nono

nono is a working-time security tool based on the protected area (sandbox) that is mandated at the core level for AI agents. It runs vehicles separately temporarily sandbox, excludes API keys from the agent by proxy-based injection, limits network access to the domain name and HTTP rules; verifies skill/instruction files with Sigstore, offers cryptographic control record and recovery from the snapshot. As a single binary file that does not require root authorization, macOS runs on Linux and Windows (WSL2); policies are defined by JSON profiles that can be registryed and expanded.