name: npx
description: Profile for npx/pnpx generators with write access to current directory
inherits: npm-restrictive

package_managers:
  - npx
  - pnpx

# npx and pnpx require PTY access to work, especially for commands like:
# npx create-next-app@latest
#
# Explicitly setting this so that it is enabled even if we decide to turn this off
# in parent profiles in the future.
allow_pty: true

# npx generators and dev servers frequently need to bind to localhost ports
allow_network_bind: true

environment:
  # The npm-restrictive base allows no environment variables. npx and pnpx
  # execute npm-ecosystem packages and use the npm auth and config
  # conventions. Sibling tokens (YARN_NPM_AUTH_*, BUN_AUTH_TOKEN) stay
  # scrubbed.
  allow:
    - NPM_TOKEN
    - NPM_AUTH_TOKEN
    - NODE_AUTH_TOKEN
    - npm_config_*
    - NPM_CONFIG_*
    - NODE_EXTRA_CA_CERTS

filesystem:
  # Add write permissions for common generator outputs
  allow_write:
    - ${CWD}/**

  # Additional deny rules for extra security
  deny_write:
    - ${CWD}/.env
    - ${CWD}/.env.*