Release notes

HOL Guard v3.59.0a2

Preview

HOL Guard v3.59.0a2, released October 28, 2026, is a preview release with 3 improvements, 5 fixes and 1 other change across 8 merged pull requests. Highlights: Build a queued native review's approval request in the resident; Retire unused Claude prompt and permission CLI helpers.

Changes since the previous release on this channel: alpha/v3.58.0a9alpha/v3.59.0a2

3 improved · 5 fixed · 1 other

Published Original GitHub release for alpha/v3.59.0a2

Key facts

Version
v3.59.0a2
Channel
Preview
Published
Previous release
alpha/v3.58.0a9
Merged pull requests
8

Documented changes

9 typed entries

Verified contributors

3 verified contributors · 89 credits

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.59.0a2 is a preview release published 2026-10-28. Upstream documents: Guard 3.59.0a2 is an opt-in prerelease cut from 647fb01. Stable installations remain on the stable channel. 8 commits • 8 merged pull requests • 1 contributor since Guard 3.59.0a1. Its comparison base is alpha/v3.58.0a9. It includes 89 verified contribution deliveries with public evidence links.

Changes

Improved

3
  • daemonBuild a queued native review's approval request in the resident (#6298) Evidence for this change
  • guardRetire unused Claude prompt and permission CLI helpers (#6290) Evidence for this change
  • receiptCheck hook decision receipts in the native runtime (#6295) Evidence for this change
    • Merged pull request #6222: refactor(guard): project workspace package findings in the native runtime (#6222)
    • Merged pull request #6298: refactor(daemon): build a queued native review's approval request in the resident
    • Merged pull request #6219: fix(dashboard): show Guard's advice when workspace findings cannot reach the daemon (#6219)
    • Merged pull request #6256: fix(plugin): print hol-guard, not hol-guard.EXE, in plan and usage text on Windows (#6256)
    • Merged pull request #6048: feat(mcp-servers): add borer MCP contribution
    • Merged pull request #6305: fix(guard): read a conditional inside a command list as the lists it holds
    • Merged pull request #6239: refactor(guard): move a test-only approval write and network enum into tests (#6239)
    • Merged pull request #6216: fix(guard): list every resolved version of a package in the workspace inventory (#6216)
    • Merged pull request #6208: refactor(guard): move test-only hook adapter wrappers out of the runtime (#6208)
    • Merged pull request #6217: fix(guard): keep a package finding's identity when its rule data changes (#6217)
    • Merged pull request #6250: fix(guard): let Cursor read its own workspace working files (#6250)
    • Merged pull request #6242: perf(mcp): reuse the catalog fingerprint while the catalog is unchanged (#6242)
    • Merged pull request #6247: fix(command): let Cursor read and edit files larger than 32 KiB (#6247)
    • Merged pull request #6254: refactor(guard): send bound resident calls through one shared helper (#6254)
    • Merged pull request #6269: refactor(guard): project the native command model without re-deriving it (#6269)
    • Merged pull request #6296: refactor(scripts): move the Python daemon hook auth out of the package
    • Merged pull request #6279: fix(cursor): route the contained probe through the native rewrite as a bridge (#6279)
    • Merged pull request #6236: refactor(hook): print the redacted hook document from the native runtime (#6236)
    • Merged pull request #6295: refactor(receipt): check hook decision receipts in the native runtime
    • Merged pull request #6276: refactor(runtime): move the offline command-effect batch client into tests (#6276)
    • Merged pull request #6290: refactor(guard): retire unused Claude prompt and permission CLI helpers
    • Merged pull request #6266: refactor(policy): retire the unused Python v1 policy generation (#6266)
    • Merged pull request #6252: test(workspace): pin realistic skill, workflow and MCP detector cases (#6252)
    • Merged pull request #6240: refactor(daemon): record the Claude review notice in the queue write (#6240)
    • Merged pull request #6223: fix(supply-chain): list every version a lockfile installs in the workspace inventory (#6223)
    • Merged pull request #6257: fix(cursor): route contained shell calls through a silent preToolUse probe (#6257)
    • Merged pull request #6280: refactor(cli): retire the Python hook-artifact composition and test the live hook path
    • Merged pull request #6128: refactor(approvals): derive package workspace approval scopes in the native runtime (#6128)
    • Merged pull request #6267: test(gauntlet): ask only for a required extension's permissions (#6267)
    • Merged pull request #6281: refactor(guard): move test-only daemon hook clients out of the runtime package (#6281)
    • Merged pull request #6287: fix(ci): accept three advisories reachable only through the cisco extra (#6287)
    • Merged pull request #6218: docs(guard): list the Linux ARM64 wheel and the Intel Mac cryptography build (#6218)
    • Merged pull request #6225: refactor(guard): drop unused Python helpers left behind by the native port (#6225)
    • Merged pull request #6243: refactor(hook): write the contained-run snapshot and sink command in the native runtime (#6243)
    • Merged pull request #6304: refactor(guard): retire dead sensitive-request, contained-execute and prompt helpers
    • Merged pull request #6214: test(guard): pin that hook and plugin findings keep their id when they move (#6214)
    • Merged pull request #6300: fix(guard): let Cursor write its own conversation's compaction notes
    • Merged pull request #6241: refactor(guard): parse a contained Node or TypeScript launch in the resident (#6241)
    • Merged pull request #6229: refactor(guard): remove Python helpers only tests reached (#6229)
    • Merged pull request #6213: fix(guard): keep workspace findings and model refusals out of enforcement records (#6213)
    • Merged pull request #6231: fix(plugin-kit): point upgrade messages at hol-guard update instead of pip (#6231)
    • Merged pull request #6226: fix(connect): ask for a new device code when Guard Cloud's approval answer is lost (#6226)
    • Merged pull request #6293: fix(guard): prove Grok folder reads, folder searches and memory notes
    • Merged pull request #6235: refactor(guard): drop the Python receipt-event and bulk-resolve helpers (#6235)
    • Merged pull request #6224: fix(dashboard): stop waiting on a stalled intel sync and show how long it has run (#6224)
    • Merged pull request #6277: fix(guard): let the resident say what a trusted-local-tool grant may be (#6277)
    • Direct commit 213a7a3511fa: Merge remote-tracking branch 'origin/main' into add-borer-mcp
    • Merged pull request #6272: refactor(guard): retire unused Python decision, floor and incident oracles (#6272)
    • Merged pull request #6255: refactor(guard): resolve portable project identity in the resident (#6255)
    • Merged pull request #6258: refactor(runtime): perform verified workspace reads in the resident (#6258)
    • Merged pull request #6227: refactor(guard): move test-only store, identity and path helpers into test support (#6227)
    • Merged pull request #6232: refactor(guard): move three test-only native helpers into test support (#6232)
    • Merged pull request #6209: refactor(guard): move test-only contribution and policy helpers out of the runtime (#6209)
    • Merged pull request #6286: refactor(codex): retire the Python approval wait the native bridge already runs
    • Merged pull request #6303: fix(guard): treat cmp of two readable files as a read
    • Merged pull request #6283: refactor(guard): retire dead saved-decision and signal mapping methods (#6283)
    • Merged pull request #6170: docs(guard): name the local CLI grant step the pre-tool floor actually asks (#6170)
    • Merged pull request #6116: feat(runtime): sign and verify command envelopes in the native runtime (#6116)
    • Merged pull request #6211: fix(dashboard): keep the last check time visible on workspace findings (#6211)
    • Merged pull request #6246: fix(dashboard): stop offering one-tap always-allow for risky extension permissions (#6246)
    • Merged pull request #6265: refactor(policy): materialize the generation-bound snapshot in the native runtime (#6265)
    • Merged pull request #6297: fix(dashboard): let an edited custom script be allowed again
    • Merged pull request #6234: feat(runtime): report running processes on the build they started from (#6234)
    • Merged pull request #6171: fix(guard): verify the signed network protection bundle in the native runtime (#6171)
    • Merged pull request #6262: refactor(runtime): check the hook edge answer in the resident
    • Merged pull request #6285: fix(guard): decide extension control enrollment terminal locality in the resident (#6285)
    • Merged pull request #6205: fix(cloud): downgrade a catalog sync only when no page reached Cloud (#6205)
    • Merged pull request #6238: test(guard): read the failed carry run through the test support helper (#6238)
    • Merged pull request #6284: fix(release): let a tag-dispatched release reach the MCPB and MCP Registry consumers (#6284)
    • Merged pull request #6245: refactor(guard): sign the paused review response in the resident (#6245)
    • Merged pull request #6230: test(guard): keep a known-vulnerable runtime approval across feed updates (#6230)
    • Merged pull request #6221: feat(mcp): add the opt-in Oids remote server contribution
    • Merged pull request #5992: chore(release): 3.58.0 (#5992)
    • Merged pull request #6220: fix(supply-chain): audit every version a lockfile resolves a package to (#6220)
    • Merged pull request #6248: fix(guard): stop reporting uninstalled tools with leftover Guard config as broken (#6248)
    • Merged pull request #6135: refactor(runtime): verify trust attestations in the native runtime (#6135)
    • Merged pull request #6251: fix(command): prove a relative cd that climbs to a parent directory (#6251)
    • Merged pull request #6291: fix(guard): read jq format strings and shorthand object keys
    • Merged pull request #6249: refactor(guard): move MDM lab contracts and network proof tooling out of the package (#6249)
    • Merged pull request #6233: fix(command): read a repository's own hooks directory as the developer's (#6233)
    • Merged pull request #6299: fix(guard): read jq bindings and empty, pgrep -P, ps column widths and test -t
    • Merged pull request #6228: docs(guard): add a guide for installing plugins from HOL (#6228)
    • Merged pull request #6282: refactor(guard): decide protection health in the resident
    • Merged pull request #6292: fix(guard): read awk regex and string literals as data
    • Merged pull request #6268: fix(runtime): keep a local CLI's grant across shell and pipeline forms (#6268)
    • Merged pull request #6237: refactor(guard): move test-only remediation, MCP and key helpers into tests (#6237)
    • Merged pull request #6294: refactor(guard): decide canonical policy bundle device scope in the resident
    • Merged pull request #6306: fix(guard): allow lsof to report a process's working directory
    • Merged pull request #6244: fix(plugins): treat stdin from NUL as no terminal on Windows (#6244)

Fixed

5
  • guardAllow lsof to report a process's working directory (#6306) Evidence for this change
  • guardRead jq bindings and empty, pgrep -P, ps column widths and test -t (#6299) Evidence for this change
    • jq empty. jq empty file.json checks that a file parses. It is now a value builtin like length.
    • jq variable bindings. (.conclusion // "") as $s | $s != "SUCCESS" binds a term and reads it back. The filter grammar now accepts as $name | ... and $name, $name.field and $name[0]. Every $ has to…
    • gh --jq with bindings. gh pr view --json statusCheckRollup --jq '... as $s | ...' used to stop on any $. A --jq or -q filter may now carry a $ when every $ in the command is single-quoted or escaped…
  • guardLet Cursor write its own conversation's compaction notes (#6300) Evidence for this change
    • it targets the project directory named after the session's own workspace, and the conversation folder matches the hook payload's conversation_id;
    • the compaction folder already exists as a real directory at its canonical path, and the spelled path has no link and no ./.. component;
    • an existing note is a regular file with one link and no execute bit.
  • guardRead a conditional inside a command list as the lists it holds (#6305) Evidence for this change
    • a branch holds a command that changes what later commands see: cd, export, source/., read, printf -v, let, an assignment and the other state builtins, at the head of any pipeline stage, or a head word…
    • the conditional reads from a pipe, or is followed by anything other than &&, ||, ; or a newline (a pipe, a redirection, &);
    • the command anywhere holds a subshell, a group, a command substitution, backticks, a here-document, a comment, a background job, a nested construct or another loop;
  • guardTreat cmp of two readable files as a read (#6303) Evidence for this change

Other changes

1

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.58.0a9

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger89 credits