Release notes

HOL Guard v3.50.0a6

Preview

Published October 19, 2026Original GitHub release for alpha/v3.50.0a6

Documented changes

136 typed entries

Verified contributors

Credits being verified. Attribution coverage is in progress.

Attribution coverage

attribution in progress; history inventory partial.

Install

Current installation guide

Scope

Guard v3.50.0a6 is a preview release published 2026-10-19. Upstream documents: Guard 3.50.0a6 is an opt-in prerelease cut from ccc08e8. Stable installations remain on the stable channel. 74 commits • 74 merged pull requests • 9 contributors since Guard 3.50.0a5. Its comparison base is alpha/v3.50.0a4. It includes 96 verified contribution deliveries with public evidence links. Attribution for this release is being ve

Added

mcp-relay: Resolve a relayed workspace instead of deferring to the proxy (#5237) Evidence for this change
mcp-relay: Keep servers with shell and command tools on the native relay (#5230) Evidence for this change
runtime: Run the Claude daemon hook in the native bridge (#5208) Evidence for this change
guard: Resume Oh My Pi after a safe-alternative approval (#4988) Evidence for this change
Daemon (both paths, OMP only). A safe-alternative block whose review has a retry binding carries approval_resume: {request_id, poll_path}: Evidence for this change
the Python path: pause_native_pre_tool_for_approval; Evidence for this change
the resident path: hook_direct_review_queue::silent. Evidence for this change
guard: Add Repo Notebook MCP server contribution (#5207) Evidence for this change
runtime: Let the runtime settle a hook request's path spellings (#5175) Evidence for this change
runtime: Let the runtime decide which directories a hook may name (#5173) Evidence for this change
runtime: Mediate Oh My Pi structured output in the resident (#5166) Evidence for this change

Fixed

unmodeled: Read a sourced file's quoted assignment as one word (#5171) Evidence for this change
pretool: Let a shared dependency link land in a directory already there (#5228) Evidence for this change
storage: Start a review store call's own budget once the gate is held (#5236) Evidence for this change
pretool: Let a scratch-copy edit chain run without review (#5226) Evidence for this change
cp /tmp/a.ts /tmp/b.ts && sed -i '' 's|x|y|' /tmp/b.ts Evidence for this change
sed -i '' '/pattern/a\ inserted line' /tmp/x.ts && sed -n 5,8p /tmp/x.ts Evidence for this change
awk 'NR==1319 {print "line"; next} {print}' /tmp/a.ts > /tmp/b.ts && wc -l /tmp/b.ts Evidence for this change
pretool: Read a repository's auth and token folders without review (#5212) Evidence for this change
The credential-path screen treats a bare auth, authorization or token directory component as a credential store. That is right under a home directory and wrong for a repository's own sign-in code. Source files… Evidence for this change
Every native_file_read_review carried the search-narrowing next step, whatever was reviewed. Evidence for this change
pretool: Let the sibling search proof finish on a real repository (#5222) Evidence for this change
pretool: A dependency link into a separate clone of the same repository stops reviewing (#5229) Evidence for this change
hook: A review with no deadline is not a review that is out of time (#5234) Evidence for this change
runtime: Let the supervisor finish its exit record before a stop removes the scope (#5217) Evidence for this change
pretool: Keep plain git reads out of the approval inbox (#5218) Evidence for this change
pretool: Let dd print a slice of a readable file without review (#5227) Evidence for this change
packages: Keep the npm scope in package review messages (#5049) Evidence for this change
desktop: Pin generated extensions to the current Desktop core and stop a superseded CLI early (#5224) Evidence for this change
runtime: Read a task result schema's field names as labels, not credential arguments (#5205) Evidence for this change
approvals: Bind a file-tool approval to the file, not the arguments (#5220) Evidence for this change
pretool: Clear recursive searches whose pattern cannot match a sensitive file (#5215) Evidence for this change
Oh My Pi grep over the repository root: "The search would reach .env.bak, which Guard treats as sensitive." Evidence for this change
Bash grep -rn, grep -rln and find /workers -type f -name "*.ts" -exec grep -l ... {} \; in a clone: "could not be confirmed read-only", with no hint of which file held the search. Evidence for this change
pretool: Let an agent write plan notes under its own plans folder without review (#5221) Evidence for this change
the resolved path must be exactly / /plans/ .md Evidence for this change
the plans folder must already exist as a real directory Evidence for this change
the name must be visible, end in .md, and not be a harness instruction file (AGENTS.md, CLAUDE.md, ...) Evidence for this change
scanner: Pin guarded-repository action with secret boundary fix (#3464) Evidence for this change

Other changes

Documented change: Guard 3.50.0a6 is an opt-in prerelease cut from ccc08e8. Stable installations remain on the stable channel. 74 commits • 74 merged pull requests • 9 contributors since Guard 3.50.0a5. Evidence for this change
Merged pull request #5206: fix(detect): find MCP servers in ~/.claude.json and Oh My Pi's mcp.json (#5206) Evidence for this change
Merged pull request #5208: feat(runtime): run the Claude daemon hook in the native bridge (#5208) Evidence for this change
Merged pull request #5194: fix(scanner): don't treat Guard's own approval link as a credential (#5194) Evidence for this change
Merged pull request #5146: fix(pretool): build and test a Cargo package inside the workspace sandbox (#5146) Evidence for this change
Merged pull request #4008: test(guard): restore Tether contribution regression coverage (#4008) Evidence for this change
Direct commit 0f5801f6067a: test(windows): assert commands without sandbox still require review Evidence for this change
Merged pull request #5198: fix(pretool): treat a docker buildx imagetools inspect registry query as a read (#5198) Evidence for this change
Direct commit 6d29efc8e560: fix(resident): stop readiness polling when publisher closes Evidence for this change
Merged pull request #5204: fix(pi): tell the agent why its tool output was withheld (#5204) Evidence for this change
Merged pull request #5190: fix(pretool): prove locale, colour and shell-option settings read-only (#5190) Evidence for this change
Merged pull request #5182: fix(runtime): stop counting an orderly resident cycle as a restart (#5182) Evidence for this change
Merged pull request #5183: fix(guard): run lint, typecheck and format checks contained on Windows (#5183) Evidence for this change
Merged pull request #5209: test(windows): expect package review for pnpm node tool runs left uncontained (#5209) Evidence for this change
Merged pull request #5234: fix(hook): a review with no deadline is not a review that is out of time (#5234) Evidence for this change
Merged pull request #5187: fix(scanner): stop flagging token-handling source as a leaked credential (#5187) Evidence for this change
Merged pull request #5229: fix(pretool): a dependency link into a separate clone of the same repository stops reviewing (#5229) Evidence for this change
Merged pull request #5168: fix(pretool): read a sourced script's comments and dead wrappers as text (#5168) Evidence for this change
Merged pull request #5230: feat(mcp-relay): keep servers with shell and command tools on the native relay (#5230) Evidence for this change
Merged pull request #5181: fix(storage): take a real shared storage gate on Windows (#5181) Evidence for this change
Merged pull request #5196: Add MCP server contribution: Debug Anything (#5196) Evidence for this change
Direct commit 8bb451c7e382: fix(gauntlet): bind proc reads to exact background job ids Evidence for this change
Direct commit 96239023f439: fix(scanner): retain output review for quoted, ranged and external credential reads Evidence for this change
Merged pull request #5185: fix(gauntlet): refuse harness lanes whose runner cannot resolve its OS account (#5185) Evidence for this change
Merged pull request #5217: fix(runtime): let the supervisor finish its exit record before a stop removes the scope (#5217) Evidence for this change
Direct commit 1c443df3f557: test(pi): verify approval URL and frozen v1 blocked-output behavior Evidence for this change
Merged pull request #5186: fix(pretool): stop typing a tool's query argument as a model prompt (#5186) Evidence for this change
Direct commit 9a8ee72036f6: fix(pretool): keep review for credential-bearing GitHub lookup text Evidence for this change
Merged pull request #5205: fix(runtime): read a task result schema's field names as labels, not credential arguments (#5205) Evidence for this change
Direct commit bdeee49b81af: Merge main into fix/guarded-repository-scanner-pin Evidence for this change
Merged pull request #5207: feat(guard): add Repo Notebook MCP server contribution (#5207) Evidence for this change
Direct commit 4bc1008fd727: fix(contained): eliminate process-wide authority failure state Evidence for this change
Merged pull request #5174: fix(ci): keep the pack-marker fixture out of the Sonar coverage report (#5174) Evidence for this change
Merged pull request #5220: fix(approvals): bind a file-tool approval to the file, not the arguments (#5220) Evidence for this change
Merged pull request #5179: fix(runtime): stop a busy authority lease from reading as lost protection (#5179) Evidence for this change
Merged pull request #5203: fix(pretool): read plan notes with a discarded stderr without a review (#5203) Evidence for this change
Merged pull request #5211: fix(contained): stop retrying a silent runtime and say it did not answer (#5211) Evidence for this change
Merged pull request #4988: feat(guard): resume Oh My Pi after a safe-alternative approval (#4988) Evidence for this change
Merged pull request #5201: fix(pretool): read a background job's output through proc:// without review (#5201) Evidence for this change
Merged pull request #5210: fix(pretool): allow Oh My Pi github lookups as network reads (#5210) Evidence for this change
Merged pull request #5221: fix(pretool): let an agent write plan notes under its own plans folder without review (#5221) Evidence for this change
Merged pull request #5237: feat(mcp-relay): resolve a relayed workspace instead of deferring to the proxy (#5237) Evidence for this change
Merged pull request #5226: fix(pretool): let a scratch-copy edit chain run without review (#5226) Evidence for this change
Merged pull request #5233: test(gate): stop reading a revision token as a path in the benign gate (#5233) Evidence for this change
Merged pull request #5199: fix(guard): recover a stalled native resident inside the hook's own wait (#5199) Evidence for this change
Direct commit 5cec2db3735c: fix(gauntlet): require OS account for Cursor managed install too Evidence for this change
Merged pull request #5218: fix(pretool): keep plain git reads out of the approval inbox (#5218) Evidence for this change
Direct commit 340d9ce79e48: Merge branch 'main' into add-dea-mcp Evidence for this change
Merged pull request #5145: fix(pretool): build and test a Go module inside the sandbox (#5145) Evidence for this change
Merged pull request #5166: feat(runtime): mediate Oh My Pi structured output in the resident (#5166) Evidence for this change
Merged pull request #5169: fix(runtime): stop the evidence worker deadlocking on its own state lock (#5169) Evidence for this change
Merged pull request #5216: fix(approvals): let Allow once reach the retry Claude Code and Codex send (#5216) Evidence for this change
Merged pull request #5165: fix(pretool): let activating a virtualenv reach review (#5165) Evidence for this change
Merged pull request #5219: test(gates): retry a case whose review ran out of budget, however it was reported (#5219) Evidence for this change
Merged pull request #5188: fix(guard): retry transient native policy publication within a hook's wait (#5188) Evidence for this change
Direct commit fb31d1a173cf: fix(review): compare durable policy control digests across unleased review Evidence for this change
Merged pull request #5159: refactor(runtime): retire the Python hook evidence writer and its journal (#5159) Evidence for this change
Merged pull request #3807: fix(scanner): distinguish embedded secrets from runtime access (#3807) Evidence for this change
Merged pull request #3464: fix(scanner): pin guarded-repository action with secret boundary fix (#3464) Evidence for this change
Merged pull request #5162: fix(runtime): ignore an exited resident's state when probing the owner lock (#5162) Evidence for this change
Merged pull request #5215: fix(pretool): clear recursive searches whose pattern cannot match a sensitive file (#5215) Evidence for this change
Direct commit e16c86c4d363: fix(policy): retain review for referenced credential literals and conditional schemas Evidence for this change
Merged pull request #5236: fix(storage): start a review store call's own budget once the gate is held (#5236) Evidence for this change
Merged pull request #5200: fix(pretool): treat a repository beside the session folder as the workspace for file writes (#5200) Evidence for this change
Merged pull request #5184: fix(runtime): keep the agent's home when Guard runs ordinary work in its sandbox (#5184) Evidence for this change
Direct commit afe6e2d078a3: test(scanner): count the runtime credential access check Evidence for this change
Merged pull request #5202: fix(runtime): stop turning a busy host into an approval row (#5202) Evidence for this change
Direct commit fd18f45fbf7a: fix(pretool): reject shell flags and pager mutations that reroute execution Evidence for this change
Merged pull request #5167: fix(pretool): read a redirected lookup as the lookup it is (#5167) Evidence for this change
Merged pull request #5214: fix(pretool): worktree add and origin fetch stop reviewing ordinary developer git config (#5214) Evidence for this change
Merged pull request #5180: test(windows): expect review for cargo and go local verbs without the sandbox (#5180) Evidence for this change
Merged pull request #5224: fix(desktop): pin generated extensions to the current Desktop core and stop a superseded CLI early (#5224) Evidence for this change
Merged pull request #5170: fix(pretool): read npx's offline and quiet options as the options they are (#5170) Evidence for this change
Merged pull request #5222: fix(pretool): let the sibling search proof finish on a real repository (#5222) Evidence for this change
Merged pull request #5223: test(gate): build the paths benign cases read (#5223) Evidence for this change
Merged pull request #5172: fix(daemon): send a hook decision that finished after its deadline (#5172) Evidence for this change
Direct commit 685572b3edaf: fix(gauntlet): compare full staged report bytes after one append Evidence for this change
Direct commit 02343d803b58: fix(scanner): require bounded structural proof for credential expressions Evidence for this change
Merged pull request #5212: fix(pretool): read a repository's auth and token folders without review (#5212) Evidence for this change
Merged pull request #5195: fix(runtime): let a harness read prove its own output read-only (#5195) Evidence for this change
Direct commit 50304f02e18c: Merge branch 'main' into fix/guarded-repository-scanner-pin Evidence for this change
Merged pull request #5228: fix(pretool): let a shared dependency link land in a directory already there (#5228) Evidence for this change
Direct commit 4aad185bd268: fix(packages): keep the npm scope in package review messages Evidence for this change
Merged pull request #5175: feat(runtime): let the runtime settle a hook request's path spellings (#5175) Evidence for this change
Merged pull request #5171: fix(unmodeled): read a sourced file's quoted assignment as one word (#5171) Evidence for this change
Merged pull request #5163: fix(pretool): read a stray file in a Node version directory as no config (#5163) Evidence for this change
Merged pull request #5197: fix(guard): make a local CLI or script setup review an ordinary approvable review (#5197) Evidence for this change
Merged pull request #5213: refactor(codex): run the Codex hook bridge from the runtime (#5213) Evidence for this change
Merged pull request #5158: fix(pretool): rebase a branch onto a local ref without a review (#5158) Evidence for this change
Direct commit 621381c438e6: fix(runtime): bind directory trust to Guard home and preserve deadline health semantics Evidence for this change
Merged pull request #5049: fix(packages): keep the npm scope in package review messages (#5049) Evidence for this change
Merged pull request #5178: Jalfeat: add ComposeBridge MCP server to registry (v1 schema) (#5178) Evidence for this change
Direct commit f45f89ec4e08: fix: add MCP contribution id Evidence for this change
Merged pull request #5173: feat(runtime): let the runtime decide which directories a hook may name (#5173) Evidence for this change
Direct commit b5f854f926b5: fix(claude): fail closed if native hook executable cannot start Evidence for this change
Direct commit 3a862f00bbef: fix(gauntlet): preserve test failures and enforce Windows venv activation Evidence for this change
Merged pull request #5227: fix(pretool): let dd print a slice of a readable file without review (#5227) Evidence for this change

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.50.0a5

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.