tenuo-claude-code 0.6.4__tar.gz → 0.7.0__tar.gz

tenuo_claude_code-0.7.0/.claude-plugin/marketplace.json

@@ -0,0 +1,26 @@
+{
+  "name": "tenuo",
+  "owner": {
+    "name": "Tenuo",
+    "email": "daniel@tenuo.ai",
+    "url": "https://tenuo.ai"
+  },
+  "description": "Tenuo plugins for Claude Code.",
+  "plugins": [
+    {
+      "name": "tenuo",
+      "displayName": "Tenuo",
+      "source": "./plugins/tenuo",
+      "description": "Task-scoped authorization for Claude Code: warrants constrain tools and arguments before each call, with signed receipts. Inactive until a project opts in with tenuo.yaml.",
+      "author": {
+        "name": "Tenuo",
+        "url": "https://tenuo.ai"
+      },
+      "homepage": "https://tenuo.ai",
+      "repository": "https://github.com/tenuo-ai/tenuo-claude-code",
+      "license": "Apache-2.0",
+      "category": "security",
+      "tags": ["security", "authorization", "governance", "audit"]
+    }
+  ]
+}

tenuo_claude_code-0.7.0/.gitattributes

@@ -0,0 +1,2 @@
+# This shell entry point must also run from Windows checkouts copied into WSL.
+/plugins/tenuo/scripts/tenuo-hook text eol=lf

{tenuo_claude_code-0.6.4 → tenuo_claude_code-0.7.0}/CONTRIBUTING.md

@@ -20,7 +20,7 @@ Re-run `init` or `refresh` after switching Python venvs (hooks pin `sys.executab
 2. Keep changes focused; match existing style in `src/tenuo_claude_code/`.
 3. Run `uv run --with pytest pytest` (fast unit tests, no Docker). If you touch enforcement
    or policy wiring, also run `cd demo && tenuo-claude verify` (live authorizer).
-4. Do not commit `.state/`, real API keys, or home-directory paths.
+4. Do not commit the state directory, real API keys, or home-directory paths.
 
 Security issues: see [SECURITY.md](SECURITY.md). No public issues for vulnerabilities.
 
@@ -28,7 +28,7 @@ Security issues: see [SECURITY.md](SECURITY.md). No public issues for vulnerabil
 
 | Path | Contains |
 |------|----------|
-| `.state/` | Holder/issuer keys, warrant, receipts, `cloud.env` |
+| state directory (`tenuo-claude state-dir`) | Holder/issuer keys, warrant, receipts, `cloud.env` |
 | `.claude/settings.json` | Generated hook wiring |
 | `~/.tenuo/admin.env` | Admin key for `tenuo-admin setup` only |
 
@@ -42,10 +42,16 @@ under `/Users/` or `C:\`.
 
 | Module | Role |
 |--------|------|
-| `src/tenuo_claude_code/cli.py` | Policy, hooks, MCP proxy, lifecycle commands |
+| `src/tenuo_claude_code/cli.py` | Project state, hooks, and lifecycle orchestration |
+| `src/tenuo_claude_code/policy.py`, `constraints.py`, `routing.py`, `action_identity.py` | Policy parsing, constraints, routing, and complete request identity without CLI state |
+| `src/tenuo_claude_code/cloud_policy.py` | Cloud warrant configuration compiler |
+| `src/tenuo_claude_code/mcp_proxy.py` | MCP transport adapter with explicit runtime callbacks |
+| `src/tenuo_claude_code/managed_runtime.py` | Administrator-owned Python runtime validation |
 | `src/tenuo_claude_code/admin.py` | One-time Cloud setup (`tenuo-admin`) |
 | `src/tenuo_claude_code/verify.py` | Policy-driven authorizer self-test |
 | `src/tenuo_claude_code/data/harness_tools.yaml` | Bundled audit-allow tool list |
+| `plugins/tenuo/` | Claude Code plugin (hooks, launcher, `/tenuo:*` skills); decision table tested in `tests/test_plugin_launcher.py` |
+| `.claude-plugin/marketplace.json` | Marketplace entry so `/plugin marketplace add` works on this repo |
 
 Root `scripts/tenuo_claude.py` / `scripts/tenuo_admin.py` are thin shims; prefer `tenuo-claude` on PATH.
 
@@ -61,6 +67,9 @@ or `PYPI_TOKEN` secret).
 Release steps:
 
 1. Bump `version` in `pyproject.toml`, `src/tenuo_claude_code/__init__.py`, and `uv.lock`.
+   If anything under `plugins/tenuo/` changed, also bump `version` in
+   `plugins/tenuo/.claude-plugin/plugin.json` (installed plugins only update when it changes)
+   and run `claude plugin validate . --strict` and `claude plugin validate plugins/tenuo --strict`.
 2. Commit (`Release X.Y.Z`) and push the `vX.Y.Z` tag (this triggers the PyPI publish).
 3. Always publish brief release notes:
    `gh release create vX.Y.Z --verify-tag --title vX.Y.Z --notes "<one short paragraph or a few bullets>"`.

{tenuo_claude_code-0.6.4 → tenuo_claude_code-0.7.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: tenuo-claude-code
-Version: 0.6.4
+Version: 0.7.0
 Summary: Tenuo governance for Claude Code — warrants, hooks, MCP proxy, and Cloud lifecycle
 Project-URL: Homepage, https://tenuo.ai
-Project-URL: Repository, https://github.com/tenuo-ai/claude-governance
-Project-URL: Documentation, https://github.com/tenuo-ai/claude-governance#readme
-Project-URL: Issues, https://github.com/tenuo-ai/claude-governance/issues
+Project-URL: Repository, https://github.com/tenuo-ai/tenuo-claude-code
+Project-URL: Documentation, https://github.com/tenuo-ai/tenuo-claude-code#readme
+Project-URL: Issues, https://github.com/tenuo-ai/tenuo-claude-code/issues
 Author: Tenuo Contributors
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -23,67 +23,59 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
-Requires-Dist: certifi>=2024.0
+Requires-Dist: anyio>=4.14.2
+Requires-Dist: certifi>=2026.10.18
 Requires-Dist: cryptography>=42.0
-Requires-Dist: mcp<2,>=1.0
+Requires-Dist: mcp<2,>=1.30
+Requires-Dist: pyjwt>=2.15.0
 Requires-Dist: pyyaml>=6.0
-Requires-Dist: tenuo<0.4,>=0.3.0
+Requires-Dist: tenuo<0.4,>=0.3.6
 Description-Content-Type: text/markdown
 
 # Tenuo for Claude Code
 
 [![PyPI](https://img.shields.io/pypi/v/tenuo-claude-code)](https://pypi.org/project/tenuo-claude-code/)
 [![Python](https://img.shields.io/pypi/pyversions/tenuo-claude-code)](https://pypi.org/project/tenuo-claude-code/)
-[![CI](https://github.com/tenuo-ai/tenuo-claude-code/actions/workflows/ci.yml/badge.svg)](https://github.com/tenuo-ai/tenuo-claude-code/actions/workflows/ci.yml)
+[![CI](https://github.com/tenuo-ai/tenuo-claude-code/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/tenuo-ai/tenuo-claude-code/actions/workflows/ci.yml?query=branch%3Amain)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
-**Task-scoped authorization for Claude Code.**
+**Claude Code's permissions decide which tools Claude can call. Tenuo decides what it can call them with.**
 
-Give Claude Code access to your codebase and tools without giving it access to everything. Tenuo constrains what Claude can read, execute, fetch, and invoke before each action runs. You get signed evidence of what was allowed or denied—a tamper-proof audit trail.
+Tenuo checks the arguments of every tool call against your policy before the call runs: which repo, which directory, which commands, which domains. That includes MCP tools, with no change to the MCP server. Each decision is written as a signed receipt.
 
-Tenuo works alongside Claude Code permissions. It adds a signed, expiring authority token that stays enforced even when permission prompts are bypassed, across MCP calls and subagents.
+Here Claude Code's own permissions allowed the GitHub MCP server's `get_file_contents`. The Tenuo policy allows one repository:
 
-## Why Tenuo?
-
-Claude Code permissions prompt the user; Tenuo checks the **model's action** at the authorizer boundary. The difference matters:
-
-| | Claude Code permissions | Tenuo warrant |
-|---|---|---|
-| **Trigger** | User prompt when Claude asks for access | Automatic check before every tool call |
-| **Scope** | Tool name only | Tool name + argument values |
-| **Bypass** | Prompt can be skipped | Cannot be disabled by the user |
-| **Evidence** | Optional hook logs | Signed, tamper-proof receipts |
-| **Revocation** | Edit rules (active sessions may keep access) | Instant fleet-wide revocation (Cloud) |
-| **Enforcement** | Claude Code settings UI | PreToolUse hook + MCP proxy + authorizer |
-| **Span** | Single session | Persists across MCP calls and subagents |
-
-Tenuo doesn't replace Claude Code permissions—it adds a cryptographic gate that works regardless of why the model tried the call: prompt injection, hallucination, poisoned tool output, or direct user request.
-
-## What It Looks Like
-
-After setup, this is what you see:
+```yaml
+mcp:
+  server: github             # must match the client MCP server name
+  enforce:
+    get_file_contents:
+      args:
+        owner: "exact:tenuo-ai"
+        repo: "pattern:tenuo"
+default: deny
+```
 
 ```
-tenuo-claude audit --verify
+$ tenuo-claude audit
+  ALLOW      [gov] mcp__github__get_file_contents -> mcp__github__get_file_contents  authorized  owner=tenuo-ai path=README.md repo=tenuo
+  DENY       [gov] mcp__github__get_file_contents -> mcp__github__get_file_contents  Constraint not satisfied  owner=tenuo-ai path=README.md repo=tenuo-cloud
+  DENY       [gov] mcp__github__get_file_contents -> mcp__github__get_file_contents  Constraint not satisfied  owner=torvalds path=README repo=linux
+```
 
-DENY   Read /etc/passwd                constraint not satisfied
-       path outside workspace (subpath:/home/user/project)
+The same check covers Claude's own tools: reads and edits stay inside the project, the shell runs only the commands you list, and WebFetch reaches only the domains you name.
 
-ALLOW  Read /home/user/project/main.py  constraint satisfied
-DENY   Bash rm -rf /                    command not permitted
-       'rm' not in allowlist [ls,pwd,cat,grep]
+## Why Tenuo?
 
-3 signed receipts verified:
-  Ed25519 signatures valid
-  Hash chain unbroken
-  Constraints replayed and satisfied
-```
+| | Claude Code permissions | Tenuo |
+|---|---|---|
+| **Matches** | Tool name; command and path patterns for built-in tools | Any argument of any tool, including MCP tools |
+| **Decides** | Allow, deny or ask the user | Allow or deny before the call, against a signed, expiring warrant |
+| **Evidence** | Optional hook logs | Signed, hash-chained receipts (`tenuo-claude audit --verify`) |
+| **Subagents** | Same rules as the session | Each declared subagent gets a narrower warrant |
+| **Teams** | Managed settings | Managed settings plus an org-signed root, revocation and approvals (Cloud) |
 
-Each decision is:
-- **Signed** with Ed25519 (cryptographic proof)
-- **Hash-chained** (tampering is detected)
-- **Constraint-replayed** (warrant terms verified at audit time)
-- **Cloud-synced** (if configured, sent to tenant for fleet audit)
+Tenuo runs alongside Claude Code permissions. It checks the call whatever led the model to make it: prompt injection, a poisoned tool result, or a plain mistake.
 
 ## Quickstart
 
@@ -95,19 +87,20 @@ tenuo-claude bootstrap --native --pack filesystem-dev
 claude
 ```
 
-That's it. `bootstrap` with `--pack filesystem-dev` generates a safe starter policy (read/write your project, run safe commands), starts the authorizer, and runs a self-test. Open Claude Code, try something in-scope (it works) and out-of-scope (it's denied). Then:
+That's it. `bootstrap` with `--pack filesystem-dev` generates a starter policy (read and edit your project, keep Tenuo's keys and hook wiring out of reach, a minimal shell), starts the authorizer, and runs a self-test. The first run also downloads the pinned authorizer binary to `~/.tenuo/bin`. The pack starts in `mode: dry-run`, so nothing is blocked yet: open Claude Code, work normally, ask for something out of scope (say, reading a file outside the project), then:
 
 ```bash
 tenuo-claude audit --verify
 ```
 
-to see the signed decision log.
+to see the signed decision log, including what would have been denied.
 
 ### What the quickstart does
 
 1. **`--pack filesystem-dev`** generates a preconfigured policy:
-   - Read/write files in your project directory
-   - Run: ls, pwd, cat, grep (safe commands)
+   - Read, edit and search files in your project directory (paths resolved, symlinks followed)
+   - Never read or change Tenuo's own files: its keys and state, `tenuo.yaml`, `.mcp.json`, `.claude/settings*.json`
+   - Run only `ls` and `pwd` in the shell; add your test and build commands to `Bash:`. The shell check covers the command name, not its paths, so list only commands you'd allow on any path
    - Deny everything else by default
    - Start in `mode: dry-run` (log, don't block)
 
@@ -124,12 +117,29 @@ tenuo-claude refresh
 ```
 
 **Available policy packs:**
-- `filesystem-dev` — Read/write project files, safe commands (default)
+- `filesystem-dev` — Read/write project files, minimal shell (default)
 - `github-mcp` — GitHub MCP server, constrained API queries
 - `http-api-safe` — WebFetch with SSRF protection and domain allowlists
 
 Browse more: [examples/policies/](examples/policies/).
 
+### Limit an MCP server
+
+Add the server to Claude Code as usual, then scope it. For the GitHub MCP server:
+
+```bash
+tenuo-claude init --pack github-mcp --param owner=myorg --param repos='service-*' --param approver=any-human
+```
+
+The pack starts in `mode: dry-run`, which logs decisions but does not block calls. Review the generated `tenuo.yaml`, change it to `mode: enforce`, then apply it and start the authorizer:
+
+```bash
+tenuo-claude refresh
+tenuo-claude up
+```
+
+In enforce mode, reads and ordinary writes are limited to `myorg/service-*`; merges, pushes and file writes need a human approval (Tenuo Cloud; locally they are denied); everything else is denied. For another server, list its tools under `mcp.enforce` with a constraint per argument; see [Policy](#policy).
+
 **For Cloud mode** (org root, revocation, human approval):
 
 ```bash
@@ -138,6 +148,37 @@ tenuo-claude bootstrap --native --pack filesystem-dev --cloud
 
 Then follow the Cloud setup prompts. [Details: Cloud mode](#cloud-mode).
 
+## Install as a Claude Code plugin
+
+The repo is also a Claude Code plugin marketplace. Inside Claude Code:
+
+```text
+/plugin marketplace add tenuo-ai/tenuo-claude-code
+/plugin install tenuo@tenuo
+```
+
+The plugin still needs the CLI (`uv tool install tenuo-claude-code`) and a policy (`tenuo-claude bootstrap --native --pack filesystem-dev`). What it adds:
+
+- **Hooks that stay out of the way.** PreToolUse, PostToolUse, and SessionStart hooks run in every project, but they do nothing unless the project has opted in. Repos without Tenuo keep Claude Code's normal permissions.
+- **A fail-closed safety net.** If a project is governed but its `.claude/settings.json` wiring is missing (a fresh clone, a regenerated settings file), the plugin routes each call to `tenuo-claude _hook` itself. If the CLI can't be found or crashes, the call is denied with a message saying how to fix it.
+- **A one-line status at session start**, plus `/tenuo:status` (`tenuo-claude check`) and `/tenuo:audit` (`tenuo-claude audit --verify`).
+
+How the plugin decides, per tool call:
+
+| Project state | PreToolUse result |
+|---|---|
+| No `tenuo.yaml` in the session directory or any parent | Nothing (Claude Code permissions apply) |
+| `tenuo.yaml` but no state directory (never initialized) | Nothing; session start says to run `bootstrap` |
+| `<state>/disabled` present (`tenuo-claude disable`) | Nothing; `tenuo-claude up` or `init` re-arms it |
+| Tenuo hooks already wired by `init`/`bootstrap` (project, user, or managed settings) | Nothing; the wired hook enforces, so no double receipts |
+| Initialized, not wired, `tenuo-claude` found | Delegates to `tenuo-claude _hook` |
+| Initialized, not wired, `tenuo-claude` missing, crashing, or timing out | Deny (fail-closed) |
+| `TENUO_PROJECT_DIR` set to a directory without `tenuo.yaml` | Deny (fail-closed) |
+
+The CLI is found via `TENUO_CLAUDE_BIN`, the project `.venv`, `PATH`, then the uv tool and pipx install locations. The launcher is stdlib Python ([`plugins/tenuo/scripts/tenuo_plugin.py`](plugins/tenuo/scripts/tenuo_plugin.py)); it makes no network calls itself. macOS and Linux only, like the CLI.
+
+To try a local checkout: `claude --plugin-dir ./plugins/tenuo`.
+
 ## How It Works
 
 You define what Claude can do in `tenuo.yaml`:
@@ -219,7 +260,8 @@ It does **not** govern:
 ## Fail-Closed Design
 
 - Missing or broken `tenuo.yaml` denies every governed call until restored
-- Private keys under `.state/` are owner-only (`0600`)
+- Private keys are owner-only (`0600`) and kept outside the project
+- In enforce mode a recursive `Grep` runs with the policy and hook wiring files (`tenuo.yaml`, `.mcp.json`, `.claude/settings*.json`) excluded, and is denied if they can't be excluded. Keep secrets out of those files anyway (`${VAR}` references), since `dry-run` blocks nothing
 - A broken receipt sink surfaces loudly (not silent data loss)
 - Cloud-disconnected nodes fall back to local policy (no open bypass)
 
@@ -252,14 +294,51 @@ subagents:                  # optional: each role runs under a narrower warrant
     tools: [Read, Grep, Glob]
 
 mcp:                        # optional: govern a downstream MCP server's tools
-  downstream: ./your_mcp_server.py
+  server: tenuo-files        # client MCP server name (default: tenuo-files)
+  downstream: ./your_mcp_server.py   # or {command: npx, args: [...], env: {...}}
   enforce:
     read_file: "subpath:{sandbox}"
     run_query:
-      arg: sql
-      constraint: "regex:^SELECT "
+      arg: database
+      constraint: "oneof:analytics,staging"
+```
+
+MCP capabilities include the server name: `mcp__<server>__<tool>`. A different server with the same tool name does not inherit these grants. For upgrades, see [0.7.0 migration notes](docs/releases/0.7.0.md).
+
+### Any MCP client
+
+`tenuo-claude mcp-proxy` serves `mcp.downstream` over stdio and checks each call against the policy before forwarding it, so the same rules apply in Cursor, Claude Desktop or any other MCP client. The downstream can be any stdio server. Env values can reference the proxy's environment, which keeps tokens out of `tenuo.yaml`:
+
+```yaml
+mcp:
+  server: github
+  downstream:
+    command: docker
+    args: [run, -i, --rm, -e, GITHUB_PERSONAL_ACCESS_TOKEN, ghcr.io/github/github-mcp-server]
+    env:
+      GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_TOKEN}"
+  enforce:
+    get_file_contents:
+      args: {owner: "exact:myorg", repo: "pattern:service-*"}
+default: deny
+```
+
+Then point the client at the proxy instead of the server, with `tenuo-claude up` running in the project:
+
+```json
+{
+  "mcpServers": {
+    "github": {
+      "command": "tenuo-claude",
+      "args": ["mcp-proxy"],
+      "env": {"TENUO_PROJECT_DIR": "/path/to/project", "GITHUB_TOKEN": "..."}
+    }
+  }
+}
 ```
 
+A denied call returns an MCP error result (`isError: true`) naming the refused constraint, and is recorded in `tenuo-claude audit`.
+
 ### Constraints
 
 | Constraint | Applies to | Checks |
@@ -312,14 +391,17 @@ Day to day: `up` (start), `audit` (review), `refresh` (after editing policy).
 | `up` / `down` | Start / stop the authorizer (auto-selects Docker or native; `--native` forces native). |
 | `refresh` | Recompile after editing `tenuo.yaml` (restarts authorizer if running). |
 | `verify [--deep]` | Self-test the policy against the authorizer (no Claude session needed). `--deep` adds SSRF/encoded-IP matrix and Bash deny cases. |
-| `audit [--tail N] [--verify]` | Show the decision log (`.state/receipts.jsonl`). `--verify` checks receipt signatures, hash-chain links, and embedded evidence. |
+| `audit [--tail N] [--verify]` | Show the decision log (`<state>/receipts.jsonl`). `--verify` checks receipt signatures, hash-chain links, and embedded evidence. |
 | `check` | Preflight: dependencies, wiring, audit-sink health, leaked keys, Cloud bindings. |
 | `status` | Warrant, mode, audit-sink health, Cloud summary. |
 | `install-authorizer` | Install the pinned native authorizer to `~/.tenuo/bin`. |
+| `state-dir` | Print this project's state directory. |
 | `bench [--json]` | Measure per-call overhead on your machine. |
 | `revoke` | Revoke the current session warrant. |
 
-The warrant is short-lived (~1h TTL); `up` refreshes it before expiry. Generated files (don't commit): `.state/` (keys, warrant, credentials), `.claude/settings.json` (hooks), `.mcp.json` (MCP proxy).
+The warrant is short-lived (~1h TTL); `up` refreshes it before expiry. Generated files (don't commit): `.claude/settings.json` (hooks), `.mcp.json` (MCP proxy).
+
+**State.** Keys, warrant, gateway config, receipts and Cloud credentials live outside the project, in `~/.tenuo/projects/<project>-<hash>/`, so nothing scoped to the project tree can reach them. `tenuo-claude state-dir` prints the path; `<state>/…` in these docs means a file in it. A project set up by an older release keeps using `<project>/.state` until the next `tenuo-claude refresh`, which moves it.
 
 ## Cloud Mode
 
@@ -330,7 +412,7 @@ For organizations: org root, fleet revocation, human approval, central audit.
 1. **Create a Tenuo tenant** at [cloud.tenuo.ai](https://cloud.tenuo.ai). Complete the **Infrastructure** onboarding (provisions KMS-backed signing keys).
 
 2. **Get credentials:**
-   - **Runtime key** (`tenuo_ct_…`) from Agents → Quick Connect → **Authorizer Only** → `.state/cloud.env`
+   - **Runtime key** (`tenuo_ct_…`) from Agents → Quick Connect → **Authorizer Only** → `<state>/cloud.env`
    - **Tenant-admin key** (`tc_…`) from Settings → API Keys → Create (admin role) → `~/.tenuo/admin.env`
 
 3. **Bootstrap with Cloud:**
@@ -391,7 +473,7 @@ When Claude tries a gated action:
 
 **Setup:** See [docs/DETAILS.md § Approval setup runbook](docs/DETAILS.md#approval-setup-runbook).
 
-For Cloud, receipts are sent to your tenant (central audit). Locally, receipts are always written to `.state/receipts.jsonl`.
+For Cloud, receipts are sent to your tenant (central audit). Locally, receipts are always written to `<state>/receipts.jsonl`.
 
 ## Security Model
 
@@ -404,11 +486,11 @@ The warrant is a capability token: it lists what Claude can do and for how long.
 
 **Receipts:** Every decision is signed with Ed25519 and hash-chained for tamper-evidence. Local `audit --verify` checks signatures, hash-chain links, warrant chains, and deterministic constraint replay. Cloud receipts are independently verified by the tenant.
 
-**Fail-closed:** Missing or broken `tenuo.yaml` denies every governed call. Keys under `.state/` are owner-only. A broken receipt sink surfaces loudly (not silent data loss).
+**Fail-closed:** Missing or broken `tenuo.yaml` denies every governed call. Keys are owner-only and kept outside the project. A broken receipt sink surfaces loudly (not silent data loss).
 
 **Rolling out to a team:** Keep `tenuo.yaml` in version control. Push hook/MCP wiring through Claude Code managed settings. Use Cloud for org-root warrants, central audit, and revocation. See [docs/DETAILS.md § Managed deployment](docs/DETAILS.md#managed-deployment) for the rollout checklist and hardened socket setup.
 
-**Turning it off:** `tenuo-claude disable` unwires the hook (Claude stops calling the authorizer) and stops the authorizer, leaving policy and warrant in place. `tenuo-claude uninstall` also deletes `.state/` (warrant, keys, credentials). `tenuo.yaml` is never touched.
+**Turning it off:** `tenuo-claude disable` unwires the hook (Claude stops calling the authorizer) and stops the authorizer, leaving policy and warrant in place. `tenuo-claude uninstall` also deletes the state directory (warrant, keys, credentials). `tenuo.yaml` is never touched.
 
 ---