Исправлен rollback/firewall lifecycle и shell execution, синхронизирована документация

orchestrator/src/commands/install.ts

@@ -33,8 +33,10 @@ async function markInstallSuccessful(context: InstallContext): Promise<void> {
   await runVisible`chown root:root ${INSTALL_STATE_PATH}`;
 }
 
-async function rollbackFailedInstall(context: InstallContext): Promise<void> {
-  await rollbackFirewallNow(context);
+async function rollbackFailedInstall(context: InstallContext, state: { firewallTouched: boolean }): Promise<void> {
+  if (state.firewallTouched) {
+    await rollbackFirewallNow(context);
+  }
   await runVisible`systemctl stop hysteria-server hy2xs-admin || true`;
   await runVisible`systemctl disable hysteria-server hy2xs-admin || true`;
   await runVisible`systemctl reset-failed hysteria-server hy2xs-admin || true`;
@@ -66,6 +68,10 @@ export async function install(options: InstallOptions): Promise<void> {
     throw new Error("missing Hysteria lock metadata in package: hysteria.version/hysteria.url/hysteria.sha256");
   }
 
+  const state = {
+    firewallTouched: false
+  };
+
   try {
     step("preflight");
     await preflight(context);
@@ -88,6 +94,7 @@ export async function install(options: InstallOptions): Promise<void> {
     await deploySystemd(context);
     step("firewall");
     await applyFirewall(context);
+    state.firewallTouched = true;
     step("post-install env");
     await writePostInstallEnv(context);
     step("bootstrap admin secret");
@@ -99,7 +106,7 @@ export async function install(options: InstallOptions): Promise<void> {
     step("mark install successful");
     await markInstallSuccessful(context);
   } catch (error) {
-    await rollbackFailedInstall(context);
+    await rollbackFailedInstall(context, state);
     throw error;
   }
 }