# npm: the "write" policy, with the npm registry and npm's cache.
# Packages' install scripts run here, which is the point: they reach
# nothing but the registry and node-gyp's headers. A package can still
# publish what it reads to the registry, with a token of its own. The
# cache is writable: a package that is not yours can put things there
# that later installs outside the sandbox use. ~/.npmrc, which may hold
# a token, is never readable. policies/commands/npm.policy in blinker's
# config directory comes first.

# type  access  pattern
include write
file    write   ${npm_config_cache:-${NPM_CONFIG_CACHE:-~/.npm}}/
file    write   ${XDG_CACHE_HOME:-~/.cache}/node-gyp/

host    allow   registry.npmjs.org
host    allow   nodejs.org
host    allow   github.com
host    allow   codeload.github.com
host    allow   *.githubusercontent.com

env     allow   NODE_PATH
env     allow   NODE_OPTIONS
env     allow   npm_config_*
env     allow   NPM_CONFIG_*