[lacymorrow]

curl -fsSL https://lash.lacy.sh/install | bash currently installs opencode. The site's /install route proxies this file straight from the repo, so the wrong product is one command away from any visitor.

What was wrong

The script is upstream's, unmodified:

APP=opencode
INSTALL_DIR=$HOME/.opencode/bin
url="https://github.com/anomalyco/opencode/releases/latest/download/$filename"
mv "$tmp_dir/opencode" "$INSTALL_DIR"

/install/beta and /install/nightly export LASH_CHANNEL and then run this same script, so the channel routes were wrong too.

What this changes

Only the identifiers. The logic is good and stays: rosetta detection, musl detection, AVX2 baseline selection, and the shell-config PATH handling all match our release matrix exactly.

	before	after
app	APP=opencode	APP=lash
asset prefix	(none)	ASSET=lashcode
install dir	$HOME/.opencode/bin	${LASH_INSTALL_DIR:-$HOME/.lash/bin}
repo	anomalyco/opencode	lacymorrow/lash
binary	mv "$tmp_dir/opencode"	mv "$tmp_dir/$APP"
version probe	command -v opencode	command -v lash

APP and ASSET are genuinely two values. Release archives publish as lashcode-<target>, the binary inside them is lash. Collapsing them into one name is exactly what makes the filename wrong, which is the bug on main (below).

Evidence

Ran end to end on darwin-arm64 with the existing brew-installed lash hidden from PATH, so the version short-circuit could not skip the download:

Installing lash version: 1.7.13
######################################## 100.0%

█    █▀▀█ █▀▀▀ █  █
█░░░ █▀▀█ ▀▀▀█ █▀▀█
▀▀▀▀ ▀  ▀ ▀▀▀▀ ▀  ▀

$ ls -la $LASH_INSTALL_DIR
-rwxr-xr-x  1  154890400  lash
$ $LASH_INSTALL_DIR/lash --version
1.7.13

Fetches lashcode-darwin-arm64.zip from the v1.7.13 release, extracts, installs, runs. shellcheck -S warning reports only the five style warnings that were already there upstream.

Also here

The README's installation section still told people to run curl -fsSL https://opencode.ai/install | bash and brew install anomalyco/tap/opencode. Rewritten to the real commands, both of which resolve today: brew install lacymorrow/tap/lash and npm i -g lashcode.

One thing to know

main carries a different install script that is lash-branded but broken in other ways: it builds filenames as lash-<target>.tar.gz (wrong prefix, and macOS ships .zip), hardcodes a default version of 0.6.12-fixed which does not exist, and does mkdir -p lashtmp && cd lashtmp in the user's current directory. This supersedes it. Worth deleting that one so it does not get promoted later.

[lacymorrow]

The two e2e failures here are pre-existing on the branch, not from this change.

They are Playwright tests of the desktop app UI: legacy-new-session.spec.ts and session-timeline-projection.spec.ts (comment strips and diff summary overflow). This PR touches install and README.md, a shell script and a markdown file. Neither is loaded by the app under test.

PR #46, the upstream sync, has the same two failures and touches none of the same files.

Evidence for the change itself is in the description: ran end to end on darwin-arm64 with the brew-installed lash hidden from PATH so the version check could not short-circuit the download. It fetched lashcode-darwin-arm64.zip from v1.7.13, extracted, installed to the target directory, and the binary reports 1.7.13.