outboundctl review

outboundctl review works with the Review queue of connections that no rule decided, such as what Learn allowed, what Strict blocked and what timed out waiting for your answer.

Listing

outboundctl review list [--app <name>] [--group-by app|domain|host|port|none]

Lists the connections waiting for review, grouped by app unless you choose another grouping. --app shows one app’s items.

One broad rule for many items

Two broad rules can clear many Review items at once: allow a website domain for every app, or block a port for every app.

outboundctl review preview allow-domain example.com
outboundctl review promote allow-domain example.com --confirm <fingerprint>

review preview shows every live Review item the rule would cover and prints a confirmation fingerprint. It changes nothing. The rule it describes is one permanent rule for every app, in both directions and over all transports, including future connections. Rules with higher precedence can still decide a connection.

review promote saves exactly that rule and clears the items it covers, through Outbound’s background agent. Pass the fingerprint from the preview with --confirm. If Review has changed since the preview, nothing is saved and the command exits 65 with “Review changed since the preview. Run review preview again and confirm its current fingerprint.” Promoting follows outboundctl changes in Settings › Security and asks for approval like any other change.

allow-domain takes one registrable public domain. IP addresses, local names and public suffixes such as co.uk are refused (exit 65). deny-port takes a port from 1 to 65535.

Exit	When
0	The preview was printed, or the rule was saved
65	The domain or port is not valid, or Review changed since the preview
66	No live Review items match the rule
69	The background agent is unavailable or the request was cancelled
77	Command-line changes are off, or rules are locked