A security-first agent harness powered by nono.

Other harnesses ask the agent to respect a boundary. Nonaut lets it try. The boundary remains technically unavoidable.

A minimal terminal agent where authentication and inference stay in the control plane, while every model-requested tool runs in a fresh, kernel-enforced sandbox.

Usage

Nono 0.80 is embedded directly, so no separate nono installation is needed.

curl -fsSL https://raw.githubusercontent.com/nolabs-ai/nonaut/main/install.sh | sh

The installer selects the correct Linux or macOS binary, verifies its SHA-256 checksum, and installs it to ~/.local/bin. Run it again at any time to install the latest release. Set NONAUT_INSTALL_DIR to choose another directory.

nonaut

Preview

Security model

• Workspace access is read/write; everything outside it is denied.
• Network access is open by default and can be blocked or limited to an allowlist in the sandbox policy.
• Provider credentials and ambient environment variables are not inherited.
• Tool results include concise diffs and sandbox denials.

The TUI and provider connection run normally. Only model-requested execution crosses the nono boundary.

Sandbox policy

By default tools get the workspace, no other paths, and open network. An optional policy.json in nonaut's config directory (~/.config/nonaut/policy.json on Linux) changes that:

{
  "network": "allowlist",
  "allow_hosts": ["crates.io", "*.crates.io", "github.com"],
  "read_paths": ["~/.cargo/registry"],
  "tool_timeout_seconds": 600,
  "workspaces": {
    "~/Work/site": { "allow_hosts": ["registry.npmjs.org"] }
  }
}

• network is open (default), blocked, or allowlist. Open network lets a tool send anything it can read in the workspace anywhere; use blocked or allowlist for code you do not want leaving the machine.
• allow_hosts lets tools reach those hosts over HTTPS (port 443) through a local proxy that checks every connection. *. matches subdomains; * on its own is rejected. Cloud metadata and link-local addresses are always denied.
• read_paths are readable, never writable.
• tool_timeout_seconds (default 120, up to 3600) caps every tool call, command and /exec; raise it for long builds or test suites. When a call times out or is interrupted, everything it started is stopped.
• A workspaces entry adds hosts and paths for that directory and may override network.
• On Linux, allow_hosts needs Landlock network rules (Linux 6.7+); older kernels keep network fully blocked. Landlock limits connections by port rather than address, so the proxy's port is reachable on any host; a seccomp supervisor would close that gap.

The file lives outside the workspace on purpose: tools can write the workspace, so a policy stored there could be edited to widen the sandbox.

Project instructions

If the workspace root has an AGENTS.md (or, failing that, a CLAUDE.md), nonaut adds it to every provider's instructions so the model learns the project's build, test and style conventions. Only a regular file is read, up to 32 KiB; symlinks and hard links are ignored so a tool cannot point it at a file outside the workspace.

Undo

Nonaut snapshots the workspace before every agent turn and /exec. /undo restores the latest snapshot; run it again to step back further. .git, target, node_modules and .gitignored files are not tracked. Snapshots are kept under $XDG_STATE_HOME/nonaut/undo, outside the sandbox's reach, and removed when nonaut exits.

Providers

Nonaut currently supports two providers:

• Codex / ChatGPT through the codex app-server and your existing login.
• Claude through the official claude CLI and subscription login, with ANTHROPIC_API_KEY available as a fallback.

Commands

Nonaut reuses your existing Codex or Claude login and remembers the selected provider, model, and reasoning effort.

Command	Action
/provider	Choose or reconnect a provider
/model	Select a model
/reasoning	Select reasoning effort
/new	Start a fresh session
/exec <command>	Run a command directly inside nono
/undo	Restore files to before the last turn
/theme	Switch between dark and light
/clear	Clear the screen
/detach	Keep the session running and return to the shell
/q	Quit

Up and Down recall earlier prompts in this session. Shift+Enter inserts a newline. Esc interrupts an active response. Sending a new prompt while streaming interrupts the current response first.

/exec does not require a connected provider. It runs through the same fresh, workspace-only nono sandbox used for agent tool calls, which makes policy and denial testing immediate:

/exec ls .
/exec ls ~/.ssh
/exec printf 'hello\n' > test.txt

The same path is available without opening the TUI, which is useful for scripts and policy checks:

nonaut exec -- "ls ."
nonaut exec -- "ls ~/.ssh"

Detached sessions keep their active provider and conversation in a local worker. They are created only when /detach is used and expire after 24 hours while detached.

nonaut ps
nonaut attach <session>
nonaut kill <session>
nonaut kill --all # -a also works

Session metadata follows XDG and is stored under $XDG_STATE_HOME/nonaut/sessions, defaulting to ~/.local/state/nonaut/sessions. Provider credentials are never copied into session metadata.

Development

Building from source requires Rust 1.99.1.

git clone git@github.com:nolabs-ai/nonaut.git
cd nonaut
make run

Development commands:

Command	Action
make ci	Run the complete local CI suite
make run	Build an optimized binary and launch Nonaut
make build	Build the optimized binary
make check	Check formatting, run Clippy, and run unit tests
make script-check	Validate the installer script syntax
make integration	Run provider-free tests against the real sandbox and TUI
make smoke	Smoke-test the release binary through nonaut exec
make fmt	Format the Rust workspace
make lint	Run Clippy with warnings denied
make test	Run the Rust test suite
make clean	Remove Cargo build artifacts

Before opening a pull request, run:

make ci

The integration suite does not connect to a provider or consume model tokens.

Install from main

Developers can build and install the latest main branch directly. This requires Cargo and Rust 1.99.1.

curl -fsSL https://raw.githubusercontent.com/nolabs-ai/nonaut/main/install.sh | sh -s -- --from-main

Running the command again downloads and rebuilds the latest source. Switching between the regular installer and --from-main replaces the existing binary with the selected release or development channel.

Limitations

• Claude subscription access requires the official Claude Code CLI.
• Nonaut does not restore conversations after restart. Provider CLIs may retain their own local session data.

Releases

Push a version tag matching Cargo.toml, such as v0.0.2, to publish signed build provenance, checksums, and binaries for Linux and macOS on x86_64 and ARM64.

License

Licensed under the Apache License 2.0.