Release v0.2.20: uvr upgrade command + R 4.6 install fix on macOS

New feature
- `uvr upgrade` (alias `uvr self-update`) checks GitHub releases and
  installs the latest binary in place. `--check` reports availability
  without downloading.

Fixes
- macOS R 4.6 install was unusable: CRAN ships 4.6 with hardened-runtime
  signing on bin/exec/R and load commands pointing at the framework path,
  so dyld stripped DYLD_LIBRARY_PATH and SIGKILL'd the process at startup.
  New `patch_r_executables` rewrites bin/exec/R load commands to point at
  our managed lib/libR.dylib and re-signs ad-hoc (which clears the runtime
  flag). `fix_libr_install_name` now also re-signs unconditionally for the
  same reason. Sync's retroactive-patch path runs the same fix on existing
  installs, so an `uvr sync` against a previously-broken 4.6 install in a
  uvr project will repair it without needing `uvr r uninstall && r install`.
- `find_r_binary`'s "any managed installation" fallback now validates each
  candidate via `query_r_version` and skips broken installs in
  version-descending order. Fixes `uvr r pin` (no arg) erroring out when
  the alphabetically-first managed R happens to be unusable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nbafrank

Cargo.lock

@@ -3,7 +3,7 @@ members = ["crates/uvr", "crates/uvr-core"]
 resolver = "2"
 
 [workspace.package]
-version = "0.2.19"
+version = "0.2.20"
 edition = "2021"
 authors = ["uvr contributors"]
 license = "MIT"

Cargo.toml

@@ -141,17 +141,25 @@ pub fn find_r_binary(version_constraint: Option<&str>) -> Result<PathBuf> {
     }
 
     // 3. Prefer managed installation, fall back to first system R.
-    //    Use the already-fetched list — do NOT call find_all() again.
-    let system_fallback = installations
-        .iter()
-        .find(|i| !i.managed)
-        .map(|i| i.binary.clone());
-    installations
-        .into_iter()
-        .find(|i| i.managed)
-        .map(|i| i.binary)
-        .or(system_fallback)
-        .ok_or(UvrError::RNotFound)
+    //    Validate each candidate via `query_r_version` so a broken managed
+    //    install (e.g. R 4.6 before the install-name patch on macOS — see
+    //    `patch_r_executables`) doesn't silently capture every uvr command.
+    let mut managed: Vec<&RInstallation> = installations.iter().filter(|i| i.managed).collect();
+    let mut system: Vec<&RInstallation> = installations.iter().filter(|i| !i.managed).collect();
+    // Probe in version-descending order so the newest working install wins.
+    managed.sort_by(|a, b| version_cmp(&b.version, &a.version));
+    system.sort_by(|a, b| version_cmp(&b.version, &a.version));
+    for inst in managed.into_iter().chain(system.into_iter()) {
+        if query_r_version(&inst.binary).is_some() {
+            return Ok(inst.binary.clone());
+        }
+    }
+    Err(UvrError::RNotFound)
+}
+
+fn version_cmp(a: &str, b: &str) -> std::cmp::Ordering {
+    let parse = |s: &str| -> Vec<u32> { s.split('.').filter_map(|p| p.parse().ok()).collect() };
+    parse(a).cmp(&parse(b))
 }
 
 fn find_exact_version(installations: &[RInstallation], version: &str) -> Result<PathBuf> {
@@ -192,20 +200,14 @@ pub fn query_r_version(binary: &std::path::Path) -> Option<String> {
     // before user code runs. The version string from our `-e` script is always
     // the last line, so pick the last non-empty line that parses as a version.
     let stdout = String::from_utf8_lossy(&output.stdout);
-    stdout
-        .lines()
-        .rev()
-        .find_map(|line| {
-            let t = line.trim();
-            if !t.is_empty()
-                && t.chars().all(|c| c.is_ascii_digit() || c == '.')
-                && t.contains('.')
-            {
-                Some(t.to_string())
-            } else {
-                None
-            }
-        })
+    stdout.lines().rev().find_map(|line| {
+        let t = line.trim();
+        if !t.is_empty() && t.chars().all(|c| c.is_ascii_digit() || c == '.') && t.contains('.') {
+            Some(t.to_string())
+        } else {
+            None
+        }
+    })
 }
 
 #[cfg(test)]

crates/uvr-core/src/r_version/detector.rs

@@ -442,6 +442,13 @@ fn install_r_macos(pkg_bytes: &[u8], version: &str, dest: &Path) -> Result<()> {
     // to load with "Symbol not found: _dgebal_".
     patch_r_dylibs(dest);
 
+    // Step 9(a.5): patch bin/exec/R (and siblings). R 4.6+ ships these with
+    // hardened-runtime signatures pointing at the framework path; without
+    // rewriting those load commands and re-signing ad-hoc, dyld can't find
+    // libR.dylib and the process is SIGKILLed at startup. (Pre-4.6 used
+    // ad-hoc signing so DYLD_LIBRARY_PATH was enough — 4.6 changed that.)
+    patch_r_executables(dest);
+
     // Step 9(b): write etc/Renviron.site so that DYLD_LIBRARY_PATH is set for every
     // R process this installation spawns — including the fresh `R --slave` sessions
     // used by R CMD INSTALL for byte-compilation.  On macOS 15+ (SIP), DYLD_*
@@ -533,30 +540,110 @@ fn patch_makeconf_libr(dest: &Path) -> Result<()> {
 /// packages compiled against it can find it at runtime without DYLD_LIBRARY_PATH.
 ///
 /// IMPORTANT: `install_name_tool` invalidates the Mach-O code signature.
-/// On Apple Silicon every dylib must be signed; we re-apply an ad-hoc signature
-/// with `codesign --force --sign -` immediately after the rename.
+/// On Apple Silicon every dylib must be signed; we always re-apply an ad-hoc
+/// signature afterwards. The ad-hoc re-sign also strips the original hardened
+/// runtime flag (set by CRAN's Developer ID signing on R 4.6+) — without that
+/// strip, macOS would refuse to load the dylib through DYLD_LIBRARY_PATH.
 fn fix_libr_install_name(dest: &Path) {
     let libr = dest.join("lib").join("libR.dylib");
     if !libr.exists() {
         return;
     }
     let new_id = libr.to_string_lossy().to_string();
-
-    let ok = Command::new("install_name_tool")
+    let _ = Command::new("install_name_tool")
         .args(["-id", &new_id, &new_id])
-        .status()
-        .map(|s| s.success())
-        .unwrap_or(false);
+        .status();
+    // Always re-sign — even if install_name_tool was a no-op, the original
+    // CRAN signature has the hardened runtime flag set on R 4.6+, which makes
+    // DYLD_LIBRARY_PATH ineffective for the executables that load this dylib.
+    resign_adhoc(&libr);
+}
 
-    if ok {
-        // Re-sign with an ad-hoc signature after modifying the binary.
-        // Without this, macOS (arm64) kills any process that loads the dylib.
-        let _ = Command::new("codesign")
-            .args(["--force", "--sign", "-", &new_id])
-            .status();
+/// Patch executable Mach-O binaries under `<r_home>/bin/exec/` so they load
+/// our managed `lib/libR.dylib` instead of the framework path baked in by CRAN.
+///
+/// Without this, R 4.6+ (which CRAN signs with hardened runtime) silently
+/// SIGKILLs at startup because:
+///   1. `bin/exec/R` has a load command for `/Library/Frameworks/R.framework/Versions/4.6/Resources/lib/libR.dylib`.
+///   2. The framework path doesn't exist in our extracted install.
+///   3. Hardened runtime causes macOS to strip `DYLD_LIBRARY_PATH`, so the
+///      `Renviron.site` hint we set has no effect on the dyld lookup.
+///
+/// Fix: rewrite the load command to point at our `lib/libR.dylib`, then re-sign
+/// ad-hoc (which also clears the hardened-runtime flag).
+pub fn patch_r_executables(r_home: &Path) {
+    let exec_dir = r_home.join("bin").join("exec");
+    if !exec_dir.exists() {
+        return;
+    }
+    let lib_dir = r_home.join("lib");
+    let Ok(entries) = std::fs::read_dir(&exec_dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if !path.is_file() {
+            continue;
+        }
+        rewrite_framework_loads(&path, &lib_dir);
     }
 }
 
+/// Rewrite every `/Library/Frameworks/R.framework/...` load command in `binary`
+/// to point at the corresponding file in `lib_dir` (matched by basename), then
+/// re-sign ad-hoc. No-op when otool reports no framework references.
+fn rewrite_framework_loads(binary: &Path, lib_dir: &Path) {
+    let path_str = binary.to_string_lossy().to_string();
+    let Ok(deps_out) = Command::new("otool").args(["-L", &path_str]).output() else {
+        return;
+    };
+    if !deps_out.status.success() {
+        return;
+    }
+    let Ok(deps) = String::from_utf8(deps_out.stdout) else {
+        return;
+    };
+    let mut changed = false;
+    for line in deps.lines().skip(1) {
+        let dep = line.split_whitespace().next().unwrap_or("");
+        if !dep.contains("/Library/Frameworks/R.framework/") {
+            continue;
+        }
+        let Some(filename) = std::path::Path::new(dep).file_name() else {
+            continue;
+        };
+        let new_dep = lib_dir.join(filename);
+        if !new_dep.exists() {
+            continue;
+        }
+        let new_dep_str = new_dep.to_string_lossy().to_string();
+        if Command::new("install_name_tool")
+            .args(["-change", dep, &new_dep_str, &path_str])
+            .status()
+            .map(|s| s.success())
+            .unwrap_or(false)
+        {
+            changed = true;
+        }
+    }
+    if changed {
+        resign_adhoc(binary);
+    } else {
+        // Even when install_name_tool was a no-op, R 4.6+ has hardened runtime
+        // on bin/exec/R that prevents DYLD_LIBRARY_PATH from rescuing the load.
+        // Re-sign defensively to drop the runtime flag.
+        resign_adhoc(binary);
+    }
+}
+
+/// Re-sign a Mach-O ad-hoc, clearing any prior hardened-runtime flag.
+fn resign_adhoc(path: &Path) {
+    let path_str = path.to_string_lossy().to_string();
+    let _ = Command::new("codesign")
+        .args(["--force", "--sign", "-", &path_str])
+        .status();
+}
+
 /// Patch all `.dylib` install names in `<r_home>/lib/` to use the managed-R
 /// path instead of the original CRAN framework path.
 ///

crates/uvr-core/src/r_version/downloader.rs

@@ -72,8 +72,9 @@ pub enum Commands {
     /// Generate shell completions
     Completions(CompletionsArgs),
 
-    /// Update uvr itself to the latest release
-    SelfUpdate,
+    /// Check for and install the latest uvr release
+    #[command(aliases = ["self-update"])]
+    Upgrade(UpgradeArgs),
 
     /// Manage R versions
     #[command(name = "r")]
@@ -342,6 +343,18 @@ pub struct RPinArgs {
     pub version: Option<String>,
 }
 
+// ────────────────────────────────────────────────────────────
+//  upgrade
+// ────────────────────────────────────────────────────────────
+
+#[derive(Debug, Args)]
+pub struct UpgradeArgs {
+    /// Print the latest version and whether an update is available, without
+    /// downloading or installing anything.
+    #[arg(long)]
+    pub check: bool,
+}
+
 // ────────────────────────────────────────────────────────────
 //  cache
 // ────────────────────────────────────────────────────────────

crates/uvr/src/cli.rs

@@ -5,7 +5,7 @@ use uvr_core::r_version::downloader::Platform;
 use crate::ui;
 use crate::ui::palette;
 
-pub async fn run() -> Result<()> {
+pub async fn run(check_only: bool) -> Result<()> {
     let current = env!("CARGO_PKG_VERSION");
     ui::info(format!("Checking for updates (current: v{current})"));
 
@@ -26,6 +26,11 @@ pub async fn run() -> Result<()> {
         palette::upgraded(format!("v{latest}")),
     );
 
+    if check_only {
+        ui::hint("Run `uvr upgrade` to install. Skipping download (--check).");
+        return Ok(());
+    }
+
     let target = Platform::detect()
         .map(|p| p.rust_target_triple())
         .unwrap_or("unknown");

crates/uvr/src/commands/self_update.rs

@@ -10,7 +10,9 @@ use uvr_core::installer::r_cmd_install::RCmdInstall;
 use uvr_core::lockfile::{LockedPackage, Lockfile};
 use uvr_core::project::Project;
 use uvr_core::r_version::detector::{find_r_binary, query_r_version};
-use uvr_core::r_version::downloader::{patch_r_dylibs, patch_renviron_site, Platform};
+use uvr_core::r_version::downloader::{
+    patch_r_dylibs, patch_r_executables, patch_renviron_site, Platform,
+};
 use uvr_core::registry::p3m::P3MBinaryIndex;
 use uvr_core::resolver::topological_install_order;
 
@@ -335,6 +337,7 @@ pub async fn install_from_lockfile(
             if cfg!(target_os = "macos") {
                 let _ = patch_renviron_site(r_home);
                 patch_r_dylibs(r_home);
+                patch_r_executables(r_home);
             }
             let libr_name = if cfg!(target_os = "macos") {
                 "libR.dylib"

crates/uvr/src/commands/sync.rs

@@ -123,8 +123,8 @@ async fn run() -> Result<()> {
         Commands::Completions(args) => {
             commands::completions::run(args.shell)?;
         }
-        Commands::SelfUpdate => {
-            commands::self_update::run().await?;
+        Commands::Upgrade(args) => {
+            commands::self_update::run(args.check).await?;
         }
         Commands::Doctor => {
             commands::doctor::run()?;

crates/uvr/src/main.rs

@@ -120,6 +120,17 @@ fn test_add_help_works() {
     uvr_cmd().args(["add", "--help"]).assert().success();
 }
 
+#[test]
+fn test_upgrade_help_works() {
+    uvr_cmd().args(["upgrade", "--help"]).assert().success();
+}
+
+#[test]
+fn test_self_update_alias_works() {
+    // Backward-compat: `uvr self-update` is a hidden alias for `uvr upgrade`.
+    uvr_cmd().args(["self-update", "--help"]).assert().success();
+}
+
 #[test]
 fn test_r_use_exact_writes_r_version_file() {
     let dir = init_project("pin-test");