pmg/sandbox/profiles/README.md

# PMG Sandbox Profiles

This directory contains built-in sandbox policies for PMG package managers.

## Available Profiles

### npm-restrictive

Restrictive policy for the npm ecosystem (npm, pnpm, yarn, bun).

### pypi-restrictive

Restrictive policy for the PyPI ecosystem (pip, pip3, pipx, poetry, uv, uvx).

### go

Policy for the Go module ecosystem (go). Standalone profile: Go has a single
package manager, so there is no shared base to inherit from.

## Custom Policies

You can create custom sandbox policies by:

1. Copying one of the built-in profiles
2. Modifying the rules to suit your needs
3. Referencing the custom profile in your PMG config:

```yaml
sandbox:
  enabled: true
  policies:
    npm:
      enabled: true
      profile: /path/to/custom-npm-policy.yml
```

## Policy Schema

See the [Policy Schema Documentation](../policy.go) for details on the YAML structure.

### Supported Variables

- `${HOME}`: User home directory
- `${CWD}`: Current working directory
- `${TMPDIR}`: Temporary directory

## Policy Enforcement

All policy violations will block execution. This provides defense-in-depth protection against malicious install scripts and supply chain attacks.