fix(orcad): stamp the build commit so orca skills install works on SSH and headless hosts (#28558)

* fix(orcad): stamp the build commit so orca skills install works on SSH and headless hosts

#27603 pins 'orca skills install|update' to the commit the CLI was built from,
read from the CLI's out/package.json. The desktop CLI build stamps it, but the
server bundle (the 'orca' in SSH-host and 'orca serve' terminals) wrote that file
without a commit, so the command always failed there with 'Could not read the
commit this Orca CLI was built from'. Stamp it the same way.

* test: verify built orcad CLI skill source in artifact preflight

config/scripts/build-orcad.mjs

@@ -56,6 +56,7 @@ import { findSlotProblems, readManifest } from './orcad-prebuild-slot-contents.m
 import { orcadAgentBrowserNativeName } from '../../src/shared/orcad-agent-browser-name.ts'
 import { runProcessSync } from '@orca/process-host'
 import { describeProcessFailure } from './process-failure-message.mjs'
+import { resolveBuildSourceCommit } from './build-source-commit.mjs'
 
 const ROOT = join(import.meta.dirname, '..', '..')
 const OUT_DIR = process.env.ORCAD_OUT_DIR
@@ -232,10 +233,14 @@ const childResults = await Promise.all(
 const result = await buildOrcadEntry(SERVER_OUT_FILE)
 const cliResult = await buildOrcadCli(join(OUT_DIR, ORCAD_CLI_ENTRY_FILENAME))
 const { version: cliVersion } = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
-writeFileSync(
-  join(OUT_DIR, ORCAD_CLI_PACKAGE_FILENAME),
-  `${JSON.stringify({ type: 'commonjs', private: true, version: cliVersion })}\n`
-)
+// Why commit: `orca skills install|update` pins official skills to it, as the desktop CLI does.
+const cliPackage = {
+  type: 'commonjs',
+  private: true,
+  version: cliVersion,
+  commit: resolveBuildSourceCommit()
+}
+writeFileSync(join(OUT_DIR, ORCAD_CLI_PACKAGE_FILENAME), `${JSON.stringify(cliPackage)}\n`)
 const launcherResult = await buildOrcadLauncher(OUT_FILE)
 
 const output = Object.values(result.metafile.outputs).find(

config/scripts/run-node-server-tests.mjs

@@ -3,6 +3,7 @@ import { join, resolve } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import { globSync, readFileSync } from 'node:fs'
 import {
+  ORCAD_CLI_ENTRY_FILENAME,
   ORCAD_SERVER_ENTRY_FILENAME,
   ORCAD_VERSION_FILENAME
 } from '../../src/shared/orcad-artifacts.ts'
@@ -17,6 +18,7 @@ import { currentTarget } from './server-build-target.mjs'
 import { UNIT_INCLUDE } from './ci-unit-files.mjs'
 import { runProcessSync } from '@orca/process-host'
 import { describeProcessFailure } from './process-failure-message.mjs'
+import { resolveBuildSourceCommit } from './build-source-commit.mjs'
 import {
   CROSS_RUNTIME_TEST_PATHS,
   nodeServerTestPaths,
@@ -79,6 +81,34 @@ if (artifact) {
     readFileSync(join(packageDir, ORCAD_VERSION_FILENAME), 'utf8').trim()
   )
   process.stdout.write(`${JSON.stringify({ target, ...response })}\n`)
+
+  const source = `https://github.com/stablyai/orca/tree/${resolveBuildSourceCommit()}`
+  const cli = runProcessSync({
+    program: runtimePath,
+    args: [
+      join(packageDir, ORCAD_CLI_ENTRY_FILENAME),
+      'skills',
+      'install',
+      '--skill',
+      'orca-cli',
+      '--agent',
+      'universal',
+      '--dry-run'
+    ],
+    cwd: root,
+    env,
+    timeoutMs: 90_000
+  })
+  if (
+    cli.code !== 0 ||
+    cli.timedOut ||
+    cli.outputTruncated ||
+    !cli.stdout.split('\n')[0].split(' ').includes(source)
+  ) {
+    throw new Error(
+      `Bundled CLI skills source did not match ${source}: ${describeProcessFailure(cli)}`
+    )
+  }
 }
 run(runtimePath, [
   join(root, 'node_modules/vitest/vitest.mjs'),