fix: Apply API

config/cobra.go

@@ -25,4 +25,6 @@ func ApplyCobraFlags(cmd *cobra.Command) {
 		globalConfig.Config.Sandbox.Enabled, "Enable sandbox mode to isolate package manager processes (EXPERIMENTAL)")
 	cmd.PersistentFlags().StringVar(&globalConfig.Config.Sandbox.ViolationMode, "sandbox-violation-mode",
 		globalConfig.Config.Sandbox.ViolationMode, "How to handle sandbox policy violations: block, warn, or allow")
+	cmd.PersistentFlags().StringVar(&globalConfig.SandboxProfileOverride, "sandbox-profile",
+		globalConfig.SandboxProfileOverride, "Override sandbox policy profile (built-in name or path to custom YAML)")
 }

config/config.go

@@ -112,6 +112,11 @@ type RuntimeConfig struct {
 	// InsecureInstallation allows bypassing install blocking on malicious packages
 	InsecureInstallation bool
 
+	// SandboxProfileOverride is a runtime override for the sandbox policy profile.
+	// When set, this profile path is used instead of the configured policy for all package managers.
+	// This is a CLI-only flag (--sandbox-profile) and is not persisted to config.yml.
+	SandboxProfileOverride string
+
 	// Internal config values computed at runtime and must be accessed via. API
 	configDir      string
 	configFilePath string

guard/guard.go

@@ -223,7 +223,7 @@ func (g *packageManagerGuard) continueExecution(ctx context.Context, pc *package
 
 	// Apply sandbox if enabled
 	pmName := g.packageManager.Name()
-	result, err := executor.ApplySandbox(ctx, cmd, pmName, "")
+	result, err := executor.ApplySandbox(ctx, cmd, pmName)
 	if err != nil {
 		return fmt.Errorf("failed to apply sandbox: %w", err)
 	}

internal/flows/proxy_flow.go

@@ -244,7 +244,7 @@ func (f *proxyFlow) executeWithProxy(ctx context.Context, parsedCmd *packagemana
 
 	// Apply sandbox if enabled (sandbox preserves proxy environment variables already set on cmd.Env)
 	pmName := f.pm.Name()
-	result, err := executor.ApplySandbox(ctx, cmd, pmName, "proxy mode")
+	result, err := executor.ApplySandbox(ctx, cmd, pmName)
 	if err != nil {
 		return fmt.Errorf("failed to apply sandbox: %w", err)
 	}

sandbox/executor/apply.go

@@ -26,26 +26,39 @@ import (
 //
 // If sandbox is not enabled/available, returns a result indicating the caller should run the command.
 // Gracefully degrades with warnings if sandbox is unavailable on the platform.
-func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string) (*sandbox.ExecutionResult, error) {
+func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.ExecutionResult, error) {
 	cfg := config.Get()
 
 	if !cfg.Config.Sandbox.Enabled {
 		return sandbox.NewExecutionResult(false), nil
 	}
 
-	// Lookup the sandbox policy for the package manager based on config
-	policyRef, exists := cfg.Config.Sandbox.Policies[pmName]
-	if !exists || !policyRef.Enabled {
-		log.Debugf("No sandbox policy enabled for %s", pmName)
-		return sandbox.NewExecutionResult(false), nil
-	}
-
 	registry := sandbox.NewProfileRegistry()
-	policy, err := registry.GetProfile(policyRef.Profile)
-	if err != nil {
-		return nil, fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err)
+	var policy *sandbox.SandboxPolicy
+	var err error
+
+	// Check for runtime profile override first (--sandbox-profile flag)
+	if cfg.SandboxProfileOverride != "" {
+		log.Debugf("Using sandbox profile override: %s", cfg.SandboxProfileOverride)
+		policy, err = registry.GetProfile(cfg.SandboxProfileOverride)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load override sandbox policy %s: %w", cfg.SandboxProfileOverride, err)
+		}
+	} else {
+		// Use configured per-package-manager policy
+		policyRef, exists := cfg.Config.Sandbox.Policies[pmName]
+		if !exists || !policyRef.Enabled {
+			log.Debugf("No sandbox policy enabled for %s", pmName)
+			return sandbox.NewExecutionResult(false), nil
+		}
+
+		policy, err = registry.GetProfile(policyRef.Profile)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err)
+		}
 	}
 
+	// Validate that the loaded policy applies to this package manager
 	if !policy.AppliesToPackageManager(pmName) {
 		log.Warnf("Sandbox policy %s does not apply to %s", policy.Name, pmName)
 		return sandbox.NewExecutionResult(false), nil
@@ -64,12 +77,7 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string
 		return sandbox.NewExecutionResult(false), nil
 	}
 
-	logMsg := fmt.Sprintf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
-	if mode != "" {
-		logMsg += fmt.Sprintf(" (%s)", mode)
-	}
-
-	log.Infof("%s", logMsg)
+	log.Debugf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
 
 	result, err := sb.Execute(ctx, cmd, policy)
 	if err != nil {