Production hardening: host-aware install, ownership contracts, firewall safety

orchestrator/src/lib/packageMeta.ts

@@ -0,0 +1,20 @@
+import { readText } from "./fs";
+import { run } from "./process";
+
+export async function readPackageValue(packageDir: string, file: string, fallback: string): Promise<string> {
+  try {
+    return (await readText(`${packageDir}/metadata/${file}`)).trim();
+  } catch {
+    return fallback;
+  }
+}
+
+export async function readInstalledHysteriaVersion(): Promise<string> {
+  try {
+    const raw = await run`/usr/local/bin/hysteria version`;
+    const match = raw.match(/v\d+\.\d+\.\d+/);
+    return match ? match[0] : raw.trim();
+  } catch {
+    return "unknown";
+  }
+}