name: npm-restrictive
description: Restrictive sandbox policy for npm ecosystem (npm, pnpm, yarn, bun)
package_managers:
  - npm
  - pnpm
  - yarn
  - bun
  - npx
  - pnpx

# Optional security settings (uncomment to enable)
# allow_git_config: false  # Allow package managers to modify .git/config (default: false, blocks for security)

# Allow interactive terminal (PTY) operations
# Required for npx and pnpx to work, especially for commands like:
# npx create-next-app@latest
allow_pty: true

filesystem:
  allow_read:
    # Essential system paths for process execution
    - /
    - /usr/**
    - /var/**
    - /Library/**
    - /System/Library/**
    - /private/var/**
    # Project and user-specific paths
    - ${CWD}/**
    - ${HOME}/.npmrc
    - ${HOME}/.yarnrc
    - ${HOME}/.yarnrc.yml
    - ${HOME}/.bundle
    - ${HOME}/.npm/**
    - ${HOME}/.pnpm-store/**
    - ${HOME}/.cache/pnpm/**
    - ${HOME}/.cache/yarn/**
    - ${HOME}/.yarn/cache/**
    - ${HOME}/.bun/install/cache/**

  allow_write:
    # Note: ${TMPDIR} is automatically allowed when write restrictions are enabled (macOS)
    # Note: Patterns ending with /** automatically allow creating the parent directory.
    #       For example, ${CWD}/node_modules/** allows both:
    #         1. Creating the node_modules directory itself
    #         2. Writing any files/directories inside it
    # Temporary directories for shell scripts and package managers
    # Note: On macOS, /tmp is a symlink to /private/tmp, so we need both
    - /tmp/**
    - /private/tmp/**
    - /var/tmp/**
    # Project directories
    - ${CWD}/node_modules/**
    - ${CWD}/package-lock.json
    - ${CWD}/package.json
    - ${CWD}/yarn.lock
    - ${CWD}/pnpm-lock.yaml
    - ${CWD}/bun.lockb
    # Package manager caches and stores
    - ${HOME}/.npm/**
    - ${HOME}/.pnpm-store/**
    - ${HOME}/.cache/pnpm/**
    - ${HOME}/.cache/yarn/**
    - ${HOME}/.yarn/cache/**
    - ${HOME}/.bun/install/cache/**

  # Additional deny rules (optional - credentials are automatically blocked)
  # Automatically blocked for security:
  #   - .env, .env.*, .ssh/, .aws/, .gcloud/, .kube/, .gnupg/, .docker/config.json
  #   - .git/hooks/ (always blocked)
  #   - .git/config (blocked unless allow_git_config: true)
  deny_read: []

  deny_write:
    # Additional system directories to protect
    - /etc/**
    - /usr/**
    - /bin/**
    - /sbin/**
    # Additional deny rules for extra security
    - ${CWD}/.env
    - ${CWD}/.env.*

network:
  # MacOS sandbox-exec does not support network restrictions, so we allow all outbound traffic
  # when at least one allow outbound rule is present.
  allow_outbound:
    - registry.npmjs.org:443
    - registry.yarnpkg.com:443
    - npm.pkg.github.com:443
    - github.com:443

  deny_outbound:
    - "*:*"

environment:
  # This profile is the shared base for the npm ecosystem and deliberately
  # allows no environment variables: everything in the built-in
  # DANGEROUS_ENV_VARS list is scrubbed. Each package manager's leaf profile
  # (npm, yarn, bun, pnpm, npx) re-allows only the variables that
  # package manager needs for auth, registry config, and TLS.
  allow: []

process:
  allow_exec:
    - /usr/bin/node
    - /usr/local/bin/node
    - ${HOME}/.npm/**
    - ${HOME}/.pnpm-store/**
    - ${HOME}/.cache/pnpm/**
    - ${HOME}/.cache/yarn/**
    - ${HOME}/.yarn/cache/**
    - ${HOME}/.bun/install/cache/**
    - ${HOME}/.asdf/shims/npm
    - ${HOME}/.asdf/shims/pnpm
    - ${HOME}/.asdf/shims/yarn
    - ${HOME}/.asdf/shims/bun
    - /usr/bin/git
    - /usr/local/bin/git
    - /bin/bash
    - /bin/sh
    - /usr/bin/env

  deny_exec:
    - /usr/bin/curl
    - /usr/bin/wget
    - /usr/bin/python*