Newer, Numbered Lower

On July 30 the OpenHands repository published a release and GitHub marked it Latest. It is v1.8.0. Three weeks earlier the same repository, on the same branch, published 1.11.0.

Both numbers are real, both releases are stable, and neither is a mistake. Comparing them by git rather than by name settles what happened: compare/1.11.0...v1.8.0 returns 903 commits ahead, zero behind. One line, moving forward, with a version number that went down.

The explanation is in the releases themselves. OpenHands archived a sibling project, Agent Canvas, and folded its release history into the main repository. Each migrated entry says so in its own words: "Migrated from https://github.com/OpenHands/agent-canvas/releases/tag/v1.6.1 to seed Agent Canvas release history in OpenHands/OpenHands. This release migration was performed by an AI agent (OpenHands) on behalf of the user." From v1.7.0 onward the releases are cut from OpenHands' own repository again, but on Agent Canvas's number series.

Nothing here is concealed and nobody was careless. A pull request in the same window disabled tag publish triggers precisely so the migration would not fire the release automation. It is consolidation, done deliberately and documented in public.

It still leaves an operator with a repository whose newest release sorts below its older one. Anything that orders versions rather than dates -- a package constraint, a Renovate rule, a pinned container tag, an internal check asking whether you are current -- reads 1.11.0 > 1.8.0 and concludes the newer release is a downgrade.

That is the window in one artifact. Every project here has a newest thing it has made and a newest thing you can install, and the interesting number is the distance between them. This week it closed in three places and opened in three others.

Three controls arrived where operators could reach them

The best news is a bug that no longer exists in a release you can install, and it is worth stating what it was.

Gemini CLI's a2a-server backend loaded a workspace's environment files before it evaluated whether the workspace was trusted. So a hostile repository could ship a .gemini/.env containing GEMINI_CLI_TRUST_WORKSPACE=true and, in the fix's own words, "self-validate their own untrusted workspace before trust is checked". The stated class is zero-click remote code execution. Opening the repository was enough.

It is the cleanest example this publication has recorded of a guard consulting the thing it is guarding against. The trust decision was read out of the directory whose trustworthiness was the question. The fix defers environment loading until after the trust check, ignores workspace-level .env files entirely when untrusted, and adds task-level isolation -- and it reached stable v0.53.0 on July 28.

Codex's network-authority work left alpha the next day, in stable 0.146.0: exec-server network policy callbacks, proxy policy propagated through auth routing and auth refreshes, filesystem sandbox entries that skip missing paths, shell approval keys as path URIs. Four of its items are Windows-specific sandbox work, which turns out to be a theme.

And Hermes tagged the guardrails. Last window this publication reported that v2026.7.20 flipped approvals to a classifier default while every control written to bound that change sat on main. Those controls are now in v2026.8.3: the consecutive-denial circuit breaker, the customisable smart_policy, the approval gate for docker and podman daemon-redirect commands.

Hermes's maintainer, who says I use it for 100% of all my work with Hermes Agent development@Teknium, is shipping fast enough that the release notes record roughly 2,789 commits on the default branch in ten days. That release also puts back something Hermes took away. In June it removed its default 600-second subagent wall-clock timeout in the same week it shipped fire-and-forget background subagents, leaving runaway detection to heartbeat staleness alone. v0.20.0 adds session-wide runaway-loop caps for web_search and delegate_task, credited in its notes as Claude Code-inspired. The limit is back, by a different mechanism, borrowed from a competitor.

And three stayed out of reach

OpenClaw's is the same fix this publication described last window: a symlink-then-.. path escaped the workspace boundary while assertSandboxPath returned success. It merged on July 27.

By ancestry it is contained in v2026.7.2-beta.5 and the two betas after it. It is not contained in the latest stable, v2026.7.1, which was published on July 13 and therefore predates the merge by a fortnight. No stable OpenClaw release shipped in this window at all.

So the fix did reach a channel, and the channel is beta. On stable the workspace path still is not a containment barrier, two windows after the bypass was recorded.

Paperclip put more than a hundred commits on its default branch and tagged nothing, which is now its established rhythm. One of them caps agent review rounds and escalates an exhausted review to the responsible human -- a good control, ending in a person rather than a silent retry, and not in any release.

The new source found its own gap in six days

Omnigent joins the watchlist this week as its fifteenth source and its first meta-harness: a layer that drives Claude Code, Codex, Cursor and Pi, shipping policies, spend caps and access controls on top of harnesses that have their own. It was added because that stacking is the hardest test of this publication's standing argument, and it did not take long to produce one.

The category is contested by the people inside it. Asked whether his own framework counted, Flue's maintainer said I wouldn’t consider eve or flue a “meta harness” in the same sense as omniagent / what it sounds like you’re trying to build.@FredKSchott -- better evidence that the boundary is real and unsettled than any definition this publication could write.

worktree_guard is, in the project's words, "the only write confinement for the unsandboxed implementer worker specs." It reasons in POSIX terms -- its own comment says backslashes are not valid in POSIX paths -- but it normalised with os.path, which on Windows is ntpath and rewrites forward slashes to backslashes. So normalized.startswith("/") was never true on a Windows runner and the absolute-path arm never ran.

/etc/passwd contains no backslash, so it cleared the backslash guard, became \etc\passwd, and returned ALLOW. So did paths into another worker's tree. The .. and ~ arms survived by coincidence, because ntpath happens to preserve both.

It was filed on August 1 with a platform-specific reproduction and fixed on August 3, with four ALLOW-to-DENY cases pinned by tests run on Windows 11. That is a good two days' work in the open, and the disclosure is better than the defect is bad.

It is also on main. v0.7.0 was tagged on July 27, six days before the fix, and is still the newest release. An operator installing the tag and running those worker specs on Windows does not have absolute-path confinement.

A cap that makes things cheaper is not a cap that stops

Omnigent's contract was written with a question at the top: are spend caps enforced before a call is made, or reconciled after it, on the grounds that a cap which reconciles is a report rather than a control. This window the code answered it, and the answer is more interesting than either option.

It enforces before, at two points -- reading the module at the tag, cost_budget gates at the request phase, "before the LLM turn, so text-only turns are budgeted too," and at the tool-call phase, "the point a native PreToolUse hook can block before the action runs." That is a control.

But max_cost_usd does not stop a session. The module is candid about it: the cap "forces a model downgrade," denying only while the session is on a model in the operator's expensive_models list, and "once the session has switched off an expensive model it is allowed again -- the budget becomes a 'downgrade gate,' not a hard stop."

Set max_cost_usd: 5.0 and you have not set a five-dollar ceiling. You have set the point at which the work continues more cheaply.

The part worth praising is the failure mode they did close. A model with no catalogue pricing never writes a cost to the session, which would score it at zero and let it run forever. The gate fails closed instead: when token usage is present and priced cost is absent, it denies and tells the operator to switch to a priced model. Most spend controls on this watchlist cannot show that much thought about their own blind spot.

Omnigent is making the same case in public, describing Built-ins like Session Risk Score and Session Cost Guard@omnigent_ai. That one is checkable and it checks out: risk_score.py ships in the v0.7.0 tag rather than sitting on main. A neighbouring claim is not checkable yet. The 0.7.0 announcement says Audio stays on your server@omnigent_ai for the new voice dictation, while the release notes describe the same transcription engine as offloadable to a remote worker. Both can be true and mean different things, and which one an operator gets is the part nobody has published.

A control you can only read about

Antigravity CLI 1.1.9 widened what a single approval covers. The changelog is one sentence: "a pattern approved at a prompt is recorded for the rest of the conversation, letting later commands that match it run without prompting again."

Several harnesses here behave that way and the design is reasonable; clicking approve forty times is its own kind of failure. What is specific to Antigravity is where the change landed.

Its public repository contains .github, CHANGELOG.md, README.md, a demo gif, and examples. No source. No license. GitHub detects no primary language. It is a changelog and an issue tracker in front of a closed binary, which Google has never claimed otherwise.

So that sentence is the entire published description of the new boundary, and what counts as a matching pattern cannot be established from anything you can read. This publication has been following the Gemini CLI succession since the June 18 shutdown, and the objection recorded then was that a tool built on six thousand community pull requests was replaced by something nobody outside Google can inspect. This is the first window in which the replacement changed a permission behaviour. The principle became a practical question, which is: what did your yes just cover?

Ten quiet days

Claude Code published nothing in this window.

Two independent surfaces agree. The documented changelog's newest entry is 2.1.220, dated July 25. The npm registry records the last publish of @anthropic-ai/claude-code as 2.1.220 at 2026-07-24T23:11:21Z, with dist-tags.latest still resolving to it. The five publishes before that were 2.1.216 on July 20, 2.1.217 on the 21st, 2.1.218 on the 22nd, and 2.1.219 and 2.1.220 both on the 24th.

A tool that had been shipping most days stopped for ten. Nothing in the public record says why, and this publication is not going to invent a reason. The operator consequence is small and worth stating anyway: 2.1.220 is still the newest build you can install, so 2.1.219's permission and sandbox fixes remain the current floor.

The team was not quiet, though. On August 3 a maintainer explained that it now copies your session into a new background session@lydiahallie, with the old in-session behaviour moving to /subtask -- documentation of something already shipped in 2.1.212 and later, rather than anything new. Elsewhere the lead was answering complaints with Actively working on improving all of these@bcherny.

And he was doing something else, which is the sharpest thing anyone said in this window about words:

…Please don’t attribute words to me that I did not say.…

Operators filled the quiet with their own reads. One asked whether the usage allowance had been cut, reporting that I was able to get $100 in the 5 hour limit but now it's like half that...@JohhanSantana. We could not establish that: Anthropic's published limits record no such change, and one person's account of their own allowance is not evidence of one. It is a fair picture of what ten quiet days do to the people paying for the thing, which is a different fact from what happened.

Breaking changes, before you upgrade

Pi v0.83.0 upgrades bundled TypeBox to 1.3.7 and removes Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options and Value.Mutate. Extensions using them must migrate (#7243).

Omnigent v0.7.0 removes omni server start in favour of omni server --background, and omni integration slack start in favour of omni integration slack --background.

OpenHands is a versioning break rather than an API one: pin by tag or digest, and do not let a version comparison decide whether you are current.

Provider notes

OpenHands shipped five stable releases in seven days, v1.6.1 through v1.8.0, and v1.7.0 moved WebSocket authentication out of the URL, where it would otherwise reach logs and referrers.

Hermes Agent tagged twice. The v0.19.1 rollup records the scale plainly: since July 20, "~2,789 commits, ~4,748 files changed, ~442,000 insertions, ~392,300 deletions" on main. v0.20.0 is where the governance work landed.

Codex carried heavy prerelease traffic alongside its stable -- two 0.146.0 alphas and seven 0.147.0 alphas between July 27 and August 3. Alpha is not a channel to recommend, and the stable is the one that matters this week. It also open-sourced a security scanner an operator can drop into CI, announced after the fact: but Hacker News found it before we had a chance to share it here@OpenAI.

Agent Zero shipped v2.8 with a stop button and a /stop API that cancels a running context without deleting it, reachable programmatically. Most authority work here constrains an agent before it acts; this is the ability to stop one that already is. v2.7 added project-scoped HTTP and SOCKS proxy settings for its Docker browser.

Pi shipped commands that print a live credential to stdout, for external clients that need one. Whether the agent's own shell can reach them without an approval is the question, and v0.83.0's notes do not answer it.

Gemini CLI shipped v0.53.0 and v0.53.1 stable and a v0.54.0 preview line, while nightlies ran daily throughout.

eve tagged more than a dozen times in the window, 0.27.9 through 0.29.5. Flue and heypi published no release. Paperclip published no release and more than a hundred commits.

Where the number stopped meaning anything

A version number is a promise about ordering. It says this one came after that one, so if you have that one, you are behind. Almost every tool an operator uses to stay current -- package resolvers, dependency bots, container tags, the internal script that asks whether the fleet is patched -- is built on that promise and nothing else.

This window, four projects broke it in four different ways. One published a Latest that sorts below its own predecessor. One left its newest security fix in a beta while stable stayed a fortnight behind. One tagged six days before fixing the confinement it had just shipped. One stopped publishing entirely and said nothing.

None of that is negligence, and three of them closed a gap they had been carrying for weeks. But it means the same thing each time: the number told you where you were, and now you have to go and look.