introduce a persistent config

config/config.go

@@ -3,6 +3,9 @@ package config
 import (
 	"context"
 	"fmt"
+
+	"github.com/safedep/pmg/internal/ui"
+	"github.com/spf13/viper"
 )
 
 type configKey struct{}
@@ -23,6 +26,42 @@ type Config struct {
 
 	// InsecureInstallation allows bypassing install blocking on malicious packages
 	InsecureInstallation bool
+
+	// TrustedPackages allows for trusting an suspicious package and ignoring the suspicious behaviour for the package in future installations
+	TrustedPackages []string
+}
+
+func CreateConfig() error {
+	dir, err := PmgConfigDir()
+	if err != nil {
+		return err
+	}
+
+	viper.SetConfigName(pmgConfigName)
+	viper.SetConfigType(pmgConfigType)
+	viper.AddConfigPath(dir)
+
+	cfgFile, err := ConfigFilePath()
+	if err != nil {
+		return err
+	}
+
+	viper.Set("transitive", true)
+	viper.Set("transitive_depth", 5)
+	viper.Set("include_dev_dependencies", false)
+	viper.Set("dry_run", false)
+	viper.Set("paranoid", false)
+	viper.Set("trusted_packages", []string{})
+
+	if err := viper.SafeWriteConfigAs(cfgFile); err != nil {
+		if _, ok := err.(viper.ConfigFileAlreadyExistsError); ok {
+			fmt.Println("Config file already exists, skipping safe write.")
+		} else {
+			ui.Fatalf("Error writing config file: %v", err)
+		}
+	}
+
+	return nil
 }
 
 // Inject config into context while protecting against context poisoning

config/paths.go

@@ -0,0 +1,72 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// This file centralizes all path-related helpers for the config package.
+// It standardizes where PMG stores configuration and related artifacts,
+// so other packages (e.g., internal/alias) can rely on a single source of truth.
+
+const (
+	pmgConfigName = "config"
+	pmgConfigType = "yml"
+	pmgConfigPath = "safedep/pmg"
+)
+
+// defaultRcFileName is the default name for the shell RC file that contains PMG aliases.
+const defaultRcFileName = ".pmg.rc"
+
+// PmgConfigDir returns the base application config directory.
+// By default, this is:
+// - macOS:   ~/Library/Application Support/safedep/pmg
+// - Linux:   ~/.config/safedep/pmg
+// - Windows: %AppData%\safedep\pmg
+func PmgConfigDir() (string, error) {
+	userConfigDir, err := os.UserConfigDir()
+	if err != nil {
+		return "", fmt.Errorf("failed to retrieve user config directory: %w", err)
+	}
+
+	return filepath.Join(userConfigDir, pmgConfigPath), nil
+}
+
+// CreatePmgConfigDir ensures the application config directory exists and returns its path.
+func CreatePmgConfigDir() (string, error) {
+	dir, err := PmgConfigDir()
+	if err != nil {
+		return "", err
+	}
+
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return "", fmt.Errorf("failed to create config directory %s: %w", dir, err)
+	}
+	return dir, nil
+}
+
+// ConfigFilePath returns the absolute path to the main PMG config file (e.g., config.yml),
+// without creating any directories.
+func ConfigFilePath() (string, error) {
+	dir, err := PmgConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, fmt.Sprintf("%s.%s", pmgConfigName, pmgConfigType)), nil
+}
+
+// RcFileName returns the default RC file name used for PMG aliases.
+func RcFileName() string {
+	return defaultRcFileName
+}
+
+// RcFilePath returns the absolute path to the PMG RC file under the app config directory,
+// without creating any directories.
+func RcFilePath() (string, error) {
+	dir, err := PmgConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, defaultRcFileName), nil
+}