Make KernelSU runtime updates self-healing

[JadenJSJ]

Root cause

The connected device had module runtime 0.1.28. Its old updater passed an APK under /data/adb directly to PackageManager, which PackageManager could not read under SELinux. Because scripts were refreshed only after a successful APK install, that device could never receive the corrected staging helper.

Fix

• package hot-update.sh in every runtime payload
• refresh the verified updater scripts before attempting APK installation
• stage APKs under /data/local/tmp with restored SELinux context
• persist and print PackageManager errors instead of hiding them
• explicitly install for Android user 0

Verification

• shell syntax checks pass
• Blacksmith performs the release packaging/build in this PR
• connected device will receive a one-time updater bootstrap after review

[coderabbitai]

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: db30ac89-0080-43f3-97b4-029f74827873

📥 Commits

Reviewing files that changed from the base of the PR and between 4e670a1 and 702af56.

📒 Files selected for processing (3)

• module/scripts/common.sh
• module/scripts/hot-update.sh
• tools/package-release.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}