Make proxy mode default for npm based managers (#148)

Sahilb315 · Copilot · web-flow · commit 28c7b6c8433e · 2026-02-02T14:30:00.000+05:30
* update npm pkg managers to use proxy mode as default

* update config template for default to true for proxy_mode

* update e2e for proxy mode

* update info cmd for correct proxy mode status

* Update config/config.template.yml

Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;
Signed-off-by: Sahil Bansal &lt;bansalsahil315@gmail.com&gt;

* Update config/config.template.yml

Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;
Signed-off-by: Sahil Bansal &lt;bansalsahil315@gmail.com&gt;

* Update config/config.go

Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;
Signed-off-by: Sahil Bansal &lt;bansalsahil315@gmail.com&gt;

---------

Signed-off-by: Sahil Bansal &lt;bansalsahil315@gmail.com&gt;
Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;
diff --git a/.github/workflows/pmg-e2e.yml b/.github/workflows/pmg-e2e.yml
@@ -101,15 +101,15 @@ jobs:
           test -d node_modules/lodash
           cd .. && rm -rf npm-test
 
-      - name: Test NPM - Experimental Proxy Mode
+      - name: Test NPM - Proxy Mode
         run: |
-          echo "Testing NPM with experimental proxy-based interception..."
+          echo "Testing NPM with proxy-based interception..."
           mkdir npm-proxy-test && cd npm-proxy-test
           pmg npm init -y
 
           echo "Testing proxy mode single package installation..."
-          pmg --experimental-proxy-mode npm install express@5.2.1
-          pmg --experimental-proxy-mode npm install lodash@4.17.21
+          pmg npm install express@5.2.1
+          pmg npm install lodash@4.17.21
 
           # Verification: packages installed via proxy mode
           test -d node_modules/express
@@ -119,15 +119,15 @@ jobs:
 
           echo "Testing proxy mode manifest installation..."
           rm -rf node_modules package-lock.json
-          pmg --experimental-proxy-mode npm install
+          pmg npm install
 
           # Verification: manifest install via proxy mode works
           test -f package-lock.json
           test -d node_modules/express
           test -d node_modules/lodash
 
           echo "Testing proxy mode with scoped package..."
-          pmg --experimental-proxy-mode npm install @types/node@18.0.0
+          pmg npm install @types/node@18.0.0
 
           # Verification: scoped package installed via proxy
           test -d node_modules/@types
@@ -136,7 +136,7 @@ jobs:
 
           echo "Testing proxy mode dry-run (should not create files)..."
           rm -rf node_modules package-lock.json
-          pmg --experimental-proxy-mode --dry-run npm install
+          pmg --dry-run npm install
 
           # Verification: dry-run doesn't create files even in proxy mode
           test ! -d node_modules
@@ -378,7 +378,7 @@ jobs:
           mkdir safedep-test-pkg-test && cd safedep-test-pkg-test
           pmg npm init -y
           # Attempt to install safedep-test-pkg - should fail
-          if pmg --experimental-proxy-mode npm --no-cache --prefer-online i safedep-test-pkg@0.1.3; then
+          if pmg npm --no-cache --prefer-online i safedep-test-pkg@0.1.3; then
             echo "ERROR: safedep-test-pkg was not blocked!"
             exit 1
           else
diff --git a/README.md b/README.md
@@ -78,7 +78,7 @@ uv pip install <package-name>
 ## Features
 
 - Malicious package identification using [SafeDep Cloud](https://docs.safedep.io/cloud/malware-analysis) with realtime threat detection
-- Deep dependency analysis and transitive dependency resolution
+- Proxy based dependency analysis and resolution
 - Fast and efficient package verification
 - Defense in depth using OS native sandboxing
 - Seamless integration with existing package managers
diff --git a/cmd/executors/npx.go b/cmd/executors/npx.go
@@ -51,9 +51,9 @@ func executeNpxFlow(ctx context.Context, args []string) error {
 		return fmt.Errorf("failed to create dependency resolver: %w", err)
 	}
 
-	if config.IsProxyModeEnabled() {
-		return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
+	if !config.IsProxyModeEnabled() {
+		return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
 	}
 
-	return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
+	return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
 }
diff --git a/cmd/executors/pnpx.go b/cmd/executors/pnpx.go
@@ -51,9 +51,9 @@ func executePnpxFlow(ctx context.Context, args []string) error {
 		return fmt.Errorf("failed to create dependency resolver: %w", err)
 	}
 
-	if config.IsProxyModeEnabled() {
-		return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
+	if !config.IsProxyModeEnabled() {
+		return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
 	}
 
-	return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
+	return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
 }
diff --git a/cmd/npm/bun.go b/cmd/npm/bun.go
@@ -51,9 +51,9 @@ func executeBunFlow(ctx context.Context, args []string) error {
 		return fmt.Errorf("failed to create dependency resolver: %w", err)
 	}
 
-	if config.IsProxyModeEnabled() {
-		return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	if !config.IsProxyModeEnabled() {
+		return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 	}
 
-	return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 }
diff --git a/cmd/npm/npm.go b/cmd/npm/npm.go
@@ -51,9 +51,9 @@ func executeNpmFlow(ctx context.Context, args []string) error {
 		return fmt.Errorf("failed to create dependency resolver: %w", err)
 	}
 
-	if config.IsProxyModeEnabled() {
-		return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	if !config.IsProxyModeEnabled() {
+		return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 	}
 
-	return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 }
diff --git a/cmd/npm/pnpm.go b/cmd/npm/pnpm.go
@@ -52,9 +52,9 @@ func executePnpmFlow(ctx context.Context, args []string) error {
 		return fmt.Errorf("failed to create dependency resolver: %w", err)
 	}
 
-	if config.IsProxyModeEnabled() {
-		return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	if !config.IsProxyModeEnabled() {
+		return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 	}
 
-	return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 }
diff --git a/cmd/npm/yarn.go b/cmd/npm/yarn.go
@@ -51,9 +51,9 @@ func executeYarnFlow(ctx context.Context, args []string) error {
 		return fmt.Errorf("failed to create dependency resolver: %w", err)
 	}
 
-	if config.IsProxyModeEnabled() {
-		return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	if !config.IsProxyModeEnabled() {
+		return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 	}
 
-	return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)
+	return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)
 }
diff --git a/cmd/setup/info.go b/cmd/setup/info.go
@@ -35,7 +35,7 @@ func executeSetupInfo() error {
 	cfg := config.Get()
 	configEntries := make(map[string]string)
 	configEntries["Config File"] = cfg.ConfigFilePath()
-	configEntries["Proxy Mode"] = strconv.FormatBool(cfg.Config.ExperimentalProxyMode)
+	configEntries["Proxy Mode"] = strconv.FormatBool(cfg.IsProxyModeEnabled())
 	ui.PrintInfoSection("Configuration", configEntries)
 
 	// Shell Integration section
diff --git a/config/config.go b/config/config.go
@@ -182,6 +182,7 @@ func DefaultConfig() RuntimeConfig {
 			SkipEventLogging:       false,
 			ExperimentalProxyMode:  false,
 			TrustedPackages:        []TrustedPackage{},
+			ProxyMode:              true,
 			Sandbox: SandboxConfig{
 				Enabled:       false,
 				EnforceAlways: false,
diff --git a/config/config.template.yml b/config/config.template.yml
@@ -15,20 +15,20 @@ include_dev_dependencies: false
 paranoid: false
 
 # Skip event logging. Default is false.
-# When event logging is enabled, all events will be logged to file. These events are useful for audit
-# trail and incident response on systems using PMG. Set this config to true to skip event logging.
+# When skip_event_logging is false, all events will be logged to file. These events are useful for audit
+# trail and incident response on systems using PMG. Set this config to true to disable event logging.
 skip_event_logging: false
 
 # Event log retention days. Default is 7.
 # This is the number of days to retain event logs.
 event_log_retention_days: 7
 
-# Proxy mode. Default is false.
-# When enabled, PMG uses an experimental proxy-based interception approach instead of the
+# Proxy mode. Default is true.
+# When enabled, PMG uses a proxy-based interception approach instead of the
 # default guard-based analysis. The proxy intercepts package manager requests in real-time
-# and analyzes packages as they are downloaded. This is an experimental feature and may not
-# work in all environments.
-proxy_mode: false
+# and analyzes packages as they are downloaded. Proxy mode may not work in all environments,
+# and can be disabled to fall back to the guard-based analysis.
+proxy_mode: true
 
 # Trusted packages are packages that are trusted by the user and will be ignored by the security guardrails.
 # This is useful for packages that are known to be safe and are used in the application.

Original file line number	Diff line number	Diff line change
`@@ -51,9 +51,9 @@ func executeNpxFlow(ctx context.Context, args []string) error {`
`51`	`51`	`return fmt.Errorf("failed to create dependency resolver: %w", err)`
`52`	`52`	`}`
`53`	`53`
`54`		`- if config.IsProxyModeEnabled() {`
`55`		`- return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
	`54`	`+ if !config.IsProxyModeEnabled() {`
	`55`	`+ return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
`56`	`56`	`}`
`57`	`57`
`58`		`- return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
	`58`	`+ return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
`59`	`59`	`}`
Original file line number	Diff line number	Diff line change
`@@ -51,9 +51,9 @@ func executePnpxFlow(ctx context.Context, args []string) error {`
`51`	`51`	`return fmt.Errorf("failed to create dependency resolver: %w", err)`
`52`	`52`	`}`
`53`	`53`
`54`		`- if config.IsProxyModeEnabled() {`
`55`		`- return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
	`54`	`+ if !config.IsProxyModeEnabled() {`
	`55`	`+ return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
`56`	`56`	`}`
`57`	`57`
`58`		`- return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
	`58`	`+ return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)`
`59`	`59`	`}`
Original file line number	Diff line number	Diff line change
`@@ -51,9 +51,9 @@ func executeBunFlow(ctx context.Context, args []string) error {`
`51`	`51`	`return fmt.Errorf("failed to create dependency resolver: %w", err)`
`52`	`52`	`}`
`53`	`53`
`54`		`- if config.IsProxyModeEnabled() {`
`55`		`- return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`54`	`+ if !config.IsProxyModeEnabled() {`
	`55`	`+ return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`56`	`56`	`}`
`57`	`57`
`58`		`- return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`58`	`+ return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`59`	`59`	`}`
Original file line number	Diff line number	Diff line change
`@@ -51,9 +51,9 @@ func executeNpmFlow(ctx context.Context, args []string) error {`
`51`	`51`	`return fmt.Errorf("failed to create dependency resolver: %w", err)`
`52`	`52`	`}`
`53`	`53`
`54`		`- if config.IsProxyModeEnabled() {`
`55`		`- return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`54`	`+ if !config.IsProxyModeEnabled() {`
	`55`	`+ return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`56`	`56`	`}`
`57`	`57`
`58`		`- return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`58`	`+ return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`59`	`59`	`}`
Original file line number	Diff line number	Diff line change
`@@ -52,9 +52,9 @@ func executePnpmFlow(ctx context.Context, args []string) error {`
`52`	`52`	`return fmt.Errorf("failed to create dependency resolver: %w", err)`
`53`	`53`	`}`
`54`	`54`
`55`		`- if config.IsProxyModeEnabled() {`
`56`		`- return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`55`	`+ if !config.IsProxyModeEnabled() {`
	`56`	`+ return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`57`	`57`	`}`
`58`	`58`
`59`		`- return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`59`	`+ return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`60`	`60`	`}`
Original file line number	Diff line number	Diff line change
`@@ -51,9 +51,9 @@ func executeYarnFlow(ctx context.Context, args []string) error {`
`51`	`51`	`return fmt.Errorf("failed to create dependency resolver: %w", err)`
`52`	`52`	`}`
`53`	`53`
`54`		`- if config.IsProxyModeEnabled() {`
`55`		`- return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`54`	`+ if !config.IsProxyModeEnabled() {`
	`55`	`+ return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`56`	`56`	`}`
`57`	`57`
`58`		`- return flows.Common(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
	`58`	`+ return flows.ProxyFlow(packageManager, packageResolver).Run(ctx, args, parsedCommand)`
`59`	`59`	`}`