VM setup: catch missing AVX2 up front and stop the sign-in step hanging

[modem7]

Summary

Root cause found: the VM's CPU type was Proxmox's x86-64-v2-AES, which doesn't expose AVX/AVX2. Claude Code's Bun-compiled Linux binary doesn't fail cleanly without AVX2: claude auth status --json spun with one thread at 100% CPU for 29+ minutes, and did the same with stdin detached and with an empty HOME. Setting the VM's CPU type to host fixed it; the same command now returns instantly.

New: AVX2 preflight check

• On x86-64, preflight checks /proc/cpuinfo for avx2 before installing anything. If it's missing, the script stops with the CPU model and the fix: set the VM CPU type to host (or at least x86-64-v3), then fully stop and start the VM, because a guest reboot isn't enough. ALLOW_NO_AVX2=1 overrides it with a warning; ARM is skipped.

Hardening of the sign-in step (defence in depth)

A real run of claude-code-vm-setup.sh got stuck right after >>> Signing in to Claude Code, with no further output. The "Open the URL below…" line never printed, so it was hanging in the sign-in status check, not in claude auth login.

That check ran claude auth status --json | jq … with stdin still attached to the user's terminal and stdout piped. Anything that made the CLI wait there would sit there silently: a prompt it printed (invisible, because stdout went to jq), or a slow first-run/network step. I couldn't reproduce the exact trigger in a clean Ubuntu 24.04 run (same apt build, 2.1.274, under a real PTY), so this makes the step impossible to hang silently, whatever the cause:

• New claude_auth_state helper, used by both the sign-in step and the health check:
  • stdin </dev/null, so a hidden prompt fails immediately instead of waiting on the terminal;
  • timeout 20, so a stuck check reports "unknown" and the script carries on to claude auth login (or warns in the health check) instead of hanging;
  • it parses the JSON instead of trusting the exit code, because auth status exits 1 when signed out.
• Prints "Checking whether you're already signed in..." first, so it's clear where time is going.
• Clearer sign-in instructions: open the URL on any device, then paste the code back.
• With no DISPLAY/WAYLAND_DISPLAY, runs the login with BROWSER=true, so a console browser set as www-browser (w3m/lynx) can't take over the terminal; the printed URL is used instead.
• Prompts now treat EOF (Ctrl-D) as "take the default" instead of killing the run with a misleading Failed during: startup.

Test plan

• Diagnosed on the affected VM: claude auth status main thread at 99.9% CPU, no network activity, no reads; reproduced with </dev/null and with an empty HOME (rc=124 after 30s); fixed by changing the CPU type to host (returns instantly)
• check_cpu unit cases: AVX2 present → pass; missing → stops with instructions; missing + ALLOW_NO_AVX2=1 → warns and continues; arm64 → skipped
• shellcheck clean
• claude_auth_state against the real CLI (signed out → out) and stub CLIs: signed-in → in:claude.ai; prompts on stdin → returns immediately, including under a real TTY; garbage output → unknown; hangs → unknown after 20s
• Full script under a PTY in a fresh ubuntu:24.04 container, apt install route: status check runs, instructions print, sign-in URL appears, waits at "Paste code here"