Skip to content

What's new

A plain-language summary of what landed in recent MEHO releases. It covers releases since v0.28.0; older releases are in the CHANGELOG, which carries the full detail — every change, and the migration recipe for each breaking one.

MEHO is under active development. Each release below links to its full notes.

v0.44.0 — 2026-11-04

  • The first release without the VMware connectors in the public image. They now come as a separate, signed connector package that runs on top of the public image. The decision record says which connectors moved and why.
  • Connector kit 1.1. A connector package can bring its own catalog rows: the vendor API file, the login profile and the risk levels.
  • Credential reads wait for a person. An ingested credential read waits for a person's approval. Ingested licence reads stay off.
  • Who may approve. Only an SA-Operator or a tenant admin may approve another person's dangerous change. A withdrawn request is recorded as withdrawn.
  • More secrets stay hidden, and more limits. More secret values are hidden in answers, previews and records. Request limits and a metrics token are on by default in the chart.
  • New FreeIPA connector. Reads, and writes that wait for approval.
  • Smaller fixes. A mail policy change holds for the next send. The appliance can send its own logs to your log server. A console bookmark of a page part opens the whole page.
  • Read first. Three database migrations, new chart defaults, and a few scripts must change. See "Breaking changes" and "Steps after the upgrade" in the release notes.

v0.43.0 — 2026-11-02

  • The last release with the VMware connectors in the public image. From the next release on, the VMware connectors come as a separate connector package, built on top of the public image. The decision record says which connectors move and why.
  • Cached logins are checked for each caller. A caller reads a target's secret once before MEHO uses a cached login for them. SSH keeps one login per caller and target.
  • Only a platform admin changes shared things. Ingesting or deleting built-in connectors and setting the Vault login role of a target need platform_admin.
  • Approvals keep fewer secrets. A decided approval request keeps no secret values. A change of the connector packages in the image ends the requests that still wait.
  • Tighter rules in the console and for mail. Running an operation in the console needs the operator role, as on REST and MCP. Mail goes only to plain addresses.
  • The appliance build. A new script builds the MEHO appliance for vSphere. The appliance is not published yet.
  • Read first. One database migration, a corrected Keycloak step for meho login, and a few scripts must change. See "Breaking changes" and "Steps after the upgrade" in the release notes.

v0.42.0 — 2026-11-02

  • Secret fields stay hidden everywhere. Every operation hides secret-named fields in its answer. A person can still ask for a value.
  • Approvals need a recent sign-in, also in the web interface. On the command line, one sign-in covers 15 minutes of approvals. It uses the new login client meho-cli-approve.
  • Logins last longer. meho login renews itself, and the Claude clients keep their login through a short network problem.
  • The connector kit. Connector packages import MEHO through one module and name the kit versions they fit.
  • New operations. vSphere hosts, VMs, vApps, templates and vSAN, HCX, fleet management, VCF Automation, VCF Operations 9.1, Orchestrator, Salt, and a new Identity Broker connector.
  • Read first. One database migration, a new Keycloak client for approvals on the command line, and a few scripts must change. See "Breaking changes" and "Steps after the upgrade" in the release notes.

v0.41.0 — 2026-11-01

  • More vCenter 8.0 reads are guarded. The reads of content libraries and Supervisor image registries hide their secrets and wait for approval, the same as on vCenter 9.0.
  • The SA-Operators group is read from the login. Approvals do not use it yet.
  • Small upgrade. No database migration. After the upgrade, load the vCenter 8.0 connector again with the same API files, and update the Claude Desktop bundle and the Claude Code plugin, which ship a fixed qs library.

v0.40.0 — 2026-11-01

  • Secret values stay hidden. Secret reads show names, not values. A person can still ask for a value, and the audit keeps a fingerprint in its place.
  • Approvals run as approved. An approved request runs only on the target and preview the person approved. Approving on the command line needs a fresh sign-in. A failed approved run can run again, and a change ticket can be approved step by step.
  • Agents work with operator rights. Tenant admin work is for people.
  • One tenant at a time. A person in several tenants picks one with meho tenants use. The MCP clients send it too.
  • New operations. HCX, Site Recovery Manager, vSphere Replication, Cloud Director, the VCF Installer, Cloud Builder for VCF 5.x, fleet management, Azure networks, Google keyless access, GitHub issues, and many vSphere tasks.
  • Read first. Three database migrations, a Vault role for the check runner, and a few scripts must change. See "Breaking changes" and "Steps after the upgrade" in the release notes.

v0.39.0 — 2026-10-30

  • Safer approvals. The sender of a change that waits for approval can withdraw it. An approval now covers one exact MEHO release, so an upgrade ends the requests that still wait, and the requester asks again.
  • First steps for several tenants. The login can list every tenant of a person, the audit views and the approvals page show the tenant, and a tenant admin can turn built-in operations on or off for their own tenant only.
  • Connector packages. A MEHO image can carry connector packages from other repositories. The status and version pages list them, and a satellite runner gets only the work its packages can run.
  • New connector and operations. The phpIPAM connector reads subnets and books addresses. New operations cover Azure VMware Solution and Azure Arc, the steps that build a Windows domain controller, Kubernetes access checks, vSphere datastore and vSAN folder lists, Vault folder deletes with one approval, and Holodeck lab removal.
  • Fewer secrets in errors and traces. Error results, HTTP diagnostics and traces hide secret fields before the audit row is written.
  • Admin edits stay, and only make things stricter. A change to an operation's risk level or approval flag now stays after a restart. An edit can only make an operation stricter; turning approval off needs a platform admin, a reason and a fresh sign-in.
  • Before you upgrade. There are nine database migrations, and a few scripts and grants must change. Read "Breaking changes" and "Steps after the upgrade" in the release notes.

v0.38.0 — 2026-10-28

  • Azure, read end to end. MEHO logs in to Azure with a service principal from Vault and reads inventory, compute, network, storage, AKS, cost, security, Automation and Azure Migrate; Entra ID users, groups and roles come through Microsoft Graph. Every later Azure read gets the same careful HTTP behaviour: one retry budget, waiting when Azure says "too many requests", paging and polling. A CI check compares every hand-written call with Azure's own API files.
  • Four more connectors. vSphere Replication, VMware Orchestrator (also through VCF Automation on VCF 9), Salt, and the migration assessment shapes that turn any source estate into one inventory.
  • A service principal reads only what a person allows. A read scope limits a machine login to named targets; a read outside it is refused.
  • Install form 2 is closed by default. The install script sets the host firewall, and meho-host checks the machine, writes a support bundle, changes the admin network and uninstalls.
  • Fewer secrets in traces and errors. An operation that sends a secret keeps the vendor's error text back, the audit parameter hash skips secrets, and the flight recorder gets only checked files.
  • Many smaller fixes in vCenter reads, approvals, the console, the CLI and MCP tools.

v0.37.0 — 2026-10-24

  • Security fix: deployment passwords in traces. For tenants with the flight recorder on, MEHO kept the full request and answer of seven deployment and depot operations in its traces. They hold deployment passwords and licence keys. MEHO now leaves them out. Traces written before the upgrade keep them until they expire: check your trace retention, and change those passwords and keys if needed.
  • More VMware work through MEHO. VM snapshots, a VM's hardware and CD drives, vSphere licences, the vCenter appliance's local accounts and vCenter alarms. Every change waits for approval. A second person approves snapshot deletes, licence assignments and appliance password changes.
  • Licence keys stay masked. The vSphere, SDDC Manager and VCF Operations licence reads show only the last 5 characters of a key. sddc.license.list now returns key_masked instead of key, so scripts that read key must change.
  • New connectors and reads. Site Recovery Manager, eight HCX reads, GitHub repository create and view, VCF Automation operations for networks, deployments and image names, and a VCF Operations property read.
  • Two 0.36.0 problems fixed. A vault.kv.patch with the right Vault rights waits for approval again, and sensors check their rule against the full result, so they no longer turn unknown when an answer is shortened.
  • Before you upgrade. No database migration. If you come from 0.35.x, do the 0.36.0 steps first.

v0.36.0 — 2026-10-23

  • Security fixes: logins, grants and secrets. Everyone who used the shared CLI and MCP logins was an admin. Now each person's role comes from one Keycloak login group. Agent and service logins could create standing grants; now only a person can. Approval requests and some SDDC Manager and BIND reads showed passwords and keys. Now MEHO hides them, and these reads wait for approval.
  • Security fixes in the image and the CLI. The image gets newer certifi and aiohttp versions, and the CLI is built with Go 1.26.10. The image still has 27 known Pillow findings. MEHO never opens image files, and the image scan skips these findings until 30 November 2026, while the fix is prepared.
  • More risky work waits for a second person. A VM move that copies disks, every delete loaded from a vendor API file, and the delete of a content-library item now wait until a second person approves. After the upgrade, load the vCenter connectors again, so their stored operations get the new rules.
  • Only registered agents post announcements. Broadcast now carries agent announcements only. A person's own login can still read them. The audit log stays the record of operations, approvals and checks.
  • A clearer audit log. Every audit record now says what kind of event it is. A multi-step operation that waits or is refused, and every tool call of a hosted agent, now leave a record.
  • Short, citable evidence from knowledge and memory. Knowledge base entries keep their earlier texts, and search returns the matching passages with a link to the exact text. Memory search returns short snippets with a link to the full entry.
  • The AI knows more about each operation. Many vCenter, SDDC Manager, NSX, VCF Automation, Holodeck and other operations now say what they take and return, with an example call. search_operations can show what one operation needs.
  • New connector and reads. A new HCX connector, VCF Installer 9.0 support, three new VCF Installer reads, vmware.tasks.history for older vCenter tasks, and new Keycloak and pfSense operations.
  • Before you upgrade. The upgrade runs 12 database steps, so back up the database first. Several changes can break scripts; read Breaking changes in the full notes. The Helm chart can now also run its own PostgreSQL, Keycloak and OpenBao, all off by default.

v0.35.22 — 2026-10-13

  • Security fix: the audit clean-up now runs on time. MEHO keeps each connector's answer before redaction in the audit log, and that answer can hold secrets. A weekly job empties old answers. Before, every restart of MEHO started the job's week again. So on a deployment that restarted often, the job never ran, and old answers stayed past the retention window. Now the job counts from its last run. After this update, its first run comes about one minute after MEHO starts.
  • Delete Keycloak users, groups and clients. The new keycloak.user.delete, keycloak.group.delete and keycloak.client.delete remove one object from a Keycloak realm. A second person must approve every call, after seeing what goes on the approval card. MEHO refuses to delete Keycloak's built-in clients and the account MEHO itself logs in with.
  • DRS operations work on vCenter 8.0. Four DRS operations failed at once on vCenter 8.0.x: the DRS recommendations read, the two rule creates and the rule delete. They now read the cluster settings in a way vCenter 8.0.x accepts.

v0.35.21 — 2026-10-13

  • Security fix: PowerShell connectors. This release fixes a critical command injection in the PowerShell-based connectors: msad, winsrv, wsfc, hyperv, windows_dns and holodeck. A value with a typographic single quote could end a quoted PowerShell string early, and the rest of the value ran as PowerShell on the target host. MEHO now handles all five single-quote characters. Please upgrade. Advisory: GHSA-v2v2-4gh2-m4q8.
  • Security fixes in the client packages. The Claude Code plugin and the Claude Desktop bundle get newer proxy-addr and undici versions that fix known vulnerabilities.
  • Fully remove a Vault secret. The new vault.kv.metadata.delete deletes every version of a Vault secret and its metadata. This cannot be undone, so a second person must approve every call. The approver sees the path, never the secret value.
  • Delete a vCenter DRS rule. The new vmware.composite.cluster.drs_rule.delete removes one DRS rule from a cluster. A second person must approve every call, after seeing the rule on the approval card.
  • Longer logins, and no hanging calls. The Claude Code plugin and the Claude Desktop bundle now keep their login up to the limit your Keycloak realm sets (48 hours is recommended), not about 30 minutes. In Claude Code, a MEHO call no longer hangs while a login waits in the browser: it fails with a clear message, or stops after 5 minutes. Run claude plugin update meho@meho, restart Claude Code, and log in once.

v0.35.20 — 2026-10-12

  • Security fix: the CLI is built with a newer Go. The meho CLI binaries are now built with Go 1.26.9. This fixes nine known flaws in the network and TLS code of Go's standard library, which the v0.35.19 CLI still had. Install the new CLI to get the fixes. These Go flaws do not affect the container image or the Helm chart.
  • Security fix in the container image. The pydantic-ai library is updated to a version that fixes a known vulnerability. Agent requests stay the same.
  • Read more around a docs hit. The new read_docs tool, the meho docs read command and a "Read around this hit" button in the console show the text before and after a docs search hit, its whole page, or its section. It is off until an operator turns it on for a docs collection, and the documentation service must offer reads.
  • Two safe pfSense reads. pfsense.user.list lists the firewall's local users, and pfsense.route.static.list lists its static routes. They need no approval. They return only a fixed set of fields, so password hashes and keys are never part of the answer. You no longer need the whole config file to check a user or a route.

v0.35.19 — 2026-10-07

  • Security fix: the pfSense config read no longer shows secrets. pfsense.config.show used to return the whole firewall config, including password hashes and private keys, to anyone who could call it, with no approval. MEHO now replaces the known secrets with ***REDACTED*** before the answer leaves the connector. The rest of the file stays the same. Secrets that someone typed into free-text fields, such as descriptions or commands, can still show. Copies of the full config that earlier versions saved in the audit log are removed by the audit clean-up below, once they are older than its retention window.
  • Security fix: the audit clean-up now works on PostgreSQL. MEHO keeps each connector's answer before redaction in the audit log, and that answer can hold secrets. A weekly job is meant to empty it after 90 days by default. Since v0.34.0 the audit log's protection against changes also blocked this job, so nothing was ever emptied. A database migration now lets the job empty that one field. Every other change and every delete stays blocked. The first run after the upgrade empties all old entries at once, about 7 days after MEHO starts.
  • Security fixes in the container image. The pymongo and fsspec Python libraries are updated to versions that fix known vulnerabilities.
  • Docs search hits show their page and source. search_docs and ask_docs hits now carry a readable title made of the section and the page name, say whether a lower or a higher score is better, and can link to the public source page, or the PDF page, when the documentation service sends that link.

v0.35.18 — 2026-10-05

  • You can now clean up vCenter objects through MEHO. Six new vCenter operations delete port groups, empty folders, files and folders on a datastore, and content libraries and their items. A seventh creates a folder on a datastore. Every delete waits for a second person's approval, and the approval request shows what will be deleted. MEHO refuses a delete while something still uses the object, for example a VM on a port group or a disk file that a VM needs, and says what blocks it. Running a delete again for an object that is already gone changes nothing.

v0.35.17 — 2026-10-04

  • A documentation collection can now answer questions with its own answer service. ask_docs used to search a collection and then write the answer with MEHO's own model. If a collection's documentation service has its own answer endpoint, MEHO can now pass the question to it and return that answer and its citations, in the same response shape as before. This is off by default. An administrator turns it on for one collection at a time and can turn it off again with one command. The console's Ask mode, the REST API and MCP now all answer through the same code.
  • The product and version you ask about reach a documentation service only when its collection is set up for them. When you give search_docs or ask_docs a product or version, MEHO now passes it on only if the collection asks for it: as a hint that ranks the matching release first, or as a strict filter. Both are off by default. MEHO used to send these values as filters, and the shared VMware documentation service ignored them, so its results do not change. The tool descriptions now also say which product names and version formats to use.
  • Documentation answers are easier to trace in the logs. Every search_docs and ask_docs call now logs the IDs of the chunks it found and the IDs of the chunks the answer cited, so you can see whether a wrong answer came from the search or from the answer step. The logs hold IDs and source references only, never the question or the document text. A new setting can also log the question while you debug; it is off by default. A new optional alert warns when searches for a product or version keep finding nothing.
  • Security fixes in the container image. OpenSSL and PCRE2 in the base image, and the PyJWT and urllib3 Python libraries, are updated to versions that fix known vulnerabilities. The image build now checks a minimum version for each security-patched system package and stops if one is older.

v0.35.16 — 2026-09-27

  • Breaking: creating a VCF Automation API token now names the Vault target that stores it. In 0.35.15 the new token was written to Vault with your own Vault identity, which usually may not write there, so the call failed after approval. You now name a Vault target, and the token is written with that target's Vault role, the same way a Vault write on that target works. The approval card shows in advance whether the Vault write will be allowed. Calls without the new vault_target setting are refused.

v0.35.15 — 2026-09-27

  • You can now set up a VCF Automation 9.1 tenant through MEHO. New operations create an organization, a custom role, a local user, an API token and a project, and test whether a tenant login works. Every change needs approval first, and running one again for something that already exists changes nothing. A new API token is written straight into Vault at a path you name. It is never shown in the result, the audit log or the activity feed. Passwords are read from Vault too.
  • Breaking for MCP clients: large list_targets pages now return a result handle. A page of more than 50 targets, or more than 4 KB, used to come back inline and could time out in Claude Desktop. It now comes back like any other large result: a short preview plus a handle you read with result_query. Smaller pages are unchanged. The release notes carry the migration recipe.
  • The Claude Desktop extension works with an internal CA again. A recent Claude Desktop update stopped passing the extension's "Internal CA bundle" setting through, so connecting to a backplane with an internal certificate timed out. The extension now loads the CA itself.

v0.35.14 — 2026-09-24

  • You can now read and change a VM's CPU and memory limits and reservations. Two new vCenter operations show a VM's current CPU and memory limit, reservation, and shares, and change any of them. A change needs approval first; the approval request shows the current values next to the requested ones, and the result reports the before and after values. Only the fields you ask for are changed, a request that already matches the VM changes nothing, and setting a limit to -1 removes it.
  • MEHO can log into VCF Automation 9.1. VCF Automation 9.1 changed how logins work, so every tenant operation against a 9.1 appliance failed. MEHO now supports both the old and the new login, and it can also use an API token stored with the target's credentials. If no login works, the error says what to add. The VCF Automation health check also works on 9.1 and now reports whether the provider API is reachable and which API versions the appliance supports.
  • The release process now covers release candidates and security advisories. The maintainer release guide describes how v1.0 release candidates are cut and promoted, and a new ledger records how every past security fix is disclosed.

v0.35.13 — 2026-09-23

  • Each tenant on a shared instance can log into Vault under its own role. MEHO used to log every operator into Vault under one deployment-wide role, which made a strict per-tenant Vault policy impossible. A new, optional setting maps each tenant to its own Vault login role; tenants not in the map keep the deployment-wide role, and leaving the setting empty changes nothing. A typo in the map stops MEHO from starting rather than silently sending a login to the wrong role.
  • The CLI no longer tells you to re-run an operation after approving it. When an operation parks for human approval, the CLI used to say "approve via the approval queue, then re-dispatch" — but approving already runs the operation, so re-running it created a second request for the same change. The hint now says approval executes the operation, and it prints the approval id with the command to inspect it.
  • The console's agent, principal, and grant forms look right again. The create/edit agent form, the agent run console, the register-principal dialog, and the new-grant / elevate dialogs used styling classes that no longer existed, so their fields were laid out unevenly and validation errors showed in plain text. They now use the same layout as the rest of the console, with errors highlighted. Agent timestamps on the detail page and cards now read as YYYY-MM-DD HH:MM UTC instead of raw machine timestamps.

v0.35.12 — 2026-09-22

  • An approved Kubernetes apply that the server accepts but never saves now fails instead of falsely reporting success. When an approved, high-risk k8s.apply ran and the Kubernetes API server accepted the request and echoed the object back but never actually persisted it, MEHO used to record the operation as a success — indistinguishable from a real write, and a violation of the rule that an operation only reports success when it actually happened. MEHO now checks that the applied object came back with a real, persisted revision; when it did not, the operation fails with a clear error instead of a false success. Server dry-run previews, which legitimately return no revision, are untouched.
  • Kubernetes targets whose kubeconfig points at an unreachable address can be reached again. A Kubernetes target registered with a static kubeconfig used to dial whatever server address was baked into that kubeconfig — which broke when that address was an internal one the backplane cannot route to (for example a guest cluster reached through a NAT alias whose kubeconfig names an internal cluster VIP). MEHO now dials the operator-reachable host and port the target was registered with and verifies the certificate against the target's own server name, exactly as it already does for vSphere Supervisor targets, while a cluster registered without a host keeps using the embedded address.

v0.35.11 — 2026-09-21

  • A vSphere Supervisor that logs in without handing back a kubeconfig can be reached again. A Kubernetes (vSphere Supervisor) target that authenticates through WCP-SSO gets back a session token and, on newer Supervisors, no embedded kubeconfig at all — and MEHO used to reject that successful login as malformed, so the target could never be probed. MEHO now treats the embedded kubeconfig as optional (just as kubectl vsphere login does): when it is absent it builds the connection from what it already knows — the login host/port, the target's pinned CA and certificate name, and the returned session token as the bearer — and the target's own TLS policy always wins over anything an embedded config tried to set.

v0.35.10 — 2026-09-21

  • The operator console can't be stranded on a stale stylesheet after a deploy. The console references its CSS, scripts and fonts at stable URLs whose contents change every release, and the server sent them without a Cache-Control header — so after a roll a returning browser could keep serving the previous release's cached stylesheet and render the console unstyled until someone hard-refreshed. MEHO now serves every console asset Cache-Control: no-cache, which forces the browser to revalidate before reuse (a cheap 304 when nothing changed), and a build-time gate refuses to ship a stylesheet that is suspiciously small or missing the console's own classes.
  • Re-running a storage-policy create now finishes instead of dead-ending. Creating a vSphere storage policy through the governed path builds a tag category, a tag and then the policy; if an earlier attempt failed partway it left the category behind, and every retry died immediately with ALREADY_EXISTS. The composite now adopts an existing category, tag or matching policy instead of blindly re-creating it, so a retry converges; a genuinely conflicting object (or a policy create that returns no id) is reported as a clear, retryable error rather than a false success.
  • Supervisors reached through a NAT alias can be probed again. A Kubernetes (vSphere Supervisor) target that logs in via WCP-SSO verified the server's certificate against the address MEHO dialed, ignoring the target's configured certificate name — so a Supervisor fronted by a NAT alias whose address isn't in the certificate failed verification and couldn't be reached at all. The login and the Kubernetes API legs now both honour the target's tls_server_name, and a verification failure explains itself instead of surfacing as a bare connection error.

v0.35.9 — 2026-09-21

  • Storage-policy writes to vCenter now authenticate. Creating or deleting a vSphere storage policy through the governed path reaches vCenter's Storage Policy (PBM) endpoint, which authenticates by a SOAP session-cookie header the connector was never sending — so the first live policy write faulted NotAuthenticated even though every other call on the very same credential succeeded. MEHO now carries the vim session cookie as the vcSessionCookie header on every PBM request (and self-heals an expired session with a single re-login), so vmware.composite.storage_policy.create / delete authenticate like the rest of the connector.
  • A composite operation that fails no longer reports success. Some composite operations signal a load-bearing failure by returning a structured error envelope rather than raising, and the dispatch/audit boundary treated any returned value as success — so a mutation that actually failed (for example a content-library create that got a 500 back from vCenter) was recorded ok / 200 in the audit log and in a parked-then-approved run's result. MEHO now maps a composite's terminal-error envelope (one flagged with an error-severity issue) to a first-class dispatch error with an error audit row, while success-with-warnings envelopes stay ok.

v0.35.8 — 2026-09-20

  • Bootstrap a tenant's Keycloak role groups through the governed path. The backplane derives a tenant's claims (tenant_id / tenant_role) from Keycloak group membership, but the Keycloak connector shipped no group operations — so standing up a tenant's role group and adding its users was the one part of an otherwise-governed identity bootstrap that had to escape to the Admin API, outside policy, audit and approval. MEHO now ships governed keycloak.group.* operations: list groups and members (safe reads), and create a group with attributes, update its attributes, and add or remove members (approval-gated writes) — also as meho keycloak group ... CLI verbs.
  • Agent permission grants now actually apply to agent tokens. A deny, auto-execute or needs-approval grant created with agent grant create was keyed on the agent's client identity but enforced only against the token's service-account id, so no agent grant ever took effect. The resolver now also matches the token's agent:<name> client identity (its azp claim), so — for example — scoping an agent off a whole connector family with a deny grant finally works; the new --principal-kind user-agent extends the same to a human who signs in as an agent through a public client. Grant ceilings are unchanged (deny still beats everything; destructive stays non-grantable for agents).

v0.35.7 — 2026-09-19

  • Change the VLAN of a distributed portgroup that already exists. MEHO could set a portgroup's VLAN only when it was created; the new vmware.composite.network.portgroup.vlan.set reconfigures the VLAN of an existing distributed portgroup — for example to add the native/untagged VLAN 0 to a trunk that was created without it — on the governed, approval-gated write path, replacing the current VLAN config and returning unchanged (no write) when the VLAN already matches.
  • A grown NFS datastore's free space becomes visible without SSH. ESXi caches a datastore's capacity and free space from mount time, so after an NFS export grows a deploy precheck could still fail on stale "not enough free space" numbers. The new vmware.composite.datastore.refresh asks the host to re-probe the volume and reads the fresh summary back — a first-class governed operation in place of dropping to SSH or govc.

v0.35.6 — 2026-09-18

  • Re-mounting an NFS datastore that is already there no longer fails. vmware.composite.host.datastore_mount_nfs is now idempotent: re-running the mount on a host where the export is already mounted converges instead of faulting. Previously a second call with the same parameters surfaced the host's already-exists fault as a connector error, so an automation pack that re-ran the step — a retry after a transient failure on a later host, or an assisted-resume recheck — could never converge once the datastore was mounted. The composite now reads the host's mounted datastores before writing and matches on the export's identity (server and path, normalised for case and a trailing slash): an export that is already mounted returns already_mounted with no write, the requested name held by a different export returns a name_conflict refusal with no write, and an export mounted concurrently between the check and the write is recovered by re-reading. A fresh mount and every other fault are unchanged.

v0.35.5 — 2026-09-17

  • A standalone ESXi host that went quiet is recovered automatically. After an idle period a standalone ESXi host could leave MEHO holding an expired session that still answered the unauthenticated bootstrap but returned every requested property as "missing" — so a read came back empty with no error and never recovered for the life of the Pod. MEHO now refreshes a host session before it can idle out (a bounded max-age, 20 minutes by default, tunable with VMWARE_SOAP_SESSION_MAX_AGE_SECONDS), re-reads once on a fresh session when a read comes back entirely missing under an auth fault, and confirms host reachability with an authenticated liveness check — so an unreachable host is reported as unreachable instead of silently empty.

v0.35.4 — 2026-09-17

  • Per-property detail on vSphere object reads. vmware.object.collect now reports, per object, which requested properties came back missing and the vSphere fault behind each (for example NoPermission) — names and counts only, never the fault message or the payload — so a partial read is diagnosable instead of opaque.
  • Service-principal grants get CLI commands and a console. Operators and tenant admins can list, create, and manage service-principal grants from the CLI and a unified grants console.
  • Stored large results are bounded by encoded size. A stored result handle now caps its whole encoded record at a configured limit (16 MiB by default), keeps the longest run of whole rows that fits, and tells the caller whether the stored copy is complete or partial.

v0.35.3 — 2026-09-17

  • A guest-composite read never keeps an in-guest password in the trace. Every vSphere guest composite that carries a login — listing guest processes, reading the guest environment or a guest file — is now classified so the flight recorder does not record its request body, closing a path where a safe-tier read could retain the guest login password in the 30-day trace store. Forward-only: traces captured before this release keep their bodies until they age out.
  • Reading a guest file can fetch its contents. vmware.composite.vm.guest.file.read can now return the file itself, fetched server-side with a size cap and returned behind a result handle; the operation moves to the caution tier, so agent and service callers park for approval while human operators run it as before.

v0.35.2 — 2026-09-16

  • A parked secret value stays off approval screens. When an operation that carries a credential parks for approval, its secret input is encrypted in a one-time, tenant-bound hand-off, so the value never lands on the approval row or any approval read surface. Operators configure the dedicated approvalHandoff Secret reference in Helm values; approval rows written before the upgrade are not backfilled.
  • Deploy request bodies redact OVF property values. Captured vendor deploy bodies could retain OVF property values, which commonly carry appliance credentials; the flight recorder now strips them structurally, on request and response, for every connector. Forward-only.
  • Governed vSphere Supervisor namespaces. Create (approval-gated), delete (approval-gated, with a blast-radius preview and a read-back), and status composites for vSphere Supervisor namespaces, each on the governed dispatch path.

v0.35.1 — 2026-09-15

  • Changing a built-in connector needs platform-admin. Enabling, disabling, or editing a built-in (global) connector now requires the platform_admin claim and answers a plain tenant admin with a clear 403 instead of the misleading 404 an earlier path returned. Tenant-scoped connectors are unaffected.
  • The operator console renders correctly again. A v0.35.0 build change left the console without its compiled styles; the build now fails loudly if the stylesheet comes out empty, and the scheduler's create-trigger form and timestamps are back on the current layout.

v0.35.0 — 2026-09-14

  • vSphere 8.0 and 9.0 side by side. A vmware-rest-8.0 catalog is registered next to vmware-rest-9.0, and MEHO picks the right one per target from its fingerprint — an 8.0.x vCenter resolves to the 8.0 catalog, a 9.x vCenter to the 9.0 one — so one estate spanning both is served correctly. An enabled 9.0 operation dispatched against an 8.0.x or otherwise unqualified target now fails closed with a clear reason instead of a vendor error.
  • VMware VM writes ingest as approval-gated by default. Ingested VMware VM hardware, create/delete, and power operations now carry the dangerous tier and require approval out of the box; a re-ingest never weakens a stricter reviewed posture.
  • Pin a host key through the backplane. net.ssh_keyscan reads a host's SSH host keys (handshake only, no credentials offered) and returns ready-to-pin known_hosts lines, so the pin the SSH connector's fail-closed verification needs is minted through a governed operation instead of an out-of-band shell step.
  • CLI parity for broadcast, and external token issuers. meho broadcast recent / announce / watch reach the activity feed from the CLI, and the declarative OAuth token-mint auth scheme can now mint a client-credentials token at an external issuer.

v0.34.3 — 2026-09-12

  • Pass a secret into a remote script without leaving it on the host. linux.script.run gains an optional secret_env map: the referenced secret is resolved server-side under the caller's tenant scope and injected into the script's environment at run time — never written to the approval request, the audit parameters, the preview, or a log line. This retires the earlier workaround that parked a live token on the target.

v0.34.2 — 2026-09-10

  • A pfSense gateway delete recovers a transient non-persist. A pfSense runtime race could leave a gateway delete uncommitted even though the command exited cleanly, so a gateway that would otherwise delete was left in place and the teardown hard-failed; the delete now re-applies once and re-verifies before failing closed.

v0.34.1 — 2026-09-09

A patch release that fixes a v0.34.0 regression and rolls up the governed connector and shared-instance work that landed since.

  • Compressed vendor responses decode again. On v0.34.0, any read against a vendor that gzip- or deflate-compressed its response failed with a decoding error, because the response body-size cap added in v0.34.0 decompressed the body a second time. Every HTTP-based connector — vmware-rest, vcf-fleet, gcloud, and the rest — was affected. This release restores the earlier behaviour so a compressed response decodes exactly once (#3521).
  • Kubernetes Secret and ArgoCD credential values are redacted on read. A safe read that surfaces a Kubernetes Secret or an ArgoCD repository object now blanks the secret values — keeping the key names and a digest — so payload secrets no longer reach an agent on a shared instance.
  • More governed VMware and SDDC lifecycle. Resource-pool create/delete and a DRS VM-Host affinity rule, an NFS tag-based storage policy, vSphere Supervisor enable/disable/status, and SDDC Manager workload-domain build ops — each approval-gated and audited on the governed dispatch path — plus a governed read that stages a guest-cluster kubeconfig to a Vault reference instead of an agent transcript.
  • Shared-instance isolation controls. Per-principal and per-tenant dispatch rate limits, a per-tenant mail-recipient allowlist, an opt-in bearer guard on /metrics and /ready, and a per-tenant bound on targetless network probes.

v0.33.3 — 2026-09-05

  • Probe a target's certificate, then pin it — in one step. net.tls_inspect now returns each presented certificate as PEM (on the leaf and every chain entry), not just facts about it. You can probe an endpoint and feed the right trust anchor straight into a target's tls_ca_pin — the leaf for a self-signed appliance, or an issuer/root for a CA-signed one — which is what you need to register a target reachable only through a NAT alias, where ordinary hostname verification can never match. The PEM is public handshake material, never a private key.
  • The assistant no longer points at result-handle features that don't exist. The guidance the agent reads, the CLI help, and the onboarding guides had described a result-handle query surface — aggregation, filtering, describe — that was never built. That text now matches what actually ships: paging a result handle by offset and limit, and nothing it cannot do.

v0.33.2 — 2026-09-05

  • Standalone ESXi host operations now actually reach the host. The host-setup reads and composites for a not-yet-managed ESXi host — list its storage devices, mount an NFS datastore, mark a disk as flash — had been failing at sign-in, because the connector spoke only the API surface a full vCenter serves. It now speaks the protocol a standalone ESXi host actually offers, so those operations work directly against a freshly provisioned host early in a management-domain bring-up — the case v0.33.0 set out to support.
  • Distributed-switch portgroup VLANs are no longer silently dropped. Creating a portgroup with a VLAN tag or a trunk range now applies that VLAN instead of quietly producing an untagged (VLAN 0) portgroup. The create had been reporting success while the tag was discarded.

v0.33.1 — 2026-09-04

  • Standing grants for query-string actions. A service principal can now hold a standing grant for an operation whose id carries a literal ?action= verb — such as a vCenter power action or an OVF deploy. Before, these were wrongly refused as wildcards, so an agent could never be granted them and the power-on and deploy-from-library flows always had to park for a human.
  • The satellite gateway guide now covers remote writes. The guide for running checks and operations through a remote runner used to say a satellite had no way to write; it now documents the opt-in tier that lets that runner perform governed, approval-gated, audited writes inside networks the central instance cannot reach.

v0.33.0 — 2026-09-04

  • A much bigger documentation site. New do-real-work guides for the flight recorder, external event ingestion, and add-ons; a guide to the Windows estate and governed in-guest program execution; a client-onramp section for Claude Code and Claude Desktop; an explainer of the MCP surface tiers — the default working surface versus the operator planes behind the mcp:admin scope; and this What's new page. An accuracy sweep also brought the existing guides back in line with what the last release actually ships.
  • Generated, always-current references. The connector catalogue, the full MCP tool inventory, and every CLI command are published as reference pages generated straight from the code, with a CI check that fails the build if they drift out of date.
  • Standalone ESXi hosts, before any vCenter exists. The host-setup composites — mount an NFS datastore, mark a disk as flash, control a service — now run directly against a freshly provisioned ESXi host that no vCenter manages yet, the exact state you are in early in a management-domain bring-up. A new read lists a host's raw storage devices so the disk it flash-marks is chosen from real data.
  • More governed deletes for pfSense. Removing a static route, a gateway, or a single member of a shared firewall alias each became a governed, approval-gated delete that previews exactly what goes and refuses to strand a route behind a gateway or empty a shared alias.
  • Preview parity for approval-gated actions. An agent can now preview the exact effect of an approval-requiring action before it parks for a human, matching what the approver sees — while actions that carry a secret in their request stay deliberately un-previewable.
  • Steadier CLI sign-in. A stale system-keyring entry can no longer shadow a newer saved token, and expiry messages now say plainly when a session has ended and point at how to sign back in.
  • Operator console polish. The Conventions create and edit dialogs render correctly again after a UI-framework upgrade.

v0.32.0 — 2026-09-02

  • The Microsoft estate gains connectors. New connectors for Windows Server, Active Directory, SQL Server, failover clustering, and Hyper-V — the Windows and SQL half of the datacenter, behind the same policy and audit as every other connector.
  • Governed permanent deletes. A destructive-delete tier previews exactly what would be removed, binds the human approval to that exact preview, and refuses to run until a person approves — so a delete of a VM, a DNS record, a firewall rule, or a secret always has a person who owns it.
  • Flight recorder. A complete, redaction-safe record of each dispatch, captured at the vendor-API level with secrets stripped, and readable by operators and by the agent's own session.
  • Governed in-guest program execution. Run a program inside a VM's guest operating system as a governed, approval-gated step that keeps secrets out of the preview.
  • Governed writes on satellite runners. A remote runner can execute policy-checked, audited writes inside networks the central instance cannot reach — limited to an operator-set allowlist, and never for the destructive or dangerous tiers.
  • Read result handles from the CLI and REST. result_query reached full parity: a large, set-shaped result can be paged back from the CLI and REST, not only from an MCP client.
  • A dedicated approve-only role. A principal who can clear the approval queue without any power to run an operation — separation of duties for regulated teams.

v0.31.0 — 2026-08-27

  • One-command onboarding. A Claude Code plugin (claude plugin marketplace add evoila/meho, then /plugin install meho@meho) and a one-click .mcpb bundle for Claude Desktop point a client at your own backplane in a single step. Nothing is exposed to the internet.
  • Least privilege by default. A connecting agent now sees only the 25-tool working surface; the operator planes list only for a session that explicitly requests the mcp:admin scope. See MCP surface and scopes.
  • The AI cannot approve itself. Approving an action, rejecting it, and granting an agent more access have no path an MCP client can call — those decisions move to the operator console or the CLI.
  • Two breaking changes for MCP clients. The default surface dropped to 25 tools, and the approval and grant-elevate verbs left the MCP surface. Each carries a migration recipe in the release notes.

v0.30.0 — 2026-08-25

  • VMware Cloud Foundation bring-up through the backplane. Submit and poll a management-domain bring-up as governed, approval-gated steps.
  • Air-gapped installs. Govern the depot configuration, TLS-trust, and bundle pre-download steps an air-gapped bring-up depends on.
  • Recover from a failed bring-up. Resume a failed management-domain bring-up from where it stopped, under the same approval posture as the original run.
  • Migration-source connectors for older VMware and Aria versions. So one estate spanning old and new resolves to the right implementation per system — useful for reading and inventorying an existing estate during onboarding.

v0.29.0 — 2026-08-19

  • External event ingestion. An authenticated webhook from your monitoring stack can fire a subscribed agent run on match, through the same policy, approval, and audit path as any other operation.
  • Checks say which items breached. A breaching aggregate assertion now carries a sample of the offending rows in its evidence, so a notification names the specific items, not just that the aggregate tripped.
  • PostgreSQL 12 dropped from the supported range. The end-of-life release is no longer supported.
  • More curated read operations across connectors. Kubernetes, Harbor, and database connectors gained typed read operations that dispatch on a fresh boot with no ingest step.