nono-rs 0.1.0

A secure shell for AI agents.

nono is a secure, kernel-enforced capability shell for running untrusted AI agents and processes. Unlike policy-based sandboxes that intercept and filter operations, nono leverages OS security primitives (Landlock on Linux, Seatbelt on macOS) to create an environment where unauthorized operations are structurally impossible.

Quick Start

# Build
cargo build --release

# Run a command with filesystem access only to current directory
nono run --allow . -- your-command

# Example: Run Claude Code with restricted access
nono run --allow ./my-project -- claude

# Block network access (air-gapped mode)
nono run --allow . --net-block -- your-command

Features

• No escape hatch - Once inside nono, there is no mechanism to bypass restrictions
• Agent agnostic - Works with any AI agent (Claude, GPT, opencode, openclaw) or any process
• OS-level enforcement - Kernel denies unauthorized operations
• Destructive command blocking - Blocks dangerous commands like rm, dd, chmod by default
• Cross-platform - Linux (Landlock) and macOS (Seatbelt)

Usage

# Allow read+write to current directory
nono run --allow . -- command

# Separate read and write permissions
nono run --read ./src --write ./output -- cargo build

# Multiple paths
nono run --allow ./project-a --allow ./project-b -- command

# Block network access
nono run --allow . --net-block -- command

# Dry run (show what would be sandboxed)
nono run --allow . --dry-run -- command

# Check why a path would be blocked
nono why ~/.ssh/id_rsa

Command Blocking

nono blocks dangerous commands by default to prevent AI agents from accidentally (or maliciously) causing harm. This provides defense-in-depth beyond filesystem restrictions.

Blocked Commands

The following categories of commands are blocked by default:

Overriding Command Blocks

# Allow a specific blocked command (use with caution)
nono run --allow . --allow-command rm -- rm ./temp-file.txt

# Block an additional command
nono run --allow . --block-command my-dangerous-tool -- my-script.sh

Kernel-Level Protection

Even if a command is allowed via --allow-command, nono applies kernel-level protection that blocks:

• File deletion - unlink/rmdir syscalls are blocked
• File truncation - Cannot zero out files via truncation

This means even if rm is allowed, the actual deletion is blocked by the kernel:

$ nono run --allow /tmp/test --allow-command rm -- rm /tmp/test/file.txt
rm: /tmp/test/file.txt: Operation not permitted

How It Works

┌─────────────────────────────────────────────────┐
│  Terminal                                       │
│                                                 │
│  $ nono run --allow ./project -- claude         │
│                                                 │
│  ┌───────────────────────────────────────────┐  │
│  │  nono (applies sandbox, then exec)        │  │
│  │                                           │  │
│  │  ┌─────────────────────────────────────┐  │  │
│  │  │  Claude Code (sandboxed)            │  │  │
│  │  │  - Can read/write ./project         │  │  │
│  │  │  - Cannot access ~/.ssh, ~/.aws...  │  │  │
│  │  │  - Network: allowed (or blocked)    │  │  │
│  │  └─────────────────────────────────────┘  │  │
│  └───────────────────────────────────────────┘  │
└─────────────────────────────────────────────────┘

Platform Support

Roadmap

• Phase 1: Filesystem sandbox (MVP)
• Phase 2: Network isolation (TCP blocking on Linux 6.7+, full on macOS)
• Phase 3: Runtime capability expansion
• Phase 4: Polish and release

See SPEC.md and IMPLEMENTATION.md for detailed design documents.

Security Model

nono follows a capability-based security model with defense-in-depth:

1. Command validation - Dangerous commands (rm, dd, chmod, etc.) are blocked before execution
2. Sandbox applied - OS-level restrictions are applied (irreversible)
3. Kernel enforcement - Even allowed paths cannot have files deleted or truncated
4. Command executed - The command runs with only granted capabilities
5. All children inherit - Subprocesses also run under restrictions

Defense Layers

The key difference from policy-based sandboxes: there is no "escape hatch" API. The agent cannot request more permissions because the mechanism doesn't exist.

License

Apache-2.0