            }
-            if (size > 0) {
-                result.totalUncompressed += size;
-                if (result.totalUncompressed > ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES) {
-                    throw new IOException("archive expands beyond "
-                        + ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES + " bytes");
-                }
-                if (compressed > 0 && size > ArchiveLimits.RATIO_CHECK_MIN_BYTES
-                    && size / compressed > ArchiveLimits.MAX_COMPRESSION_RATIO) {
-                    throw new IOException(
-                        "archive entry compression ratio too high: " + entry.getName());
-                }
-            }
+    long inspect(long archiveBytes) throws IOException {
+        ArrayList<? extends ZipEntry> entries = Collections.list(entries());
+        int count = entries.size();
+        String[] names = new String[count];
+        long[] sizes = new long[count];
+        long[] compressedSizes = new long[count];
+        for (int i = 0; i < count; i++) {
+            ZipEntry entry = entries.get(i);
+            names[i] = entry.getName();
+            sizes[i] = entry.getSize();
+            compressedSizes[i] = entry.getCompressedSize();
         }
-        return result;
-    }
-
-    // Files the SDK itself writes into a version directory to record its own
-    // decisions (the ".pushy-complete" install marker today). An archive
-    // must never be able to ship one: a package that unzips its own marker
-    // next to a bundle would be trusted as a finished install even when the
-    // patch step that follows fails.
-    static final String RESERVED_ENTRY_PREFIX = ".pushy-";
-
-    static boolean isReservedEntryName(String name) {
-        if (name == null) {
-            return false;
-        }
-        String normalized = name.replace('\\', '/');
-        while (normalized.endsWith("/")) {
-            normalized = normalized.substring(0, normalized.length() - 1);
-        }
-        int slash = normalized.lastIndexOf('/');
-        String baseName = slash >= 0 ? normalized.substring(slash + 1) : normalized;
-        return baseName.startsWith(RESERVED_ENTRY_PREFIX);
+        return ArchiveLimits.checkEntries(archiveBytes, names, sizes, compressedSizes);
     }
 
     @Override
@@ -115,15 +75,17 @@ public class SafeZipFile extends ZipFile {
                 if (null != name && (name.contains("../") || name.contains("..\\"))) {
                     throw new SecurityException("illegal entry: " + name);
                 }
-                if (isReservedEntryName(name)) {
-                    throw new SecurityException("reserved entry: " + name);
-                }
             }
             return entry;
         }
     }
 
     public void unzipToPath(ZipEntry ze, File targetPath) throws IOException {
+        unzipToPath(ze, targetPath, null);
+    }
+
+    /** As above; a non-null digest is fed every byte written for the entry. */
+    void unzipToPath(ZipEntry ze, File targetPath, MessageDigest digest) throws IOException {
         String name = ze.getName();
         File target = new File(targetPath, name);
 
@@ -133,22 +95,19 @@ public class SafeZipFile extends ZipFile {
         if (!canonicalPath.startsWith(targetPath.getCanonicalPath() + File.separator)) {
             throw new SecurityException("Illegal name: " + name);
         }
-        if (isReservedEntryName(name)) {
-            throw new SecurityException("reserved entry: " + name);
-        }
-
         if (ze.isDirectory()) {
             target.mkdirs();
             return;
         }
-        unzipToFile(ze, target);
+        unzipToFile(ze, target, digest);
     }
 
     public void unzipToFile(ZipEntry ze, File target) throws IOException {
-        File parent = target.getParentFile();
-        if (parent != null && !parent.exists() && !parent.mkdirs() && !parent.exists()) {
-            throw new IOException("Failed to create parent dir for " + target);
-        }
+        unzipToFile(ze, target, null);
+    }
+
+    private void unzipToFile(ZipEntry ze, File target, MessageDigest digest) throws IOException {
+        UpdateFileUtils.ensureParentDirectory(target);
 
         // The declared size is the budget when known; otherwise the global
         // per-entry cap. Either way the stream may not exceed it.
@@ -157,12 +116,15 @@ public class SafeZipFile extends ZipFile {
             ? Math.min(declared, ArchiveLimits.MAX_ENTRY_BYTES)
             : ArchiveLimits.MAX_ENTRY_BYTES;
         long written = 0;
-        try (InputStream inputStream = getInputStream(ze)) {
-            try (BufferedOutputStream output = new BufferedOutputStream(new FileOutputStream(target));
-                 BufferedInputStream input = new BufferedInputStream(inputStream)) {
-                byte[] buffer = new byte[BUFFER_SIZE];
+        // One 64KB buffer, no extra buffered wrappers: every read/write is
+        // already a large block.
+        try (InputStream input = getInputStream(ze)) {
+            try (OutputStream output = digest == null
+                     ? new FileOutputStream(target)
+                     : new DigestOutputStream(new FileOutputStream(target), digest)) {
+                byte[] buffer = new byte[UpdateFileUtils.BUFFER_SIZE];
                 int n;
-                while ((n = input.read(buffer, 0, BUFFER_SIZE)) >= 0) {
+                while ((n = input.read(buffer, 0, buffer.length)) >= 0) {
                     written += n;
                     totalWritten += n;
                     if (written > budget) {

package/android/src/main/java/cn/reactnative/modules/update/StateSerialRunner.java

@@ -1,64 +1,47 @@
 package cn.reactnative.modules.update;
 
-import android.util.Log;
-import androidx.annotation.Nullable;
 import com.facebook.react.bridge.Promise;
-
+import com.facebook.react.bridge.UiThreadUtil;
 import java.util.concurrent.Executor;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ThreadFactory;
 
 /**
- * Runs state-persistence operations (switchVersion / markSuccess / setUuid /
- * setLocalHashInfo) on a dedicated single background thread.
- *
- * These operations only read/modify SharedPreferences via a synchronous
- * commit(); they were previously dispatched to the UI thread purely to
- * serialize them. markSuccess in particular runs on every cold start, so doing
- * its blocking disk write on the main thread caused jank/ANR on low-end
- * devices. A single-thread executor preserves the same serialization guarantee
- * while keeping the disk I/O off the UI thread.
+ * Runs a module operation on a given executor and rejects its promise with
+ * the operation's error code when it throws; the operation resolves the
+ * promise itself.
  *
- * Note: reload/restart operations must still run on the UI thread and therefore
- * keep using {@link UiThreadRunner}.
+ * State-persistence operations (switchVersion / markSuccess / setUuid /
+ * setLocalHashInfo / reset / config) go to {@link #STATE_SERIAL}, a single
+ * background thread: they only read/modify SharedPreferences via a
+ * synchronous commit(), and were once dispatched to the UI thread purely to
+ * serialize them. markSuccess runs on every cold start, so its blocking disk
+ * write on the main thread caused jank/ANR on low-end devices; one worker
+ * keeps the serialization in submission order without that. Only the React
+ * reload itself still hops to {@link #UI_THREAD}.
  */
 final class StateSerialRunner {
     interface Operation {
         void run() throws Throwable;
     }
 
-    // Single worker thread -> operations stay serialized in submission order,
-    // matching the previous UI-thread behavior. The thread is named so it is
-    // identifiable in thread dumps / ANR traces when diagnosing persistence.
-    private static final Executor EXECUTOR = Executors.newSingleThreadExecutor(
-        new ThreadFactory() {
-            @Override
-            public Thread newThread(Runnable r) {
-                return new Thread(r, "pushy-state-serial");
-            }
-        });
+    // Named so it is identifiable in thread dumps / ANR traces.
+    static final Executor STATE_SERIAL = Threads.single("pushy-state-serial", false);
+    static final Executor UI_THREAD = UiThreadUtil::runOnUiThread;
 
     private StateSerialRunner() {
     }
 
     static void run(
-        @Nullable final Promise promise,
+        Executor executor,
+        final Promise promise,
         final String errorCode,
         final String operationName,
         final Operation operation
     ) {
-        EXECUTOR.execute(new Runnable() {
-            @Override
-            public void run() {
-                try {
-                    operation.run();
-                } catch (Throwable error) {
-                    if (promise != null) {
-                        promise.reject(errorCode, operationName + " failed", error);
-                    } else {
-                        Log.e(Texts.LOG_TAG, operationName + " failed", error);
-                    }
-                }
+        executor.execute(() -> {
+            try {
+                operation.run();
+            } catch (Throwable error) {
+                promise.reject(errorCode, operationName + " failed", error);
             }
         });
     }