fix(cli): replace shell-based update with native Rust implementation

[debugmcpdev]

Summary

Replaces the shell-based goose update implementation (which shells out to curl + bash) with a native Rust implementation that works on Windows, macOS, and Linux.

Problem

goose update has been broken on native Windows since ~v1.9.0. The current implementation downloads download_cli.sh and executes it via bash - neither curl nor bash exist on native Windows. This affects all Windows users who try to update via the CLI.

See: #7146, #5006

Solution

Complete rewrite of crates/goose-cli/src/commands/update.rs (~37 lines -> ~460 lines) to use native Rust libraries instead of shell commands:

Step	Before (broken)	After (native)
Download	curl	reqwest (blocking + rustls)
Extract	bash + tar	zip crate (Windows) / tar + bzip2 (Unix)
Replace binary	mv via bash	std::fs::rename with rename-away strategy on Windows
DLL handling	N/A	Copies companion DLLs on Windows (libgcc, libstdc++, libwinpthread)

Key design decisions

• Compile-time platform detection via #[cfg] attributes - no runtime OS sniffing
• Rename-away binary replacement on Windows (goose.exe -> goose.exe.old, then new -> goose.exe) because Windows locks running executables
• Handles goose-package/ subdirectory in archives (matches existing release structure)
• Preserves existing API - update(canary, reconfigure) signature unchanged, just made async
• disable-update feature flag still works

Files Changed

File	Change
Cargo.lock	Updated for new dependencies
crates/goose-cli/Cargo.toml	Added reqwest (blocking, rustls-tls-native-roots), zip 7.4 (deflate), bzip2 0.5
crates/goose-cli/src/commands/update.rs	Complete rewrite - native Rust download, extract, replace
crates/goose-cli/src/cli.rs	One line: added .await to update() call
crates/goose-cli/src/session/editor.rs	Added #[cfg(unix)] to 2 test functions (bonus fix for pre-existing Windows test compilation)

Testing

Unit tests (10 new, all pass)

• test_asset_name_valid - correct platform asset selection
• test_binary_name - correct binary name per OS
• test_find_binary_* (4 tests) - binary discovery in various archive layouts
• test_extract_zip_with_package_dir - zip extraction with goose-package subdir
• test_replace_binary_* (3 tests) - binary replacement including Windows rename-away

End-to-end (manual, Windows)

• goose update - successfully downloaded 50MB stable release, extracted, replaced binary + 3 DLLs
• goose update --canary - successfully downloaded 89MB canary release
• goose --version confirms updated version after each test

Regression

• All 118 other goose-cli lib tests pass (0 regressions)

Closes

• Goose update not working on Windows (Powershell or CMD) #7146 - goose update fails on Windows with 'Unsupported OS' error
• Related: Update goose CLI on Windows failed #5006 - Update goose CLI on Windows failed

[DOsinga]

fixes: #7146

[Copilot]

Pull request overview

Replaces the goose update command’s shell-based installer (curl/bash) with a native Rust implementation to support Windows/macOS/Linux updates reliably.

Changes:

• Rewrote goose update to download release assets via reqwest, extract archives, and replace the running binary (with Windows-specific rename-away behavior + DLL copying).
• Updated CLI dispatch to await the now-async updater.
• Adjusted two editor tests to compile only on Unix.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/goose-cli/src/commands/update.rs	Native Rust updater: download, extract (zip/tar.bz2), locate binary, replace in-place, Windows DLL handling, and new unit tests.
crates/goose-cli/src/cli.rs	Awaits the async update() command.
crates/goose-cli/Cargo.toml	Adds dependencies needed for native download/extraction (reqwest/zip/bzip2).
crates/goose-cli/src/session/editor.rs	Gates Unix-only symlink tests behind #[cfg(unix)].
Cargo.lock	Lockfile updates for newly added dependencies.

[Copilot]

asset_name() has no fallback for unsupported target triples, which can produce a confusing compile error on new/unsupported platforms; consider adding an explicit #[cfg(not(any(...)))] compile_error!(...) (or returning a clear error) so the failure mode is intentional and readable.

Suggested change

	}
	}
	#[cfg(not(any(
	all(target_os = "macos", target_arch = "aarch64"),
	all(target_os = "macos", target_arch = "x86_64"),
	all(target_os = "linux", target_arch = "x86_64"),
	all(target_os = "linux", target_arch = "aarch64"),
	all(target_os = "windows", target_arch = "x86_64"),
	)))]
	{
	compile_error!(
	"goose update is not supported on this target; no prebuilt binary asset is available"
	);
	}

[Copilot]

The update download uses reqwest::get without any explicit timeout, so goose update can hang indefinitely on stalled networks; consider using a reqwest::Client with a reasonable request/overall timeout (and reuse it for the body download).

[Copilot]

tar::Archive::unpack can write files with paths from the archive as-is; to avoid potential path traversal (writing outside dest) when extracting remote archives, consider iterating entries and using Entry::unpack_in(dest) (and rejecting absolute/parent components).

[Copilot]

find_binary() uses Path::exists() which can match directories; using is_file() (and possibly metadata checks) avoids returning a non-file path that will later fail to copy/execute.

[Copilot]

copy_dlls() silently ignores read_dir failures via if let Ok(entries) = ..., which can report a successful update while skipping required DLL copies; consider propagating the error with context so update fails loudly when DLL enumeration isn’t possible.

Suggested change

	if let Ok(entries) = fs::read_dir(source_dir) {
	for entry in entries.flatten() {
	let path = entry.path();
	if let Some(ext) = path.extension() {
	if ext.eq_ignore_ascii_case("dll") {
	let file_name = path.file_name().unwrap();
	let dest = dest_dir.join(file_name);
	// Remove existing DLL first (it may be locked by another process)
	if dest.exists() {
	let _ = fs::remove_file(&dest);
	}
	fs::copy(&path, &dest).with_context(|| {
	format!("Failed to copy {} to {}", path.display(), dest.display())
	})?;
	println!(" Copied {}", file_name.to_string_lossy());
	}
	let entries = fs::read_dir(source_dir)
	.with_context(|| format!("Failed to read directory {}", source_dir.display()))?;
	for entry in entries.flatten() {
	let path = entry.path();
	if let Some(ext) = path.extension() {
	if ext.eq_ignore_ascii_case("dll") {
	let file_name = path.file_name().unwrap();
	let dest = dest_dir.join(file_name);
	// Remove existing DLL first (it may be locked by another process)
	if dest.exists() {
	let _ = fs::remove_file(&dest);
	}
	fs::copy(&path, &dest).with_context(|| {
	format!("Failed to copy {} to {}", path.display(), dest.display())
	})?;
	println!(" Copied {}", file_name.to_string_lossy());

[Copilot]

reqwest is enabled with the blocking feature but the new updater uses the async API (reqwest::get(...).await); dropping the blocking feature would reduce dependency surface/compile time unless it’s needed elsewhere in goose-cli.

Suggested change

	reqwest = { workspace = true, features = ["blocking", "rustls-tls-native-roots"] }
	reqwest = { workspace = true, features = ["rustls-tls-native-roots"] }

[jamadeo]

Looks great, thanks for this. Tested this out on mac + windows