feat: add interactive network approval and domain rejection#698

Open

klassm wants to merge 91 commits into

nolabs-ai:mainfrom

klassm:network_permission_handling

Commits on Jun 1, 2026

feat: add interactive network approval and domain rejection

lukehinds
authored and
klassm
committed
fix: propagate approval decision to dedup waiters in network approval
klassm
committed
fix: always create ConfigWriter so Approve Always persists
klassm
committed

Commits on Jun 4, 2026

fix: check runtime filter before showing approval dialog
klassm
committed
fix: network approval hardening — link-local, DNS rebinding, external proxy, CRLF
klassm
committed

Commits on Jul 3, 2026

refactor(network-policy): do not enable credentials by default in profiles

lukehinds
authored and
klassm
committed
feat(diagnostic): add profile option to suppress system service diagnostics (#1059)

lukehinds
authored and
klassm
committed
chore: release v0.61.0

lukehinds
authored and
klassm
committed
feat(profile): allow registry refs in profile extends (#1061)

lukehinds
authored and
klassm
committed
chore: release v0.61.1

lukehinds
authored and
klassm
committed
chore(deps): bump rustls-native-certs from 0.8.3 to 0.8.4

dependabot[bot]
authored and
klassm
committed
chore(deps): bump jsonschema from 0.46.4 to 0.46.5

dependabot[bot]
authored and
klassm
committed
chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0

dependabot[bot]
authored and
klassm
committed
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3

dependabot[bot]
authored and
klassm
committed
fix(proxy): deny-by-default when network.block is set (#1082)

caiocdcs
authored and
klassm
committed
chore: release v0.61.2

lukehinds
authored and
klassm
committed
feat(packaging): add automated AUR package publishing (#917) (#1083)

authored and
klassm
committed
Merge commit from fork

lukehinds
authored and
klassm
committed
chore: release v0.62.0

lukehinds
authored and
klassm
committed
fix(aur): skip ssh-keyscan banner lines in host key check

authored and
klassm
committed
feat(pack-verification): skip pack verification on dry runs

lukehinds
authored and
klassm
committed
build: add copr source rpm packaging (#1075)

Doooooo0o
authored and
klassm
committed
Remove env_clear from the session_hook subprocess

intentionally-left-nil
authored and
klassm
committed
chore(deps): bump hyper from 1.9.0 to 1.10.1

dependabot[bot]
authored and
klassm
committed
chore(deps): bump cbindgen from 0.29.2 to 0.29.3

dependabot[bot]
authored and
klassm
committed
chore(deps): bump x509-parser from 0.16.0 to 0.18.1

dependabot[bot]
authored and
klassm
committed
fix: write cargo vendor config for copr srpms

Doooooo0o
authored and
klassm
committed
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3

dependabot[bot]
authored and
klassm
committed
docs: add copr installation instructions

Doooooo0o
authored and
klassm
committed
refactor(audit): move audit integrity logic to nono crate

lukehinds
authored and
klassm
committed
refactor(audit-ledger): move audit ledger logic to library crate

lukehinds
authored and
klassm
committed
fix(audit): address ledger review and clippy

lukehinds
authored and
klassm
committed
ci: use actions/attest

SequeI
authored and
klassm
committed
fix: guard deduplicate() against inheriting procfs-remap originals (#1064)

scp7
authored and
klassm
committed
test(wsl2): fix has_landlock_network V4+ detection

authored and
klassm
committed
fix: replace stale nono.dev schema domains with nono.sh

mvanhorn
authored and
klassm
committed
docs(cli-quickstart): add profile usage to quickstart guide

lukehinds
authored and
klassm
committed
refactor(profiles): standardize profile names with namespace

lukehinds
authored and
klassm
committed
feat(environment): add set_vars for static env injection (#1134)

authored and
klassm
committed
Improve readme, which is underselling and not showing value (#1141)

lukehinds
authored and
klassm
committed
docs(readme): update agent package publishing link (#1142)

lukehinds
authored and
klassm
committed
docs(readme): refine project description and history (#1143)

lukehinds
authored and
klassm
committed
feat(keyring): add NONO_KEYRING_TIMEOUT_SECS for keychain access (#977)

authored and
klassm
committed
docs(readme): update agent commands and enhance feature descriptions (#1145)

authored and
klassm
committed
docs: document diagnostics.suppress_system_services for macOS (#1076) (#1138)

SequeI
authored and
klassm
committed
refactor(pull_ui): remove sigstore provenance display (#1144)

lukehinds
authored and
klassm
committed
feat: add $PACK_DIR support to session_hooks for store pack support (#1073)

authored and
klassm
committed
fix(cli): accept truthy env values for bool flags (#1136)

authored and
klassm
committed
fix(linux): trap sendto/sendmsg to prevent AF_UNIX datagram bypass (#1096)

authored and
klassm
committed
chore(project): add new issue template for agent package requests (#1081)

lukehinds
authored and
klassm
committed
fix: report the actual blocked operation instead of the readable target path in sandbox denial diagnostics (#1150)

mvanhorn
authored and
klassm
committed
chore(deps): bump typify from 0.6.2 to 0.7.0 (#1156)

dependabot[bot]
authored and
klassm
committed
chore(deps): bump zeroize from 1.8.2 to 1.9.0 (#1157)

authored and
klassm
committed
chore(deps): bump time from 0.3.47 to 0.3.49 (#1158)

authored and
klassm
committed
chore(deps): bump chrono from 0.4.44 to 0.4.45 (#1159)

authored and
klassm
committed
chore(deps): bump ignore from 0.4.25 to 0.4.26 (#1160)

dependabot[bot]
authored and
klassm
committed
fix(proxy): keep connection open for reactive proxy auth on CONNECT (#1151)

authored and
klassm
committed
feat(cli): move runtime state to XDG state dirs (#1152)

SequeI
authored and
klassm
committed
refactor(diagnostic): move diagnostic UX out of core nono crate (#1155)

SequeI
authored and
klassm
committed
chore: release v0.63.0 (#1161)

SequeI
authored and
klassm
committed
chore: import agents.md inside claude.md (#1153)

SequeI
authored and
klassm
committed
fix(proxy): return 403 + audit for denied non-CONNECT requests (#1077)

authored and
klassm
committed
docs(quickstart): fix profiles link (#1168)

connrg
authored and
klassm
committed
docs(install): add version check and COPR fallback note (#1169)

connrg
authored and
klassm
committed
fix(diagnostic): replace deprecated nono learn with nono run (#1170)

connrg
authored and
klassm
committed
docs(networking): lead with the common cases (#1174)

connrg
authored and
klassm
committed
docs(credential-injection): fix broken Proxy Overrides anchor (#1177)

connrg
authored and
klassm
committed
chore(deps): add 3-day Dependabot cooldown for cargo and github-actions (#1163)

SequeI
authored and
klassm
committed
docs(allow-cwd): clarify access level is profile-driven (#1180)

connrg
authored and
klassm
committed
chore(deps): bump which from 8.0.2 to 8.0.3 (#1181)

dependabot[bot]
authored and
klassm
committed
chore(deps): bump cbindgen from 0.29.3 to 0.29.4 (#1182)

dependabot[bot]
authored and
klassm
committed
fix(policy): allow go_runtime to readwrite go-build cache (#1173)

authored and
klassm
committed
fix(proxy): respect upstream_proxy in TLS CONNECT intercept path (#1048) (#1091)

authored and
klassm
committed
fix(proxy): stop allow_domain endpoint route from shadowing credential catch-all (#1132)

authored and
klassm
committed
refactor(audit): move attestation logic to core library (#1148)

authored and
klassm
committed
feat(output): show blocked macos grants in capability summary (#1178)

lukehinds
authored and
klassm
committed
ci: run integration tests on ubuntu runner (#1185)

SequeI
authored and
klassm
committed
fix(cli): use XDG config paths consistently (#1179)

SequeI
authored and
klassm
committed
feat: [aws] implement aws_auth config (#1166)

intentionally-left-nil
authored and
klassm
committed
Refactor forward_inner_request (#1192)

intentionally-left-nil
authored and
klassm
committed
fix: proxy should activate with customCredentials set (#1197)

intentionally-left-nil
authored and
klassm
committed
feat(update-check): discover ci environments on update (#1113)

authored and
klassm
committed
feat(diagnostics): expose structured diagnostics for library and FFI clients (#1171)

SequeI
authored and
klassm
committed
fix(pty): ctrl-z hangs when running with a PTY (#1135)

authored and
klassm
committed
refactor(proxy): separate proxy intent from activation (#1199)

SequeI
authored and
klassm
committed
chore: release v0.64.0 (#1201)

SequeI
authored and
klassm
committed
refactor(credentials): require explicit activation for custom credentials (#1215)

lukehinds
authored and
klassm
committed
chore: release v0.64.1 (#1217)

lukehinds
authored and
klassm
committed
feat: add interactive network approval and domain rejection

lukehinds
authored and
klassm
committed
fix: persist approved hosts to correct profile file across restarts
klassm
committed
fix: reapply DenyLinkLocal short-circuit and is_denied() Timeout after rebase
klassm
committed