# The "build" policy, installed with blinker: "write", with what
# toolchains need ("toolchains": their configuration, libraries and
# variables), their caches, which it may write, and the policies of the
# package managers
# (go, cargo, npm, pnpm, uv), with their registries. A program that is
# not yours can put things in those caches that later builds outside the
# sandbox use, or send what it reads to a registry. policies/build.policy
# in blinker's config directory comes first.

# type  access  pattern
include write
include toolchains
# Build caches.
file    write   ${XDG_CACHE_HOME:-~/.cache}
file    write   ~/Library/Caches
# The package managers, after the rules above, so theirs win.
include commands/go
include commands/cargo
include commands/npm
include commands/pnpm
include commands/uv