freebuff 0.1.2 → 0.1.5

package/README.md

@@ -33,7 +33,7 @@ and keep the extracted `freebuff` binary and `tree-sitter.wasm` together.
 
 ## Why Freebuff?
 
-**Choice of leading models** — The regular CLI picker includes GLM 5.3 Flash, DeepSeek, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.2, with GLM 5.3 Flash selected by default.
+**Choice of leading models** — The regular CLI picker includes GLM 5.3 Flash, DeepSeek, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.3, with GLM 5.3 Flash selected by default.
 
 **Fast** — 5–10× speed up. 3–5× tokens per second compared to Claude, plus context gathering in seconds.
 
@@ -43,7 +43,7 @@ and keep the extracted `freebuff` binary and `tree-sitter.wasm` together.
 
 **How can it be free?** Freebuff is supported by text ads.
 
-**What models do you use?** In full mode, the regular picker includes GLM 5.3 Flash, DeepSeek V4.1 Flash, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.2. Space Bunny Alpha is a beta stealth model from an anonymous provider that retains prompts. Gemini 3.8 Flash requires a paid plan: without one it is listed but locked, and selecting it opens the plans page. GPT-6 Luna and MiMo 2.6 Pro are open to every full-access account. Muse Spark 1.2 has a 1M-token context and is rate limited across all users, so at busy times it queues and then answers on DeepSeek V4 Flash instead of leaving you waiting. GLM 5.3 Flash is the CLI default, and it costs no session at all, so the default is always available no matter how much you have used. Limited mode uses GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4. Most models draw on your normal daily sessions rather than a separate limit; GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4 are unmetered at full access. Models may still serve from a quantized (Q8_0) build.
+**What models do you use?** In full mode, the regular picker includes GLM 5.3 Flash, DeepSeek V4.1 Flash, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.3. Space Bunny Alpha is a beta stealth model from an anonymous provider that retains prompts. Gemini 3.8 Flash and Muse Spark 1.3 require a paid plan: without one they are listed but locked, and selecting one opens the plans page. GPT-6 Luna and MiMo 2.6 Pro are open to every full-access account. Muse Spark 1.3 has a 1M-token context and is rate limited across all users, so at busy times it queues and then answers on DeepSeek V4 Flash instead of leaving you waiting. GLM 5.3 Flash is the CLI default, and it costs no session at all, so the default is always available no matter how much you have used. Limited mode uses GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4. Most models draw on your normal daily sessions rather than a separate limit; GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4 are unmetered at full access. Models may still serve from a quantized (Q8_0) build.
 
 **Which countries is Freebuff available in?** All countries. Freebuff runs in "full" mode in the US, Canada, UK, EU, and other select countries, and in "limited" mode everywhere else (or while using a VPN). See [freebuff.com](https://freebuff.com) for the full list.
 

package/launcher.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-const { spawn } = require('child_process')
+const { execFileSync, spawn } = require('child_process')
 const crypto = require('crypto')
 const fs = require('fs')
 const http = require('http')
@@ -35,15 +35,51 @@ const PLATFORM_TARGET_KEYS = [
 
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]'])
 
+/**
+ * Registrable domains that serve release downloads. An https override must
+ * name one of these or a subdomain of one.
+ */
+const RELEASE_ORIGIN_DOMAINS = ['codebuff.com', 'freebuff.com']
+
+function isReleaseOriginHost(hostname) {
+  const host = hostname.toLowerCase()
+  return RELEASE_ORIGIN_DOMAINS.some(
+    (domain) => host === domain || host.endsWith(`.${domain}`),
+  )
+}
+
+/**
+ * A release version the launcher will put into a download URL or a file
+ * name: strict `MAJOR.MINOR.PATCH` with an optional dot-separated
+ * alphanumeric prerelease, and nothing else — no build metadata, no
+ * leading `v`, no whitespace, `/`, `..`, `%` or `?`. The version reaches
+ * `/api/releases/download/<version>/<file>` and the partial-archive path
+ * from the npm registry document or the local metadata file, and neither
+ * is a place that should be able to rewrite a URL path or escape a
+ * directory.
+ */
+const STRICT_RELEASE_VERSION =
+  /^(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})(?:-(?:0|[1-9]\d{0,8}|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d{0,8}|\d*[A-Za-z-][0-9A-Za-z-]*))*)?$/
+
+function isStrictReleaseVersion(version) {
+  return (
+    typeof version === 'string' &&
+    version.length <= 64 &&
+    STRICT_RELEASE_VERSION.test(version)
+  )
+}
+
 /**
  * Decide where release archives are downloaded from.
  *
  * NEXT_PUBLIC_CODEBUFF_APP_URL is read at runtime, so anyone able to set an
- * environment variable could point the launcher at a plain-http origin and
- * let a network attacker substitute the archive. The override is honoured
- * only over https, or over http on a loopback host (local release servers in
- * development and tests). Anything else is ignored with a warning and the
- * default origin is used.
+ * environment variable could point the launcher at another origin. The
+ * archive's sha256 comes from npm, not from that origin, so a substituted
+ * archive is refused either way; the origin is still held to the hosts that
+ * actually serve releases. The override is honoured only over https to a
+ * codebuff.com / freebuff.com host, or over http/https on a loopback host
+ * (local release servers in development and tests). Anything else is
+ * ignored with a warning and the default origin is used.
  */
 function resolveDownloadOrigin(configuredOrigin, { warn = () => {} } = {}) {
   if (typeof configuredOrigin !== 'string' || configuredOrigin.trim() === '') {
@@ -62,15 +98,25 @@ function resolveDownloadOrigin(configuredOrigin, { warn = () => {} } = {}) {
   }
 
   const isLocal = LOCAL_HOSTNAMES.has(parsed.hostname.toLowerCase())
+  const isHttp = parsed.protocol === 'http:' || parsed.protocol === 'https:'
+  // Only an origin: credentials or a query would ride along on every request.
+  const isBareOrigin =
+    !parsed.username && !parsed.password && !parsed.search && !parsed.hash
+  if (isHttp && isLocal && isBareOrigin) {
+    return trimmed
+  }
   if (
-    parsed.protocol === 'https:' ||
-    (parsed.protocol === 'http:' && isLocal)
+    parsed.protocol === 'https:' &&
+    isReleaseOriginHost(parsed.hostname) &&
+    isBareOrigin
   ) {
     return trimmed
   }
 
   warn(
-    `Ignoring NEXT_PUBLIC_CODEBUFF_APP_URL=${configuredOrigin}: release downloads must use https (http is allowed only for localhost). Downloading from ${DEFAULT_DOWNLOAD_ORIGIN}.`,
+    parsed.protocol === 'https:'
+      ? `Ignoring NEXT_PUBLIC_CODEBUFF_APP_URL=${parsed.protocol}//${parsed.host}: release downloads come only from codebuff.com or freebuff.com (or localhost). Downloading from ${DEFAULT_DOWNLOAD_ORIGIN}.`
+      : `Ignoring NEXT_PUBLIC_CODEBUFF_APP_URL=${parsed.protocol}//${parsed.host}: release downloads must use https (http is allowed only for localhost). Downloading from ${DEFAULT_DOWNLOAD_ORIGIN}.`,
   )
   return DEFAULT_DOWNLOAD_ORIGIN
 }
@@ -146,6 +192,9 @@ function createLauncher(productConfig) {
     // Tests only. os.homedir() ignores $HOME under `bun test`, so pointing HOME
     // at a temp dir is not enough to keep a test off the real ~/.config.
     configDir: configDirOverride = null,
+    // Tests only: stands in for the OS AVX2 probe (/proc/cpuinfo, sysctl),
+    // returning true, false, or null for "could not tell".
+    cpuAvx2Probe: cpuAvx2ProbeOverride = null,
   } = productConfig
 
   /**
@@ -282,6 +331,19 @@ function createLauncher(productConfig) {
   const BUN_ILLEGAL_INSTRUCTION_PANIC =
     /^panic(?:\([^)\n]*\))?: Illegal instruction at address 0x[0-9a-f]+/im
 
+  /**
+   * Bun's `CPU:` header line lists the features it detected (`CPU: sse42
+   * popcnt avx avx2`). avx2 in that list is Bun's own CPUID saying the CPU has
+   * it, so an illegal instruction on such a machine is not a missing AVX2.
+   */
+  const BUN_CPU_LINE = /^CPU:([^\n]*)$/m
+
+  function stderrReportsAvx2Present(stderrTail) {
+    if (!stderrTail) return false
+    const match = BUN_CPU_LINE.exec(sanitizeForReplay(stderrTail))
+    return Boolean(match && /(?:^|\s)avx2(?:\s|$)/i.test(match[1]))
+  }
+
   function stderrReportsMissingCpuFeature(code, signal, stderrTail) {
     if (!stderrTail || (code === 0 && !signal)) return false
     const text = sanitizeForReplay(stderrTail)
@@ -442,12 +504,75 @@ function createLauncher(productConfig) {
     return null
   }
 
-  function linuxCpuHasAvx2() {
-    try {
-      return /\bavx2\b/i.test(fs.readFileSync('/proc/cpuinfo', 'utf8'))
-    } catch {
-      return true
+  /**
+   * `/proc/cpuinfo` answers for the kernel's view of the CPU: true or false
+   * from its `flags` lines, null when it has none to read.
+   */
+  function parseCpuinfoAvx2(text) {
+    if (typeof text !== 'string' || !/^flags\s*:/m.test(text)) return null
+    return /^flags\s*:.*\bavx2\b/m.test(text)
+  }
+
+  /** `sysctl -n hw.optional.avx2_0` prints 1 or 0 on an Intel Mac. */
+  function parseSysctlAvx2(output) {
+    const value = typeof output === 'string' ? output.trim() : ''
+    if (value === '1') return true
+    if (value === '0') return false
+    return null
+  }
+
+  // Where probeCpuAvx2() gets its answer, recorded as the evidence for a pin.
+  function cpuProbeSource() {
+    if (process.platform === 'linux') return 'cpuinfo'
+    if (process.platform === 'darwin') return 'sysctl'
+    return 'probe'
+  }
+
+  let _cpuProbeCache
+
+  /**
+   * Ask the OS whether this CPU has AVX2: true, false, or null for "could not
+   * tell". Linux reads /proc/cpuinfo. macOS asks sysctl, which costs a
+   * subprocess, so this runs only on the crash path, when re-checking an old
+   * pin, and when picking a download target for a baseline install, never on
+   * an ordinary launch. Windows has no probe: the one we had tripped Defender
+   * (see detectMachineHasAvx2), so there Bun's crash report is the evidence.
+   */
+  function probeCpuAvx2() {
+    if (_cpuProbeCache === undefined) {
+      _cpuProbeCache = cpuAvx2ProbeOverride
+        ? cpuAvx2ProbeOverride()
+        : probeCpuAvx2FromOs()
     }
+    return _cpuProbeCache
+  }
+
+  function probeCpuAvx2FromOs() {
+    if (process.arch !== 'x64') return null
+    if (process.platform === 'linux') {
+      try {
+        return parseCpuinfoAvx2(fs.readFileSync('/proc/cpuinfo', 'utf8'))
+      } catch {
+        return null
+      }
+    }
+    if (process.platform === 'darwin') {
+      // x64 node on Apple Silicon runs under Rosetta, and sysctl (arm64 only)
+      // then describes the host, not what Rosetta emulates. No answer there.
+      if (/\bApple\b/.test(os.cpus()[0]?.model || '')) return null
+      try {
+        return parseSysctlAvx2(
+          execFileSync('/usr/sbin/sysctl', ['-n', 'hw.optional.avx2_0'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 2000,
+          }),
+        )
+      } catch {
+        return null
+      }
+    }
+    return null
   }
 
   let _hasAvx2Cache
@@ -464,17 +589,33 @@ function createLauncher(productConfig) {
       return true
     }
 
-    // A recorded illegal-instruction crash outranks everything below it: the
-    // binary actually failed on this machine, which beats any inference we
-    // could make about the CPU.
-    const recorded = readCachedAvx2()
-    if (recorded !== null) {
-      return recorded
+    // A recorded verdict outranks everything below it. Every record now names
+    // its evidence: Bun's crash report, the OS probe, or 'crash' for an
+    // illegal instruction nothing could explain.
+    //
+    // A record WITHOUT evidence was written by an older launcher, which pinned
+    // baseline on any SIGILL, including a bug on a CPU that has AVX2. Re-check
+    // those against the OS once: a CPU with AVX2 gets its record dropped and
+    // the optimized build back on the next update (see getDownloadTargetKey).
+    const record = readCpuFeatureRecord()
+    if (record && (record.avx2 || record.evidence)) {
+      return record.avx2
+    }
+    if (record) {
+      const probed = probeCpuAvx2()
+      if (probed !== true) {
+        writeCpuFeatureRecord(
+          false,
+          probed === false ? cpuProbeSource() : 'crash',
+        )
+        return false
+      }
+      clearCpuFeatureRecord()
     }
 
     // Linux can just ask, and a file read is cheap enough not to cache.
     if (process.platform === 'linux') {
-      return linuxCpuHasAvx2()
+      return probeCpuAvx2() ?? true
     }
 
     // Everything else assumes AVX2 — true of every x64 CPU since ~2013.
@@ -492,42 +633,77 @@ function createLauncher(productConfig) {
     return true
   }
 
-  // Called from the illegal-instruction fallback. Persisting here is what keeps
-  // the optimistic assumption above from costing more than a single crash — and
-  // it is deliberately separate from the metadata target, so a lost or rewritten
-  // metadata file can't resurrect the AVX2 build on a CPU that can't run it.
-  function recordMachineLacksAvx2() {
+  /**
+   * Positive evidence that this CPU runs the optimized build: a recorded
+   * verdict with evidence, or the OS probe. The optimistic default does not
+   * count. This is what lets a baseline install move back to the optimized
+   * build; without evidence, baseline stays put.
+   */
+  function knownToHaveAvx2() {
+    if (!machineHasAvx2()) return false
+    const record = readCpuFeatureRecord()
+    if (record?.avx2 === true && record.evidence) return true
+    return probeCpuAvx2() === true
+  }
+
+  // Called from the illegal-instruction fallback, only when the CPU is shown
+  // to lack AVX2 or nothing can say either way (see tryFallbackToBaseline).
+  // Persisting here is what keeps the optimistic assumption above from costing
+  // more than a single crash — and it is deliberately separate from the
+  // metadata target, so a lost or rewritten metadata file can't resurrect the
+  // AVX2 build on a CPU that can't run it.
+  function recordMachineLacksAvx2(evidence = 'crash') {
     _hasAvx2Cache = false
-    writeCachedAvx2(false)
+    writeCpuFeatureRecord(false, evidence)
   }
 
   function getCpuFeatureCachePath() {
     return path.join(CONFIG.configDir, 'cpu-features.json')
   }
 
-  function readCachedAvx2() {
+  /** `{ avx2, evidence }`; evidence is null on a record from an older launcher. */
+  function readCpuFeatureRecord() {
     try {
       const cache = JSON.parse(
         fs.readFileSync(getCpuFeatureCachePath(), 'utf8'),
       )
-      return typeof cache.avx2 === 'boolean' ? cache.avx2 : null
+      if (typeof cache.avx2 !== 'boolean') return null
+      return {
+        avx2: cache.avx2,
+        evidence:
+          typeof cache.evidence === 'string' && cache.evidence
+            ? cache.evidence
+            : null,
+      }
     } catch {
       return null
     }
   }
 
-  function writeCachedAvx2(value) {
+  function readCachedAvx2() {
+    return readCpuFeatureRecord()?.avx2 ?? null
+  }
+
+  function writeCpuFeatureRecord(value, evidence) {
     try {
       fs.mkdirSync(CONFIG.configDir, { recursive: true })
       fs.writeFileSync(
         getCpuFeatureCachePath(),
-        JSON.stringify({ avx2: value }),
+        JSON.stringify({ avx2: value, evidence }),
       )
     } catch {
       // Best effort; we'll just re-probe next launch.
     }
   }
 
+  function clearCpuFeatureRecord() {
+    try {
+      fs.unlinkSync(getCpuFeatureCachePath())
+    } catch {
+      // Already gone, or unwritable; either way nothing pins baseline now.
+    }
+  }
+
   function getDefaultTargetKey() {
     const override = getTargetOverride()
     if (override) {
@@ -580,6 +756,17 @@ function createLauncher(productConfig) {
 
     const metadata = getCurrentMetadata()
     if (metadata?.target && isTargetAllowedForThisMachine(metadata.target)) {
+      // An installed baseline keeps running (isTargetAllowedForThisMachine
+      // always allows it), but it is not a life sentence: once there is
+      // evidence the CPU has AVX2, the next download goes back to the optimized
+      // build. That is how a machine sent to baseline by a crash that was not a
+      // missing AVX2 re-probes on the next version.
+      if (
+        metadata.target === getBaselineFallbackTargetKey() &&
+        knownToHaveAvx2()
+      ) {
+        return getDefaultTargetKey()
+      }
       return metadata.target
     }
 
@@ -606,7 +793,7 @@ function createLauncher(productConfig) {
 
       const body = await streamToString(res)
       const packageData = JSON.parse(body)
-      if (typeof packageData.version !== 'string' || !packageData.version) {
+      if (!isStrictReleaseVersion(packageData.version)) {
         return null
       }
 
@@ -795,6 +982,9 @@ function createLauncher(productConfig) {
   }
 
   function getPartialArchivePath(version, targetKey) {
+    if (!isStrictReleaseVersion(version)) {
+      throw new Error(`Invalid release version for an archive path: ${version}`)
+    }
     return path.join(
       CONFIG.configDir,
       `.${packageName}-${version}-${targetKey}.tar.gz.part`,
@@ -1027,6 +1217,21 @@ function createLauncher(productConfig) {
   ) {
     const fileName = PLATFORM_TARGETS[targetKey]
 
+    // Before anything is built from it: the version becomes a URL path
+    // segment and part of a file name below.
+    if (!isStrictReleaseVersion(version)) {
+      const error = new Error(
+        `Refusing to download ${packageName}: ${JSON.stringify(String(version)).slice(0, 80)} is not a release version.`,
+      )
+      error.code = 'EBADVERSION'
+      error.retryable = false
+      trackUpdateFailed(error.message, 'invalid', {
+        stage: 'version_check',
+        target: targetKey,
+      })
+      throw error
+    }
+
     if (!fileName) {
       const error = new Error(
         `Unsupported platform: ${process.platform} ${process.arch}`,
@@ -1713,7 +1918,7 @@ function createLauncher(productConfig) {
     // feature (see stderrReportsMissingCpuFeature), is proof this CPU cannot
     // run this build; a Windows startup abort is a strong suspicion (see
     // isStartupCpuFeatureCrash).
-    const confirmed =
+    let confirmed =
       isIllegalInstructionExit(code, signal) ||
       stderrReportsMissingCpuFeature(code, signal, stderrTail)
     if (!confirmed && !isStartupCpuFeatureCrash(code, signal, msAlive)) {
@@ -1736,16 +1941,35 @@ function createLauncher(productConfig) {
       return false
     }
 
-    // Only a confirmed illegal instruction gets written down. Persisting it
-    // before the download is what caps the cost at one crash: even if the
-    // download or the relaunch fails, we never optimistically pick the AVX2
-    // build again. A suspected crash records nothing — installing the baseline
-    // already keeps this machine on it, so a guess that turns out to be wrong
-    // costs the slower build instead of leaving cpu-features.json asserting a
-    // CPU limitation we never observed.
-    if (confirmed) {
-      recordMachineLacksAvx2()
-    }
+    // An illegal instruction proves the binary used an instruction this
+    // machine refused, not that the instruction was AVX2: a Bun or JIT bug
+    // raises SIGILL too. So ask for evidence before pinning baseline, which
+    // otherwise sticks for good.
+    //
+    // - The CPU lacks AVX2 (Bun's `Features: no_avx2`, or the OS probe):
+    //   record it. Persisting before the download is what caps the cost at
+    //   one crash: even if the download or the relaunch fails, we never
+    //   optimistically pick the AVX2 build again.
+    // - The CPU has AVX2 (the OS probe, or avx2 in Bun's `CPU:` line): this
+    //   crash is something else. Run baseline for now, since it may still
+    //   start, and record the evidence so the next update goes back to the
+    //   optimized build (getDownloadTargetKey). At worst one crash per release.
+    // - No evidence either way (Windows without Bun's report, an unreadable
+    //   /proc/cpuinfo, Rosetta): a confirmed crash is pinned as before.
+    // A suspected crash records nothing: installing the baseline already keeps
+    // this machine on it, and cpu-features.json should not assert a CPU
+    // limitation we never observed.
+    const verdict = crashAvx2Verdict(code, signal, stderrTail)
+    if (verdict.avx2 === true) {
+      writeCpuFeatureRecord(true, verdict.evidence)
+      confirmed = false
+    } else if (verdict.avx2 === false) {
+      recordMachineLacksAvx2(verdict.evidence)
+      confirmed = true
+    } else if (confirmed) {
+      recordMachineLacksAvx2('crash')
+    }
+    const cpuHasAvx2 = verdict.avx2 === true
 
     let version = metadata?.version || null
     let binaryChecksums = null
@@ -1763,9 +1987,11 @@ function createLauncher(productConfig) {
     })
     console.error('')
     console.error(
-      confirmed
-        ? `${packageName} is switching to the older-CPU binary for this machine.`
-        : `${packageName} crashed on startup; trying the older-CPU binary.`,
+      cpuHasAvx2
+        ? `${packageName} crashed, but this CPU supports AVX2; using the older-CPU binary until the next update.`
+        : confirmed
+          ? `${packageName} is switching to the older-CPU binary for this machine.`
+          : `${packageName} crashed on startup; trying the older-CPU binary.`,
     )
 
     try {
@@ -1781,6 +2007,27 @@ function createLauncher(productConfig) {
     return true
   }
 
+  /**
+   * What the evidence says about AVX2 after a crash: `{ avx2, evidence }`,
+   * avx2 null when nothing can tell. Bun's own verdict that AVX2 is missing
+   * wins, then the OS probe, then avx2 in Bun's `CPU:` line.
+   */
+  function crashAvx2Verdict(code, signal, stderrTail) {
+    if (
+      stderrTail &&
+      !(code === 0 && !signal) &&
+      BUN_NO_AVX2_FEATURE.test(sanitizeForReplay(stderrTail))
+    ) {
+      return { avx2: false, evidence: 'bun-report' }
+    }
+    const probed = probeCpuAvx2()
+    if (probed !== null) return { avx2: probed, evidence: cpuProbeSource() }
+    if (stderrReportsAvx2Present(stderrTail)) {
+      return { avx2: true, evidence: 'bun-report' }
+    }
+    return { avx2: null, evidence: null }
+  }
+
   function attachExitHandler(child, allowBaselineFallback = true) {
     const exitListener = async (code, signal) => {
       // A child we never watched (only reachable from a test) reports no age
@@ -1843,6 +2090,11 @@ function createLauncher(productConfig) {
       detectMachineHasAvx2,
       recordMachineLacksAvx2,
       readCachedAvx2,
+      readCpuFeatureRecord,
+      parseCpuinfoAvx2,
+      parseSysctlAvx2,
+      stderrReportsAvx2Present,
+      getDownloadTargetKey,
       isIllegalInstructionExit,
       isStartupCpuFeatureCrash,
       stderrReportsMissingCpuFeature,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freebuff",
-  "version": "0.1.2",
+  "version": "0.1.5",
   "description": "The world's strongest free coding agent",
   "license": "MIT",
   "bin": {
@@ -41,13 +41,13 @@
     "provenance": false
   },
   "binaryChecksums": {
-    "linux-x64": "2a149ec595d8f27ec8654b5ab072c22020d5e4f4bd0a0d2c0a1a334b6a063f71",
-    "linux-x64-baseline": "22b13efa9eb52d9a074ed2e67feb6474a551796e22d0fa0e7a9a3081943ef16b",
-    "linux-arm64": "ef43f44264cae55d86f5d0df45f4c948543d0bf92525c1b296b910badc2f0c71",
-    "darwin-x64": "cba39ca908625a8b43335942879fa6c9bd91a2a623f4a26d8a9e0d3e39b080e3",
-    "darwin-x64-baseline": "8be9ca67c635dd4bac21d1e726353c24df5d421d598a2c94fff43540a8062369",
-    "darwin-arm64": "529b4b2352690c9d3cfc8436e8b15649bc043eb58e07781d6986c6f0f2577f4e",
-    "win32-x64": "fc97aa41e2a59304afa49e27bb2f22aa8d7b47f39d182a3abd99c5ca33c5ddd2",
-    "win32-x64-baseline": "d280003c00ce1d91b19cbeee3ead6fee516f9aba665c175a8e19553d0a6dfe8c"
+    "linux-x64": "2c0f5b23b563830cbfb99f4fcc57e2657524f77159f2a8088b67f8279f7db3f9",
+    "linux-x64-baseline": "194b9ea6667ef7503412f4edca2d0e256cf8dc592e658bc147a46105f15aa44e",
+    "linux-arm64": "7609d2cad1055d0df2c9d73b95a10c98439eee77a78d739084af408c33d8e6b4",
+    "darwin-x64": "a1c7aa7fc361d1f5095d5c50dab409101a411b14951933c55b8f03d777600f5f",
+    "darwin-x64-baseline": "165d9077f04af2d30063d06445f0ddc2aa1feafadb034140d2f66435df4ae1c6",
+    "darwin-arm64": "2e99d58f7805c5ff8975e94ee6c31d23bfd2d0dd1094806659a1fa6c4c9c68e0",
+    "win32-x64": "ba239c2aae754927e11655cbc534c6c5dcfc3c41e6f8a8e9c4ede256acf23fc3",
+    "win32-x64-baseline": "cb1d911d296d481ffb1165bda1999c6e5633bb0d183c584fc121da2db7cf8abc"
   }
 }