Security Hardening Upgrade Guide

​

At a glance

​

Trusted workspaces

• .chatcli/hooks.json — its hooks run shell commands, so an untrusted hook could run code at startup.
• ./.env — it could point a provider’s base URL at another host (sending your API key or OAuth token there), disable TLS verification, or name an MCP server that is then launched.
• coder_policy.json — a project copy could previously replace your global coder policy and disable every approval prompt.

• In the interactive REPL, the first time you start in a folder that contains any of these files, ChatCLI lists them and asks once ([y/N], default No). Answering y records trust for that folder.
• In non-interactive modes (-p, ACP, mcp-server, gateway, server, …) nothing is ever loaded from an untrusted folder; a one-line warning on stderr names the files and the command to trust them.
• A trusted folder’s coder_policy.json can only tighten the global policy (add ask/deny); a local allow rule is ignored.
• If any covered file changes, trust lapses and you are asked again.

chatcli trust              # trust the current directory
chatcli trust /path/to/repo
chatcli trust --list       # show trusted folders and which have lapsed
chatcli trust --revoke .   # drop trust for a folder

• Command history moved from ./.chatcli_history to ~/.chatcli/history (mode 0600). An existing ./.chatcli_history is still read for up-arrow recall but no longer written; delete it when you no longer need it.
• ACP project overlay: a project .env opened over ACP now applies only an allowlist of harmless keys (provider and model selection, region, AWS_PROFILE, CHATCLI_LANG, CHATCLI_THEME). Anything else needs CHATCLI_PROJECT_ENV=all and a trusted folder.
• Evaluation harness: a per-case policy that used to live in a sandbox coder_policy.json now comes from CHATCLI_CODER_POLICY_OVERLAY, a path read only from the process environment.

​

Chat gateway

export CHATCLI_TELEGRAM_ALLOWED_USERS="111111111,222222222"
export CHATCLI_SLACK_ALLOWED_USERS="U0123,TEAM1:U0456"   # U<id>, or TEAM:U<id> to pin a workspace
export CHATCLI_WHATSAPP_ALLOWED_USERS="15551234567"       # the wa_id / phone, no '+'
export CHATCLI_DISCORD_ALLOWED_USERS="305172394…"         # the author snowflake

• /session over chat is limited to senders listed by id. It is no longer available over the webhook, whose user_id is caller-chosen.
• A failed network call no longer writes the Telegram bot token to the logs.

​

Webhook channel

• X-ChatCLI-Timestamp: <unix seconds> — within ±5 minutes of the receiver.
• X-ChatCLI-Signature: sha256=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>

import hmac, hashlib, time
ts = str(int(time.time()))
sig = "sha256=" + hmac.new(secret.encode(), f"{ts}.".encode() + body, hashlib.sha256).hexdigest()
headers = {"X-ChatCLI-Timestamp": ts, "X-ChatCLI-Signature": sig}

​

Local web surfaces

​

Unattended agent and @coder

export CHATCLI_POLICY_AUTOMODE=true

export CHATCLI_CODER_ALLOW_UNSAFE=true   # lift the dangerous-command block
export CHATCLI_AGENT_ALLOW_SUDO=true     # allow sudo

​

gRPC server mode

• Remote @coder execution requires the admin role and runs through the coder policy. A user-role caller can no longer run commands on the server host through ExecuteRemotePlugin.
• Agent providers (DEVIN) require admin. A non-admin turn that resolves to DEVIN is refused on every RPC. A server whose own default provider is DEVIN refuses non-admin turns.
• Saved sessions are per principal. Each caller sees only its own sessions; a readonly caller cannot save or delete. Sessions created before this release are reachable over gRPC by admins only and are not migrated automatically.
• Client-supplied endpoints are refused. A provider base_url in provider_config is rejected unless its origin is listed in CHATCLI_SERVER_PROVIDER_ENDPOINTS, and even then the address is checked at dial time. An unknown provider_config key is now an error instead of being ignored.

​

Kubernetes operator

• Pin the AIOps Instance. The operator no longer connects to whichever Instance happens to be ready in any namespace. Pin exactly one:
  aiops:
    instance:
      namespace: chatcli-system
      name: aiops
  
  or CHATCLI_OPERATOR_AIOPS_INSTANCE=chatcli-system/aiops. With no pin, AIOps stays disconnected and logs what to set. Alerts for namespaces outside the pinned Instance’s watch targets are dropped.
• Remediation mode. New value remediationMode, default approve:
  • observe — analyse only, never create a plan.
  • approve — run a plan only when an ApprovalPolicy or the decision engine explicitly allows it; everything else, and every high-risk action, parks for a human.
  • auto — the previous behaviour, now an explicit choice.
• Federation kubeconfig. A ClusterRegistration kubeconfig may now contain only inline token or certificate data; exec, auth-provider, tokenFile, file-path credentials, insecure-skip-tls-verify, basic auth and a non-https server are refused. The kubeconfig Secret is read only from the operator’s namespace and must carry the annotation platform.chatcli.io/cluster-registration: <ns>/<name> binding it to its registration.

​

Self-update

​

MCP remote server login