fix: bake version into binary at build time

Instead of hacking around the version in the Node.js wrapper script,
properly pass the version at build time via SANDBOX_AGENT_VERSION env var.

Changes:
- build.rs: Generate version.rs with VERSION constant from env var
- main.rs: Use generated version constant for clap --version
- Dockerfiles: Accept SANDBOX_AGENT_VERSION as build arg
- build.sh: Pass version as second argument to Docker builds
- release.yaml: Pass version to build script during CI
- Remove version hack from sdks/cli/bin/sandbox-agent wrapper

The version is now baked into the binary during the release build,
ensuring --version reports the correct npm package version.

server/packages/sandbox-agent/build.rs

@@ -16,10 +16,14 @@ fn main() {
         .join("dist");
 
     println!("cargo:rerun-if-env-changed=SANDBOX_AGENT_SKIP_INSPECTOR");
+    println!("cargo:rerun-if-env-changed=SANDBOX_AGENT_VERSION");
     println!("cargo:rerun-if-changed={}", dist_dir.display());
 
-    let skip = env::var("SANDBOX_AGENT_SKIP_INSPECTOR").is_ok();
+    // Generate version constant from environment variable or fallback to Cargo.toml version
     let out_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR"));
+    generate_version(&out_dir);
+
+    let skip = env::var("SANDBOX_AGENT_SKIP_INSPECTOR").is_ok();
     let out_file = out_dir.join("inspector_assets.rs");
 
     if skip {
@@ -61,3 +65,19 @@ fn quote_path(path: &Path) -> String {
         .replace('\\', "\\\\")
         .replace('"', "\\\"")
 }
+
+fn generate_version(out_dir: &Path) {
+    // Use SANDBOX_AGENT_VERSION env var if set, otherwise fall back to CARGO_PKG_VERSION
+    let version = env::var("SANDBOX_AGENT_VERSION")
+        .unwrap_or_else(|_| env::var("CARGO_PKG_VERSION").expect("CARGO_PKG_VERSION"));
+
+    let out_file = out_dir.join("version.rs");
+    let contents = format!(
+        "/// Version string for this build.\n\
+         /// Set via SANDBOX_AGENT_VERSION env var at build time, or falls back to Cargo.toml version.\n\
+         pub const VERSION: &str = \"{}\";\n",
+        version
+    );
+
+    fs::write(&out_file, contents).expect("write version.rs");
+}

server/packages/sandbox-agent/src/main.rs

@@ -4,6 +4,11 @@ use std::path::PathBuf;
 use std::sync::Arc;
 
 use clap::{Args, Parser, Subcommand};
+
+// Include the generated version constant
+mod build_version {
+    include!(concat!(env!("OUT_DIR"), "/version.rs"));
+}
 use reqwest::blocking::Client as HttpClient;
 use reqwest::Method;
 use sandbox_agent::router::{build_router_with_state, shutdown_servers};
@@ -34,7 +39,7 @@ const DEFAULT_PORT: u16 = 2468;
 
 #[derive(Parser, Debug)]
 #[command(name = "sandbox-agent", bin_name = "sandbox-agent")]
-#[command(about = "https://sandboxagent.dev", version)]
+#[command(about = "https://sandboxagent.dev", version = build_version::VERSION)]
 #[command(arg_required_else_help = true)]
 struct Cli {
     #[command(subcommand)]