Production hardening: host-aware install, ownership contracts, firewall safety

orchestrator/src/commands/reconfigure.ts

@@ -9,6 +9,7 @@ import { applyFirewall } from "../steps/firewall";
 import { writePostInstallEnv } from "../steps/env";
 import { smoke } from "../steps/smoke";
 import { runVisible } from "../lib/process";
+import { readInstalledHysteriaVersion, readPackageValue } from "../lib/packageMeta";
 
 async function backupCurrentState(): Promise<void> {
   await runVisible`mkdir -p /etc/hy2xs/backups`;
@@ -48,11 +49,11 @@ export async function reconfigure(options: ReconfigureOptions): Promise<void> {
   const context: ReconfigureContext & { packageVersion: string; packageBuildId: string; installDate: string; hysteriaAuthPassword: string; hysteriaVersion: string } = {
     options,
     config,
-    packageVersion: "reconfigure",
-    packageBuildId: "reconfigure",
+    packageVersion: await readPackageValue(options.packageDir, "package.version", "unknown"),
+    packageBuildId: await readPackageValue(options.packageDir, "package.build_id", "unknown"),
     installDate: new Date().toISOString(),
     hysteriaAuthPassword: "managed-by-ui-auth",
-    hysteriaVersion: "unknown"
+    hysteriaVersion: await readInstalledHysteriaVersion()
   };
 
   step("preflight");