Breeze RMM v0.89.0 — partner-wide everything: define a policy once, apply it to every org — plus scheduled report delivery and a faster Windows remote desktop.
Summary
- Partner-wide first (epic #2135) — the config surfaces MSP techs define once now apply across ALL their orgs, not one at a time: software & security policies (#2143), compliance rule sets, sensitive-data, peripheral-control policies & maintenance windows (#2149), alert notification channels, routing rules & escalation policies (#2156), and standalone automations (#2162) are all dual-ownership (org-scoped or partner-wide), with isolation enforced by database row-level security, not just app code. Patching's artificial org-first restrictions are gone too (#2143).
- Reports — saved reports now actually run on their schedule and email recipients, with branded PDF attachments, an exec-summary cover, trend deltas vs the prior period, and next-run visibility in the UI (#2148, #2152).
- Remote desktop (Windows) — encode pipeline rebuilt: async Media Foundation transforms, zero-copy texture path, adaptive slow-start; noticeably lower latency on busy hosts (#2145).
- Billing & AI — the AI/MCP surface gains full write coverage over billing and ticketing (quotes, invoices, contracts, tickets) and the six broken billing read tools are repaired with a contract test against registry drift (#2122). Quotes/Invoices/Contracts get a shared UI kit and editor parity (#2150).
Added
- Partner-wide ("All orgs") ownership for software policies, security policies (#2143); compliance rule sets, sensitive-data policies, peripheral-control policies, maintenance windows (#2149); notification channels, routing rules, escalation policies (#2156); automations (#2162). Create-time scope selector + "All orgs" badge in each list; partner-wide evaluation fans out per device org (results, alerts, and findings always land on the device's own org).
- Partner-wide patching unblocked — update rings are partner-axis; a partner-wide patch policy now resolves and schedules end-to-end (#2143)
- Scheduled report execution — daily/weekly/monthly saved reports run per-org-timezone and email recipients; PDF-format reports attach branded PDFs with exec-summary cover and trend deltas (#2148, #2152)
- Ticket soft-delete + admin restore — clear out test/spam/duplicate tickets reversibly instead of parking them in Closed (#2144)
- Billing & ticketing AI/MCP write tools — create/update quotes, invoices, contracts, and tickets from the AI agent and MCP clients; broken billing read tools repaired (#2122)
Improved
- Quotes/Invoices/Contracts — shared status/loading/save UI kit and editor parity across the three surfaces (#2150)
- Windows remote desktop — async MFT encode, zero-copy capture→encoder path, adaptive slow-start bitrate ramp (#2145)
- Reliability score card — self-explaining factor rows for all five factors; devices no longer bounce to a mystery score (#2159)
Fixed
- Reliability scoring — VSS software events no longer count as memory/disk hardware errors (bare event-ID matches now require a hardware source), and a device's own failure events no longer double-penalize its score; fleet scores may shift (mostly upward) after upgrade (#2159)
- Remote viewer — session stats survive auto-reconnect, so adaptive bitrate no longer freezes after a network blip (#2158)
- UniFi (self-hosted controller) — deep-telemetry collector upsert now matches its partial unique index, fixing a 500 (#2141)
Security
- Tenant isolation — every table converted to partner-wide ownership ships a dual-axis row-level-security policy plus a database CHECK enforcing exactly-one-owner (org XOR partner), covered by per-table cross-tenant forge tests against real Postgres (#2143, #2149, #2156, #2162)
- MCP — the
breeze://scriptsresource read now applies dual-ownership scoping (previously org-only) (#2162)
Self-hosters are encouraged to upgrade.
Self-Hosting / Upgrade Notes
Upgrade command. Bump BREEZE_VERSION=0.89.0 in your .env, then:
docker compose pull api web && docker compose up -d(If you build from source, run pnpm install first.)
Database — 10 migrations, idempotent, auto-apply on boot via autoMigrate (unless AUTO_MIGRATE=false). All are DDL-only on small config tables: nullable partner_id columns, org_id NOT NULL relaxations, exactly-one-owner CHECK constraints, partner indexes, RLS policy swaps (org-only → dual-axis), and ticket soft-delete columns. No backfills or table rewrites — no long stall on boot.
No new required environment variables.
Behavior changes.
- Ticket delete is now a soft-delete with admin restore; deleted tickets leave the default lists but remain restorable (#2144).
- Reliability scores may shift after upgrade — devices previously penalized by VSS event misclassification or self-failure double-counting will score higher as new data accrues (#2159).
- Partner-wide features are additive — existing org-scoped policies, channels, and automations behave exactly as before. Creating "All orgs" objects requires a partner admin with all-organizations access.
No breaking changes.
Full Changelog: v0.88.0...v0.89.0
What's Changed
- docs: sync technical docs for v0.88.0 by @ToddHebebrand in #2121
- Partner-wide first: patch enablement, capability gate, and dual-ownership software + security policies by @ToddHebebrand in #2143
- perf(agent): Windows remote-desktop encode pipeline — async MFT, zero-copy, adaptive slow-start by @ToddHebebrand in #2145
- Quotes/Invoices/Contracts polishing round 2: shared billing kit + editor parity by @ToddHebebrand in #2150
- Ship scheduled report execution and posture report polish by @ToddHebebrand in #2148
- Reports: PDF email attachments, exec-summary cover, trend deltas, next-run visibility by @ToddHebebrand in #2152
- feat(ai): billing & ticketing AI/MCP write tools + repair broken read tools by @ToddHebebrand in #2122
- fix(unifi): match partial unique index in cloud collector upsert (deep telemetry 500) by @ToddHebebrand in #2141
- feat(tickets): soft-delete + admin restore for tickets (#2140) by @ToddHebebrand in #2144
- chore(deps): bump tauri from 2.11.3 to 2.11.5 in /apps/helper/src-tauri by @dependabot[bot] in #2154
- chore(deps): bump tauri from 2.11.3 to 2.11.5 in /apps/viewer/src-tauri by @dependabot[bot] in #2155
- Partner-wide first phase 2: compliance, sensitive-data, peripheral, and maintenance dual-ownership by @ToddHebebrand in #2149
- fix(viewer): viewer_stats survive auto-reconnect — adaptive bitrate no longer freezes by @ToddHebebrand in #2158
- Partner-wide first phase 3: alert delivery rails dual-ownership (channels, routing, escalation) by @ToddHebebrand in #2156
- docs(partner-wide): backup template/binding design (#2132) + automations conversion mapping (#2133) by @ToddHebebrand in #2157
- fix(reliability): bare-ID hardware gate, self-failure exclusion, self-explaining score card by @ToddHebebrand in #2159
- Partner-wide first phase 4: automations dual-ownership (org XOR partner) by @ToddHebebrand in #2162
Full Changelog: v0.88.0...v0.89.0