Add nono AI agent sandbox CLI

modules/_lib/build-rust-package.nix

@@ -1,20 +0,0 @@
-{
-	inputs,
-	input,
-	prev,
-}: let
-	naersk-lib = prev.callPackage inputs.naersk {};
-	manifest = (prev.lib.importTOML "${input}/Cargo.toml").package;
-in
-	naersk-lib.buildPackage {
-		pname = manifest.name;
-		version = manifest.version;
-
-		src = input;
-
-		nativeBuildInputs = [prev.pkg-config];
-		buildInputs = [prev.openssl];
-		OPENSSL_NO_VENDOR = 1;
-
-		doCheck = false;
-	}

modules/ai-tools.nix

@@ -52,6 +52,7 @@
 
 		home.packages = [
 			inputs'.llm-agents.packages.claude-code
+			pkgs.nono
 		];
 
 		xdg.configFile = {

modules/dendritic.nix

@@ -63,6 +63,10 @@
 			url = "github:nix-community/naersk/master";
 			inputs.nixpkgs.follows = "nixpkgs";
 		};
+		nono = {
+			url = "github:always-further/nono";
+			flake = false;
+		};
 		# Secrets inputs
 		sops-nix = {
 			url = "github:Mic92/sops-nix";

modules/overlays.nix

@@ -4,12 +4,36 @@
 		(final: prev: {
 				himalaya = inputs.himalaya.packages.${prev.stdenv.hostPlatform.system}.default;
 			})
-		# jj-ryu (uses build-rust-package helper)
-		(final: prev: {
+		# jj-ryu
+		(final: prev: let
+				naersk-lib = prev.callPackage inputs.naersk {};
+				manifest = (prev.lib.importTOML "${inputs.jj-ryu}/Cargo.toml").package;
+			in {
 				jj-ryu =
-					import ./_lib/build-rust-package.nix {
-						inherit inputs prev;
-						input = inputs.jj-ryu;
+					naersk-lib.buildPackage {
+						pname = manifest.name;
+						version = manifest.version;
+						src = inputs.jj-ryu;
+						nativeBuildInputs = [prev.pkg-config];
+						buildInputs = [prev.openssl];
+						OPENSSL_NO_VENDOR = 1;
+						doCheck = false;
+					};
+			})
+		# nono (AI agent sandbox CLI — Cargo workspace)
+		(final: prev: let
+				naersk-lib = prev.callPackage inputs.naersk {};
+				manifest = (prev.lib.importTOML "${inputs.nono}/crates/nono-cli/Cargo.toml").package;
+			in {
+				nono =
+					naersk-lib.buildPackage {
+						pname = manifest.name;
+						version = manifest.version;
+						src = inputs.nono;
+						nativeBuildInputs = [prev.pkg-config prev.cmake prev.perl];
+						buildInputs = [prev.openssl] ++ prev.lib.optionals prev.stdenv.isLinux [prev.dbus];
+						OPENSSL_NO_VENDOR = 1;
+						doCheck = false;
 					};
 			})
 		# jj-starship (passes through upstream overlay)