codebuff 1.0.685 → 1.0.686

package/index.js

@@ -21,6 +21,7 @@ const { createLauncher } = require(
 const launcher = createLauncher({
   packageName: 'codebuff',
   displayName: 'Codebuff',
+  wrapperVersion: require('./package.json').version,
   tempDownloadDirName: '.download-temp',
 })
 

package/launcher.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-const { spawn, execFileSync } = require('child_process')
+const { spawn } = require('child_process')
 const fs = require('fs')
 const http = require('http')
 const https = require('https')
@@ -16,11 +16,15 @@ function createLauncher(productConfig) {
   const {
     packageName,
     displayName,
+    wrapperVersion = null,
     includeTreeSitterWasm = true,
     startupBanner = [],
     telemetryEvent = 'cli.update_codebuff_failed',
     telemetryProperties = {},
     tempDownloadDirName = `.${packageName}-download-temp`,
+    // Tests only. os.homedir() ignores $HOME under `bun test`, so pointing HOME
+    // at a temp dir is not enough to keep a test off the real ~/.config.
+    configDir: configDirOverride = null,
   } = productConfig
 
   /**
@@ -68,6 +72,16 @@ function createLauncher(productConfig) {
     }
   }
 
+  /**
+   * How long a binary has to survive before a crash stops looking like a
+   * startup failure. Used to bound the STATUS_STACK_BUFFER_OVERRUN heuristic
+   * below, which is only trustworthy for deaths during startup.
+   */
+  const STARTUP_CRASH_WINDOW_MS = 10000
+
+  /** Bytes of the binary's stderr kept for the crash report. */
+  const STDERR_TAIL_BYTES = 8192
+
   function getUnsignedExitCode(code) {
     return code != null && code < 0 ? code >>> 0 : code
   }
@@ -94,9 +108,38 @@ function createLauncher(productConfig) {
     )
   }
 
+  /**
+   * A startup death that is probably this machine failing to run the optimized
+   * build, reported under the *other* Windows spelling.
+   *
+   * Bun is written in Zig, and a Zig panic on Windows reports itself with
+   * __fastfail(FAST_FAIL_FATAL_APP_EXIT) — NTSTATUS 0xC0000409
+   * (STATUS_STACK_BUFFER_OVERRUN, exit code 3221226505), not
+   * STATUS_ILLEGAL_INSTRUCTION. So a CPU without AVX2 does not reliably die on
+   * the illegal instruction itself: Bun detects the missing feature, then
+   * panics while starting up anyway (oven-sh/bun#28399), and the crash arrives
+   * as 0xC0000409. Only the SIGILL spelling was wired to the baseline
+   * fallback, which is why these machines crash-looped forever.
+   *
+   * On its own 0xC0000409 only means "the binary aborted", so this is bounded
+   * to deaths during startup. A panic ten minutes into a session is an
+   * ordinary bug, and reading it as a missing instruction set would send a
+   * perfectly capable machine to the slower build.
+   */
+  function isStartupCpuFeatureCrash(code, signal, msAlive) {
+    return (
+      process.platform === 'win32' &&
+      getUnsignedExitCode(code) === 0xc0000409 &&
+      !signal &&
+      typeof msAlive === 'number' &&
+      msAlive < STARTUP_CRASH_WINDOW_MS
+    )
+  }
+
   function createConfig(packageName) {
     const homeDir = os.homedir()
-    const configDir = path.join(homeDir, '.config', 'manicode')
+    const configDir =
+      configDirOverride || path.join(homeDir, '.config', 'manicode')
     const binaryName =
       process.platform === 'win32' ? `${packageName}.exe` : packageName
 
@@ -245,35 +288,6 @@ function createLauncher(productConfig) {
     }
   }
 
-  // Returns true (AVX2 present), false (absent), or null (couldn't determine).
-  // Ask the OS directly via IsProcessorFeaturePresent (kernel32), which is
-  // backed by CPUID — far more reliable than matching CPU model names, and it
-  // works on the stock Windows PowerShell that ships with every supported
-  // Windows version. Feature 40 = PF_AVX2_INSTRUCTIONS_AVAILABLE.
-  function probeWindowsAvx2() {
-    const script =
-      '$f = Add-Type -MemberDefinition \'[DllImport("kernel32.dll")] ' +
-      "public static extern bool IsProcessorFeaturePresent(uint feature);' " +
-      '-Name Cpu -Namespace Win32 -PassThru; $f::IsProcessorFeaturePresent(40)'
-    try {
-      const out = execFileSync(
-        'powershell.exe',
-        ['-NoProfile', '-NonInteractive', '-Command', script],
-        {
-          encoding: 'utf8',
-          timeout: 5000,
-          stdio: ['ignore', 'pipe', 'ignore'],
-        },
-      ).trim()
-      if (out === 'True') return true
-      if (out === 'False') return false
-      return null
-    } catch {
-      // No PowerShell, locked-down policy, timeout, etc. — inconclusive.
-      return null
-    }
-  }
-
   let _hasAvx2Cache
 
   function machineHasAvx2() {
@@ -288,31 +302,41 @@ function createLauncher(productConfig) {
       return true
     }
 
-    // Linux detection is a cheap file read, so we don't bother persisting it.
+    // A recorded illegal-instruction crash outranks everything below it: the
+    // binary actually failed on this machine, which beats any inference we
+    // could make about the CPU.
+    const recorded = readCachedAvx2()
+    if (recorded !== null) {
+      return recorded
+    }
+
+    // Linux can just ask, and a file read is cheap enough not to cache.
     if (process.platform === 'linux') {
       return linuxCpuHasAvx2()
     }
 
-    if (process.platform !== 'win32') {
-      return true
-    }
+    // Everything else assumes AVX2 — true of every x64 CPU since ~2013.
+    //
+    // Windows is the case that matters, since it's the only other platform with
+    // a baseline build. It has no /proc/cpuinfo equivalent we can read without
+    // spawning something, and the probe that used to fill the gap asked
+    // PowerShell to compile a C# stub and P/Invoke
+    // kernel32!IsProcessorFeaturePresent — accurate, but a textbook malware
+    // shape that Windows Defender flagged as a "Suspicious PowerShell command
+    // line" on real user machines. The illegal-instruction handler corrects us
+    // instead: tryFallbackToBaseline() calls recordMachineLacksAvx2(), so a
+    // machine without AVX2 pays exactly one failed launch and is answered by
+    // the cache read above from then on.
+    return true
+  }
 
-    // Windows detection shells out to PowerShell. getDefaultTargetKey runs on
-    // every launch (via the version check), so cache the result on disk to keep
-    // startup fast after the first probe.
-    const cached = readCachedAvx2()
-    if (cached !== null) {
-      return cached
-    }
-    const detected = probeWindowsAvx2()
-    if (detected === null) {
-      // Inconclusive probe: assume AVX2 for this launch and rely on the SIGILL
-      // fallback, but don't persist it — a transient failure must not lock in a
-      // wrong answer for the lifetime of the install. We'll re-probe next launch.
-      return true
-    }
-    writeCachedAvx2(detected)
-    return detected
+  // Called from the illegal-instruction fallback. Persisting here is what keeps
+  // the optimistic assumption above from costing more than a single crash — and
+  // it is deliberately separate from the metadata target, so a lost or rewritten
+  // metadata file can't resurrect the AVX2 build on a CPU that can't run it.
+  function recordMachineLacksAvx2() {
+    _hasAvx2Cache = false
+    writeCachedAvx2(false)
   }
 
   function getCpuFeatureCachePath() {
@@ -349,11 +373,12 @@ function createLauncher(productConfig) {
     }
 
     const platformKey = getPlatformKey()
-    // Select the binary up front from explicit CPU feature detection rather than
-    // optimistically launching the AVX2 build and waiting for it to crash with
-    // an illegal instruction. The crash isn't always a clean immediate failure —
-    // it can surface later from a deeper code path — so older CPUs (e.g. an
-    // Intel Xeon with AVX but no AVX2) are safer on baseline from the start.
+    // Linux still detects up front (reading /proc/cpuinfo is free). Windows
+    // cannot without spawning a process, and the PowerShell probe that used to
+    // do it tripped Defender, so Windows is optimistic-then-corrected: see
+    // detectMachineHasAvx2() and tryFallbackToBaseline(). Once a machine has
+    // failed once, readCachedAvx2() answers here and baseline is chosen up front
+    // exactly as it used to be.
     //
     // This assumes every baseline target is gated on AVX2 specifically, which
     // holds today (only linux-x64 and win32-x64 have baseline builds, both
@@ -439,12 +464,18 @@ function createLauncher(productConfig) {
       if (!isTargetAllowedForThisMachine(metadataTarget)) {
         return null
       }
-      return metadata.version || null
+      return getMetadataVersion(metadata)
     } catch (error) {
       return null
     }
   }
 
+  function getMetadataVersion(metadata) {
+    return typeof metadata?.version === 'string' && metadata.version
+      ? metadata.version
+      : null
+  }
+
   function getCurrentMetadata() {
     try {
       if (!fs.existsSync(CONFIG.metadataPath)) {
@@ -456,68 +487,63 @@ function createLauncher(productConfig) {
     }
   }
 
-  function compareVersions(v1, v2) {
-    if (!v1 || !v2) return 0
+  function parseVersion(version) {
+    if (typeof version !== 'string') return null
 
-    // Always update if the current version is not a valid semver
-    // e.g. 1.0.420-beta.1
-    if (!v1.match(/^\d+(\.\d+)*$/)) {
-      return -1
-    }
+    const match = version.match(
+      /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/,
+    )
+    if (!match) return null
+
+    const prerelease = match[4]?.split('.') ?? []
+    if (prerelease.some((part) => /^0\d+$/.test(part))) return null
 
-    const parseVersion = (version) => {
-      const parts = version.split('-')
-      const mainParts = parts[0].split('.').map(Number)
-      const prereleaseParts = parts[1] ? parts[1].split('.') : []
-      return { main: mainParts, prerelease: prereleaseParts }
+    return {
+      main: match.slice(1, 4).map(BigInt),
+      prerelease,
     }
+  }
 
+  function compareVersions(v1, v2) {
     const p1 = parseVersion(v1)
     const p2 = parseVersion(v2)
 
-    for (let i = 0; i < Math.max(p1.main.length, p2.main.length); i++) {
-      const n1 = p1.main[i] || 0
-      const n2 = p2.main[i] || 0
+    // Published package versions are valid semver. Treat malformed cached
+    // metadata as stale so the wrapper repairs it instead of trusting it.
+    if (!p1) return -1
+    if (!p2) return 1
 
-      if (n1 < n2) return -1
-      if (n1 > n2) return 1
+    for (let i = 0; i < p1.main.length; i++) {
+      if (p1.main[i] < p2.main[i]) return -1
+      if (p1.main[i] > p2.main[i]) return 1
     }
 
-    if (p1.prerelease.length === 0 && p2.prerelease.length === 0) {
-      return 0
-    } else if (p1.prerelease.length === 0) {
-      return 1
-    } else if (p2.prerelease.length === 0) {
-      return -1
-    } else {
-      for (
-        let i = 0;
-        i < Math.max(p1.prerelease.length, p2.prerelease.length);
-        i++
-      ) {
-        const pr1 = p1.prerelease[i] || ''
-        const pr2 = p2.prerelease[i] || ''
-
-        const isNum1 = !isNaN(parseInt(pr1))
-        const isNum2 = !isNaN(parseInt(pr2))
-
-        if (isNum1 && isNum2) {
-          const num1 = parseInt(pr1)
-          const num2 = parseInt(pr2)
-          if (num1 < num2) return -1
-          if (num1 > num2) return 1
-        } else if (isNum1 && !isNum2) {
-          return 1
-        } else if (!isNum1 && isNum2) {
-          return -1
-        } else if (pr1 < pr2) {
-          return -1
-        } else if (pr1 > pr2) {
-          return 1
-        }
+    if (p1.prerelease.length === 0) {
+      return p2.prerelease.length === 0 ? 0 : 1
+    }
+    if (p2.prerelease.length === 0) return -1
+
+    for (
+      let i = 0;
+      i < Math.max(p1.prerelease.length, p2.prerelease.length);
+      i++
+    ) {
+      const identifier1 = p1.prerelease[i]
+      const identifier2 = p2.prerelease[i]
+      if (identifier1 === undefined) return -1
+      if (identifier2 === undefined) return 1
+      if (identifier1 === identifier2) continue
+
+      const numeric1 = /^\d+$/.test(identifier1)
+      const numeric2 = /^\d+$/.test(identifier2)
+      if (numeric1 && numeric2) {
+        return BigInt(identifier1) < BigInt(identifier2) ? -1 : 1
       }
-      return 0
+      if (numeric1 !== numeric2) return numeric1 ? -1 : 1
+      return identifier1 < identifier2 ? -1 : 1
     }
+
+    return 0
   }
 
   function formatBytes(bytes) {
@@ -860,13 +886,31 @@ function createLauncher(productConfig) {
     installStagedBinary(stagedBinary)
   }
 
-  async function ensureBinaryExists() {
+  function getRequiredWrapperVersion(currentVersion) {
+    if (
+      !wrapperVersion ||
+      (currentVersion !== null &&
+        compareVersions(currentVersion, wrapperVersion) >= 0)
+    ) {
+      return null
+    }
+    return wrapperVersion
+  }
+
+  async function ensureBinaryReady() {
     const currentVersion = getCurrentVersion()
-    if (currentVersion !== null) {
+    const requiredWrapperVersion = getRequiredWrapperVersion(currentVersion)
+
+    if (currentVersion !== null && requiredWrapperVersion === null) {
       return
     }
 
-    const version = await getLatestVersion()
+    // npm installs update this JavaScript wrapper but intentionally preserve the
+    // downloaded binary. If that binary exits before the background update
+    // check starts, it can otherwise remain stuck forever. The wrapper and its
+    // release binary share a version, so repair that stale cache synchronously
+    // without adding a registry lookup to healthy launches.
+    const version = requiredWrapperVersion ?? (await getLatestVersion())
     if (!version) {
       console.error('❌ Failed to determine latest version')
       console.error('Please check your internet connection and try again')
@@ -878,6 +922,12 @@ function createLauncher(productConfig) {
     } catch (error) {
       term.clearLine()
       printDownloadFailure(error)
+      if (currentVersion !== null) {
+        console.error(
+          `Continuing with cached ${packageName} ${currentVersion}.`,
+        )
+        return
+      }
       process.exit(1)
     }
   }
@@ -921,6 +971,16 @@ function createLauncher(productConfig) {
   }
 
   async function checkForUpdates(runningProcess, exitListener) {
+    // main() schedules this 100ms after launch, so the binary it was handed can
+    // already be dead — a startup crash that handed off to the baseline
+    // fallback, most of all. Updating around a corpse would race that
+    // relaunch's download for the shared temp directory (prepareTempDownloadDir
+    // rmSyncs it) and then spend six seconds SIGKILLing a process that has
+    // already exited.
+    if (runningProcess.exitCode !== null || runningProcess.signalCode !== null) {
+      return
+    }
+
     let stoppedForUpdate = false
 
     try {
@@ -979,7 +1039,32 @@ function createLauncher(productConfig) {
     }
   }
 
-  function printCrashDiagnostics(code, signal) {
+  /**
+   * Make captured output safe to print back to the terminal.
+   *
+   * The tail is replayed *after* resetTerminal() has put the terminal back in
+   * order, so it must not be able to undo that: a stray \x1b[?1049h or
+   * \x1b[?1003h in what the binary printed would re-enter the alternate screen
+   * or re-enable mouse reporting, hiding the very report it is part of. Strip
+   * the escapes and keep the words.
+   */
+  function sanitizeForReplay(text) {
+    if (!text) return ''
+    return (
+      text
+        .replace(/\r\n?/g, '\n')
+        // CSI sequences — the ones that actually change terminal state.
+        .replace(/\x1b\[[0-9;:?<>=]*[ -/]*[@-~]/g, '')
+        // Everything else: strip the control bytes and keep the text. An OSC
+        // or a lone escape loses its introducer and degrades to inert
+        // characters, which is all a crash report needs it to be.
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
+        .replace(/\s+$/, '')
+    )
+  }
+
+  function printCrashDiagnostics(code, signal, context = {}) {
+    const { msAlive = null, stderrTail = '' } = context
     // Windows NTSTATUS codes (unsigned DWORD)
     const unsignedCode = getUnsignedExitCode(code)
     const isIllegalInstruction = isIllegalInstructionExit(code, signal)
@@ -1014,11 +1099,46 @@ function createLauncher(productConfig) {
       console.error('This may indicate a platform compatibility issue.')
       console.error('')
     } else if (isAbort) {
-      console.error('The binary crashed with an abort signal.')
+      const startupCpuCrash = isStartupCpuFeatureCrash(code, signal, msAlive)
+      console.error(
+        startupCpuCrash
+          ? 'The binary aborted while starting up.'
+          : 'The binary crashed with an abort signal.',
+      )
       console.error('')
+      // Reached only once the baseline fallback has declined or failed, so name
+      // the case the user can still act on instead of leaving them with an
+      // abort code and a bug-tracker link.
+      if (startupCpuCrash) {
+        if (getCurrentMetadata()?.target === getBaselineFallbackTargetKey()) {
+          console.error(
+            'This is already the older-CPU (baseline) build, so a missing AVX2',
+          )
+          console.error(
+            'instruction set is not the whole story — please include the output',
+          )
+          console.error('below in your report.')
+          console.error('')
+        } else {
+          console.error(
+            'On x64 Windows this is usually a CPU without AVX2 support, which',
+          )
+          console.error('the standard build requires.')
+          console.error('')
+          printBaselineOverrideHint()
+        }
+      }
     }
 
     printSystemInfo()
+    const tailText = sanitizeForReplay(stderrTail)
+    if (tailText) {
+      console.error('')
+      console.error(`Last output from ${packageName}:`)
+      for (const line of tailText.split('\n')) {
+        console.error(`  ${line}`)
+      }
+    }
     console.error('')
     console.error('Please report this issue at:')
     console.error('  https://github.com/CodebuffAI/codebuff/issues')
@@ -1035,13 +1155,28 @@ function createLauncher(productConfig) {
     console.error('')
   }
 
+  /**
+   * What we actually know about AVX2, not what we assume.
+   *
+   * The old line printed a flat "yes" from machineHasAvx2(), which on Windows
+   * is an optimistic default and not a measurement (see detectMachineHasAvx2).
+   * Every crash report that reached us therefore claimed AVX2 was present on
+   * machines we had never asked, which is exactly the evidence that would have
+   * pointed at the CPU.
+   */
+  function describeAvx2Support() {
+    if (readCachedAvx2() === false) return 'no (recorded crash)'
+    if (process.platform === 'linux') return machineHasAvx2() ? 'yes' : 'no'
+    return 'not checked (assumed present)'
+  }
+
   function printSystemInfo() {
     const metadata = getCurrentMetadata()
     console.error('System info:')
     console.error(`  Platform: ${process.platform} ${process.arch}`)
     console.error(`  Node:     ${process.version}`)
     if (process.arch === 'x64') {
-      console.error(`  AVX2:     ${machineHasAvx2() ? 'yes' : 'no'}`)
+      console.error(`  AVX2:     ${describeAvx2Support()}`)
     }
     console.error(`  Target:   ${metadata?.target || getDefaultTargetKey()}`)
     console.error(`  Binary:   ${CONFIG.binaryPath}`)
@@ -1112,7 +1247,12 @@ function createLauncher(productConfig) {
     try {
       const { env: optionEnv, ...spawnOptions } = options
       child = spawn(CONFIG.binaryPath, process.argv.slice(2), {
-        stdio: 'inherit',
+        // stdin/stdout stay inherited — the TUI owns the terminal and must see
+        // a real tty. stderr is teed on Windows only; see watchLaunch.
+        stdio:
+          process.platform === 'win32'
+            ? ['inherit', 'inherit', 'pipe']
+            : ['inherit', 'inherit', 'inherit'],
         ...spawnOptions,
         env: {
           ...process.env,
@@ -1125,12 +1265,72 @@ function createLauncher(productConfig) {
     }
 
     child.on('error', exitOnSpawnFailure)
+    child.launch = watchLaunch(child)
 
     return child
   }
 
-  async function tryFallbackToBaseline(code, signal) {
-    if (!isIllegalInstructionExit(code, signal)) {
+  /**
+   * Watch a launch so its death can be explained: how long the binary lived,
+   * and what it printed on the way out.
+   *
+   * The stderr tee is what makes a crash report self-contained. When the binary
+   * dies natively we reset the terminal, and that reset leaves the alternate
+   * screen with \x1b[?1049l — discarding its contents, including any panic Bun
+   * printed there. (The CLI's own terminal watchdog sends the same sequence, so
+   * dropping it here wouldn't help.) Every report of codebuff#792 is a launcher
+   * message with no panic text above it; keeping a copy means the next one
+   * arrives with Bun's own words in it.
+   *
+   * Only Windows pipes stderr — that's where the reports come from, and
+   * everywhere else stderr stays a real tty.
+   */
+  function watchLaunch(child) {
+    const startedAt = Date.now()
+    const chunks = []
+    let bufferedBytes = 0
+
+    child.stderr?.on('data', (chunk) => {
+      try {
+        // Straight through: as far as the binary and the user are concerned,
+        // this is still its terminal.
+        process.stderr.write(chunk)
+      } catch {
+        // stderr may be closed
+      }
+      chunks.push(chunk)
+      bufferedBytes += chunk.length
+      while (bufferedBytes > STDERR_TAIL_BYTES && chunks.length > 1) {
+        bufferedBytes -= chunks.shift().length
+      }
+    })
+
+    return {
+      msAlive: () => Date.now() - startedAt,
+      stderrTail: () =>
+        Buffer.concat(chunks).toString('utf8').slice(-STDERR_TAIL_BYTES),
+      // 'exit' can beat the last bytes through the pipe; 'close' is the event
+      // that means the stdio is drained too. The timeout is a bound on a stuck
+      // pipe and is deliberately NOT unref'd — an unref'd timer lets the
+      // process exit before it fires, which would swallow the crash report
+      // entirely. Already-drained streams resolve without waiting for it.
+      drained: () =>
+        child.stderr && !child.stderr.readableEnded
+          ? new Promise((resolve) => {
+              child.once('close', resolve)
+              child.stderr.once('end', resolve)
+              setTimeout(resolve, 250)
+            })
+          : Promise.resolve(),
+    }
+  }
+
+  async function tryFallbackToBaseline(code, signal, msAlive) {
+    // Two spellings of one failure, at two levels of certainty. SIGILL /
+    // STATUS_ILLEGAL_INSTRUCTION is proof this CPU cannot run this build; a
+    // Windows startup abort is a strong suspicion (see isStartupCpuFeatureCrash).
+    const confirmed = isIllegalInstructionExit(code, signal)
+    if (!confirmed && !isStartupCpuFeatureCrash(code, signal, msAlive)) {
       return false
     }
 
@@ -1139,12 +1339,28 @@ function createLauncher(productConfig) {
       return false
     }
 
+    // An explicit target is the user's decision; don't download over it.
+    if (getTargetOverride()) {
+      return false
+    }
+
     const metadata = getCurrentMetadata()
     const currentTarget = metadata?.target || getDefaultTargetKey()
     if (currentTarget === fallbackTarget) {
       return false
     }
 
+    // Only a confirmed illegal instruction gets written down. Persisting it
+    // before the download is what caps the cost at one crash: even if the
+    // download or the relaunch fails, we never optimistically pick the AVX2
+    // build again. A suspected crash records nothing — installing the baseline
+    // already keeps this machine on it, so a guess that turns out to be wrong
+    // costs the slower build instead of leaving cpu-features.json asserting a
+    // CPU limitation we never observed.
+    if (confirmed) {
+      recordMachineLacksAvx2()
+    }
+
     const version = metadata?.version || (await getLatestVersion())
     if (!version) {
       return false
@@ -1155,7 +1371,9 @@ function createLauncher(productConfig) {
     })
     console.error('')
     console.error(
-      `${packageName} is switching to the older-CPU binary for this machine.`,
+      confirmed
+        ? `${packageName} is switching to the older-CPU binary for this machine.`
+        : `${packageName} crashed on startup; trying the older-CPU binary.`,
     )
 
     try {
@@ -1173,9 +1391,20 @@ function createLauncher(productConfig) {
 
   function attachExitHandler(child, allowBaselineFallback = true) {
     const exitListener = async (code, signal) => {
+      // A child we never watched (only reachable from a test) reports no age
+      // rather than a suspiciously young one: absent evidence must not be read
+      // as a startup crash and trigger a download.
+      const msAlive = child.launch ? child.launch.msAlive() : Infinity
+
+      let stderrTail = ''
+      if (child.launch && (isWindowsNativeCrashCode(code) || signal)) {
+        await child.launch.drained()
+        stderrTail = child.launch.stderrTail()
+      }
+
       if (
         allowBaselineFallback &&
-        (await tryFallbackToBaseline(code, signal))
+        (await tryFallbackToBaseline(code, signal, msAlive))
       ) {
         return
       }
@@ -1183,7 +1412,7 @@ function createLauncher(productConfig) {
       resetTerminal({
         exitAlternateScreen: shouldExitAlternateScreen(code, signal),
       })
-      printCrashDiagnostics(code, signal)
+      printCrashDiagnostics(code, signal, { msAlive, stderrTail })
       process.exit(signal ? 1 : code || 0)
     }
 
@@ -1197,7 +1426,7 @@ function createLauncher(productConfig) {
     }
     if (startupBanner.length > 0) console.log('')
 
-    await ensureBinaryExists()
+    await ensureBinaryReady()
 
     const child = spawnInstalledBinary()
     const exitListener = attachExitHandler(child)
@@ -1211,6 +1440,29 @@ function createLauncher(productConfig) {
     config: productConfig,
     main,
     stopRunningProcess,
+    // Internals exposed for tests only. The AVX2 path is optimistic-then-
+    // corrected (see detectMachineHasAvx2), so the correction has to be
+    // exercised directly — there is no way to make a CI runner lack AVX2.
+    __testing: {
+      detectMachineHasAvx2,
+      recordMachineLacksAvx2,
+      readCachedAvx2,
+      isIllegalInstructionExit,
+      isStartupCpuFeatureCrash,
+      tryFallbackToBaseline,
+      printCrashDiagnostics,
+      checkForUpdates,
+      spawnInstalledBinary,
+      attachExitHandler,
+      getDefaultTargetKey,
+      getCpuFeatureCachePath,
+      getCurrentVersion,
+      getMetadataVersion,
+      getRequiredWrapperVersion,
+      ensureBinaryReady,
+      isTargetAllowedForThisMachine,
+      CONFIG,
+    },
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebuff",
-  "version": "1.0.685",
+  "version": "1.0.686",
   "description": "AI coding agent",
   "license": "MIT",
   "bin": {