fix: add postinstall chmod for npm binary permissions (#43)

* fix: add postinstall chmod for npm binary permissions

* fix: report npm package version instead of compiled binary version

The --version flag now reports the version from package.json instead of the
version compiled into the Rust binary. This ensures the version matches what
was installed via npm, even when binaries are reused from previous releases.

* fix: bake version into binary at build time

Instead of hacking around the version in the Node.js wrapper script,
properly pass the version at build time via SANDBOX_AGENT_VERSION env var.

Changes:
- build.rs: Generate version.rs with VERSION constant from env var
- main.rs: Use generated version constant for clap --version
- Dockerfiles: Accept SANDBOX_AGENT_VERSION as build arg
- build.sh: Pass version as second argument to Docker builds
- release.yaml: Pass version to build script during CI
- Remove version hack from sdks/cli/bin/sandbox-agent wrapper

The version is now baked into the binary during the release build,
ensuring --version reports the correct npm package version.

server/packages/sandbox-agent/build.rs

@@ -16,10 +16,14 @@ fn main() {
         .join("dist");
 
     println!("cargo:rerun-if-env-changed=SANDBOX_AGENT_SKIP_INSPECTOR");
+    println!("cargo:rerun-if-env-changed=SANDBOX_AGENT_VERSION");
     println!("cargo:rerun-if-changed={}", dist_dir.display());
 
-    let skip = env::var("SANDBOX_AGENT_SKIP_INSPECTOR").is_ok();
+    // Generate version constant from environment variable or fallback to Cargo.toml version
     let out_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR"));
+    generate_version(&out_dir);
+
+    let skip = env::var("SANDBOX_AGENT_SKIP_INSPECTOR").is_ok();
     let out_file = out_dir.join("inspector_assets.rs");
 
     if skip {
@@ -61,3 +65,19 @@ fn quote_path(path: &Path) -> String {
         .replace('\\', "\\\\")
         .replace('"', "\\\"")
 }
+
+fn generate_version(out_dir: &Path) {
+    // Use SANDBOX_AGENT_VERSION env var if set, otherwise fall back to CARGO_PKG_VERSION
+    let version = env::var("SANDBOX_AGENT_VERSION")
+        .unwrap_or_else(|_| env::var("CARGO_PKG_VERSION").expect("CARGO_PKG_VERSION"));
+
+    let out_file = out_dir.join("version.rs");
+    let contents = format!(
+        "/// Version string for this build.\n\
+         /// Set via SANDBOX_AGENT_VERSION env var at build time, or falls back to Cargo.toml version.\n\
+         pub const VERSION: &str = \"{}\";\n",
+        version
+    );
+
+    fs::write(&out_file, contents).expect("write version.rs");
+}

server/packages/sandbox-agent/src/main.rs

@@ -4,6 +4,11 @@ use std::path::PathBuf;
 use std::sync::Arc;
 
 use clap::{Args, Parser, Subcommand};
+
+// Include the generated version constant
+mod build_version {
+    include!(concat!(env!("OUT_DIR"), "/version.rs"));
+}
 use reqwest::blocking::Client as HttpClient;
 use reqwest::Method;
 use sandbox_agent::router::{build_router_with_state, shutdown_servers};
@@ -34,7 +39,7 @@ const DEFAULT_PORT: u16 = 2468;
 
 #[derive(Parser, Debug)]
 #[command(name = "sandbox-agent", bin_name = "sandbox-agent")]
-#[command(about = "https://sandboxagent.dev", version)]
+#[command(about = "https://sandboxagent.dev", version = build_version::VERSION)]
 #[command(arg_required_else_help = true)]
 struct Cli {
     #[command(subcommand)]