IRIS CLI v1.2.2 — Fix iris update not replacing binary

[mayoalexander]

Summary

• Fix iris update silently failing to replace the binary on macOS (#59972)
• rm + mv instead of cp -f over running executable
• Add chmod +x, symlink resolution, post-update version verification
• Warn user with fallback command if verification fails

Test plan

• Build passes typecheck
• Upgrade logic writes script to temp file, avoids Bun template interpolation issues
• Post-update runs iris --version to verify

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes IRIS CLI self-upgrade on macOS where updating could silently fail to replace the running executable, and adds post-upgrade verification.

Changes:

• Update IRIS upgrade flow to resolve symlinks and replace the binary via rm + mv instead of overwriting in-place.
• Execute upgrade steps via a generated bash script and add executable bit + runtime verification.
• Add CLI-side version verification/warning after upgrade and bump package version to 1.2.2.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
packages/opencode/src/installation/index.ts	Adjusts IRIS self-upgrade to resolve real binary path, run upgrade via script, and replace binary using rm/mv with a --version check.
packages/opencode/src/cli/cmd/upgrade.ts	Adds post-upgrade verification and user guidance if version mismatch is detected.
packages/opencode/package.json	Bumps package version to 1.2.2.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

With set -e, the final "${binDir}/iris" --version check will cause the whole update to fail if the new binary can't execute (Gatekeeper/quarantine, missing deps, etc.). That prevents the later CLI-level warning/fallback flow from running and makes the update appear failed. Consider making this check non-fatal (capture output/exit code and always exit 0) and let the TypeScript verification/warning handle mismatches.

Suggested change

	# Verify the new binary works
	"${binDir}/iris" --version
	# Best-effort verification only; let the TypeScript layer handle warnings/fallbacks.
	set +e
	"${binDir}/iris" --version >/dev/null 2>&1
	verify_status=$?
	set -e
	exit 0

[Copilot]

bash ${scriptPath} && rm -f ${scriptPath} only removes the script on success. If the script fails at any step (curl/unzip/mv/version check), the script file will be left behind in the install directory. Prefer ensuring cleanup in a finally/trap (or use ; rm -f after capturing exit code) so the temp script is removed even on failure.

Suggested change

	cmd = $`bash ${scriptPath} && rm -f ${scriptPath}`.env({ ...process.env })
	cmd =
	$`bash -c 'script_path="$1"; trap '"'"'rm -f "$script_path"'"'"' EXIT; bash "$script_path"' -- ${scriptPath}`.env(
	{ ...process.env },
	)

[Copilot]

The verification uses .nothrow().quiet().text() and then treats an empty/failed command the same as success (it falls into the else branch and prints "Verified"). Consider capturing the process result (including exit code) and only reporting success when exitCode is 0 and a version string was produced.

[Copilot]

The update script deletes the existing "${binDir}/iris" before moving the new binary into place. If the mv fails (download/extract issues, permissions, disk full), this leaves the user with no iris binary at all. Consider doing an atomic swap (move new binary to a temp name in binDir, then rename over), and/or moving the old binary to a backup and restoring it on failure.

Suggested change

	# Remove old binary first (avoids overwriting a running executable)
	rm -f "${binDir}/iris"
	mv iris "${binDir}/iris"
	rm -rf "${tmpDir}"
	# Verify the new binary works
	"${binDir}/iris" --version
	newBinary="${binDir}/iris.new.$$"
	backupBinary="${binDir}/iris.backup.$$"
	restore_previous() {
	status=$?
	if [ -f "${backupBinary}" ] && [ ! -f "${binDir}/iris" ]; then
	mv -f "${backupBinary}" "${binDir}/iris" || true
	fi
	rm -f "${newBinary}"
	rm -rf "${tmpDir}"
	exit $status
	}
	trap restore_previous EXIT
	# Stage the new binary in the target directory before replacing the current one.
	mv -f iris "${newBinary}"
	# Move the current binary aside so it can be restored if anything fails.
	if [ -f "${binDir}/iris" ]; then
	mv -f "${binDir}/iris" "${backupBinary}"
	fi
	mv -f "${newBinary}" "${binDir}/iris"
	# Verify the new binary works before removing the backup.
	"${binDir}/iris" --version
	rm -f "${backupBinary}"
	rm -rf "${tmpDir}"
	trap - EXIT