fix: fix bun install bug (#62)

* fix: fix bun install bug

* refactor: consolidate executable check into assertExecutable helper

- Add assertExecutable() to cli-shared that checks and attempts chmod
- Simplify CLI and SDK spawn code to use the shared helper
- Fix cli-shared package.json exports (.js not .mjs)
- Add global install instructions to SDK error message

* chore(release): update version to 0.1.6-rc.1

* fix: add cli-shared package to Dockerfiles

* chore(release): update version to 0.1.6-rc.1

* fix: add cli-shared publishing to release workflow

* chore(release): update version to 0.1.6-rc.1

* fix: handle already-exists error during crate publish

* chore(release): update version to 0.1.6-rc.1

sdks/cli-shared/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@sandbox-agent/cli-shared",
+  "version": "0.1.6-rc.1",
+  "description": "Shared helpers for sandbox-agent CLI and SDK",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rivet-dev/sandbox-agent"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.7.0"
+  }
+}

sdks/cli-shared/src/index.ts

@@ -0,0 +1,99 @@
+export type InstallCommandBlock = {
+	label: string;
+	commands: string[];
+};
+
+export type NonExecutableBinaryMessageOptions = {
+	binPath: string;
+	trustPackages: string;
+	bunInstallBlocks: InstallCommandBlock[];
+	genericInstallCommands?: string[];
+};
+
+export type FsSubset = {
+	accessSync: (path: string, mode?: number) => void;
+	chmodSync: (path: string, mode: number) => void;
+	constants: { X_OK: number };
+};
+
+export function isBunRuntime(): boolean {
+	if (typeof process?.versions?.bun === "string") return true;
+	const userAgent = process?.env?.npm_config_user_agent || "";
+	return userAgent.includes("bun/");
+}
+
+const PERMISSION_ERRORS = new Set(["EACCES", "EPERM", "ENOEXEC"]);
+
+function isPermissionError(error: unknown): boolean {
+	if (!error || typeof error !== "object") return false;
+	const code = (error as { code?: unknown }).code;
+	return typeof code === "string" && PERMISSION_ERRORS.has(code);
+}
+
+/**
+ * Checks if a binary is executable and attempts to make it executable if not.
+ * Returns true if the binary is (or was made) executable, false if it couldn't
+ * be made executable due to permission errors. Throws for other errors.
+ *
+ * Requires fs to be passed in to avoid static imports that break browser builds.
+ */
+export function assertExecutable(binPath: string, fs: FsSubset): boolean {
+	if (process.platform === "win32") {
+		return true;
+	}
+
+	try {
+		fs.accessSync(binPath, fs.constants.X_OK);
+		return true;
+	} catch {
+		// Not executable, try to fix
+	}
+
+	try {
+		fs.chmodSync(binPath, 0o755);
+		return true;
+	} catch (error) {
+		if (isPermissionError(error)) {
+			return false;
+		}
+		throw error;
+	}
+}
+
+export function formatNonExecutableBinaryMessage(
+	options: NonExecutableBinaryMessageOptions,
+): string {
+	const { binPath, trustPackages, bunInstallBlocks, genericInstallCommands } =
+		options;
+
+	const lines = [`sandbox-agent binary is not executable: ${binPath}`];
+
+	if (isBunRuntime()) {
+		lines.push(
+			"Allow Bun to run postinstall scripts for native binaries and reinstall:",
+		);
+		for (const block of bunInstallBlocks) {
+			lines.push(`${block.label}:`);
+			for (const command of block.commands) {
+				lines.push(`  ${command}`);
+			}
+		}
+		lines.push(`Or run: chmod +x "${binPath}"`);
+		return lines.join("\n");
+	}
+
+	lines.push(
+		"Postinstall scripts for native packages did not run, so the binary was left non-executable.",
+	);
+	if (genericInstallCommands && genericInstallCommands.length > 0) {
+		lines.push("Reinstall with scripts enabled:");
+		for (const command of genericInstallCommands) {
+			lines.push(`  ${command}`);
+		}
+	} else {
+		lines.push("Reinstall with scripts enabled for:");
+		lines.push(`  ${trustPackages}`);
+	}
+	lines.push(`Or run: chmod +x "${binPath}"`);
+	return lines.join("\n");
+}

sdks/cli-shared/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "noEmit": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

sdks/cli-shared/tsup.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from "tsup";
+
+export default defineConfig({
+  entry: ["src/index.ts"],
+  format: ["esm", "cjs"],
+  dts: true,
+  clean: true,
+  sourcemap: true,
+});

sdks/cli/bin/sandbox-agent

@@ -1,7 +1,38 @@
 #!/usr/bin/env node
 const { execFileSync } = require("child_process");
+const {
+  assertExecutable,
+  formatNonExecutableBinaryMessage,
+} = require("@sandbox-agent/cli-shared");
+const fs = require("fs");
 const path = require("path");
 
+const TRUST_PACKAGES =
+  "@sandbox-agent/cli-linux-x64 @sandbox-agent/cli-darwin-arm64 @sandbox-agent/cli-darwin-x64 @sandbox-agent/cli-win32-x64";
+
+function formatHint(binPath) {
+  return formatNonExecutableBinaryMessage({
+    binPath,
+    trustPackages: TRUST_PACKAGES,
+    bunInstallBlocks: [
+      {
+        label: "Project install",
+        commands: [
+          `bun pm trust ${TRUST_PACKAGES}`,
+          "bun add @sandbox-agent/cli",
+        ],
+      },
+      {
+        label: "Global install",
+        commands: [
+          `bun pm -g trust ${TRUST_PACKAGES}`,
+          "bun add -g @sandbox-agent/cli",
+        ],
+      },
+    ],
+  });
+}
+
 const PLATFORMS = {
   "darwin-arm64": "@sandbox-agent/cli-darwin-arm64",
   "darwin-x64": "@sandbox-agent/cli-darwin-x64",
@@ -19,7 +50,14 @@ if (!pkg) {
 try {
   const pkgPath = require.resolve(`${pkg}/package.json`);
   const bin = process.platform === "win32" ? "sandbox-agent.exe" : "sandbox-agent";
-  execFileSync(path.join(path.dirname(pkgPath), "bin", bin), process.argv.slice(2), { stdio: "inherit" });
+  const binPath = path.join(path.dirname(pkgPath), "bin", bin);
+
+  if (!assertExecutable(binPath, fs)) {
+    console.error(formatHint(binPath));
+    process.exit(1);
+  }
+
+  execFileSync(binPath, process.argv.slice(2), { stdio: "inherit" });
 } catch (e) {
   if (e.status !== undefined) process.exit(e.status);
   throw e;

sdks/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandbox-agent/cli",
-  "version": "0.1.4-rc.7",
+  "version": "0.1.6-rc.1",
   "description": "CLI for sandbox-agent - run AI coding agents in sandboxes",
   "license": "Apache-2.0",
   "repository": {
@@ -13,6 +13,9 @@
   "scripts": {
     "test": "vitest run"
   },
+  "dependencies": {
+    "@sandbox-agent/cli-shared": "workspace:*"
+  },
   "devDependencies": {
     "vitest": "^3.0.0"
   },

sdks/cli/platforms/darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandbox-agent/cli-darwin-arm64",
-  "version": "0.1.4-rc.7",
+  "version": "0.1.6-rc.1",
   "description": "sandbox-agent CLI binary for macOS ARM64",
   "license": "Apache-2.0",
   "repository": {

sdks/cli/platforms/darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandbox-agent/cli-darwin-x64",
-  "version": "0.1.4-rc.7",
+  "version": "0.1.6-rc.1",
   "description": "sandbox-agent CLI binary for macOS x64",
   "license": "Apache-2.0",
   "repository": {

sdks/cli/platforms/linux-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandbox-agent/cli-linux-x64",
-  "version": "0.1.4-rc.7",
+  "version": "0.1.6-rc.1",
   "description": "sandbox-agent CLI binary for Linux x64",
   "license": "Apache-2.0",
   "repository": {

sdks/cli/platforms/win32-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandbox-agent/cli-win32-x64",
-  "version": "0.1.4-rc.7",
+  "version": "0.1.6-rc.1",
   "description": "sandbox-agent CLI binary for Windows x64",
   "license": "Apache-2.0",
   "repository": {

sdks/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandbox-agent",
-  "version": "0.1.4-rc.7",
+  "version": "0.1.6-rc.1",
   "description": "Universal API for automatic coding agents in sandboxes. Supprots Claude Code, Codex, OpenCode, and Amp.",
   "license": "Apache-2.0",
   "repository": {
@@ -16,6 +16,9 @@
       "import": "./dist/index.js"
     }
   },
+  "dependencies": {
+    "@sandbox-agent/cli-shared": "workspace:*"
+  },
   "files": [
     "dist"
   ],

sdks/typescript/src/spawn.ts

@@ -1,5 +1,9 @@
 import type { ChildProcess } from "node:child_process";
 import type { AddressInfo } from "node:net";
+import {
+  assertExecutable,
+  formatNonExecutableBinaryMessage,
+} from "@sandbox-agent/cli-shared";
 
 export type SandboxAgentSpawnLogMode = "inherit" | "pipe" | "silent";
 
@@ -28,6 +32,9 @@ const PLATFORM_PACKAGES: Record<string, string> = {
   "win32-x64": "@sandbox-agent/cli-win32-x64",
 };
 
+const TRUST_PACKAGES =
+  "@sandbox-agent/cli-linux-x64 @sandbox-agent/cli-darwin-arm64 @sandbox-agent/cli-darwin-x64 @sandbox-agent/cli-win32-x64";
+
 export function isNodeRuntime(): boolean {
   return typeof process !== "undefined" && !!process.versions?.node;
 }
@@ -66,6 +73,31 @@ export async function spawnSandboxAgent(
     throw new Error("sandbox-agent binary not found. Install @sandbox-agent/cli or set SANDBOX_AGENT_BIN.");
   }
 
+  if (!assertExecutable(binaryPath, fs)) {
+    throw new Error(
+      formatNonExecutableBinaryMessage({
+        binPath: binaryPath,
+        trustPackages: TRUST_PACKAGES,
+        bunInstallBlocks: [
+          {
+            label: "Project install",
+            commands: [
+              `bun pm trust ${TRUST_PACKAGES}`,
+              "bun add sandbox-agent",
+            ],
+          },
+          {
+            label: "Global install",
+            commands: [
+              `bun pm -g trust ${TRUST_PACKAGES}`,
+              "bun add -g sandbox-agent",
+            ],
+          },
+        ],
+      }),
+    );
+  }
+
   const stdio = logMode === "inherit" ? "inherit" : logMode === "silent" ? "ignore" : "pipe";
   const args = ["server", "--host", bindHost, "--port", String(port), "--token", token];
   const child = spawn(binaryPath, args, {