v3.46.0

Guard 3.46.0 is a stable release cut from 50c755b.
62 commits • 57 merged pull requests • 7 contributors since Guard 3.45.0.

Features

• pi: Answer Pi and Oh My Pi hooks through the native runtime (#4745)
  • New hol-guard-runtime pi-hook-bridge <config> command (feature pi-hook-bridge-v1). It reads the hook payload on stdin, asks a live resident through hook_direct with half of the remaining deadline, and posts…
  • The generated extension spawns the runtime once per hook when the installed runtime advertises pi-hook-bridge-v1. It keeps its loopback request on Windows, when no runtime advertises the feature, or when the runtime…
  • The CLI decision fallback is removed. If daemon recovery fails, the hook is denied with daemon_unavailable ("HOL Guard could not reach its local review service before the deadline. Retry the action."). `daemon…
• runtime: Route frozen Desktop hooks through the native bridges (#4739)
  • Frozen builds publish the bundled native runtime to a content-addressed copy under the Guard home (native-runtime/<sha256>/hol-guard-runtime). The copy is verified against the runtime's digest, owner-only, a regular…
  • Claude, Codex, Cursor and the bounded harnesses (Grok, Hermes, OpenClaw) emit native bridge hook commands on frozen installs. The bounded and Cursor bridges accept the frozen launcher and recover the daemon through the…
  • The frozen cold-CLI fallbacks are removed. When no daemon answers, the Claude, Codex, Cursor and bounded bridges fail closed rather than starting a Python evaluator.
• mcp: Add Plim MCP server contribution (#3372)
• extensions: Command.faf-cli v1.1.0 — card init, npx --help, one severity re-rate (#3657)
• extensions: Add DataMan command safety extension and fixtures (#3047)
• guard-policy: Author, test and explain policies from the command line (#4716)
• extensions: Add MusicContext publisher listing (#3750)
  • contributors: AAGAM17 (GitHub ID 69311837) as author of #3683.
  • maintainerGithubIds: ["69311837"], the account that authored #3683 and maintains MusicContext upstream. This is the authority-bearing change for review.
  • originalContributions: #3683. upstream: the MusicContext repository.
• extensions: Protect DigitalOcean doctl operations and reproduce real false-positive shapes in the Gauntlet (#4694)
• guard: Write dashboard settings through the native runtime (#4701)
  • Rust reads config.toml with the same stable-read checks as guard-config-load, validates the payload, composes the managed policy, applies the posture and per-harness changes, and renders the file byte for byte as…
  • Python keeps the approval gate, managed-policy resolution, the reload through guard-config-load, the policy-mutation notice and the posture timeline events. The native call returns the posture state before the write…
  • Removed: the Python TOML writer and coercion helpers in config.py, config_preset_support.py, the harness posture patch helpers, the presentation write coercion, and the Python config file reader that nothing calls…
• guard: Prepare contained Linux launches in the native runtime (#4692)
  • rust/crates/guard-runtime/src/restricted_linux_launch/ adds discovery, mapping records and copies, mounts, Landlock, capabilities, socket filter, admission and the launch pipeline. restricted_pytest_op routes the…
  • guard-command's mapping evidence accepts optional dependency_candidates: the filenames discovery actually observed, including symlink aliases. Bare DT_NEEDED lookups are limited to those names, then pass the same…
  • restricted_linux_{elf,entry,landlock,mapping_plan,mappings,namespace,paths}.py are now thin calls through native_restricted_linux.py. Native unavailability raises LinuxContainmentUnavailableError, so the launch…
• runtime: Answer more hooks in the native bridges instead of running Python (#4689)

Fixes

• guard: Run relative cd builds and resolved workspace paths without false blocks, and repair nightly native tests (#4747)
• policy: Point the editor modeline at the published schema URL (#4752)
• guard: Run relative-directory node builds under the workspace sandbox (#4751)
• guard: Leave Copilot, Devin and ZCode approval prompts to the harness (#4742)
• dashboard: Rank whole-word search matches first and stop matching inside words (#4741)
• guard: Let routine agent work through and fix the macOS and Windows nightly failures (#4735)
• hooks: Wait for the restarted daemon before retrying a Claude hook (#4738)
• guard: Keep rg and grep reviewed when they can reach hidden secrets (#4721)
  • A ! rule in an ignore file rg honors. !.env in a .ignore, .gitignore, .rgignore, .git/info/exclude or the global Git excludes file makes rg -n foo print .env lines.
  • A file type whose globs name dotfiles. rg -t sh includes .env, .bashrc and .profile; ruby includes .irbrc.
  • An extra ignore file passed with --ignore-file, which can carry its own ! rules.
• guard: Make native lib tests platform-aware and judge NTFS stream spellings on Windows (#4723)
  • Native command lib tests follow the host platform. POSIX-only shapes (2>/dev/null, $(pwd) chains, hooks-path writes, routine directory positives) run on unix only. Windows gets its own path and tokenization…
  • The content sensitivity test deadline is 300 s so slow nightly runners do not time out.
  • On Windows, a file name containing : names an NTFS data stream. When a stat of such a spelling fails, Guard now reads the target as the OMP selector it spells, as it already does on Unix. main.rs:1-5:raw and…
• guard: Clear Windows false positives for drive paths and stderr redirects (#4713)
• guard: Let more routine Oh My Pi session work through (#4718)
  • A TMPDIR output folder with a /tmp fallback. An agent ran a repository script with OUT_DIR="${TMPDIR:-/tmp}/report" bun scripts/report.ts --json. Guard already runs $TMPDIR and ${TMPDIR} settings in the…
  • any other fallback, such as a host path or /tmpx;
  • ${TMPDIR:=/tmp};
• guard: Stop flagging credential identifiers in source output as secrets (#4706)
• guard: Run redirected package commands correctly on macOS (#4717)
• guard: Let routine Oh My Pi session work through and review language server edits (#4695)
• ci: Get the nightly native workflow building on macOS and Windows (#4710)
• guard: Stop review reasons from promising an approval that may not help (#4686)
• hooks: Answer Cursor and Grok hooks natively from older installed clients (#4696)
• guard: Quiet temp-root checkouts, test-vector searches and AskUserQuestion prompts (#4669)
• release: Finish a stable release whose plugin-scanner upload stopped partway (#4674)

Performance

• hooks: Start a stopped daemon from the native Claude SessionStart hook (#4746)
• guard: Resolve single and duplicate approval requests in the native runtime (#4744)
• guard: Resolve approval scope sweeps in the native runtime (#4743)
• guard: Page, count and summarize approval requests in the native runtime (#4737)
• guard: Read approval requests through the native runtime (#4731)
• runtime: Answer the first hook in a new file-less directory on the current policy snapshot (#4727)
• guard: Record approval creation events in the native queue write (#4726)
• runtime: Keep hooks on the direct lane while a new policy ACK lands (#4728)
• runtime: Block custom-rule launches the resident cannot verify in the native hook (#4724)
• runtime: Run npm -C and pnpm -C package scripts on the native contained sink (#4730)
• runtime: Run package scripts in a workspace subdirectory in the native sink (#4722)
• guard: Write approval requests through the native runtime (#4705)
• runtime: Answer reviews natively in homes with custom CLI rules when the command launches no local CLI (#4719)
• runtime: Run piped, stderr-folded and status-reading workspace commands in the native sink (#4720)
• runtime: Run workspace commands that cd into a subdirectory in the native sink (#4709)
• runtime: Run workspace-contained shell commands in the native runtime (#4704)
• guard: Resolve a hook's saved decision in one resident call (#4703)
• guard: Keep saved lookups native when a cached policy bundle has no rows to match (#4702)
• mcp-relay: Keep sessions native while the direct lane warms up (#4697)
• policy: Verify the current snapshot once instead of on every request (#4698)
• guard: Answer saved lookups natively when the store holds cloud policy rows (#4700)
• mcp-relay: Reuse store connections and per-call policy work (#4699)

Documentation

• policy: Describe Policy Studio and import as GuardPolicy authors (#4729)

CI & automation

• Emit shard plans with verified native artifacts (0a2b5c4)
• Warm native caches independently of main analysis (b19468c)
• release: Cancel superseded main release-prepare warm runs (#4734)
• perf: Keep installed SLO memory sampling working after the session ends (#4725)
• macos: Reuse exact native runtime builds (47d9e48)
• tests: Speed wheel builds and isolate corpus timing (78e62c6)
• size: Reuse exact shipped runtime builds (2758e5d)
• gates: Keep macOS replay shards within five minutes (#4707)

Internal

• release: 3.46.0 (#4693)

Install

Install this release:

uv tool install "hol-guard[cisco]==3.46.0"

Full changelog: v3.45.0...v3.46.0

Thanks @zerocodefast, ZCF, @marcusedu, @Wolfe-Jam, @vikashgraja, @AAGAM17, @Vyeche!

Package publication and Desktop update availability are separate. Desktop updates are ready when the signed Core assets and update manifests appear below; macOS feed status shows signing and verification progress.