> ## Documentation Index
> Fetch the complete documentation index at: https://nono.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Examples

> Runnable nono-ts scenarios in JavaScript and TypeScript

The repository includes end-to-end scenario scripts under `tests/smoke/` in both JavaScript and TypeScript. These run as part of the test suite and also serve as readable usage documentation.

## Run all scenarios

```bash theme={null}
npm run build:debug
npm test
```

## Run a single scenario

```bash theme={null}
# JavaScript
node tests/smoke/js/03-query-policy.js

# TypeScript
node --experimental-strip-types tests/smoke/ts/03-query-policy.ts
```

## Scenarios

| Scenario                     | Purpose                                            |
| ---------------------------- | -------------------------------------------------- |
| `01-support-check`           | Detect and print platform support                  |
| `02-build-capabilities`      | Build capability sets and inspect grants           |
| `03-query-policy`            | Dry-run allow/deny decisions with `QueryContext`   |
| `04-state-roundtrip`         | Serialize and restore policy state                 |
| `05-safe-apply-pattern`      | Guarded irreversible `apply()` flow                |
| `06-minimal-safe-cli`        | Small wrapper pattern for sandbox + transform      |
| `07-agent-workspace-pattern` | Agent-like input/output least-privilege pattern    |
| `08-failure-diagnostics`     | Preflight + runtime denial diagnostics             |
| `09-config-roundtrip`        | Config-driven capability build and state parity    |
| `10-subprocess-inheritance`  | Opt-in `apply()` + child-process inheritance check |

## Safety

`apply(caps)` is irreversible for the lifetime of the process.
`05-safe-apply-pattern` and `10-subprocess-inheritance` only apply the sandbox when `NONO_APPLY=1` is set.

```bash theme={null}
NONO_APPLY=1 node tests/smoke/js/05-safe-apply-pattern.js
NONO_APPLY=1 node tests/smoke/js/10-subprocess-inheritance.js
```

`10-subprocess-inheritance` reports denied reads as:

* `BLOCKED` for `EACCES`/`EPERM` (expected secure behavior)
* `MISSING` for `ENOENT` (target file absent on host)
* `ALLOWED` when access unexpectedly succeeds

## End-to-End Demonstrator

Use the dedicated demonstrator for a full workflow:

```bash theme={null}
npm run demo:dry-run
npm run demo
npm run demo:attack-test
```

See [`Demonstrator`](/typescript/demonstrator) for details.