tene GEMINI.md

Secrets Management — tene

This project uses tene for secret management. Secrets are encrypted locally with XChaCha20-Poly1305. No server, no cloud.

Quick Reference

Task	Command
List available secrets	tene list
Get a secret value	tene get <KEY>
Get secret as JSON	tene get <KEY> --json
Set a secret	tene set <KEY> <VALUE>
Set from stdin	`echo "value"
Run with secrets injected	tene run -- <command>
Import from .env	tene import .env
Export to .env	tene export
Switch environment	tene env <name>
List environments	tene env list

Rules

1. Never hardcode secrets in source code, config files, or comments
2. Never create .env files — use tene run -- <command> to inject secrets as environment variables
3. Access secrets via environment variables — process.env.KEY_NAME (Node.js), os.Getenv("KEY_NAME") (Go), os.environ["KEY_NAME"] (Python)
4. Use tene list first to check what secrets are available before asking the user
5. If a secret is missing, tell the user to run: tene set <KEY> <VALUE>
6. Use --json flag for programmatic parsing: tene get KEY --json returns {"name":"KEY","value":"...","environment":"..."}
7. Environment isolation: secrets are scoped per environment (default, dev, staging, prod). Use --env <name> to target a specific environment

Available Environments

Run tene env list to see all environments and which is active.

Example Workflows

Starting a new feature that needs an API key

1. Check if key exists: tene list
2. If not: ask user to run tene set STRIPE_KEY sk_test_xxx
3. Use in code via process.env.STRIPE_KEY
4. Run/test with: tene run -- npm test

Running the project

tene run -- npm start          # Node.js
tene run -- go run .           # Go
tene run -- python main.py     # Python