nvim-sandman

Neovim Network Control That Stays Out of Your Way

nvim-sandman helps you block plugin network access, allow only trusted tools, and audit what happened, directly inside Neovim.

View Repository Full README Changelog

Offline by Default

Start in strict mode and permit only what you trust.

Practical Controls

Use commands for temporary network windows and fast allow/block changes.

Policy Rules

Add ordered allow/deny/prompt rules for exec and socket actions.

Quick Start

Install (lazy.nvim)

{
  'stasfilin/nvim-sandman',
  config = function()
    require('nvim_sandman').setup({
      enabled = true,
      mode = 'block_all',
      allow = { 'lazy.nvim' },
    })
  end
}
  1. Start in block_all.
  2. Inspect activity with :Sandman stats.
  3. Add trusted plugins to allow.
  4. Use :Sandman temp-net 30000 for short exceptions.

Modes

Core Modes

  • block_all: block all except allow
  • blocklist: block only listed plugins
  • allowlist: allow only listed plugins

Key Commands

  • :Sandman block / :Sandman unblock
  • :Sandman block-only <p1> <p2>
  • :Sandman allow-only <p1> <p2>
  • :Sandman stats / :Sandman stats-reset
  • :Sandman temp-net [ms]

Policy Engine (Optional)

Policy evaluates ordered rules and applies allow, deny, or prompt_once decisions for exec/socket. 

policy = {
  enabled = true,
  mode = 'enforce',
  default = 'prompt_once',
  rules = {
    { id = 'allow-rg', action = 'exec', exe = 'rg', decision = 'allow' },
    { id = 'deny-curl', action = 'exec', exe = 'curl', decision = 'deny' },
    { id = 'prompt-node', action = 'exec', exe = 'node', decision = 'prompt_once' },
  },
}

Troubleshooting

blocked ... from unknown

Actor attribution is best-effort. Wrappers, timers, and manual :lua paths may show as unknown.

Policy not blocking

Verify policy.enabled = true, policy.mode = 'enforce', and rule order/default fallback.

This page is built from site/ via .github/workflows/pages.yml.