{"version":"2.1.268","anchor":"per-command-network-allowlists-now-enforced-against-actual-s","canonical_anchor":"bashpowershellmonitor-tools-can-declare-per-command-networ","heading":"Sandboxed Bash\/PowerShell commands can declare a per-command network allowlist","tier":"notice","area":"Sandbox Network","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/per-command-network-allowlists-now-enforced-against-actual-s","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Sandboxed Bash\/PowerShell commands can declare a per-command network allowlist\n\nA new allowed_domains option lets sandboxed Bash\/PowerShell commands reach specific extra hosts, enforced against the actual sandbox\n\n**What**\n\n- Bash, PowerShell, and Monitor tool calls can now include an `allowed_domains` field listing hosts (plain domain, wildcard, or IP, each with an optional port) that a sandboxed command is allowed to reach. In auto mode this list is reviewed together with the command by the auto-mode classifier and applied for that one command; in any other mode it's ignored.\n\n- The list is checked against anti-spoofing rules that reject loopback\/IPv4-mapped addresses and canonical-form mismatches.\n\n- If a command carries an `allowed_domains` list but wouldn't actually run inside a confining sandbox, execution is now refused outright instead of silently running unconfined. When it does run sandboxed, the list is registered with the sandbox manager for the life of the process and unregistered on exit or error, via new `registerCommandNetworkLists`\/`unregisterCommandNetworkLists` sandbox functions.\n\n- A new canned deny response short-circuits network classification for hosts not in the command's `allowed_domains`, returning the message \"not in this command's allowed_domains \u2014 re-run the command with this host listed if it needs it\" instead of running the full classifier.\n\n- The whole capability is gated behind the `tengu_flickering_rain` flag plus sandboxing being enabled, and applies to both Bash and PowerShell's input validation.\n\n**Why**\n\nThis gives the model a way to ask for specific extra network access a sandboxed command needs (for example, to reach a particular API) without disabling sandbox network confinement altogether, while making sure the allowlist is only honored when a real sandbox is actually enforcing it.\n\n- Area: Sandbox Network\n- Names: `allowed_domains`\n- Tier: You'll notice\n- Useful: 5\/5\n- Signal: 4\/5"}