Release notes

HOL Guard v3.46.0a1

Preview

Published October 15, 2026Original GitHub release for alpha/v3.46.0a1

Documented changes

200 typed entries

Verified contributors

Credits being verified. Attribution coverage is in progress.

Attribution coverage

attribution in progress; history inventory partial.

Install

Current installation guide

Scope

Guard v3.46.0a1 is a preview release published 2026-10-15. Upstream documents: Guard 3.46.0a1 is an opt-in prerelease cut from 3841b78. Stable installations remain on the stable channel. 35 commits • 32 merged pull requests • 4 contributors since Guard 3.45.0. Its comparison base is alpha/v3.44.0a11. It includes 176 verified contribution deliveries with public evidence links. Attribution for this release is being verified.

Added

guard-policy: Author, test and explain policies from the command line (#4716) Evidence for this change
extensions: Add MusicContext publisher listing (#3750) Evidence for this change
contributors: AAGAM17 (GitHub ID 69311837) as author of #3683. Evidence for this change
maintainerGithubIds: ["69311837"], the account that authored #3683 and maintains MusicContext upstream. This is the authority-bearing change for review. Evidence for this change
originalContributions: #3683. upstream: the MusicContext repository. Evidence for this change
extensions: Protect DigitalOcean doctl operations and reproduce real false-positive shapes in the Gauntlet (#4694) Evidence for this change
guard: Write dashboard settings through the native runtime (#4701) Evidence for this change
Rust reads config.toml with the same stable-read checks as guard-config-load, validates the payload, composes the managed policy, applies the posture and per-harness changes, and renders the file byte for byte as… Evidence for this change
Python keeps the approval gate, managed-policy resolution, the reload through guard-config-load, the policy-mutation notice and the posture timeline events. The native call returns the posture state before the write… Evidence for this change
Removed: the Python TOML writer and coercion helpers in config.py, config_preset_support.py, the harness posture patch helpers, the presentation write coercion, and the Python config file reader that nothing calls… Evidence for this change
guard: Prepare contained Linux launches in the native runtime (#4692) Evidence for this change
rust/crates/guard-runtime/src/restricted_linux_launch/ adds discovery, mapping records and copies, mounts, Landlock, capabilities, socket filter, admission and the launch pipeline. restricted_pytest_op routes the… Evidence for this change
guard-command's mapping evidence accepts optional dependency_candidates: the filenames discovery actually observed, including symlink aliases. Bare DT_NEEDED lookups are limited to those names, then pass the same… Evidence for this change
restricted_linux_{elf,entry,landlock,mapping_plan,mappings,namespace,paths}.py are now thin calls through native_restricted_linux.py. Native unavailability raises LinuxContainmentUnavailableError, so the launch… Evidence for this change
runtime: Answer more hooks in the native bridges instead of running Python (#4689) Evidence for this change

Fixed

guard: Keep rg and grep reviewed when they can reach hidden secrets (#4721) Evidence for this change
A ! rule in an ignore file rg honors. !.env in a .ignore, .gitignore, .rgignore, .git/info/exclude or the global Git excludes file makes rg -n foo print .env lines. Evidence for this change
A file type whose globs name dotfiles. rg -t sh includes .env, .bashrc and .profile; ruby includes .irbrc. Evidence for this change
An extra ignore file passed with --ignore-file, which can carry its own ! rules. Evidence for this change
guard: Make native lib tests platform-aware and judge NTFS stream spellings on Windows (#4723) Evidence for this change
Native command lib tests follow the host platform. POSIX-only shapes (2>/dev/null, $(pwd) chains, hooks-path writes, routine directory positives) run on unix only. Windows gets its own path and tokenization… Evidence for this change
The content sensitivity test deadline is 300 s so slow nightly runners do not time out. Evidence for this change
On Windows, a file name containing : names an NTFS data stream. When a stat of such a spelling fails, Guard now reads the target as the OMP selector it spells, as it already does on Unix. main.rs:1-5:raw and… Evidence for this change
guard: Clear Windows false positives for drive paths and stderr redirects (#4713) Evidence for this change
guard: Let more routine Oh My Pi session work through (#4718) Evidence for this change
A TMPDIR output folder with a /tmp fallback. An agent ran a repository script with OUT_DIR="${TMPDIR:-/tmp}/report" bun scripts/report.ts --json. Guard already runs $TMPDIR and ${TMPDIR} settings in the… Evidence for this change
any other fallback, such as a host path or /tmpx; Evidence for this change
guard: Stop flagging credential identifiers in source output as secrets (#4706) Evidence for this change
guard: Run redirected package commands correctly on macOS (#4717) Evidence for this change
guard: Let routine Oh My Pi session work through and review language server edits (#4695) Evidence for this change
ci: Get the nightly native workflow building on macOS and Windows (#4710) Evidence for this change
guard: Stop review reasons from promising an approval that may not help (#4686) Evidence for this change
hooks: Answer Cursor and Grok hooks natively from older installed clients (#4696) Evidence for this change
guard: Quiet temp-root checkouts, test-vector searches and AskUserQuestion prompts (#4669) Evidence for this change
release: Finish a stable release whose plugin-scanner upload stopped partway (#4674) Evidence for this change

Other changes

165

Documented change: Guard 3.46.0a1 is an opt-in prerelease cut from 3841b78. Stable installations remain on the stable channel. 35 commits • 32 merged pull requests • 4 contributors since Guard 3.45.0. Evidence for this change
runtime: Run package scripts in a workspace subdirectory in the native sink (#4722) Evidence for this change
guard: Write approval requests through the native runtime (#4705) Evidence for this change
runtime: Answer reviews natively in homes with custom CLI rules when the command launches no local CLI (#4719) Evidence for this change
runtime: Run piped, stderr-folded and status-reading workspace commands in the native sink (#4720) Evidence for this change
Merged pull request #4641: ci: run Python coverage in 64 shards so PR checks stop queueing for hours (#4641) Evidence for this change
Merged pull request #4599: perf(claude): answer no-op Claude session starts from the native runtime (#4599) Evidence for this change
Direct commit 342020a03832: Merge main into fix/guard-review-reason-without-approval-advice Evidence for this change
Merged pull request #4706: fix(guard): stop flagging credential identifiers in source output as secrets (#4706) Evidence for this change
Merged pull request #4543: fix(guard): allow saving read output to a workspace scratch file (#4543) Evidence for this change
Merged pull request #4669: fix(guard): quiet temp-root checkouts, test-vector searches and AskUserQuestion prompts (#4669) Evidence for this change
Merged pull request #4552: fix(guard): treat tr and base64 as stdin filters after a proven read (#4552) Evidence for this change
Merged pull request #4594: fix(guard): let Codex apply_patch edit sibling projects in the home directory (#4594) Evidence for this change
Merged pull request #4562: fix(guard): treat git remote get-url as a read-only Git command (#4562) Evidence for this change
Merged pull request #4574: fix(guard): let proven Git commands share a chain with mkdir (#4574) Evidence for this change
Direct commit bba6a356ba2d: feat(mcp): decide relayed shell and command calls that install no package Evidence for this change
Merged pull request #3750: feat(extensions): add MusicContext publisher listing (#3750) Evidence for this change
Merged pull request #4648: fix(guard): let an Oh My Pi grep take a file line range (#4648) Evidence for this change
Merged pull request #4652: fix(guard): let the workspace sandbox list the directories above it (#4652) Evidence for this change
Merged pull request #4584: fix(guard): review a line-numbered source slice by the lines it shows (#4584) Evidence for this change
Merged pull request #4697: perf(mcp-relay): keep sessions native while the direct lane warms up (#4697) Evidence for this change
Merged pull request #4715: ci(size): reuse exact shipped runtime builds Evidence for this change
Merged pull request #4559: fix(guard): prove semicolon path lists and brace globs in Oh My Pi search tools (#4559) Evidence for this change
Merged pull request #4539: chore(scope): count hook health, install checks and edge-event builders as control plane (#4539) Evidence for this change
Merged pull request #4582: fix(guard): stop flagging credential references in source as secrets (#4582) Evidence for this change
Merged pull request #4583: feat(guard): detect Claude Code artifacts in the native resident (#4583) Evidence for this change
Merged pull request #4635: fix(guard): review an anchored source slice one run of lines at a time (#4635) Evidence for this change
Direct commit 558212cee5bc: fix(guard): detect rustfmt child modules across Rust comments Evidence for this change
Merged pull request #4541: fix(guard): release Oh My Pi eval output for proved shell calls (#4541) Evidence for this change
Merged pull request #4646: fix(guard): name the sensitive file behind an Oh My Pi search review (#4646) Evidence for this change
Merged pull request #4623: fix(guard): name the no-script install when the package script setting holds an install (#4623) Evidence for this change
Merged pull request #4692: feat(guard): prepare contained Linux launches in the native runtime (#4692) Evidence for this change
Merged pull request #4596: refactor(claude): build managed Claude hook groups from one shared contract (#4596) Evidence for this change
Merged pull request #4615: feat(mcp-relay): decide observe-mode sessions natively (#4615) Evidence for this change
Merged pull request #4546: feat(mcp): decide relayed MCP tool calls in the resident with one round trip (#4546) Evidence for this change
Merged pull request #4568: fix(guard): review shell reads of secrets reached through a symbolic link (#4568) Evidence for this change
Merged pull request #4589: fix(guard): allow curl to print response headers (#4589) Evidence for this change
Merged pull request #4560: refactor(guard): load the supply-chain keyring without the bundle models (#4560) Evidence for this change
Merged pull request #4653: fix(guard): treat clearing Git commit identity as an inert env prefix (#4653) Evidence for this change
Merged pull request #4612: feat(mcp-relay): advertise the native MCP relay on Unix (#4612) Evidence for this change
Merged pull request #4716: feat(guard-policy): author, test and explain policies from the command line (#4716) Evidence for this change
Direct commit 248469933453: feat(guard): select the native MCP relay when the runtime advertises it Evidence for this change
Merged pull request #4550: refactor(guard): remove unreferenced runtime helpers (#4550) Evidence for this change
Merged pull request #4577: fix(guard): judge work in a linked worktree beside the checkout (#4577) Evidence for this change
Merged pull request #4556: feat(mcp): decide relayed calls with saved policy decisions in the resident (#4556) Evidence for this change
Merged pull request #4702: perf(guard): keep saved lookups native when a cached policy bundle has no rows to match (#4702) Evidence for this change
Merged pull request #4544: fix(guard): keep agent plan documents readable outside the workspace (#4544) Evidence for this change
Merged pull request #4621: fix(guard): say when an Oh My Pi grep list names a missing path (#4621) Evidence for this change
Merged pull request #4703: perf(guard): resolve a hook's saved decision in one resident call (#4703) Evidence for this change
Merged pull request #4534: fix(guard): let contained test runs pipe output through grep (#4534) Evidence for this change
Merged pull request #4571: feat(mcp-relay): bind the direct lane before a relay session starts (#4571) Evidence for this change
Merged pull request #4721: fix(guard): keep rg and grep reviewed when they can reach hidden secrets (#4721) Evidence for this change
Direct commit 26350d575739: test(pretool): recognize benign subshell while rejecting dangerous grouped commands Evidence for this change
Merged pull request #4588: fix(guard): allow bounded kubectl logs reads and opening the Guard dashboard (#4588) Evidence for this change
Merged pull request #4713: fix(guard): clear Windows false positives for drive paths and stderr redirects (#4713) Evidence for this change
Merged pull request #4700: perf(guard): answer saved lookups natively when the store holds cloud policy rows (#4700) Evidence for this change
Merged pull request #4592: fix(guard): run contained Python tests from an active virtual environment (#4592) Evidence for this change
Merged pull request #4572: feat(copilot): move Copilot config discovery into the native resident (#4572) Evidence for this change
Merged pull request #4549: ci(gauntlet): build the qualify wheel automatically on release PR pushes (#4549) Evidence for this change
Merged pull request #4634: fix(guard): honor refused retries and avoid impossible approval waits (#4634) Evidence for this change
Merged pull request #4632: fix(guard): tell agents how to narrow a held search (#4632) Evidence for this change
Merged pull request #4637: fix(guard): point a held omp eval to the bash tool (#4637) Evidence for this change
Merged pull request #4617: feat(cursor): post deferred Cursor hooks to the Guard daemon natively (#4617) Evidence for this change
Merged pull request #4565: fix(guard): judge Oh My Pi bash commands in their directory and explain missing paths (#4565) Evidence for this change
Merged pull request #4655: fix(guard): stop flagging credential field copies as secrets (#4655) Evidence for this change
Direct commit 7798804f25a3: fix(discovery): repair fused statement in server.py and remaining clippy findings Evidence for this change
Merged pull request #4619: test(guard): pin how Oh My Pi classifies a copied worktree .git file (#4619) Evidence for this change
Merged pull request #4719: perf(runtime): answer reviews natively in homes with custom CLI rules when the command launches no local CLI (#4719) Evidence for this change
Merged pull request #4535: chore(scope): count dashboard, probe, audit and update-only helpers as control plane (#4535) Evidence for this change
Merged pull request #4595: perf(guard): count how direct hooks are answered or deferred, for diagnostics (#4595) Evidence for this change
Merged pull request #4709: perf(runtime): run workspace commands that cd into a subdirectory in the native sink (#4709) Evidence for this change
Merged pull request #4580: fix(guard): publish the current policy-integrity state with the direct lane (#4580) Evidence for this change
Merged pull request #4649: fix(guard): keep contained-test requests for backgrounded OMP calls (#4649) Evidence for this change
Merged pull request #4624: fix(guard): stop treating stand-in fixture credentials as secret output (#4624) Evidence for this change
Merged pull request #4598: fix(guard): keep the worktree commit proof after removing its dependency link (#4598) Evidence for this change
Merged pull request #4551: fix(guard): review writes into a repository's configured hooks directory (#4551) Evidence for this change
Merged pull request #4578: fix(guard): prove publish chains behind a TLS proxy and identity-only git -c commits (#4578) Evidence for this change
Merged pull request #4250: fix(guard): scope Protect-screen per-app protection to apps Guard manages (#4250) Evidence for this change
Merged pull request #4620: fix(guard): let agents start existing Docker containers without review (#4620) Evidence for this change
Merged pull request #4704: perf(runtime): run workspace-contained shell commands in the native runtime (#4704) Evidence for this change
Merged pull request #4276: chore(release): 3.44.0 (#4276) Evidence for this change
Direct commit 96d4d4a5f10e: fix(guard): require loopback host for pg_isready read proof Evidence for this change
Merged pull request #4567: fix(gauntlet): repair the Claude Code and Codex lanes on macOS and accept Oh My Pi's default task agent (#4567) Evidence for this change
Merged pull request #4631: perf(cli): show hol-guard help without loading the Guard runtime (#4631) Evidence for this change
Merged pull request #4564: feat(guard): prepare native MCP relay installer selection and measure relay deferrals (#4564) Evidence for this change
Merged pull request #4686: fix(guard): stop review reasons from promising an approval that may not help (#4686) Evidence for this change
Merged pull request #4640: fix(guard): prove routine Oh My Pi hashline edits (#4640) Evidence for this change
Merged pull request #4542: fix(guard): allow listing a sibling checkout's tool bin directory and screen autostart worktree targets (#4542) Evidence for this change
Merged pull request #4618: fix(guard): run a contained test in the directory Oh My Pi's bash names (#4618) Evidence for this change
Merged pull request #4718: fix(guard): let more routine Oh My Pi session work through (#4718) Evidence for this change
Merged pull request #4601: fix(guard): prove read fallbacks, scratch log captures, glob copies and home worktrees (#4601) Evidence for this change
Merged pull request #4509: fix(guard): prove process probes natively so outside reads can chain with them (#4509) Evidence for this change
Merged pull request #4610: feat(guard): detect OpenClaw gateway, channels, MCP servers and skills in the resident (#4610) Evidence for this change
Direct commit e16f8692843e: fix(guard): publish the current policy-integrity state with the direct lane Evidence for this change
Merged pull request #4710: fix(ci): get the nightly native workflow building on macOS and Windows (#4710) Evidence for this change
Merged pull request #4547: fix(guard): allow copying scratch checkout files into the workspace (#4547) Evidence for this change
Merged pull request #4689: feat(runtime): answer more hooks in the native bridges instead of running Python (#4689) Evidence for this change
Merged pull request #4630: fix(guard): give bridged OMP eval shell calls their standalone containment (#4630) Evidence for this change
Merged pull request #4722: perf(runtime): run package scripts in a workspace subdirectory in the native sink (#4722) Evidence for this change
Merged pull request #4558: fix(runtime): bind the Claude hook bridge to Windows Guard homes (#4558) Evidence for this change
Merged pull request #4698: perf(policy): verify the current snapshot once instead of on every request (#4698) Evidence for this change
Merged pull request #4712: ci(tests): speed wheel builds and isolate corpus timing Evidence for this change
Merged pull request #4579: feat(relay): answer saved workspace lookups for Git checkouts in the native relay (#4579) Evidence for this change
Merged pull request #4554: fix(guard): let an explicit extension Allow take precedence over native command review (#4554) Evidence for this change
Merged pull request #4614: fix(pi): run routine test and build commands contained instead of asking (#4614) Evidence for this change
Merged pull request #4656: fix(guard): allow git -C reads in the checkout a worktree add creates (#4656) Evidence for this change
Merged pull request #4563: perf(runtime): embed command data compressed and hash rule sources at build time (#4563) Evidence for this change
Merged pull request #4613: fix(guard): pass the host's error through when a read names a missing file (#4613) Evidence for this change
Merged pull request #4694: feat(extensions): protect DigitalOcean doctl operations and reproduce real false-positive shapes in the Gauntlet (#4694) Evidence for this change
Merged pull request #4581: feat(hook): answer saved exact-action decisions in Git checkouts with their portable project memory (#4581) Evidence for this change
Merged pull request #4717: fix(guard): run redirected package commands correctly on macOS (#4717) Evidence for this change
Merged pull request #4593: perf(guard): answer hooks run from a plain project subdirectory without starting Python (#4593) Evidence for this change
Merged pull request #4705: perf(guard): write approval requests through the native runtime (#4705) Evidence for this change
Merged pull request #4600: feat(guard): detect Devin artifacts in the resident (#4600) Evidence for this change
Merged pull request #4532: fix(guard): allow reading installed package and toolchain source below hidden home dirs (#4532) Evidence for this change
Merged pull request #4651: fix(guard): run commands that write under $TMPDIR in the workspace sandbox (#4651) Evidence for this change
Merged pull request #4611: test(gate): model the sibling checkout as a real clone (#4611) Evidence for this change
Merged pull request #4714: ci(macos): reuse exact native runtime builds Evidence for this change
Merged pull request #4586: feat(guard): detect Gemini and Antigravity artifacts in the resident (#4586) Evidence for this change
Direct commit 0aca72ea8f49: feat(mcp): relay MCP stdio traffic natively behind a fail-closed decision seam Evidence for this change
Merged pull request #4604: feat(guard): detect Grok and Kimi artifacts in the resident (#4604) Evidence for this change
Merged pull request #4609: feat(mcp-relay): run servers with proxy-decided tools under the Python proxy (#4609) Evidence for this change
Merged pull request #4569: feat(mcp): decide relayed tool calls whose arguments carry decimal numbers (#4569) Evidence for this change
Merged pull request #4590: fix(guard): judge cd-chained Git reads where the shell runs them (#4590) Evidence for this change
Merged pull request #4639: fix(guard): accept a trusted KUBECONFIG prefix on kubectl reads (#4639) Evidence for this change
Merged pull request #4522: feat(guard): verify and sign policy rows in the native resident (#4522) Evidence for this change
Merged pull request #4536: fix(guard): contain one command after a cd below a sibling repository root on Linux (#4536) Evidence for this change
Merged pull request #4654: fix(guard): treat test -x, test -s and [ ... ] probes as reads (#4654) Evidence for this change
Merged pull request #4533: chore(scope): count update, policy-file and device-health helpers as control plane (#4533) Evidence for this change
Merged pull request #4557: fix(release): give native wheel jobs time to compile on repair dispatches (#4557) Evidence for this change
Merged pull request #4638: perf(bench): attribute warm-path service CPU and memory per process role (#4638) Evidence for this change
Merged pull request #4597: fix(guard): let npm cache ls run as a read-only query (#4597) Evidence for this change
Merged pull request #4701: feat(guard): write dashboard settings through the native runtime (#4701) Evidence for this change
Merged pull request #4566: feat(mcp): claim saved approvals for relayed calls in the resident (#4566) Evidence for this change
Merged pull request #4602: fix(guard): read quoted brackets and escaped code spans in gh comment bodies as text (#4602) Evidence for this change
Merged pull request #4650: fix(guard): keep a Git read's proof after a proven worktree add (#4650) Evidence for this change
Merged pull request #4517: fix(guard): decide a trailing subshell group by its command list (#4517) Evidence for this change
Merged pull request #4538: fix(guard): let agents inspect a scratch checkout through a rooted parent path (#4538) Evidence for this change
Merged pull request #4591: perf(codex): answer Codex tool blocks without starting Python (#4591) Evidence for this change
Merged pull request #4530: perf(hooks): skip runtime hashing when the native bridge finds its resident (#4530) Evidence for this change
Merged pull request #4540: chore(scope): count managed policy delivery and AIBOM inventory helpers as control plane (#4540) Evidence for this change
Merged pull request #4642: fix(guard): explain a denied write after a contained run fails (#4642) Evidence for this change
Merged pull request #4573: fix(windows): run Claude Code Python test scripts in an AppContainer (#4573) Evidence for this change
Direct commit a2620209d51f: fix(listing): match MusicContext summary to merged tool states Evidence for this change
Merged pull request #4657: style(rust): apply rustfmt to search scope filter check (#4657) Evidence for this change
Merged pull request #4576: feat(guard): detect Pi and Oh My Pi resources in the native runtime (#4576) Evidence for this change
Merged pull request #4480: feat(discovery): sponsored extension discovery (native op, daemon transport, Discover view) (#4480) Evidence for this change
Merged pull request #4529: fix(dashboard): simplify local approval setup and restore its return path (#4529) Evidence for this change
Merged pull request #4553: fix(release): raise native wheel size budgets so 3.44 can publish (#4553) Evidence for this change
Merged pull request #4643: fix(guard): prove plain git rev-list commit walks read-only (#4643) Evidence for this change
Merged pull request #4695: fix(guard): let routine Oh My Pi session work through and review language server edits (#4695) Evidence for this change
Merged pull request #4625: fix(guard): let test files use values that say they are fake (#4625) Evidence for this change
Merged pull request #4606: feat(mcp): hand relay sessions the resident cannot decide to the Python proxy at startup (#4606) Evidence for this change
Merged pull request #4570: feat(mcp): decide relayed shell and command calls that install no package (#4570) Evidence for this change
Merged pull request #4627: fix(guard): let Oh My Pi search and list ordinary workspaces (#4627) Evidence for this change
Merged pull request #4555: chore(release): 3.45.0 (#4555) Evidence for this change
Merged pull request #4720: perf(runtime): run piped, stderr-folded and status-reading workspace commands in the native sink (#4720) Evidence for this change
Merged pull request #4628: ci(bench): measure MCP tools/call at the same installed steady state (#4628) Evidence for this change
Merged pull request #4603: feat(mcp): block queued relay calls natively under the safe-alternative mode (#4603) Evidence for this change
Merged pull request #4493: fix(guard): allow cd-semicolon chains, awk reads and rustfmt in sibling repositories (#4493) Evidence for this change
Merged pull request #4607: feat(guard): detect Cursor and OpenCode artifacts in the resident (#4607) Evidence for this change
Merged pull request #4629: fix(guard): screen host file-tool writes that name a parent folder (#4629) Evidence for this change
Merged pull request #4585: fix(guard): prove merges, cherry-picks and merge pulls in sibling checkouts (#4585) Evidence for this change
Merged pull request #4707: ci(gates): keep macOS replay shards within five minutes (#4707) Evidence for this change
Merged pull request #4644: fix(guard): accept bundled short flags in git branch listings (#4644) Evidence for this change

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.44.0a11

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.