fix11: runtime contracts and smoke stability

orchestrator/src/config/env.ts

@@ -74,13 +74,28 @@ function normalizeIpv4Host(name: string, value: string): string {
 }
 
 function normalizePublicHost(value: string): string {
-  if (!value) {
+  const host = value.trim();
+
+  if (!host) {
     throw new Error("missing required HY2XS_PUBLIC_HOST");
   }
-  if (value.includes(":")) {
-    throw new Error("HY2XS_PUBLIC_HOST must not contain IPv6");
+
+  if (host.includes("/") || host.includes(":") || /\s/.test(host)) {
+    throw new Error("HY2XS_PUBLIC_HOST must be a domain or IPv4 without scheme, port, path or spaces");
   }
-  return value;
+
+  const ipv4 = /^(25[0-5]|2[0-4]\d|1?\d?\d)(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$/;
+  const domain = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/;
+
+  if (!ipv4.test(host) && !domain.test(host)) {
+    throw new Error(`invalid HY2XS_PUBLIC_HOST: ${value}`);
+  }
+
+  if (host === "0.0.0.0" || host === "127.0.0.1") {
+    throw new Error("HY2XS_PUBLIC_HOST must be a routable domain or public IPv4");
+  }
+
+  return host;
 }
 
 function normalizeTlsMode(value: string): TlsMode {

orchestrator/src/steps/smoke.ts

@@ -2,6 +2,27 @@ import type { RuntimeContext } from "../types/context";
 import { info } from "../lib/log";
 import { runHidden, runSecret, runVisible } from "../lib/process";
 
+async function retry<T>(
+  attempts: number,
+  delayMs: number,
+  action: () => Promise<T>,
+  validate: (value: T) => boolean,
+  errorFactory: (value: T) => Error,
+): Promise<T> {
+  let lastValue: T | undefined;
+  for (let i = 0; i < attempts; i += 1) {
+    const value = await action();
+    lastValue = value;
+    if (validate(value)) {
+      return value;
+    }
+    if (i < attempts - 1) {
+      await runHidden`sleep ${Math.max(1, Math.ceil(delayMs / 1000))}`;
+    }
+  }
+  throw errorFactory(lastValue as T);
+}
+
 export async function smoke(context: RuntimeContext): Promise<void> {
   if (context.options.skipStart) {
     info("service start and smoke checks skipped by flag");
@@ -40,10 +61,13 @@ export async function smoke(context: RuntimeContext): Promise<void> {
   await runVisible`ss -H -lun | grep -q '0.0.0.0:${context.config.hysteriaPort} '`;
   await runVisible`! ss -H -ltn | grep -q '\[::\]:${context.config.uiPort} '`;
   await runVisible`! ss -H -lun | grep -q '\[::\]:${context.config.hysteriaPort} '`;
-  const invalidAuthResponse = await runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"invalid","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`;
-  if (!/"ok"\s*:\s*false/.test(invalidAuthResponse)) {
-    throw new Error(`unexpected auth response for invalid credentials: ${invalidAuthResponse}`);
-  }
+  const invalidAuthResponse = await retry(
+    5,
+    1000,
+    async () => runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"invalid","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`,
+    (response) => /"ok"\s*:\s*false/.test(response),
+    (response) => new Error(`unexpected auth response for invalid credentials: ${response}`),
+  );
 
   for (let i = 0; i < 10; i += 1) {
     const response = await runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"invalid","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`;
@@ -57,12 +81,21 @@ export async function smoke(context: RuntimeContext): Promise<void> {
     throw new Error("admin connection password is empty in bootstrap secret file");
   }
 
-  const validAuthResponse = await runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"${adminConPass}","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`;
-  if (!/"ok"\s*:\s*true/.test(validAuthResponse)) {
-    throw new Error(`unexpected auth response for valid credentials`);
-  }
+  const validAuthResponse = await retry(
+    10,
+    1000,
+    async () => runSecret`curl -sS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"${adminConPass}","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth`,
+    (response) => /"ok"\s*:\s*true/.test(response),
+    () => new Error("unexpected auth response for valid credentials"),
+  );
 
-  await runHidden`curl -fsS --max-time 5 -H 'Authorization: ${context.config.hysteriaTrafficStatsSecret}' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online >/dev/null`;
+  await retry(
+    10,
+    1000,
+    async () => runSecret`curl -sS --max-time 5 -o /dev/null -w '%{http_code}' -H 'Authorization: ${context.config.hysteriaTrafficStatsSecret}' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online`,
+    (code) => /^2\d\d$/.test(code.trim()),
+    (code) => new Error(`unexpected trafficStats status for valid secret: ${code}`),
+  );
   const deniedCode = await runSecret`curl -sS --max-time 5 -o /dev/null -w '%{http_code}' -H 'Authorization: invalid-hy2xs-secret' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online`;
   if (!/(401|403)/.test(deniedCode)) {
     throw new Error(`unexpected trafficStats status for invalid secret: ${deniedCode}`);