Issues

• [Bug]: Clear-text storage of sensitive information #938

Summary

Hardens .env file handling in EnvManager to prevent cleartext secrets from being exposed via insecure file permissions. All .env file writes now use os.open with 0o600 mode to restrict access to the file owner only, and adds fsync to ensure data durability. Also removes trailing whitespace throughout the file.

Security Hardening

• Replace open() with os.open(..., 0o600) + os.fdopen() for all .env file writes, ensuring owner-only (read/write) permissions on creation
• Add os.chmod(self.env_file, 0o600) when overwriting pre-existing .env files to retroactively restrict permissions
• Add f.flush() + os.fsync() calls to the main save_env_file() write path to guarantee data is durably written to disk
• Apply os.chmod(0o600) to the migrated .env after shutil.copy2 in the
  legacy migration branch (init), which previously inherited the
  source file's permissions.
• Apply os.chmod(0o600) to the timestamped backup file created in
  save_env_file before the new .env is written, ensuring the backup is
  also protected.

Logging Improvements

• Elevate OPENRAG_VERSION update error from logger.debug to logger.error so failures surface in standard log output

Code Cleanup

• Remove redundant import os statement in ensure_version_in_env() (already imported at module level)
• Strip trailing whitespace on blank lines throughout the file

Tests

• Add tests/unit/test_env_manager.py with 168 lines of unit tests covering
  all three affected code paths:
  • TestSaveEnvFilePermissions: new file creation, overwrite of a permissive
    existing file, and backup file permissions.
  • TestEnsureOpenragVersionPermissions: update of an existing permissive
    file and creation of a new file.
  • TestLegacyMigrationPermissions: migrated file receives 0o600 after copy.
• All tests use pytest tmp_path and unittest.mock; no running infrastructure
  required. Tests are skipped on Windows (Unix permission model only).

Build / Developer Experience

• Add test-unit Makefile target (uv run pytest tests/unit/ -v) for running
  unit tests in isolation without triggering integration tests.
• Register test-unit in .PHONY and add it to the help_test output.

Full Background Info on Remediation

• [Bug]: Clear-text storage of sensitive information #938 (comment)

Related PRs

• fix: Clear-text storage of sensitive information #937

Test Coverage

Test 1 — save_env_file: new file creation

• No .env exists.
• Call save_env_file().
• Assert file exists and stat.S_IMODE == 0o600.

Test 2 — save_env_file: new .env when prior file exists (permissions)

• Create a pre-existing .env with 0o644 permissions.
• Call save_env_file().
• Assert the new .env has 0o600.

Test 3 — save_env_file: backup file permissions

• Create a pre-existing .env with 0o644 permissions.
• Call save_env_file().
• Glob for .env.backup.* in tmp_path.
• Assert exactly one backup exists and its permissions are 0o600.

Test 4 — ensure_openrag_version: existing file update path

• Create an .env file with 0o644 permissions containing no OPENRAG_VERSION line.
• Mock get_current_version() to return "1.2.3".
• Call env_manager.ensure_openrag_version().
• Assert file permissions are 0o600 and file contains OPENRAG_VERSION='1.2.3'.

Test 5 — ensure_openrag_version: new file creation path

• No .env exists.
• Mock get_current_version() to return "1.2.3".
• Call env_manager.ensure_openrag_version().
• Assert file is created with 0o600 permissions.

Test 6 — Legacy migration path in init

• Create a legacy_env file in tmp_path with 0o644 permissions and some content.
• Mock get_tui_env_file() to return a path that does not exist.
• Mock get_legacy_paths() to return {"tui_env": legacy_env}.
• Instantiate EnvManager() (no explicit env_file).
• Assert the migrated file exists and has 0o600 permissions.

6 tests across 3 classes:

┌───────────────────────────────────────────────────────────────────────────────────────┬────────────────────────────────────────────────────────────────────┐
│                                         Test                                          │                              Verifies                              │
├───────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ TestSaveEnvFilePermissions::test_new_file_creation_has_secure_permissions             │ New .env created via save_env_file gets 0o600                      │
├───────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ TestSaveEnvFilePermissions::test_overwrite_existing_file_has_secure_permissions       │ New .env written over a permissive 0o644 file gets 0o600           │
├───────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ TestSaveEnvFilePermissions::test_backup_file_has_secure_permissions                   │ Timestamped backup of a permissive 0o644 file gets 0o600           │
├───────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ TestEnsureOpenragVersionPermissions::test_existing_file_update_has_secure_permissions │ Updating OPENRAG_VERSION in a permissive 0o644 file enforces 0o600 │
├───────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ TestEnsureOpenragVersionPermissions::test_new_file_creation_has_secure_permissions    │ New .env created by ensure_openrag_version gets 0o600              │
├───────────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────────────────────┤
│ TestLegacyMigrationPermissions::test_migrated_file_has_secure_permissions             │ Legacy 0o644 .env copied via __init__ migration path gets 0o600    │
└───────────────────────────────────────────────────────────────────────────────────────┴────────────────────────────────────────────────────────────────────┘