Metadata-Version: 2.5
Name: inspect-glovebox
Version: 0.4.1
Summary: A hypervisor-isolated, egress-filtered Inspect sandbox provider backed by glovebox
Project-URL: Homepage, https://github.com/AlexanderMattTurner/agent-glovebox
Project-URL: Documentation, https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/docs/inspect-provider.md
Project-URL: Source, https://github.com/AlexanderMattTurner/agent-glovebox
Author: AlexanderMattTurner
License-Expression: Apache-2.0
Keywords: ai-control,evals,inspect,inspect-ai,microvm,sandbox
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Science/Research
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.11.4
Requires-Dist: glovebox-driver>=0.1
Requires-Dist: inspect-ai>=0.3.130
Requires-Dist: pydantic>=2
Requires-Dist: pyyaml>=6
Description-Content-Type: text/markdown

# inspect-glovebox

A sandbox provider for [UK AISI Inspect](https://inspect.aisi.org.uk) that runs each sample in a hardware-isolated microVM with a default-deny outgoing-traffic allowlist, and hands your scorer the record of every host the agent reached.

```bash
pip install inspect-glovebox
```

That pulls the `glovebox-driver` dependency from PyPI too. To run the unreleased code on `main` instead, install both distributions from the repository:

```bash
pip install \
  "glovebox-driver @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=glovebox-driver" \
  "inspect-glovebox @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=inspect-glovebox"
```

## Adoption is one line on your Task

```python
from inspect_glovebox import GloveboxSandboxConfig, glovebox_egress_scorer

Task(
    dataset=dataset,
    solver=solver,
    sandbox=SandboxEnvironmentSpec("glovebox", GloveboxSandboxConfig(memory="4g")),
    scorer=glovebox_egress_scorer("pastebin.com"),
)
```

Inspect finds the provider through this distribution's `inspect_ai` entry point, so nothing in your own code imports it. `sandbox="glovebox"` alone takes every default below.

## What the host needs

The provider drives the `glovebox` command, which drives Docker's `sbx` sandbox runtime. A `glovebox` you installed ([glovebox](https://github.com/AlexanderMattTurner/agent-glovebox)) is used first; with none on `PATH`, the provider downloads the release this package pins, refuses it unless its SHA-256 matches the pinned digest, and runs it from `~/.cache/inspect-glovebox`. Sign in to `sbx`, then ask whether this host qualifies:

```bash
inspect-glovebox sandbox preflight
```

That console script comes with this package and runs whichever `glovebox` a task would drive, so it works before you have installed one. Run `glovebox sandbox preflight` instead when you installed the CLI yourself.

It exits 0 when the host can boot a sandbox, and otherwise names what is missing and the command that installs it. `GLOVEBOX_BIN` points the provider at a `bin/glovebox` that is not on `PATH`. Every task refuses at startup on a host that fails preflight, so one bad host costs one error and not one error per sample.

## Configuration

| Field                  | Default          | Purpose                                                                                                                                                                                                      |
| ---------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `workspace`            | `None`           | Host directory bound into the guest; `None` mints an empty one per sample.                                                                                                                                   |
| `allowlist`            | `None`           | Path to a `domain-allowlist.json` saying which hosts the guest may reach and how; `None` takes glovebox's shipped list.                                                                                      |
| `per_sample_workspace` | `True`           | Give each sample a private copy of `workspace`.                                                                                                                                                              |
| `boot_timeout`         | `300`            | Seconds to wait for the microVM to become usable.                                                                                                                                                            |
| `cpus`                 | `None`           | Virtual CPUs for the VM; `None` takes glovebox's own cap.                                                                                                                                                    |
| `memory`               | `None`           | Memory ceiling, such as `4g`; `None` takes glovebox's own cap.                                                                                                                                               |
| `user`                 | `glovebox-agent` | The de-privileged guest identity every command runs as.                                                                                                                                                      |
| `rootfs_image`         | `None`           | Boot from this image, already built by `glovebox sandbox build-rootfs`; a compose `image:` fills it in.                                                                                                      |
| `capture_egress`       | `True`           | Write each sample's outgoing-traffic record beside the run's eval log, in a `glovebox-egress/` directory, honoring `--log-dir`. Falls back to `INSPECT_LOG_DIR` when no active sample location is available. |

## Read next

[docs/inspect-provider.md](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/docs/inspect-provider.md) covers the lifecycle, custom scorers over the traffic record, cleanup and troubleshooting. It also states which tools run at the model provider rather than in the sandbox, which the allowlist cannot bound. [examples/claude_code_task.py](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/inspect-glovebox/examples/claude_code_task.py) is a runnable Claude Code task. [examples/containment_smoke.py](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/inspect-glovebox/examples/containment_smoke.py) needs no model API key: `inspect eval containment_smoke.py --model mockllm/model` boots one sandbox, reaches for an allowed host and a refused one, and grades what left. The sandbox itself lives in the [agent-glovebox](https://github.com/AlexanderMattTurner/agent-glovebox) repository, whose `SECURITY.md` states the threat model and what each layer does not stop.
