Initial opencode‑tinfoil nono profile repository

README.md

@@ -0,0 +1,66 @@
+# nono-opencode-tinfoil
+
+A [`nono`](https://github.com/guybedford/nono) sandbox profile for running
+[OpenCode](https://opencode.ai) with access to [Tinfoil](https://tinfoil.sh)
+enclaves and other LLM providers.
+
+## Install
+
+### macOS / Linux
+
+```bash
+git clone https://github.com/YOUR_USERNAME/nono-opencode-tinfoil.git
+cd nono-opencode-tinfoil
+make install
+```
+
+This installs the profile to `~/.config/nono/profiles/` and a wrapper script
+to `~/.local/bin/`.
+
+### Requirements
+
+- [nono](https://github.com/guybedford/nono) installed
+- `opencode` installed globally (e.g. `npm i -g opencode-ai`)
+
+## Usage
+
+After install, run OpenCode from any project directory:
+
+```bash
+opencode
+```
+
+Or use the profile directly:
+
+```bash
+nono run --profile opencode-tinfoil --allow-cwd -- opencode
+```
+
+## Tinfoil integration
+
+The profile allows network access to:
+
+- `*.tinfoil.sh`
+- `inference.tinfoil.sh`
+- `containers.tinfoil.sh`
+- `ghcr.io`
+
+and grants read/write access to `~/.tinfoil` for Tinfoil credentials.
+
+## Security model
+
+- Current working directory: read/write
+- OpenCode config: read/write
+- Tinfoil config: read/write
+- SSH private keys, AWS/GCP/Azure credentials, kubeconfig: denied
+- `sudo`, `su`, `doas`, `passwd`, disk tools: denied
+
+## Uninstall
+
+```bash
+make uninstall
+```
+
+## License
+
+MIT