External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add proxy_install_only config to restrict proxy to download commands

Browse Source 
Introduces proxy_install_only (default: false) which, when enabled,
skips the proxy for package manager commands that do not download
packages (e.g. npm ls, pip list), avoiding unnecessary MITM overhead.

- Add ProxyInstallOnly to Config and config template
- Add IsKnownDownloadCommand / MayDownloadPackages to ParsedCommand
- Add DownloadCommands to npm and pypi PM configs covering update,
  ci, audit, dlx, exec, x, download, run and equivalents per PM
- Extract shared runner.Execute used by both proxy flow and guard
- Proxy flow short-circuits to runner.Execute for non-download commands
  when proxy_install_only=true
This commit is contained in:
Sahilb315
2026-04-13 20:15:50 +05:30
parent 887984612c
commit da098a51a8
11 changed files with 387 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/config.template.yml
+6
View File
@@ -36,6 +36,12 @@ event_log_retention_days: 7
# and can be disabled to fall back to the guard-based analysis.
proxy_mode: true
# Restrict proxy to install commands only. Default is false.
# When false, the proxy intercepts all package manager commands (e.g., npm install, npm ls).
# When true, non-install commands bypass the proxy and execute directly, which can improve
# performance for commands that don't download packages (e.g., npm ls, pip list, npm outdated).
proxy_install_only: false
# Trusted packages are packages that are trusted by the user and will be ignored by the security guardrails.
# This is useful for packages that are known to be safe and are used in the application.
# Example: