tene-ai/tene

1. Repo shape: two major products in one monorepo.

The core product is a Go CLI (cmd/tene, internal, pkg) that manages encrypted secrets locally. In parallel, apps/web is a Next.js/TypeScript marketing and documentation site with blog, comparison pages, SEO/AI-discoverability assets, and interactive product content.

2. CLI entrypoint and command boundary.

cmd/tene/main.go is the executable entrypoint. The CLI is built around Cobra-style command dispatch in internal/cli, where each command maps to a user-facing operation such as init, set, get, run, list, delete, import, export, passwd, recover, env, audit, and permissions.

3. Core secret storage pipeline.

The storage path is: command input → CLI layer → vault/crypto layer → local encrypted vault.

Secret data is stored in a local SQLite-backed vault (internal/vault, internal/encfile) and encrypted with the crypto primitives in pkg/crypto. The README and code layout indicate the vault is local-first and offline by default, with no server required for the CLI.

4. Crypto and key-management subsystem.

pkg/crypto contains the cryptographic boundary: encryption/decryption, key derivation, key rotation, X25519/team-key helpers, and memory zeroing. The design centers on a master password → Argon2id-derived key → XChaCha20-Poly1305-encrypted vault. This is the main security boundary in the repository.

5. OS keychain and recovery flow.

The master key is cached in the native OS keychain via internal/keychain / go-keyring, with a fallback/null-store path for non-interactive or unsupported environments. Recovery is handled by internal/recovery, which uses a 12-word mnemonic to restore access if the master password is lost.

6. Runtime injection is the key “AI-safe” workflow.

The most important execution path is tene run -- <cmd>: secrets are decrypted only long enough to be injected into the child process as environment variables, then the AI/editor process runs without seeing plaintext in the repo context. This is the product’s core differentiation: secrets are used at runtime, not exposed to the assistant or file system.

7. Environment and multi-vault separation.

The CLI supports named environments (dev, staging, prod, etc.) through internal/vaultcfg and environment-aware command handling in internal/cli. That means the same secret name can exist in multiple isolated environments, and command behavior is scoped by the active or explicitly selected environment.

8. Permissions and safety gates.

internal/auth and the CLI permission tables classify commands into tiers such as metadata-only, secret-write, and secret-read. The repo enforces this as an architectural guardrail: some commands can run without unlocking, while value-revealing actions require explicit trust/password handling. There are also safety checks around stdout leakage and delete/get behavior.

9. Audit, sync, and cloud are present but partially gated.

The codebase includes internal/audit, internal/sync, and internal/auth, plus command files for login, push, pull, sync, team, and billing. However, the README says these cloud features are currently disabled in the released CLI, so architecturally they form a latent cloud subsystem rather than the active local-first path. That boundary matters when diagramming what is live versus planned.

10. Generated AI-editor context files are a first-class output.

tene init does more than create a vault: it generates editor-specific guidance files such as CLAUDE.md, .cursor/rules/tene.mdc, .windsurfrules, GEMINI.md, and AGENTS.md. This is an important output boundary because it bridges the CLI with AI coding tools and affects how the product is discovered and used by agents.

11. Web app is a separate presentation/runtime stack.

apps/web is a Next.js app that serves the public site, blog, comparison pages, CLI docs, RSS/sitemap/robots, and structured SEO metadata. It is largely content-driven: MDX blog posts, static data modules, and reusable UI components. It has its own runtime, build pipeline, and asset set, independent of the Go CLI.

12. Discoverability and agent-facing content extend beyond the app.

The repo contains llms.txt, .well-known/ai.json, skills/tene-cli, and a large examples/demo tree. These are not product runtime paths, but they are part of the architecture because they shape how AI agents and humans learn, validate, and adopt the CLI. They act as documentation, evaluation, and onboarding layers.

13. Build, release, and distribution are standard but important.

The repo uses GitHub Actions (.github/workflows), Go tooling (golangci-lint, goreleaser, Makefile), and a Dockerfile. For the CLI, distribution is via Go binaries and GitHub Releases; for the website, deployment is a separate Node/Next.js concern. The architecture is therefore split across two deployable surfaces: a CLI binary and a web frontend.

14. Overall data-flow summary.

The main flow is: user command → CLI orchestration → permission check → key retrieval/derivation → vault read/write → output or subprocess injection. The web side flows separately from content/data modules → Next.js rendering → static/interactive site output. There is no default backend service in the active CLI path; the repository’s architecture is intentionally centered on local execution, encrypted storage, and AI-safe runtime injection.