CLI Reference

nono -s run --allow-cwd -- my-agent
nono --silent why --path ~/.ssh/id_rsa --op read

# Per invocation
nono --theme tokyo-night run --allow-cwd -- claude

# Via environment variable
NONO_THEME=latte nono run --allow-cwd -- codex

# Config file
# ~/.config/nono/config.toml
# [ui]
# theme = "frappe"

[redaction]
extra_flags = ["--private-token", "--pat"]
extra_headers = ["Private-Token"]
extra_query_keys = ["sig", "signature"]

[redaction]
unsafe_redaction_overrides = true
allow_unredacted_defaults = ["state"]

nono run [OPTIONS] -- <COMMAND> [ARGS...]

nono shell [OPTIONS]

nono wrap [OPTIONS] -- <COMMAND> [ARGS...]

nono why --path <PATH> --op <OP> [OPTIONS]
nono why --host <HOST> [--port <PORT>] [OPTIONS]
nono why --scope <SCOPE> [OPTIONS]
nono why --self --path <PATH> --op <OP> [OPTIONS]  # Inside sandbox

nono learn [OPTIONS] -- <COMMAND> [ARGS...]

nono setup [OPTIONS]

nono profile <SUBCOMMAND>

nono trust <SUBCOMMAND>

nono learn --profile opencode -- opencode

nono learn --json -- my-app > paths.json

nono learn --timeout 30 -- my-long-running-app

nono learn --all -- my-app

nono learn --trace -- my-app

nono learn -vv -- my-app

nono run --allow ./project -- command
nono run -a ./src -a ./tests -- command

nono run --read ./config -- command
nono run -r /etc/myapp -- command

nono run --write ./output -- command
nono run -w ./logs -- command

nono run --allow-file ./database.sqlite -- command

nono run --read-file ./config.toml -- command
nono run --read-file ~/.gitconfig -- command

nono run --write-file ./output.log -- command

nono run --profile claude-code \
  --suppress-save-prompt ~/.copilot/settings.json \
  -- claude

# Connect to a running Postgres dev server via Unix socket
nono run --block-net --allow-unix-socket /tmp/.s.PGSQL.5432 -- psql

# Server that binds its own IPC socket
nono run --block-net --allow-unix-socket-bind /run/myapp.sock -- myapp

# Connect to any Unix socket directly in /run/user/1000
nono run --block-net --allow-unix-socket-dir /run/user/$UID -- my-client

# tsx creates /tmp/tsx-<uid>/<pid>.pipe on every invocation
nono run --block-net --allow-unix-socket-dir-bind $TMPDIR/tsx-$UID -- tsx app.ts

nono run --block-net --allow-unix-socket-subtree $TMPDIR/nx -- nx serve

nono run --block-net --allow-unix-socket-subtree-bind $TMPDIR/nx -- nx serve

# Block network for a build process that should be offline
nono run --allow . --block-net -- cargo build

# Use the claude-code network profile
nono run --allow-cwd --network-profile claude-code -- claude

# Use minimal profile (LLM APIs only)
nono run --allow-cwd --network-profile minimal -- my-agent

# Allow specific domains (all paths)
nono run --allow-cwd --allow-domain api.openai.com --allow-domain api.anthropic.com -- my-agent

# Restrict to specific paths on a domain
nono run --allow-cwd \
  --allow-domain 'https://github.com/my-org/**' \
  --allow-domain 'https://github.com/other-org/**' \
  -- my-agent

# Combine with a network profile for additional domains
nono run --allow-cwd --network-profile minimal --allow-domain custom-api.example.com -- my-agent

# Inject OpenAI credentials (loads from keyring account "openai_api_key")
nono run --allow-cwd --network-profile claude-code --credential openai -- my-agent

# Multiple credentials
nono run --allow-cwd --network-profile claude-code \
  --credential openai --credential anthropic -- my-agent

{
  "network": {
    "custom_credentials": {
      "my-api": {
        "upstream": "https://api.example.com",
        "credential_key": "my_api_key"
      }
    }
  }
}

# Allow only chat completions through OpenAI
nono run --allow-cwd --credential openai \
  --allow-endpoint 'openai:POST:/v1/chat/completions' \
  -- my-agent

# Allow GitHub issue reads and comment writes, block everything else
nono run --allow-cwd --credential github \
  --allow-endpoint 'github:GET:/repos/*/issues/**' \
  --allow-endpoint 'github:POST:/repos/*/issues/*/comments' \
  -- my-agent

nono run --allow-cwd --network-profile enterprise --upstream-proxy squid.corp:3128 -- my-agent

# Bypass the upstream proxy for internal services
nono run --allow-cwd --network-profile enterprise \
  --upstream-proxy squid.corp:3128 \
  --upstream-bypass internal.corp \
  --upstream-bypass "*.private.net" \
  -- my-agent

# Multiple bypass patterns
nono run --allow-cwd \
  --upstream-proxy squid.corp:3128 \
  --upstream-bypass git.internal.corp \
  --upstream-bypass "*.dev.local" \
  -- my-agent

# Use a fixed proxy port for applications that need base URL configuration
nono run --profile openclaw --proxy-port 19999 --listen-port 18789 -- openclaw gateway

# The credential proxy will always be at http://127.0.0.1:19999
# Configure the application to use this base URL for API calls

# Allow OpenClaw gateway to listen on its default port
nono run --profile openclaw --listen-port 18789 \
  --credential openai -- openclaw gateway

# Allow a development server
nono run --allow-cwd --network-profile developer --listen-port 3000 -- npm run dev

# MCP server in one sandbox, client in another — both can use port 3000
nono run --block-net --open-port 3000 --allow ./mcp-server -- node server.js
nono run --block-net --open-port 3000 --allow ./client -- claude

# Multiple IPC ports
nono run --block-net --open-port 3000 --open-port 5000 --allow-cwd -- my-agent

# Combine with proxy mode — outbound filtered + localhost IPC on port 4000
nono run --network-profile claude-code --open-port 4000 --allow-cwd -- claude

nono shell --allow-cwd --shell /bin/zsh

# Allow rm (blocked by default)
nono run --allow-cwd --allow-command rm -- rm ./temp-file.txt

# Allow multiple commands
nono run --allow-cwd --allow-command rm --allow-command mv -- my-script.sh

{
  "meta": { "name": "my-profile" },
  "filesystem": { "allow": ["/tmp"] },
  "commands": { "allow": ["rm", "chmod"] }
}

nono run --profile my-profile -- rm /tmp/old-file.txt

# Block a custom tool in addition to defaults
nono run --allow-cwd --block-command my-dangerous-tool -- my-script.sh

# Allow an AWS agent to access credentials
nono run --bypass-protection ~/.aws --allow ~/.aws -- my-aws-agent

# Allow read-only access to GCP config
nono run --bypass-protection ~/.config/gcloud --read ~/.config/gcloud -- gcloud-agent

# Multiple bypasses
nono run \
  --bypass-protection ~/.aws \
  --bypass-protection ~/.config/gcloud \
  --allow ~/.aws \
  --read ~/.config/gcloud \
  -- multi-cloud-agent

# Load specific credentials by account name
nono run --allow-cwd --env-credential openai_api_key,anthropic_api_key -- my-agent

# Use with a profile that defines env_credentials
nono run --profile my-agent -- my-agent

# Load from 1Password
nono run --allow-cwd --env-credential-map 'op://Development/OpenAI/credential' OPENAI_API_KEY -- my-agent

# Load from Apple Passwords on macOS
nono run --allow-cwd --env-credential-map 'apple-password://github.com/alice@example.com' GITHUB_PASSWORD -- my-agent

# Load and rename from parent env
nono run --allow-cwd --env-credential-map 'env://GITHUB_TOKEN' GH_TOKEN -- my-agent

# Multiple mappings
nono run --allow-cwd \
  --env-credential-map 'op://Development/OpenAI/credential' OPENAI_API_KEY \
  --env-credential-map 'apple-password://github.com/alice@example.com' GITHUB_PASSWORD \
  -- my-agent

nono run --profile claude-code -- claude
nono run -p openclaw -- openclaw gateway

nono run --profile claude-code --workdir ./my-project -- claude

# Non-interactive mode (e.g., CI/CD)
nono run --profile claude-code --allow-cwd -- claude

# Silent mode requires --allow-cwd (cannot prompt)
nono -s run --profile claude-code --allow-cwd -- claude

nono run --profile claude-code --allow-launch-services -- claude

nono run --allow-gpu -- llama-cli -m ./model.gguf -p "hello"

# Start in the background, then attach later
nono run --detached --profile claude-code --allow-cwd -- claude

# Detached launch with an explicit session name
nono run --detached --name gold-core --allow-cwd -- my-agent

# Give a slow app 60 seconds to initialise
nono run --detached --detach-timeout 60 --allow-cwd -- opencode

# Via environment variable
NONO_DETACH_STARTUP_TIMEOUT=60 nono run --detached --allow-cwd -- opencode

# Name a foreground supervised session
nono run --name gold-core --allow-cwd -- my-agent

# Combine with detached startup
nono run --detached --name nightly-indexer --allow ./workspace -- indexer

nono run --rollback --profile claude-code -- claude
nono run --rollback --allow-cwd -- my-agent

nono run --rollback --no-rollback-prompt --allow-cwd -- my-agent

nono run --no-rollback --allow . -- npm test

nono run --no-audit --allow-cwd -- my-command

# Default: session audit + tamper-evident event log
nono run --allow-cwd -- my-agent

# Session audit only, without the integrity layer
nono run --no-audit-integrity --allow-cwd -- my-agent

# Add filesystem-state hashing over tracked writable paths
nono run --audit-integrity --allow-cwd -- my-agent

# Strongest mode: audit + filesystem integrity + restoreable rollback snapshots
nono run --audit-integrity --rollback --profile claude-code -- claude

# Sign with the default trust key from the keystore
nono run --audit-sign-key default --allow-cwd -- my-agent

# Sign with an explicit file-backed key
nono run --audit-sign-key file:///tmp/nono-audit-key.pem --allow-cwd -- my-agent

# Sign with a 1Password-backed key
nono run --audit-sign-key op://Development/Nono/audit-key --profile claude-code -- claude

nono audit verify <session-id> --public-key-file ./audit-signing-key.pub

# Exclude a custom directory from rollback
nono run --rollback --rollback-exclude vendor -- go test ./...

# Exclude multiple directories
nono run --rollback --rollback-exclude vendor --rollback-exclude .terraform -- terraform plan

# Exclude log files from rollback (glob pattern)
nono run --rollback --rollback-exclude "*.log" -- my-agent

# Include target/ in rollback (normally auto-excluded)
nono run --rollback --rollback-include target -- cargo build

# Include multiple directories
nono run --rollback --rollback-include target --rollback-include dist -- make build

# Full rollback coverage (may be slow)
nono run --rollback --rollback-all -- cargo test

# Skip a generated docs tree for this run
nono run --skip-dir docs-build --allow-cwd -- my-agent

# Skip multiple large trees
nono run --skip-dir vendor-cache --skip-dir generated --allow-cwd -- my-agent

# Kill the process if it hasn't become interactive after 10 seconds
nono run --startup-timeout 10 --allow-cwd -- opencode

# Disable the timeout entirely
nono run --startup-timeout 0 --allow-cwd -- opencode

# Via environment variable
NONO_STARTUP_TIMEOUT=10 nono run --allow-cwd -- opencode

nono run --no-diagnostics --allow-cwd -- my-command

nono run --capability-elevation --allow-cwd -- my-agent

nono run --allow-cwd --read /etc --dry-run -- my-agent

Capabilities that would be granted:
  [rw] /Users/luke/project
  [r-] /etc
  [net] allowed

Would execute: my-agent

nono run --dry-run -v --profile claude-code -- claude

nono run -vvv --allow-cwd -- command

nono run --trust-override --allow-cwd -- my-agent

nono run --config ./nono.toml -- command

nono run --help

nono why --path ~/.ssh/id_rsa --op read
nono why --path ./my-project --op write

nono why --path ./src --op read
nono why --path ./output --op write
nono why --path ./data --op readwrite

nono why --host api.openai.com --port 443
nono why --self --host https://github.com/my-org/repo

nono why --host example.com --port 8080

nono why --scope signal --profile claude-code
nono why --scope abstract-unix-socket --profile claude-code

nono why --json --path ~/.ssh --op read
# {"status":"denied","reason":"sensitive_path","category":"SSH keys and config",...}

# Inside a sandbox:
nono why --self --path /tmp --op write --json

# Check if ./src would be writable with --allow .
nono why --path ./src --op write --allow .

# Check against a profile
nono why --path ~/.config --op read --profile claude-code

nono trust init                            # Scan root directory only
nono trust init -r                         # Scan recursively
nono trust init -r --exclude-dirs tmp logs # Exclude extra directories
nono trust init --key my-key --force       # Specific key, overwrite existing
nono trust init --keyref file:///path/to/key.pem  # File-backed key

nono trust sign <FILES...>                 # Sign specific files
nono trust sign --all                      # Sign all instruction files in CWD
nono trust sign SKILLS.md --key my-key     # Use a specific key
nono trust sign SKILLS.md --keyref file:///path/to/key.pem  # File-backed key

nono trust sign-policy                     # Sign trust-policy.json in CWD
nono trust sign-policy --user              # Sign user-level trust policy (~/.config/nono/)
nono trust sign-policy path/to/policy.json # Sign specific file
nono trust sign-policy --key my-key        # Use a specific key
nono trust sign-policy --keyref file:///path/to/key.pem  # File-backed key

nono trust verify <FILES...>               # Verify specific files
nono trust verify --all                    # Verify all instruction files in CWD
nono trust verify --policy path/to/policy  # Use specific trust policy

nono trust list                            # Human-readable output
nono trust list --json                     # JSON output

nono trust keygen                          # Default key ID ("default") in system keystore
nono trust keygen --id my-signing-key      # Named key in system keystore
nono trust keygen --keyref file:///path/to/key.pem  # File-backed key

nono trust export-key                      # Export default key (base64 DER)
nono trust export-key --id my-key          # Export named key
nono trust export-key --keyref file:///path/to/key.pem  # Export from file-backed key
nono trust export-key --pem                # Output as PEM format

nono setup --check-only

nono setup --profiles

nono setup --shell-integration

nono setup -v --profiles

# These are equivalent if ./project resolves to /home/user/project
nono run --allow ./project -- command
nono run --allow /home/user/project -- command

nono run \
  --allow ./project \
  --read ~/.config/myapp \
  --write ./logs \
  --read-file ~/.gitconfig \
  -vv \
  -- my-agent --arg1 --arg2

# CI/CD example: configure nono via environment
export NONO_PROFILE=developer
export NONO_ALLOW=/workspace
export NONO_BLOCK_NET=true
nono run -- cargo build