feat: Add Support for Proxy Based Npm Interceptor (#87)

* feat: Add experimental proxy based npm interceptor

* refactor: Analysis cache

* ci: Add E2E for npm proxy

* fix: Handle dry-run in proxy flow

* fix: Handle special case for scope package name

* fix: Misc fixes

* fix: Code review fixes

* fix: Code review fixes

* refactor: Reusable code into base registry interceptor

* Pause npm process during user confirmation (#90)

* pause npm process when prompting user for confirmation

* disable progress bar

* fix logging and close chan on return

* update use of deprecated field

* refactor: Separation of concerns for handling process state

* fix: Safe permission for cert file

* fix: Handle nil check for interaction hook

* fix: Add test for base registry

* Fix goreleaser for windows build (#93)

* introduce platform specific process control

* rename common.go to common_flow.go

* feat: Add support for pause resume on windows

* fix: Code review fixes

* test: Add confirmation handler tests

---------

Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>

config/cobra.go

@@ -19,4 +19,6 @@ func ApplyCobraFlags(cmd *cobra.Command) {
 		globalConfig.Config.Paranoid, "Perform active scanning of unknown packages (slow)")
 	cmd.PersistentFlags().BoolVar(&globalConfig.Config.SkipEventLogging, "skip-event-log",
 		globalConfig.Config.SkipEventLogging, "Skip event logging")
+	cmd.PersistentFlags().BoolVar(&globalConfig.Config.ExperimentalProxyMode, "experimental-proxy-mode",
+		globalConfig.Config.ExperimentalProxyMode, "Use experimental proxy-based interception (EXPERIMENTAL)")
 }

config/config.go

@@ -52,6 +52,10 @@ type Config struct {
 
 	// EventLogRetentionDays is the number of days to retain event logs.
 	EventLogRetentionDays int `mapstructure:"event_log_retention_days"`
+
+	// ExperimentalProxyMode enables experimental proxy-based package interception.
+	// When enabled, PMG starts a proxy server and intercepts package manager requests in real-time.
+	ExperimentalProxyMode bool `mapstructure:"experimental_proxy_mode"`
 }
 
 // TrustedPackage is a package that is trusted by the user and will be ignored by the security guardrails.
@@ -106,6 +110,7 @@ func DefaultConfig() RuntimeConfig {
 			Paranoid:               false,
 			EventLogRetentionDays:  7,
 			SkipEventLogging:       false,
+			ExperimentalProxyMode:  false,
 			TrustedPackages:        []TrustedPackage{},
 		},
 		DryRun:               false,

config/config.template.yml

@@ -23,6 +23,13 @@ skip_event_logging: false
 # This is the number of days to retain event logs.
 event_log_retention_days: 7
 
+# Experimental proxy mode. Default is false.
+# When enabled, PMG uses an experimental proxy-based interception approach instead of the
+# default guard-based analysis. The proxy intercepts package manager requests in real-time
+# and analyzes packages as they are downloaded. This is an experimental feature and may not
+# work in all environments.
+experimental_proxy_mode: false
+
 # Trusted packages are packages that are trusted by the user and will be ignored by the security guardrails.
 # This is useful for packages that are known to be safe and are used in the application.
 # Example: