Glassbox v0.2.0

Glassbox 0.2.0

Glassbox now records what an agent does without custom integration code: a Claude Code hook turns file edits and shell commands into receipts, and a command-line tool lists, verifies, and undoes them. This is still alpha software for Linux.

Added

• Claude Code hook (glassbox hook claude-code) that records file edits with before and after text, new files, and shell commands
• CLI commands record, log, show, verify, head, export, rollback, and prune
• Rollback for file.create (moves the file to a private recovery directory) and file.delete (recreates it only where nothing exists)
• Encrypted diff stored with file receipts, shown by glassbox show --diff and, with serve --show-diffs, in the dashboard
• Signed snapshot retention: glassbox prune and serve --prune-older-than-days
• API paging and filters on /api/events, plus /api/events/{id}, /api/events/{id}/diff, /api/stats, /api/head, /api/export, and /api/config
• Dashboard server-side search and filters, session grouping, automatic refresh, whole-ledger metrics, and receipt metadata
• glassbox.client.GlassboxClient, a standard-library HTTP client
• Chain-head anchoring with glassbox head and glassbox verify --expect-head
• Release workflow that publishes to PyPI as glassbox-agent through trusted publishing

Changed

• Risk labels now depend on what an action touches. Shell commands are high, medium, or low by content rather than always high, and unrecognized actions are medium rather than low. Each receipt records a risk_reason
• Encrypted snapshots are stored as private files instead of database rows; existing ledgers are migrated when opened and still verify
• GET /api/events also returns total and next_before_id
• A receipt that was rolled back or pruned is no longer reported as reversible
• The package version is defined once, in src/glassbox/__init__.py

Security

• The receipt target is now redacted; previously a shell command line was stored as submitted
• Redaction covers GitHub, AWS, and Slack tokens, JWTs, private key blocks, URL credentials, and --password-style flags
• The glassbox agent name and the file.rollback and snapshot.prune actions are reserved, so integrations cannot forge them
• A single-writer lock prevents two processes from publishing the same ledger
• Rollback refuses a receipt recorded for a different workspace

Full changelog: v0.1.1...v0.2.0

Glassbox v0.1.1

Glassbox 0.1.1

Glassbox is now open source under the Apache License 2.0.

This public-readiness release preserves the independently reviewed Glassbox 0.1.0 security behavior while adding the policies, metadata, and automation needed for public development.

Added

• Apache-2.0 LICENSE and NOTICE
• SECURITY.md with GitHub private vulnerability-reporting guidance
• CONTRIBUTING.md, CHANGELOG.md, CODEOWNERS, issue forms, and a pull-request template
• GitHub Actions checks across Python 3.11, 3.12, and 3.13
• Locked Ruff, MyPy, pytest, and test-client development tools
• cryptography 48.0.1 or newer, excluding wheels affected by GHSA-537c-gmf6-5ccf
• Dependabot configuration for Python and GitHub Actions
• Package author, license, classifier, and project URL metadata

Verification

• 60/60 tests passed on Python 3.11, 3.12, and 3.13
• Ruff lint and format checks passed
• MyPy and compile checks passed
• uv lock --check, Twine, and check-wheel-contents passed
• Clean-installed wheel passed nine rollback/database/workspace security probes
• Wheel and source archive matched the release source
• Candidate public files produced zero detect-secrets findings

Install

python3 -m venv .venv
.venv/bin/pip install glassbox_agent-0.1.1-py3-none-any.whl
.venv/bin/glassbox demo
.venv/bin/glassbox serve

Verify downloads

Download all three release assets into one directory, then run:

sha256sum -c SHA256SUMS

Platform and durability notes

Glassbox 0.1.1 requires Linux and filesystem support for directory descriptors, O_TMPFILE, and renameat2(..., RENAME_EXCHANGE).

SQLite and an arbitrary workspace filesystem cannot share one crash-atomic transaction. A process or power failure in the filesystem-to-ledger interval can require manual reconciliation. Successful rollback intentionally retains private recovery directories containing displaced plaintext workspace content until an operator removes them.

Glassbox v0.1.0

Glassbox 0.1.0

Receipts and safe undo for AI agents.

Glassbox is a local-first receipt ledger and guarded rollback service for AI-agent actions. This initial release includes:

• Plain-language, recursively redacted action receipts
• Deterministic risk classification
• Tamper-evident HMAC receipt chaining and verification
• Encrypted rollback snapshots
• Guarded atomic rollback for eligible UTF-8 regular-file writes
• Workspace, target, ownership, mode, ACL, inode, and newer-work conflict checks
• Copy-on-write database publication and concurrent descriptor protection
• Loopback-only FastAPI service and self-contained browser dashboard
• Safe synthetic demo generation and the glassbox CLI

Install

python3 -m venv .venv
.venv/bin/pip install glassbox_agent-0.1.0-py3-none-any.whl
.venv/bin/glassbox demo
.venv/bin/glassbox serve

Verify downloads

Download all three release assets into one directory, then run:

sha256sum -c SHA256SUMS

Platform and durability notes

Glassbox 0.1.0 requires Linux and filesystem support for the facilities used by protected database publication and atomic rollback, including directory descriptors, O_TMPFILE, and renameat2(..., RENAME_EXCHANGE).

SQLite and arbitrary workspace filesystems cannot share one crash-atomic transaction. Glassbox compensates detected in-process failures, but a process or power failure in the filesystem-to-ledger interval can require manual reconciliation. Successful rollback intentionally retains private recovery directories containing displaced plaintext workspace content until an operator removes them.