#compdef nono

autoload -U is-at-least

_nono() {
    typeset -A opt_args
    typeset -a _arguments_options
    local ret=1

    if is-at-least 5.2; then
        _arguments_options=(-s -S -C)
    else
        _arguments_options=(-s -C)
    fi

    local context curcontext="$curcontext" state line
    _arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
'-V[Print version]' \
'--version[Print version]' \
":: :_nono_commands" \
"*::: :->nono" \
&& ret=0
    case $state in
    (nono)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-command-$line[1]:"
        case $line[1] in
            (setup)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--check-only[Only verify installation and sandbox support, don'\''t create files]' \
'--profiles[Generate example user profiles in ~/.config/nono/profiles/]' \
'--shell-integration[Show shell integration instructions]' \
'*-v[Show detailed information during setup]' \
'*--verbose[Show detailed information during setup]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(run)
_arguments "${_arguments_options[@]}" : \
'*-a+[Allow read+write access to a directory (recursive)]:DIR:_files' \
'*--allow=[Allow read+write access to a directory (recursive)]:DIR:_files' \
'*-r+[Allow read-only access to a directory (recursive)]:DIR:_files' \
'*--read=[Allow read-only access to a directory (recursive)]:DIR:_files' \
'*-w+[Allow write-only access to a directory (recursive). Directory deletion NOT included]:DIR:_files' \
'*--write=[Allow write-only access to a directory (recursive). Directory deletion NOT included]:DIR:_files' \
'*--allow-file=[Allow read+write access to a single file]:FILE:_files' \
'*--read-file=[Allow read-only access to a single file]:FILE:_files' \
'*--write-file=[Allow write-only access to a single file]:FILE:_files' \
'*--allow-unix-socket=[Allow connect() to an AF_UNIX socket at this path (implies --read-file)]:SOCKET:_files' \
'*--allow-unix-socket-bind=[Allow connect() and bind() on an AF_UNIX socket at this path. If the path exists, implies --allow-file on the socket. If it does not yet exist (the typical bind(2) case), implies --allow on the parent directory so the kernel can create the socket file. Prefer --allow-unix-socket-dir-bind for runtime-generated filenames]:SOCKET:_files' \
'*--allow-unix-socket-dir=[Allow connect() to any AF_UNIX socket directly within this directory. Non-recursive on macOS and future Linux AF_UNIX mediation; current Linux Landlock filesystem fallback is recursive]:DIR:_files' \
'*--allow-unix-socket-dir-bind=[Allow connect() and bind() on any AF_UNIX socket directly within this directory. Non-recursive on macOS and future Linux AF_UNIX mediation; current Linux Landlock filesystem fallback is recursive. Use for runtime-generated socket filenames (PID-derived paths, etc.)]:DIR:_files' \
'*--allow-unix-socket-subtree=[Allow connect() to any AF_UNIX socket within this directory subtree (recursive; implies --read)]:DIR:_files' \
'*--allow-unix-socket-subtree-bind=[Allow connect() and bind() on any AF_UNIX socket within this directory subtree (recursive; implies --allow)]:DIR:_files' \
'*--bypass-protection=[Override a deny rule for a path. Pair with --allow/--read/--write grant ALIAS(canonical="--bypass-protection", introduced="v0.41.0", remove_by="v1.0.0", issue="#594")]:PATH:_files' \
'*--suppress-save-prompt=[Suppress save-profile prompts for denials under this path. Does not grant access ALIAS(canonical="--suppress-save-prompt", introduced="v0.52.0", remove_by="indefinite", issue="#875")]:PATH:_files' \
'--workdir=[Working directory for \$WORKDIR expansion in profiles]:DIR:_files' \
'--network-profile=[Enable proxy filtering with a named network profile]:PROFILE:_default' \
'*--allow-domain=[Add a domain to the proxy allowlist (repeatable). Use a plain hostname for unrestricted access, or a URL with a path glob to restrict to specific endpoints (e.g., https\://github.com/org/**) ALIAS(canonical="--allow-domain", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:DOMAIN_OR_URL:_default' \
'(--allow-net)*--deny-domain=[Block a domain through the proxy. Evaluated before the allowlist. Supports wildcards (e.g. *.ads.example.com). Incompatible with --allow-net]:DOMAIN:_default' \
'*--listen-port=[Allow the sandboxed child to listen on a TCP port (repeatable) ALIAS(canonical="--listen-port", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:PORT:_default' \
'*--open-port=[Allow bidirectional localhost TCP on a port\: connect + listen (repeatable) ALIAS(canonical="--open-port", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:PORT:_default' \
'*--allow-connect-port=[Allow outbound TCP connect to a specific port (repeatable; Linux Landlock V4+ only)]:PORT:_default' \
'--upstream-proxy=[Chain outbound traffic through an upstream proxy (host\:port) ALIAS(canonical="--upstream-proxy", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:HOST:PORT:_default' \
'*--upstream-bypass=[Route these domains direct instead of through the upstream proxy ALIAS(canonical="--upstream-bypass", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:DOMAIN:_default' \
'--proxy-port=[Fixed port for the credential proxy (default\: OS-assigned)]:PORT:_default' \
'--proxy-ca-validity=[Proxy CA certificate validity in days (1–365, default\: 1). Controls how long the ephemeral CA (and its leaf certificates) remain valid]:DAYS:_default' \
'*--credential=[Inject credentials via reverse proxy for a service (repeatable) ALIAS(canonical="--credential", introduced="v0.0.0", remove_by="v1.0.0", issue="#143")]:SERVICE:_default' \
'*--allow-endpoint=[Restrict a credential service to specific HTTP method+path patterns (repeatable). Format\: "SERVICE\:METHOD\:/path/pattern" (e.g., "github\:GET\:/repos/*/issues") Use "*" for any method\: "github\:*\:/repos/*/issues" Patterns\: "*" matches one path segment, "**" matches zero or more]:SERVICE:METHOD:PATH:_default' \
'--env-credential=[Load credentials as env vars. For network API keys, prefer --credential]:CREDENTIALS:_default' \
'*--env-credential-map=[Map a credential reference to an environment variable (repeatable)]:CREDENTIAL_REF:_default:CREDENTIAL_REF:_default' \
'*--allow-command=[Deprecated startup-only command allowlist override (not child-process enforced)]:CMD:_default' \
'*--block-command=[Deprecated startup-only command denylist extension (not child-process enforced)]:CMD:_default' \
'-p+[Use a profile by name or file path]:NAME_OR_PATH:_default' \
'--profile=[Use a profile by name or file path]:NAME_OR_PATH:_default' \
'--sandbox-policy=[Linux sandbox enforcement mechanism \[auto|landlock|external\] (default\: auto)]:POLICY:((auto\:"Landlock plus a static seccomp baseline for restricted networking, with automatic seccomp fallback when the kernel ABI lacks network support (< V4). This is the default"
landlock\:"Landlock only. Returns an error at startup if the kernel cannot satisfy network restrictions via Landlock alone"
external\:"TCP network egress enforcement is managed externally (iptables, cgroups, systemd, etc.). nono still installs filesystem/process sandboxing and skips only its own TCP network lockdown"))' \
'*--extends=[Extend the selected profile with an additional base profile for this invocation]:PROFILE:_default' \
'(-a --allow -r --read -w --write --allow-file --read-file --write-file --allow-unix-socket --allow-unix-socket-bind --allow-unix-socket-dir --allow-unix-socket-dir-bind --allow-unix-socket-subtree --allow-unix-socket-subtree-bind -p --profile --extends --bypass-protection --suppress-save-prompt --allow-cwd --block-net --allow-net --network-profile --allow-domain --listen-port --open-port --allow-connect-port --upstream-proxy --proxy-port --credential --allow-endpoint --env-credential --env-credential-map --allow-command --block-command --allow-launch-services --allow-gpu --allow-http2 --memory --max-processes)-c+[Capability manifest file (JSON). A fully-resolved sandbox specification — mutually exclusive with all other sandbox configuration flags]:FILE:_files' \
'(-a --allow -r --read -w --write --allow-file --read-file --write-file --allow-unix-socket --allow-unix-socket-bind --allow-unix-socket-dir --allow-unix-socket-dir-bind --allow-unix-socket-subtree --allow-unix-socket-subtree-bind -p --profile --extends --bypass-protection --suppress-save-prompt --allow-cwd --block-net --allow-net --network-profile --allow-domain --listen-port --open-port --allow-connect-port --upstream-proxy --proxy-port --credential --allow-endpoint --env-credential --env-credential-map --allow-command --block-command --allow-launch-services --allow-gpu --allow-http2 --memory --max-processes)--config=[Capability manifest file (JSON). A fully-resolved sandbox specification — mutually exclusive with all other sandbox configuration flags]:FILE:_files' \
'--memory=[Maximum resident memory for the process tree (e.g. 512M, 1Gi). Enforced on Linux via cgroup v2; requires a supervised run]:SIZE:_default' \
'--max-processes=[Maximum number of processes and threads in the process tree. Enforced on Linux via cgroup v2 (pids.max); requires a supervised run. At the cap the kernel refuses new forks rather than killing anything]:COUNT:_default' \
'--detach-timeout=[How long (seconds) to wait for a detached session to become attachable. Only meaningful with --detached. Env\: NONO_DETACH_STARTUP_TIMEOUT]:SECS:_default' \
'*--rollback-exclude=[Exclude from snapshots. Globs match filenames; plain names match path components]:PATTERN:_default' \
'*--rollback-include=[Force-include an auto-excluded directory (name only, not full path)]:DIR_NAME:_default' \
'*--skip-dir=[Skip large directory trees during trust scanning and rollback preflight. Matched as an exact path component name. Repeatable]:DIR_NAME:_default' \
'--rollback-dest=[Override the rollback snapshot destination directory. By default, snapshots are stored in \$XDG_STATE_HOME/nono/rollbacks/. The destination must be within a path already granted write access by --allow (or profile); nono will fail with a clear error if not. Useful for Docker volume mounts or shared storage paths]:PATH:_files' \
'--startup-timeout=[Kill the process if it has not entered alt-screen mode after this many seconds. Startup banners and log lines do not count; only a full-screen TUI transition satisfies the check. Set to 0 to disable. Env\: NONO_STARTUP_TIMEOUT]:SECS:_default' \
'(--no-audit --no-audit-integrity)--audit-sign-key=[Sign the audit Merkle root with a keyed signing key loaded from the given secret reference. Accepts bare trust-key IDs, keystore\:// names, file\:// paths, op\:// URIs, apple-password\:// URIs, keyring\:// URIs, or env\:// URIs]:SECRET_REF:_default' \
'--name=[Name for this session (shown in \`nono ps\`)]:NAME:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--allow-cwd[Allow CWD access without prompting (level set by profile, defaults to read-only)]' \
'(--allow-net)--block-net[Block outbound network access (allowed by default) ALIAS(canonical="--block-net", introduced="v0.0.0", remove_by="indefinite", issue="#302")]' \
'(--block-net --network-profile --allow-domain --credential --upstream-proxy --upstream-bypass --proxy-port)--allow-net[Deprecated compatibility flag. Network is unrestricted by default. ALIAS(canonical="--allow-net", introduced="v0.0.0", remove_by="indefinite", issue="#302")]' \
'--allow-launch-services[Allow direct LaunchServices opens on macOS (temporary login/setup flows)]' \
'--allow-gpu[Allow GPU access (Metal/IOKit on Apple Silicon macOS, render nodes on Linux)]' \
'--strict-broker-path[Refuse to start instead of warning when a filesystem grant overlaps a directory on PATH. nono'\''s own credential/browser brokers already sanitize PATH before resolving anything by bare name, so this isn'\''t about protecting them — it'\''s about the directory itself\: once the sandboxed process can plant a same-named binary there, anything else on the host that later resolves that name (a shell, cron, another tool) runs it with full privileges, outside nono entirely]' \
'--allow-http2[Allow HTTP/2 multiplexing for upstream proxy connections]' \
'*-v[Enable verbose output]' \
'*--verbose[Enable verbose output]' \
'--dry-run[Show what would be sandboxed without executing]' \
'--detached[Start the session without attaching the current terminal. The supervisor keeps the sandboxed process running in the background; use \`nono attach <session>\` later to inspect or interact with it]' \
'(--no-rollback)--rollback[Enable atomic rollback snapshots for the session]' \
'--no-rollback-prompt[Skip the post-exit rollback review prompt]' \
'(--rollback)--no-rollback[Disable rollback entirely (no snapshots taken)]' \
'(--rollback-include)--rollback-all[Include all directories in snapshots. VCS dirs (.git) always excluded]' \
'--no-diagnostics[Suppress diagnostic footer on command failure]' \
'--diagnostics-json[After the run, print session diagnostics as JSON on stderr (merged with proxy diagnostics when present)]' \
'(--audit-integrity --no-audit-integrity --rollback)--no-audit[Disable the audit trail for this session]' \
'(--audit-integrity --rollback)--no-audit-integrity[Disable the default Merkleized append-only audit log]' \
'--audit-integrity[Add filesystem-state hashing over in-scope writable paths]' \
'--trust-override[Disable trust verification (not recommended for production)]' \
'--capability-elevation[Enable runtime capability elevation (seccomp-notify + approval prompts). Overrides the profile'\''s capability_elevation setting. When enabled, the supervisor can grant access to paths not in the initial capability set via interactive prompts]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'*::command -- Command to run inside the sandbox (optional if profile specifies `binary`):_default' \
&& ret=0
;;
(shell)
_arguments "${_arguments_options[@]}" : \
'*-a+[Allow read+write access to a directory (recursive)]:DIR:_files' \
'*--allow=[Allow read+write access to a directory (recursive)]:DIR:_files' \
'*-r+[Allow read-only access to a directory (recursive)]:DIR:_files' \
'*--read=[Allow read-only access to a directory (recursive)]:DIR:_files' \
'*-w+[Allow write-only access to a directory (recursive). Directory deletion NOT included]:DIR:_files' \
'*--write=[Allow write-only access to a directory (recursive). Directory deletion NOT included]:DIR:_files' \
'*--allow-file=[Allow read+write access to a single file]:FILE:_files' \
'*--read-file=[Allow read-only access to a single file]:FILE:_files' \
'*--write-file=[Allow write-only access to a single file]:FILE:_files' \
'*--allow-unix-socket=[Allow connect() to an AF_UNIX socket at this path (implies --read-file)]:SOCKET:_files' \
'*--allow-unix-socket-bind=[Allow connect() and bind() on an AF_UNIX socket at this path. If the path exists, implies --allow-file on the socket. If it does not yet exist (the typical bind(2) case), implies --allow on the parent directory so the kernel can create the socket file. Prefer --allow-unix-socket-dir-bind for runtime-generated filenames]:SOCKET:_files' \
'*--allow-unix-socket-dir=[Allow connect() to any AF_UNIX socket directly within this directory. Non-recursive on macOS and future Linux AF_UNIX mediation; current Linux Landlock filesystem fallback is recursive]:DIR:_files' \
'*--allow-unix-socket-dir-bind=[Allow connect() and bind() on any AF_UNIX socket directly within this directory. Non-recursive on macOS and future Linux AF_UNIX mediation; current Linux Landlock filesystem fallback is recursive. Use for runtime-generated socket filenames (PID-derived paths, etc.)]:DIR:_files' \
'*--allow-unix-socket-subtree=[Allow connect() to any AF_UNIX socket within this directory subtree (recursive; implies --read)]:DIR:_files' \
'*--allow-unix-socket-subtree-bind=[Allow connect() and bind() on any AF_UNIX socket within this directory subtree (recursive; implies --allow)]:DIR:_files' \
'*--bypass-protection=[Override a deny rule for a path. Pair with --allow/--read/--write grant ALIAS(canonical="--bypass-protection", introduced="v0.41.0", remove_by="v1.0.0", issue="#594")]:PATH:_files' \
'*--suppress-save-prompt=[Suppress save-profile prompts for denials under this path. Does not grant access ALIAS(canonical="--suppress-save-prompt", introduced="v0.52.0", remove_by="indefinite", issue="#875")]:PATH:_files' \
'--workdir=[Working directory for \$WORKDIR expansion in profiles]:DIR:_files' \
'--network-profile=[Enable proxy filtering with a named network profile]:PROFILE:_default' \
'*--allow-domain=[Add a domain to the proxy allowlist (repeatable). Use a plain hostname for unrestricted access, or a URL with a path glob to restrict to specific endpoints (e.g., https\://github.com/org/**) ALIAS(canonical="--allow-domain", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:DOMAIN_OR_URL:_default' \
'(--allow-net)*--deny-domain=[Block a domain through the proxy. Evaluated before the allowlist. Supports wildcards (e.g. *.ads.example.com). Incompatible with --allow-net]:DOMAIN:_default' \
'*--listen-port=[Allow the sandboxed child to listen on a TCP port (repeatable) ALIAS(canonical="--listen-port", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:PORT:_default' \
'*--open-port=[Allow bidirectional localhost TCP on a port\: connect + listen (repeatable) ALIAS(canonical="--open-port", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:PORT:_default' \
'*--allow-connect-port=[Allow outbound TCP connect to a specific port (repeatable; Linux Landlock V4+ only)]:PORT:_default' \
'--upstream-proxy=[Chain outbound traffic through an upstream proxy (host\:port) ALIAS(canonical="--upstream-proxy", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:HOST:PORT:_default' \
'*--upstream-bypass=[Route these domains direct instead of through the upstream proxy ALIAS(canonical="--upstream-bypass", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:DOMAIN:_default' \
'--proxy-port=[Fixed port for the credential proxy (default\: OS-assigned)]:PORT:_default' \
'--proxy-ca-validity=[Proxy CA certificate validity in days (1–365, default\: 1). Controls how long the ephemeral CA (and its leaf certificates) remain valid]:DAYS:_default' \
'*--credential=[Inject credentials via reverse proxy for a service (repeatable) ALIAS(canonical="--credential", introduced="v0.0.0", remove_by="v1.0.0", issue="#143")]:SERVICE:_default' \
'*--allow-endpoint=[Restrict a credential service to specific HTTP method+path patterns (repeatable). Format\: "SERVICE\:METHOD\:/path/pattern" (e.g., "github\:GET\:/repos/*/issues") Use "*" for any method\: "github\:*\:/repos/*/issues" Patterns\: "*" matches one path segment, "**" matches zero or more]:SERVICE:METHOD:PATH:_default' \
'--env-credential=[Load credentials as env vars. For network API keys, prefer --credential]:CREDENTIALS:_default' \
'*--env-credential-map=[Map a credential reference to an environment variable (repeatable)]:CREDENTIAL_REF:_default:CREDENTIAL_REF:_default' \
'*--allow-command=[Deprecated startup-only command allowlist override (not child-process enforced)]:CMD:_default' \
'*--block-command=[Deprecated startup-only command denylist extension (not child-process enforced)]:CMD:_default' \
'-p+[Use a profile by name or file path]:NAME_OR_PATH:_default' \
'--profile=[Use a profile by name or file path]:NAME_OR_PATH:_default' \
'--sandbox-policy=[Linux sandbox enforcement mechanism \[auto|landlock|external\] (default\: auto)]:POLICY:((auto\:"Landlock plus a static seccomp baseline for restricted networking, with automatic seccomp fallback when the kernel ABI lacks network support (< V4). This is the default"
landlock\:"Landlock only. Returns an error at startup if the kernel cannot satisfy network restrictions via Landlock alone"
external\:"TCP network egress enforcement is managed externally (iptables, cgroups, systemd, etc.). nono still installs filesystem/process sandboxing and skips only its own TCP network lockdown"))' \
'*--extends=[Extend the selected profile with an additional base profile for this invocation]:PROFILE:_default' \
'(-a --allow -r --read -w --write --allow-file --read-file --write-file --allow-unix-socket --allow-unix-socket-bind --allow-unix-socket-dir --allow-unix-socket-dir-bind --allow-unix-socket-subtree --allow-unix-socket-subtree-bind -p --profile --extends --bypass-protection --suppress-save-prompt --allow-cwd --block-net --allow-net --network-profile --allow-domain --listen-port --open-port --allow-connect-port --upstream-proxy --proxy-port --credential --allow-endpoint --env-credential --env-credential-map --allow-command --block-command --allow-launch-services --allow-gpu --allow-http2 --memory --max-processes)-c+[Capability manifest file (JSON). A fully-resolved sandbox specification — mutually exclusive with all other sandbox configuration flags]:FILE:_files' \
'(-a --allow -r --read -w --write --allow-file --read-file --write-file --allow-unix-socket --allow-unix-socket-bind --allow-unix-socket-dir --allow-unix-socket-dir-bind --allow-unix-socket-subtree --allow-unix-socket-subtree-bind -p --profile --extends --bypass-protection --suppress-save-prompt --allow-cwd --block-net --allow-net --network-profile --allow-domain --listen-port --open-port --allow-connect-port --upstream-proxy --proxy-port --credential --allow-endpoint --env-credential --env-credential-map --allow-command --block-command --allow-launch-services --allow-gpu --allow-http2 --memory --max-processes)--config=[Capability manifest file (JSON). A fully-resolved sandbox specification — mutually exclusive with all other sandbox configuration flags]:FILE:_files' \
'--memory=[Maximum resident memory for the process tree (e.g. 512M, 1Gi). Enforced on Linux via cgroup v2; requires a supervised run]:SIZE:_default' \
'--max-processes=[Maximum number of processes and threads in the process tree. Enforced on Linux via cgroup v2 (pids.max); requires a supervised run. At the cap the kernel refuses new forks rather than killing anything]:COUNT:_default' \
'--shell=[Shell to execute (defaults to \$SHELL or /bin/sh)]:SHELL:_files' \
'--name=[Name for this session (shown in \`nono ps\`)]:NAME:_default' \
'--startup-timeout=[Kill the process if it has not become interactive after this many seconds. Set to 0 to disable. Env\: NONO_STARTUP_TIMEOUT]:SECS:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--allow-cwd[Allow CWD access without prompting (level set by profile, defaults to read-only)]' \
'(--allow-net)--block-net[Block outbound network access (allowed by default) ALIAS(canonical="--block-net", introduced="v0.0.0", remove_by="indefinite", issue="#302")]' \
'(--block-net --network-profile --allow-domain --credential --upstream-proxy --upstream-bypass --proxy-port)--allow-net[Deprecated compatibility flag. Network is unrestricted by default. ALIAS(canonical="--allow-net", introduced="v0.0.0", remove_by="indefinite", issue="#302")]' \
'--allow-launch-services[Allow direct LaunchServices opens on macOS (temporary login/setup flows)]' \
'--allow-gpu[Allow GPU access (Metal/IOKit on Apple Silicon macOS, render nodes on Linux)]' \
'--strict-broker-path[Refuse to start instead of warning when a filesystem grant overlaps a directory on PATH. nono'\''s own credential/browser brokers already sanitize PATH before resolving anything by bare name, so this isn'\''t about protecting them — it'\''s about the directory itself\: once the sandboxed process can plant a same-named binary there, anything else on the host that later resolves that name (a shell, cron, another tool) runs it with full privileges, outside nono entirely]' \
'--allow-http2[Allow HTTP/2 multiplexing for upstream proxy connections]' \
'*-v[Enable verbose output]' \
'*--verbose[Enable verbose output]' \
'--dry-run[Show what would be sandboxed without executing]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(wrap)
_arguments "${_arguments_options[@]}" : \
'*-a+[Allow read+write access to a directory (recursive)]:DIR:_files' \
'*--allow=[Allow read+write access to a directory (recursive)]:DIR:_files' \
'*-r+[Allow read-only access to a directory (recursive)]:DIR:_files' \
'*--read=[Allow read-only access to a directory (recursive)]:DIR:_files' \
'*-w+[Allow write-only access to a directory (recursive). Directory deletion NOT included]:DIR:_files' \
'*--write=[Allow write-only access to a directory (recursive). Directory deletion NOT included]:DIR:_files' \
'*--allow-file=[Allow read+write access to a single file]:FILE:_files' \
'*--read-file=[Allow read-only access to a single file]:FILE:_files' \
'*--write-file=[Allow write-only access to a single file]:FILE:_files' \
'*--allow-unix-socket=[Allow connect() to an AF_UNIX socket at this path (implies --read-file)]:SOCKET:_files' \
'*--allow-unix-socket-bind=[Allow connect() and bind() on an AF_UNIX socket at this path. If the path exists, implies --allow-file on the socket. If it does not yet exist (the typical bind(2) case), implies --allow on the parent directory so the kernel can create the socket file. Prefer --allow-unix-socket-dir-bind for runtime-generated filenames]:SOCKET:_files' \
'*--allow-unix-socket-dir=[Allow connect() to any AF_UNIX socket directly within this directory. Non-recursive on macOS and future Linux AF_UNIX mediation; current Linux Landlock filesystem fallback is recursive]:DIR:_files' \
'*--allow-unix-socket-dir-bind=[Allow connect() and bind() on any AF_UNIX socket directly within this directory. Non-recursive on macOS and future Linux AF_UNIX mediation; current Linux Landlock filesystem fallback is recursive. Use for runtime-generated socket filenames (PID-derived paths, etc.)]:DIR:_files' \
'*--allow-unix-socket-subtree=[Allow connect() to any AF_UNIX socket within this directory subtree (recursive; implies --read)]:DIR:_files' \
'*--allow-unix-socket-subtree-bind=[Allow connect() and bind() on any AF_UNIX socket within this directory subtree (recursive; implies --allow)]:DIR:_files' \
'*--bypass-protection=[Override a deny rule for a path. Pair with --allow/--read/--write grant ALIAS(canonical="--bypass-protection", introduced="v0.41.0", remove_by="v1.0.0", issue="#594")]:PATH:_files' \
'*--suppress-save-prompt=[Suppress save-profile prompts for denials under this path. Does not grant access ALIAS(canonical="--suppress-save-prompt", introduced="v0.52.0", remove_by="indefinite", issue="#875")]:PATH:_files' \
'--workdir=[Working directory for \$WORKDIR expansion in profiles]:DIR:_files' \
'*--listen-port=[Allow the sandboxed child to listen on a TCP port (repeatable) ALIAS(canonical="--listen-port", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:PORT:_default' \
'*--open-port=[Allow bidirectional localhost TCP on a port\: connect + listen (repeatable) ALIAS(canonical="--open-port", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:PORT:_default' \
'*--allow-connect-port=[Allow outbound TCP connect to a specific port (repeatable; Linux Landlock V4+ only)]:PORT:_default' \
'--env-credential=[Load credentials as env vars]:CREDENTIALS:_default' \
'*--env-credential-map=[Map a credential reference to an environment variable (repeatable)]:CREDENTIAL_REF:_default:CREDENTIAL_REF:_default' \
'*--allow-command=[Deprecated startup-only command allowlist override (not child-process enforced)]:CMD:_default' \
'*--block-command=[Deprecated startup-only command denylist extension (not child-process enforced)]:CMD:_default' \
'-p+[Use a profile by name or file path]:NAME_OR_PATH:_default' \
'--profile=[Use a profile by name or file path]:NAME_OR_PATH:_default' \
'*--extends=[Extend the selected profile with an additional base profile for this invocation]:PROFILE:_default' \
'(-a --allow -r --read -w --write --allow-file --read-file --write-file --allow-unix-socket --allow-unix-socket-bind --allow-unix-socket-dir --allow-unix-socket-dir-bind --allow-unix-socket-subtree --allow-unix-socket-subtree-bind -p --profile --extends --bypass-protection --suppress-save-prompt --allow-cwd --block-net --listen-port --open-port --allow-connect-port --env-credential --env-credential-map --allow-command --block-command --allow-launch-services --allow-gpu)-c+[Capability manifest file (JSON). A fully-resolved sandbox specification — mutually exclusive with all other sandbox configuration flags]:FILE:_files' \
'(-a --allow -r --read -w --write --allow-file --read-file --write-file --allow-unix-socket --allow-unix-socket-bind --allow-unix-socket-dir --allow-unix-socket-dir-bind --allow-unix-socket-subtree --allow-unix-socket-subtree-bind -p --profile --extends --bypass-protection --suppress-save-prompt --allow-cwd --block-net --listen-port --open-port --allow-connect-port --env-credential --env-credential-map --allow-command --block-command --allow-launch-services --allow-gpu)--config=[Capability manifest file (JSON). A fully-resolved sandbox specification — mutually exclusive with all other sandbox configuration flags]:FILE:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--allow-cwd[Allow CWD access without prompting (level set by profile, defaults to read-only)]' \
'--block-net[Block outbound network access (allowed by default) ALIAS(canonical="--block-net", introduced="v0.0.0", remove_by="indefinite", issue="#302")]' \
'--allow-launch-services[Allow direct LaunchServices opens on macOS (temporary login/setup flows)]' \
'--allow-gpu[Allow GPU access (Metal/IOKit on Apple Silicon macOS, render nodes on Linux)]' \
'*-v[Enable verbose output]' \
'*--verbose[Enable verbose output]' \
'--dry-run[Show what would be sandboxed without executing]' \
'--no-diagnostics[Suppress diagnostic footer on command failure]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'*::command -- Command to run inside the sandbox:_default' \
&& ret=0
;;
(why)
_arguments "${_arguments_options[@]}" : \
'--command=[Tool-sandbox command name to check (ETI command policy)]:COMMAND:_default' \
'--caller=[Caller edge for command policy checks (default\: session)]:CALLER:_default' \
'--path=[Path to check]:PATH:_files' \
'--op=[Operation to check\: read, write, or readwrite]:OP:((read\:"Read-only access"
write\:"Write-only access"
readwrite\:"Read and write access"))' \
'--host=[Network host or URL to check (e.g. github.com or https\://github.com/org/repo)]:HOST:_default' \
'--scope=[Landlock scope to check]:SCOPE:((signal\:"Signal scoping"
abstract-unix-socket\:"Abstract UNIX socket scoping"))' \
'--port=[Network port (default 443)]:PORT:_default' \
'*--allow-domain=[Add a domain to the proxy allowlist for this query (repeatable)]:DOMAIN_OR_URL:_default' \
'*--deny-domain=[Block a domain through the proxy for this query (repeatable)]:DOMAIN:_default' \
'*-a+[Directories to allow read+write access (for query context)]:DIR:_files' \
'*--allow=[Directories to allow read+write access (for query context)]:DIR:_files' \
'*-r+[Directories to allow read-only access (for query context)]:DIR:_files' \
'*--read=[Directories to allow read-only access (for query context)]:DIR:_files' \
'*-w+[Directories to allow write-only access (for query context)]:DIR:_files' \
'*--write=[Directories to allow write-only access (for query context)]:DIR:_files' \
'*--allow-file=[Single files to allow read+write access (for query context)]:FILE:_files' \
'*--read-file=[Single files to allow read-only access (for query context)]:FILE:_files' \
'*--write-file=[Single files to allow write-only access (for query context)]:FILE:_files' \
'-p+[Use a named profile for query context]:NAME:_default' \
'--profile=[Use a named profile for query context]:NAME:_default' \
'*--extends=[Extend the selected profile with an additional base profile for this query]:PROFILE:_default' \
'--workdir=[Working directory for \$WORKDIR expansion in profiles]:DIR:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output JSON instead of human-readable format]' \
'--self[Query current sandbox state (use inside a sandboxed process)]' \
'--block-net[Block network access (for query context) ALIAS(canonical="--block-net", introduced="v0.0.0", remove_by="indefinite", issue="#302")]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'*::command_args -- Arguments for --command after `--`:_default' \
&& ret=0
;;
(proxy)
_arguments "${_arguments_options[@]}" : \
'--listen=[Address the proxy listens on (loopback only unless --no-auth is omitted)]:ADDR:_default' \
'--port=[Port to listen on (0 = OS-assigned ephemeral port)]:PORT:_default' \
'--pass=[Use this exact password as the proxy credential instead of a randomly generated session token. Clients present it via Proxy-Authorization (Basic password or Bearer token). Prefer NONO_PROXY_PASS to avoid leaking the secret in shell history / process listings]:PASSWORD:_default' \
'-p+[Use a profile by name or file path (loads its network/credential settings)]:NAME_OR_PATH:_default' \
'--profile=[Use a profile by name or file path (loads its network/credential settings)]:NAME_OR_PATH:_default' \
'*--extends=[Extend the selected profile with an additional base profile for this invocation]:PROFILE:_default' \
'--max-connections=[Maximum concurrent client connections (0 = unlimited). Raise this when driving highly parallel clients such as \`docker pull\`, which opens many simultaneous tunnels and can exhaust the default limit]:N:_default' \
'--network-profile=[Enable proxy filtering with a named network profile]:PROFILE:_default' \
'*--allow-domain=[Add a domain to the proxy allowlist (repeatable). Plain hostname for unrestricted access, or a URL with a path glob to restrict to specific endpoints (e.g., https\://github.com/org/**) ALIAS(canonical="--allow-domain", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:DOMAIN_OR_URL:_default' \
'*--deny-domain=[Block a domain through the proxy. Evaluated before the allowlist. Supports wildcards (e.g. *.ads.example.com)]:DOMAIN:_default' \
'--upstream-proxy=[Chain outbound traffic through an upstream proxy (host\:port) ALIAS(canonical="--upstream-proxy", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:HOST:PORT:_default' \
'*--upstream-bypass=[Route these domains direct instead of through the upstream proxy ALIAS(canonical="--upstream-bypass", introduced="v0.0.0", remove_by="indefinite", issue="#415")]:DOMAIN:_default' \
'--proxy-ca-validity=[Proxy CA certificate validity in days (1–365, default\: 1)]:DAYS:_default' \
'(--proxy-ca-validity)--proxy-ca-cert=[Sign intercepted TLS connections with this existing CA certificate (PEM) instead of a fresh per-session CA. Reuses the same CA across proxy runs so clients only have to trust it once. Requires --proxy-ca-key. Validity comes from the supplied certificate, so it cannot be combined with --proxy-ca-validity]:PEM_FILE:_files' \
'--proxy-ca-key=[Private key (PKCS#8 PEM) for --proxy-ca-cert. Prefer NONO_PROXY_CA_KEY to keep the path out of shell history; the key file itself should be readable only by you]:PEM_FILE:_files' \
'*--credential=[Inject credentials via reverse proxy for a service (repeatable) ALIAS(canonical="--credential", introduced="v0.0.0", remove_by="v1.0.0", issue="#143")]:SERVICE:_default' \
'*--allow-endpoint=[Restrict a credential service to specific HTTP method+path patterns (repeatable). Format\: "SERVICE\:METHOD\:/path/pattern" (e.g., "github\:GET\:/repos/*/issues") Use "*" for any method\: "github\:*\:/repos/*/issues" Patterns\: "*" matches one path segment, "**" matches zero or more]:SERVICE:METHOD:PATH:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'(--pass)--no-auth[Disable session-token auth\: accept every request on the bind address. Refused for non-loopback bind addresses. Use with care]' \
'--allow-http2[Allow HTTP/2 multiplexing for upstream proxy connections]' \
'*-v[Enable verbose output (-v info, -vv debug, -vvv trace)]' \
'*--verbose[Enable verbose output (-v info, -vv debug, -vvv trace)]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help (see more with '\''--help'\'')]' \
'--help[Print help (see more with '\''--help'\'')]' \
&& ret=0
;;
(rollback)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
":: :_nono__subcmd__rollback_commands" \
"*::: :->rollback" \
&& ret=0

    case $state in
    (rollback)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-rollback-command-$line[1]:"
        case $line[1] in
            (list)
_arguments "${_arguments_options[@]}" : \
'--recent=[Show only the N most recent sessions]:N:_default' \
'--path=[Filter sessions by tracked path (matches if session tracked this path or a parent/child)]:PATH:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--all[Compatibility flag; rollback sessions are shown by default]' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--diff[Show unified diff (git diff style)]' \
'--side-by-side[Show side-by-side diff]' \
'--full[Show full file content from snapshot]' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':session_id -- Session ID (e.g., 20260214-143022-12345):_default' \
&& ret=0
;;
(restore)
_arguments "${_arguments_options[@]}" : \
'--snapshot=[Snapshot number to restore to (default\: last snapshot)]:SNAPSHOT:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--dry-run[Show what would change without modifying files]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':session_id -- Session ID (e.g., 20260214-143022-12345):_default' \
&& ret=0
;;
(verify)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':session_id -- Session ID (e.g., 20260214-143022-12345):_default' \
&& ret=0
;;
(cleanup)
_arguments "${_arguments_options[@]}" : \
'--keep=[Retain N newest sessions (default\: from config, usually 10)]:N:_default' \
'--older-than=[Remove sessions older than N days]:DAYS:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--dry-run[Show what would be removed without deleting]' \
'--all[Remove all sessions (requires confirmation)]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
        esac
    ;;
esac
;;
(audit)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
":: :_nono__subcmd__audit_commands" \
"*::: :->audit" \
&& ret=0

    case $state in
    (audit)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-audit-command-$line[1]:"
        case $line[1] in
            (list)
_arguments "${_arguments_options[@]}" : \
'--since=[Show sessions since date (YYYY-MM-DD)]:DATE:_default' \
'--until=[Show sessions until date (YYYY-MM-DD)]:DATE:_default' \
'--command=[Filter by command name (e.g., claude, cat)]:CMD:_default' \
'--path=[Filter by tracked path]:PATH:_files' \
'--recent=[Show only the N most recent sessions]:N:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--today[Show only sessions from today]' \
'--no-tools[Hide the per-session mediated tool summary]' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':session_id -- Session ID (e.g., 20260214-143022-12345):_default' \
&& ret=0
;;
(verify)
_arguments "${_arguments_options[@]}" : \
'--public-key-file=[Public key file to match against the attested signer key (PEM or base64 DER)]:FILE:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':session_id -- Session ID (e.g., 20260214-143022-12345):_default' \
&& ret=0
;;
(cleanup)
_arguments "${_arguments_options[@]}" : \
'--keep=[Retain N newest audit sessions]:N:_default' \
'--older-than=[Remove sessions older than N days]:DAYS:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--dry-run[Show what would be removed without deleting]' \
'--all[Remove all audit sessions (skips active sessions)]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(sync)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Print delivery results as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(status)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Print status as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
        esac
    ;;
esac
;;
(platform)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
":: :_nono__subcmd__platform_commands" \
"*::: :->platform" \
&& ret=0

    case $state in
    (platform)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-platform-command-$line[1]:"
        case $line[1] in
            (enroll)
_arguments "${_arguments_options[@]}" : \
'--url=[Platform origin, for example https\://nono.example.com]:URL:_default' \
'--token=[Short-lived, single-use enrollment token]:TOKEN:_default' \
'--name=[Operator-facing label for this device or workload]:NAME:_default' \
'--keyref=[Private key location (keystore\:// name or absolute file\:// URI)]:KEYREF:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--workload[Enroll as a durable workload instead of a developer device]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(status)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Print status as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(unenroll)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--delete-key[Also delete the local signing key (the next enrollment mints a new one)]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
        esac
    ;;
esac
;;
(trust)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
":: :_nono__subcmd__trust_commands" \
"*::: :->trust" \
&& ret=0

    case $state in
    (trust)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-trust-command-$line[1]:"
        case $line[1] in
            (init)
_arguments "${_arguments_options[@]}" : \
'*--include=[Glob patterns for files to include in the trust policy (e.g., "*.md", "*.py", "SKILLS.md")]:PATTERN:_default' \
'(--keyref)--key=[Key ID to include as a publisher (default\: "default")]:KEY_ID:_default' \
'(--key)--keyref=[Key reference URI (keystore\://name or file\:///path/to/key.pem)]:URI:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--user[Create a user-level policy at ~/.config/nono/ instead of the current directory]' \
'--force[Overwrite existing trust-policy.json]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(sign)
_arguments "${_arguments_options[@]}" : \
'(--keyless --keyref)--key=[Key ID to use from the system keystore (default\: "default")]:KEY_ID:_default' \
'(--key --keyless)--keyref=[Key reference URI (keystore\://name or file\:///path/to/key.pem)]:URI:_default' \
'--policy=[Trust policy file (default\: auto-discover)]:FILE:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--all[Sign all files matching trust policy patterns in CWD]' \
'(--keyref)--keyless[Use Sigstore keyless signing (Fulcio + Rekor via ambient OIDC)]' \
'--multi-subject[Produce a single .nono-trust.bundle containing all subjects instead of per-file bundles]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'*::files -- Instruction file(s) to sign:_files' \
&& ret=0
;;
(sign-policy)
_arguments "${_arguments_options[@]}" : \
'(--keyref)--key=[Key ID to use from the system keystore (default\: "default")]:KEY_ID:_default' \
'(--key)--keyref=[Key reference URI (keystore\://name or file\:///path/to/key.pem)]:URI:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--user[Sign the user-level trust policy at ~/.config/nono/trust-policy.json]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'::file -- Trust policy file to sign (default\: trust-policy.json in CWD):_files' \
&& ret=0
;;
(verify)
_arguments "${_arguments_options[@]}" : \
'--policy=[Trust policy file (default\: auto-discover)]:FILE:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--all[Verify all files matching trust policy patterns in CWD]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'*::files -- Instruction file(s) to verify:_files' \
&& ret=0
;;
(list)
_arguments "${_arguments_options[@]}" : \
'--policy=[Trust policy file (default\: auto-discover)]:FILE:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(keygen)
_arguments "${_arguments_options[@]}" : \
'(--keyref)--id=[Key identifier (stored in system keystore under this name)]:NAME:_default' \
'(--id)--keyref=[Key reference URI (keystore\://name or file\:///path/to/key.pem)]:URI:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--force[Overwrite existing key with the same ID]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(export-key)
_arguments "${_arguments_options[@]}" : \
'(--keyref)--id=[Key identifier to export (default\: "default")]:NAME:_default' \
'(--id)--keyref=[Key reference URI (keystore\://name or file\:///path/to/key.pem)]:URI:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--pem[Output as PEM instead of base64 DER]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
        esac
    ;;
esac
;;
(ps)
_arguments "${_arguments_options[@]}" : \
'--console=[nono-console origin override (valid only with --remote)]:CONSOLE:_default' \
'--token-file=[Explicit console token-file override (valid only with --remote)]:PATH:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--remote[List sessions hosted by the enrolled tenant'\''s nono-console]' \
'--json[Output as JSON]' \
'--all[Include exited sessions]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(stop)
_arguments "${_arguments_options[@]}" : \
'--timeout=[Grace period in seconds before SIGKILL (default\: 10)]:TIMEOUT:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--force[Force stop (SIGKILL instead of SIGTERM)]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
':session -- Session ID (or prefix):_default' \
&& ret=0
;;
(detach)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
':session -- Session ID, prefix, or name:_default' \
&& ret=0
;;
(attach)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--bridge-status[Emit the private nono-console attach-helper readiness protocol]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
':session -- Session ID, prefix, or name:_default' \
&& ret=0
;;
(connect)
_arguments "${_arguments_options[@]}" : \
'--console=[nono-console origin; defaults to signed discovery from device enrollment]:CONSOLE:_default' \
'--token-file=[Explicit token-file override; normally browser authorization is automatic]:TOKEN_FILE:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--read-only[Spectate without sending terminal input (reserved until console fan-out lands)]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
'::target -- Session name/global ID, or a complete ws(s) terminal URL:_default' \
&& ret=0
;;
(logs)
_arguments "${_arguments_options[@]}" : \
'--tail=[Show last N events]:N:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-f[Follow events in real-time]' \
'--follow[Follow events in real-time]' \
'--json[Output as JSON]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
':session -- Session ID (or prefix):_default' \
&& ret=0
;;
(inspect)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'--events[Include event log]' \
'--changes[Include file changes]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
':session -- Session ID (or prefix):_default' \
&& ret=0
;;
(prune)
_arguments "${_arguments_options[@]}" : \
'--older-than=[Remove sessions older than N days]:DAYS:_default' \
'--keep=[Keep only the N most recent sessions]:N:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--dry-run[Show what would be removed without deleting]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(session)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
":: :_nono__subcmd__session_commands" \
"*::: :->session" \
&& ret=0

    case $state in
    (session)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-session-command-$line[1]:"
        case $line[1] in
            (cleanup)
_arguments "${_arguments_options[@]}" : \
'--older-than=[Remove sessions older than N days]:DAYS:_default' \
'--keep=[Keep only the N most recent sessions]:N:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--dry-run[Show what would be removed without deleting]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__session__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-session-help-command-$line[1]:"
        case $line[1] in
            (cleanup)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(policy)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
":: :_nono__subcmd__policy_commands" \
"*::: :->policy" \
&& ret=0

    case $state in
    (policy)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-policy-command-$line[1]:"
        case $line[1] in
            (groups)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'--all-platforms[Show all platforms (not just current)]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'::name -- Group name to show details for (omit to list all):_default' \
&& ret=0
;;
(profiles)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
'--format=[Output format\: '\''profile'\'' (default) or '\''manifest'\'' (capability manifest JSON)]:FORMAT:(profile manifest)' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'--raw[Show raw paths before expansion (e.g., \$HOME instead of /Users/luke)]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':profile -- Profile name or path:_default' \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':profile1 -- First profile name or path:_default' \
':profile2 -- Second profile name or path:_default' \
&& ret=0
;;
(validate)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--draft[Treat the argument as a draft name under ~/.config/nono/profile-drafts]' \
'--json[Output as JSON]' \
'--strict[Treat deprecated schema warnings as errors (exit code 2 if any are found)]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':file -- Profile JSON file to validate:_files' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__policy__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-policy-help-command-$line[1]:"
        case $line[1] in
            (groups)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(profiles)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(validate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(profile)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
":: :_nono__subcmd__profile_commands" \
"*::: :->profile" \
&& ret=0

    case $state in
    (profile)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-profile-command-$line[1]:"
        case $line[1] in
            (init)
_arguments "${_arguments_options[@]}" : \
'--extends=[Base profile to extend]:EXTENDS:_default' \
'*--groups=[Security groups to include (comma-separated)]:GROUPS:_default' \
'--description=[Profile description]:DESCRIPTION:_default' \
'-o+[Output file path (default\: ~/.config/nono/profiles/<name>.json)]:OUTPUT:_files' \
'--output=[Output file path (default\: ~/.config/nono/profiles/<name>.json)]:OUTPUT:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--full[Generate a full skeleton with all sections]' \
'--force[Overwrite existing file]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':name -- Profile name (alphanumeric + hyphens):_default' \
&& ret=0
;;
(list)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
'--format=[Output format\: '\''profile'\'' (default) or '\''manifest'\'' (capability manifest JSON)]:FORMAT:(profile manifest)' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'--raw[Show raw paths before expansion (e.g., \$HOME instead of /Users/luke)]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':profile -- Profile name or path:_default' \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':profile1 -- First profile name or path:_default' \
':profile2 -- Second profile name or path:_default' \
&& ret=0
;;
(validate)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--draft[Treat the argument as a draft name under ~/.config/nono/profile-drafts]' \
'--json[Output as JSON]' \
'--strict[Treat deprecated schema warnings as errors (exit code 2 if any are found)]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':file -- Profile JSON file to validate:_files' \
&& ret=0
;;
(promote)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--diff[Show the proposed diff without applying it]' \
'--yes[Apply without interactive confirmation]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':name -- Draft profile name:_default' \
&& ret=0
;;
(groups)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'--all-platforms[Show all platforms (not just current)]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'::name -- Group name to show details for (omit to list all):_default' \
&& ret=0
;;
(schema)
_arguments "${_arguments_options[@]}" : \
'-o+[Write schema to a file instead of stdout]:OUTPUT:_files' \
'--output=[Write schema to a file instead of stdout]:OUTPUT:_files' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(guide)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__profile__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-profile-help-command-$line[1]:"
        case $line[1] in
            (init)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(list)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(validate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(promote)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(groups)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(schema)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(guide)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(pull)
_arguments "${_arguments_options[@]}" : \
'--registry=[Registry base URL]:URL:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--force[Overwrite conflicts and accept signer changes]' \
'--init[Copy project instructions into the current directory]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':package_ref -- Package reference (<namespace>/<name>\[@<version>\]):_default' \
&& ret=0
;;
(remove)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--force[Continue removal even if some wiring directives fail to reverse. Without this flag, partial reversal failures keep the lockfile entry intact so the user can retry, since silently forgetting a half-removed pack would orphan agent wiring (e.g. a hook entry in \`~/.codex/hooks.json\` left active with no record of who put it there)]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':package_ref -- Installed package reference (<namespace>/<name>):_default' \
&& ret=0
;;
(update)
_arguments "${_arguments_options[@]}" : \
'--registry=[Registry base URL]:URL:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--dry-run[Show what would be updated without making changes]' \
'--force[Update pinned packs and accept signer changes]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'::package_ref -- Optional package reference (<namespace>/<name>):_default' \
&& ret=0
;;
(search)
_arguments "${_arguments_options[@]}" : \
'--registry=[Registry base URL]:URL:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':query -- Search query:_default' \
&& ret=0
;;
(list)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--installed[Show installed nono packs]' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(pin)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':package_ref -- Installed package reference (<namespace>/<name>):_default' \
&& ret=0
;;
(unpin)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':package_ref -- Installed package reference (<namespace>/<name>):_default' \
&& ret=0
;;
(outdated)
_arguments "${_arguments_options[@]}" : \
'--registry=[Registry base URL]:URL:_default' \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
&& ret=0
;;
(completion)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-h[Print help]' \
'--help[Print help]' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
':shell -- Shell to generate completions for:((bash\:"Bourne Again SHell (bash)"
zsh\:"Z Shell (zsh)"
fish\:"Friendly Interactive Shell (fish)"
powershell\:"PowerShell"))' \
&& ret=0
;;
(open-url-helper)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
':url -- The URL to open:_default' \
&& ret=0
;;
(pack-update-hint-helper)
_arguments "${_arguments_options[@]}" : \
'--theme=[Color theme for output (mocha, latte, frappe, macchiato, tokyo-night, minimal)]:THEME:_default' \
'--log-file=[Write logs to a file instead of stderr]:PATH:_files' \
'-s[Silent mode - suppress all nono output (banner, summary, status)]' \
'--silent[Silent mode - suppress all nono output (banner, summary, status)]' \
'-h[Print help]' \
'--help[Print help]' \
'*::packs -- Alternating package reference and installed version values:_default' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-command-$line[1]:"
        case $line[1] in
            (setup)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(run)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(shell)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(wrap)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(why)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(proxy)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(rollback)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help__subcmd__rollback_commands" \
"*::: :->rollback" \
&& ret=0

    case $state in
    (rollback)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-rollback-command-$line[1]:"
        case $line[1] in
            (list)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(restore)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(verify)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(cleanup)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(audit)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help__subcmd__audit_commands" \
"*::: :->audit" \
&& ret=0

    case $state in
    (audit)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-audit-command-$line[1]:"
        case $line[1] in
            (list)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(verify)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(cleanup)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(sync)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(status)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(platform)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help__subcmd__platform_commands" \
"*::: :->platform" \
&& ret=0

    case $state in
    (platform)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-platform-command-$line[1]:"
        case $line[1] in
            (enroll)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(status)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(unenroll)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(trust)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help__subcmd__trust_commands" \
"*::: :->trust" \
&& ret=0

    case $state in
    (trust)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-trust-command-$line[1]:"
        case $line[1] in
            (init)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(sign)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(sign-policy)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(verify)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(list)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(keygen)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(export-key)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(ps)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(stop)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(detach)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(attach)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(connect)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(logs)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(inspect)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(prune)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(session)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help__subcmd__session_commands" \
"*::: :->session" \
&& ret=0

    case $state in
    (session)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-session-command-$line[1]:"
        case $line[1] in
            (cleanup)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(policy)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help__subcmd__policy_commands" \
"*::: :->policy" \
&& ret=0

    case $state in
    (policy)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-policy-command-$line[1]:"
        case $line[1] in
            (groups)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(profiles)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(validate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(profile)
_arguments "${_arguments_options[@]}" : \
":: :_nono__subcmd__help__subcmd__profile_commands" \
"*::: :->profile" \
&& ret=0

    case $state in
    (profile)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:nono-help-profile-command-$line[1]:"
        case $line[1] in
            (init)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(list)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(validate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(promote)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(groups)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(schema)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(guide)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(pull)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(remove)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(update)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(search)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(list)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(pin)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(unpin)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(outdated)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(completion)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(open-url-helper)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(pack-update-hint-helper)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
}

(( $+functions[_nono_commands] )) ||
_nono_commands() {
    local commands; commands=(
'setup:Set up nono on this system' \
'run:Run a command inside the sandbox' \
'shell:Start an interactive shell inside the sandbox' \
'wrap:Apply sandbox and exec into command (nono disappears). For scripts, piping, and embedding where no parent process is wanted' \
'why:Check why filesystem, network, scope, or command access would be allowed or denied' \
'proxy:Run the network filtering / credential proxy as a standalone server' \
'rollback:Manage rollback sessions (browse, restore, cleanup)' \
'audit:View audit trail of sandboxed commands' \
'platform:Enroll with and inspect an audit control plane' \
'trust:Manage file trust and attestation' \
'ps:List local or remote sandboxed sessions' \
'stop:Stop a running sandboxed session' \
'detach:Detach from a running sandboxed session and return to the shell' \
'attach:Attach to a detached or running session from another terminal' \
'connect:Connect this terminal to a session hosted by nono-console' \
'logs:View event log for a session' \
'inspect:Show detailed information about a session' \
'prune:Clean up old session files' \
'session:Manage runtime session storage' \
'policy:\[deprecated\] Use '\''nono profile'\'' instead' \
'profile:Create, inspect, and compare nono profiles' \
'pull:Install a signed nono pack from the registry' \
'remove:Remove an installed nono pack' \
'update:Update installed nono packs' \
'search:Search the registry for nono packs' \
'list:List installed nono packs' \
'pin:Pin an installed pack to its current version, excluding it from updates' \
'unpin:Unpin a pack so it is included in updates again' \
'outdated:Show which installed packs have newer versions available' \
'completion:Generate shell completion scripts' \
'open-url-helper:Internal\: open a URL via supervisor IPC' \
'pack-update-hint-helper:Internal\: refresh cached pack update hints out of process' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono commands' commands "$@"
}
(( $+functions[_nono__subcmd__attach_commands] )) ||
_nono__subcmd__attach_commands() {
    local commands; commands=()
    _describe -t commands 'nono attach commands' commands "$@"
}
(( $+functions[_nono__subcmd__audit_commands] )) ||
_nono__subcmd__audit_commands() {
    local commands; commands=(
'list:List all sandboxed sessions' \
'show:Show audit details for a session' \
'verify:Verify audit integrity by recomputing hashes from the event log' \
'cleanup:Remove old audit sessions' \
'sync:Deliver queued final audit sessions to the enrolled platform' \
'status:Show audit delivery queue status' \
    )
    _describe -t commands 'nono audit commands' commands "$@"
}
(( $+functions[_nono__subcmd__audit__subcmd__cleanup_commands] )) ||
_nono__subcmd__audit__subcmd__cleanup_commands() {
    local commands; commands=()
    _describe -t commands 'nono audit cleanup commands' commands "$@"
}
(( $+functions[_nono__subcmd__audit__subcmd__list_commands] )) ||
_nono__subcmd__audit__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono audit list commands' commands "$@"
}
(( $+functions[_nono__subcmd__audit__subcmd__show_commands] )) ||
_nono__subcmd__audit__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono audit show commands' commands "$@"
}
(( $+functions[_nono__subcmd__audit__subcmd__status_commands] )) ||
_nono__subcmd__audit__subcmd__status_commands() {
    local commands; commands=()
    _describe -t commands 'nono audit status commands' commands "$@"
}
(( $+functions[_nono__subcmd__audit__subcmd__sync_commands] )) ||
_nono__subcmd__audit__subcmd__sync_commands() {
    local commands; commands=()
    _describe -t commands 'nono audit sync commands' commands "$@"
}
(( $+functions[_nono__subcmd__audit__subcmd__verify_commands] )) ||
_nono__subcmd__audit__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'nono audit verify commands' commands "$@"
}
(( $+functions[_nono__subcmd__completion_commands] )) ||
_nono__subcmd__completion_commands() {
    local commands; commands=()
    _describe -t commands 'nono completion commands' commands "$@"
}
(( $+functions[_nono__subcmd__connect_commands] )) ||
_nono__subcmd__connect_commands() {
    local commands; commands=()
    _describe -t commands 'nono connect commands' commands "$@"
}
(( $+functions[_nono__subcmd__detach_commands] )) ||
_nono__subcmd__detach_commands() {
    local commands; commands=()
    _describe -t commands 'nono detach commands' commands "$@"
}
(( $+functions[_nono__subcmd__help_commands] )) ||
_nono__subcmd__help_commands() {
    local commands; commands=(
'setup:Set up nono on this system' \
'run:Run a command inside the sandbox' \
'shell:Start an interactive shell inside the sandbox' \
'wrap:Apply sandbox and exec into command (nono disappears). For scripts, piping, and embedding where no parent process is wanted' \
'why:Check why filesystem, network, scope, or command access would be allowed or denied' \
'proxy:Run the network filtering / credential proxy as a standalone server' \
'rollback:Manage rollback sessions (browse, restore, cleanup)' \
'audit:View audit trail of sandboxed commands' \
'platform:Enroll with and inspect an audit control plane' \
'trust:Manage file trust and attestation' \
'ps:List local or remote sandboxed sessions' \
'stop:Stop a running sandboxed session' \
'detach:Detach from a running sandboxed session and return to the shell' \
'attach:Attach to a detached or running session from another terminal' \
'connect:Connect this terminal to a session hosted by nono-console' \
'logs:View event log for a session' \
'inspect:Show detailed information about a session' \
'prune:Clean up old session files' \
'session:Manage runtime session storage' \
'policy:\[deprecated\] Use '\''nono profile'\'' instead' \
'profile:Create, inspect, and compare nono profiles' \
'pull:Install a signed nono pack from the registry' \
'remove:Remove an installed nono pack' \
'update:Update installed nono packs' \
'search:Search the registry for nono packs' \
'list:List installed nono packs' \
'pin:Pin an installed pack to its current version, excluding it from updates' \
'unpin:Unpin a pack so it is included in updates again' \
'outdated:Show which installed packs have newer versions available' \
'completion:Generate shell completion scripts' \
'open-url-helper:Internal\: open a URL via supervisor IPC' \
'pack-update-hint-helper:Internal\: refresh cached pack update hints out of process' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono help commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__attach_commands] )) ||
_nono__subcmd__help__subcmd__attach_commands() {
    local commands; commands=()
    _describe -t commands 'nono help attach commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__audit_commands] )) ||
_nono__subcmd__help__subcmd__audit_commands() {
    local commands; commands=(
'list:List all sandboxed sessions' \
'show:Show audit details for a session' \
'verify:Verify audit integrity by recomputing hashes from the event log' \
'cleanup:Remove old audit sessions' \
'sync:Deliver queued final audit sessions to the enrolled platform' \
'status:Show audit delivery queue status' \
    )
    _describe -t commands 'nono help audit commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__audit__subcmd__cleanup_commands] )) ||
_nono__subcmd__help__subcmd__audit__subcmd__cleanup_commands() {
    local commands; commands=()
    _describe -t commands 'nono help audit cleanup commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__audit__subcmd__list_commands] )) ||
_nono__subcmd__help__subcmd__audit__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono help audit list commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__audit__subcmd__show_commands] )) ||
_nono__subcmd__help__subcmd__audit__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono help audit show commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__audit__subcmd__status_commands] )) ||
_nono__subcmd__help__subcmd__audit__subcmd__status_commands() {
    local commands; commands=()
    _describe -t commands 'nono help audit status commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__audit__subcmd__sync_commands] )) ||
_nono__subcmd__help__subcmd__audit__subcmd__sync_commands() {
    local commands; commands=()
    _describe -t commands 'nono help audit sync commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__audit__subcmd__verify_commands] )) ||
_nono__subcmd__help__subcmd__audit__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'nono help audit verify commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__completion_commands] )) ||
_nono__subcmd__help__subcmd__completion_commands() {
    local commands; commands=()
    _describe -t commands 'nono help completion commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__connect_commands] )) ||
_nono__subcmd__help__subcmd__connect_commands() {
    local commands; commands=()
    _describe -t commands 'nono help connect commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__detach_commands] )) ||
_nono__subcmd__help__subcmd__detach_commands() {
    local commands; commands=()
    _describe -t commands 'nono help detach commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__help_commands] )) ||
_nono__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'nono help help commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__inspect_commands] )) ||
_nono__subcmd__help__subcmd__inspect_commands() {
    local commands; commands=()
    _describe -t commands 'nono help inspect commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__list_commands] )) ||
_nono__subcmd__help__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono help list commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__logs_commands] )) ||
_nono__subcmd__help__subcmd__logs_commands() {
    local commands; commands=()
    _describe -t commands 'nono help logs commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__open-url-helper_commands] )) ||
_nono__subcmd__help__subcmd__open-url-helper_commands() {
    local commands; commands=()
    _describe -t commands 'nono help open-url-helper commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__outdated_commands] )) ||
_nono__subcmd__help__subcmd__outdated_commands() {
    local commands; commands=()
    _describe -t commands 'nono help outdated commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__pack-update-hint-helper_commands] )) ||
_nono__subcmd__help__subcmd__pack-update-hint-helper_commands() {
    local commands; commands=()
    _describe -t commands 'nono help pack-update-hint-helper commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__pin_commands] )) ||
_nono__subcmd__help__subcmd__pin_commands() {
    local commands; commands=()
    _describe -t commands 'nono help pin commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__platform_commands] )) ||
_nono__subcmd__help__subcmd__platform_commands() {
    local commands; commands=(
'enroll:Exchange a one-time token for an audit-only enrolled identity' \
'status:Show the locally enrolled platform identity' \
'unenroll:Remove the local platform enrollment' \
    )
    _describe -t commands 'nono help platform commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__platform__subcmd__enroll_commands] )) ||
_nono__subcmd__help__subcmd__platform__subcmd__enroll_commands() {
    local commands; commands=()
    _describe -t commands 'nono help platform enroll commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__platform__subcmd__status_commands] )) ||
_nono__subcmd__help__subcmd__platform__subcmd__status_commands() {
    local commands; commands=()
    _describe -t commands 'nono help platform status commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__platform__subcmd__unenroll_commands] )) ||
_nono__subcmd__help__subcmd__platform__subcmd__unenroll_commands() {
    local commands; commands=()
    _describe -t commands 'nono help platform unenroll commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__policy_commands] )) ||
_nono__subcmd__help__subcmd__policy_commands() {
    local commands; commands=(
'groups:\[deprecated\] Use '\''nono profile groups'\'' instead' \
'profiles:\[deprecated\] Use '\''nono profile list'\'' instead' \
'show:\[deprecated\] Use '\''nono profile show'\'' instead' \
'diff:\[deprecated\] Use '\''nono profile diff'\'' instead' \
'validate:\[deprecated\] Use '\''nono profile validate'\'' instead' \
    )
    _describe -t commands 'nono help policy commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__policy__subcmd__diff_commands] )) ||
_nono__subcmd__help__subcmd__policy__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'nono help policy diff commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__policy__subcmd__groups_commands] )) ||
_nono__subcmd__help__subcmd__policy__subcmd__groups_commands() {
    local commands; commands=()
    _describe -t commands 'nono help policy groups commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__policy__subcmd__profiles_commands] )) ||
_nono__subcmd__help__subcmd__policy__subcmd__profiles_commands() {
    local commands; commands=()
    _describe -t commands 'nono help policy profiles commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__policy__subcmd__show_commands] )) ||
_nono__subcmd__help__subcmd__policy__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono help policy show commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__policy__subcmd__validate_commands] )) ||
_nono__subcmd__help__subcmd__policy__subcmd__validate_commands() {
    local commands; commands=()
    _describe -t commands 'nono help policy validate commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile_commands] )) ||
_nono__subcmd__help__subcmd__profile_commands() {
    local commands; commands=(
'init:Generate a skeleton profile JSON file' \
'list:List all available profiles (built-in and user)' \
'show:Show a fully resolved profile' \
'diff:Diff two profiles' \
'validate:Validate a profile JSON file' \
'promote:Review and apply a profile draft from ~/.config/nono/profile-drafts' \
'groups:List policy groups or show details for a specific group' \
'schema:Output the JSON Schema for profile files' \
'guide:Print the profile authoring guide' \
    )
    _describe -t commands 'nono help profile commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__diff_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile diff commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__groups_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__groups_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile groups commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__guide_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__guide_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile guide commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__init_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile init commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__list_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile list commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__promote_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__promote_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile promote commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__schema_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__schema_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile schema commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__show_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile show commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__profile__subcmd__validate_commands] )) ||
_nono__subcmd__help__subcmd__profile__subcmd__validate_commands() {
    local commands; commands=()
    _describe -t commands 'nono help profile validate commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__proxy_commands] )) ||
_nono__subcmd__help__subcmd__proxy_commands() {
    local commands; commands=()
    _describe -t commands 'nono help proxy commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__prune_commands] )) ||
_nono__subcmd__help__subcmd__prune_commands() {
    local commands; commands=()
    _describe -t commands 'nono help prune commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__ps_commands] )) ||
_nono__subcmd__help__subcmd__ps_commands() {
    local commands; commands=()
    _describe -t commands 'nono help ps commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__pull_commands] )) ||
_nono__subcmd__help__subcmd__pull_commands() {
    local commands; commands=()
    _describe -t commands 'nono help pull commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__remove_commands] )) ||
_nono__subcmd__help__subcmd__remove_commands() {
    local commands; commands=()
    _describe -t commands 'nono help remove commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__rollback_commands] )) ||
_nono__subcmd__help__subcmd__rollback_commands() {
    local commands; commands=(
'list:List rollback sessions' \
'show:Show changes in a session' \
'restore:Restore files from a past session' \
'verify:Verify session integrity' \
'cleanup:Clean up old sessions' \
    )
    _describe -t commands 'nono help rollback commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__rollback__subcmd__cleanup_commands] )) ||
_nono__subcmd__help__subcmd__rollback__subcmd__cleanup_commands() {
    local commands; commands=()
    _describe -t commands 'nono help rollback cleanup commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__rollback__subcmd__list_commands] )) ||
_nono__subcmd__help__subcmd__rollback__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono help rollback list commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__rollback__subcmd__restore_commands] )) ||
_nono__subcmd__help__subcmd__rollback__subcmd__restore_commands() {
    local commands; commands=()
    _describe -t commands 'nono help rollback restore commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__rollback__subcmd__show_commands] )) ||
_nono__subcmd__help__subcmd__rollback__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono help rollback show commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__rollback__subcmd__verify_commands] )) ||
_nono__subcmd__help__subcmd__rollback__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'nono help rollback verify commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__run_commands] )) ||
_nono__subcmd__help__subcmd__run_commands() {
    local commands; commands=()
    _describe -t commands 'nono help run commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__search_commands] )) ||
_nono__subcmd__help__subcmd__search_commands() {
    local commands; commands=()
    _describe -t commands 'nono help search commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__session_commands] )) ||
_nono__subcmd__help__subcmd__session_commands() {
    local commands; commands=(
'cleanup:Remove old runtime sessions' \
    )
    _describe -t commands 'nono help session commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__session__subcmd__cleanup_commands] )) ||
_nono__subcmd__help__subcmd__session__subcmd__cleanup_commands() {
    local commands; commands=()
    _describe -t commands 'nono help session cleanup commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__setup_commands] )) ||
_nono__subcmd__help__subcmd__setup_commands() {
    local commands; commands=()
    _describe -t commands 'nono help setup commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__shell_commands] )) ||
_nono__subcmd__help__subcmd__shell_commands() {
    local commands; commands=()
    _describe -t commands 'nono help shell commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__stop_commands] )) ||
_nono__subcmd__help__subcmd__stop_commands() {
    local commands; commands=()
    _describe -t commands 'nono help stop commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust_commands] )) ||
_nono__subcmd__help__subcmd__trust_commands() {
    local commands; commands=(
'init:Create a trust-policy.json in the current directory' \
'sign:Sign a file, producing a .bundle alongside it' \
'sign-policy:Sign a trust policy file, producing a .bundle alongside it' \
'verify:Verify a file'\''s bundle against the trust policy' \
'list:List files and their verification status' \
'keygen:Generate a new ECDSA P-256 signing key pair' \
'export-key:Export the public key for a signing key (base64 DER)' \
    )
    _describe -t commands 'nono help trust commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust__subcmd__export-key_commands] )) ||
_nono__subcmd__help__subcmd__trust__subcmd__export-key_commands() {
    local commands; commands=()
    _describe -t commands 'nono help trust export-key commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust__subcmd__init_commands] )) ||
_nono__subcmd__help__subcmd__trust__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'nono help trust init commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust__subcmd__keygen_commands] )) ||
_nono__subcmd__help__subcmd__trust__subcmd__keygen_commands() {
    local commands; commands=()
    _describe -t commands 'nono help trust keygen commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust__subcmd__list_commands] )) ||
_nono__subcmd__help__subcmd__trust__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono help trust list commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust__subcmd__sign_commands] )) ||
_nono__subcmd__help__subcmd__trust__subcmd__sign_commands() {
    local commands; commands=()
    _describe -t commands 'nono help trust sign commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust__subcmd__sign-policy_commands] )) ||
_nono__subcmd__help__subcmd__trust__subcmd__sign-policy_commands() {
    local commands; commands=()
    _describe -t commands 'nono help trust sign-policy commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__trust__subcmd__verify_commands] )) ||
_nono__subcmd__help__subcmd__trust__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'nono help trust verify commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__unpin_commands] )) ||
_nono__subcmd__help__subcmd__unpin_commands() {
    local commands; commands=()
    _describe -t commands 'nono help unpin commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__update_commands] )) ||
_nono__subcmd__help__subcmd__update_commands() {
    local commands; commands=()
    _describe -t commands 'nono help update commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__why_commands] )) ||
_nono__subcmd__help__subcmd__why_commands() {
    local commands; commands=()
    _describe -t commands 'nono help why commands' commands "$@"
}
(( $+functions[_nono__subcmd__help__subcmd__wrap_commands] )) ||
_nono__subcmd__help__subcmd__wrap_commands() {
    local commands; commands=()
    _describe -t commands 'nono help wrap commands' commands "$@"
}
(( $+functions[_nono__subcmd__inspect_commands] )) ||
_nono__subcmd__inspect_commands() {
    local commands; commands=()
    _describe -t commands 'nono inspect commands' commands "$@"
}
(( $+functions[_nono__subcmd__list_commands] )) ||
_nono__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono list commands' commands "$@"
}
(( $+functions[_nono__subcmd__logs_commands] )) ||
_nono__subcmd__logs_commands() {
    local commands; commands=()
    _describe -t commands 'nono logs commands' commands "$@"
}
(( $+functions[_nono__subcmd__open-url-helper_commands] )) ||
_nono__subcmd__open-url-helper_commands() {
    local commands; commands=()
    _describe -t commands 'nono open-url-helper commands' commands "$@"
}
(( $+functions[_nono__subcmd__outdated_commands] )) ||
_nono__subcmd__outdated_commands() {
    local commands; commands=()
    _describe -t commands 'nono outdated commands' commands "$@"
}
(( $+functions[_nono__subcmd__pack-update-hint-helper_commands] )) ||
_nono__subcmd__pack-update-hint-helper_commands() {
    local commands; commands=()
    _describe -t commands 'nono pack-update-hint-helper commands' commands "$@"
}
(( $+functions[_nono__subcmd__pin_commands] )) ||
_nono__subcmd__pin_commands() {
    local commands; commands=()
    _describe -t commands 'nono pin commands' commands "$@"
}
(( $+functions[_nono__subcmd__platform_commands] )) ||
_nono__subcmd__platform_commands() {
    local commands; commands=(
'enroll:Exchange a one-time token for an audit-only enrolled identity' \
'status:Show the locally enrolled platform identity' \
'unenroll:Remove the local platform enrollment' \
    )
    _describe -t commands 'nono platform commands' commands "$@"
}
(( $+functions[_nono__subcmd__platform__subcmd__enroll_commands] )) ||
_nono__subcmd__platform__subcmd__enroll_commands() {
    local commands; commands=()
    _describe -t commands 'nono platform enroll commands' commands "$@"
}
(( $+functions[_nono__subcmd__platform__subcmd__status_commands] )) ||
_nono__subcmd__platform__subcmd__status_commands() {
    local commands; commands=()
    _describe -t commands 'nono platform status commands' commands "$@"
}
(( $+functions[_nono__subcmd__platform__subcmd__unenroll_commands] )) ||
_nono__subcmd__platform__subcmd__unenroll_commands() {
    local commands; commands=()
    _describe -t commands 'nono platform unenroll commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy_commands] )) ||
_nono__subcmd__policy_commands() {
    local commands; commands=(
'groups:\[deprecated\] Use '\''nono profile groups'\'' instead' \
'profiles:\[deprecated\] Use '\''nono profile list'\'' instead' \
'show:\[deprecated\] Use '\''nono profile show'\'' instead' \
'diff:\[deprecated\] Use '\''nono profile diff'\'' instead' \
'validate:\[deprecated\] Use '\''nono profile validate'\'' instead' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono policy commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__diff_commands] )) ||
_nono__subcmd__policy__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy diff commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__groups_commands] )) ||
_nono__subcmd__policy__subcmd__groups_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy groups commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__help_commands] )) ||
_nono__subcmd__policy__subcmd__help_commands() {
    local commands; commands=(
'groups:\[deprecated\] Use '\''nono profile groups'\'' instead' \
'profiles:\[deprecated\] Use '\''nono profile list'\'' instead' \
'show:\[deprecated\] Use '\''nono profile show'\'' instead' \
'diff:\[deprecated\] Use '\''nono profile diff'\'' instead' \
'validate:\[deprecated\] Use '\''nono profile validate'\'' instead' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono policy help commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__help__subcmd__diff_commands] )) ||
_nono__subcmd__policy__subcmd__help__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy help diff commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__help__subcmd__groups_commands] )) ||
_nono__subcmd__policy__subcmd__help__subcmd__groups_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy help groups commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__help__subcmd__help_commands] )) ||
_nono__subcmd__policy__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy help help commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__help__subcmd__profiles_commands] )) ||
_nono__subcmd__policy__subcmd__help__subcmd__profiles_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy help profiles commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__help__subcmd__show_commands] )) ||
_nono__subcmd__policy__subcmd__help__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy help show commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__help__subcmd__validate_commands] )) ||
_nono__subcmd__policy__subcmd__help__subcmd__validate_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy help validate commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__profiles_commands] )) ||
_nono__subcmd__policy__subcmd__profiles_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy profiles commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__show_commands] )) ||
_nono__subcmd__policy__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy show commands' commands "$@"
}
(( $+functions[_nono__subcmd__policy__subcmd__validate_commands] )) ||
_nono__subcmd__policy__subcmd__validate_commands() {
    local commands; commands=()
    _describe -t commands 'nono policy validate commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile_commands] )) ||
_nono__subcmd__profile_commands() {
    local commands; commands=(
'init:Generate a skeleton profile JSON file' \
'list:List all available profiles (built-in and user)' \
'show:Show a fully resolved profile' \
'diff:Diff two profiles' \
'validate:Validate a profile JSON file' \
'promote:Review and apply a profile draft from ~/.config/nono/profile-drafts' \
'groups:List policy groups or show details for a specific group' \
'schema:Output the JSON Schema for profile files' \
'guide:Print the profile authoring guide' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono profile commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__diff_commands] )) ||
_nono__subcmd__profile__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile diff commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__groups_commands] )) ||
_nono__subcmd__profile__subcmd__groups_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile groups commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__guide_commands] )) ||
_nono__subcmd__profile__subcmd__guide_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile guide commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help_commands] )) ||
_nono__subcmd__profile__subcmd__help_commands() {
    local commands; commands=(
'init:Generate a skeleton profile JSON file' \
'list:List all available profiles (built-in and user)' \
'show:Show a fully resolved profile' \
'diff:Diff two profiles' \
'validate:Validate a profile JSON file' \
'promote:Review and apply a profile draft from ~/.config/nono/profile-drafts' \
'groups:List policy groups or show details for a specific group' \
'schema:Output the JSON Schema for profile files' \
'guide:Print the profile authoring guide' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono profile help commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__diff_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help diff commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__groups_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__groups_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help groups commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__guide_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__guide_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help guide commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__help_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help help commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__init_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help init commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__list_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help list commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__promote_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__promote_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help promote commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__schema_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__schema_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help schema commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__show_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help show commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__help__subcmd__validate_commands] )) ||
_nono__subcmd__profile__subcmd__help__subcmd__validate_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile help validate commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__init_commands] )) ||
_nono__subcmd__profile__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile init commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__list_commands] )) ||
_nono__subcmd__profile__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile list commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__promote_commands] )) ||
_nono__subcmd__profile__subcmd__promote_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile promote commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__schema_commands] )) ||
_nono__subcmd__profile__subcmd__schema_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile schema commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__show_commands] )) ||
_nono__subcmd__profile__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile show commands' commands "$@"
}
(( $+functions[_nono__subcmd__profile__subcmd__validate_commands] )) ||
_nono__subcmd__profile__subcmd__validate_commands() {
    local commands; commands=()
    _describe -t commands 'nono profile validate commands' commands "$@"
}
(( $+functions[_nono__subcmd__proxy_commands] )) ||
_nono__subcmd__proxy_commands() {
    local commands; commands=()
    _describe -t commands 'nono proxy commands' commands "$@"
}
(( $+functions[_nono__subcmd__prune_commands] )) ||
_nono__subcmd__prune_commands() {
    local commands; commands=()
    _describe -t commands 'nono prune commands' commands "$@"
}
(( $+functions[_nono__subcmd__ps_commands] )) ||
_nono__subcmd__ps_commands() {
    local commands; commands=()
    _describe -t commands 'nono ps commands' commands "$@"
}
(( $+functions[_nono__subcmd__pull_commands] )) ||
_nono__subcmd__pull_commands() {
    local commands; commands=()
    _describe -t commands 'nono pull commands' commands "$@"
}
(( $+functions[_nono__subcmd__remove_commands] )) ||
_nono__subcmd__remove_commands() {
    local commands; commands=()
    _describe -t commands 'nono remove commands' commands "$@"
}
(( $+functions[_nono__subcmd__rollback_commands] )) ||
_nono__subcmd__rollback_commands() {
    local commands; commands=(
'list:List rollback sessions' \
'show:Show changes in a session' \
'restore:Restore files from a past session' \
'verify:Verify session integrity' \
'cleanup:Clean up old sessions' \
    )
    _describe -t commands 'nono rollback commands' commands "$@"
}
(( $+functions[_nono__subcmd__rollback__subcmd__cleanup_commands] )) ||
_nono__subcmd__rollback__subcmd__cleanup_commands() {
    local commands; commands=()
    _describe -t commands 'nono rollback cleanup commands' commands "$@"
}
(( $+functions[_nono__subcmd__rollback__subcmd__list_commands] )) ||
_nono__subcmd__rollback__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono rollback list commands' commands "$@"
}
(( $+functions[_nono__subcmd__rollback__subcmd__restore_commands] )) ||
_nono__subcmd__rollback__subcmd__restore_commands() {
    local commands; commands=()
    _describe -t commands 'nono rollback restore commands' commands "$@"
}
(( $+functions[_nono__subcmd__rollback__subcmd__show_commands] )) ||
_nono__subcmd__rollback__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'nono rollback show commands' commands "$@"
}
(( $+functions[_nono__subcmd__rollback__subcmd__verify_commands] )) ||
_nono__subcmd__rollback__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'nono rollback verify commands' commands "$@"
}
(( $+functions[_nono__subcmd__run_commands] )) ||
_nono__subcmd__run_commands() {
    local commands; commands=()
    _describe -t commands 'nono run commands' commands "$@"
}
(( $+functions[_nono__subcmd__search_commands] )) ||
_nono__subcmd__search_commands() {
    local commands; commands=()
    _describe -t commands 'nono search commands' commands "$@"
}
(( $+functions[_nono__subcmd__session_commands] )) ||
_nono__subcmd__session_commands() {
    local commands; commands=(
'cleanup:Remove old runtime sessions' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono session commands' commands "$@"
}
(( $+functions[_nono__subcmd__session__subcmd__cleanup_commands] )) ||
_nono__subcmd__session__subcmd__cleanup_commands() {
    local commands; commands=()
    _describe -t commands 'nono session cleanup commands' commands "$@"
}
(( $+functions[_nono__subcmd__session__subcmd__help_commands] )) ||
_nono__subcmd__session__subcmd__help_commands() {
    local commands; commands=(
'cleanup:Remove old runtime sessions' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'nono session help commands' commands "$@"
}
(( $+functions[_nono__subcmd__session__subcmd__help__subcmd__cleanup_commands] )) ||
_nono__subcmd__session__subcmd__help__subcmd__cleanup_commands() {
    local commands; commands=()
    _describe -t commands 'nono session help cleanup commands' commands "$@"
}
(( $+functions[_nono__subcmd__session__subcmd__help__subcmd__help_commands] )) ||
_nono__subcmd__session__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'nono session help help commands' commands "$@"
}
(( $+functions[_nono__subcmd__setup_commands] )) ||
_nono__subcmd__setup_commands() {
    local commands; commands=()
    _describe -t commands 'nono setup commands' commands "$@"
}
(( $+functions[_nono__subcmd__shell_commands] )) ||
_nono__subcmd__shell_commands() {
    local commands; commands=()
    _describe -t commands 'nono shell commands' commands "$@"
}
(( $+functions[_nono__subcmd__stop_commands] )) ||
_nono__subcmd__stop_commands() {
    local commands; commands=()
    _describe -t commands 'nono stop commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust_commands] )) ||
_nono__subcmd__trust_commands() {
    local commands; commands=(
'init:Create a trust-policy.json in the current directory' \
'sign:Sign a file, producing a .bundle alongside it' \
'sign-policy:Sign a trust policy file, producing a .bundle alongside it' \
'verify:Verify a file'\''s bundle against the trust policy' \
'list:List files and their verification status' \
'keygen:Generate a new ECDSA P-256 signing key pair' \
'export-key:Export the public key for a signing key (base64 DER)' \
    )
    _describe -t commands 'nono trust commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust__subcmd__export-key_commands] )) ||
_nono__subcmd__trust__subcmd__export-key_commands() {
    local commands; commands=()
    _describe -t commands 'nono trust export-key commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust__subcmd__init_commands] )) ||
_nono__subcmd__trust__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'nono trust init commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust__subcmd__keygen_commands] )) ||
_nono__subcmd__trust__subcmd__keygen_commands() {
    local commands; commands=()
    _describe -t commands 'nono trust keygen commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust__subcmd__list_commands] )) ||
_nono__subcmd__trust__subcmd__list_commands() {
    local commands; commands=()
    _describe -t commands 'nono trust list commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust__subcmd__sign_commands] )) ||
_nono__subcmd__trust__subcmd__sign_commands() {
    local commands; commands=()
    _describe -t commands 'nono trust sign commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust__subcmd__sign-policy_commands] )) ||
_nono__subcmd__trust__subcmd__sign-policy_commands() {
    local commands; commands=()
    _describe -t commands 'nono trust sign-policy commands' commands "$@"
}
(( $+functions[_nono__subcmd__trust__subcmd__verify_commands] )) ||
_nono__subcmd__trust__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'nono trust verify commands' commands "$@"
}
(( $+functions[_nono__subcmd__unpin_commands] )) ||
_nono__subcmd__unpin_commands() {
    local commands; commands=()
    _describe -t commands 'nono unpin commands' commands "$@"
}
(( $+functions[_nono__subcmd__update_commands] )) ||
_nono__subcmd__update_commands() {
    local commands; commands=()
    _describe -t commands 'nono update commands' commands "$@"
}
(( $+functions[_nono__subcmd__why_commands] )) ||
_nono__subcmd__why_commands() {
    local commands; commands=()
    _describe -t commands 'nono why commands' commands "$@"
}
(( $+functions[_nono__subcmd__wrap_commands] )) ||
_nono__subcmd__wrap_commands() {
    local commands; commands=()
    _describe -t commands 'nono wrap commands' commands "$@"
}

if [ "$funcstack[1]" = "_nono" ]; then
    _nono "$@"
else
    compdef _nono nono
fi
