github LanternOps/breeze v0.114.0
on GitHub

4 hours ago

Breeze RMM v0.114.0 — network devices get truthful health/reachability data, compliance evidence reporting expands to four new report types, and the AI agent execution plane, patch agent, and sweeps act-mode waves land as connected infrastructure.

⚠️ Breaking change: catalog_items.unit_price is dropped from the schema (#6095). Prices have lived in catalog_item_prices since the multi-currency wave; anything still reading the old column directly (custom SQL, BI exports) will break. See Self-Hosting below — take a database backup before upgrading, since this is not a clean rollback to v0.113.0 once applied.

Summary

The network device page now reflects real collection state end to end — sourced reachability, per-OID SNMP outcomes, bounded table walks, template-suggested vendor/model identity, and a dedicated Monitoring tab (#5988 W01–W05). Compliance/evidence reporting grows four new report types (identity & access, vulnerability management, endpoint management, threat detection) on top of last release's service-deliverables foundation. The AI side ships three connected waves as infrastructure: an execution plane for artifact-backed tool runs, an AI patch agent that chases and retries failed patch work, and AI sweeps act-mode with a graduated autonomy gate — plus Fleet Design apply/rollback, a BYO MCP tool-catalog (flagged off), and Organizations/Hardware-Lifecycle/Agreements portal and admin surfaces. A broad fix sweep (SNMP polling correctness, remote-desktop MFA lease evaluation, RLS/lock-order hardening) rounds out the release.

Added

  • Network device page truth, W01–W05 (#5988 — PRs #6002, #6017, #6016, #6015, #6035): sourced reachability header, probe/SNMP collection health, per-OID outcomes with bounded table walks, sysObjectID template suggestion (including a Xerox template), one asset-settings modal with a single writer, and a Monitoring tab with an OID table and charts.
  • Evidence report types, four new end-to-end reports over the service-plan evidence framework (#5812/#5784 — PRs #5842, #6006, #6007, #6027, #6034): threat detection review, endpoint management review (M365 Intune sync tables), vulnerability management, and identity & access review.
  • AI Agent Execution Plane, W01–W05 (#5711 — PRs #5738, #5736, #5771, #5902, #5919): artifact store with large-result capture, a sandbox adapter with compute pricing, an export_dataset tool with run-progress events, workspace tools and admission/compute settlement, and chat integration with observability and rollout.
  • AI patch agent, W01–W04 (#5747/#5750 — PRs #5792, #5888, #5903, #5920): the patch lane end to end, actionable installs with a shared eligibility resolver and device-scoped Tier-3 install cards, chase/retry/escalate with deterministic failure classes, and reactive routing with reboot planning.
  • AI sweeps act mode, W02–W05 (#5753/#5755/#5756 — PRs #5889, #5913, #5937) plus provenance (#5751 — #5780) and the measured impact band (#5761 — PRs #5807, #5885): verification for schedule-triggered intents, an act gate, fan-out/budget/graduation/visibility, and exposure-time cohort metrics on /ai-agents/impact.
  • Fleet Design apply/rollback, W03–W05 (#5650 — PRs #5698, #5706, #5726): applied-items ledger, legacy intent inventory with bundle-import tags, and scheduled drift with a delivered-designs counter.
  • BYO MCP tool catalog, W01 (#5216 — PRs #5964, #5974, #5983): tool-source tables, discovery, and resolver, chat + MCP bridge, external Tier-3 tools via action intents, and a Tool Sources UI. Ships off by default behind TOOL_SOURCES_ENABLED.
  • Desired-state install arming, W02–W06 (#5505/#5506/#5508 — PRs #5917, #5931, #5934, #5968, #6039, plus #5933): compliance-worker install-remediation branch, policy-owned install deployments, AI guardrails that keep the AI from ever arming installs itself, an install-preview dry-run endpoint, and remediation status projected on GET /software-policies/violations.
  • Ticket checklists, W01–W03 (#5808 — PRs #5833, #5916, #5921): the checklist primitive, a partner-wide template library, and sweep-seeded instructions wired onto deliverables.
  • Hardware Lifecycle portal page, W02–W03 (#5728/#5701 — PRs #5701, #5763, #5785, #5791): a replacement-plan report sourced from warranty ship dates, a portal page (status bar, schedule, plan tables, Reports card), and a timeline with hover/device links.
  • Organizations account board, W01–W03 (#5721 — PRs #5734, #5737, #5766) plus a page refinement (#5708): GET /orgs/account-readiness, /organizations replacing the split view, and integrations/contracts/backup surfaces.
  • Agreements area, W01–W03 (#5822 — PRs #5834, #5835, #5887): vocabulary, permission, and an IA split for the agreements module.
  • M365 tenant-sync, W04–W05 (#5327/#5329/#5331/#5332 — PRs #5695, #5702, #5985): executor core with claim ticker, enrichment/continuation/Secure Score rollup, and a signin_events sync domain with forced RLS and retention.
  • Ticket AI assistance: attribution at the source for AI-dispatched device work (#5758 — #5788), an AI ticket proposal posted on the ticket detail as the technician (#5790), per-event helpdesk admissions with an ordered loop guard (#4212 — #5800), a hardened autonomous ticket private-note lane (#5742 — #5805), and a Tier-2 time-entry proposal from AI-assisted ticket work (#5743 — #5872).
  • Monitors: episodes and recurrence escalation (#5290 W03 — #5769), coverage kinds with a script monitor and network_check adapter (#5287 W04 — #5770), an editable HTTP check target and certificate block on the monitor drawer (#5966 — #6060), and built-in CPU/memory/disk monitors with Network as the hub root (#5710).
  • AI device scorecard, W02 device-page surfaces (#5022 — #5802).
  • HP warranty opt-in, W02 (#5511 — #5700): server-stamped consent, execute+MFA gate, heartbeat delivery.
  • Portal Devices page gains a per-org visibility toggle, default off (#4933 — #6065); default_time_entry_minutes exposed in the ticket category editor (#5954 — #6055).

Improved

  • Additive API error codes with client-side translation, and Zod validation errors now translate through a VALIDATION_FAILED envelope (Task 3/Step 4 of #3859 — #5692, #5886).
  • RLS-context bound backend detection: the request DB context's RLS GUC prologue is now bounded, and wedged ClientRead backends are detected and reclaimed automatically (#6048 — #6056) — see new optional env vars below.
  • Artifact blob uploads stream through multipart Upload instead of buffering (#5868 — #5869).
  • sites and portal_users gain an org_id index (#5732 — #5979).
  • Org AI budget editor moved to an Org Settings → AI tab (#6004 — #6014); Variables "All organizations" view now lists partner-wide variables only, with rows carrying the owning org (#5353 — #6064).

Fixed

  • Remote desktop: v0.113.0 operators saw "Launching viewer…" silently revert for a Partner Admin with no MFA factor — the revocation lease now evaluates MFA through the login policy instead of failing closed (#6107 — #6121).
  • SNMP: a device configured for snmp_version=v1 is now polled as v1 with GETNEXT walks instead of SNMPv2c GetRequest/GetBulk (#6019 — #6077); one over-long instance string no longer discards an entire poll's metrics (#6108 — #6109); failed snmp_poll results now persist and surface on the network device page (#6021 — #6066).
  • Fleet Designer apply steps now run on the savepoint transaction instead of the ambient DB connection (#5707 — #6068).
  • Partner-wide event-log forwarding destinations are now delivered to child orgs (#5424 — #6059).
  • Device cards abort in-flight metrics fetches on unmount and cap concurrent sparkline requests (#6044 — #6061).
  • Deliverable sweep now closes retired deliverables' occurrences, and pinned-ticket asserts carry an org predicate (#5609 — #6057).
  • Portal dashboard Support tile counts only the logged-in user's own tickets (#5965 — #6054).
  • Organizations board now works for a system-scope platform admin (#6029 — #6045); several sweep paper cuts fixed (branding save outcome, Built-in provenance, monitor owner badge, escalation picker) (#6030 — #6041).
  • An approved intent's terminal outcome now reads back into chat, and terminal intents surface in /approvals (#6022 — #6047).
  • Org-owned tool sources were unreachable under a partner session; tool-source enqueue now audits before enqueue and returns 202 on enqueue failure (#6023/#6025 — #6043, #6042).
  • offlineDetector now matches last_seen_at at millisecond precision and skips a bad UUID device row instead of failing the whole sweep (#6024, #5867 — #6040, #5944).
  • Windows installer one-liner now downloads the agent into a temp dir instead of the shell's working directory (#5900); hosted first install stages the watchdog from the control plane with a checksum check (#5899 — #5901).
  • A repeat proxy Connect through a tunnel no longer 500s — the allowlist insert is now savepointed (#5907).
  • System-scope tokens now correctly resolve platform-admin permissions (#5733 — #5978).
  • resolveMonitorsForDevice can now distinguish a vanished device from "no monitors apply" (#5677 — #5973); partner-wide read visibility restored for compiled network checks (#5866 — #5972).
  • Backup: verification timeouts are now handled and surfaced (#6038); stale metadata.error is cleared on recovery-media rebuild (#5411 — #5977); killed backup helper processes are reaped instead of leaking zombies (#5420 — #5975); transferredSize now finalizes from the terminal result as bytes actually uploaded (#5410 — #5782).
  • Recovery console PID is held alive after poweroff instead of vanishing mid-recovery (#5890 — #5897).
  • OAuth DCR clients now age out once-used, and last_used_at stamping is non-fatal (#5610 — #5976).
  • macOS user-session helpers get a per-user log directory (#5877 — #5970).
  • Patches can be unapproved after being approved (#5585 — #5914).
  • Automation runs triggered by an event now bind to the triggering device (#5240 — #5910).
  • Warranty lookup failures are now distinguished from confirmed no-warranty in reports (#5764 — #5947); measured impact band renders censored p50/p90 instead of a misleading 90-day omission label (#5879 — #5885); merged saved-report cards are now keyed by their own id (#5765 — #5943); device_inventory export filters by device id instead of hostname (#5776 — #5950).
  • Monitoring "Test connection" now performs a real provider check instead of a stub (#5427 — #5778).
  • AI metrics adapter paginates within a device instead of hard-capping results (#5775 — #5949).
  • Portal: customCss gets a write path and is now injected into the portal UI (#5952, #5940 — #5982, #5945); lifecycle device rows stop linking to Devices when self-service is off (#5880 — #5884); DeviceList relative-time cells are stable across hydration (#5881 — #5883).

Security

  • SEC-023, SEC-046, SEC-084, SEC-110 (#5545): site scope is now enforced consistently on software deployments, software name search, monitoring names, and manual-asset mutations for site-restricted accounts.
  • AI workspaces hardening (#6086 — #6096): pre-ship enforcement pass across ~60 AI tools — scoped-agent enforcement, sandbox lifecycle, and artifact preview handling.
  • SEC-038 W05/W06 (#5536, #5537 — PRs #5915, #5922): a durable desktop-start fence with helper IPC generation/resync, plus a capability gate and cutover flag for the fence — laying groundwork for REMOTE_DESKTOP_FENCE_REQUIRED (still off this release).
  • alert_correlations RLS now checks both alert orgs instead of one (#5607 — #5673).
  • AI guardrails added so the AI may never arm software installation itself, even when a policy expresses it (#5505 W05 — #5934).
  • Dependency hardening: rustls updated to clear RUSTSEC-2026-0285 in the desktop helper and viewer (#5850, plus a follow-up Cargo Audit fix — #5956, #6084).

Self-Hosting / Upgrade Notes

Upgrade: bump BREEZE_VERSION in .env, then docker compose pull api web portal && docker compose up -d (or pnpm install when running from source).

⚠️ Breaking change: 2026-10-17-130000-drop-catalog-items-unit-price.sql drops catalog_items.unit_price (#6095). Prices have lived in catalog_item_prices since the multi-currency migration; anything reading the old column directly (custom SQL, BI exports) will break once this migration applies. Because a column is dropped, rolling back to v0.113.0 after upgrading is not a clean revert — take a database backup before upgrading.

Migrations: 54 new migration files land in this range, on top of a v0.113.0 install. All are idempotent and auto-apply on boot via autoMigrate (unless AUTO_MIGRATE=false). One is a backfill worth calling out: 2026-10-16-181300-monitor-coverage-kinds.sql backfills org_id on network_monitor_results in a single UPDATE at boot. This runs in a few seconds on a few hundred thousand rows; an instance with many millions of network monitor results should expect a slower first boot on this release.

Schema note: snmp_metrics.instance is widened from VARCHAR(64) to VARCHAR(200) (#6109) — a plain length increase, no table rewrite.

No new required environment variables. New optional env vars, all defaulted, for the wedged-backend detector (#6056): DB_ACCESS_CONTEXT_PROLOGUE_TIMEOUT_MS, DB_WEDGED_BACKEND_SCAN_DISABLED, DB_WEDGED_BACKEND_SCAN_INTERVAL_MS, DB_WEDGED_BACKEND_MIN_AGE_MS, DB_WEDGED_BACKEND_RECLAIM_DISABLED, DB_WEDGED_BACKEND_RECLAIM_MIN_INTERVAL_MS, DB_WEDGED_BACKEND_RECLAIM_MAX_PER_PASS, DB_WEDGED_BACKEND_RECLAIM_TIMEOUT_MS, DB_WEDGED_BACKEND_CONFIRM_DELAY_MS. New log lines: [db-wedged-backend] Detector started … at boot, and a reclaim line when a backend stuck in ClientRead is terminated.

Compose mappings added (#6031): TOOL_SOURCES_ENABLED, TOOL_SOURCES_ALLOW_PRIVATE_EGRESS, WEBAUTHN_RP_ID, WEBAUTHN_ORIGIN, WEBAUTHN_RP_NAME, BREEZE_AI_AGENTS_SWEEP_ACT_ENABLED. Self-hosters with a hand-edited docker-compose.yml must copy these into the api service's environment: block — a value in .env alone does not reach the container. Passkeys on a non-default host need WEBAUTHN_RP_ID set.

Feature flags: nothing new to enable this release. TOOL_SOURCES_ENABLED stays off by default (the BYO MCP tool catalog above is inert until it's turned on). REMOTE_DESKTOP_FENCE_REQUIRED stays off this release.

Behavior changes operators will notice:

  • Navigation: the Fleet Management entry Monitoring is now Network Monitor (network assets, checks and templates only). Device monitors moved to Alerts → Monitors; the old /monitoring/monitors URLs redirect (#5710).
  • Portal Devices page is now a per-org visibility toggle, default off — re-enable under Org settings → Portal.
  • The org AI budget editor moved to Org settings → AI.
  • Variables "All organizations" view now lists partner-wide variables only, with each row carrying its owning org.
  • Four new evidence report types are available (identity & access, vulnerability management, endpoint management, threat detection).

No other breaking changes.

Full Changelog: v0.113.0...v0.114.0

What's Changed

New Contributors

Full Changelog: v0.113.0...v0.114.0

What's Changed

New Contributors

Full Changelog: v0.113.0...v0.114.0

What's Changed

New Contributors

Full Changelog: v0.113.0...v0.114.0

Check out latest releases or
releases around LanternOps/breeze v0.114.0

Don't miss a new breeze release

NewReleases is sending notifications on new releases.

Get notifications