fix: harden operations and configuration recovery

internal/dockerdaemon/dockerdaemon.go

@@ -15,6 +15,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"proxyctl/internal/execsafe"
 	"proxyctl/internal/profile"
 	"proxyctl/internal/securefs"
 	"proxyctl/internal/target"
@@ -64,7 +65,11 @@ type CommandRunner interface {
 type ExecRunner struct{}
 
 func (ExecRunner) Run(ctx context.Context, name string, args ...string) ([]byte, error) {
-	output, err := exec.CommandContext(ctx, name, args...).CombinedOutput()
+	command, err := execsafe.LookPath(name)
+	if err != nil {
+		return nil, err
+	}
+	output, err := exec.CommandContext(ctx, command, args...).CombinedOutput()
 	if err != nil {
 		return output, fmt.Errorf("%s: %s: %w", name, strings.TrimSpace(string(output)), err)
 	}
@@ -336,11 +341,9 @@ func (a *Adapter) enable(ctx context.Context, p profile.Profile) error {
 		return fmt.Errorf("persist Docker daemon recovery metadata before changing configuration: %w", err)
 	}
 	if fingerprint(current) != desiredFingerprint {
-		mode := os.FileMode(0o600)
-		if metadata.OriginalExists {
-			mode = os.FileMode(metadata.OriginalMode)
-		}
-		if err := a.files.AtomicWrite(a.configuration.DaemonConfigPath, desired, mode); err != nil {
+		// Managed proxy URLs may contain credentials. Keep the live configuration
+		// owner-only; disable restores the original mode with the original data.
+		if err := a.files.AtomicWrite(a.configuration.DaemonConfigPath, desired, 0o600); err != nil {
 			return fmt.Errorf("write Docker daemon configuration after recovery metadata persisted: %w", err)
 		}
 	}

internal/dockerdaemon/dockerdaemon_test.go

@@ -546,6 +546,9 @@ func TestDockerDaemonPreservesAndRestoresExistingConfiguration(t *testing.T) {
 	if got := a.SetDesired(context.Background(), true, activeProfile()); got.Err != nil {
 		t.Fatal(got.Err)
 	}
+	if info, err := os.Stat(daemonPath); err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("managed mode = %v, %v; want owner-only", info, err)
+	}
 	if got := a.SetDesired(context.Background(), false, nil); got.Err != nil || got.Inspection.State != target.External {
 		t.Fatalf("disable = %#v", got)
 	}