Release notes

HOL Guard v3.57.0a2

Preview

HOL Guard v3.57.0a2, released October 25, 2026, is a preview release with 16 additions, 5 improvements, 17 fixes and 4 other changes across 39 merged pull requests. Highlights: Report observed MCP launch runtimes in fleet posture; Assess workspaces registered with install --workspace.

Changes since the previous release on this channel: alpha/v3.56.0a6alpha/v3.57.0a2

16 added · 5 improved · 17 fixed · 4 other

Published Original GitHub release for alpha/v3.57.0a2

Key facts

Version
v3.57.0a2
Channel
Preview
Published
Previous release
alpha/v3.56.0a6
Merged pull requests
39

Documented changes

42 typed entries

Verified contributors

Credits being verified. Attribution coverage is in progress.

Attribution coverage

attribution in progress; history inventory partial.

Install

Current installation guide

Scope

Guard v3.57.0a2 is a preview release published 2026-10-25. Upstream documents: Guard 3.57.0a2 is an opt-in prerelease cut from e0cec0e. Stable installations remain on the stable channel. 41 commits • 39 merged pull requests • 5 contributors since Guard 3.57.0a1. Its comparison base is alpha/v3.56.0a6. It includes 50 verified contribution deliveries with public evidence links. Attribution for this release is being verified.

Changes

Added

16
  • guardReport observed MCP launch runtimes in fleet posture (#5950) Evidence for this change
    • Coverage is observed_only, so the section never claims a complete scope and never reports a runtime as safe.
    • A minimal report leaves the section out; older receivers that do not know it are unaffected because it is optional in the v1 schema.
    • Observing launches hashes executables, so the section is cached for an hour.
  • guardAssess workspaces registered with install --workspace (#5947) Evidence for this change
    • Each poll admits the workspace of every active install once. A root that is already admitted is skipped before any snapshot.
    • Automatic admission never resumes a paused worktree, even when the same worktree is reached through a newly registered path. Manual admission still resumes, as before.
    • A root that cannot be admitted (for example, the snapshot is refused) is remembered for the life of the worker, so it is not walked on every poll. A missing root is retried once it exists.
  • dashboardReview and apply dependency fixes from the Workspaces tab (#5935) Evidence for this change
    • A Fix column joins the findings table. An npm finding with a published fix version gets Prepare fix. Other findings show "Manual update" and no button, so the tab never offers an edit the daemon cannot make.
    • Prepare fix opens a review below the table, without a modal. It shows each package.json Guard would change, the section and the range before and after, and the diff. Each manifest gets its own **Apply to **…
    • After apply, the notice names the lockfile to update with the package manager. The row shows Waiting for re-check until a complete assessment settles the proposal as Fixed or Still found ("Update the…
  • guardScan workspace snapshots for secrets in background assessments (#5930) Evidence for this change
    • The native workspace snapshot scans the same bounded file set it already hashes, with the existing guard-scanner repository secret rules. It follows no symlinks and never leaves the workspace root.
    • Credential stores, key and certificate files, non-text files and oversize files are skipped. They are counted under coverage.secrets.skipped and are not reported as findings.
    • Matched text is dropped at the native boundary. The native scan emits the final finding: a worktree-scoped id, the rule id, the root-relative path, every line where it appears (up to 16) with an occurrences count…
  • runtimeReport the runtimes configured servers would launch, without running them (#5929) Evidence for this change
    • A new native runtime-identity-probe command (feature runtime-identity-probe-v1) describes each candidate path without executing it. It resolves symlinks and hashes the file with a bounded read. Missing files…
    • The runtime family and version are inferred from the file name and the install layout only: nvm, Homebrew Cellar, fnm, asdf, volta and pyenv. Because nothing is executed or signature-checked, assurance is at most…
    • Launch resolution is native too: the probe takes launch specs (the configured command, the server's own PATH, the launch directory, and the environment values a search path may reference) under a new…
  • guardPrepare, apply and verify reviewed dependency fixes for workspace findings (#5926) Evidence for this change
  • pluginsShow update prompts for installed plugins with a newer checked release (#5928) Evidence for this change
    • Guard downloads the public listing index and the public release index. Before the native check it narrows the listing index to plugins found on this machine, using the same repositories filter as install counts.
    • The native runtime (guard-plugin-telemetry, new updates command behind the plugin-updates-v1 resident feature) compares installed versions with recorded releases locally. Nothing about installed plugins is sent.
    • A prompt is marked urgent when the newer release fixes a high or critical scanner finding, or when the installed release had one.
  • guardSend workspace assessment summaries with receipt sync (#5919) Evidence for this change
  • telemetryAdd opt-in weekly plugin install counts (#5909) Evidence for this change
  • runtimeAssess runtime identities against vendor advisory ranges (#5916) Evidence for this change
  • dashboardShow background workspace assessments in the supply-chain hub (#5921) Evidence for this change
    • Each tracked worktree shows one status: fresh, stale, queued, running, partial, failed, paused or pending.
    • A partial check lists its coverage gaps, and detectors that are not part of the check yet are named, so a partial result never reads as all clear.
    • Dependency findings show the package, installed version, fixed version, decision, severity and advisory IDs.
  • guardAssess the active worktree in the background (#5901) Evidence for this change
  • plugin-releaseAttest each plugin release with the scanner and the Plugin Kit (#5913) Evidence for this change
  • plugin-kitCheck and package one plugin source for every agent runtime (#5889) Evidence for this change
    • check reports what a marketplace reviewer or runtime loader would reject (name not kebab-case, missing description or license, skills without frontmatter, MCP servers with neither command nor url, a literal value…
    • package writes a ready-to-load copy for claude-code, codex, gemini-cli, cursor, vscode, opencode, mcp-registry and agent-skills, plus hol.provenance.json (source digest and per-file SHA-256, no…
    • links prints the install commands that already work for the repository and the steps left to list it everywhere.
  • commandAdmit the daemon summaries that resolve no compose project (#5860) Evidence for this change
  • Add ApexCompress command safety extension (#2994) Evidence for this change
    • Merged pull request #5919: feat(guard): send workspace assessment summaries with receipt sync (#5919)
    • Merged pull request #5917: fix(command): keep a checkout's own signing and pager settings out of the way
    • Merged pull request #2994: Add ApexCompress command safety extension (#2994)
    • Merged pull request #5928: feat(plugins): show update prompts for installed plugins with a newer checked release (#5928)
    • Merged pull request #5916: feat(runtime): assess runtime identities against vendor advisory ranges (#5916)
    • Merged pull request #5929: feat(runtime): report the runtimes configured servers would launch, without running them (#5929)
    • Merged pull request #5890: fix(contain): find a workspace venv the session's PATH never names (#5890)
    • Merged pull request #5942: refactor(hook): ask the resident for queued review hints (#5942)
    • Merged pull request #5914: fix(command): keep a reader's proof when it follows a verified directory change (#5914)
    • Merged pull request #5926: feat(guard): prepare, apply and verify reviewed dependency fixes for workspace findings (#5926)
    • Merged pull request #5927: fix(guard): keep packages Cloud could not answer out of background findings (#5927)
    • Merged pull request #5936: fix(command): keep a proven fast-forward silent when a read follows it (#5936)
    • Merged pull request #5855: fix(command): read a closed double-bracket test as the test it asks (#5855)
    • Merged pull request #5946: refactor(runtime): drop request-classifier tables nothing reads (#5946)
    • Merged pull request #5932: fix(command): read a branch switch as the checkout it is (#5932)
    • Merged pull request #5939: perf(ci): widen the benign gate to 24 shards (#5939)
    • Merged pull request #5899: refactor(runtime): remove the unused Python skill-path resolver
    • Merged pull request #5938: fix(command): read a backgrounded launch followed by more jobs as a review, not a block (#5938)
    • Merged pull request #5905: fix(guard): verify supply-chain bundles whose text is not ASCII (#5905)
    • Merged pull request #5862: fix(command): read a grouped command that stands in a pipeline (#5862)
    • Merged pull request #5912: fix(command): read the command list a redirected control-flow construct runs (#5912)
    • Merged pull request #5922: refactor(hook): declare fail-closed hook envelopes in one Rust-checked contract (#5922)
    • Merged pull request #5894: feat(diagnostics): record active-set and candidate counts for scale runs (#5894)
    • Merged pull request #5941: fix(catalog): note a publication built for another engine once, not as two errors every refresh (#5941)
    • Merged pull request #5913: feat(plugin-release): attest each plugin release with the scanner and the Plugin Kit (#5913)
    • Merged pull request #5918: fix(daemon): keep the verdict's reason when a hook render misses its deadline (#5918)
    • Merged pull request #5906: fix(supply-chain): find the package managers a launcher PATH hides and explain a failed audit sync (#5906)
    • Merged pull request #5933: fix(command): read a bare refresh as the reach it has, and let a fetch lead a chain (#5933)
    • Merged pull request #5948: test(guard): show that restoring protection leaves a known workspace risk open (#5948)
    • Merged pull request #5935: feat(dashboard): review and apply dependency fixes from the Workspaces tab (#5935)
    • Merged pull request #5693: chore(release): 3.56.0 (#5693)
    • Direct commit d9f569a60d69: maintainer: merge main; normalize non-contribution paths to main
    • Merged pull request #5909: feat(telemetry): add opt-in weekly plugin install counts (#5909)
    • Merged pull request #5903: fix(mcpb): pack the release bundle without the MCPB CLI (#5903)
    • Merged pull request #5945: refactor(runtime): remove the unused Python literal-cd shell parser (#5945)
    • Merged pull request #5943: fix(dashboard): close Supply Chain dialogs on Escape and report real intel freshness (#5943)
    • Merged pull request #5949: fix(command): prove the branch git worktree add names after its destination (#5949)
    • Merged pull request #5921: feat(dashboard): show background workspace assessments in the supply-chain hub (#5921)
    • Merged pull request #5860: feat(command): admit the daemon summaries that resolve no compose project (#5860)
    • Merged pull request #5950: feat(guard): report observed MCP launch runtimes in fleet posture
    • Merged pull request #5947: feat(guard): assess workspaces registered with install --workspace (#5947)
    • Direct commit 91b54314e920: fix(scanner): close packaged binary coverage gaps
    • Merged pull request #5930: feat(guard): scan workspace snapshots for secrets in background assessments (#5930)
    • Merged pull request #5920: perf(hook): answer a review's retry binding and exact-action token in one resident ask (#5920)
    • Merged pull request #5889: feat(plugin-kit): check and package one plugin source for every agent runtime (#5889)
    • Merged pull request #5944: refactor(runtime): share artifact payload and Python whitespace helpers
    • Merged pull request #5901: feat(guard): assess the active worktree in the background (#5901)
    • Merged pull request #5902: fix(scanner): report oversized packaged Mac executables as uninspected
    • Merged pull request #5904: fix(release): list every change in large release notes (#5904)
    • Direct commit f2a150a53644: Merge branch 'main' into handle-large-extensionless-packaged-Mac-executables-safely

Improved

5

Fixed

17
  • commandKeep a checkout's own signing and pager settings out of the way (#5917) Evidence for this change
  • commandProve the branch git worktree add names after its destination (#5949) Evidence for this change
  • commandRead a bare refresh as the reach it has, and let a fetch lead a chain (#5933) Evidence for this change
  • commandRead a branch switch as the checkout it is (#5932) Evidence for this change
  • catalogNote a publication built for another engine once, not as two errors every refresh (#5941) Evidence for this change
  • commandRead a backgrounded launch followed by more jobs as a review, not a block (#5938) Evidence for this change
  • dashboardClose Supply Chain dialogs on Escape and report real intel freshness (#5943) Evidence for this change
  • commandKeep a proven fast-forward silent when a read follows it (#5936) Evidence for this change
  • scannerReport oversized packaged Mac executables as uninspected (8725d33) Evidence for this change
  • commandKeep a reader's proof when it follows a verified directory change (#5914) Evidence for this change
  • guardKeep packages Cloud could not answer out of background findings (#5927) Evidence for this change
    • A package whose only reasons are Cloud lookup failures is left out of the findings. A block decision is always kept.
    • Supply-chain coverage for that run is reported as incomplete, with supply_chain_incomplete in the reasons, so the result reads as partial and never as clean.
  • daemonKeep the verdict's reason when a hook render misses its deadline (#5918) Evidence for this change
  • supply-chainFind the package managers a launcher PATH hides and explain a failed audit sync (#5906) Evidence for this change
  • commandRead the command list a redirected control-flow construct runs (#5912) Evidence for this change
  • guardVerify supply-chain bundles whose text is not ASCII (#5905) Evidence for this change
  • releaseList every change in large release notes (#5904) Evidence for this change
  • mcpbPack the release bundle without the MCPB CLI (#5903) Evidence for this change
    • publish-mcpb.yml and mcpb-validation.yml pack distributions/mcpb with scripts/ci/pack_mcpb.py. The release still uploads hol-guard- .mcpb and its checksum.
    • The script checks the manifest, reads [project].version and [project].dependencies, refuses symlinks and paths that leave the bundle, and writes the zip through an exclusive temporary file.
    • .github/tools/mcpb-cli is removed, including the Forge backport, the Trivy skip for that lockfile, and the node-forge ignore entry that belonged to that tool.

Other changes

4

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.56.0a6

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger50 credits