SuperBased changelog

v1.32.0 - 2026-08-26

2026-08-26T00:00:00Z

Fixed

fix(retention): the daemon no longer runs unbounded full-database VACUUMs - the retention size-cap's automatic, looping bare VACUUM (which could write tens of GiB of SQLite temp files on large databases and fill the host disk) is removed from every automatic path. Size-cap reclamation is now a single bounded pass (aged-actions shed + WAL checkpoint + incremental vacuum where enabled); full compaction is operator-triggered via observer prune --vacuum, which now also requires the daemon to be down and ~2× free disk headroom.
fix(db): connection-scoped pragmas apply to every pooled connection - synchronous, temp_store, and a new hard_heap_limit memory backstop moved into the SQLite DSN (previously they were applied post-open to one arbitrary pooled connection, letting other connections spill temp files to disk with default settings). The pool is now bounded (SetMaxOpenConns/SetConnMaxIdleTime), and a regression test pins the pragma set on N concurrent connections. Applied to the node DB, the org server DB, and the edge WAL store.
fix(db): startup integrity check is size-gated - PRAGMA quick_check (which reads every page and could run for over an hour on multi-GiB databases) is skipped above a configurable size threshold (integrity_check_max_gb, default 8) with a 10-minute deadline; observer doctor db remains the explicit, authoritative integrity path.
fix(observer): cross-process maintenance lease - retention, maintenance, and codeintel-on-start acquire a flock-based lease so concurrent observer processes cannot duplicate expensive maintenance work; codeintel index-on-start gained an aggregate deadline.
perf(store): org-push snapshot queries no longer sort or scan far more than they ship - three per-tick reads fixed, each verified with EXPLAIN QUERY PLAN and selection-equivalence tests: session network events (per-session cap pushed into SQL via ROW_NUMBER() so the body join fires only on surviving rows, migration 089), session process rows (same cap pushdown, plus the per-run event count now seeks a new process_run_id index instead of aggregating the whole process_events table per tick, migration 090), and the codeintel dev + teams-tier aggregates (Cartesian-product joins rewritten to pre-aggregate per file). On the profiled node these were ~55% of steady-state daemon CPU.
fix(arena): Windows build - unix-only process-group syscalls in internal/arena are build-tagged, restoring GOOS=windows builds (and the win32 npm/VSIX artifacts).

Added

feat(observer): env-gated pprof endpoint - OBSERVER_PPROF_ADDR (loopback-only, default off, fail-soft) serves net/http/pprof for the daemon's lifetime, so steady-state CPU consumers can be named empirically.
feat(observer): temp-file watchdog + startup guidance - a background check WARNs when deleted-but-open SQLite temp files exceed a threshold (the failure mode that silently consumed ~80 GiB inside WSL), a stale-binary check WARNs when the running executable no longer matches the on-disk build, and daemon startup states that full integrity checks and compaction are operator-triggered.

Docs

Root-cause audit + remediation plan for the disk/compute exhaustion incident, and a steady-state CPU audit (pprof-named findings, a full background-loop cadence inventory, and prevention guidance) with its remediation plan - see docs/audits/ and docs/plans/ (*2026-08-26*).

v1.31.0 - 2026-08-17

2026-08-17T00:00:00Z

Added

feat(adapter): JetBrains Junie adapter - event-sourced events.jsonl capture for JetBrains' Junie coding agent, bringing the supported-tool count to 33.
feat(judge): opt-in Baseten judge provider - a Qwen 2.5 3B Instruct judge behind a budget on/off switch, for admission and eval scoring.
docs: adapter count reconciled to 33 - READMEs, package manifests, and in-product copy aligned to the 33 tools folded from the integration registry.
feat(plane-a): P1-4 remote-config and cert rotation v1 - server migration 040 org_fleet_remote_config / org_fleet_cert_events; GET/PUT /api/org/fleet/collectors/{id}/config; POST /api/org/fleet/collectors/{id}/certs/rotate (placeholder not_before/ not_after); fleet board gains remote_config_present / last_cert_event.
refactor(plane-a): telemetry bundle helper for deployment paths - telemetry.AssembleBundle is the single seam for capabilities/Doctor/ connector Test connection; handlers no longer construct CH/Parquet/SQLite adapters inline. Full Control Store rewrite (Postgres dialect across orgserver handlers) remains residual (tracker P1-7).
feat(plane-a): P1-1 FTS filter on ClickHouse query store - additive model.QueryRequest.TextQuery; ClickHouse fts_text column (DedupKey+ ServiceName) + positionCaseInsensitive filter. Trajectory (obs_traces) explorer remains without FTS - TelemetryQueryStore only.
feat(plane-a): P1-9 Doctor + demo IaC emit - POST /api/org/deployment/doctor returns {ok, probes, ingest_ok, query_matched, detail} (hot/ingest/query/ durable Probe + synthetic doctor-<uuid> batch when hot configured); GET /api/org/deployment/iac emits static Terraform/Bicep demo templates (CH URL / Blob / ACI open-webui vars, no secrets); /deployment Doctor + IaC card.
feat(plane-a): P1-7 ClickHouse HTTP adapter + JSONL durable SoR - clickhouse.Store (EnsureSchema / IngestBatch / Query / Probe via HTTP JSONEachRow; OBSERVER_CLICKHOUSE_URL or CLICKHOUSE_URL); parquet.Store filesystem JSONL under OBSERVER_PARQUET_ROOT (engine parquet_object, interim until Arrow); stubs when unset; assembleTelemetryBundle prefers env stores; POST /api/org/deployment/doctor synthetic ingest+query.
feat(plane-a): P1-4 fleet inventory + health board v1 - org-scoped collector board (fleetinventory) with healthy/stale/never_seen; GET /api/org/fleet/collectors; hosted on /deployment. Residual: remote config / cert rotation.
feat(plane-a): P1-2 entity correlation graph v1 - server migration 039 org_entities/org_entity_edges; Upsert/List/Link/Neighbors; admin APIs + /deployment entity card. Provenance taxonomy unchanged.
feat(plane-a): P1-9 Phase 2 - connector catalog + capability probes - server migration 038 org_deployment_connectors; catalog CRUD + Test connection via P1-7 capability Probe; /deployment shows resolved capabilities + connectors.
feat(plane-a): P0-10 Phase B - targeting, simulate, rollout UX - workspace/environment/service selectors on policy-resource publish (signing-bound); agent GET query attrs; POST …/simulate fleet preview; /policy rollout panel wired to P1-3 APIs.
feat(plane-a): P1-7 Phase A - engine ratification + capability seams - designate ClickHouse T1 / Postgres control / SQLite starter / Parquet SoR (harness = validation). Pure telemetry/model + five capability contracts + topology resolver; SQLite adapter; ClickHouse/Parquet NotConfigured stubs; GET /api/org/deployment/capabilities. Plan: docs/plans/plane-a-storage-ha-plan.md.
feat(plane-a): P1-9 Deployment Control Center Phase 1 - server migration 037 org_deployment_wizard; GET/PUT topology APIs; web2 /deployment wizard (SQLite / ClickHouse-recommended / existing / custom). Connectors, Doctor, IaC residual (P1-7 blocked). Plan: docs/plans/plane-a-deployment-control-center-plan.md.
feat(plane-a): P0-10 Organization Control Center Phase A - admin HTTP list/show/lint for admission.input + egress.routing_guardrail; web2 /policy gains family tabs (Guard TOML + Plane-A JSON lint→publish) with links to /fleet-state. Targeting/simulate/rollout UX residual. Plan: docs/plans/plane-a-p0-10-org-control-center-v1-plan.md.
feat(plane-a): P1-3 policy rollout + exceptions v1 (API+CLI) - server migration 036 (org_policy_rollouts / org_policy_exceptions); canary delivery via policyrollout.ResolveDelivered on GET /api/agent/policy/{family} (named + hash% cohort; waivers force baseline); admin stage/approve/promote/halt/rollback + exception routes; auto-halt from policy_state cohort rates; rollback republishes baseline as MAX+1; CLI observer-org policy-rollout. UI deferred to P0-10. Plan: docs/plans/plane-a-p1-3-policy-rollout-exceptions-plan.md.
feat(plane-a): P1-1 trajectory explorer v1 (pagination + filters) - GET /api/org/obs/trajectories gains Sessions-style limit/offset/ total plus status/source/session_id/model/provider filters over the pushed obs_traces substrate. Web2 /trajectories gains a filter row
- pager. FTS / saved views / live-tail / gateway browse / million-trace remain deferred (P1-7). Plan: docs/plans/plane-a-p1-1-searchable-trajectory-explorer-plan.md.
feat(plane-a): P1-10 production self-obs retrofit (Phases A-D) - opt-in [selfobs] (default OFF) builds a credentialed OTLP emit sink in buildProxy (Shutdown on cleanup). Routing Decide emits sampled DecisionRuns (routing_sample_n, default 32). Admission Admit, online eval (OnlineSampler.OnScored) + CLI obsEvalRun, and observer advise emit under system_agent. Conformance registry Wired:true for routing/advisor/admission/eval (insight-agent remains P2-7). Plan: docs/plans/plane-a-p1-10-production-retrofit-plan.md.
feat(plane-a): P0-5 unified policy resource v1 - org distribution for admission.input + egress.routing_guardrail (agent mig 081 / server mig 035). Signed fetch + CAS-fenced accept, enrolment-generation fence, LKG-before-listener (incl. standalone observer proxy start), steady-state poller, layered Org ownership on the shared AdmissionService, and P0-6 reporter widening (accepted_inert / delivered_unaccepted). Pure compilers live in internal/policyfam/{admission,egress}; wire in internal/orgclient + cmd/observer/policyresource_wire.go + internal/orgserver/policyresource. Codex BLOCK B1-B11 + SHOULD-FIX SF1-SF8 folded (304 revalidate, LKG pin-required, cache-tree clear on identity change, Cleared outcome slots, accepted_inert↔observe, publish BEGIN IMMEDIATE + in-txn audit, 4KiB description cap).
feat(dashboard): New Terminal dialog gains a model picker. Per-tool, capability-gated: a grounded Model ModelSpec row on the adapter's internal/integration capability declares HOW a tool takes a model (top-level flag, subcommand-scoped flag, or env var) so no consumer branches on tool name. The picker is seeded from the tool's own local session history (180-day window, recency-ordered) plus the row's grounded known models; an invalid or unsupported value is silently dropped so the tool's own default applies. goose is delivered via GOOSE_MODEL (env-only, no flag exists); kiro-cli's --model lives under its chat subcommand. openclaw and droid get no picker at all - neither has a grounded seed-time model mechanism (droid's --model exists only on its headless droid exec, not the interactive launch).
feat(terminal): New Terminal launches can run inside a bubblewrap filesystem sandbox (Linux + WSL2, opt-in, default off). New internal/sandbox (bwrap argv composition + a readiness probe) and internal/workspace (three host-side workspace sources) packages, both pure per CLAUDE.md #1 - no SQL/HTTP/os-exec, the actual bwrap and git exec calls live in the one seam, cmd/observer/terminal_sandbox.go. The private root is bwrap-only in v1 (no Docker backend); it shares the host's network namespace, so this does not block or monitor egress - a sandboxed agent can still reach the network exactly like an unsandboxed one, same provider creds and all. ~/.observer is bound read-write inside the sandbox on purpose, so the proxy route, hooks, and token capture are unaffected. Workspaces come from one of three host-side git operations before the sandbox starts - live (bind the real project dir), clone-local (git clone --no-hardlinks, so the clone can never hardlink objects back into the real repo), or clone-remote (host-side git clone <url> using your ambient auth, gated by allow_remote_clone, off by default) - plus a fourth, worktree, that ships off by default because it needs the main repo's .git bound read-write and a known pre-existing worktree-attribution bug (findGitRoot) has to be fixed first. Only claude-code has a grounded per-tool SandboxSpec (its real state directories) in v1; every other adapter is honestly reported as not sandbox-launchable rather than guessed at. A sandboxed launch request that can't actually be satisfied (disabled, backend missing/too old, userns denied, tool unmapped, workspace prep failed) fails the launch outright - there is no silent unsandboxed fallback. New observer workspaces ls|rm <id> CLI to inspect/clean up the managed workspace tree (no automatic retention sweep yet in v1). See docs/sandboxed-terminals.md.

Fixed

fix(watcher): New Terminal install→launch capture for Muse/Prime (and peers). The watcher used to freeze its fsnotify root set at daemon start via one-shot Detected(), and entered permanent idle mode when no session directories existed yet. Installing Muse/Prime (or any transcript-only adapter) from the New Terminal dialog and launching immediately left that session invisible until a daemon restart. Watcher.RefreshRoots now hot-adds newly-existing roots into the live watch set and Scans; the dashboard kicks it (with a short retry schedule) after guided install and after a successful launch; the poller's full-scan pass also re-applies roots so CLI installs recover without a dashboard kick. Empty enabled_adapters = [] still detects nothing.
fix(launchers): every observer <tool> launcher now faithfully passes arbitrary flags through to the wrapped CLI. observer claude --model sonnet previously died on a silently-swallowed unknown-flag rejection (exit 1, no output); passthrough only worked when a positional preceded the flag or after --. All 24 launcher verbs now parse their own wrapper-reserved flags manually (DisableFlagParsing + a shared parser) and forward every other token verbatim, in order. Wrapper-owned flags (--resume, --continue-from/--carry and the handoff family, --attach/--no-attach/--no-proxy, --verify, --config, --proxy, --<tool>-path, codex's process-control flags, copilot-cli's --model) keep their existing meaning and are never forwarded; malformed wrapper-flag usage now errors loudly instead of silently. Positional-first and -- invocations behave byte-identically to before. Known trade-off: shell completion no longer suggests wrapper flag names on these subcommands (a cobra DisableFlagParsing limitation).

v1.30.0 - 2026-08-08

2026-08-08T00:00:00Z

Fixed

fix(cursor): Cursor-on-Windows capture restored end to end. The hook bridge had been dead since 2026-07-05 behind stale tee-shim entries; auto-register now self-heals that file shape (loud WARN + remediation on failure, last_result/last_error persisted to hook_checksums.json), the watcher resolves project roots from .workspace-trusted with stat-gated candidate expansion, and hook payloads carrying the IDE's Uri.fsPath spelling (/c:/…) now land on the same canonical /mnt/c/… root as the watcher's rows - one project identity instead of up to six spellings of one directory.
fix(pathnorm): the /c:/ URI-fsPath drive spelling folds into the Windows-drive layer. Anchored lexical detection (never filepath.IsAbs, which is host-dependent); non-drive lookalikes (/cache/…, /cc:/…, bare /c:) are pinned untouched. Hook == watcher convergence is enforced by test.

Changed

Tool count synced to 31 everywhere, from one generated manifest. tools/toolcountgen derives the editorial adapter count from the integration registry (fold rules explicit and tested); the website hero badge, docs, READMEs, npm and VS Code Marketplace descriptions, and the extension walkthrough all read 31 now, and the accuracy checker fails on bare "N tools"/"N integrations" drift, on registry↔prose disagreement, and on the distribution surfaces that previously sat outside its scan root.
Version-scoped the stale "Cursor 3.4+ stopped writing transcripts" claims. True on 3.4.20-3.9.16 where it was measured; on 3.14.27 the transcript walker is live again and currently the sole Windows-IDE capture path.

v1.29.0 - 2026-08-07

2026-08-07T00:00:00Z

Added

feat(adapter): Meta Muse Code CLI - the 30th adapter. Event-sourced session.jsonl parsing (envelope → payload_type → event.kind) with microsecond recorded_at timestamps. model_completed.usage needs DUAL netting - input including cache_read, output including reasoning - the OpenAI-Responses convention rather than Anthropic's; a subagent run under subagent/<child-uuid>/ rolls up into its parent session. auth.json, trust.json, and tui-history.jsonl are never read.
feat(adapter): Prime Agent - the 31st adapter. Prime Intellect's Prime Agent CLI is a hard fork of pi-mono with its own parser, not a retag of the existing pi adapter. Flat JSONL sessions under ~/.prime/agent/sessions/<uuid>.jsonl form a tree via parentId (8-hex ids); the envelope timestamp is ISO-8601 while the inner message timestamp is Unix milliseconds. Usage input arrives already NET (totalTokens == input+output+cacheRead+cacheWrite exactly) - the opposite of most adapters' gross-then-netted convention, so this one is a genuine exception, not a bug. ipython is the sole built-in tool: reads, edits, and shell commands all run through one persistent Python kernel. A child agent run's usage folds into the parent's token row via the same source-event id (ON CONFLICT MAX-upgrade, never double-counted). auth.json, daemon-workers/*.json, and the pickled kernel-state.dill sidecar are never read.
feat(cli): observer muse and observer prime-agent - launcher verbs 22 → 24. Muse launches non-proxied for now; an open --base-url question blocks proxy routing until it's answered. Prime Agent launches proxied, through its own ~/.prime/agent/models.json provider entry. Both ship with the same grammar/resume-row/provider-merge conformance tests every other launcher verb carries.
feat(dashboard): plain-shell "New terminal" launch, opt-in. The New Terminal dialog can now spawn a bare shell - the child's own $SHELL, or /bin/bash//bin/sh as a fallback - instead of only a known AI-tool launcher. Off by default and deliberately independent of the existing fresh-agent toggle: [terminal.launch].allow_shell is its own opt-in, because a plain shell can run any command, a strictly larger authority grant than a capability-registry-bounded AI-tool launch. The dialog only offers the option when the daemon reports it enabled, rather than showing it and failing at launch time.
feat(dashboard,obs): Policies module - admission and egress policy authoring on the node dashboard. What used to be config-file-only setup is now a guided editor at /policies: six tabs (Overview, Templates, Guardrails, Routing, Test, Activity) covering an 11-entry template catalog across five groups (Scope, Safety, Cost, Data locality, Bundles) for one-click guardrail criteria and egress rules, plus live validate-and-apply and an activity feed. The UI states its own honesty limit rather than hiding it: the dashboard and the proxy each hold a SEPARATE AdmissionService instance, so "Apply live" only takes effect on the dashboard's own SDK front door immediately - egress edits and proxy-side enforcement need Save plus a daemon restart. Paired with a new examples/copilot-harness demo walking the whole Plane-A governance loop (admit → proxy → optional OTLP trace) end to end.
feat(store,dashboard,cli): overall session rating (1-10). A fourth session-classification primitive alongside tags, favorite, and note (migration 080): one reviewer score per session, landing as a column on the existing session_annotations row rather than a new table. 0 is the "unrated" zero value everywhere, and an annotation row is garbage-collected once favorite, note, and rating are all back to their zero states - "no row" and "reviewed and found unremarkable" stay indistinguishable, as intended. Node-local like the rest of session classification: no wire surface, no org-push column.
feat(cost,dashboard): dated pricing - recorded → dated → undated. A new per-model rate timeline lets a price change take effect without silently repricing history: usage before a cut keeps the old rate, usage after keeps the new one. First landed against a real change - the OpenAI GPT-5.6 Terra/Luna price cut effective 2026-07-30 - then rolled out across the dashboard surfaces that had been pricing every row at today's flat rate regardless of when it ran: report, budget, statusline, live, and experiments, plus two more found beyond the originally named list. Each now prefers a turn's own recorded cost_usd first, falls back to the rate that was actually in force on that turn's own timestamp, and only falls back further to the current flat rate when neither exists.
feat(website): /pricing. The site had no pricing link anywhere, and a missing price label reads as a hidden price rather than a free product. The page states what is true: the node and the self-hosted org server are both Apache-2.0 with no licence gate, so Teams can be self-hosted free today; commercial support and a managed option are in design and do not exist yet. No figures, because none are shipped. Pricing takes the Arcade slot in the primary nav; Arcade stays reachable from both footers.
feat(website): homepage rebuilt around the install command. Four competing hero subheadlines collapse to one, and npx @superbased/observer becomes the primary copyable call to action
- the site's own analytics already counted installing as the conversion while the gold button pointed at the docs. "No account · No signup · No telemetry" is promoted out of fine print. A new measurement-honesty section surfaces the public retraction, which had no link from any marketing page, alongside two entry points to the eight comparison pages, previously unreachable from the marketing site.
feat(website): FAQPage schema on the comparison pages. The docs renderer was already generic; emission was gated behind an allow-list containing only the track section. Auditing Compare and flipping one map entry adds 31 questions across 9 pages, taking site coverage from 30 pages / 151 questions to 39 / 182, with honesty parity holding by construction.
feat(website): RFC 9116 security.txt. The disclosure route existed only as prose; researchers and enterprise scanners look for /.well-known/security.txt first, and its absence reads as no process.
test(website): licensing and release-date tripwires in the accuracy gate (9 → 11 check groups). The licensing check binds to structural column identity - locate the header column named SuperBased, inspect only its cells - rather than proximity to the word, because comparison prose routinely names SuperBased and a competitor in one sentence.

Fixed

fix(integration,adapters): adapter-count surfaces move together, 30 → 31. Landing Prime Agent meant every pinned adapter-count surface had to move in the same pass - observer adapters, doc counts, and the generated website pages that state "N coding tools"
- six drift gates re-verified in sync so the number can't drift out from under the roster the way a stale "26 coding tools" once did (see v1.28.0's tool-count drift fix).
fix(vscode): observer.daemon.mode now defaults to auto. It shipped as detect, which never spawns the daemon, so a fresh install showed an empty sidebar and a warning status bar until the user found and changed a setting the README itself called "recommended for most users" - the documentation and the default disagreed, and the default won. auto attaches to a daemon you already started and only spawns when none is running, and only ever stops a daemon it spawned itself.
fix(website): three shipped claims that contradicted the site's own honesty standard. Literal [REDACTED] placeholders in the live /enterprise SSO and enrolment copy; SuperBased's own Apache-2.0 licence described as "Source-available" across nine comparison pages, next to competitors correctly labelled MIT; and npm/PyPI downloads presented as "total installs" beside a 35-star repo.
fix(website): the nav "Install free" button was unreadable. It rendered --ink-dim cream on gold at 1.52:1, in both rest and hover, on every home-layout page: the CTA sits inside .nav__links, so that rule's higher specificity beat .nav__cta and the intended dark text never applied. Now 9.14:1.
fix(website): WCAG AA contrast across both themes. Eight measured failures, worst 2.70:1, corrected by lightness and alpha only so hue and brand identity are unchanged; verified live at 77 elements per theme with zero failures.
fix(website): meta descriptions across 61 docs pages. All were past the point where search results truncate, and 16 generated ones carried a literal ellipsis mid-sentence. Composition is now budget-aware, spending what is left after the per-tool lead on the longest call-to-action rung that fits, so the marketing tail degrades and the differentiating fact survives. Median length 209 → 154, zero ellipses, all unique.
fix(website): exactly one <h1> per docs page. 62 of 95 emitted two - one from the front-matter title, one from the markdown body. Fixed in the renderer rather than the sources, because the changelog page is itself generated and would have been overwritten.
fix(website): sitemap freshness. lastmod was a hardcoded constant reused for every URL and never updated, leaving /docs a month stale; it now derives per file from git history. changefreq was "weekly" on 94 of 104 URLs, contradicting its own stale timestamps.
fix(website): missing <main> landmark and focus ring on the home-layout pages, which had neither while every support page had both.

v1.28.0 - 2026-08-01

2026-08-01T00:00:00Z

Added

feat(cli): observer statusline - one-line, fail-open, wordmarked cost status. Prints a single line - the ▞ superbased wordmark plus (when available) the current session's cost, today's total observed spend, and the active model name - for Claude Code's statusLine contract or any host tool that execs a command and reads stdout. Input precedence is piped stdin JSON, then --session-cost/--model/ --cwd flags, then OBSERVER_STATUSLINE_SESSION_COST/ OBSERVER_STATUSLINE_MODEL env vars, then nothing - segments are omitted, never rendered as a fabricated $0.00. The "today" segment comes from a new, lean GET /api/statusline daemon endpoint over a bounded, loopback-only HTTP call (--timeout, default 80ms); when no daemon is running, or it doesn't answer in time, that segment (and only that segment) is silently omitted and the command still exits 0. --no-daemon skips the daemon attempt entirely; --explain reports which data path was used to stderr; --json emits a machine-readable line. All dollar figures are estimated list-price totals, not invoiced amounts, stated once at --help and at registration time, never per-render. Registration is opt-in via observer init --statusline (writes Claude Code settings.json's top-level "statusLine" key) - never implied by --all, never auto-registered by observer start; --uninstall removes the key entirely. A Claude Code install detected only on the Windows side of a cross-OS WSL setup gets an honest WARN, not a cross-OS bridge. The VS Code status bar's live-state text also picks up the same ▞ superbased wordmark prefix (observer.statusBar.wordmark, default true, to turn it off). The daemon side adds migration 074 (idx_token_usage_timestamp) so the endpoint's "today" aggregate is an index scan, not a table scan. See docs/observer-statusline.md.
feat(cli): observer usage - zero-install one-shot cost report (the npx @superbased/observer activation path). Scans every detected AI coding tool's own local session files into a throwaway temp database, prints one tool × model cost table, and deletes the database again. Zero configuration, zero network calls: pricing is embedded in the binary and the default path never reads ~/.observer/config.toml or any OBSERVER_* environment variable, never writes any AI tool's config, and never binds a port. Flags: --since (default 30d, accepts 7d|30d|90d|all|RFC3339), --days, --group-by (tool-model|tool|model|day), --tool, --budget (default 30s, 0 = unlimited, prints an honest partial: footer on expiry), --json, --keep-db, --config (opt back into a real config and its pricing overrides), --no-progress. Bare observer now runs this same report on a machine with no local SuperBased state at all (no ~/.observer/observer.db, no config.toml, no daemon listening) - a state branch, never an invocation-channel branch - and prints the usual welcome screen otherwise; OBSERVER_ONESHOT=off always forces the welcome screen. New pure package internal/oneshot. See docs/one-shot-usage-report.md.
docs: repo-landing hygiene fixes. README gets a "Try it in one command" block (the npx/observer usage activation path, immediately above Install) and a plain, no-count "⭐ Star this repo" badge + CTA line near the top. scripts/release.sh's public-mirror re-staging now also carves out docs/deployment-models.md, docs/remote-access.md, docs/session-handoff.md, docs/cache-tracking.md, and the docs/guard-{rules,policy-authoring,compliance}.md trio, fixing four confirmed-live 404s on the public repo's README links (all three re-staging sites - the force-add list, the .gitignore negation block, and the docs_leaks sanity-check regex - kept in sync). Both README hero infographics regenerated from new versioned HTML sources (docs/assets/infographics/gen/ + render.mjs - the old images were one-offs with no source in the repo): current single-word lockup, correct counts (29 adapters / 25 MCP tools), and the proxy-accuracy / cache-attribution / routing differentiators now in the pixels. The stale 13-trajectories.png screenshot recaptured from the web2 admin dashboard's Trajectory Explorer (the node dashboard no longer hosts that page).
feat(mcp): droid + Command Code MCP registration. observer init can now register the SuperBased MCP server into Factory Droid and Command Code - one locate row + Installed probe + registry MCPTarget each, following the grounded droid pattern. Registry rows only; no new switches (integration-registry discipline).
feat(store,dashboard,web,cli): session tags/favorites/notes. New migration 075 backs a sessiontags store seam behind Execute-class routes (mutations gated the same way as every other write path), plus an observer tag/observer tags CLI with exact-first-then-index-range prefix resolution. The dashboard gains TagPill/TagEditor, star-favorite toggles, a note field, server-side tag+favorite filters, and a tags rollup panel; the rollup query is chunked past SQLite's 32766 bind-variable ceiling (cost.SessionRowsByID, capped at 900 session IDs per scope - the pre-fix symptom was cost columns silently zeroing out, not an error). Remote devices are honestly read-only for tag mutation: the only Execute-class mint is terminal-scoped and loopback, so a phone or tablet viewing the dashboard sees the classification controls disabled with a stated reason rather than a control that quietly fails. Mutations are validate-before-write atomic and single-flight; a conflicting note edit surfaces a hint instead of silently overwriting. Privacy pins cover the new columns end to end (a canary tag proven never pushed under admin_managed). See docs/dashboard-walkthrough.md ("Classifying sessions: tags, favorites, notes").
feat(announce,web,orgserver,orgclient,web2): dashboard announcements, three rails. New pure package internal/announce backs R1, a GET /api/announcements embedded rail with a dismissible AnnouncementBanner (ack tracked in sb_announce_ack, never re-shown once dismissed). R2 is a click-only npm-metadata piggyback - the superbased.announcement field an operator authors into npm/observer/package.json at publish time and the dashboard reads passively; an always-on background poll was considered and rejected for the zero-network posture observer privacy states, and the choice is written down on the measurement-honesty page. R3 is a signed org-distribution rail on the routing-policy pattern: agent migration 076 (a node-side cache) + server migration 022, a [dashboard].org_announcements gate (partial-merge default tested), and a web2 composer as the first UI consumer of the sign-and-distribute mechanism. See Fixed below for the security round that hardened R3 before it shipped, and docs/teams-operations.md §7 for the publish/retract/trust-model/opt-out operator reference.
feat(tooltax,web): canonical cross-adapter tool taxonomy. New pure package internal/tooltax (WP-T1) is a 1,074-row table across all 30 tool identities, with MCPIdentity as the one owner of MCP-tool naming - a corpus-measured slash-form convention was dropped on zero corpus evidence rather than guessed at, closing a taint false-positive class; models.IsMCPToolName now delegates to it, and the routing package's independent zero-imports pin correctly refuses the same delegation, with equivalence proven from the tooltax side instead. WP-T2 generates a TypeScript mirror (actiontax.gen.json → actions.ts as a reader) so the dashboard's category/colour data can't drift from the Go table, aligns the MCP-parser divergence to Go, and adds a taxonomy-build-drift CI job. A codex gate round then closed the real hole the first pass left open: the Go-side test suite stayed green while a hand-written TS reader could still silently diverge, so the fix is a REAL-TS parity gate that esbuild-compiles the actual actions.ts against 28 Go-oracle vectors, a generated literal category union that makes a missing CATEGORY_COLOR a compile error instead of a silent runtime fallback, and C:/-drive plus POSIX-colon path guards.
feat(mcp,cli,docs): published stable MCP local contract. docs/mcp-contract.md documents the full 25-tool tier table (18 stable, 4 conditional, 3 experimental) and observer contract --json emits it as machine-readable data, backed by conformance tests that pin it against the real server; the README gains an Integrations section pointing at it. A codex round then made the published invariants actually true: a days-parameter clamp closes a gap between the documented and enforced range, every one of the 25 tools' required parameters and all 18 stable tools' result keys are wire-checked, and the markdown drift-gate test now parses BOTH the doc and the generated mirror instead of one - the prior version could pass while blind to a real divergence between them.
feat(plugins): adapter distribution as installable plugins, Phase 1 in-repo - not yet published. plugins/plugingen satisfies the one-owner registration rule by execution rather than duplication: it runs the real observer init registrars (mcp.Registrar, hook.Registry) against a sandbox $HOME and transposes their exact output into plugins/claude-code/ (a marketplace root plus a plugin directory - plugin.json, .mcp.json, hooks.json with all 22 events) and plugins/cursor/deeplink.txt (a static, exact-config base64 deeplink, with its inherent one-click-install caveat stated rather than hidden). A byte-for-byte verify-plugins-build plus a plugins-build-drift CI job keep the generated trees honest, and sync-npm-version.sh now stamps both plugin manifests with the full semver (an opaque version pin, not MV3's numeric-core trap). Nothing is published: the superbasedapp/observer-plugins repo, the Claude Code marketplace listing, and the Cursor deeplink distribution all stay operator-gated pending a decision on a known caveat - installing the plugin alongside observer init --claude-code double-registers hooks, so both would fire on every event until that's deduped.
feat(orgserver,orgclient,web2): Teams member-invite loop, default-off. [server].member_invites (default false) lets an active admin mint a capped, audited, time-boxed invite link - server migration 023 backs the monthly cap and the invite_minted audit trail - with a web2 invite composer page and a node-dashboard nudge on the Execute-class surface. Conversion is reconstructed by joining minted_by against used_at; nothing new goes on the agent wire. See Fixed below for the security round that closed eight findings (seven fixed, one documented) before this shipped.
feat(plugins): one-command install for 20 AI coding tools, published as the public superbasedapp/plugins repo. Each supported tool can now wire SuperBased up through its own native plugin or extension mechanism instead of a hand-edited config file. The repo is assembled from this one, never hand-maintained: scripts/assemble-plugins-repo.sh runs the REAL observer init registrars (mcp.Registrar + hook.Registry) against a sandbox HOME and transposes their exact output, so a plugin manifest can never drift from what init actually writes. Coverage grew across three waves to a 52-file assembled tree: six native manifests (kimi-code, qoder, devin, droid, openclaw, antigravity - validated with each vendor's own validator where one exists), six generated config listings (crush, kiro-cli, copilot-cli, kilo-code, roo-code, open-interpreter), a Gemini CLI extension, a Goose listing, a Codex plugin + marketplace, and a Copilot vscode:mcp/install deep link. @superbased/opencode-plugin is published to npm. Cowork's .mcpb bundle is built but deliberately not claimed as supported until a live install verifies it.
feat(tooltax): a canonical tool-name taxonomy shared by every adapter. A single 1,074-row table (30 tools) is now the one owner of what each tool call is - its canonical name, category, and surface - replacing per-adapter string matching. Adapters read tooltax.For; migration 077 backfills historical rows whose action_type was unknown; the dashboard gains a /api/tools/breakdown endpoint with real category and surface dimensions; and observer adapters gains a VOCAB column reporting, per adapter, whether its vocabulary is grounded or honestly unknown.
feat(db): test runs can no longer touch your real database. db.Open now refuses any path inside the operator's actual ~/.observer when running under go test, returning ErrRealDBInTest before sql.Open. This closes a real incident in which a working-tree test resolved config.Default()'s live path and ran a migration against the 16 GB production store. The gate resolves symlinks across the full path and checks hard links via os.SameFile, guards both migration entry points (including internal/orgserver/db), and fails loudly rather than skipping when the home directory can't be resolved.
feat(orgserver,web2): GitHub Copilot seat subscriptions are finally priced. The seats API returns COUNTS ONLY, so /api/org/telemetry reported "50 seats" and the metered overage while the subscription those seats cost - normally the larger of Copilot's two cost feeds - appeared nowhere. [copilot_analytics].per_seat_price_usd existed and defaulted to $19, but nothing read it: an admin could set it and change nothing. SeatStats now carries per_seat_price_usd and monthly_usd (total × price), threaded from config through the dashboard options, and the org dashboard renders a "Seat subscription" tile plus a summary stat. Both are omitted entirely when the price is unconfigured - absent means "price not supplied", never "seats are free". The unit trap is preserved at every level: monthly_usd is a point-in-time monthly fee and is never summed into cost_usd (additive per-day metered spend) - asserted in Go, on the wire, and in every UI aggregate. A non-finite or negative price is now refused at config validation: TOML accepts the literals nan and inf without error, and inf would otherwise reach encoding/json, which refuses it after the 200 status is already sent.
feat(cockpit): burn rate on the session cost strip. A running total never answers "should I stop this?" - a rate does. The terminal cockpit's cost strip gains $/h plus a +1h projection. The rate is measured over the turns the cockpit already polls so it reflects current spend rather than being diluted by earlier idle time; the oldest fetched turn is the window boundary, so it sets the denominator but is excluded from the numerator. Falls back to the session average over the same elapsed the header shows, and returns nothing - never a confident $0.00/h - when neither basis exists.

Fixed

fix(codex): patch rows no longer land with an empty input. Modern Codex invokes apply_patch from inside an exec custom_tool_call and the executor stamps patch_apply_end with its own exec-<uuid> id, while the response_item carries call_<hash>. Different namespaces, so the join could never match on current builds and every patch row took the standalone path with no raw_tool_input. Measured over a 393-rollout corpus: 2,059 exec-uuid vs 416 call_hash. There is no join to repair, so the standalone path now reconstructs the input from the producer's own changes object, with the rendering owned in one place so a live-captured row and a backfill --codex-tool-input recovery are byte-identical. On one live update-heavy session this took empty inputs from 95 to 0.

Authored-byte accounting was deliberately left alone after measurement proved the obvious "fix" wrong: an update change carries only unified_diff and scores zero here, which looks like a bug, but every patch also emits an invocation row that already counts the same bytes from its own patch text (107 invocation rows / 142,823 B alongside 95 executor rows). Counting the diff as well double-counts every update. The reasoning is now written into the code so the zero is not "fixed" again.
fix(dashboard): Compression tiles show an em dash, not a confident zero. deriveTotals() returned an all-zero object whenever the timeseries query had no data, so five tiles rendered "$0.00 saved across 0 compression events" from the moment the page mounted - and because the loading flag also clears on error, a failed query settled that zero in as a confident, wrong answer. The no-data branch now yields undefined, which the existing null-safe formatters render as an em dash: loading keeps the pulse, an error settles to a static dash.
test(terminal): one flaked assertion can no longer kill an entire package. A cache-cleared -race sweep reported FAIL cmd/observer 2400s - the full 40-minute timeout. The cause was not slowness: TestTerminalPidSeederEndToEnd failed an assertion and then deadlocked in cleanup, because the PTY stub's Kill/Close were no-ops that never unblocked the parked reader, so Manager.Shutdown's unbounded wg.Wait() never returned. Being a serial test, it left ~340 parallel tests in the same package waiting and never run - the package reported FAIL having executed almost none of itself. The prior "green" sweep could not have caught this: cmd/observer was one of the 193/195 cached packages. With the stub honouring Close, the same failure now takes 6.9s instead of 40 minutes.
fix(dashboard): cache-savings counterfactual no longer zeroed for proxy-recorded turns. Rows with a recorded cache read > 0 contributed $0 to the "saved by caching" counterfactual, understating cache savings roughly 3× on real corpora. Found by the Show HN corpus mining pass; the memo's savings claims are gated on this fix.
fix(store): outcome-update seam hardened. Cross-tick tool_results outcome flips now persist action outcomes through ONE store-owned seam instead of per-adapter writes, closed across two adversarial review rounds (evidence-gated 1→0 self-heal included).
fix(hook,init): settings.json writer classes hardened (9 call sites). Two pre-existing defect classes shared by the hooks/cursor/ statusline registrars: the any-decode re-indent path could mangle big integers (float64), reformat numbers, HTML-escape strings, panic on JSON null, and silently collapse duplicate keys - now re-indents RAW bytes; and the read-modify-write used a fixed temp name with no lock - now unique temps + a cross-process advisory lock + re-read-after-lock. Plus: loose ownership matching tightened, symlink clobbering refused, a 5 MiB size cap, PID-reuse liveness via /proc cmdline, and oversize-stdin handling on the statusline path.
fix(hook): registrar write-path hardening, second pass. The deferred WP9 ledger: hook_checksums.json writes now take the cross-process advisory lock and rename a unique temp file (was an unlocked plain write); the codex hooks.json/config.toml writers drop their fixed .tmp names for unique-temp atomic writes under per-path locks with re-read-after-lock; and the unregister path refuses to delete a symlinked config file instead of silently unlinking the link while the target keeps stale hooks. Each pinned by a concurrent-writer or symlink regression test.
fix(adapter): foreign-mount SQLite mirror staging unified under internal/adapter/mirrorbase. Seven adapters staged cross-mount DB mirrors into persistent ~/.cache during parsing through copied helper code; the new single-owner seam scopes them, and observer usage redirects mirrors into its throwaway scratch directory (live-verified: a one-shot run adds zero cache entries).
fix(integration): npm Binary-row honesty. Dropped impossible .exe spellings from 10 npm-distributed CLI tools' Windows binary rows - npm shims install .cmd/.ps1 wrappers, never raw .exe.
feat(web): share surfaces + camera-ready wordmark + once-only star prompt. CommunityCard can share a real personal stat the user opts into ("$X tracked across N tools this month - superbased.app"), with the exact text previewed before sharing and a static-link fallback (never "$0.00 tracked"). MilestonesCard brag moments gain share/copy actions. The four hero stat surfaces (Cost, Suggestions, Milestones, Report) carry a muted in-frame ▞ superbased wordmark so a native screenshot travels with attribution - no export pipeline. A lazygit-pattern once-only GitHub star prompt appears after a week of real usage (never in demo mode, never twice). A new open-ended Feedback issue form joins the GitHub templates.
feat(cli): observer privacy - verifiable zero-network posture. Prints an honest, config-derived egress report: every listening socket (loopback-only except the opt-in tailnet remote-access listener) and every outbound path the binary can take, each with its gate and this config's actual on/off state; --json for scripting. Paired with two changes that make the claim exact: the dashboard's npm-registry update check is now user-initiated only (a "Check for updates" card in Settings → Health; no fetch on tab load, no background timer), and a new website page, /docs/reference/measurement-honesty, states the compression-savings retraction plainly and documents the provable accuracy claims that replace it.
feat(website): three new competitor comparison pages (CodeBurn, Claude Code Usage Monitor, TokenTracker), authored from a dated 2026-07-30 re-verification of every competitor claim, with steelman sections and the competitors' newest features stated fairly. New make track-build / verify-track-build + a CI drift gate; fixed a track-gen idempotency bug (marker blocks re-appended at EOF instead of spliced in place, which could permanently redden a byte-for-byte drift gate).
fix(website): tool-count drift sweep. Live compare pages said "26 coding tools" against 29 shipped adapters; the four compare pages are corrected and track-gen now derives counts from len(roster) so the class can't recur (new accuracy-check Check B2 guards it).
fix(orgserver,orgclient,store): org-announcements rail hardened before release (adversarial review, six findings, all fixed). The rail was built by cloning the routing-policy distribution rail, and cloning a mechanism cloned its weaknesses into a context that couldn't tolerate them. Three HIGHs, all fixable because the rail was still unreleased: the signature covered the body only - no version, no rail identity - so a captured signed document replayed at a bumped version froze a node's cache via its own monotonic short-circuit, an old retraction replayed cleared every banner, and because the org server has one shared signing identity, a genuinely-signed routing-policy document verified as a valid announcement. Fixed with orgcontract.AnnouncementSigningMessage (a domain tag, the version, and the body, hashed together) - the routing rail keeps its released wire shape as-is, and the residual is now tracked as ledger row ROUTING-SIG-1 (docs/security.md) instead of silently inherited. Announcement TOFU also consulted only its own rail's pin, so a node enrolled for months would accept any key on its first announcement fetch - closed in internal/orgclient/orgpin.go, one org identity now enforced across both rails. And unenrolment left a departed org's cached banner (and its pinned key) live, risking poisoning re-enrolment into a different org - store.DeleteEnrolment now clears both distribution caches. Three smaller fixes: the per-cycle poll is now stated in observer privacy instead of left implicit; both endpoints' 1 MiB caps applied to the read only and ignored trailing bytes, now orgcontract.DecodeCapped; and "[]"/"null" were a third and fourth silent spelling of a retraction, now one representation. Every fix carries a regression test proven to fail pre-fix by inline mutation against a document the org genuinely signed.
fix(orgserver): member-invite loop hardened before release (adversarial review, eight findings, seven fixed, one documented). Two HIGHs: the monthly mint cap was read-then-insert across two connections with tens of milliseconds of argon2id hashing between them, so concurrent mints could all read the same pre-mint count and all land past the cap - now one BEGIN IMMEDIATE transaction, mutation-proved by an 8-goroutine hammer test; and a SCIM-deactivated admin with a still-live SAML cookie kept minting uncapped because the admin branch returned before any liveness check - fixed both at the invite gate and, more broadly, at adminCheckerFor (AND active = 1), restoring deactivation as an authority revocation across every RequireAdminSAML route. Three MEDs: ttl_days was unbounded (a 273-year token was mintable) and is now clamped 1-90 with explicit-zero rejected rather than treated as "omitted"; the invite-lookup 404-vs-201 response was a membership oracle, now rate-limited to 20 failed lookups/hour per inviter (server migration 024, storing only the inviter id and timestamp - never the probed address); and the enrol link is now copy-only text rather than a clickable URL (the SPA has no /enrol/:token route, so navigability bought nothing and only cost exposure to link-unfurlers and mail scanners). One MED + one LOW: inviter attribution now survives SCIM deletion via a minted_by fallback, and the invite audit's source_ip no longer trusts X-Forwarded-For (new ledger row XFF-1 for two pre-existing, deliberately-deferred XFF-trusting audit sites elsewhere in the org server). One LOW documented rather than fixed: target-deletion CASCADE frees a cap slot early, recorded in docs/teams-operations.md §8.2 as needing member-lifecycle authority that already outranks the cap.
fix(adapters): model reasoning no longer files itself as a completed task. Fifteen adapters minted a separate action row - typed task_complete - every time the model produced a reasoning block, inventing 15,734 phantom "task completions" in a live corpus for work the model never did. Reasoning is not an action; it is something the model did on the way to one. Every adapter now carries it as preceding_reasoning on the successor event and mints no row at all. Threading is consumed-once, last-wins, discarded at a turn boundary, and never crosses a session id. Opaque or encrypted reasoning placeholders are never threaded anywhere. Affected: crush, hermes, cline-cli, antigravity, cursor, opencode, kilo-code-cli, codex, open-interpreter, openclaw, cline, cowork, pi, copilot, copilot-cli, gemini.
fix(dashboard): /api/status no longer saturates the daemon. diag.Snapshot costs several seconds of COUNT(*)s on a large database, and two always-mounted chrome components polled it every 5 seconds - so a scan was permanently in flight and starved every other query (measured first-load latencies reached 36 s). The snapshot is now computed behind a 15-second TTL + singleflight cache. Crucially the scan runs detached from the caller's request context: the previous fix was incomplete because the client aborts its prior fetch each tick, cancelling whichever poller held the gate and serialising the scans anyway. Degraded snapshots now carry a QueryErrors count and are returned but never cached.
fix(cursor): the reasoning stash is now safe across hook processes. Cursor is a hook adapter - one process per event - so its pending reasoning needs an on-disk carrier. The first implementation raced: under contention, 190 of 200 iterations double-threaded a thought and 8 of 200 reads saw a truncated file. It is now an atomic rename-claim protocol - writes land at a unique temporary name and rename over the target, and consumers claim by renaming the target to a nonce first, so exactly one participant can win a name. Proven under -race with multiple concurrent participants.
fix(gemini): a failed call no longer records itself as a success. A legacy-shaped failed call persisted success=1 forever. The verdict is now taken from the response body - but only for meaningful errors (non-blank strings, non-empty objects or arrays). {"error": false}, 0, [], {}, and bare booleans or numbers never invent a failure.
fix(plugins): two wrong-plugin-resolution hazards caught before publication. Both were reproduced live, not theorised. Factory's droid resolved ./superbased at the repo root to the Claude Code plugin directory - hooks and all - so the plugin was relocated to factory/superbased. qodercli plugins marketplace add likewise installed the Claude plugin via its binary's literal search order; closed with a root .qoder-plugin/marketplace.json whose schema was extracted from the shipped binary, then verified end to end.

Changed

Migration 079 deletes ~15,050 content-free reasoning rows on first run, and your action counts will drop. This is the historical half of the reasoning fix above: the (reasoning) and (encrypted reasoning, N bytes) placeholder rows written by the retired emit sites, plus their FTS search excerpts, are removed, and 7 stale cursor rows are rewritten. Those rows have no content, never had content, and were never threaded anywhere - deleting them removes rows, not information. Aggregate action counts on the dashboard will fall accordingly; this is the intended correction, not data loss. Everything content-bearing is kept, including the 329 codex reasoning rows carrying real summary text and all 15 gemini reasoning rows (deleting those was measured to be lossy). An id high-water marker is recorded in schema_meta before the deletes so the result can be re-verified afterwards. Schema golden moves 78 → 79.
scripts/sync-npm-version.sh now stamps 11 plugin-side manifests in addition to the npm and VS Code packages, with a set-equality test in both directions so a new manifest cannot be silently missed.

v1.27.0 - 2026-07-29

2026-07-29T00:00:00Z

Added

feat(adapter): three new adapters - Factory droid, Open Interpreter and Command Code (26 → 29). All three were Phase-0 grounded against live installs on WSL and Windows before any parser was written, then put through one adversarial review over the combined diff (four confirmed findings, each fixed with a revert-proof regression test - see Fixed below). All three are Tier-2 log capture: none has a verified proxy lane and none exposes a hook mechanism, so every token figure they produce is the tool's own reported number read out of its local transcript, never a proxy-exact one.
- droid (internal/adapter/droid/, models.ToolDroid) is Factory AI's terminal agent - the company is Factory AI, the product is droid, and Observer names adapters after the product. Two flat files per session and no SQLite anywhere: the JSONL transcript at ~/.factory/sessions/<dashed-cwd>/<uuid>.jsonl plus a <uuid>.settings.json sidecar. There is no per-message usage envelope anywhere in the corpus ("usage" occurs zero times across the nine captured sessions), so tokens are SESSION-level cumulative only - the goose precedent. Only the self-only tokenUsage block is emitted, under the stable id tokens:<session-id>, so a later parse of a grown sidecar rewrites the same (source_file, source_event_id) row and the store's ON CONFLICT … MAX(…) upgrade keeps the counts monotonically non-decreasing; inclusiveTokenUsage and lastCallTokenUsage are deliberately NOT emitted (both would double-count - mission child sessions get their own transcript and sidecar), and factoryCredits has no TokenBundle counterpart at all. Tier source='jsonl', reliability='approximate'. Project root comes from the inline session_start.cwd; compaction_state maps to ActionContextCompacted with its git-output snapshots dropped. The adapter never reads the ~/.factory root - auth.v2.* and the top-level settings.json carry plaintext BYOK keys - and sidecar reads refuse symlinks (a new house idiom).
- Open Interpreter is deliberately not a new package. The interpreter binary is the OpenAI Codex CLI Rust codebase recompiled under another product name, and the evidence is not circumstantial: every subcommand's --help is titled "Codex", the Rust module namespace is codex_*, the session file's base_instructions say "You are Codex", CODEX_HOME is renamed to INTERPRETER_HOME, and every token_count event's rate_limits.limit_id is still the literal string "codex". So codex.NewOpenInterpreter() retags the existing codex parser at the §2.1 boundary seam (CLAUDE.md rule 3 - branch on capability, not source identity) with watch root ~/.openinterpreter/sessions; because the on-disk shape is identical to codex's, root-based watcher dispatch is the only thing keeping the two apart. Tier 2 JSONL token_count, with gross input netted against cached_input_tokens exactly as codex's own path does. Its four SQLite stores are index/debug only and are not read.
- Command Code (internal/adapter/commandcode/, models.ToolCommandCode) is the closed-source command-code npm CLI (v1.4.5 at capture) - one binary behind four bin aliases (cmd, cmdc, command-code, commandcode), not a two-product split. Claude-Code-shaped JSONL under ~/.commandcode/projects/, with per-assistant-message usage inline. inputTokens is GROSS - it includes cacheReadTokens - so the adapter emits the netted figure, clamped at zero (mutation-proved), and carries the cached count separately. The provider's own costUsd is carried through as an estimated cost (the opencode / pi precedent) because Command Code resells ~48 mostly open-weight models through its own gateway, for which Observer has no pricing rows. .checkpoints.jsonl, meta, config and history files are excluded by IsSessionFile, and auth.json is never read.
- Registration. enabled_adapters goes 26 → 29, with one internal/integration capability row each (droid and open-interpreter probe_required; command-code after_bridge - its API-URL knob points at its own closed gateway, not an Anthropic/OpenAI-shaped endpoint), guard conformance rows, cross-OS process-attribution basenames (the cmd / cmdc aliases are deliberately excluded - they collide with cmd.exe), defaults.Adapters(), and dashboard tool label + colour rows (CIE76-checked). RegistryVersion stays at 1 by the browserchat precedent: a bump revokes aggregate consent receipts, and adding tools is not a consent-shape change. As with every new adapter, a daemon built before this release has no compiled-in support
  - rebuild and restart before expecting rows.
feat(launch): full terminal parity for the wave - 19 → 22 launchers. observer droid, observer open-interpreter (alias interpreter) and observer command-code (alias commandcode) each open a real PTY from the dashboard or a shell. Every seed and resume contract was read out of the tool's own --help on 2026-07-29 rather than inferred: droid takes the distilled handover as a trailing positional and resumes with a JOINED --resume=<uuid> (its flag declares an optional value, so a space-separated form would swallow the next argument); Open Interpreter resumes through the resume <uuid> subcommand, codex's shape, which landed as a new positional resumeTranslation shape expressed as DATA rather than a new code path; Command Code resumes with --session <id>, chosen over its optional-value, name-resolving -r. All three launch non-proxied on purpose - no proxy lane has been probed for any of them, and observer open-interpreter deliberately does not copy observer codex's openai_base_url injection. Attach, attach-by-default, Jump-in and the Session Cockpit come for free, because those dispatch on the launcher capability rather than the tool name (new-adapter checklist §3.6a). Totals after the pass, read out of the registry: 22 launcher verbs (20 seeded + 2 doc-assisted), 22 attachable, 21 of 22 with native resume - openclaw is the sole holdout, picker-only - 22 Binary rows, and 21 with at least one grounded install hint (kimi-code is the sole gap, no official channel grounded). Factory's Windows irm one-liner is deliberately NOT offered as an install hint: it is undocumented upstream.
docs: the adapter-coverage parity matrix is re-derived from code. docs/plans/adapter-coverage-parity-plan-2026-06-26.md §15 is now a 34-row matrix - every cell read out of the internal/integration registry and the launcher wiring on 2026-07-29 and cross-checked against observer adapters, with - meaning the registry's honest zero ("no grounded capability"), never "probably". It also writes down the four adapter numbers that are routinely confused and are not a discrepancy: 29 CLI/IDE/desktop adapters, 34 registry rows (the 29 plus the five browser-rail *-web tool identities, which are one package), 35 enabled_adapters entries (the 34 plus roo-code, which has no package and no row), and integration.Tools() - not EnabledAdapters - as the canonical closed tool vocabulary. docs/new-adapter-checklist.md gains §3.6a, "what a new launcher gets for FREE".

Fixed

fix(adapter): a tool result that lands in the NEXT parse tick is no longer dropped. Found by adversarial review over the wave's combined diff, not by a test: when a poll ends between a tool_use record and its tool_result, the outcome arrives in a later parse and the action had already been written without it. Both new JSONL parsers now defer - an unanswered trailing tool_use rewinds NewOffset back to that record's start (never below fromOffset), bounded by a 1 MiB tail and a 90-minute mtime grace so a genuinely abandoned session cannot pin the cursor forever. Honest scope: this fixes the two new parsers only. claudecode, qwencode, qoder, kimicode and grok carry the same latent defect, and the right fix there is one store seam (an ON CONFLICT outcome upgrade, or a ParseResult outcome-update channel) rather than five more copies of the deferral - that arc is deferred and recorded rather than quietly bundled here.
fix(codex): duplicate token and system-prompt rows when identical snapshots straddle a poll boundary. Surfaced while reviewing the Open Interpreter retag, but it is a codex bug and the fix benefits codex itself: prefetchSessionContext did not seed its dedup state from the already-parsed prefix, so a token_count snapshot whose totals were unchanged across a poll - and, separately, a re-seen system prompt
- produced a second row. It now seeds both seenModernTotal and seenSystemPrompts by a state-only prefix replay: rescan-idempotent, with no change to the SourceEventID scheme, and it closes a pre-existing codex system-prompt duplicate class along the way.
fix(dashboard): the messages-table sort survives a reload and follows you across sessions. v1.26.0 made every header sortable but the choice was per-mount state, so any reload or session switch silently reverted to chronological. The selection now persists in localStorage, is validated on read (an unknown column or direction falls back to today's exact chronological default rather than erroring), and is removed rather than written when the sort IS the default - so a stored value never out-lives the preference that created it.
fix(adapter): two smaller findings from the same review. Command Code's meta-model fallback was reachable only at offset 0, so a session first parsed mid-file never recovered its model; it is now lazy and fires at any offset. And a racy WithName mutator was removed outright - the adapter name is construction-only, so a setter that could run concurrently with a parse had no reason to exist.

Changed

test(terminal): the repaint-nudge geometry read is now pinned. v1.26.0's reconnect repaint nudge shipped with the gap written into its own commit message: the geometry snapshot must be taken BEFORE the forwarded resize (after it, the manager's snapshot has already converged and every resize misreads as identical), but nothing pinned that order, because the package's fake Snapshot() never converged - so a refactor moving the read below the resize would have passed the whole suite while nudging on every resize. A converging fake closes it; mutation-proved.

v1.26.0 - 2026-07-28

2026-07-28T00:00:00Z

Added

feat(processobs/etw): Windows per-process network accounting over ETW (W1-W4). Closes the cross-OS gap where only Linux (eBPF) could measure per-process network bytes. W1 is a pure-Go, CGO-free, dependency-free decode-only consumer of Microsoft-Windows-Kernel-Network - the manifest provider chosen over the legacy NT Kernel Logger for no singleton-session contention, fixed-width payloads (connid is win:UInt32, where the legacy MOF declares it Pointer-qualified so the width tracks pointer size) and keyword filtering. Bytes are attributed to the PAYLOAD pid, never EVENT_HEADER.ProcessId, which for kernel network events is routinely 4 (System) or 0 (Idle) because completion runs in a DPC or worker thread. TCP only, enforced structurally: TCP and UDP decode into unrelated types with no shared parent, so a UDP count cannot reach a TCP total by accident. The ABI is pinned by 26 two-sided compile-time assertions rather than tests - CI has no Windows runner and GOOS=windows go build does not compile _test.go files, so a size test would never execute anywhere. W2 adds the per-pid cumulative accumulator that reconciles ETW's PER-EVENT byte reports with the cumulative contract every consumer differentiates (16384 live entries with LRU eviction, mirroring the Linux netMapMaxEntries, plus a 1024-entry retired cache so an exit event still carries final totals), and settles the W1 open question: Linux's tcp_cleanup_rbuf(copied) maps to ETW event 11 alone, not 11+18 - summing both would double-count already-pended data.
feat(processobs,cmd,config): the elevated Windows capturer dials the daemon (ETW W3/W4). The transport direction from the 2026-06-17 spike was inverted by measurement: on a NAT-mode host, WSL→Windows 127.0.0.1 is REFUSED (it is WSL's own loopback) and WSL→gateway times out (Defender drops inbound on the WSL vNIC), while Windows→WSL loopback works via localhostForwarding. So the capturer dials a loopback listener the WSL daemon owns - no firewall rule, no host-IP discovery, no NAT-vs-mirrored probe. Auth is mandatory with no bypass: 256 bits of crypto/rand persisted 0600 beside the DB, constant-time compared, never logged, read from --token-file or OBSERVER_PROCESS_BRIDGE_TOKEN - there is deliberately NO --token flag, because argv is world-readable and this tool captures argv. New [observer.process.etw] config block. Backend selection is additive: etw selects the same baseline auto would and ADDS the listener, so an elevated feed that never arrives can never trade away working zero-privilege capture. Two real bugs were found building it - an infinite hot loop (a read error and bufio.ErrTooLong are permanent and bufio.Scanner returns them forever, latent on a pipe where EOF ends a stream, immediately fatal on a socket where a reset does) and a 30s reconnect stall, now ~1s via a hangup watcher. W4 adds capturer-link health (a TransportStatsSource + TransportUnavailableSource capability PAIR resolved into none/unavailable/configured, with the (TransportStats, bool) signature load-bearing so a Composite carrying no transport child cannot be forced to claim "a transport exists, with zero connections"), a detect-and-emit setup surface (observer init DETECTS an existing task via /Query, which works unprivileged, and emits a fully-resolved command for the operator's own elevated run - it never prints "registered", because from WSL's medium-integrity interop token /Create is refused for /RL HIGHEST and for /SC ONLOGON while a plain /SC ONCE succeeds, so it is elevation that is blocked, not task creation), and --token-file re-read per reconnect attempt so a logon-triggered task firing before WSL is up no longer dies permanently. AuthFailures counts every handshake refusal and so can never name a cause - proven live, a wire-version mismatch and port-scanner garbage both rendered as "shared-token mismatch" - so the daemon's verbatim reason now travels separately, clamped to 240 bytes, with the metric label carrying a bounded CLASS rather than the remote string.
feat(processobs,dashboard): dashboard-driven ETW capturer setup (E1-E7). The W4 arc had concluded observer init can only DETECT and emit a command; the measurement behind that still stands (schtasks /Create IS Access-denied from WSL's medium-integrity token) but the inference - "elevation cannot be self-granted" - was too strong. Elevation cannot be taken silently; it can be brokered through UAC consent. Measured on this host: Start-Process -Verb RunAs from WSL reaches High Mandatory Level, /Create /SC ONLOGON /RL HIGHEST succeeds, and the single-quoted /TR form stores correctly - the first end-to-end confirmation of the quoting rule W4 derived (the backslash-escaped form parses in cmd.exe but FAILS in PowerShell; the unquoted form stores unquoted and would launch C:\Program). New GET /api/process/etw/status (capability V, first-class states rather than errors), POST /api/process/etw/register (capability L
- confirm token, with the argv built ENTIRELY server-side - there is no request struct at all), and an ETW capturer card under Settings → Process capture. Independent review of E1-E6 raised eight findings, each reproduced with a failing test before any fix; two were real and sharp - an apostrophe in a Windows path (C:\Users\O'Brien\…) closed the /TR quote early so schtasks stored a program that was a PREFIX of the real path, and normalize() floored a negative counter to zero, turning "this report is nonsense" into "the decoder ran and refused nothing".
feat(processobs,diag,metrics): decode-classification counters, so "nothing captured" can no longer read as "healthy". Classify() routes every unknown event id to ClassIgnored, so a renumbered provider would report dropped:0 / unsupported:0 and zero bytes - passing validation while measuring nothing. New NetworkIgnored + NetworkDecoded counters and NothingClassified(); Ignored is deliberately NOT in Any(), because a healthy busy capture has a huge Ignored and folding it in would fire a fault on every working host. Separately, Health.NetworkAccountingMode / Reason were computed and read by nothing, so an operator whose probes failed to attach got silence and could not tell "measured, no traffic" from "never measured". The daemon now publishes a small node-local JSON record beside the DB (per-PID + liveness-filtered, the pattern diag.LockInfo already uses; a record whose writer pid is gone is dropped rather than called stale), refreshed every 30s because the backend only decides the accounting outcome inside Start. Both observer doctor and the /metrics exporter read it and report it AS A REPORT ("pid N said X, T ago"), never as live truth; with no daemon reporting, the observer_process_* families are ABSENT rather than zeroed, since a fabricated backend_up 0 is indistinguishable from a genuinely down backend, and the network mode is an enum series per mode so a mode flip cannot leave a stale series at 1.
- Honesty caveat, restated on every surface: nothing under internal/processobs/etw/ has ever executed. There is no Windows CI runner and WSL cannot elevate, so the Windows runtime path is compiled, vetted and lint-clean under both GOOS - not run. The six-step elevated validation is now enumerated (it had been cited in three documents and written down in none) in docs/process-observability.md §5.5 and is still owed. An idle host also produces the same counter shape as a renumbered provider; no threshold was invented in either direction, so the signal is worded as a suspicion.
feat(processobs): eBPF per-process network bytes + a high-frequency metric ring. The Linux backend attached only sched_process_exec/exit and hard-coded NetworkBytesIn/Out to zero; it now attaches fexit/tcp_sendmsg (return value = bytes actually queued, so partial sends are honest) and fentry/tcp_cleanup_rbuf. tcp_recvmsg was rejected deliberately - its arity changed between 5.x and 6.x and an fexit program must know the argument count to locate the return slot. Same pure-Go cilium/ebpf loader and hand-written asm as the existing lifecycle programs: no clang, no bpf2go, no CO-RE, no CGO. Alongside it, sampling and persistence are split into separate cadences - sample_interval_ms (2000) into memory, persist_interval_ms (15000) with a ring capped at persist_max_samples (60) - which is 7.5× finer sampling AND 7.5× fewer row rewrites, with the stored column the same size as before and independent of the sample rate. MetricSample gains net_rx/net_tx/net_measured as additive JSON on the existing ring, so no migration; old rings decode with the fields absent, which reads as unmeasured. TCP payload bytes only - no UDP, so QUIC/HTTP-3 is invisible - stated in the field docs, the config and the operator docs. NOT VERIFIED: the eBPF happy path; the authoring host runs kernel.unprivileged_bpf_disabled=2, so the programs have never been through the kernel verifier. The degradation path is verified.
feat(dashboard): live CPU/RSS/disk charts on the Session Cockpit. The cockpit's System section rendered three 48×14px sparklines with no axes, units, tooltip or time base, and three defects underneath: only ONE process was charted (measured on a real session - 458 processes, 455 with samples, 33 with the ≥2 samples a rate needs, exactly one drawn); cpu_ms, rb and wb are cumulative monotonic counters plotted RAW, and no differentiation code existed anywhere in the repo. New GET /api/session/<id>/metrics?bucket= aggregates the process subtree onto an epoch-anchored common grid, differentiates each consecutive pair with overlap weighting, and sums per-process rates (RSS is instantaneous and is summed, never differentiated). Each trap is pinned by a test: mid-window entry is a baseline not a delta against an implicit zero, mid-window exit contributes nothing after its last sample, a counter reset drops that pair for that metric only, a pair spanning >8 buckets is a sampling gap rather than a fake plateau, and a counter reading zero in every sample of every process is reported UNMEASURED. Every rate is nullable - null is a real gap, 0 is covered-and-idle - and cpu_scale is per_core_sum with cpu_cores, unclamped (real data hit 963%). The bucket is the observed median sample interval; nothing hardcodes a cadence. Rendered pixels are NOT verified: reaching the cockpit needs a live agent terminal.
feat(attach): native auto-resume on 18 of 19 launchers. v1.25.0 held auto-resume-on-daemon-restart to claude and codex. Two live PTY verification waves (bare binaries, bounded, no input typed, read-only store inspection) confirmed 15 more tools reopen the SAME transcript by the observer-captured id - opencode, kilo, cline-cli, goose, gemini, copilot-cli, pi, qwen, grok, kimi, devin, hermes, kiro, qoder, antigravity - and a follow-up authenticated run added cursor, whose chatId is our SessionID verbatim (Cursor names its on-disk chat directories with the same uuid the adapter already stores). Cursor's id is passed JOINED as --resume=<id> because the flag declares an OPTIONAL value; resumeTranslation grew a joined field for it. Implemented as 15 Resume: ResumeSpec registry rows + 5 new id mechanisms (flag:--session / --session-id / --id / --conversation / --resume-id) driving one shared table-driven cmd/observer/resume_launcher.go; claude/codex stay bespoke for their session-id/fork interplay. Grounded nuances captured in the table: gemini resumes by full UUID, goose strips the @hash8 scope suffix while announcing the stored scoped id for correlation, kimi wants the session_-prefixed id, kiro's flag rides the chat subcommand. openclaw is now the sole ResumeNone launcher (picker-only, runtime-blocked from probing). Recorded honestly: cursor's resume is flaky over some networks ("RetriableError: WritableIterable is closed"), affecting non-resume calls alike, so it is transport rather than a broken mechanism.
feat(attach,integration): the launching shell's credentials now reach an attached child. Retires the v1.25.0 accepted caveat that an attached child inherits the DAEMON's environment, so a shell-exported-only API key that worked bare vanished under attach-by-default. New Capability.AuthEnv []string carries the env-var NAMES (never values) a tool reads credentials from, with seven grounded rows - claude-code, codex, hermes, pi, copilot-cli (BYOK key plus the documented GitHub-token precedence chain), gemini-cli (upstream-verified 6-var set across AI-Studio and Vertex auth modes) and grok; every other row stays zero-valued with candidate/exclusion comments, and kiro-cli's AWS credential chain is a deliberate exclusion. forwardAuthEnv is presence-aware (an explicit empty KEY= forwards verbatim and overrides the daemon value at the child, last-wins) and wired ONCE in launcherAttach by capability dispatch - no per-launcher edits, bare launch untouched. New [terminal.attach].forward_auth_env, default TRUE. Values transit the owner-only attach socket once per launch, are never logged (count-only audit, test-pinned) and are never persisted.
feat(predict): billed tokens beside the next-message cost band. The predictor showed a dollar band and a fan-out pill with no token figure. Every dimension was already on the wire, so this is a pure read-side change - no API, no Go model, no migration. The figure is turns × (prefix + fresh_input + output), the term-for-term counterpart of the priced P·cache_read + S·input + O·output, so the tokens and the dollars count the same things; showing only "new" tokens was the tempting alternative and is wrong by roughly three orders of magnitude against the price. It is called BILLED, never "total tokens" or "context" - cache-read tokens genuinely are billed, and the cockpit already uses the same prefix_tokens field as a context-fill gauge. The composition is shown rather than hidden ("420.7K tok billed · 702 new"); a percentage was tried and rejected because 420,702 against 420,000 rounds to "100% cached". Arithmetic verified end-to-end through the real CLI against the pinned fixture: 2.0 × (210,000 + 1 + 350) = 420,702, new 2 × 351 = 702. Same figure added to the CLI band table; the docs disclose that cache-WRITE is neither read nor priced, so both the dollars and the tokens are a lower bound on a message that seeds new cache.
feat(dashboard): sortable columns on the session messages table. The table was chronologically ascending with server-side pagination, so new messages landed on the LAST page while page 1 stayed pinned to the oldest rows - following a live session meant paging manually to the end. Every header now toggles asc/desc with the DataTable arrow convention, and the sort is SERVER-side (a client-only sort would have reordered just the 25 rows of the current page). New allow-listed sort_by + sort_dir mirror parseSessionsSortParams; an absent OR unrecognised key reproduces today's exact chronological order rather than erroring. Three details carry the correctness: elapsed_ms and tps_ms/tps_basis are derived from neighbouring rows over the whole timeline, so the reorder runs strictly after those derivations and immediately before the offset/limit slice; the # column is now a server-assigned whole-timeline ordinal (seq) instead of a page-relative array index; and every comparator falls through to seq ascending, without which equal-valued rows would visibly reshuffle between 4s polls. tail=N still selects the last N chronologically and then sorts those for display, and locate computes its page in the post-sort order. Suggested-by: @smoochy.
feat(website): IA + aesthetics rework - generated marketing pages, /features and /faq. The homepage was 22.4 mobile screens and the product screenshots were hand-crops cut mid-column; the root cause the operator named is that the site had two mandatory pre-ship gates and both are CORRECTNESS gates - neither asks whether the page is any good. So docs/website-design-guide.md gains a third mandatory gate (editorial & aesthetic review, 13 items each tracing to a real observed defect) plus a quarterly cadence. The top-level marketing pages are now GENERATED from website/pages-src/*.html through one shared shell (docs-tools/pagegen) via make website-build, gated by make verify-website-build - which kills a materialised drift class, since the chrome had already forked into 4 #topnav and 3 footer variants with mismatched analytics attributes and stale build markers. The gate runs in website-deploy.yml BEFORE the strip step, not only in ci.yml, because ci.yml is a separate workflow and cannot block a deploy. The homepage goes 19054px / 22.4 screens / 1787 words → 11294px / 13.3 / 897 with ZERO points deleted: the removed prose moved to new /features and /faq pages, with the FAQPage JSON-LD moved WITH it (parity is checked by same-file verbatim presence). 20 pixel icons redrawn at 16×16; the nav and footer drop the "S" glyph for a wordmark - six chrome sources needed updating, not the three expected, because /docs, /arcade and legal/eula each carried their own lockup. Density and a11y: the privacy prose-run 4418→437px, enterprise 14 tiny fonts / 11 sub-44px targets → 0/0, all five support pages at 0/0. The public site and READMEs also gained a terminal-capability content wave (dashboard launch, Jump-in, native→local→remote lease movement, Session Cockpit, per-terminal Files/Git), a new website/docs-src/guides/terminals.md, and matching README sections regenerated through docs/distribution/README-body.md. security.html / privacy.html corrected: raw content ships under full_content OR admin_managed, not full_content alone.

Fixed

fix(web,dashboard): the mobile terminal is usable. Reported from a phone: tapping a running-terminal pill rendered the panel clipped on BOTH sides, scrolling did nothing in either presentation, and the soft keyboard offers no Ctrl/Alt/Esc/Tab/arrows. Panel geometry - min-w-[480px] beats max-w-[96vw] (CSS 10.4: min wins over max), so the box resolved to 480px on a 393px viewport and the justify-center backdrop split the overflow evenly, making the LEFT half unreachable (before: panel 480×511 @ left −43, 3 text overflows; after: 393×852 @ left 0, 0 overflows). The breakpoint is a CAPABILITY query - (pointer: coarse) and (max-width: 1023px) - so a desktop user who merely narrows their window keeps a fine pointer and is untouched; desktop geometry is bit-identical. Touch scroll was never a CSS problem: xterm gates its ONLY touch-scroll path behind !coreMouseService.areMouseEventsActive, so scrolling dies the moment a TUI enables mouse reporting - an identical 150px drag moved −30px with mouse mode off and 0px with it on. Own handlers now drive term.scrollLines() for vertical-dominant gestures on a scrollable normal buffer, so a tap still reaches the TUI as an SGR mouse report. On the ALTERNATE buffer (captured live from claude 2.1.220, which sets ?1049h with ?1000h ?1002h ?1003h ?1006h) there is no scrollback at all and the app scrolls on WHEEL events - which a finger does not have, and which is exactly why this never reproduced on desktop; a vertical drag there now dispatches a WheelEvent and lets XTERM encode it, so the writer-lease gate applies with no second input path. The on-screen key bar writes through term.input(seq, true), inheriting both the disableStdin and canWrite gates, with exact bytes asserted per button including SS3 under DECCKM. Keys are now labelled by ACTION (Interrupt / End input) with caret notation demoted to a sub-label - the operator read ^C/^D as "Alt+C / Alt+D" - and Mac labelling (⌃ Control, ⌥ Option) is driven by the DAEMON's OS via a new host_os on /api/status, not the browser's user-agent, since the browser is usually a phone that is not the machine being typed into. There is deliberately no ⌘ button: a PTY receives bytes, Ctrl+C is 0x03 on every OS, and ⌘ never reaches a terminal at all. Also: a visible "▾ Minimize" with a filled background so the SAFE exit catches the eye (all three of minimize's previous doors are shut on a phone - no hardware Escape, no backdrop under a full-viewport panel, and an icon-only ▾ carrying its meaning only in an aria-label, which left the operator believing the destructive ✕ was the only exit); horizontal swipes are now swallowed rather than declined, so the OS edge-swipe no longer unloads the whole dashboard; tap targets 19px → 44px; a Copy action, because xterm's mouse-drag selection leaves no way to get an error off a phone; and focus mode renders honestly disabled naming its missing dependency instead of vanishing.
fix(web): the on-screen keyboard costs the terminal zero rows. The first fix here rested on a wrong premise - per the CSSWG a virtual keyboard does not affect ANY CSS viewport unit, dvh included - and the second (interactive-widget=resizes-content) broke Chrome/Android touch scrolling with the keyboard DISMISSED and could not be tested at all, since the Playwright suites run desktop Chromium where the key is inert. Both are gone. Shrinking the panel turned out to be the defect itself: measured live from the operator's own session, the keyboard took the PTY from rows=29 to rows=8, and a live claude 2.1.220 driven in a PTY at fixed sizes caps its composer at 2 lines and shows only the tail at 8 rows - so a third typed line looked like it overwrote the second. Nothing was wrong with the emulation; the app was being handed an 8-row terminal. The panel now keeps its UNOCCLUDED height and TRANSLATES up instead, putting the composer and key bar at the bottom of the visible area while the row count never changes, with the header sliding off the top as the deliberate trade. The unoccluded height is the running maximum of visualViewport.height at the current width - a keyboard only ever reduces that height and never changes the width, so the maximum IS the no-keyboard height, obtained without asking any engine-specific "is a keyboard present" question. Width changes reset it, which is rotation. The two keyboard specs are inverted to pin the new contract, and the test fake's viewport snapshot (taken in an init script that runs BEFORE Playwright applies the emulated viewport, so every consumer inherited a baseline no test asked for) is now live getters.
fix(terminal): a reattached terminal renders at its own width, and repaints. Operator-reported from a phone after a page reload: every line missing its first character, that character appearing at the end of the line above - the signature of content wrapped at one width being rendered at another. Manager.Subscribe started every new subscriber at the replay ring's OLDEST byte, and the ring stores raw PTY bytes with no geometry tagging, so a session that lived at 152 columns on a desktop and later at 47 on a phone replayed both eras into whichever width the reconnecting client happened to be. The ring's absolute offset is now recorded at each real geometry change (planted in recordResize and nowhere else, so geometry keeps its single owner) and every subscriber starts at max(currentBase(), that offset). The stated trade: a genuine resize shortens the replay available to the NEXT attach - those bytes were unrenderable at the new width anyway, and already-attached subscribers are untouched. It never self-healed because the client's post-replay resize is a no-op: Linux tty_do_resize() skips SIGWINCH when the winsize is unchanged, measured directly as three TIOCSWINSZ calls and only two SIGWINCH delivered - and a full-screen TUI on the alternate buffer owns every cell and only rewrites what it believes changed, so a stale frame persists indefinitely. A one-shot repaint nudge (resize by one row and immediately back, rows-1 so the PTY never exceeds the client's real viewport) now fires once per reattach on the writer path only, skipped when geometry is unknown or when the client's resize already differs from the live size.
fix(terminal): mobile backgrounding no longer kills terminals or forces a fresh capability code. Leaving the browser to copy a code out of email tore down the view of every running terminal. The PTYs never died - unsubscribe detaches a viewer without killing the process and idle reaping is off by default - but ws.onclose latched status "exited", a terminal state, and the socket-setup effect depended only on [token, isRemote], so nothing ever reopened it; only a full page reload recovered. There is now a distinct "reconnecting" status that counts as live, retry with exponential backoff and jitter, and a visibilitychange/pageshow handler that reconnects immediately on return, with the standing-secret auto-present in onopen so control is regained with no user action. Server side, three expiries each forced a new code and each moved with a config key whose default is the new value: capability TTL 2m → 10m (two minutes is shorter than the round trip to a mail app; still single-use, still bound to session+action+handle), device-session idle 1h → 24h with the absolute cap 12h → 48h (an absolute cap below the idle target makes the target unreachable), and standing-provenance writer leases exempted from the 5m idle reap while the 30m hard cap stays. WS liveness now needs 5 consecutive missed pongs (~3.3min) rather than one, so a briefly-frozen tab is not mistaken for a dead peer; an aged-out lease DEMOTES rather than closing the socket, while a trust-withdrawing revoke still closes it outright. A revoked standing secret is classified auth_revoked (permanent, so the device clears it) while temporarily-disabled and rate-limited stay transient - previously any auth-ish denial deleted the saved secret with no retry. Negative session_ttl_minutes values previously validated clean and silently yielded the maximum; they are now rejected at load.
fix(remote): a paired phone no longer loses authorization within the hour. Returning to the dashboard from a phone gave 401 unauthorized: authentication required on every API call while the UI itself still served - a working shell with no data. handlePair set the cookie with HttpOnly, Secure, SameSite=Strict, Path / - and NO Max-Age and NO Expires, making it a BROWSER-SESSION cookie that mobile Safari/Chrome discard when they end a browsing session or evict a backgrounded tab, while the server session stayed live and simply unreachable. Root-caused by elimination against the live install, with the session table as the fingerprint: 17 rows from 24 pairings since Jul 14, ELEVEN with zero seconds between created_at and last_seen. MaxAge now derives from the store's own post-defaults lifetime via a new SessionStore.TTL() accessor, tracking [remote].session_ttl_minutes with no second constant, clamped to ≥1 (a 0 omits the attribute and silently restores the bug); nothing was loosened and no TTL was extended. This is also the true root cause of the symptom the 2026-07-25 TTL widening treated
- no server-side lifetime can rescue a credential the browser has already thrown away, which is why the defect survived that work by two days. Two adjacent defects fixed with it: restore() loaded every non-expired row with no Max check while Create hard-fails ErrTooManySessions, so the store could start above max_sessions and pairing then failed with a bare 503 (restore now keeps the Max most-recently-seen and durably prunes the surplus; the refusal is a 409 naming the revoke path); and api.ts gated 401 recovery on unsafeMethod(), which is FALSE for GET, so EVERY read had no recovery and no UX - recovery is now gated on isRemoteView() with a single-flight whoami probe and a one-shot latch, rendering a full-screen re-pair prompt on a confirmed loss and latching nothing on a probe failure.
fix(remote): the pairing audit was never wired, so mobile auth was unfalsifiable. buildRemoteController built dashboard.RemoteOptions and never set Audit, and remoteController.auditSession returns early on a nil func - so every session-lifecycle event was silently discarded: session_paired, session_revoked, terminal_control_standing_acquire, and the six reasons handlePair distinguishes. Only the DIFFERENT Options.RemoteAudit seam was ever set, which is why http_request rows existed in abundance and hid the gap. Measured on this install: the audit window 2026-07-13..2026-07-27 covers all 17 rows in remote_sessions and contains zero session_paired rows to explain any of them, so the "maybe it's the max_sessions limit" hypothesis had been untestable the whole time. Second half: a deny row could not tell a missing credential from a rejected one - Principal collapses no cookie, unknown session, expired session and failed CSRF into CapabilityPublic, and those have opposite fixes. The deny row now carries no_cookie or cookie_rejected, appended to the row that is already written so it adds no audit volume on a hot auth path. Both changes are metadata-only and neither alters an authorization decision.
fix(dashboard): /api/health/doctor withholds local paths and user names from remote callers. The route is capability V, so a paired REMOTE device could read the checks' free text verbatim - and that text carries absolute paths and user names pervasively, because most checks are built as "read X: " + err.Error() and a Go path error stringifies the whole path. Measured on a live host before designing anything, and the finding that mattered is that the disclosure is in the HEALTHY report, not just on errors: the windows proxy routes check emits the Windows USER NAME on a passing run. The sibling ETW route already withheld exactly this class, so the two were inconsistent in the ordinary case. One choke point now mirrors the ETW route: for a remote-exposed caller a pathRedactor performs EXACT-SUBSTRING substitution of roots the server already holds - deliberately NOT a "looks like a path" regex, on the precedent that heuristic predicates in this tree have shipped critical bypasses four times
- longest-root-first with dedupe, both cleaned and as-given spellings registered, roots under 4 chars discarded, and cross-OS homes from crossmount.AllHomes() given INDEXED placeholders because several homes can carry the config. local_detail_withheld is set UNCONDITIONALLY so the client knows which projection it is rendering, and the UI notice says the redaction is partial rather than implying it is complete. Named residuals: a path under no known root, OS-convention system paths left readable on purpose, and non-path identity - the org enrolment check reports the enrolled user's EMAIL, which substitution structurally cannot touch.
fix(cost,cachetrack,routing): Claude Opus 5 was unregistered and priced live traffic at $0.00. LookupWithSource MISSed claude-opus-5 because the family ladder had no bare claude-opus key and "claude-opus-4" is not a prefix of "claude-opus-5". Measured on a live node: 78 Opus-5 turns over ~3 days (16.76M cache-read + 1.26M cache-write) reported $0.00 and re-cost to $18.04 - an under-count that grew with every turn. Three registries were wrong, not one: cost/pricing.go gains an exact row at $5/$25 per MTok (cache read 0.50, 5m write 6.25, 1h write 10, web search 0.01) with FastMultiplier 2, plus a bare claude-opus family net so a future SKU inherits current rates instead of MISSing to $0; cachetrack/tier.go gains the 512-token min-cacheable tier (Opus 5 halved Opus 4.8's 1024, and Fable 5 and Mythos 5 shared the same bug, so 512-1023-token prefixes were labelled below_min_cacheable though they cached); routing/tiers.go gains an explicit TierOpusClass pin plus the seedRepresentatives opus-class swap. Adversarial review caught four pre-existing errors in the same tables, each re-verified against the vendor card: opus-4-7 was 4096 where 2048 is published (it survived because a test asserted the 4095/4096 boundary - a passing test defending the bug); claude-mythos-preview had no row and fell through to 1024 instead of 2048, erring in the dangerous direction where the engine predicts a cache write that never happens and then grades a mispredict; there were no bare claude-sonnet / claude-haiku rows, the identical MISS-to-$0 hole, added at the STANDARD $3/$15 rather than Sonnet 5's introductory rate which expires 2026-08-31; and legacy alias claude-opus-4-0 resolved through the current-gen family row at $5/$25 instead of $15/$75, a 3× under-bill. Non-shadowing was proven empirically by resolving a 277-id corpus against both the old and new tables - 259 rows byte-identical, every delta intended.
fix(policy,guard): R-155 launcher-wrapper bypass. R-155 (persistence installs) is SeverityCritical/DecisionDeny, but matchPersistenceCommand switched on Command.Base, so any launcher wrapper put the real program in a positional slot and the rule never saw it - measured ALLOW in ModeEnforce, in all three dialects, for Start-Process (positional, -FilePath, saps/start aliases, -Verb RunAs), wsl.exe -d <d> -- and cmd's start, and for the crontab / systemctl enable / Run-key arms too. Fixed at the PARSE layer rather than inside R-155: internal/policy/launcher.go resolves a launcher into the launched argv so EVERY rule inherits the coverage (verified through R-101 rm -rf /, R-110 force-push and R-153 secret-read). Three further rounds each found the same class again, each after clean mutation proofs: a bound flag computed over the whole argv SUPPRESSED the cmd-START reading (the tell was that ADDING an argument made a denied command allowed) and is deleted, with ambiguity now emitted as a full cross-product; four fail-OPEN exits became fail-CLOSED via Command.Unanalyzed, a new rule R-157 and a maxParseUnits budget; pwsh -CommandWithArgs/-cwa was absent from the host vocabulary, substitutions were never stripped under the cmd dialect at any depth, and parseDepth stopped stripping at the cap without marking - all fixed vocabulary-wide with a ~30-row psHostParams table. Found unprompted while fixing: a PANIC (seven matchers sliced Argv[1:] unguarded, so a line lexing to no words crashed the whole evaluation on attacker-influenced input), and that .NET ignores whitespace in base64 while Go rejects it, so powershell -e "<b64 with spaces>" was silently undecodable. Because mutation proofs verify the change you made and never the class, the defence is now GENERATED: TestLauncher_WrappingNeverRelaxes walks 2,385 command lines / 7,155 verdicts asserting that wrapping never turns a deny into an allow, and it found four further holes in the fix's own drafts. Recorded rather than papered over: ssh, docker run, psexec, conhost, wt.exe and Invoke-Command/Start-Job -ScriptBlock are still unresolved and still allow. The ETW setup carve-out was deliberately not widened - it now fails closed on any launcher-wrapped unit, and its predicate is a tokenizer plus closed allow-lists (subcommand must be the FIRST argument, /TN must match, the schtasks flag set is closed, the program extension must be .exe or absent, --connect must name a loopback address) after two adversarial passes each found a critical bypass in permissive parsing.
fix(processobs,termsession,store): process attribution reaches non-claude-code tools. Resource charts and process trees were blank for almost every AI tool - measured against a real DB, 101 direct-attribution rows out of ~2.67M, with session_pid_bridge holding only claude-code and hermes. Three independent causes. (1) The terminal knew the pid and threw it away: termsession spawns the PTY child and held proc.Pid only to set the process group, so a terminal launched from the dashboard - exactly where the operator clicks "Session" - was never directly attributed. It is now published through an injected OnProcess seam (nil = clean no-op) on both unix and Windows ConPTY, each pinned by a compile-time assertion, and seeded ON CORRELATION rather than on run identity, because putting a run_id in the session_id column would fabricate a session that the PROXY then stamps onto api_turns, corrupting cost attribution. (2) Attribution resolved once at exec and never again, so a correlation-time seed was a race against the poll: measured over 103 real runs, out-of-band correlation lands in 0.2-1.9s and usually wins, while discovered correlation takes 30-266s and ALWAYS lost - i.e. precisely the non-claude tools. A deferred pass now re-resolves a tracked-but-unattributed run when a seed appears and re-inherits down its subtree, upgrade-only (none<low<medium<high), bounded to the live in-memory tree with a 15-min age cut and 512 lookups/pass; steady state is zero lookups. (3) The store was erasing attribution it had already resolved: upsertProcessRunSQL wrote session_id / attribution_source / attribution_confidence unconditionally from excluded, so the exit persist wiped whatever CorrelateCrossOS had since set - and cross_os_correlation is the ONLY attribution path for every non-claude tool. Now a SQL MAX-upgrade guard mirroring the token_usage ON CONFLICT discipline, five columns gated on one shared predicate so they move as a unit. The guard stops future erasure but does not repair already-blanked rows.
fix(dashboard,web): the per-process network series reaches the chart. The network chart was invisible on Linux with the eBPF probes live and measuring, and the cause was on both sides of the wire: sampleNetworkRx/Tx were hardcoded return 0, false stubs whose comment ("MetricSample carries no network counters today") had been stale since the fields landed, forcing MetricSeriesAvailability.Network false forever; and ResourceCharts.tsx had no network chart at all - ChartSpec.dataKey was typed "cpu" | "rss" | "disk" - so the server would have emitted the fields and the browser discarded them. Both sides now land, gated on series.network exactly the way the other charts gate on their availability flags, so an unmeasured host gets no chart rather than a flat zero line that would read as "no traffic" when the truth is "not measured". ok is gated on NetMeasured alone and never inferred from the byte value; mixed rings produce an honest gap. Also fixes anySeries, which ORed only cpu/rss/disk, so a host measuring network but none of those rendered "No resource samples in the retained window." over a non-empty points array. The series is TCP-only and the chart says so.
fix(dashboard): the etw process backend is runnable, and the whole vocabulary is pinned. processBackendRunnable mirrors selectProcessBackend's construction vocabulary and had silently drifted: "etw" was correctly false while the selector returned "not yet implemented" and STAYED false after the selector began constructing a real Backend. Nothing went red, because the only coverage was a handler test asserting the OLD answer - the test defended the staleness rather than catching it. The consequence was not cosmetic: the enable verb switches a non-runnable backend to auto, so an operator who had configured backend = "etw" and granted elevation would have had it quietly rewritten, discarding the ETW feed they set up, with the response reporting success. A table-driven test now covers the ENTIRE vocabulary, each row stating the selector behaviour it claims.
fix(termsvc): a correlate-before-registration race dropped the out-of-band session link. drainOOB starts INSIDE Spawn but s.byRun[runID] is only assigned after Spawn returns, so a trusted OOB session frame could reach Correlate before the run was registered. Correlate's liveness guard exists to stop an ENDED run being resurrected, but byRun is equally empty for a NOT-YET-REGISTERED one, so a legitimate early correlation was silently discarded - and the frame is one-shot, so the link was lost for the life of the run and "Jump in" stayed blank. Not theoretical: the full -race suite failed on TestAttachCorrelationAssembledThroughHTTP. Fixed with a launching reservation taken under s.mu BEFORE Spawn and released in the SAME critical section that installs byHandle/byRun; releaseLaunching drops the reservation AND any bySession entry on the Spawn-error path plus a deferred catch-all, because an entry written while the run was only reserved would otherwise be unreachable by EndRunByHandle (keyed by handle) - i.e. fixing the bug naively would have reintroduced the resurrection leak the guard exists to prevent.
fix(hermes): observer hermes supplies a model whenever it injects --provider. The launcher prepended --provider observer and nothing else; hermes rejects that combination outright (--provider requires --model (or HERMES_INFERENCE_MODEL)) and exits before issuing a single API call, so every wrapped run died at argument validation while the same agent was healthy run natively. The bug survived live verification because the documented invocation always carried an explicit --model - the one form anybody tested was the one form that worked. The launcher now resolves a model the way hermes would, via an ordered rule table: a foreign --provider X leaves argv untouched with a not-proxy-routed warning; an already-supplied model injects the provider only; otherwise hermes' own model.default is injected alongside; and failing that, nothing is injected and the run launches unrouted with a loud notice (deliberately fail-open - injecting --provider without a model is guaranteed to fail, and refusing to launch would break a command that works natively). Also fixed while hardening the arg scanner: hermesConfigPath ignored HERMES_HOME and --profile, so with a profile active the provider entry was written to the wrong file AND the injected model came from the wrong home; the chat subcommand re-declares --model/--provider, so top-level flags were silently discarded and are now placed after chat; --oneshot and chat -q did not trip the attach-incompatible gate, so scripted headless runs were handed to a daemon-owned PTY; argparse abbreviations (--prov openrouter) bypassed the foreign-provider guard; and an option-looking token is no longer accepted as a flag value. stripUpstreamPrefix now warns once per unknown upstream id - it fails open by design but did so silently, returning an opaque 404 with nothing to debug from. Reported-by: @Pranjal-Godhat.
fix(obs): the budget-band-cheaper egress starter template routed to a retired model. It suggested claude-3-5-haiku-20241022, retired 2026-02-19, so an operator applying the template as-is would route budget-pressured end-users to a model that now 404s upstream. Swapped to claude-haiku-4-5, the documented drop-in replacement. Test fixtures and the historical pricing-registry row keep the old id by design - they price observed data, not suggestions.
fix(website): mobile visual density and three tap/overflow defects. The complaint was "the mobile site is very text-heavy"; measurement said the intuition was right but the cause was not text volume - word count is IDENTICAL desktop vs mobile and words/screen is actually LOWER on a phone. What collapses is the visual supply: text:visual 0.59 at 1280px vs 1.69 at 393px, with 6 of 13 sections carrying zero visual coverage - 6.2 phone screens without an image, diagram, chart or code block. Two mechanisms: a 16:9 embed loses height exactly as fast as prose gains it (648px at 1280 becomes 201px at 393, −69%, while the same copy grows 751 → 1963px), and the 860px collapse stacks visuals BELOW copy instead of beside it. So the fix adds visual supply rather than cutting text - nothing deleted, hidden, collapsed or reordered, which keeps the deliberately text-first indexable homepage intact: text:visual @393 1.69 → 0.879, longest visual-free run 2936 → 1023px, longest prose run 1916 → 318px, sections at 0% visual 6 → 0. The cheapest step was surfacing what already shipped - pixel-icons.js defines 20 pixel-art glyphs, loads on every page except index and arcade, and its 13 domain icons rendered nowhere. The two dashboard screenshots were 1920×1080 rendered into 355 CSS px, a 5.4× reduction putting the UI's own 13px labels at ~2.4px, and are now 3:2 detail crops whose numbers are readable. Defects: the arcade rotate-banner dismiss button was 100% unreachable at every phone width and tapping it navigated the visitor OFF the arcade (the real cause was a full-screen z-index:200 scrim on first paint, not the top bar that appeared to steal the tap); all six support pages scrolled horizontally below 344px (+21px at 320 - iPhone SE, Galaxy Fold cover), and the earlier 7px-font hack attempting this is deleted; two homepage images had no intrinsic size, reserving 0px before load for ~400px of cumulative shift; the install command - the page's primary CTA - was visually truncated and now wraps; footer legal links were 17px tall. Site download and stars figures refreshed from authoritative sources (the npm registry range API, pepy.tech for the all-time PyPI figure since pypistats only exposes a 180-day window, and the Marketplace extensionquery).

Changed

perf(db): the quick_check integrity probe is opt-IN, not opt-out. observer remote status took 3m59.971s on a 14.7GB install - not because the data was too large to read, but because db.Open ran PRAGMA quick_check, which reads and checksums every page, so a read-only status command paid a full-database verification to print a table. Measured after: 0.189s, same output. The polarity was the defect: under the opt-out spelling (SkipIntegrityCheck) the same class had already been patched three times at individual call sites - the MCP server, the daemon, and observer run (re-measured 0.16s vs >120s) - and each patch left the trap armed for the next caller. The real blast radius was never 11 files: cmd/observer's loadConfigAndDB reached 85 call sites across 40 files, every read-only reporting command among them. An opt-out flag must be remembered at each new site and is silent when forgotten; an opt-in flag fails safe. Options.SkipIntegrityCheck becomes Options.IntegrityCheck, and the loadConfigAndDB / loadConfigAndDBFast twins collapse into one function - two names for identical behaviour is how callers picked wrong in the first place. Nothing loses the probe: it runs once per daemon via RunStartupMaintenance (off the readiness path) and as observer doctor's db.integrity check, which ran its OWN quick_check all along, so doctor had been paying for it twice. The one caller that opts in is observer db import, which validates an untrusted foreign database before merging it. The schema-034 path-hash backfill also moves to a single owner (RunStartupMaintenance) rather than whichever Open happened to come first.
ci: the Windows cross-compile is gated. go test ./... never compiles a //go:build windows file and the build step's only Windows target was cmd/antigravity-bridge, so a Windows-only break in internal/processobs shipped undetected - a gap that widens with the almost entirely windows-tagged ETW backend. Compile-only; the tree was verified clean before adding, so this pins a property that already held. make test-race also gains a -timeout (cmd/observer measures 593-698s against Go's 600s default, so the release checklist's full race suite could have failed RED for no reason).

v1.25.0 - 2026-07-24

2026-07-24T00:00:00Z

Added

feat(terminal): dashboard-launched terminals joinable by default. /api/attach/sessions widened to every live daemon-owned run kind (fresh/handoff/attach/resume) - a terminal launched from the dashboard is now itself a Jump-in candidate, not just an --attach session. A handoff terminal's row keys by the FORKED session (not the source it continued from), so it's joined from the fork's session detail once correlation links it. JumpInButton's copy and newest-row selection (picking the most recently created live row when more than one matches a session) were updated to match the wider row set.
feat(attach): attach-by-default for all 19 CLI launchers. Every observer <verb> launcher (claude, codex, opencode, cursor, copilot-cli, kilo, cline-cli, hermes, gemini, openclaw, pi, antigravity-cli, qwen, kiro, grok, kimi, devin, qoder, goose) now attaches by default the same way claude/codex have - a shared launcher gate plus 19 new integration-registry Attach rows (tool key → launcher verb). Auto-resume-on-daemon-restart stays gated to the two tools with a verified native resume (claude, codex) - every other launcher gets an honest degraded-mortality notice instead (a daemon restart ends the session outright; observer <verb> --continue-from <session-id> is the manual fork fallback). Proxy env forwarding and [terminal.attach].route_proxy / --no-proxy remain claude/codex-scoped - every other tool's daemon-spawned inner launcher handles its own base-URL routing itself. Note the attached child inherits the DAEMON's environment, not the launching shell's - a credential exported only in the launching shell won't reach it (config-file/OAuth auth unaffected; export it where observer start runs, or use --no-attach). JumpInButton's verb map extended to cover all 19 tools.

v1.24.1 - 2026-07-24

2026-07-24T00:00:00Z

Added

feat(terminal): generic terminal→session correlation sweep. Closes the Session Cockpit gap where only claude-code (out-of-band, 0.95 confidence) and codex (rollout discovery, 0.75) could link a dashboard-launched terminal to its observer session - every other launcher stayed uncorrelated. A 10s daemon-side, tool-agnostic discovery pass (termsvc.Correlate) now links any LIVE uncorrelated run to a UNIQUE candidate session (matched on tool + project root + a launch-time window of [−5s, +30m]) at SourceDiscovered 0.75 confidence - unique-or-abstain with a 2-tick dwell before committing a link, and tick-wide abstention on any unsound tick (hit caps, transient failures) rather than a partial or best-guess link. Both sides are revalidated immediately before a link commits; store queries use julianday-precise window arithmetic; dashboard-handoff runs are resolved via the source session's own project root; a new integration reverse map (launcher-verb → tool) normalizes the match. Open Session Cockpit panels self-heal through the existing 15s link poll - no frontend change needed.
feat(dashboard): themed tooltips. Finished the migration to the existing floating-ui Tooltip primitive across the sidebar collapsed rail, terminal toolbars (⊙ Session/Files/Git, focus/grid/minimize/close, size-mode, standing-secret), the Launch Dock, and the New Terminal dialog - aria-labels preserved or added throughout, and the Playwright specs flipped from title to aria-label assertions in lockstep. Native <option> titles are deliberately kept as-is, and the terminal-resize modal hint deliberately stays a native title (a persistent tooltip hovering a live terminal is worse than a native one).
feat(dashboard): Tailscale setup flow. The Configuration card's "Pair a device" action now gates on tailnet reachability: disabled with the exact missing step plus a "Go to Tailscale setup" scroll-link when the tailnet is known-unreachable, and enabled-with-caution when serve status can't be detected on older Tailscale CLIs. Device-side guidance was added to the serve-active step and the QR reveal ("install Tailscale on your phone/device and sign into the same tailnet", with iOS/Android/download links). The HTTPS-consent (enable_url) path now states plainly that approval alone does not start serving, and offers a Retry serve action. docs/remote-access.md updated to match.

Notes

Adversarial review: two codex GPT-5.6 passes (all findings fixed) plus an independent Claude Opus pass (verdict SHIP; its remaining findings - bounding the forward correlation window at 30 minutes, reconciling the remote-language e2e case, reverting the resize-hint tooltip, and a watcher-lag accessibility fix - were all applied). codex usage stayed capped through this work (resets 2026-07-28); the Opus substitution was operator-approved.

v1.24.0 - 2026-07-24

2026-07-24T00:00:00Z

Added

Session Cockpit: a live per-terminal floating panel. Every embedded dashboard terminal running an AI tool gains a "⊙ Session" button that opens a compact, draggable cockpit next to the terminal - the glanceable companion to the session-detail page, not a clone of it. It shows, live: a now strip (last activity, tokens/sec with an honest measured/estimated basis badge, live process count), total cost with the AI/tool split and the next-message cost band, context fill against the model budget, token buckets, the 5h/7d rate-limit gauge (proxy-routed sessions), prompt-cache expiry countdown chips, system telemetry (CPU/memory/disk sparklines and the spawned-process tree from process observation, plus proxied API traffic with byte totals when body capture measures them), and the last five turns deep-linking into the session-detail page.
Terminal→session live linkage. New GET /api/terminal/session/<token> resolves a running terminal to its correlated observer session (id + correlation confidence, refusal-ordered so remote callers can never probe token existence); the cockpit keeps polling so a later authoritative correlation re-points the panel, and links below the out-of-band tier carry an explicit "≈ linked" badge.
One-click process-capture enable. When process observation is off, the cockpit's System section explains what's missing and offers an atomic server-side enable (POST /api/process/enable-capture): non-runnable backend selections switch to automatic with the previous value named in the notice, hosts with no runnable capture backend get an honest "unavailable on this machine" instead of a false success, and capture honestly starts only after the daemon restarts.
?tail=N on the session messages API - returns the true last N rows of the full timeline for fast pollers (explicitly rejected when combined with pagination parameters).
?summary=1 on the session network API - a server-side aggregate separating proxied API calls (with request/response byte sums from body metadata) from OS-observed process connections.
Tool-binary resolution with classified verdicts. Every embedded- terminal launcher now resolves its tool binary through a shared ladder - process PATH, then a memoized login-shell PATH capture, then native install-location probing, then (WSL only) a foreign-Windows-home check - and classifies the result as ok, ok_off_path, shadowed, foreign_only, or not_found. Fixes the class of bug where a Windows-installed npm shim shadowed (or stood in for) a native binary on WSL, and the launcher's stale process PATH meant a fresh native install wasn't picked up without restarting the daemon.
Guided one-click install. When a tool isn't natively resolvable, the New Terminal dialog shows the verified official install command and an "Install in terminal" button that runs it in a visible PTY. Gated by the new [terminal.launch].allow_install config key (default on).
observer doctor and observer adapters surface binary-resolution health, including a foreign_only bucket (tool installed on Windows only, not launchable from a WSL daemon) and a best-effort Windows proxy-route reachability check.
observer init writes Windows-side proxy routes. When the daemon runs in WSL, init can now also point a Windows-installed claude-code or codex at the daemon's proxy (localhost:8820, relying on WSL2's localhostForwarding), so accurate token capture works even when the AI tool itself is installed on the Windows side.
[launch.tools.<tool>].path config override to pin a specific binary path per tool, bypassing the resolution ladder.
Custom terminal project paths typed in Windows form (C:\Users\…) are now translated to their WSL mount equivalent before validation.

Fixed

Concurrent dashboard config saves can no longer lose updates. All in-process config read-modify-write paths - section saves, pricing, backup restore, remote-manage toggles, terminal limits/policy, experiments, and the admission-policy persister - now serialize on one shared lock in the config package (cross-process CLI writes remain outside a mutex's reach and are documented as such).
The attach-replay bound test no longer flakes on slow runners (the precondition now waits for the pump to drain the full produced stream).

v1.23.0 - 2026-07-23

2026-07-23T00:00:00Z

Added

superbased CLI alias. The binary now also runs as superbased, selected from argv[0] - observer is unchanged and stays canonical (no deprecation yet). npm and PyPI ship superbased alongside observer as console entry points, and release tarballs/zips include a superbased alias next to the observer binary.
First-run guided dashboard tour. A spotlight-and-coach-mark walkthrough (Overview → Live → Sessions → Cost → Cache → Terminals → Security → Settings → global filter/help) auto-starts once on new installs and is replayable any time from the Help drawer or the command palette.
Per-terminal Files/Git project explorer. Every dashboard terminal (floating window or grid tile) gets Files/Git panel buttons: a read-only file tree + viewer and a git view (branch, ahead/behind, changes, 100-commit history). Panels are floating, draggable, multi-panel windows
- one per terminal, open simultaneously - with a right-click context menu to copy the selected path (relative or absolute) and, on a live write-capable terminal, paste it straight into that terminal.
Authenticated remote terminal takeover. A fully-authorized remote dashboard can now take over control of a terminal from a local/native writer or from another remote seat, completing the native → local → remote handoff. Default-on; see the config change below.
Playwright e2e regression suites covering the guided tour, terminal key/paste handling, and the new project panels.
VS Code extension lint gate. npm run lint (eslint) is now runnable in the extension's dev workflow; dev-only, not part of the packaged extension.
Pricing: the 2026 model-release wave. ~35 new cost-engine rows for Claude Mythos 5 (Fable-5-equivalent pricing); the Qwen 3.5 family (plus/flash/omni-plus/omni-flash) plus 3.7-Plus and a 3.8-Max-Preview placeholder row (no published rate yet - anchored to 3.7-Max's exact price pending an official card); GLM-5.2; MiniMax M3; Tencent Hy3; StepFun Step-3.5-Flash; ERNIE 5.1; ByteDance Seed 2.0 (provisional, Volcengine has no official card yet); Meta Muse Spark 1.1; Cohere North Mini Code (genuinely free); Sakana Fugu Ultra; Thinking Machines Inkling; Jamba Mini 2; Gemini Omni Flash; and Sarvam (free). A researched-but-not-priced ledger is kept in code comments for models with no public rate card (Cohere Command A+, the original pre-1.1 Muse Spark, Phi-4-reasoning-vision-15B, Falcon H1R 7B) so they aren't re-researched needlessly.
Website repositioned around the AI-agent control-plane story. superbased.app now leads with seeing agents' actions and provider- reported token usage across 26 tools, then controlling the supported sessions (dashboard terminals, paired-device session attach/takeover, model routing, egress guardrails); four decorative Canvas animations from the marketing library embed on the homepage (prefers-reduced-motion-aware, pause when hidden/offscreen). "Observer Quest" renamed "SuperBased Quest". 12 README + 3 website dashboard screenshots refreshed against the current UI.

Changed

[remote].allow_terminal_view now defaults to true. A paired, authenticated remote device can view (read-only) attach/resume terminal output by default; set it to false to restore the prior deny-by-default posture.
New [remote].allow_remote_terminal_takeover, defaults to true. Pairs with the takeover feature above; set it to false to keep refusing a remote takeover of an existing writer.
[terminal].idle_timeout now defaults to "0". Idle embedded terminals are no longer reaped after 30 minutes of no PTY I/O (a quiet agent sitting at its prompt was being killed mid-session); set it back to "30m" to restore the old cleanup behavior.
Product renamed "SuperBased Observer" → "SuperBased" in prose and UI only. Every technical identifier - the observer CLI, package names, the [observer] config section, ~/.observer, the observer.db filename - is unchanged. VS Code extension display strings (command titles, activity bar, output channel, notifications) were renamed the same way; the Marketplace listing name updates at the next publish.

Fixed

observer run no longer mangles multi-line commands or shell builtins (cd, export, …) when wrapping them for hooks, and the wrapped command now skips the daemon's integrity check on that path - about 750× faster to start (measured 0.16s vs. over 120s against a large database).
STT/dictation paste into the embedded terminal: xterm.js was silently canceling plain Ctrl+V, so dictation tools' fallback paste landed a stale clipboard instead of the transcription; plain Ctrl+V now reaches the browser's native paste handling.
Terminal-dock drag gestures: an interrupted drag (pointer cancel or lost pointer capture) can no longer leave the gesture armed for a later stray pointer move to resume from a stale origin.

v1.22.0 - 2026-07-21

2026-07-21T00:00:00Z

Added

Take control back at your native terminal. The missing leg of the session-control triangle: after a dashboard Jump-in, just start typing in the terminal that launched the session (observer claude/codex) - the daemon returns the writer lease, delivers that keystroke, prints a one-line notice, and re-pushes your terminal's geometry so a TUI the dashboard left at foreign dimensions heals in the same gesture. Machine bytes never reclaim (terminal emulators auto-answer TUI queries on stdin); arrow keys or a bare ESC alone won't either, by design. Config: [terminal.attach].reclaim_on_input (default on). The dashboard seat goes honestly read-only - "control returned to the native terminal - click to take back".
Original-size restore for broken TUIs. The daemon now tracks each session's launch-time and current PTY dimensions; every dashboard terminal gets a fit / original-size toggle that pins the launch geometry (auto-refit suppressed) to recover a TUI corrupted by resizes, and a seat re-asserts its own geometry whenever it regains control.
Keyboard shortcuts reach the dashboard terminal. Ctrl+A/E/K/. and friends now go to the TUI instead of the page while the terminal is focused; Ctrl+Alt push-to-talk chords pass through untouched; copy-with-selection stays native. Browser-reserved keys (Ctrl+W/T/N) honestly can't be intercepted in a normal tab - the new fullscreen focus mode (Keyboard Lock, Chromium) is where they reach the TUI.
Watch a bare session read-only. Sessions started outside observer (plain claude, codex, …) that are actively producing events now show a "live · watch" badge: a read-only, auto-following view of the conversation (4s refresh, stick-to-bottom) in the session panel. "Jump in" stays honestly disabled - a bare launch's terminal belongs to the shell that started it - with "Watch instead (read-only)" offered in its place.
Collapsible sidebar. The dashboard's left nav collapses to a compact icon rail on desktop (persisted, tooltips); the mobile drawer is unchanged.

Fixed

Post-v1.21.0 CI red: six golangci-lint findings in the release's new code (behavior-preserving refactors) and the missed website version sweep.

v1.21.0 - 2026-07-21

2026-07-21T00:00:00Z

Added

Browser-chat capture (opt-in MV3 extension). Full-detail capture of ChatGPT, Claude.ai, Perplexity, Gemini, and consumer Copilot web sessions from Chrome (WSL + Windows) via a native-messaging bridge into the new browserchat adapter - prompts, responses, models, and estimated tokens, with best-effort redaction and health telemetry (observer browser health). Load-unpacked only for now. See docs/browser-extension.md.
Session attach: join and drive live sessions from the dashboard. Observer-launched claude/codex sessions are daemon-owned PTYs the dashboard can now join ("live · joinable" badge → Jump in), while your native terminal stays fully interactive. Closed sessions gain one-click native Resume (observer claude --resume <id> composed server-side) from the session panel. Remote (paired-device) viewing of attach/resume terminals stays deny-by-default behind the new [remote].allow_terminal_view read opt-in.
Resilient default-on attach. Interactive observer claude/observer codex launches attach by default when the daemon is reachable ([terminal.attach].default_on, Settings-togglable; --no-attach opts out per launch). Graceful daemon restarts stamp a durable end_reason (migration 072) and the attach client offers prompt-with-timeout auto-resume onto the same transcript; every skipped default-attach prints an honest one-line reason.
Terminal Workspace dock grid. The Terminals page is now a workspace: an auto-compacting responsive grid of live terminals - drag tiles by their header, resize from edges, add running sessions from the tray, "⊞ Add to grid" directly on any floating terminal window, "⬈ Open as window" to undock a tile back into a user-resizable, size-persisted floating window. Layouts persist server-side (node-local workspace_layouts, migration 073) and render read-only on paired remote devices. Honest close semantics: "Remove from grid" keeps the session running; "Stop & close" actually ends the process. [terminal].max_concurrent default raised to 9. Existing policy/status/history content lives under a Settings tab.
Standing-access hardening toggle. Opt-in [remote].revoke_standing_on_takeover: a desktop takeover of a remote writer that held control through the standing secret also revokes the standing secret itself (identical teardown to the explicit revoke). Default stays seamless - takeover revokes only the live lease.

Fixed

Daemon-down no longer breaks claude launches. observer init bakes the proxy route into claude's own settings.json, which outranks the process environment - so a "bare" fallback launch used to route API calls into a dead proxy. The launchers now resolve the effective route across every settings scope claude honors (managed/CLI/local/project/user, including inline-JSON --settings and --continue-from working directories) and neutralize observer routes with a one-shot CLI-scope --settings override (signal-safe temp file); un-overridable cases (managed scope, your own --settings, codex's config-file route) refuse with copy naming the exact fix. Third-party gateway routes are always honored, never clobbered.
"Stop & close" now actually stops the process. Since detach-replay, a websocket close only detached the embedded terminal; every stop control now issues the explicit server-side reap.
Mobile layout no longer breaks on long project paths. One shared tail-preserving truncation primitive (ellipsis at the head, leaf visible, full path on hover) across all pages, plus explicit horizontal-scroll containment on the Overview table.
Terminal runs killed by a daemon shutdown no longer show as running forever in the run history; floating-terminal resize no longer minimizes the window on release.

v1.20.0 - 2026-07-17

2026-07-17T00:00:00Z

Added

Remote dashboard + terminal control (Phase 4, explicit opt-in). Drive a node from another device over your tailnet: multi-device pairing, a draggable launch dock, in-dashboard terminals, and a mobile-friendly dashboard layout. Remote execute (launching AI tools / running terminal commands from the dashboard) is gated behind an explicit standing grant ([remote].allow_standing_terminal_control, default off) with per-session terminal leases, fanout bounds, revoked-lease handling, an execute-tier CSP, and a full audit lifecycle. Tailnet-only; nothing is exposed to the public internet. See docs/remote-access.md.
Process-network body capture + attribution wave. For observed processes routed through the proxy, capture proxied/plaintext request/response bodies into the new process_network_bodies store (agent migration 067) - never a claim of TLS visibility. Broader process observation and attribution: five adapters seed the pid bridge directly, a background attribution sweep and per-wave basenames tighten which session a process belongs to, and the dashboard gains process + raw-events surfaces. See docs/process-observability.md.
GPT-5.6 / OpenAI cache-write token capture. The proxy now parses input_tokens_details.cache_write_tokens from OpenAI/Responses usage (both the provider and streaming paths), nets cache-write against gross input correctly, and feeds the cachetrack engine so implicit-write events are observed instead of silently dropped. Wire field + expiry semantics documented in docs/general_info/openai_cache_expiry.md and docs/cache-tracking.md.
Dashboard time-window dropdown. A new date-range control adds 1h / 12h / 1d windows plus explicit custom ranges alongside the existing options, resolving since/until with hours taking precedence over days. The range params thread through every dashboard page.
Benchmark integrity: retry-as-attempt + ephemeral runs. Each retry is now recorded as its own attempt (agent migration 068) so benchmark integrity reflects real attempt counts instead of collapsing retries. New ephemeral runs execute without persisting into the main corpus.
Compression: no-drop capability + honest lossy-eviction display. A new disable_drops capability lets the codex-safe recipe compress without lossy content eviction. All lossy eviction now routes through one classifier owner, and evicted bytes are subtracted from reported compression savings so "saved" reflects genuine, retrievable compression only - evicted content is surfaced additively (still recoverable via search_past_outputs markers, never counted as a saving).
M365 Copilot org analytics + browser-extension capture fixes. New observer-org m365 command and M365 Copilot analytics surface (Graph auth + surface_graph) on the org server - server-side only, never on the agent wire. Browser-extension capture (native-messaging host + service worker + the loopback ingest receiver) is fixed, with per-browser/per-OS host manifest writers including Windows registry hostfiles.
[dashboard].addr config knob (#8). The dashboard bind address is now configurable via [dashboard].addr (and the OBSERVER_DASHBOARD_ADDR environment override).
Kimi K3 model pricing added to the cost engine and the settings surface.

Changed

Codex fork/subagent token de-duplication + session lineage. Replayed fork/subagent turns are now skipped so a forked Codex session no longer double-counts tokens already attributed to its parent. New parent/child session-lineage tracking (agent migration 069, surfaced in the session-detail panel) makes the relationship explicit, and the new --codex-fork-dedup backfill pass reconciles historical fork double-counting.

Fixed

VS Code extension activation stall (#5). Fixed extension activation and observer-binary resolution; a new preferPathBinary setting lets the extension use a PATH-resolved observer instead of its bundled copy.
Codex 16 MiB record limit (#7). The Codex JSONL scanner's 16 MiB record cap is replaced with a shared readRecord (64 MiB bound + per-record skip) so an oversized record no longer aborts a whole session parse.
Prune now reclaims disk space. observer prune actually reclaims disk instead of only shedding rows, and startup latency previously spent in on-open integrity work is cut.

Upgrade notes

Agent DB migrates to schema 69 (migrations 061-069); the org server stays at schema 21 - both automatic.
Restart the daemon via the safe order (route off → stop → relaunch → route on; scripts/restart-daemon.sh) so the new binary and migrations load.
Remote execute + standing terminal control stay fully inert until you set [remote].allow_standing_terminal_control = true; pairing and remote viewing are tailnet-only.
Run observer backfill --codex-fork-dedup (or observer backfill --all) to reconcile historical Codex fork double-counting.

v1.19.0 - 2026-07-11

2026-07-11T00:00:00Z

Added

Email notifications. New [email] config block (stdlib SMTP: STARTTLS/implicit-TLS, AUTH PLAIN/LOGIN; default off, fail-soft - a delivery failure never affects evaluation). Rides the existing alert evaluators: org budget alerts, org obs-alert rules, and node-side [observability.alerts]. See docs/email-notifications.md.
Scheduled cost digests. Weekly/monthly digest emails on both the node ([digest]) and the org server: period spend, per-model/per-project (org: per-developer) breakdowns, movers vs prior period. Restart-safe send-once de-dup via the new digest_state table (agent migration 060, server migration 021). Test on demand with observer digest send --dry-run / observer-org digest send --dry-run.
Shareable cost card. observer report share [--period week|month] [--markdown] renders a 1200×630 SVG social card + markdown summary of your observed spend (period total, cache-read share, model/tool leaderboards). Aggregates only - project names/paths never appear (pinned by test). No network.
Admin dashboard (web2) onboarding & navigation. First-run checklist for a fresh org server, command-palette data search (teams / projects / people / recent sessions), teaching empty states across pages, breadcrumbs on detail routes, and sidebar count badges.
Plane-A general-observability upgrades. web2 Admission center (/trajectories/admission, read-only policy viewer) + T6 admission org-wire tier ([org_client.share.obs].admission, default off; server migration 019) with audited deep reads; T7 per-item eval tier (.eval_items, server migration 020) with per-item EvalRun detail and run-vs-run compare; per-end-user spend page; node-side alert evaluation for share-off deployments ([observability.alerts], default off); LLM-judge robustness (map-reduce chunking, per-criterion prompts, hardened client) + observer obs admission verify; SDKs attach prompt/response content by default (OBSERVER_CAPTURE_CONTENT=0 to disable) and target the correct node port :8081; POST /policy?persist=1 write-through.
M365 Copilot org-tier connector (server-side native-console poller, server migration 018; never on the agent wire).
Browser-chatbot capture extension (preview). Opt-in MV3 extension capturing ChatGPT / Claude.ai / Perplexity / Gemini / consumer-Copilot web chats via a native-messaging bridge (observer browser hook). Load-unpacked only for now - not yet published to the Chrome Web Store; all token counts are estimates.
Website. Text-first, fully indexable homepage (the Observer Quest arcade lives on at /arcade); product deck at /deck with a downloadable PDF; 28 per-tool "track costs" pages generated from the adapter registry; 6 comparison pages; 21-term glossary; a public two-planes explainer; llms.txt + JSON-LD + an explicit GEO robots posture (retrieval crawlers allowed, training crawlers opted out).

Changed

READMEs and store listings overhauled around the durable story: proxy-accurate billed-token attribution, local-first privacy, free node → team layer. One true adapter count (26) everywhere; npm/PyPI/VS Code listing descriptions rewritten; MCP tool census corrected to 25 (21 always-on + 4 conditional) and docs/mcp-tools.md fully rewritten.
Org-server retention is now enforced. server.data_retention_days (default 730) actively prunes: upgraded org servers begin deleting rows older than the configured window (identity/config/audit/guard-chain tables are never pruned). Set the knob before upgrading if you need longer retention.
Guard alerting (desktop toasts, Slack/Discord/PagerDuty webhooks) and process observability are now documented on the main surfaces.

Fixed

VS Code walkthrough listed a nonexistent "Continue" adapter; stale "seventeen tools" counts across README/website/listings; dead help entries in the node dashboard; org migrate-test schema assertion; a date-dependent test (TestAggregateForOrg) that failed once its hardcoded day aged out.

Upgrade notes

Agent DB migrates to schema 60; org server to 21 - both automatic.
Restart the daemon via the safe order (route off → stop → relaunch → route on; scripts/restart-daemon.sh) so the new binary and migrations load.
Email/digests stay inert until you set [email].enabled = true plus the per-consumer opt-ins.

v1.18.0 - 2026-07-10

2026-07-10T00:00:00Z

Added

observer devin --continue-from launcher. Devin CLI joins the session-handoff launchers: observer devin --continue-from <session-id> distills a handover and seeds it as Devin's first prompt. Devin takes its prompt as a clap last-only positional after the -- separator (devin -- "<prompt>", operator-verified on a real TTY), so the launcher uses a new injectTrailingPositionalAfterDashDash inject kind. The launch is seed-only and non-proxied (Cognition backend, native_exempt, no base-URL knob); child.Dir is threaded from the continue-from cwd per the cross-OS handoff contract. The launchable set grows to 19 launchers (17 Seeded + 2 DocAssisted); the Devin registry row gains InjectPrompt
- Launch and drops its unverified-seed caveat.

Changed

qwen-code promoted to a live, observer-driven proxy route. qwen-code resolves its active model by the (id, baseUrl) pair, so rewriting model.baseUrl alone was ignored when it matched no modelProviders entry - the grounded 2026-07-09 probe failure (qwen fell back to api.openai.com and bypassed the proxy). RegisterQwenCode now also retargets every OpenAI-lane modelProviders entry on the known default host to the proxy URL, keeping each entry's id + envKey untouched, tolerating both live schema shapes (array + object form), and synthesizing an entry only when none matched (same guard matrix: refuse-foreign-URL, idempotent, .bak, temp+rename, ConfigMissing skip; API keys never touched). Live-verified 2026-07-09: a qwen -p turn through :8820 landed api_turns 23728-23730 (gpt-4o, provider=openai). The registry row is promoted to routable_now with an observer-driven Proxy route; ProxyProbe is KEPT - it remains the persistent config-lane writer observer init dispatches on.
GPT-5.6 cache/effort grounding closed against live traffic. A live gpt-5.6 session (019f4801) confirms the launch pricing: the model ids gpt-5.6-{sol,terra} hit their pricing rows exactly and a live terra turn recomputes to the stored cost to the digit; no effort levels beyond low/medium/high manifested. NO cache-write usage field exists on the Codex wire - only cached_input_tokens (read discount). OpenAI docs confirm the write tier we priced (1.25× uncached input, 90% read discount, 30-min minimum TTL, explicit-breakpoint mode), but Codex's ChatGPT-plan credit formula has no write term, which is why the field never appears on our wire. The shipped write-tier pricing therefore stays present-but-dormant and harmless, and parsing a cache_write_tokens field is deliberately DEFERRED until the netting semantics can be arithmetic-grounded on live traffic - additive billing without grounding would repeat the reasoning-double-bill trap. docs/cache-tracking.md gained a GPT-5.6 cache-expiry subsection.

Fixed

Codex reasoning tokens were double-billed. The OpenAI/Codex wire reports GROSS output_tokens with reasoning as a subset (input + output == total on every live token_count event - arithmetic-verified on gpt-5.6 traffic). The codex adapter emitted that gross value alongside ReasoningTokens, and the cost engine's additive reasoning-at-output-rate rule then billed every codex reasoning token twice. The adapter now nets reasoning out at both emit sites (clamped ≥ 0, mirroring the netInput pattern), and TokenBundle.Reasoning gained a hard documented precondition: netting is a per-wire property - OpenAI/Codex fold reasoning into output (subset), whereas gemini/antigravity report it disjoint (the additive rule is correct only for disjoint wires). Migration 058 corrects the stored history one-shot (1,991 gross codex rows / 436k double-billed reasoning tokens on the reference node): historical rows are corrected automatically at the first startup of the upgraded binary, because a rescan cannot lower counts past the ON CONFLICT MAX-upgrade and the run-once ordering makes the subtraction idempotent by construction. Scoped to tool='codex' only - gemini/antigravity are disjoint-correct.
grok ACP update content was dropped when polymorphic. tool_call_update content arrives as an array of text/diff blocks (and rawOutput.output as a byte array); the single-object decode dropped 38 records across the two fresh captures. search_replace (grok's in-place edit) was also unmapped and landed as unknown; it now maps to edit_file (with defensive deletefile/removefile handling - grok exposes no distinct delete tool). Rescan: warnings 38 → 0, unknown 2 → 0.
Adapter rescans now reclassify action_type from the unknown sentinel. insertActionSQL's ON CONFLICT clause never refreshed action_type, so a rescan (observer scan --force) could not reclassify rows stored as unknown before a mapping fix landed - which blocked the grok search_replace fix above from healing the two live unknown rows. The conflict clause now upgrades only unknown → a real type; it never rewrites one known type to another and never downgrades to unknown/empty (all three invariants pinned by table-driven tests).

v1.17.0 - 2026-07-09

2026-07-09T00:00:00Z

Added

Nine new tool adapters - the 10-tool adapter wave (freebuff descoped). Observer now captures 26 adapters total. Each new adapter ships with a testdata fixture, an operator doc, an integration-registry row, a dashboard tool color, and a docs/cross-adapter-schema-mapping.md section (§3.11-3.19):
- qwen-code - Qwen Code CLI (Gemini-CLI fork), Claude-Code-shaped JSONL under ~/.qwen; GROSS input netted against cached.
- kiro-cli - AWS Kiro CLI; mode-dependent dual store (interactive flat bundles vs --no-interactive SQLite conversations_v2 keyed by the RAW cwd, translated through crossmount); SigV4, native-exempt.
- crush - Charmbracelet Crush; project-local .crush/crush.db discovered via projects.json; Unix-SECONDS timestamps.
- kimi-code - Moonshot Kimi CLI; wire.jsonl usage.record (inputOther is already NET); no seed lane (DocAssisted only).
- grok - xAI Grok CLI; 8-file ACP session bundles, with per-request token splits pulled from the GLOBAL ~/.grok/logs/unified.jsonl correlated by sid (no timestamp heuristics).
- devin - Devin CLI; SQLite message_nodes TREE walked along main_chain_id to dedupe regeneration branches so tokens never double-count; per-message metadata.metrics tokens.
- aider - Aider; per-repo .aider.chat.history.md Markdown, with watch roots = discovered transcript FILE paths (a bounded breadth-first native-home walk memoized once per process); prose tokens GROSS→netted.
- qoder - Alibaba Qoder CLI; Claude-Code-shaped JSONL under ~/.qoder/projects; NO local model or tokens (server-side only - honest-zero, native-exempt).
- goose - Block Goose; WAL SQLite sessions.db with SESSION-level tokens only (accumulated_* + accumulated_cost); input GROSS→netted vs cache_read; SessionID is store-scoped (<id>@<sha8(store)>) so the YYYYMMDD_seq ids can't collide across a WSL + Windows store pair.
Fresh installs pick all nine up automatically; an EXPLICIT enabled_adapters list must add the new tool names (qwen-code, kiro-cli, crush, kimi-code, grok, devin, aider, qoder, goose) - the startup WARN names any that are missing.
Seeded session-handoff launchers for the new adapters - observer qwen, observer kiro, observer kimi, observer grok, observer qoder, and observer goose accept --continue-from <session-id> to distill a handover and seed it as the tool's first prompt (18 launchers total). qwen, kiro, grok, qoder, and goose seed directly; kimi is DocAssisted (no -p seed lane). devin, aider, and crush deliberately ship no launcher (no scriptable seed lane).
The watcher and adapter registry now accept a FILE as a watch root (not only a directory), which the aider adapter needs for its per-repo transcript-file watch set.
Guarded proxy-route config-lane writers - internal/proxyroute gained RegisterKimiCode (TOML base_url in ~/.kimi-code/config.toml), RegisterCrush (JSON map-merge in crush.json), and RegisterQwenCode (rewrites ~/.qwen/settings.json model.baseUrl, stricter guard: refuses any custom host). Each backs up (.bak) and writes via temp/rename, skips benignly when the config is missing, is idempotent when already observer, and refuses a foreign URL; API keys are never touched. A new additive registry field Capability.ProxyProbe marks "writer ready, promotion pending a live probe"; these writers fire ONLY through observer init - batch under --all (honoring --skip-proxy-route), or one per-tool consent prompt in the interactive checklist (default NO). ⚠️ Once a tool is routed, stopping the daemon breaks it until reverted (the standard routed-tool caveat - see the daemon-restart runbook).
Per-adapter Backfill scan modes in the dashboard - Settings → Backfill now derives one scan-<tool> row per integration-registry adapter (26 rows), backed by the generic observer scan --force --adapter <tool> lane (idempotent; overrides enabled_adapters for the run). A future adapter's Backfill row appears automatically.
Pricing: GPT-5.6 and Grok 4.5 model launches. Added gpt-5.6-sol ($5/$30), gpt-5.6-terra ($2.50 in / $15 out at launch), gpt-5.6-luna ($1 in / $6 out at launch; OpenAI cut Terra and Luna prices on 2026-07-30 - the current table reflects the cut), and a gpt-5.6 family row. GPT-5.6 introduces the first non-Anthropic explicit cache-write tier (writes at 1.25× uncached input, reads keep the 90% discount); the write rate is wired into the cost table but INERT until a live 5.6 response grounds the cache-write usage field. Added grok-4.5 ($2/$6, the new xAI flagship - previously under-billed via the grok family row at 4.3 rates) and grok-build-0.1 / grok-build ($1/$2); bumped the grok family prefix to flagship rates. docs/pricing-reference.md updated.

Changed

Adapter routability promotions. aider, goose, and grok were live-grounded through the :8820 proxy and promoted to routable_now (observer drives no route today; the launchers stay non-proxied). kimi-code and crush were promoted further to observer-driven Proxy routes after live turns landed api_turns rows through their config-lane writers. qwen-code stays route-blocked - its (empty) modelProviders map overrides model.baseUrl, so the env/base-URL lanes are grounded-dead and the writer needs a matching provider entry first.
Dashboard tool-identity colors for the 10 previously-uncolored adapters (light + dark tokens, CVD-validated), plus the missing tools.ts entries.

Fixed

Actions page window selector was a no-op. The 7d/14d/30d window computed windowDays but never passed it to /api/actions (only the Timeline day-counts honored it). /api/actions gained the same optional days contract as /api/sessions (0 = unwindowed; legacy callers unchanged) and the page now threads the selected window.
antigravity-cli cross-OS + guard coverage. Added the antigravity-cli cross-OS project-root anchors and its guard watcher-conformance row.

v1.16.0 - 2026-07-07

2026-07-07T00:00:00Z

Added

Richer session-handoff content - two complementary "full" carry modes. full carries the excerpted flow plus a [msg <id>] tag on every message and an MCP-hint line; a target with the Observer MCP pulls any full body on demand via the new get_session_message tool (always-on MCP tool count 19 → 20), which re-reads ONE un-excerpted message by (session_id, message_id|index) from the source transcript and never persists it. full_cache inlines the un-excerpted read/tool bodies INTO the handover doc so the new session starts warm with zero MCP round-trips (uses the FullTranscriptReader capability - claude-code + codex; other tools degrade to full with a stated reason), size-capped by [handoff] max_cache_bytes (8 MB default). models.TranscriptMessage gained an ID lifted from each source format's own record id where grounded.
Antigravity CLI (agy) adapter - the newer Antigravity CLI is now a first-class, separately-tagged adapter (antigravity-cli): plaintext-protobuf SQLite .db conversations parsed directly, .pb conversations via the existing transcript fallback, name-gated so the desktop and CLI layouts each claim only their own files, with observer backfill --antigravity-cli-rescan and an integration-registry row. Add "antigravity-cli" to an explicit enabled_adapters list to enable it.
observer antigravity-cli handoff launcher (aliases antigravity, agy) - --continue-from distills a handover and seeds it via agy -i (non-proxied).
Community links surfaced in the dashboard Settings page and the observer init footer.

Changed

Obs share flags nested under [org_client.share.obs]; the dashboard Settings Observability section is now plane-tagged (Plane A admin vs Plane B developer) for legibility.
Website download counter refreshed (npm 14,893 / PyPI 9,242).

Fixed

Antigravity CLI sessions are now tagged antigravity-cli instead of blending into the desktop antigravity tool - the parse helpers hardcoded the tool constant; ParseSessionFile now re-tags every event to the adapter's own name at the boundary.
MCP observer serve skips the SQLite quick_check so a large DB can't blow the init timeout.
Session handoff resolves a foreign-OS project root for the doc + launch cwd (cross-OS WSL case).

v1.15.0 - 2026-07-06

2026-07-06T00:00:00Z

Added

Session Handoff (continue-anywhere) - observer handoff <session-id> [--to <tool>] distills any captured session from the source tool's OWN transcript files into a scrubbed HANDOFF-<id>.md the target tool reads in the project root, priced per carry mode (metadata / distilled / distilled_tail / full) at the target model. Fork from any stable point of the message history (snap table refuses cuts inside unresolved tool chains). NOT cache migration - provider caches are server-side and prefix-exact; the estimate's stay option (next-message predict band + live cache value-at-risk) is the honest surface of that fact. Surfaces: CLI (observer handoff, handoff list), dashboard session-detail "Continue in…" modal with fork picker (GET /api/session/<id>/handoff/estimate + POST /api/session/<id>/handoff), MCP continue_session (tool count 19 → 20). Transcript readers: claude-code, codex, cursor, cline, cline-cli, hermes, opencode. Node-local handoffs table (migration 055) stores counts/enums/hashes only - never the doc. Docs: docs/session-handoff.md.
Session Handoff - dashboard "Launch <tool> here" (embedded web terminal). The Continue-in… modal can now START the target tool in the browser instead of only writing a handover file: for a launchable target (claude-code / codex / gemini-cli / pi) the daemon spawns observer <tool> --continue-from <id> in a PTY inside its own OS and streams the TUI into an xterm.js panel over a /ws/launch/<handle> websocket - working uniformly local, remote, or WSL-daemon/Windows-browser (no cross-OS shell). New pure-logic internal/termsession (PTY session registry behind an injected spawner; process-group reaping on unix, concurrent cap + idle reaper) and the HandoffCapability.Launch registry field. Server-derived argv only; CSWSH-defended (256-bit crypto/rand handle minted only by the Origin-checked POST /api/session/<id>/launch, plus coder/websocket cross-origin rejection). On by default, kill-switch [handoff].allow_dashboard_launch. GET /api/launch/sessions + DELETE /api/launch/<handle> for the live-session list. Unix-only PTY backend (native-Windows daemon reports unsupported → run under WSL). Docs: docs/session-handoff.md (Launch here), docs/security.md ledger.
Session Handoff - armed hook delivery (--deliver hook, claude-code). observer handoff <id> --to claude-code --deliver hook arms the handover for the NEXT claude-code session in the project: it injects as SessionStart additionalContext (same seam as the advisor digest), one-shot, expiring after [handoff] hook_ttl_minutes (default 240). The payload is hard- budgeted to [handoff] hook_max_bytes (default 8192; Phase 0 D-P0.2's 8KB intact cap) - the compact doc when it fits, else the document head plus a pointer to read the on-disk HANDOFF-*.md. Doc content stays on disk; the handoffs row (migration 056: hook_expires_at / hook_delivered_at / project_root) records only the arming window and file path. The claim is a single guarded UPDATE … RETURNING (race-safe). Delivery dispatches on the target's integration.HandoffCapability inject set - only claude-code declares inject_hook; other tools error honestly.
Session Handoff - launcher --continue-from (prompt delivery). observer claude --continue-from <session-id> and observer codex --continue-from <session-id> run the handoff for the launcher's OWN tool (delivery inject_prompt) and seed the rendered handover as the tool's first user prompt before exec'ing it - no copy/paste. Mirrors observer handoff flags (--carry, --from-message, --from-time; default fork = last message). claude gets the doc prepended as its leading positional prompt, codex appended as the trailing positional (TUI + exec); forwarding your own positional prompt errors honestly (two prompts - forward value-flags as --flag=value). Handovers over 100KB degrade to a marker-carrying pointer prompt (the full doc is on disk). The observer handoff … --to claude-code|codex output now prints a --continue-from tip. Delivery still dispatches on the target's integration.HandoffCapability - a prompt handoff to a tool without the lane errors honestly.
Session Handoff - --continue-from extended to observer gemini and observer pi. Both now accept --continue-from (plus --carry, --from-message, --from-time), seeding the handover as the tool's first prompt: gemini via its -i/--prompt-interactive flag ("Execute the provided prompt and continue in interactive mode"), pi as a trailing positional message (pi [messages...] start an interactive session). The injection strategy is now a declared promptInjection descriptor (leading positional / trailing positional / flag value) applied by a shared injectPrompt helper - no switch tool; claude and codex are refactored onto the same helper. hermes stays deferred: its only prompt flag (-z/--oneshot, chat -q) is headless one-shot (answer once and exit), not an interactive seed, so wiring it would change the run mode. opencode (TUI positional is a project path), copilot-cli (headless -p only), openclaw (proxy runtime-block) and cline-cli (not verifiable on the grounding node) also remain deferred.
Session Handoff - best-effort target-session linker. Every rendered handover carries a  marker that rides into the target session on every delivery lane (injected prompt, SessionStart context, or the model reading HANDOFF-<shortid>.md). observer handoff list now runs a time-boxed best-effort sweep first: for each delivered handoff of the last 7 days still missing a target, it re-reads candidate sessions of the target tool in the same project (started after the handoff) via the shared transcript-reader dispatch and stamps handoffs.target_session_id on the first whose transcript carries the marker. The link is written once (guarded UPDATE); the list gains a TARGET column. Pure marker scan lives in internal/handoff (ScanMarkers / ContainsMarker); store seam adds LinkTargetSession, ListUnlinkedHandoffs, CandidateTargetSessions. Short-id is recovered from the delivered doc's file name (delivery_ref). Everything is best-effort - an unreadable candidate is skipped and one handoff's failure never aborts the sweep.
Session Handoff - handoff_rehydration cache accounting. A handoff target's first turn is a large cold cache write BY DESIGN (the handover doc arrives as the first prompt / SessionStart context / an early HANDOFF-<id>.md read). It is now annotated as a new cause=handoff_rehydration (same reanchor kind, so kind-based denominators are unchanged) instead of a plain reanchor, so it no longer trips the advisor's session_balloon / cache_write_waste detectors or observer cache-health's cause-concentration WARN. Fired live in cachetrack when the superbased-handoff marker is present on the first observed turn (proxy parseRequest body scan + Tier-2 store block-body scan), and applied retroactively by the advisor via handoffs.target_session_id (the belt for non-proxied targets). Docs: docs/cache-tracking.md → "Session-handoff accounting".
Session Handoff - implicit-cache lane consults the handoff marker. The §15.3 implicit / OpenAI-Codex attribution path now mirrors the Anthropic lane: on the bootstrap turn with the superbased-handoff marker set, ruleImplicitHandoffRehydration fires cause=handoff_rehydration with the same implicit_write kind the plain reanchor uses, so every denominator/exclusion is unmoved (the kind routes to bucketSkipped + isRateSkipped, and the bootstrap turn is already excluded from ImplicitCacheConsistency) - only the cause differs. The marker flag, already scanned provider-agnostically by the proxy's parseRequest, is now threaded through the OpenAI branch of buildCacheObserveInput (it was previously dropped) and consumed by observeImplicit. Live coverage is proxy-only; a non-proxied codex Tier-2 target carries no reconstructed block bodies to scan, so that lane stays covered by the advisor's retroactive handoff-target belt.
Session Handoff - retention sweep + observer doctor probe (P4). The node-local handoffs table is now pruned by the shared retention runner (observer prune, and prune_on_startup on observer start / watch) via store.PruneHandoffRows, gated by the new [handoff] retention_days (default 180; 0 = keep forever). The prune summary line reports handoff_rows=<n>. observer doctor gains a handoff readers check: per adapter it reports the declared transcript tier + delivery lanes and, where a session exists from the last 30 days and the adapter implements the reader, runs a read-only, time-boxed (2s) readability probe against the latest session - honest read OK / metadata handover only / reader-declared-but-unreadable WARN, dispatched on capability shape (no tool-name branching).

Changed

The node/developer dashboard is now purely coding-agent (Plane B). The general-observability surfaces - Trajectories, Evals, and the Admission policy editor / per-end-user budgets - were removed from the local dashboard nav. These observe an LLM application you host at the admin level (end-user traces, evals, and input guardrails), not your own coding assistant, so their home is the admin dashboard (web2, the Trajectories nav group). A node still captures and pushes obs data when [observability] is enabled; it just no longer renders the obs UI locally. The obs backend, /api/obs/* endpoints, and observer obs … / observer eval CLIs are unchanged. See the new [docs/deployment-models.md].
New two-plane documentation. docs/deployment-models.md is the canonical explainer of the two deployment models - Plane A (general observability of a hosted LLM app) vs Plane B (coding-agent org/teams) - and is now Start-here #1. CLAUDE.md, docs/README.md, docs/observability.md, and the root README.md were updated to keep the two planes legible, backed by a full plane-separation audit (docs/audits/plane-separation-audit-2026-07-06.md) whose verdict is that every enforced code boundary between the planes holds.
Community & support card added to the node dashboard Overview (star the repo, report a problem, refer/share, send feedback).

Security

SQLite DSN path escaping (low; closes ledger item L8). Every SQLite file: DSN now routes its filesystem path through the new one-owner helper internal/platform/sqlitedsn.Escape, which percent-encodes the characters the SQLite URI parser treats specially (%, ?, #). Previously a database path containing ? was truncated into the query string (and %XX sequences were mis-decoded), which could drop the read-only pragmas on adapter reads. Applied to all 13 DSN sites: the 8 external-database adapter readers (kilocode, opencode, openclaw, cline-cli, cursor, hermes, antigravity ×2), both backfill readers, the observer import read-only ATTACH, and both first-party database opens. Ordinary paths produce byte-identical DSNs.

v1.14.0 - 2026-07-02

2026-07-02T00:00:00Z

Security

Whole-product security review + remediation (see docs/audits/security-review-2026-07-02.md; tracked in docs/security.md). A six-surface review plus govulncheck found and fixed 4 high, 8 medium, and 6 low findings; govulncheck reachable advisories went 28 → 0.
- Org server access control (high). Three privileged /api/org/* routes (routing-policy publish, routing-summaries export, enrolment-token mint) were gated on SAML-session presence only, so any SSO-capable member could reach them - publish a fleet-wide routing policy, export every developer's email and spend, or mint an enrolment token for an arbitrary user (ingest impersonation). They now require org-admin authority (admin_emails).
- SAML signature bypass (high). Bumped goxmldsig 1.4.0 → 1.6.0 (GO-2026-4753, reachable from assertion validation), golang.org/x/net 0.53 → 0.55, and the build toolchain to go1.25.11 (clears ~25 stdlib advisories including html/template XSS reachable from the org dashboard).
- Dashboard CSRF / DNS-rebinding (high). The local dashboard exposed state-changing endpoints with no origin or Host validation; a malicious web page could drive them. Added a same-origin + loopback-Host guard and a non-loopback-bind warning.
- Watcher symlink escape (high). A symlink planted under a watch root could be followed out of the tree and its contents excerpted into the DB; such symlinks are now skipped.
- Privacy / attribution (medium). Ingested user_email is pinned to the authenticated pusher (was forgeable on aggregate rows), and git_branch is no longer shipped in the default metadata-only sharing posture.
- Denial-of-service hardening (medium/low). Enforced the previously-dead [watcher].max_file_size_mb, added watcher panic recovery, a protobuf recursion-depth cap, and a proxy request-body size cap; plus a proxy guard-mask JSON backstop, WSL hook-command quoting, git gitdir: traversal rejection, and PowerShell path escaping.

Added

Config auto-migration rail. Deprecated config keys are now rewritten to their current names on disk instead of only being mapped in memory (which reprinted a config: deprecation: warning on every load). A new pure, table-driven registry (internal/config/migrate) surgically renames keys - preserving your values, comments, ordering, and every untouched section - drops keys with no analog, and stamps [observer] config_version. It runs automatically once on observer start (the daemon is the sole writer; a config.toml.bak backup is written first) and on demand via observer config migrate / observer config migrate --dry-run. Idempotent and fail-safe: a value it can't edit by line surgery is left untouched, never corrupted. Registry v1 migrates the decommissioned [compression.code_graph] / [intelligence.code_graph] blocks onto [codeintel].