From 12b097581795aeab99a95bfe0b21f9b84e45068e Mon Sep 17 00:00:00 2001
From: Nathan Flurry <git@nathanflurry.com>
Date: Fri, 30 Jan 2026 13:23:56 -0800
Subject: [PATCH 1/2] fix: add postinstall chmod for npm binary permissions

---
 sdks/cli/platforms/darwin-arm64/package.json | 3 +++
 sdks/cli/platforms/darwin-x64/package.json   | 3 +++
 sdks/cli/platforms/linux-x64/package.json    | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/sdks/cli/platforms/darwin-arm64/package.json b/sdks/cli/platforms/darwin-arm64/package.json
index 51ccb8f..39c64da 100644
--- a/sdks/cli/platforms/darwin-arm64/package.json
+++ b/sdks/cli/platforms/darwin-arm64/package.json
@@ -13,6 +13,9 @@
   "cpu": [
     "arm64"
   ],
+  "scripts": {
+    "postinstall": "chmod +x bin/sandbox-agent || true"
+  },
   "files": [
     "bin"
   ]
diff --git a/sdks/cli/platforms/darwin-x64/package.json b/sdks/cli/platforms/darwin-x64/package.json
index 34b6a81..ad8cd44 100644
--- a/sdks/cli/platforms/darwin-x64/package.json
+++ b/sdks/cli/platforms/darwin-x64/package.json
@@ -13,6 +13,9 @@
   "cpu": [
     "x64"
   ],
+  "scripts": {
+    "postinstall": "chmod +x bin/sandbox-agent || true"
+  },
   "files": [
     "bin"
   ]
diff --git a/sdks/cli/platforms/linux-x64/package.json b/sdks/cli/platforms/linux-x64/package.json
index 9d330e5..62b2a5d 100644
--- a/sdks/cli/platforms/linux-x64/package.json
+++ b/sdks/cli/platforms/linux-x64/package.json
@@ -13,6 +13,9 @@
   "cpu": [
     "x64"
   ],
+  "scripts": {
+    "postinstall": "chmod +x bin/sandbox-agent || true"
+  },
   "files": [
     "bin"
   ]

From 93445b3d4f03f88e9b02b1a568133841fc53c6b0 Mon Sep 17 00:00:00 2001
From: Nathan Flurry <git@nathanflurry.com>
Date: Fri, 30 Jan 2026 14:58:41 -0800
Subject: [PATCH 2/2] fix: report npm package version instead of compiled
 binary version

The --version flag now reports the version from package.json instead of the
version compiled into the Rust binary. This ensures the version matches what
was installed via npm, even when binaries are reused from previous releases.
---
 sdks/cli/bin/sandbox-agent | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/sdks/cli/bin/sandbox-agent b/sdks/cli/bin/sandbox-agent
index 9374244..705af5d 100755
--- a/sdks/cli/bin/sandbox-agent
+++ b/sdks/cli/bin/sandbox-agent
@@ -1,6 +1,21 @@
 #!/usr/bin/env node
 const { execFileSync } = require("child_process");
 const path = require("path");
+const fs = require("fs");
+
+// Handle --version / -V at the launcher level to report npm package version
+// This ensures version matches what's installed via npm, not what's compiled into the binary
+const args = process.argv.slice(2);
+if (args.length === 1 && (args[0] === "--version" || args[0] === "-V")) {
+  const pkgJsonPath = path.join(__dirname, "..", "package.json");
+  try {
+    const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+    console.log(`sandbox-agent ${pkgJson.version}`);
+    process.exit(0);
+  } catch (e) {
+    // Fall through to binary if we can't read package.json
+  }
+}
 
 const PLATFORMS = {
   "darwin-arm64": "@sandbox-agent/cli-darwin-arm64",
@@ -19,7 +34,7 @@ if (!pkg) {
 try {
   const pkgPath = require.resolve(`${pkg}/package.json`);
   const bin = process.platform === "win32" ? "sandbox-agent.exe" : "sandbox-agent";
-  execFileSync(path.join(path.dirname(pkgPath), "bin", bin), process.argv.slice(2), { stdio: "inherit" });
+  execFileSync(path.join(path.dirname(pkgPath), "bin", bin), args, { stdio: "inherit" });
 } catch (e) {
   if (e.status !== undefined) process.exit(e.status);
   throw e;