fix(fix4): enforce runtime contract and orchestrator guardrails

orchestrator/src/steps/env.ts

@@ -30,5 +30,5 @@ export async function writePostInstallEnv(context: InstallContext): Promise<void
   });
 
   await writeText("/etc/hysteria/post-install.env", rendered, 0o600);
-  await writeText(context.config.bootstrapAdminSecretPath, `${context.config.adminUser}:${context.config.adminInitialPassword}\n`, 0o600);
+  await writeText(context.config.bootstrapAdminSecretPath, `${context.config.adminUser}:${context.config.adminConPass}\n`, 0o600);
 }

orchestrator/src/steps/smoke.ts

@@ -32,7 +32,12 @@ export async function smoke(context: InstallContext): Promise<void> {
     throw new Error(`unexpected auth response for invalid credentials: ${invalidAuthResponse}`);
   }
 
-  const validAuthResponse = await runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"${context.config.adminUser}.${context.config.adminInitialPassword}","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`;
+  const adminConPass = (await runSecret`grep '^${context.config.adminUser}:' ${context.config.bootstrapAdminSecretPath} | head -n1 | cut -d: -f2-`).trim();
+  if (!adminConPass) {
+    throw new Error("admin connection password is empty in bootstrap secret file");
+  }
+
+  const validAuthResponse = await runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"${adminConPass}","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`;
   if (!/"ok"\s*:\s*true/.test(validAuthResponse)) {
     throw new Error(`unexpected auth response for valid credentials`);
   }