Agent libOS：一种受库操作系统启发的、用于长时间运行且能力可控的LLM智能体的运行时

摘要

大型语言模型（LLM）智能体正从请求-响应助手演变为长时间运行的软件Actor：它们在模型调用之间维护状态，分叉子任务，等待外部事件，请求人工授权，生成工具，并执行必须被恢复和审计的副作用。本文提出Agent libOS，一种受库操作系统启发的LLM智能体运行时基座。Agent libOS运行在传统宿主操作系统之上；它不实现硬件驱动、内核态隔离或POSIX兼容操作系统。相反，它将智能体视为一个AgentProcess：一种可调度执行主体，具有进程标识、父子关系、生命周期状态、从AgentImage派生的工具表、类型化对象内存、显式能力、人工队列、检查点、事件和审计记录。其核心设计规则是：工具是类似libc的封装，运行时原语构成权限边界。文件系统访问、对象访问、休眠、人工审批、JIT工具注册以及外部副作用均在原语边界处，基于显式能力和策略进行校验。我们描述了其设计、威胁模型、Python原型以及面向安全的评估。当前原型实现了异步调度、命名空间本地对象内存、运行时集成的人工审批、一次性权限授予、每个进程的工作目录、shell与镜像注册原语、基于libOS系统调用代理的Deno/TypeScript JIT工具、文件系统/对象桥接工具、可注入的资源提供者基座、确定性演示、真实模型冒烟脚本，以及截至撰写时的123项回归测试。Agent libOS并不致力于提升规划器的准确性，而是展示了一种运行时基座，在该基座中，长时间运行的LLM智能体可以被调度、授权、恢复和审计，而无需将工具分发作为信任边界。

English

Large language model (LLM) agents are evolving from request-response assistants into long-running software actors: they maintain state across model calls, fork subtasks, wait for external events, request human authority, generate tools, and perform side effects that must be resumed and audited. This paper presents Agent libOS, a library-OS-inspired runtime substrate for LLM agents. Agent libOS runs above a conventional host operating system; it does not implement hardware drivers, kernel-mode isolation, or a POSIX-compatible operating system. Instead, it treats an agent as an AgentProcess: a schedulable execution subject with process identity, parent-child lineage, lifecycle state, a tool table derived from an AgentImage, typed Object Memory, explicit capabilities, human queues, checkpoints, events, and audit records. Its central design rule is tools are libc-like wrappers; runtime primitives are the authority boundary. Filesystem access, object access, sleeps, human approval, JIT tool registration, and external side effects are checked at primitive boundaries under explicit capabilities and policy. We describe the design, threat model, Python prototype, and safety-oriented evaluation. The current prototype implements async scheduling, namespace-local Object Memory, runtime-integrated human approval, one-shot permission grants, per-process working directories, shell and image-registration primitives, Deno/TypeScript JIT tools over a libOS syscall broker, filesystem/object bridge tools, an injectable Resource Provider Substrate, deterministic demos, real-model smoke scripts, and 123 regression tests at the time of writing. Rather than improving planner accuracy, Agent libOS demonstrates a runtime substrate in which long-running LLM agents can be scheduled, authorized, resumed, and audited without treating tool dispatch as the trust boundary.