Merge branch 'main' into feat/experimental-sandbox-support

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

docs/proxy-mode.md

@@ -0,0 +1,36 @@
+# Proxy Mode
+
+PMG supports an experimental proxy based interception as an alternative to the current optimistic dependency resolution. When enabled via `--experimental-proxy-mode` flag:
+
+- PMG starts a micro-proxy server on a random localhost port
+- Runs `npm` and other supported package managers configured to use the proxy
+- Intercepts package registry requests and analyzes packages as they are downloaded
+- Blocks malicious packages and allows trusted packages to be installed
+
+## Usage
+
+```bash
+pmg --experimental-proxy-mode npm install lodash
+```
+
+## Configuration
+
+To permanently enable proxy mode, add the following to your `config.yml` file:
+
+```yaml
+experimental_proxy_mode: true
+```
+
+## Supported Package Managers
+
+| Package Manager | Status    |
+| --------------- | --------- |
+| `npm`           | ✅ Active  |
+| `npx`           | ✅ Active |
+| `pnpm`          | ✅ Active |
+| `pnpx`          | ✅ Active |
+| `bun`           | ✅ Active |
+| `yarn`          | ✅ Active |
+| `pip`           | 🕒 Planned |
+| `uv`            | 🕒 Planned |
+| `poetry`        | 🕒 Planned |

docs/trusted-packages.md

@@ -0,0 +1,18 @@
+# Trusted Packages
+
+`pmg` allows you to trust a package. Trusted packages are not scanned and always allowed to be installed.
+
+## Configuration
+
+Trusted packages are configured in the `config.yml` file. See [config template](../config/config.template.yml) for the configuration schema.
+If you don't have a `config.yml` file, you can create one by running `pmg setup install`.
+
+### Example
+
+```yaml
+trusted_packages:
+  - purl: pkg:npm/@safedep/pmg
+    reason: "All versions of PMG are trusted"
+  - purl: pkg:npm/express@4.18.0
+    reason: "Version 4.18.0 of Express is a trusted package"
+```