Two recent AI-agent releases address different parts of agent work: AgentOS adds host-set limits on what generated tools can access, while Local Operator can retrieve a remote peer’s saved transcript without starting that peer.
AgentOS v0.12.5. The TypeScript framework’s documentation describes an agent writing code for a new tool, running it in a sandbox, and having an LLM judge review the code and tests before the approved tool joins the session. The host must enable this code-execution mode; it is off by default. The release adds a host-configured ceiling on what these tools can access: named domains for network requests and chosen roots for file reads. With the ceiling, documented requests are limited to GET and HEAD, a 5 MB response and a 30-second timeout; each file read is capped at 1 MB. A host-side broker mediates granted calls and can record them, while the run handle ends them when the agent run ends. The project warns that Node’s vm module is not a security mechanism and that memory use is observed, not enforced. These controls are guardrails, not independent validation of isolation. AgentOS is licensed under Apache-2.0.
Local Operator v0.68.3. The October 7 release lets a remote read return the owner’s saved transcript even when the peer has not started; it starts nothing on the peer and does not restore a live session. The documented setup requires Python 3.12 or later and a provider login, API key or local model server. The software is MIT-licensed; provider access and any associated costs are separate.
Sources
- AgentOS v0.12.5 release; sandbox and capability documentation; release commit; README snapshot; Apache-2.0 license
- Local Operator v0.68.3 release; README snapshot; MIT license
- Image: “VS Code Screenshot.png” by Cycling2, CC0 1.0, via Wikimedia Commons. Illustrative coding screenshot; not either selected project.
