This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+11 more
Affected surfaces
Summary
AI summaryOperator‑supplied loopback callback URL added for plugin OAuth and dashboard toasts now render correctly.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds operator-supplied loopback callback URL for plugin OAuth Adds operator-supplied loopback callback URL for plugin OAuth Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Authenticates and saves plugin OAuth provider credentials atomically Authenticates and saves plugin OAuth provider credentials atomically Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Scope‑aware validation skips optional fields for multi‑account backends in plugin credentials Scope‑aware validation skips optional fields for multi‑account backends in plugin credentials Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Materializes plugin credentials file at runtime path after wizard completion Materializes plugin credentials file at runtime path after wizard completion Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes dashboard toasts rendering above page content regardless of scroll position Fixes dashboard toasts rendering above page content regardless of scroll position Source: llm_adapter@2026-06-12 Confidence: high |
— |
Full changelog
Plugin OAuth onboarding reaches first-run usability — the two blockers found while verifying Yahoo! JAPAN Ads on an agency install — plus the configure correctness/UI fixes that landed alongside.
Added
- Operator-supplied loopback callback URL for plugin OAuth (#216) — the wizard binds the operator-registered loopback port and sends that URL verbatim as the
redirect_uri(exact match providers require), validated loopback-only, with a clearcallback_port_unavailableerror and saved-URL pre-fill on re-auth. - Authenticate-is-save for plugin OAuth providers (#217) — Authenticate now persists the submitted form values together with the obtained token in one atomic write; no Save button, read-only token status, OAuth
target_fieldexempt from required-validation. First-time setup no longer deadlocks. - Scope-aware required-validation for plugin credentials (#211) — a field a multi-account backend scopes out of the dashboard is no longer required-enforced on save; standalone installs unchanged.
- Materialize the credentials file at the runtime path on wizard completion (#210).
Fixed
- Dashboard toasts now render above page content (#214) — the toast overlay moved to body level so it is visible regardless of scroll position.
Full Changelog: https://github.com/logly/mureo/compare/v0.9.30...v0.9.31
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About logly/mureo
Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]