v3.43.0

3.43.0 (2026-10-12)

Features

• cli: resolve Copilot server identities in Rust (#4235) (22af1c6)
• guard: acquire restricted archives in the native resident (#4101) (4090b17)
• guard: add hol-guard repair and step-up gated hook removal (#3956) (6258ae0)
• guard: build hook approval-context tokens in the native runtime (#4223) (da75713)
• guard: build the MCP tool-call artifact and approval hash in the native resident (#4234) (be91b4b)
• guard: build workspace scan targets in the native resident (#4048) (e5e66ee)
• guard: classify sensitive file read and write requests in Rust (#4073) (c9ab19e)
• guard: compile observed MCP tool actions in the guard store resident (#4159) (c2a059c)
• guard: consume native-review approvals in the resident store (#4194) (0320660)
• guard: decide approval-reuse claims and miss diagnosis in the resident (#3962) (e68d93c)
• guard: decide bulk approve-once eligibility in the native resident (#4020) (52eb843)
• guard: decide Codex tool-output review in the native resident (#3950) (dac48ab)
• guard: decide daemon lifecycle in the native resident (#3969) (8ffeeb3)
• guard: decide daemon route, origin and session policy in the native resident (#3936) (3a6c5d1)
• guard: decide headless app action responses in the native resident (#3989) (0c50011)
• guard: derive and compose the effective native policy in Rust (#4127) (f14d8f1)
• guard: derive approval queue identity in the native resident (#4001) (83cafc3)
• guard: derive approval scope contracts in the native resident (#4015) (352803d)
• guard: derive the local supply-chain posture in the native resident (#4007) (66a6fae)
• guard: derive the workspace dependency inventory in the native resident (#4027) (07c5f61)
• guard: evaluate Cloud-connected package supply chain in the resident (#3933) (5fea854)
• guard: evaluate local package requests in the native resident (#3987) (baab299)
• guard: fold the configured policy action into the native policy_stack query (#4254) (90d293e)
• guard: give per-app protection its own tab and Protect-screen controls (c9cf0af)
• guard: identify unlisted local CLIs in the native resident (#4237) (33cb25c)
• guard: model Windows paths in the native shim admin (#4232) (c339d9d)
• guard: move AIBOM workspace detection to the native resident (#4207) (6849601)
• guard: move artifact inventory store writes to the native resident (#4022) (d2ecb5f)
• guard: move Cisco preflight authority to the native resident (#4042) (aed675c)
• guard: move command-activity store into the native resident (#3997) (3813f32)
• guard: move consumer artifact decision composition to the native runtime (#4108) (36f5994)
• guard: move direct-tool context authority into the native resident (#4137) (3558b3b)
• guard: move hook payload preparation and the action envelope to the native resident (#3940) (b3f185b)
• guard: move MCP archive binding and package signals into the resident (#4063) (94a01c7)
• guard: move package audit projections to the native resident (#4083) (4144bb5)
• guard: move package execution context build to the native resident (#4231) (32cfe23)
• guard: move runner cloud-sync decisions into the native resident (#3978) (efeb1c3)
• guard: move session, operation and client-lease store into the native resident (#4012) (086110c)
• guard: move signed Claude/Cursor hook authority state to the native resident (#4113) (d658157)
• guard: move storage maintenance into the native resident (#4053) (00b113e)
• guard: move the Codex request-resume record to the native resident (#4147) (72aedb0)
• guard: move the receipt store, rollups and analytics into the resident (#4072) (94ab442)
• guard: move workflow-capability authority to the native resident (#4092) (c790f64)
• guard: native Codex harness detection at exact Python parity (#4264) (ffa8f4f)
• guard: native Hermes harness detection at exact Python parity (#4233) (e5f7e37)
• guard: native package-shim administration at exact Python parity (#4205) (067a066)
• guard: offer exact-action Always for read-only git, file reads and proven compound commands (#3961) (19b0f8a)
• guard: offer exact-action Always for todo tools and refuse it for risk-signal reviews (#4043) (ed0d602)
• guard: plan approval resolutions in the native resident (#3994) (5e15ac6)
• guard: port docker requests, jq filters and static shell safety to Rust (#4081) (1f2a4c2)
• guard: port GitHub shell helpers, developer graph, index inspection and source edits to Rust (#4123) (75b8545)
• guard: port the benign native file read check to Rust (#4075) (f877083)
• guard: port the contained node, TypeScript and Bun script runners to the resident (#4078) (67a358c)
• guard: port the sensitive tool-action dispatcher to Rust (#4246) (a32ac6d)
• guard: port ZCode harness detection to the native runtime (#4218) (c50f1e4)
• guard: prepare restricted test execution with native authority (#4213) (73c7eb5)
• guard: record bounded startup phase timings in the daemon diagnostics (#4076) (f529350)
• guard: render CLI hook responses and documents in the native resident (#4172) (5b5ac3f)
• guard: render hook harness responses in the native resident (#4054) (7e1a027)
• guard: route package-shim admin through the resident shim_admin op (#4215) (1971ab7)
• guard: run Codex test commands in the contained runner (#4170) (d75f7f7)
• guard: run hol-guard secrets scans and hooks in the native runtime (#4182) (78be1d8)
• guard: send Codex thread continuations from the native resident (#4125) (3b9e855)
• guard: set Watch or Protected per app (#3952) (5ff8c0d)
• guard: settle Copilot tool calls in the native resident (#4209) (df9e43e)
• guard: validate daemon handler requests in the native resident (#3979) (17c2338)
• guard: verify Cursor after-observer proofs in the native resident (#4006) (bf7bf79)
• protect: parse install commands and match cached advisories in the native resident (#4160) (4e0c1cd)
• release: cut optional alpha releases from main through Release Please (#4099) (a23f859)
• release: publish signed Desktop Core sidecars for alpha prereleases (#4100) (2f8ffac)
• runtime: add pinned native process custody and capture (#3751) (a3a8148)
• runtime: native skill-directory identity on all platforms (e3807d9)
• runtime: run the default runtime detectors in the native resident (#4145) (dce33e7)

Bug Fixes

• ci: accept the compact native PostToolUse shape in the legacy-mode probe (#4087) (99c1ce3)
• ci: check the pre-tool command dispatch where it now lives (#4003) (3a0b25a)
• ci: clear Windows clippy, regression-list and format drift from the native lanes (#4036) (139168d)
• claude: give the hook bridge four seconds to reach the daemon (#4068) (f584ad3)
• claude: time the hook from its own request, not the identity challenge (#4124) (61e958e)
• cli: drop an always-true workspace check in Copilot root resolution (#4258) (2c3f927)
• cloud-review: recover expired sign-in without redundant approval (#3111) (644faea)
• codex: name the real cause when the hook bridge cannot reach the daemon (#4155) (bae1805)
• contained-process: stop probing Windows Lib paths on case-insensitive macOS volumes (#4038) (7bfb9d0)
• dashboard: retry a failed screen once before showing the error page (#4193) (9987159)
• extensions: invite introducing contributors to claim automatically (#3985) (b8028fc)
• gauntlet: accept OMP contained-test runs in core cases only when fully bound (#4267) (f189056)
• gauntlet: ask for each listed command as its own Bash call (#4270) (1210e0c)
• gauntlet: bind OMP raw reads to their resolved source (#4045) (1bf30fd)
• gauntlet: bind scratch-directory output to SDK timing metadata (#4031) (bddeb22)
• gauntlet: keep Luna inference streams alive (45d8b4b)
• gauntlet: match the native session-tool contract (#3995) (e23ab57)
• gauntlet: reconcile delegated model and tool evidence (af4a627)
• gauntlet: stop the Guard tap from serializing parallel reviews (#4149) (a3c6c11)
• gauntlet: verify SDK eval bridge execution (ab2ec13)
• guard: accept constant text encodings in PowerShell file calls (#3970) (291afeb)
• guard: accept Promise.all reads and console.log output in Oh My Pi eval (#4139) (919b5cc)
• guard: accept repeated separators in exact Windows drive targets (#4033) (bce3218)
• guard: accept the ZCode managed-hook marker when cmd.exe passes it as arguments (#3992) (8794a77)
• guard: admit bounded read-only shell probes in the native proof (#3973) (d9fc01e)
• guard: allow bounded Oh My Pi task, eval, listing, skill and artifact reads (#3959) (180b0af)
• guard: allow file reads of Git HEAD and ref files in workspace repositories (#4134) (21eeb08)
• guard: allow git reads with untracked nested repos and registered linked worktrees (#3960) (0026040)
• guard: allow linked worktrees to read refs in their common git dir (#4163) (fa2b79b)
• guard: allow lone version queries for package tools and rustup-proxied cargo (#4077) (ce2643e)
• guard: allow names-only listings of the Oh My Pi agent root (#4263) (f4b49e2)
• guard: allow read-only git branch listings and hash-object reads without approval (#4056) (d4026a6)
• guard: allow recursive copies that create a new workspace tree (#4192) (738c6c7)
• guard: allow rg searches of sibling repositories below home (#4166) (6ea1954)
• guard: allow the contained pytest runner route Guard recommends (#4044) (a057e07)
• guard: bound CLI-run hook native evaluation with a real deadline instead of 0.75s (#4104) (d3bf08b)
• guard: carry a bounded reason when the resident prerequisite cannot be provisioned (#4074) (e3f0206)
• guard: contain builds and tests run after cd into a sibling repository (#4262) (f143996)
• guard: contain test-named TypeScript and JavaScript scripts (#4268) (8a621d4)
• guard: daemon repair no longer fails when one lifecycle request lapses on a slow host (#4115) (d38b591)
• guard: expand named-user skill rules, widen aibom deadlines, back off MCP enrichment (#4230) (084de22)
• guard: fail Codex hook health and update loudly when a Guard handler points at a deleted program (#4089) (9ea8913)
• guard: give a cold resident spawn an allowance on daemon lifecycle verdicts (#4023) (22d4a21)
• guard: give Pi ls, find and grep the same bounded proofs as Oh My Pi (#4082) (74bcb6f)
• guard: honor Extensions Allow for plain git fetch origin (#3953) (29d2f37)
• guard: keep a Codex hook waiting for a daemon that is still starting (#4179) (d116a03)
• guard: keep a slow-starting daemon alive instead of terminating it (#4106) (4752bea)
• guard: keep a slow-starting daemon alive when its start budget runs out (#4168) (f15a541)
• guard: keep Git read proofs stable in large repositories and on busy hosts (#4120) (00ccd7f)
• guard: keep Git read proofs when loader search paths point at trusted system directories (#4094) (cf00113)
• guard: keep Git read proofs when the loader search path names a home toolchain directory (#4144) (9773ed0)
• guard: keep non-finite package-shim manifest fields (#4265) (1302423)
• guard: keep read-only proofs through 2>&1, allow Oh My Pi Python reads, and let the gate see real Git config (#4035) (9562066)
• guard: keep the code from a framed resident refusal in policy bundle calls (#4055) (00be9ff)
• guard: keep the policy-floor warning silent on proven-safe tool output (#4251) (c25c379)
• guard: let bounded staged diffs use the ordinary git read proof (#4269) (7d84b0d)
• guard: let du, df, diff and git config reads run without review (#4260) (ccb9d14)
• guard: let enabled GitHub permissions cover GraphQL mutations and @mentions (#4202) (6f2876a)
• guard: let Oh My Pi search its own artifact reports (#4165) (322fae8)
• guard: let prompts that only name a credential stay benign (#3955) (53cc010)
• guard: list Next.js bracket route folders without review (#4161) (83bf7e7)
• guard: make the dead-daemon fast path and hook-removal floor work end to end (#3984) (5d09b78)
• guard: prove benign omp/zcode reads, globs and constant evals natively (#4052) (db12664)
• guard: prove cd-compound and -C git history reads as read-only (#4047) (541316a)
• guard: prove each file in a multi-file cat read (#4050) (b1efe28)
• guard: prove read-only rg, fd and git -C across repositories below home (#4112) (02aac58)
• guard: prove rg glob operands by expanding them like the shell (#4069) (4a73814)
• guard: publish the verifier key atomically on first provision (#4096) (bf767c3)
• guard: read hook stdin as UTF-8 on every platform (#4066) (e76a3b0)
• guard: recover the native runtime after it dies and fail hooks fast (#4058) (0efe479)
• guard: refresh a superseded policy snapshot before failing a daemon hook (#4131) (4bf0c32)
• guard: resolve new-code Sonar findings in hook removal, state prune and Windows capture (#4032) (ef0f876)
• guard: retry truncated daemon GET bodies read through read1 (#3981) (8c3b1a7)
• guard: reuse the native review binding when queueing a review (#4243) (ab46ac6)
• guard: review PostToolUse results after a contained test supersedes the policy snapshot (#4272) (f905512)
• guard: review writes that place a shared library below home (#4154) (d38713c)
• guard: run Claude Code test commands in the contained runner on macOS (#4157) (3449d43)
• guard: run test-named Python scripts in the read-only inline-eval boundary (#4199) (120f87b)
• guard: scale the resident client handshake window with the request budget (#4062) (75d40b2)
• guard: skip the unknown-publisher review for proven constant MCP evals (#4177) (805d5d3)
• guard: stop rendering the policy-floor warning on proven-safe tool calls (#4060) (807c953)
• guard: stop reviewing ordinary git reads for a configured textconv driver (#4107) (6c4e51d)
• guard: treat a workspace in the macOS per-user temporary directory as a workspace (#4126) (c939823)
• guard: treat writes into user-owned temp directories as bounded file writes (#3958) (53853e5)
• omp: admit bounded reads and scan typed reports before submission (#3998) (08ebbe1)
• omp: let ordinary skill, artifact, scratch and raw reads complete (#4017) (4136e0a)
• release: give release jobs their own GitHub App token and retry rate-limited API calls (#4143) (00b066d)
• release: read the PyPI publish job from the first publish attempt (#3972) (626e4f1)
• release: verify alpha Core sidecar wheels against the GitHub prerelease (#4117) (d7759da)
• runtime: gate the remaining Unix-only imports for Windows clippy (#4051) (ec4936f)
• update: install the native alpha wheel from the GitHub prerelease (#4118) (df3fad4)
• update: only offer alpha releases whose GitHub prerelease tag is still live (#4097) (8d96ae7)

Performance Improvements

• gauntlet: build qualification wheels with a fast development profile (#4252) (71de248)
• guard: build the warm MCP tools/call identity in one resident call (#4247) (c87c25c)
• guard: cut hook client import closure for codex and bounded bridges (#4176) (c191daa)
• guard: decide MCP extension grants in the resident, delete Python hops (#4171) (bb3f452)
• guard: discover the native runtime once per hook request (#4224) (9d38526)
• guard: fuse the MCP tools/call quiet edge, write and response into one resident exchange (#4206) (9559124)
• guard: give the pi hook hot path latency headroom (#3990) (472d54e)
• guard: keep the Claude hook bridge off the daemon manager and adapter imports (#4136) (ff5a07c)
• guard: move OCI bundle evidence, verdict and plan digest to the native resident (#4013) (4708a70)
• guard: move stdio sensitive-read decisions into the native resident (#3986) (4fda2b7)
• guard: one resident store call for MCP tool-call evidence (e9814d7)
• guard: read saved MCP tool policy inside the resident decide op (#4211) (7b93e73)
• guard: reuse the verified runtime status when a review needs approval (#4169) (da723a4)
• guard: skip the unused invocation-preview round trip for command-less hook records (#4225) (1b76783)
• guard: speed up cached path re-checks and measure daemon workloads after the client pool warms (#4222) (d50c973)
• guard: validate the native runtime once per hook request (3547733)
• release: compile alpha native binaries in parallel with fast codegen (#4152) (f5f4d6d)
• release: overlap the alpha prerelease with PyPI and compile Windows alpha crates at opt-level 0 (#4174) (4470271)