OpenFrame v0.8.14 - PSA, Knowledge Management & Device Tagging

Launch of the full Professional Services Automation platform powered by the Mingo (technician-facing) and Fae (client-facing) AI assistants. Delivers intelligent ticket triage, automated workflow orchestration, AI-driven auto-resolution for common IT requests, transparent escalation for complex issues, and a column-based ticket board view. Includes data migration backfilling tickets from existing dialogs and full automation test coverage for ticket workflows.

Integrated documentation management and knowledge base system within OpenFrame's unified platform. Provides version-controlled documentation repositories, searchable knowledge bases, automated documentation generation from configurations, and collaborative editing capabilities for runbooks, SOPs, and network configuration documentation.

New multi-type tagging system supporting custom, system, and category-based tags (e.g., org_type:school, org_type:bank). Allows tagging devices individually or in bulk for streamlined organization, filtering, and automation. Includes a Device Tag Filter modal with empty-state placeholder, renamed 'Device Tags' label across all relevant pages, and full automation test coverage for tag functionality.

Responsive design overhaul for the dashboard UI targeting mobile devices. Implements responsive design patterns tested across various mobile screen sizes, including a specific fix for the 860px breakpoint.

Implement per-tenant feature flags stored in the database with default fallback values. Supports enabling or disabling specific features for individual tenants without code changes, with a GraphQL API for frontend consumption per environment.

Frontend calendar UI implemented according to the approved design, enabling scheduling and time-based views within the platform.

Users can now archive organizations from the UI. Archiving is blocked if any device remains in active/online status, with a clear validation message listing devices that must be archived or deleted first. Archived organizations are visually distinct in the list.

Users can upload and manage profile pictures stored in GCS. Profile pictures sourced from Google/Office 365 SSO are automatically saved and displayed across the platform including navigation, comments, and team member lists.

New Grafana dashboard providing observability into device log volume, error rates, and device-level log activity for operational monitoring.

Real-time device log streaming with tenant-scoped filtering. Supports MeshCentral log ingestion into the device stream logs pipeline alongside other log sources.

Automatic osquery updates are now supported. Previously treated as a static Fleet asset, osquery can now be updated like regular agents, with version checks surfacing outdated installations.

New mechanism allowing per-tool and per-asset version overrides during agent installations via Cargo feature flags. Supports targeting specific versions of OpenFrame chat, MeshCentral agent, Fleet MDM agent, Tactical RMM agent, and osquery for individual tenants or devices without affecting the default installation flow.

OpenFrame Client service now configures Windows Service Control Manager failure/recovery actions at install time: restart after 10s on first failure, 1 min on second, 5 min on subsequent failures, with a 1-day reset counter. Applies to both crash and clean exit(1) scenarios.

Mechanism to detect and block users with overdue or unpaid subscriptions. Includes access restriction, user notification, admin visibility into blocked users, and edge case handling for grace periods and payment retries.

BIMI (Brand Indicators for Message Identification) enabled for flamingo.cx, allowing the company logo to display next to emails in Gmail, Yahoo, and Apple Mail following trademark receipt.

In OpenFrame mode, Fleet's default behavior of assigning all devices when no filters are set was incorrectly applied. Fixed to ensure the system only operates on explicitly assigned hosts.

After creating a new organization, the list did not update automatically - requiring a manual page refresh to see the new entry. The list now refreshes automatically on creation and deletion.

The chat widget was overlapping the bottom rows of the device selection list when setting up monitoring scripts, making it impossible to select devices at the bottom. Fixed z-index and layout to ensure all devices remain selectable.

Every message sent through Fae (L1 AI agent) was rendering twice in the UI. Root cause investigated and duplicate message rendering eliminated.

Four Tactical RMM agents were generating ~14 req/s combined (~5,041 WebSocket attempts in 6 minutes) with zero backoff, flooding the gateway and causing rate-limiting. Fixed with proper exponential backoff.

Initial key sync was triggered on startup before the tenant ID was available in the database, causing failures. Sync is now triggered by the tenant registration event instead.

When authentication tokens expired, active topic subscriptions were not re-established after token renewal, causing missed messages and broken real-time updates. Subscriptions now automatically resubscribe after token refresh.

User profile was being fetched on every route change instead of being loaded once and cached, causing unnecessary API calls and UI flickering. Profile is now loaded once on app init and cached in state.

Orphaned ZooKeeper metadata from a previous partial table creation was blocking the management pod from creating REALTIME tables for 13 tenants on every restart (409 Conflict). Stale metadata cleared and table creation unblocked.

Device count on the dashboard pulled from Pinot did not match the real device count due to Kafka ingestion lag, missing upsert handling, or stale segments. Investigated and corrected Pinot REALTIME table sync.

After initially selecting a display in MeshCentral remote sessions, switching to a different monitor was not working. Fixed display switching behavior for multi-monitor setups.

Keyboard and mouse inputs stopped working entirely when a single screen was selected during remote control sessions. Input handling corrected for single-screen mode.

Users could not paste clipboard content from their local machine into a remote Windows machine during remote control sessions. Clipboard sharing now works correctly without requiring the toggle workaround.

Keyboard and mouse input was not being registered on certain machines (notably Windows Server) during remote control sessions. Input handling fixed for affected configurations.

MeshCentral integration and online/offline status were not functioning correctly when running the OpenFrame client on Windows Terminal Server. Root cause investigated and resolved.

NATS WebSocket reconnection on token refresh or network drop was losing streaming chunks mid-response, leaving chat stuck in typing state or losing approval request chunks. Chat chunk processor refactored to handle reconnection gracefully.

The chat input field lost focus while Mingo was generating a response, requiring users to manually click the field before typing. Auto-focus is now maintained throughout the response cycle.

Fae client chat showed 1 pending approval while the Technician chat showed 2 for the same ticket after pressing Back and returning. Approval state is now consistent across both views.

Pending approval UI remained visible and interactive when switching to direct mode, allowing approval/rejection of actions that should no longer be pending. Switching to direct mode now immediately hides and cancels pending approvals.

Post-ticket-creation redirect used router.push, polluting browser history so the back button returned to the create form. All ticket creation flows now use router.replace.

Command titles in chat tool/command blocks were changing when the block was expanded. Title now remains stable on expand, and code inside tool blocks now renders with proper formatting.

The 'Hide Menu' element in the navigation bar had incorrect text animation when expanding. Behavior and animation now aligned with other navigation elements.

The 'Back to' button was navigating to the logical parent page rather than the previously visited page. Now correctly references and navigates to the actual previous page in the user's navigation history.

Corrected shared Kafka retention configuration to prevent unbounded topic growth and ensure proper message expiry.

Log rotation was not functioning correctly. Fixed to ensure logs are properly rotated and do not grow unbounded.

Concurrent updates to OpenFrame client config and integrated tools config could cause race conditions during version publishing. Fixed to protect against concurrent updates while retaining NATS downtime retry logic.

Token budget was not resolving correctly after a page reload, causing inconsistent AI context behavior. Fixed to correctly restore token budget state on reload.

Archiving a ticket/entity was incorrectly transitioning status to Active instead of Resolved. Status transition logic corrected.

Fleet installation was failing due to a timeout during the download phase. Deployment configuration updated to resolve the timeout.

Tactical RMM going offline on Windows was triggering crashes and memory corruption, likely related to self-exec behavior or EDR conflicts. Investigated and resolved.

From the Tickets view, users could attempt remote connect to offline devices (which would fail), while the Devices view correctly disabled the action. Remote action buttons now behave consistently - offline devices have remote actions disabled in both views.

Active Chats and Resolved Chats links were not filtered correctly; metric cards (Avg Solve Time, Avg FAE Rate) were incorrectly navigable; organization name cards and device blocks were not linking to the correct filtered pages. All dashboard redirections corrected.

Frontend adoption of Relay required full Relay Server Specification compliance. Added Node interface with global IDs, base64-encoded entity IDs, Relay Connection spec with PageInfo/hasPreviousPage/startCursor, and a root node query with type-routing datafetcher.

Removed the separate Uninstall button - only 'Delete' remains. Clicking Delete now shows a confirmation modal containing the agent uninstall command to run on the endpoint before removal, aligned with the updated design system.

Chat memory system refactored from message-count-based to token-count-based context management for both Mingo and Fae. Enables smarter, more accurate context retention and supports per-model configurable context sizes. Deprecated message-based memory code removed.

Context compaction now runs asynchronously at the HTTP request level - requests return immediately while compaction runs in the background. The AI chain still executes strictly after compaction completes, preserving correctness while eliminating blocking latency.

Token usage is now returned separately for each chat type (Mingo and Fae) in API responses and displayed on the Admin Dashboard with human-readable model names (e.g., 'Claude Sonnet 4.6' instead of raw identifiers).

Users can now interrupt and cancel ongoing AI responses for both Mingo and Fae. The stop button is automatically disabled during context compaction to prevent context corruption.

Debezium health check job enhanced with automatic recovery and connector recreation logic in case of connector failures, improving CDC pipeline resilience.

Pinot data storage migrated from per-tenant tables (2 tables per tenant, growing linearly) to 2 shared multi-tenant tables for all tenants, with tenantId field for query filtering. Dramatically simplifies infrastructure and improves resource utilization.

Redis migrated to Cluster mode for high availability, scalability, and data partitioning. Helm charts, application connection configs, and all services updated to use cluster-aware Redis clients. Redis unified and standardized across Fleet, Tactical, and Authentic services, with Tactical Redis upgraded to 7.4.2.

Audited all microservices to eliminate duplicate MongoClients caused by pulling both sync and reactive MongoDB starters. Each service now depends only on the stack it actually uses, reducing unnecessary connections.

Mongock provides a Flyway/Liquibase-style versioned, auditable migration framework for MongoDB in the Management Service, replacing error-prone manual or ad-hoc migration scripts.

Tactical RMM frontend and Docker images migrated to OpenFrame's forked versions, providing full control over UI customization, patches, and release cycle.

Nginx routing previously used by Tactical RMM consolidated into the tenant gateway, reducing infrastructure complexity and simplifying routing management.

Configured Fleet's built-in result rotation/retention settings and enforced minimum query execution intervals to prevent database bloat and performance degradation from excessive query/policy result accumulation.

DNS caching disabled across all agents to prevent connection failures from stale DNS records. Each request now performs a fresh DNS lookup, improving NATS connection reliability.

Version check functionality added for both OSquery and the OpenFrame client to surface outdated installations. Gracefully skips the check if the OpenFrame client is absent on a machine.

Policies now show a 'Deploying' status indicator when the Fleet agent has not yet completed registration on a device, preventing confusion when policies are assigned but not yet active.

Timestamps added to MeshAgent logs to improve observability and enable time-based root cause analysis for intermittent Mesh connection drops.

The OpenFrame Client version is now captured and displayed in the Agents tab immediately after installation, not only after a self-update. The --version parameter is passed during install command generation and stored during machine registration.

Added a 'Deploying' status indicator on policies when the Fleet agent has not yet registered on the device, giving technicians clear visibility into policy deployment state.

Cluster autoscaling configuration tuned to improve resource utilization and reduce unnecessary node provisioning.

Shared cluster primary ranges expanded from /24 to /20 and pod ranges from /20 to /19 (with further expansion to /17 planned for tenant-per-namespace migration) to address 50% subnet consumption.

Dependency versions locked and Dockerfile updated to build the frontend with pre-resolved dependencies, improving build reproducibility and reducing build times.

Added server-side centralized configuration for the frontend, enabling environment-specific settings without frontend redeployment.

CORS settings configured on GCS tenant buckets for both staging and production environments to allow proper cross-origin access from the frontend.

Centralized database backup bucket established for consolidated, manageable backup storage across services.

GitHub CODEOWNERS file configured to enforce required code review for changes to /manifests and /configs directories, ensuring infrastructure and configuration changes are reviewed by appropriate team members.

API keys for Vercel integration updated to maintain deployment pipeline continuity.

Fae desktop app icon replaced with the OpenFrame icon. System tray icon now persists when the user closes the app window, since the agent continues running in the background.

Added a clear 'Back' button to the Fae chat interface allowing users to intuitively return to the home screen.

Emoji output disabled for both Fae and Mingo AI assistants for a more professional communication style.

A loading indicator is now displayed while AI responses are streaming, providing clear visual feedback that the assistant is actively generating a response.

Chat chunks processor refactored for improved code quality, maintainability, and performance, including better handling of NATS reconnection scenarios.

Organization Details page simplified and restructured with tabs: Devices, Tickets, Logs, and Organization Details. Create and Edit Organization forms updated to match the redesigned layout.

All references to 'Organization' replaced with 'Customer' across frontend labels, headings, tooltips, navigation, API endpoints, models, and DTOs for clearer MSP-oriented terminology.

Tables and action buttons across the platform updated to support opening records in a new tab via a primary icon button (right-up arrow), while clicking the row cell opens in the same tab.

All date displays audited and updated to use a consistent mm/dd/yy format across billing, device details, monitoring queries, and other locations.

Comprehensive UI polish pass: button paddings standardized (16px L/R desktop, 12px mobile; 48×48px icon-only desktop), chevron buttons added to all drill-down table rows, fade gradient added to tab selectors, tooltip alignment corrected, and toast notifications added for user feedback on actions.

Removed incorrect paddings from table card block components. All header cells are now fully clickable for sorting and filtering. OS icons standardized to 24×24px on desktop and tablet.

Spacing, fonts, and stroke in the 'Add Users' modal corrected to match the design system.

Organization images on the Organizations page now correctly render at the specified 80×80px dimensions.

Incorrect paddings inside disk info blocks on the Device Details page corrected, with spacing between blocks and section titles verified against design.

Button component fully refactored: vertical padding set to 16px (12px mobile), icon-only buttons made square at 48×48px (44×44px mobile), and disabled button icons now use soft-grey (#3A3A3A).

Remote Control button moved to the more prominent position (previously occupied by Run Script) since it is the more frequently used action.

Remote connect and other MeshCentral action buttons now behave consistently between Tickets and Devices views - offline devices have remote actions disabled regardless of entry point.

Regression tests added covering all Pinot-related GraphQL calls for devices, validating that data returned from Pinot matches MongoDB source of truth for counts and key data points.

Comprehensive automation test coverage added across: device add/read/uninstall (VM), script search/run/bulk/env vars/arguments, policies, scheduled scripts, remote control, remote shell, file manager, device tags (CRUD, assign/unassign, filter), and ticket workflows. Browser added to test container for Playwright/Selenium support.

Per-tenant data migration backfills the tickets collection from existing dialogs on every tenant DB of the shared MongoDB cluster. Idempotent - re-runs are safe via duplicate-key blocking.

Active device counts per tenant are now correctly synchronized with the shared cluster, ensuring accurate billing and dashboard metrics.

AI token consumption is now calculated and tracked per tenant, supporting usage-based billing and quota enforcement.

Discount management capabilities integrated through HubSpot, enabling sales and operations teams to manage customer discounts from within the CRM.

The scripting feature was broken or incomplete. Full end-to-end functionality restored covering execution, error handling, and all missing pieces for reliable operation in practice.

Updated the 'Filter Tags' button label to 'Device Tags' across all relevant pages including organization device lists, devices list, archived devices, script modals, monitoring, and more.

New Kanban-style column-based board view for tickets, enabling visual workflow management across ticket status columns.

Investigated the significant increase in old MeshCentral agents (34 → 120) following the last release. Root cause identified across auto-update triggering, new agent installs with outdated versions, and legacy agent upgrade paths.