# PMG configuration template. Customize this file as needed.
# https://github.com/safedep/pmg

# Enable transitive dependency resolution. Default is true.
transitive: true

# Maximum depth of transitive dependencies to resolve. Default is 5.
transitive_depth: 5

# Include dev dependencies in the dependency graph. Default is false.
include_dev_dependencies: false

# Enable paranoid mode. In paranoid mode, PMG will use SafeDep Cloud credentials
# to scan unknown packages for malware. This is slow and should be used with caution.
paranoid: false

# Skip event logging. Default is false.
# When event logging is enabled, all events will be logged to file. These events are useful for audit
# trail and incident response on systems using PMG. Set this config to true to skip event logging.
skip_event_logging: false

# Event log retention days. Default is 7.
# This is the number of days to retain event logs.
event_log_retention_days: 7

# Experimental proxy mode. Default is false.
# When enabled, PMG uses an experimental proxy-based interception approach instead of the
# default guard-based analysis. The proxy intercepts package manager requests in real-time
# and analyzes packages as they are downloaded. This is an experimental feature and may not
# work in all environments.
experimental_proxy_mode: false

# Trusted packages are packages that are trusted by the user and will be ignored by the security guardrails.
# This is useful for packages that are known to be safe and are used in the application.
# Example:
#   - purl: pkg:npm/@safedep/pmg
#     reason: "PMG is a trusted package for PMG"
#
# When a package is specified without an explicit version, all versions of the package will be trusted.
# This feature should be used with caution and should be used for minimal set of packages.
#
# When a package is specified with an explicit version, only that version will be trusted.
#
# The purl is the package identifier and the reason is the reason for trusting the package.
# PURL specification: https://github.com/package-url/purl-spec
trusted_packages:
  - purl: pkg:npm/@safedep/pmg
    reason: "PMG is a trusted package for PMG"

# Sandbox configuration (EXPERIMENTAL)
# When enabled, package managers run in sandbox environments with restricted
# filesystem, network, and process execution access. This provides defense-in-depth
# protection against malicious install scripts and supply chain attacks.
#
# When sandboxing is enabled for a package manager, policy violations will block execution
# (no "warn-only" mode). Sandboxing itself can be disabled globally or per package manager.
#
# Currently supported platforms:
# - macOS (using Seatbelt sandbox-exec)
# - Linux (planned: Bubblewrap or seccomp-bpf)
# - Windows (planned)
sandbox:
  # Enable sandbox mode (opt-in, default: false for backward compatibility)
  enabled: false

  # Policy templates define policy profiles by name and path.
  # They can be used to override a built-in profile or create a custom profile.
  policy_templates:
    # Name for the template. Can be used to override a built-in profile or create a custom profile.
    # Path is the path to the template file.
    # Relative path can be used to reference a template file in the config directory (example: ./npm-restrictive.yml)
    npm-restrictive-override:
      path: ./profiles/npm-restrictive.yml

  # Per-package-manager sandbox policies
  # Each package manager can have its own policy to account for unique security characteristics
  policies:
    # npm ecosystem. npm-restrictive is a built-in profile.
    npm:
      enabled: true
      profile: npm-restrictive  # Built-in profile, template name, or path to custom YAML

    pnpm:
      enabled: true
      profile: npm-restrictive

    yarn:
      enabled: true
      profile: npm-restrictive

    bun:
      enabled: true
      profile: npm-restrictive

    # PyPI ecosystem. pypi-restrictive is a built-in profile.
    pip:
      enabled: true
      profile: pypi-restrictive

    pip3:
      enabled: true
      profile: pypi-restrictive

    poetry:
      enabled: true
      profile: pypi-restrictive

    uv:
      enabled: true
      profile: pypi-restrictive