feat: Sandbox implementation with seatbelt

sandbox/profiles/README.md

@@ -0,0 +1,65 @@
+# PMG Sandbox Profiles
+
+This directory contains built-in sandbox policies for PMG package managers.
+
+## Available Profiles
+
+### npm-restrictive
+
+Restrictive policy for the npm ecosystem (npm, pnpm, yarn, bun).
+
+**Features:**
+- Allows read access to current directory, package manager configs, and caches
+- Restricts write access to `node_modules/` and lockfiles only
+- Blocks access to sensitive files (`~/.ssh`, `~/.aws`, `.env` files)
+- Allows network access to npm registries only
+- Permits Node.js and git execution, blocks shell and curl/wget
+
+**Use when:** You want balanced protection for npm package installations
+
+### pypi-restrictive
+
+Restrictive policy for the PyPI ecosystem (pip, pip3, poetry, uv).
+
+**Features:**
+- Allows read access to current directory, pip configs, and caches
+- Restricts write access to virtual environments and package caches
+- Blocks access to sensitive files (`~/.ssh`, `~/.aws`, `.env` files)
+- Allows network access to PyPI registries only
+- Permits Python, compilers (for native extensions), and git
+
+**Use when:** You want balanced protection for pip package installations
+
+## Custom Policies
+
+You can create custom sandbox policies by:
+
+1. Copying one of the built-in profiles
+2. Modifying the rules to suit your needs
+3. Referencing the custom profile in your PMG config:
+
+```yaml
+sandbox:
+  enabled: true
+  policies:
+    npm:
+      enabled: true
+      profile: /path/to/custom-npm-policy.yml
+```
+
+## Policy Schema
+
+See the [Policy Schema Documentation](../policy.go) for details on the YAML structure.
+
+### Supported Variables
+
+- `${HOME}`: User home directory
+- `${CWD}`: Current working directory
+- `${PM_CACHE}`: Package manager cache directory
+- `${TMPDIR}`: Temporary directory
+
+### Violation Modes
+
+- `block`: Block execution on policy violation (recommended)
+- `warn`: Log warning but allow execution
+- `allow`: Allow all operations (disables sandbox)

sandbox/profiles/npm-restrictive.yml

@@ -0,0 +1,73 @@
+name: npm-restrictive
+description: Restrictive sandbox policy for npm ecosystem (npm, pnpm, yarn, bun)
+package_managers:
+  - npm
+  - pnpm
+  - yarn
+  - bun
+
+violation_mode: block
+
+filesystem:
+  allow_read:
+    - ${CWD}/**
+    - ${HOME}/.npmrc
+    - ${HOME}/.yarnrc
+    - ${HOME}/.yarnrc.yml
+    - ${HOME}/.bundle
+    - ${PM_CACHE}/**
+    - /usr/local/**
+    - /Library/**
+    - /System/Library/**
+    - /private/var/**
+
+  allow_write:
+    - ${CWD}/node_modules/**
+    - ${PM_CACHE}/**
+    - ${CWD}/package-lock.json
+    - ${CWD}/yarn.lock
+    - ${CWD}/pnpm-lock.yaml
+    - ${CWD}/bun.lockb
+    - ${TMPDIR}/**
+
+  deny_read:
+    - ${HOME}/.ssh/**
+    - ${HOME}/.aws/**
+    - ${HOME}/.gcloud/**
+    - ${HOME}/.kube/**
+    - "**/.env"
+    - "**/.env.*"
+    - ${HOME}/.docker/config.json
+
+  deny_write:
+    - ${HOME}/.ssh/**
+    - ${HOME}/.aws/**
+    - /etc/**
+    - /usr/**
+    - /bin/**
+    - /sbin/**
+
+network:
+  allow_outbound:
+    - registry.npmjs.org:443
+    - registry.yarnpkg.com:443
+    - npm.pkg.github.com:443
+    - github.com:443
+
+  deny_outbound:
+    - "*:*"
+
+process:
+  allow_exec:
+    - /usr/bin/node
+    - /usr/local/bin/node
+    - ${PM_CACHE}/**
+    - /usr/bin/git
+    - /usr/local/bin/git
+
+  deny_exec:
+    - /usr/bin/curl
+    - /usr/bin/wget
+    - /bin/bash
+    - /bin/sh
+    - /usr/bin/python*

sandbox/profiles/pypi-restrictive.yml

@@ -0,0 +1,60 @@
+name: pypi-restrictive
+description: Restrictive sandbox policy for PyPI ecosystem (pip, poetry, uv)
+package_managers:
+  - pip
+  - pip3
+  - poetry
+  - uv
+
+violation_mode: block
+
+filesystem:
+  allow_read:
+    - ${CWD}/**
+    - ${HOME}/.config/pip/**
+    - ${HOME}/.pip/**
+    - ${HOME}/.poetry/**
+    - ${PM_CACHE}/**
+    - /usr/local/**
+    - /Library/**
+    - /System/Library/**
+
+  allow_write:
+    - ${CWD}/.venv/**
+    - ${CWD}/venv/**
+    - ${PM_CACHE}/**
+    - ${HOME}/.local/lib/python*/**
+    - ${TMPDIR}/**
+
+  deny_read:
+    - ${HOME}/.ssh/**
+    - ${HOME}/.aws/**
+    - ${HOME}/.gcloud/**
+    - "**/.env"
+
+  deny_write:
+    - ${HOME}/.ssh/**
+    - /etc/**
+    - /usr/**
+
+network:
+  allow_outbound:
+    - pypi.org:443
+    - files.pythonhosted.org:443
+    - github.com:443
+
+  deny_outbound:
+    - "*:*"
+
+process:
+  allow_exec:
+    - /usr/bin/python*
+    - /usr/local/bin/python*
+    - /usr/bin/gcc
+    - /usr/bin/clang
+    - /usr/bin/git
+
+  deny_exec:
+    - /usr/bin/curl
+    - /usr/bin/wget
+    - /bin/bash