601ba315c2
ci: Add GHA for issue triage ( #171 )
...
* ci: Add GHA for issue triage
* Update .github/workflows/issue-triage.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* Update .github/workflows/issue-triage.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-20 07:12:39 +00:00
Abhisek Datta and GitHub
91aa4547c4
feat: Show sandbox info in PMG setup info command ( #170 )
2026-02-20 11:59:29 +05:30
a81a4918c0
add support to merge system CA with PMG CA ( #169 )
...
* add support to merge system CA with PMG CA
* Keep CA cert immutable; merge system bundle only when writing proxy CA file
* Update proxy/certmanager/generator.go
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update internal/flows/proxy_flow.go
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* update config field name
* Use integer-only guard when sizing merged CA bundle
* Use int64-only guard when sizing merged CA bundle
* add tests for firstReadablePath
* Update proxy/certmanager/generator.go
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* fix linter
* refactor system CA merge API
* add max limit to 2MB for certificates
* update max limit to 2MB for certificate merging
* remove python specific env var for CAs
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
2026-02-20 11:40:26 +05:30
Sahil Bansal and GitHub
b0305cb54d
Add concurrency cancel and ignore docs/markdown changes across CI workflows ( #168 )
...
* Add concurrency cancel and ignore docs/markdown changes across CI workflows
* Clarify PR-only concurrency (no push queuing)
2026-02-16 21:33:27 +05:30
442a974aaa
Fix npm global flag usage ( #166 )
...
* fix global flag usage
* add comment
* Update packagemanager/npm_test.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update packagemanager/npm_test.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-16 16:55:23 +05:30
Abhisek Datta and GitHub
6074080219
feat: Add support for sandbox allow override ( #165 )
...
* feat: Add support for sandbox allow override
* fix: Main should fail on arg processing error
* fix: Remove redundant policy conflict check
2026-02-16 13:58:08 +05:30
d3cb15a3ea
docs: Update README ( #163 )
...
* docs: Update README
* docs: Misc fixes
* Update README.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* Update README.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-16 13:35:58 +05:30
Sahil Bansal and GitHub
ec6cdf5f78
verify upstream certs & reject unverified ( #158 )
...
* verify upstream certs & reject unverified
* update transport to only harden TLS & rm (http.Transport).Clone
2026-02-12 20:47:05 +05:30
Sahil Bansal and GitHub
5b0517f92a
add event type & logging interceptor for unknown hosts ( #157 )
...
* add event type & logging interceptor for unknown hosts
* update logging
* add break
* rename host_observation interceptor to audit_logger
* restore MITMDecider and make AuditLogger telemetry skip MITM on CONNECT
2026-02-12 13:48:01 +05:30
Sahil Bansal and GitHub
7fe9fc8763
provide package blocked feedback in proxy mode ( #154 )
...
* provide package blocked feedback in proxy mode
* update test case & clear status on block
* refactor reporting
* clearStatus on `continueExecution`
* set spinnerChan to nil
* add sync for spinner
2026-02-11 09:22:18 +05:30
Sahil Bansal and GitHub
a6cb60a757
Treat suspicious as malicious in paranoid mode ( #156 )
...
* paranoid mode blocks suspicious packages
* enable sandbox for paranoid flag
* rm sandbox enabling for paranoid mode
* update docs
2026-02-10 22:22:40 +05:30
41e3b9b22e
Deprecate malysis active scanner ( #155 )
...
* deprecate malysis active scanner
* Update config/config.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* copilot fixes
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-10 20:38:55 +05:30
Sahil Bansal and GitHub
b161d34f9e
fix proxy stuck on blocking malicious package ( #153 )
...
* fix proxy stuck on blocking malicious package
* update pmg e2e
2026-02-06 22:41:56 +05:30
Sahil Bansal and GitHub
f1891271c1
Add proxy support for pypi package managers ( #150 )
...
* initial pypi registry implementation
* support proxy mode for pypi package managers
* support proxy mode for pypi package managers - 2
* rm default mode as proxy for pip3
* update goproxy version & fix pypi proxy failing on 304
* add PIP_RETRIES=0 env
* update pmg e2e & add proxy mode e2e for pypi
* rm safedep-test-pkg for pypi proxy e2e
2026-02-05 13:30:27 +05:30
Abhisek Datta and GitHub
3778d4d1f3
fix: Sandbox Allow network bind for npx ( #151 )
...
* feat: Add support for network bind
* chore: Add comments for bwrap sandbox
2026-02-04 15:32:47 +05:30
Sahil Bansal and GitHub
f90fa0e6a5
Generalise Proxy Mode Registry Config ( #149 )
...
* refactor: generalise registry config
* add test cases & add defensive check for domain match
* fix linter
2026-02-03 07:47:07 +00:00
28c7b6c843
Make proxy mode default for npm based managers ( #148 )
...
* update npm pkg managers to use proxy mode as default
* update config template for default to true for proxy_mode
* update e2e for proxy mode
* update info cmd for correct proxy mode status
* Update config/config.template.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update config/config.template.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update config/config.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-02 14:30:00 +05:30
Abhisek Datta and GitHub
b5696f989f
chore: Proxy mode without experimental tag ( #147 )
...
* chore: Proxy mode without experimental tag
* fix: Update proxy mode docs
* fix: Code review fixes
2026-02-02 12:58:28 +05:30
4600ab0245
fix: Sandbox policy tuning for tmp write access ( #145 )
...
* fix: Sandbox policy tuning for tmp write access
* fix: Remove numbers from test
* Update sandbox/profiles/pnpm-restrictive.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Sandbox E2E test to consider Linux bubblewrap tmpfs mount
* Update sandbox/profiles/pnpm-restrictive.yml
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Migrate deny rules from pnpm to npm policy
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-02-01 15:20:17 +05:30
Sahil Bansal and GitHub
b332e1d6d4
update setup install cmd info ( #143 )
...
* update setup install cmd info
* update demo
* add doc comment
2026-01-27 21:24:08 +05:30
Abhisek Datta and GitHub
be63fdd6ea
fix: Remove Emoji from Setup ( #142 )
...
* fix: Remove emoji from setup
* fix: Update README demo
2026-01-27 20:08:23 +05:30
Sahil Bansal and GitHub
224658e6d2
Update PMG banner ( #138 )
...
* update pmg banner
* rm width
* trial: rm lines
* trial: add line above demo
* trial: add thin line above demo
* trial: add thin line above demo
* trial: add thin line below demo
* trial: rm lines
* trial: add br
* trial: replace images with badges
* trial: replace h1 with h3
* trial: increase pmg height
* revert back to h1
* trial: change theme for demo
* trial: use lighter bg for demo
* trial: use lighter bg for demo
* trial: use lighter bg for demo & rm extra div
* revert demo back to original
* add private package limitation in non-proxy mode
* update demos
2026-01-27 19:39:36 +05:30
Abhisek Datta and GitHub
36ac3e3384
feat: Add post-exec reporting support ( #134 )
...
* feat: Add post install reporting support
* fix: UI report handling
* fix: Duplicate reporting
* fix: Show warning on insecure bypass
* fix: Proxy event log insecure skip installation
* fix: Proxy event log insecure skip installation
* fix: Common definition for infer outcome
2026-01-27 17:50:26 +05:30
Sahil Bansal and GitHub
0aa82033a5
fix proxy mode failing for GH private packages ( #137 )
...
* fix proxy mode failing for GH private packages
* skip analysis for private packages for proxy mode
* introduce npmRegistryConfig and support for handling multiple parsers in future
* refactor name and unexport npm config functions
* rm unused function
* rename & unexport npmRegistryURLParser
* add e2e for malicious pkg blocked using proxy mode
2026-01-23 18:38:54 +05:30
aa5c528a9d
docs: Update README ( #133 )
...
* docs: Update README
* docs: Update README
* docs: Update README
* docs: Update README
* docs: Update README
* Apply suggestion from @Sahilb315
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-01-21 20:29:15 +05:30
Sahil Bansal and GitHub
736c63a7b6
Sandbox fails for unsupported cmds ( #129 )
...
* introduce enforce_always sandbox config & hooks for flows
* fix sandbox failing for unsupported commands
* add hooks for pypi package managers
* add tests for sandbox hook
* introduce enforce_always flag for ease use & CI
* make comments descriptive
* remove hooks & update config to add API to configure sandbox
* add comments
* rm unused function
2026-01-19 22:24:59 +05:30
Sahil Bansal and GitHub
cc2dd993ed
update module path to safedep/ptyx ( #130 )
2026-01-19 14:33:37 +05:30
ff4a4a4734
update pmg banner & fix empty commit ( #127 )
...
* update pmg banner & fix empty commit
* rm old banner
* precompile regex for version
* fix: Color in github URL (#128 )
---------
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
2026-01-18 19:46:23 +05:30
edfdd543e0
chore: README update demo and Error Fix ( #126 )
...
* docs: Update README with demo gif
* fix: Proxy remove dependency on interaction
* fix: Update demo gif width
* Update docs/demo/pmg-intro.tape
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: PMG demo
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-18 16:00:37 +05:30
Abhisek Datta and GitHub
6a3821d44a
chore: Improve console error experience ( #124 )
...
* chore: Improve console error experience
* fix: Use standard error code and handle verbosity
2026-01-17 14:05:01 +05:30
Abhisek Datta and GitHub
80a1747e3e
feat: Add support for Linux Sandbox using Bubblewrap ( #120 )
...
* feat: Add support for bubblewrap sandbox
* fix: Glob pattern expansion limit for linux
* fix: Bug in glob pattern expansion for bwrap
* fix: README on trust
* fix: Multiple bubblewrap translator fix
* test: Add E2E for linux sandbox
* fix: Refactor bwrap sandbox to use common dangerous files
* fix: Path test case
* fix: Non-existent path handling bug
* refactor: Misc cleanup
* fix: Avoid bind mount for non-existentent deny protection
* fix: Off by one bug in path depth handling
* ci: Disable AppArmor on GHA runner
* fix: Disable apparmor userns restrictions
2026-01-15 20:12:12 +05:30
b97a4c2ee5
docs: Add trust doc ( #118 )
...
* docs: Add trust doc
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-14 15:02:08 +05:30
Sahil Bansal and GitHub
f1b7e3f403
fix download artifact path ( #117 )
2026-01-14 06:43:08 +00:00
Abhisek Datta and GitHub
cf12914ab3
ci: Add support for build provenance ( #116 )
...
* ci: Add support for build provenance
* fix: Fix provenance job
2026-01-14 11:45:54 +05:30
2e1f5b1a36
feat: Add support for policy inheritence ( #113 )
...
* feat: Add support for policy inheritence
* fix: Linter fixes
* Update docs/sandbox.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Handle boolean inheritence
* ci: Add linter
* Update sandbox/policy_test.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Linter fixes
* fix: Linter fixes
* fix: Sandbox rule regex format
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-14 10:50:39 +05:30
9693428171
feat: Experimental Sandbox Support ( #101 )
...
* feat: Sandbox implementation with seatbelt
* refactor: Remove concept of PM_CACHE
* fix: Misc fixes
* refactor: Sandbox for separation of boundaries
* fix: Apply API
* fix: Add support for sandbox cleanup
* test: Add variable interpolation test
* fix: Misc cleanup fixes
* chore: Cleanup sandbox registry
* chore: Cleanup sandbox policy
* chore: Cleanup sandbox
* fix: Misc cleanup fixes
* fix: Remove violation mode
* fix: Update config template
* chore: Go mod cleanup
* fix: Handle the case when package manager policy is explicitly disabled
* fix: Sandbox executor
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* test: Remove unused var
* test: Add test for seatbelt sandbox driver
* fix: Sandbox profile loader from file should use path for caching
* test: Add policy test
* feat: Add support for config templates
* fix: Seatbelt translator handle glob
* fix: Merge conflicts
* fix: Fix sandbox policy generator for MacOS min permissions
* fix: Sandbox path handling bugs
* fix: Deny read to dangerous directories
* fix: Deny read to dangerous directories
* add sandbox e2e (#112 )
* fix: Sandbox E2E test
* fix: Code review fixes
* fix: Code review fixes
* doc: Add sandbox debugging guide
* doc: Update sandbox doc
* docs: Add sandbox usage doc
* fix: Use better error for sandbox without policy
* fix: Add sandbox for npx
* fix: Enable PTY for npm
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-01-13 14:52:02 +05:30
Abhisek Datta and GitHub
c0122898ca
feat: Add support for setup-info command ( #108 )
...
* feat: Add support for setup-info command
* fix: Code review fixes
* fix: Add event log info
2026-01-11 19:25:13 +05:30
Sahil Bansal and GitHub
11481c3f4c
remove windows proxy limitation ( #107 )
...
* remove windows proxy limitation
* move setup cmd details to a single place
2026-01-11 10:05:19 +05:30
f851a1ebba
remove process control code to pause/resume process ( #106 )
...
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
2026-01-10 11:21:24 +00:00
f50d296935
add e2e and alias for npx, pnpx ( #105 )
...
* add e2e and alias for npx, pnpx
* Update .github/workflows/pmg-e2e.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-10 16:47:43 +05:30
Sahil Bansal and GitHub
ca224f523c
enable support for proxy mode for npm package managers ( #104 )
...
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-01-10 00:24:45 +05:30
31f23fd065
Add support for package executors and support for PTY handling ( #100 )
...
* define contract for package executors
* introduce npx executor
* add npx and pnpx cmd support
* fix typo
* rm PackageExecutor and depend on PackageManager interface
* add support for PTY to handle parent-child process interaction
* refactor PTY handling in proxy flow
* enforce interactiveSession interface check
* close reader explicitly and clean npm version for pkg executors
* rm interaction from interceptors
* add docs and wait for outputRouter before exit
* add support for non interactive TTY for proxy mode
* add support for CI env var check for non interactive tty proxy mode
* update readme to include npx, pnpx support
* Update internal/flows/proxy_flow.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* update ptyx lib
* fix docs typo
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-09 22:03:42 +05:30
Abhisek Datta and GitHub
a373b5b243
docs: Add doc for trusted packages and proxy mode ( #102 )
2026-01-09 13:56:48 +00:00
Sahil Bansal and GitHub
6e830c4c3d
update node to use v24 ( #99 )
2026-01-08 06:48:57 +05:30
Abhisek Datta and GitHub
1684e25cc9
fix: Use separate event for trusted package allowed ( #98 )
2026-01-08 01:03:31 +05:30
Abhisek Datta and GitHub
0603df8c25
docs: Update README ( #97 )
...
* docs: Update README
* docs: Update README
2026-01-07 18:54:18 +00:00
Abhisek Datta and GitHub
1c319eba0e
fix: Proxy flow should respect trusted packages ( #96 )
...
* fix: Handle trusted packages in proxy flow
* perf: Pre-parse trusted PURLs
* fix: Code review fixes
* fix: Remove unused config
2026-01-08 00:15:02 +05:30
Sahil Bansal and GitHub
028e78aed8
rm npm progress bar flag ( #95 )
2026-01-07 17:17:00 +05:30
Sahil Bansal and GitHub
4fb147b0fb
add unit tests for validating config template ( #94 )
...
* add unit tests for validating config template
* add defensive check
* update asserts
2026-01-07 07:59:32 +00:00
779deeb23d
feat: Add Support for Proxy Based Npm Interceptor ( #87 )
...
* feat: Add experimental proxy based npm interceptor
* refactor: Analysis cache
* ci: Add E2E for npm proxy
* fix: Handle dry-run in proxy flow
* fix: Handle special case for scope package name
* fix: Misc fixes
* fix: Code review fixes
* fix: Code review fixes
* refactor: Reusable code into base registry interceptor
* Pause npm process during user confirmation (#90 )
* pause npm process when prompting user for confirmation
* disable progress bar
* fix logging and close chan on return
* update use of deprecated field
* refactor: Separation of concerns for handling process state
* fix: Safe permission for cert file
* fix: Handle nil check for interaction hook
* fix: Add test for base registry
* Fix goreleaser for windows build (#93 )
* introduce platform specific process control
* rename common.go to common_flow.go
* feat: Add support for pause resume on windows
* fix: Code review fixes
* test: Add confirmation handler tests
---------
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-01-07 13:22:08 +05:30
