[sandboxes] devbox ls: print versions (#2277)

## Summary

For packages without an explicit version, this PR will print the version
for
the user in `devbox ls`.

Fixes #2274 

## How was it tested?
```
% devbox ls
* go@latest - 1.23.0
* runx:golangci/golangci-lint@latest - 1.60.2
* runx:mvdan/gofumpt@latest - 0.7.0
* [email protected]
```
Notice that versions are printed for go@latest and the runx packages,
but
not for cowsay since it was added via `devbox add [email protected]`

Also, `devbox ls -c examples/flakes/php` and `devbox ls -c
examples/flakes/remote`
```
% devbox ls -c examples/flakes/remote
* github:nixos/nixpkgs/5233fd2ba76a3accb5aaa999c00509a11fd0793c#hello
* github:nixos/nixpkgs/5233fd2ba76a3accb5aaa999c00509a11fd0793c#cowsay
* github:F1bonacc1/process-compose/v0.43.1
```

Author: savil

internal/boxcli/list.go

@@ -5,6 +5,7 @@ package boxcli
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
@@ -32,8 +33,26 @@ func listCmd() *cobra.Command {
 			if err != nil {
 				return errors.WithStack(err)
 			}
-			for _, p := range box.AllPackageNamesIncludingRemovedTriggerPackages() {
-				fmt.Fprintf(cmd.OutOrStdout(), "* %s\n", p)
+
+			for _, pkg := range box.AllPackagesIncludingRemovedTriggerPackages() {
+				resolvedVersion, err := pkg.ResolvedVersion()
+				if err != nil {
+					// Continue to print the package even if we can't resolve the version
+					// so that the user can see the error for this package, as well as get the
+					// results for the other packages
+					resolvedVersion = "<error resolving version>"
+				}
+				msg := ""
+
+				// Print the resolved version, unless the user has specified a version already
+				if strings.HasSuffix(pkg.Versioned(), "latest") && resolvedVersion != "" {
+					// Runx packages have a "v" prefix (why?). Trim for consistency.
+					resolvedVersion = strings.TrimPrefix(resolvedVersion, "v")
+					msg = fmt.Sprintf("* %s - %s\n", pkg.Versioned(), resolvedVersion)
+				} else {
+					msg = fmt.Sprintf("* %s\n", pkg.Versioned())
+				}
+				fmt.Fprint(cmd.OutOrStdout(), msg)
 			}
 			return nil
 		},

internal/devbox/devbox.go

@@ -842,12 +842,17 @@ func (d *Devbox) flakeDir() string {
 // flakes  (lockfile vs devbox list)
 func (d *Devbox) AllPackageNamesIncludingRemovedTriggerPackages() []string {
 	result := []string{}
-	for _, p := range d.cfg.Packages(true /*includeRemovedTriggerPackages*/) {
-		result = append(result, p.VersionedName())
+	for _, p := range d.AllPackagesIncludingRemovedTriggerPackages() {
+		result = append(result, p.Versioned())
 	}
 	return result
 }
 
+func (d *Devbox) AllPackagesIncludingRemovedTriggerPackages() []*devpkg.Package {
+	packages := d.cfg.Packages(true /*includeRemovedTriggerPackages*/)
+	return devpkg.PackagesFromConfig(packages, d.lockfile)
+}
+
 // AllPackages returns the packages that are defined in devbox.json and
 // recursively added by plugins.
 // NOTE: This will not return packages removed by their plugin with the

internal/devpkg/package.go

@@ -832,3 +832,15 @@ func packageInstallErrorHandler(err error, pkg *Package, installableOrEmpty stri
 
 	return usererr.WithUserMessage(err, "error installing package %s", pkg.Raw)
 }
+
+func (p *Package) ResolvedVersion() (string, error) {
+	if err := p.resolve(); err != nil {
+		return "", err
+	}
+	lockPackage := p.lockfile.Get(p.Raw)
+	// Flake packages don't have any values in the lockfile
+	if lockPackage == nil {
+		return "", nil
+	}
+	return p.lockfile.Get(p.Raw).Version, nil
+}