From 860e855048c23d46501e1bd998ca9526e4a14bc8 Mon Sep 17 00:00:00 2001
From: Alexander Mayo <alex@freelabel.net>
Date: Sun, 19 Apr 2026 10:30:23 -0500
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20iris=20update=20fails=20to=20replace?=
 =?UTF-8?q?=20binary=20=E2=80=94=20rm+mv=20instead=20of=20cp,=20add=20veri?=
 =?UTF-8?q?fication=20(#59972)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause: `cp -f` over a running macOS binary can silently fail. Also no
chmod +x after extract, no symlink resolution, no post-update verification.

Fixes:
- rm old binary first, then mv new one in (avoids locked-file issue)
- chmod +x after extracting from zip/tar
- Resolve symlinks via realpathSync before determining binDir
- Write upgrade script to temp file (avoids Bun $ template interpolation bugs)
- Verify installed version after update, warn + show fallback if mismatch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 packages/opencode/src/cli/cmd/upgrade.ts    | 12 ++++++-
 packages/opencode/src/installation/index.ts | 35 +++++++++++++++------
 2 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/packages/opencode/src/cli/cmd/upgrade.ts b/packages/opencode/src/cli/cmd/upgrade.ts
index 7365a652127d..ab3eb2b1181b 100644
--- a/packages/opencode/src/cli/cmd/upgrade.ts
+++ b/packages/opencode/src/cli/cmd/upgrade.ts
@@ -68,8 +68,18 @@ export const UpgradeCommand = {
     spinner.stop(Installation.isIris() ? "IRIS CLI updated" : "Upgrade complete")
 
     if (Installation.isIris()) {
-      // Also update SDK and bridge if present
+      // Verify the update actually took effect
       const { $ } = await import("bun")
+      const verifyResult = await $`${process.execPath} --version`.nothrow().quiet().text()
+      const installedVersion = verifyResult.trim()
+      if (installedVersion && installedVersion !== target) {
+        prompts.log.warn(`Expected v${target} but binary reports v${installedVersion}`)
+        prompts.log.info(`Try: curl -fsSL https://heyiris.io/install-iris.sh | bash`)
+      } else {
+        prompts.log.success(`Verified: v${installedVersion}`)
+      }
+
+      // Also update SDK and bridge if present
       const home = process.env.HOME || ""
 
       const sdkDir = `${home}/.iris/sdk`
diff --git a/packages/opencode/src/installation/index.ts b/packages/opencode/src/installation/index.ts
index 37aa2a6fa278..b0fca3bb8b8e 100644
--- a/packages/opencode/src/installation/index.ts
+++ b/packages/opencode/src/installation/index.ts
@@ -137,21 +137,36 @@ export namespace Installation {
       const ext = platform === "linux" ? "tar.gz" : "zip"
       const assetName = `iris-${platform}-${arch}.${ext}`
       const releaseUrl = `https://github.com/FREELABEL/iris-opencode/releases/download/v${target}/${assetName}`
-      const binDir = path.dirname(process.execPath)
+      // Resolve symlinks to get the real binary path
+      const realExecPath = await import("fs").then(fs => fs.realpathSync(process.execPath))
+      const binDir = path.dirname(realExecPath)
       const tmpDir = path.join(binDir, ".iris-update-tmp")
 
-      cmd = $`set -e
-mkdir -p ${tmpDir}
-cd ${tmpDir}
-curl -fsSL -o ${assetName} ${releaseUrl}
+      // Use a script file to avoid Bun template literal interpolation issues
+      const script = `#!/bin/bash
+set -e
+mkdir -p "${tmpDir}"
+cd "${tmpDir}"
+curl -fsSL -o "${assetName}" "${releaseUrl}"
 if [ "${ext}" = "tar.gz" ]; then
-  tar -xzf ${assetName}
+  tar -xzf "${assetName}"
 else
-  unzip -o ${assetName}
+  unzip -o "${assetName}"
 fi
-cp -f iris ${binDir}/iris
-rm -rf ${tmpDir}
-echo "Updated to v${target}"`.env({ ...process.env })
+chmod +x iris
+# Remove old binary first (avoids overwriting a running executable)
+rm -f "${binDir}/iris"
+mv iris "${binDir}/iris"
+rm -rf "${tmpDir}"
+# Verify the new binary works
+"${binDir}/iris" --version
+`
+      const scriptPath = path.join(tmpDir + "-script.sh")
+      await import("fs").then(fs => {
+        fs.mkdirSync(path.dirname(scriptPath), { recursive: true })
+        fs.writeFileSync(scriptPath, script, { mode: 0o755 })
+      })
+      cmd = $`bash ${scriptPath} && rm -f ${scriptPath}`.env({ ...process.env })
     } else {
       switch (method) {
         case "curl":

From 5e84626d3d4465571ccdc4e7e06f9b98e8d5ce0f Mon Sep 17 00:00:00 2001
From: Alexander Mayo <alex@freelabel.net>
Date: Sun, 19 Apr 2026 10:30:42 -0500
Subject: [PATCH 2/2] chore: bump version to 1.2.2

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 packages/opencode/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/opencode/package.json b/packages/opencode/package.json
index b143141f465a..b9a6feddded4 100644
--- a/packages/opencode/package.json
+++ b/packages/opencode/package.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "name": "opencode",
   "displayName": "iris-agent-cli",
   "type": "module",