fix: Apply API

config/cobra.go

@@ -25,4 +25,6 @@ func ApplyCobraFlags(cmd *cobra.Command) {
 		globalConfig.Config.Sandbox.Enabled, "Enable sandbox mode to isolate package manager processes (EXPERIMENTAL)")
 	cmd.PersistentFlags().StringVar(&globalConfig.Config.Sandbox.ViolationMode, "sandbox-violation-mode",
 		globalConfig.Config.Sandbox.ViolationMode, "How to handle sandbox policy violations: block, warn, or allow")
+	cmd.PersistentFlags().StringVar(&globalConfig.SandboxProfileOverride, "sandbox-profile",
+		globalConfig.SandboxProfileOverride, "Override sandbox policy profile (built-in name or path to custom YAML)")
 }

config/config.go

@@ -112,6 +112,11 @@ type RuntimeConfig struct {
 	// InsecureInstallation allows bypassing install blocking on malicious packages
 	InsecureInstallation bool
 
+	// SandboxProfileOverride is a runtime override for the sandbox policy profile.
+	// When set, this profile path is used instead of the configured policy for all package managers.
+	// This is a CLI-only flag (--sandbox-profile) and is not persisted to config.yml.
+	SandboxProfileOverride string
+
 	// Internal config values computed at runtime and must be accessed via. API
 	configDir      string
 	configFilePath string