fix: harden the native media upload server (review of #357) - #561

Merged

jkmassel merged 32 commits into

feat/leverage-host-media-processingfrom

feat/leverage-host-media-processing-v1

Aug 14, 2026

Commits on Aug 13, 2026

fix: bound upload-server body read by idle timeout, not a total read cap
jkmassel
committed
c8cc8cb
fix(ios): trap when mediaUploadDelegate is set too late or released early
jkmassel
committed
1046811
fix(ios): guard temp-file cleanup so concurrent servers don't wipe live buffers
jkmassel
committed
20f9855
fix(ios): tear down the upload body writer thread on every exit
jkmassel
committed
9daf52f
test(js): make the upload-cancel tests exercise the abort-vs-network race
jkmassel
committed
b3bcac7
fix(android): don't resurrect the upload server on a detached view
jkmassel
committed
d603c0b
fix(android): cancel the upload server's coroutine scope when it owns it
jkmassel
committed
d4b1b74
fix(ios): escape multipart header values to prevent injection
jkmassel
committed
a18a48d
docs(ios): document the upload body's non-replayable-stream limitation
jkmassel
committed
c6a84a5
fix(js): reject with a canonical AbortError when an aborted signal has no reason
jkmassel
committed
65f58ed
fix(ios): cancel the upload relay when the client aborts the connection
jkmassel
committed
0ef2fb1
fix(android): cancel the upload relay when the client aborts the connection
jkmassel
committed
3f87758
fix(ios): don't apply the REST request timeout to media uploads
jkmassel
committed
cf89a83
fix(android): capture the media upload delegate once at load, matching iOS
jkmassel
committed
eedc409
fix(ios): bound the HTTP server's wait for the listener to become ready
jkmassel
committed
f689b3f
fix(ios): don't send a truncated multipart when the upload file can't be fully read
jkmassel
committed
061c0ed
fix(ios): don't write a response to a connection cancelled mid-handler
jkmassel
committed
06a1853
fix(android): rethrow coroutine cancellation instead of mapping it to a 500
jkmassel
committed
1016092
fix(js): treat an abort during the response body read as a cancel, not an error
jkmassel
committed
58c48a5
feat(ios): let the delegate decline a file by metadata to skip the temp copy
jkmassel
committed
5eca958
feat(android): let the delegate decline a file by metadata to skip the temp copy
jkmassel
committed
c756650
fix(android): start connection handlers ATOMIC so a shutdown race can't leak the socket
jkmassel
committed
52da689
fix(js): normalize a native-upload transport failure to api-fetch's error shape
jkmassel
committed
a324a0b
docs(ios): explain the mediaUploadDelegate precondition is a deliberate fail-fast
jkmassel
committed
4c90a2a
refactor(ios): route recoverable parse errors through an HTTPServerDelegate
jkmassel
committed
9eb898a
refactor(android): route recoverable parse errors through an HttpServerDelegate
jkmassel
committed
feabd00
docs: explain why the upload server's CORS is `*` and not an origin allowlist
jkmassel
committed
d1460bc
refactor(js): only route a genuine File through the native upload path
jkmassel
committed
6b0d2d5
fix(android): resume the upload coroutine when the response-body read fails
jkmassel
committed
7b34e48
fix(ios): carry the request-observing delegate into the upload client
jkmassel
committed
8e3cc9d
test: pin the racing-close half-close behavior and document it
jkmassel
committed
6634894
test(ios): reconcile parent's start/cleanup tests after reparenting onto the rebased base
jkmassel
committed
3634a02

Navigation Menu

Uh oh!

fix: harden the native media upload server (review of #357) - #561

fix: harden the native media upload server (review of #357)#561
jkmassel merged 32 commits into
feat/leverage-host-media-processingfrom
feat/leverage-host-media-processing-v1

Commits on Aug 13, 2026

fix: bound upload-server body read by idle timeout, not a total read cap

fix(ios): trap when mediaUploadDelegate is set too late or released early

fix(ios): guard temp-file cleanup so concurrent servers don't wipe live buffers

fix(ios): tear down the upload body writer thread on every exit

test(js): make the upload-cancel tests exercise the abort-vs-network race

fix(android): don't resurrect the upload server on a detached view

fix(android): cancel the upload server's coroutine scope when it owns it

fix(ios): escape multipart header values to prevent injection

docs(ios): document the upload body's non-replayable-stream limitation

fix(js): reject with a canonical AbortError when an aborted signal has no reason

fix(ios): cancel the upload relay when the client aborts the connection

fix(android): cancel the upload relay when the client aborts the connection

fix(ios): don't apply the REST request timeout to media uploads

fix(android): capture the media upload delegate once at load, matching iOS

fix(ios): bound the HTTP server's wait for the listener to become ready

fix(ios): don't send a truncated multipart when the upload file can't be fully read

fix(ios): don't write a response to a connection cancelled mid-handler

fix(android): rethrow coroutine cancellation instead of mapping it to a 500

fix(js): treat an abort during the response body read as a cancel, not an error

feat(ios): let the delegate decline a file by metadata to skip the temp copy

feat(android): let the delegate decline a file by metadata to skip the temp copy

fix(android): start connection handlers ATOMIC so a shutdown race can't leak the socket

fix(js): normalize a native-upload transport failure to api-fetch's error shape

docs(ios): explain the mediaUploadDelegate precondition is a deliberate fail-fast

refactor(ios): route recoverable parse errors through an HTTPServerDelegate

refactor(android): route recoverable parse errors through an HttpServerDelegate

docs: explain why the upload server's CORS is `*` and not an origin allowlist

refactor(js): only route a genuine File through the native upload path

fix(android): resume the upload coroutine when the response-body read fails

fix(ios): carry the request-observing delegate into the upload client

test: pin the racing-close half-close behavior and document it

test(ios): reconcile parent's start/cleanup tests after reparenting onto the rebased base