fix: add postinstall chmod for npm binary permissions (#43)

* fix: add postinstall chmod for npm binary permissions

* fix: report npm package version instead of compiled binary version

The --version flag now reports the version from package.json instead of the
version compiled into the Rust binary. This ensures the version matches what
was installed via npm, even when binaries are reused from previous releases.

* fix: bake version into binary at build time

Instead of hacking around the version in the Node.js wrapper script,
properly pass the version at build time via SANDBOX_AGENT_VERSION env var.

Changes:
- build.rs: Generate version.rs with VERSION constant from env var
- main.rs: Use generated version constant for clap --version
- Dockerfiles: Accept SANDBOX_AGENT_VERSION as build arg
- build.sh: Pass version as second argument to Docker builds
- release.yaml: Pass version to build script during CI
- Remove version hack from sdks/cli/bin/sandbox-agent wrapper

The version is now baked into the binary during the release build,
ensuring --version reports the correct npm package version.

docker/release/build.sh

@@ -2,6 +2,14 @@
 set -euo pipefail
 
 TARGET=${1:-x86_64-unknown-linux-musl}
+VERSION=${2:-}
+
+# Build arguments for Docker
+BUILD_ARGS=""
+if [ -n "$VERSION" ]; then
+  BUILD_ARGS="--build-arg SANDBOX_AGENT_VERSION=$VERSION"
+  echo "Building with version: $VERSION"
+fi
 
 case $TARGET in
   x86_64-unknown-linux-musl)
@@ -36,9 +44,9 @@ case $TARGET in
 
 DOCKER_BUILDKIT=1
 if [ -n "$TARGET_STAGE" ]; then
-  docker build --target "$TARGET_STAGE" -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
+  docker build --target "$TARGET_STAGE" $BUILD_ARGS -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
 else
-  docker build -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
+  docker build $BUILD_ARGS -f "docker/release/$DOCKERFILE" -t "sandbox-agent-builder-$TARGET" .
 fi
 
 CONTAINER_ID=$(docker create "sandbox-agent-builder-$TARGET")

docker/release/linux-x86_64.Dockerfile

@@ -66,6 +66,10 @@ WORKDIR /build
 # Build for x86_64
 FROM base AS x86_64-builder
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Set up OpenSSL for x86_64 musl target
 ENV SSL_VER=1.1.1w
 RUN wget https://www.openssl.org/source/openssl-$SSL_VER.tar.gz \

docker/release/macos-aarch64.Dockerfile

@@ -70,6 +70,10 @@ WORKDIR /build
 # Build for ARM64 macOS
 FROM base AS aarch64-builder
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Install macOS ARM64 target
 RUN rustup target add aarch64-apple-darwin
 

docker/release/macos-x86_64.Dockerfile

@@ -70,6 +70,10 @@ WORKDIR /build
 # Build for x86_64 macOS
 FROM base AS x86_64-builder
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Install macOS x86_64 target
 RUN rustup target add x86_64-apple-darwin
 

docker/release/windows.Dockerfile

@@ -26,6 +26,10 @@ RUN cd frontend/packages/inspector && pnpm exec vite build
 
 FROM rust:1.88.0
 
+# Accept version as build arg
+ARG SANDBOX_AGENT_VERSION
+ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
+
 # Install dependencies
 RUN apt-get update && apt-get install -y \
     llvm-14-dev \