fix: publish binary installer assets

.github/workflows/release.yml

@@ -0,0 +1,73 @@
+name: Publish Binaries
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Build and publish CLI binaries
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: darwin
+            goarch: arm64
+          - goos: darwin
+            goarch: amd64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build archive
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: "0"
+        run: |
+          set -eu
+          asset="opencode-sandbox_${GOOS}_${GOARCH}"
+          mkdir -p "dist/${asset}"
+          go build -trimpath -ldflags="-s -w" -o "dist/${asset}/opencode-sandbox" ./cmd/opencode-sandbox
+          tar -C "dist/${asset}" -czf "dist/${asset}.tar.gz" opencode-sandbox
+
+      - name: Upload archive artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: opencode-sandbox_${{ matrix.goos }}_${{ matrix.goarch }}
+          path: dist/opencode-sandbox_${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz
+          if-no-files-found: error
+
+  publish:
+    name: Attach release assets
+    runs-on: ubuntu-latest
+    needs: release
+    steps:
+      - name: Download archives
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Generate checksums
+        working-directory: dist
+        run: sha256sum opencode-sandbox_*.tar.gz > checksums.txt
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/opencode-sandbox_*.tar.gz
+            dist/checksums.txt

README.md

@@ -5,7 +5,7 @@ A Go CLI wrapper that runs [OpenCode](https://opencode.ai) inside Apple's native
 ## Quickstart
 
 ```bash
-# Use install the wrapper
+# Install the prebuilt wrapper for your Mac architecture
 curl -fsSL https://raw.githubusercontent.com/RabbITCybErSeC/opencode-sandbox/main/install.sh | bash
 
 # Add the alias printed by the installer, then check your environment
@@ -178,6 +178,8 @@ opencode-sandbox image pull --strict-init
 Local source builds remain supported:
 
 ```bash
+git clone https://github.com/RabbITCybErSeC/opencode-sandbox.git
+cd opencode-sandbox
 opencode-sandbox image build
 opencode-sandbox image build --strict-init
 ```

docs/network-policy-implementation-report.md

@@ -39,10 +39,15 @@ When `localhostAccess.enabled` is true:
 ### 5. Container Command Builder (`internal/containercmd/builder.go`)
 
 When `LocalhostAccess.Enabled` is true, appends to `container run` argv:
-- `--localhost 203.0.113.113` (the Apple container flag for host DNS)
 - `--env OPENCODE_SANDBOX_HOST_DOMAIN=host.container.internal`
 - `--env OPENCODE_SANDBOX_HOST_IP=203.0.113.113`
 
+Host DNS itself is configured outside `container run` with:
+
+```bash
+sudo container system dns create host.container.internal --localhost 203.0.113.113
+```
+
 ### 6. CLI Flag (`internal/cli/run.go`, `internal/cli/run_plan.go`)
 
 Added `--allow-host-access` flag parsing:
@@ -75,7 +80,7 @@ localhostAccess:
 
 ### 9. Tests (`internal/containercmd/builder_test.go`, `internal/cli/init_config_test.go`)
 
-- `TestBuildArgvLocalhostAccessEnabled`: verifies `--localhost` flag and both env vars are present
+- `TestBuildArgvLocalhostAccessEnabled`: verifies no invalid `container run --localhost` flag is present and both env vars are present
 - `TestBuildArgvLocalhostAccessDisabled`: verifies no `--localhost` flag when disabled
 - `TestInitProjectCreatesConfig`: verifies generated config contains `localhostAccess:`
 
@@ -123,7 +128,7 @@ sudo container system dns create host.container.internal --localhost 203.0.113.1
 | `internal/config/defaults.go` | +5 | Default `localhostAccess` values |
 | `internal/config/load.go` | +17 | `applyLocalhostAccess()` merge function |
 | `internal/config/validate.go` | +12 | IP and domain validation |
-| `internal/containercmd/builder.go` | +6 | `--localhost` flag and env vars |
+| `internal/containercmd/builder.go` | +5 | Host access env vars |
 | `internal/containercmd/builder_test.go` | +48 | Two new test cases |
 | `internal/cli/run.go` | +13/-2 | `--allow-host-access` flag parsing and override |
 | `internal/cli/run_plan.go` | +5/-2 | `AllowHostAccess` field on `RunPlan` |
@@ -139,6 +144,6 @@ sudo container system dns create host.container.internal --localhost 203.0.113.1
 - [ ] `go build ./cmd/opencode-sandbox` succeeds
 - [ ] `opencode-sandbox init` generates config with `localhostAccess` section
 - [ ] `opencode-sandbox init --global` generates config with `localhostAccess` section
-- [ ] `opencode-sandbox run . --allow-host-access --print-command` shows `--localhost 203.0.113.113`
+- [ ] `opencode-sandbox run . --allow-host-access --print-command` shows host access env vars and no `--localhost` run flag
 - [ ] `opencode-sandbox doctor` shows `host.dns` check when `localhostAccess.enabled: true`
 - [ ] Config validation rejects invalid IP or missing domain when enabled

docs/quickstart.md

@@ -5,14 +5,13 @@ This guide gets opencode-sandbox from install to a first sandboxed OpenCode run.
 ## Prerequisites
 
 - macOS with Apple's `container` CLI installed and available on `PATH`.
-- Go installed for building the wrapper CLI.
-- Network access to pull the published OpenCode container image, or to build it locally from source.
+- `curl` and `tar` for the installer.
+- Network access to download the wrapper binary and pull the published OpenCode container image.
 
 Check the environment first:
 
 ```bash
 container system version
-go version
 ```
 
 ## 1. Install the wrapper CLI
@@ -23,7 +22,13 @@ Install from GitHub:
 curl -fsSL https://raw.githubusercontent.com/RabbITCybErSeC/opencode-sandbox/main/install.sh | bash
 ```
 
-The installer clones or updates the repo, builds the wrapper CLI, pulls the published runtime image, and prints a ready-to-add shell alias. In an interactive shell it also asks whether to pull the optional strict eBPF init image.
+The installer downloads the latest prebuilt macOS binary for your architecture, pulls the published runtime image, and prints a ready-to-add shell alias. In an interactive shell it also asks whether to pull the optional strict eBPF init image.
+
+To install a specific release instead of the latest one:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/RabbITCybErSeC/opencode-sandbox/main/install.sh | OPENCODE_SANDBOX_VERSION=v0.0.2 bash
+```
 
 ```bash
 alias sopencode="$HOME/.local/bin/opencode-sandbox"
@@ -39,6 +44,7 @@ If you want a development checkout, clone the repo:
 git clone https://github.com/RabbITCybErSeC/opencode-sandbox.git
 cd opencode-sandbox
 git pull --ff-only
+go version
 ```
 
 From the repo root:
@@ -305,6 +311,14 @@ sopencode run .
 sopencode run . --dry-run
 ```
 
+Uninstall global wrapper artifacts and container resources:
+
+```bash
+sopencode uninstall
+```
+
+Uninstall intentionally preserves project-local files such as `.opencode-sandbox.yaml` and `.opencode-sandbox/`.
+
 ## Optional Shell Alias
 
 During active development, keep the wrapper command explicit:

docs/troubleshooting.md

@@ -139,7 +139,7 @@ For normal installs, prefer pulling the published image:
 opencode-sandbox image pull
 ```
 
-For local source builds, ensure the installer source checkout still exists at `~/.local/share/opencode-sandbox-src`, set `OPENCODE_SANDBOX_DIR`, or pass the source explicitly:
+For local source builds, use a development checkout and pass the source explicitly. The installer downloads a prebuilt wrapper binary and no longer creates `~/.local/share/opencode-sandbox-src`.
 
 ```bash
 opencode-sandbox image build --context /path/to/opencode-sandbox