nono — The AI Toolchain

nono v0.74.0

Wed, 19 Aug 2026 13:28:06 GMT

nono v0.74.0 adds remote session connect/ps, subtool audit surfacing, export_env pass-through, and configurable approval backends • Adds `nono connect` subcommand to attach a local terminal to a session hosted by nono-console, with `nono connect` for interactive discovery or `nono connect ` to attach directly by global session ID. • Extends `nono ps` with `--remote` flag to list sessions hosted by the enrolled tenant's nono-console, combinable with `--all` and `--json` for full remote session visibility. • Adds `export_env` to tool-sandbox command policy config, letting callers declare specific environment variables to pass through to child tools verbatim, bypassing the `allow_vars` blocklist — supports exact names, trailing-`*` prefixes, or bare `*`. • Adds `session_export_env` key to `command_policies` config for declaring env pass-through when the resolved caller is the session itself rather than a mediated command. • Adds configurable approval backend for supervised-mode prompts via the profile's `approval_backends` and `approval_defaults` config fields. • Surfaces subtool audit events in `nono audit`, making child-tool activity visible alongside the parent session's audit trail. • Extends sandbox policy to allow `unlink` for atomic write temp files, enabling tools that perform atomic writes (write-then-rename) to clean up temp files within policy.

nono v0.73.0

Mon, 10 Aug 2026 15:53:57 GMT

nono v0.73.0 adds glob pattern support in filesystem path fields for profile sandboxes. • Supports glob patterns in filesystem path fields (e.g. `fs_read`, `fs_write`) within profile sandboxes, enabling wildcard-based path grants without enumerating individual paths.

nono v0.72.0

Fri, 07 Aug 2026 13:35:40 GMT

nono v0.72.0 adds a static seccomp network baseline on Linux, explicit deny-path reporting in `why`, and ships a musl release artifact. • Adds a static seccomp network baseline on Linux (alongside Landlock) under the `auto` `--sandbox-policy` mode, strengthening network restriction on kernels where Landlock ABI < V4. • Extends the `why` subcommand to report explicit deny paths from sandbox policy, making it easier to diagnose why a specific network or filesystem access was blocked. • Ships a musl release artifact, enabling deployment on musl-based Linux distributions without a glibc dependency. • Removes `openclaw` and `swival` as built-in profiles; users relying on them must supply their own profile going forward. Breaking changes: • The `openclaw` and `swival` built-in profiles have been removed; any `nono run --profile openclaw` or `nono run --profile swival` invocation will fail after upgrading. • The `external` value for `--sandbox-policy` on Linux now keeps Landlock active for filesystem/process policy while only delegating TCP enforcement externally, rather than installing no sandbox at all.

nono v0.71.0

Fri, 31 Jul 2026 15:00:59 GMT

nono v0.71.0 adds a `platform` subcommand for audit control-plane enrollment and removes the deprecated `learn` command. • Adds `nono platform` subcommand for enrolling with and inspecting an audit control plane, enabling centralised audit delivery at scale. • Removes the deprecated `nono learn` command (deprecated since v0.50.1). Breaking changes: • The `nono learn` subcommand has been removed. Any scripts or workflows invoking `nono learn` will break; use `nono run` instead.

nono v0.70.0

Wed, 29 Jul 2026 15:01:22 GMT

nono v0.70.0 adds SPIFFE/SPIRE workload identity, per-route rate limiting, JWT-shaped capture nonces, Vault OIDC mediation, and profile-declared no_proxy bypass • Adds `CapturedNonceShape` with a `jwt` option for capture intercepts, emitting a `

..nono_<64hex>` token so consumers that validate JWT structure before use can still resolve the embedded nonce. • Adds per-route request rate limiting via `RouteRateLimiter` on proxy upstream routes, letting profiles cap how many requests an agent or tool can send through a given route. • Adds SPIFFE/SPIRE workload identity auth for upstream proxy routes, enabling mutual workload attestation without static credentials. • Adds mediation for `vault login -method=oidc` with support for a custom `inject_header` and a per-command `open_port`, so Vault OIDC flows can complete inside a sandboxed tool policy. • Adds profile-declared `no_proxy` bypass support, letting profiles explicitly list hosts that should skip the proxy. • New CLI prompt at session exit offers to save denied open-url origins, turning one-off denials into persistent policy without manual profile edits.