fix: Misc fixes

config/config.go

@@ -149,6 +149,9 @@ func DefaultConfig() RuntimeConfig {
 			SkipEventLogging:       false,
 			ExperimentalProxyMode:  false,
 			TrustedPackages:        []TrustedPackage{},
+			Sandbox: SandboxConfig{
+				Enabled: false,
+			},
 		},
 		DryRun:               false,
 		InsecureInstallation: insecureInstallation,

sandbox/apply.go

@@ -23,26 +23,23 @@ import (
 func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string) error {
 	cfg := config.Get()
 
-	// Check if sandbox is enabled globally
 	if !cfg.Config.Sandbox.Enabled {
-		return nil // Sandbox disabled, skip
+		return nil
 	}
 
-	// Check if sandbox policy exists for this package manager
+	// Lookup the sandbox policy for the package manager based on config
 	policyRef, exists := cfg.Config.Sandbox.Policies[pmName]
 	if !exists || !policyRef.Enabled {
 		log.Debugf("No sandbox policy enabled for %s", pmName)
 		return nil
 	}
 
-	// Load the sandbox policy
 	registry := NewProfileRegistry()
 	policy, err := registry.GetProfile(policyRef.Profile)
 	if err != nil {
 		return fmt.Errorf("failed to load sandbox policy %s: %w", policyRef.Profile, err)
 	}
 
-	// Validate that the policy applies to this package manager
 	if !policy.AppliesToPackageManager(pmName) {
 		log.Warnf("Sandbox policy %s does not apply to %s", policy.Name, pmName)
 		return nil
@@ -51,7 +48,6 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string
 	// Create platform-specific sandbox
 	sb, err := NewSandbox()
 	if err != nil {
-		// Sandbox not available on this platform - log warning and continue
 		log.Warnf("Sandbox not available on this platform: %v", err)
 		log.Warnf("Continuing without sandbox protection")
 		return nil
@@ -62,15 +58,13 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, mode string
 		return nil
 	}
 
-	// Build log message with optional mode suffix
 	logMsg := fmt.Sprintf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
 	if mode != "" {
 		logMsg += fmt.Sprintf(" (%s)", mode)
 	}
-	log.Infof(logMsg)
 
-	// Execute sandbox setup (modifies cmd in place)
+	log.Infof("%s", logMsg)
-	// Note: The sandbox preserves any environment variables already set on cmd.Env
+
 	if err := sb.Execute(ctx, cmd, policy); err != nil {
 		return fmt.Errorf("failed to setup sandbox: %w", err)
 	}

sandbox/policy.go

@@ -138,5 +138,6 @@ func (p *SandboxPolicy) AppliesToPackageManager(pm string) bool {
 			return true
 		}
 	}
+
 	return false
 }

sandbox/sandbox_linux.go

@@ -6,8 +6,6 @@ package sandbox
 import "errors"
 
 // newPlatformSandbox creates a platform-specific sandbox instance for Linux.
-// Currently not implemented - returns an error.
-// Future implementations will use Bubblewrap or seccomp-bpf.
 func newPlatformSandbox() (Sandbox, error) {
 	return nil, errors.New("sandbox not yet implemented for Linux (coming soon: Bubblewrap or seccomp-bpf)")
 }

sandbox/sandbox_windows.go

@@ -6,8 +6,6 @@ package sandbox
 import "errors"
 
 // newPlatformSandbox creates a platform-specific sandbox instance for Windows.
-// Currently not implemented - returns an error.
-// Future implementations will use AppContainer or Job Objects.
 func newPlatformSandbox() (Sandbox, error) {
-	return nil, errors.New("sandbox not yet implemented for Windows (coming soon: AppContainer or Job Objects)")
+	return nil, errors.New("sandbox not yet implemented for Windows")
 }