Release notes

HOL Guard v3.59.0a34

Preview

HOL Guard v3.59.0a34, released November 2, 2026, is a preview release with 1 addition, 7 improvements, 3 fixes and 1 other change across 11 merged pull requests. Highlights: Finish Antigravity settings and skill discovery; Route approval review copy in the native runtime.

Changes since the previous release on this channel: alpha/v3.59.0a30alpha/v3.59.0a34

1 added · 7 improved · 3 fixed · 1 other

Published Original GitHub release for alpha/v3.59.0a34

Key facts

Version
v3.59.0a34
Channel
Preview
Published
Previous release
alpha/v3.59.0a30
Merged pull requests
11

Documented changes

12 typed entries

Verified contributors

6 verified contributors · 107 credits

View the complete verified roster

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.59.0a34 is a preview release published 2026-11-02. Upstream documents: Guard 3.59.0a34 is an opt-in prerelease cut from 97b1b22. Stable installations remain on the stable channel. 11 commits • 11 merged pull requests • 2 contributors since Guard 3.59.0a33. Its comparison base is alpha/v3.59.0a30. It includes 107 verified contribution deliveries with public evidence links.

Changes

Added

1
  • guardFinish Antigravity settings and skill discovery (#5644) Evidence for this change
    • Discover Antigravity skills under .gemini/antigravity/skills/ (skills), .gemini/antigravity/builtin/skills/ (builtin-skills), and .gemini/config/plugins/ (plugin-skills), plus workspace .agents/skills/…
    • Read .config/antigravity/user/settings.json as well as the capitalized XDG settings file. A case-insensitive disk still reads that file once. When both files exist, their MCP servers keep separate artifact ids.
    • Leave home .agents/skills/ with the adapters that already own it.

Improved

7
  • guardRoute approval review copy in the native runtime (#6931) Evidence for this change
  • guardBuild the start and status product copy in the native runtime (#6936) Evidence for this change
  • guardBuild the runtime cloud status copy in the native runtime (#6935) Evidence for this change
  • guardDiscover installed harness versions in the native runtime (#6929) Evidence for this change
  • guardDecide protection-health signals in the native runtime (#6924) Evidence for this change
  • guardSummarize the workspace audit sync in the native runtime (#6933) Evidence for this change
  • guardDecide the protect cached-advisory merge in the native runtime (#6925) Evidence for this change
    • Merged pull request #6908: refactor(guard): scan hook launchers for stale runtimes and foreign interpreters in the native runtime (#6908)
    • Merged pull request #6888: test(command): cover the test-runner spellings the catalogs had no case for (#6888)
    • Merged pull request #6850: refactor(windows): create owner-private directories in the native runtime (#6850)
    • Merged pull request #6919: fix(command): read ag and ack search patterns as patterns, not paths (#6919)
    • Merged pull request #6860: fix(command): read a project's own Mocha as the read-only run it is (#6860)
    • Merged pull request #6915: refactor(cline): run the native hook worker in the native runtime (#6915)
    • Merged pull request #6936: refactor(guard): build the start and status product copy in the native runtime (#6936)
    • Merged pull request #6837: fix(command): read the message filters a script pipes into git (#6837)
    • Merged pull request #6870: fix(command): read a test run by the interpreter it names (#6870)
    • Merged pull request #6862: fix(supply-chain): give the Cloud evaluate retry a longer deadline than the first try (#6862)
    • Merged pull request #6904: refactor(desktop): find superseded Guard installs in the native runtime (#6904)
    • Merged pull request #6856: refactor(hooks): run the hook removal sweep in the native runtime (#6856)
    • Merged pull request #6846: refactor(skills): index local skill metadata in the native runtime (#6846)
    • Merged pull request #6877: refactor(store): run quarantine and update-staging retention in the native runtime (#6877)
    • Merged pull request #6932: fix(package): read pnpm and yarn lockfiles for the pinned-runner verdict (#6932)
    • Merged pull request #6865: refactor(notifications): show desktop approval notifications from the native runtime (#6865)
    • Merged pull request #6863: refactor(codex): compute Codex hook trust in the native runtime (#6863)
    • Merged pull request #6897: feat(command): add stateless cloud action evaluator (#6897)
    • Merged pull request #6849: refactor(daemon): reap orphaned hook workers in the native runtime (#6849)
    • Merged pull request #6851: refactor(onefile): scan for in-use extraction dirs in the native runtime (#6851)
    • Merged pull request #6901: refactor(runtime): keep running runtime instances in the native probe (#6901)
    • Merged pull request #6866: fix(command): read git switch - as the branch Git left last (#6866)
    • Merged pull request #6892: refactor(policy): read and write policy files in the native runtime (#6892)
    • Merged pull request #6882: refactor(authority): sign and verify local authority integrity in the native runtime (#6882)
    • Merged pull request #3157: deps(actions): bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 (#3157)
    • Merged pull request #6913: refactor(store): prove a failed store unusable in the native runtime (#6913)
    • Merged pull request #6855: fix(command): read a search tool's recursive and alternation globs (#6855)
    • Merged pull request #6890: feat(cigar): turn CIGAR on with one click (#6890)
    • Merged pull request #6902: refactor(runtime): match the legacy Codex probe receipt in the native store (#6902)
    • Merged pull request #6884: refactor(network): validate network status in the native runtime (#6884)
    • Merged pull request #6911: refactor(desktop): remove superseded Guard installs in the native runtime (#6911)
    • Merged pull request #3159: deps(actions): bump docker/build-push-action from 7.2.0 to 7.4.0 (#3159)
    • Direct commit df3b57744953: deps(actions): bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2
    • Merged pull request #3166: deps(actions): bump docker/login-action from 4.2.0 to 4.6.0 (#3166)
    • Merged pull request #6832: refactor(daemon): read Windows process command lines in the native runtime (#6832)
    • Merged pull request #6916: refactor(guard): classify Copilot managed hook commands in the native runtime (#6916)
    • Merged pull request #6894: feat(local-cli): read a script's commands from its source before running it (#6894)
    • Merged pull request #6864: test(gate): pin the sorted, projected GitHub search read (#6864)
    • Merged pull request #6889: fix(command): read a manager run behind the options that only choose how much it prints (#6889)
    • Merged pull request #6831: refactor(sync): let the runtime read the Cloud exceptions a policy bundle carries (#6831)
    • Merged pull request #6874: fix(daemon): give a packaged Windows start the time it actually needs (#6874)
    • Direct commit b276cf113d69: Merge remote-tracking branch 'origin/main' into repair/pr-5971
    • Merged pull request #6927: refactor(guard): pick the approval link in the native runtime (#6927)
    • Merged pull request #6905: fix(local-cli): launch a pasted script as an MCP server only when its source serves MCP (#6905)
    • Merged pull request #6872: refactor(hermes): read Hermes files in the native runtime (#6872)
    • Merged pull request #5644: feat(guard): finish Antigravity settings and skill discovery (#5644)
    • Merged pull request #6843: fix(scanner): read the zip behind a self-extracting stub (#6843)
    • Merged pull request #6886: fix(command): read the program an fd --exec runs (#6886)
    • Merged pull request #6845: refactor(mdm): read the Windows token user through the native runtime (#6845)
    • Merged pull request #6841: refactor(windows): keep owner-private state files in the native runtime (#6841)
    • Direct commit 4704f47c0741: deps(actions): bump docker/build-push-action from 7.2.0 to 7.4.0
    • Merged pull request #6879: refactor(daemon): hash the runtime identity in the native runtime (#6879)
    • Merged pull request #6858: refactor(grok): verify the Grok executable in the native runtime (#6858)
    • Merged pull request #6880: fix(command): gate the words a package script run passes on (#6880)
    • Merged pull request #6906: fix(package): run a project's own pinned runner without a package review (#6906)
    • Merged pull request #6871: refactor(desktop-core): unpack onedir archives in the native runtime (#6871)
    • Merged pull request #6869: refactor(signing): check macOS code signatures in the native runtime (#6869)
    • Merged pull request #6930: fix(grok): route Grok's workspace containment through its own hook (#6930)
    • Merged pull request #6842: fix(command): run Bun's own test runner contained instead of reviewing it (#6842)
    • Merged pull request #6929: refactor(guard): discover installed harness versions in the native runtime (#6929)
    • Merged pull request #6838: fix(command): read the helper script a skill document names (#6838)
    • Merged pull request #6895: fix(command): read a sed address a reader spells as a pattern (#6895)
    • Merged pull request #6899: refactor(guard): resolve and migrate the Guard home in the native runtime (#6899)
    • Merged pull request #6907: fix(cigar): install CIGAR without a separate qualification receipt (#6907)
    • Merged pull request #6853: fix(policy): stop holding a new publication against an older v1 shadow (#6853)
    • Merged pull request #6857: feat(mcp-servers): add the opt-in Legwork MCP contribution
    • Merged pull request #6885: fix(command): run a test runner Bun launched by its entry path (#6885)
    • Merged pull request #6883: refactor(store): write quarantine forensics in the native runtime (#6883)
    • Merged pull request #6933: refactor(guard): summarize the workspace audit sync in the native runtime (#6933)
    • Merged pull request #6859: refactor(onefile): reclaim leaked extraction dirs in the native runtime (#6859)
    • Merged pull request #6900: fix(policy): say how many inactive devices Cloud left out of policy status (#6900)
    • Merged pull request #6848: feat(command): run the test scripts a project names for its suites (#6848)
    • Merged pull request #6867: refactor(contained): run output-filter matchers from the native runtime (#6867)
    • Merged pull request #6896: fix(command): read a package manager's own verb aliases (#6896)
    • Merged pull request #6935: refactor(guard): build the runtime cloud status copy in the native runtime (#6935)
    • Merged pull request #6893: refactor(runtime): advertise native helper features from the op feature list (#6893)
    • Merged pull request #5971: fix(mcp.aseprite): describe the published 0.2.0 server
    • Merged pull request #6881: refactor(identity): read process start tokens and owner markers in the native runtime (#6881)
    • Merged pull request #6914: fix(command): read the subcommand behind yarn workspaces (#6914)
    • Merged pull request #6912: refactor(shims): render the harness launcher profile block in the native runtime (#6912)
    • Merged pull request #6910: test(gate): pin the project test-runner spellings that stay quiet (#6910)
    • Merged pull request #6920: refactor(guard): prune dead resident state in the native runtime (#6920)
    • Merged pull request #6925: refactor(guard): decide the protect cached-advisory merge in the native runtime (#6925)
    • Merged pull request #6937: fix(policy): let policy commands run first on a new Guard home
    • Merged pull request #6918: feat(cigar): set up CIGAR on macOS Intel and Linux, not only Apple Silicon (#6918)
    • Merged pull request #6854: fix(scanner): wipe the archive buffers the secret scan reads from (#6854)
    • Merged pull request #6891: fix(command): stop reading an operand word as the program a command runs (#6891)
    • Direct commit 646e5b35e18a: deps(actions): bump docker/login-action from 4.2.0 to 4.6.0
    • Merged pull request #6922: refactor(guard): decide harness version compatibility in the native runtime (#6922)
    • Merged pull request #6875: refactor(daemon): run POSIX process queries in the native runtime (#6875)
    • Merged pull request #6868: feat(builder): carry reviewed literals on the unclassified rule; optional license and description (#6868)
    • Merged pull request #6873: fix(runtime): let Cursor and ZCode retries reach the approval the user gave (#6873)
    • Merged pull request #6852: fix(policy): show Cloud's version number for an applied v1 bundle in policy status (#6852)
    • Merged pull request #6847: fix(scanner): wipe the file buffers the secret scan reads from (#6847)
    • Merged pull request #6923: fix(package): bind a pinned tsc through its typescript package (#6923)
    • Merged pull request #6844: refactor(mdm): observe the boot in the native runtime (#6844)
    • Merged pull request #6878: fix(command): charge a grep include walk only for its own time (#6878)
    • Direct commit 34265e80e478: feat(guard): finish Antigravity settings and skill discovery
    • Merged pull request #6926: fix(policy): tell users how to show a policy with workspace rules (#6926)
    • Merged pull request #6909: refactor(guard): build the local risk report in the native runtime (#6909)
    • Merged pull request #6924: refactor(guard): decide protection-health signals in the native runtime (#6924)
    • Merged pull request #6928: test(command): cover catalog MCP tightening on cloud remote MCP actions (#6928)
    • Merged pull request #6917: test(gate): pin the npx tool and test-runner spellings that stay quiet (#6917)
    • Merged pull request #6921: refactor(guard): back up hook config files in the native runtime (#6921)
    • Merged pull request #6903: refactor(store): salvage a quarantined store in the native runtime (#6903)
    • Merged pull request #6931: refactor(guard): route approval review copy in the native runtime (#6931)
    • Merged pull request #6887: refactor(install): write the agent safety guidance in the native runtime (#6887)

Fixed

3

Other changes

1

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.59.0a30

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger107 credits