tenon v0.10.0

tenon v0.10.0

The face release. tenon gets a home screen, a session panel and a jurisdiction badge on every answer, in the terminal and in VS Code: you see at a glance where each turn went.

Site and documentation (EN/FR): https://tenon-code-eu.github.io/tenon/

New

Terminal

• Home screen until the first message: the tenon logo (with a short intro animation), the slogan and version, the input box, the shortcuts, a tip of the day and links to the docs, GitHub and the bug tracker (clickable in terminals that support OSC 8 links). A resumed session opens directly on its thread.
• Status bar: project, model, provider and country, jurisdiction and sandbox pills, profile, session tokens and session id; items drop by priority on narrow terminals.
• Session panel (Ctrl+B, open by default from 100 columns): title and session id, context gauge, tokens in and out, modified files, and sovereignty — calls per provider and jurisdiction (non-EU and unknown in amber), sandbox, profile, policy, skills/agents/hooks. A resumed session rebuilds the panel from its history.
• Badge under each answer: <provider> · <country> · <EU|non-EU|local> of the call that produced it, so a routing fallback is visible turn by turn. An unknown jurisdiction now reads "unknown jurisdiction" everywhere.
• Command palette (Ctrl+P): commands, skills, past sessions, themes, the active provider.
• Themes: tenon (Europe blue and gold, default), tokyonight, catppuccin, gruvbox, light. Switch with /theme <name> or set [ui] theme in the global configuration; [ui] animation = false turns the intro off. NO_COLOR is respected everywhere. Errors and diff deletions get their own red colour, distinct from amber warnings.

VS Code extension 0.10.0

• The same home screen in the chat panel, with links opened by the extension only.
• Jurisdiction badges under answers, including in resumed sessions.
• A Session view under the chat: context, tokens, modified files (a click opens the diff), sovereignty with every call of the session, sub-agents included.
• Palette: "tenon: Palette" (Cmd+Shift+; / Ctrl+Shift+;, or the ⋯ button in the chat).
• tenon.theme setting: auto (editor colours) or tenon.

Agent Client Protocol (tenon acp)

• session/load now streams the whole history before it replies, as the ACP specification asks; Zed and other clients benefit too.
• The history replay includes usage updates, and every usage_update carries the session-wide sends per provider and jurisdiction (_meta.tenon.sends, sessionIn, sessionOut).

Notes

• Ctrl+B and Ctrl+P take precedence over the input's Emacs bindings (character back, line up); the arrow keys still work.
• On AZERTY keyboards Cmd+Shift+; can be awkward: use the ⋯ button or the command "tenon: Palette".

Verify

minisign -Vm SHA256SUMS -p tenon.pub
sha256sum -c SHA256SUMS --ignore-missing

tenon v0.9.0

tenon v0.9.0

The editor release. tenon now runs inside your editor, with every guarantee it has in the terminal: permissions, sandbox, masking, routing, checkpoints and audit.

Site and documentation (EN/FR): https://tenon-code-eu.github.io/tenon/ · Editors: https://tenon-code-eu.github.io/tenon/editors/

New

tenon acp: an Agent Client Protocol agent

• tenon acp speaks the Agent Client Protocol over stdio. Editors launch it as a subprocess: Zed, JetBrains AI Assistant, Neovim (CodeCompanion, avante.nvim), Emacs and VS Code.
• Same startup as tenon: global and project config, signed policy, profile, allowlists, sandbox probe, routing and MCP servers. A startup refusal shows in the editor with tenon's message.
• tenon's own tools do all the work. The editor never reads or writes files for tenon (fs/* and terminal/* are not used).
• Permission requests appear in the editor: Allow, Always for this session, Reject, and Allow with network for a sandboxed command. "Always for this session" never grants network. A cancelled request or a client error counts as a refusal. Consent to a non-EU provider is asked in the editor and refused by default.
• Everything sent to the editor is masked: messages, tool arguments and results, diffs, session titles, errors.
• Diffs: old text from the checkpoint, new text from the masked tool arguments, never read from disk.
• Sessions: session/load replays a session, session/list lists the sessions of a folder.
• Session metadata (_meta.tenon): provider, model, jurisdiction, sandbox (with an explicit confined flag), profile, policy. usage_update carries the context size, the provider and its jurisdiction, so an editor can follow a routing fallback.
• Editor MCP servers are ignored by default. With [acp] accept_editor_mcp = true (global config only; a policy can force it off) they go through the same filters as configured servers. Editor-provided env and header values are dropped.
• Audit: SessionStarted records the editor (client) and transport: "acp"; the compliance export shows the editor per session.

tenon for VS Code

• A tenon-branded extension, tenon-code-eu.tenon, on the Visual Studio Marketplace and Open VSX (VSCodium, Cursor, Windsurf). Also attached to this release as .vsix files, covered by the signed SHA256SUMS.
• One package per platform (macOS and Linux, arm64 and x64) with the tenon binary of this release bundled, byte for byte. A tenon.path setting or a tenon on the PATH also works.
• Chat panel: streamed answers, tenon's notices as thoughts, tool calls, Stop, past sessions and resume, / skills.
• Permission cards in the thread, and a notification when the panel is hidden. No automatic answer.
• Diffs open in VS Code's own diff editor, read-only.
• Attach the selection or a file to your message.
• Status bar: tenon · <provider> · <EU|non-EU|local> · <sandboxed|not sandboxed>, in the warning colour outside the EU or when the jurisdiction is unknown. It follows routing fallbacks.
• Terminal mode: Cmd+Esc / Ctrl+Esc opens the tenon terminal interface beside the editor; Cmd+Alt+K / Ctrl+Alt+K inserts @<file>#L<a>-<b>.
• English and French interface. No telemetry and no network access from the extension: only tenon talks to providers.

Known limits

• No Windows build (as for tenon).
• No images or audio in prompts.
• Editor buffers are not read; tenon reads files itself, under permission.
• On Linux without Landlock network support, commands are sandboxed for files but keep network access: the status bar still shows "sandboxed"; tenon warns at startup.
• If you set terminal.integrated.commandsToSkipShell yourself, add tenon.insertReference to it.

Verify

minisign -Vm SHA256SUMS -p tenon.pub
sha256sum -c SHA256SUMS --ignore-missing

tenon v0.8.0

tenon v0.8.0

The sobriety and memory release. tenon now measures the tokens it really spends and sends less of them. It also remembers your project between sessions, under the same rules as everything else: approval, audit, classification and the right to erasure.

Site and documentation (EN/FR): https://tenon-code-eu.github.io/tenon/

New

Token sobriety

• Real usage: every model call records its input, output and cached tokens, read from the provider's stream. When the provider reports none, tenon estimates and marks the figure as estimated. Set stream_usage = false on a provider that rejects the option.
• A lighter context, with the full history kept for audit, --resume, /rewind and routing:
  • identical tool results are sent once;
  • above 50 % of the window, the oldest tool results are replaced by a short stub until the context is under 40 %;
  • the masked set is kept from one request to the next, so the provider's prompt cache stays valid;
  • results of the agent tool are never masked;
  • long outputs keep their head and their tail.
• Compaction is decided on what is actually sent.
• Session budget: [budget] session_tokens warns at warn_at (80 % by default), then refuses the next turn with budget_exceeded (exit code 4 under --strict). A project can only lower it; a policy can impose it.
• Small models: [routing] compaction and [routing] subagents send compaction and sub-agents to another provider, under the same checks as the session. A sensitive session always stays on routing.local.
• Totals:
  • TUI status line: in 12.4k · out 1.1k · session 340k;
  • headless, on stderr: tokens: in … · out … · cached … · session …;
  • a Tokens section in the compliance export;
  • energy and CO₂e in the export, only with the factors you declare ([usage] wh_per_mtoken, gco2_per_kwh).

Governed memory

• Three scopes:
  • project: .tenon/memory/, versioned with the code;
  • user: personal, for this project;
  • global: personal, for every project.
• Progressive loading: only a short index enters the system prompt, and the model reads an entry with memory_read when it needs it.
• Writing:
  • the model proposes with memory_write, which needs your approval and shows a diff;
  • you write with /remember;
  • rules can allow a scope, matched as <scope>/<id>, for example user/*.
• Trust: a project entry that comes from someone else (clone, pull) is never loaded until you accept it with tenon memory trust.
• Sensitivity:
  • secrets and personal data are redacted before anything is written;
  • an entry with a classification marker is stored in the personal scope, never in git;
  • such an entry is left out of the index;
  • reading it makes the session sensitive, and it is refused without a local model.
• Retention: personal entries expire after 90 days without use ([memory] retention_days). Project entries do not expire.
• Audit and erasure:
  • every write, read of a sensitive entry, trust and deletion is recorded, without title or content;
  • tenon memory list|show|forget|trust lets you list and erase entries;
  • the export has a Memory section.
• Configuration and policy: [memory] enabled, project and retention_days. A project can only tighten, and a policy can switch memory off or cap retention. Erasure always stays possible.

Changes

• New configuration keys: [budget], [usage], [memory], routing.compaction, routing.subagents, stream_usage.
• New audit events:
  • Usage, ContextShaped, BudgetWarning;
  • MemoryWritten, MemoryRead, MemoryForgotten, MemoryTrusted.
• A local provider used as a routing fallback never goes through the environment proxy.
• The CI templates pin v0.8.0.

Known limits

• Memory:
  • tenon memory forget removes the entry, not the past conversations that mention it, nor git history for project entries;
  • the memory lock between processes is Unix-only, like the rest of tenon.
• Tokens:
  • the "tokens saved" figure is an estimate;
  • masking never lowers a session's sensitivity.
• Linux and macOS only.

Verify

minisign -Vm SHA256SUMS -p tenon.pub
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

tenon v0.7.0

tenon v0.7.0

The compliance and sovereignty release. It gives you evidence an auditor can check, rules an organisation can enforce, system confinement for commands, data that stays on your machine when it is classified, a Cyber Resilience Act assistant, and tenon in your CI.

Site and documentation (EN/FR): https://tenon-code-eu.github.io/tenon/

New

System sandbox

• Shell commands and stdio MCP servers run confined by the operating system: Landlock and user/network namespaces on Linux, sandbox-exec on macOS.
• Writes are limited to the project, temporary files, caches and [sandbox] write. Credentials directories (~/.ssh, ~/.aws, the Keychain on macOS…), tenon's configuration and its audit data are unreadable. The network is closed unless a network = true rule or your answer ("Allow with network") opens it.
• [sandbox] mode = "auto" | "required" | "off". required refuses to start without confinement, and strict-local implies it. A project can only tighten; an organisation policy can impose required.
• Secret environment variables (api_key_env of every provider and preset, MCP bearer_env and env_from) are never passed to commands, in every mode.
• The limits are documented, including Unix sockets on Landlock ABI < 9 (a notice names docker.sock and the D-Bus bus when reachable), UDP under the TCP-only fallback, and .git protection (best effort on macOS, none on Linux).

Data-sensitivity routing

• [classification] paths and markers (DIFFUSION RESTREINTE, EU RESTRICTED or your own) make a session sensitive. From then on it is sent only to the local model set in [routing] local.
• Without a local provider, classified content is not read, or is withheld.
• [routing] fallback gives an ordered list of providers for the rest, on network errors, 429 and 5xx. Each candidate still goes through the profile, allowlist and policy checks.
• The audit log proves every decision, and the compliance export flags any violation.

Cyber Resilience Act assistant

• tenon cra keeps an SBOM, a VEX, the article 14 reporting deadlines and an exportable technical dossier in the repository.
• It runs an offline OSV vulnerability scan, usable in CI with tenon cra scan --fail-on open, and the OSV database can be downloaded from a mirror.
• Four built-in skills are included. Nothing is sent to ENISA.

Compliance export

• tenon audit export writes an HTML (FR/EN) and JSON report from the audit log: providers, consents, permissions, modified files, sub-agents, hooks, rewinds, incidents, regulatory mapping and a timeline.
• The report includes profiles, policies, timestamps, sandbox use, routing and the CRA section. It contains no conversation content unless you ask for it.

Compliance profiles, provider allowlist, signed organisation policy

• profile = "eu-only" | "secnumcloud" | "strict-local" is checked at startup and before each send. secnumcloud relies on a declared qualification, which tenon never verifies.
• [provider_allowlist] restricts provider hosts.
• A system policy signed with minisign (tenon policy check) acts as a floor nobody can loosen. It covers the profile, provider hosts, permission and redaction rules, audit level, MCP servers, timestamp authority, sandbox and classification.

RFC 3161 timestamping

• [audit.timestamp] has a timestamp authority sign the head of the audit chain at the end of each session, or on demand with tenon audit timestamp. Only a SHA-256 hash leaves the machine.
• tenon audit verify and the export check the tokens offline (--tsa-ca). A log rewritten after a timestamp is detected.

CI integration

• --strict exits with code 4 when a non-interactive turn does not end cleanly.
• --config <file> names the global configuration.
• install.sh supports TENON_DOWNLOAD_BASE for sovereign mirrors (pinned version, https, hash and signature unchanged).
• Copy-ready templates for GitLab CI, Forgejo/Gitea Actions and GitHub Actions are in docs/ci/.

Providers and interface

• New presets: albert (Albert API, French public sector) and codestral.
• TUI scrolling: mouse wheel, Shift+arrows, half-page, Home/End.
• Approval panel: "Allow with network" for confined commands; "Network granted by rule" when a rule opens it.

Changes

• tenon config check prints the configuration path, the sandbox status and the timestamp authority.
• New configuration keys: profile, [provider_allowlist], [audit.timestamp], [sandbox], [classification], [routing], qualifications, and network on shell rules.
• On upgrade, commands now run confined by default (mode = "auto"). Tools that write outside the project, for example ~/go/pkg/mod, ~/.cargo or ~/.m2, need [sandbox] write (~/.npm is writable by default). A stdio MCP server's risk now also decides its confinement: an empty risk means no network and a read-only project.
• Built with Go 1.26.10, which fixes GO-2026-6809 in the standard library. golang.org/x/* dependencies are updated.

Known limits

• The sandbox confines; it is not a complete isolation. Reads elsewhere stay open, and so do UDP under the TCP fallback, Unix sockets on Landlock ABI < 9, .git on Linux, and hooks, which run unconfined. See docs/security.md.
• Routing relies on declared paths and markers. Content without a marker that is not under a classified path is not detected.
• The provider allowlist and the policy do not restrict network access made by unconfined commands. An administrator of the machine can remove the policy.
• RFC 3161 tokens are not checked for revocation.
• Linux and macOS only.

Verify

minisign -Vm SHA256SUMS -p tenon.pub
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

tenon v0.6.0

Checkpoints and rewind

Each prompt is now a checkpoint. /rewind (or Esc twice when no turn is running) takes you back to an earlier prompt.

• What is saved: before write_file or edit_file changes a file, tenon saves its previous content. Writes of sub-agents and inputs rewritten by a hook are saved too. Effects of shell and of MCP tools are not undone: /rewind tells you how many such calls it cannot undo.
• Three modes: code and conversation, conversation only, or code only. The conversation cannot go back past a compaction; the code still can.
• Your work is protected:
  • A file you changed after the agent is shown as a conflict, and kept unless you answer y.
  • A file that changes while the /rewind window is open is not touched (file changed during rewind).
  • A path that became a symbolic link is never followed.
  • Writing to an existing file that tenon cannot read is refused, so a rewind can never delete it.
• Journal: never rewritten. A Rewound event is added to the session and the audit chain, and --resume rebuilds the same state.
• Command line: tenon rewind --list --resume <id|last> lists the checkpoints of a session.
• Store: ~/.local/share/tenon/checkpoints (0700/0600). It holds raw file contents, secrets included, so that files are restored exactly. It is never sent to the provider nor written to the logs. Copies are kept 30 days ([checkpoints] retention_days; 0 turns copies off). A file larger than 10 MiB is written without a copy.

See Checkpoints and rewind and security.

Welcome screen and help

• The welcome screen shows how many skills, agents and hooks are loaded, and lists every / command.
• /help lists each command with a short description.
• Long lines wrap instead of being cut.

Other changes

• New key [checkpoints] in the global configuration. It is refused in .tenon/config.toml.
• write_file refuses to overwrite an existing file it cannot read (cannot read existing file).

Install

brew install tenon-code-eu/tap/tenon
# or
curl -fsSL https://raw.githubusercontent.com/tenon-code-eu/tenon/main/install.sh | sh

Verify a manual download:

minisign -Vm SHA256SUMS -P RWR+vfCWjGO42uRKOxNSrKz5afZPCWJf8iJPO04kFdkhLldZHhxo532F
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

Version 0.x: configuration, options and session/audit formats may still change. License: EUPL-1.2.

tenon v0.5.0

Hooks

tenon now runs hooks: commands, or checks by the model, that tenon runs at fixed points of a session. The format is the one of Claude Code (the hooks key of settings.json): a hook written for Claude Code works without change.

• Sources: ~/.config/tenon/hooks.json, always. ~/.claude/settings.json only with [hooks] claude_settings = true in the global configuration. Hooks of a project (.claude/settings.json, .tenon/hooks.json) are never run: tenon shows a notice.
• Events: PreToolUse, PostToolUse, UserPromptSubmit, Stop, SubagentStop, SessionStart, SessionEnd, PreCompact, Notification.
• Types: command (a shell command), prompt (a check by the session model), agent (a read-only sub-agent).
• What a hook can do: block a tool call or a prompt, ask for your approval, rewrite the input of a tool, give feedback to the model, add context, continue a turn that would stop.
• Claude Code compatibility: tool names (Bash, Edit, Write…) and arguments (file_path…) are translated both ways; exit code 2 and the JSON output work as in Claude Code.
• Security:
  • A hook allow lifts only what a global allow rule could lift. It never lifts a deny rule, a forced approval for a non-EU tool, an access outside the project or to a sensitive file, or an ask rule of the project.
  • A rewritten input is checked again, and the permission rules apply to the new input.
  • An invalid hooks file stops tenon at startup.
  • Each hook run is in the audit chain (HookStarted, HookCompleted).
  • Text that a hook sends to the model is masked and goes through the jurisdiction check.
  • command hooks get the unmasked input and run with your rights: what they do with it is your responsibility.
• Interface: tenon hooks and /hooks list the hooks. The banner shows hooks: N (claude: M). A hook that blocks, asks or fails shows a line in the interface. In -p mode with text output, the same messages go to stderr.

See Hooks and security.

Other changes

• New key [hooks] in the global configuration (claude_settings, disabled). It is refused in .tenon/config.toml.
• tenon config check also checks the hooks files.
• The help text (tenon -h) now lists tenon agents and tenon hooks.

Install

brew install tenon-code-eu/tap/tenon
# or
curl -fsSL https://raw.githubusercontent.com/tenon-code-eu/tenon/main/install.sh | sh

Verify a manual download:

minisign -Vm SHA256SUMS -P RWR+vfCWjGO42uRKOxNSrKz5afZPCWJf8iJPO04kFdkhLldZHhxo532F
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

Version 0.x: configuration, options and session/audit formats may still change. License: EUPL-1.2.

tenon v0.4.0

Sub-agents

The main agent can now hand a self-contained task to a sub-agent. The sub-agent works in its own context and returns one final answer. tenon reads the Claude Code format (.claude/agents/*.md): an agent written for Claude Code works without change.

• Discovery: ~/.config/tenon/agents, ~/.claude/agents, ~/.agents/agents, then the same folders in the project. A user agent wins over a project agent with the same name. The built-in general-purpose agent always exists.
• Format: a YAML header (name, description, optional tools and model) and a body, which is the system prompt. Claude Code tool names (Read, Bash, Grep...) are translated. model is shown but has no effect: a sub-agent always uses the provider and model of the session.
• Model use: the system prompt lists agents; the model launches one with the new agent tool. The result is the sub-agent's final answer, cut by output_limit and masked like any tool result.
• User view: the interface shows ⏺ agent <name> · <description> with the sub-agent's tool calls indented below it. /agents and tenon agents list the agents. With --output json, sub-agent events carry parent_call_id and are framed by SubagentStarted / SubagentCompleted.
• Security: a sub-agent never widens permissions. Each of its actions follows the usual rules and approvals, one by one; approvals "yes for the session" are shared with the main agent. deny and ask rules apply to tool = "agent", matched on the agent name. A sub-agent cannot launch a sub-agent. Its actions are in the same audit chain. Project agents are untrusted content, like AGENTS.md.

Limits: sub-agents run one after the other; max_iterations applies to each one. --resume ignores sub-agent events.

See Sub-agents and security.

Other changes

• The system prompt is about 250 tokens longer (the agent tool and the agents section). This counts on small local models with a short context window.

Install

brew install tenon-code-eu/tap/tenon
# or
curl -fsSL https://raw.githubusercontent.com/tenon-code-eu/tenon/main/install.sh | sh

Verify a manual download:

minisign -Vm SHA256SUMS -P RWR+vfCWjGO42uRKOxNSrKz5afZPCWJf8iJPO04kFdkhLldZHhxo532F
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

Version 0.x: configuration, options and session/audit formats may still change. License: EUPL-1.2.

tenon v0.3.0

Skills

tenon now supports skills in the open Agent Skills format (SKILL.md folders), compatible with Claude Code.

• Discovery: ~/.config/tenon/skills, ~/.claude/skills, ~/.agents/skills, then the same folders in the project. A user skill wins over a project skill with the same name.
• Model use: the system prompt lists skills; the model loads one with the new skill tool. The SHA-256 of what was read is recorded in the audit log.
• User use: type /<name> [arguments] in the interface or with tenon -p "/<name> …". /skills lists skills, Tab completes names, tenon skills lists them from the command line.
• Security: a skill never widens permissions (allowed-tools has no effect); its scripts run through shell with the usual approval. Project skills are untrusted content, like AGENTS.md. Symbolic links, .. paths, sensitive files and control characters are refused or stripped.

See Skills and security.

Other changes

• tenon sessions shows what you typed for a session started with a skill.

Install

brew install tenon-code-eu/tap/tenon
# or
curl -fsSL https://raw.githubusercontent.com/tenon-code-eu/tenon/main/install.sh | sh

Verify a manual download:

minisign -Vm SHA256SUMS -P RWR+vfCWjGO42uRKOxNSrKz5afZPCWJf8iJPO04kFdkhLldZHhxo532F
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

Version 0.x: configuration, options and session/audit formats may still change. License: EUPL-1.2.

tenon v0.2.0

Changes

• English by default. The interface, the system prompt, messages and documentation are now in English. French stays available: --lang fr or lang = "fr" in the configuration. $LANG is no longer read.
• Local models detected automatically (Ollama, vLLM). tenon reads the served model and the context window applied by the server at startup. Ollama: the most recent installed model that supports tool calls (e.g. ollama pull qwen3:8b). A window below 16000 tokens triggers a warning. See Local models.
• Interface. Assistant replies render markdown (headings, lists, code blocks, bold, code); no more blank lines between tool calls.
• Provider errors. On HTTP 429 and 5xx, the error now includes the provider's message (rate limit, quota, overloaded model).
• Installation. Homebrew (brew install tenon-code-eu/tap/tenon) and a verifying install script (install.sh). go install reports the right version.

Configuration changes

• The ollama and vllm presets no longer assume devstral / default and 32000 tokens: values are read from the server. A value set in the configuration still wins; detect = "off" disables detection.
• Docs moved: docs/usage.md and docs/security.md are the reference; French versions are in docs/fr/.

Install

brew install tenon-code-eu/tap/tenon
# or
curl -fsSL https://raw.githubusercontent.com/tenon-code-eu/tenon/main/install.sh | sh

Verify a manual download:

minisign -Vm SHA256SUMS -P RWR+vfCWjGO42uRKOxNSrKz5afZPCWJf8iJPO04kFdkhLldZHhxo532F
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

Version 0.x: configuration, options and session/audit formats may still change.

License: EUPL-1.2.

tenon v0.1.0

Première version publique de tenon, agent de code en terminal, souverain et auto-hébergeable (Linux, macOS).

Points clés

• Fournisseurs préconfigurés européens (Mistral AI par défaut, Scaleway, OVHcloud) ou locaux (Ollama, vLLM) ; tout point d'accès compatible OpenAI.
• Envoi hors de l'UE refusé sans accord explicite (--allow-non-eu).
• Écritures, commandes et outils MCP soumis à validation par défaut.
• Journal d'audit chaîné et vérifiable (tenon audit verify).
• Masquage des secrets et de données personnelles avant envoi.
• Interface interactive (TUI), mode non interactif (tenon -p), sessions reprenables, serveurs MCP, marquage git des commits assistés.
• Interface en français et en anglais.

Installation

Téléchargez l'archive de votre plateforme, puis vérifiez la signature et les empreintes :

minisign -Vm SHA256SUMS -P RWR+vfCWjGO42uRKOxNSrKz5afZPCWJf8iJPO04kFdkhLldZHhxo532F
sha256sum -c SHA256SUMS --ignore-missing   # macOS : shasum -a 256 -c SHA256SUMS --ignore-missing

Ou depuis les sources : go install github.com/tenon-code-eu/tenon/cmd/tenon@v0.1.0 (Go ≥ 1.26.9).

Sous macOS, le binaire n'est pas signé par Apple : xattr -d com.apple.quarantine ./tenon si Gatekeeper le bloque.

Limites connues

Version 0.x : le format de configuration, les options et les formats de session et d'audit peuvent encore changer.
Ollama et vLLM : la fenêtre de contexte et le nom de modèle dépendent de votre serveur, à régler dans la configuration.
Voir docs/securite.md.

Licence : EUPL-1.2.