Skip to content

feat: configurable android assetHost + chart-webview reuse fixes & iOS cold-start deeplink#62

Open
huhuanming wants to merge 17 commits into
mainfrom
feat/android-assethost
Open

feat: configurable android assetHost + chart-webview reuse fixes & iOS cold-start deeplink#62
huhuanming wants to merge 17 commits into
mainfrom
feat/android-assethost

Conversation

@huhuanming

Copy link
Copy Markdown
Contributor

概述

本分支聚合了 chart-webview 离线/复用相关的原生改动、iOS 冷启动本地通知深链能力,以及可配置的 Android assetHost,并 bump 版本到 3.0.57。

主要改动

chart-webview

  • 离线图表打点 + warm-driver:预热与离线加载链路的可观测性。
  • Android pause-when-idle + attach 重试 + debug 开关:复用场景下提升稳定性。
  • forceDetach on pooled dispose(parent-checked):修复 Android 复用时白屏 / 卡 loading。
  • 可配置 assetHost:新增 Android assetHost 配置项(ChartWebview.nitro.ts)。
  • 收尾去掉临时 debug 打点,保留必要 native log。

device-utils

  • getAndClearColdStartLocalNotification:支持 iOS 冷启动本地通知深链 (OK-55681)。

其他

  • 各 native module package.json 版本号 bump 至 3.0.57。

影响范围

  • iOS: ChartWebview.swift, ReactNativeDeviceUtils.swift
  • Android: ChartWebview.kt, PooledChartWebView.kt, ReactNativeDeviceUtils.kt
  • TS specs: ChartWebview.nitro.ts, ReactNativeDeviceUtils.nitro.ts

测试

  • iOS 图表预热/秒开 & 冷启动深链
  • Android 图表复用白屏/卡 loading 回归

huhuanming added 13 commits June 9, 2026 19:01
… cold-start deep-link (OK-55681)

LaunchOptionsStore gains an in-memory coldStartLocalNotification slot
(JSON userInfo of a tapped LOCAL notification) plus a read-once
takeColdStartLocalNotification(). The new Nitro method
getAndClearColdStartLocalNotification() returns it and clears it; the host
AppDelegate writes the slot via KVC on a killed-app notification tap.

In-memory only (no NSUserDefaults): a new process = fresh nil, so it is
launch-scoped and cannot replay a stale tap. Android returns "" (taps
arrive via Intent extras there). Run yarn nitrogen + yarn prepare before
publishing 3.0.54.
- iOS/Android: warm-boot the shared offline page + route page->native
  callbacks to owner ?? warmDriver so bars-state/load-end aren't dropped
  while the host that owns the WebView is the offscreen prewarm
- source/bridge setters apply synchronously (drop scheduleReconcile, which
  caused an infinite reconcile loop on Android)
- add ChartWV diagnostics via OneKeyLog (depend on ReactNativeNativeLogger)
- fix Android compileReleaseKotlin: dispose() needs override
…retries

- Android: pause the pooled WebView's renderer (onPause) when no host owns it and
  resume on claim — Android (unlike iOS WKWebView) never throttles an offscreen
  WebView, so the warm page burned a CPU core + grew RAM to OOM after leaving the
  chart. Per-instance onPause (NOT process-global pauseTimers).
- attachToContainer: retry reparent up to 12 frames instead of giving up after 1
  (a single retry stranded the WebView in the old container -> blank chart slot)
- webviewDebuggingEnabled Nitro prop (iOS isInspectable / Android
  setWebContentsDebuggingEnabled) following the dev-mode toggle (Agent B)
…roid re-entry white-screen/stuck-loading)

Pooled WebView re-parented across hosts left a stale parent on dispose, so
re-entering a chart showed a white screen / infinite loading (issues 1 & 2).
- forceDetach(): endViewTransition + removeView, fallback removeViewInLayout +
  requestLayout, so the parent is cleared synchronously even on a dead container.
- detachFrom(): parent-checked, used by ChartWebview.dispose() for pooled hosts.
- attachToContainer(): uses forceDetach, retries via container.post.

Retains ChartDBG diagnostic counters (warmDriver/owner setters, throttled
per-3s msgIn/native->page RATE, pauseIfIdle SKIP/PAUSE/RESUME) for ongoing
on-device verification; to be removed before merge.
…ve logs

Remove the ChartDBG diagnostic layer added for the Android root-cause work:
- DBG tag, owner/warmDriver transition logs, dbgId getter
- throttled msgIn/native->page rate counters + rateLogger handler
- pauseIfIdle SKIP verbose log

Keep only operational logs under the ChartWebviewPool tag: WebView
CREATED/DESTROYED (singleton verification), renderer PAUSE/RESUME, and the
attach-failed-after-retries warning. Logging-only change; behavior unchanged.
Address code-review findings on the Android pooled chart WebView:
- weak owner/warmDriver refs (mirror iOS) so the immortal pool can't
  pin a disposed host's ReactContext/Activity
- validate assetHost to a bare hostname before it becomes the
  privileged-bridge origin / WebViewAssetLoader.setDomain; fall back
  to the built-in host on malformed input
- normalize localBundle (trim '/') in computeTargetUrl to avoid
  double-slash URLs that miss the handler prefix (blank chart)
- attach retry uses postDelayed + last-resort forceDetach before
  giving up, so a stuck old parent can't leave the WebView unparented
- log forceDetach failures instead of swallowing them
- demote per-switch pause/resume logs to debug
- guard the read-and-clear of coldStartLocalNotification with an
  os_unfair_lock so a concurrent get-and-clear can't double-drain the
  deep-link (the exactly-once invariant the method exists to provide)
- add a presence-only log on the take path for field diagnosis
  (never logs the payload)
Introduce safe cleanup routines for APK and bundle artifacts across platforms: add clearApkCache (Android implementation + iOS no-op) and expose it in the Nitro spec; introduce pruneStaleAppVersionBundles on Android and iOS to remove stale onekey-bundle artifacts (extracted dirs, download stages, orphan asc signatures, and stale fallback entries). Implementations are defensive: tolerate missing files, avoid deleting current app/bundle versions, and log progress; bundle pruning returns the count of deleted version directories. These changes help reclaim disk space and avoid leaked stale artifacts after native upgrades.
@socket-security

socket-security Bot commented Jun 10, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: npm shell-quote quote() does not escape newlines in object .op values

CVE: GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values (CRITICAL)

Affected versions: >= 1.1.0 < 1.8.4

Patched version: 1.8.4

From: ?npm/react-native@0.83.0npm/shell-quote@1.8.3

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/shell-quote@1.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm react-native is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: example/react-native/package.jsonnpm/react-native@0.83.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native@0.83.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm string-width is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/release-it@19.1.0npm/string-width@8.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/string-width@8.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Android app-update: change wipeApkCacheFiles to accept protectedPaths and skip deleting verified/pending-install APKs; clearApkCache now aborts if a download is in progress, collects verified file paths to protect, and logs skipped files to avoid races during native cleanup.

Android bundle-update: make deleteDirectory return a boolean (treating missing entries as success and failing on any leftover child), propagate that result to callers and log warnings on incomplete deletes instead of always reporting success.

iOS bundle-update: reference appVersionFromStem as Self.appVersionFromStem to use the correct static method scope.
Refresh example/react-native/ios/Podfile.lock to update native module pod specs/checksums and Podfile checksum. Also adjust a comment in ReactNativeBundleUpdate.kt to explicitly reference versioned onekey-bundle/<v> dirs and onekey-bundle-download/<v> stages for clarity.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant