[brennanb2025]

	Files	Added	Deleted	Net
Test	0	0	0	0
Prod	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​39	$\color{#cf222e}{\Huge{\mathbf{−}}}$​4	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​35

ELI5

orca skills install and orca skills update stopped working in terminals on SSH hosts and headless orca serve machines. They need to know which Orca build they belong to, and the server build forgot to write that down. Now it does.

What Changed

Before (since #27603, Oct 11):

• In a terminal on an SSH host or an orca serve machine, orca skills install --skill … and orca skills update --all always failed, even with --dry-run: "Could not read the commit this Orca CLI was built from, so there is no source to install skills from."
• In 1.4.224 these commands worked. The remote-servers docs page lists them under "Install or refresh agent skills without a Settings UI".
• Settings → Skills on the desktop was never affected.

After: the commands work there again and install the skill versions pinned to the commit that server was built from, the same as on the desktop.

Mechanism:

• fix(skills): judge official skill updates by ownership, not snapshot matching #27603 pins official skill installs to the commit the CLI was built from. The CLI reads that commit from the package.json beside it (src/cli/cli-version.ts).
• The desktop CLI build stamps commit into that file (config/scripts/verify-cli-bin.mjs).
• The server bundle wrote its own out/package.json with only type, private and version (config/scripts/build-orcad.mjs).
• This change stamps commit there too, using the same resolveBuildSourceCommit() the desktop build uses.

Why

• This is the smallest change that makes the two CLI builds agree on the contract cli-version.ts reads.
• The alternative was to let the server CLI fall back to installing unpinned skills when the commit is missing. That would quietly bring back the version drift fix(skills): judge official skill updates by ownership, not snapshot matching #27603 removed.
• Like the desktop build, the server build now needs a git checkout. Every place it runs already is one: pnpm build:orcad in CI and in the release workflows.

Linked Issue

Found by the 1.4.225 release audit (P1-A). Follow-up to #27603.

Visual Proof

N/A: CLI output only. Before and after are in Testing below.

Testing

• I manually tested these changes locally
• Automated tests added/updated, or explained why not below

What I ran (macOS):

• pnpm run build:orcad with this change. The built out/orcad/out/package.json is {"type":"commonjs","private":true,"version":"1.4.214","commit":"<HEAD sha>"}.
• With the fix, node out/orcad/out/cli/index.js skills install --skill orca-cli --dry-run (the built server CLI) prints npx --yes skills@1.7.2 add https://github.com/stablyai/orca/tree/<HEAD sha> --skill orca-cli --global ….
• Before the fix, the same built CLI with the same file minus commit (what main builds today) prints "Could not read the commit this Orca CLI was built from, so there is no source to install skills from."

Why no new automated test:

• build-orcad.mjs is a top-level build script with no unit harness.
• Exercising it means a full server build, which the existing build:orcad CI jobs already do.
• The reading side is covered by src/cli/cli-version.test.ts.

Not run: a real SSH host or a Linux/Windows build of the server.

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• Security: the build commit is already public in the desktop build and in skill install URLs.
• Cross-platform: the file is written the same way for every server target (Linux, macOS, Windows).
• SSH / remote: this is the SSH and headless fix.
• Backward compatibility: an added field only. Readers that don't know it ignore it.
• Performance: one git rev-parse at build time.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c68d3b60-5fd6-4aaf-824d-f11ca77ffa31

📥 Commits

Reviewing files that changed from the base of the PR and between 90e0ef7 and edf216b.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e04c848a-c066-467c-aab8-78194ffe0039

📥 Commits

Reviewing files that changed from the base of the PR and between 349493f and fb40193.

📒 Files selected for processing: 1

• config/scripts/run-node-server-tests.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

📝 Walkthrough

The build script now adds the resolved source commit to generated CLI package metadata. In artifact mode, the Node server test script runs the packaged CLI’s skills install dry run and checks for successful completion and the expected source URL.

Estimated code review effort

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to fb401

The server build includes the commit metadata needed by the packaged skills CLI. No issue identified here prevents merging after normal checks.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description check		The description is detailed and covers the user impact, mechanism, rationale, testing, limitations, and checklist. It notes that SSH and Linux/Windows testing were not performed.
Title check		The title clearly and concisely identifies the main change and its SSH/headless-host impact.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[brennanb2025]

orca skills install and orca skills update failed in SSH/headless server terminals after #27603 because the bundled server CLI omitted the build commit that those commands require. This PR stamps the same validated source commit as the desktop CLI, so official skills again install from the revision belonging to the shipped server.

Review verdict: the build-time stamp is the right contract; deployed hosts need no Git checkout. Traced the shared metadata through server targets, desktop templates, SSH uploads, and AppImage serve selection, and found no competing fix in the inspected current main. A shared JSON writer would add little beyond the provenance resolver already reused.

Added one regression check in fb40193eebf: the existing server test command runs the actual built CLI and checks its exact source URL. Verified both required dry runs, their copied missing-commit failures, a relocated bundle outside Git, a real paired terminal on the built server, and a real isolated Linux SSH install whose skill hash matched source. Independent reviews found no remaining product issues; all 22 local static checks passed with the pinned Bun toolchain. Remote M4Air CDP screenshots show the same negative/positive terminal comparison. GitHub's Linux server build and tests passed; CI's only failure was main's unrelated typecheck break, and the fix is in #28570.

Known intended consequence: a new source commit can require a fresh server copy between development builds with the same version so the correct skill revision reaches the host; normal releases already change version. Full SSH transport/redeploy failure testing was not run and was accepted out of scope for this metadata-only change. Windows/WSL, full AppImage packaging, and the all-target release matrix were not run locally; real global updates were avoided. No product fixes were deferred, and nothing was merged.

Before: copied build with only commit removed.

After: stamped build prints both pinned commands.