# doctl hardener

Run `av harden doctl` to apply this hardener and `av doctor doctl` to verify it.

`av harden doctl` installs the Automic Vault-signed repack of doctl 1.175.0
under `/opt/av/doctl/1.175.0-av.1`. Upstream executable code is unpatched.
The native AV launcher verifies the pinned binary and protected paths, then
applies `DIGITALOCEAN_ACCESS_TOKEN` directly to that Target without a shell.
The approval service rechecks installation before policy admission and Secret
release. The client rechecks after Approval and before execution.

The reviewed catalog contains 469 exact command paths and their aliases.
Help, local commands, unknown commands, plugins, `apps dev`, serverless support,
and the new harness runtime execute without the protected token. Explicit
credentials, alternate contexts, custom configuration/API endpoints and trace
logging also suppress AV token access. These commands may still use credentials
outside Automic Vault.

`auth token` discloses the token; `auth init` writes it to plaintext configuration.
Both require Secret Disclosure authorization. `compute droplet ssh` and registry
login may launch other executables and remain Unknown, requiring Approval.
Other operations without a reviewed policy classification also require Approval.

Migration retains the existing default-context-only boundary. Named-context
tokens require manual migration. Installation verification precedes credential
migration; a failed installation retains plaintext. Use `av scan` afterwards
for remaining credential sources and `av doctor doctl` for installation checks.

Updates require another reviewed signed repack and an AV release with new
archive and executable digests. Re-hardening repairs this pinned version. The
tap formula records the same artifacts; AV owns the protected runtime and launcher.
Code signing establishes identity and integrity, not destination safety or
confidentiality after Secret Application. This integration verifies the Target
before execution; it does not add a live credential-provider handshake.

Credential-bearing execution prepends a fixed DigitalOcean API URL and disables
trace logging. Both client and approval service require these exact options
and reject later overrides before Secret release. This prevents a mutable
config file from redirecting the normal API client; other destination, proxy
and post-application behavior remains controlled by doctl.