5.3 KiB
Nono policy fields in this environment
Consult this reference when mapping interview answers into a profile. Treat nono profile validate and the installed parent profiles as authoritative for the installed nono version.
Inheritance
Use a single string-valued extends. Local profiles may extend pi-local, registry profiles such as nolabs-ai/pi, or another available profile. Inheritance is transitive.
Treat included groups and list-valued capabilities as additive. An empty child list does not establish revocation. To create a narrower policy, derive from a narrower parent and add only the required capabilities.
Runtime working directory
workdir.access: "readwrite" grants the directory from which nono launches the process. It does not mean the directory containing the profile.
Use the working-directory grant for a single active repository. Add explicit filesystem paths when one session needs several repositories or client directories.
Filesystem access
Use directory fields for recursive directory-tree access:
| Field | Capability |
|---|---|
filesystem.read |
Read a directory tree |
filesystem.write |
Write a directory tree |
filesystem.allow |
Read and write a directory tree |
Use exact-file fields for one file:
| Field | Capability |
|---|---|
filesystem.read_file |
Read one file |
filesystem.write_file |
Write one file |
filesystem.allow_file |
Read and write one file |
Prefer enumerating exact repositories. Grant a shared parent only after confirming that every current and future child directory may receive the selected capability.
Resolve symlinks before reasoning about access. nono enforcement and audit output may use canonical targets.
Internet tiers
Offline
Derive from nolabs-ai/pi, not allowlisted pi-local. Inherited proxy domains conflict with blocked networking. Clear the inherited URL-opening and service-launch capabilities too:
{
"extends": "nolabs-ai/pi",
"network": {
"block": true
},
"open_urls": {
"allow_origins": [],
"allow_localhost": false
},
"allow_launch_services": false
}
Validate the resolved policy and confirm that it reports network blocked with no approved URL origins.
Allowlisted
Set networking enabled with a non-empty hostname list:
{
"network": {
"block": false,
"allow_domain": [
"example.internal",
"registry.npmjs.org"
]
}
}
Use hostnames only. URL paths belong in credential endpoint rules, not allow_domain.
Inherited hostname lists may remain effective. Derive from nolabs-ai/pi when the intended list must be smaller than pi-local's list.
Collect domains by operation rather than guessing:
- source fetch and issue API
- package metadata and package artifacts/CDNs
- language toolchains and binary downloads
- model or application APIs
- deployment, telemetry, or error reporting
Open
Set networking enabled without a domain allowlist inherited from the chosen parent. Derive from nolabs-ai/pi, not an allowlisted pi-local, unless installed documentation proves the inherited allowlist can be removed.
{
"network": {
"block": false
}
}
State that open mode allows destinations beyond those currently known to the project.
URL opening and service launching
open_urls.allow_origins controls origins that sandboxed tools may ask the host to open. open_urls.allow_localhost controls localhost URL opening. These capabilities remain separate from direct Internet access.
allow_launch_services controls service launching on supported platforms. Set it to false for offline profiles and inspect the inherited value for other tiers.
The installed nolabs-ai/pi parent enables selected OpenAI, Anthropic, and GitHub origins, localhost URL opening, and service launching. Child profiles must review those inherited settings rather than assuming network.block or allow_domain controls them.
Unix sockets
filesystem.unix_socket controls pathname-mediated Unix sockets independently of Internet networking. Add only exact socket paths required by local services. Diagnose socket denials separately from domain denials.
Credentials
Treat a credential route as a separate capability from reaching its domain. Confirm both the route and endpoint restrictions. Prefer nono-mediated credential routes over exposing real API keys inside the sandbox.
Local sources of truth
Read these when behavior or schema details are uncertain:
profiles/nono/pi-local.json~/.config/nono/packages/nolabs-ai/pi/profiles/pi.json~/.config/nono/packages/nolabs-ai/pi/README.md~/.config/nono/packages/nolabs-ai/pi/skills/nono-sandbox/SKILL.md/usr/share/doc/nono-ai-bin/README.mdnono profile --help
Stage candidates under ~/.config/nono/profile-drafts/, then inspect them with:
nono profile validate --draft <name> --strict
nono profile show ~/.config/nono/profile-drafts/<name>.json
Validate the repository copy with nono profile validate --strict profiles/nono/<name>.json.
When promoting over an existing regular active profile, nono requires ~/.config/nono/profile-drafts/<name>.base to contain the active profile's lowercase SHA-256 digest. Prefer nono's profile-edit workflow to create this guard. Preserve the repository symlink convention instead of promotion when the profile belongs in this repository.