feat: Sandbox implementation with seatbelt

config/cobra.go

@@ -21,4 +21,8 @@ func ApplyCobraFlags(cmd *cobra.Command) {
 		globalConfig.Config.SkipEventLogging, "Skip event logging")
 	cmd.PersistentFlags().BoolVar(&globalConfig.Config.ExperimentalProxyMode, "experimental-proxy-mode",
 		globalConfig.Config.ExperimentalProxyMode, "Use experimental proxy-based interception (EXPERIMENTAL)")
+	cmd.PersistentFlags().BoolVar(&globalConfig.Config.Sandbox.Enabled, "sandbox",
+		globalConfig.Config.Sandbox.Enabled, "Enable sandbox mode to isolate package manager processes (EXPERIMENTAL)")
+	cmd.PersistentFlags().StringVar(&globalConfig.Config.Sandbox.ViolationMode, "sandbox-violation-mode",
+		globalConfig.Config.Sandbox.ViolationMode, "How to handle sandbox policy violations: block, warn, or allow")
 }

config/config.go

@@ -59,6 +59,33 @@ type Config struct {
 	// ExperimentalProxyMode enables experimental proxy-based package interception.
 	// When enabled, PMG starts a proxy server and intercepts package manager requests in real-time.
 	ExperimentalProxyMode bool `mapstructure:"experimental_proxy_mode"`
+
+	// Sandbox enables sandboxing of package manager processes with controlled filesystem,
+	// network, and process execution access. Provides defense-in-depth against supply chain attacks.
+	Sandbox SandboxConfig `mapstructure:"sandbox"`
+}
+
+// SandboxConfig configures the sandbox system for isolating package manager processes.
+type SandboxConfig struct {
+	// Enabled enables sandbox mode (opt-in by default for backward compatibility).
+	Enabled bool `mapstructure:"enabled"`
+
+	// ViolationMode defines how policy violations are handled (block, warn, or allow).
+	ViolationMode string `mapstructure:"violation_mode"`
+
+	// Policies maps package manager names to their sandbox policy references.
+	// Key is package manager name (e.g., "npm", "pip"), value is policy reference.
+	Policies map[string]SandboxPolicyRef `mapstructure:"policies"`
+}
+
+// SandboxPolicyRef references a sandbox policy for a specific package manager.
+type SandboxPolicyRef struct {
+	// Enabled enables sandboxing for this specific package manager.
+	Enabled bool `mapstructure:"enabled"`
+
+	// Profile is the name of a built-in profile (e.g., "npm-restrictive")
+	// or an absolute path to a custom YAML policy file.
+	Profile string `mapstructure:"profile"`
 }
 
 // TrustedPackage is a package that is trusted by the user and will be ignored by the security guardrails.

config/config.template.yml

@@ -46,3 +46,70 @@ experimental_proxy_mode: false
 trusted_packages:
   - purl: pkg:npm/@safedep/pmg
     reason: "PMG is a trusted package for PMG"
+
+# Sandbox configuration (EXPERIMENTAL)
+# When enabled, package managers run in sandboxed environments with restricted
+# filesystem, network, and process execution access. This provides defense-in-depth
+# protection against malicious install scripts and supply chain attacks.
+#
+# Currently supported platforms:
+# - macOS (using Seatbelt sandbox-exec)
+# - Linux (coming soon: Bubblewrap or seccomp-bpf)
+# - Windows (coming soon)
+sandbox:
+  # Enable sandbox mode (opt-in, default: false for backward compatibility)
+  enabled: false
+
+  # How to handle policy violations: block | warn | allow
+  # - block: Prevent execution on policy violation (recommended)
+  # - warn: Log warning but allow execution
+  # - allow: Allow all operations (disables sandbox)
+  violation_mode: block
+
+  # Per-package-manager sandbox policies
+  # Each package manager can have its own policy to account for unique security characteristics
+  policies:
+    # npm ecosystem
+    npm:
+      enabled: true
+      profile: npm-restrictive  # Built-in profile or path to custom YAML
+
+    pnpm:
+      enabled: true
+      profile: npm-restrictive
+
+    yarn:
+      enabled: true
+      profile: npm-restrictive
+
+    bun:
+      enabled: true
+      profile: npm-restrictive
+
+    # PyPI ecosystem
+    pip:
+      enabled: true
+      profile: pypi-restrictive
+
+    pip3:
+      enabled: true
+      profile: pypi-restrictive
+
+    poetry:
+      enabled: true
+      profile: pypi-restrictive
+
+    uv:
+      enabled: true
+      profile: pypi-restrictive
+
+# Usage:
+# 1. Enable sandbox globally: set sandbox.enabled to true
+# 2. Enable via CLI flag: pmg --sandbox npm install lodash
+# 3. Use custom profile: pmg --sandbox-profile=/path/to/policy.yml npm install
+#
+# Built-in profiles:
+# - npm-restrictive: Balanced security for npm/pnpm/yarn/bun
+# - pypi-restrictive: Balanced security for pip/poetry/uv
+#
+# See sandbox/profiles/ directory for profile definitions