LanternOps/breeze v0.97.1

on GitHub

Breeze RMM v0.97.1 — Linux remote desktop, contract-backed quotes, incremental backups, and the partner reconstruction API.

Summary

• Linux remote desktop actually works — a pure-Go X11 mirror ships in the CGO_ENABLED=0 release agent for the first time (#2602).
• Quotes → contracts — rich-text contract templates, executed-document snapshots, and a real send/branding/portal experience (#2596).
• Backups — incremental backups plus checkpoint/resume, a stalled-job reaper, and progress tracking (#2599).
• PAM — Path B token-launch elevation actuator, secure-desktop dialog, a redesigned console, and requester-session privacy fixes (#2588, #2591).
• M365 — a closed, typed catalog of 12 Microsoft Graph read actions surfaced as six m365_query_* AI tools (#2615).
• Partner reconstruction API — a 13-resource export API with DB-enforced tenant integrity, backing Weavestream-style integrations (#2506).
• Org context, round three — a unified switcher with an explicit per-route scope contract (#2595).

Added

• Linux remote desktop (X11 mirror, pure-Go) — capture now works in shipped agents; earlier builds only ever contained the ErrNotSupported stub because the sole capturer required cgo (#2602).
• Contract-backed proposals — versioned rich-text contract template library (partner-wide gated), contract blocks + PDF cover pages in quotes, variable substitution with an unresolved-variable send gate, contract-aware acceptance hash, and an atomic accept-time executed-document snapshot linked to the billing contract (#2596).
• Incremental backups — agent checkpoint journal + resume across restart/VSS, plus incremental mode on top of the existing full-backup path (#2599).
• PAM Path B actuator + secure-desktop dialog — the elevation prompt renders on the Winlogon secure desktop, stays in the target session, and uses a custom Win32 dialog (shield, signer/user/command-line grid, live expiry countdown); redesigned PAM web console (#2588).
• M365 typed Graph read tools — 12-action Zod-typed read catalog on the customer-graph-read connection, exposed as six m365_query_* tools in in-app chat and the Breeze MCP; read-only, T1, no manifest bump, no DB migrations (#2615).
• Partner reconstruction integration API — partner service principals, scoped API keys with rotation + rate limiting, a 13-resource reconstruction API with stable cursor pagination and incremental material watermarks, and bounded export auditing (#2506).

Improved

• Org context switcher (round three) — pill removed; "All organizations" is a pinned, distinct fleet row with type-ahead search; a two-layer model separates your context from each route's scope contract so neither misrepresents the other (#2595).
• Backup reliability & controls — API ingests backup_progress (bytes/files/last_progress_at); a reaper fails stalled/orphaned/over-cap jobs; an undeliverable-result outbox flushes on reconnect so a dropped terminal result never strands a job as "running" (#2599).

Fixed

• PAM consent shown in the requester's session — consent UI, approval, denial, and dismissal now route through the helper in the exact interactive session that requested elevation, attributed to the recent trusted consent.exe; invalid sessions fail closed to the documented physical-console fallback (#2591).
• Persistent-login failure over plain HTTP — the refresh cookie's Secure flag is now derived from the real transport (X-Forwarded-Proto → request URL) instead of NODE_ENV, so an HTTP-reachable deployment stops silently discarding the refresh cookie and 401-ing every reload (#2612, #1618).
• Software-report FK violation (23503) — the device_vulnerabilities → software_inventory FK is now ON DELETE SET NULL (added NOT VALID, validated separately to avoid an exclusive lock); vuln findings re-link to the replacement inventory row after a wipe-and-reinsert (#2613).
• Patch all-orgs approval status persists on reload (#2597).

Security

• PAM remote-session privacy fixes — elevation attribution and consent rendering are pinned to the requester session and fail closed on partial process enumeration, closing cross-session exposure paths (#2588, #2591).
• DB-level tenant & reference integrity for the partner reconstruction paths — configuration, backup, OneDrive, assignment, and custom-value ownership are enforced by database triggers/constraints, not app-layer checks alone (#2506).
• Self-hosters are encouraged to upgrade.

Self-Hosting / Upgrade Notes

No breaking changes to existing behavior — but there is one new required environment variable (below) that will block boot in production if unset.

1. Upgrade command. Bump BREEZE_VERSION=0.97.1, then docker compose pull api web && docker compose up -d (add pnpm install if you build from source).

2. Database — 33 idempotent migrations auto-apply on boot via autoMigrate (unless AUTO_MIGRATE=false). They create the contracts, partner-service-principal, and partner-export/config-policy integrity machinery. No large-table rewrite or blocking backfill — the device_vulnerabilities FK is validated with a low-lock VALIDATE CONSTRAINT (SHARE UPDATE EXCLUSIVE), the big backfill UPDATE is intentionally avoided in favor of ON DELETE SET NULL, and new indexes are on new/empty tables (the two composite uniques on devices/sites are PK-covered and fast). A backup_jobs timestamp column is converted to timestamptz (small table).

3. New required environment variable — PARTNER_API_CURSOR_SIGNING_KEY. In production the config validator now refuses to boot without it. It must decode from canonical base64 to ≥32 bytes of random key material and must not reuse JWT_SECRET. Generate one with openssl rand -base64 48. As with any required var, add it to .env and map it in the api service environment: block of your compose — a value in .env alone is not enough. (No other new required vars. AUTH_COOKIE_FORCE_SECURE / AUTH_COOKIE_SAME_SITE are optional overrides for the cookie-transport fix and default to auto-detected behavior.)

4. Behavior changes & feature flags. The refresh-cookie Secure flag now follows the real request transport rather than NODE_ENV — correct for HTTPS deployments, and it fixes (rather than changes) behavior for HTTP-reachable ones. No feature flags flipped default.

What's Changed

• fix(migrations): non-superuser custom-GUC elevation by @ToddHebebrand in #2622

Full Changelog: v0.96.0...v0.97.1