Production hardening: host-aware install, ownership contracts, firewall safety

orchestrator/src/commands/install.ts

@@ -3,6 +3,7 @@ import type { InstallContext, InstallOptions } from "../types/context";
 import { exists, readText, writeText } from "../lib/fs";
 import { runVisible } from "../lib/process";
 import { step } from "../lib/log";
+import { readPackageValue } from "../lib/packageMeta";
 import { parseRuntimeEnv, renderRuntimeEnv } from "../config/env";
 import { preflight } from "../steps/preflight";
 import { installDeps } from "../steps/deps";
@@ -15,14 +16,6 @@ import { applyFirewall } from "../steps/firewall";
 import { writePostInstallEnv } from "../steps/env";
 import { smoke } from "../steps/smoke";
 
-async function readPackageValue(packageDir: string, file: string, fallback: string): Promise<string> {
-  try {
-    return (await readText(`${packageDir}/metadata/${file}`)).trim();
-  } catch {
-    return fallback;
-  }
-}
-
 function secret(): string {
   return randomBytes(24).toString("base64url");
 }