fix: package parsing, aab handling and diff stream robustness

- anchor and escape native bundle lookup patterns so .map/.backup
  entries can no longer shadow the real bundle's bundleHash
- only fall back to npx node-bundletool on spawn ENOENT; surface all
  other bundletool failures as-is
- extract the universal APK for aab uploads into a private mkdtemp dir
- propagate write/read stream errors when producing diff zips and
  extracting universal.apk
- in the stream diff path, adopt the HBC-transformed patch only when
  it is smaller than the raw baseline (same rule as the in-memory path)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sunnylqm

src/diff.ts

@@ -113,7 +113,10 @@ function createOutputZip(output: string) {
   const zipfile = new YazlZipFile();
   const writePromise = new Promise<void>((resolve, reject) => {
     zipfile.outputStream.on('error', reject);
-    zipfile.outputStream.pipe(fs.createWriteStream(output)).on('close', () => {
+    const writeStream = fs.createWriteStream(output);
+    // without this, a full disk / read-only target left the promise pending
+    writeStream.on('error', reject);
+    zipfile.outputStream.pipe(writeStream).on('close', () => {
       resolve(void 0);
     });
   });
@@ -248,18 +251,13 @@ async function buildStreamBundlePatch(
     originBuffer && newBuffer
       ? tryTransformPair(originBuffer, newBuffer)
       : null;
-  const oldFile = pair
-    ? path.join(tempRoot, 'old-transformed.bin')
-    : rawOldFile;
-  const newFile = pair
-    ? path.join(tempRoot, 'new-transformed.bin')
-    : rawNewFile;
-  const patchFile = path.join(tempRoot, 'patch.bin');
+  const transformedOldFile = path.join(tempRoot, 'old-transformed.bin');
+  const transformedNewFile = path.join(tempRoot, 'new-transformed.bin');
 
   if (pair) {
     await Promise.all([
-      fs.writeFile(oldFile, pair.tOld),
-      fs.writeFile(newFile, pair.tNew),
+      fs.writeFile(transformedOldFile, pair.tOld),
+      fs.writeFile(transformedNewFile, pair.tNew),
     ]);
   }
   reportDiffPhase(options, {
@@ -268,9 +266,29 @@ async function buildStreamBundlePatch(
     inputBytes,
   });
 
+  // 与内存路径同一约束:变换候选连同元数据开销必须比 baseline 更小才采用,
+  // 因此变换命中时两个候选都要生成再比较。
   phaseStartedAt = performance.now();
-  await diffStreamFn(oldFile, newFile, patchFile);
-  const patchBytes = (await fs.stat(patchFile)).size;
+  const rawPatchFile = path.join(tempRoot, 'patch-raw.bin');
+  await diffStreamFn(rawOldFile, rawNewFile, rawPatchFile);
+  let patchFile = rawPatchFile;
+  let patchBytes = (await fs.stat(rawPatchFile)).size;
+  let chosenPair: typeof pair = null;
+  if (pair) {
+    const transformedPatchFile = path.join(tempRoot, 'patch-transformed.bin');
+    await diffStreamFn(
+      transformedOldFile,
+      transformedNewFile,
+      transformedPatchFile,
+    );
+    const transformedPatchBytes = (await fs.stat(transformedPatchFile)).size;
+    const metaOverhead = Buffer.byteLength(JSON.stringify(pair.meta));
+    if (transformedPatchBytes + metaOverhead < patchBytes) {
+      patchFile = transformedPatchFile;
+      patchBytes = transformedPatchBytes;
+      chosenPair = pair;
+    }
+  }
   reportDiffPhase(options, {
     phase: 'diff',
     durationMs: performance.now() - phaseStartedAt,
@@ -280,13 +298,21 @@ async function buildStreamBundlePatch(
 
   // 变换路径必须验证 T⁻¹ 和元数据;未声明自校验的自定义 diff 也保留
   // round-trip。node-hdiffpatch native 普通路径已经在返回前完整验证。
-  if (pair || !options.streamOutputVerified) {
+  if (chosenPair || !options.streamOutputVerified) {
     phaseStartedAt = performance.now();
     const restoredFile = path.join(tempRoot, 'restored.bin');
-    await patchStreamFn(oldFile, patchFile, restoredFile);
-    if (pair) {
+    await patchStreamFn(
+      chosenPair ? transformedOldFile : rawOldFile,
+      patchFile,
+      restoredFile,
+    );
+    if (chosenPair) {
       const restoredRaw = await fs.readFile(restoredFile);
-      const restored = transformHbcWithLayout(restoredRaw, pair.layout, true);
+      const restored = transformHbcWithLayout(
+        restoredRaw,
+        chosenPair.layout,
+        true,
+      );
       if (
         !restored ||
         !newBuffer ||
@@ -315,7 +341,7 @@ async function buildStreamBundlePatch(
 
   return {
     patch: { kind: 'file', path: patchFile },
-    ...(pair ? { hbcTransform: pair.meta } : {}),
+    ...(chosenPair ? { hbcTransform: chosenPair.meta } : {}),
   };
 }
 

src/package.ts

@@ -270,10 +270,12 @@ export const packageCommands = {
   }) => {
     const source = ensureFileByExt(args[0], '.aab', 'usageUploadAab');
 
-    const output = path.join(
-      os.tmpdir(),
-      `${path.basename(source, path.extname(source))}-${Date.now()}.apk`,
+    // private temp dir: unpredictable path, safe against symlink squatting in
+    // the shared tmpdir and against concurrent uploads of same-named AABs
+    const tempRoot = await fs.mkdtemp(
+      path.join(os.tmpdir(), 'rnu-aab-upload-'),
     );
+    const output = path.join(tempRoot, 'universal.apk');
 
     const includeAllSplits = parseBooleanOption(options.includeAllSplits);
     const splits = parseCsvOption(options.splits);
@@ -289,9 +291,7 @@ export const packageCommands = {
         options,
       });
     } finally {
-      if (await fs.pathExists(output)) {
-        await fs.remove(output);
-      }
+      await fs.remove(tempRoot);
     }
   },
   uploadApp: async ({

src/utils/app-info-parser/aab.ts

@@ -88,7 +88,14 @@ export class AabParser extends Zip {
           '--overwrite',
           ...modulesArgs,
         ]);
-      } catch (_e) {
+      } catch (e) {
+        // Only fall back when bundletool itself is missing from PATH (spawn
+        // ENOENT). Any other failure (corrupt AAB, Java issues, bad args,
+        // non-zero exit) must surface as-is instead of being masked by an
+        // online npx install.
+        if ((e as NodeJS.ErrnoException)?.code !== 'ENOENT') {
+          throw e;
+        }
         // Fallback to npx node-bundletool if bundletool is not in PATH
         // We use -y to avoid interactive prompt for installation
         if (await needsNpxDownload()) {
@@ -140,6 +147,7 @@ export class AabParser extends Zip {
                   zipfile.close();
                   resolve();
                 });
+                readStream.on('error', reject);
                 writeStream.on('error', reject);
               });
             } else {

src/utils/index.ts

@@ -153,8 +153,11 @@ async function sha256(data: Buffer | Blob): Promise<string> {
   return createHash('sha256').update(buffer).digest('hex');
 }
 
-const ApkBundleFileName = /assets\/index.android.bundle/;
-const ApkUpdateJsonName = /res\/raw\/update.json/;
+// Anchored exact paths: unanchored/unescaped patterns also matched entries
+// like index.android.bundle.map or .backup, and a later match would silently
+// overwrite the real bundle, registering a wrong bundleHash.
+export const ApkBundleFileName = /^assets\/index\.android\.bundle$/;
+const ApkUpdateJsonName = /^res\/raw\/update\.json$/;
 
 export async function getApkInfo(fn: string) {
   const appInfoParser = new AppInfoParser(fn);
@@ -208,9 +211,9 @@ export async function getAppInfo(fn: string) {
   // single scan (and single nested .hap extraction) for all three entries
   const [bundleFile, updateJsonFile, metaJsonFile] =
     await appInfoParser.parser.getEntriesFromHarmonyApp([
-      /rawfile\/bundle.harmony.js/,
-      /rawfile\/update.json/,
-      /rawfile\/meta.json/,
+      /^resources\/rawfile\/bundle\.harmony\.js$/,
+      /^resources\/rawfile\/update\.json$/,
+      /^resources\/rawfile\/meta\.json$/,
     ]);
   if (!bundleFile) {
     throw new Error(
@@ -244,12 +247,14 @@ export async function getAppInfo(fn: string) {
   };
 }
 
-const IpaBundleFileName = /payload\/.+?\.app\/main.jsbundle/;
-const IpaUpdateJsonName = /payload\/.+?\.app\/assets\/update.json/;
-const IpaBuildTimeName = /payload\/.+?\.app\/pushy_build_time.txt/;
+// lowercase because the zip reader also matches against the lowercased entry
+// name (real IPAs use "Payload/")
+export const IpaBundleFileName = /^payload\/[^/]+\.app\/main\.jsbundle$/;
+const IpaUpdateJsonName = /^payload\/[^/]+\.app\/assets\/update\.json$/;
+const IpaBuildTimeName = /^payload\/[^/]+\.app\/pushy_build_time\.txt$/;
 // Not in root bundle when use `use_frameworks`
 const IpaBuildTimeFrameworkName =
-  /payload\/.+?\.app\/frameworks\/react_native_update.framework\/pushy_build_time.txt/;
+  /^payload\/[^/]+\.app\/frameworks\/react_native_update\.framework\/pushy_build_time\.txt$/;
 
 export async function getIpaInfo(fn: string) {
   const appInfoParser = new AppInfoParser(fn);

tests/app-info-zip.test.ts

@@ -3,6 +3,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { ZipFile as YazlZipFile } from 'yazl';
+import { ApkBundleFileName, IpaBundleFileName } from '../src/utils';
 import { IpaParser } from '../src/utils/app-info-parser/ipa';
 import { Zip } from '../src/utils/app-info-parser/zip';
 
@@ -63,6 +64,34 @@ describe('app-info-parser Zip', () => {
     expect((buffers['res/icon.png'] as Buffer).toString()).toBe('icon');
   });
 
+  test('bundle patterns only match the exact bundle entry, not .map/.backup siblings', async () => {
+    const apkPath = path.join(tempRoot, 'app.apk');
+    await writeZip(apkPath, {
+      'assets/index.android.bundle': 'REAL_BUNDLE',
+      // later entries used to overwrite the real match via the unanchored regex
+      'assets/index.android.bundle.map': 'SOURCE_MAP',
+      'assets/index.android.bundle.backup': 'BACKUP',
+      'foo/assets/index.android.bundle.tmp': 'TMP',
+    });
+
+    const apkEntries = await new Zip(apkPath).getEntries([ApkBundleFileName]);
+    expect((apkEntries[String(ApkBundleFileName)] as Buffer).toString()).toBe(
+      'REAL_BUNDLE',
+    );
+
+    const ipaPath = path.join(tempRoot, 'app-bundle.ipa');
+    await writeZip(ipaPath, {
+      'Payload/Test.app/main.jsbundle': 'REAL_IPA_BUNDLE',
+      'Payload/Test.app/main.jsbundle.map': 'IPA_SOURCE_MAP',
+      'Payload/Test.app/mainXjsbundle': 'NOT_A_BUNDLE',
+    });
+
+    const ipaEntries = await new Zip(ipaPath).getEntries([IpaBundleFileName]);
+    expect((ipaEntries[String(IpaBundleFileName)] as Buffer).toString()).toBe(
+      'REAL_IPA_BUNDLE',
+    );
+  });
+
   test('parses ipa plist with current plist package exports', async () => {
     const ipaPath = path.join(tempRoot, 'app.ipa');
     await writeZip(ipaPath, {

tests/diff-stream.test.ts

@@ -310,6 +310,38 @@ describe('hdiff with bundleStreamThreshold (large-bundle stream path)', () => {
     },
   );
 
+  itIfStream(
+    'stream path drops the hbc transform when its patch is not smaller than baseline',
+    async () => {
+      // 该 diff 把补丁写成完整的 new 内容:raw/transformed 两个候选大小
+      // 几乎一致,加上元数据开销后变换候选必然不占优,必须回退 baseline
+      const copyDiff = (_o: string, n: string, out: string) => {
+        fs.writeFileSync(out, fs.readFileSync(n));
+        return out;
+      };
+      const copyPatch = (_o: string, d: string, out: string) => {
+        fs.writeFileSync(out, fs.readFileSync(d));
+        return out;
+      };
+      const origin = fixture('v96-a.hbc');
+      const next = fixture('v96-b.hbc');
+      const files = await runHdiff(
+        { origin, next },
+        {
+          hbcTransform: true,
+          bundleStreamThreshold: 1,
+          customDiff: (loadHdiff() as HdiffFull).diff,
+          customDiffSingleStream: copyDiff,
+          customPatchSingleStream: copyPatch,
+        },
+      );
+      const manifest = JSON.parse(files['__diff.json'].toString('utf8'));
+      expect(manifest.hbcTransform).toBeUndefined();
+      // 采用的是 raw 基线候选:补丁内容就是未变换的 new bundle
+      expect(Buffer.compare(files['index.bundlejs.patch'], next)).toBe(0);
+    },
+  );
+
   itIfStream(
     'bundles below the threshold keep the in-memory single-format path',
     async () => {