fix: address PR #85 review comments

- Extract ensure_config_file() helper to eliminate duplicate code
- Use metadata().is_file() with permission error handling instead
  of Path::exists()
- Fix TOCTOU: use OpenOptions::create_new(true) for atomic creates
- Remove baked-in admin/admin credentials from .env template
- Create .env with 0600 permissions on Unix (contains secrets)
- Add missing env vars: COMPOSE_AGENT_ENABLED, VAULT_ADDRESS,
  VAULT_TOKEN, TRYDIRECT_IP, UPDATE_BINARY_URL, UPDATE_EXPECTED_SHA256
- Honor --config path in init (derive output dir from it)
- 2 new tests: env var completeness, Unix permission check

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: vsilent

src/agent/init.rs

@@ -37,20 +37,30 @@ COMMAND_TIMEOUT_SECS=300
 METRICS_INTERVAL_SECS=15
 # METRICS_WEBHOOK=https://example.com/metrics
 
-# ── UI / API credentials (defaults to admin/admin) ───────────────────
-STATUS_PANEL_USERNAME=admin
-STATUS_PANEL_PASSWORD=admin
+# ── UI / API credentials (must be set explicitly before use) ─────────
+STATUS_PANEL_USERNAME=
+STATUS_PANEL_PASSWORD=
 
 # ── Docker ───────────────────────────────────────────────────────────
 # DOCKER_SOCK=unix:///var/run/docker.sock
 # NGINX_CONTAINER=nginx
 
+# ── Compose Agent ────────────────────────────────────────────────────
+# COMPOSE_AGENT_ENABLED=false
+
 # ── Backup / Security ───────────────────────────────────────────────
 # DEPLOYMENT_HASH=
 # BACKUP_PATH=/data/encrypted/backup.tar.gz.cpt
+# TRYDIRECT_IP=
+
+# ── Vault (optional) ────────────────────────────────────────────────
+# VAULT_ADDRESS=http://127.0.0.1:8200
+# VAULT_TOKEN=
 
 # ── Self-update (optional) ──────────────────────────────────────────
 # UPDATE_SERVER_URL=
+# UPDATE_BINARY_URL=
+# UPDATE_EXPECTED_SHA256=
 # UPDATE_STORAGE_PATH=/var/lib/status-panel
 "#;
 
@@ -65,13 +75,15 @@ pub struct InitResult {
 /// Generate default config.json and .env files in the given directory.
 ///
 /// Existing files are never overwritten unless `force` is true.
+/// The .env file is created with restricted permissions (0600) on Unix.
 pub fn generate_default_config(dir: &Path, force: bool) -> Result<InitResult> {
     let config_path = dir.join("config.json");
     let env_path = dir.join(".env");
 
     let config_created =
         write_if_absent(&config_path, DEFAULT_CONFIG, force).context("writing config.json")?;
-    let env_created = write_if_absent(&env_path, DEFAULT_ENV, force).context("writing .env")?;
+    let env_created =
+        write_if_absent_secure(&env_path, DEFAULT_ENV, force).context("writing .env")?;
 
     if config_created {
         info!(path = %config_path.display(), "created default config.json");
@@ -88,14 +100,66 @@ pub fn generate_default_config(dir: &Path, force: bool) -> Result<InitResult> {
     })
 }
 
-/// Write `content` to `path` if the file does not exist or `force` is true.
+/// Write `content` to `path` atomically if the file does not exist.
+/// When `force` is true, truncates and overwrites.
 /// Returns `true` when the file was actually written.
 fn write_if_absent(path: &Path, content: &str, force: bool) -> Result<bool> {
-    if path.exists() && !force {
-        return Ok(false);
+    use std::fs::OpenOptions;
+    use std::io::Write;
+
+    if force {
+        std::fs::write(path, content)?;
+        return Ok(true);
     }
+
+    // Atomic create: fails with AlreadyExists if file is present (no TOCTOU)
+    match OpenOptions::new().write(true).create_new(true).open(path) {
+        Ok(mut f) => {
+            f.write_all(content.as_bytes())?;
+            Ok(true)
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => Ok(false),
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// Like `write_if_absent` but sets 0600 permissions on Unix (for secret-bearing files).
+fn write_if_absent_secure(path: &Path, content: &str, force: bool) -> Result<bool> {
+    use std::fs::OpenOptions;
+    use std::io::Write;
+
+    if force {
+        write_with_restricted_perms(path, content)?;
+        return Ok(true);
+    }
+
+    match OpenOptions::new().write(true).create_new(true).open(path) {
+        Ok(mut f) => {
+            f.write_all(content.as_bytes())?;
+            drop(f);
+            set_restricted_perms(path);
+            Ok(true)
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => Ok(false),
+        Err(e) => Err(e.into()),
+    }
+}
+
+fn write_with_restricted_perms(path: &Path, content: &str) -> Result<()> {
     std::fs::write(path, content)?;
-    Ok(true)
+    set_restricted_perms(path);
+    Ok(())
+}
+
+#[cfg(unix)]
+fn set_restricted_perms(path: &Path) {
+    use std::os::unix::fs::PermissionsExt;
+    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
+}
+
+#[cfg(not(unix))]
+fn set_restricted_perms(_path: &Path) {
+    // No-op on non-Unix platforms
 }
 
 #[cfg(test)]
@@ -160,4 +224,34 @@ mod tests {
         assert_eq!(cfg.reqdata.email, "admin@example.com");
         assert!(!cfg.compose_agent_enabled);
     }
+
+    #[test]
+    fn test_env_contains_all_documented_vars() {
+        assert!(DEFAULT_ENV.contains("AGENT_ID="));
+        assert!(DEFAULT_ENV.contains("AGENT_TOKEN="));
+        assert!(DEFAULT_ENV.contains("DASHBOARD_URL="));
+        assert!(DEFAULT_ENV.contains("STATUS_PANEL_USERNAME="));
+        assert!(DEFAULT_ENV.contains("STATUS_PANEL_PASSWORD="));
+        assert!(DEFAULT_ENV.contains("COMPOSE_AGENT_ENABLED"));
+        assert!(DEFAULT_ENV.contains("VAULT_ADDRESS"));
+        assert!(DEFAULT_ENV.contains("VAULT_TOKEN"));
+        assert!(DEFAULT_ENV.contains("DEPLOYMENT_HASH"));
+        assert!(DEFAULT_ENV.contains("UPDATE_SERVER_URL"));
+        assert!(DEFAULT_ENV.contains("UPDATE_STORAGE_PATH"));
+        // Credentials must not have default values baked in
+        assert!(DEFAULT_ENV.contains("STATUS_PANEL_USERNAME=\n"));
+        assert!(DEFAULT_ENV.contains("STATUS_PANEL_PASSWORD=\n"));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_env_file_has_restricted_permissions() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = tempfile::tempdir().unwrap();
+        generate_default_config(dir.path(), false).unwrap();
+
+        let meta = std::fs::metadata(dir.path().join(".env")).unwrap();
+        let mode = meta.permissions().mode() & 0o777;
+        assert_eq!(mode, 0o600, "expected 0600, got {:o}", mode);
+    }
 }

src/main.rs

@@ -1,14 +1,72 @@
 use dotenvy::dotenv;
 use status_panel::{agent, commands, comms, monitoring, utils};
 
-use anyhow::{Context, Result};
+use anyhow::Result;
 use clap::{Parser, Subcommand};
 use tracing::info;
 
 /// Application version from Cargo.toml
 const VERSION: &str = env!("CARGO_PKG_VERSION");
 const PKG_NAME: &str = env!("CARGO_PKG_NAME");
 
+/// Check that `path` points to a readable file. Prints a friendly error and
+/// exits if the file is missing, is not a regular file, or is not readable.
+fn ensure_config_file(path: &str) {
+    match std::fs::metadata(path) {
+        Ok(meta) if meta.is_file() => {
+            // Verify readability
+            if let Err(err) = std::fs::File::open(path) {
+                if err.kind() == std::io::ErrorKind::PermissionDenied {
+                    eprintln!();
+                    eprintln!("  Config file is not readable: {path}");
+                    eprintln!();
+                    eprintln!("  Check the file permissions and try again.");
+                    eprintln!();
+                    std::process::exit(1);
+                }
+                eprintln!();
+                eprintln!("  Cannot open config file: {path}");
+                eprintln!("  Error: {err}");
+                eprintln!();
+                std::process::exit(1);
+            }
+        }
+        Ok(_) => {
+            eprintln!();
+            eprintln!("  Config path is not a regular file: {path}");
+            eprintln!();
+            eprintln!("  Run 'status init' to generate a default configuration,");
+            eprintln!("  or specify a valid file with --config <path>");
+            eprintln!();
+            std::process::exit(1);
+        }
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            eprintln!();
+            eprintln!("  Config file not found: {path}");
+            eprintln!();
+            eprintln!("  Run 'status init' to generate a default configuration,");
+            eprintln!("  or specify a custom path with --config <path>");
+            eprintln!();
+            std::process::exit(1);
+        }
+        Err(err) if err.kind() == std::io::ErrorKind::PermissionDenied => {
+            eprintln!();
+            eprintln!("  Config file is not readable: {path}");
+            eprintln!();
+            eprintln!("  Check the file permissions and try again.");
+            eprintln!();
+            std::process::exit(1);
+        }
+        Err(err) => {
+            eprintln!();
+            eprintln!("  Cannot access config file: {path}");
+            eprintln!("  Error: {err}");
+            eprintln!();
+            std::process::exit(1);
+        }
+    }
+}
+
 /// Print startup banner with version and system info
 fn print_banner() {
     let rust_version = rustc_version_runtime::version();
@@ -237,15 +295,7 @@ async fn main() -> Result<()> {
 
     match args.command {
         Some(Commands::Serve { port, with_ui }) => {
-            if !std::path::Path::new(&args.config).exists() {
-                eprintln!();
-                eprintln!("  Config file not found: {}", args.config);
-                eprintln!();
-                eprintln!("  Run 'status init' to generate a default configuration,");
-                eprintln!("  or specify a custom path with --config <path>");
-                eprintln!();
-                std::process::exit(1);
-            }
+            ensure_config_file(&args.config);
             if with_ui {
                 info!("Starting local API server with UI on port {port}");
             } else {
@@ -416,8 +466,16 @@ async fn main() -> Result<()> {
             }
         }
         Some(Commands::Init { force }) => {
-            let cwd = std::env::current_dir().context("could not determine current directory")?;
-            let result = agent::init::generate_default_config(&cwd, force)?;
+            // Derive output directory from --config path (defaults to current dir)
+            let config_path = std::path::Path::new(&args.config);
+            let dir = config_path
+                .parent()
+                .filter(|p| !p.as_os_str().is_empty())
+                .map(|p| p.to_path_buf())
+                .unwrap_or_else(|| {
+                    std::env::current_dir().expect("could not determine current directory")
+                });
+            let result = agent::init::generate_default_config(&dir, force)?;
 
             println!();
             if result.config_created {
@@ -450,15 +508,7 @@ async fn main() -> Result<()> {
         }
         None => {
             // Default: run the agent daemon
-            if !std::path::Path::new(&args.config).exists() {
-                eprintln!();
-                eprintln!("  Config file not found: {}", args.config);
-                eprintln!();
-                eprintln!("  Run 'status init' to generate a default configuration,");
-                eprintln!("  or specify a custom path with --config <path>");
-                eprintln!();
-                std::process::exit(1);
-            }
+            ensure_config_file(&args.config);
             if args.compose_mode {
                 info!("Starting compose-agent daemon mode");
                 // Set CONTROL_PLANE environment variable for identification