> ## Documentation Index
> Fetch the complete documentation index at: https://nono.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Examples

> Runnable nono-ts examples in JavaScript and TypeScript

The repository includes runnable examples for the most common `nono-ts` workflows.
These files in `examples/` are the source of truth. Keep docs snippets aligned to them.

## Run from repository root

```bash theme={null}
npm run build:debug
npm run examples:list
npm run example:all
```

Run a single scenario:

```bash theme={null}
npm run example:js:03-query-policy
npm run example:ts:03-query-policy
```

TypeScript scripts use Node's `--experimental-strip-types` and are best run on Node 22+.

## Scenarios

| Scenario                     | JavaScript                                  | TypeScript                                  | Purpose                                            |
| ---------------------------- | ------------------------------------------- | ------------------------------------------- | -------------------------------------------------- |
| `01-support-check`           | `examples/js/01-support-check.js`           | `examples/ts/01-support-check.ts`           | Detect and print platform support                  |
| `02-build-capabilities`      | `examples/js/02-build-capabilities.js`      | `examples/ts/02-build-capabilities.ts`      | Build capability sets and inspect grants           |
| `03-query-policy`            | `examples/js/03-query-policy.js`            | `examples/ts/03-query-policy.ts`            | Dry-run allow/deny decisions with `QueryContext`   |
| `04-state-roundtrip`         | `examples/js/04-state-roundtrip.js`         | `examples/ts/04-state-roundtrip.ts`         | Serialize and restore policy state                 |
| `05-safe-apply-pattern`      | `examples/js/05-safe-apply-pattern.js`      | `examples/ts/05-safe-apply-pattern.ts`      | Guarded irreversible `apply()` flow                |
| `06-minimal-safe-cli`        | `examples/js/06-minimal-safe-cli.js`        | `examples/ts/06-minimal-safe-cli.ts`        | Small wrapper pattern for sandbox + transform      |
| `07-agent-workspace-pattern` | `examples/js/07-agent-workspace-pattern.js` | `examples/ts/07-agent-workspace-pattern.ts` | Agent-like input/output least-privilege pattern    |
| `08-failure-diagnostics`     | `examples/js/08-failure-diagnostics.js`     | `examples/ts/08-failure-diagnostics.ts`     | Preflight + runtime denial diagnostics             |
| `09-config-roundtrip`        | `examples/js/09-config-roundtrip.js`        | `examples/ts/09-config-roundtrip.ts`        | Config-driven capability build and state parity    |
| `10-subprocess-inheritance`  | `examples/js/10-subprocess-inheritance.js`  | `examples/ts/10-subprocess-inheritance.ts`  | Opt-in `apply()` + child-process inheritance check |

## Safety

`apply(caps)` is irreversible for the lifetime of the process.\
`05-safe-apply-pattern` only applies the sandbox when `NONO_APPLY=1` is set.

```bash theme={null}
NONO_APPLY=1 npm run example:js:05-safe-apply-pattern
NONO_APPLY=1 npm run example:ts:05-safe-apply-pattern
NONO_APPLY=1 npm run example:js:10-subprocess-inheritance
NONO_APPLY=1 npm run example:ts:10-subprocess-inheritance
```

`10-subprocess-inheritance` reports denied reads as:

* `BLOCKED` for `EACCES`/`EPERM` (expected secure behavior)
* `MISSING` for `ENOENT` (target file absent on host)
* `ALLOWED` when access unexpectedly succeeds

## End-to-End Demonstrator

Use the dedicated demonstrator for a full workflow:

```bash theme={null}
npm run demo:dry-run
npm run demo
npm run demo:attack-test
```

See [`Demonstrator`](/typescript/demonstrator) for details.