Examples

nono run --allow . -- claude

nono run --allow . --read-file ~/.claude/config.json -- claude

nono shell --allow .

nono run --profile openclaw -- openclaw gateway

nono run --allow ~/.openclaw -- openclaw gateway

nono run --allow ./workspace -- my-ai-agent

# Check a sensitive path
nono why --path ~/.ssh/id_rsa --op read
# Output: DENIED - sensitive_path (SSH keys and config)

# JSON output for programmatic use
nono why --json --path ~/.aws --op read
# {"status":"denied","reason":"sensitive_path","category":"AWS credentials",...}

# Would ./src be writable if we use --allow .?
nono why --path ./src --op write --allow .
# Output: ALLOWED - Granted by: --allow .

# Check against a profile
nono why --path ./src --op read --profile always-further/claude

# AI agents can query their own capabilities
nono run --allow-cwd -- nono why --self --path /var --op write --json
# {"status":"denied","reason":"not_in_allowed_paths",...}

# Network is allowed by default
nono why --host api.openai.com --port 443
# Output: ALLOWED - network allowed by default

# Check with network blocked
nono why --host api.openai.com --block-net
# Output: DENIED - network_blocked

# Full build with all access
nono run --allow . -- cargo build

# Read source, write only to target
nono run --read ./src --read ./Cargo.toml --read ./Cargo.lock --allow ./target -- cargo build

# Install dependencies (requires network, allowed by default)
nono run --allow . -- npm install

# Run build (offline)
nono run --allow . --block-net -- npm run build

# Run tests
nono run --allow . -- npm test

nono run --allow . -- make

# Download a file (network allowed by default)
nono run --write ./downloads -- curl -o ./downloads/file.tar.gz https://example.com/file.tar.gz

# API request
nono run --allow-cwd -- curl -X POST https://api.example.com/data

# Clone (network allowed by default)
nono run --allow ./repos -- git clone https://github.com/user/repo.git

# Local operations
nono run --allow . -- git status
nono run --allow . -- git commit -m "message"

# Push/pull (network allowed by default)
nono run --allow . -- git push

nono run --read ./src --allow ./dist -- webpack build

nono run --allow ./project-a --allow ./project-b -- my-tool

nono run --allow . --read ~/.local/share/my-tool -- my-tool

nono run --allow-cwd --read /etc --dry-run -- my-agent

# Maximum verbosity
nono run -vvv --allow-cwd -- command

# Should succeed - writing to allowed path
nono run --allow . -- sh -c "echo test > ./allowed.txt"

# Should fail - writing outside allowed path
nono run --allow-cwd -- sh -c "echo test > /var/blocked.txt"

# Should succeed - network allowed by default
nono run --allow-cwd -- curl https://example.com

# Should fail - network blocked with --block-net
nono run --allow-cwd --block-net -- curl https://example.com

nono run --allow . -- ./my-script.sh

nono run --allow-cwd -- sh -c "echo hello && ls -la"

nono run --allow . --read-file ~/.config/myapp/config.toml -- myapp

nono run --allow . \
  --read-file ~/.gitconfig \
  --read-file ~/.npmrc \
  -- my-tool

# Claude Code profile
nono run --profile always-further/claude -- claude

# OpenClaw profile
nono run --profile openclaw -- openclaw gateway

nono run --profile always-further/claude --read /tmp/extra -- claude

nono run --profile always-further/claude --workdir ./my-project -- claude

nono run --profile always-further/claude --allow-domain api.openai.com -- claude

nono run \
  --read ./src \
  --read ./tests \
  --write ./reviews \
  -- code-review-agent

nono run \
  --read ./src \
  --allow ./docs \
  -- doc-generator

nono run \
  --read ./input \
  --write ./output \
  --read-file ./config.yaml \
  -- data-processor

# AWS agent
nono run \
  --allow-cwd \
  --bypass-protection ~/.aws \
  --allow ~/.aws \
  -- my-aws-agent

# Multi-cloud agent
nono run \
  --allow-cwd \
  --bypass-protection ~/.aws \
  --bypass-protection ~/.config/gcloud \
  --allow ~/.aws \
  --read ~/.config/gcloud \
  -- multi-cloud-agent

nono run \
  --allow-cwd \
  --block-net \
  -- make release

# Terminal 1: MCP server on port 3000 (network blocked except IPC port)
nono run --block-net --open-port 3000 --allow ./mcp-server -- node server.js

# Terminal 2: Agent connects to the MCP server on port 3000
nono run --block-net --open-port 3000 --allow ./agent -- my-agent

# With proxy filtering + localhost IPC
nono run --network-profile claude-code --open-port 3000 --allow-cwd -- claude