Metadata-Version: 2.5
Name: glovebox-monitor
Version: 0.1.0
Summary: glovebox's fail-closed tool-call monitor: a second model that reviews each tool call before it runs
Project-URL: Homepage, https://github.com/AlexanderMattTurner/agent-glovebox
Project-URL: Documentation, https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/docs/inspect-approver.md
Project-URL: Source, https://github.com/AlexanderMattTurner/agent-glovebox
Author: AlexanderMattTurner
License-Expression: Apache-2.0
Keywords: ai-control,evals,inspect-ai,monitor,security
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Science/Research
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.11.4
Provides-Extra: inspect
Requires-Dist: inspect-ai>=0.3.130; extra == 'inspect'
Description-Content-Type: text/markdown

# glovebox-monitor

A second model that reads every tool call an agent proposes, before the call runs, and answers allow / ask / deny. This is the supervision layer out of [glovebox](https://github.com/AlexanderMattTurner/agent-glovebox), packaged on its own so you can run it over your existing isolation instead of adopting glovebox's sandbox.

If `pip install glovebox-monitor` reports no matching distribution, no release has reached PyPI yet. Install from the repository instead, which tracks the `main` branch:

```bash
pip install "glovebox-monitor @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=glovebox-monitor"
```

## What is in the box

The package is `monitorlib`, and it is stdlib-only. That is a deliberate constraint, not an accident: the monitor runs inside a guest image with no package index, so a dependency here would have to be installable there too.

- A **fail-closed** design. Every layer that judges a call denies on its own failure. The fail-mode setting structurally refuses `allow`, an unparsable model reply is a hard deny, and the circuit breaker denies rather than opening the gate.
- **Code-side legs the model cannot be argued out of**: a static scan of the proposed command, and a deterministic risk taxonomy that labels the action from its content alone.
- **Memory across calls.** The judge sees what the agent already did this trajectory, so a chain assembled one harmless-looking step at a time is visible.
- **Injection hardening.** Two independent parsers must agree on the verdict, and untrusted text is stripped of invisible and ANSI bytes before the judge reads it.

## Using it with Inspect

Register it as an Inspect approver. It composes with an approver you already have rather than replacing it — [the approver contract](https://github.com/AlexanderMattTurner/agent-glovebox/blob/main/docs/inspect-approver.md) covers the rules, including the edge where a policy list with no catch-all entry silently rejects every tool it forgot. <!-- # allow-dangling-path: the page lands with the approver work; this link resolves against main, not this branch -->

## What a scaffold-level deployment does not give you

glovebox's own deployment reads the sandbox's network decision log, so it can say what a call actually reached. An approver sees only what the agent proposed. A tool that opens its own connection, and any process the agent started earlier, are outside its view. Pair it with the egress gateway when you need that ground truth.
