refactor: linearize fetchBinary decision tree for readability

The version check, lock-wait, and rename logic in fetchBinary used
nested if/else-if blocks and a needsDownload flag that made the
control flow hard to follow. This refactors it into sequential guard
clauses (version match, downloads disabled, version mismatch) and
replaces the flag with an early return. The duplicated rename-to-
final-path logic is extracted into a small helper used in both the
lock-wait and download paths.

No behavior changes.

Author: EhabY

CHANGELOG.md

@@ -5,6 +5,21 @@
      from published versions since it shows up in the VS Code extension changelog
      tab and is confusing to users. Add it back between releases if needed. -->
 
+## Unreleased
+
+### Added
+
+- `coder.binaryDestination` now accepts a full file path (e.g. `/usr/bin/coder`) in addition
+  to a directory. The extension checks the binary's version against the server and downloads a
+  replacement when needed. When set to a directory, the simple name (`coder` / `coder.exe`) is
+  tried as a fallback after the platform-specific name, so package-manager-installed CLIs work
+  without symlinking.
+
+### Fixed
+
+- Cleanup of old/temp files in shared directories like `/usr/bin` is now scoped to the binary's
+  own basename, preventing accidental removal of unrelated files.
+
 ## [v1.14.3](https://github.com/coder/vscode-coder/releases/tag/v1.14.3) 2026-03-30
 
 ### Added

src/core/cliManager.ts

@@ -139,27 +139,15 @@ export class CliManager {
 			`Resolved binary: ${resolved.binPath} (${resolved.source})`,
 		);
 
-		// Check existing binary version when one was found.
+		let existingVersion: string | null = null;
 		if (resolved.source !== "not-found") {
 			this.output.debug(
 				"Existing binary size is",
 				prettyBytes(resolved.stat.size),
 			);
 			try {
-				const version = await cliVersion(resolved.binPath);
-				this.output.debug("Existing binary version is", version);
-				if (version === buildInfo.version) {
-					this.output.debug("Existing binary matches server version");
-					return resolved.binPath;
-				} else if (!enableDownloads) {
-					this.output.info(
-						"Using existing binary despite version mismatch because downloads are disabled",
-					);
-					return resolved.binPath;
-				}
-				this.output.info(
-					"Downloading since existing binary does not match the server version",
-				);
+				existingVersion = await cliVersion(resolved.binPath);
+				this.output.debug("Existing binary version is", existingVersion);
 			} catch (error) {
 				this.output.warn(
 					"Unable to get version of existing binary, downloading instead",
@@ -170,11 +158,28 @@ export class CliManager {
 			this.output.info("No existing binary found, starting download");
 		}
 
+		if (existingVersion === buildInfo.version) {
+			this.output.debug("Existing binary matches server version");
+			return resolved.binPath;
+		}
+
 		if (!enableDownloads) {
+			if (existingVersion) {
+				this.output.info(
+					"Using existing binary despite version mismatch because downloads are disabled",
+				);
+				return resolved.binPath;
+			}
 			this.output.warn("Unable to download CLI because downloads are disabled");
 			throw new Error("Unable to download CLI because downloads are disabled");
 		}
 
+		if (existingVersion) {
+			this.output.info(
+				"Downloading since existing binary does not match the server version",
+			);
+		}
+
 		// Always download using the platform-specific name.
 		const downloadBinPath = path.join(
 			path.dirname(resolved.binPath),
@@ -196,8 +201,7 @@ export class CliManager {
 			);
 			this.output.debug("Acquired download lock");
 
-			// If we waited for another process, re-check if binary is now ready
-			let needsDownload = true;
+			// Another process may have finished the download while we waited.
 			if (lockResult.waited) {
 				const latestBuildInfo = await restClient.getBuildInfo();
 				this.output.debug("Got latest server version", latestBuildInfo.version);
@@ -207,43 +211,26 @@ export class CliManager {
 					latestBuildInfo.version,
 				);
 				if (recheckAfterWait.matches) {
-					this.output.debug(
-						"Using existing binary since it matches the latest server version",
-					);
-					needsDownload = false;
-				} else {
-					const latestParsedVersion = semver.parse(latestBuildInfo.version);
-					if (!latestParsedVersion) {
-						throw new Error(
-							`Got invalid version from deployment: ${latestBuildInfo.version}`,
-						);
-					}
-					latestVersion = latestParsedVersion;
+					this.output.debug("Binary already matches server version after wait");
+					return await this.renameToFinalPath(resolved, downloadBinPath);
 				}
-			}
 
-			if (needsDownload) {
-				await this.performBinaryDownload(
-					restClient,
-					latestVersion,
-					downloadBinPath,
-					progressLogPath,
-				);
+				const latestParsedVersion = semver.parse(latestBuildInfo.version);
+				if (!latestParsedVersion) {
+					throw new Error(
+						`Got invalid version from deployment: ${latestBuildInfo.version}`,
+					);
+				}
+				latestVersion = latestParsedVersion;
 			}
 
-			// Rename to user-configured file path while we hold the lock.
-			if (
-				resolved.source === "file-path" &&
-				downloadBinPath !== resolved.binPath
-			) {
-				this.output.info(
-					"Renaming downloaded binary to",
-					path.basename(resolved.binPath),
-				);
-				await fs.rename(downloadBinPath, resolved.binPath);
-				return resolved.binPath;
-			}
-			return downloadBinPath;
+			await this.performBinaryDownload(
+				restClient,
+				latestVersion,
+				downloadBinPath,
+				progressLogPath,
+			);
+			return await this.renameToFinalPath(resolved, downloadBinPath);
 		} catch (error) {
 			const fallback = await this.handleAnyBinaryFailure(
 				error,
@@ -288,6 +275,27 @@ export class CliManager {
 		}
 	}
 
+	/**
+	 * Rename the downloaded binary to the user-configured file path if needed.
+	 */
+	private async renameToFinalPath(
+		resolved: ResolvedBinary,
+		downloadBinPath: string,
+	): Promise<string> {
+		if (
+			resolved.source === "file-path" &&
+			downloadBinPath !== resolved.binPath
+		) {
+			this.output.info(
+				"Renaming downloaded binary to",
+				path.basename(resolved.binPath),
+			);
+			await fs.rename(downloadBinPath, resolved.binPath);
+			return resolved.binPath;
+		}
+		return downloadBinPath;
+	}
+
 	/**
 	 * Prompt the user to use an existing binary version.
 	 */
@@ -388,7 +396,7 @@ export class CliManager {
 			}
 		}
 
-		// Last resort: try the most recent .old-* backup.
+		// Last resort: most recent .old-* backup (deferred to avoid IO when unnecessary).
 		const oldBinaries = await cliUtils.findOldBinaries(binPath);
 		if (oldBinaries.length > 0) {
 			const old = await tryCandidate(oldBinaries[0]);