logly/mureo

v0.10.23 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 14d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

advertising agentic-ai ai-agents claude-code cli codex

+11 more

cursor facebook-ads gemini-cli google-ads marketing marketing-automation mcp meta-ads model-context-protocol python search-console

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 13d

Credential guard now blocks credential access with a deny response and `mureo upgrade` refreshes stale hooks on Claude Code and Codex.

Why it matters: Security severity of 90 ensures blocked credential access; upgrades automatically refresh hooks, eliminating manual intervention for affected surfaces.

Summary

AI summary

Credential guard now blocks access and upgrade refreshes stale hooks.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Credential guard now correctly blocks credential access with deny response. Credential guard now correctly blocks credential access with deny response. Source: llm_adapter@2026-07-13 Confidence: high	—
Bugfix	Medium	`mureo upgrade` now refreshes installed credential‑guard hooks on both Claude Code and Codex. `mureo upgrade` now refreshes installed credential‑guard hooks on both Claude Code and Codex. Source: llm_adapter@2026-07-13 Confidence: low	—
Bugfix	Low	Dashboard (re)install buttons now report success, “already up to date”, or error via toast messages. Dashboard (re)install buttons now report success, “already up to date”, or error via toast messages. Source: llm_adapter@2026-07-13 Confidence: high	—

Full changelog

Fixed

Credential guard now actually blocks. The PreToolUse hooks installed into Claude Code's ~/.claude/settings.json and Codex's ~/.codex/hooks.json used sys.exit(1), which both hosts treat as a non-blocking hook error — reading ~/.mureo/credentials.json was never actually blocked. The guard templates (now shared via a single mureo.credential_guard module so a fix can never again land on one host and miss the other) block with a permissionDecision: "deny" JSON response, protect the entire ~/.mureo tree via realpath + case-folded path matching (closing symlink, tilde, wildcard cred*, and case-insensitive-filesystem ~/.MUREO evasions), and widen coverage to Read|Edit|Write|Grep|Glob|NotebookEdit plus Bash. Codex's hooks.json is now written in the nested {"hooks": {"PreToolUse": [...]}} shape Codex actually loads, migrating mureo's entries out of the legacy top-level list. The installers are upgrade-aware: re-running mureo setup (or the configure UI's per-row Reinstall button) replaces stale hooks in place. (#393)
mureo upgrade refreshes installed credential-guard hooks. The post-upgrade refresh now upgrades stale tagged guard hooks on both the Claude Code and Codex surfaces — only where a guard entry actually exists, so a deliberately removed guard is never reinstalled. (#398)
Dashboard (re)install buttons report their outcome. The basic-setup rows' (re)install buttons now toast every result — success, "already up to date", and error — instead of reacting only to errors. (#400)

Security

Action required for existing installations: the old non-blocking guard stays in place until refreshed. Run mureo upgrade once (or press the credential-guard Reinstall button in the configure UI) to replace the stale hooks. (#393, #398)

Full Changelog: https://github.com/logly/mureo/compare/v0.10.22...v0.10.23

Breaking Changes

Removed non-blocking `sys.exit(1)` implementation from PreToolUse hooks; replaced with a JSON response that denies permission (`permissionDecision: "deny"`).
Credential guard templates consolidated into a single `mureo.credential_guard` module for Claude Code and Codex.
Codex `hooks.json` now uses the nested shape `{"hooks": {"PreToolUse": [...]}}` instead of a top‑level list.

Security Fixes

Credential guard now properly blocks access to `~/.mureo/credentials.json` via a deny response, closing symlink, tilde, wildcard (`cred*`) and case‑insensitive filesystem evasion vectors.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track logly/mureo

Get notified when new releases ship.

About logly/mureo

Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.

All releases →