From aa2a6cc214deda0f0f24b7ae395dad8ea7b0db03 Mon Sep 17 00:00:00 2001
From: Abhisek Datta <abhisek.datta@gmail.com>
Date: Thu, 8 Jan 2026 13:50:21 +0530
Subject: [PATCH] fix: Misc fixes

---
 config/config.go           |  3 +++
 sandbox/apply.go           | 14 ++++----------
 sandbox/policy.go          |  1 +
 sandbox/sandbox_linux.go   |  2 --
 sandbox/sandbox_windows.go |  4 +---
 5 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/config/config.go b/config/config.go
index ee74dcd..0d7b10b 100644
--- a/config/config.go
+++ b/config/config.go
@@ -149,6 +149,9 @@ func DefaultConfig() RuntimeConfig {
 			SkipEventLogging:       false,
 			ExperimentalProxyMode:  false,
 			TrustedPackages:        []TrustedPackage{},
+			Sandbox: SandboxConfig{
+				Enabled: false,
+			},
 		},
 		DryRun:               false,
 		InsecureInstallation: insecureInstallation,
diff --git a/sandbox/apply.go b/sandbox/apply.go
index 980a2bb..1f76974 100644
--- a/sandbox/apply.go
+++ b/sandbox/apply.go
@@ -23,26 +23,23 @@ import (
 func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string) error {
 	cfg := config.Get()
 
-	// Check if sandbox is enabled globally
 	if !cfg.Config.Sandbox.Enabled {
-		return nil // Sandbox disabled, skip
+		return nil
 	}
 
-	// Check if sandbox policy exists for this package manager
+	// Lookup the sandbox policy for the package manager based on config
 	policyRef, exists := cfg.Config.Sandbox.Policies[pmName]
 	if !exists || !policyRef.Enabled {
 		log.Debugf("No sandbox policy enabled for %s", pmName)
 		return nil
 	}
 
-	// Load the sandbox policy
 	registry := NewProfileRegistry()
 	policy, err := registry.GetProfile(policyRef.Profile)
 	if err != nil {
 		return fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err)
 	}
 
-	// Validate that the policy applies to this package manager
 	if !policy.AppliesToPackageManager(pmName) {
 		log.Warnf("Sandbox policy %s does not apply to %s", policy.Name, pmName)
 		return nil
@@ -51,7 +48,6 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string
 	// Create platform-specific sandbox
 	sb, err := NewSandbox()
 	if err != nil {
-		// Sandbox not available on this platform - log warning and continue
 		log.Warnf("Sandbox not available on this platform: %v", err)
 		log.Warnf("Continuing without sandbox protection")
 		return nil
@@ -62,15 +58,13 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string
 		return nil
 	}
 
-	// Build log message with optional mode suffix
 	logMsg := fmt.Sprintf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
 	if mode != "" {
 		logMsg += fmt.Sprintf(" (%s)", mode)
 	}
-	log.Infof(logMsg)
 
-	// Execute sandbox setup (modifies cmd in place)
-	// Note: The sandbox preserves any environment variables already set on cmd.Env
+	log.Infof("%s", logMsg)
+
 	if err := sb.Execute(ctx, cmd, policy); err != nil {
 		return fmt.Errorf("failed to setup sandbox: %w", err)
 	}
diff --git a/sandbox/policy.go b/sandbox/policy.go
index 90a4a24..970a156 100644
--- a/sandbox/policy.go
+++ b/sandbox/policy.go
@@ -138,5 +138,6 @@ func (p *SandboxPolicy) AppliesToPackageManager(pm string) bool {
 			return true
 		}
 	}
+
 	return false
 }
diff --git a/sandbox/sandbox_linux.go b/sandbox/sandbox_linux.go
index 9f644d9..5e0b491 100644
--- a/sandbox/sandbox_linux.go
+++ b/sandbox/sandbox_linux.go
@@ -6,8 +6,6 @@ package sandbox
 import "errors"
 
 // newPlatformSandbox creates a platform-specific sandbox instance for Linux.
-// Currently not implemented - returns an error.
-// Future implementations will use Bubblewrap or seccomp-bpf.
 func newPlatformSandbox() (Sandbox, error) {
 	return nil, errors.New("sandbox not yet implemented for Linux (coming soon: Bubblewrap or seccomp-bpf)")
 }
diff --git a/sandbox/sandbox_windows.go b/sandbox/sandbox_windows.go
index 1070cb7..4ea3b78 100644
--- a/sandbox/sandbox_windows.go
+++ b/sandbox/sandbox_windows.go
@@ -6,8 +6,6 @@ package sandbox
 import "errors"
 
 // newPlatformSandbox creates a platform-specific sandbox instance for Windows.
-// Currently not implemented - returns an error.
-// Future implementations will use AppContainer or Job Objects.
 func newPlatformSandbox() (Sandbox, error) {
-	return nil, errors.New("sandbox not yet implemented for Windows (coming soon: AppContainer or Job Objects)")
+	return nil, errors.New("sandbox not yet implemented for Windows")
 }