v3.48.0

Guard 3.48.0 is a stable release cut from 3864097.
31 commits • 30 merged pull requests • 8 contributors since Guard 3.47.0.

Features

• guard: Report fleet posture (Guard version, OS, AI-tool protection, inventory, policy ack) to Guard Cloud (e3b4358)
• dashboard: Search, filter, sort and group custom extension scripts and commands (#5002)
• extensions: Add kindling command source (#3277)
• mcp: Add PC-Control MCP server contribution (#4320)
• extension: Add command.hashdup extension for HashDup CLI (#3018)
• Add DeArmour command extension (#3073)

Fixes

• guard: Keep the output of a toolchain package read under a hidden home directory (#5019)
  • PostToolUse review of an Oh My Pi read of a file below one hidden directory of the home directory (for example a Node toolchain's installed package.json) returned no_output_to_review and blocked the result, even…
  • The source-reference path now applies the same credential screen PreToolUse uses to a hidden component below the home directory. That screen moves from guard-command to guard-secure-fs so both paths read one list.
  • Credential stores, file names a token is normally written under, a tool's own configuration slot, program directories, nested hidden directories and links that resolve outside the home directory keep refusing. The file…
• daemon: Retry the Windows daemon-state replace while a reader holds the file (#5021)
• guard: Read a file named in a neighbouring repository without review (#5009)
• guard: Let a literal pattern bound an fd search below a dot-directory (#5015)
• guard: Read a migration named for the table it defines (#5007)
• guard: Let a name pattern bound what a deeper find prints (#5013)
• guard: Prove a recursive search for what it actually reads (#5012)
• guard: List a home dot-directory through the host's own listing tools (#5003)
• guard: End the extension policy conflict dead-end (#5000)
• guard: Screen hidden home reads for credentials, not for being hidden (#4992)
• guard: Bind one-time ssh push approvals on hosts with XQuartz (#4999)
• mcp: Drop omarchy-mcp contribution pointing pipx at an unrelated package (#4996)
  • Removes contributions/mcp-servers/mcp.omarchy-mcp.json and its trust binding contracts/extensions/trust/command.mcp-omarchy-mcp.v1.json.
  • The contribution (merged via #2973) declares launch: {"kind": "package-launcher", "command": "pipx", "package": "omarchy-mcp"}, but omarchy-mcp on PyPI is published by ServiceStack…
  • No schema-valid launch target exists for JPeetz/omarchy-mcp today: the upstream repository is not a pip-installable package (no pyproject.toml/setup.py; README installs via git clone + `pip install -r…
• guard: Sandbox script smoke tests that reuse a fresh mktemp directory (#4995)
  • The pre-tool rejudge now reads a later $tmp expansion of a fresh mktemp -d directory as $TMPDIR, matching the sandbox launcher. Before, it wrote the stand-in literal into each program argument. The stand-in then…
  • The bun --cwd lockfile test calls the unix-only package context builder. It and its helper are now gated to unix, so the Windows test build compiles again.
  • reviewed, launches_as_judged and launcher_shape move to chain_literals_launch.rs, which keeps chain_literals.rs under the size limit. Their behavior is unchanged.
• release: Raise x86_64 wheel download budgets so 3.47 can publish (#4993)

Tests

• runtime: Make Windows native tests independent of the host (#5018)
• gauntlet: Put a toolchain's package and a home workflow in a full task's way (#5001)
• guard: Bind the ambient digest home the hook context holds itself (#5010)
• Stop two suites from failing on how the shard was composed (#5014)
• guard: Create the lockfile the benign gate's read probe names (#5008)
• gauntlet: Record which lane a qualification run actually drove (#4998)
• gauntlet: Run structured-tool cases on the lanes that have those tools (#4997)

CI & automation

• nightly: Give the Windows native job room and skip host-bound vectors there (#5006)

Internal

• release: 3.48.0 (#4994)
• Add Codex Migrate command protection extension (#2879)
• Add mcp.ccm — CCM code-graph MCP server (external, opt-in) (#3650)

Install

Install this release:

uv tool install "hol-guard[cisco]==3.48.0"

Full changelog: v3.47.0...v3.48.0

Thanks @zerocodefast, ZCF, @juan52878911, @VortexJer, @jsegeren, @mahdyarmonfared, @senoldogann, @mustafakorkunc!

Package publication and Desktop update availability are separate. Desktop updates are ready when the signed Core assets and update manifests appear below; macOS feed status shows signing and verification progress.