InftyAI-Agent · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Makefile b/Makefile
@@ -210,12 +210,18 @@ build-wheels-linux:
 	@echo "Building for Linux aarch64..."
 	docker run --rm --platform linux/arm64 -v $$(pwd):/io ghcr.io/pyo3/maturin build --release -m /io/server/Cargo.toml
 
-# Build all wheels (local + Linux if Docker available)
-build-wheels: build-wheels-local build-wheels-linux
-
-# Upload wheels to PyPI
+# Build all wheels (local + Linux). Starts from an empty target/wheels so only this
+# version is uploaded: publish-pypi uploads everything in it, and a leftover wheel
+# from an earlier version bump once got published by accident.
+build-wheels:
+	rm -rf target/wheels
+	$(MAKE) build-wheels-local build-wheels-linux
+
+# Upload wheels to PyPI. Exported so `make publish-pypi INFTYAI_PYPI_TOKEN=...` also
+# reaches the recipe through the environment.
+export INFTYAI_PYPI_TOKEN
 publish-pypi: $(MATURIN) build-wheels
-	@if [ -z "$(INFTYAI_PYPI_TOKEN)" ]; then \
+	@if [ -z "$$INFTYAI_PYPI_TOKEN" ]; then \
 		echo "Error: INFTYAI_PYPI_TOKEN environment variable not set"; \
 		exit 1; \
 	fi
@@ -225,7 +231,9 @@ publish-pypi: $(MATURIN) build-wheels
 	fi
 	@echo "Uploading wheels to PyPI..."
 	@ls target/wheels/*.whl
-	$(MATURIN) upload target/wheels/*.whl --skip-existing --username __token__ --password $(INFTYAI_PYPI_TOKEN)
+	@# The token goes in via the environment, never argv: a make-echoed or `ps`-visible
+	@# command line would expose it.
+	@MATURIN_PYPI_TOKEN="$$INFTYAI_PYPI_TOKEN" $(MATURIN) upload --skip-existing target/wheels/*.whl
 
 # Publish one crate unless that exact version is already on crates.io. cargo has
 # no --skip-existing, and crates.io is append-only, so reruns of a partially

diff --git a/README.md b/README.md
@@ -130,7 +130,7 @@ curl -fsSL https://raw.githubusercontent.com/InftyAI/SandD/main/hack/scripts/ins
 This installs the latest release to `/usr/local/bin/sandd`. To pin a specific version:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/InftyAI/SandD/main/hack/scripts/install.sh | sudo bash -s -- --version v0.2.0
+curl -fsSL https://raw.githubusercontent.com/InftyAI/SandD/main/hack/scripts/install.sh | sudo bash -s -- --version v0.2.1
 ```
 
 #### Alternative Methods

diff --git a/hack/docker/Dockerfile.daemon-tunnel-release b/hack/docker/Dockerfile.daemon-tunnel-release
@@ -2,9 +2,9 @@
 # Downloads pre-built binary from GitHub releases
 #
 # Build: docker build -f hack/docker/Dockerfile.daemon-tunnel-release \
-#        --build-arg SANDD_VERSION=v0.2.0 \
-#        -t inftyai/sandd-tunnel:v0.2.0 .
-# Run:   docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-tunnel:v0.2.0
+#        --build-arg SANDD_VERSION=v0.2.1 \
+#        -t inftyai/sandd-tunnel:v0.2.1 .
+# Run:   docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-tunnel:v0.2.1
 
 FROM debian:bookworm-slim
 
@@ -23,7 +23,7 @@ RUN apt-get update && apt-get install -y \
 RUN curl -fsSL https://tailscale.com/install.sh | sh
 
 # Download pre-built daemon binary from GitHub releases
-ARG SANDD_VERSION=v0.2.0
+ARG SANDD_VERSION=v0.2.1
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
 

diff --git a/hack/docker/Dockerfile.server-tunnel-release b/hack/docker/Dockerfile.server-tunnel-release
@@ -2,9 +2,9 @@
 # Uses published PyPI package instead of building from source
 #
 # Build: docker build -f hack/docker/Dockerfile.server-tunnel-release \
-#        --build-arg SANDD_VERSION=0.2.0 \
-#        -t inftyai/sandd-server-tunnel:v0.2.0 .
-# Run:   docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-server-tunnel:v0.2.0
+#        --build-arg SANDD_VERSION=0.2.1 \
+#        -t inftyai/sandd-server-tunnel:v0.2.1 .
+# Run:   docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-server-tunnel:v0.2.1
 
 FROM python:3.11-slim-bookworm
 
@@ -23,7 +23,7 @@ RUN apt-get update && apt-get install -y \
 RUN curl -fsSL https://tailscale.com/install.sh | sh
 
 # Install SandD from PyPI (specify version or use latest)
-ARG SANDD_VERSION=0.2.0
+ARG SANDD_VERSION=0.2.1
 RUN pip install --no-cache-dir sandd==${SANDD_VERSION}
 
 # Create directory for Tailscale state

diff --git a/hack/docker/README.md b/hack/docker/README.md
@@ -15,7 +15,7 @@ This directory contains Docker-related files for building and testing SandD.
 
 - **`Dockerfile.server-tunnel-release`** - Server with Tailscale (uses PyPI release)
   - Use: Production deployments
-  - Build: `docker build -f hack/docker/Dockerfile.server-tunnel-release --build-arg SANDD_VERSION=0.2.0 -t inftyai/sandd-server-tunnel:v0.2.0 .`
+  - Build: `docker build -f hack/docker/Dockerfile.server-tunnel-release --build-arg SANDD_VERSION=0.2.1 -t inftyai/sandd-server-tunnel:v0.2.1 .`
 
 #### Daemon (Worker) Images
 
@@ -25,7 +25,7 @@ This directory contains Docker-related files for building and testing SandD.
 
 - **`Dockerfile.daemon-tunnel-release`** - Daemon with Tailscale (uses GitHub release)
   - Use: Production deployments
-  - Build: `docker build -f hack/docker/Dockerfile.daemon-tunnel-release --build-arg SANDD_VERSION=v0.2.0 -t inftyai/sandd-tunnel:v0.2.0 .`
+  - Build: `docker build -f hack/docker/Dockerfile.daemon-tunnel-release --build-arg SANDD_VERSION=v0.2.1 -t inftyai/sandd-tunnel:v0.2.1 .`
 
 #### Test Images (Direct Mode)
 
@@ -68,7 +68,7 @@ Overridable variables: `SERVER_TUNNEL_IMG`, `SERVER_TUNNEL_TAG`, `PLATFORMS`,
 
 ```bash
 make docker-push-server-tunnel \
-  SERVER_TUNNEL_IMG=myrepo/sandd-server-tunnel SERVER_TUNNEL_TAG=v0.2.0
+  SERVER_TUNNEL_IMG=myrepo/sandd-server-tunnel SERVER_TUNNEL_TAG=v0.2.1
 ```
 
 To iterate locally you need a **runnable** image, which a multi-platform build cannot

diff --git a/protocol/Cargo.toml b/protocol/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "sandd-protocol"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "Apache-2.0"
 description = "Shared wire protocol types for the SandD sandbox daemon and controller."

diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "sandd"
-version = "0.2.0"
+version = "0.2.1"
 description = "A lightweight sandbox daemon for secure agent execution in isolated environments."
 readme = {file = "README.md", content-type = "text/markdown"}
 requires-python = ">=3.8"

diff --git a/sandd/Cargo.toml b/sandd/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "sandd"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "Apache-2.0"
 description = "A lightweight sandbox daemon for secure agent execution in isolated environments."
@@ -30,7 +30,7 @@ path = "../examples/snapshot_real_project.rs"
 [dependencies]
 # `version` is required to publish: cargo strips `path` and resolves the
 # dependency from crates.io, so sandd-protocol must be published first.
-sandd-protocol = { path = "../protocol", version = "0.2.0" }
+sandd-protocol = { path = "../protocol", version = "0.2.1" }
 tokio = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

diff --git a/server/Cargo.toml b/server/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "sandbox-server"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "Apache-2.0"
 description = "A lightweight sandbox daemon for secure agent execution in isolated environments."
@@ -39,7 +39,7 @@ parking_lot = "0.12"
 # [features] below). With extension-module set, pyo3 deliberately leaves the CPython
 # symbols undefined for an interpreter to supply at dlopen time, so a plain `cargo
 # test` linking it would fail (loudly on macOS, subtly elsewhere).
-pyo3 = { version = "0.20", features = ["extension-module", "anyhow"], optional = true }
+pyo3 = { version = "0.20", features = ["extension-module", "anyhow", "abi3-py38"], optional = true }
 pythonize = { version = "0.20", optional = true }
 
 # Base64 for protocol