Nothing to try yet Notable
Sandbox can now terminate HTTPS itself and route traffic through an upstream proxy, both experimental
What
Two new experimental sandbox network settings:
network.tlsTerminatelets the sandbox terminate HTTPS connections itself, making request and response bodies visible to request filtering and credential injection; anexcludeDomainsoption opts specific hosts (such as ones using certificate pinning) out of this.network.parentProxylets the sandbox's proxy route outbound traffic through an upstream HTTP proxy, falling back to theHTTP_PROXY,HTTPS_PROXY, andNO_PROXYenvironment variables if not explicitly set.
Credential masking now requires tlsTerminate to be turned on, unless you explicitly opt out with allowPlaintextInject (off by default).
Why
Terminating TLS in-process lets the sandbox actually inspect and mask credentials inside encrypted traffic instead of only seeing opaque bytes, but both features are marked experimental, so behavior may still change.
Names in the bundlenetwork.tlsTerminate
network.tlsTerminate
Configure server-managed settings modified, medium confidence
An approval for `sandbox.credentials` or `sandbox.network.tlsTerminate` also covers the [`sandbox.network.allowedDomains`](/docs/en/settings-reference#sandbox-network-alloweddomains) entries in those same delivered settings, because both s…see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
network.tlsTerminate on Configure server-managed settings