Metadata-Version: 2.5
Name: inspect-glovebox
Version: 0.4.3
Summary: A hypervisor-isolated, egress-filtered Inspect sandbox provider backed by glovebox
Project-URL: Homepage, https://github.com/AlexanderMattTurner/agent-glovebox
Project-URL: Documentation, https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/docs/inspect-provider.md
Project-URL: Source, https://github.com/AlexanderMattTurner/agent-glovebox
Author: AlexanderMattTurner
License-Expression: Apache-2.0
Keywords: ai-control,evals,inspect,inspect-ai,microvm,sandbox
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Science/Research
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.11.4
Requires-Dist: glovebox-driver>=0.6.0
Requires-Dist: inspect-ai>=0.3.245
Requires-Dist: pydantic>=2
Requires-Dist: pyyaml>=6
Description-Content-Type: text/markdown

# inspect-glovebox

A sandbox provider for [UK AISI Inspect](https://inspect.aisi.org.uk) that runs each sample in a hardware-isolated microVM with a default-deny outgoing-traffic allowlist, and hands your scorer the record of every host the agent reached.

```bash
pip install inspect-glovebox
```

That pulls the `glovebox-driver` dependency from PyPI too. To run the unreleased code on `main` instead, install both distributions from the repository:

```bash
pip install \
  "glovebox-driver @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=glovebox-driver" \
  "inspect-glovebox @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=inspect-glovebox"
```

## Adoption is one line on your Task

```python
from inspect_glovebox import GloveboxSandboxConfig, glovebox_egress_scorer

Task(
    dataset=dataset,
    solver=solver,
    sandbox=SandboxEnvironmentSpec("glovebox", GloveboxSandboxConfig(memory="4g")),
    scorer=glovebox_egress_scorer("pastebin.com"),
)
```

Inspect finds the provider through this distribution's `inspect_ai` entry point, so nothing in your own code imports it. `sandbox="glovebox"` alone takes every default below.

## What the host needs

The provider drives the `glovebox` command, which boots a Kata Containers microVM. A `glovebox` you installed ([glovebox](https://github.com/AlexanderMattTurner/agent-glovebox)) is used first; with none on `PATH`, the provider downloads the release this package pins, refuses it unless its SHA-256 matches the pinned digest, and runs it from `~/.cache/inspect-glovebox`. Ask whether this host qualifies:

```bash
inspect-glovebox sandbox preflight
```

That console script comes with this package and runs whichever `glovebox` a task would drive, so it works before you have installed one. Run `glovebox sandbox preflight` instead when you installed the CLI yourself.

It exits 0 when the host can boot a sandbox, and otherwise names what is missing and the command that installs it. `GLOVEBOX_BIN` points the provider at a `bin/glovebox` that is not on `PATH`. Every task refuses at startup on a host that fails preflight, so one bad host costs one error and not one error per sample.

## Configuration

[docs/inspect-provider.md § Configuration](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/docs/inspect-provider.md#configuration) lists every field, its default, and what it does.

## Read next

[docs/inspect-provider.md](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/docs/inspect-provider.md) covers the lifecycle, custom scorers over the traffic record, cleanup and troubleshooting. It also states which tools run at the model provider rather than in the sandbox, which the allowlist cannot bound. [examples/claude_code_task.py](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/inspect-glovebox/examples/claude_code_task.py) is a runnable Claude Code task. It needs `pip install inspect-swe` first. [examples/containment_smoke.py](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/inspect-glovebox/examples/containment_smoke.py) needs no model API key: `inspect eval containment_smoke.py --model mockllm/model` boots one sandbox, reaches for an allowed host and a refused one, and grades what left. The sandbox itself lives in the [agent-glovebox](https://github.com/AlexanderMattTurner/agent-glovebox) repository, whose `SECURITY.md` states the threat model and what each layer does not stop.
