chore: Cleanup sandbox registry

sandbox/executor/apply.go

@@ -23,9 +23,12 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.E
 		return sandbox.NewExecutionResult(), nil
 	}
 
-	registry := sandbox.NewProfileRegistry()
+	registry, err := sandbox.NewProfileRegistry()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create profile registry: %w", err)
+	}
+
 	var policy *sandbox.SandboxPolicy
-	var err error
 
 	if cfg.SandboxProfileOverride != "" {
 		log.Debugf("Using sandbox profile override: %s", cfg.SandboxProfileOverride)

sandbox/registry.go

@@ -14,26 +14,21 @@ import (
 //go:embed profiles/*.yml
 var profilesFS embed.FS
 
-// defaultProfileRegistry implements ProfileRegistry with support for
-// built-in embedded profiles and custom user-provided profiles.
 type defaultProfileRegistry struct {
 	mu       sync.RWMutex
 	profiles map[string]*SandboxPolicy
 }
 
-// newDefaultProfileRegistry creates a new profile registry and loads built-in profiles.
-func newDefaultProfileRegistry() *defaultProfileRegistry {
+func newDefaultProfileRegistry() (*defaultProfileRegistry, error) {
 	registry := &defaultProfileRegistry{
 		profiles: make(map[string]*SandboxPolicy),
 	}
 
-	// Load built-in profiles from embedded filesystem
 	if err := registry.loadBuiltinProfiles(); err != nil {
-		// Log error but don't fail - graceful degradation
-		fmt.Fprintf(os.Stderr, "Warning: failed to load built-in sandbox profiles: %v\n", err)
+		return nil, fmt.Errorf("failed to load built-in sandbox profiles: %w", err)
 	}
 
-	return registry
+	return registry, nil
 }
 
 // loadBuiltinProfiles loads all built-in YAML profiles from the embedded filesystem.
@@ -72,9 +67,7 @@ func (r *defaultProfileRegistry) loadBuiltinProfiles() error {
 }
 
 // GetProfile retrieves a policy by name.
-// First checks built-in profiles, then attempts to load as a custom file path.
 func (r *defaultProfileRegistry) GetProfile(name string) (*SandboxPolicy, error) {
-	// Check if it's a built-in profile
 	r.mu.RLock()
 	if policy, exists := r.profiles[name]; exists {
 		r.mu.RUnlock()
@@ -82,7 +75,6 @@ func (r *defaultProfileRegistry) GetProfile(name string) (*SandboxPolicy, error)
 	}
 	r.mu.RUnlock()
 
-	// Not a built-in profile - try to load as custom file
 	if fileExists(name) {
 		return r.LoadCustomProfile(name)
 	}
@@ -106,7 +98,6 @@ func (r *defaultProfileRegistry) LoadCustomProfile(path string) (*SandboxPolicy,
 		return nil, fmt.Errorf("invalid custom profile %s: %w", path, err)
 	}
 
-	// Cache the custom profile for future use
 	r.mu.Lock()
 	r.profiles[policy.Name] = policy
 	r.mu.Unlock()
@@ -127,22 +118,21 @@ func (r *defaultProfileRegistry) ListProfiles() []string {
 	return profiles
 }
 
-// parsePolicy parses a YAML policy file into a SandboxPolicy struct.
 func parsePolicy(data []byte) (*SandboxPolicy, error) {
 	var policy SandboxPolicy
 
 	if err := yaml.Unmarshal(data, &policy); err != nil {
-		return nil, fmt.Errorf("failed to parse YAML: %w", err)
+		return nil, fmt.Errorf("failed to parse policy from YAML: %w", err)
 	}
 
 	return &policy, nil
 }
 
-// fileExists checks if a file exists and is not a directory.
 func fileExists(path string) bool {
 	info, err := os.Stat(path)
 	if err != nil {
 		return false
 	}
+
 	return !info.IsDir()
 }

sandbox/registry_test.go

@@ -0,0 +1,23 @@
+package sandbox
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewDefaultProfileRegistry(t *testing.T) {
+	registry, err := newDefaultProfileRegistry()
+	assert.NoError(t, err)
+	assert.NotNil(t, registry)
+
+	assert.Greater(t, len(registry.profiles), 0)
+
+	npmRestrictive, err := registry.GetProfile("npm-restrictive")
+	assert.NoError(t, err)
+	assert.NotNil(t, npmRestrictive)
+
+	pypiRestrictive, err := registry.GetProfile("pypi-restrictive")
+	assert.NoError(t, err)
+	assert.NotNil(t, pypiRestrictive)
+}

sandbox/sandbox.go

@@ -99,6 +99,6 @@ type ProfileRegistry interface {
 }
 
 // NewProfileRegistry creates a new profile registry with built-in policies.
-func NewProfileRegistry() ProfileRegistry {
+func NewProfileRegistry() (ProfileRegistry, error) {
 	return newDefaultProfileRegistry()
 }