Profile Introspection

The nono profile command lets you inspect the group-based security policy, explore profiles, compare configurations, and validate user-defined profiles. Every subcommand supports --json for programmatic consumption.

Commands

`nono profile groups`

List all policy groups or show details for a specific group.

# List groups for the current platform
nono profile groups

# List groups for all platforms
nono profile groups --all-platforms

# Show details for a specific group
nono profile groups deny_credentials

# Machine-readable output
nono profile groups --json

Example output:

nono profile: 21 groups

  claude_code_macos                    Claude Code macOS-specific state and credential paths macos
  deny_credentials                     Block access to cryptographic keys, tokens, and cloud credentials cross-platform  required
  deny_shell_history                   Block access to shell command history files cross-platform  required
  node_runtime                         Node.js runtime and package manager paths  cross-platform
  system_read_macos                    macOS system paths required for executables to function macos
  ...

Detailed view shows every path in the group, with variables expanded to their actual values:

nono profile: group 'deny_credentials'

  Description:  Block access to cryptographic keys, tokens, and cloud credentials
  Platform:     cross-platform
  Required:     yes

  deny.access:
    ~/.ssh                               -> /Users/luke/.ssh
    ~/.aws                               -> /Users/luke/.aws
    ~/.config/gcloud                     -> /Users/luke/.config/gcloud
    ~/.docker                            -> /Users/luke/.docker
    ~/.git-credentials                   -> /Users/luke/.git-credentials
    ...

Options

Option	Description
`[NAME]`	Group name to show details for (omit to list all)
`--json`	Output as JSON
`--all-platforms`	Show groups for all platforms, not just the current one

`nono profile list`

List all available profiles, showing built-in, package-provided, and user-defined profiles separately. User profiles that shadow a built-in profile are flagged. Package profiles always use fully-qualified names and cannot be shadowed by bare user-profile names.

nono profile list
nono profile list --json

Example output:

nono profile: 15 profiles

  Built-in:
    default                Default conservative base profile
    python-dev             Python SDK development profile
    ...

  Packages:
    nolabs-ai/claude       Anthropic Claude Code CLI agent
    nolabs-ai/opencode     OpenCode 2 AI coding assistant
    nolabs-ai/opencode-v1  OpenCode 1 AI coding assistant

  User (~/.config/nono/profiles/):
    my-agent                Custom agent profile                       extends default
    ...

Malformed user profiles are surfaced with their error instead of being silently hidden:

  User (~/.config/nono/profiles/):
    broken-profile          [error: Profile error: missing field `meta`]

Bare names resolve from the user profile directory first, then built-ins. Package profiles resolve only by their fully-qualified package name, such as nolabs-ai/claude, so a user claude.json does not shadow the package profile.

Options

Option	Description
`--json`	Output as JSON

JSON entries contain name, source, and either the loaded profile’s description and extends fields or an error. For package profiles, source is "pack" and name is already the fully-qualified package identity; there is no separate pack field.

`nono profile show`

Display a fully resolved profile, including all inherited groups, filesystem grants, network configuration, hooks, and rollback settings.

# Show a profile
nono profile show default

# Show a user profile
nono profile show my-agent

# Show a profile by file path
nono profile show ./profiles/custom.json

# Show raw paths (before variable expansion)
nono profile show nolabs-ai/claude --raw

# Machine-readable output
nono profile show nolabs-ai/claude --json

# Emit fully resolved effective rules as JSON (same resolution as nono run)
nono profile show nolabs-ai/claude --format manifest

Example output:

nono profile: profile 'nolabs-ai/claude'

  Description:  Anthropic Claude Code CLI agent
  Extends:      default

  Security groups:
    deny_credentials
    deny_keychains_macos
    node_runtime
    python_runtime
    rust_runtime
    unlink_protection
    ...

  Filesystem:
    allow (r+w):
      $HOME/.claude                        -> /Users/luke/.claude
    read_file:
      $HOME/.gitconfig                     -> /Users/luke/.gitconfig

  Workdir access:  ReadWrite

  Rollback exclusions:
    node_modules
    target
    __pycache__
    glob: *.tmp.[0-9]*.[0-9]*

  Open URLs:
    localhost allowed
    https://claude.ai

The --raw flag shows path variables as written in the profile (e.g., $HOME/.claude) rather than their expanded values. This is useful for understanding what a profile declares versus what it resolves to on a specific machine.

Options

Option	Description
`<PROFILE>`	Profile name or file path
`--json`	Output as JSON
`--raw`	Show raw paths before variable expansion
`--format manifest`	Emit the fully resolved effective rules as JSON (same resolution as `nono run`)

`nono profile diff`

Compare two profiles side-by-side. Shows additions, removals, and changes across all profile sections: groups, filesystem, policy patches, security settings, network, hooks, rollback, open URLs, env credentials, and custom credentials.

# Compare two profiles
nono profile diff default nolabs-ai/claude

# Compare a user profile against a pack profile
nono profile diff default ./my-profile.json

# Machine-readable output
nono profile diff default nolabs-ai/claude --json

Example output:

nono profile: diff 'default' vs 'nolabs-ai/claude'

  Groups:
    + claude_code_macos
    + node_runtime
    + python_runtime
    + rust_runtime
    + unlink_protection
    + user_caches_macos

  Filesystem:
    + allow $HOME/.claude
    + read_file $HOME/.gitconfig
    + read_file $HOME/.gitignore_global

  Workdir:
    - access: None
    + access: ReadWrite

  Open URLs:
    + allow_origins https://claude.ai
    - allow_localhost: false
    + allow_localhost: true

  Hooks:
    + claude-code

For custom credentials and hooks, the diff detects value-level changes when two profiles share the same key but differ in configuration (e.g., different upstream URL or inject_mode):

  Custom credentials:
    ~ my-api (changed)
      - upstream: https://old-api.example.com
      + upstream: https://new-api.example.com

When profiles are identical, the output shows (no differences).

Options

Option	Description
`<PROFILE1>`	First profile name or path
`<PROFILE2>`	Second profile name or path
`--json`	Output as JSON

`nono profile validate`

Validate a user profile JSON file against the embedded policy. Catches common mistakes before they cause runtime failures.

nono profile validate ~/my-profile.json
nono profile validate ./profiles/custom.json --json

Checks performed:

Check	Severity	Description
JSON syntax	Error	File must be valid JSON and deserialize into a profile
Inheritance	Error	`extends` target must be a loadable profile
Group references	Error	Every group in `groups.include` must exist in policy.json
Required group exclusion	Error	`groups.exclude` cannot exclude required groups
Empty paths	Warning	Empty strings in filesystem path arrays

Example output for a valid profile:

nono profile: validating /Users/luke/my-profile.json

  [ok]  JSON syntax valid
  [ok]  All 3 group references valid

  Result: valid

Example output for an invalid profile:

nono profile: validating /Users/luke/bad-profile.json

  [ok]  JSON syntax valid
  [err]  Group 'nonexistent_group' not found in policy.json

  Result: invalid (1 error)

The command exits with a non-zero status when validation fails, making it suitable for CI pipelines.

Options

Option	Description
`<FILE>`	Profile JSON file to validate
`--json`	Output as JSON

JSON Output

All subcommands support --json for integration with scripts, CI pipelines, and tools like jq.

# List groups and extract names
nono profile groups --json | jq '.[].name'

# Check if a profile has network blocked
nono profile show my-profile --json | jq '.network.block'

# Get added groups between two profiles
nono profile diff default nolabs-ai/claude --json | jq '.groups.added'

# Validate in CI and check result
nono profile validate ./profile.json --json | jq '.valid'

Use Cases

Resolved effective rules

--format manifest emits the fully resolved effective rules as JSON, using the same extends + group resolution that nono run uses. This is useful for policy-as-code pipelines, diffing resolved rules across environments, or feeding the output into other tooling:

nono profile show nolabs-ai/claude --format manifest

Auditing security posture

Review exactly what a profile grants before deploying it:

# What does this profile actually allow?
nono profile show nolabs-ai/claude

# What groups protect sensitive data?
nono profile groups deny_credentials

# How does our custom profile differ from the pack profile?
nono profile diff nolabs-ai/claude ./our-custom-profile.json

Debugging sandbox failures

When a sandboxed process fails because a path is blocked, trace the policy:

# What groups apply to the current platform?
nono profile groups

# Does the profile include the needed runtime group?
nono profile show my-profile | grep python_runtime

# Compare against a working profile
nono profile diff my-profile nolabs-ai/claude

CI/CD validation

Validate custom profiles before they ship:

# Validate all profile files in a directory
for f in profiles/*.json; do
  nono profile validate "$f" --json || exit 1
done

Detecting built-in overrides

Check whether built-in profiles have been shadowed by user files:

# JSON output flags the actual source
nono profile list --json | jq '.[] | select(.source | contains("overrides"))'

Getting Started

Policy

Sessions

Packaging

Networking

Secrets

Audit

Supply Chain Security

Rollback

Resource Limits

Architecture

Reference

Development

Profile Introspection

Commands

`nono profile groups`

Options

`nono profile list`

Options

`nono profile show`

Options

`nono profile diff`

Options

`nono profile validate`

Options

JSON Output

Use Cases

Resolved effective rules

Auditing security posture

Debugging sandbox failures

CI/CD validation

Detecting built-in overrides

​Commands

​nono profile groups

​Options

​nono profile list

​Options

​nono profile show

​Options

​nono profile diff

​Options

​nono profile validate

​Options

​JSON Output

​Use Cases

​Resolved effective rules

​Auditing security posture

​Debugging sandbox failures

​CI/CD validation

​Detecting built-in overrides

Commands

`nono profile groups`

Options

`nono profile list`

Options

`nono profile show`

Options

`nono profile diff`

Options

`nono profile validate`

Options

JSON Output

Use Cases

Resolved effective rules

Auditing security posture

Debugging sandbox failures

CI/CD validation

Detecting built-in overrides