From 9f77cca5e58902be4ca86731de816f687ba10cb7 Mon Sep 17 00:00:00 2001 From: Abhisek Datta Date: Thu, 8 Jan 2026 14:20:47 +0530 Subject: [PATCH] fix: Apply API --- config/cobra.go | 2 ++ config/config.go | 5 +++++ guard/guard.go | 2 +- internal/flows/proxy_flow.go | 2 +- sandbox/executor/apply.go | 42 +++++++++++++++++++++--------------- 5 files changed, 34 insertions(+), 19 deletions(-) diff --git a/config/cobra.go b/config/cobra.go index 2a734ae..1e0b18f 100644 --- a/config/cobra.go +++ b/config/cobra.go @@ -25,4 +25,6 @@ func ApplyCobraFlags(cmd *cobra.Command) { globalConfig.Config.Sandbox.Enabled, "Enable sandbox mode to isolate package manager processes (EXPERIMENTAL)") cmd.PersistentFlags().StringVar(&globalConfig.Config.Sandbox.ViolationMode, "sandbox-violation-mode", globalConfig.Config.Sandbox.ViolationMode, "How to handle sandbox policy violations: block, warn, or allow") + cmd.PersistentFlags().StringVar(&globalConfig.SandboxProfileOverride, "sandbox-profile", + globalConfig.SandboxProfileOverride, "Override sandbox policy profile (built-in name or path to custom YAML)") } diff --git a/config/config.go b/config/config.go index 0d7b10b..70292e8 100644 --- a/config/config.go +++ b/config/config.go @@ -112,6 +112,11 @@ type RuntimeConfig struct { // InsecureInstallation allows bypassing install blocking on malicious packages InsecureInstallation bool + // SandboxProfileOverride is a runtime override for the sandbox policy profile. + // When set, this profile path is used instead of the configured policy for all package managers. + // This is a CLI-only flag (--sandbox-profile) and is not persisted to config.yml. + SandboxProfileOverride string + // Internal config values computed at runtime and must be accessed via. API configDir string configFilePath string diff --git a/guard/guard.go b/guard/guard.go index 6765583..03c0179 100644 --- a/guard/guard.go +++ b/guard/guard.go @@ -223,7 +223,7 @@ func (g *packageManagerGuard) continueExecution(ctx context.Context, pc *package // Apply sandbox if enabled pmName := g.packageManager.Name() - result, err := executor.ApplySandbox(ctx, cmd, pmName, "") + result, err := executor.ApplySandbox(ctx, cmd, pmName) if err != nil { return fmt.Errorf("failed to apply sandbox: %w", err) } diff --git a/internal/flows/proxy_flow.go b/internal/flows/proxy_flow.go index 5903a8e..d80abe0 100644 --- a/internal/flows/proxy_flow.go +++ b/internal/flows/proxy_flow.go @@ -244,7 +244,7 @@ func (f *proxyFlow) executeWithProxy(ctx context.Context, parsedCmd *packagemana // Apply sandbox if enabled (sandbox preserves proxy environment variables already set on cmd.Env) pmName := f.pm.Name() - result, err := executor.ApplySandbox(ctx, cmd, pmName, "proxy mode") + result, err := executor.ApplySandbox(ctx, cmd, pmName) if err != nil { return fmt.Errorf("failed to apply sandbox: %w", err) } diff --git a/sandbox/executor/apply.go b/sandbox/executor/apply.go index ed8f813..57c1e0b 100644 --- a/sandbox/executor/apply.go +++ b/sandbox/executor/apply.go @@ -26,26 +26,39 @@ import ( // // If sandbox is not enabled/available, returns a result indicating the caller should run the command. // Gracefully degrades with warnings if sandbox is unavailable on the platform. -func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string) (*sandbox.ExecutionResult, error) { +func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.ExecutionResult, error) { cfg := config.Get() if !cfg.Config.Sandbox.Enabled { return sandbox.NewExecutionResult(false), nil } - // Lookup the sandbox policy for the package manager based on config - policyRef, exists := cfg.Config.Sandbox.Policies[pmName] - if !exists || !policyRef.Enabled { - log.Debugf("No sandbox policy enabled for %s", pmName) - return sandbox.NewExecutionResult(false), nil - } - registry := sandbox.NewProfileRegistry() - policy, err := registry.GetProfile(policyRef.Profile) - if err != nil { - return nil, fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err) + var policy *sandbox.SandboxPolicy + var err error + + // Check for runtime profile override first (--sandbox-profile flag) + if cfg.SandboxProfileOverride != "" { + log.Debugf("Using sandbox profile override: %s", cfg.SandboxProfileOverride) + policy, err = registry.GetProfile(cfg.SandboxProfileOverride) + if err != nil { + return nil, fmt.Errorf("failed to load override sandbox policy %s: %w", cfg.SandboxProfileOverride, err) + } + } else { + // Use configured per-package-manager policy + policyRef, exists := cfg.Config.Sandbox.Policies[pmName] + if !exists || !policyRef.Enabled { + log.Debugf("No sandbox policy enabled for %s", pmName) + return sandbox.NewExecutionResult(false), nil + } + + policy, err = registry.GetProfile(policyRef.Profile) + if err != nil { + return nil, fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err) + } } + // Validate that the loaded policy applies to this package manager if !policy.AppliesToPackageManager(pmName) { log.Warnf("Sandbox policy %s does not apply to %s", policy.Name, pmName) return sandbox.NewExecutionResult(false), nil @@ -64,12 +77,7 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string return sandbox.NewExecutionResult(false), nil } - logMsg := fmt.Sprintf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name) - if mode != "" { - logMsg += fmt.Sprintf(" (%s)", mode) - } - - log.Infof("%s", logMsg) + log.Debugf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name) result, err := sb.Execute(ctx, cmd, policy) if err != nil {