Skip to content

v1.7.27

Choose a tag to compare

View all tags
@marmutapp marmutapp released this 02 Jun 13:56
· 18 commits to main since this release
v1.7.27
178c2ac

Release headline. SuperBased Observer is now a VS Code extension.
The same observer binary that ships via npm + PyPI now also ships as
superbased.superbased-observer on the VS Code Marketplace and Open VSX,
with 5 platform-tagged VSIXes (linux-x64, linux-arm64, darwin-x64,
darwin-arm64, win32-x64) per release. The extension wraps the existing
CLI + dashboard + proxy + MCP server with a UX shell — status bar with
today's spend, sidebar with Today / Sessions / Discovery / Costs trees,
embedded dashboard webview, file-freshness decorations, budget +
watcher-lag notifications, daemon crash recovery, contributed terminal
profile that pre-exports the proxy env vars, CodeLens on
CLAUDE.md / AGENTS.md / .cursorrules, and a native Get Started
walkthrough. Zero telemetry. All seven plan milestones (M0 → M6) +
the user-walkthrough follow-up (M6.1) shipped in one session.

Added (v1.7.27)

VS Code extension

  • vscode/ — full TypeScript extension under superbased.superbased-observer
    publisher, version 1.7.27. Bundles the observer binary per platform
    via the new vscode-package matrix CI job + vscode-publish job in
    .github/workflows/npm-release.yml. 118 unit tests (~5.7 s green).
    • Binary manager with 4-step precedence: observer.binary.path
      setting → $PATH → bundled in VSIX → download from GitHub Releases
      with SHA256 verification.
    • Three-mode daemon lifecycle (observer.daemon.mode = detect | managed | auto) with lockfile safety so the extension never
      spawns a second daemon over the same database. Crash recovery via
      exponential backoff [1 s, 2 s, 5 s]; 4th failure surfaces an
      "Open Output Channel" / "Retry" toast.
    • Today-spend status bar polling /api/analysis/headline?days=1
      every 60 s. Click → open dashboard.
    • Native sidebar with four TreeViews: Today (60 s), Sessions
      (60 s + onSave), Discovery (5 min), Costs 7d (5 min).
    • Embedded dashboard webview hosting the React SPA via iframe,
      with portMapping so Codespaces / Remote-SSH work without
      operator intervention.
    • File-freshness decorations via the new /api/file/state
      endpoint — small dot in the explorer + Markdown hover with last-
      read-by, edits in 24 h, stale re-reads flagged, tools touched.
      5-min TTL cache with in-flight dedup.
    • Budget + watcher-lag notifications with sensible dedup
      (budget once/day, watcher-lag once/5 min/file).
    • Contributed terminal profile "AI Coding Tool (Observer-proxied)"
      pre-exporting ANTHROPIC_BASE_URL, OPENAI_BASE_URL, and
      ENABLE_TOOL_SEARCH=true.
    • CodeLens on CLAUDE.md / AGENTS.md / .cursorrules
      surfacing Refresh from Observer learnings and Preview suggestions.
    • Native walkthrough via contributes.walkthroughs — 7 steps
      with completion-event tracking, rendered in VS Code's Get Started
      view on first install.
    • Zero telemetry, zero outbound network calls except first-install
      binary download from GitHub Releases. All /api/* traffic to
      127.0.0.1.

Go side

  • /api/file/state?path=<abs> — new dashboard endpoint
    (internal/intelligence/dashboard/file_state.go) returning
    {last_read_at, last_read_by, edit_count_24h, stale_rereads_24h, tools_touched[]} for one file. Four single-row queries against the
    existing actions + sessions tables; no new schema. Drives the
    VS Code extension's FileDecorationProvider + HoverProvider.
    Field name pinned as stale_rereads_24h (not _avoided_24h) —
    observer flags stale re-reads via actions.freshness='stale',
    doesn't prevent them.

Release pipeline

  • vscode-package matrix CI job (5 targets) + vscode-publish
    job added to .github/workflows/npm-release.yml. Both gated on
    VSCE_PAT presence with an inline id: gate step — no-op
    gracefully when secrets are absent so previously-passing releases
    stay green. OVSX has an additional OVSX_PAT gate with
    continue-on-error: true.

Docs (v1.7.27)

  • docs/vscode-extension.md — user-facing reference (commands,
    settings, surface tour).
  • docs/vscode-extension-user-guide.md — long-form prose user
    guide (quick start, daily workflow, per-AI-tool integration for
    Claude Code / Cursor / Codex / Cline / Copilot, customisation,
    troubleshooting).
  • docs/vscode-extension-tracker.md — implementation tracker for
    the M0 → M6 + M6.1 build-out.
  • docs/vscode-marketplace-publish-process.md — canonical
    publish runbook with 7 named gotchas (G1 AzDO PAT scope, G2 indexing
    lag, G3 OVSX namespace auto-create, G4 Eclipse Publisher Agreement,
    G5 no-republish-same-version, G6 VSIX secret leakage, G7
    multi-target). Pairs with docs/pypi-release-process.md.
  • docs/release-runbook.md updated: pipeline diagram includes
    vscode-package + vscode-publish jobs; output enumeration lists the
    5 Marketplace + 5 OVSX VSIXes alongside npm + PyPI; new
    Marketplace + OVSX section with VSCE_PAT + OVSX_PAT setup.
  • .env.example at repo root + vscode/.vscodeignore belt-and-
    braces .env exclusion so secrets never ride into a VSIX.

Compatibility (v1.7.27)

  • No breaking changes. CLI surface unchanged; existing npm + PyPI
    installs continue working identically. The new
    /api/file/state endpoint is additive — pre-1.7.27 dashboard
    consumers don't notice it. The VS Code extension is a new
    distribution channel, not a replacement.
  • Marketplace listing for v1.7.27 ships with the real SuperBased
    brand icon (replacing the placeholder used for the v1.7.26
    linux-x64 smoke publish), all 5 platforms instead of just linux-x64,
    and the new walkthrough.

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform Asset
Linux x86_64 observer-v1.7.27-linux-x64.tar.gz
Linux arm64 observer-v1.7.27-linux-arm64.tar.gz
macOS x86_64 (Intel) observer-v1.7.27-darwin-x64.tar.gz
macOS arm64 (Apple Silicon) observer-v1.7.27-darwin-arm64.tar.gz
Windows x86_64 observer-v1.7.27-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.7.27

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.7.27-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.7.27

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.7.27 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private
Assets 16
Loading