fix(fix4): enforce runtime contract and orchestrator guardrails

orchestrator/src/config/env.ts

@@ -119,6 +119,7 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     uiPort,
     adminUser: requireValue("HY2XS_ADMIN_USER", env.HY2XS_ADMIN_USER || "admin"),
     adminInitialPassword: valueOrGenerate(env.HY2XS_ADMIN_INITIAL_PASSWORD),
+    adminConPass: requireValue("HY2XS_ADMIN_CON_PASS", valueOrGenerate(env.HY2XS_ADMIN_CON_PASS)),
     forcePasswordChange: parseBool("HY2XS_FORCE_PASSWORD_CHANGE", env.HY2XS_FORCE_PASSWORD_CHANGE, true),
     tlsMode,
     acmeType,
@@ -202,6 +203,7 @@ export function renderRuntimeEnv(config: RuntimeConfig): string {
     `HY2XS_UI_PORT=${config.uiPort}`,
     `HY2XS_ADMIN_USER=${config.adminUser}`,
     `HY2XS_ADMIN_INITIAL_PASSWORD=${config.adminInitialPassword}`,
+    `HY2XS_ADMIN_CON_PASS=${config.adminConPass}`,
     `HY2XS_FORCE_PASSWORD_CHANGE=${config.forcePasswordChange}`,
     `HY2XS_TLS_MODE=${config.tlsMode}`,
     `HY2XS_ACME_TYPE=${config.acmeType}`,

orchestrator/src/steps/env.ts

@@ -30,5 +30,5 @@ export async function writePostInstallEnv(context: InstallContext): Promise<void
   });
 
   await writeText("/etc/hysteria/post-install.env", rendered, 0o600);
-  await writeText(context.config.bootstrapAdminSecretPath, `${context.config.adminUser}:${context.config.adminInitialPassword}\n`, 0o600);
+  await writeText(context.config.bootstrapAdminSecretPath, `${context.config.adminUser}:${context.config.adminConPass}\n`, 0o600);
 }

orchestrator/src/steps/smoke.ts

@@ -32,7 +32,12 @@ export async function smoke(context: InstallContext): Promise<void> {
     throw new Error(`unexpected auth response for invalid credentials: ${invalidAuthResponse}`);
   }
 
-  const validAuthResponse = await runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"${context.config.adminUser}.${context.config.adminInitialPassword}","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`;
+  const adminConPass = (await runSecret`grep '^${context.config.adminUser}:' ${context.config.bootstrapAdminSecretPath} | head -n1 | cut -d: -f2-`).trim();
+  if (!adminConPass) {
+    throw new Error("admin connection password is empty in bootstrap secret file");
+  }
+
+  const validAuthResponse = await runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"${adminConPass}","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`;
   if (!/"ok"\s*:\s*true/.test(validAuthResponse)) {
     throw new Error(`unexpected auth response for valid credentials`);
   }

orchestrator/src/types/context.ts

@@ -32,6 +32,7 @@ export type RuntimeConfig = {
   uiPort: number;
   adminUser: string;
   adminInitialPassword: string;
+  adminConPass: string;
   forcePasswordChange: boolean;
   tlsMode: TlsMode;
   acmeType: "http" | "tls" | "dns";