Release v0.108.0
Aug 26, 2026
Four programs that were built in waves all land together: AI agents that triage alerts and propose actions for your approval, your own LLM provider key so AI usage bills to you instead of platform credits, currency handling that finally reaches the catalog and tickets, and quote revisions that supersede a sent quote without leaving the customer on a stale link. Plus a redesigned customer portal, secret variables in scripts, and a security fix for anyone who has tried to turn on single sign-on with MFA.
AI & Automation
- AI agents arrive. An agent is a named, permission-scoped worker you configure once — today it triages alerts: it wakes on an alert, reads the device and its history, and writes up what it thinks is happening. Every agent keeps a runs ledger, so you can open any run and see exactly what it looked at and what it concluded.
- Agents never act behind your back. When an agent wants to do something it proposes the action and waits — you get an in-app notification and a new Approvals inbox where you approve or reject it. Nothing an agent proposes executes without a person deciding.
- Agent activity is attributed to the agent, not to you. Actions taken by an agent show up in the audit trail as the agent itself, so an agent's work is never mistaken for a technician's.
- The whole feature is off unless you turn it on, and it is gated behind its own permission — no existing role gains access to agents just by upgrading.
- Bring your own AI provider key, per partner. Point Breeze at your own model provider account from the new AI Provider settings tab and your AI usage is billed to that account instead of drawing down platform credits. A usage indicator shows which is being used.
Billing & Multi-Currency
- Your product catalog now holds real price books. A catalog item can carry a price per currency and a cost in the currency you actually pay it in, instead of one dollar figure stretched across every customer.
- Tickets are currency-aware. Parts and labour rates on a ticket are stamped with the currency at the time they're recorded, so a ticket billed months later still totals in the currency it was worked in.
- Pick a currency per customer organization, with a release gate and an escape hatch for organizations that already have active contracts — changing currency under a live contract requires an owner to approve it rather than happening silently.
- Reporting-only exchange rates let dashboards segment revenue across currencies without ever converting the documents themselves. Your invoices stay in the currency they were issued in; only the roll-up view converts.
- Invoices and quotes issued before this release keep the language they were actually sent in, rather than silently re-rendering in whatever your partner language is set to today.
Quotes & Proposals
- Revise a quote you have already sent. A revision starts from the existing quote, keeps the lineage, and marks the old one superseded — the customer sees a banner pointing at the current version instead of a dead end.
- Sending a revision retires the previous version's public link everywhere at once. An old link no longer opens the stale quote through any route, so a customer who kept the first email can't accept a price you have replaced.
- The customer portal shows replaced quotes for what they are, with a path to the version that superseded them.
Customer Portal
- The Guest Ledger — the customer-facing portal has been redesigned around what customers actually come there to do: see what they owe, what they've paid, and what's outstanding, without hunting for it.
Devices & Agent
- Device 'Decommission' is now called 'Remove', and the action only appears where it will actually work. Previously several screens offered it in situations the server would reject, so you'd click it and get an error.
- Removing a device from the list or grid now asks for confirmation first, like it always did from the device page.
- Network assets — switches, printers, anything discovered rather than agent-managed — no longer show agent actions on their cards that could never have run.
- Fixed the Windows agent failing to delete deeply nested folders, which could leave software-removal and cleanup scripts reporting success with files still on disk.
- Fixed remote desktop occasionally starting into a frozen first frame on Windows by forcing a desktop repaint before the session's startup check.
- Fixed macOS agents reporting a screen-capture failure as a permissions problem when it wasn't — a capture timeout or an unplugged display no longer sends you to check Screen Recording settings for nothing.
Alerts & Notifications
- Acknowledged and resolved alerts show the person's name instead of an internal user id.
- A notification channel test now tells you why it failed and keeps that reason on the channel, instead of a bare red icon you have to guess at.
- Testing an alert rule reports the real evaluation result, on the rule you are actually editing — previously the verdict could reflect the saved rule rather than your unsaved changes.
- Mobile: swipe or multi-select to acknowledge alerts instead of opening each one.
Scripts & Platform
- Scripts can take secret tenant variables. A `tenantSecret` parameter pulls its value from your tenant's stored secrets at run time, so credentials stay out of script bodies and out of run history.
- Empty lists now say whether there is genuinely nothing there or your search simply matched nothing — the two used to look identical.
- Agent error messages survive the trip back to you. Long-running agent actions that failed behind a gateway timeout used to surface a generic proxy error page instead of what the agent actually said.
- Fixed several places where a database error surfaced as a blank failure instead of the real message, including on the Organizations page.
- Fixed a delete button on the Automations tab that was nested inside the row expander, so clicking it also toggled the row.
- Fixed text in non-English locales losing spaces between labels and their values, and angle brackets or ampersands rendering as raw HTML entities.
- Background work no longer stacks up on the hour. Scheduled jobs that all fired at exactly midnight UTC are now staggered, and the hourly risk-score refresh no longer holds a database connection for two minutes while it runs.
- Fixed a database deadlock between vulnerability correlation and agent software inventory arriving at the same time.
Security
- Single sign-on accounts can finally enroll multi-factor authentication. A passwordless SSO user previously had no way to register a first MFA factor at all, which meant any action requiring MFA was permanently out of reach for them — including for administrators trying to enforce MFA org-wide. Enrollment now works through a single-use re-authentication with your identity provider, scoped to that enrollment only.
- Fixed notification channel credentials being readable in a test-failure message. The failure reason is now redacted before it is composed rather than afterwards, which is the only order that reliably works.
- Fixed a race where cancelling a device offboarding could still queue agent uninstall commands against the rescued customer. The repair now re-checks its own precondition under a lock before acting.
- A throttled session refresh is treated as 'wait and retry' rather than 'you are signed out', so a burst of activity no longer logs you out.
- Partner-wide write protection extended across the service layer, with distributor credential routes brought under the same gate.
- Customer organization short names are now enforced unique per partner in the database itself, not just in the application.
Self-Hosting
- 26 database migrations apply automatically on first boot of the new version. There are no large-table rewrites and only one small backfill, but this is the largest migration set shipped in a single Breeze release — take a snapshot before you upgrade.
- No new required environment variables. One new optional flag, `BREEZE_AI_AGENTS_ENABLED`, defaults to off — leave it unset and nothing in the AI agent feature set runs.
- Remember to include `portal` in your pull and up commands; it is a separate container from `api` and `web`.
- A new check refuses any migration that would sort ahead of one already committed, catching a class of upgrade ordering bug before it reaches your database.
Four things that have been landing in pieces all arrive finished in this release. The headline is AI agents. An agent is a named worker you configure once and scope with its own permission; today it triages alerts — it wakes when one fires, reads the device and its history, and writes up what it thinks is going on. The part that matters is what it does next: nothing. When an agent wants to take an action it proposes it and waits, and you approve or reject it from a new Approvals inbox. Every run is recorded in a ledger you can open, and anything an agent does is attributed to the agent in the audit trail rather than to whoever happened to be logged in. It is off unless you turn it on, and upgrading grants nobody access to it.
Alongside that, you can now point Breeze at your own AI provider account. Set a provider key per partner from the new AI Provider settings tab and that usage bills to your account instead of drawing down platform credits — useful if you already have a negotiated rate, or simply want the spend in one place. Currency handling also grew up: your catalog holds real price books with per-currency prices and costs recorded in the currency you actually pay, tickets stamp their parts and labour rates at the time they’re recorded, each customer organization can be set to its own currency, and dashboards can segment across currencies using reporting-only exchange rates that never touch the documents themselves. Quotes gained revisions — revise one you’ve already sent, and the previous version is superseded and its public link retired everywhere at once, so a customer holding the first email can’t accept a price you’ve replaced.
One security fix is worth reading even if you skip the rest. Passwordless single sign-on accounts had no way to enroll a first multi-factor factor — not a hard path, no path — which meant every MFA-gated action was permanently unreachable for those users, including for administrators trying to enforce MFA across an organization. That now works through a single-use re-authentication with your identity provider, scoped to enrollment only. Also fixed: notification channel credentials could surface in a test-failure message, and cancelling a device offboarding could still queue agent uninstalls against the customer you had just rescued.
Self-hosters: this release carries 26 database migrations, which apply automatically on first boot. There are no large-table rewrites and only one small backfill, but it is the biggest migration set we have shipped at once — take a snapshot first. There are no new required environment variables; the one new flag, BREEZE_AI_AGENTS_ENABLED, defaults to off, so AI agents stay dormant until you decide otherwise. And remember portal is its own container — include it in your pull and up commands alongside api and web.