v26.10.4

Plugin package version 26.10.4. The mariadb-shell MCP server floor
(MARIADB_SHELL_VERSION) moves from 26.10.1 to 26.10.2, the newest
mariadb-shell release (published 2026-10-17). An install already at or
above 26.10.2 is used as-is; only a machine below it fetches anything.

Every plugin with the MCP server now ships a CLI guard. It stops the
agent from using the MariaDB and MySQL command-line clients for what the
MCP server's tools do, so no password reaches a command line, the
process list, logs or the model. The guard covers mariadb or mysql
running SQL, mariadb-shell or mysqlsh in SQL mode or calling an API a
tool wraps, and mariadb-dump piped into another client. A blocked
command is answered with the tool to use instead; everything else still
runs, and MARIADB_PLUGIN_ALLOW_CLI=1 turns the guard off. It is a
PreToolUse hook in Claude Code and Codex, the extension itself in Pi,
and an OpenCode plugin loaded from opencode.json. For Hermes Agent it is
a new, separate plugin, mariadb-guard (hermes/guard-plugin), installed
next to mariadb-dev or mariadb-sql; this is its first release.

Skills were re-vendored from mariadb-docs at a439473 (no skill content
changed) and from mariadb-shell at a4352a5. The contributor skill
review-shell-change adds two rules: a scenario the product cannot
produce is not a finding, and a defect outside the change goes to a
follow-up list. Counts stay at 85 dev, 47 sql and 3 contributor skills.

See each plugin's CHANGELOG.md [26.10.4] section for details.