fix: flatten proxy skip_commands schema and move docs to proxy-mode.md (#241)

- Replace nested policies map with flat skip_commands map in ProxyConfig
- Make skip_commands dependent on install_only being enabled
- Move proxy configuration docs from proxy.md to proxy-mode.md
- Update config template and tests for new schema

config/config.go

@@ -91,14 +91,10 @@ type CloudConfig struct {
 	EndpointID string `mapstructure:"endpoint_id"`
 }
 
-type ProxyPolicy struct {
-	SkipCommands []string `mapstructure:"skip_commands"`
-}
-
 type ProxyConfig struct {
-	Enabled     bool                   `mapstructure:"enabled"`
-	InstallOnly bool                   `mapstructure:"install_only"`
-	Policies    map[string]ProxyPolicy `mapstructure:"policies"`
+	Enabled      bool                `mapstructure:"enabled"`
+	InstallOnly  bool                `mapstructure:"install_only"`
+	SkipCommands map[string][]string `mapstructure:"skip_commands"`
 }
 
 // SandboxConfig configures the sandbox system for isolating package manager processes.
@@ -268,7 +264,7 @@ func DefaultConfig() RuntimeConfig {
 			Proxy: ProxyConfig{
 				Enabled:     true,
 				InstallOnly: false,
-				Policies:    map[string]ProxyPolicy{},
+				SkipCommands: map[string][]string{},
 			},
 		},
 		DryRun:               false,

config/config.template.yml

@@ -44,15 +44,12 @@ proxy:
   # (e.g., npm ls, pip list) bypass the proxy and execute directly.
   install_only: false
 
-  # Per-package-manager proxy policies.
-  # Additional commands to bypass the proxy.
+  # Per-package-manager commands to skip proxying (only applies when install_only is true).
   # Example:
-  #   policies:
-  #     pip:
-  #       skip_commands: ["list", "show"]
-  policies:
-    npm:
-      skip_commands: []
+  #   skip_commands:
+  #     pip: ["list", "show"]
+  skip_commands:
+    npm: []
 
 # Trusted packages are packages that are trusted by the user and will be ignored by the security guardrails.
 # This is useful for packages that are known to be safe and are used in the application.

config/config_test.go

@@ -325,7 +325,7 @@ func TestProxyConfigSection(t *testing.T) {
 		cfg := Get()
 		assert.Equal(t, true, cfg.Config.Proxy.Enabled)
 		assert.Equal(t, false, cfg.Config.Proxy.InstallOnly)
-		assert.NotNil(t, cfg.Config.Proxy.Policies)
+		assert.NotNil(t, cfg.Config.Proxy.SkipCommands)
 	})
 
 	t.Run("reads proxy section from config file", func(t *testing.T) {
@@ -335,9 +335,8 @@ func TestProxyConfigSection(t *testing.T) {
 		configYAML := `proxy:
   enabled: true
   install_only: true
-  policies:
-    npm:
-      skip_commands: ["my-script", "dev"]
+  skip_commands:
+    npm: ["my-script", "dev"]
 `
 		configPath := filepath.Join(tmpDir, "config.yml")
 		err := os.WriteFile(configPath, []byte(configYAML), 0o644)
@@ -348,7 +347,7 @@ func TestProxyConfigSection(t *testing.T) {
 
 		assert.Equal(t, true, cfg.Config.Proxy.Enabled)
 		assert.Equal(t, true, cfg.Config.Proxy.InstallOnly)
-		assert.Equal(t, []string{"my-script", "dev"}, cfg.Config.Proxy.Policies["npm"].SkipCommands)
+		assert.Equal(t, []string{"my-script", "dev"}, cfg.Config.Proxy.SkipCommands["npm"])
 	})
 
 	t.Run("falls back to legacy keys from config file", func(t *testing.T) {