Add nono sandbox for AI agents

flake.lock

@@ -548,6 +548,22 @@
         "type": "github"
       }
     },
+    "nono": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1770047555,
+        "narHash": "sha256-BL1lBZYs6bsjk/+g+Zc2lUjErlvgYYJQqYEKLUjvtVU=",
+        "owner": "lukehinds",
+        "repo": "nono",
+        "rev": "8d382fbc0b21ad06d255a97000d876c15b5dea09",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lukehinds",
+        "repo": "nono",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "colmena": "colmena",
@@ -564,6 +580,7 @@
         "nix-homebrew": "nix-homebrew",
         "nixpkgs": "nixpkgs_3",
         "nixvim": "nixvim",
+        "nono": "nono",
         "sops-nix": "sops-nix",
         "zjstatus": "zjstatus"
       }

flake.nix

@@ -45,6 +45,10 @@
 			flake = false;
 		};
 		jj-starship.url = "github:dmmulroy/jj-starship";
+		nono = {
+			url = "github:lukehinds/nono";
+			flake = false;
+		};
 	};
 
 	outputs = inputs @ {flake-parts, ...}:

hosts/chidi/default.nix

@@ -36,6 +36,7 @@
 			../../profiles/lazygit.nix
 			../../profiles/lumen.nix
 			../../profiles/mise.nix
+			../../profiles/nono.nix
 			../../profiles/neovim
 			../../profiles/opencode.nix
 			../../profiles/ripgrep.nix

hosts/jason/default.nix

@@ -35,6 +35,7 @@
 			../../profiles/lazygit.nix
 			../../profiles/lumen.nix
 			../../profiles/mise.nix
+			../../profiles/nono.nix
 			../../profiles/neovim
 			../../profiles/opencode.nix
 			../../profiles/ripgrep.nix

hosts/tahani/default.nix

@@ -36,6 +36,7 @@
 			../../profiles/lazygit.nix
 			../../profiles/lumen.nix
 			../../profiles/mise.nix
+			../../profiles/nono.nix
 			../../profiles/neovim
 			../../profiles/opencode.nix
 			../../profiles/ripgrep.nix

overlays/nono.nix

@@ -0,0 +1,18 @@
+{inputs}: final: prev: let
+	manifest = (prev.lib.importTOML "${inputs.nono}/Cargo.toml").package;
+in {
+	nono = prev.rustPlatform.buildRustPackage {
+		pname = manifest.name;
+		version = manifest.version;
+
+		cargoLock.lockFile = "${inputs.nono}/Cargo.lock";
+
+		src = inputs.nono;
+
+		nativeBuildInputs = with prev; [pkg-config];
+		buildInputs = with prev; [openssl dbus];
+		OPENSSL_NO_VENDOR = 1;
+
+		doCheck = false;
+	};
+}

profiles/nono.nix

@@ -0,0 +1,5 @@
+{pkgs, ...}: {
+	home.packages = with pkgs; [
+		nono
+	];
+}