Governance, Sold Separately

heypi’s headline feature is approvals. Its own approvals page contains the sentence that walks the headline back: approval does not make every tool call require approval. Tool confirmation does that. Out of the box, the only automatic gate is a bash command classifier that blocks destructive commands and pauses on risky ones. Every other tool runs ungated until an operator wires a policy by hand.

That is documented, not concealed. It also means a team that adopts heypi for its approvals is buying a kit, not a posture.

heypi joins the watchlist this window. It is a TypeScript framework for one agent a whole team uses in Slack, Discord and Telegram, with approvals, an audit record, sandboxed tools and encrypted secret handoff. What makes it worth the space is what it is built on. It pins Pi as a hard dependency, and Pi is the harness that has made a principle of refusing to govern: no permission popups, no plan mode, build your own confirmation flow. heypi is that confirmation flow, sold as a product. The agent loop is the commodity underneath. The authority around it is the thing you buy. A builder on the Flue side of the same problem replied to the launch: heypi looks awesome. love when great ideas converge. keep cooking@andrew_barba

The real defaults are the quiet ones

The landing page promises a multiplayer chat agent for your team with approvals, an audit trail, and sandboxed tools. The docs describe something more modest and more useful: governance primitives with conservative defaults, where the headline controls are things you assemble.

The conservatism lives where nobody demos it. The default runtime is an in-process bash interpreter over a virtual filesystem with the network off. The admin panel, which is also where the advertised audit trail lives, as typed trace events rather than a ledger, is off by default, binds to loopback, and hands out a one-time login URL that expires in five minutes. Memory is off. The docs say of the admin setting: never set it on a public host.

heypi is at its best when it states a limit. The secret handoff encrypts a credential in the browser so it never enters chat history or the model context, then tells you the secret rests as a readable file in the runtime workspace. The encryption protects the handoff, not the storage. It does not replay an in-flight turn after a crash, and says so. A Show HN commenter named the value: most frameworks forget the human-in-the-loop part, critical for anything with real side-effects. heypi remembers it, then leaves it switched off until you reach for the switch.

The 0.2.0-beta.0 tag (23 June) tightened things further. Webhooks are HTTPS by default, and a misplaced root-level approver block now fails at startup instead of silently not binding. It is a beta, heypi cuts no GitHub releases, only tags, and two dozen commits already sit on main past it.

One maintainer’s week

Adding heypi means depending on it. The night the beta shipped, its maintainer posted this:

He was releasing three projects at once. That is not a criticism of the work, which is good, and not a prediction about the project. It is the operator fact under a one-person dependency: the governance layer you are adopting is maintained by somebody with a finite week. Ask the same of every framework in this issue, including the ones with a company behind them.

The same two days, from the capability side

Not everything that shipped was about saying no. Hermes added a /learn command: feed it directories of any source material (code, API docs, manuals, PDFs, configs) and it distills a verifiable reusable skill@NousResearch The word “verifiable” is doing the work there, and the release note is its only evidence. A Paperclip fork launched selling the governance layer as an org chart: You stay the board; the agents ship the work, with proof@bartender_loopy

A relayed talk quote, attributed to an unnamed OpenAI engineer, claimed 90% of our engineers use Codex subagent harnesses + loops to ship code 5× faster@0xMovez. We hold no primary source and the number is not a finding. The prescription under it is the interesting part: give the agent a way to check its own output. That is where the governance argument lands too, reached by people who were not thinking about approvals.

heypi against its neighbours

Against Pi, heypi is the layer Pi told you to build, not a competitor. Against OpenClaw, which it was first described as a version of (Openclaw, but for teams), it trades a single-user gateway for a multiplayer one, with approver and admin identities scoped per chat adapter rather than per sender.

The comparison that changes a decision is eve. Both document their governance. heypi ships approvals off and disclaims crash replay. eve’s human-in-the-loop docs make approval gates and a pause-for-a-human tool first-class, and its durable runtime resumes the paused turn after a crash. heypi is an app you run on your own host; eve is an agent that lives on a managed runtime. If an in-flight turn must survive a crash, that difference decides it. The fuller comparison is in the heypi profile.

A boundary, withdrawn in public

Hermes cut no tag in these two days, but it held a governance argument in the open. On 22 June a commit on main stopped the dashboard auto-importing the Python backends of user-installed plugins, reserving backend routes for bundled ones. It was part of the security wave Protected on Paper covered. A plugin author found it on the 24th, tagged the lead, and wrote: Latest commits on Hermes break existing plugin contracts.@8bit64k_X

The lead replied within half an hour that it was a mistaken change being reverted, and why: The security boundary is not saved by this its saved by people not being stupid and exposing their dashboard insecurely to the internet.@Teknium

Set that against the record and it is a real position, not a shrug. The same wave answered a campaign that, by the project’s own commits, found exposed dashboards. His answer holds that line at the operator’s network, not in the plugin API, and keeps the extension contract whole. We hold no receipt for the revert inside the window; it is his statement. It is also the opposite of heypi’s bet. heypi sells the boundary. Hermes hands it back to you.

OpenHands patched on main, again

The one item on the rest of the watchlist an operator must act on is OpenHands’. Dependency fixes for CVE-2026-44727 in jupyter-server, CVE-2026-49458 in dompurify and three more, in msgpack, idna and bleach, landed on main on 23 June. No tag was cut. The only release is still 1.8.0, from 10 June. “OpenHands patched these CVEs” is true on the default branch and false in the binary most operators run, which is the gap Protected on Paper described a week ago.

Elsewhere the same gap held at lower stakes. Codex cut five 0.143.0 alpha tags while stable stayed at 0.142.0. Agent Zero put about nineteen more commits on its non-default ready branch, with no tag past v1.20.

One correction to the last issue. Protected on Paper said Flue‘s private-by-default run rewrite and the removal of flue logs sat in an Unreleased changelog section, not a tag. Both were in the beta tag 1.0.0-beta.3, dated 22 June. No stable carries them. This window added only a scoped @flue/react beta fix.

Provider notes

heypi (0.1.0 through 0.2.0-beta.0). New. Sound quiet defaults, headline controls left to the operator, newest fixes on main past a beta.

OpenHands (1.8.0). Another security batch that exists only on main.

Codex (stable 0.142.0). Alpha tags only.

Agent Zero (v1.20). Still staging on ready, still untagged.

Flue (@flue/react 1.0.0-beta.4). A scoped React fix.

Hermes Agent (v2026.6.19). No tag; a plugin-contract break on main, which its lead said was being reverted.

Claude Code, Gemini CLI, Pi, OpenClaw, Paperclip. No material change in the day. Last tags hold at 2.1.186, v0.47.0, v0.79.10, v2026.6.9 and v2026.618.0.

Somebody else’s refusal

A harness that refuses to govern points upward. A framework whose whole product is the governance layer ships its headline control switched off. Between them sits an operator who now buys the ability to say no separately from the thing that acts.

The argument reached past heypi the same day. Ashwin Gopinath, the day after Anthropic launched Claude Tag in Slack, called it useful and argued that the lock-in to worry about is context, not the model: Your company memory should be inspectable, permissioned, portable, and model-neutral.@ashwingop And Simon Willison, whose prompts in Claude Code for web mostly start by cloning a repo, showed what a refusal feels like from the receiving end. He reported that Claude Code for web just started saying "GitHub is blocked by egress policy"@simonw and asked whether it was a known issue. He had not written that policy.

Buying it separately is not obviously wrong. Specialisation usually beats one vendor doing everything badly. But it changes what you are purchasing. You are not buying a boundary. You are buying somebody else’s promise to hold one, kept on somebody else’s week.