# uv: the "write" policy, with PyPI, the Pythons and tools uv installs,
# and its cache. Packages' build scripts run here, and reach only PyPI
# and GitHub, where uv gets Pythons. What it installs and caches runs
# outside the sandbox later. policies/commands/uv.policy in blinker's
# config directory comes first.

# type  access  pattern
include write
file    read    ${XDG_CONFIG_HOME:-~/.config}/uv
file    write   ${XDG_DATA_HOME:-~/.local/share}/uv/
file    write   ${UV_CACHE_DIR:-${XDG_CACHE_HOME:-~/.cache}/uv}/
file    write   ${UV_PYTHON_INSTALL_DIR:-${XDG_DATA_HOME:-~/.local/share}/uv/python}

host    allow   pypi.org
host    allow   files.pythonhosted.org
host    allow   github.com
host    allow   *.githubusercontent.com

env     allow   VIRTUAL_ENV
env     allow   PYTHONPATH
env     allow   UV_*