google-gemini/gemini-cli merged commit bca5667 on June 15 to block path traversal during skill installation and uninstallation, adding tests for .., absolute-path names, unsafe subpaths, and sibling-directory deletion attempts.
Facts
- Gemini CLI commit 0f8a157 makes the A2A server yield when tools are still waiting for approval and routes task configuration through explicit trust handling.
- LangChain commit afff89a removes the
disallow_any_generics = falsemypy escape hatch and adjusts core message, prompt, and runnable types. - OpenAI Codex commit 46f1793 switches filesystem permission paths for the exec server to
PathUri, a stricter boundary representation in core session tooling.
Evidence
The common move is guardrail work: sanitize the folder a skill can write to, pause while tools need user approval, make generic typing explicit, and normalize permission paths.
Context
For builders and operators, these are the places agent systems fail quietly: a skill archive escaping its directory, a pending tool continuing as if approved, a permissive type alias hiding shape, or a permission path being parsed loosely.
Limits
The commits are independent and mostly infrastructure-level. They do not prove one shared safety architecture, but they show active projects pushing safety out of policy language and into code boundaries readers can inspect.