# nono-opencode-tinfoil

A [`nono`](https://github.com/guybedford/nono) sandbox profile for running
[OpenCode](https://opencode.ai) with access to [Tinfoil](https://tinfoil.sh)
enclaves and other LLM providers.

## Install

### macOS / Linux

```bash
git clone https://github.com/YOUR_USERNAME/nono-opencode-tinfoil.git
cd nono-opencode-tinfoil
make install
```

This installs the profile to `~/.config/nono/profiles/` and a wrapper script
to `~/.local/bin/`.

### Requirements

- [nono](https://github.com/guybedford/nono) installed
- `opencode` installed globally (e.g. `npm i -g opencode-ai`)

## Usage

After install, run OpenCode from any project directory:

```bash
opencode
```

Or use the profile directly:

```bash
nono run --profile opencode-tinfoil --allow-cwd -- opencode
```

## Tinfoil integration

The profile allows network access to:

- `*.tinfoil.sh`
- `inference.tinfoil.sh`
- `containers.tinfoil.sh`
- `ghcr.io`

and grants read/write access to `~/.tinfoil` for Tinfoil credentials.

## Security model

- Current working directory: read/write
- OpenCode config: read/write
- Tinfoil config: read/write
- SSH private keys, AWS/GCP/Azure credentials, kubeconfig: denied
- `sudo`, `su`, `doas`, `passwd`, disk tools: denied

## Uninstall

```bash
make uninstall
```

## License

MIT