Releases from July 24–31, 2026 — covering iblai-prod-images 1.109.0 through 1.119.0 and the iblai-web-frontend packages.
| service | image / pin | version span |
|---|---|---|
| dm | iblai-dm-pro | 4.316.1-ai → 4.324.0-ai |
| os | iblai-os-spa | 0.102.2 → 0.108.9 |
| lms | iblai-lms-spa | 0.51.0 → 0.54.3 |
| edx | iblai-edx-pro | sumac.2.42.0 → sumac.2.45.0 |
| auth | iblai-auth-spa | 1.19.0 → 2.1.1 |
| cli | ibl-cli | 5.52.0 → 5.53.1 |
| course | iblai-course-spa | 1.0.24 → 1.0.26 |
| hq | iblai-hq-spa | 2.1.26 → 2.1.28 |
| video | iblai-video-spa | 1.0.18 → 1.0.25 |
| web-utils | @iblai/web-utils | 1.13.5 → 2.1.6 |
| web-containers | @iblai/web-containers | 1.15.5 → 1.15.8 |
| iblai-js | @iblai/iblai-js | 1.26.6 → 2.2.7 |
| agent-ai | @iblai/agent-ai | 2.7.0 → 2.8.0 |
| data-layer | @iblai/data-layer | 1.9.6 → 1.11.1 |
| mcp | @iblai/mcp | 1.8.2 → 1.8.4 |
iblai-dm-pro (4.316.1-ai → 4.324.0-ai)
Global configuration uniqueness. A partial unique constraint (unique_global_config_key) now enforces one global row per configuration key where platform IS NULL, with a data migration that de-duplicates existing rows before applying the constraint.
Session title generation with structured model responses. generate_session_title now handles models (e.g. Anthropic/Claude) that return AIMessage.content as a list of content blocks, flattening via the extract_text helper before processing.
Topic generation model flexibility. get_proposed_topic_from_llm adapts to models that reject explicit temperature values (reasoning models, certain Azure deployments) by catching the BadRequestError, resetting to the default temperature, and retrying. Topic generation also uses the mentor's own Anthropic model when the provider is anthropic, removing the previous requirement for an OpenAI key on Anthropic-backed platforms.
Documents list performance. The documents list endpoint (documents/pathways/{pathway}/) now batches MediaFilePermission lookups into a single query and bulk_update, replacing per-document queries for S3-backed documents.
Health-check mentor Langfuse opt-in is async-safe. The ENABLE_LANGFUSE_FOR_FAKE_MENTORS flag is read via sync_to_async at all async call sites, sourced purely from dynamic config (defaults False), and short-circuits on mentor.unique_id before any DB access.
Webcrawler periodic retraining. URL-based documents (webcrawler and other URL sources) now correctly trigger periodic retraining on their configured retrain_interval_days. The periodic task logs candidate counts and each document scheduled for retraining.
Usage reconciliation and checkpointing. The cumulative cost rollup reads correctly against the current ClickHouse view structure. A new seed_usage_checkpoints management command sets CreditAccount.usage_checkpoint_usd to recorded usage before a cutoff date (default 2026-07-23), ensuring billing covers only post-cutoff usage. Options: --apply writes checkpoints and records a zero-amount checkpoint_backfill transaction per account; --reconcile settles post-cutoff usage immediately; --username / --platform scope a targeted run. Checkpoints are only raised, never lowered.
OpenClaw worker cost attribution. Worker-side usage is now persisted and emitted to Langfuse for billing. Single-tenant hosts bill all worker cost to that platform via ClawInstance.bill_all_usage (default on, superuser-only); shared hosts leave cost unattributed. Reconciliation no longer opens a WebSocket to each managed worker, so an unreachable worker cannot delay or fail it. Kill switches: CLAW_USAGE_INGEST_ENABLED and CLAW_USAGE_LANGFUSE_EMIT_ENABLED.
Deployment
- Run migrations. Migration
0339_claw_usage_persistencemust complete before the new image goes live — it addsbill_all_usagetoibl_ai_mentor_clawinstance, which is read on request paths. Setslock_timeout = 5s; retry the deploy if it aborts under contention. - Rolling deploy is safe once
0339has run: a node on the previous image can still create workers because the column has a database-level default. - Register the fake-LLM model for health-check cost tracking:
python manage.py register_langfuse_health_model - Usage ingest and Langfuse emission stay inert until periodic tasks are created (separate operator step).
iblai-os-spa (0.102.2 → 0.108.9)
Projects list pagination. The projects sidebar now supports infinite-scroll pagination.
Navbar routing. "New Chat" correctly routes home when off a chat route, and the analytics page is no longer treated as a prompt-gallery route.
Agent settings from SDK. The in-repo agent settings tab is replaced by the SDK's AgentSettingsTab component, sourced from @iblai/iblai-js.
Grading in embedded mode. The iframe integration handles MENTOR:ENABLE_GRADING messages from the parent frame and reads DOCUMENTFILTER, EDX, and ENABLE_GRADING payloads from event.data. EDX metadata is dispatched via chatActions.setMetadata.
Desktop app stability. Tauri event emits are marshaled to the main thread, resolving an IPC deadlock in the desktop app.
Welcome message layout. Long embed welcome messages scroll correctly, and the default welcome message width matches the chat input.
Header logo fallback. The ibl.ai logo is used as the default header when no custom logo is configured.
Content Security Policy. CSP is now enforced by default (report-only in dev), with *.iblai.org and *.iblai.tech whitelisted. The enforcement decision is decoupled from NODE_ENV.
RBAC permissions. Mentor access RBAC permissions are corrected.
iblai-lms-spa (0.51.0 → 0.54.3)
Content Security Policy. Nonce-based CSP middleware is now active via @iblai/iblai-js/security, with *.iblai.org / *.iblai.tech whitelisted and enforcement on by default.
iblai-edx-pro (sumac.2.42.0 → sumac.2.45.0)
Grading-enabled field and API field renames. A gradingenabled field is added, and course_id / block_id fields are renamed. This is a breaking change (PR #175).
iblai-auth-spa (1.19.0 → 2.1.1)
Major version bump to v2. The auth SPA moves to the v2 SDK release line. The env.js script is nonced for strict-dynamic CSP compliance.
ibl-cli (5.52.0 → 5.53.1)
SPA network binding. The vibe, courseai, videoai, and hq SPAs now bind to all interfaces (HOSTNAME: "0.0.0.0"). Each runs the Next.js standalone server and attaches to both ibl_local_default and internal-network; without the override, the server bound whichever single IP Docker's auto-set HOSTNAME resolved, which could leave the SPA port unreachable on the host. mentor and os already carried this fix.
iblai-course-spa (1.0.24 → 1.0.26), iblai-hq-spa (2.1.26 → 2.1.28), iblai-video-spa (1.0.18 → 1.0.25)
CSP middleware. All three SPAs now include nonce-based Content Security Policy middleware.
@iblai/web-utils (1.13.5 → 2.1.6)
Content Security Policy (breaking — v2.0). CSP is now enforced by default in production (report-only in dev). Nonce-based, using @iblai/iblai-js/security. Allowlisted domains: *.iblai.org, *.iblai.tech. Enforcement is decoupled from NODE_ENV.
Todo list extraction from chat. write_todos tool calls are now recovered from chat history. tool_call.end frames are captured, and tool calls are upserted by ID instead of appended. Named chat socket frame types.
Field-level RBAC write filtering. New helpers for field-level RBAC write filtering.
edX JWT forwarding. Preserved token forwarded as edx_jwt_token on native redirect.
Tenant-switch race fix. Loader-hang race closed in performAuthCheck during tenant switches, with mid-check deferral coverage.
@iblai/web-containers (1.15.5 → 1.15.8)
Application feature v1. New "Apply" UI with translations, completing the application feature across web-containers.
Human support tab. New tab for human support in the agent interface.
Agent settings convergence. Settings tab split into per-sub-tab components, converged onto OS mentor settings layout, with i18n alignment to the mentor monolith.
Datasets tab enhancements. Info box, RBAC gate, controlled props, theming, and controlled page/search in useDatasetsWithPagination. Training toggle uses CustomSwitch. RBAC role and policy save buttons disable while saving.
@iblai/iblai-js (1.26.6 → 2.2.7)
Major version bump to v2. Tracks the web-utils v2 CSP enforcement release line. Auth SPA nonces the env.js script for strict-dynamic CSP.
ACP integration. Complete ACP integration in the auth package.
Microsoft auth icon. Microsoft icon added for microsoft/azure SSO providers.
@iblai/agent-ai (2.7.0 → 2.8.0)
edX JWT via request-jwt. Fetches edX JWT via request-jwt with refresh-div fallback. edX grading context gated behind enablegrading flag.
@iblai/data-layer (1.9.6 → 1.11.1)
Studio course creation. New endpoints integration for studio course creation.
@iblai/mcp (1.8.2 → 1.8.4)
Tracks upstream web-containers and data-layer releases. No standalone feature changes.