saphan egress
Reads the recorded egress decisions, that is which outbound connections were allowed or refused, for a run or a session.
Reads the recorded egress decisions, that is which outbound connections were allowed or refused, for a run or a session. Run it with a subcommand.
saphan egress facts
Prints every recorded egress decision for one run or session (host, port, verdict, reason and source) together with the run's egress posture. An empty result does not prove that no connection was attempted, in particular for a remote run whose records have not come back yet.
| flag | type | default | what it does |
|---|---|---|---|
--json | bool | false | Print the result as JSON. |
--run | string | The run to read; give this or --session. | |
--session | string | The session to read; give this or --run. |
Global options apply to every command — see Every command.
saphan dry-run
Rehearses a command that would change the record, without making the change: saphan dry-run <command> [args...] runs the same checks the real command runs and shows what it would do, or the refusal it
saphan egress-door
Runs one agent's egress door on a remote machine: it opens a SOCKS5 proxy on a unix socket that judges every outbound connection against the run's egress policy, runs the given command as its child, a