Documented changes
40 typed entries
Verified contributors
Credits being verified. Attribution coverage is unknown.
Attribution coverage
attribution not yet verified; history inventory partial.
Install
Scope
Guard v3.52.0 is a stable release published 2026-10-21. Upstream documents: Guard 3.52.0 is a stable release cut from 13f9ea9. 40 commits • 40 merged pull requests • 1 contributor since Guard 3.51.0. Attribution for this release is being verified.
Changes
Added
14- dashboard: Give Rules & exceptions the Home hero, a widest-rules spotlight, and a rule inspector (#5458) Evidence for this change
- Rules & exceptions now leads with the Home hero surface — same dark gradient, status badge tones, facts row, live label, and particle brand mark — driven by the real rule set: "Guard asks before it repeats anything"… Evidence for this change
- A "Worth a second look" spotlight shelf (Extensions spotlight card language) shows the three highest-blast-radius rules, ranked by action, scope width, matcher family, and recency, each with its plain-language… Evidence for this change
- Every rule opens in a focus-trapped inspector dialog: consequence sentence, source/scope/app/folder, last-remembered relative + exact date, matcher id, governing Extension link, approval-record (Evidence) link, and… Evidence for this change
- extensions: Accept a public profile on extension credit (#5454) Evidence for this change
- Extension listing credit can include a description, organization, website, LinkedIn profile, and X profile. Evidence for this change
- The profile is display copy. Claim authority stays on maintainer GitHub ids, and validation does not fetch the links. Evidence for this change
- containment: Run the installed containment proof in the native runtime (#5441) Evidence for this change
- dashboard: Put remembered rules first on Rules & exceptions with at-a-glance counts, action filters, and bulk removal (#5453) Evidence for this change
- Rules & exceptions now leads with an "At a glance" strip — rules on this device, rules from Guard Cloud, allow count, block count, and the active protection mode — instead of the Guard Cloud bundle and protection cards… Evidence for this change
- Each remembered rule states what Guard will do in plain language (for example, "Guard will block … the next time Codex retries this exact action"), and local rules can be selected with checkboxes and removed in bulk… Evidence for this change
- Allow / Block filter chips with live counts are always visible, a result line ("Showing X of Y remembered rules") appears when filters are active with a one-click "Clear search and filters" recovery, and the empty… Evidence for this change
- windows: Run a project's pytest inside read-only containment (#5422) Evidence for this change
- containment: Let the resident answer containment health (#5417) Evidence for this change
Fixed
25- deps: Take certifi 2026.10.19 for the compromised emSign roots (#5480) Evidence for this change
- extensions: Save a protection policy without reaching the network (#5442) Evidence for this change
- pretool: Stop a missing worktree read from climbing out with .. (#5457) Evidence for this change
- The steps after the nearest existing ancestor must be plain names. A
.or..there sends the call to the ordinary screens. Evidence for this change - A
..inside the existing part is still accepted, so../review-worktree/docs/change.mdfrom the main checkout stays quiet. It is accepted only when resolving the prefix as text names the same directory the… Evidence for this change - pretool: Allow worktree creation through missing parent directories (#5456) Evidence for this change
- containment: Keep the contained workspace write's own deadline (#5446) Evidence for this change
- guard: Surface container extension hints and category icons in inbox (#5439) Evidence for this change
- Allow an explicitly enabled
command.container-runtimepermission (command.container-runtime.permission.docker-sensitive) to settle uncertain container-runtime observations (`uncertainty_reasons =… Evidence for this change - Handle non-comma, non-range nested brace tokens such as Go templates (
{{.Server.Version}}) inexpand_brace_globssodocker version --format '{{.Server.Version}}'does not fail closed as a sensitive-file glob… Evidence for this change - Admit reviews whose only uncertain observations belong to
command.container-runtimeinto the counterfactual extension allow-hint check (native_review_allow_hint.pyandhook_direct_review_request.rs), and compute… Evidence for this change - fleet: Report AIBOM-detected items and name machines by host name (#5440) Evidence for this change
- Inventory. Fleet posture read only the local inventory table. Guard writes that table when it scans an artifact itself (a
hol-guard runlaunch, an install, a consumer scan). Machines protected through hooks… Evidence for this change - Machine name. The local device row is seeded with the label "Local machine", and nothing replaced it unless the user ran
hol-guard device label set. Evidence for this change - guard: Record a failing catalog preparation and report it as terminal (#5437) Evidence for this change
- guard: Review in-place sed of a runnable file on Windows (#5414) Evidence for this change
- pretool: Read a missing path in a registered worktree quietly (#5424) Evidence for this change
- extensions: Keep the Extensions page loading after a catalog activation lands (#5438) Evidence for this change
- pretool: Prove an rg listing by the names it can print (#5429) Evidence for this change
- gauntlet: Tell a session started beside a checkout where it really is (#5421) Evidence for this change
- gauntlet: Re-run a case the model never exercised instead of a whole attempt (#5411) Evidence for this change
- pretool: Let a read-only git route to a directory without a repository (#5408) Evidence for this change
- pretool: List a temporary scratch directory the way its owner sees it (#5432) Evidence for this change
- runtime: Keep a cancelled Bash launch's reply deliverable on Windows (#5428) Evidence for this change
- contained: Accept a venv link into the macOS developer directory (#5425) Evidence for this change
Other changes
1- Documented change: Guard 3.52.0 is a stable release cut from
13f9ea9. 40 commits • 40 merged pull requests • 1 contributor since Guard 3.51.0. Evidence for this change
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: v3.51.0
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Evidence ledger0 credits
No credits are published for this release yet.