# Uaa Cli hardener

Run `av harden uaa-cli` to apply this hardener and `av doctor uaa-cli` to verify it.

`av harden uaa-cli` installs the signed UAA CLI Isotope and migrates every
saved OAuth access and refresh token into one Automic Vault Secret. The UAA
config retains targets, contexts, expiry metadata, and reserved non-secret
`@av` markers.

The patched Target routes config reads, token updates, and context removal
through fixed UAA-only XPC operations. Each operation binds the live Target,
complete arguments, fixed credential scope, and exact Secret Name.

Unsupported fields, partial migration state, unsafe paths, malformed bundles,
and unsigned or incorrectly signed Targets fail closed.