This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+11 more
Affected surfaces
Summary
AI summaryDashboard now detects basic‑setup components on disk instead of relying on setup_state.json, fixing misreporting.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds ability for extensions to contribute a DashboardCard to the Reports tab. Adds ability for extensions to contribute a DashboardCard to the Reports tab. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes dashboard configure detecting basic-setup parts from disk instead of flag file. Fixes dashboard configure detecting basic-setup parts from disk instead of flag file. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
Detects basic-setup components (MCP, credential-guard hook, workflow skills) from disk instead of `setup_state.json`. Detects basic-setup components (MCP, credential-guard hook, workflow skills) from disk instead of `setup_state.json`. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
Added
- Extensions can contribute a
DashboardCardto the Reports tab (#425).
BUILTIN_CARD_GROUPSpreviously allowed only"advanced", where operator settings live."reports"is now a second accepted group, so an extension can place an operator reporting action — "refresh every client's numbers now", a cross-client daily-check — beside the built-in report cards rather than under Advanced or in a whole separate tab. Purely additive:"advanced"-only extensions are unaffected, and aDashboardCard(group="reports")raisesValueErroron an older mureo, so a downstream extension version-gates on this release. Same safety contract as before (no inline-executable HTML; behaviour ships asStaticAssetscripts/styles).
Fixed
- The configure dashboard detects the basic-setup parts on disk instead of recalling them from a flag file (#423 / #424). Every other row on the status snapshot is read off the filesystem, but the three basic-setup rows (mureo MCP, credential-guard hook, workflow skills) came from
setup_state.json— a record only the dashboard's own actions ever wrote. So skills installed withmureo setup, or by hand, read as not installed while present; and, in the dangerous direction, a component deleted after a dashboard install kept reading as installed while absent. Each part is now detected on every read: the hook by the credential guard's own tag on the host's real hook surface, the skills by presence in the host's skills directory, and the mureo MCP block by the same registry read that already reports every other provider.setup_state.jsonis no longer written or read; one left behind by an older mureo is ignored.
Full changelog: https://github.com/logly/mureo/compare/v0.10.25...v0.10.26
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About logly/mureo
Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]