What
When the sandbox blocks an outbound connection, the violation record now includes the shell command responsible, so you can tell which command tried to reach the network rather than only seeing that something did.
Details
- The proxy's auth check returns a result object carrying an encoded command instead of a plain yes/no.
- The proxy Basic credential username may now be
srtorsrt.<suffix>; the SOCKS path previously required an exactsrtmatch. The suffix decodes to the command identity, set fromSRT_ENCODED_CMDwhen a command id is supplied. - The decoded command is passed to the allowlist filter and to the denial callback, and violation records carry both the encoded form and a resolved command string.
- Requests failing the auth check still get the existing 407 and 403 responses.
Evidence
SRT_ENCODED_CMD, encodedCommand
Strings lifted out of the shipped bundle, so the claim above can be checked against them.