Oxide CLI hardener
Run av harden oxide-cli to apply this hardener and
av doctor oxide-cli to verify it.
av harden oxide-cli installs the signed Oxide CLI
Isotope and migrates every supported profile token from
~/.config/oxide/credentials.toml into Automic Vault. The
file retains only the profile, host, user, token identifier, expiration
metadata, and the non-secret @av marker.
The patched Target rejects plaintext and OXIDE_TOKEN
credentials. Token reads, login stores, and logout deletes use fixed
Oxide-only operations through the signed av Gate Client.
Each operation binds the live Oxide Target, complete arguments, working
directory, profile, host, and derived Secret Name.
Unknown credential fields fail hardening without changing the file.
The Hardened State covers the selected Isotopes tap or direct-install
oxide Command; code signing does not establish user intent
or protect a token after the Target receives it.