Release v1.24.0 — sanitized source snapshot (2026-07-24)

Author: marmutapp

.golangci.yml

@@ -64,6 +64,10 @@ issues:
     - testdata
     - bin
     - scripts
+    # Vendored npm packages can ship Go source (e.g. flatted's golang/ port
+    # under vscode/node_modules); third-party code isn't ours to lint and CI
+    # never installs node_modules for the Go job.
+    - node_modules
     # oapi-codegen output (DO NOT EDIT). Declaring security schemes used only
     # by documentation-tagged operations emits unused context-key types that
     # `unused` would flag; generated code is regenerated deterministically and

CHANGELOG.md

@@ -2,7 +2,79 @@
 
 All notable changes to SuperBased Observer are documented here.
 
-## [Unreleased]
+## [1.24.0] — 2026-07-24
+
+### Added
+
+- **Session Cockpit: a live per-terminal floating panel.** Every embedded
+  dashboard terminal running an AI tool gains a "⊙ Session" button that
+  opens a compact, draggable cockpit next to the terminal — the glanceable
+  companion to the session-detail page, not a clone of it. It shows, live:
+  a now strip (last activity, tokens/sec with an honest measured/estimated
+  basis badge, live process count), total cost with the AI/tool split and
+  the next-message cost band, context fill against the model budget, token
+  buckets, the 5h/7d rate-limit gauge (proxy-routed sessions), prompt-cache
+  expiry countdown chips, system telemetry (CPU/memory/disk sparklines and
+  the spawned-process tree from process observation, plus proxied API
+  traffic with byte totals when body capture measures them), and the last
+  five turns deep-linking into the session-detail page.
+- **Terminal→session live linkage.** New `GET /api/terminal/session/<token>`
+  resolves a running terminal to its correlated observer session (id +
+  correlation confidence, refusal-ordered so remote callers can never probe
+  token existence); the cockpit keeps polling so a later authoritative
+  correlation re-points the panel, and links below the out-of-band tier
+  carry an explicit "≈ linked" badge.
+- **One-click process-capture enable.** When process observation is off, the
+  cockpit's System section explains what's missing and offers an atomic
+  server-side enable (`POST /api/process/enable-capture`): non-runnable
+  backend selections switch to automatic with the previous value named in
+  the notice, hosts with no runnable capture backend get an honest
+  "unavailable on this machine" instead of a false success, and capture
+  honestly starts only after the daemon restarts.
+- **`?tail=N` on the session messages API** — returns the true last N rows
+  of the full timeline for fast pollers (explicitly rejected when combined
+  with pagination parameters).
+- **`?summary=1` on the session network API** — a server-side aggregate
+  separating proxied API calls (with request/response byte sums from body
+  metadata) from OS-observed process connections.
+
+- **Tool-binary resolution with classified verdicts.** Every embedded-
+  terminal launcher now resolves its tool binary through a shared ladder —
+  process PATH, then a memoized login-shell PATH capture, then native
+  install-location probing, then (WSL only) a foreign-Windows-home check —
+  and classifies the result as `ok`, `ok_off_path`, `shadowed`,
+  `foreign_only`, or `not_found`. Fixes the class of bug where a
+  Windows-installed npm shim shadowed (or stood in for) a native binary on
+  WSL, and the launcher's stale process PATH meant a fresh native install
+  wasn't picked up without restarting the daemon.
+- **Guided one-click install.** When a tool isn't natively resolvable, the
+  New Terminal dialog shows the verified official install command and an
+  "Install in terminal" button that runs it in a visible PTY. Gated by the
+  new `[terminal.launch].allow_install` config key (default on).
+- **`observer doctor` and `observer adapters` surface binary-resolution
+  health**, including a `foreign_only` bucket (tool installed on Windows
+  only, not launchable from a WSL daemon) and a best-effort Windows
+  proxy-route reachability check.
+- **`observer init` writes Windows-side proxy routes.** When the daemon
+  runs in WSL, `init` can now also point a Windows-installed claude-code or
+  codex at the daemon's proxy (`localhost:8820`, relying on WSL2's
+  `localhostForwarding`), so accurate token capture works even when the AI
+  tool itself is installed on the Windows side.
+- **`[launch.tools.<tool>].path`** config override to pin a specific binary
+  path per tool, bypassing the resolution ladder.
+- Custom terminal project paths typed in Windows form (`C:\Users\…`) are
+  now translated to their WSL mount equivalent before validation.
+
+### Fixed
+
+- **Concurrent dashboard config saves can no longer lose updates.** All
+  in-process config read-modify-write paths — section saves, pricing,
+  backup restore, remote-manage toggles, terminal limits/policy,
+  experiments, and the admission-policy persister — now serialize on one
+  shared lock in the config package (cross-process CLI writes remain
+  outside a mutex's reach and are documented as such).
+- The attach-replay bound test no longer flakes on slow runners (the
+  precondition now waits for the pump to drain the full produced stream).
 
 ## [1.23.0] — 2026-07-23
 

browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "SuperBased Observer — Browser Capture",
-  "version": "1.23.0",
+  "version": "1.24.0",
   "description": "Opt-in, passive observability of your own AI chatbot web usage (ChatGPT, Claude, Perplexity, Gemini, Copilot). Captures per-turn metadata + estimated tokens locally; nothing leaves your machine except to your local observer daemon.",
   "minimum_chrome_version": "111",
   "permissions": [

cmd/observer/admission_persist.go

@@ -69,19 +69,31 @@ func admissionPolicyPersister() func(ctx context.Context, policyJSON []byte) err
 		if err := json.Unmarshal(policyJSON, &p); err != nil {
 			return fmt.Errorf("admissionPolicyPersister: decode policy: %w", err)
 		}
-		path, err := resolveAdmissionConfigPath("")
-		if err != nil {
-			return fmt.Errorf("admissionPolicyPersister: resolve config path: %w", err)
-		}
-		cfg, err := loadConfigForSetup(path)
-		if err != nil {
-			return fmt.Errorf("admissionPolicyPersister: load config: %w", err)
-		}
-		cfg = applyAdmissionEditorPolicy(cfg, p)
-		if err := config.WriteToml(path, cfg); err != nil {
-			return fmt.Errorf("admissionPolicyPersister: write config: %w", err)
-		}
-		return nil
+		// Serialize the WHOLE resolve→load→overlay→write span against every
+		// other in-process config writer — critically the dashboard's config
+		// handlers, which hold the SAME process-wide mutex via
+		// config.WriteLock(). This daemon runs the dashboard and this persister
+		// in one process; without the shared lock a section save and a policy
+		// persist can each read the same on-disk base and clobber the other's
+		// edit (lost update in BOTH directions). config.WithConfigLock is the
+		// one seam (CLAUDE.md #4 — one owner per piece of state). Cross-PROCESS
+		// CLI writers remain unserialized — an accepted limitation documented on
+		// WithConfigLock (flock is the future upgrade).
+		return config.WithConfigLock(func() error {
+			path, err := resolveAdmissionConfigPath("")
+			if err != nil {
+				return fmt.Errorf("admissionPolicyPersister: resolve config path: %w", err)
+			}
+			cfg, err := loadConfigForSetup(path)
+			if err != nil {
+				return fmt.Errorf("admissionPolicyPersister: load config: %w", err)
+			}
+			cfg = applyAdmissionEditorPolicy(cfg, p)
+			if err := config.WriteToml(path, cfg); err != nil {
+				return fmt.Errorf("admissionPolicyPersister: write config: %w", err)
+			}
+			return nil
+		})
 	}
 }
 

cmd/observer/antigravity.go

@@ -46,7 +46,7 @@ func newAntigravityCmd() *cobra.Command {
 			"to separate observer flags from agy flags. NEVER touches API keys.",
 		SilenceErrors: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			bin, err := resolveToolBin("agy", binPath, "--agy-path")
+			bin, err := resolveToolBin("antigravity-cli", binPath, "--agy-path", configPath, cmd.ErrOrStderr())
 			if err != nil {
 				return err
 			}

cmd/observer/benchmark_driver.go

@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -346,15 +347,15 @@ func parseClaudeResult(out []byte) (string, bool) {
 	return last, found
 }
 
-// resolveClaudeBin returns the configured claude path or resolves `claude` on
-// PATH. A missing binary is a Drive-time harness error (no spend), not a
-// Preflight failure — Preflight owns only the isolated-daemon gate, so a
-// dry-run cost estimate still works on a host without claude installed.
+// resolveClaudeBin returns the configured claude path or resolves the claude
+// binary through the registry ladder (registry key "claude-code"). A missing
+// binary is a Drive-time harness error (no spend), not a Preflight failure —
+// Preflight owns only the isolated-daemon gate, so a dry-run cost estimate
+// still works on a host without claude installed. stderr is discarded (the
+// harness is non-interactive); any PATH-hygiene note is dropped, and an
+// unresolvable binary surfaces as the returned error at Drive time.
 func resolveClaudeBin(configured string) (string, error) {
-	if configured != "" {
-		return configured, nil
-	}
-	return exec.LookPath("claude")
+	return resolveToolBin("claude-code", configured, "--claude-path", "", io.Discard)
 }
 
 // defaultObserverDBPath returns the operator default observer DB path

cmd/observer/claude.go

@@ -26,7 +26,6 @@ import (
 	"fmt"
 	"net"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -244,13 +243,9 @@ func runClaudeLauncher(ctx context.Context, opts claudeLauncherOptions) error {
 			opts.resume)
 	}
 
-	bin := opts.claudePath
-	if bin == "" {
-		resolved, lookErr := exec.LookPath("claude")
-		if lookErr != nil {
-			return fmt.Errorf("locate claude binary: %w (set --claude-path)", lookErr)
-		}
-		bin = resolved
+	bin, binErr := resolveToolBin("claude-code", opts.claudePath, "--claude-path", opts.configPath, opts.stderr)
+	if binErr != nil {
+		return binErr
 	}
 
 	// --verify is a NO-LAUNCH mode: evaluate it BEFORE any launch branch so it

cmd/observer/clinecli.go

@@ -65,7 +65,7 @@ func newClineCLICmd() *cobra.Command {
 				return fmt.Errorf("load config: %w", err)
 			}
 			resolved := resolveProxyURL(cfg.Proxy.Port, proxyURL)
-			bin, err := resolveToolBin("cline", binPath, "--cline-path")
+			bin, err := resolveToolBin("cline-cli", binPath, "--cline-path", configPath, cmd.ErrOrStderr())
 			if err != nil {
 				return err
 			}

cmd/observer/codex.go

@@ -410,13 +410,9 @@ func runCodexLauncher(ctx context.Context, opts codexLauncherOptions) error {
 // bounds; the caller reaches it only on a proxyRouteProceed / neutralized
 // verdict.
 func runCodexChild(ctx context.Context, opts codexLauncherOptions, proxyURL string, preflight []codexipc.Process) error {
-	bin := opts.codexPath
-	if bin == "" {
-		resolved, lookErr := exec.LookPath("codex")
-		if lookErr != nil {
-			return fmt.Errorf("locate codex binary: %w (set --codex-path)", lookErr)
-		}
-		bin = resolved
+	bin, binErr := resolveToolBin("codex", opts.codexPath, "--codex-path", opts.configPath, opts.stderr)
+	if binErr != nil {
+		return binErr
 	}
 
 	codexArgs := opts.codexArgs

cmd/observer/copilotcli.go

@@ -60,7 +60,7 @@ func newCopilotCLICmd() *cobra.Command {
 				return fmt.Errorf("load config: %w", err)
 			}
 			resolved := resolveProxyURL(cfg.Proxy.Port, proxyURL)
-			bin, err := resolveToolBin("copilot", binPath, "--copilot-path")
+			bin, err := resolveToolBin("copilot-cli", binPath, "--copilot-path", configPath, cmd.ErrOrStderr())
 			if err != nil {
 				return err
 			}