Release notes

HOL Guard v3.50.0a3

Preview

Published Original GitHub release for alpha/v3.50.0a3

Documented changes

48 typed entries

Verified contributors

1 verified contributor · 16 credits

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.50.0a3 is a preview release published 2026-10-17. Upstream documents: Guard 3.50.0a3 is an opt-in prerelease cut from e2574e0. Stable installations remain on the stable channel. 16 commits • 15 merged pull requests • 2 contributors since Guard 3.50.0a2. Its comparison base is alpha/v3.50.0a2. It includes 16 verified contribution deliveries with public evidence links.

Changes

Added

19
  • guard: Run granted local CLIs in a capability-scoped workspace sandbox (#5074) Evidence for this change
  • guard: Record connector setup context and compute the setup recommendation (#5085) Evidence for this change
  • dashboard: Open the Protect page on a held connector request (#5084) Evidence for this change
  • connector_recommendation.setup_href links to /extensions/local-cli/ ?setup= &identity= . Evidence for this change
  • The Protect detail page reads both values. It accepts only a bounded request id and a 64-character lowercase hash, and it shows the bound identity. Evidence for this change
  • Set up with recommended appears only while the stored connector has the same identity and is still unset. If the identity changed, the page explains that the binary differs from the held one. If the connector… Evidence for this change
  • guard: Store per-CLI capabilities behind the extension-control proof (#5071) Evidence for this change
  • local-cli: Resolve a connector's held requests once it is set up (#5083) Evidence for this change
  • POST /v1/local-clis/apply accepts an optional connector_group_request_id with state: "allowed". The id is validated before the approval proof is spent, and a blocked apply cannot carry it. Evidence for this change
  • After the proof-bound write saves, the daemon approves the connector's pending connector: : rows once through the existing bulk approve-once path. That path checks the approval gate again and applies… Evidence for this change
  • The request the setup started from gets the existing continuation: Codex rows use the resume binding, and other harnesses get the same text as hol-guard approvals retry-hint. No new resume machinery. Evidence for this change
  • guard: Say what runs contained and what runs directly in sandbox text (#5090) Evidence for this change
  • The plain contained reason and the contained-publish reason now say: every program the command starts, including children of an interpreter, runs contained and can write only the workspace and $TMPDIR; the sandbox… Evidence for this change
  • Every denial note ends with the same scope sentence. Evidence for this change
  • Two new denial causes name a blocked pseudo-terminal (/dev/ptmx, openpty, forkpty, posix_openpt, "out of pty devices") and a blocked Docker socket (the Docker CLI's "cannot connect to the Docker daemon" and… Evidence for this change
  • approvals: Recommend setting up the connector a held request waits on (#5078) Evidence for this change
  • A review held only because Guard does not recognise the local CLI it launches (for example a user-installed lanectl) now stores a connector setup hint (guard.connector-setup-hint.v1) on the approval row instead of… Evidence for this change
  • GET /v1/requests/ adds a read-only connector_recommendation (guard.approval-connector-recommendation.v1). It is rebuilt on every read: the request must still be pending and in the connector's… Evidence for this change
  • Nothing here writes a grant. Setting a connector up still goes through the local-CLI preview, one-use proof and apply flow, hosted dashboard origins never receive the recommendation, and the agent-facing setup text is… Evidence for this change

Improved

1

Fixed

9

Other changes

19
  • Documented change: Guard 3.50.0a3 is an opt-in prerelease cut from e2574e0. Stable installations remain on the stable channel. 16 commits • 15 merged pull requests • 2 contributors since Guard 3.50.0a2. Evidence for this change
  • gauntlet: Approve an env-prefixed command and retry it unchanged (#5096) Evidence for this change
  • guard: Replay MCP connector setup in the benign false-positive gate (#5093) Evidence for this change
  • Merged pull request #5090: feat(guard): say what runs contained and what runs directly in sandbox text (#5090) Evidence for this change
  • Merged pull request #5092: fix(guard): let writes into framework build output pass in sibling checkouts (#5092) Evidence for this change
  • Merged pull request #5087: refactor(runtime): decide command policy in the resident (#5087) Evidence for this change
  • Merged pull request #5071: feat(guard): store per-CLI capabilities behind the extension-control proof (#5071) Evidence for this change
  • Merged pull request #5094: fix(extensions): compile raw sources without a corpus envelope Evidence for this change
  • Merged pull request #5093: test(guard): replay MCP connector setup in the benign false-positive gate (#5093) Evidence for this change
  • Merged pull request #5078: feat(approvals): recommend setting up the connector a held request waits on (#5078) Evidence for this change
  • Merged pull request #5085: feat(guard): record connector setup context and compute the setup recommendation (#5085) Evidence for this change
  • Merged pull request #5074: feat(guard): run granted local CLIs in a capability-scoped workspace sandbox (#5074) Evidence for this change
  • Merged pull request #5083: feat(local-cli): resolve a connector's held requests once it is set up (#5083) Evidence for this change
  • Merged pull request #5089: fix(guard): let pip print installed package metadata without review (#5089) Evidence for this change
  • Merged pull request #5095: fix(runtime): let a write probe remove the directory it created (#5095) Evidence for this change
  • Merged pull request #5044: fix(guard): prove the Git tag listing and clean preview as reads (#5044) Evidence for this change
  • Merged pull request #5066: fix(guard): keep a review when the workspace sandbox cannot run the program (#5066) Evidence for this change
  • Merged pull request #5096: test(gauntlet): approve an env-prefixed command and retry it unchanged (#5096) Evidence for this change
  • Merged pull request #5084: feat(dashboard): open the Protect page on a held connector request (#5084) Evidence for this change

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.50.0a2

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger16 credits