This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+11 more
ReleasePort's take
Light signalThe Dashboard provider rows now render as styled cards, and `MUREO.toast()` accepts an optional `kind` argument for color‑coded messages.
Why it matters: These UI enhancements improve visual clarity in the configure dashboard and enable richer toast notifications; no version bounds or security triggers are specified.
Summary
AI summaryUpdates Backwards compatibility, red, and message across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Dashboard provider rows now render as cards with visual styling. Dashboard provider rows now render as cards with visual styling. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Low |
`MUREO.toast()` now accepts an optional `kind` argument for color-coded toast messages. `MUREO.toast()` now accepts an optional `kind` argument for color-coded toast messages. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Low |
Toast errors and successes added to nine inline failure paths. Toast errors and successes added to nine inline failure paths. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Toast strings externalized to i18n keys with EN/JA translations. Toast strings externalized to i18n keys with EN/JA translations. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Feature | Low |
Plugin credential fields support locale-aware display names and descriptions. Plugin credential fields support locale-aware display names and descriptions. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
Full changelog
Added — configure UI quality + locale-aware plugin credential fields (#183, #184, #186)
Three operator-experience improvements bundled in one release. None
change the MCP tool surface; every change is in the mureo configure
local-only web UI and its plugin-extension contract.
Dashboard provider rows render as cards (#183)
The Dashboard tab's "Official MCP providers" list and "Plugin
credentials" list used to render as a flat hairline-separated list,
making credential boundaries hard to scan once two or three
platforms were configured. Each row now renders as its own card —
1 px border, soft drop shadow, light off-white background that
lifts off the warm --paper page colour, and a 4 px left-accent
stripe coloured per platform (Google blue, Meta blue, GA4 orange).
Hosted-provider sub-notes fall naturally inside the same card.
A new dark-mode media query mirrors the lift with the --surface
token against --paper. CSS-only — no JS, no HTML markup changes
for built-in lists.
Generic .hint / .field-hint / label > small block
typography also lands so plugin-supplied field descriptions no
longer flow inline with the next <label> heading (the run-on
text reported in the agency-clients plugin tab).
Color-coded toast errors + audit pass (#184)
MUREO.toast(message) now accepts an optional kind ("info" /
"success" / "error") that maps to an is-<kind> CSS class for
color-coded pills. Backwards compatible — every existing single-arg
caller still works and defaults to the info pill.
.app-toast.is-success (green) and .app-toast.is-error (red)
tints land alongside, both passing WCAG AA contrast against white
text.
Nine previously-toast-less inline failure paths now also fire a
toast so an operator scrolled to the bottom of a long Dashboard
always sees the result:
auth_wizards.js: connector finalize, env-var save (×2), OAuth
start, OAuth poll.dashboard.js: demo init (×2), BYOD import (×2).
The inline status node is kept alongside every new toast call for
accessibility and scroll-anchored context; the toast adds the
scroll-resistant surface.
Existing single-arg MUREO.toast() calls across dashboard.js
(remove/save/picker/clear/plugin-credentials, ~15 sites) gain the
right "error" / "success" kind so red and green are consistent
across the whole UI.
Four hardcoded English toast strings ("Setup failed",
"Operation failed", "Saved.", "Save failed.") move to new
app.toast_* i18n keys with EN + JA translations.
Locale-aware plugin credential fields (#186)
AccountCredentialField gains two optional dataclass attributes
that mirror the pattern already used for web-extension menu names:
display_name_i18n: Mapping[str, str] = field(default_factory=dict)
description_i18n: Mapping[str, str] = field(default_factory=dict)
Both default to empty dicts, so plugins that ship only English
labels keep working unchanged.
list_plugin_credential_fields(locale: str = "en") now resolves
each label via the chain
i18n[locale] → i18n["en"] → display_name (and the equivalent for
description). Empty-string entries are treated as "not declared"
so a mistakenly-empty translation cannot blank the label.
GET /api/credentials/plugins forwards
self.wizard.session.locale (the existing session attribute,
allow-listed to {"en", "ja"} at the setter). Wire shape is
unchanged — only the strings inside display_name / description
are now locale-resolved.
OSS-side hook only. Translation strings are owned by each plugin;
mureo never ships strings for plugin-declared fields. docs/ plugin-authoring.md documents the new attributes with a JA
example mirroring the extension-tab i18n pattern.
Backwards compatibility
- Every change is additive. No public API removed, no signature
change beyond optional kwargs / dataclass attributes. mureo upgrade [--all](shipped in 0.9.25) is the recommended
upgrade path for pipx and pip operators alike.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About logly/mureo
Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]