From 1b775e6afe730c237f49b2d203591e07db11bfd8 Mon Sep 17 00:00:00 2001
From: Jinwoo-H <jinwoo0825@gmail.com>
Date: Tue, 14 Jul 2026 17:58:42 -0400
Subject: [PATCH] build(ssh): read numeric linker PE version

Co-authored-by: Orca <help@stably.ai>
---
 config/scripts/ssh-relay-runtime-toolchain.mjs  |  9 ++++++---
 .../ssh-relay-runtime-toolchain.test.mjs        | 17 +++++++++++++----
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/config/scripts/ssh-relay-runtime-toolchain.mjs b/config/scripts/ssh-relay-runtime-toolchain.mjs
index 1fbd5162a65..3045f7e0446 100644
--- a/config/scripts/ssh-relay-runtime-toolchain.mjs
+++ b/config/scripts/ssh-relay-runtime-toolchain.mjs
@@ -188,6 +188,8 @@ export function sshRelayRuntimeStripVersionProbe(platform) {
 }
 
 export function sshRelayRuntimeWindowsFileVersionInvocation(path) {
+  const versionInfo =
+    "[System.Diagnostics.FileVersionInfo]::GetVersionInfo([Environment]::GetEnvironmentVariable('ORCA_SSH_RELAY_TOOL_PATH'))"
   return {
     command: 'pwsh.exe',
     args: [
@@ -195,7 +197,8 @@ export function sshRelayRuntimeWindowsFileVersionInvocation(path) {
       '-NoProfile',
       '-NonInteractive',
       '-Command',
-      "[System.Diagnostics.FileVersionInfo]::GetVersionInfo([Environment]::GetEnvironmentVariable('ORCA_SSH_RELAY_TOOL_PATH')).FileVersion"
+      // Why: hosted link.exe returns an empty FileVersion string; its numeric PE fields are stable.
+      `$versionInfo = ${versionInfo}; '{0}.{1}.{2}.{3}' -f $versionInfo.FileMajorPart, $versionInfo.FileMinorPart, $versionInfo.FileBuildPart, $versionInfo.FilePrivatePart`
     ],
     options: { env: { ORCA_SSH_RELAY_TOOL_PATH: path } }
   }
@@ -245,9 +248,9 @@ export async function collectSshRelayRuntimeToolchain(nodePath) {
       linker: await executableRecord({
         command: 'link.exe',
         args: [],
-        // Why: hosted link.exe is pipe-silent; authenticated PE metadata gives its real version.
+        // Why: hosted link.exe is pipe-silent; authenticated numeric PE metadata gives its version.
         windowsFileVersion: true,
-        versionPattern: /^\d+(?:\.\d+){2,3}(?:\s.*)?$/
+        versionPattern: /^(?!0\.0\.0\.0$)\d+(?:\.\d+){3}$/
       }),
       buildSystem: await executableRecord({
         command: 'msbuild.exe',
diff --git a/config/scripts/ssh-relay-runtime-toolchain.test.mjs b/config/scripts/ssh-relay-runtime-toolchain.test.mjs
index 9903908420c..b175b17b453 100644
--- a/config/scripts/ssh-relay-runtime-toolchain.test.mjs
+++ b/config/scripts/ssh-relay-runtime-toolchain.test.mjs
@@ -31,10 +31,19 @@ describe('SSH relay runtime build provenance', () => {
   it('selects a bounded Windows linker file version', () => {
     expect(
       selectSshRelayRuntimeToolVersion(
-        { stdout: '14.44.35228.0 built by release pipeline\r\n' },
-        /^\d+(?:\.\d+){2,3}(?:\s.*)?$/
+        { stdout: '14.44.35228.0\r\n' },
+        /^(?!0\.0\.0\.0$)\d+(?:\.\d+){3}$/
       )
-    ).toBe('14.44.35228.0 built by release pipeline')
+    ).toBe('14.44.35228.0')
+  })
+
+  it('rejects an absent Windows linker numeric file version', () => {
+    expect(() =>
+      selectSshRelayRuntimeToolVersion(
+        { stdout: '0.0.0.0\r\n' },
+        /^(?!0\.0\.0\.0$)\d+(?:\.\d+){3}$/
+      )
+    ).toThrow(/0\.0\.0\.0/)
   })
 
   it('passes the resolved linker path through a non-interpolated environment value', () => {
@@ -46,7 +55,7 @@ describe('SSH relay runtime build provenance', () => {
         '-NoProfile',
         '-NonInteractive',
         '-Command',
-        "[System.Diagnostics.FileVersionInfo]::GetVersionInfo([Environment]::GetEnvironmentVariable('ORCA_SSH_RELAY_TOOL_PATH')).FileVersion"
+        "$versionInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo([Environment]::GetEnvironmentVariable('ORCA_SSH_RELAY_TOOL_PATH')); '{0}.{1}.{2}.{3}' -f $versionInfo.FileMajorPart, $versionInfo.FileMinorPart, $versionInfo.FileBuildPart, $versionInfo.FilePrivatePart"
       ],
       options: { env: { ORCA_SSH_RELAY_TOOL_PATH: path } }
     })