nono-opencode-tinfoil

A nono sandbox profile for running OpenCode with access to Tinfoil enclaves and other LLM providers.

Install

macOS / Linux

git clone https://github.com/YOUR_USERNAME/nono-opencode-tinfoil.git
cd nono-opencode-tinfoil
make install

This installs the profile to ~/.config/nono/profiles/ and a wrapper script to ~/.local/bin/.

Requirements

• nono installed
• opencode installed globally (e.g. npm i -g opencode-ai)

Usage

After install, run OpenCode from any project directory:

opencode

Or use the profile directly:

nono run --profile opencode-tinfoil --allow-cwd -- opencode

Tinfoil integration

The profile allows network access to:

• *.tinfoil.sh
• inference.tinfoil.sh
• containers.tinfoil.sh
• ghcr.io

and grants read/write access to ~/.tinfoil for Tinfoil credentials.

Security model

• Current working directory: read/write
• OpenCode config: read/write
• Tinfoil config: read/write
• SSH private keys, AWS/GCP/Azure credentials, kubeconfig: denied
• sudo, su, doas, passwd, disk tools: denied

Uninstall

make uninstall

License

MIT