─── Section: SECURITY ───────────────────────────────────────── showConfigSecurity covers policy/sandbox — distinct from /config agent which is about behavior. Grouped here: command allow/deny, workspace path validation, TLS posture, SSRF toggle, redaction rules, plugin signature enforcement.
()
| 1191 | // path validation, TLS posture, SSRF toggle, redaction rules, plugin |
| 1192 | // signature enforcement. |
| 1193 | func (cli *ChatCLI) showConfigSecurity() { |
| 1194 | sectionHeader("🔒", "cfg.section.security.title", ColorRed) |
| 1195 | p := uiPrefix(ColorRed) |
| 1196 | |
| 1197 | subheader(p, "cfg.sub.sec.cmd_policy") |
| 1198 | kv(p, "CHATCLI_AGENT_SECURITY_MODE", envOr("CHATCLI_AGENT_SECURITY_MODE")) |
| 1199 | kv(p, "CHATCLI_AGENT_ALLOWLIST", envOr("CHATCLI_AGENT_ALLOWLIST")) |
| 1200 | kv(p, "CHATCLI_AGENT_DENYLIST", envOr("CHATCLI_AGENT_DENYLIST")) |
| 1201 | kv(p, "CHATCLI_AGENT_ALLOW_SUDO", envBool("CHATCLI_AGENT_ALLOW_SUDO")) |
| 1202 | |
| 1203 | fmt.Println(p) |
| 1204 | subheader(p, "cfg.sub.sec.workspace") |
| 1205 | kv(p, "CHATCLI_AGENT_WORKSPACE_STRICT", envBool("CHATCLI_AGENT_WORKSPACE_STRICT")) |
| 1206 | kv(p, "CHATCLI_AGENT_ALLOW_KUBECONFIG", envBool("CHATCLI_AGENT_ALLOW_KUBECONFIG")) |
| 1207 | kv(p, "CHATCLI_AGENT_EXTRA_READ_PATHS", envOr("CHATCLI_AGENT_EXTRA_READ_PATHS")) |
| 1208 | kv(p, "CHATCLI_BLOCK_TMP_WRITES", envBool("CHATCLI_BLOCK_TMP_WRITES")) |
| 1209 | kv(p, "CHATCLI_IGNORE", envOr("CHATCLI_IGNORE")) |
| 1210 | |
| 1211 | fmt.Println(p) |
| 1212 | subheader(p, "cfg.sub.sec.coder_policy") |
| 1213 | cli.renderCoderPolicy(p) |
| 1214 | |
| 1215 | fmt.Println(p) |
| 1216 | subheader(p, "cfg.sub.sec.tls") |
| 1217 | kv(p, "CHATCLI_ALLOW_HTTP_PROVIDERS", envBool("CHATCLI_ALLOW_HTTP_PROVIDERS")) |
| 1218 | kv(p, "CHATCLI_ALLOW_INSECURE", envBool("CHATCLI_ALLOW_INSECURE")) |
| 1219 | kv(p, "CHATCLI_TLS_CLIENT_CERT", envOr("CHATCLI_TLS_CLIENT_CERT")) |
| 1220 | kv(p, "CHATCLI_TLS_CLIENT_KEY", presence(os.Getenv("CHATCLI_TLS_CLIENT_KEY"))) |
| 1221 | |
| 1222 | fmt.Println(p) |
| 1223 | subheader(p, "cfg.sub.sec.redaction") |
| 1224 | kv(p, "CHATCLI_ENV_REDACT_MODE", envOr("CHATCLI_ENV_REDACT_MODE")) |
| 1225 | kv(p, "CHATCLI_REDACT_PATTERNS", envOr("CHATCLI_REDACT_PATTERNS")) |
| 1226 | |
| 1227 | fmt.Println(p) |
| 1228 | subheader(p, "cfg.sub.sec.plugins") |
| 1229 | kv(p, "CHATCLI_ALLOW_UNSIGNED_PLUGINS", envBool("CHATCLI_ALLOW_UNSIGNED_PLUGINS")) |
| 1230 | |
| 1231 | sectionEnd(ColorRed) |
| 1232 | } |
| 1233 | |
| 1234 | // ─── Section: SERVER (conditional) ───────────────────────────── |
| 1235 |