This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+11 more
Summary
AI summaryAdded skippable OAuth account picker, platform-selection step, and web‑extension surface overrides.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds skippable OAuth account-picker for multi-account backends. Adds skippable OAuth account-picker for multi-account backends. Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Feature | Low |
Adds skippable platform-selection wizard step in mureo configure. Adds skippable platform-selection wizard step in mureo configure. Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Feature | Low |
Adds WebExtension surface overrides for hiding built‑in tabs and replacing landing view. Adds WebExtension surface overrides for hiding built‑in tabs and replacing landing view. Source: llm_adapter@2026-06-10 Confidence: low |
— |
| Feature | Low |
Allows WebExtensions to hide built-in tabs and replace landing view via overrides. Allows WebExtensions to hide built-in tabs and replace landing view via overrides. Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes credentials path mismatch between configure UI and RuntimeContext. Fixes credentials path mismatch between configure UI and RuntimeContext. Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Restores terminal state around TerminalMenu picker. Restores terminal state around TerminalMenu picker. Source: llm_adapter@2026-06-10 Confidence: high |
— |
Full changelog
Configure-UI extensibility plus multi-account / RuntimeContext polish. As with 0.9.27, none of these change the MCP tool surface — every change is in the mureo configure local-only web UI, its OAuth wizard, or the RuntimeContext extension contract third-party backends plug into. Standalone OSS behavior is unchanged across the board.
Added
- Skippable OAuth account-picker for multi-account backends (#198) — a
SecretStorecan advertise an optionalmulti_account_auth: boolcapability. When set, the OAuth flow persists only the operator-shared credentials (Googledeveloper_token+ OAuth client, or the Meta app creds/token) and skips the per-account picker, going straight to/done; the per-clientcustomer_id/account_idare supplied out of band. Default (standalone OSS): picker shown exactly as before. Resolved behind ahome is Nonegate so a sandboxed wizard never inherits a real backend's behavior. - Skippable platform-selection wizard step (#193) — the platform-selection step in
mureo configurecan now be skipped. - WebExtension surface overrides (#189) — a registered web extension can declare
hidden_builtin_tabsandreplaces_landing, letting a third-party surface hide built-in configure tabs and substitute its own landing view.
Fixed
- configure-UI credentials path follows the active RuntimeContext (#194, #195, #196) — the configure web layer hard-coded
~/.mureo/credentials.jsonwhile the MCP runtime reads through the pluggableSecretStore, so aruntime_context_factorythat relocated the store produced a silent split-brain (wizard wrote one place, runtime read another). The wizard now resolves its credentials path from the activeRuntimeContext(protocol-based via an optionalcredentials_write_path, not type-sniffing), gated so an explicitly-injectedhomestays sandboxed and can never clobber the operator's real credentials. - Terminal state restored around the TerminalMenu picker (#190) —
TerminalMenu.show()could leave the terminal in an altered state on some exits; the CLI now saves and restores terminal state around the menu.
Full changelog: https://github.com/logly/mureo/blob/main/CHANGELOG.md
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About logly/mureo
Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]