From 3ee02a88b22950e38d6299fd287d0a097972c434 Mon Sep 17 00:00:00 2001
From: Dario Lencina <dario@securityunion.dev>
Date: Tue, 7 Jul 2026 00:48:55 -0700
Subject: [PATCH] fix(cli): --version carries build provenance (git hash, dirty
 flag)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two different builds could both claim 'videoeditor 0.1.0' — a stale nix
binary and a fresh checkout build are indistinguishable, which is how the
greenfield pressure test got a binary missing documented features with no
signal. build.rs embeds the short git hash and a dirty marker
('0.1.0 (e61a478, dirty)'); crates.io tarballs and nix store sources have
no .git and gracefully fall back to the plain version.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 crates/videoeditor/build.rs    | 33 +++++++++++++++++++++++++++++++++
 crates/videoeditor/src/main.rs |  2 +-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 crates/videoeditor/build.rs

diff --git a/crates/videoeditor/build.rs b/crates/videoeditor/build.rs
new file mode 100644
index 0000000..7ed0581
--- /dev/null
+++ b/crates/videoeditor/build.rs
@@ -0,0 +1,33 @@
+//! Embed build provenance in `--version` so two different builds can never
+//! masquerade as each other (a stale binary claiming to be "0.1.0" while the
+//! source moved on is how template features silently "disappear").
+
+use std::process::Command;
+
+fn main() {
+    let git = |args: &[&str]| {
+        Command::new("git")
+            .args(args)
+            .output()
+            .ok()
+            .filter(|o| o.status.success())
+            .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+    };
+    // crates.io tarballs and nix store sources have no .git — plain version
+    let build = match git(&["rev-parse", "--short=9", "HEAD"]) {
+        Some(hash) => {
+            let dirty = git(&["status", "--porcelain"])
+                .map(|s| !s.is_empty())
+                .unwrap_or(false);
+            if dirty {
+                format!(" ({hash}, dirty)")
+            } else {
+                format!(" ({hash})")
+            }
+        }
+        None => String::new(),
+    };
+    println!("cargo:rustc-env=VIDEOEDITOR_BUILD_INFO={build}");
+    println!("cargo:rerun-if-changed=../../.git/HEAD");
+    println!("cargo:rerun-if-changed=../../.git/index");
+}
diff --git a/crates/videoeditor/src/main.rs b/crates/videoeditor/src/main.rs
index c412b96..40f3011 100644
--- a/crates/videoeditor/src/main.rs
+++ b/crates/videoeditor/src/main.rs
@@ -11,7 +11,7 @@ use std::path::{Path, PathBuf};
 #[derive(Parser)]
 #[command(
     name = "videoeditor",
-    version,
+    version = concat!(env!("CARGO_PKG_VERSION"), env!("VIDEOEDITOR_BUILD_INFO")),
     about = "Scripted short-video renderer: script.md in, rendered vertical video out",
     after_help = "AI agents (Claude Code, etc.): run `videoeditor guide` for the embedded \
                   director's guide — the full production workflow, script grammar, and \