Abhisek Datta and GitHub
19e04b71b4
fix: Enable HTTP/2 for proxy upstream with connection tuning ( #183 )
...
* fix: Enable HTTP/2 for proxy upstream with connection tuning
* fix: Handle HTTP/2 upstream translating to HTTP/1.1 downstream
* fix: Remove go tool golangci-lint as per docs
* fix: Code review fixes
* fix: Code review fixes
2026-03-11 14:40:27 +05:30
Abhisek Datta and GitHub
e31a11e8e2
docs: Update README ( #182 )
...
* docs: Update README
* docs: Update README
2026-03-11 11:04:05 +05:30
Abhisek Datta and GitHub
2d1926388c
fix: Handle goproxy scheme handling bug ( #181 )
...
* fix: Handle goproxy scheme handling bug
* fix: Code review fixes
2026-03-10 10:35:28 +05:30
Abhisek Datta and GitHub
f8fcdf6929
chore: Rotate PH analytics public token ( #180 )
2026-03-10 08:47:18 +05:30
Abhisek Datta and GitHub
0588e66131
fix: Tune pypi sandbox profile ( #178 )
2026-03-06 17:47:04 +05:30
Abhisek Datta and GitHub
2bb5dd3778
fix: Allow explicit override over deny patterns ( #177 )
...
* fix: Allow explicit override over deny patterns
* test: Non-glob expansion for overrides is expected
2026-03-06 10:10:15 +05:30
70db1b3078
fix: redirect spinner output from stdout to stderr ( #176 )
...
The spinner goroutine was writing carriage-return + status text to
os.Stdout every 100ms. In the non-interactive TTY path, the child
process also writes directly to os.Stdout, causing both writers to
race on the same file descriptor. The \r emitted by the spinner
resets the cursor to column 0 mid-line, corrupting and truncating
the child process output.
Fix by writing all spinner/status output to os.Stderr, which is the
standard Unix convention for diagnostic and status messages. This is
also consistent with how progress.go and ShowWarning already behave.
https://claude.ai/code/session_012jMiRSS4Jx9Bs7a2F4S6KN
Co-authored-by: Claude <noreply@anthropic.com >
2026-03-06 08:27:11 +05:30
Abhisek Datta and GitHub
8cba52201c
feat: Add config support for UI verbosity level ( #175 )
...
* feat: Add config support for UI verbosity level
* docs: Add verbosity info in UI doc
2026-03-04 13:32:34 +05:30
Abhisek Datta and GitHub
0c09988776
fix: Interactive pty identification for proxy mode ( #174 )
2026-03-04 06:56:06 +00:00
601ba315c2
ci: Add GHA for issue triage ( #171 )
...
* ci: Add GHA for issue triage
* Update .github/workflows/issue-triage.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* Update .github/workflows/issue-triage.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-20 07:12:39 +00:00
Abhisek Datta and GitHub
91aa4547c4
feat: Show sandbox info in PMG setup info command ( #170 )
2026-02-20 11:59:29 +05:30
a81a4918c0
add support to merge system CA with PMG CA ( #169 )
...
* add support to merge system CA with PMG CA
* Keep CA cert immutable; merge system bundle only when writing proxy CA file
* Update proxy/certmanager/generator.go
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update internal/flows/proxy_flow.go
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* update config field name
* Use integer-only guard when sizing merged CA bundle
* Use int64-only guard when sizing merged CA bundle
* add tests for firstReadablePath
* Update proxy/certmanager/generator.go
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* fix linter
* refactor system CA merge API
* add max limit to 2MB for certificates
* update max limit to 2MB for certificate merging
* remove python specific env var for CAs
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
2026-02-20 11:40:26 +05:30
Sahil Bansal and GitHub
b0305cb54d
Add concurrency cancel and ignore docs/markdown changes across CI workflows ( #168 )
...
* Add concurrency cancel and ignore docs/markdown changes across CI workflows
* Clarify PR-only concurrency (no push queuing)
2026-02-16 21:33:27 +05:30
442a974aaa
Fix npm global flag usage ( #166 )
...
* fix global flag usage
* add comment
* Update packagemanager/npm_test.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update packagemanager/npm_test.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-16 16:55:23 +05:30
Abhisek Datta and GitHub
6074080219
feat: Add support for sandbox allow override ( #165 )
...
* feat: Add support for sandbox allow override
* fix: Main should fail on arg processing error
* fix: Remove redundant policy conflict check
2026-02-16 13:58:08 +05:30
d3cb15a3ea
docs: Update README ( #163 )
...
* docs: Update README
* docs: Misc fixes
* Update README.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* Update README.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-16 13:35:58 +05:30
Sahil Bansal and GitHub
ec6cdf5f78
verify upstream certs & reject unverified ( #158 )
...
* verify upstream certs & reject unverified
* update transport to only harden TLS & rm (http.Transport).Clone
2026-02-12 20:47:05 +05:30
Sahil Bansal and GitHub
5b0517f92a
add event type & logging interceptor for unknown hosts ( #157 )
...
* add event type & logging interceptor for unknown hosts
* update logging
* add break
* rename host_observation interceptor to audit_logger
* restore MITMDecider and make AuditLogger telemetry skip MITM on CONNECT
2026-02-12 13:48:01 +05:30
Sahil Bansal and GitHub
7fe9fc8763
provide package blocked feedback in proxy mode ( #154 )
...
* provide package blocked feedback in proxy mode
* update test case & clear status on block
* refactor reporting
* clearStatus on `continueExecution`
* set spinnerChan to nil
* add sync for spinner
2026-02-11 09:22:18 +05:30
Sahil Bansal and GitHub
a6cb60a757
Treat suspicious as malicious in paranoid mode ( #156 )
...
* paranoid mode blocks suspicious packages
* enable sandbox for paranoid flag
* rm sandbox enabling for paranoid mode
* update docs
2026-02-10 22:22:40 +05:30
41e3b9b22e
Deprecate malysis active scanner ( #155 )
...
* deprecate malysis active scanner
* Update config/config.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* copilot fixes
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-10 20:38:55 +05:30
Sahil Bansal and GitHub
b161d34f9e
fix proxy stuck on blocking malicious package ( #153 )
...
* fix proxy stuck on blocking malicious package
* update pmg e2e
2026-02-06 22:41:56 +05:30
Sahil Bansal and GitHub
f1891271c1
Add proxy support for pypi package managers ( #150 )
...
* initial pypi registry implementation
* support proxy mode for pypi package managers
* support proxy mode for pypi package managers - 2
* rm default mode as proxy for pip3
* update goproxy version & fix pypi proxy failing on 304
* add PIP_RETRIES=0 env
* update pmg e2e & add proxy mode e2e for pypi
* rm safedep-test-pkg for pypi proxy e2e
2026-02-05 13:30:27 +05:30
Abhisek Datta and GitHub
3778d4d1f3
fix: Sandbox Allow network bind for npx ( #151 )
...
* feat: Add support for network bind
* chore: Add comments for bwrap sandbox
2026-02-04 15:32:47 +05:30
Sahil Bansal and GitHub
f90fa0e6a5
Generalise Proxy Mode Registry Config ( #149 )
...
* refactor: generalise registry config
* add test cases & add defensive check for domain match
* fix linter
2026-02-03 07:47:07 +00:00
28c7b6c843
Make proxy mode default for npm based managers ( #148 )
...
* update npm pkg managers to use proxy mode as default
* update config template for default to true for proxy_mode
* update e2e for proxy mode
* update info cmd for correct proxy mode status
* Update config/config.template.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update config/config.template.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
* Update config/config.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-02 14:30:00 +05:30
Abhisek Datta and GitHub
b5696f989f
chore: Proxy mode without experimental tag ( #147 )
...
* chore: Proxy mode without experimental tag
* fix: Update proxy mode docs
* fix: Code review fixes
2026-02-02 12:58:28 +05:30
4600ab0245
fix: Sandbox policy tuning for tmp write access ( #145 )
...
* fix: Sandbox policy tuning for tmp write access
* fix: Remove numbers from test
* Update sandbox/profiles/pnpm-restrictive.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Sandbox E2E test to consider Linux bubblewrap tmpfs mount
* Update sandbox/profiles/pnpm-restrictive.yml
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Migrate deny rules from pnpm to npm policy
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-02-01 15:20:17 +05:30
Sahil Bansal and GitHub
b332e1d6d4
update setup install cmd info ( #143 )
...
* update setup install cmd info
* update demo
* add doc comment
2026-01-27 21:24:08 +05:30
Abhisek Datta and GitHub
be63fdd6ea
fix: Remove Emoji from Setup ( #142 )
...
* fix: Remove emoji from setup
* fix: Update README demo
2026-01-27 20:08:23 +05:30
Sahil Bansal and GitHub
224658e6d2
Update PMG banner ( #138 )
...
* update pmg banner
* rm width
* trial: rm lines
* trial: add line above demo
* trial: add thin line above demo
* trial: add thin line above demo
* trial: add thin line below demo
* trial: rm lines
* trial: add br
* trial: replace images with badges
* trial: replace h1 with h3
* trial: increase pmg height
* revert back to h1
* trial: change theme for demo
* trial: use lighter bg for demo
* trial: use lighter bg for demo
* trial: use lighter bg for demo & rm extra div
* revert demo back to original
* add private package limitation in non-proxy mode
* update demos
2026-01-27 19:39:36 +05:30
Abhisek Datta and GitHub
36ac3e3384
feat: Add post-exec reporting support ( #134 )
...
* feat: Add post install reporting support
* fix: UI report handling
* fix: Duplicate reporting
* fix: Show warning on insecure bypass
* fix: Proxy event log insecure skip installation
* fix: Proxy event log insecure skip installation
* fix: Common definition for infer outcome
2026-01-27 17:50:26 +05:30
Sahil Bansal and GitHub
0aa82033a5
fix proxy mode failing for GH private packages ( #137 )
...
* fix proxy mode failing for GH private packages
* skip analysis for private packages for proxy mode
* introduce npmRegistryConfig and support for handling multiple parsers in future
* refactor name and unexport npm config functions
* rm unused function
* rename & unexport npmRegistryURLParser
* add e2e for malicious pkg blocked using proxy mode
2026-01-23 18:38:54 +05:30
aa5c528a9d
docs: Update README ( #133 )
...
* docs: Update README
* docs: Update README
* docs: Update README
* docs: Update README
* docs: Update README
* Apply suggestion from @Sahilb315
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-01-21 20:29:15 +05:30
Sahil Bansal and GitHub
736c63a7b6
Sandbox fails for unsupported cmds ( #129 )
...
* introduce enforce_always sandbox config & hooks for flows
* fix sandbox failing for unsupported commands
* add hooks for pypi package managers
* add tests for sandbox hook
* introduce enforce_always flag for ease use & CI
* make comments descriptive
* remove hooks & update config to add API to configure sandbox
* add comments
* rm unused function
2026-01-19 22:24:59 +05:30
Sahil Bansal and GitHub
cc2dd993ed
update module path to safedep/ptyx ( #130 )
2026-01-19 14:33:37 +05:30
ff4a4a4734
update pmg banner & fix empty commit ( #127 )
...
* update pmg banner & fix empty commit
* rm old banner
* precompile regex for version
* fix: Color in github URL (#128 )
---------
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
2026-01-18 19:46:23 +05:30
edfdd543e0
chore: README update demo and Error Fix ( #126 )
...
* docs: Update README with demo gif
* fix: Proxy remove dependency on interaction
* fix: Update demo gif width
* Update docs/demo/pmg-intro.tape
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: PMG demo
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-18 16:00:37 +05:30
Abhisek Datta and GitHub
6a3821d44a
chore: Improve console error experience ( #124 )
...
* chore: Improve console error experience
* fix: Use standard error code and handle verbosity
2026-01-17 14:05:01 +05:30
Abhisek Datta and GitHub
80a1747e3e
feat: Add support for Linux Sandbox using Bubblewrap ( #120 )
...
* feat: Add support for bubblewrap sandbox
* fix: Glob pattern expansion limit for linux
* fix: Bug in glob pattern expansion for bwrap
* fix: README on trust
* fix: Multiple bubblewrap translator fix
* test: Add E2E for linux sandbox
* fix: Refactor bwrap sandbox to use common dangerous files
* fix: Path test case
* fix: Non-existent path handling bug
* refactor: Misc cleanup
* fix: Avoid bind mount for non-existentent deny protection
* fix: Off by one bug in path depth handling
* ci: Disable AppArmor on GHA runner
* fix: Disable apparmor userns restrictions
2026-01-15 20:12:12 +05:30
b97a4c2ee5
docs: Add trust doc ( #118 )
...
* docs: Add trust doc
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-14 15:02:08 +05:30
Sahil Bansal and GitHub
f1b7e3f403
fix download artifact path ( #117 )
2026-01-14 06:43:08 +00:00
Abhisek Datta and GitHub
cf12914ab3
ci: Add support for build provenance ( #116 )
...
* ci: Add support for build provenance
* fix: Fix provenance job
2026-01-14 11:45:54 +05:30
2e1f5b1a36
feat: Add support for policy inheritence ( #113 )
...
* feat: Add support for policy inheritence
* fix: Linter fixes
* Update docs/sandbox.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Handle boolean inheritence
* ci: Add linter
* Update sandbox/policy_test.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* fix: Linter fixes
* fix: Linter fixes
* fix: Sandbox rule regex format
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-14 10:50:39 +05:30
9693428171
feat: Experimental Sandbox Support ( #101 )
...
* feat: Sandbox implementation with seatbelt
* refactor: Remove concept of PM_CACHE
* fix: Misc fixes
* refactor: Sandbox for separation of boundaries
* fix: Apply API
* fix: Add support for sandbox cleanup
* test: Add variable interpolation test
* fix: Misc cleanup fixes
* chore: Cleanup sandbox registry
* chore: Cleanup sandbox policy
* chore: Cleanup sandbox
* fix: Misc cleanup fixes
* fix: Remove violation mode
* fix: Update config template
* chore: Go mod cleanup
* fix: Handle the case when package manager policy is explicitly disabled
* fix: Sandbox executor
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
* test: Remove unused var
* test: Add test for seatbelt sandbox driver
* fix: Sandbox profile loader from file should use path for caching
* test: Add policy test
* feat: Add support for config templates
* fix: Seatbelt translator handle glob
* fix: Merge conflicts
* fix: Fix sandbox policy generator for MacOS min permissions
* fix: Sandbox path handling bugs
* fix: Deny read to dangerous directories
* fix: Deny read to dangerous directories
* add sandbox e2e (#112 )
* fix: Sandbox E2E test
* fix: Code review fixes
* fix: Code review fixes
* doc: Add sandbox debugging guide
* doc: Update sandbox doc
* docs: Add sandbox usage doc
* fix: Use better error for sandbox without policy
* fix: Add sandbox for npx
* fix: Enable PTY for npm
---------
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-01-13 14:52:02 +05:30
Abhisek Datta and GitHub
c0122898ca
feat: Add support for setup-info command ( #108 )
...
* feat: Add support for setup-info command
* fix: Code review fixes
* fix: Add event log info
2026-01-11 19:25:13 +05:30
Sahil Bansal and GitHub
11481c3f4c
remove windows proxy limitation ( #107 )
...
* remove windows proxy limitation
* move setup cmd details to a single place
2026-01-11 10:05:19 +05:30
f851a1ebba
remove process control code to pause/resume process ( #106 )
...
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com >
2026-01-10 11:21:24 +00:00
f50d296935
add e2e and alias for npx, pnpx ( #105 )
...
* add e2e and alias for npx, pnpx
* Update .github/workflows/pmg-e2e.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
---------
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-01-10 16:47:43 +05:30
Sahil Bansal and GitHub
ca224f523c
enable support for proxy mode for npm package managers ( #104 )
...
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com >
2026-01-10 00:24:45 +05:30
