CHANGELOG.md

# Changelog

## [0.72.0] - 2026-08-07

### Bug Fixes

- *(proxy)* Fail closed on non-granted endpoint approvals in TLS intercept (#1585) ([#1585](https://github.com/nolabs-ai/nono/pull/1585))

- *(deps)* Update event-listener 5.4.1 → 5.4.2 (RUSTSEC-2026-0221) (#1581) ([#1581](https://github.com/nolabs-ai/nono/pull/1581))

- Allow config files for Claude (#1547) ([#1547](https://github.com/nolabs-ai/nono/pull/1547))

- *(exec)* Update `PWD` with `--workdir` (#1564) ([#1564](https://github.com/nolabs-ai/nono/pull/1564))

- *(profile)* Preserve user profile source context (#1571) ([#1571](https://github.com/nolabs-ai/nono/pull/1571))

- *(why)* Fail on unresolvable network policy instead of degrading (#1554) ([#1554](https://github.com/nolabs-ai/nono/pull/1554))


### CI/CD

- Add doc tests to CI and ship musl release artifact (#1578) ([#1578](https://github.com/nolabs-ai/nono/pull/1578))

- *(issue-triage)* Remove automatic triage label on new issues (#1575) ([#1575](https://github.com/nolabs-ai/nono/pull/1575))

- Add COPR build validation on release PRs (#1572) ([#1572](https://github.com/nolabs-ai/nono/pull/1572))


### Dependencies

- *(deps)* Bump prettyplease from 0.2.37 to 0.3.0 (#1563) ([#1563](https://github.com/nolabs-ai/nono/pull/1563))

- *(deps)* Bump tokio from 1.52.3 to 1.53.1 (#1562) ([#1562](https://github.com/nolabs-ai/nono/pull/1562))

- *(deps)* Bump uuid from 1.23.5 to 1.24.0 (#1561) ([#1561](https://github.com/nolabs-ai/nono/pull/1561))

- *(deps)* Bump sigstore-verify from 0.9.0 to 0.11.0 (#1560) ([#1560](https://github.com/nolabs-ai/nono/pull/1560))

- *(deps)* Bump aws-config from 1.9.0 to 1.10.1 (#1558) ([#1558](https://github.com/nolabs-ai/nono/pull/1558))

- *(deps)* Bump actions/attest from 4.2.0 to 4.2.1 (#1559) ([#1559](https://github.com/nolabs-ai/nono/pull/1559))

- *(deps)* Bump docker/login-action from 4.5.1 to 4.6.0 (#1557) ([#1557](https://github.com/nolabs-ai/nono/pull/1557))


### Documentation

- *(profiles)* Clarify profiles dir is read-only by default, unless explicitly allowed via `--allow` (#1587) ([#1587](https://github.com/nolabs-ai/nono/pull/1587))

- *(cli)* Fix curl command for fetching latest version (#1569) ([#1569](https://github.com/nolabs-ai/nono/pull/1569))


### Features

- *(sandbox)* Add static seccomp network baseline on linux (#1590) ([#1590](https://github.com/nolabs-ai/nono/pull/1590))

- *(why)* Report explicit deny paths from sandbox policy (#1556) ([#1556](https://github.com/nolabs-ai/nono/pull/1556))

- *(profiles)* Remove openclaw and swival as built-in profiles (#1582) ([#1582](https://github.com/nolabs-ai/nono/pull/1582))

## [0.71.0] - 2026-07-31

### Bug Fixes

- *(query)* Dont widen grant suggestions to $HOME or XDG roots (#1541) ([#1541](https://github.com/nolabs-ai/nono/pull/1541))

- *(tool-sandbox)* Collapse command-not-found warnings into one summary line (#1550) ([#1550](https://github.com/nolabs-ai/nono/pull/1550))

- *(deps)* Bump aws-lc-rs to 1.17.3 for hardened RPM builds (#1544) ([#1544](https://github.com/nolabs-ai/nono/pull/1544))

- *(audit)* Record and show seccomp capability decisions (#1525) ([#1525](https://github.com/nolabs-ai/nono/pull/1525))

- *(macos)* Group-sourced keychain caps must not bypass deny_keychains_macos (#1539) ([#1539](https://github.com/nolabs-ai/nono/pull/1539))

- *(profile)* Resolve symlinked parent extends (#1536) ([#1536](https://github.com/nolabs-ai/nono/pull/1536))

- *(profile)* Child overrides base in env_credentials by destination env var (#1533) ([#1533](https://github.com/nolabs-ai/nono/pull/1533))

- Allow non-UTF-8 command line arguments (#1521) ([#1521](https://github.com/nolabs-ai/nono/pull/1521))

- *(profile)* Include all Unix socket grant fields in JSON output (#1516) ([#1516](https://github.com/nolabs-ai/nono/pull/1516))


### Dependencies

- *(deps)* Bump x509-cert from 0.2.5 to 0.3.0 (#1462) ([#1462](https://github.com/nolabs-ai/nono/pull/1462))


### Documentation

- Add git_config paths and document --format manifest for profile show (#1545) ([#1545](https://github.com/nolabs-ai/nono/pull/1545))

- *(supervisor)* Clarify that capability elevation is disabled by default (#1540) ([#1540](https://github.com/nolabs-ai/nono/pull/1540))

- Fix examples that used /tmp as a blocked path on Linux (#1531) ([#1531](https://github.com/nolabs-ai/nono/pull/1531))

- *(profile)* Add profile-drafts section to guide (#1530) ([#1530](https://github.com/nolabs-ai/nono/pull/1530))


### Features

- *(cli)* Add platform enrollment and audit delivery (#1538) ([#1538](https://github.com/nolabs-ai/nono/pull/1538))


### Miscellaneous

- Remove deprecated nono learn command (#1543) ([#1543](https://github.com/nolabs-ai/nono/pull/1543))

## [0.70.0] - 2026-07-27

### Bug Fixes

- *(undo)* Skip symlinks when walking snapshots (#1493) ([#1493](https://github.com/nolabs-ai/nono/pull/1493))

- *(registry)* Suppress X-Nono-UUID when update check is opted out (#1508) ([#1508](https://github.com/nolabs-ai/nono/pull/1508))

- *(cli)* Add explicit intercept match predicates (#1364) ([#1364](https://github.com/nolabs-ai/nono/pull/1364))

- *(pty)* Capability-elevation approval prompt PTY handoff (#1254) ([#1254](https://github.com/nolabs-ai/nono/pull/1254))

- *(tool-sandbox)* Clean up runtime dir with sealed shims (#1492) ([#1492](https://github.com/nolabs-ai/nono/pull/1492))

- *(proxy)* Prevent credential from enabling host filter (#1497) ([#1497](https://github.com/nolabs-ai/nono/pull/1497))

- *(cli)* Support SOCKS proxies from environment (#1474) ([#1474](https://github.com/nolabs-ai/nono/pull/1474))

- *(sandbox)* Grant metadata read on $PATH dirs for command resolution (#1455) ([#1455](https://github.com/nolabs-ai/nono/pull/1455))

- *(tool-sandbox)* Grant command interpreter read of its script (#1467) ([#1467](https://github.com/nolabs-ai/nono/pull/1467))

- *(pr-template)* Redundant release note check-box (#1499) ([#1499](https://github.com/nolabs-ai/nono/pull/1499))

- *(tool-sandbox)* Let allow_launch_services reach the open shim on macOS (#1464) ([#1464](https://github.com/nolabs-ai/nono/pull/1464))

- *(policy)* Survive atomic replacement of resolv.conf; report stale … (#1448) ([#1448](https://github.com/nolabs-ai/nono/pull/1448))

- *(tool-sandbox)* Skip missing fs_write_file grants instead of denying (#1452) ([#1452](https://github.com/nolabs-ai/nono/pull/1452))

- *(cli)* Reject upstream proxy with block net (#1392) ([#1392](https://github.com/nolabs-ai/nono/pull/1392))

- *(session)* Route attach socket through symlink ([#1477](https://github.com/nolabs-ai/nono/pull/1477))

- *(tool-sandbox)* Drop trailing newline from captured credential phantoms (#1475) ([#1475](https://github.com/nolabs-ai/nono/pull/1475))


### CI/CD

- *(release)* Add macos code signing and notarization (#1483) ([#1483](https://github.com/nolabs-ai/nono/pull/1483))


### Dependencies

- *(deps)* Bump hyper from 1.10.1 to 1.11.0 (#1513) ([#1513](https://github.com/nolabs-ai/nono/pull/1513))

- *(deps)* Bump base64 from 0.22.1 to 0.23.0 (#1512) ([#1512](https://github.com/nolabs-ai/nono/pull/1512))

- *(deps)* Bump clap from 4.6.2 to 4.6.4 (#1510) ([#1510](https://github.com/nolabs-ai/nono/pull/1510))

- *(deps)* Bump docker/login-action from 4.4.0 to 4.5.1 (#1511) ([#1511](https://github.com/nolabs-ai/nono/pull/1511))

- *(deps)* Bump actions/checkout from 7.0.0 to 7.0.1 (#1509) ([#1509](https://github.com/nolabs-ai/nono/pull/1509))

- *(deps)* Bump jsonschema from 0.46.10 to 0.48.0 (#1460) ([#1460](https://github.com/nolabs-ai/nono/pull/1460))

- *(deps)* Bump clap from 4.6.1 to 4.6.2 (#1461) ([#1461](https://github.com/nolabs-ai/nono/pull/1461))

- *(deps)* Bump ignore from 0.4.29 to 0.4.30 (#1458) ([#1458](https://github.com/nolabs-ai/nono/pull/1458))

- *(deps)* Bump actions/cache from 5.0.5 to 6.1.0 (#1457) ([#1457](https://github.com/nolabs-ai/nono/pull/1457))

- *(deps)* Bump actions/attest from 4.1.1 to 4.2.0 (#1456) ([#1456](https://github.com/nolabs-ai/nono/pull/1456))

- *(deps)* Bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#1459) ([#1459](https://github.com/nolabs-ai/nono/pull/1459))


### Features

- Mediate vault login -method=oidc (custom inject header + per-command open_port) (#1476) ([#1476](https://github.com/nolabs-ai/nono/pull/1476))

- *(cli)* Offer to save denied open-url origins on exit (#1222) ([#1222](https://github.com/nolabs-ai/nono/pull/1222))

- *(proxy)* Add per-route request rate limiting (RouteRateLimiter) (#1428) ([#1428](https://github.com/nolabs-ai/nono/pull/1428))

- *(tool-sandbox)* Add jwt-shaped nonce option for capture intercepts (#1453) ([#1453](https://github.com/nolabs-ai/nono/pull/1453))


### Miscellaneous

- Release v0.69.0 (#1449) ([#1449](https://github.com/nolabs-ai/nono/pull/1449))


### Testing

- *(nono-cli)* Hermetic git test commit.gpgsign (#1470) ([#1470](https://github.com/nolabs-ai/nono/pull/1470))

## [0.69.0] - 2026-07-20

### Bug Fixes

- *(proxy)* Don't cross-deny sibling routes sharing an upstream (#1437) ([#1437](https://github.com/nolabs-ai/nono/pull/1437))

- *(tool-sandbox)* Attribute daemonized callers to their command (cgroup on linux, verified daemon-pid on macos) (#1417) ([#1417](https://github.com/nolabs-ai/nono/pull/1417))

- *(exec)* Raise MAX_CRYPTO_THREADS to 12 for macOS libdispatch workqueue threads (#1424) ([#1424](https://github.com/nolabs-ai/nono/pull/1424))

- *(sandbox)* Allow exec in writable grant-dirs under command policies (#1391) ([#1391](https://github.com/nolabs-ai/nono/pull/1391))


### Documentation

- *(profiles)* Fix codeblock (#1426) ([#1426](https://github.com/nolabs-ai/nono/pull/1426))


### Features

- Add profile-declared no_proxy bypass support (#1415) ([#1415](https://github.com/nolabs-ai/nono/pull/1415))

- *(proxy)* Add SPIFFE/SPIRE workload identity auth for upstream routes (#1272) ([#1272](https://github.com/nolabs-ai/nono/pull/1272))


### Bug

- Fix SigV4 URI generation errors for uri's that have encoded characters in them (#1430) ([#1430](https://github.com/nolabs-ai/nono/pull/1430))

## [0.68.0] - 2026-07-14

### Bug Fixes

- *(tool-sandbox)* Preserve argv[0] for symlink-dispatched commands (#1413) ([#1413](https://github.com/nolabs-ai/nono/pull/1413))

- *(sandbox)* Keep orphaned descendants in supervisor ancestry for seccomp-notify mediation (#1401) ([#1401](https://github.com/nolabs-ai/nono/pull/1401))

- *(profile)* Omit inheritable Option fields when None on save (#1400) (#1402) ([#1402](https://github.com/nolabs-ai/nono/pull/1402))

- *(sandbox)* Grant Refer in execute-restriction layer on Linux (#1397) ([#1397](https://github.com/nolabs-ai/nono/pull/1397))

- Missing ~/.cache on macOS (#1378) ([#1378](https://github.com/nolabs-ai/nono/pull/1378))

- *(tool-sandbox)* Grant env-shebang scripts their re-exec interpreter (#1394) ([#1394](https://github.com/nolabs-ai/nono/pull/1394))

- *(registry)* Add X-Nono-Pull-Reason header to distinguish pull triggers (#1383) (#1386) ([#1386](https://github.com/nolabs-ai/nono/pull/1386))

- *(profile)* Preserve platform_overrides through extends resolution (#1380) ([#1380](https://github.com/nolabs-ai/nono/pull/1380))

- *(command-policy)* Resolve command_policies binaries once, in parallel, with caching (#1373) ([#1373](https://github.com/nolabs-ai/nono/pull/1373))

- *(why)* Respect proxy domain filter in --profile and --self host queries (#1372) ([#1372](https://github.com/nolabs-ai/nono/pull/1372))

- *(proxy)* Skip credential_capture entries with missing helper binaries (#1368) ([#1368](https://github.com/nolabs-ai/nono/pull/1368))


### Dependencies

- *(deps)* Bump sigstore-trust-root from 0.9.0 to 0.11.0 (#1410) ([#1410](https://github.com/nolabs-ai/nono/pull/1410))

- *(deps)* Bump bytes from 1.12.0 to 1.12.1 (#1408) ([#1408](https://github.com/nolabs-ai/nono/pull/1408))

- *(deps)* Bump regex from 1.12.4 to 1.13.0 (#1406) ([#1406](https://github.com/nolabs-ai/nono/pull/1406))

- *(deps)* Bump sigstore-sign from 0.10.0 to 0.11.0 (#1407) ([#1407](https://github.com/nolabs-ai/nono/pull/1407))

- *(deps)* Bump crossbeam-epoch from 0.9.18 to 0.9.20 (#1369) ([#1369](https://github.com/nolabs-ai/nono/pull/1369))

- *(deps)* Bump clap_complete from 4.6.5 to 4.6.7 (#1360) ([#1360](https://github.com/nolabs-ai/nono/pull/1360))

- *(deps)* Bump ignore from 0.4.26 to 0.4.27 (#1363) ([#1363](https://github.com/nolabs-ai/nono/pull/1363))

- *(deps)* Bump time from 0.3.52 to 0.3.53 (#1358) ([#1358](https://github.com/nolabs-ai/nono/pull/1358))

- *(deps)* Bump rand from 0.10.1 to 0.10.2 (#1362) ([#1362](https://github.com/nolabs-ai/nono/pull/1362))

- *(deps)* Bump sigstore-sign from 0.8.0 to 0.10.0 (#1361) ([#1361](https://github.com/nolabs-ai/nono/pull/1361))

- *(deps)* Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (#1359) ([#1359](https://github.com/nolabs-ai/nono/pull/1359))

- *(deps)* Bump docker/login-action from 4.2.0 to 4.4.0 (#1357) ([#1357](https://github.com/nolabs-ai/nono/pull/1357))

- *(deps)* Bump nolabs-ai/agent-sign from 0.0.11 to 0.1.0 (#1355) ([#1355](https://github.com/nolabs-ai/nono/pull/1355))

- *(deps)* Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#1354) ([#1354](https://github.com/nolabs-ai/nono/pull/1354))

- *(deps)* Bump docker/build-push-action from 7.2.0 to 7.3.0 (#1356) ([#1356](https://github.com/nolabs-ai/nono/pull/1356))


### Documentation

- *(codex)* Clarify codex docs around the optional login-shell hardening (#1381) ([#1381](https://github.com/nolabs-ai/nono/pull/1381))


### Features

- *(resources)* Cap sandbox process count with --max-processes (cgroup v2 pids.max) (#1403) ([#1403](https://github.com/nolabs-ai/nono/pull/1403))

- Add port range support to sandbox profiles (#1398) ([#1398](https://github.com/nolabs-ai/nono/pull/1398))

- *(policy)* Add bun runtime preset (#1305) ([#1305](https://github.com/nolabs-ai/nono/pull/1305))

- *(proxy)* Support plain HTTP forward-proxying via HTTP_PROXY (#1335) ([#1335](https://github.com/nolabs-ai/nono/pull/1335))

- *(tool-sandbox)* Add per-command exec_paths for multi-call binaries (#1384) ([#1384](https://github.com/nolabs-ai/nono/pull/1384))

- *(proxy)* Add deny_domain to block domains through the proxy (#1374) ([#1374](https://github.com/nolabs-ai/nono/pull/1374))

- *(profile)* Add platform_overrides field for per-OS profile patches (#1371) ([#1371](https://github.com/nolabs-ai/nono/pull/1371))


### Miscellaneous

- Migrate registry namespace references from always-further to nolabs-ai (#1405) ([#1405](https://github.com/nolabs-ai/nono/pull/1405))

## [0.67.1] - 2026-07-06

### Bug Fixes

- *(release)* Strip ./ prefix from SHA256SUMS.txt entries (#1352) ([#1352](https://github.com/nolabs-ai/nono/pull/1352))

## [0.67.0] - 2026-07-06

### Bug Fixes

- *(tool-sandbox)* Resolve command policy paths against the live cwd (#1339) ([#1339](https://github.com/nolabs-ai/nono/pull/1339))

- Use permanent community link across project (#1349) ([#1349](https://github.com/nolabs-ai/nono/pull/1349))

- *(cli)* Match intercept args after global options (#1344) ([#1344](https://github.com/nolabs-ai/nono/pull/1344))

- *(oauth)* Harden capture security boundaries

- *(tool-sandbox)* Strip untrusted unsafe_macos_seatbelt_rules before emission

- *(tool-sandbox)* Warn on unsafe_macos_seatbelt_rules nested in command/intercept sandboxes

- *(tests)* Raise credential-capture test timeout to reduce macOS CI flakiness

- *(trust)* Add predicate field to distinguish nono trust policies from foreign JSON (#1333) ([#1333](https://github.com/nolabs-ai/nono/pull/1333))

- *(linux)* Use u64 for fs_type_unsupported to fix musl build (#1332) ([#1332](https://github.com/nolabs-ai/nono/pull/1332))

- *(tests)* Share stdin-manipulation lock between capture_helper stdin tests (#1327) ([#1327](https://github.com/nolabs-ai/nono/pull/1327))

- *(pty)* Drain late terminal query reply on teardown (#1258) ([#1258](https://github.com/nolabs-ai/nono/pull/1258))

- *(tool-sandbox)* Ack frame before SCM_RIGHTS send to prevent EMSGSIZE on macOS (#1325) ([#1325](https://github.com/nolabs-ai/nono/pull/1325))

- *(profile)* Empty allow_vars no longer strips all env vars (#1204) ([#1204](https://github.com/nolabs-ai/nono/pull/1204))

- *(proxy)* Separate stdin and stderr inheritance for credential helpers (#1300) ([#1300](https://github.com/nolabs-ai/nono/pull/1300))

- *(execution-runtime)* Allow env_credentials + command_policies on non-shim entry (#1301) ([#1301](https://github.com/nolabs-ai/nono/pull/1301))

- *(dynamic-providers)* Run git config from repo root to honour hasconfig: includeIf (#1313) ([#1313](https://github.com/nolabs-ai/nono/pull/1313))

- *(tests)* Use /tmp for socket test dirs to stay under SUN_LEN limit (#1303) ([#1303](https://github.com/nolabs-ai/nono/pull/1303))


### CI/CD

- Run actionlint (#1273) ([#1273](https://github.com/nolabs-ai/nono/pull/1273))


### Dependencies

- *(deps)* Bump h2 from 0.4.14 to 0.4.15 (#1312) ([#1312](https://github.com/nolabs-ai/nono/pull/1312))

- *(deps)* Bump webpki-roots from 1.0.7 to 1.0.8 (#1311) ([#1311](https://github.com/nolabs-ai/nono/pull/1311))

- *(deps)* Bump rustls from 0.23.40 to 0.23.41 (#1310) ([#1310](https://github.com/nolabs-ai/nono/pull/1310))

- *(deps)* Bump actions/attest from 4.1.0 to 4.1.1 (#1309) ([#1309](https://github.com/nolabs-ai/nono/pull/1309))

- *(deps)* Bump actions/cache from 5.0.5 to 6.1.0 (#1308) ([#1308](https://github.com/nolabs-ai/nono/pull/1308))

- *(deps)* Bump time from 0.3.49 to 0.3.51 (#1307) ([#1307](https://github.com/nolabs-ai/nono/pull/1307))

- *(deps)* Bump jsonschema from 0.46.5 to 0.46.6 (#1306) ([#1306](https://github.com/nolabs-ai/nono/pull/1306))


### Documentation

- Add community health files (#1348) ([#1348](https://github.com/nolabs-ai/nono/pull/1348))

- *(readme)* Explain tool sandboxing for agents (#1342) ([#1342](https://github.com/nolabs-ai/nono/pull/1342))

- *(cli/profile)* Simplify credential provider def doc comment

- *(profiles)* Clarify predefined vs user profiles scope (#1331) ([#1331](https://github.com/nolabs-ai/nono/pull/1331))

- *(credential-injection)* Document AWS SigV4 proxy signing (#1329) ([#1329](https://github.com/nolabs-ai/nono/pull/1329))

- *(nogent)* Add nogent markdown file (#1288) ([#1288](https://github.com/nolabs-ai/nono/pull/1288))


### Features

- *(registry-client)* Attach installation context headers to registry requests (#1341) ([#1341](https://github.com/nolabs-ai/nono/pull/1341))

- *(update-check)* Emit install_source on update check requests (#1340) ([#1340](https://github.com/nolabs-ai/nono/pull/1340))

- *(tool-sandbox)* Add exec intercept action (#1322) ([#1322](https://github.com/nolabs-ai/nono/pull/1322))

- *(oauth)* Add declarative sandboxed OAuth capture

- *(cli)* Add standalone `nono proxy` command (#1261) ([#1261](https://github.com/nolabs-ai/nono/pull/1261))

- *(tool-sandbox)* Per-command unsafe_macos_seatbelt_rules escape hatch

- *(tool-sandbox)* Per-intercept sandbox override

- Resource limiting (#1269) ([#1269](https://github.com/nolabs-ai/nono/pull/1269))

- Implement aws authentication for the MiTM proxy  (#1195) ([#1195](https://github.com/nolabs-ai/nono/pull/1195))

- *(profile)* Expand @git:* dynamic tokens in top-level filesystem paths (#1298) ([#1298](https://github.com/nolabs-ai/nono/pull/1298))

- *(profile)* Expand $VAR tokens from process env in profile paths and capture commands (#1296) ([#1296](https://github.com/nolabs-ai/nono/pull/1296))

- *(tool-sandbox)* Add git worktree tokens; fold include-files into @git:config-files (#1280) ([#1280](https://github.com/nolabs-ai/nono/pull/1280))

- *(profile)* Support CLI profile extends (#1320) ([#1320](https://github.com/nolabs-ai/nono/pull/1320))

- *(gpu)* Harden NVIDIA procfs mediation (#1284) ([#1284](https://github.com/nolabs-ai/nono/pull/1284))


### Miscellaneous

- *(ci)* Remove homebrew bump workflow (#1294) ([#1294](https://github.com/nolabs-ai/nono/pull/1294))

- *(ci)* Refine automation workflow (#1292) ([#1292](https://github.com/nolabs-ai/nono/pull/1292))


### Refactoring

- *(seccomp)* Introduce SeccompPolicy struct and client-driven selection (#1283) ([#1283](https://github.com/nolabs-ai/nono/pull/1283))


### Testing

- *(oauth)* Consume provider stdin in header fixture

- Suppress save prompt in socket access tests (#1279) ([#1279](https://github.com/nolabs-ai/nono/pull/1279))

## [0.66.0] - 2026-06-29

### Bug Fixes

- *(network)* Error early on contradictory network flag combinations (#1263) ([#1263](https://github.com/nolabs-ai/nono/pull/1263))

- *(network)* Wire --allow-endpoint through to credential routes (#1127) ([#1127](https://github.com/nolabs-ai/nono/pull/1127))

- *(sandbox)* Warn when capability path is on a 9P filesystem (#1207) ([#1207](https://github.com/nolabs-ai/nono/pull/1207))

- *(ci)* Downgrade runner to ubuntu-latest (#1259) ([#1259](https://github.com/nolabs-ai/nono/pull/1259))

- *(tool-sandbox)* Skip missing fs_read/fs_write dirs instead of erroring (#1253) ([#1253](https://github.com/nolabs-ai/nono/pull/1253))

- *(tool-sandbox)* Pass TLS trust bundle env vars to tool-sandbox children (#1249) ([#1249](https://github.com/nolabs-ai/nono/pull/1249))

- *(proxy)* Match wildcard credential upstream routes (#1243) ([#1243](https://github.com/nolabs-ai/nono/pull/1243))


### CI/CD

- Fix mapping err in compile step (#1251) ([#1251](https://github.com/nolabs-ai/nono/pull/1251))

- Idempotent publish-crates + cross-compile check on release PRs (#1245) ([#1245](https://github.com/nolabs-ai/nono/pull/1245))


### Dependencies

- *(deps)* Bump sigstore-trust-root from 0.8.0 to 0.9.0 (#1229) ([#1229](https://github.com/nolabs-ai/nono/pull/1229))

- *(deps)* Bump criterion from 0.5.1 to 0.8.2 (#1232) ([#1232](https://github.com/nolabs-ai/nono/pull/1232))


### Documentation

- *(proxy)* Explain proxy activation via custom credentials (#1247) ([#1247](https://github.com/nolabs-ai/nono/pull/1247))

- *(proxy)* Fix stale X-Nono-Token authentication claim (#1246) ([#1246](https://github.com/nolabs-ai/nono/pull/1246))


### Features

- *(tool-sandbox)* Simplify self-invocation policy (#1268) ([#1268](https://github.com/nolabs-ai/nono/pull/1268))

- *(tool-sandbox)* Add @git:common-dir dynamic token (#1271) ([#1271](https://github.com/nolabs-ai/nono/pull/1271))

- *(proxy)* Add HTTP/2 support for reverse proxy and credential injection (#983) ([#983](https://github.com/nolabs-ai/nono/pull/983))

- *(tests)* Add end-to-end integration tests for sandbox execution strategies (#1213) ([#1213](https://github.com/nolabs-ai/nono/pull/1213))


### Miscellaneous

- Migrate GitHub org references from always-further to nolabs-ai (#1235) ([#1235](https://github.com/nolabs-ai/nono/pull/1235))


### Refactoring

- *(network)* Introduce NetworkIntent and remove ProxyOnly placeholders (#1225) ([#1225](https://github.com/nolabs-ai/nono/pull/1225))

## [Unreleased]

### Features

- *(profile)* Add repeatable `--extends <PROFILE>` support for profile-consuming commands, allowing one invocation to compose a selected `--profile` with additional base profiles ([#956](https://github.com/nolabs-ai/nono/issues/956))

- *(tool-sandbox)* Add `@git:common-dir` dynamic token: expands to the git common directory (`.git` in a regular repo; the main repo's `.git` when running inside a worktree). Use in `fs_write` to cover the object store when the agent session starts from a worktree and `--workdir` points to the worktree itself ([#1270](https://github.com/nolabs-ai/nono/issues/1270))

### Bug Fixes

- *(tool-sandbox)* Pass TLS trust bundle env vars (`SSL_CERT_FILE`, `CURL_CA_BUNDLE`, `NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `GIT_SSL_CAINFO`) to tool-sandbox children so HTTPS certificate verification works when TLS interception is active (#1248)

- *(tool-sandbox)* Skip missing `fs_read`/`fs_write` directories instead of erroring on startup; matches existing `fs_read_file` behaviour (#1252)

## [0.65.1] - 2026-06-23
## [0.65.0] - 2026-06-23

### Bug Fixes

- *(sandbox)* Exempt IPC fd from sendmsg trapping to resolve af_unix_mediation deadlock (#1210) ([#1210](https://github.com/always-further/nono/pull/1210))

- *(docs)* Replace broken link in readme (#1221) ([#1221](https://github.com/always-further/nono/pull/1221))


### Dependencies

- *(deps)* Bump syn from 2.0.117 to 2.0.118 (#1230) ([#1230](https://github.com/always-further/nono/pull/1230))

- *(deps)* Bump regex from 1.12.3 to 1.12.4 (#1231) ([#1231](https://github.com/always-further/nono/pull/1231))

- *(deps)* Bump sigstore-verify from 0.8.0 to 0.9.0 (#1228) ([#1228](https://github.com/always-further/nono/pull/1228))

- *(deps)* Bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#1227) ([#1227](https://github.com/always-further/nono/pull/1227))

- *(deps)* Bump actions/checkout from 6.0.3 to 7.0.0 (#1226) ([#1226](https://github.com/always-further/nono/pull/1226))


### Features

- *(sandbox)* Tool sandbox (#1105) ([#1105](https://github.com/always-further/nono/pull/1105))


### Miscellaneous

- *(docs)* Improve profile documentation (#1212) ([#1212](https://github.com/always-further/nono/pull/1212))

- Release v0.64.1 (#1217) ([#1217](https://github.com/always-further/nono/pull/1217))

## [0.64.1] - 2026-06-20

### Refactoring

- *(credentials)* Require explicit activation for custom credentials (#1215) ([#1215](https://github.com/always-further/nono/pull/1215))

## [0.64.0] - 2026-06-18

### Bug Fixes

- *(pty)* Ctrl-z hangs when running with a PTY (#1135) ([#1135](https://github.com/always-further/nono/pull/1135))

- Proxy should activate with customCredentials set (#1197) ([#1197](https://github.com/always-further/nono/pull/1197))

- *(cli)* Use XDG config paths consistently (#1179) ([#1179](https://github.com/always-further/nono/pull/1179))

- *(proxy)* Stop allow_domain endpoint route from shadowing credential catch-all (#1132) ([#1132](https://github.com/always-further/nono/pull/1132))

- *(proxy)* Respect upstream_proxy in TLS CONNECT intercept path (#1048) (#1091) ([#1091](https://github.com/always-further/nono/pull/1091))

- *(policy)* Allow go_runtime to readwrite go-build cache (#1173) ([#1173](https://github.com/always-further/nono/pull/1173))

- *(diagnostic)* Replace deprecated nono learn with nono run (#1170) ([#1170](https://github.com/always-further/nono/pull/1170))

- *(proxy)* Return 403 + audit for denied non-CONNECT requests (#1077) ([#1077](https://github.com/always-further/nono/pull/1077))


### CI/CD

- Run integration tests on ubuntu runner (#1185) ([#1185](https://github.com/always-further/nono/pull/1185))


### Dependencies

- *(deps)* Bump cbindgen from 0.29.3 to 0.29.4 (#1182) ([#1182](https://github.com/always-further/nono/pull/1182))

- *(deps)* Bump which from 8.0.2 to 8.0.3 (#1181) ([#1181](https://github.com/always-further/nono/pull/1181))

- *(deps)* Add 3-day Dependabot cooldown for cargo and github-actions (#1163) ([#1163](https://github.com/always-further/nono/pull/1163))


### Documentation

- *(allow-cwd)* Clarify access level is profile-driven (#1180) ([#1180](https://github.com/always-further/nono/pull/1180))

- *(credential-injection)* Fix broken Proxy Overrides anchor (#1177) ([#1177](https://github.com/always-further/nono/pull/1177))

- *(networking)* Lead with the common cases (#1174) ([#1174](https://github.com/always-further/nono/pull/1174))

- *(install)* Add version check and COPR fallback note (#1169) ([#1169](https://github.com/always-further/nono/pull/1169))

- *(quickstart)* Fix profiles link (#1168) ([#1168](https://github.com/always-further/nono/pull/1168))


### Features

- *(diagnostics)* Expose structured diagnostics for library and FFI clients (#1171) ([#1171](https://github.com/always-further/nono/pull/1171))

- *(update-check)* Discover ci environments on update (#1113) ([#1113](https://github.com/always-further/nono/pull/1113))

- [aws] implement aws_auth config (#1166) ([#1166](https://github.com/always-further/nono/pull/1166))

- *(output)* Show blocked macos grants in capability summary (#1178) ([#1178](https://github.com/always-further/nono/pull/1178))


### Miscellaneous

- Import agents.md inside claude.md (#1153) ([#1153](https://github.com/always-further/nono/pull/1153))


### Refactoring

- *(proxy)* Separate proxy intent from activation (#1199) ([#1199](https://github.com/always-further/nono/pull/1199))

- *(audit)* Move attestation logic to core library (#1148) ([#1148](https://github.com/always-further/nono/pull/1148))

## [0.63.0] - 2026-06-15

### Bug Fixes

- *(proxy)* Keep connection open for reactive proxy auth on CONNECT (#1151) ([#1151](https://github.com/always-further/nono/pull/1151))

- Report the actual blocked operation instead of the readable target path in sandbox denial diagnostics (#1150) ([#1150](https://github.com/always-further/nono/pull/1150))

- *(linux)* Trap sendto/sendmsg to prevent AF_UNIX datagram bypass (#1096) ([#1096](https://github.com/always-further/nono/pull/1096))

- *(cli)* Accept truthy env values for bool flags (#1136) ([#1136](https://github.com/always-further/nono/pull/1136))

- Replace stale nono.dev schema domains with nono.sh

- *(audit)* Address ledger review and clippy

- Write cargo vendor config for copr srpms

- *(aur)* Skip ssh-keyscan banner lines in host key check


### Build

- Add copr source rpm packaging (#1075) ([#1075](https://github.com/always-further/nono/pull/1075))


### CI/CD

- Use actions/attest


### Dependencies

- *(deps)* Bump ignore from 0.4.25 to 0.4.26 (#1160) ([#1160](https://github.com/always-further/nono/pull/1160))

- *(deps)* Bump chrono from 0.4.44 to 0.4.45 (#1159) ([#1159](https://github.com/always-further/nono/pull/1159))

- *(deps)* Bump time from 0.3.47 to 0.3.49 (#1158) ([#1158](https://github.com/always-further/nono/pull/1158))

- *(deps)* Bump zeroize from 1.8.2 to 1.9.0 (#1157) ([#1157](https://github.com/always-further/nono/pull/1157))

- *(deps)* Bump typify from 0.6.2 to 0.7.0 (#1156) ([#1156](https://github.com/always-further/nono/pull/1156))

- *(deps)* Bump actions/checkout from 6.0.2 to 6.0.3

- *(deps)* Bump x509-parser from 0.16.0 to 0.18.1

- *(deps)* Bump cbindgen from 0.29.2 to 0.29.3

- *(deps)* Bump hyper from 1.9.0 to 1.10.1


### Documentation

- Document diagnostics.suppress_system_services for macOS (#1076) (#1138) ([#1138](https://github.com/always-further/nono/pull/1138))

- *(readme)* Update agent commands and enhance feature descriptions (#1145) ([#1145](https://github.com/always-further/nono/pull/1145))

- *(readme)* Refine project description and history (#1143) ([#1143](https://github.com/always-further/nono/pull/1143))

- *(readme)* Update agent package publishing link (#1142) ([#1142](https://github.com/always-further/nono/pull/1142))

- *(cli-quickstart)* Add profile usage to quickstart guide

- Add copr installation instructions


### Features

- *(cli)* Move runtime state to XDG state dirs (#1152) ([#1152](https://github.com/always-further/nono/pull/1152))

- Add $PACK_DIR support to session_hooks for store pack support (#1073) ([#1073](https://github.com/always-further/nono/pull/1073))

- *(keyring)* Add NONO_KEYRING_TIMEOUT_SECS for keychain access (#977) ([#977](https://github.com/always-further/nono/pull/977))

- *(environment)* Add set_vars for static env injection (#1134) ([#1134](https://github.com/always-further/nono/pull/1134))

- *(pack-verification)* Skip pack verification on dry runs


### Miscellaneous

- *(project)* Add new issue template for agent package requests (#1081) ([#1081](https://github.com/always-further/nono/pull/1081))


### Refactoring

- *(diagnostic)* Move diagnostic UX out of core nono crate (#1155) ([#1155](https://github.com/always-further/nono/pull/1155))

- *(pull_ui)* Remove sigstore provenance display (#1144) ([#1144](https://github.com/always-further/nono/pull/1144))

- *(profiles)* Standardize profile names with namespace

- *(audit-ledger)* Move audit ledger logic to library crate

- *(audit)* Move audit integrity logic to nono crate


### Testing

- *(wsl2)* Fix has_landlock_network V4+ detection

## [0.62.0] - 2026-06-07

### Bug Fixes

- *(proxy)* Deny-by-default when network.block is set (#1082) ([#1082](https://github.com/always-further/nono/pull/1082))


### Dependencies

- *(deps)* Bump actions/checkout from 6.0.2 to 6.0.3

- *(deps)* Bump docker/setup-qemu-action from 4.0.0 to 4.1.0

- *(deps)* Bump jsonschema from 0.46.4 to 0.46.5

- *(deps)* Bump rustls-native-certs from 0.8.3 to 0.8.4


### Features

- *(packaging)* Add automated AUR package publishing (#917) (#1083) ([#1083](https://github.com/always-further/nono/pull/1083))


### Miscellaneous

- Release v0.61.2

## [0.61.2] - 2026-06-05

### Bug Fixes

- *(proxy)* Deny-by-default when network.block is set (#1082) ([#1082](https://github.com/always-further/nono/pull/1082))


### Dependencies

- *(deps)* Bump actions/checkout from 6.0.2 to 6.0.3

- *(deps)* Bump docker/setup-qemu-action from 4.0.0 to 4.1.0

- *(deps)* Bump jsonschema from 0.46.4 to 0.46.5

- *(deps)* Bump rustls-native-certs from 0.8.3 to 0.8.4

## [0.61.1] - 2026-06-02

### Features

- *(profile)* Allow registry refs in profile extends (#1061) ([#1061](https://github.com/always-further/nono/pull/1061))

## [0.61.0] - 2026-06-02

### Features

- *(diagnostic)* Add profile option to suppress system service diagnostics (#1059) ([#1059](https://github.com/always-further/nono/pull/1059))


### Refactoring

- *(network-policy)* Do not enable credentials by default in profiles

## [0.60.0] - 2026-06-01

### Bug Fixes

- *(cli)* Accept cap file under any known temp root for why --self

- Ci

- *(proxy)* Clean up Keychain on trust failure and expand security docs

- *(proxy)* Disambiguate AsRef call on Cow<[u8]> for typed_path compat

- *(proxy)* Detect user-cancelled trust prompts via OSStatus codes

- *(cli)* Limit visible items in denial selector


### Build

- Add rpm release artifacts


### Documentation

- *(cli)* Update credential injection with bitwarden and custom keyring


### Features

- Remove libdbus dependency on linux

- *(proxy)* Align leaf cert expiry with CA and add --proxy-ca-validity flag

- *(proxy)* Add --trust-proxy-ca for macOS system trust store integration

- *(cli)* Introduce interactive denied path selector

- *(wiring)* Support jsonc in wiring directives


### Miscellaneous

- Remove PR description file

### Refactoring

- *(proxy)* Consolidate Keychain CA storage to single combined PEM entry

- *(denial-selector)* Extract visible range logic

- *(jsonc)* Centralize jsonc parsing


### Style

- *(formatting)* Make expressions more compact

## [0.59.0] - 2026-05-27

### Bug Fixes

- *(proxy)* Enforce endpoint rules before credential selection in TLS intercept

- Formatting

- Tighten up overflow checks

- Use rfind for access mode spliting; add test

- Annotate suppressed denials and style save prompt paths (#984)

- Restore jsonc-parser dep

- Use fully qualified pack name in Quick Start example

- Correct Quick Start profile reference in README


### Dependencies

- *(deps)* Bump shlex from 1.3.0 to 2.0.1


### Documentation

- Note [save skipped] annotation in suppress_save_prompt sections


### Features

- *(cli)* Allow-domain accepts URL with path for endpoint restrictions

- *(cli)* Support fine-grained method+path restrictions in allow_domain (#960)

- *(cli)* Centralize timeout constants and make user-facing timeouts configurable


### Refactoring

- *(profile)* Extract opencode profile from built-ins


### Diagnostic

- Pre-compute canonical denial paths to avoid repeated fs I/O

## [0.58.0] - 2026-05-26

### Bug Fixes

- Set accepted listener connections to blocking mode

- Include URL listener in supervisor loop keep-alive conditions

- Keep supervisor loop alive when child closes direct IPC socket

- Increase supervisor listener read timeout to 5s for URL open

- Address review comments on supervisor socket IPC

- Add read timeout on accepted listener connections

- Grant UnixSocketCapability for supervisor socket in child sandbox

- Replace fd-based IPC with named socket for URL open helpers (#959)

- *(proxy)* Preserve upstream error and sanitise 502 reason line

- *(proxy)* Return 502 with audit entry on upstream connect failure

- *(pack-update-hint)* Make state file writes atomic

- *(policy)* Address review comments on java_runtime group

- *(keystore)* Use Zeroizing<String> for Bitwarden item fields and in-place truncation

- Review fixes

- *(macos)* Emit platform rules after user write allows

- Add user docs for *.json/*.jsonc

- *(sandbox)* Use \$PWD to capture symlink CWD without --workdir

- *(sandbox)* Preserve symlink path when adding CWD capability on macOS


### CI/CD

- *(release)* Reorder artifact attestation job

- *(attestation)* Add release artifact attestation

- *(pr-summary)* Apply automatic pr and size labels

- *(pr-summary)* Add pull request summary workflow


### Dependencies

- *(deps)* Bump rcgen from 0.13.2 to 0.14.8

- *(deps)* Bump docker/build-push-action from 7.1.0 to 7.2.0

- *(deps)* Bump actions/attest-build-provenance

- *(deps)* Bump docker/login-action from 4.1.0 to 4.2.0

- *(deps)* Bump docker/setup-buildx-action from 4.0.0 to 4.1.0

- *(deps)* Bump similar from 3.1.0 to 3.1.1

- *(deps)* Bump serde_json from 1.0.149 to 1.0.150

- *(deps)* Bump landlock from 0.4.4 to 0.4.5

- *(deps)* Update sigstore crates to 0.8.0


### Documentation

- Add session_hooks to profiles-groups page

- Update profile authoring with binary path

- *(readme)* Remove terminal demo gif

- *(readme)* Refine project description and quick start


### Features

- Session lifecycle hooks (#954)

- *(policy)* Add java_runtime group and java-dev profile

- Add Bitwarden credential source (bw:// URI scheme)

- *(profile)* Allow profiles to specify a target binary

- *(profile)* Add JSONC support for profile files


### Refactoring

- *(pack-hints)* Refresh in detached process to avoid threads

- *(hook_runtime)* Gate module unix-only, drop dead non-unix branches

- Use chained if let for conditional statements


### Testing

- Lock ENV_LOCK in test_all_groups_no_deny_within_allow_overlap


### Style

- Format debug message for line length

## [0.57.0] - 2026-05-19

### Bug Fixes

- *(profile)* Fix fmt and test assertion after shadow-check refactor

- *(profile)* Handle versioned package refs in fast path

- *(profiles)* Block profile init when name shadows builtin or pack profile

- *(profiles)* Address review points on shadow-check PR


### Dependencies

- *(deps)* Bump aws-lc-rs from 1.16.3 to 1.17.0


### Features

- *(profile)* Refine profile name resolution and init validation

- *(profiles)* Expand shadowing checks to include pack profiles

## [0.56.0] - 2026-05-18

### Bug Fixes

- *(startup)* Use SIGKILL consistently and remove dead prompt infrastructure


### CI/CD

- Add standalone homebrew-bump workflow; pin to AvesAlight fork for 3xx redirect fix


### Documentation

- *(cli)* Clarify startup timeout definition of interactive


### Features

- *(cli)* Expand startup timeout interactive detection

- *(cli)* Add option to configure process startup timeout


### Refactoring

- *(cli)* Simplify startup timeout check

- *(cli-exec-strategy)* Simplify startup timeout checks

- *(cli)* Require alt-screen for startup timeout

## [0.55.0] - 2026-05-17


### Security
- Sandbox escape on Linux via D-Bus ([GHSA-27vp-2mmc-vmh3](https://github.com/always-further/nono/security/advisories/GHSA-27vp-2mmc-vmh3)) — reported by @cgwalters

GHSA-27vp-2mmc-vmh3 

### Bug Fixes

- *(cli)* Unify macOS exact-path grant restore

- *(cli)* Preserve macOS future-file grants in why --self

- *(pty)* Forward bare ESC immediately in filter_client_input

- *(docker)* Pin Alpine version and add --platform to musl Dockerfiles

- *(musl)* Use as _ for TIOCSCTTY ioctl cast to support all platforms

- *(musl)* Fix libc::Ioctl type mismatches for x86_64-unknown-linux-musl target

- Code review

- *(proxy)* Honor explicit credential_format on custom inject headers

- *(profile-verification)* Strengthen profile and pack verification checks

- *(sandbox)* Correctly resolve af_unix socket paths for seccomp

- Preserve child output without trailing newline (#881)


### Dependencies

- *(deps)* Bump clap_complete from 4.6.3 to 4.6.5


### Documentation

- *(cli-security-model)* Correct typo in nono description

- *(cli)* Correct grammar in security model doc

- *(cli-security)* Add isolation scope and deployment model

- *(installation)* Add makepkg instructions and Note disclaimer

- *(installation)* Add Arch Linux (AUR) section

- *(capability)* Clarify linux signal mode behavior with landlock


### Features

- *(macos)* Treat open_port 0 as localhost:* outbound

- *(package)* Prevent artifact install path conflicts

- *(profile)* Ensure source pack is included for verification

- *(profiles)* Verify pack signer identities

- *(linux)* Implement af_unix pathname mediation

- *(sandbox)* Add explicit allowlist for pathname af_unix sockets

- *(unix-socket)* Record explicit scope for grants

- *(cli)* Add recursive unix socket directory grants

- *(landlock)* Add landlock v6 signal and abstract unix socket scoping


### Miscellaneous

- Drop changelog update for issue 943


### Refactoring

- *(package)* Base installs on package manifest

- *(supervisor)* Refine ipc denial reporting and audit timestamps


### Testing

- *(integration-tests)* Use CARGO_TARGET_DIR in runner

- *(supervisor-linux)* Add unix listener for connect capability test


### Cli

- Quiet Landlock deny-overlap diagnostics on Linux

## Unreleased

### Bug Fixes

- *(pty)* Forward bare ESC immediately instead of buffering for CSI-u detach match, fixing ESC key in TUI apps inside tmux with `extended-keys-format csi-u` (#941)

### Notes

- Socket grant state now records explicit socket scope. New subtree socket
  grants require this metadata; rolling back to older nono builds may read
  those state entries as file-scoped grants.

## [0.54.0] - 2026-05-13

### Bug Fixes

- *(pack-update-hint)* Treat unparsable installed as older in update check

- Macos lint

- Macos lint

- Macos lint

- *(snapshot)* Validate restore targets against symlinks

- *(platform)* Correctly parse windows registry dword values


### Dependencies

- *(deps)* Bump nix from 0.31.2 to 0.31.3

- *(deps)* Bump sigstore/cosign-installer from 4.1.1 to 4.1.2

- *(deps)* Bump tokio from 1.52.2 to 1.52.3


### Features

- *(pack-hints)* Document inline pack update hints

- *(pack_update_hint)* Refresh hints synchronously on first run

- *(packs)* Add pinning, outdated, and clarify publishing versioning

- *(cli)* Implement `nono update` command

- *(package)* Add package pinning and outdated commands

- Upgrade to Rust edition 2024, centralize workspace dependencies

- *(platform)* Implement robust windows platform detection

- *(profile)* Add platform-conditional profile fields


### Style

- *(cli)* Adjust line breaks and module order

- *(cli)* Improve formatting and simplify error handling

## [0.53.0] - 2026-05-11

### Bug Fixes

- Absolute match / 2 matches = deny / no match = passthrough w no creds

- Review comments

- Return full failure diagnostic

- *(sandbox)* Cache Landlock ABI detection with OnceLock


### Features

- Fix upstream TLS trust, intercept auth, and multi-route dispatch.

- *(core)* Scrub command arguments for secrets


### Refactoring

- *(scrub)* Optimize and simplify scrubbing logic

## [0.52.2] - 2026-05-11

### Bug Fixes

- *(profile-save)* Address suppression review feedback


### Features

- *(profile-save)* Suppress save-profile prompts for denied paths


### Miscellaneous

- Release v0.52.1

## [0.52.1] - 2026-05-11

### Bug Fixes

- *(profile-save)* Address suppression review feedback


### Features

- *(profile-save)* Suppress save-profile prompts for denied paths

## [0.52.1] - 2026-05-11

### Bug Fixes

- Match backend validation logic

- *(schema)* Add missing 'environment' property to profile JSON schema

- *(proxy)* Set NODE_USE_ENV_PROXY for Node 26

- *(policy)* Expand browser deny groups with missing Chromium-based browsers

- Preserve two keyboard-mode resets

- Documented concat! blocks instead of opaque byte blobs

- *(pty)* Stop clearing terminal scrollback on exit for normal-mode sessions

- Provide more accurate warning message + doc comment update

- *(cli)* Validate --allow paths and persist domain allowlist in sandbox state

- *(cli)* Make 'nono why --host' aware of proxy domain filtering

- Prevent feature unification from linking libdbus in no-keyring builds


### Documentation

- *(agents)* Relax agent disclosure and expand campaign ban

## [0.52.0] - 2026-05-10

### Bug Fixes

- *(diagnostic)* Parse escaped quotes in structured properties

- *(env)* Preserve fail-closed semantics for empty allow_vars

- *(lint)* Replace unwrap() with is_some_and() in test


### Documentation

- *(environment)* Document empty allow_vars array behavior

- Restructure navigation and fix stale terminology


### Features

- *(cli)* Deprecate 'nono learn' and improve diagnostics

- *(cli)* Enhance interactive experience and profile saving

- *(cli)* Enhance macos learn and run diagnostics

- *(env)* Add operator-controlled deny_vars to EnvironmentConfig


### Refactoring

- *(env)* Extract matches_env_var_patterns helper, fix docs wording


### Style

- Run cargo fmt

## [0.51.0] - 2026-05-09

### Bug Fixes

- *(tls_intercept)* Add authority key identifier to leaf certs


### Features

- *(proxy)* Extend ca trust to git clients

- *(proxy)* Enhance audit context for managed auth and harden tls ca dir

- *(audit)* Add structured context to network audit events

- *(proxy)* Add tls interception for l7-bearing connect routes

## [0.50.1] - 2026-05-08

### Bug Fixes

- Use native types for iotcl integers

## [0.50.0] - 2026-05-08

### Features

- *(profile)* Support env:// URI in custom_credentials credential_key


### Refactoring

- *(cli)* Optimize ps command column width calculation

- *(cli/ps)* Improve ps command display with dynamic columns

## [0.49.0] - 2026-05-07

### Bug Fixes

- *(trust)* Treat empty parent() as CWD when deriving scan_root

- *(trust)* Reject symlink-escape in multi-subject bundle subject names

- *(trust)* Reject path traversal in multi-subject bundle subject names

- *(yaml-merge)* Pin serde_yaml_ng to 0.10.0 and add reversal failure test


### Dependencies

- *(deps)* Bump tokio from 1.52.1 to 1.52.2


### Features

- *(wiring)* Add yaml_merge directive for YAML config patching


### Miscellaneous

- Add PR template requiring linked issue


### Style

- Apply rustfmt to trust_cmd and trust_scan

- Apply rustfmt

## [0.48.0] - 2026-05-07

### Bug Fixes

- *(cli)* Prevent truncate_chars panic and spurious truncation

- Demote --allow-launch-services log from warn to debug

- *(profile)* Skip self-references in sibling extends resolution


### Features

- *(cli)* Add shell completion generation via `nono completion <shell>`


### Miscellaneous

- Harden CI workflows and fix stale metadata

- Reduce nono run output verbosity


### Refactoring

- *(string-truncation)* Extract generic string truncation utility

## [0.47.1] - 2026-05-06

### Dependencies

- *(deps)* Bump jsonschema from 0.45.1 to 0.46.4

- *(deps)* Bump rustls from 0.23.39 to 0.23.40


### Documentation

- Fix stale references, deprecation wording, and built-in vs pack distinction

## [0.47.0] - 2026-05-05

### Bug Fixes

- Doc changes + relax strict cap check

- Resolve extends against sibling profiles in the same directory

- *(capability)* Platform-specific dedup key (original on macOS, resolved on Linux)

- *(ci)* Poll crates.io index instead of fixed sleep before publish

- *(profile)* Emit serde-rendered values in show/diff JSON output

- Migrate diagnostic.rs to shared try_canonicalize helper

- Canonicalize protected roots at call sites to handle raw paths

- Replace unwrap() with expect() in path tests for clippy

- Unify path canonicalization with ancestor-walk fallback


### Documentation

- *(plans)* Design and implementation plan for #594 phase 2 schema restructure


### Features

- *(profile)* #594 phase 2 — canonical JSON schema restructure (#594)


### Performance

- Eliminate redundant canonicalize syscalls per review feedback


### Policy

- Normalize nix profile paths to tilde-style and add defexpr


### Style

- Remove extra blank line in diagnostic.rs

- Run cargo fmt

## [0.46.0] - 2026-05-01

### Bug Fixes

- *(policy)* Add XDG_STATE_HOME nix profiles path to nix_runtime group

- *(policy)* Make nix_runtime group cross-platform

- *(cli)* Re-validate deny overlaps after all grants

- Update examples in setup.rs


### Features

- *(network)* Support GitLab developer domains


### Testing

- *(cli-tests)* Add workdir access to deny overlap test

- Exclude system_write_linux in post-CWD overlap regression test

## [0.45.0] - 2026-04-30

### Features

- *(packages)* Use native tls root certificates
- *(ux)* Warn on macOS when `--allow` targets a path blocked by a deny group (e.g. `deny_credentials`), suggesting `--override-deny`

## [0.44.0] - 2026-04-29

### Bug Fixes

- *(package)* Harden re-pulls against user edits

- *(wiring)* Harden install and uninstall wiring


### Features

- *(claude)* Detect and remove pre-0.43 inbuilt hook leftovers (`~/.claude/hooks/nono-hook.sh` and matching `settings.json::hooks` entry) on first
   claude pack install/resolve, with a confirmation prompt and a per-item summary
- *(profile, migration)* Move codex, claude-code to registry pack


### Miscellaneous

- *(ci)* Improve ci stability and profile test coverage


### Refactoring

- *(wiring)* Simplify string expansion

## [0.43.1] - 2026-04-29

### Bug Fixes

- *(cli)* Char-aware truncation in truncate_command

## [0.43.0] - 2026-04-28

### Bug Fixes

- *(cli)* Fail fast on --allow-connect-port on macOS

- Set system-keyring as default feature for backward compatibility


### Dependencies

- *(deps)* Bump aws-lc-rs from 1.16.2 to 1.16.3

- *(deps)* Bump hyper from 1.8.1 to 1.9.0


### Features

- *(cli)* Add --allow-connect-port for outbound TCP port allowlisting

- Make system keyring optional for headless/container builds


### Style

- Run cargo fmt

## [0.42.0] - 2026-04-25

### Bug Fixes

- *(proxy)* Stop adding allow_domain hosts to NO_PROXY without direct TCP grants


### Documentation

- Add --allow-unix-socket* flags and profile fields


### Features

- *(cli)* Add --allow-unix-socket flag family + profile schema

- *(capability)* Add UnixSocketCapability and UnixSocketMode

## [0.41.0] - 2026-04-24

### Bug Fixes

- *(cli)* Improve attach/detach scrollback and alt-screen

- *(pty-proxy)* Ensure full scrollback on reattach for normal screen

- *(cli)* Improve profile save resilience and policy suggestions

- *(signals)* Prevent signal swallowing


### Features

- *(pty-proxy)* Scroll viewport to native scrollback on detach

- *(pty)* Enhance detach notice and terminal cleanup

- *(pty)* Preserve outer terminal scrollback on attach

- *(cli)* Consolidate 'nono policy' subcommands under 'nono profile' with deprecation alias (#594)

- *(cli)* Enhance prompts and denial diagnostics

- *(cli)* Improve denial diagnostics and profile saving workflow


### Refactoring

- *(cli-startup-prompt)* Extract startup prompt functions

## [0.40.1] - 2026-04-23

### Bug Fixes

- *(policy)* Improve unlink rules; add claude read path


### Miscellaneous

- Add gitignore entries and hiring badge

## [0.40.0] - 2026-04-23

### Bug Fixes

- *(sandbox)* Downgrade unsafe seatbelt rules log from warn to info

- Add unsafe_macos_seatbelt_rules to test Profile initializers

- Address review feedback

- *(reverse-proxy)* Disallow insecure http upstreams for unspecified local addresses

- *(proxy)* Support local-only http upstreams safely

- *(proxy)* Restrict insecure http upstreams to local-only targets

- *(policy)* Update tests and claude-no-kc for allow_file move

- *(policy)* Move .claude.lock to allow_file for least-privilege access

- *(cli)* Skip non-existent profile deny overrides


### Build

- *(docker)* Harden user and create work dir


### Dependencies

- *(deps)* Update rustls-webpki

- *(deps)* Bump rustls-webpki from 0.103.12 to 0.103.13


### Documentation

- *(agents)* Update agent contribution policy and project overview

- Add documentation for agents and claude


### Features

- Add unsafe_macos_seatbelt_rules profile field

- *(reverse-proxy)* Add http upstream support

- *(audit)* Refine audit path derivation and documentation

- *(audit)* Add audit attestation for session merkle roots

- *(audit)* Record exec identity and unify audit integrity

- *(audit)* Record executable identity and improve integrity

- *(audit)* Add audit verify command for integrity checks

- *(audit)* Add tamper-evident audit log integrity

- *(rollback)* Refine snapshot exclusion and path tracking

- *(audit)* Capture pre/post merkle roots in audit trail


### Miscellaneous

- *(cli)* Make path and policy messages informational

- *(test-env)* Isolate integration tests from audit artifacts


### Refactoring

- *(docker)* Move dockerfiles and update build workflow

- *(policy)* Enforce stricter policy for overrides, rollback


### Testing

- Improve profile and edge case test accuracy

- *(profiles)* Add tests for missing codex profile


### Style

- Run cargo fmt

## [0.39.0] - 2026-04-21

### Bug Fixes

- *(dry)* Duplicated allow_domain warning-print logic

- *(tests)* Tests and format fixes

- *(network)* Keep --allow-domain in strict proxy-only mode

- *(policy)* Add entry for ~.local/share/claude/versions

- *(learn)* Validate profile name and re-prompt on invalid input

- *(oauth)* PR 517 rebase on main

- Compilation against current main after rebase

- *(proxy)* Return early after 413 in read_request_body


### Dependencies

- *(deps)* Bump clap from 4.6.0 to 4.6.1

- *(deps)* Bump tokio from 1.51.0 to 1.52.1

- *(deps)* Bump semver from 1.0.27 to 1.0.28

- *(deps)* Bump actions/cache from 5.0.4 to 5.0.5


### Features

- *(policy)* Filter profile override deny entries without grants

- *(claude)* Add no-keychain profile and expand existing access

- *(profile)* Support OAuth2 auth config in custom_credentials

- *(proxy)* Implement OAuth2 client_credentials token exchange with cache

- *(config)* Add OAuth2Config type for client_credentials flow

## [0.38.0] - 2026-04-20

### Bug Fixes

- *(trust)* Function or associated item not found in `TrustedRoot`

- *(package)* Harden package installation security

- *(hooks)* Invoke bash via env


### Documentation

- *(cli-package-publishing)* Add warning for unreleased feature

- *(cli)* Add installation instructions for nix


### Features

- *(trust)* Prefer CI_CONFIG_REF_URI for GitLab workflow identity

- *(claude-code)* Remove claude-code integration package

- *(profile)* Add support for loading profiles from registry packs

- *(profile)* Introduce packs and command_args for profiles

- *(pack)* Introduce pack types and unify package naming

- *(package)* Add install_dir artifact placement and hook unregistration

- *(cli)* Add package management commands (pull, remove, search, list)

- Implements environment variables filtering #688


### Miscellaneous

- Release v0.37.1


### Refactoring

- *(pkg)* Stream package artifact downloads

- *(package)* Simplify artifact signer validation

- *(package-cmd)* Centralize trust bundle for package verification

- *(cli)* Improve artifact path validation


### Style

- Cargo fmt

## [0.37.1] - 2026-04-17

### Bug Fixes

- *(macos)* Emit specific-op seatbelt rules for keychain DB allows

- *(sandbox)* Allow Unix domain socket connections in restricted network modes

- *(learn)* Print profile JSON as fallback when save fails


### Documentation

- Add github to credential route configuration


### Miscellaneous

- Upgrade rustls-webpki to 0.103.12 to fix RUSTSEC-2026-0098 and RUSTSEC-2026-0099

- Upgrade rustls-webpki to 0.103.12 to fix RUSTSEC-2026-0098 and RUSTSEC-2026-0099


### Style

- Apply rustfmt

## [0.37.0] - 2026-04-16

### Bug Fixes

- *(claude-code)* Enable token refresh via .claude.json symlink

- *(profiles)* Prevent infinite recursion in profile extends check

- *(sandbox)* Support claude-code profile extensions and simplify config


### Features

- *(claude-code)* Pre-create claude config lock directory


### Refactoring

- *(proxy-tls)* Remove rustls-pemfile and use pki_types for pem parsing

## [0.36.0] - 2026-04-15

### Bug Fixes

- *(proxy)* Downgrade CONNECT-to-route-upstream log from warn to debug


### Features

- Add ?decode=go-keyring query param for keyring:// URIs

- Add keyring:// URI scheme for custom-service credential lookup

## [0.35.0] - 2026-04-14

### Bug Fixes

- Chore: lint

- Chore: revert to json! obj syntax

- Chore: split predicate out again for provider specific claims

- Refactor: expose build config URI extension

- *(pty)* Improve session gone error detection when connecting

- *(cli)* Increase detached session startup timeout and order


### Features

- *(trust)* Support GitLab ID tokens for signing

- Strip proxy artifacts and fix upstream connection handling


### Miscellaneous

- Revert doc string

- Drop example workflow in comment

- Mention GitLab tokens in doc comment


### Refactoring

- Use append to merge signer fields

- Use build signer URI extension for trust

## [0.34.0] - 2026-04-13

### Bug Fixes

- *(gpu)* Grant NVIDIA procfs paths required for CUDA init under --allow-gpu

- *(gpu)* Add nvidia-uvm-tools to GPU device allowlist

- *(proxy)* Add missing proxy field in regression tests

- *(network-policy)* Activate anthropic credential in claude-code profile

- *(proxy)* Set ANTHROPIC_API_KEY phantom token for anthropic credential

- *(sandbox)* Use relative path for ~/.claude.json symlink

- *(sandbox)* Redirect ~/.claude.json to ~/.claude/ via symlink on all unix platforms


### Dependencies

- *(deps)* Bump rustls from 0.23.37 to 0.23.38

- *(deps)* Bump similar from 2.7.0 to 3.1.0

- *(deps)* Bump rand from 0.10.0 to 0.10.1

- *(deps)* Bump always-further/agent-sign from 0.0.8 to 0.0.11

- *(deps)* Bump peter-evans/repository-dispatch from 3.0.0 to 4.0.1

- *(deps)* Bump docker/build-push-action from 7.0.0 to 7.1.0

- *(deps)* Bump softprops/action-gh-release from 2.6.1 to 3.0.0

- *(deps)* Bump actions/upload-artifact from 7.0.0 to 7.0.1


### Features

- *(macos)* Auto-enable claude launch services, refine keychain access


### Refactoring

- *(policy)* Improve seatbelt path regex escaping


### Testing

- *(gpu)* Add unit + integration coverage for NVIDIA procfs grants

- *(gpu)* Extract is_nvidia_compute_device predicate and add unit tests

- *(proxy)* Add regression test for issue #624 phantom token bug


### Style

- Fix rustfmt formatting in sandbox_prepare.rs

## [0.33.0] - 2026-04-12

### Bug Fixes

- Address review feedback on downstream bump workflows

- *(fmt)* Sort imports alphabetically in command_runtime.rs

- *(shell)* Initialize proxy runtime when credentials are configured

- *(cli)* Decouple audit trail from rollback

- *(proxy)* Guard macOS keychain hint with platform check

- *(proxy)* Warn when keychain credential is not found

- *(landlock)* Widen /proc/self Landlock rule to /proc for grandchild access

- *(seccomp)* Resolve /proc/self correctly for grandchild processes

- *(cli)* Adjust ps command output column widths

- *(cli)* Align status and attach columns in ps output

- *(test)* Add --allow-cwd to GPU integration tests

- *(cli)* Compile dummy GPU function for non-macOS tests

- *(pty-proxy)* Exit early if client socket cannot be set nonblocking

- *(pty)* Correctly handle blocking state for attach streams

- *(sandbox)* Prevent interactive CWD prompt in detached mode

- Tighten GPU IOKit surface to AGXDeviceUserClient only

- *(test)* Handle non-default TMPDIR in linux nested home grant test

- *(policy)* Remove broad ~/.local allow from openclaw profile on Linux


### CI/CD

- Remove nono-registry from downstream dispatch

- Add release automation for downstream SDK repos


### Documentation

- *(readme)* Add early alpha warning and remove separator

- *(readme)* Overhaul content and visuals

- *(cli)* Clarify --allow-gpu flag behavior and profile interaction


### Features

- *(macos)* Make parent-of-protected-root relaxation opt-in via profile

- *(gpu)* Add WSL2 GPU support via /dev/dxg passthrough

- *(gpu)* Add WSL2 GPU support via /dev/dxg passthrough

- *(gpu)* Add Linux GPU access and improve macOS support

- *(profile)* Introduce separate profile preparation for preflight

- *(cli)* Introduce pre-flight CWD prompt for detached launches


### Miscellaneous

- Remove test results file


### Performance

- *(seccomp)* Skip read_tgid for direct child and use Cow for cap_check_path


### Refactoring

- *(cli-validation)* Propagate protected parent flag to cli validation

- *(command-blocking)* Improve deprecation warning messages

- *(command-blocking)* Deprecate startup-only command blocking


### Testing

- *(macos)* Address Gemini review feedback

- *(macos)* Align GPU IOKit tests with tightened surface from #635

- *(gpu)* Skip DRM tests if no render node permissions

## [Unreleased]

### Deprecations

- Deprecate startup-only command blocking surfaces in `v0.33.0`, add compatibility warnings, and document the child-process bypass.

## [0.32.0] - 2026-04-10

### Features

- Add upstream mTLS client certificate support

## [0.31.0] - 2026-04-10

### Bug Fixes

- Tighten GPU IOKit rules

- Remove allow_gpu from default profiles

- Address review feedback for --allow-gpu

- Add docs for --allow-gpu flag and improve test coverage

- *(macos)* Deny keychain Mach IPC services on modern macOS

- *(macos)* Allow atomic-write temp files for writable capabilities


### Features

- Add --allow-gpu flag for GPU access on Apple Silicon Macs

- *(trust)* Add file:// backend for trust signing keys

## [0.30.1] - 2026-04-09

### Bug Fixes

- *(cli)* Handle profile allow_file entries resolving to directories

- *(cli)* Handle profile allow_file entries resolving to directories

## [0.30.0] - 2026-04-08

### Bug Fixes

- *(macos)* Improve path resolution for non-existent files

- *(reverse-proxy)* Authenticate requests on non-credentialed routes

- *(test)* Guard EnvVarGuard::remove against unmanaged keys

- *(test)* Prevent TMPDIR pollution by not auto-deleting temp dirs used as TMPDIR

- *(test)* Add clippy disallowed_methods lint and migrate remaining unguarded env var tests

- *(test)* Unify env var locks to eliminate flaky test failures

- *(policy)* Avoid false deny for Nix store symlink targets on Linux

- Allow filesystem.read entries to be files

- *(proxy)* Address review feedback — normalize prefix in CredentialStore

- *(proxy)* Handle route prefixes with leading slashes


### Build

- *(deps)* Bump getrandom from 0.4.1 to 0.4.2

- *(deps)* Bump tokio from 1.49.0 to 1.51.0

- *(deps)* Bump sha2 from 0.10.9 to 0.11.0

- *(deps)* Bump docker/login-action from 4.0.0 to 4.1.0


### Documentation

- *(theme)* Update theme colors


### Features

- *(macos)* Expand keychain DB exception to include metadata DB

- *(macos)* Allow future file grants and update policies

- *(nix)* Improve NixOS compatibility for /nix/store paths

- *(wsl2)* ABI-aware tests and rolling kernel documentation

- *(trust)* Add `files` field for attesting arbitrary-location paths


### Miscellaneous

- *(scripts)* Add script to manage Claude authentication state


### Performance

- *(nono-proxy/route)* Cache upstream host:port for faster lookups


### Refactoring

- *(proxy)* Separate route configuration from credential configuration

- *(policy)* Consolidate resolved deny target skipping logic

## [0.29.1] - 2026-04-04

### Bug Fixes

- *(macos)* Allow DNS resolution via mDNSResponder in proxy and blocked modes (#588)

- *(profile)* Add missing $TMPDIR and state dir to opencode profile

- Ipv6 normalization logic

- *(proxy)* Disable NO_PROXY bypass on macOS (#580)

- *(policy)* Grant ~/.cache/claude readwrite in claude-code profile

## [0.29.0] - 2026-04-03

### Bug Fixes

- *(proxy)* Don't factor seatbelt for port lockdown

- *(pty_proxy)* Improve write retry test reliability with deadline-based polling

- *(pty_proxy)* Remove timeout from test recv to prevent race condition

- *(test)* Resolve race condition and cache key uniqueness


### Build

- *(deps)* Sort wait-timeout in Cargo.lock and fix credentials resolution


### Documentation

- *(cli)* Add `--detached` and `--name` flag documentation

- Document supervised session lifecycle and runtime workflows


### Features

- *(cli)* Add manifest support and improve sandbox preparation

- *(rollback)* Add configurable rollback destination support

- *(pty,session,supervisor)* Enhance PTY attach/detach and socket utilities

- *(pty_proxy)* Improve logging and error handling for attach/detach

- *(exec_strategy)* Replace startup timeout thread with interactive prompt

- *(diagnostic)* Add macOS sandbox violation logging and startup timeouts

- *(rollback)* Condition audit state creation on rollback request flags

- *(pty_proxy)* Disable keyboard enhancement modes on terminal restore

- *(pty_proxy)* Improve enhanced key detection and multi-key sequences

- *(pty_proxy)* Support enhanced CSI u key sequences in detach detection

- *(runtime)* Harden supervised child dumpability and fd passing

- *(runtime)* Land supervised sessions and diagnostics stack


### Refactoring

- *(output)* Consolidate leading break logic in print_terminal_block

## [0.28.0] - 2026-04-03

### Bug Fixes

- *(proxy)* Add tls_ca field to file:// credential test fixtures

- *(proxy)* Simplify tls_ca to tilde expansion and doc clarification

- *(proxy)* Expand and validate tls_ca paths at credential resolution


### Features

- *(policy)* Expand git config paths in credentials group

- *(credential,proxy)* Add missing tls_ca and tls_connector fields

- *(proxy)* Add custom CA certificate support for upstream TLS (closes #545)

- *(policy)* Skip system temp grants when HOME is nested under TMPDIR

- *(policy)* Split homebrew group into platform-specific variants


### Refactoring

- *(proxy)* Wrap CA file read in Zeroizing and improve error messages

- *(proxy)* Reuse policy::expand_path for tls_ca expansion

- *(capability_ext)* Extract locked test helpers for env isolation

- *(test)* Extract environment variable guard into reusable utility


### Testing

- *(cli)* Remove proptest regression file for manifest roundtrip

- *(profile,query)* Isolate environment variables and fix symlink test


### Style

- Fix rustfmt in tls_ca path expansion closure

## [0.27.0] - 2026-04-02

### Bug Fixes

- *(test)* Use real temp directories for env_nono_allow_comma_separated

- *(proxy)* Strip port suffix from allow_domain entries in proxy host filter

- Tighten manifest round-trip fidelity and wire proxy from --config

- *(test)* Use portable paths in manifest round-trip test

- Harden --config flag conflicts and error handling

- *(macos)* Align Seatbelt signal isolation with Linux Landlock behaviour

- Gate deny-overlap test to Linux only

- Harden deny-overlap validation, reject unknown profile fields, narrow user_tools scope


### Dependencies

- *(deps)* Bump tracing-subscriber from 0.3.22 to 0.3.23

- *(deps)* Bump ureq from 3.2.0 to 3.3.0


### Documentation

- Replace mention of --supervised with --capability-elevation in README

- Address review feedback on wsl2 cross-references

- Add WSL2 cross-references to feature docs and fix discoverability

- Move endpoint filtering from credential injection to networking page

- *(keystore)* Update module docs for file:// scheme and add redaction


### Features

- *(policy)* Check credentials Option with is_some_and instead of field access

- *(proxy)* Block CONNECT to credential upstreams and smart NO_PROXY

- *(sandbox)* Add allow_domain ports to Landlock ConnectTcp rules

- *(profile)* Allow child to override inherited credentials to empty

- *(schema)* Allow additionalProperties for forward-compatible evolution

- *(cli)* Add `nono policy show --format manifest` for profile-to-manifest compilation

- *(cli)* Wire up --config manifest path in prepare_sandbox

- *(cli)* Add conflicts_with to --config flag

- *(manifest)* Add typify codegen, manifest module, and CapabilitySet conversion

- *(schema)* Add capability manifest JSON Schema

- *(proxy)* Auto-detect credential format from inject_header

- *(keystore)* Preserve significant whitespace in secret files

- *(profile)* Accept file:// credential keys in custom_credentials

- *(keystore)* Wire file:// into credential dispatch and CLI mappings

- *(keystore)* Add load_from_file() for file:// credential source

- *(keystore)* Add file:// URI validation for local file credentials

- *(policy)* Split linux system groups for granular host compatibility

- Add $XDG_RUNTIME_DIR to variable expansion


### Refactoring

- Deduplicate path expansion and fs grant construction

- *(keystore)* Extract file-backed secret helpers


### Testing

- *(env_vars)* Use as_str() for contains() calls

- *(env_vars)* Replace to_str() with display().to_string()

- *(profile,trust_scan)* Add env lock guards to fix test isolation

- *(cli)* Add global env lock for parallel test isolation

- *(cli)* Add integration tests for --config manifest flag

- *(profile)* Add endpoint_rules field to credential test fixtures


### Revert

- Keep ~/.local/state in user_tools, defer to #546

## [0.26.1] - 2026-03-31

### Bug Fixes

- *(learn)* Make Enter actually skip profile save prompt (closes #431)

- *(proxy)* Use lossy UTF-8 decoding for percent-encoded paths

- *(proxy)* Percent-decode paths before endpoint rule matching


### CI/CD

- *(workflows)* Decouple image build from release workflow


### Dependencies

- *(deps)* Bump docker/setup-buildx-action from 3.12.0 to 4.0.0

- *(deps)* Bump toml from 1.0.6+spec-1.1.0 to 1.0.7+spec-1.1.0

- *(deps)* Bump docker/setup-qemu-action from 3.7.0 to 4.0.0

- *(deps)* Bump docker/build-push-action from 6.19.2 to 7.0.0

- *(deps)* Bump docker/login-action from 3.7.0 to 4.0.0

- *(deps)* Bump sigstore/cosign-installer from 3.10.1 to 4.1.1


### Miscellaneous

- Add DCO sign-off requirement to CLAUDE.md

## [0.26.0] - 2026-03-30

### Bug Fixes

- *(wsl2)* Security hardening from code review

- *(learn)* Resolve fs_usage pipe buffering and process name mismatch on macOS


### CI/CD

- *(workflows)* Extract push condition to environment variable

- *(workflows)* Extract Docker image build into reusable workflow

- *(release)* Fix workflow inputs reference syntax

- *(release)* Use inputs.tag fallback in Docker publish condition

- *(release)* Support manual tag input in workflow conditions


### Documentation

- *(wsl2)* Add WSL2 documentation and feature matrix (Track 1.5)


### Features

- *(wsl2)* Add WSL2 feature matrix to setup --check-only (Track 1.4)

- *(wsl2)* Clarify proxy network enforcement on WSL2 (Track 1.3)

- *(wsl2)* Guard seccomp notify paths for WSL2 (Track 1.2)

- *(wsl2)* Add WSL2 detection, feature matrix, and integration tests (Track 1.1)

- *(proxy)* Add L7 method+path endpoint filtering for reverse proxy routes (#465)

- *(ci)* Add Docker image build and push to release workflow (#511) ([#511](https://github.com/always-further/nono/pull/511))

- *(cli)* Add --log-file flag to redirect logs to a file (#490) ([#490](https://github.com/always-further/nono/pull/490))


### Miscellaneous

- Add .gitattributes to enforce LF line endings

## [0.25.0] - 2026-03-26

### Features

- *(undo)* Support per-root exclusion filters in snapshot manager (#506) ([#506](https://github.com/always-further/nono/pull/506))

- *(sandbox/linux)* Add seccomp proxy-only network fallback (#503) ([#503](https://github.com/always-further/nono/pull/503))

- *(trust)* Add skip_dirs support to trust scanning and rollback preflight (#498) ([#498](https://github.com/always-further/nono/pull/498))

## [0.24.0] - 2026-03-25

### Documentation

- Add documentation for add_deny_commands (#495) ([#495](https://github.com/always-further/nono/pull/495))

- Update GitHub Action badge to agent-sign (#494) ([#494](https://github.com/always-further/nono/pull/494))


### Features

- *(sandbox/linux)* Add seccomp fallback for network  (#496) ([#496](https://github.com/always-further/nono/pull/496))

## [0.23.1] - 2026-03-25

### Bug Fixes

- Block Unix socket connections via add_deny_access; add add_deny_commands (#488) ([#488](https://github.com/always-further/nono/pull/488))

- Handle relative paths in --rollback-dest pre-check (#486) ([#486](https://github.com/always-further/nono/pull/486))

## [0.23.0] - 2026-03-24

### Dependencies

- *(deps)* Bump toml from 1.0.3+spec-1.1.0 to 1.0.6+spec-1.1.0 (#479) ([#479](https://github.com/always-further/nono/pull/479))

- *(deps)* Bump which from 8.0.0 to 8.0.2 (#478) ([#478](https://github.com/always-further/nono/pull/478))

- *(deps)* Bump aws-lc-rs from 1.16.1 to 1.16.2 (#477) ([#477](https://github.com/always-further/nono/pull/477))

- *(deps)* Bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 (#476) ([#476](https://github.com/always-further/nono/pull/476))

- *(deps)* Bump actions/cache from 5.0.3 to 5.0.4 (#474) ([#474](https://github.com/always-further/nono/pull/474))

- *(deps)* Bump always-further/agent-sign from 0.0.4 to 0.0.8 (#475) ([#475](https://github.com/always-further/nono/pull/475))


### Documentation

- Remove compiled PDF, keep Typst source


### Features

- *(query)* Add diagnostic details to path query results (#472) ([#472](https://github.com/always-further/nono/pull/472))

- *(cli)* Add --rollback-dest flag to override snapshot storage path

## [0.22.1] - 2026-03-23

### Build

- *(audit)* Add cargo-audit ignores for AWS-LC X.509 advisories (#449) ([#449](https://github.com/always-further/nono/pull/449))


### CI/CD

- Add change classification to skip unnecessary jobs (#456) ([#456](https://github.com/always-further/nono/pull/456))


### Documentation

- Detect system architecture in deb installation command (#455) ([#455](https://github.com/always-further/nono/pull/455))

- Fix arrow direction in OS-level enforcement diagram (#453) ([#453](https://github.com/always-further/nono/pull/453))

- *(clients)* Recommend disabling agent sandboxes when running under nono (#451) ([#451](https://github.com/always-further/nono/pull/451))

## [0.22.0] - 2026-03-21

### Dependencies

- *(deps)* Bump rustls-webpki from 0.103.9 to 0.103.10 (#443) ([#443](https://github.com/always-further/nono/pull/443))


### Features

- *(trust)* Lazy verification of scan policies (#448) ([#448](https://github.com/always-further/nono/pull/448))

## [0.21.0] - 2026-03-21

### Bug Fixes

- *(setup)* Detect Landlock via syscall probe instead of LSM file (#417) ([#417](https://github.com/always-further/nono/pull/417))

- *(cli)* Add ~/.opencode to opencode profile paths (#421) ([#421](https://github.com/always-further/nono/pull/421))


### Features

- *(policy)* Add standard I/O and fd paths to base_posix group (#441) ([#441](https://github.com/always-further/nono/pull/441))

- *(trust)* Add --user flag to sign-policy for user-level trust policy (#440) ([#440](https://github.com/always-further/nono/pull/440))

- *(trust)* Scaffold policies, enforce missing includes at startup, and simplify write protection (#435) ([#435](https://github.com/always-further/nono/pull/435))


### Doc

- Fix installation command for nono-cli package (#426) ([#426](https://github.com/always-further/nono/pull/426))

## [0.20.0] - 2026-03-18

### Features

- Support multiple base profiles in extends field (#399) ([#399](https://github.com/always-further/nono/pull/399))

- *(cli)* Standardize network flag naming and add listen_port support (#415) ([#415](https://github.com/always-further/nono/pull/415))

## [0.19.0] - 2026-03-18

### Bug Fixes

- *(deny)* Canonicalize parent directories in deny access rules (#393) ([#393](https://github.com/always-further/nono/pull/393))


### Dependencies

- *(deps)* Bump tempfile from 3.26.0 to 3.27.0 (#398) ([#398](https://github.com/always-further/nono/pull/398))

- *(deps)* Bump sigstore-sign from 0.6.3 to 0.6.4 (#397) ([#397](https://github.com/always-further/nono/pull/397))

- *(deps)* Bump clap from 4.5.60 to 4.6.0 (#396) ([#396](https://github.com/always-further/nono/pull/396))

- *(deps)* Bump actions/download-artifact from 8.0.0 to 8.0.1 (#395) ([#395](https://github.com/always-further/nono/pull/395))

- *(deps)* Bump softprops/action-gh-release from 2.5.0 to 2.6.1 (#394) ([#394](https://github.com/always-further/nono/pull/394))


### Features

- *(sandbox)* Add IpcMode capability for POSIX semaphores (macOS Seatbelt) (#412) ([#412](https://github.com/always-further/nono/pull/412))

- *(learn)* Add macOS network tracing via nettop (#403) ([#403](https://github.com/always-further/nono/pull/403))

- Add linux-arm64 (#402) ([#402](https://github.com/always-further/nono/pull/402))

## [0.18.0] - 2026-03-16

### Bug Fixes

- *(hooks)* Use resolved path in capability display (#387) ([#387](https://github.com/always-further/nono/pull/387))

- *(main)* Move cwd resolution before pre-fork sandbox setup (#370) ([#370](https://github.com/always-further/nono/pull/370))

- *(policy)* Honor excluded dangerous command groups for direct exec (#368) ([#368](https://github.com/always-further/nono/pull/368))

- *(config)* Remove hardcoded dangerous commands list (#366) ([#366](https://github.com/always-further/nono/pull/366))

- *(exec)* Prevent implicit cwd access under restrictive profiles (#363) ([#363](https://github.com/always-further/nono/pull/363))


### Documentation

- *(profiles)* Simplify group-based profile creation guide (#390) ([#390](https://github.com/always-further/nono/pull/390))

- *(profiles-groups)* Expand built-in profiles and add policy override examples (#376) ([#376](https://github.com/always-further/nono/pull/376))


### Features

- Restyle --help output with grouped sections and bold headings (#345) ([#345](https://github.com/always-further/nono/pull/345))

- *(trust)* Skip well-known heavy directories in instruction file walk (#388) ([#388](https://github.com/always-further/nono/pull/388))

- *(cli)* Add `nono profile` scaffolding and authoring tooling (#385) ([#385](https://github.com/always-further/nono/pull/385))

- *(policy)* Extract git config paths into reusable group (#383) ([#383](https://github.com/always-further/nono/pull/383))

- *(cli)* Add `nono policy` introspection subcommand (#382) ([#382](https://github.com/always-further/nono/pull/382))

- *(profile)* Add profile-level override_deny for deny group exceptions (#380) ([#380](https://github.com/always-further/nono/pull/380))

- *(macos)* Gate open shim installation behind launch services flag (#374) ([#374](https://github.com/always-further/nono/pull/374))

- *(capability)* Remove exact file caps when deny patch overrides grant (#367) ([#367](https://github.com/always-further/nono/pull/367))

- *(policy)* Deprecate security.trust_groups in favor of policy.exclude_groups (#357) ([#357](https://github.com/always-further/nono/pull/357))

- *(policy)* Use default profile groups for runtime policy resolution (#356) ([#356](https://github.com/always-further/nono/pull/356))

- *(policy)* Add extends field to embedded profiles (#355) ([#355](https://github.com/always-further/nono/pull/355))

- Add default profile with base group configuration (#352) ([#352](https://github.com/always-further/nono/pull/352))

- *(profile)* Add composable policy patch configuration (#351) ([#351](https://github.com/always-further/nono/pull/351))


### Refactoring

- *(setup)* Move banner printing to main.rs (#386) ([#386](https://github.com/always-further/nono/pull/386))

- *(supervisor)* Remove never_grant in favor of protected roots (#360) ([#360](https://github.com/always-further/nono/pull/360))

- *(policy)* Remove deprecated base_groups and trust_groups fields (#359) ([#359](https://github.com/always-further/nono/pull/359))

- *(policy)* Deprecate base_groups in favor of default profile (#358) ([#358](https://github.com/always-further/nono/pull/358))

## [0.17.1] - 2026-03-13

### Bug Fixes

- Narrow broad linux /etc and /proc reads in system_read policy (#350) ([#350](https://github.com/always-further/nono/pull/350))


### Features

- *(sandbox/linux)* Add Landlock V6 signal scoping support (#344) ([#344](https://github.com/always-further/nono/pull/344))


### Miscellaneous

- Release v0.17.0

- Release v0.17.0

## [0.17.0] - 2026-03-13

### Bug Fixes

- Narrow broad linux /etc and /proc reads in system_read policy (#350) ([#350](https://github.com/always-further/nono/pull/350))


### Features

- *(sandbox/linux)* Add Landlock V6 signal scoping support (#344) ([#344](https://github.com/always-further/nono/pull/344))


### Miscellaneous

- Release v0.17.0

## [0.17.0] - 2026-03-12

### Bug Fixes

- Add OAuth2 URL opening support via supervisor IPC (#340) ([#340](https://github.com/always-further/nono/pull/340))

- Check access mode when determining if CWD is already covered (#334) ([#334](https://github.com/always-further/nono/pull/334))


### Documentation

- Updating docs to reflect pnpm support. (#332) ([#332](https://github.com/always-further/nono/pull/332))

- Update Homebrew install references (#326) ([#326](https://github.com/always-further/nono/pull/326))


### Features

- *(cli)* Add pluggable theme system with 6 built-in palettes (#341) ([#341](https://github.com/always-further/nono/pull/341))


### Refactoring

- *(cli)* Standardize flags to verb-noun ordering (#302) ([#302](https://github.com/always-further/nono/pull/302))

## [0.16.0] - 2026-03-10

### Bug Fixes

- Add pnpm paths to policy.json (#320) ([#320](https://github.com/always-further/nono/pull/320))

- Add uv paths to python_runtime group (#313) ([#313](https://github.com/always-further/nono/pull/313))

- Allow tty ioctls on Linux v5+ (#310) ([#310](https://github.com/always-further/nono/pull/310))


### Documentation

- Fix broken links and stale examples (#283) ([#283](https://github.com/always-further/nono/pull/283))


### Features

- Inject nono sandbox instructions via Claude Code system prompt (#322) ([#322](https://github.com/always-further/nono/pull/322))

- Add `--external-proxy-bypass` for routing domains direct (#309) ([#309](https://github.com/always-further/nono/pull/309))

- Abi-aware Landlock capability system (#256, #306) (#311) ([#311](https://github.com/always-further/nono/pull/311))

- Add built-in swival profile (#312) ([#312](https://github.com/always-further/nono/pull/312))

- Add same-sandbox process mode for signal and process-info (#299) ([#299](https://github.com/always-further/nono/pull/299))


### Miscellaneous

- Migrate Homebrew distribution from tap to homebrew-core (#321) ([#321](https://github.com/always-further/nono/pull/321))

- Simplify instruction file signing with nono-attest Action (#317) ([#317](https://github.com/always-further/nono/pull/317))

## [0.15.0] - 2026-03-09

### Bug Fixes

- Allow opentui data dir in opencode profile (#296) ([#296](https://github.com/always-further/nono/pull/296))

- `nono run` default to direct exec when supervision is not needed (#295) ([#295](https://github.com/always-further/nono/pull/295))

- Add tilde expansion to profile paths and opencode binary access (#294) ([#294](https://github.com/always-further/nono/pull/294))

- Honor silent tracing output (#290) ([#290](https://github.com/always-further/nono/pull/290))

- Preserve supervised Linux open semantics (#289) ([#289](https://github.com/always-further/nono/pull/289))


### Dependencies

- *(deps)* Bump sigstore-verify from 0.6.3 to 0.6.4 (#305) ([#305](https://github.com/always-further/nono/pull/305))

- *(deps)* Bump libc from 0.2.182 to 0.2.183 (#304) ([#304](https://github.com/always-further/nono/pull/304))

- *(deps)* Bump tempfile from 3.25.0 to 3.26.0 (#303) ([#303](https://github.com/always-further/nono/pull/303))


### Documentation

- Document that gemini baseurl is ignored in opencode (#307) ([#307](https://github.com/always-further/nono/pull/307))


### Features

- Add Apple Passwords URI credential support (#229) ([#229](https://github.com/always-further/nono/pull/229))

- Add built-in Codex profile (#300) ([#300](https://github.com/always-further/nono/pull/300))

- Add Debian package support (#298) ([#298](https://github.com/always-further/nono/pull/298))

- Add capability_elevation profile field and OS-aware groups (#293) ([#293](https://github.com/always-further/nono/pull/293))

- Make claude-code profile platform-aware (#291) ([#291](https://github.com/always-further/nono/pull/291))

## [0.14.0] - 2026-03-08

### Bug Fixes

- Resolve symlinked paths in deny rule checks (#272) (#279) ([#279](https://github.com/always-further/nono/pull/279))


### Features

- Add environment variable equivalents for CLI flags (#270) (#278) ([#278](https://github.com/always-further/nono/pull/278))

## [0.12.0] - 2026-03-07

### Bug Fixes

- Resolve dirfd-relative paths in seccomp-notify handler (#262) (#277) ([#277](https://github.com/always-further/nono/pull/277))

- Show platform-correct path in user-level policy warning (#263) ([#263](https://github.com/always-further/nono/pull/263))

- Enforce macOS signal isolation via Seatbelt (#264) ([#264](https://github.com/always-further/nono/pull/264))

- *(profile)* Allow clearing inherited network profiles (#252) ([#252](https://github.com/always-further/nono/pull/252))


### Documentation

- *(readme)* Update latest release note (#253) ([#253](https://github.com/always-further/nono/pull/253))


### Features

- Add port_allow to profile JSON NetworkConfig (#254) (#276) ([#276](https://github.com/always-further/nono/pull/276))

- Context-aware diagnostic banner for sandbox failures (#275) ([#275](https://github.com/always-further/nono/pull/275))

- *(cli)* Add --net-allow override (#251) ([#251](https://github.com/always-further/nono/pull/251))

- Add macOS learn mode using fs_usage and profile save prompt (#244) ([#244](https://github.com/always-further/nono/pull/244))


### Miscellaneous

- Implement Cargo audit and update AWS-LC (#273) ([#273](https://github.com/always-further/nono/pull/273))

- Remove Monitor strategy, make Supervised the default (#267) ([#267](https://github.com/always-further/nono/pull/267))

## [0.11.0] - 2026-03-05

### Features

- Add --allow-port for bidirectional localhost IPC between sandboxes (#248) ([#248](https://github.com/always-further/nono/pull/248))

- Unify proxy network audit with session audit trail (#231) ([#231](https://github.com/always-further/nono/pull/231))


### Miscellaneous

- Add GitHub issue templates for bugs, features, and onboarding (#247) ([#247](https://github.com/always-further/nono/pull/247))

- Add GitHub issue templates for bugs, features, and onboarding

## [0.10.0] - 2026-03-04

### Bug Fixes

- Don't inject phantom token for unavailable credentials (#234) (#236) ([#236](https://github.com/always-further/nono/pull/236))

- Allow CLI flags to upgrade access mode of profile-covered paths (#232) ([#232](https://github.com/always-further/nono/pull/232))

- Landlock network false-negative and runtime ABI probe in setup (#230) ([#230](https://github.com/always-further/nono/pull/230))

- Proxy host filtering and credential resolution for sandboxed (#215) ([#215](https://github.com/always-further/nono/pull/215))

- Include character device files in policy group resolution (#218) ([#218](https://github.com/always-further/nono/pull/218))

- Pre-create claude-code config lock file on Linux (#221) ([#221](https://github.com/always-further/nono/pull/221))


### Features

- Add --override-deny CLI flag for targeted deny group exemptions (#242) ([#242](https://github.com/always-further/nono/pull/242))

- Add env:// credential scheme and GitHub token proxy support (#227) ([#227](https://github.com/always-further/nono/pull/227))

- Remove RFC1918 private network CIDR deny list from host filter (#226) ([#226](https://github.com/always-further/nono/pull/226))

- Add allowed_commands support to profile security config (#204) ([#204](https://github.com/always-further/nono/pull/204))

- Profile inheritance via `extends` field (#203) ([#203](https://github.com/always-further/nono/pull/203))

## [0.9.0] - 2026-03-03

### Bug Fixes

- Prevent --net-block bypass via proxy credential activation (#202) ([#202](https://github.com/always-further/nono/pull/202))


### Features

- Rollback preflight with auto-exclude and walk budget (#200) ([#200](https://github.com/always-further/nono/pull/200))

## [0.8.1] - 2026-03-03

### Miscellaneous

- Release v0.8.0

## [0.8.0] - 2026-03-02

### Bug Fixes

- Reject parent directory traversal in snapshot manifest validation (#201) ([#201](https://github.com/always-further/nono/pull/201))

- Writes setup profiles to the correct directory on macOS (#184) ([#184](https://github.com/always-further/nono/pull/184))

- Add AccessFs::RemoveDir to Landlock write permissions (#199) ([#199](https://github.com/always-further/nono/pull/199))

- *(network)* Add claude.ai to llm_apis allow list (#206) ([#206](https://github.com/always-further/nono/pull/206))


### CI/CD

- Add conventional commits enforcement and auto-labeling (#194) ([#194](https://github.com/always-further/nono/pull/194))


### Features

- Add 7 new integration test suites and parallelize test runner (#214) ([#214](https://github.com/always-further/nono/pull/214))


### Miscellaneous

- *(docs)* Add 1Password credential injection documentation (#198) ([#198](https://github.com/always-further/nono/pull/198))

## [0.7.0] - 2026-03-01

### 🚀 Features

- Add 1Password secret injection via op:// URI support (#183)
## [0.6.1] - 2026-02-27

### 🚀 Features

- First release of seperarate nono and nono-cli packages