Patched for Whom

A coding agent is a machine for doing things you did not approve one at a time. The work of the last several months has been building the layer that decides which of those things it may do -- approvals, sandboxes, permission scopes, audit trails. This window that layer thickened almost everywhere at once. Hermes closed a path escape and a command-approval bypass. Claude Code sealed an MCP self-approval hole. Codex now gates PowerShell it cannot inspect. Gemini's open repo landed a path-traversal fix. Paperclip tagged budget caps and split one permission in two. eve capped how deep its subagents may recurse. The field is converging, independently, on the same class of fix: closing the gaps where an agent's own inputs could escalate past the boundary -- a model-chosen ID, an injected command, a self-approved config, a runaway subagent.

And then it split on who gets the fix. That is the story of the week, and it is sharper than the merged-versus-shipped gap that ran through the last three digests. The gap is no longer just when a fix ships; it is to which channel, and the channel now differs per provider. OpenHands shipped its dependency-CVE batch to its cloud tags and left the open-source line frozen. Hermes put an entire wave on main and tagged none of it; Gemini pushed one patch to stable and held the newer ones back; Codex patched stable and kept its substance in alpha. Same wave, four different answers to the question an operator actually has: is the fix in the thing I run?

The clearest case of the split is not a version number. It is a discontinuation.

Google retired the CLI you could read

On June 18, 2026, Google stopped serving requests to consumer Gemini CLI -- Google AI Pro and Ultra, free individual Code Assist, and new GitHub-organization installs. Enterprise Code Assist kept access. The open-source gemini-cli repository stays Apache-2.0 and enterprise-serving. The consumer path is now Antigravity CLI, the agy binary: a closed-source Go rewrite.

We have tracked this succession for three windows -- the every-session upgrade banner, the agy migration funnel, a note that Gemini CLI "may be entering a managed succession." We under-called it. By the time Protected on Paper closed on June 23, the consumer shutdown had already happened on the 18th, and we still wrote it as prospective. The record moves forward: the retirement is executed, and it is tiered -- consumer dark, enterprise kept, the open repo shipping on.

The lead is the trade it forces, not the shutdown. Gemini CLI was open: an approval rule or a sandbox boundary was, in principle, readable. Antigravity is not. The governance is real, and in a single release train it moved in both directions at once. Version 1.0.13 (June 27) hardened command permissions -- "Always Approve" rule matching is now strict and non-regex by default, closing a class of over-broad approve rules. Three days later, 1.0.14 (June 30) loosened them, adding an "always proceeds" mode that auto-approves a subagent's artifacts -- work the parent flow never confirmed. Both changes are quoted from a changelog. Neither can be checked against the code, because there is no code to check. For the tier that just got migrated, the authority layer did not weaken or strengthen. It became unauditable. The new Antigravity profile holds the full read; the Gemini CLI profile holds the other side.

The same fix, four channels

The item an operator must act on is OpenHands'. Last window's unreleased dependency-CVE batch reached tags this window -- but only on the cloud channel: cloud-1.39.0 (June 24) and cloud-1.40.0 (June 26). The open-source line got no new tag; the newest non-cloud release is still 1.8.0 from June 10. A fresh authlib CVE -- an unauthenticated open redirect in its OIDC flow, the kind used to bounce a victim through a trusted domain into a phishing page -- already sits on main (commit e6fe505) after cloud-1.40.0, untagged. So a managed OpenHands Cloud tenant is patched; a self-hoster pinned to the 1.8.0 tag is not, and has no fixed OSS tag to move to. Merged-versus-shipped became cloud-versus-self-host: a billing boundary.

Hermes ran the other extreme: everything, nowhere. A path-traversal fix for model-supplied tool-call IDs that could escape the tool-result directory, a command-approval-bypass close, and secret redaction in approval prompts all landed on main. The bypass was the pointed one: GNU long-flag abbreviations of chown --recursive and git push --force had been slipping past the guard. The newest tag is still v2026.6.19, so if you run it, a rule you believed blocked chown --recursive can be beaten by typing --rec.

Gemini's OSS repo split within itself: the skill path-traversal fix, stranded in preview for two windows, reached stable in v0.49.0 (June 25), while newer @file path hardening (commit b5fc06e) stayed on main. And Codex cut four stable 0.142.x patches while 0.143.0 held alpha-only through alpha.31 -- the OTEL and Codex Apps MCP work is real, and it shipped to no one.

Where the hardening did reach the operator

The counter-current is that where controls did ship stable, they got more specific and better-aimed.

Claude Code 2.1.196 is a security release worth the upgrade: claude mcp list/get no longer spawn .mcp.json servers that a repository self-approves -- closing a path where merely inspecting MCP config in an untrusted repo could launch a repo-declared server -- and Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host. Codex 0.142.2 gates PowerShell whose AST regions the classifier cannot inspect behind approval rather than running it, and switches MCP tool discovery to tool-search by default. Paperclip v2026.626.0 finally tagged 128 commits of master-only control plane: hard daily run-count and cost ceilings enforced before an adapter runs, and a skills:create permission split out from agents:create. OpenClaw shipped /fast auto and approval-tool hardening to stable, with a channel-owner-only approval-scope fix still on main.

The quiet story, and the counterexample

Two threads run under all this. The first: Sonnet 5 propagated in a week. Claude Code 2.1.197 made it the default with native 1M-token context, and Pi 0.80.3 added support the same week -- a new frontier model becoming a default and a cross-harness option within days. If you pin models, that default changed under you.

The second cuts against everything above. eve -- durability-first, human-in-the-loop-first -- spent the window making its governance more first-class, not less: it repaired its HITL approval-resume contract so a plain "approve" reply resolves a pending tool approval, and capped recursive subagent delegation at depth three with model-visible guards. Where the self-hostable harnesses shipped their governance fixes to main-but-not-tagged, the platform-hosted one shipped containment to its runtime. The axis from Governance, Sold Separately holds: govern-it-yourself-on-your-host versus govern-it-durably-on-a-platform. This window, the platform side was the one whose controls you could actually run.

Provider notes

Antigravity CLI (1.0.12-1.0.14) joins the watchlist as the consumer successor to Gemini CLI: closed-source Go, shipping a rapid stable train that hardened approve-rule matching (1.0.13) and added subagent auto-approval (1.0.14). The governance case and the closed-source-verifiability case in one entry.

Gemini CLI (stable v0.49.0) is now the tiered-retirement story: consumer service dark since June 18, enterprise retained, OSS repo active -- shipping the skill path-traversal fix to stable and a breaking coreTools -> tools.core rename.

OpenHands (OSS 1.8.0; cloud-1.40.0) shipped its CVE batch cloud-only; the OSS line is frozen and a new authlib CVE sits untagged on main.

Hermes Agent (v2026.6.19) landed a full slate of security fixes -- path escape, approval-bypass, secret redaction -- entirely on main, tagged nothing.

Claude Code (2.1.191-2.1.197) closed the MCP self-approval hole and Remote Control host-binding (2.1.196), routed all shell through the auto-mode classifier via autoMode.classifyAllShell (2.1.193), and made Sonnet 5 the default (2.1.197).

Codex (stable 0.142.4; 0.143.0 alpha.31) patched stable four times and gated uninspectable PowerShell; 0.143.0 stayed alpha.

Paperclip (v2026.626.0) tagged its master-only control plane: budget caps, skills:create split, cross-company auth hardening.

Pi (v0.80.3) added Sonnet 5 support and read-only RPC session inspection for external orchestrators.

Agent Zero (v2.0/v2.1) tagged its ready-branch backlog: Responses API as the default transport, and a LiteLLM bump past CVE-2026-42271 -- LiteLLM's MCP-preview command injection (CVSS 8.8), which researchers chained to unauthenticated RCE and exploited in the wild, and which can leak every model-provider key the proxy holds. Below v2.0, upgrade.

OpenClaw (v2026.6.11) shipped /fast auto and approval-tool hardening; a permission-boundary fix waits on main.

eve (0.17.1) repaired HITL approval-resume and capped subagent depth -- the governance-first foil.

Flue (Tier 2; 1.0.0-beta.9) iterated durability primitives on the preview line (append-only canonical stream, durable data parts). heypi had no material in-window change; its 0.2.0 line held at beta.

What to try

• OpenHands: determine whether you run Cloud or the OSS 1.8.0 tag. On Cloud you have the CVE batch; on the tag you do not, with no OSS tag to move to -- decide whether to track main or accept the exposure.
• Claude Code: upgrade to 2.1.196+ and re-audit MCP trust on any untrusted-repo workflow; confirm the new Remote Control base-URL binding matches your setup.
• Gemini CLI (OSS): upgrade to v0.49.0 and migrate coreTools -> tools.core. If you were a consumer, your migration is to Antigravity, not a version bump.
• Paperclip: wire the daily run/cost ceilings and adopt the skills:create permission split.
• Everyone on Claude Code or Pi: check whether you are now on Sonnet 5 by default, and pin explicitly if cost or behavior matters.

What remains uncertain

• Antigravity's enforcement is unverifiable by inspection. Closed source means its approval and sandbox claims rest on a changelog, not readable code. Treat a closed governance guarantee as unconfirmed until a local probe says otherwise.
• The OpenHands CVE resolutions. The fixes are verified present on the cloud tags and main; the individual advisories were not independently confirmed, and there is no fixed OSS tag.
• The open gemini-cli repo's future. It shipped actively this window, but Google said nothing about maintaining it long-term now that the consumer service is gone.
• Whether the channel split is structural. Four providers this window put the patch on a different channel than the binary an operator runs. If that is the steady state, posture depends entirely on the channel -- and naming it every week is the work.

Revised 2026-07-02 (artifact_version 2): operator-brief thesis compressed to the house standfirst standard. Body, claims, and receipts unchanged.