---
title: "Platform Update — October 16, 2026"
slug: "platform-update-2026-10-16"
date: "2026-10-16"
tag: "Application"
summary: "Eleven services and packages moved in a week, led by agent selection and full-screen mode inside embedded agents, alongside cross-page PDF chunking with page-range citations, incremental chat-session sync, a unified SDK chat in the OS, a default-organization picker, and `ibl backups cleanup`."
author: "ibl.ai Engineering"
linkedin: |
  Your embedded AI agent no longer has to be one agent in a small box: end users can now browse and switch agents, and expand the embed to full screen, without ever leaving the iframe.

  It is one of eleven services and packages we shipped this week. Two new switches on the Embed tab — Allow Agent Selection and Allow Full Screen — generate the matching attributes in your embed code. The embed also gains a redesigned header with a dedicated New Chat button, downloads from inside the iframe, and long-running sessions that stay signed in without a page reload.

  Retrieval and data got sharper:

  → PDFs are now chunked across page boundaries, so a heading at the foot of one page stays with its body on the next — and citations carry page ranges like (Page: 33-34)
  → A new chat-sessions endpoint lists conversations by last activity for incremental sync, and resumed chats return only the new turns
  → Google voices for text-to-speech route through the ibl.ai gateway for tenants without their own Google key

  Also shipped this week:

  → A unified SDK chat in the OS, plus admin-configurable welcome headings and starter prompts
  → Code-mode sessions described step by step in plain words, for non-technical users
  → A default-organization picker on the profile page
  → `ibl backups cleanup`, which prunes old backups without running a new one, plus logrotate for backup logs
  → Richer nginx access logs that show whether a request body arrived in full
  → Tree-shakeable SDK builds that trim first-load JavaScript off non-chat routes

  Seventy-two releases across eleven services and packages in seven days. When you run the platform yourself, that velocity arrives on your own maintenance window — nobody else decides when you upgrade.

  With ibl.ai you own all the code and the data — self-hosted inside your own perimeter, model-agnostic across any LLM, with no per-seat pricing, deployable anywhere from your own cloud to a fully air-gapped network.

  #iblai #AgenticAI #EnterpriseAI #AIAgents #SelfHosted #RAG
---

Weekly platform digest covering releases from `iblai/iblai-prod-images` (1.297.0 – 1.315.0) and `iblai/iblai-web-frontend` (53 releases), published between 2026-10-09 and 2026-10-16.

| Service | Image / Pin | Version Span |
|---|---|---|
| dm | `iblai-dm-pro` | `4.421.0-ai` → `4.426.1-ai` |
| os | `iblai-os-spa` | `0.163.1` → `0.171.3` |
| lms | `iblai-lms-spa` | `0.91.0` → `0.95.0` |
| cli | `ibl-cli` | `7.28.0` → `7.30.0` |
| auth | `iblai-auth-spa` | `2.7.0` → `2.8.1` |
| agent-ai | `@iblai/agent-ai` | `2.11.2` → `2.13.1` |
| web-containers | `@iblai/web-containers` | `1.38.1` → `1.44.3` |
| data-layer | `@iblai/data-layer` | `1.29.2` → `1.30.3` |
| mcp | `@iblai/mcp` | `1.28.1` → `1.31.0` |
| web-utils | `@iblai/web-utils` | `2.6.1` → `2.9.4` |
| iblai-js | `@iblai/iblai-js` | `2.33.3` → `2.40.6` |

## iblai-dm-pro (`4.421.0-ai` → `4.426.1-ai`)

**Analytics rate limiting** (4.422.0). Per-user, per-platform throttling on 126 analytics views: `ANALYTICS_READ_THROTTLE_RATE` (default `300/min`) for datastore, analytics API, mentor analytics, and credential analytics, and `ANALYTICS_EXTERNAL_THROTTLE_RATE` (default `60/min`) for analytics that call an external service (Langfuse traces/observations, LLM usage, predictive analytics via an LLM). MCP analytics tool calls share the caller's budget. Server-to-server callers are never throttled; `ENABLE_THROTTLE=false` turns it off. Over the limit returns `429` with `Retry-After`. No migration; env vars are optional.

**MCP analytics LLM usage tool** (4.423.1). The analytics MCP server now correctly registers the `get_llm_usage_analytics` tool at startup.

**Mentor deletion metadata cleanup** (4.423.0). Deleting a mentor (soft-delete) now scrubs the tenant's public metadata references — `overall_default_mentor`, `courseai_default_agent_id`, `vibe_default_agent`, `skills_embedded_mentor_name`, `user_onboarding_form` — that pointed at the deleted mentor, regardless of the various JSON shapes those keys use. The recently-accessed-mentors endpoint filters out soft-deleted mentors.

**Agent memory curator attribution** (4.423.0). Creating an agent memory now correctly attributes the curator (username, email, full name) when the request originates from a student/DM token.

**LLM-access endpoint rename** (4.424.0). `rbac/student-llm-access/{set,status}/` is renamed to `rbac/llm-access/{set,status}/`. Setting a provider or model that is not an active row in the mentor-app catalog now returns 400; the `llms/` wildcard is always allowed, and when the catalog is unpopulated, validation is skipped. **Clients must update** to the new path.

**Google TTS gateway routing** (4.424.1). Google-voice text-to-speech now routes through the iblai gateway for tenants without their own Google key, using Gemini TTS with sentence-chunked MP3 synthesis. Tenants with their own key call Google directly over REST with a 20 s timeout. Provider failures return 400.

**PDF cross-page chunking** (4.426.0). PDFs are now chunked across page boundaries (400-token chunks, 80-token overlap) instead of one chunk per page, so a section heading at the foot of a page stays with its body on the next page. Chunk page numbers are 1-based, and chunks spanning a page break carry `page_end` (shown to the model as `(Page: 33-34)`). Retrain existing PDFs to get the new chunking and correct page citations.

**Chat-sessions incremental sync** (4.426.0). `GET /api/ai-analytics/orgs/<org>/chat-sessions/` lists chat sessions by last activity without message text, for incremental sync. Filters by `mentor_id` (unique_id), `last_message_after`, `include_deleted`, `ordering`, and `start_date`/`end_date`, cursor-paginated. RBAC uses `Ibl.Mentor/ChatHistory/list`. Chat-history endpoints (admin and learner) now accept `session_id` and `messages_after` for resumed chats to return only new turns. Every chat-session response now includes `last_message_at`, `message_count`, and `deleted_at`.
- **Deploy:** migration `ibl_ai_mentor.0391_session_deleted_at` (one nullable column, metadata-only). Retrain affected PDF documents to re-chunk them.

## iblai-os-spa (`0.163.1` → `0.171.3`)

**Embed agent selection** (0.164.0). A new "Allow Agent Selection" toggle on the Embed tab lets the embed host expose an Agents sidebar and the Explore page inside the embed, so end users can switch agents without leaving the iframe. The flag persists through navigation.

**Chrome extension updates** (0.165.0–0.168.1). The Chrome extension (v1.1.3 → v1.1.5) supports mentor selection from the side panel and vendors the current agent-ai UMD for reliable embed routing.

**Desktop app v0.95.25** (0.166.0). The Tauri desktop app now reports Rust-side errors to Sentry.

**SDK chat integration and embed redesign** (0.167.0). The OS agent page and project chat now render the SDK's `SdkChat` component, unifying the chat experience between OS and SDK consumers. The embed header is redesigned with a dedicated "New Chat" button; incognito, help, and support are consolidated under a `?` menu. LTI launches hide the close button. The Welcome Screen settings tab lets admins configure `welcome_heading_style` and `starter_prompts` from the agent settings page. The composer passes labels to the SDK chat, and the product tour starts on the SDK chat composer.

**Embed full screen** (0.168.0). A new `allow-fullscreen` URL flag and Embed tab toggle lets the embed expand to fill the browser window.

**Embed auth resilience** (0.169.1–0.169.3). Embeds now recover from expired authentication tokens in place — a token-update event re-checks auth without a full-page reload, so users see no disruption in long-running embedded sessions.

**Code mode plain-words descriptions** (0.171.0). Every Code-turn step, card, line, and error is now described in plain words, making code-execution sessions more readable for non-technical users. The Code-turn UI is now rendered from the SDK.

**Performance** (0.171.2–0.171.3). The OS adopts tree-shakeable `web-containers` imports and trims first-load JavaScript off error, 404, and non-chat routes.

**Desktop app v0.95.26** (0.171.0). Desktop app release tracking SDK changes.

## iblai-lms-spa (`0.91.0` → `0.95.0`)

**Desktop app v1.0.18** (0.92.0). The Tauri desktop LMS app now reports Rust-side errors to Sentry.

**Autoplay on iframe ready** (0.93.0). The autoplay button now also appears on the iframe `ready` event, improving reliability for content that loads asynchronously.

**Course unit iframe load** (0.94.0). edX course unit iframe loading is improved for faster content display.

## ibl-cli (`7.28.0` → `7.30.0`)

**`ibl backups cleanup`** (7.29.0). `ibl backups cleanup [--all | SERVICES...] [--local/--no-local] [--external/--no-external]` prunes old backups without running a new backup (local only by default). `ibl backups cron install` now also installs logrotate for `app/backups-logs/*.log` (weekly, 4 rotations, compressed); re-run `ibl backups cron install` on existing hosts to add it. Local cleanup now runs even when the upload fails, so repeated upload failures no longer pile up local backups. A failed dump, compress, or encrypt removes the partial file.

**nginx access log format** (7.30.0). The nginx `ibl` access log format now records `rl=$request_length` (bytes received), `cl="$http_content_length"` (declared body size), `proto=$server_protocol`, and `ua="$upstream_addr"`. If `rl` is well below `cl`, the request body did not reach nginx in full. Fields are appended at the end, so `ibl global-proxy allow-report` continues to parse as before.
- **Deploy:** `ibl render` + `ibl global-proxy reload`.

## iblai-auth-spa (`2.7.0` → `2.8.1`)

**Default organization picker** (2.8.0). Users can now pick a default organization on the `/me` profile page.

## @iblai/agent-ai (`2.11.2` → `2.13.1`)

**`allowmentorselection` attribute** (2.12.0). The embed widget accepts `allowmentorselection` to let end users browse and switch agents inside the embed.

**Concurrent auth coalescing** (2.12.1). Concurrent `authExpired` events are coalesced into a single token refresh, preventing redundant auth calls from burst scenarios.

**`allowfullscreen` attribute** (2.13.0). The embed widget accepts `allowfullscreen` to show a full-screen toggle in the embed header; the full-screen box sits flush with the window edge.

**Embed iframe downloads** (2.13.1). Downloads from within the embed iframe sandbox are now permitted.

## @iblai/web-containers (`1.38.1` → `1.44.3`)

**Allow Agent Selection toggle** (1.39.0). The Embed tab exposes an "Allow Agent Selection" toggle and injects the `allow-mentor-selection` parameter into generated embed code.

**Welcome screen settings** (1.40.0). The Welcome Screen settings sub-tab lets admins configure `welcome_heading_style` (agent name vs. personal greeting) and `starter_prompts` (all, guided, suggested, none). The personal greeting resolves the first name from the user's full name. The guided-prompt count is honored and starter-prompts-off correctly disables generation.

**Tenant default agent logic** (1.41.0 via web-utils). Updated logic for resolving the tenant's default agent.

**Memory tabs** (1.41.2). Consistent layout across memory tabs (agent shared memory, session memory).

**Allow Full Screen toggle** (1.42.0). The Embed tab gains an "Allow Full Screen" toggle that generates the `allow-fullscreen` attribute in embed code.

**Code-turn plain-words UI** (1.43.0). Every Code-turn step, card, line, and error is described in plain words, with safe detail exposure, live status cards, and scoped error messages.

**DM media URL resolution** (1.44.0). `AgentSettingsProvider` accepts an optional `dmUrl` prop; a new `resolveDmMediaUrl` helper ensures uploaded dataset documents and project files open from the correct DM host. `/media/` link rewrites apply only on the DM host.

**Tree-shakeable builds** (1.44.1). `web-containers` is now built with `preserveModules` and `sideEffects: false`, enabling per-module ESM tree shaking. Heavy feature libraries are externalized from the barrel.

**LLM retry and cancel UI** (1.44.1). The retry and cancel controls in the chat composer are updated.

**Diagnostic logging** (1.44.2 via data-layer 1.30.2). Welcome errors are logged under a fixed label with masked payloads; chat socket errors include the masked last payload via `maskWsPayload` for safe debugging without leaking tokens.

## @iblai/data-layer (`1.29.2` → `1.30.3`)

**API types for DM 4.422.0** (1.30.0). Typed endpoints for the analytics rate-limiting release.

**DM path handling** (1.30.3). Redundant `/dm` segments in the base URL are removed, and reports base URL paths are preserved correctly.

## @iblai/mcp (`1.28.1` → `1.31.0`)

Rolls up `web-containers`, `data-layer`, and `agent-ai` changes above. Documents `dmUrl` on `AgentSettingsProvider`, project files, and the expanded Chat/Code-turn APIs.

## @iblai/web-utils (`2.6.1` → `2.9.4`)

**Tenant default agent** (2.8.0). Updated logic for the mentor-provider tenant default agent resolution.

**Token-update event auth** (2.9.0). The auth layer re-checks credentials in place on a `token-update` event, supporting seamless embed auth recovery.

**Socket payload masking** (2.9.2). `maskWsPayload` hides tokens in logged WebSocket payloads so diagnostic logs are safe to collect.

**Grading lesson context** (2.9.3). Grading lesson context loading is optimized.

**Performance** (2.9.4). The `enhanceTenants` pipeline drops the user-apps lookup, reducing the per-tenant startup cost.

## @iblai/iblai-js (`2.33.3` → `2.40.6`)

Umbrella SDK package. Rolls up all `agent-ai`, `web-containers`, `data-layer`, `mcp`, `auth`, and `web-utils` changes listed above. From 2.40.0 onwards, `web-containers`' per-module ESM tree is copied for Tailwind CSS scanning.