fix(fix3): runtime env hardening and public endpoint source-of-truth

orchestrator/src/steps/preflight.ts

@@ -12,6 +12,15 @@ async function isPortBusy(port: number): Promise<boolean> {
   }
 }
 
+async function isUnitActive(unit: string): Promise<boolean> {
+  try {
+    await run`systemctl is-active --quiet ${unit}`;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export async function preflight(context: InstallContext): Promise<void> {
   const isReconfigure = context.packageVersion === "reconfigure";
 
@@ -76,11 +85,24 @@ export async function preflight(context: InstallContext): Promise<void> {
     }
   }
 
-  if (await isPortBusy(context.config.hysteriaPort)) {
-    fail(`Hysteria UDP/TCP port already appears to be in use: ${context.config.hysteriaPort}`);
+  const hysteriaPortBusy = await isPortBusy(context.config.hysteriaPort);
+  const uiPortBusy = await isPortBusy(context.config.uiPort);
+
+  if (!isReconfigure) {
+    if (hysteriaPortBusy) {
+      fail(`Hysteria UDP/TCP port already appears to be in use: ${context.config.hysteriaPort}`);
+    }
+    if (uiPortBusy) {
+      fail(`HY2XS admin port already appears to be in use: ${context.config.uiPort}`);
+    }
+    return;
   }
 
-  if (await isPortBusy(context.config.uiPort)) {
-    fail(`HY2XS admin port already appears to be in use: ${context.config.uiPort}`);
+  if (hysteriaPortBusy && !(await isUnitActive("hysteria-server"))) {
+    fail(`Hysteria port ${context.config.hysteriaPort} is occupied by a non-HY2XS process`);
+  }
+
+  if (uiPortBusy && !(await isUnitActive("hy2xs-admin"))) {
+    fail(`HY2XS admin port ${context.config.uiPort} is occupied by a non-HY2XS process`);
   }
 }