nono

No entries match these filters. Clear filters

1. v0.81.0 Oct 29, 2026 · issue 125

   nono adds network approval backends, opt-in namespace isolation, and LandlockLandlockA Linux kernel access-control mechanism that lets an unprivileged process restrict its own filesystem and network access, giving cyber tools a way to sandbox themselves without root privileges. V9 detection alongside new policy groups and proxy denial logging⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONHomebrewDockergit

   Homebrew copy

   $ brew install nono
   # already installed? upgrade to this version:
   $ brew upgrade nono

   Docker copy

   $ docker pull ghcr.io/nolabs-ai/nono:0.81.0

   git copy

   $ git clone --branch v0.81.0 https://github.com/nolabs-ai/nono.git
   # already have the repo? check out this version:
   $ git checkout v0.81.0

   Homebrew lists this version · published under the project's GitHub account · checked 30 Oct

   └──▷ TRY IT
   Check whether a sandboxed agent or tool is permitted to connect to a Unix socket such as the Docker daemon socket.
   copy

   $ nono why --unix-socket /run/docker.sock

   • Query pathname Unix socket connect access with nono why --unix-socket <path> to diagnose AF_UNIX policy decisions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add the rtk_state policy group to grant runtime-state access in profiles.
   • Enable opt-in namespace isolation on Linux (NEP-0004) for stronger per-tool containment.
   • nono now detects Landlock ABI up to V9, extending future-proofing for Linux kernel upgrades while keeping enforcement at V6.
   • Proxy deny log lines now include denial_category, giving operators a structured field to filter and alert on blocked network requests.

   +2 more show less

   • Profiles now require fully qualified package profile names, making profile references unambiguous across registries.
   • The exec gate on Linux now reads only the ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. regions it actually parses, reducing per-execution overhead and enabling lower-latency sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. for workloads that spawn many processes.
   • Query pathname Unix socket connect access with nono why --unix-socket <path> to diagnose AF_UNIX policy decisions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add the rtk_state policy group to grant runtime-state access in profiles.
   • Enable opt-in namespace isolation on Linux (NEP-0004) for stronger per-tool containment.
   • Proxy deny log lines now include denial_category, giving operators a structured field to filter and alert on blocked network requests.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Profiles now require fully qualified package profile names; bare/unqualified profile name references that worked in v0.80.0 will break on upgrade.
2. v0.80.0 Oct 13, 2026 · issue 107

   nono v0.80.0 adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. executable pinning, per-command AWS SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. auth, and macOS keychain_accesskeychain_accessA macOS system service and GUI app from Apple that stores and retrieves passwords, certificates, and keys from encrypted keychains, giving cyber tools a native credential store without managing their own crypto. grants for tool sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.80.0 https://github.com/nolabs-ai/nono.git
   # already have the repo? check out this version:
   $ git checkout v0.80.0

   └──▷ USE IT
   Pin a sandboxed tool to its exact binary so a supply-chain swap or path-hijack is caught before execution.
   json copy

   {
     "command_policies": {
       "commands": {
         "gh": {
           "executable": "/usr/local/bin/gh",
           "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
         }
       }
     }
   }

   • Adds sha256 field to CommandPolicyConfig in the command-policy config to pin a command to its expected SHA-256 executable digest, blocking substituted or tampered binaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds aws_auth field (type AwsAuthConfig) to CommandCredentialConfig in the command-policy config, enabling per-command AWS SigV4 signing in tool-sandbox scoped-proxy routes — the child process sees only dummy keys while real credentials are resolved host-side.
   • Adds command-level keychain_access grant for macOS, letting profiles permit a specific sandboxed command to access the macOS Keychain without widening the entire session sandbox.
   • Adds sha256 field to CommandPolicyConfig in the command-policy config to pin a command to its expected SHA-256 executable digest, blocking substituted or tampered binaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds command-level keychain_access grant for macOS, letting profiles permit a specific sandboxed command to access the macOS Keychain without widening the entire session sandbox.

   1 more in Everything

3. docs update Oct 4, 2026 · issue 094

   nono command-sandbox proxy credentials now support aws_auth for SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets.-signed AWS routing without exposing real credentials inside the sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Route sandboxed AWS Bedrock CLI calls through the host-side production AWS profile via SigV4 signing, keeping real credentials off the sandboxed process entirely.
   json copy

   {
     "bedrock": {
       "proxy": {
         "upstream": "https://bedrock-runtime.us-east-1.amazonaws.com",
         "aws_auth": {
           "profile": "production"
         }
       },
       "endpoint_policy": [
         {
           "allow": {
             "method": "POST",
             "path": "/model/**"
           }
         }
       ]
     },
     "AWS_ACCESS_KEY_ID": "nono-placeholder",
     "AWS_SECRET_ACCESS_KEY": "nono-placeholder",
     "AWS_CONFIG_FILE": "/dev/null",
     "AWS_SHARED_CREDENTIALS_FILE": "/dev/null"
   }

   • Adds aws_auth as an alternative to credential_key on proxy credential type in command sandbox policies, letting the host supervisor resolve an AWS profile and sign outbound requests with SigV4 so real AWS credentials never enter the sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds aws_auth.profile config key to specify which host-side AWS profile (including SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. profiles) is used for signing permitted outbound requests from a command-scoped proxy credential.
   • Supports setting AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE to /dev/null inside the sandbox to prevent the sandboxed CLI from probing ~/.aws, while aws_auth.profile is still resolved by the host supervisor.
   • Supports non-secret AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY placeholder values inside the sandbox to satisfy client-side credential checks before the proxy removes their signature and re-signs with host-side credentials.

   4 details in Everything

4. docs update Oct 4, 2026 · issue 094

   nono adds diagnostics.redaction.extra_env_vars and network_denial_audit rate-limit controls for audit hygiene⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Prevent a CI-injected deploy token and any secret-suffixed vars from appearing in audit logs, alongside the profile's existing deny rules.
   toml copy

   [diagnostics]
     [diagnostics.redaction]
       extra_env_vars = ["DEPLOY_TOKEN", "ACME_*", "*_SECRET"]

   Cap audit noise from a chatty process that hammers a blocked endpoint, keeping the log small while still enforcing every denial.
   toml copy

   [network_denial_audit]
     rate_per_sec = 5
     burst = 20

   Temporarily capture every network denial for a single debugging run without modifying the profile.
   copy

   $ nono run --network-denial-audit-rate 1000 --network-denial-audit-burst 10000 -- ./my-service

   • Adds diagnostics.redaction.extra_env_vars config key to redact additional environment variable values (by exact name or glob such as ACME_*, *_SECRET) from diagnostics, session records, and the audit log — for variables not already derived from the profile's deny or credential declarations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds network_denial_audit profile section with rate_per_sec (max 1000) and burst (max 10000) integer fields to control how many per-run network syscall denials are individually recorded in the audit trail on Linux seccomp-mediated runs.
   • Adds --network-denial-audit-rate and --network-denial-audit-burst CLI flags to override the network_denial_audit profile settings for a single run.
   • Automatically redacts exact environment.deny_vars entries and all credential destinations (command_policies.credentials, network.custom_credentials, credential_routes env_var fields) from diagnostics and the audit log without requiring a separate redaction declaration.
   • Denied connections past the audit budget are still enforced and emit a single summary audit event (e.g. '50 network syscall denials were enforced but not individually recorded (audit rate limit exceeded)') rather than being silently dropped from the log.

   5 details in Everything

5. docs update Oct 1, 2026 · issue 091

   nono adds diagnostics.redaction.extra_env_vars to scrub additional environment variables from diagnostics and audit logs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Scrub a deployment credential and a wildcard family of secrets from diagnostics and audit logs when they are passed through the host environment rather than declared in the profile.
   yaml copy

   diagnostics:
     redaction:
       extra_env_vars:
         - "DEPLOY_TOKEN"
         - "ACME_*"
         - "*_SECRET"

   • Derives automatic redaction from environment.deny_vars exact-name entries and from command_policies.credentials, network.custom_credentials, and credential_routes env_var destinations — no separate redaction declaration needed for these.
   • Supports glob syntax (e.g. ACME_*, *_SECRET) matched case-insensitively against the full variable name, using the same matcher as environment.deny_vars.
   • Merges extra_env_vars additively across profile inheritance, so child profiles widen the inherited redaction list rather than replacing it.
   • Records names added via a profile in the audit log's redaction-policy diff, so each audit record documents how its own scrubbing differed from the default.
   • Requires [redaction].unsafe_redaction_overrides in user config to remove a secure default from the redaction list — profile-level entries are add-only.
   • Supports glob syntax (e.g. ACME_*, *_SECRET) matched case-insensitively against the full variable name, using the same matcher as environment.deny_vars.
   • Merges extra_env_vars additively across profile inheritance, so child profiles widen the inherited redaction list rather than replacing it.
   • Records names added via a profile in the audit log's redaction-policy diff, so each audit record documents how its own scrubbing differed from the default.
   • Requires [redaction].unsafe_redaction_overrides in user config to remove a secure default from the redaction list — profile-level entries are add-only.

   1 more in Everything

6. v0.79.0 Sep 30, 2026 · issue 091

   nono v0.79.0 adds remote agent session launch, proxy denial diagnostics, Snap policy group, and diagnostics.redaction.extra_env_vars⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.79.0 https://github.com/nolabs-ai/nono.git
   # already have the repo? check out this version:
   $ git checkout v0.79.0

   └──▷ TRY IT
   Attach interactively to a remote agent workspace — useful for inspecting or resuming a long-running sandboxed session from another machine.
   copy

   $ nono run --remote --agent claude --workspace my-project

   Launch a remote agent session in the background without attaching, then walk away — the session runs detached under the sandbox policy.
   copy

   $ nono run --remote --agent claude --workspace my-project --detached

   • Adds --remote, --agent, --workspace, and --detached flags to nono run to launch and attach to remote agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds diagnostics.redaction.extra_env_vars profile key to redact additional environment variables from diagnostic output.
   • Renders proxy network denials in the CLI diagnostic footer so blocked outbound calls are visible at a glance.
   • Adds --remote, --agent, --workspace, and --detached flags to nono run to launch and attach to remote agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds diagnostics.redaction.extra_env_vars profile key to redact additional environment variables from diagnostic output.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Legacy Claude hook cleanup code has been removed (feat(cli)!: remove legacy Claude hook cleanup); any setup relying on that automatic cleanup will no longer have it performed on upgrade.
7. docs update Sep 26, 2026 · issue 086

   nono adds Sandboxed Tool Execution with per-command filesystem, network, and credential grants brokered through a command sandbox policy⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Sandbox curl to HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.-only traffic by defining a command sandbox policy that restricts network access to port 443 via a proxy credential, preventing any direct or unproxied connections.
   ~/.config/nono/profiles/my-command-policy-profile.json copy

   {
     "commands": {
       "curl": {
         "from": {
           "session": {
             "sandbox": {
               "network": {
                 "credentials": ["command-curl-https"]
               }
             }
           }
         }
       }
     }
   }

   • Adds commands.<name>.from.session.sandbox config key to define a direct-session command sandbox policy, scoping a named command's filesystem, network, and credential grants independently of the session sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds commands.<name>.from.<caller>.sandbox config key to define caller-specific command sandbox policies, enabling chained tool execution where each hop receives its own narrowly scoped policy.
   • Adds network.allow_all field within a command sandbox policy to grant unrestricted network access to a specific command sandbox.
   • Adds command-scoped proxy policy: a command sandbox whose network policy includes a proxy credential receives a dedicated loopback proxy and fresh proxy credential, isolated from the session sandbox's broader domain allowlist.
   • Adds NO_PROXY awareness to command sandbox proxy enforcement — setting NO_PROXY or opening a direct socket does not bypass network policy unless the command sandbox policy separately grants raw TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. access.

   +11 more show less

   • Adds endpoint_policy field so proxy credential reverse routes may reach configured upstreams without adding those upstreams to the command sandbox's domain allowlist.
   • Adds per-command trust downgrade for pinned executables writable by the session sandbox capability set, requiring an absolute path.
   • Adds profile-wide trust downgrade option to disable the writable-executable trust check across command mediation for low-assurance profiles.
   • Supports intercept sandboxes that replace the selected command sandbox for a matched invocation, validated for well-formedness but not restricted to narrowing the base sandbox.
   • Adds dynamic provider token expansion in command sandbox path grants — tokens are expanded at launch before the sandbox is built and are opt-in.
   • Supports shebang script mediation: scripts detected by entrypoint are classified as shebang scripts and the command sandbox grants the script, its interpreter, and the interpreter's ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. loader closure.
   • Adds Linux cgroup-based caller attribution so mediated commands spawned by double-forking daemons (e.g. tmux servers) are still attributed correctly rather than falling back to a replayable identity.
   • Adds optional command sandbox resource limits field within a command sandbox policy.
   • Adds seatbelt escape-hatch field (macOS only) to append raw Seatbelt rules after the deny gate for a specific command sandbox.
   • Supports two credential types in command sandbox policies: named credentials injected into the selected sandbox and local-socket credentials backed by SSH_AUTH_SOCK.
   • Provides example profiles command-jq-readonly, command-curl-https, command-git-ssh, and command-make-cc stored under ~/.config/nono/profiles/ illustrating common sandboxed tool configurations.

   16 details in Everything

8. docs update Sep 26, 2026 · issue 086

   nono adds sandboxed tool execution and dangerous command blocking via command policies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds sandboxed tool execution to run selected commands in zero-trust command sandboxes with brokered chaining.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dangerous command blocking to prevent destructive commands via command policies.

   2 details in Everything

9. v0.78.0 Sep 16, 2026 · issue 077

   nono v0.78.0 adds backend-signed approval webhooks, macOS DNS opt-out, and a Nix #prebuilt flake output⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.78.0 https://github.com/nolabs-ai/nono.git
   # already have the repo? check out this version:
   $ git checkout v0.78.0

   └──▷ USE IT
   Wire a profile's approval backend to your enrolled platform so every approval request is cryptographically signed and uses submit-and-poll instead of a plain webhook.
   json copy

   {
     "approval_backends": {
       "my-backend": {
         "backend_type": "webhook",
         "auth": "platform"
       }
     }
   }

   Install nono instantly in a Nix environment without compiling from source — useful in CI or on machines without a Rust toolchain.
   copy

   $ nix run github:nolabs-ai/nono#prebuilt

   • Adds CapabilitySet::block_dns() (and C-API nono_capability_set_block_dns() / nono_capability_set_dns_enabled()) on macOS to opt out of implicit mDNSResponder grants in Blocked and ProxyOnly network modes.
   • Adds #prebuilt Nix flakeNix flakeA Nix packaging construct that pins all dependencies in a lockfile and exposes a standardized interface, giving cyber tools fully reproducible builds across any machine running the Nix package manager. output to fetch the official release binary directly from GitHub Releases, skipping source compilation.
   • Removes all remaining deprecated surfaces and legacy aliases as part of v1.0.0 preparation.
   • Adds #prebuilt Nix flakeNix flakeA Nix packaging construct that pins all dependencies in a lockfile and exposes a standardized interface, giving cyber tools fully reproducible builds across any machine running the Nix package manager. output to fetch the official release binary directly from GitHub Releases, skipping source compilation.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !All remaining deprecated CLI surfaces and legacy profile aliases removed — any profile or script relying on them will break on upgrade.
10. docs update Sep 15, 2026 · issue 075

    nono tool-sandbox adds webhook and chain approval backends with configurable auth and multi-backend chaining⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Require platform-signed approval before any sandboxed tool runs, using the enrolled platform's approval route.
    yaml copy

    type: webhook
    auth: "platform"

    Require both terminal confirmation and a webhook to approve a tool call, so two channels must agree before execution proceeds.
    yaml copy

    type: chain
    mode: all
    backends:
      - type: terminal
      - type: webhook
        url: https://approvals.example.com/hook

    • Adds webhook approval backend with url and auth fields; set auth: "platform" to sign requests with the enrollment key and use the submit-and-poll exchange against the enrolled platform's approval route.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds chain approval backend with mode (default all) and backends fields to combine multiple approval backends.
    • Adds terminal approval backend to prompt the operator directly in the terminal.

    3 details in Everything

11. docs update Sep 12, 2026 · issue 072

    nono gains nono session cleanup command to remove sessions from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Clean up terminated sessions from the nono runtime — note: avoid running against paused/stopped sessions until conservative handling is tightened.
    copy

    $ nono session cleanup

12. docs update Sep 12, 2026 · issue 072

    nono adds live sandbox session management with ps, attach, detach, stop, inspect, and cleanup commands⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

13. v0.77.0 Sep 11, 2026 · issue 072

    nono v0.77.0 removes all legacy profile aliases and shims, and switches network-notification sessions to CLONE_FILESCLONE_FILESA Linux kernel flag passed to `clone()` that makes a new process share the parent's file-descriptor table rather than copying it, saving overhead when a tool spawns many lightweight worker threads. bootstrap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.77.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.77.0

    • Removes all legacy profile-key aliases, CLI flag aliases (including --allow-net, --net-allow, and env vars NONO_NET_BLOCK, NONO_NET_ALLOW, NONO_PROXY_CREDENTIAL, etc.), and the nono policy subcommand — these now fail to parse instead of warning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Switches network-notification session bootstrap to use CLONE_FILES, improving session startup for that session type.
    • Removes all legacy profile-key aliases, CLI flag aliases (including --allow-net, --net-allow, and env vars NONO_NET_BLOCK, NONO_NET_ALLOW, NONO_PROXY_CREDENTIAL, etc.), and the nono policy subcommand — these now fail to parse instead of warning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The nono policy subcommand (and all its sub-forms such as nono policy groups, nono policy profiles, nono policy show) is removed — use nono profile equivalents instead.
    • !Legacy profile keys and CLI flag aliases (--allow-net, --net-allow, and others) and environment variable aliases (NONO_NET_BLOCK, NONO_NET_ALLOW, NONO_ALLOW_PROXY, NONO_PROXY_ALLOW, NONO_PROXY_CREDENTIAL, NONO_EXTERNAL_PROXY, NONO_EXTERNAL_PROXY_BYPASS) are removed and now fail to parse — replace with their current equivalents.
    • !The nono prune subcommand is removed from the CLI.
    • !Profile JSON keys security.allowed_commands and policy.add_deny_commands are no longer accepted — use commands.allow and commands.deny respectively.
14. docs update Sep 9, 2026 · issue 069

    nono audit gains cleanup subcommand with --keep, --older-than, --max-total-size, and --dry-run filters to prune old audit sessions from disk.

    └──▷ TRY IT
    Preview which audit sessions would be removed before committing to a cleanup — useful before running in CI or on a shared system.
    copy

    $ nono audit cleanup --keep 10 --max-total-size 500 --dry-run

    Enforce a rolling retention policy that keeps only sessions from the last 30 days and caps total disk usage at 500 MB, removing oldest sessions first.
    copy

    $ nono audit cleanup --older-than 30 --max-total-size 500

    • Supports combining --keep, --older-than, and --max-total-size filters so each narrows further which sessions are removed.

    1 more in Everything

15. v0.76.0 Sep 9, 2026 · issue 069

    nono v0.76.0 adds --max-total-size to audit cleanup, Nix flakeNix flakeA Nix packaging construct that pins all dependencies in a lockfile and exposes a standardized interface, giving cyber tools fully reproducible builds across any machine running the Nix package manager. support, and unix_socket_bindunix_socket_bindA system call that assigns a filesystem path or abstract name to a Unix domain socket, letting processes on the same host find and connect to it without using a network port. for tool sandboxes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.76.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.76.0

    └──▷ TRY IT
    Cap audit storage in CI environments where disk is limited — purge oldest sessions to stay under 500 MB without touching recent runs.
    copy

    $ nono audit cleanup --max-total-size 500

    Grant a sandboxed git command access to its fsmonitor socket without giving the agent-level sandbox the same socket bind rights.
    json copy

    {
      "command_policies": {
        "commands": {
          "git": {
            "from": {
              "session": {
                "sandbox": {
                  "fs_read": ["."],
                  "unix_socket_bind": ["/tmp/git-fsmonitor.sock"]
                }
              }
            }
          }
        }
      }
    }

    • Adds --max-total-size <MB> flag to nono audit cleanup to evict oldest sessions until total audit storage falls below a specified megabyte threshold.
    • Adds unix_socket_bind field to CommandSandboxConfig in tool-sandbox profiles, allowing per-command Unix domain socket grants (e.g. Git fsmonitor socket) without widening the agent-level sandbox.
    • Adds Nix flake support, enabling nix run github:nolabs-ai/nono and nix profile add github:nolabs-ai/nono installs without Homebrew or the install script.

    3 details in Everything

16. docs update Sep 8, 2026 · issue 068

    nono Tool Sandbox gains unix_socket_bindunix_socket_bindA system call that assigns a filesystem path or abstract name to a Unix domain socket, letting processes on the same host find and connect to it without using a network port. grants, @git:fsmonitor-socket token, and macOS per-session isolation for mediated commands

    └──▷ USE IT
    Allow a sandboxed build tool to bind and connect to a local sccache socket stored under $XDG_RUNTIME_DIR.
    yaml copy

    unix_socket_bind:
      - "$XDG_RUNTIME_DIR/sccache.sock"

    Let a sandboxed git-aware tool reach the fsmonitor daemon socket for the current worktree without granting broad filesystem access.
    yaml copy

    unix_socket_bind:
      - "@git:fsmonitor-socket"

    • Adds unix_socket_bind grant type to tool sandbox policy, accepting a path array to allow connect(2) and bind(2) on named AF_UNIX socket files, with implied ReadWrite filesystem grants on the socket file or its parent directory.
    • Adds @git:fsmonitor-socket dynamic path token that resolves to fsmonitor--daemon.ipc under the current worktree's private git-dir without spawning a process, enabling core.fsmonitor=true to reach its daemon socket inside a sandbox.
    • On macOS, every mediated command now runs in its own POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. session (setsid before exec), making session membership an unforgeable proof of descent for orphaned child processes.
    • Supports environment-variable expansion in path values (e.g. $XDG_RUNTIME_DIR/sccache.sock), with a named-variable error at launch if the variable is unset.
    • Adds unix_socket_bind grant type to tool sandbox policy, accepting a path array to allow connect(2) and bind(2) on named AF_UNIX socket files, with implied ReadWrite filesystem grants on the socket file or its parent directory.
    • Adds @git:fsmonitor-socket dynamic path token that resolves to fsmonitor--daemon.ipc under the current worktree's private git-dir without spawning a process, enabling core.fsmonitor=true to reach its daemon socket inside a sandbox.
    • On macOS, every mediated command now runs in its own POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. session (setsid before exec), making session membership an unforgeable proof of descent for orphaned child processes.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !On macOS, mediated commands no longer have a controlling terminal: open("/dev/tty") fails with ENXIO, and TIOCSCTTY is refused — tools that prompt for passphrases or use a terminal credential helper directly will fail instead of prompting; supply credentials via environment, an askpass helper, or an agent socket.
17. v0.75.0 Sep 1, 2026 · issue 061

    nono v0.75.0 adds --extends to nono proxy, glob allow/deny patterns, --strict-broker-path, and resolved command_policies in profile show

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.75.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.75.0

    └──▷ TRY IT
    Compose an extra-domains profile on top of an existing proxy profile at runtime — useful when a specific session needs additional allow-listed hosts without permanently editing the base profile.
    copy

    $ nono proxy -p default --extends extra-domains

    Harden a sandbox so it refuses to start if any filesystem grant overlaps a PATH directory — catch planted-binary risk in CI before the agent runs.
    copy

    $ nono run --profile nolabs-ai/opencode --strict-broker-path -- opencode

    Shape a phantom credential token so a prefix-sniffing client (e.g. an Anthropic SDK checking for sk-ant-) still recognises it as valid while nono brokers the real secret.
    json copy

    {
      "command_policies": {
        "credentials": {
          "claude-key": {
            "type": "ambient",
            "env_var": "ANTHROPIC_API_KEY",
            "format": "sk-ant-oat01-{}"
          }
        }
      }
    }

    • Adds --extends <PROFILE> to nono proxy, enabling the same repeatable profile-composition semantics already available on nono run — requires --profile to be set.
    • Adds --strict-broker-path flag to sandbox args: refuses to start instead of warning when a filesystem grant overlaps a directory on PATH, blocking planted-binary attacks on host processes outside the sandbox.
    • Adds glob pattern support for env var and hostname allow/deny lists in profile and proxy network configuration.
    • Adds a format field to CommandCredentialConfig for ambient credentials: a literal template (e.g. sk-ant-oat01-{}) that shapes the visible phantom token so prefix-sniffing clients recognise it.
    • Sanitizes PATH for host-side credential and URL brokers, preventing bare-name binary resolution from grants that overlap PATH directories.

    +1 more show less

    • Ships an initial set of tool sandbox examples demonstrating command_policies configurations.

    6 details in Everything

18. docs update Aug 31, 2026 · issue 060

    nono adds deny_domain config key and --deny-domain CLI flag with three wildcard forms for precise host blocking.

    └──▷ USE IT
    Block ad-serving subdomains as an exception inside a broad allow rule, using the deny_domain config key.
    yaml copy

    deny_domain:
      - "*.ads.example.com"
      - "jenkins.*.ci.example.com"

    Block a specific subdomain pattern at the CLI without modifying the profile file.
    copy

    $ nono --deny-domain '*.ads.example.com'

    • Adds deny_domain config key to block specific hosts through the proxy before the allowlist is checked, letting it carve exceptions out of broad network profile entries.
    • Adds --deny-domain CLI flag as the command-line equivalent of the deny_domain config key.
    • Supports three wildcard forms in deny_domain entries: a bare * matches any host; a leading * (e.g. *.example.com) matches one or more subdomain labels but not the apex; and a * occupying a whole label elsewhere (e.g. jenkins.*.ci.example.com) matches exactly one label at that position.
    • deny_domain is additive across profile inheritance and is evaluated before the allowlist, so it can override broad network_profile entries.
    • Invalid wildcard patterns — where * occupies only part of a label (e.g. foo*bar.com) or a leading * is combined with another * elsewhere — are rejected at profile load time rather than silently matching nothing.

    5 details in Everything

19. docs update Aug 31, 2026 · issue 060

    nono CLI gains wildcard pattern matching and case-insensitive variable filtering for environment profiles

    └──▷ USE IT
    Allow only AWS session tokens and any var ending in _TOKEN into a sandboxed run, blocking everything else.
    yaml copy

    allow_vars:
      - "AWS_*_SESSION"
      - "*_TOKEN"

    Enable case-insensitive variable matching so patterns work regardless of casing conventions across different CI environments.
    yaml copy

    case_insensitive_vars: true
    allow_vars:
      - "gh_token"
      - "*_secret"

    • Adds * wildcard support anywhere in environment variable patterns (leading, trailing, or middle) within profile config, matching any run of characters — e.g. *_TOKEN, AWS_*_SESSION, *SECRET*.
    • Adds case_insensitive_vars: true config key to match variable names and patterns case-insensitively (ASCII only), so a pattern like gh_token also matches GH_TOKEN, Gh_Token, etc.
    • case_insensitive_vars is sticky across extends: once a base profile sets it to true, child profiles cannot silently revert it.
    • Patterns without * require an exact full-name match, reducing risk of accidental over-permission.
    • Malformed patterns (empty string or containing a NUL byte) are now rejected at profile load time rather than silently ignored at runtime.

    5 details in Everything

20. docs update Aug 31, 2026 · issue 060

    nono ambient credentials gain a format field to shape phantom token prefixes for picky clients

    └──▷ USE IT
    Ensure a phantom issued for an Anthropic OAuth ambient credential carries the expected sk-ant-oat01- prefix so the consuming client accepts it without extra configuration.
    yaml copy

    format: "sk-ant-oat01-{}"

    • Adds a format field to ambient credential declarations, accepting a literal template with exactly one {} placeholder (e.g. "sk-ant-oat01-{}"), so phantoms are issued with a recognizable prefix instead of a bare token — the template is stripped on egress so the real credential is never exposed upstream.
    • format is rejected on non-ambient credentials, when the value contains control characters, or when the minting rule also sets shape: "jwt".

    2 details in Everything

21. v0.74.0 Aug 19, 2026 · issue 050

    nono v0.74.0 adds remote session connect/ps, subtool audit surfacing, export_env pass-through, and configurable approval backends

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.74.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.74.0

    └──▷ TRY IT
    List all live and exited sessions running on the enrolled tenant's nono-console — useful for incident triage across a team.
    copy

    $ nono ps --remote --all --json

    Attach your terminal directly to a known remote session by its global session ID.
    copy

    $ nono connect local:host:abc123

    • Adds nono connect subcommand to attach this terminal to a session hosted by nono-console; accepts a session ID (e.g. local:host:abc123) or URL directly.
    • Extends nono ps with --remote flag to list sessions hosted by the enrolled tenant's nono-console, combinable with --all and --json.
    • Adds export_env field to tool-sandbox CommandPolicyConfig and top-level session_export_env list in CommandPoliciesConfig, letting callers explicitly pass named env vars (exact names, trailing-* prefixes, or bare *) through to child processes, bypassing the dangerous-var blocklist.
    • Adds configurable approval backend for supervised-mode prompts via approval_backends in the profile, letting operators route capability-approval decisions to different backends.

    4 details in Everything

22. v0.73.0 Aug 10, 2026 · issue 042

    nono v0.73.0 adds glob pattern support in filesystem path fields for more flexible sandbox policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.73.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.73.0

    • Supports glob patterns in filesystem path fields (e.g. fs_read, fs_write) within profiles, enabling wildcard-based filesystem access rules in sandbox policies.

    1 detail in Everything

23. v0.72.0 Aug 7, 2026 · issue 039

    nono v0.72.0 adds static seccomp network baseline on Linux, explicit deny-path reporting in why, and drops openclaw/swival built-in profiles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.72.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.72.0

    • The why subcommand now reports explicit deny paths from the sandbox policy, making it easier to diagnose why a network or filesystem access was blocked.
    • Removes openclaw and swival as built-in profiles; users relying on them must pull the equivalent packages from the registry.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The openclaw and swival built-in profiles have been removed; any setup using them will break on upgrade until the equivalent profiles are pulled from the registry.
    • !The external --sandbox-policy mode on Linux no longer disables all nono sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls.: Landlock still handles filesystem/process policy, and only TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. enforcement is delegated externally. Configurations that relied on external bypassing Landlock will behave differently.
24. v0.71.0 Jul 31, 2026 · issue 031

    nono v0.71.0 adds a new platform subcommand for enrollment and audit delivery to a control plane.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.71.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.71.0

    └──▷ BREAKING ON UPGRADE

    • !The nono learn command has been removed; it was deprecated since v0.50.1.
25. v0.70.0 Jul 29, 2026 · issue 029

    nono v0.70.0 adds SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials./SPIRE workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials., per-route rate limiting, Vault OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. mediation, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-shaped capture nonces, and profile-declared no_proxy bypass.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.70.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.70.0

    • Adds SPIFFE/SPIRE workload identity authentication for upstream proxy routes, enabling zero-trust service-to-service auth without static credentials.
    • Adds per-route request rate limiting via RouteRateLimiter, letting profiles cap how many requests a sandboxed tool can make to a given upstream.
    • Adds support for mediating vault login -method=oidc, including a custom inject header and per-command open_port to handle the OIDC browser callback.
    • Adds a JWT-shaped nonce option (CapturedNonceShape::Jwt) for capture intercepts, producing a <header>.<payload>.nono_<64hex> token for consumers that validate token structure before use.
    • Adds profile-declared no_proxy bypass support, allowing profiles to specify hosts that skip the nono proxy.

    +1 more show less

    • Offers to save denied open-URL origins on session exit, streamlining iterative policy development.

    6 details in Everything

26. v0.69.0 Jul 20, 2026 · issue 023

    nono v0.69.0 adds SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials./SPIRE workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. auth for upstream proxy routes and profile-declared no_proxy bypass support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.69.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.69.0

    └──▷ USE IT
    Bypass the nono proxy for internal hosts (e.g. a local Redis or internal registry) that should be reached directly.
    json copy

    {
      "no_proxy": ["redis", "registry.internal"]
    }

    • Adds SPIFFE/SPIRE workload identity authentication for upstream proxy routes, supporting both JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. bearer injection and OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. client assertion (RFC 7523RFC 7523An IETF standard that defines how a JSON Web Token (JWT) can be used as a credential to request an OAuth 2.0 access token, letting a cyber tool authenticate to an API without exchanging a username and password at runtime.) flows; all flows are fail-closed if the SPIRE socket is unreachable.
    • Adds profile-declared no_proxy bypass support, letting profiles specify hosts that skip the nono proxy.

    2 details in Everything

27. v0.68.0 Jul 14, 2026 · issue 015

    nono v0.68.0 adds process-count caps, port ranges, per-OS profile overrides, domain blocking, plain HTTP proxy support, and bun/mise policy presets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.68.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.68.0

    └──▷ USE IT
    Block a known data-exfiltration domain at the proxy layer for all traffic through a sandboxed agent.
    json copy

    {
      "deny_domain": ["exfil.example.com"]
    }

    Apply different filesystem grants on macOS vs Linux within a single shared profile using platform_overrides.
    json copy

    {
      "platform_overrides": {
        "macos": {
          "fs_read": ["/opt/homebrew"]
        },
        "linux": {
          "fs_read": ["/usr/local"]
        }
      }
    }

    • Adds --max-processes flag to cap the number of processes a sandbox may spawn (enforced via cgroup v2 pids.max).
    • Adds port range support to sandbox profiles, enabling network rules that span a range of ports rather than individual ports.
    • Adds platform_overrides field to profiles for per-OS patch sets, letting a single profile express different rules on macOS vs Linux.
    • Adds deny_domain proxy configuration to explicitly block specific domains through the proxy.
    • Adds exec_paths per-command tool-sandbox setting to support multi-call binaries (e.g. busybox-style) that need access to multiple executable paths.

    +3 more show less

    • Supports plain HTTP forward-proxying via the HTTP_PROXY environment variable.
    • Adds built-in bun runtime policy preset for sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. Bun-based agents.
    • Adds built-in mise policy preset for sandboxing mise-based tool workflows.

    8 details in Everything

28. v0.67.0 Jul 6, 2026 · issue 014

    nono v0.67.0 adds a standalone proxy command, AWS SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. MitM auth, declarative OAuth capture, resource limiting, exec intercept, and richer sandbox token expansion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.67.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.67.0

    └──▷ TRY IT
    Run the credential/filtering proxy on a fixed port with a specific domain allowlist — useful when an agent or CI job needs a pre-started proxy to route through.
    copy

    $ nono proxy --port 8080 --allow-domain api.github.com

    Extend a community registry profile locally so you can add custom rules without forking the upstream profile.
    copy

    $ nono profile init opencode --extends always-further/opencode

    Start a loopback proxy with no token auth for local development or testing pipelines that don't require authentication.
    copy

    $ nono proxy --port 8080 --no-auth

    • Adds nono proxy standalone command to run the network-filtering and credential-injection proxy as an independent server, with options for fixed port, no-auth mode, and domain allowlisting.
    • Implements AWS SigV4 authentication for the MitM proxy, enabling signed AWS API request interception and credential injection.
    • Adds declarative sandboxed OAuth capture, allowing profiles to define OAuth flows without manual credential handling.
    • Introduces resource limiting support in sandbox profiles.
    • Adds exec intercept action for tool-sandbox command policies, enabling a helper binary to replace a matched command's real binary inside the existing sandbox.

    +5 more show less

    • Supports per-intercept sandbox overrides and per-command unsafe_macos_seatbelt_rules escape hatch in tool-sandbox policies.
    • Supports CLI profile extends inheritance, letting a local profile compose on top of a registry base profile.
    • Expands $VAR tokens from the process environment in profile filesystem paths and capture commands.
    • Expands @git:* dynamic tokens in top-level filesystem paths, including new git worktree tokens.
    • Enables NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. 570+ thread naming in sandbox mediation.

    10 details in Everything

29. v0.66.0 Jun 29, 2026 · issue 014

    nono v0.66.0 adds HTTP/2 proxy support, a @git:common-dir dynamic token, and a simplified self-invocation policy for tool sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.66.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.66.0

    └──▷ TRY IT
    Enable HTTP/2 multiplexing when running an agent that makes many concurrent requests through the credential proxy (e.g., Maven/Gradle artifact downloads) to improve throughput.
    copy

    $ nono run --profile always-further/opencode --allow-http2 -- opencode

    • Adds --allow-http2 flag to enable HTTP/2 multiplexing (via ALPN) for reverse proxy and credential injection upstream connections.
    • Adds @git:common-dir dynamic token for tool-sandbox profiles, allowing policies to reference the Git common directory at runtime.
    • Simplifies self-invocation policy for sandboxed tools, reducing boilerplate needed when a tool is permitted to call itself.

    3 details in Everything

30. v0.65.0 Jun 23, 2026 · release notes

    nono v0.65.0 introduces a tool sandbox for isolating tool execution environments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.65.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.65.0

    • Adds a tool sandbox capability to isolate tool execution at runtime.

    1 detail in Everything

31. v0.65.0 Jun 23, 2026 · issue 014

    nono v0.65.0 introduces tool sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., giving delegated tools their own isolated child sandboxes with separate filesystem, network, and credential policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.65.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.65.0

    └──▷ TRY IT
    Restrict gh so the agent can only list and view issues — not comment — and inject a credential-proxied GitHub token scoped to those API paths only.
    copy

    $ nono run --profile opencode -- opencode

    Diagnose why the tool sandbox blocked a gh issue comment invocation — useful when tuning command_policies argv allow-lists.
    copy

    $ nono why --profile gh --command gh -- issue comment 1052

    Define a tool sandbox policy in your profile that scopes gh to read-only issue access with a proxied credential and an L7 endpoint allow-list.
    json copy

    {
      "command_policies": {
        "credentials": {
          "github-api": {
            "type": "proxy",
            "upstream": "https://api.github.com",
            "credential_key": "keyring://gh:github.com/example?decode=go-keyring",
            "env_var": "GH_TOKEN",
            "inject_header": "Authorization",
            "credential_format": "Bearer {}"
          }
        },
        "commands": {
          "gh": {
            "from": {
              "session": {
                "sandbox": {
                  "fs_read": ["."],
                  "credentials": [
                    {
                      "name": "github-api",
                      "endpoint_policy": {
                        "default": "deny",
                        "allow": [
                          { "method": "GET", "path": "/repos/nolabs-ai/nono/issues/**" }
                        ]
                      }
                    }
                  ]
                },
                "invocation_policy": {
                  "default": "deny",
                  "allow": [
                    { "argv": { "prefix": ["issue", "list"] } },
                    { "argv": { "prefix": ["issue", "view"] } }
                  ]
                }
              }
            }
          }
        }
      }
    }

    • Adds tool sandbox (ETI): delegated tools such as git, gh, and curl now run in isolated child sandboxes with their own fs_read/fs_write, network rules, credential grants, and argv invocation policies — independent of the agent's session sandbox.
    • Enables per-tool credential proxy injection via command_policies.credentials, letting profiles expose a proxied token to a specific tool (e.g. gh) while enforcing L7 endpoint and HTTP-method allow-lists on that token.
    • Extends nono why to diagnose tool-sandbox argv policy denials via --command <cmd> -- <args…>, in addition to its existing filesystem and network queries.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Custom credentials now require explicit activation; previously working custom credential configurations will no longer function without being explicitly activated.
32. v0.64.0 Jun 18, 2026 · release notes

    nono v0.64.0 adds AWS auth config, macOS blocked-grant visibility, CI environment detection, and structured diagnostics for library/FFI clients.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.64.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.64.0

    └──▷ USE IT
    Authenticate outbound AWS API calls through the nono proxy without managing credentials manually.
    yaml copy

    # In your nono profile config
    aws_auth:
      enabled: true

    • New aws_auth config block enables AWS authentication support in the proxy.
    • Capability summary now shows blocked macOS grants, giving practitioners a clear view of denied sandbox permissions.
    • Update-check now detects CI environments automatically, suppressing irrelevant update prompts in pipelines.
    • Structured diagnostics exposed via library and FFI interfaces, enabling programmatic access to diagnostic output.

    4 details in Everything

33. v0.64.0 Jun 18, 2026 · issue 014

    nono v0.64.0 adds AWS auth config, structured diagnostics JSON output, CI environment detection, and macOS blocked-grants visibility.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.64.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.64.0

    └──▷ TRY IT
    Capture machine-readable session diagnostics after a run to feed into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or audit pipeline.
    copy

    $ nono run --profile always-further/opencode --diagnostics-json -- opencode 2>session-diagnostics.json

    • Adds aws_auth config support, enabling native AWS credential handling in agent sandbox profiles.
    • New --diagnostics-json flag on nono run emits structured session diagnostics as JSON on stderr, including proxy diagnostics when present.
    • Update-check now detects CI environments, suppressing spurious upgrade prompts in automated pipelines.
    • Capability summary now surfaces blocked macOS grants, giving practitioners a clearer view of what the sandbox is denying on macOS.
    • Exposes structured diagnostics for library and FFI clients, enabling programmatic access to session diagnostic data from Rust, Python, TypeScript, and Go bindings.

    5 details in Everything

34. v0.63.0 Jun 15, 2026 · release notes

    nono v0.63.0 adds static env injection, keyring timeout control, $PACK_DIR in session hooks, and XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. state dir migration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.63.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.63.0

    └──▷ TRY IT
    Prevent keychain prompts from hanging indefinitely in automated pipelines by capping how long nono waits for keyring access.
    copy

    $ NONO_KEYRING_TIMEOUT_SECS=10 nono run -- <command>

    • Adds set_vars for static environment variable injection into sandboxed sessions.
    • Adds NONO_KEYRING_TIMEOUT_SECS environment variable to control keychain access timeout.
    • Adds $PACK_DIR variable support in session hooks, enabling store pack workflows.
    • Moves runtime state to XDG state directories for cleaner system integration.

    4 details in Everything

35. v0.63.0 Jun 15, 2026 · issue 014

    nono v0.63.0 adds static env injection, keyring timeout control, $PACK_DIR in session hooks, and XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. state dir support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.63.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.63.0

    └──▷ TRY IT
    Inject a fixed environment variable into every sandboxed session — useful for pinning model names or feature flags without leaking them through the host environment.
    copy

    $ nono run --profile always-further/opencode -- opencode

    Prevent indefinite hangs when the system keyring is locked or unavailable — useful in headless CI environments where keychain prompts never appear.
    copy

    $ NONO_KEYRING_TIMEOUT_SECS=5 nono run --profile always-further/opencode -- opencode

    • Adds set_vars profile field for static environment variable injection into sandboxed sessions — set fixed env values without exposing them through the agent's environment.
    • Adds NONO_KEYRING_TIMEOUT_SECS environment variable to control how long nono waits for keychain/keyring access before timing out.
    • Adds $PACK_DIR expansion support in session_hooks, enabling hooks to reference the store pack directory for pack-aware scripts.
    • Moves CLI runtime state to XDG state directories, aligning with the XDG Base Directory specification for cleaner system integration.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Runtime state is moved to XDG state directories (feat(cli): move runtime state to XDG state dirs), which may break setups that reference the previous runtime state paths.
36. v0.61.1 Jun 2, 2026 · release notes

    nono v0.61.1 lets profiles extend from registry references, enabling shared policy inheritance across repos.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.61.1 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.61.1

    • Supports registry references in profile extends fields, enabling profiles to inherit from centrally-managed registry entries.

    1 detail in Everything

37. v0.61.0 Jun 2, 2026 · release notes

    nono v0.61.0 adds a profile option to suppress system service diagnostics output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.61.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.61.0

    └──▷ BREAKING ON UPGRADE

    • !Credentials are no longer enabled by default in network-policy profiles; existing profiles that relied on credentials being enabled by default will need to explicitly enable them.
38. v0.60.0 Jun 1, 2026 · release notes

    nono v0.60.0 adds interactive denied-path selection, fine-grained allow_domain controls, configurable timeouts, and macOS CA trust-store integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.60.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.60.0

    └──▷ TRY IT
    Trust your corporate proxy CA via the macOS system keychain so nono doesn't reject intercepted TLS traffic.
    copy

    $ nono run --trust-proxy-ca <target>

    • New interactive denied path selector lets users pick and allow blocked paths without manually editing config.
    • Supports fine-grained method+path restrictions inside allow_domain rules for tighter egress control.
    • New --trust-proxy-ca flag integrates with the macOS system trust store for proxy CA validation.
    • User-facing timeouts are now configurable via centralized timeout constants.
    • Supports JSONC (JSON with comments) in wiring directives.

    +3 more show less

    • Annotates suppressed denials in output and styles save-prompt paths for clearer audit visibility.
    • Removes libdbus dependency on Linux, simplifying deployment on minimal systems.
    • RPM release artifacts now available for Red Hat-based distributions.

    8 details in Everything

39. v0.59.0 May 27, 2026 · release notes

    nono v0.59.0 adds suppressed-denial annotations, configurable timeouts, and fine-grained method+path allow_domain restrictions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.59.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.59.0

    • Annotates suppressed denials in output and styles save-prompt paths for clearer audit visibility.
    • Makes user-facing timeouts configurable via centralized timeout constants instead of hard-coded values.
    • Supports fine-grained HTTP method+path restrictions inside allow_domain rules, enabling per-endpoint allowlisting.

    3 details in Everything

40. v0.58.0 May 26, 2026 · release notes

    nono v0.58.0 adds JSONC profile support, per-profile target binary, Bitwarden credential source, session lifecycle hooks, and a java-dev profile.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.58.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.58.0

    └──▷ TRY IT
    Use JSONC so you can annotate policy decisions directly in a profile file with inline comments.
    copy

    $ # myapp.jsonc
    {
      // Allow outbound HTTPS to internal API only
      "allow": ["net:api.internal:443"]
    }

    • Supports JSONC (JSON with comments) syntax in profile files for easier annotation of policy configs.
    • Allows profiles to specify a target binary directly, scoping a profile to a particular executable.
    • Adds Bitwarden credential source via the bw:// URI scheme for secret resolution.
    • Introduces session lifecycle hooks to run commands or scripts at session start and end.
    • Adds a java_runtime policy group and a java-dev built-in profile for sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. Java workloads.

    5 details in Everything

41. v0.57.0 May 20, 2026 · release notes

    nono v0.57.0 expands shadowing checks to cover pack profiles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.57.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.57.0

    • Extends shadowing checks to include pack profiles, broadening detection coverage.

    1 detail in Everything

42. v0.56.0 May 18, 2026 · release notes

    nono v0.56.0 adds a configurable process startup timeout option to the CLI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.56.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.56.0

43. v0.55.0 May 17, 2026 · release notes

    nono v0.55.0 adds AF_UNIX socket sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., Landlock v6 support, and profile signer verification.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.55.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.55.0

    • Adds Landlock v6 signal support and abstract Unix socket scoping on Linux.
    • Adds recursive Unix socket directory grants via the CLI.
    • Adds an explicit allowlist for pathname AF_UNIX sockets in the sandbox.
    • Implements AF_UNIX pathname mediation on Linux for fine-grained socket access control.
    • Verifies pack signer identities when pulling profiles and supports org/repo pull format.

    +1 more show less

    • On macOS, treats open_port 0 as a wildcard grant for all localhost outbound connections.

    6 details in Everything

44. advisory CVE-2026-47128 May 17, 2026 · issue 128
    • CVE-2026-47128: nono: Sandbox escape on Linux via D-Bus: systemd-run --user (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects < 0.55.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
45. v0.54.0 May 13, 2026 · release notes

    nono v0.54.0 adds platform-conditional profile fields and package update, pinning, and outdated commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.54.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.54.0

    • Adds platform-conditional profile fields, enabling profiles to specify different settings per platform.
    • Adds package update, package pinning, and package outdated subcommands for managing package lifecycle.

    2 details in Everything

46. v0.53.0 May 11, 2026 · release notes

    nono v0.53.0 adds upstream TLS trust, auth interception, multi-route dispatch, and secret scrubbing from command arguments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.53.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.53.0

    • Supports upstream TLS trust configuration for secure proxy connections.
    • Adds interception of authentication flows in proxied requests.
    • Enables multi-route dispatch for routing traffic across multiple upstream targets.

    3 details in Everything

47. v0.52.2 May 11, 2026 · release notes

    nono v0.52.2 suppresses save-profile prompts for denied paths

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.52.2 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.52.2

48. v0.52.0 May 10, 2026 · release notes

    nono v0.52.0 adds operator-controlled variable denylisting and improved CLI diagnostics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.52.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.52.0

    • Adds deny_vars field to EnvironmentConfig, letting operators block specific environment variables from being used.
    • Improves diagnostics output in the CLI for better troubleshooting visibility.

    2 details in Everything

49. v0.51.0 May 9, 2026 · release notes

    nono v0.51.0 adds TLS interception for L7-bearing CONNECT routes in proxy mode.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.51.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.51.0

50. v0.50.0 May 8, 2026 · release notes

    nono v0.50.0 adds env:// URI support for credential keys in custom credential profiles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.50.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.50.0

    └──▷ USE IT
    Pull a credential value from an environment variable instead of hardcoding it in a profile config.
    yaml copy

    credential_key: env://MY_SECRET_TOKEN

    • Supports env:// URI scheme in custom_credentials credential_key fields, enabling secrets to be sourced from environment variables in profiles.

    1 detail in Everything

51. v0.49.0 May 7, 2026 · release notes

    nono v0.49.0 adds a yaml_merge directive to the wiring system.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.49.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.49.0

52. v0.48.0 May 7, 2026 · release notes

    nono v0.48.0 adds shell completion generation via nono completion <shell>

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.48.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.48.0

    └──▷ TRY IT
    Set up tab completion for nono in your shell so you can autocomplete subcommands and flags.
    copy

    $ nono completion bash >> ~/.bashrc && source ~/.bashrc

53. v0.47.1 May 6, 2026 · release notes

    Adds profile subcommands to manage drafts and check package status.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.47.1 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.47.1

54. v0.47.0 May 5, 2026 · release notes

    nono v0.47.0 restructures the profile JSON schema (phase 2 breaking change).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.47.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.47.0

    └──▷ BREAKING ON UPGRADE

    • !The profile JSON schema has been restructured (feat(profile)!): existing tooling or scripts that parse or produce profile JSON will need to be updated to match the new schema shape.
55. v0.46.0 May 1, 2026 · release notes

    nono v0.46.0 adds GitLab domain support to the developer network policy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.46.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.46.0

56. v0.45.0 Apr 30, 2026 · release notes

    nono v0.45.0 adds native TLS root certificate support for improved PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.45.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.45.0

    • Supports native TLS root certificates, enabling use of system or enterprise CA stores instead of bundled roots.

    1 detail in Everything

57. v0.44.0 Apr 29, 2026 · release notes

    nono v0.44.0 moves built-in profiles to the package and adds a Claude prompt to clean up old built-in hooks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.44.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.44.0

    • Migrates inbuilt profiles to the package, consolidating profile management.
    • Adds a Claude prompt to remove old built-in hooks, simplifying hook cleanup.

    2 details in Everything

58. v0.43.0 Apr 28, 2026 · release notes

    nono v0.43.0 adds outbound TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port allowlisting and optional system keyring for headless/container builds.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.43.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.43.0

    └──▷ TRY IT
    Restrict a process to only make outbound TCP connections on specific ports (e.g., 443 and 8080) — useful for locking down egress in a sandboxed environment.
    copy

    $ nono --allow-connect-port 443 --allow-connect-port 8080 -- <your-command>

    • Adds --allow-connect-port flag for outbound TCP port allowlisting.
    • Makes system keyring optional, enabling headless and container deployments.

    2 details in Everything

59. v0.42.0 Apr 25, 2026 · release notes

    nono v0.42.0 adds Unix domain socket allow-listing via a new --allow-unix-socket flag family.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.42.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.42.0

    └──▷ TRY IT
    Permit a process to communicate over a specific Unix domain socket while keeping all other traffic subject to normal policy.
    copy

    $ nono --allow-unix-socket /var/run/docker.sock -- my-container-tool

60. v0.41.0 Apr 24, 2026 · release notes

    nono v0.41.0 enhances denial diagnostics, consolidates policy under profile, and preserves terminal scrollback on attach.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.41.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.41.0

    • Enhances prompts and denial diagnostics to surface clearer context when a policy blocks an action.
    • Consolidates nono policy subcommand under nono profile, with nono policy retained as a deprecation alias.
    • Preserves outer terminal scrollback buffer when attaching to a PTY session.

    3 details in Everything

61. v0.40.1 Apr 23, 2026 · release notes

    nono v0.40.1 adds Code URL Handler read path and improves unlink rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.40.1 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.40.1

    • Improves unlink rule logic

    1 detail in Everything

62. v0.40.0 Apr 23, 2026 · release notes

    nono v0.40.0 adds signed audit trails with Merkle roots, HTTP upstream reverse-proxy support, and a macOS seatbelt profile field.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.40.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.40.0

    └──▷ USE IT
    Apply a custom macOS seatbelt sandbox profile to tighten or loosen OS-level restrictions for a specific nono policy.
    yaml copy

    # In your nono policy file:
    unsafe_macos_seatbelt_rules: |
      (allow file-read* (subpath "/usr/local/share"))
      (deny network*)

    • Captures pre- and post-operation Merkle roots in the audit trail and introduces audit signing for tamper-evident records.
    • Adds HTTP upstream support to the built-in reverse proxy.
    • New unsafe_macos_seatbelt_rules profile field lets operators supply custom macOS sandbox (seatbelt) rules.

    3 details in Everything

63. v0.39.0 Apr 21, 2026 · release notes

    nono v0.39.0 adds OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. client-credentials token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. with caching and a no-keychain Claude profile.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.39.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.39.0

    • Adds OAuth2 client-credentials token exchange with caching to the proxy, enabling automated service-to-service authentication flows.
    • Adds a no-keychain profile for Claude and expands existing Claude access controls.

    2 details in Everything

64. v0.38.0 Apr 20, 2026 · release notes

    nono v0.38.0 adds package management commands, environment variable filtering, and GitLab keyless identity improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.38.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    └──▷ TRY IT
    Search for and install a nono package without leaving the CLI.
    copy

    $ nono search <package> && nono pull <package>

    List installed packages or remove one that is no longer needed.
    copy

    $ nono list
    nono remove <package>

    • Adds package management subcommands (pull, remove, search, list) for managing nono packages from the CLI.
    • Adds environment variable filtering to control which variables are exposed in sandboxed environments.
    • Prefers CI_CONFIG_REF_URI for GitLab keyless workflow identity in trust verification.
    • Prints profile JSON to stdout as a fallback when saving a learned profile fails, preserving the output.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The claude-code integration package has been removed (feat(claude-code): remove claude-code integration package).
65. v0.37.1 Apr 17, 2026 · release notes

    nono v0.37.1 adds profile JSON fallback output when saving a learned profile fails.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.37.1 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.37.1

66. v0.36.0 Apr 15, 2026 · release notes

    nono v0.36.0 adds keyring:// URI scheme for custom-service credential lookup.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.36.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.36.0

67. v0.35.0 Apr 14, 2026 · release notes

    nono v0.35.0 adds GitLab ID token support for attestation and improved proxy artifact handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.35.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.35.0

    • Supports GitLab ID tokens for trust attestation workflows.
    • Strips proxy artifacts and improves upstream connection handling.

    2 details in Everything

68. v0.34.0 Apr 13, 2026 · release notes

    nono v0.34.0 adds separate optional proxy settings and auto-enables Claude launch services on macOS.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.34.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.34.0

    • Adds separate, optional proxy settings so proxy configuration can be specified independently of other network options.
    • Auto-enables Claude launch services on macOS and refines keychain access and login flow.

    2 details in Everything

69. v0.33.0 Apr 12, 2026 · release notes

    nono v0.33.0 adds Linux/WSL2WSL2A Microsoft-maintained compatibility layer in Windows 10/11 that runs a real Linux kernel inside a lightweight VM, letting cyber tools built for Linux execute natively on Windows without dual-booting or a full VM. GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. access via --allow-gpu, a pre-flight CWD prompt for detached launches, and opt-in parent-of-protected-root relaxation on macOS.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.33.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.33.0

    └──▷ TRY IT
    Grant a sandboxed process access to the GPU on Linux or WSL2 without opening up the full host.
    copy

    $ nono run --allow-gpu <your-gpu-workload>

    • Adds --allow-gpu flag to enable Linux and WSL2 GPU access from sandboxed processes.
    • Introduces a pre-flight CWD prompt for detached launches, surfacing working directory context before execution begins.
    • Makes parent-of-protected-root filesystem relaxation opt-in via profile on macOS, replacing the previous always-on behavior.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The parent-of-protected-root relaxation on macOS is now opt-in via profile; setups that relied on this being enabled by default will no longer receive it without explicitly opting in.
70. v0.32.0 Apr 10, 2026 · release notes

    nono v0.32.0 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client certificate support for upstream connections.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.32.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.32.0

    • Supports mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS) client certificates for upstream connections, enabling authenticated encryption to backend services.

    1 detail in Everything

71. v0.31.0 Apr 10, 2026 · release notes

    nono v0.31.0 adds a file:// trust-key backend and --allow-gpu flag for Apple Silicon GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. access.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.31.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.31.0

    └──▷ TRY IT
    Grant a sandboxed workload access to the Apple Silicon GPU without disabling the sandbox entirely.
    copy

    $ nono run --allow-gpu <target>

    • Adds file:// backend for trust signing keys, enabling local file-based key storage for trust verification.
    • Adds --allow-gpu flag to grant sandboxed processes GPU access on Apple Silicon Macs.

    2 details in Everything

72. v0.30.0 Apr 8, 2026 · release notes

    nono v0.30.0 adds a files field for attesting arbitrary-location paths and improves NixOS compatibility.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.30.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.30.0

    └──▷ USE IT
    Attest a file outside standard locations by declaring it under the new files field in your trust config.
    yaml copy

    # In your nono trust config:
    files:
      - /opt/custom/binary
      - /usr/local/share/myapp/config.toml

    • Adds files field in trust attestation config for attesting arbitrary-location file paths.
    • Improves NixOS compatibility with /nix/store path support.

    2 details in Everything

73. v0.29.0 Apr 3, 2026 · release notes

    nono v0.29.0 adds runtime and multiplexing session support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.29.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.29.0

74. v0.28.0 Apr 3, 2026 · release notes

    nono v0.28.0 adds custom CA certificate support for upstream TLS and smarter platform-specific policy handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.28.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.28.0

    └──▷ USE IT
    Route nono's proxy through a corporate or internal CA by supplying your own certificate — useful when intercepting TLS in enterprise environments.
    yaml copy

    tls_ca: /path/to/corporate-ca.crt
    tls_connector: custom

    • Supports custom CA certificates for upstream TLS connections via new tls_ca and tls_connector fields in credential/proxy config.
    • Splits the Homebrew policy group into platform-specific variants for more precise sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..
    • Skips system temp grants automatically when HOME is nested under TMPDIR, reducing over-permissive policies.
    • Expands recognized git config paths in policy rules.

    4 details in Everything

75. v0.27.0 Apr 2, 2026 · release notes

    nono v0.27.0 adds file-based credential sources, schema-first capability manifests, and smarter proxy tunnel blocking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.27.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.27.0

    • Adds file:// credential source support in the keystore, enabling credentials to be loaded from local files.
    • Adds schema-first capability manifest with --config and --format manifest flags for structured policy declaration.
    • Splits Linux system groups into finer-grained categories for improved host compatibility in policy definitions.
    • Auto-detects credential format from inject_header in the proxy, removing the need for manual format specification.
    • Blocks CONNECT tunnels to credential upstreams and adds smart NO_PROXY handling in the proxy.

    5 details in Everything

76. v0.25.0 Mar 26, 2026 · release notes

    nono v0.25.0 adds directory exclusions for trust scanning, a seccomp proxy-only network fallback for Linux sandboxes, and per-root snapshot filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.25.0

    • Adds skip_dirs support to trust scanning and rollback preflight, letting you exclude specific directories from trust checks.
    • Adds a seccomp proxy-only network fallback for Linux sandbox environments, tightening network isolation when full seccomp enforcement is unavailable.
    • Adds per-root exclusion filters to the snapshot manager, enabling finer-grained control over which paths are captured during undo snapshots.

    3 details in Everything

77. v0.24.0 Mar 25, 2026 · release notes

    nono v0.24.0 adds seccomp-based network fallback for Linux sandbox environments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

78. v0.23.1 Mar 25, 2026 · release notes

    nono v0.23.1 adds --rollback-dest for directing snapshots to a custom storage path.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.1 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.23.1

    • Adds --rollback-dest flag to specify a custom destination directory for snapshot storage.

    1 detail in Everything

79. v0.23.0 Mar 24, 2026 · release notes

    nono v0.23.0 adds diagnostic details to path query results.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0

80. v0.22.0 Mar 21, 2026 · release notes

    nono v0.22.0 adds lazy verification of scan policies for faster trust evaluation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.22.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.22.0

81. v0.21.0 Mar 21, 2026 · release notes

    nono v0.21.0 adds trust policy scaffolding, startup enforcement, and a --user flag for user-level policy signing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    └──▷ TRY IT
    Sign a user-level trust policy so per-user tool permissions are enforced without requiring system-wide policy changes.
    copy

    $ nono sign-policy --user

    • Scaffolds trust policies automatically, enforces missing includes at startup, and simplifies write protection.
    • New --user flag for sign-policy enables signing user-level trust policies.
    • Adds standard I/O and file-descriptor paths to the base_posix policy group.

    3 details in Everything

82. v0.20.0 Mar 18, 2026 · release notes

    nono v0.20.0 adds standardized network flags with listen_port support and multi-profile extends.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.20.0

    • Adds listen_port flag support for controlling the port nono listens on via standardized network flag naming.
    • Supports multiple base profiles in the extends field, enabling profile composition from more than one base.

    2 details in Everything

83. v0.19.0 Mar 18, 2026 · release notes

    nono v0.19.0 adds linux-arm64 support, macOS network tracing via nettop, and IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. semaphore sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.19.0

    • Adds linux-arm64 binary, extending nono to ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based Linux environments.
    • Adds macOS network tracing via nettop in learn mode, enabling automatic discovery of network activity for policy generation.
    • Adds IpcMode capability for POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. semaphores in the macOS Seatbelt sandbox, allowing sandboxed processes that use IPC semaphores to be properly profiled and contained.

    3 details in Everything

84. v0.18.0 Mar 16, 2026 · release notes

    nono v0.18.0 adds nono policy and nono profile subcommands, composable policy patches, and profile-level deny overrides.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.18.0

    └──▷ TRY IT
    Inspect the fully-resolved runtime policy for your current project to verify which groups and capabilities are active.
    copy

    $ nono policy

    Scaffold a new custom profile interactively so you can author project-specific policy without starting from scratch.
    copy

    $ nono profile

    • New nono policy subcommand for introspecting the resolved runtime policy.
    • New nono profile subcommand for scaffolding and authoring custom profiles.
    • Adds composable policy patch configuration, letting profiles layer incremental patches on top of base groups.
    • Adds extends field to embedded profiles for explicit profile inheritance.
    • Adds override_deny at the profile level to carve out exceptions from deny groups.

    +5 more show less

    • Adds a default profile with base group configuration for out-of-the-box policy resolution.
    • Extracts git config paths into a reusable policy group.
    • Gates macOS open shim installation behind a launch services flag.
    • Skips well-known heavy directories (e.g. node_modules, .git) during instruction file walk for faster trust resolution.
    • Restyled --help output with grouped sections and bold headings for improved readability.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The security.trust_groups config field is removed; use policy.exclude_groups instead.
    • !The base_groups field is removed; use the default profile mechanism instead.
    • !The never_grant supervisor field is removed in favor of protected roots.
85. v0.17.1 Mar 13, 2026 · release notes

    nono v0.17.1 adds a pluggable theme system with 6 built-in palettes and Landlock V6 signal scoping on Linux.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.1 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.17.1

    • Adds a pluggable theme system with 6 built-in color palettes for CLI output customization.
    • Adds Landlock V6 signal scoping support in the Linux sandbox, tightening process signal isolation.

    2 details in Everything

86. v0.17.0 Mar 12, 2026 · release notes

    nono v0.17.0 adds a pluggable theme system with 6 built-in palettes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.17.0

    └──▷ BREAKING ON UPGRADE

    • !CLI flags have been standardized to verb-noun ordering; any scripts or aliases using the old flag names may break.
87. v0.16.0 Mar 10, 2026 · release notes

    nono v0.16.0 adds ABI-aware Landlock sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., external proxy bypass routing, Claude Code integration, and a swival profile.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    └──▷ TRY IT
    Route a trusted internal domain directly around the nono proxy while keeping all other traffic sandboxed.
    copy

    $ nono run --external-proxy-bypass internal.corp.example.com -- ./my-service

    • Adds ABI-aware Landlock capability system for fine-grained filesystem sandboxing tuned to the target binary's ABI.
    • New --external-proxy-bypass flag routes specified domains directly, skipping the sandbox proxy.
    • Injects nono sandbox instructions via Claude Code system prompt, enabling automated sandbox policy enforcement in AI coding sessions.
    • Adds same-sandbox process mode for signal and process-info operations.
    • New built-in profile for swival applications.

    5 details in Everything

88. v0.15.0 Mar 9, 2026 · release notes

    nono v0.15.0 adds platform-aware profiles, capability elevation, Debian packaging, a built-in Codex profile, and Apple Passwords credential support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    └──▷ USE IT
    Restrict a sandboxed AI coding agent to only the privileges it needs by declaring capability elevation in your profile.
    yaml copy

    # In your nono profile TOML/YAML:
    capability_elevation = { groups = ["audio"] }  # OS-aware; ignored on unsupported platforms

    Pull API credentials from the macOS Passwords app instead of storing secrets in plaintext config.
    yaml copy

    # In your nono profile, set the credential URI to an Apple Passwords entry:
    credential = "apple-passwords://MyVault/OPENAI_API_KEY"

    • Makes the claude-code profile platform-aware, adapting behavior based on the host OS.
    • Adds capability_elevation profile field with OS-aware group support for fine-grained privilege control in profiles.
    • Adds Debian package support, enabling installation via .deb on Debian-based systems.
    • Adds a built-in Codex profile for out-of-the-box OpenAI Codex sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..
    • Adds Apple Passwords URI credential support for sourcing secrets directly from the macOS Passwords app.

    5 details in Everything

89. v0.14.0 Mar 8, 2026 · release notes

    nono v0.14.0 adds environment variable equivalents for all CLI flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

90. v0.12.0 Mar 7, 2026 · release notes

    nono v0.12.0 adds macOS learn mode, --net-allow override, port_allow in profiles, and context-aware sandbox failure banners.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    └──▷ TRY IT
    Temporarily permit outbound network access when running a sandboxed tool that needs to pull dependencies.
    copy

    $ nono run --net-allow -- npm install

    Lock a sandboxed service to specific outbound ports by adding port_allow to its network profile.
    json copy

    {
      "network_profile": {
        "port_allow": [443, 8080]
      }
    }

    • Adds macOS learn mode via fs_usage that observes a process and prompts to save a generated profile.
    • New --net-allow CLI flag lets users override network restrictions at runtime without editing a profile.
    • Adds port_allow field to profile JSON NetworkConfig for fine-grained port-level network control.
    • New context-aware diagnostic banner surfaces actionable details when sandbox failures occur.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Monitor strategy is removed; Supervised is now the default strategy — setups relying on Monitor will break on upgrade.
91. v0.11.0 Mar 5, 2026 · release notes

    nono v0.11.0 unifies proxy and session audit trails and adds bidirectional localhost IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. between sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    └──▷ TRY IT
    Permit two sandboxes to communicate over a specific localhost port for inter-process coordination.
    copy

    $ nono run --allow-port 9000 <target>

    • Unifies proxy network audit with session audit trail for a single, consolidated view of network and session activity.
    • Adds --allow-port flag to enable bidirectional localhost IPC between sandboxes.

    2 details in Everything

92. v0.10.0 Mar 4, 2026 · release notes

    nono v0.10.0 adds profile inheritance, allowed_commands, env:// credentials, and a new --override-deny flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    └──▷ USE IT
    Reuse a hardened base profile across multiple agent configs without duplicating policy.
    yaml copy

    # In your profile YAML:
    extends: base-hardened
    allowed_commands:
      - git
      - cargo

    Exempt a specific deny group (e.g. a network rule) for a single run without relaxing the whole policy.
    copy

    $ nono run --override-deny <deny-group-name> -- <target>

    • Adds profile inheritance via the extends field, letting security profiles compose and reuse base configurations.
    • Adds allowed_commands support to profile security config for explicit command allowlisting within a profile.
    • Introduces the env:// credential scheme and GitHub token proxy support for injecting credentials from environment variables.
    • Adds --override-deny CLI flag for targeted exemptions from specific deny groups without disabling the full policy.
    • Removes RFC1918RFC1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. private network CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. deny list from host filtering, enabling sandboxed tools to reach internal services.

    +1 more show less

    • Adds platform.claude.com to the built-in LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. APIs allowlist.

    6 details in Everything

93. v0.9.0 Mar 3, 2026 · release notes

    nono v0.9.0 adds rollback preflight with auto-exclude and walk budget controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

94. v0.8.0 Mar 2, 2026 · release notes

    Adds claude.ai to the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. allow list and new Landlock permissions for snapshot creation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

95. v0.7.0 Mar 1, 2026 · release notes

    nono v0.7.0 adds 1Password secret injection, Nix Darwin path support, and hard Landlock network enforcement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    • Supports 1Password secret injection via op:// URI, enabling secrets to be pulled directly from 1Password at runtime.
    • Adds /nix and /run to default macOS read paths, enabling Nix Darwin environments to work out of the box.
    • Enforces hard failure when Landlock network filtering cannot be applied, preventing silent sandbox escapes.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Landlock network filtering now fails hard when it cannot be enforced; previously non-enforced Landlock would not halt execution, so setups running on kernels or configurations where Landlock network filtering is unavailable will now fail on upgrade.
96. v0.6.0 Feb 27, 2026 · release notes

    nono v0.6.0 adds a network filtering proxy with credential injection, network activity tracking in learn mode, and multi-subject artifact attestation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    • Adds a network filtering proxy with host-level filtering and credential injection for sandboxed processes.
    • Adds network activity tracking to nono learn, enabling discovery of outbound connections made during a learning session.
    • Supports custom credential definitions in user profiles, with multiple injection modes (e.g. header, environment variable).
    • Allows the sandboxed process to bind and listen on a TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port.
    • Supports a static proxy port for deterministic proxy configuration.

    +1 more show less

    • Adds multi-subject file attestation for companion artifact signing.

    6 details in Everything

97. v0.6.0-alpha.2 Prerelease Feb 21, 2026 · release notes

    nono v0.6.0-alpha.2 adds Sigstore verification for instruction files, decoupled rollback, and flexible profile loading.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0-alpha.2 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0-alpha.2

    └──▷ TRY IT
    Use rollback independently of supervised mode to revert the last nono action.
    copy

    $ nono --rollback

    • Implements Sigstore cryptographic verification for instruction files, enabling trust validation of nono instruction sources.
    • Renames undo to rollback and decouples --rollback from --supervised, allowing rollback to be used independently.
    • Supports loading profiles from outside XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. Home, enabling flexible configuration paths.
    • Denies access to the .nono XDG directory when a user shares the HOME path, hardening the sandbox boundary.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The undo subcommand/flag is renamed to rollback; any scripts or workflows using undo will break.
    • !--rollback is decoupled from --supervised; previously coupled behavior may change for setups that relied on their interaction.
98. v0.6.0-alpha.1 Prerelease Feb 18, 2026 · release notes

    nono v0.6.0-alpha.1 adds human-readable timestamps to undo session listings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0-alpha.1 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0-alpha.1

99. v0.5.0 Feb 15, 2026 · release notes

    nono v0.5.0 adds Secretive, 1Password, and Go community profiles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/nolabs-ai/nono.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • Adds Secretive community profile for SSH key management sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..
    • Adds 1Password community profile for credential manager sandboxing.
    • Adds Go community profile for Go toolchain sandboxing.

    3 details in Everything

100. v0.4.0 Feb 12, 2026 · release notes

     nono v0.4.0 adds Unix socket sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., --exec for direct process launch, and --no-diagnostics for clean output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.4.0 https://github.com/nolabs-ai/nono.git
     # already have the repo? check out this version:
     $ git checkout v0.4.0

     └──▷ TRY IT
     Run a sandboxed process directly (no shell) while suppressing diagnostic noise — useful in CI pipelines where only the subprocess output matters.
     copy

     $ nono run --exec --no-diagnostics -- <your-command>

     • Supports Unix domain sockets in file capability rules, enabling sandboxing of tools that communicate over local sockets.
     • Adds --exec flag to the run command for direct process execution without a shell wrapper.
     • Adds --no-diagnostics flag to the run command to suppress diagnostic output for scripting and CI use.

     3 details in Everything

101. v0.3.0 Feb 9, 2026 · release notes

     nono v0.3.0 adds a shell command and a learn command for building allowlists from observed behavior.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.3.0 https://github.com/nolabs-ai/nono.git
     # already have the repo? check out this version:
     $ git checkout v0.3.0

     └──▷ TRY IT
     Launch an interactive shell monitored by nono to capture real-world behavior.
     copy

     $ nono shell

     • Adds shell command for interactive shell session monitoring.
     • Adds nono learn command to observe and record process behavior for policy creation.
     • Adds fork+wait execution strategy with diagnostics for improved process tracing.

     3 details in Everything

102. v0.2.6 Feb 4, 2026 · release notes

     nono v0.2.6 introduces profile-driven [workdir] config and a new --allow-cwd flag

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.2.6 https://github.com/nolabs-ai/nono.git
     # already have the repo? check out this version:
     $ git checkout v0.2.6

     └──▷ TRY IT
     Explicitly allow the current working directory when running nono from the command line.
     copy

     $ nono --allow-cwd

     • Adds profile-driven [workdir] config section to control working directory per profile, replacing hardcoded CWD handling.
     • Adds --allow-cwd flag to explicitly permit use of the current working directory.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !CWD handling has been removed from its previous location and replaced by the [workdir] profile config; existing setups relying on implicit CWD behavior will need to migrate to the new [workdir] config block.
103. v0.2.0 Feb 2, 2026 · release notes

     nono v0.2.0 adds signed security lists and a centralized config system

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.2.0 https://github.com/nolabs-ai/nono.git
     # already have the repo? check out this version:
     $ git checkout v0.2.0

     • Adds signed security lists to verify integrity of detection rule sets.
     • Introduces a centralized configuration system for managing nono settings.

     2 details in Everything

104. v0.1.1 Feb 1, 2026 · release notes

     nono v0.1.1 adds var folders integration for openclaw

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.1.1 https://github.com/nolabs-ai/nono.git
     # already have the repo? check out this version:
     $ git checkout v0.1.1

     • add var folders for openclaw

     1 detail in Everything

105. v0.1.0 Feb 1, 2026 · release notes

     nono v0.1.0 debuts with sandboxed AI coding-assistant control, destructive-command blocking, and keystore-backed secrets.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.1.0 https://github.com/nolabs-ai/nono.git
     # already have the repo? check out this version:
     $ git checkout v0.1.0

     • Adds file-specific permission flags to enforce granular read/write/exec controls on files accessed by coding assistants.
     • Steers coding assistants toward nono's policy layer, enabling policy enforcement over AI-generated actions.
     • Supports inbuilt and custom security profiles for flexible, reusable sandbox configurations.
     • Adds destructive command blocking with defense-in-depth protection to prevent dangerous shell operations.
     • Adds secure secrets management via the system keystore, keeping credentials out of plaintext config files.

     5 details in Everything