nono kept the real API token out of our sandboxed agent in 8 of 8 e2e tests
We ran the real nono 0.80.0 binary keyless. The sandbox saw only a phantom token, the proxy swapped in the real one, and /v1/admin got a 403. 7 of 7 gate steps passed.
By David Discua
Measured in the lab
- 7/7
- gate steps passed
- 8
- e2e tests passed
- 17,894 ms
- e2e step
- 21,606 ms
- whole gate
- Proxy swapped the phantom for the real token, HTTP 200
- Sandbox environment held only the phantom token
- Read of the ~/.ssh fixture denied inside the sandbox
- /v1/admin got 403 and the mock saw 0 admin requests
- fmt, clippy and upstream CI parity pass
From reports/keyproxy.json · run on October 14, 2026. nono 0.80.0 (v0.80.0, 8bb041356d48) on Darwin 25.6.0, so the macOS Seatbelt sandbox; random token minted per test, local mock API
How it is wired
01/03The agent runs inside nono's sandbox holding a phantom token.
nono runs an agent command inside a kernel sandbox and sends its outbound API calls through a credential proxy. The sandboxed process only ever holds a phantom token, and the proxy swaps in the real secret for endpoints you allow. We ran the real nono 0.80.0 binary against a local mock API with a random token minted per test, and 8 of 8 end-to-end tests passed. The catch is that the real token still sits in the shell that launches nono, and our run covered macOS only.
The catch
nono protects the child process. Test T5 is a control, and it confirms that outside the sandbox your shell still sees the real token. Anything else running in that shell, or anything that reads its environment, can still get the secret. Load the token as late as you can and keep it out of dotfiles.
Our gate ran on Darwin 25.6.0, so the sandbox under test was macOS Seatbelt. On Linux nono uses Landlock (kernel 5.13 or newer). The lab's CI matrix adds a Linux runner with a kernel check, but reports/keyproxy.json holds only the macOS run, so we quote no Linux numbers here.
There is also a quirk at this pin. A URI-form credential_key needs custom_credentials.lab_mock.env_var = "LAB_UPSTREAM_TOKEN" in the profile, which RESULTS.md traces to crates/nono-proxy/src/server.rs. Run nono profile validate --strict on any profile before you trust it.
What we ran (keyless)
git clone --recurse-submodules https://github.com/SkilledDragonCorp/minilab-nono-key-proxy.git
cd minilab-nono-key-proxy
cargo install --locked nono-cli --version 0.80.0
cargo test --workspace --locked --lib
cargo test --workspace --locked --test e2e -- --test-threads=1
bash scripts/report.sh
From reports/keyproxy.json, run on October 14, 2026:
| Step | Status | Duration |
|---|---|---|
| unit_lib | pass | 616 ms |
| e2e | pass | 17,894 ms |
| fmt | pass | 529 ms |
| clippy | pass | 459 ms |
| skills | pass | 220 ms |
| banned | pass | 185 ms |
| upstream_parity | pass | 925 ms |
| Total | 7 pass, 0 fail | 21,606 ms |
The e2e step log (reports/_step_e2e.log) shows 8 passed, 0 failed. Here is what each security test asserts:
| Test | Assertion |
|---|---|
| T1 | Phantom swapped at the proxy, HTTP 200 from the mock, real token absent from stdout and stderr |
| T1b | No Authorization header gets a 401 from the proxy |
| T2 | The sandbox environment holds the phantom, which differs from the real token |
| T3 | Reading a fake ~/.ssh/id_ed25519 fails and the marker never leaks |
| T4 | /v1/admin gets a 403 and the mock receives zero admin requests |
| T5 | Control: the parent shell still sees the real token |
How it is wired
nono run --profile starts the agent command in the sandbox. The profile swaps LAB_UPSTREAM_TOKEN for a phantom value and points LAB_MOCK_BASE_URL at the proxy. When the agent sends Authorization: Bearer <phantom>, the proxy checks the path against endpoint_rules, replaces the header with the real token, and forwards only GET /v1/ok. The sandbox itself refused the read of the fake home's .ssh key in T3, and the key's marker never reached stdout or stderr.
Minilab (open source)
Upstream is nolabs-ai/nono (4,503 stars, Apache-2.0, Rust, as of October 14, 2026). Install the pinned CLI, confirm git -C upstream rev-parse HEAD prints 8bb041356d48f771a221e58c98d9b1ff442e76fe, and re-run bash scripts/report.sh to regenerate reports/keyproxy.json.
Run it yourself
SkilledDragonCorp/minilab-nono-key-proxy
Clone, install and run the report with no API keys. The numbers above are what that run writes.
cargo install --locked nono-cli --version 0.80.0 && cargo test --workspace --locked --test e2e -- --test-threads=1SkilledDragon is not affiliated with nono or nolabs-ai. Numbers are from our own keyless lab run; re-run the report before relying on them. Marks belong to their owners.
All labs