nono

Nolabs AI‘s agent sandbox: a single binary that launches an agent harness (Claude Code, Codex, Copilot, Pi, Hermes, OpenCode, openclaw) inside a least-privilege environment with no daemon, container or VM. Apache-2.0, ~3.2k★ / 216 forks, pre-1.0. macOS, Linux and Windows (WSL2); brew install nono or a shell installer, then nono run --profile <profile> -- <agent>.

It is the clearest instance yet of the enforcement pole that agent-guardrails describes, and it moves the boundary somewhere no source in this wiki had put it.

The tools are the trust boundary, not the agent

Most sandboxing stops at the agent process: one policy, one credential set, one network posture, and everything the agent runs inherits it. nono’s argument is that the interesting privileges belong to the tools the agent delegates to — git, gh, curl, kubectl — and it runs each of them in its own child sandbox with separate filesystem grants, network rules, credentials and policy.

The consequence is the part worth keeping: an agent cannot widen a tool’s permissions from inside its own session, because the tool’s policy was never the agent’s to hold. That answers the failure mode auto-company demonstrates (prose limits plus danger-full-access, with permission prompts turned off when they get inconvenient) at the mechanism level rather than the instruction level.

Credentials the agent never holds

Tokens are injected through a proxy with L7 filtering on API endpoints rather than handed to the agent as environment variables. So a compromised or merely over-enthusiastic agent has access to an endpoint, not to a secret it can exfiltrate or reuse. This is the same move ../defensive-security-wiki’s Beyond Zero makes at enterprise scale — authorize the action rather than trust the holder of the session — arriving independently on a developer laptop the same week.

Policies as composable artifacts

Policies are JSON covering filesystem, network, credentials and tool rules, with profile inheritance (extend a base profile rather than fork it) and a searchable registry at registry.nono.sh publishing per-agent profiles. That makes a sandbox policy a shareable, versioned object — the same packaging move agent-skills made for capability, applied to restriction.

Pedigree and posture

Built by people behind Sigstore, with an OpenSSF Best Practices badge — supply-chain-security provenance rather than agent-framework provenance, which shows in the design. FFI bindings for Rust, Python, TypeScript and Go with separate language packages.

Tier

T3 — a project README, self-described, pre-1.0 with APIs explicitly still moving and 110 open issues. The claim that engineers at large companies run it in production is unattributed. Nothing here is an independent audit, and a sandbox is exactly the sort of thing whose value is decided by audits and escapes rather than by its README. No escape analysis or threat model is summarized in the listing.

agent-guardrails · nolabs-ai · agentic-coding-harness · openclaw · auto-company · run-claude-code-agents-24-hours · agent-skills · synthesis