Release notes

HOL Guard v3.44.0

Stable

Published October 14, 2026Original GitHub release for v3.44.0

Documented changes

200 typed entries

Verified contributors

Credits being verified. Attribution coverage is in progress.

Attribution coverage

attribution in progress; history inventory partial.

Install

Current installation guide

Scope

Guard v3.44.0 is a stable release published 2026-10-14. Upstream documents: Guard 3.44.0 is a stable release cut from [`300395d`](https://github.com/hashgraph-online/hol-guard/commit/300395d837a74dd3914bf372631398d340a829dc). **244 commits • 239 merged pull requests • 7 contributors** since [Guard 3.43.1](https://github.com/hashgraph-online/hol-guard/releases/tag/v3.43.1). Its comparison base is v3.43.1. It includes 259 verified contribution deliveries with public evidence links. Attribution for this release is being verified.

Improved

This release spans too many changes to list; browse the [full commit history](https://github.com/hashgraph-online/hol-guard/commits/300395d837a74dd3914bf372631398d340a829dc). Evidence for: This release spans too many changes to list; browse the [full commit history](https://github.com/hashgraph-online/hol-guard/commits/300395d837a74dd3914bf372631398d340a829dc).

Other changes

199

Documented change: Guard 3.44.0 is a stable release cut from [`300395d`](https://github.com/hashgraph-online/hol-guard/commit/300395d837a74dd3914bf372631398d340a829dc). **244 commits • 239 merged pull requests • 7 contributors** since [Guard 3.43.1](https://github.com/hashgraph-online/hol-guard/releases/tag/v3.43.1). Evidence for: Documented change: Guard 3.44.0 is a stable release cut from [`300395d`](https://github.com/hashgraph-online/hol-guard/commit/300395d837a74dd3914bf372631398d340a829dc). **244 commits • 239 merged pull requests • 7 contributors** since [Guard 3.43.1](https://github.com/hashgraph-online/hol-guard/releases/tag/v3.43.1).
Direct commit 654377508c81: test(guard): isolate sibling fixtures and borrow formatted command Evidence for: Direct commit 654377508c81: test(guard): isolate sibling fixtures and borrow formatted command
Merged pull request #4377: fix(guard): let --ignore-scripts installs of a git-free tree continue on npm 11.9 and later (#4377) Evidence for: Merged pull request #4377: fix(guard): let --ignore-scripts installs of a git-free tree continue on npm 11.9 and later (#4377)
Merged pull request #4428: refactor(guard): delete store and config helpers that nothing calls (#4428) Evidence for: Merged pull request #4428: refactor(guard): delete store and config helpers that nothing calls (#4428)
Merged pull request #4337: feat(guard): answer reviewed PostToolUse hooks from the resident (#4337) Evidence for: Merged pull request #4337: feat(guard): answer reviewed PostToolUse hooks from the resident (#4337)
Merged pull request #4374: fix(guard): let script-free npm installs continue from ordinary developer shells (#4374) Evidence for: Merged pull request #4374: fix(guard): let script-free npm installs continue from ordinary developer shells (#4374)
Merged pull request #4420: test(ci): distribute complete AWS safety contract commands across bounded pytest nodes (#4420) Evidence for: Merged pull request #4420: test(ci): distribute complete AWS safety contract commands across bounded pytest nodes (#4420)
Merged pull request #4442: refactor(mcp): project each tools/call in one resident round trip (#4442) Evidence for: Merged pull request #4442: refactor(mcp): project each tools/call in one resident round trip (#4442)
Merged pull request #4473: fix(guard): allow chains that stage and reuse private temp files (#4473) Evidence for: Merged pull request #4473: fix(guard): allow chains that stage and reuse private temp files (#4473)
Merged pull request #4287: fix(gauntlet): list required commands as plain lines in the agent prompt (#4287) Evidence for: Merged pull request #4287: fix(gauntlet): list required commands as plain lines in the agent prompt (#4287)
Merged pull request #4524: fix(guard): allow git worktree add for an existing branch Evidence for: Merged pull request #4524: fix(guard): allow git worktree add for an existing branch
Merged pull request #4496: fix(guard): prove git ls-tree and plain cat-file object reads (#4496) Evidence for: Merged pull request #4496: fix(guard): prove git ls-tree and plain cat-file object reads (#4496)
Merged pull request #4518: fix(guard): admit bare builtins and object filters in jq file reads Evidence for: Merged pull request #4518: fix(guard): admit bare builtins and object filters in jq file reads
Direct commit bd0fee06d660: fix(guard): retain projection-only jq stdin proof while allowing bounded file filters Evidence for: Direct commit bd0fee06d660: fix(guard): retain projection-only jq stdin proof while allowing bounded file filters
Merged pull request #4357: fix(guard): stop false blocks on routine git, listing and web-fetch work in agent sessions (#4357) Evidence for: Merged pull request #4357: fix(guard): stop false blocks on routine git, listing and web-fetch work in agent sessions (#4357)
Merged pull request #4453: feat(guard): sign native review approval links in the resident (#4453) Evidence for: Merged pull request #4453: feat(guard): sign native review approval links in the resident (#4453)
Merged pull request #4419: ci: run Windows shim security gates in parallel without dropping coverage (#4419) Evidence for: Merged pull request #4419: ci: run Windows shim security gates in parallel without dropping coverage (#4419)
Merged pull request #4317: feat(guard): answer OpenCode shell reviews from the native bounded bridge (#4317) Evidence for: Merged pull request #4317: feat(guard): answer OpenCode shell reviews from the native bounded bridge (#4317)
Merged pull request #4436: fix(guard): let frozen script-free installs, local package runners and plain printenv proceed (#4436) Evidence for: Merged pull request #4436: fix(guard): let frozen script-free installs, local package runners and plain printenv proceed (#4436)
Merged pull request #4300: feat(guard): answer sensitive-request classifiers in the native resident (#4300) Evidence for: Merged pull request #4300: feat(guard): answer sensitive-request classifiers in the native resident (#4300)
Merged pull request #4323: fix(ci): give the native command evaluator job room for the larger replay gate (#4323) Evidence for: Merged pull request #4323: fix(ci): give the native command evaluator job room for the larger replay gate (#4323)
Merged pull request #4502: feat(runtime): prove bridge and resident identity on Windows (#4502) Evidence for: Merged pull request #4502: feat(runtime): prove bridge and resident identity on Windows (#4502)
Merged pull request #4433: ci: avoid redundant fat-LTO link in shipped runtime size gate (#4433) Evidence for: Merged pull request #4433: ci: avoid redundant fat-LTO link in shipped runtime size gate (#4433)
Merged pull request #4427: fix(guard): let agents read and write .gitignore and rename branches without review (#4427) Evidence for: Merged pull request #4427: fix(guard): let agents read and write .gitignore and rename branches without review (#4427)
Merged pull request #4333: feat(guard): let agents look up npm packages without a prompt (#4333) Evidence for: Merged pull request #4333: feat(guard): let agents look up npm packages without a prompt (#4333)
Merged pull request #4411: ci: finish native evaluator producer under five minutes without skipping gates (#4411) Evidence for: Merged pull request #4411: ci: finish native evaluator producer under five minutes without skipping gates (#4411)
Merged pull request #4446: fix(guard): review writes to harness configuration inside the workspace (#4446) Evidence for: Merged pull request #4446: fix(guard): review writes to harness configuration inside the workspace (#4446)
Direct commit f0faa4f4b6cf: fix(ci): own the Rust nextest config in the hook data-plane contract Evidence for: Direct commit f0faa4f4b6cf: fix(ci): own the Rust nextest config in the hook data-plane contract
Merged pull request #4440: perf(guard): reuse registry metadata between npm install reviews (#4440) Evidence for: Merged pull request #4440: perf(guard): reuse registry metadata between npm install reviews (#4440)
Merged pull request #4311: fix(guard): let routine agent sessions run without false stops (#4311) Evidence for: Merged pull request #4311: fix(guard): let routine agent sessions run without false stops (#4311)
Merged pull request #4328: fix(guard): let ordinary variables on build commands run (#4328) Evidence for: Merged pull request #4328: fix(guard): let ordinary variables on build commands run (#4328)
Merged pull request #4437: feat(guard): spend an approve-once for a reviewed PreToolUse in the resident (#4437) Evidence for: Merged pull request #4437: feat(guard): spend an approve-once for a reviewed PreToolUse in the resident (#4437)
Merged pull request #4307: feat(guard): run the Codex hook bridge in the native runtime (#4307) Evidence for: Merged pull request #4307: feat(guard): run the Codex hook bridge in the native runtime (#4307)
Direct commit 0265a0437d6e: fix(guard): fail closed on unparsed cp and touch destinations Evidence for: Direct commit 0265a0437d6e: fix(guard): fail closed on unparsed cp and touch destinations
Merged pull request #4521: fix(guard): report a Cloudflare block of Guard Cloud as a network failure, not an expired sign-in (#4521) Evidence for: Merged pull request #4521: fix(guard): report a Cloudflare block of Guard Cloud as a network failure, not an expired sign-in (#4521)
Merged pull request #2943: [extension] command.ai-dev: ai-dev command safety extension (#2943) Evidence for: Merged pull request #2943: [extension] command.ai-dev: ai-dev command safety extension (#2943)
Merged pull request #4355: feat(guard): answer PreToolUse hooks under custom extension rules when no local CLI launches (#4355) Evidence for: Merged pull request #4355: feat(guard): answer PreToolUse hooks under custom extension rules when no local CLI launches (#4355)
Merged pull request #4479: fix(guard): allow docker listings, loopback nc probes and guard-prefixed help (#4479) Evidence for: Merged pull request #4479: fix(guard): allow docker listings, loopback nc probes and guard-prefixed help (#4479)
Merged pull request #4439: fix(guard): let read-only git grep searches proceed without review (#4439) Evidence for: Merged pull request #4439: fix(guard): let read-only git grep searches proceed without review (#4439)
Merged pull request #4373: feat(guard): answer bounded harness hooks from the resident (#4373) Evidence for: Merged pull request #4373: feat(guard): answer bounded harness hooks from the resident (#4373)
Merged pull request #4409: perf(guard): record and forget observed custom extensions in the resident store op (#4409) Evidence for: Merged pull request #4409: perf(guard): record and forget observed custom extensions in the resident store op (#4409)
Merged pull request #4296: fix(guard): accept Windows home spellings in Oh My Pi agent-root listings (#4296) Evidence for: Merged pull request #4296: fix(guard): accept Windows home spellings in Oh My Pi agent-root listings (#4296)
Merged pull request #4340: feat(guard): answer reviewed UserPromptSubmit hooks from the resident (#4340) Evidence for: Merged pull request #4340: feat(guard): answer reviewed UserPromptSubmit hooks from the resident (#4340)
Merged pull request #4266: fix(gauntlet): stop exporting a Unix loader path in the Windows realistic environment (#4266) Evidence for: Merged pull request #4266: fix(gauntlet): stop exporting a Unix loader path in the Windows realistic environment (#4266)
Merged pull request #4285: fix(guard): let pushes of the checked-out branch to a GitHub origin proceed natively (#4285) Evidence for: Merged pull request #4285: fix(guard): let pushes of the checked-out branch to a GitHub origin proceed natively (#4285)
Merged pull request #4541: fix(guard): release Oh My Pi eval output for proved shell calls Evidence for: Merged pull request #4541: fix(guard): release Oh My Pi eval output for proved shell calls
Merged pull request #4477: fix(guard): admit file-less subdirectories on the current policy snapshot (#4477) Evidence for: Merged pull request #4477: fix(guard): admit file-less subdirectories on the current policy snapshot (#4477)
Merged pull request #4454: refactor(context-digest): drop request kinds no client sends anymore (#4454) Evidence for: Merged pull request #4454: refactor(context-digest): drop request kinds no client sends anymore (#4454)
Merged pull request #4349: feat(guard): answer terminal PreToolUse blocks from the resident (#4349) Evidence for: Merged pull request #4349: feat(guard): answer terminal PreToolUse blocks from the resident (#4349)
Merged pull request #4347: feat(guard): answer warned PreToolUse allows from the resident (#4347) Evidence for: Merged pull request #4347: feat(guard): answer warned PreToolUse allows from the resident (#4347)
Merged pull request #4336: fix(guard): let contained pytest on macOS load packages installed with pip --user (#4336) Evidence for: Merged pull request #4336: fix(guard): let contained pytest on macOS load packages installed with pip --user (#4336)
Merged pull request #4414: perf(guard): read custom-extension grants and command choices in the resident store op (#4414) Evidence for: Merged pull request #4414: perf(guard): read custom-extension grants and command choices in the resident store op (#4414)
Merged pull request #4402: perf(guard): compose generic-hook approval reuse in the grouped saved-decision call (#4402) Evidence for: Merged pull request #4402: perf(guard): compose generic-hook approval reuse in the grouped saved-decision call (#4402)
Merged pull request #4407: perf(guard): build the generic hook's approval context token in the saved-decision lookup (#4407) Evidence for: Merged pull request #4407: perf(guard): build the generic hook's approval context token in the saved-decision lookup (#4407)
Direct commit 5e5d031b6b0f: Merge branch 'main' into feat/command-ai-dev-extension Evidence for: Direct commit 5e5d031b6b0f: Merge branch 'main' into feat/command-ai-dev-extension
Merged pull request #4379: fix(guard): accept every Oh My Pi line selector on reads Guard already allows (#4379) Evidence for: Merged pull request #4379: fix(guard): accept every Oh My Pi line selector on reads Guard already allows (#4379)
Merged pull request #4458: refactor(guard): remove four unreachable Python modules (#4458) Evidence for: Merged pull request #4458: refactor(guard): remove four unreachable Python modules (#4458)
Merged pull request #4463: fix(guard): keep macOS sandbox patterns within Seatbelt's string limit (#4463) Evidence for: Merged pull request #4463: fix(guard): keep macOS sandbox patterns within Seatbelt's string limit (#4463)
Merged pull request #4520: fix(guard): treat git search patterns as search text, not paths (#4520) Evidence for: Merged pull request #4520: fix(guard): treat git search patterns as search text, not paths (#4520)
Merged pull request #4345: fix(guard): keep Git commands that write repository metadata out of the workspace sandbox (#4345) Evidence for: Merged pull request #4345: fix(guard): keep Git commands that write repository metadata out of the workspace sandbox (#4345)
Merged pull request #4298: fix(guard): let names-only listings of skill directories and missing paths proceed (#4298) Evidence for: Merged pull request #4298: fix(guard): let names-only listings of skill directories and missing paths proceed (#4298)
Merged pull request #4444: fix(guard): let frozen lockfile installs without scripts run without review (#4444) Evidence for: Merged pull request #4444: fix(guard): let frozen lockfile installs without scripts run without review (#4444)
Merged pull request #4371: fix(guard): let commits in a contained linked worktree clear AUTO_MERGE (#4371) Evidence for: Merged pull request #4371: fix(guard): let commits in a contained linked worktree clear AUTO_MERGE (#4371)
Merged pull request #4508: test(guard): leave the background evidence drain out of the pi hook RPC budget (#4508) Evidence for: Merged pull request #4508: test(guard): leave the background evidence drain out of the pi hook RPC budget (#4508)
Merged pull request #4466: feat(guard): pause reviewed PreToolUse hooks with a queued approval from the resident (#4466) Evidence for: Merged pull request #4466: feat(guard): pause reviewed PreToolUse hooks with a queued approval from the resident (#4466)
Merged pull request #4534: fix(guard): let contained test runs pipe output through grep Evidence for: Merged pull request #4534: fix(guard): let contained test runs pipe output through grep
Merged pull request #4491: fix(codex): leave Codex approval requests to Codex's own prompt (#4491) Evidence for: Merged pull request #4491: fix(codex): leave Codex approval requests to Codex's own prompt (#4491)
Merged pull request #4372: fix(gauntlet): judge the Python full task's tests by what they import (#4372) Evidence for: Merged pull request #4372: fix(gauntlet): judge the Python full task's tests by what they import (#4372)
Merged pull request #4338: feat(guard): let script-free npm installs with trimmed output continue without review (#4338) Evidence for: Merged pull request #4338: feat(guard): let script-free npm installs with trimmed output continue without review (#4338)
Merged pull request #4470: fix(guard): run checks contained, then the proven Git steps, for check-then-publish chains (#4470) Evidence for: Merged pull request #4470: fix(guard): run checks contained, then the proven Git steps, for check-then-publish chains (#4470)
Merged pull request #4451: refactor(mcp): retire the Python tool-call risk helpers now that call_projection owns risk (#4451) Evidence for: Merged pull request #4451: refactor(mcp): retire the Python tool-call risk helpers now that call_projection owns risk (#4451)
Merged pull request #4488: feat(guard): answer Cursor reviews and prompts from the resident (#4488) Evidence for: Merged pull request #4488: feat(guard): answer Cursor reviews and prompts from the resident (#4488)
Merged pull request #4321: feat(guard): let npm installs that run no package code continue without review (#4321) Evidence for: Merged pull request #4321: feat(guard): let npm installs that run no package code continue without review (#4321)
Merged pull request #4482: fix(guard): allow bounded in-place sed substitutions on workspace files (#4482) Evidence for: Merged pull request #4482: fix(guard): allow bounded in-place sed substitutions on workspace files (#4482)
Merged pull request #4438: perf(guard): fetch each registry document once per package review (#4438) Evidence for: Merged pull request #4438: perf(guard): fetch each registry document once per package review (#4438)
Merged pull request #4449: feat(guard): publish the review queue facts in the direct-lane binding (#4449) Evidence for: Merged pull request #4449: feat(guard): publish the review queue facts in the direct-lane binding (#4449)
Merged pull request #4308: feat(guard): let agents create a private GitHub repository without a prompt (#4308) Evidence for: Merged pull request #4308: feat(guard): let agents create a private GitHub repository without a prompt (#4308)
Merged pull request #4400: perf(ci): parallelize Rust compilation and prioritize slow tests (#4400) Evidence for: Merged pull request #4400: perf(ci): parallelize Rust compilation and prioritize slow tests (#4400)
Merged pull request #4378: fix(guard): let recursive search read feature directories named after secrets (#4378) Evidence for: Merged pull request #4378: fix(guard): let recursive search read feature directories named after secrets (#4378)
Merged pull request #4450: ci(gates): run the benign false-positive gates on macOS (#4450) Evidence for: Merged pull request #4450: ci(gates): run the benign false-positive gates on macOS (#4450)
Merged pull request #4513: fix(guard): accept a trailing command terminator and version checks after cd (#4513) Evidence for: Merged pull request #4513: fix(guard): accept a trailing command terminator and version checks after cd (#4513)
Merged pull request #4389: feat(guard): answer Grok hooks from the resident (#4389) Evidence for: Merged pull request #4389: feat(guard): answer Grok hooks from the resident (#4389)
Merged pull request #4394: fix(guard): point chained public repo creates to the private alternative (#4394) Evidence for: Merged pull request #4394: fix(guard): point chained public repo creates to the private alternative (#4394)
Merged pull request #4393: fix(guard): tell agents to retry when the native policy is not ready (#4393) Evidence for: Merged pull request #4393: fix(guard): tell agents to retry when the native policy is not ready (#4393)
Merged pull request #4485: fix(guard): keep sync working on stores with more than 4,096 events (#4485) Evidence for: Merged pull request #4485: fix(guard): keep sync working on stores with more than 4,096 events (#4485)
Merged pull request #4395: feat(guard): answer Claude permission dialogs without a Guard notice from the resident (#4395) Evidence for: Merged pull request #4395: feat(guard): answer Claude permission dialogs without a Guard notice from the resident (#4395)
Merged pull request #4375: fix(guard): name the home-directory bound when git worktree add leaves home (#4375) Evidence for: Merged pull request #4375: fix(guard): name the home-directory bound when git worktree add leaves home (#4375)
Merged pull request #4528: feat(mcp): relay MCP stdio traffic natively behind a fail-closed decision seam Evidence for: Merged pull request #4528: feat(mcp): relay MCP stdio traffic natively behind a fail-closed decision seam
Merged pull request #4535: chore(scope): count dashboard, probe, audit and update-only helpers as control plane Evidence for: Merged pull request #4535: chore(scope): count dashboard, probe, audit and update-only helpers as control plane
Merged pull request #4361: fix(gauntlet): count a full task's failed contained command as Guard's only when the sandbox refused it (#4361) Evidence for: Merged pull request #4361: fix(gauntlet): count a full task's failed contained command as Guard's only when the sandbox refused it (#4361)
Merged pull request #4343: fix(guard): stop blocking login status output that shows only a masked token (#4343) Evidence for: Merged pull request #4343: fix(guard): stop blocking login status output that shows only a masked token (#4343)
Merged pull request #4350: fix(guard): stop flagging everyday search, process, push and env-prefixed build commands (#4350) Evidence for: Merged pull request #4350: fix(guard): stop flagging everyday search, process, push and env-prefixed build commands (#4350)
Merged pull request #4431: fix(guard): allow plain Git config writes, grep and start-point branches in proven repositories (#4431) Evidence for: Merged pull request #4431: fix(guard): allow plain Git config writes, grep and start-point branches in proven repositories (#4431)
Merged pull request #4418: refactor(guard): retire dead Python command catalog and matcher tests (#4418) Evidence for: Merged pull request #4418: refactor(guard): retire dead Python command catalog and matcher tests (#4418)
Merged pull request #4489: fix(guard): treat package-manager directory flags like cd into that directory (#4489) Evidence for: Merged pull request #4489: fix(guard): treat package-manager directory flags like cd into that directory (#4489)
Merged pull request #4417: fix(guard): keep git read proofs after a glob-pathspec log in the same command (#4417) Evidence for: Merged pull request #4417: fix(guard): keep git read proofs after a glob-pathspec log in the same command (#4417)
Merged pull request #4309: refactor(guard): stop loading the Python sensitive-request classifiers (#4309) Evidence for: Merged pull request #4309: refactor(guard): stop loading the Python sensitive-request classifiers (#4309)
Merged pull request #4290: refactor(guard): classify GitHub shell requests in Rust (#4290) Evidence for: Merged pull request #4290: refactor(guard): classify GitHub shell requests in Rust (#4290)
Merged pull request #4424: fix(updates): publish and select Linux Desktop alpha Core releases (#4424) Evidence for: Merged pull request #4424: fix(updates): publish and select Linux Desktop alpha Core releases (#4424)
Merged pull request #4250: fix(guard): scope Protect-screen per-app protection to apps Guard manages Evidence for: Merged pull request #4250: fix(guard): scope Protect-screen per-app protection to apps Guard manages
Merged pull request #4376: fix(gauntlet): build Docker full tasks in the container user's own home (#4376) Evidence for: Merged pull request #4376: fix(gauntlet): build Docker full tasks in the container user's own home (#4376)
Merged pull request #4478: fix(guard): allow sibling repository reads with print filters, globs and several directories (#4478) Evidence for: Merged pull request #4478: fix(guard): allow sibling repository reads with print filters, globs and several directories (#4478)
Merged pull request #4276: chore(release): 3.44.0 Evidence for: Merged pull request #4276: chore(release): 3.44.0
Merged pull request #4360: fix(guard): let agents create a private GitHub repository without review (#4360) Evidence for: Merged pull request #4360: fix(guard): let agents create a private GitHub repository without review (#4360)
Merged pull request #4306: feat(guard): ship the source compiler inside the native runtime (#4306) Evidence for: Merged pull request #4306: feat(guard): ship the source compiler inside the native runtime (#4306)
Merged pull request #4469: fix(gauntlet): await startup publication before binding Watch evidence Evidence for: Merged pull request #4469: fix(gauntlet): await startup publication before binding Watch evidence
Direct commit 96d4d4a5f10e: fix(guard): require loopback host for pg_isready read proof Evidence for: Direct commit 96d4d4a5f10e: fix(guard): require loopback host for pg_isready read proof
Merged pull request #4471: fix(guard): allow host file-tool writes into bracket and $ route files (#4471) Evidence for: Merged pull request #4471: fix(guard): allow host file-tool writes into bracket and $ route files (#4471)
Merged pull request #4365: fix(guard): let script-free npm installs continue on npm releases before 11.9 (#4365) Evidence for: Merged pull request #4365: fix(guard): let script-free npm installs continue on npm releases before 11.9 (#4365)
Merged pull request #4421: fix(guard): allow plain curl reads and read-only kubectl queries (#4421) Evidence for: Merged pull request #4421: fix(guard): allow plain curl reads and read-only kubectl queries (#4421)
Merged pull request #4500: feat(runtime): compile native hook bridges on Windows (#4500) Evidence for: Merged pull request #4500: feat(runtime): compile native hook bridges on Windows (#4500)
Merged pull request #4301: build(release): leave Rust integration tests and fixtures out of the sdist (#4301) Evidence for: Merged pull request #4301: build(release): leave Rust integration tests and fixtures out of the sdist (#4301)
Merged pull request #4299: feat(guard): run unproven local commands in a workspace sandbox instead of asking (#4299) Evidence for: Merged pull request #4299: feat(guard): run unproven local commands in a workspace sandbox instead of asking (#4299)
Merged pull request #4368: feat(guard): answer allowed Cursor hooks from the resident (#4368) Evidence for: Merged pull request #4368: feat(guard): answer allowed Cursor hooks from the resident (#4368)
Merged pull request #4426: perf(gauntlet): scale qualification workers and preserve linked-write protection (#4426) Evidence for: Merged pull request #4426: perf(gauntlet): scale qualification workers and preserve linked-write protection (#4426)
Merged pull request #4429: feat(guard): answer saved exact-action decisions for reviewed PreToolUse from the resident (#4429) Evidence for: Merged pull request #4429: feat(guard): answer saved exact-action decisions for reviewed PreToolUse from the resident (#4429)
Merged pull request #4445: fix(guard): judge chained $VAR uses by their literal in-chain assignment (#4445) Evidence for: Merged pull request #4445: fix(guard): judge chained $VAR uses by their literal in-chain assignment (#4445)
Merged pull request #4448: fix(guard): allow sibling worktree add and linked-worktree fetch with Apple Git (#4448) Evidence for: Merged pull request #4448: fix(guard): allow sibling worktree add and linked-worktree fetch with Apple Git (#4448)
Merged pull request #4510: feat(runtime): launch the native hook bridges on Windows Evidence for: Merged pull request #4510: feat(runtime): launch the native hook bridges on Windows
Merged pull request #4326: feat(guard): answer Codex pre-tool allows from the resident (#4326) Evidence for: Merged pull request #4326: feat(guard): answer Codex pre-tool allows from the resident (#4326)
Merged pull request #4279: test(gauntlet): add git, registry, index-url and lockfile-integrity supply-chain block cases (#4279) Evidence for: Merged pull request #4279: test(gauntlet): add git, registry, index-url and lockfile-integrity supply-chain block cases (#4279)
Merged pull request #4499: test(guard): re-run a gate case once when the native review misses its budget (#4499) Evidence for: Merged pull request #4499: test(guard): re-run a gate case once when the native review misses its budget (#4499)
Merged pull request #4509: fix(guard): prove process probes natively so outside reads can chain with them Evidence for: Merged pull request #4509: fix(guard): prove process probes natively so outside reads can chain with them
Merged pull request #4239: feat: move portable policy compilation and YAML admission to Rust (#4239) Evidence for: Merged pull request #4239: feat: move portable policy compilation and YAML admission to Rust (#4239)
Merged pull request #4292: test(gauntlet): run full developer tasks end to end and list what would stop them (#4292) Evidence for: Merged pull request #4292: test(gauntlet): run full developer tasks end to end and list what would stop them (#4292)
Merged pull request #4324: feat(guard): bind policy snapshots to a freshness proof for direct resident hooks (#4324) Evidence for: Merged pull request #4324: feat(guard): bind policy snapshots to a freshness proof for direct resident hooks (#4324)
Merged pull request #4492: fix(guard): allow chains that copy readable files into private temp files (#4492) Evidence for: Merged pull request #4492: fix(guard): allow chains that copy readable files into private temp files (#4492)
Merged pull request #4325: fix(guard): let the macOS workspace sandbox run Xcode, Homebrew and python.org tools, pipelines and file deletes (#4325) Evidence for: Merged pull request #4325: fix(guard): let the macOS workspace sandbox run Xcode, Homebrew and python.org tools, pipelines and file deletes (#4325)
Merged pull request #4456: fix(guard): prove names-only git log reads with glob pathspecs (#4456) Evidence for: Merged pull request #4456: fix(guard): prove names-only git log reads with glob pathspecs (#4456)
Merged pull request #4498: refactor(guard): answer Kubernetes secret-read checks from the resident (#4498) Evidence for: Merged pull request #4498: refactor(guard): answer Kubernetes secret-read checks from the resident (#4498)
Merged pull request #4280: feat(runtime): prepare contained execution plans in Rust (#4280) Evidence for: Merged pull request #4280: feat(runtime): prepare contained execution plans in Rust (#4280)
Merged pull request #4472: fix(guard-command): allow missing .git probes with Windows home paths (#4472) Evidence for: Merged pull request #4472: fix(guard-command): allow missing .git probes with Windows home paths (#4472)
Merged pull request #4397: feat(guard): compose generic-hook saved decisions in one resident call (#4397) Evidence for: Merged pull request #4397: feat(guard): compose generic-hook saved decisions in one resident call (#4397)
Merged pull request #4422: fix(guard): allow ordinary file work outside the workspace while credential contents and tool config stay reviewed (#4422) Evidence for: Merged pull request #4422: fix(guard): allow ordinary file work outside the workspace while credential contents and tool config stay reviewed (#4422)
Merged pull request #4523: fix(guard): allow gh api reads that merge stderr into stdout (#4523) Evidence for: Merged pull request #4523: fix(guard): allow gh api reads that merge stderr into stdout (#4523)
Merged pull request #4289: fix(guard): accept the guard prefix in contained runs on the Desktop launcher (#4289) Evidence for: Merged pull request #4289: fix(guard): accept the guard prefix in contained runs on the Desktop launcher (#4289)
Merged pull request #4399: feat(guard): answer Claude permission requests with a pending notice from the resident (#4399) Evidence for: Merged pull request #4399: feat(guard): answer Claude permission requests with a pending notice from the resident (#4399)
Direct commit bdaad081bd1f: test(guard): reconcile sandbox-enabled benign gate cases Evidence for: Direct commit bdaad081bd1f: test(guard): reconcile sandbox-enabled benign gate cases
Merged pull request #4455: fix(runtime): stop orphaned Windows residents once their owner and clients exit (#4455) Evidence for: Merged pull request #4455: fix(runtime): stop orphaned Windows residents once their owner and clients exit (#4455)
Merged pull request #4403: feat(guard): answer Claude permission prompt notifications from the resident (#4403) Evidence for: Merged pull request #4403: feat(guard): answer Claude permission prompt notifications from the resident (#4403)
Merged pull request #4476: refactor(guard): retire the Python secret-file request dispatcher (#4476) Evidence for: Merged pull request #4476: refactor(guard): retire the Python secret-file request dispatcher (#4476)
Merged pull request #4329: fix(guard): stop asking before git init, git reads after a listing, and git status outside a repository (#4329) Evidence for: Merged pull request #4329: fix(guard): stop asking before git init, git reads after a listing, and git status outside a repository (#4329)
Direct commit 9cd9117f37da: fix(guard): keep cloud evaluation under the reviewed module line limit Evidence for: Direct commit 9cd9117f37da: fix(guard): keep cloud evaluation under the reviewed module line limit
Merged pull request #4494: fix(guard): release proven Oh My Pi directory listings Evidence for: Merged pull request #4494: fix(guard): release proven Oh My Pi directory listings
Direct commit 1e08d9df0484: fix(extensions): retain discovery status across filters and errors Evidence for: Direct commit 1e08d9df0484: fix(extensions): retain discovery status across filters and errors
Merged pull request #4391: fix(guard): admit read-only for loops over literal words by unrolling them (#4391) Evidence for: Merged pull request #4391: fix(guard): admit read-only for loops over literal words by unrolling them (#4391)
Merged pull request #4415: feat(guard): fall through temporary workspace roots in the resident direct hook lane (#4415) Evidence for: Merged pull request #4415: feat(guard): fall through temporary workspace roots in the resident direct hook lane (#4415)
Merged pull request #4313: feat(guard): answer bounded CLI hooks from the native runtime (#4313) Evidence for: Merged pull request #4313: feat(guard): answer bounded CLI hooks from the native runtime (#4313)
Merged pull request #4278: fix(guard): prove cd ~/ prefixes and relative node_modules entrypoints (#4278) Evidence for: Merged pull request #4278: fix(guard): prove cd ~/ prefixes and relative node_modules entrypoints (#4278)
Merged pull request #4382: fix(guard): keep the evidence drain from tripping the restart circuit (#4382) Evidence for: Merged pull request #4382: fix(guard): keep the evidence drain from tripping the restart circuit (#4382)
Merged pull request #4487: fix(guard): allow local Git writes in proven sibling repositories (#4487) Evidence for: Merged pull request #4487: fix(guard): allow local Git writes in proven sibling repositories (#4487)
Merged pull request #4315: feat(guard): answer Hermes hooks from the native bounded bridge (#4315) Evidence for: Merged pull request #4315: feat(guard): answer Hermes hooks from the native bounded bridge (#4315)
Merged pull request #4486: feat(guard): answer Oh My Pi hooks from the native resident (#4486) Evidence for: Merged pull request #4486: feat(guard): answer Oh My Pi hooks from the native resident (#4486)
Merged pull request #4363: feat(guard): route Claude Code sandbox requirements from the resident (#4363) Evidence for: Merged pull request #4363: feat(guard): route Claude Code sandbox requirements from the resident (#4363)
Merged pull request #4462: fix(guard): keep the direct lane bound when the daemon's listen origin lands (#4462) Evidence for: Merged pull request #4462: fix(guard): keep the direct lane bound when the daemon's listen origin lands (#4462)
Merged pull request #4432: fix(guard): run a command list in a sibling worktree in that worktree's sandbox (#4432) Evidence for: Merged pull request #4432: fix(guard): run a command list in a sibling worktree in that worktree's sandbox (#4432)
Merged pull request #4475: ci(gates): shard the macOS gates so they finish inside the job timeout (#4475) Evidence for: Merged pull request #4475: ci(gates): shard the macOS gates so they finish inside the job timeout (#4475)
Merged pull request #4297: fix(guard): prove workspace symlinks and plain file removals natively (#4297) Evidence for: Merged pull request #4297: fix(guard): prove workspace symlinks and plain file removals natively (#4297)
Merged pull request #4387: fix(guard): prove worktree add with -C, global hook managers and LFS filters (#4387) Evidence for: Merged pull request #4387: fix(guard): prove worktree add with -C, global hook managers and LFS filters (#4387)
Merged pull request #4187: refactor(guard): move Codex binding capture to the native runtime (#4187) Evidence for: Merged pull request #4187: refactor(guard): move Codex binding capture to the native runtime (#4187)
Merged pull request #4342: fix(guard): mark tool input cut to an excerpt in the action envelope (#4342) Evidence for: Merged pull request #4342: fix(guard): mark tool input cut to an excerpt in the action envelope (#4342)
Merged pull request #4341: fix(approvals): show inbox approvals of tool calls as the user's decision (#4341) Evidence for: Merged pull request #4341: fix(approvals): show inbox approvals of tool calls as the user's decision (#4341)
Merged pull request #4275: fix(guard): treat Unix loader search paths as inert for Windows Git proofs (#4275) Evidence for: Merged pull request #4275: fix(guard): treat Unix loader search paths as inert for Windows Git proofs (#4275)
Merged pull request #4457: feat(guard): write Guard events from the resident store (#4457) Evidence for: Merged pull request #4457: feat(guard): write Guard events from the resident store (#4457)
Merged pull request #4293: fix(guard): model command, time and env prefixes on ordinary programs (#4293) Evidence for: Merged pull request #4293: fix(guard): model command, time and env prefixes on ordinary programs (#4293)
Merged pull request #4401: ci: compile guard-command tests as one binary and shard the replay gates (#4401) Evidence for: Merged pull request #4401: ci: compile guard-command tests as one binary and shard the replay gates (#4401)
Merged pull request #4447: feat(guard): write reviewed approval requests from the resident store (#4447) Evidence for: Merged pull request #4447: feat(guard): write reviewed approval requests from the resident store (#4447)
Merged pull request #4522: feat(guard): verify and sign policy rows in the native resident Evidence for: Merged pull request #4522: feat(guard): verify and sign policy rows in the native resident
Merged pull request #4501: feat(runtime): check Guard's private files on Windows before the bridges trust them (#4501) Evidence for: Merged pull request #4501: feat(runtime): check Guard's private files on Windows before the bridges trust them (#4501)
Merged pull request #4533: chore(scope): count update, policy-file and device-health helpers as control plane Evidence for: Merged pull request #4533: chore(scope): count update, policy-file and device-health helpers as control plane
Merged pull request #4281: fix(guard): let command lookups, Guard help, merge-base and chained Git reads proceed (#4281) Evidence for: Merged pull request #4281: fix(guard): let command lookups, Guard help, merge-base and chained Git reads proceed (#4281)
Merged pull request #4312: fix(release): optimize Windows alpha workspace code Evidence for: Merged pull request #4312: fix(release): optimize Windows alpha workspace code
Merged pull request #4464: fix(guard): prove sibling glob reads and admit read-only command inspection (#4464) Evidence for: Merged pull request #4464: fix(guard): prove sibling glob reads and admit read-only command inspection (#4464)
Merged pull request #4384: feat(guard): answer lifecycle hooks from the resident (#4384) Evidence for: Merged pull request #4384: feat(guard): answer lifecycle hooks from the resident (#4384)
Merged pull request #4318: feat(guard): review Cline plugin tool calls through the bounded hook bridge (#4318) Evidence for: Merged pull request #4318: feat(guard): review Cline plugin tool calls through the bounded hook bridge (#4318)
Merged pull request #4511: fix(guard): give du of a missing sibling path the ls absent-path proof (#4511) Evidence for: Merged pull request #4511: fix(guard): give du of a missing sibling path the ls absent-path proof (#4511)
Merged pull request #4367: fix(guard): contain linked worktree runs with the shared Git directory writable (#4367) Evidence for: Merged pull request #4367: fix(guard): contain linked worktree runs with the shared Git directory writable (#4367)
Merged pull request #4506: fix(guard): let read-only brew and pg_ctl status queries run without review (#4506) Evidence for: Merged pull request #4506: fix(guard): let read-only brew and pg_ctl status queries run without review (#4506)
Merged pull request #4430: fix(guard): let agents read a sibling checkout through a relative parent path (#4430) Evidence for: Merged pull request #4430: fix(guard): let agents read a sibling checkout through a relative parent path (#4430)
Merged pull request #4256: refactor(continuation): move finalization and evidence authority into Rust (#4256) Evidence for: Merged pull request #4256: refactor(continuation): move finalization and evidence authority into Rust (#4256)
Merged pull request #4381: fix(guard): stop offering --ignore-scripts as the way past a package review (#4381) Evidence for: Merged pull request #4381: fix(guard): stop offering --ignore-scripts as the way past a package review (#4381)
Merged pull request #4388: fix(guard): keep quoted regex alternation from posing as a synthesized program (#4388) Evidence for: Merged pull request #4388: fix(guard): keep quoted regex alternation from posing as a synthesized program (#4388)
Merged pull request #4319: feat(guard): answer Grok hooks from the native bounded bridge (#4319) Evidence for: Merged pull request #4319: feat(guard): answer Grok hooks from the native bounded bridge (#4319)
Merged pull request #4459: fix(guard): accept bounded task result contents without review Evidence for: Merged pull request #4459: fix(guard): accept bounded task result contents without review
Merged pull request #4515: test(gauntlet): render Windows fixture paths with forward slashes (#4515) Evidence for: Merged pull request #4515: test(gauntlet): render Windows fixture paths with forward slashes (#4515)
Merged pull request #4405: feat(guard): answer Claude prompts that carry Guard's notice from the resident (#4405) Evidence for: Merged pull request #4405: feat(guard): answer Claude prompts that carry Guard's notice from the resident (#4405)
Merged pull request #4291: feat(guard): build memory pattern fingerprints in the native runtime (#4291) Evidence for: Merged pull request #4291: feat(guard): build memory pattern fingerprints in the native runtime (#4291)
Merged pull request #4255: fix(guard): let agent-home listings, sibling-repo grep and mktemp scratch dirs proceed (#4255) Evidence for: Merged pull request #4255: fix(guard): let agent-home listings, sibling-repo grep and mktemp scratch dirs proceed (#4255)
Merged pull request #4410: perf(ci): skip fallback downloads after partial Rust cache restores (#4410) Evidence for: Merged pull request #4410: perf(ci): skip fallback downloads after partial Rust cache restores (#4410)
Merged pull request #4386: feat(guard): answer ZCode hooks from the resident (#4386) Evidence for: Merged pull request #4386: feat(guard): answer ZCode hooks from the resident (#4386)
Direct commit 9eb44445e933: maintainer: merge main; normalize non-contribution paths to main Evidence for: Direct commit 9eb44445e933: maintainer: merge main; normalize non-contribution paths to main
Merged pull request #4369: feat(guard): answer Cursor terminal denials from the resident (#4369) Evidence for: Merged pull request #4369: feat(guard): answer Cursor terminal denials from the resident (#4369)
Merged pull request #4503: chore(guard): exclude extension-control authority enroll, commit and recovery from runtime scope Evidence for: Merged pull request #4503: chore(guard): exclude extension-control authority enroll, commit and recovery from runtime scope
Merged pull request #4490: chore(guard): exclude the opt-in `guard mcp serve` dispatcher from runtime scope (#4490) Evidence for: Merged pull request #4490: chore(guard): exclude the opt-in `guard mcp serve` dispatcher from runtime scope (#4490)
Merged pull request #4452: feat(guard): build the reviewed PreToolUse approval request in the resident (#4452) Evidence for: Merged pull request #4452: feat(guard): build the reviewed PreToolUse approval request in the resident (#4452)
Merged pull request #4354: feat(guard): answer Watch PreToolUse hooks from the resident (#4354) Evidence for: Merged pull request #4354: feat(guard): answer Watch PreToolUse hooks from the resident (#4354)
Merged pull request #4530: perf(hooks): skip runtime hashing when the native bridge finds its resident Evidence for: Merged pull request #4530: perf(hooks): skip runtime hashing when the native bridge finds its resident
Direct commit 1c5343b2f1a7: fix(guard): keep broad parent-directory searches review-gated Evidence for: Direct commit 1c5343b2f1a7: fix(guard): keep broad parent-directory searches review-gated
Merged pull request #4483: fix(guard): keep Cargo builds out of the workspace sandbox and document why (#4483) Evidence for: Merged pull request #4483: fix(guard): keep Cargo builds out of the workspace sandbox and document why (#4483)

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: v3.43.1

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.