Documented changes
58 typed entries
Verified contributors
Credits being verified. Attribution coverage is in progress.
Attribution coverage
attribution in progress; history inventory partial.
Install
Scope
Guard v3.44.0a3 is a preview release published 2026-10-13. Upstream documents: Guard 3.44.0a3 is an opt-in prerelease cut from [`2f067ed`](https://github.com/hashgraph-online/hol-guard/commit/2f067ede9b9125836f7cf29ecb2fa2a7b7595b73). Stable installations remain on the stable channel. **18 commits • 18 merged pull requests • 2 contributors** since [Guard 3.44.0a2](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a2). Its comparison base is alpha/v3.44.0a2. It includes 18 verified contribution deliveries with public evidence links. Attribution for this release is being ve
Changes
Added
27- **guard**: Answer reviewed UserPromptSubmit hooks from the resident ([#4340](https://github.com/hashgraph-online/hol-guard/pull/4340)) Evidence for: **guard**: Answer reviewed UserPromptSubmit hooks from the resident ([#4340](https://github.com/hashgraph-online/hol-guard/pull/4340))
- `hook_direct` accepts `UserPromptSubmit` (and the daemon's prompt aliases). It answers a reviewed prompt that carries a receipt, for Codex and Claude Code in any posture. A Claude Code prompt outside Watch whose… Evidence for: `hook_direct` accepts `UserPromptSubmit` (and the daemon's prompt aliases). It answers a reviewed prompt that carries a receipt, for Codex and Claude Code in any posture. A Claude Code prompt outside Watch whose…
- The Codex and Claude Code bridges ask the resident for `UserPromptSubmit` as well as the tool events. A defer or an unreachable resident still takes the daemon path. Evidence for: The Codex and Claude Code bridges ask the resident for `UserPromptSubmit` as well as the tool events. A defer or an unreachable resident still takes the daemon path.
- The daemon drain records a drained prompt as its own path does: the decision receipt and, for Codex, the binding capture. It records no command activity or command-line observation, matching the daemon. Evidence for: The daemon drain records a drained prompt as its own path does: the decision receipt and, for Codex, the binding capture. It records no command activity or command-line observation, matching the daemon.
- **guard**: Answer warned PreToolUse allows from the resident ([#4347](https://github.com/hashgraph-online/hol-guard/pull/4347)) Evidence for: **guard**: Answer warned PreToolUse allows from the resident ([#4347](https://github.com/hashgraph-online/hol-guard/pull/4347))
- it asks for approval only on `review` and `require-reapproval` floors; Evidence for: it asks for approval only on `review` and `require-reapproval` floors;
- command policy repair returns early for an allowed command; Evidence for: command policy repair returns early for an allowed command;
- it returns the edge's harness response unchanged. Evidence for: it returns the edge's harness response unchanged.
- **guard**: Answer reviewed PostToolUse hooks from the resident ([#4337](https://github.com/hashgraph-online/hol-guard/pull/4337)) Evidence for: **guard**: Answer reviewed PostToolUse hooks from the resident ([#4337](https://github.com/hashgraph-online/hol-guard/pull/4337))
- `hook_direct` accepts `PostToolUse` (and the daemon's post-tool aliases) for both harnesses. It answers any reviewed result and keeps every other gate: unmanaged harness, binding completeness, home and workspace… Evidence for: `hook_direct` accepts `PostToolUse` (and the daemon's post-tool aliases) for both harnesses. It answers any reviewed result and keeps every other gate: unmanaged harness, binding completeness, home and workspace…
- Each queued evidence record now carries its event. The daemon drain records a post-tool answer as its own path does: the decision receipt, the Codex binding capture, and the post-tool command activity with the success… Evidence for: Each queued evidence record now carries its event. The daemon drain records a post-tool answer as its own path does: the decision receipt, the Codex binding capture, and the post-tool command activity with the success…
- The Codex and Claude Code bridges ask the resident for `PostToolUse` as well as `PreToolUse`. A defer or an unreachable resident still takes the daemon path. Evidence for: The Codex and Claude Code bridges ask the resident for `PostToolUse` as well as `PreToolUse`. A defer or an unreachable resident still takes the daemon path.
- **guard**: Let script-free npm installs with trimmed output continue without review ([#4338](https://github.com/hashgraph-online/hol-guard/pull/4338)) Evidence for: **guard**: Let script-free npm installs with trimmed output continue without review ([#4338](https://github.com/hashgraph-online/hol-guard/pull/4338))
- any number of `tail` or `head` filters with an optional line count (`-3`, `-n 5`); Evidence for: any number of `tail` or `head` filters with an optional line count (`-3`, `-n 5`);
- `grep` with flags from `-iEFvcnw` and one pattern. Evidence for: `grep` with flags from `-iEFvcnw` and one pattern.
- **guard**: Answer Codex pre-tool allows from the resident ([#4326](https://github.com/hashgraph-online/hol-guard/pull/4326)) Evidence for: **guard**: Answer Codex pre-tool allows from the resident ([#4326](https://github.com/hashgraph-online/hol-guard/pull/4326))
- **`hook_direct` operation.** A new resident request (feature `hook-direct-v1`) evaluates a Codex `PreToolUse` payload against the admitted snapshot through the existing edge evaluator. It answers only an unconditional… Evidence for: **`hook_direct` operation.** A new resident request (feature `hook-direct-v1`) evaluates a Codex `PreToolUse` payload against the admitted snapshot through the existing edge evaluator. It answers only an unconditional…
- **Daemon parity before evaluation.** The request is resolved the way the daemon resolves it: the event name rule, the workspace order (`exec_command` workdir, then `cwd`, then the query workspace) with the same… Evidence for: **Daemon parity before evaluation.** The request is resolved the way the daemon resolves it: the event name rule, the workspace order (`exec_command` workdir, then `cwd`, then the query workspace) with the same…
- **Daemon state in the binding.** The direct-lane binding now also carries the daemon's home directory, the per-harness postures and whether any custom command-line block rule exists. A direct answer requires a matching… Evidence for: **Daemon state in the binding.** The direct-lane binding now also carries the daemon's home directory, the per-harness postures and whether any custom command-line block rule exists. A direct answer requires a matching…
- **guard**: Let agents look up npm packages without a prompt ([#4333](https://github.com/hashgraph-online/hol-guard/pull/4333)) Evidence for: **guard**: Let agents look up npm packages without a prompt ([#4333](https://github.com/hashgraph-online/hol-guard/pull/4333))
- It is `npm view|info|show|v` with one plain registry spec (`zod`, `zod@^3`, `@types/node`) followed by field paths and optionally `--json`, or `npm ls|list` with package names and display flags (`--all`, `--json`… Evidence for: It is `npm view|info|show|v` with one plain registry spec (`zod`, `zod@^3`, `@types/node`) followed by field paths and optionally `--json`, or `npm ls|list` with package names and display flags (`--all`, `--json`…
- No `.npmrc` that npm could read changes where it fetches from, how it trusts the connection, which other config files it loads or where it writes, and none sends unscoped credentials. The check covers every ancestor of… Evidence for: No `.npmrc` that npm could read changes where it fetches from, how it trusts the connection, which other config files it loads or where it writes, and none sends unscoped credentials. The check covers every ancestor of…
- The stamped session environment carries no `npm_config_*` variable and none of `NODE_OPTIONS`, `NODE_PATH`, `NODE_EXTRA_CA_CERTS` or library preload variables. This is a new `PathContext` field computed the same way as… Evidence for: The stamped session environment carries no `npm_config_*` variable and none of `NODE_OPTIONS`, `NODE_PATH`, `NODE_EXTRA_CA_CERTS` or library preload variables. This is a new `PathContext` field computed the same way as…
- **guard**: Let npm installs that run no package code continue without review ([#4321](https://github.com/hashgraph-online/hol-guard/pull/4321)) Evidence for: **guard**: Let npm installs that run no package code continue without review ([#4321](https://github.com/hashgraph-online/hol-guard/pull/4321))
- npm is 11.9 or later and the command passes `--ignore-scripts --allow-git=none`. Lifecycle scripts are off, and git dependencies are refused. The second flag matters: with scripts off, npm before 11.9 still clones git… Evidence for: npm is 11.9 or later and the command passes `--ignore-scripts --allow-git=none`. Lifecycle scripts are off, and git dependencies are refused. The second flag matters: with scripts off, npm before 11.9 still clones git…
- Every target is a plain registry spec (`zod`, `zod@^3`, `[email protected]`, `zod@latest`) that resolves on the public registry and is not flagged by the existing package checks. Evidence for: Every target is a plain registry spec (`zod`, `zod@^3`, `[email protected]`, `zod@latest`) that resolves on the public registry and is not flagged by the existing package checks.
- The command uses only options that shape how the install is recorded (`-D`, `--save-exact`, `--no-audit`, ...). npm expands unambiguous abbreviations such as `--reg=`, so options are matched against a fixed list rather… Evidence for: The command uses only options that shape how the install is recorded (`-D`, `--save-exact`, `--no-audit`, ...). npm expands unambiguous abbreviations such as `--reg=`, so options are matched against a fixed list rather…
Fixed
12- **approvals**: Show inbox approvals of tool calls as the user's decision ([#4341](https://github.com/hashgraph-online/hol-guard/pull/4341)) Evidence for: **approvals**: Show inbox approvals of tool calls as the user's decision ([#4341](https://github.com/hashgraph-online/hol-guard/pull/4341))
- **guard**: Mark tool input cut to an excerpt in the action envelope ([#4342](https://github.com/hashgraph-online/hol-guard/pull/4342)) Evidence for: **guard**: Mark tool input cut to an excerpt in the action envelope ([#4342](https://github.com/hashgraph-online/hol-guard/pull/4342))
- **guard**: Let ordinary variables on build commands run ([#4328](https://github.com/hashgraph-online/hol-guard/pull/4328)) Evidence for: **guard**: Let ordinary variables on build commands run ([#4328](https://github.com/hashgraph-online/hol-guard/pull/4328))
- **guard**: Stop telling headless Oh My Pi agents to approve a stop that has no request ([#4339](https://github.com/hashgraph-online/hol-guard/pull/4339)) Evidence for: **guard**: Stop telling headless Oh My Pi agents to approve a stop that has no request ([#4339](https://github.com/hashgraph-online/hol-guard/pull/4339))
- **guard**: Stop blocking login status output that shows only a masked token ([#4343](https://github.com/hashgraph-online/hol-guard/pull/4343)) Evidence for: **guard**: Stop blocking login status output that shows only a masked token ([#4343](https://github.com/hashgraph-online/hol-guard/pull/4343))
- **guard**: Prove relative cd and profile temp writes on Windows ([#4332](https://github.com/hashgraph-online/hol-guard/pull/4332)) Evidence for: **guard**: Prove relative cd and profile temp writes on Windows ([#4332](https://github.com/hashgraph-online/hol-guard/pull/4332))
- **`cd src && ls`**: relative `cd` targets were refused outright on Windows. They now get the same proofs as on other platforms: Evidence for: **`cd src && ls`**: relative `cd` targets were refused outright on Windows. They now get the same proofs as on other platforms:
- CDPATH must be absent from the stamped environment, now matched case-insensitively; Evidence for: CDPATH must be absent from the stamped environment, now matched case-insensitively;
- **guard**: Stop asking before git init, git reads after a listing, and git status outside a repository ([#4329](https://github.com/hashgraph-online/hol-guard/pull/4329)) Evidence for: **guard**: Stop asking before git init, git reads after a listing, and git status outside a repository ([#4329](https://github.com/hashgraph-online/hol-guard/pull/4329))
- **guard**: Let contained pytest on macOS load packages installed with pip --user ([#4336](https://github.com/hashgraph-online/hol-guard/pull/4336)) Evidence for: **guard**: Let contained pytest on macOS load packages installed with pip --user ([#4336](https://github.com/hashgraph-online/hol-guard/pull/4336))
- the caller has neither set `PYTHONNOUSERSITE` nor moved the user base with `PYTHONUSERBASE`; Evidence for: the caller has neither set `PYTHONNOUSERSITE` nor moved the user base with `PYTHONUSERBASE`;
- `~/Library` and `~/Library/Python` under the account's home, taken from the user database rather than the caller's `HOME`, are real directories owned by the current user that no one else can write. Evidence for: `~/Library` and `~/Library/Python` under the account's home, taken from the user database rather than the caller's `HOME`, are real directories owned by the current user that no one else can write.
Other changes
19- Documented change: Guard 3.44.0a3 is an opt-in prerelease cut from [`2f067ed`](https://github.com/hashgraph-online/hol-guard/commit/2f067ede9b9125836f7cf29ecb2fa2a7b7595b73). Stable installations remain on the stable channel. **18 commits • 18 merged pull requests • 2 contributors** since [Guard 3.44.0a2](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a2). Evidence for: Documented change: Guard 3.44.0a3 is an opt-in prerelease cut from [`2f067ed`](https://github.com/hashgraph-online/hol-guard/commit/2f067ede9b9125836f7cf29ecb2fa2a7b7595b73). Stable installations remain on the stable channel. **18 commits • 18 merged pull requests • 2 contributors** since [Guard 3.44.0a2](https://github.com/hashgraph-online/hol-guard/releases/tag/alpha/v3.44.0a2).
- Merged pull request #4337: feat(guard): answer reviewed PostToolUse hooks from the resident (#4337) Evidence for: Merged pull request #4337: feat(guard): answer reviewed PostToolUse hooks from the resident (#4337)
- Merged pull request #4333: feat(guard): let agents look up npm packages without a prompt (#4333) Evidence for: Merged pull request #4333: feat(guard): let agents look up npm packages without a prompt (#4333)
- Merged pull request #4328: fix(guard): let ordinary variables on build commands run (#4328) Evidence for: Merged pull request #4328: fix(guard): let ordinary variables on build commands run (#4328)
- Merged pull request #4340: feat(guard): answer reviewed UserPromptSubmit hooks from the resident (#4340) Evidence for: Merged pull request #4340: feat(guard): answer reviewed UserPromptSubmit hooks from the resident (#4340)
- Merged pull request #4347: feat(guard): answer warned PreToolUse allows from the resident (#4347) Evidence for: Merged pull request #4347: feat(guard): answer warned PreToolUse allows from the resident (#4347)
- Merged pull request #4336: fix(guard): let contained pytest on macOS load packages installed with pip --user (#4336) Evidence for: Merged pull request #4336: fix(guard): let contained pytest on macOS load packages installed with pip --user (#4336)
- Merged pull request #4338: feat(guard): let script-free npm installs with trimmed output continue without review (#4338) Evidence for: Merged pull request #4338: feat(guard): let script-free npm installs with trimmed output continue without review (#4338)
- Merged pull request #4321: feat(guard): let npm installs that run no package code continue without review (#4321) Evidence for: Merged pull request #4321: feat(guard): let npm installs that run no package code continue without review (#4321)
- Merged pull request #4343: fix(guard): stop blocking login status output that shows only a masked token (#4343) Evidence for: Merged pull request #4343: fix(guard): stop blocking login status output that shows only a masked token (#4343)
- Merged pull request #4326: feat(guard): answer Codex pre-tool allows from the resident (#4326) Evidence for: Merged pull request #4326: feat(guard): answer Codex pre-tool allows from the resident (#4326)
- Merged pull request #4329: fix(guard): stop asking before git init, git reads after a listing, and git status outside a repository (#4329) Evidence for: Merged pull request #4329: fix(guard): stop asking before git init, git reads after a listing, and git status outside a repository (#4329)
- Merged pull request #4342: fix(guard): mark tool input cut to an excerpt in the action envelope (#4342) Evidence for: Merged pull request #4342: fix(guard): mark tool input cut to an excerpt in the action envelope (#4342)
- Merged pull request #4341: fix(approvals): show inbox approvals of tool calls as the user's decision (#4341) Evidence for: Merged pull request #4341: fix(approvals): show inbox approvals of tool calls as the user's decision (#4341)
- Merged pull request #4344: ci(gauntlet): run Guard's Linux workspace containment in full-task containers (#4344) Evidence for: Merged pull request #4344: ci(gauntlet): run Guard's Linux workspace containment in full-task containers (#4344)
- Merged pull request #4330: fix(gauntlet): keep a case's Guard observations when one row cannot be verified (#4330) Evidence for: Merged pull request #4330: fix(gauntlet): keep a case's Guard observations when one row cannot be verified (#4330)
- Merged pull request #4332: fix(guard): prove relative cd and profile temp writes on Windows (#4332) Evidence for: Merged pull request #4332: fix(guard): prove relative cd and profile temp writes on Windows (#4332)
- Merged pull request #4339: fix(guard): stop telling headless Oh My Pi agents to approve a stop that has no request (#4339) Evidence for: Merged pull request #4339: fix(guard): stop telling headless Oh My Pi agents to approve a stop that has no request (#4339)
- Merged pull request #4334: fix(guard): run contained pytest in a project that only has source and test modules (#4334) Evidence for: Merged pull request #4334: fix(guard): run contained pytest in a project that only has source and test modules (#4334)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.44.0a2
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Contributors
- @Vyeche
Implementation · 2 credits
- @zerocodefast
Implementation · 16 credits
Evidence ledger18 credits
- @VyecheSource for Vyeche
Implementation · Pull request author
- @VyecheSource for Vyeche
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author
- @zerocodefastSource for zerocodefast
Implementation · Pull request author