nono Files

What's Changed

• test: suppress save prompt in socket access tests by @lukehinds in https://github.com/nolabs-ai/nono/pull/1279
• docs(nogent): add nogent markdown file by @lukehinds in https://github.com/nolabs-ai/nono/pull/1288
• chore(ci): refine automation workflow by @lukehinds in https://github.com/nolabs-ai/nono/pull/1292
• refactor(seccomp): introduce SeccompPolicy struct and client-driven selection by @lukehinds in https://github.com/nolabs-ai/nono/pull/1283
• ci: run actionlint by @SequeI in https://github.com/nolabs-ai/nono/pull/1273
• fix(tests): use /tmp for socket test dirs to stay under SUN_LEN limit by @kipz in https://github.com/nolabs-ai/nono/pull/1303
• chore(ci): remove homebrew bump workflow by @SequeI in https://github.com/nolabs-ai/nono/pull/1294
• chore(deps): bump jsonschema from 0.46.5 to 0.46.6 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1306
• chore(deps): bump time from 0.3.49 to 0.3.51 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1307
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1308
• chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1309
• chore(deps): bump rustls from 0.23.40 to 0.23.41 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1310
• chore(deps): bump webpki-roots from 1.0.7 to 1.0.8 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1311
• fix(dynamic-providers): run git config from repo root to honour hasconfig: includeIf by @kipz in https://github.com/nolabs-ai/nono/pull/1313
• fix(execution-runtime): allow env_credentials + command_policies on non-shim entry by @kipz in https://github.com/nolabs-ai/nono/pull/1301
• chore(deps): bump h2 from 0.4.14 to 0.4.15 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1312
• fix(proxy): separate stdin and stderr inheritance for credential helpers by @kipz in https://github.com/nolabs-ai/nono/pull/1300
• fix(profile): empty allow_vars no longer strips all env vars by @SequeI in https://github.com/nolabs-ai/nono/pull/1204
• refactor: load_with_diagnostics should be async by @intentionally-left-nil in https://github.com/nolabs-ai/nono/pull/1287
• feat(gpu): enable nvidia gpu 570+ thread naming by @lukehinds in https://github.com/nolabs-ai/nono/pull/1284
• feat(profile): support CLI profile extends by @acidghost in https://github.com/nolabs-ai/nono/pull/1320
• feat(tool-sandbox): add more git dynamic tokens by @kipz in https://github.com/nolabs-ai/nono/pull/1280
• feat(profile): expand $VAR tokens from process env in capture commands and paths by @kipz in https://github.com/nolabs-ai/nono/pull/1296
• fix(tool-sandbox): ack frame before SCM_RIGHTS send to prevent EMSGSIZE on macOS by @SequeI in https://github.com/nolabs-ai/nono/pull/1325
• fix(pty): drain late terminal query reply on teardown by @sweb in https://github.com/nolabs-ai/nono/pull/1258
• fix(tests): share stdin-manipulation lock between capture_helper stdin tests by @kipz in https://github.com/nolabs-ai/nono/pull/1327
• feat(profile): expand @git:* dynamic tokens in top-level filesystem paths by @kipz in https://github.com/nolabs-ai/nono/pull/1298
• feat: implement aws authentication for the MiTM proxy by @intentionally-left-nil in https://github.com/nolabs-ai/nono/pull/1195
• docs(credential-injection): document AWS SigV4 proxy signing by @DenisDupeyron in https://github.com/nolabs-ai/nono/pull/1329
• docs(profiles): clarify predefined vs user profiles scope by @SequeI in https://github.com/nolabs-ai/nono/pull/1331
• feat: resource limiting by @connrg in https://github.com/nolabs-ai/nono/pull/1269
• fix(linux): use u64 for fs_type_unsupported to fix musl build by @SequeI in https://github.com/nolabs-ai/nono/pull/1332
• fix(trust): add predicate field to distinguish nono trust policies from foreign JSON by @SequeI in https://github.com/nolabs-ai/nono/pull/1333
• feat(tool-sandbox): per-intercept sandbox override + per-command unsafe_macos_seatbelt_rules by @kipz in https://github.com/nolabs-ai/nono/pull/1324
• feat(cli): add standalone nono proxy command by @panga in https://github.com/nolabs-ai/nono/pull/1261
• docs(readme): add tool sandboxing for agents to README by @lukehinds in https://github.com/nolabs-ai/nono/pull/1342
• feat(tool-sandbox): add exec intercept action by @kipz in https://github.com/nolabs-ai/nono/pull/1322
• feat(update-check): emit install_source on update check requests by @scp7 in https://github.com/nolabs-ai/nono/pull/1340
• feat(registry-client): attach installation context headers to registry requests by @scp7 in https://github.com/nolabs-ai/nono/pull/1341
• fix(cli): match intercept args after global options by @SyntaxSawdust in https://github.com/nolabs-ai/nono/pull/1344
• feat(oauth): add declarative sandboxed OAuth capture by @lukehinds in https://github.com/nolabs-ai/nono/pull/1343
• docs: add community health files by @SequeI in https://github.com/nolabs-ai/nono/pull/1348
• fix: use permanent community link across project by @SequeI in https://github.com/nolabs-ai/nono/pull/1349
• fix(tool-sandbox): resolve command policy paths against the live cwd by @kipz in https://github.com/nolabs-ai/nono/pull/1339
• chore: release v0.67.0 by @SequeI in https://github.com/nolabs-ai/nono/pull/1350

New Contributors

• @acidghost made their first contribution in https://github.com/nolabs-ai/nono/pull/1320
• @sweb made their first contribution in https://github.com/nolabs-ai/nono/pull/1258
• @DenisDupeyron made their first contribution in https://github.com/nolabs-ai/nono/pull/1329
• @SyntaxSawdust made their first contribution in https://github.com/nolabs-ai/nono/pull/1344

Full Changelog: https://github.com/nolabs-ai/nono/compare/v0.66.0...v0.67.0