You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add @capgo/react-native-updater: React Native native module (iOS/Android) that speaks Capgo /updates + /stats and applies Capgo file-level delta manifests (SHA-256 + optional Brotli), same backend contract as @capgo/capacitor-updater.
Add @capgo/rn-cli (capgo-rn): Metro export of index.android.bundle + main.jsbundle + assets, then upload via @capgo/cli bundle upload --delta.
Extend @capgo/cli so upload/delta/brotli detection accepts @capgo/react-native-updater, and skip Capacitor index.html / notifyAppReady checks for RN export folders.
Motivation (AI generated)
React Native teams need Capgo-style OTA with the same Capgo Cloud delta system (not binary bspatch). This mirrors the RN integration pattern from zepto-labs/react-native-delta (JS bundle path override + check/download/apply), while reusing Capgo’s existing file-manifest delta pipeline end to end.
Business Impact (AI generated)
Opens Capgo live updates to React Native without forking storage/backend. One cloud, one delta format, new client + CLI surface.
Test Plan (AI generated)
bun run --cwd packages/rn-cli test
bun run --cwd packages/react-native-updater test
bun test ./cli/test/test-rn-updater-version.test.mjs
Wire a sample RN app: getJSBundleFile / getJSBundleURL, call notifyAppReady(), upload with capgo-rn upload <appId> --channel production, verify /updates returns manifest and only changed files download
Confirm Capacitor uploads still detect @capgo/capacitor-updater and require index.html / notifyAppReady unless --no-code-check
Added React Native live-update support for Android and iOS, including bundle downloads, activation, rollback, channels, progress events, and bundle status management.
Added a React Native CLI with bundle, upload, and initialization commands.
Added file-level delta updates with SHA-256 checksums and optional Brotli compression.
Bug Fixes
Improved updater detection for both Capacitor and React Native projects.
Added support for React Native Metro export layouts during validation.
Documentation
Added setup, integration, usage, and CLI guidance for React Native updates.
This change adds a React Native updater package with Android and iOS native implementations, a React Native bundling/upload CLI, updater-package detection in the existing CLI, related tests and documentation, and new Supabase user username typings.
Changes
React Native updater package
Layer / File(s)
Summary
Package contracts and native wiring packages/react-native-updater/src/*, packages/react-native-updater/package.json, packages/react-native-updater/ios/CapgoUpdater.m, packages/react-native-updater/react-native.config.js
sequenceDiagram
participant App as React Native app
participant Bridge as CapgoUpdater bridge
participant Server as Capgo update API
participant Storage as Bundle storage
App->>Bridge: getLatest(options)
Bridge->>Server: POST update metadata
Server-->>Bridge: version, URL, checksum, manifest
App->>Bridge: download(options)
Bridge->>Server: GET bundle files
Bridge->>Storage: validate and persist bundle
Storage-->>Bridge: bundle record
Bridge-->>App: download result and events
App->>Bridge: set({ id })
Bridge->>Storage: select current bundle
Loading
Suggested reviewers:dalanir, wcaleniewolny
🚥 Pre-merge checks | ✅ 3 | ❌ 2
❌ Failed checks (2 warnings)
Check name
Status
Explanation
Resolution
Description check
⚠️ Warning
Summary and test plan are present, but the required Screenshots and Checklist sections are missing.
Add the template sections for Screenshots and Checklist, and include checklist items plus concrete reproduction steps in Test plan.
Docstring Coverage
⚠️ Warning
Docstring coverage is 2.42% which is insufficient. The required threshold is 80.00%.
Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name
Status
Explanation
Title check
✅ Passed
The title accurately summarizes the main change: adding the React Native updater/CLI and file-level delta support.
Linked Issues check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
✅ Passed
Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches📝 Generate docstrings
Create stacked PR
Commit on current branch
Comment @coderabbitai help to get the list of available commands.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/commander@9.5.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm fast-xml-parser is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm yargs is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
No successful run was found on main (caa8138) during the generation of this report, so 6e178ee was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩
Introduce @capgo/react-native-updater and @capgo/rn-cli so RN apps can use
the same Capgo /updates + manifest delta path as Capacitor, plus CLI upload
wiring that detects the RN updater package.
Co-authored-by: Cursor <cursoragent@cursor.com>
Auto-sync on main regenerated types without the columns from the social
usernames migration, breaking backend typecheck against updated tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
We've triggered an ultrareview automatically — This PR introduces a new React Native native updater with file-level delta manifests, Brotli decompression, and state management across 42 files, modifying core CLI upload logic and package resolution.... I'll post findings when complete.
An ultrareview is cubic's deepest review, catching hard-to-find bugs in the most critical PRs. It runs a longer, multi-pass analysis using cubic's most capable review models, and typically takes around 30 minutes. It consumes your team's reviewed-lines allowance at 3× the standard rate.
Automated ultrareviews are disabled by default. We triggered this run as part of your trial. Want cubic to do this for every high-risk PR? Enable auto-ultrareview in your settings.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Cursor Bugbot did not complete (usage limit reached), so automated review is incomplete. Human review is required for this new React Native updater and CLI changes; reviewers assigned.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Cursor Bugbot did not complete (usage limit reached), so automated review is incomplete. Human review remains required; Dalanir and WcaleNieWolny are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Cursor Bugbot did not complete (usage limit reached), so automated review is incomplete. Human review is still required; two reviewers are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: Cursor Bugbot skipped (usage limit reached), so the required automated review did not complete. This PR adds a new native React Native updater and CLI upload changes that need human review.
Sent by Cursor Approval Agent: Pull Request Approver
Reject encrypted Capgo session keys until crypto is ported, canonicalize
manifest/zip paths under the bundle dir, and drop the ineffective
verification-metadata file.
Co-authored-by: Cursor <cursoragent@cursor.com>
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Not approving: Cursor Bugbot skipped (usage limit reached), so the required automated review did not complete. Human review is still required for this new native React Native updater and CLI changes; two reviewers are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Not approving: Cursor Bugbot skipped (usage limit reached), so the required automated review did not complete. Human review is still required for this native React Native updater and CLI changes; Dalanir and WcaleNieWolny are already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 28
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/react-native-updater/android/src/main/AndroidManifest.xml`:
- Around line 1-3: Add the android.permission.INTERNET uses-permission
declaration to the AndroidManifest manifest so the updater can perform HTTP
update checks and downloads when the host application does not declare network
access.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/BundleStore.kt`:
- Around line 55-85: Update BundleStore’s list, save, and upsert methods to
synchronize index mutations so concurrent list→modify→save operations cannot
overwrite each other. Make save write the JSON to a temporary file in the same
directory, then atomically replace bundles.json, preserving the existing index
contents on write failures and preventing readers from seeing partial JSON.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoDownloader.kt`:
- Around line 56-59: Update the download flow around request.url and downloadZip
to pass request.checksum through, then compute the downloaded ZIP’s SHA-256 and
compare it with that checksum before any extraction or activation. Abort the
update on mismatch, preserving the existing success stats only for verified
archives, and update all downloadZip call sites including the additional
referenced path.
- Around line 131-139: Refactor the download flow around findCachedByHash so the
existing cached bundles are recursively scanned and hashed once per download,
producing a hash-to-file index. Pass and reuse this index for each manifest
entry instead of rescanning the cache on every call, while preserving the
existing reuse and writeDownloadedFile behavior.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoHttp.kt`:
- Around line 42-55: Update postJson to check response.isSuccessful before
parsing the body as a JSONObject update payload. For non-2xx responses, return
or surface an error result containing the HTTP status and response details so
getLatest cannot interpret the failure as updateAvailable; preserve the existing
JSON parsing and invalid_json fallback for successful responses.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoUpdaterModule.kt`:
- Around line 177-181: Reorder the operations in CapgoUpdaterModule: resolve the
promise with bundleToMap(record) before invoking CapgoUpdater.reload for the
selected-bundle flow at
packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoUpdaterModule.kt
lines 177-181, and apply the same resolve-before-reload ordering for the
builtin-bundle flow at lines 208-210.
- Around line 134-164: Enforce successful terminal status before activation: in
packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoUpdaterModule.kt:134-164,
update the download failure path to persist the record as error and remove
partial files; at :172-180, require record.status == "success" in set; at
:193-197, require successful status and complete files in next; and in
packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoUpdater.kt:27-36,
allow promotion only for successful records.
- Around line 182-184: Read and store the nullable option ID before entering the
try/catch surrounding the set operation, using the existing options access
pattern and guarding missing or null values as needed. Update the catch block to
reuse that captured ID in CapgoHttp.sendStats instead of calling
options.getString("id") again, ensuring the failure path can always reach
promise.reject.
In `@packages/react-native-updater/ios/CapgoBrotli.swift`:
- Around line 13-32: Update decodeBrotli to avoid relying on the fixed 6×/64 KiB
dstCapacity guess. Use compression_stream or a retry loop that enlarges the
output buffer when compression_decode_buffer cannot fit the decoded payload,
while preserving successful Data output and the existing failure error.
In `@packages/react-native-updater/ios/CapgoUpdater.swift`:
- Around line 364-389: Update set and next to validate the requested bundle ID
using the index and confirm its bundle file exists before writing
capgo_current_bundle_id or capgo_next_bundle_id. Reject unknown or incomplete
IDs and return without persisting preferences or sending stats; preserve the
existing success flow for valid bundles.
- Around line 255-274: Update the ZIP download flow in the updater method
containing the manifest and url branches to compute the downloaded archive’s
SHA-256 checksum and compare it with the supplied checksum before extraction or
marking the bundle successful. Reject the download on mismatch, while preserving
the existing behavior for valid ZIP downloads and the manifest branch.
- Around line 375-377: Remove the exit(0) termination from the set and reset
activation paths in CapgoUpdater.swift. Replace it with React Native bridge
reload behavior, or defer activation until the next normal app launch, while
preserving the existing update/reset flow and avoiding host-process termination.
- Around line 40-49: Update applyPendingNext() to check capgo_app_ready before
promoting the pending bundle. Persist the current bundle ID as the previous
bundle when applying an update, and if the prior launch was not marked ready,
restore that previous bundle instead of promoting the pending one; ensure the
relevant UserDefaults keys are updated consistently.
- Around line 193-196: Replace the whole-file loading in sha256(path:) and the
related download/archive/install flows with file-backed URLSessionDownloadTask
handling and incremental SHA-256 updates. Stream response data directly to disk,
then hash files in chunks rather than loading them into Data, preserving the
existing checksum and processing behavior while avoiding simultaneous full-size
allocations.
- Around line 161-183: Refactor postJson to avoid semaphore-based synchronous
waiting and expose an asynchronous completion or async/throws result to its
callers. Configure explicit request and resource timeouts on the
URLSession/request, and update every caller of postJson to await or handle the
asynchronous result while preserving JSON parsing and error propagation.
- Around line 218-233: Update the response maps in the updater callback around
sendEvent and resolve to avoid storing Swift optionals as Any: conditionally add
optional error fields so missing values are omitted, and validate required
version, URL, and session_key fields before constructing or resolving the
success map. Preserve the existing noNeedUpdate event and resolution behavior
while ensuring all emitted values are React Native-compatible.
- Around line 118-121: Update saveIndex(_:) to write the serialized bundle index
atomically, using a temporary file and replacing or renaming the existing index
only after the write succeeds. Stop suppressing serialization and file-write
errors; propagate failures through the saveIndex(_:) API and its callers so
unsuccessful updates are observable.
In `@packages/react-native-updater/ios/CapgoZip.swift`:
- Around line 24-33: Update the ZIP entry parsing flow around nameData and
payload in CapgoZip.swift to validate every computed range before calling
Data.subdata(in:), including the filename range and payload range derived from
nameLen, extraLen, and compSize. Throw the existing extraction NSError with a
clear invalid or truncated entry message when any range exceeds data.count,
while preserving normal parsing for valid entries.
- Around line 82-101: Update the decompression logic around the stream
processing in CapgoZip to decode in bounded output chunks, enforce a maximum
extracted-size limit independent of the ZIP header’s expectedSize, and continue
processing until the stream reaches COMPRESSION_STATUS_END. Treat
COMPRESSION_STATUS_OK as incomplete rather than success, rejecting streams that
exceed the cap or cannot reach END, and only return the fully decoded output
after successful completion.
In `@packages/react-native-updater/README.md`:
- Around line 34-40: Update the AppDelegate release bundle URL guidance to fall
back to the packaged bundle URL when CapgoUpdater.getJSBundleURL() returns nil,
preserving the Capgo URL when available. Reference CapgoUpdater.getJSBundleURL()
and the existing packaged-bundle URL implementation, and ensure first and reset
installations always return a valid release bundle.
In `@packages/react-native-updater/src/definitions.ts`:
- Around line 1-4: Keep ManifestEntry nullable for server responses, and
introduce a separate request manifest type with required file_name and
download_url while omitting file_hash. Update DownloadOptions.manifest and the
download flow to use this request-only type, ensuring LatestVersion.manifest is
validated or transformed before being passed to download rather than forwarding
nullable fields to the Android bridge.
In `@packages/react-native-updater/src/index.ts`:
- Around line 68-73: Update addListener in the unlinked-emitter branch to throw
the existing LINKING_ERROR instead of returning a no-op remove subscription.
Preserve the current emitter.addListener registration and removal behavior when
the native module is linked.
In `@packages/rn-cli/README.md`:
- Around line 27-32: Add the text language identifier to the fenced
export-layout example in the README, changing the opening fence before
.capgo-rn/export/ while leaving the example contents unchanged.
In `@packages/rn-cli/src/bundle.ts`:
- Around line 66-95: Wrap the export loop and its bundle-output validation in a
try/catch so failures from run or the missing-output check stop the spinner
before propagating. In the catch associated with the spinner started by the
export flow, stop it with a failure message, then rethrow the original error;
preserve the existing success stop and completion logging.
- Around line 15-21: Update the run function’s spawn options to avoid the
Windows shell fallback: keep shell disabled and invoke a direct Windows-safe
executable path so --entry-file and other args remain literal argv values.
Preserve the existing exit and error handling behavior.
In `@packages/rn-cli/src/upload.ts`:
- Around line 60-70: Validate the delta options in the upload flow before
invoking Capgo: reject configurations where `options.delta === false` and
`options.deltaOnly` is enabled. Keep the existing argument construction for
valid combinations, ensuring `--delta-only` is never forwarded without
`--delta`.
- Around line 23-30: Update the run function’s spawn invocation to avoid shell
parsing on Windows by removing the platform-based shell option or otherwise
using a Windows-safe direct executable/.cmd launcher. Preserve the existing cwd,
stdio, environment, and exit/error handling behavior.
In `@packages/rn-cli/test/export-layout.test.ts`:
- Around line 7-18: Update the test expected Capgo delta folder shape to
exercise production behavior through runBundle rather than creating the asserted
files directly. Mock the Metro executable and invoke runBundle, then retain
assertions for index.android.bundle, main.jsbundle, and assets/img.png;
alternatively, test the production layout validator if that is the exposed
implementation path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: df7fe8be-4676-4afc-8d1e-e6db7da07d62
📥 Commits
Reviewing files that changed from the base of the PR and between caa8138 and 33939ef.
Declare the network permission required by the updater.
The module performs HTTP downloads, but its merged manifest contributes no android.permission.INTERNET; host apps that do not already declare it cannot check or download updates.
‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/react-native-updater/android/src/main/AndroidManifest.xml` around
lines 1 - 3, Add the android.permission.INTERNET uses-permission declaration to
the AndroidManifest manifest so the updater can perform HTTP update checks and
downloads when the host application does not declare network access.
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Make bundle-index updates synchronized and atomic.
Concurrent downloads execute list → modify → save on a cached thread pool, so one upsert can overwrite another. Directly writing bundles.json also lets readers observe truncated JSON; Line 70 then silently converts that corruption into an empty index, enabling subsequent permanent data loss.
Serialize index mutations and write a temporary file followed by an atomic replacement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/BundleStore.kt`
around lines 55 - 85, Update BundleStore’s list, save, and upsert methods to
synchronize index mutations so concurrent list→modify→save operations cannot
overwrite each other. Make save write the JSON to a temporary file in the same
directory, then atomically replace bundles.json, preserving the existing index
contents on write failures and preventing readers from seeing partial JSON.
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
Verify the full ZIP against request.checksum before extraction.
The ZIP path never consumes the supplied checksum, yet the downloaded JavaScript is subsequently activated. A corrupted or tampered archive can therefore be installed despite the advertised SHA-256 contract.
Pass the checksum into downloadZip, compare it with sha256(zipFile), and abort before extraction on mismatch.
Also applies to: 201-217
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoDownloader.kt`
around lines 56 - 59, Update the download flow around request.url and
downloadZip to pass request.checksum through, then compute the downloaded ZIP’s
SHA-256 and compare it with that checksum before any extraction or activation.
Abort the update on mismatch, preserving the existing success stats only for
verified archives, and update all downloadZip call sites including the
additional referenced path.
The reason will be displayed to describe this comment to others. Learn more.
🚀 Performance & Scalability | 🟠 Major | 🏗️ Heavy lift
Build the cache hash index once per download.
For every manifest entry, findCachedByHash recursively rereads and hashes every file in every existing bundle. A manifest and cached bundle containing (N) files require roughly (N²) full-file reads, making large delta updates unnecessarily slow and battery-intensive.
Also applies to: 183-199
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoDownloader.kt`
around lines 131 - 139, Refactor the download flow around findCachedByHash so
the existing cached bundles are recursively scanned and hashed once per
download, producing a hash-to-file index. Pass and reuse this index for each
manifest entry instead of rescanning the cache on every call, while preserving
the existing reuse and writeDownloadedFile behavior.
#!/bin/bash# Verify every postJson caller and whether HTTP status is handled elsewhere.
rg -n -C4 '\bpostJson\s*\(|\bisSuccessful\b' packages/react-native-updater/android
Repository: Cap-go/capgo.app
Length of output: 5044
🏁 Script executed:
#!/bin/bashset -euo pipefail
echo'--- CapgoHttp.kt ---'
sed -n '1,220p' packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoHttp.kt
echoecho'--- CapgoUpdaterModule.kt ---'
sed -n '1,180p' packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoUpdaterModule.kt
Handle non-2xx responses before treating the body as an update payload.postJson always parses the response body, so a 4xx/5xx JSON response without an error field can still flow through getLatest as updateAvailable with empty or invalid fields. Check response.isSuccessful and surface the HTTP failure instead.
🧰 Tools🪛 ast-grep (0.44.1)
[error] 42-43: An outbound HTTP request is built from a non-literal URL: URL(...).openConnection(), OkHttp's Request.Builder().url(...), or a Spring RestTemplate call (getForObject/getForEntity/postForObject/postForEntity/exchange/execute). When the URL is derived from a variable, method call, concatenation, or interpolation, an attacker can point the request at internal services, cloud metadata endpoints (e.g. 169.254.169.254), or arbitrary hosts (Server-Side Request Forgery). Do not build request targets from untrusted input: validate the URL against a strict allowlist of permitted hosts/schemes, resolve and re-check the host after DNS resolution, and reject internal/link-local/loopback addresses before connecting.
Context: Request.Builder()
.url(url)
Note: [CWE-918] Server-Side Request Forgery (SSRF).
(ssrf-outbound-request-tainted-url-kotlin)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@packages/react-native-updater/android/src/main/java/app/capgo/rnupdater/CapgoHttp.kt`
around lines 42 - 55, Update postJson to check response.isSuccessful before
parsing the body as a JSONObject update payload. For non-2xx responses, return
or surface an error result containing the HTTP status and response details so
getLatest cannot interpret the failure as updateAvailable; preserve the existing
JSON parsing and invalid_json fallback for successful responses.
#!/bin/bashset -euo pipefail
printf'\n## runBundle usages\n'
rg -n "runBundle\\(" packages/rn-cli/src
printf'\n## full bundle.ts with line numbers around the loop\n'
cat -n packages/rn-cli/src/bundle.ts | sed -n '50,120p'printf'\n## upload.ts for the same spawn pattern\n'
cat -n packages/rn-cli/src/upload.ts | sed -n '1,120p'
Repository: Cap-go/capgo.app
Length of output: 5884
Avoid the Windows shell fallback here.shell: true on line 17 lets cmd.exe parse --entry-file and the other CLI values as shell syntax instead of literal argv items, so user-controlled input can become command injection. Keep shell: false and use a direct Windows-safe executable path instead.
🧰 Tools🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from 'node:child_process'
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/rn-cli/src/bundle.ts` around lines 15 - 21, Update the run
function’s spawn options to avoid the Windows shell fallback: keep shell
disabled and invoke a direct Windows-safe executable path so --entry-file and
other args remain literal argv values. Preserve the existing exit and error
handling behavior.
A rejected run() call or the missing-output error bypasses Line 94, leaving an active spinner before the top-level error is printed. Wrap the export loop in try/catch, stop it with a failure message, then rethrow.
Proposed fix
const s = spinner()
s.start(`Exporting Metro bundles (${platforms.join(', ')})`)
- for (const platform of platforms) {- // export work+ try {+ for (const platform of platforms) {+ // export work+ }+ s.stop(color.green(`Export ready at ${out}`))+ }+ catch (error) {+ s.stop(color.red('Export failed'))+ throw error
}
-- s.stop(color.green(`Export ready at ${out}`))
📝 Committable suggestion
‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
consts=spinner()
s.start(`Exporting Metro bundles (${platforms.join(', ')})`)
constmetroBin=findMetroBin(project)
constuseNode=metroBin.endsWith('.js')
for(constplatformofplatforms){
constbundleOut=platform==='ios'
? join(out,'main.jsbundle')
: join(out,'index.android.bundle')
constassetsDest=join(out,'assets')
constargs=[
...(useNode ? [metroBin] : []),
'bundle',
'--platform',platform,
'--dev',options.dev ? 'true' : 'false',
'--entry-file',entryFile,
'--bundle-output',bundleOut,
'--assets-dest',assetsDest,
'--reset-cache',
]
constcmd=useNode ? process.execPath : metroBin
awaitrun(cmd,args,project)
if(!existsSync(bundleOut)){
thrownewError(`Metro did not produce ${bundleOut}`)
}
}
s.stop(color.green(`Export ready at ${out}`))
log.info(`Files: ${readdirSync(out).join(', ')}`)
consts=spinner()
s.start(`Exporting Metro bundles (${platforms.join(', ')})`)
constmetroBin=findMetroBin(project)
constuseNode=metroBin.endsWith('.js')
try{
for(constplatformofplatforms){
constbundleOut=platform==='ios'
? join(out,'main.jsbundle')
: join(out,'index.android.bundle')
constassetsDest=join(out,'assets')
constargs=[
...(useNode ? [metroBin] : []),
'bundle',
'--platform',platform,
'--dev',options.dev ? 'true' : 'false',
'--entry-file',entryFile,
'--bundle-output',bundleOut,
'--assets-dest',assetsDest,
'--reset-cache',
]
constcmd=useNode ? process.execPath : metroBin
awaitrun(cmd,args,project)
if(!existsSync(bundleOut)){
thrownewError(`Metro did not produce ${bundleOut}`)
}
}
s.stop(color.green(`Export ready at ${out}`))
}
catch(error){
s.stop(color.red('Export failed'))
throwerror
}
log.info(`Files: ${readdirSync(out).join(', ')}`)
🧰 Tools🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from 'node:child_process'
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/rn-cli/src/bundle.ts` around lines 66 - 95, Wrap the export loop and
its bundle-output validation in a try/catch so failures from run or the
missing-output check stop the spinner before propagating. In the catch
associated with the spinner started by the export flow, stop it with a failure
message, then rethrow the original error; preserve the existing success stop and
completion logging.
Do not route this spawn through cmd.exe on Windows.shell: process.platform === 'win32' lets CLI-controlled paths and flags be parsed by the shell, so legitimate values with metacharacters can break or redirect the upload. Spawn the executable directly, or use a Windows-safe .cmd launcher without shell parsing.
🧰 Tools🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from 'node:child_process'
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/rn-cli/src/upload.ts` around lines 23 - 30, Update the run
function’s spawn invocation to avoid shell parsing on Windows by removing the
platform-based shell option or otherwise using a Windows-safe direct
executable/.cmd launcher. Preserve the existing cwd, stdio, environment, and
exit/error handling behavior.
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Reject conflicting --no-delta and --delta-only options.
The current logic can omit --delta while still forwarding --delta-only. Validate these options as mutually exclusive before invoking Capgo.
Proposed fix
const useDelta = options.delta !== false
+ if (!useDelta && options.deltaOnly) {+ throw new Error('--delta-only cannot be combined with --no-delta')+ }+
const args = [
📝 Committable suggestion
‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
constuseDelta=options.delta!==false
constargs=[
'bundle','upload',
appId,
'--path',exportPath,
'--channel',options.channel,
'--no-code-check',
]
if(useDelta)args.push('--delta')
if(options.deltaOnly)args.push('--delta-only')
constuseDelta=options.delta!==false
if(!useDelta&&options.deltaOnly){
thrownewError('--delta-only cannot be combined with --no-delta')
}
constargs=[
'bundle','upload',
appId,
'--path',exportPath,
'--channel',options.channel,
'--no-code-check',
]
if(useDelta)args.push('--delta')
if(options.deltaOnly)args.push('--delta-only')
🧰 Tools🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from 'node:child_process'
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/rn-cli/src/upload.ts` around lines 60 - 70, Validate the delta
options in the upload flow before invoking Capgo: reject configurations where
`options.delta === false` and `options.deltaOnly` is enabled. Keep the existing
argument construction for valid combinations, ensuring `--delta-only` is never
forwarded without `--delta`.
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
Exercise the production export logic instead of recreating its expected output.
This test writes every asserted file itself, so changes that break runBundle cannot fail the test. Invoke runBundle with a mocked Metro executable, or extract and test the production layout validator.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/rn-cli/test/export-layout.test.ts` around lines 7 - 18, Update the
test expected Capgo delta folder shape to exercise production behavior through
runBundle rather than creating the asserted files directly. Mock the Metro
executable and invoke runBundle, then retain assertions for
index.android.bundle, main.jsbundle, and assets/img.png; alternatively, test the
production layout validator if that is the exposed implementation path.
The reason will be displayed to describe this comment to others. Learn more.
1 issue found across 5 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="packages/react-native-updater/android/build.gradle">
<violation number="1" location="packages/react-native-updater/android/build.gradle:26">
P3: This comment does not suppress the intended `text:S8569` finding: `NOSONAR` applies only to issues raised on the comment's own line, not subsequent Gradle declarations. Consider a scoped `sonar.issue.ignore.multicriteria` entry for this rule and file instead.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
The reason will be displayed to describe this comment to others. Learn more.
P3: This comment does not suppress the intended text:S8569 finding: NOSONAR applies only to issues raised on the comment's own line, not subsequent Gradle declarations. Consider a scoped sonar.issue.ignore.multicriteria entry for this rule and file instead.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/react-native-updater/android/build.gradle, line 26:
<comment>This comment does not suppress the intended `text:S8569` finding: `NOSONAR` applies only to issues raised on the comment's own line, not subsequent Gradle declarations. Consider a scoped `sonar.issue.ignore.multicriteria` entry for this rule and file instead.</comment>
<file context>
@@ -23,6 +23,7 @@ android {
}
}
+// NOSONAR text:S8569 - library pins versions; consuming app owns Gradle dependency locking
configurations.configureEach {
resolutionStrategy {
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
riderx
force-pushed
the
feat/react-native-updater-cli
branch
from
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary (AI generated)
@capgo/react-native-updater: React Native native module (iOS/Android) that speaks Capgo/updates+/statsand applies Capgo file-level delta manifests (SHA-256 + optional Brotli), same backend contract as@capgo/capacitor-updater.@capgo/rn-cli(capgo-rn): Metro export ofindex.android.bundle+main.jsbundle+ assets, then upload via@capgo/cli bundle upload --delta.@capgo/cliso upload/delta/brotli detection accepts@capgo/react-native-updater, and skip Capacitorindex.html/notifyAppReadychecks for RN export folders.Motivation (AI generated)
React Native teams need Capgo-style OTA with the same Capgo Cloud delta system (not binary bspatch). This mirrors the RN integration pattern from zepto-labs/react-native-delta (JS bundle path override + check/download/apply), while reusing Capgo’s existing file-manifest delta pipeline end to end.
Business Impact (AI generated)
Opens Capgo live updates to React Native without forking storage/backend. One cloud, one delta format, new client + CLI surface.
Test Plan (AI generated)
bun run --cwd packages/rn-cli testbun run --cwd packages/react-native-updater testbun test ./cli/test/test-rn-updater-version.test.mjsgetJSBundleFile/getJSBundleURL, callnotifyAppReady(), upload withcapgo-rn upload <appId> --channel production, verify/updatesreturnsmanifestand only changed files download@capgo/capacitor-updaterand requireindex.html/notifyAppReadyunless--no-code-checkGenerated with AI
Made with Cursor
Summary by CodeRabbit