Examples

nono run --allow-cwd -- claude

nono run --allow-cwd --read-file ~/.claude/config.json -- claude

nono shell --allow .

nono run --profile openclaw -- openclaw gateway

nono run --allow ~/.openclaw -- openclaw gateway

nono run --allow ./workspace -- my-ai-agent

# Check a sensitive path
nono why --path ~/.ssh/id_rsa --op read
# Output: DENIED - sensitive_path (SSH keys and config)

# JSON output for programmatic use
nono why --json --path ~/.aws --op read
# {"status":"denied","reason":"sensitive_path","category":"AWS credentials",...}

# Would ./src be writable if we use --allow .?
nono why --path ./src --op write --allow .
# Output: ALLOWED - Granted by: --allow .

# Check against a profile
nono why --path ./src --op read --profile claude-code

# AI agents can query their own capabilities
nono run --allow-cwd -- nono why --self --path /tmp --op write --json
# {"status":"denied","reason":"not_in_allowed_paths",...}

# Network is allowed by default
nono why --host api.openai.com --port 443
# Output: ALLOWED - network allowed by default

# Check with network blocked
nono why --host api.openai.com --net-block
# Output: DENIED - network_blocked

# Full build with all access
nono run --allow-cwd -- cargo build

# Read source, write only to target
nono run --read ./src --read ./Cargo.toml --read ./Cargo.lock --allow ./target -- cargo build

# Install dependencies (requires network, allowed by default)
nono run --allow-cwd -- npm install

# Run build (offline)
nono run --allow-cwd --net-block -- npm run build

# Run tests
nono run --allow-cwd -- npm test

nono run --allow-cwd -- make

# Download a file (network allowed by default)
nono run --write ./downloads -- curl -o ./downloads/file.tar.gz https://example.com/file.tar.gz

# API request
nono run --allow-cwd -- curl -X POST https://api.example.com/data

# Clone (network allowed by default)
nono run --allow ./repos -- git clone https://github.com/user/repo.git

# Local operations
nono run --allow-cwd -- git status
nono run --allow-cwd -- git commit -m "message"

# Push/pull (network allowed by default)
nono run --allow-cwd -- git push

nono run --read ./src --allow ./dist -- webpack build

nono run --allow ./project-a --allow ./project-b -- my-tool

nono run --allow-cwd --read ~/.local/share/my-tool -- my-tool

nono run --allow-cwd --read /etc --dry-run -- my-agent

# Maximum verbosity
nono run -vvv --allow-cwd -- command

# Should succeed - writing to allowed path
nono run --allow-cwd -- sh -c "echo test > ./allowed.txt"

# Should fail - writing outside allowed path
nono run --allow-cwd -- sh -c "echo test > /tmp/blocked.txt"

# Should succeed - network allowed by default
nono run --allow-cwd -- curl https://example.com

# Should fail - network blocked with --net-block
nono run --allow-cwd --net-block -- curl https://example.com

nono run --allow-cwd -- ./my-script.sh

nono run --allow-cwd -- sh -c "echo hello && ls -la"

nono run --allow-cwd --read-file ~/.config/myapp/config.toml -- myapp

nono run --allow-cwd \
  --read-file ~/.gitconfig \
  --read-file ~/.npmrc \
  -- my-tool

# Claude Code profile
nono run --profile claude-code -- claude

# OpenClaw profile
nono run --profile openclaw -- openclaw gateway

nono run --profile claude-code --read /tmp/extra -- claude

nono run --profile claude-code --workdir ./my-project -- claude

nono run \
  --read ./src \
  --read ./tests \
  --write ./reviews \
  -- code-review-agent

nono run \
  --read ./src \
  --allow ./docs \
  -- doc-generator

nono run \
  --read ./input \
  --write ./output \
  --read-file ./config.yaml \
  -- data-processor

nono run \
  --allow-cwd \
  --net-block \
  -- make release