Release notes

HOL Guard v3.60.0a80

Preview

HOL Guard v3.60.0a80, released November 13, 2026, is a preview release with 5 additions, 1 improvement, 8 fixes and 2 other changes across 15 merged pull requests. Highlights: Add benign and attack corpora for cloud action packs; Add Core update preferences.

Changes since the previous release on this channel: alpha/v3.60.0a79alpha/v3.60.0a80

5 added · 1 improved · 8 fixed · 2 other

Published Original GitHub release for alpha/v3.60.0a80

Key facts

Version
v3.60.0a80
Channel
Preview
Published
Previous release
alpha/v3.60.0a79
Merged pull requests
15

Documented changes

16 typed entries

Verified contributors

Credits being verified. Attribution coverage is in progress.

Attribution coverage

attribution in progress; history inventory partial.

Install

Current installation guide

Scope

Guard v3.60.0a80 is a preview release published 2026-11-13. Upstream documents: Guard 3.60.0a80 is an opt-in prerelease cut from 869364b. Stable installations remain on the stable channel. 15 commits • 15 merged pull requests • 2 contributors since Guard 3.60.0a79. Its comparison base is alpha/v3.60.0a79. It includes 16 verified contribution deliveries with public evidence links. Attribution for this release is being verified.

Changes

Added

5
  • guardAdd benign and attack corpora for cloud action packs (#7640) Evidence for this change
    • tests/fixtures/cloud_benign_corpus.json: 166 ordinary tasks across Slack, GitHub, Notion, Gmail, Drive and Calendar. At most 5% may ask for review, and none may be blocked.
    • tests/fixtures/cloud_attack_corpus.json: 100 attacks (secret exfiltration, public sharing, prompt-injected deletes, money and permission changes). Each must reach review or block; none may run without the user.
    • Every secret kind the attack corpus plants must be one the output inspector detects, so a corpus case can't pass by planting a secret Guard doesn't recognize.
  • updateAdd Core update preferences (#7641) Evidence for this change
    • Add a user-level Core update mode with Automatic, Ask first, and Off choices.
    • Stop the command queue from installing when the user has chosen Ask first or Off, and suppress background retries of a failed target version until a newer release is available.
    • Expose the saved preference in the update panel without installing when the setting changes, and keep native settings reads and exports in sync with the saved value.
  • guardOffer bounded Always allow on cloud action reviews (#7632) Evidence for this change
    • consent_options gains up to two {"kind": "always", "scope": "bounded", "selector", "selector_sha256"} choices. The selector pins the provider, class, object and reversibility. It bounds the record count, or for an…
    • No bounded choice is offered when the object, reversibility or count is unknown, when the call is known to reach outside the workspace, or when the count exceeds 1000. Permanent and unknown-reversibility re-approvals…
    • Resource and bounded consents no longer answer a call in a session that saw an injection signal. They also no longer answer an outbound call in a session that read untrusted or sensitive content or keeps no journal.…
  • guardExpand the Slack, GitHub and Notion cloud action packs (#7631) Evidence for this change
    • Slack (3 → 14 actions): message update and delete, file delete, channel archive and restore, invite, Slack Connect invite, remove member, reactions, pins and channel topics.
    • GitHub (→ 17 actions): issues, comments and labels, pull request reviews (comment or request changes only; an approving review is refused) and merges, branch delete and force update, repository archive, visibility…
    • Notion (→ 14 actions): page property setters, page archive and restore, block delete, database query and creation, and database column removal and type changes.
  • mcp-serversAdd the opt-in Bunker MCP contribution (#7645) Evidence for this change

Improved

1

Fixed

8
  • guardOpen a relayed approval link that is one character off (#7642) Evidence for this change
    • Daemon (native_review_link_repair.rs): a short link with at most one dropped, added or changed character across the id, expiry and MAC now opens the request it was signed for. Every repair must verify by HMAC for…
    • Gauntlet judge (approval_retry_relay.py): each relayed short link is opened against the fixture's own daemon without following the redirect, and counts only when the daemon sends it to a page signed for a request…
    • Gauntlet runners: Guard takes the relayed link's origin from the daemon's runtime state, which an installed daemon records from its heartbeat. The fixture daemon listens on a free port and recorded nothing, so the…
  • piHarden managed extension rendering (#7643) Evidence for this change
    • Escape managed Pi and Oh My Pi display names before embedding them in generated JavaScript.
    • Validate approval links, fail closed when browser-policy state cannot be read, and avoid shell parsing for Windows browser launches.
    • Add renderer regression coverage and refresh the recorded render vectors.
  • guardLet Cursor read back its own saved shell and tool output from the shell (#7646) Evidence for this change
  • guardClear three core Gauntlet failures on main (#7624) Evidence for this change
    • Names-only environment listing. The omp-native-environment-variable-names case piped printenv into an anchored grep -o, and the rules shipped since #7424 allowed that shape. That proof is unsound and this…
    • A printenv or env dump piped into any filter (grep, cut, awk -F=) keeps its review again. The process-environment-secret-read rule observes those segments as it did before #7424, and the prompt scan no longer…
    • The proven listing is now one that never renders a value: awk 'BEGIN { for (name in ENVIRON) print name }'. The program runs before any input is read, names no file, and never indexes ENVIRON, so only keys reach…
  • guardRead an apostrophe in a heredoc commit message as message text (#7626) Evidence for this change
  • guardRefuse searches that read through a link out of the checkout (#7627) Evidence for this change
  • guardLet the contained sink ask the daemon when the resident defers (#7623) Evidence for this change
  • guardRun a perl in-place edit with a separate -i switch in the workspace sandbox (#7625) Evidence for this change

Other changes

2
  • Guard 3.60.0a80 is an opt-in prerelease cut from 869364b. Stable installations remain on the stable channel. 15 commits • 15 merged pull requests • 2 contributors since Guard 3.60.0a79. Evidence for this change
  • readmeAdd sponsor logos (#7644) Evidence for this change
    • Merged pull request #7624: fix(guard): clear three core Gauntlet failures on main
    • Merged pull request #7646: fix(guard): let Cursor read back its own saved shell and tool output from the shell
    • Merged pull request #7631: feat(guard): expand the Slack, GitHub and Notion cloud action packs
    • Merged pull request #7632: feat(guard): offer bounded Always allow on cloud action reviews
    • Merged pull request #7625: fix(guard): run a perl in-place edit with a separate -i switch in the workspace sandbox
    • Merged pull request #7623: fix(guard): let the contained sink ask the daemon when the resident defers
    • Merged pull request #7627: fix(guard): refuse searches that read through a link out of the checkout
    • Merged pull request #7626: fix(guard): read an apostrophe in a heredoc commit message as message text
    • Merged pull request #7645: feat(mcp-servers): add the opt-in Bunker MCP contribution
    • Merged pull request #7644: docs(readme): add sponsor logos
    • Merged pull request #7641: feat(update): add Core update preferences
    • Merged pull request #7633: refactor(guard): move the Devin, Gemini, Antigravity, Kimi, OpenClaw, Paseo and Muse adapters into the native runtime
    • Merged pull request #7643: fix(pi): harden managed extension rendering
    • Merged pull request #7642: fix(guard): open a relayed approval link that is one character off
    • Merged pull request #7640: feat(guard): add benign and attack corpora for cloud action packs
    • Direct commit 777ae77b7852: feat(mcp-servers): add the opt-in Bunker MCP contribution

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.60.0a79

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger16 credits