Release notes

HOL Guard v3.59.0a52

Preview

HOL Guard v3.59.0a52, released November 4, 2026, is a preview release with 2 improvements, 2 fixes and 1 other change across 4 merged pull requests. Highlights: Pick the package approval plan in the native runtime; Build the OAuth package-firewall grant in the native runtime.

Changes since the previous release on this channel: alpha/v3.59.0a44alpha/v3.59.0a52

2 improved · 2 fixed · 1 other

Published Original GitHub release for alpha/v3.59.0a52

Key facts

Version
v3.59.0a52
Channel
Preview
Published
Previous release
alpha/v3.59.0a44
Merged pull requests
4

Documented changes

5 typed entries

Verified contributors

4 verified contributors · 73 credits

View the complete verified roster

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.59.0a52 is a preview release published 2026-11-04. Upstream documents: Guard 3.59.0a52 is an opt-in prerelease cut from 65c7809. Stable installations remain on the stable channel. 4 commits • 4 merged pull requests • 1 contributor since Guard 3.59.0a51. Its comparison base is alpha/v3.59.0a44. It includes 73 verified contribution deliveries with public evidence links.

Changes

Improved

2
  • protectPick the package approval plan in the native runtime (#7174) Evidence for this change
  • entitlementBuild the OAuth package-firewall grant in the native runtime (#7171) Evidence for this change
    • Merged pull request #7133: refactor(approvals): merge the approval surface link in the native runtime (#7133)
    • Merged pull request #7131: refactor(adapters): decide Cursor and Copilot probe warnings in the native runtime (#7131)
    • Merged pull request #7166: fix(muse): keep skill discovery issue ids free of local paths (#7166)
    • Direct commit c770d9173a6f: Merge branch 'main' into feat/guard-yanez-pulse-crate
    • Merged pull request #7102: fix(cigar): show the quoted lines when CIGAR picks other lines of the same file (#7102)
    • Merged pull request #7171: refactor(entitlement): build the OAuth package-firewall grant in the native runtime (#7171)
    • Merged pull request #7127: refactor(local-cli): recognize pasted operator CLIs in the native runtime (#7127)
    • Merged pull request #7170: refactor(inventory): resolve inventory item descriptions in the native runtime (#7170)
    • Merged pull request #7174: refactor(protect): pick the package approval plan in the native runtime (#7174)
    • Merged pull request #7085: refactor(opencode): edit refreshed launcher commands in the native runtime (#7085)
    • Merged pull request #7128: feat(connect): report Cloud actions from hol-guard connect (#7128)
    • Merged pull request #7107: feat(runners): contain Jasmine, QUnit and uvu runs that stay in their workspace (#7107)
    • Merged pull request #7089: feat(dashboard): show where each Extension runs (#7089)
    • Merged pull request #7164: fix(dashboard): make Cloud actions links and commands accessible (#7164)
    • Merged pull request #7103: refactor(review): authenticate stored Review outbox events in the native runtime (#7103)
    • Merged pull request #7165: refactor(cline): pick the MCP servers to proxy in the native runtime (#7165)
    • Merged pull request #7101: fix(cigar): wake a resting CIGAR worker when a Claude Code session starts (#7101)
    • Merged pull request #7110: refactor(workspace): check rule detector findings in the native runtime (#7110)
    • Merged pull request #7121: fix(guard): read the columns paste, join and column lay out (#7121)
    • Merged pull request #7108: fix(runners): read tsx --test the way node --test already reads it (#7108)
    • Merged pull request #7148: fix(network): verify a network protection bundle too large for a request frame (#7148)
    • Merged pull request #7150: refactor(workspace): carry unchecked findings in the native runtime (#7150)
    • Merged pull request #7097: refactor(network): build the network status payload in the native runtime (#7097)
    • Merged pull request #7117: refactor(extensions): shape-check stored review hints in the native runtime (#7117)
    • Merged pull request #7144: refactor(memory): derive memory decision receipt fields in the native runtime (#7144)
    • Merged pull request #7152: fix(mcp): say when a server exits before Guard's discovery probe hears it (#7152)
    • Merged pull request #7119: feat(extensions): add the rupa command extension
    • Merged pull request #7162: refactor(opencode): normalize OpenCode configs for install in the native runtime (#7162)
    • Merged pull request #7158: refactor(inventory): classify MCP server tools in the native runtime (#7158)
    • Merged pull request #7129: refactor(connectors): pick and check Protect's connector rows in the native runtime (#7129)
    • Merged pull request #7106: fix(cigar): projects count for every app and Home explains CIGAR again (#7106)
    • Merged pull request #7105: refactor(local-cli): check custom-extension change requests in the native runtime (#7105)
    • Merged pull request #7098: fix(guard-command): give AVA the contained run Vitest, Jest and Mocha already have (#7098)
    • Direct commit bd265de2cb21: fix(package): review the package npm's config adds to an npx launch
    • Merged pull request #7124: refactor(guard): retire Python helpers that only tests still called (#7124)
    • Merged pull request #7149: fix(network): refresh a lapsed token before giving up on the network bundle (#7149)
    • Merged pull request #7104: fix(cloud-actions): let the local Cloud actions reads run without a review (#7104)
    • Merged pull request #7123: refactor(catalog): attribute catalog migrations in the native runtime (#7123)
    • Merged pull request #7111: fix(runners): read tape and tsd runs inside their own workspace (#7111)
    • Merged pull request #7142: refactor(cloud): build the access graph snapshot in the native runtime (#7142)
    • Merged pull request #7168: refactor(policy): render policy init starters in the native runtime (#7168)
    • Merged pull request #7125: fix(guard): read the lines nl, tac, rev, fold, expand and fmt lay out (#7125)
    • Merged pull request #7136: refactor(approvals): page saved native business requests in the native runtime (#7136)
    • Merged pull request #7035: fix(package): review the package npm's config adds to an npx launch (#7035)
    • Merged pull request #7143: refactor(cline): decide the Cline install transport in the native runtime (#7143)
    • Merged pull request #7141: refactor(memory): build memory decision events in the native runtime (#7141)
    • Merged pull request #6562: feat(guard-yanez-pulse): verify Yanez Pulse approval receipts
    • Merged pull request #7138: fix(network-protection): verify bundles whose threat feeds exceed 4,096 entries (#7138)
    • Merged pull request #7156: fix(review): stop advising a split that cannot reduce a chained review (#7156)
    • Merged pull request #7147: refactor(workspace): settle applied dependency fixes in the native runtime (#7147)
    • Merged pull request #7116: docs(extensions): test contributions with an installed Guard (#7116)
    • Merged pull request #7145: fix(guard): let CIGAR read React files that pass a password prop (#7145)
    • Merged pull request #7099: refactor(mcp): read MCP registry search pages in the native runtime (#7099)
    • Merged pull request #7153: fix(runners): read tap, borp, poku and lab runs inside their own workspace (#7153)
    • Merged pull request #7177: fix(aibom): upload one primary body per inventory item
    • Merged pull request #7161: fix(guard): give a session's first prompt code while CIGAR starts (#7161)
    • Merged pull request #7113: refactor(mcp): check policy tool arguments in the native runtime (#7113)
    • Merged pull request #7100: refactor(review): plan signed policy-memory rules in the native runtime (#7100)
    • Merged pull request #7155: fix(git): allow a shared-objects clone of a local checkout (#7155)
    • Merged pull request #7135: fix(worktree): recognise a branch named after the worktree start point (#7135)
    • Merged pull request #7134: refactor(mcp): check reviewed Codex MCP setup selections in the native runtime (#7134)
    • Merged pull request #7167: refactor(mcp): read a Guard proxy's upstream launch in the native runtime (#7167)
    • Merged pull request #7154: fix(approvals): open paused reviews signed in, and in HOL Guard Desktop when it is installed (#7154)
    • Merged pull request #7120: refactor(local-cli): serve curated CLI profiles from the native runtime (#7120)
    • Merged pull request #7114: fix(runners): read cucumber-js runs inside their own workspace (#7114)
    • Merged pull request #7146: refactor(history): recover receipt heredoc scripts in the native runtime (#7146)
    • Merged pull request #7157: fix(prompt): stop holding secret-category prompts and review their tool calls instead (#7157)
    • Merged pull request #7132: fix(claude): move upgraded installs back onto the native SessionStart lane (#7132)
    • Merged pull request #7091: refactor(trust-attestation): plan attestation payloads and bindings in the native runtime (#7091)
    • Merged pull request #7159: refactor(inventory): redact inventory exports in the native runtime (#7159)
    • Merged pull request #7112: refactor(local-cli): decide connector review regroups in the native runtime (#7112)
    • Merged pull request #7118: fix(guard): read a sort key, field separator or buffer size as the option value it is (#7118)
    • Merged pull request #7115: refactor(mcp): sanitize MCP tool output in the native runtime (#7115)

Fixed

2

Other changes

1

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.59.0a44

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger73 credits