v1.22.0

Added

• Take control back at your native terminal. The missing leg of the
  session-control triangle: after a dashboard Jump-in, just start typing in
  the terminal that launched the session (observer claude/codex) — the
  daemon returns the writer lease, delivers that keystroke, prints a
  one-line notice, and re-pushes your terminal's geometry so a TUI the
  dashboard left at foreign dimensions heals in the same gesture. Machine
  bytes never reclaim (terminal emulators auto-answer TUI queries on stdin);
  arrow keys or a bare ESC alone won't either, by design. Config:
  [terminal.attach].reclaim_on_input (default on). The dashboard seat goes
  honestly read-only — "control returned to the native terminal — click to
  take back".
• Original-size restore for broken TUIs. The daemon now tracks each
  session's launch-time and current PTY dimensions; every dashboard terminal
  gets a fit / original-size toggle that pins the launch geometry (auto-refit
  suppressed) to recover a TUI corrupted by resizes, and a seat re-asserts
  its own geometry whenever it regains control.
• Keyboard shortcuts reach the dashboard terminal. Ctrl+A/E/K/. and
  friends now go to the TUI instead of the page while the terminal is
  focused; Ctrl+Alt push-to-talk chords pass through untouched;
  copy-with-selection stays native. Browser-reserved keys (Ctrl+W/T/N)
  honestly can't be intercepted in a normal tab — the new fullscreen
  focus mode (Keyboard Lock, Chromium) is where they reach the TUI.
• Watch a bare session read-only. Sessions started outside observer
  (plain claude, codex, …) that are actively producing events now show a
  "live · watch" badge: a read-only, auto-following view of the conversation
  (4s refresh, stick-to-bottom) in the session panel. "Jump in" stays
  honestly disabled — a bare launch's terminal belongs to the shell that
  started it — with "Watch instead (read-only)" offered in its place.
• Collapsible sidebar. The dashboard's left nav collapses to a compact
  icon rail on desktop (persisted, tooltips); the mobile drawer is unchanged.

Fixed

• Post-v1.21.0 CI red: six golangci-lint findings in the release's new code
  (behavior-preserving refactors) and the missed website version sweep.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.22.0-linux-x64.tar.gz
Linux arm64	observer-v1.22.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.22.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.22.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.22.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.22.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.22.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.22.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.22.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.21.0

Added

• Browser-chat capture (opt-in MV3 extension). Full-detail capture of
  ChatGPT, Claude.ai, Perplexity, Gemini, and consumer Copilot web sessions
  from Chrome (WSL + Windows) via a native-messaging bridge into the new
  browserchat adapter — prompts, responses, models, and estimated tokens,
  with best-effort redaction and health telemetry (observer browser health).
  Load-unpacked only for now. See docs/browser-extension.md.
• Session attach: join and drive live sessions from the dashboard.
  Observer-launched claude/codex sessions are daemon-owned PTYs the
  dashboard can now join ("live · joinable" badge → Jump in), while your
  native terminal stays fully interactive. Closed sessions gain one-click
  native Resume (observer claude --resume <id> composed server-side)
  from the session panel. Remote (paired-device) viewing of attach/resume
  terminals stays deny-by-default behind the new [remote].allow_terminal_view
  read opt-in.
• Resilient default-on attach. Interactive observer claude/observer codex
  launches attach by default when the daemon is reachable
  ([terminal.attach].default_on, Settings-togglable; --no-attach opts out
  per launch). Graceful daemon restarts stamp a durable end_reason
  (migration 072) and the attach client offers prompt-with-timeout
  auto-resume onto the same transcript; every skipped default-attach prints
  an honest one-line reason.
• Terminal Workspace dock grid. The Terminals page is now a workspace:
  an auto-compacting responsive grid of live terminals — drag tiles by their
  header, resize from edges, add running sessions from the tray, "⊞ Add to
  grid" directly on any floating terminal window, "⬈ Open as window" to
  undock a tile back into a user-resizable, size-persisted floating
  window. Layouts persist server-side (node-local workspace_layouts,
  migration 073) and render read-only on paired remote devices. Honest close
  semantics: "Remove from grid" keeps the session running; "Stop & close"
  actually ends the process. [terminal].max_concurrent default raised to 9.
  Existing policy/status/history content lives under a Settings tab.
• Standing-access hardening toggle. Opt-in
  [remote].revoke_standing_on_takeover: a desktop takeover of a remote
  writer that held control through the standing secret also revokes the
  standing secret itself (identical teardown to the explicit revoke). Default
  stays seamless — takeover revokes only the live lease.

Fixed

• Daemon-down no longer breaks claude launches. observer init bakes the
  proxy route into claude's own settings.json, which outranks the process
  environment — so a "bare" fallback launch used to route API calls into a
  dead proxy. The launchers now resolve the effective route across every
  settings scope claude honors (managed/CLI/local/project/user, including
  inline-JSON --settings and --continue-from working directories) and
  neutralize observer routes with a one-shot CLI-scope --settings override
  (signal-safe temp file); un-overridable cases (managed scope, your own
  --settings, codex's config-file route) refuse with copy naming the exact
  fix. Third-party gateway routes are always honored, never clobbered.
• "Stop & close" now actually stops the process. Since detach-replay, a
  websocket close only detached the embedded terminal; every stop control now
  issues the explicit server-side reap.
• Mobile layout no longer breaks on long project paths. One shared
  tail-preserving truncation primitive (ellipsis at the head, leaf visible,
  full path on hover) across all pages, plus explicit horizontal-scroll
  containment on the Overview table.
• Terminal runs killed by a daemon shutdown no longer show as running forever
  in the run history; floating-terminal resize no longer minimizes the window
  on release.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.21.0-linux-x64.tar.gz
Linux arm64	observer-v1.21.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.21.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.21.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.21.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.21.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.21.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.21.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.21.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.20.0

Added

• Remote dashboard + terminal control (Phase 4, explicit opt-in). Drive a
  node from another device over your tailnet: multi-device pairing, a draggable
  launch dock, in-dashboard terminals, and a mobile-friendly dashboard layout.
  Remote execute (launching AI tools / running terminal commands from the
  dashboard) is gated behind an explicit standing grant
  ([remote].allow_standing_terminal_control, default off) with per-session
  terminal leases, fanout bounds, revoked-lease handling, an execute-tier CSP,
  and a full audit lifecycle. Tailnet-only; nothing is exposed to the public
  internet. See docs/remote-access.md.
• Process-network body capture + attribution wave. For observed processes
  routed through the proxy, capture proxied/plaintext request/response bodies
  into the new process_network_bodies store (agent migration 067) — never a
  claim of TLS visibility. Broader process observation and attribution: five
  adapters seed the pid bridge directly, a background attribution sweep and
  per-wave basenames tighten which session a process belongs to, and the
  dashboard gains process + raw-events surfaces. See
  docs/process-observability.md.
• GPT-5.6 / OpenAI cache-write token capture. The proxy now parses
  input_tokens_details.cache_write_tokens from OpenAI/Responses usage (both
  the provider and streaming paths), nets cache-write against gross input
  correctly, and feeds the cachetrack engine so implicit-write events are
  observed instead of silently dropped. Wire field + expiry semantics
  documented in docs/general_info/openai_cache_expiry.md and
  docs/cache-tracking.md.
• Dashboard time-window dropdown. A new date-range control adds 1h / 12h /
  1d windows plus explicit custom ranges alongside the existing options,
  resolving since/until with hours taking precedence over days. The range
  params thread through every dashboard page.
• Benchmark integrity: retry-as-attempt + ephemeral runs. Each retry is now
  recorded as its own attempt (agent migration 068) so benchmark integrity
  reflects real attempt counts instead of collapsing retries. New ephemeral
  runs execute without persisting into the main corpus.
• Compression: no-drop capability + honest lossy-eviction display. A new
  disable_drops capability lets the codex-safe recipe compress without lossy
  content eviction. All lossy eviction now routes through one classifier owner,
  and evicted bytes are subtracted from reported compression savings so
  "saved" reflects genuine, retrievable compression only — evicted content is
  surfaced additively (still recoverable via search_past_outputs markers,
  never counted as a saving).
• M365 Copilot org analytics + browser-extension capture fixes. New
  observer-org m365 command and M365 Copilot analytics surface (Graph auth +
  surface_graph) on the org server — server-side only, never on the agent
  wire. Browser-extension capture (native-messaging host + service worker + the
  loopback ingest receiver) is fixed, with per-browser/per-OS host manifest
  writers including Windows registry hostfiles.
• [dashboard].addr config knob (#8). The dashboard bind address is now
  configurable via [dashboard].addr (and the OBSERVER_DASHBOARD_ADDR
  environment override).
• Kimi K3 model pricing added to the cost engine and the settings surface.

Changed

• Codex fork/subagent token de-duplication + session lineage. Replayed
  fork/subagent turns are now skipped so a forked Codex session no longer
  double-counts tokens already attributed to its parent. New parent/child
  session-lineage tracking (agent migration 069, surfaced in the session-detail
  panel) makes the relationship explicit, and the new --codex-fork-dedup
  backfill pass reconciles historical fork double-counting.

Fixed

• VS Code extension activation stall (#5). Fixed extension activation and
  observer-binary resolution; a new preferPathBinary setting lets the
  extension use a PATH-resolved observer instead of its bundled copy.
• Codex 16 MiB record limit (#7). The Codex JSONL scanner's 16 MiB record
  cap is replaced with a shared readRecord (64 MiB bound + per-record skip) so
  an oversized record no longer aborts a whole session parse.
• Prune now reclaims disk space. observer prune actually reclaims disk
  instead of only shedding rows, and startup latency previously spent in
  on-open integrity work is cut.

Upgrade notes

• Agent DB migrates to schema 69 (migrations 061–069); the org server stays at
  schema 21 — both automatic.
• Restart the daemon via the safe order (route off → stop → relaunch → route
  on; scripts/restart-daemon.sh) so the new binary and migrations load.
• Remote execute + standing terminal control stay fully inert until you set
  [remote].allow_standing_terminal_control = true; pairing and remote viewing
  are tailnet-only.
• Run observer backfill --codex-fork-dedup (or observer backfill --all) to
  reconcile historical Codex fork double-counting.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.20.0-linux-x64.tar.gz
Linux arm64	observer-v1.20.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.20.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.20.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.20.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.20.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.20.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.20.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.20.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.19.0

Added

• Email notifications. New [email] config block (stdlib SMTP:
  STARTTLS/implicit-TLS, AUTH PLAIN/LOGIN; default off, fail-soft —
  a delivery failure never affects evaluation). Rides the existing alert
  evaluators: org budget alerts, org obs-alert rules, and node-side
  [observability.alerts]. See docs/email-notifications.md.
• Scheduled cost digests. Weekly/monthly digest emails on both the node
  ([digest]) and the org server: period spend, per-model/per-project (org:
  per-developer) breakdowns, movers vs prior period. Restart-safe send-once
  de-dup via the new digest_state table (agent migration 060, server
  migration 021). Test on demand with observer digest send --dry-run /
  observer-org digest send --dry-run.
• Shareable cost card. observer report share [--period week|month] [--markdown] renders a 1200×630 SVG social card + markdown summary of your
  observed spend (period total, cache-read share, model/tool leaderboards).
  Aggregates only — project names/paths never appear (pinned by test). No
  network.
• Admin dashboard (web2) onboarding & navigation. First-run checklist for
  a fresh org server, command-palette data search (teams / projects /
  people / recent sessions), teaching empty states across pages, breadcrumbs
  on detail routes, and sidebar count badges.
• Plane-A general-observability upgrades. web2 Admission center
  (/trajectories/admission, read-only policy viewer) + T6 admission
  org-wire tier ([org_client.share.obs].admission, default off; server
  migration 019) with audited deep reads; T7 per-item eval tier
  (.eval_items, server migration 020) with per-item EvalRun detail and
  run-vs-run compare; per-end-user spend page; node-side alert
  evaluation for share-off deployments ([observability.alerts], default
  off); LLM-judge robustness (map-reduce chunking, per-criterion prompts,
  hardened client) + observer obs admission verify; SDKs attach
  prompt/response content by default (OBSERVER_CAPTURE_CONTENT=0 to
  disable) and target the correct node port :8081; POST /policy?persist=1
  write-through.
• M365 Copilot org-tier connector (server-side native-console poller,
  server migration 018; never on the agent wire).
• Browser-chatbot capture extension (preview). Opt-in MV3 extension
  capturing ChatGPT / Claude.ai / Perplexity / Gemini / consumer-Copilot web
  chats via a native-messaging bridge (observer browser hook). Load-unpacked
  only for now — not yet published to the Chrome Web Store; all token
  counts are estimates.
• Website. Text-first, fully indexable homepage (the Observer Quest
  arcade lives on at /arcade); product deck at /deck with a downloadable
  PDF; 28 per-tool "track costs" pages generated from the adapter
  registry; 6 comparison pages; 21-term glossary; a public two-planes
  explainer; llms.txt + JSON-LD + an explicit GEO robots posture
  (retrieval crawlers allowed, training crawlers opted out).

Changed

• READMEs and store listings overhauled around the durable story:
  proxy-accurate billed-token attribution, local-first privacy, free node →
  team layer. One true adapter count (26) everywhere; npm/PyPI/VS Code
  listing descriptions rewritten; MCP tool census corrected to 25 (21
  always-on + 4 conditional) and docs/mcp-tools.md fully rewritten.
• Org-server retention is now enforced. server.data_retention_days
  (default 730) actively prunes: upgraded org servers begin deleting
  rows older than the configured window (identity/config/audit/guard-chain
  tables are never pruned). Set the knob before upgrading if you need longer
  retention.
• Guard alerting (desktop toasts, Slack/Discord/PagerDuty webhooks) and
  process observability are now documented on the main surfaces.

Fixed

• VS Code walkthrough listed a nonexistent "Continue" adapter; stale
  "seventeen tools" counts across README/website/listings; dead help entries
  in the node dashboard; org migrate-test schema assertion; a date-dependent
  test (TestAggregateForOrg) that failed once its hardcoded day aged out.

Upgrade notes

• Agent DB migrates to schema 60; org server to 21 — both automatic.
• Restart the daemon via the safe order (route off → stop → relaunch →
  route on; scripts/restart-daemon.sh) so the new binary and migrations
  load.
• Email/digests stay inert until you set [email].enabled = true plus the
  per-consumer opt-ins.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.19.0-linux-x64.tar.gz
Linux arm64	observer-v1.19.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.19.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.19.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.19.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.19.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.19.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.19.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.19.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.18.0

Added

• observer devin --continue-from launcher. Devin CLI joins the
  session-handoff launchers: observer devin --continue-from <session-id>
  distills a handover and seeds it as Devin's first prompt. Devin takes its
  prompt as a clap last-only positional after the -- separator
  (devin -- "<prompt>", operator-verified on a real TTY), so the launcher
  uses a new injectTrailingPositionalAfterDashDash inject kind. The launch is
  seed-only and non-proxied (Cognition backend, native_exempt, no
  base-URL knob); child.Dir is threaded from the continue-from cwd per the
  cross-OS handoff contract. The launchable set grows to 19 launchers
  (17 Seeded + 2 DocAssisted); the Devin registry row gains InjectPrompt
  • Launch and drops its unverified-seed caveat.

Changed

• qwen-code promoted to a live, observer-driven proxy route. qwen-code
  resolves its active model by the (id, baseUrl) pair, so rewriting
  model.baseUrl alone was ignored when it matched no modelProviders entry —
  the grounded 2026-07-09 probe failure (qwen fell back to api.openai.com and
  bypassed the proxy). RegisterQwenCode now also retargets every OpenAI-lane
  modelProviders entry on the known default host to the proxy URL, keeping
  each entry's id + envKey untouched, tolerating both live schema shapes
  (array + object form), and synthesizing an entry only when none matched (same
  guard matrix: refuse-foreign-URL, idempotent, .bak, temp+rename,
  ConfigMissing skip; API keys never touched). Live-verified 2026-07-09: a
  qwen -p turn through :8820 landed api_turns 23728–23730 (gpt-4o,
  provider=openai). The registry row is promoted to routable_now with an
  observer-driven Proxy route; ProxyProbe is KEPT — it remains the
  persistent config-lane writer observer init dispatches on.
• GPT-5.6 cache/effort grounding closed against live traffic. A live
  gpt-5.6 session (019f4801) confirms the launch pricing: the model ids
  gpt-5.6-{sol,terra} hit their pricing rows exactly and a live terra turn
  recomputes to the stored cost to the digit; no effort levels beyond
  low/medium/high manifested. NO cache-write usage field exists on the Codex
  wire — only cached_input_tokens (read discount). OpenAI docs confirm the
  write tier we priced (1.25× uncached input, 90% read discount, 30-min minimum
  TTL, explicit-breakpoint mode), but Codex's ChatGPT-plan credit formula has no
  write term, which is why the field never appears on our wire. The shipped
  write-tier pricing therefore stays present-but-dormant and harmless, and
  parsing a cache_write_tokens field is deliberately DEFERRED until the
  netting semantics can be arithmetic-grounded on live traffic — additive
  billing without grounding would repeat the reasoning-double-bill trap.
  docs/cache-tracking.md gained a GPT-5.6 cache-expiry subsection.

Fixed

• Codex reasoning tokens were double-billed. The OpenAI/Codex wire reports
  GROSS output_tokens with reasoning as a subset (input + output == total on every live token_count event — arithmetic-verified on gpt-5.6
  traffic). The codex adapter emitted that gross value alongside
  ReasoningTokens, and the cost engine's additive reasoning-at-output-rate
  rule then billed every codex reasoning token twice. The adapter now nets
  reasoning out at both emit sites (clamped ≥ 0, mirroring the netInput
  pattern), and TokenBundle.Reasoning gained a hard documented precondition:
  netting is a per-wire property — OpenAI/Codex fold reasoning into output
  (subset), whereas gemini/antigravity report it disjoint (the additive rule is
  correct only for disjoint wires). Migration 058 corrects the stored history
  one-shot (1,991 gross codex rows / 436k double-billed reasoning tokens on
  the reference node): historical rows are corrected automatically at the first
  startup of the upgraded binary, because a rescan cannot lower counts past the
  ON CONFLICT MAX-upgrade and the run-once ordering makes the subtraction
  idempotent by construction. Scoped to tool='codex' only —
  gemini/antigravity are disjoint-correct.
• grok ACP update content was dropped when polymorphic. tool_call_update
  content arrives as an array of text/diff blocks (and rawOutput.output
  as a byte array); the single-object decode dropped 38 records across the two
  fresh captures. search_replace (grok's in-place edit) was also unmapped and
  landed as unknown; it now maps to edit_file (with defensive
  deletefile/removefile handling — grok exposes no distinct delete tool).
  Rescan: warnings 38 → 0, unknown 2 → 0.
• Adapter rescans now reclassify action_type from the unknown sentinel.
  insertActionSQL's ON CONFLICT clause never refreshed action_type, so a
  rescan (observer scan --force) could not reclassify rows stored as
  unknown before a mapping fix landed — which blocked the grok
  search_replace fix above from healing the two live unknown rows. The
  conflict clause now upgrades only unknown → a real type; it never
  rewrites one known type to another and never downgrades to unknown/empty
  (all three invariants pinned by table-driven tests).

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.18.0-linux-x64.tar.gz
Linux arm64	observer-v1.18.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.18.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.18.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.18.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.18.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.18.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.18.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.18.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.17.0

Added

• Nine new tool adapters — the 10-tool adapter wave (freebuff descoped).
  Observer now captures 26 adapters total. Each new adapter ships with a
  testdata fixture, an operator doc, an integration-registry row, a dashboard
  tool color, and a docs/cross-adapter-schema-mapping.md section (§3.11–3.19):

  • qwen-code — Qwen Code CLI (Gemini-CLI fork), Claude-Code-shaped JSONL
    under ~/.qwen; GROSS input netted against cached.
  • kiro-cli — AWS Kiro CLI; mode-dependent dual store (interactive flat
    bundles vs --no-interactive SQLite conversations_v2 keyed by the RAW
    cwd, translated through crossmount); SigV4, native-exempt.
  • crush — Charmbracelet Crush; project-local .crush/crush.db
    discovered via projects.json; Unix-SECONDS timestamps.
  • kimi-code — Moonshot Kimi CLI; wire.jsonl usage.record
    (inputOther is already NET); no seed lane (DocAssisted only).
  • grok — xAI Grok CLI; 8-file ACP session bundles, with per-request
    token splits pulled from the GLOBAL ~/.grok/logs/unified.jsonl
    correlated by sid (no timestamp heuristics).
  • devin — Devin CLI; SQLite message_nodes TREE walked along
    main_chain_id to dedupe regeneration branches so tokens never
    double-count; per-message metadata.metrics tokens.
  • aider — Aider; per-repo .aider.chat.history.md Markdown, with watch
    roots = discovered transcript FILE paths (a bounded breadth-first
    native-home walk memoized once per process); prose tokens GROSS→netted.
  • qoder — Alibaba Qoder CLI; Claude-Code-shaped JSONL under
    ~/.qoder/projects; NO local model or tokens (server-side only —
    honest-zero, native-exempt).
  • goose — Block Goose; WAL SQLite sessions.db with SESSION-level
    tokens only (accumulated_* + accumulated_cost); input GROSS→netted vs
    cache_read; SessionID is store-scoped (<id>@<sha8(store)>) so the
    YYYYMMDD_seq ids can't collide across a WSL + Windows store pair.

  Fresh installs pick all nine up automatically; an EXPLICIT enabled_adapters
  list must add the new tool names (qwen-code, kiro-cli, crush,
  kimi-code, grok, devin, aider, qoder, goose) — the startup WARN
  names any that are missing.

• Seeded session-handoff launchers for the new adapters — observer qwen,
  observer kiro, observer kimi, observer grok, observer qoder, and
  observer goose accept --continue-from <session-id> to distill a handover
  and seed it as the tool's first prompt (18 launchers total). qwen,
  kiro, grok, qoder, and goose seed directly; kimi is DocAssisted
  (no -p seed lane). devin, aider, and crush deliberately ship no
  launcher (no scriptable seed lane).

• The watcher and adapter registry now accept a FILE as a watch root
  (not only a directory), which the aider adapter needs for its per-repo
  transcript-file watch set.

• Guarded proxy-route config-lane writers — internal/proxyroute gained
  RegisterKimiCode (TOML base_url in ~/.kimi-code/config.toml),
  RegisterCrush (JSON map-merge in crush.json), and RegisterQwenCode
  (rewrites ~/.qwen/settings.json model.baseUrl, stricter guard: refuses
  any custom host). Each backs up (.bak) and writes via temp/rename, skips
  benignly when the config is missing, is idempotent when already observer,
  and refuses a foreign URL; API keys are never touched. A new additive
  registry field Capability.ProxyProbe marks "writer ready, promotion
  pending a live probe"; these writers fire ONLY through observer init —
  batch under --all (honoring --skip-proxy-route), or one per-tool consent
  prompt in the interactive checklist (default NO). ⚠️ Once a tool is routed,
  stopping the daemon breaks it until reverted (the standard routed-tool
  caveat — see the daemon-restart runbook).

• Per-adapter Backfill scan modes in the dashboard — Settings → Backfill
  now derives one scan-<tool> row per integration-registry adapter (26 rows),
  backed by the generic observer scan --force --adapter <tool> lane
  (idempotent; overrides enabled_adapters for the run). A future adapter's
  Backfill row appears automatically.

• Pricing: GPT-5.6 and Grok 4.5 model launches. Added gpt-5.6-sol
  ($5/$30), gpt-5.6-terra ($2.50/$15), gpt-5.6-luna ($1/$6), and a
  gpt-5.6 family row. GPT-5.6 introduces the first non-Anthropic explicit
  cache-write tier (writes at 1.25× uncached input, reads keep the 90%
  discount); the write rate is wired into the cost table but INERT until a live
  5.6 response grounds the cache-write usage field. Added grok-4.5 ($2/$6,
  the new xAI flagship — previously under-billed via the grok family row at
  4.3 rates) and grok-build-0.1 / grok-build ($1/$2); bumped the grok
  family prefix to flagship rates. docs/pricing-reference.md updated.

Changed

• Adapter routability promotions. aider, goose, and grok were
  live-grounded through the :8820 proxy and promoted to routable_now
  (observer drives no route today; the launchers stay non-proxied).
  kimi-code and crush were promoted further to observer-driven Proxy
  routes after live turns landed api_turns rows through their config-lane
  writers. qwen-code stays route-blocked — its (empty) modelProviders map
  overrides model.baseUrl, so the env/base-URL lanes are grounded-dead and
  the writer needs a matching provider entry first.
• Dashboard tool-identity colors for the 10 previously-uncolored adapters
  (light + dark tokens, CVD-validated), plus the missing tools.ts entries.

Fixed

• Actions page window selector was a no-op. The 7d/14d/30d window computed
  windowDays but never passed it to /api/actions (only the Timeline
  day-counts honored it). /api/actions gained the same optional days
  contract as /api/sessions (0 = unwindowed; legacy callers unchanged) and
  the page now threads the selected window.
• antigravity-cli cross-OS + guard coverage. Added the antigravity-cli
  cross-OS project-root anchors and its guard watcher-conformance row.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.17.0-linux-x64.tar.gz
Linux arm64	observer-v1.17.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.17.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.17.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.17.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.17.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.17.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.17.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.17.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.16.0

Added

• Richer session-handoff content — two complementary "full" carry modes.
  full carries the excerpted flow plus a [msg <id>] tag on every message
  and an MCP-hint line; a target with the Observer MCP pulls any full body on
  demand via the new get_session_message tool (always-on MCP tool count
  19 → 20), which re-reads ONE un-excerpted message by
  (session_id, message_id|index) from the source transcript and never
  persists it. full_cache inlines the un-excerpted read/tool bodies INTO the
  handover doc so the new session starts warm with zero MCP round-trips (uses
  the FullTranscriptReader capability — claude-code + codex; other tools
  degrade to full with a stated reason), size-capped by
  [handoff] max_cache_bytes (8 MB default). models.TranscriptMessage gained
  an ID lifted from each source format's own record id where grounded.
• Antigravity CLI (agy) adapter — the newer Antigravity CLI is now a
  first-class, separately-tagged adapter (antigravity-cli):
  plaintext-protobuf SQLite .db conversations parsed directly, .pb
  conversations via the existing transcript fallback, name-gated so the desktop
  and CLI layouts each claim only their own files, with
  observer backfill --antigravity-cli-rescan and an integration-registry row.
  Add "antigravity-cli" to an explicit enabled_adapters list to enable it.
• observer antigravity-cli handoff launcher (aliases antigravity,
  agy) — --continue-from distills a handover and seeds it via agy -i
  (non-proxied).
• Community links surfaced in the dashboard Settings page and the
  observer init footer.

Changed

• Obs share flags nested under [org_client.share.obs]; the dashboard Settings
  Observability section is now plane-tagged (Plane A admin vs Plane B
  developer) for legibility.
• Website download counter refreshed (npm 14,893 / PyPI 9,242).

Fixed

• Antigravity CLI sessions are now tagged antigravity-cli instead of blending
  into the desktop antigravity tool — the parse helpers hardcoded the tool
  constant; ParseSessionFile now re-tags every event to the adapter's own
  name at the boundary.
• MCP observer serve skips the SQLite quick_check so a large DB can't blow
  the init timeout.
• Session handoff resolves a foreign-OS project root for the doc + launch cwd
  (cross-OS WSL case).

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.16.0-linux-x64.tar.gz
Linux arm64	observer-v1.16.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.16.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.16.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.16.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.16.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.16.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.16.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.16.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.15.0

Added

• Session Handoff (continue-anywhere) — observer handoff <session-id> [--to <tool>] distills any captured session from the source tool's OWN
  transcript files into a scrubbed HANDOFF-<id>.md the target tool reads in
  the project root, priced per carry mode (metadata / distilled /
  distilled_tail / full) at the target model. Fork from any stable point of
  the message history (snap table refuses cuts inside unresolved tool chains).
  NOT cache migration — provider caches are server-side and prefix-exact; the
  estimate's stay option (next-message predict band + live cache
  value-at-risk) is the honest surface of that fact. Surfaces: CLI
  (observer handoff, handoff list), dashboard session-detail
  "Continue in…" modal with fork picker
  (GET /api/session/<id>/handoff/estimate + POST /api/session/<id>/handoff),
  MCP continue_session (tool count 19 → 20). Transcript readers:
  claude-code, codex, cursor, cline, cline-cli, hermes, opencode. Node-local
  handoffs table (migration 055) stores counts/enums/hashes only — never
  the doc. Docs: docs/session-handoff.md.
• Session Handoff — dashboard "Launch <tool> here" (embedded web
  terminal). The Continue-in… modal can now START the target tool in the
  browser instead of only writing a handover file: for a launchable target
  (claude-code / codex / gemini-cli / pi) the daemon spawns
  observer <tool> --continue-from <id> in a PTY inside its own OS and
  streams the TUI into an xterm.js panel over a /ws/launch/<handle>
  websocket — working uniformly local, remote, or WSL-daemon/Windows-browser
  (no cross-OS shell). New pure-logic internal/termsession (PTY session
  registry behind an injected spawner; process-group reaping on unix,
  concurrent cap + idle reaper) and the HandoffCapability.Launch registry
  field. Server-derived argv only; CSWSH-defended (256-bit crypto/rand
  handle minted only by the Origin-checked POST /api/session/<id>/launch,
  plus coder/websocket cross-origin rejection). On by default, kill-switch
  [handoff].allow_dashboard_launch. GET /api/launch/sessions +
  DELETE /api/launch/<handle> for the live-session list. Unix-only PTY
  backend (native-Windows daemon reports unsupported → run under WSL). Docs:
  docs/session-handoff.md (Launch here), docs/security.md ledger.
• Session Handoff — armed hook delivery (--deliver hook, claude-code).
  observer handoff <id> --to claude-code --deliver hook arms the handover
  for the NEXT claude-code session in the project: it injects as SessionStart
  additionalContext (same seam as the advisor digest), one-shot, expiring
  after [handoff] hook_ttl_minutes (default 240). The payload is hard-
  budgeted to [handoff] hook_max_bytes (default 8192; Phase 0 D-P0.2's 8KB
  intact cap) — the compact doc when it fits, else the document head plus a
  pointer to read the on-disk HANDOFF-*.md. Doc content stays on disk; the
  handoffs row (migration 056: hook_expires_at / hook_delivered_at /
  project_root) records only the arming window and file path. The claim is
  a single guarded UPDATE … RETURNING (race-safe). Delivery dispatches on
  the target's integration.HandoffCapability inject set — only claude-code
  declares inject_hook; other tools error honestly.
• Session Handoff — launcher --continue-from (prompt delivery).
  observer claude --continue-from <session-id> and
  observer codex --continue-from <session-id> run the handoff for the
  launcher's OWN tool (delivery inject_prompt) and seed the rendered
  handover as the tool's first user prompt before exec'ing it — no
  copy/paste. Mirrors observer handoff flags (--carry, --from-message,
  --from-time; default fork = last message). claude gets the doc prepended
  as its leading positional prompt, codex appended as the trailing positional
  (TUI + exec); forwarding your own positional prompt errors honestly (two
  prompts — forward value-flags as --flag=value). Handovers over 100KB
  degrade to a marker-carrying pointer prompt (the full doc is on disk). The
  observer handoff … --to claude-code|codex output now prints a
  --continue-from tip. Delivery still dispatches on the target's
  integration.HandoffCapability — a prompt handoff to a tool without the
  lane errors honestly.
• Session Handoff — --continue-from extended to observer gemini and
  observer pi. Both now accept --continue-from (plus --carry,
  --from-message, --from-time), seeding the handover as the tool's first
  prompt: gemini via its -i/--prompt-interactive flag ("Execute the
  provided prompt and continue in interactive mode"), pi as a trailing
  positional message (pi [messages...] start an interactive session). The
  injection strategy is now a declared promptInjection descriptor (leading
  positional / trailing positional / flag value) applied by a shared
  injectPrompt helper — no switch tool; claude and codex are refactored
  onto the same helper. hermes stays deferred: its only prompt flag
  (-z/--oneshot, chat -q) is headless one-shot (answer once and exit),
  not an interactive seed, so wiring it would change the run mode.
  opencode (TUI positional is a project path), copilot-cli (headless
  -p only), openclaw (proxy runtime-block) and cline-cli (not
  verifiable on the grounding node) also remain deferred.
• Session Handoff — best-effort target-session linker. Every rendered
  handover carries a <!-- superbased-handoff <shortid> --> marker that
  rides into the target session on every delivery lane (injected prompt,
  SessionStart context, or the model reading HANDOFF-<shortid>.md).
  observer handoff list now runs a time-boxed best-effort sweep first:
  for each delivered handoff of the last 7 days still missing a target,
  it re-reads candidate sessions of the target tool in the same project
  (started after the handoff) via the shared transcript-reader dispatch and
  stamps handoffs.target_session_id on the first whose transcript carries
  the marker. The link is written once (guarded UPDATE); the list gains a
  TARGET column. Pure marker scan lives in internal/handoff
  (ScanMarkers / ContainsMarker); store seam adds LinkTargetSession,
  ListUnlinkedHandoffs, CandidateTargetSessions. Short-id is recovered
  from the delivered doc's file name (delivery_ref). Everything is
  best-effort — an unreadable candidate is skipped and one handoff's failure
  never aborts the sweep.
• Session Handoff — handoff_rehydration cache accounting. A handoff
  target's first turn is a large cold cache write BY DESIGN (the handover
  doc arrives as the first prompt / SessionStart context / an early
  HANDOFF-<id>.md read). It is now annotated as a new
  cause=handoff_rehydration (same reanchor kind, so kind-based
  denominators are unchanged) instead of a plain reanchor, so it no
  longer trips the advisor's session_balloon / cache_write_waste
  detectors or observer cache-health's cause-concentration WARN. Fired
  live in cachetrack when the superbased-handoff marker is present on the
  first observed turn (proxy parseRequest body scan + Tier-2 store
  block-body scan), and applied retroactively by the advisor via
  handoffs.target_session_id (the belt for non-proxied targets). Docs:
  docs/cache-tracking.md → "Session-handoff accounting".
• Session Handoff — implicit-cache lane consults the handoff marker. The
  §15.3 implicit / OpenAI-Codex attribution path now mirrors the Anthropic
  lane: on the bootstrap turn with the superbased-handoff marker set,
  ruleImplicitHandoffRehydration fires cause=handoff_rehydration with the
  same implicit_write kind the plain reanchor uses, so every
  denominator/exclusion is unmoved (the kind routes to bucketSkipped +
  isRateSkipped, and the bootstrap turn is already excluded from
  ImplicitCacheConsistency) — only the cause differs. The marker flag,
  already scanned provider-agnostically by the proxy's parseRequest, is now
  threaded through the OpenAI branch of buildCacheObserveInput (it was
  previously dropped) and consumed by observeImplicit. Live coverage is
  proxy-only; a non-proxied codex Tier-2 target carries no reconstructed
  block bodies to scan, so that lane stays covered by the advisor's
  retroactive handoff-target belt.
• Session Handoff — retention sweep + observer doctor probe (P4). The
  node-local handoffs table is now pruned by the shared retention runner
  (observer prune, and prune_on_startup on observer start / watch)
  via store.PruneHandoffRows, gated by the new [handoff] retention_days
  (default 180; 0 = keep forever). The prune summary line reports
  handoff_rows=<n>. observer doctor gains a handoff readers check:
  per adapter it reports the declared transcript tier + delivery lanes and,
  where a session exists from the last 30 days and the adapter implements
  the reader, runs a read-only, time-boxed (2s) readability probe against
  the latest session — honest read OK / metadata handover only /
  reader-declared-but-unreadable WARN, dispatched on capability shape (no
  tool-name branching).

Changed

• The node/developer dashboard is now purely coding-agent (Plane B). The
  general-observability surfaces — Trajectories, Evals, and the
  Admission policy editor / per-end-user budgets — were removed from the
  local dashboard nav. These observe an LLM application you host at the
  admin level (end-user traces, evals, and input guardrails), not your own
  coding assistant, so their home is the admin dashboard (web2, the
  Trajectories nav group). A node still captures and pushes obs data when
  [observability] is enabled; it just no longer renders the obs UI locally.
  The obs backend, /api/obs/* endpoints, and observer obs … / observer eval CLIs are unchanged. See the new [`docs/deployment-m...

v1.14.0

Security

• Whole-product security review + remediation (see
  docs/audits/security-review-2026-07-02.md; tracked in docs/security.md).
  A six-surface review plus govulncheck found and fixed 4 high, 8 medium, and
  6 low findings; govulncheck reachable advisories went 28 → 0.
  • Org server access control (high). Three privileged /api/org/* routes
    (routing-policy publish, routing-summaries export, enrolment-token mint)
    were gated on SAML-session presence only, so any SSO-capable member could
    reach them — publish a fleet-wide routing policy, export every developer's
    email and spend, or mint an enrolment token for an arbitrary user (ingest
    impersonation). They now require org-admin authority (admin_emails).
  • SAML signature bypass (high). Bumped goxmldsig 1.4.0 → 1.6.0
    (GO-2026-4753, reachable from assertion validation), golang.org/x/net
    0.53 → 0.55, and the build toolchain to go1.25.11 (clears ~25 stdlib
    advisories including html/template XSS reachable from the org dashboard).
  • Dashboard CSRF / DNS-rebinding (high). The local dashboard exposed
    state-changing endpoints with no origin or Host validation; a malicious web
    page could drive them. Added a same-origin + loopback-Host guard and a
    non-loopback-bind warning.
  • Watcher symlink escape (high). A symlink planted under a watch root
    could be followed out of the tree and its contents excerpted into the DB;
    such symlinks are now skipped.
  • Privacy / attribution (medium). Ingested user_email is pinned to the
    authenticated pusher (was forgeable on aggregate rows), and git_branch is
    no longer shipped in the default metadata-only sharing posture.
  • Denial-of-service hardening (medium/low). Enforced the previously-dead
    [watcher].max_file_size_mb, added watcher panic recovery, a protobuf
    recursion-depth cap, and a proxy request-body size cap; plus a proxy
    guard-mask JSON backstop, WSL hook-command quoting, git gitdir: traversal
    rejection, and PowerShell path escaping.

Added

• Config auto-migration rail. Deprecated config keys are now rewritten
  to their current names on disk instead of only being mapped in memory (which
  reprinted a config: deprecation: warning on every load). A new pure,
  table-driven registry (internal/config/migrate) surgically renames keys —
  preserving your values, comments, ordering, and every untouched section —
  drops keys with no analog, and stamps [observer] config_version. It runs
  automatically once on observer start (the daemon is the sole writer; a
  config.toml.bak backup is written first) and on demand via observer config migrate / observer config migrate --dry-run. Idempotent and
  fail-safe: a value it can't edit by line surgery is left untouched, never
  corrupted. Registry v1 migrates the decommissioned [compression.code_graph]
  / [intelligence.code_graph] blocks onto [codeintel].

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.14.0-linux-x64.tar.gz
Linux arm64	observer-v1.14.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.14.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.14.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.14.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.14.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.14.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.14.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.14.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private

v1.13.0

Added

• Output Composition (verbosity) — code vs. explanation, by language, with
  estimated cost. Measures what actually comes through an AI assistant's
  output: narrative explanation vs. shown (fenced) display artifacts vs.
  authored code (file writes + shell commands), resolved by language, at turn /
  session / aggregate levels. A new pure internal/verbosity layer owns the
  markdown fence scanner, a comprehensive extension/filename/fence-tag →
  language+category table, the byte breakdown, and the token/cost apportionment
  (output tokens split by per-class chars-per-token, priced at the model's
  output rate). Capture adds the node-local actions.content_bytes column
  (migration 054) — an exact byte length of the code the model authored in each
  action, computed at ingest from the untruncated tool input with the content
  itself discarded; it is deliberately not on the org-push wire. Surfaces:
  the observer verbosity <session> | --by model|project|day | --unknown-ext
  CLI, GET /api/session/<id>/verbosity + a SessionDetailPanel card, GET /api/verbosity/aggregate + an Analysis Output-composition section, and the
  always-on get_output_composition MCP read tool. Bytes are exact; token and
  dollar figures are labelled estimates.

Changed

• "CCR" reversibility surface renamed to "SROD" (Stash & Retrieve on
  Demand). The user-facing label is renamed across the Compression page
  panel, the help glossary, the savings-by-mechanism donut, and the Settings
  label; internal identifiers are unchanged.
• SROD stash previews. The opaque "Top retrieved SHAs" list is replaced
  with a "What's getting stashed" preview — a short, scrubbed, single-line
  snippet of each recent stashed body (with size and a retrieved badge), read
  from the stash dir by the stash event's body_hash. Snippets are scrubbed
  for display (the stashed body is the model's raw pre-scrub tool output);
  LRU-evicted shas are skipped.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.13.0-linux-x64.tar.gz
Linux arm64	observer-v1.13.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.13.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.13.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.13.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.13.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.13.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.13.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.13.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private