Dangerous Command Blocking

Dangerous command blocking prevents selected executables from running through command-mediation shims. Use it for commands that should not be available to an agent at all, such as rm, dd, chmod, package managers, privilege escalation tools, or system administration commands. This is different from giving a command a restricted command sandbox. A command with a command sandbox policy is allowed to run with specific grants. A deny-only command is resolved and controlled, but every matching invocation is denied.

Recommended Shape

Put blocked commands under command_policies.commands and deny the session caller:

{
  "extends": "default",
  "meta": {
    "name": "agent-with-command-denies"
  },
  "command_policies": {
    "commands": {
      "rm": {
        "from": {
          "session": "deny"
        }
      },
      "chmod": {
        "from": {
          "session": "deny"
        }
      },
      "sudo": {
        "from": {
          "session": "deny"
        }
      }
    }
  }
}

Run:

nono profile validate ~/.config/nono/profiles/agent-with-command-denies.json
nono run --profile agent-with-command-denies -- rm -rf build

Expected:

rm through PATH is denied by the command-mediation shim;
direct canonical-path invocation, such as /bin/rm, is denied as a direct-exec bypass of a controlled command;
no command sandbox is launched for the denied command.

Blocking Child Tools

Use caller-specific denies when one allowed tool must not launch another tool:

{
  "command_policies": {
    "commands": {
      "npm": {
        "can_use": ["node", "sh"],
        "sandbox": {
          "fs_read": ["."],
          "fs_write": ["."]
        }
      },
      "node": {
        "from": {
          "npm": {
            "fs_read": ["."],
            "fs_write": ["."]
          }
        }
      },
      "sh": {
        "from": {
          "npm": "deny",
          "session": "deny"
        }
      }
    }
  }
}

Here npm may launch node, but an attempted npm lifecycle escape through sh is denied.

Inherited Dangerous Groups

The default profile includes dangerous_commands, dangerous_commands_macos, and dangerous_commands_linux. These groups still populate the older blocked-command list. When command_policies.commands is non-empty, command mediation folds inherited blocked commands into deny-only command-policy entries. That gives dangerous commands shim coverage and direct-path bypass protection while command mediation is active. Inherited blocked commands do not activate command mediation by themselves. A profile that only inherits dangerous_commands still uses the older startup-command warning path. Add at least one command_policies.commands entry when you want command-policy behavior.

Allowing One Dangerous Command

If a profile inherits dangerous_commands but intentionally needs one command, use the profile’s commands.allow compatibility field to remove that inherited blocked-command entry before command-policy resolution:

{
  "extends": "default",
  "meta": {
    "name": "allow-rm-but-block-rest"
  },
  "commands": {
    "allow": ["rm"]
  },
  "command_policies": {
    "commands": {
      "jq": {
        "sandbox": {
          "fs_read": ["."]
        }
      }
    }
  }
}

Prefer avoiding broad command allowances. If the real need is to delete files in one workspace area, use filesystem grants and unlink protection instead of allowing rm globally.

Direct Exec Bypass

Policy-controlled and deny-only commands are meant to be reached through command-mediation shims. Direct paths are denied unless explicitly allowed by allow_direct_exec_bypass on a policy-controlled command. Deny-only commands are never eligible for allow_direct_exec_bypass. The profile-wide deny_direct_exec_bypass list can also name canonical executable paths that must not be bypassed by any command policy.

{
  "command_policies": {
    "deny_direct_exec_bypass": ["/bin/rm"],
    "commands": {
      "rm": {
        "from": {
          "session": "deny"
        }
      }
    }
  }
}

Deprecated Surfaces

These older command-blocking surfaces are still parsed for compatibility, but they are startup-only and are not the preferred authoring path:

CLI --block-command;
profile commands.deny;
capability manifest process.blocked_commands.

For new profiles, put command policy under command_policies. Use Sandboxed Tool Execution when a command should be allowed with a specific command sandbox, and use this page when a command should not run.

Getting Started

Policy

Sessions

Packaging

Networking

Secrets

Audit

Supply Chain Security

Rollback

Resource Limits

Architecture

Reference

Development

Dangerous Command Blocking

Recommended Shape

Blocking Child Tools

Inherited Dangerous Groups

Allowing One Dangerous Command

Direct Exec Bypass

Deprecated Surfaces

​Recommended Shape

​Blocking Child Tools

​Inherited Dangerous Groups

​Allowing One Dangerous Command

​Direct Exec Bypass

​Deprecated Surfaces

Recommended Shape

Blocking Child Tools

Inherited Dangerous Groups

Allowing One Dangerous Command

Direct Exec Bypass

Deprecated Surfaces