refactor: Remove concept of PM_CACHE

sandbox/apply.go

@@ -15,7 +15,7 @@ import (
 // Parameters:
 //   - ctx: Context for the sandbox execution
 //   - cmd: The exec.Cmd to be sandboxed (will be modified in place)
-//   - pmName: Package manager name (e.g., "npm", "pip")
+//   - pmName: Package manager name (e.g., "npm", "pip") used to determine the sandbox policy to apply
 //   - mode: Optional mode description for logging (e.g., "proxy mode", empty for default)
 //
 // Returns an error if sandbox setup fails, or nil if sandbox is not enabled/available.

sandbox/profiles/npm-restrictive.yml

@@ -15,7 +15,12 @@ filesystem:
     - ${HOME}/.yarnrc
     - ${HOME}/.yarnrc.yml
     - ${HOME}/.bundle
-    - ${PM_CACHE}/**
+    - ${HOME}/.npm/**
+    - ${HOME}/.pnpm-store/**
+    - ${HOME}/.cache/pnpm/**
+    - ${HOME}/.cache/yarn/**
+    - ${HOME}/.yarn/cache/**
+    - ${HOME}/.bun/install/cache/**
     - /usr/local/**
     - /Library/**
     - /System/Library/**
@@ -23,7 +28,12 @@ filesystem:
 
   allow_write:
     - ${CWD}/node_modules/**
-    - ${PM_CACHE}/**
+    - ${HOME}/.npm/**
+    - ${HOME}/.pnpm-store/**
+    - ${HOME}/.cache/pnpm/**
+    - ${HOME}/.cache/yarn/**
+    - ${HOME}/.yarn/cache/**
+    - ${HOME}/.bun/install/cache/**
     - ${CWD}/package-lock.json
     - ${CWD}/yarn.lock
     - ${CWD}/pnpm-lock.yaml
@@ -61,7 +71,12 @@ process:
   allow_exec:
     - /usr/bin/node
     - /usr/local/bin/node
-    - ${PM_CACHE}/**
+    - ${HOME}/.npm/**
+    - ${HOME}/.pnpm-store/**
+    - ${HOME}/.cache/pnpm/**
+    - ${HOME}/.cache/yarn/**
+    - ${HOME}/.yarn/cache/**
+    - ${HOME}/.bun/install/cache/**
     - /usr/bin/git
     - /usr/local/bin/git
 

sandbox/profiles/pypi-restrictive.yml

@@ -14,7 +14,10 @@ filesystem:
     - ${HOME}/.config/pip/**
     - ${HOME}/.pip/**
     - ${HOME}/.poetry/**
-    - ${PM_CACHE}/**
+    - ${HOME}/.cache/pip/**
+    - ${HOME}/.cache/pypoetry/**
+    - ${HOME}/.cache/poetry/**
+    - ${HOME}/.cache/uv/**
     - /usr/local/**
     - /Library/**
     - /System/Library/**
@@ -22,7 +25,10 @@ filesystem:
   allow_write:
     - ${CWD}/.venv/**
     - ${CWD}/venv/**
-    - ${PM_CACHE}/**
+    - ${HOME}/.cache/pip/**
+    - ${HOME}/.cache/pypoetry/**
+    - ${HOME}/.cache/poetry/**
+    - ${HOME}/.cache/uv/**
     - ${HOME}/.local/lib/python*/**
     - ${TMPDIR}/**