Upgrade the ibl.ai toolchain in the current project to the latest versions. Two things:
- The
@iblai/iblai-jsSDK in the project'spackage.json - Every ibl.ai skill — both families,
iblai-vibe-*andiblai-api-*, come from this one repo (re-runsnpx skills add iblai/vibe --all)
Installed skills are a copy: they never update themselves. This repo changes often (daily SDK bumps; skills corrected as endpoints and components move), so run this whenever the installed copy is older than the latest release.
Use when asked to "upgrade iblai", "get the latest SDK", "update ibl.ai", or "refresh the skills".
Key commands
| What | Command |
|---|---|
| SDK version | pnpm list @iblai/iblai-js |
| Skills source | npx skills add iblai/vibe --all |
Step 0: How stale is the installed copy?
SKILLS_DIR=$(ls -d .claude/skills .agents/skills .cursor/rules 2>/dev/null | head -1)
LOCAL=$(stat -f %m "$SKILLS_DIR/iblai-vibe/SKILL.md" 2>/dev/null || stat -c %Y "$SKILLS_DIR/iblai-vibe/SKILL.md" 2>/dev/null || echo 0)
LATEST=$(curl -s https://api.github.com/repos/iblai/vibe/releases/latest | python3 -c 'import json,sys,datetime; d=json.load(sys.stdin); print(d.get("tag_name",""), d.get("published_at",""))')
echo "installed: $(date -r "$LOCAL" 2>/dev/null || date -d @"$LOCAL") · latest release: $LATEST"
If the release is newer than the installed copy, or the copy is older than 14 days, continue; otherwise tell the user they are current and stop.
Step 1: Detect current SDK
OLD_SDK=$(node -p "require('./package.json').dependencies['@iblai/iblai-js'] || ''" 2>/dev/null || echo "")
echo "Current SDK (package.json): ${OLD_SDK:-not-installed}"
Step 2: Upgrade the SDK
Skip this step if there is no package.json in the current directory, or if
@iblai/iblai-js is not a dependency.
Projects scaffolded before this release carry an override that holds
@iblai/web-containers at 1.16.0 (vibe-starter needed it while
@iblai/data-layer lagged behind). With it in place, pnpm update moves
@iblai/iblai-js but every component stays on the old UI — no Privacy
sub-tabs, no Incognito policy, no Virtual Machine settings. Remove it
first; it lives in pnpm-workspace.yaml under overrides: (pnpm 10 —
older starters wrote the key single-quoted, newer ones double-quoted,
so match either) or in package.json under pnpm.overrides (older
setups). The ten-line comment vibe-starter wrote above the hold goes
with it, but only when both of its marker lines are present:
if [ -f pnpm-workspace.yaml ] && grep -Eq "^[[:space:]]+[\"']?@iblai/web-containers[\"']?: *1\.16\.0" pnpm-workspace.yaml; then
sed -i.bak -E "/^[[:space:]]+[\"']?@iblai\/web-containers[\"']?: *1\.16\.0/d" pnpm-workspace.yaml && rm -f pnpm-workspace.yaml.bak
echo "removed the @iblai/web-containers 1.16.0 override from pnpm-workspace.yaml"
fi
if [ -f pnpm-workspace.yaml ] && grep -q '^# `@iblai/web-containers` 1\.16\.1 was published' pnpm-workspace.yaml && grep -q '^# exports; iblai-js 2\.3\.1\.\.2\.3\.3 are all affected\.$' pnpm-workspace.yaml; then
sed -i.bak '/^# `@iblai\/web-containers` 1\.16\.1 was published/,/^# exports; iblai-js 2\.3\.1\.\.2\.3\.3 are all affected\.$/d' pnpm-workspace.yaml && rm -f pnpm-workspace.yaml.bak
echo "removed the comment that explained the hold"
fi
if [ -f package.json ] && node -e "process.exit(require('./package.json').pnpm?.overrides?.['@iblai/web-containers'] ? 0 : 1)"; then
node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));delete p.pnpm.overrides['@iblai/web-containers'];if(!Object.keys(p.pnpm.overrides).length)delete p.pnpm.overrides;if(!Object.keys(p.pnpm).length)delete p.pnpm;fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
echo "removed the @iblai/web-containers override from package.json"
fi
Then update the SDK:
if [ -f package.json ] && [ -n "$OLD_SDK" ]; then
if command -v pnpm >/dev/null 2>&1; then
pnpm update @iblai/iblai-js@latest
elif command -v npm >/dev/null 2>&1; then
npm install @iblai/iblai-js@latest
fi
NEW_SDK=$(node -p "require('./package.json').dependencies['@iblai/iblai-js']")
echo "SDK: $OLD_SDK → $NEW_SDK"
fi
If an override survived in a shape the step above does not match, the lockfile still resolves the old package. Make that fail loudly instead of shipping the old UI:
if [ -f pnpm-lock.yaml ] && grep -q '@iblai/web-containers@1\.16\.0' pnpm-lock.yaml; then
echo "ERROR: pnpm-lock.yaml still resolves @iblai/web-containers 1.16.0 — an override is still in place. Remove it from pnpm-workspace.yaml (overrides:) or package.json (pnpm.overrides) and run pnpm update again." >&2
false
fi
Run a quick sanity check afterward:
pnpm typecheck 2>/dev/null || npx tsc --noEmit 2>/dev/null || true
If typecheck fails with new errors, surface them to the user — the SDK
may have introduced breaking changes. Compare against the installed
package's README (node_modules/@iblai/iblai-js/README.md) and the
npm version history
to see what changed.
Step 3: Refresh skills
Re-run the installer to pull the latest skills — both families, the Cursor /
Codex adapters, and any new skills added since. Pass --all so it runs
non-interactively and refreshes every skill in the pack.
npx skills add iblai/vibe --all
Step 4: Show What's New
Fetch the last few entries from the vibe CHANGELOG and summarize as 3-7 bullets grouped by theme. Focus on user-facing changes, skip internal refactors.
curl -sL https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/CHANGELOG.md | head -80
Format the report:
ibl.ai upgrade complete!
SDK: {OLD_SDK} → {NEW_SDK}
Skills: refreshed from iblai/vibe@<latest tag> (iblai-vibe-* + iblai-api-*)
What's new:
- [bullet 1]
- [bullet 2]
- ...
If any step was skipped (no package.json, SDK not a dependency, etc.),
note that explicitly in the summary.
When to run
- After a new ibl.ai release is announced
- Before starting work on a project you haven't touched in a while
- When a skill misbehaves in a way that might be fixed upstream
- Periodically (monthly) to stay current on security patches
Reference
- SDK package: https://www.npmjs.com/package/@iblai/iblai-js
- Vibe skills: https://github.com/iblai/vibe