nono

Why we included this project

Letting a coding agent run commands on your machine means giving it access to your files, and nono is a lightweight way to keep that from becoming a problem. It doesn't wrap the agent in a container or VM; instead it uses the OS's own isolation, Landlock on Linux and Seatbelt on macOS, to give the agent a least-privilege sandbox with almost no overhead, no daemon, and no disk usage. It adds a capability-based policy layer, diagnostics, secure key management, and atomic rollback, so a misbehaving model can't quietly rewrite files and leave you with no way to undo it. If you run agents like Claude Code, Codex, or OpenCode in personal or CI workflows and you care about execution and supply-chain security, it's worth evaluating against your own threat model.