Re-exec the new binary after an in-place self-upgrade

When the auto-updater ran 'brew upgrade' (or npm/go/docker) mid-command, it
replaced the binary on disk but kept executing the old image already loaded in
memory. So the very run that triggered the upgrade still used pre-upgrade
logic (e.g. a service-detection fix that had just shipped), confusing users
who saw a fixed bug reappear until the next invocation.

After a successful upgrade, re-exec the freshly installed binary in place
(syscall.Exec on Unix), preserving the user's original args, so their command
continues on the new code. Resolve the new binary via a fresh PATH lookup
since os.Executable() can point at the old install dir the upgrade deleted
(e.g. Homebrew Cellar/<old-version>). A PREFLIGHT_NO_UPDATE_CHECK guard set on
the re-exec'd process prevents a re-prompt loop and lets users opt out.
Windows has no exec(2) equivalent, so it falls back to asking the user to
re-run.

Author: phillips-jon

cmd/reexec_unix.go

@@ -0,0 +1,21 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"os"
+	"syscall"
+)
+
+// execNewBinary replaces the current process image with the freshly installed
+// binary, preserving the user's original arguments. On success it does not
+// return (the new program takes over); it only returns on error so the caller
+// can fall back to asking the user to re-run.
+func execNewBinary() error {
+	bin, err := resolveNewBinary()
+	if err != nil {
+		return err
+	}
+	env := append(os.Environ(), noUpdateCheckEnv+"=1")
+	return syscall.Exec(bin, os.Args, env)
+}

cmd/reexec_windows.go

@@ -0,0 +1,12 @@
+//go:build windows
+
+package cmd
+
+import "errors"
+
+// execNewBinary is unsupported on Windows: there is no exec(2) equivalent that
+// replaces the running process image in place. The caller falls back to asking
+// the user to re-run their command on the new version.
+func execNewBinary() error {
+	return errors.New("in-place re-exec is not supported on windows")
+}

cmd/update.go

@@ -16,6 +16,11 @@ import (
 
 const updateCheckInterval = 24 * time.Hour
 
+// noUpdateCheckEnv disables the update check entirely when set to a non-empty
+// value. It is also set on the re-exec'd process after an in-place upgrade so
+// the freshly launched binary doesn't immediately prompt again.
+const noUpdateCheckEnv = "PREFLIGHT_NO_UPDATE_CHECK"
+
 type githubRelease struct {
 	TagName string `json:"tag_name"`
 }
@@ -28,6 +33,12 @@ func CheckForUpdates() {
 		return
 	}
 
+	// Allow opting out, and avoid re-prompting on the process we re-exec
+	// after an in-place upgrade.
+	if os.Getenv(noUpdateCheckEnv) != "" {
+		return
+	}
+
 	if !shouldCheckForUpdate() {
 		return
 	}
@@ -69,7 +80,12 @@ func CheckForUpdates() {
 		// Require explicit Y; default (empty input) is No.
 		response = strings.TrimSpace(strings.ToLower(response))
 		if response == "y" || response == "yes" {
-			runUpgrade(upgradeCmd)
+			if runUpgrade(upgradeCmd) {
+				// The current process still holds the pre-upgrade binary in
+				// memory; without handing off, the rest of this invocation
+				// runs stale logic. This does not return on success.
+				relaunchAfterUpgrade()
+			}
 		} else {
 			fmt.Printf("   To upgrade later: %s\n", upgradeCmd)
 		}
@@ -111,34 +127,70 @@ func markUpdateChecked() {
 	_ = os.WriteFile(checkFile, []byte(time.Now().UTC().Format(time.RFC3339)), 0644)
 }
 
-// runUpgrade executes an already-vetted upgrade command. The caller is
-// responsible for gating any `curl | sh` style commands, which this
-// function will refuse for safety.
-func runUpgrade(upgradeCmd string) {
+// runUpgrade executes an already-vetted upgrade command and reports whether it
+// succeeded. The caller is responsible for gating any `curl | sh` style
+// commands, which this function will refuse for safety.
+func runUpgrade(upgradeCmd string) bool {
 	if strings.Contains(upgradeCmd, "|") {
 		// Defense in depth: CheckForUpdates is supposed to filter these
 		// out already, but make sure we never pipe untrusted bytes into
 		// a shell from this code path.
 		fmt.Printf("   ✗ Refusing to auto-run piped shell command: %s\n", upgradeCmd)
-		return
+		return false
 	}
 
 	fmt.Printf("   Running: %s\n", upgradeCmd)
 	parts := strings.Fields(upgradeCmd)
 	if len(parts) == 0 {
 		fmt.Println("   ✗ Could not determine upgrade command")
-		return
+		return false
 	}
 
 	cmd := exec.Command(parts[0], parts[1:]...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	if err := cmd.Run(); err != nil {
 		fmt.Printf("   ✗ Upgrade failed: %v\n", err)
-		return
+		return false
 	}
 
 	fmt.Println("   ✓ Upgrade complete!")
+	return true
+}
+
+// relaunchAfterUpgrade hands the user's original command off to the
+// just-installed binary. The current process still has the pre-upgrade binary
+// loaded in memory, so without this the rest of the invocation keeps running
+// stale logic (e.g. service detection from before a fix). On Unix this re-execs
+// in place and never returns; if re-exec is unsupported (Windows) or fails, it
+// prints a re-run hint and exits so we never silently continue on old code.
+func relaunchAfterUpgrade() {
+	fmt.Println("   ↻ Restarting with the new version...")
+	fmt.Println()
+	if err := execNewBinary(); err != nil {
+		fmt.Println("   Please re-run your command to use the new version.")
+	}
+	os.Exit(0)
+}
+
+// resolveNewBinary returns an absolute path to the preflight binary to re-exec
+// after an upgrade. It prefers a fresh PATH lookup of the invoked name because
+// os.Executable() can point at the previous version's install directory (e.g. a
+// Homebrew Cellar/<old-version> path) that the upgrade just deleted; the PATH
+// entry (a symlink/shim) already targets the newly installed binary.
+func resolveNewBinary() (string, error) {
+	if name := os.Args[0]; name != "" {
+		if bin, err := exec.LookPath(name); err == nil {
+			if abs, err := filepath.Abs(bin); err == nil {
+				return abs, nil
+			}
+		}
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Abs(exe)
 }
 
 func fetchLatestVersion() (string, error) {