Release notes
HOL Guard v3.59.0a4
PreviewHOL Guard v3.59.0a4, released October 28, 2026, is a preview release with 3 additions, 17 improvements, 8 fixes and 5 other changes across 32 merged pull requests. Highlights: Flag agent instruction files that tell an agent to drop its safeguards; Preview a redacted source export from the Workspaces tab.
Changes since the previous release on this channel: alpha/v3.59.0a3alpha/v3.59.0a4
3 added · 17 improved · 8 fixed · 5 other
Key facts
- Version
- v3.59.0a4
- Channel
- Preview
- Published
- Previous release
- alpha/v3.59.0a3
- Merged pull requests
- 32
Documented changes
33 typed entries
Verified contributors
1 verified contributor · 32 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.59.0a4 is a preview release published 2026-10-28. Upstream documents: Guard 3.59.0a4 is an opt-in prerelease cut from c91f698. Stable installations remain on the stable channel. 32 commits • 32 merged pull requests • 1 contributor since Guard 3.59.0a3. Its comparison base is alpha/v3.59.0a3. It includes 32 verified contribution deliveries with public evidence links.
Changes
Added
3- guardFlag agent instruction files that tell an agent to drop its safeguards (#6322) Evidence for this change
- guardPreview a redacted source export from the Workspaces tab (#6324) Evidence for this change
POST /v1/supply-chain/workspace-export-previewpreviews named, root-relative files in a tracked worktree. The daemon resolves the root from the assessment store, never from the request, and refuses the reply when the…- The Workspaces tab gets a "Preview a source export" panel. It suggests the workspace files current findings point at (never a runtime executable), and shows each included file with its size before and after redaction…
- The panel reads nothing until the user opens it, and marks a preview stale once the path list changes.
- dashboardLoad commands for command-line tools Guard has only seen in use (#6321) Evidence for this change
Improved
17- guardDrop the one-shot resident client test seam (#6351) Evidence for this change
- guardMove test-only runtime helpers out of the package (#6350) Evidence for this change
- guardDrop Python copies of logic the native runtime owns (#6348) Evidence for this change
- guardMove test-only PostToolUse review out of the runtime (#6345) Evidence for this change
- guardFail the bounded hook bridge closed instead of evaluating cold (#6346) Evidence for this change
- guardAnswer Claude Code's permission and stop hooks in one resident call (#6343) Evidence for this change
- guardRecord the CLI a hook launches in the resident (#6340) Evidence for this change
- guardMediate Pi structured output in the hook edge (#6341) Evidence for this change
- guardRetire the Codex tool-output review the resident no longer runs (#6338) Evidence for this change
- guardSettle custom extension rules in the hook edge (#6330) Evidence for this change
- guardRetire the resident codex tool output operation (#6335) Evidence for this change
- codexRetire the unwired Codex prompt credential-file and attachment scans (#6334) Evidence for this change
- codexVerify a Codex hook manifest against the live installation in the resident (#6328) Evidence for this change
- guardRetire the unused Python command-observation validator (#6333) Evidence for this change
- codexWalk a Codex hook source's inventory in the resident (#6308) Evidence for this change
- supply-chainSettle a package review from the resident's verdict (#6309) Evidence for this change
- approvalsSettle an approval's scope and persistence in one resident ask (#6326) Evidence for this change
Fixed
8- ciLoad the PostToolUse review client by path in the default-auto probe (#6352) Evidence for this change
- commandProject a backgrounded command to its foreground text (#6342) Evidence for this change
- commandRead a freshly created worktree through a pipe or a semicolon (#6318) Evidence for this change
- commandRead a package manager's group verb by the subcommand behind it (#6331) Evidence for this change
- daemonLoad the CLI helper registry before settling Claude turns (#6337) Evidence for this change
- Regression test:**
test_an_in_process_resident_answers_a_claude_turn_without_the_cli_loadedintests/test_daemon_cli_helper_registry.py. It runs in a fresh interpreter, checks the registry is not loaded, and asks…
- Regression test:**
- commandRead npm's report verbs as the reads they are (#6327) Evidence for this change
- runtimeWatch mode keeps the known-vulnerable runtime finding over an earlier warning (#6325) Evidence for this change
- Mixed outcomes in one workspace. A strict workspace holds a patched Node archive and an affected copy under
runtimes/. Reviewing the affected copy is denied withnative_runtime_known_vulnerable; reviewing the… - Watch mode completes. With
mode = "observe"and the watch posture, the affected launch is not denied. Where the contained workspace sandbox exists, the result carriesnative_runtime_known_vulnerable_observed…
- Mixed outcomes in one workspace. A strict workspace holds a patched Node archive and an affected copy under
- commandCreate a branch at a start point without asking (#6319) Evidence for this change
Other changes
5- Guard 3.59.0a4 is an opt-in prerelease cut from
c91f698. Stable installations remain on the stable channel. 32 commits • 32 merged pull requests • 1 contributor since Guard 3.59.0a3. Evidence for this change - guardAsk the resident about a Claude approval answer only for AskUserQuestion (#6332) Evidence for this change
- mcpGive the fixture policy admission time to start the resident (#6353) Evidence for this change
- nativeExpect a backgrounded test run to keep the bare verdict (#6329) Evidence for this change
- ciBring the nightly release and command model checks up to date (#6344) Evidence for this change
- Merged pull request #6346: refactor(guard): fail the bounded hook bridge closed instead of evaluating cold
- Merged pull request #6324: feat(guard): preview a redacted source export from the Workspaces tab
- Merged pull request #6325: fix(runtime): watch mode keeps the known-vulnerable runtime finding over an earlier warning (#6325)
- Merged pull request #6335: refactor(guard): retire the resident codex tool output operation
- Merged pull request #6343: refactor(guard): answer Claude Code's permission and stop hooks in one resident call
- Merged pull request #6338: refactor(guard): retire the Codex tool-output review the resident no longer runs
- Merged pull request #6333: refactor(guard): retire the unused Python command-observation validator
- Merged pull request #6352: fix(ci): load the PostToolUse review client by path in the default-auto probe
- Merged pull request #6344: test(ci): bring the nightly release and command model checks up to date
- Merged pull request #6340: refactor(guard): record the CLI a hook launches in the resident
- Merged pull request #6348: refactor(guard): drop Python copies of logic the native runtime owns
- Merged pull request #6321: feat(dashboard): load commands for command-line tools Guard has only seen in use (#6321)
- Merged pull request #6328: refactor(codex): verify a Codex hook manifest against the live installation in the resident
- Merged pull request #6337: fix(daemon): load the CLI helper registry before settling Claude turns
- Merged pull request #6309: refactor(supply-chain): settle a package review from the resident's verdict (#6309)
- Merged pull request #6319: fix(command): create a branch at a start point without asking (#6319)
- Merged pull request #6342: fix(command): project a backgrounded command to its foreground text
- Merged pull request #6351: refactor(guard): drop the one-shot resident client test seam
- Merged pull request #6353: test(mcp): give the fixture policy admission time to start the resident
- Merged pull request #6326: refactor(approvals): settle an approval's scope and persistence in one resident ask (#6326)
- Merged pull request #6331: fix(command): read a package manager's group verb by the subcommand behind it
- Merged pull request #6318: fix(command): read a freshly created worktree through a pipe or a semicolon
- Merged pull request #6330: refactor(guard): settle custom extension rules in the hook edge
- Merged pull request #6322: feat(guard): flag agent instruction files that tell an agent to drop its safeguards
- Merged pull request #6329: test(native): expect a backgrounded test run to keep the bare verdict
- Merged pull request #6332: perf(guard): ask the resident about a Claude approval answer only for AskUserQuestion
- Merged pull request #6341: refactor(guard): mediate Pi structured output in the hook edge
- Merged pull request #6334: refactor(codex): retire the unwired Codex prompt credential-file and attachment scans
- Merged pull request #6345: refactor(guard): move test-only PostToolUse review out of the runtime
- Merged pull request #6350: refactor(guard): move test-only runtime helpers out of the package
- Merged pull request #6308: refactor(codex): walk a Codex hook source's inventory in the resident (#6308)
- Merged pull request #6327: fix(command): read npm's report verbs as the reads they are (#6327)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.59.0a3
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.