@superbased/observer 1.10.0 → 1.12.0

package/README.md

@@ -8,9 +8,10 @@
 **Homepage:** [https://superbased.app/](https://superbased.app/)
 
 **Capture, normalize, compress, and analyze every AI coding tool call you
-run** — across Claude Code, Codex, Cursor, Cline / Roo Code, GitHub
-Copilot (VS Code), GitHub Copilot CLI, OpenCode, OpenClaw, Pi, Google
-Antigravity, Gemini CLI, and Cowork — in one local single-binary tool.
+run** — across Claude Code, Codex, Cursor, Cline / Roo Code + Cline CLI,
+GitHub Copilot (VS Code), GitHub Copilot CLI, OpenCode, OpenClaw, Pi,
+Google Antigravity, Gemini CLI, Cowork, Nous Research's Hermes Agent, and
+Kilo Code (legacy IDE extension + CLI) — in one local single-binary tool.
 No telemetry, no cloud, no data leaves your machine.
 
 <p align="center">
@@ -264,21 +265,28 @@ Pure-Go via `modernc.org/sqlite`, no CGO. WAL mode by default.
 
 ### 4. Local dashboard (`:8081`)
 
-Fifteen tabs in four groups — Monitor (Overview, Live, Sessions,
-Actions, Search), Analyze (Cost, Analysis, Tools), Optimize
-(Compression, Cache, Suggestions, Discovery, Patterns), Configure
-(Privacy, Settings). See [Dashboard tour](#dashboard-tour).
+Eighteen tabs in four groups — Monitor (Overview, Live, Sessions,
+Actions, Trajectories, Evals, Security, Search), Analyze (Cost,
+Analysis, Tools), Optimize (Compression, Cache, Suggestions,
+Discovery, Patterns), Configure (Privacy, Settings). See
+[Dashboard tour](#dashboard-tour).
 
-Static HTML + Chart.js. No analytics, no external requests.
+A React + TypeScript single-page app (Vite build, Recharts charts),
+embedded in the binary and served locally. No analytics, no external
+requests.
 
 ### 5. MCP server (stdio) — opt-in via `observer init`
 
-13 read-only tools the AI client itself can call mid-conversation —
+19 read-only tools the AI client itself can call mid-conversation —
 `check_file_freshness`, `get_last_test_result`, `search_past_outputs`,
-etc. (plus `retrieve_stashed` when the proxy stash is configured).
+`search_symbols`, etc. (plus `retrieve_stashed` when the proxy stash
+is configured).
 Powers cross-client tool sharing: if Claude Code ran `go test`,
 Cursor's MCP query for the latest test result will return Claude
-Code's run. See [MCP tools reference](#mcp-tools-reference).
+Code's run. The code-aware tools (`get_symbols`, `get_relations`,
+`search_symbols`) are backed by a native, CGO-free code-intelligence
+engine (tree-sitter via wasm) that indexes your repo locally. See
+[MCP tools reference](#mcp-tools-reference).
 
 **Lifecycle**: the MCP server is a stdio subprocess spawned by your
 AI tool — not by the observer daemon. It's registered into each AI
@@ -293,9 +301,10 @@ running `init`.
 
 `observer start` opens the dashboard automatically on interactive
 launches (suppress with `--no-open`; the URL is also printed —
-`http://127.0.0.1:8081/` by default). Fifteen tabs in four nav groups
+`http://127.0.0.1:8081/` by default). Eighteen tabs in four nav groups
 (Monitor / Analyze / Optimize / Configure) — the tour below covers the
 core surfaces; Live (recent sessions with a real-time action feed),
+Trajectories + Evals (OTLP trace/span capture for your own agents),
 Search (full-text over captured tool outputs), and Privacy (capture
 map + scrub tester) are self-explanatory once you're in. On an empty
 database the Overview tab leads with a three-step onboarding
@@ -365,7 +374,7 @@ the tiles: a daily-spend stacked bar with Model / Project / Tool
 dimension toggle, hour-of-day heatmap, top-12 expensive sessions
 with explanatory badges (`opus`, `lc_tier`, `many_turns`,
 `large_prompt`), period-over-period movers (top increases / decreases
-/ new entrants), and routing-efficiency suggestions (trivial Opus
+/ new entrants), and model right-sizing hints (trivial Opus
 sessions that could have used Sonnet).
 
 ### Sessions tab
@@ -536,7 +545,7 @@ recommendations. **On by default** and entirely local: detectors are
 pure reads over data the observer already stores, recomputed fresh on
 every view — zero LLM calls, zero network.
 
-Twenty detectors across four categories:
+Nineteen detectors across four categories:
 
 - **cost** — session balloons (one session's context growth dominating
   spend), idle re-cache (cache rewrites after idle gaps), long-context
@@ -544,10 +553,7 @@ Twenty detectors across four categories:
   cache-write waste, prefix thrash, read-heavy sessions on expensive
   models, effort overprovisioning, cross-session stale reads,
   web-search spend, spend spikes ("today is 3× your daily average" —
-  the while-it's-still-happening check, linking to the Live view),
-  routing evidence ready (the advise shadow met its promotion gate
-  with routing still not enforcing — linking to the Shadow card,
-  which owns the evidence and the consent-gated promote).
+  the while-it's-still-happening check, linking to the Live view).
 - **latency** — fast-tier premium (sessions that paid the 2× fast-tier
   rate without needing it).
 - **quality** — unrecovered failures, quality regressions.
@@ -626,21 +632,6 @@ suggested from your own observed spend with a daily burn-down meter,
 MCP pin approvals, and one-click **compliance evidence** downloads
 (report / JSONL / CEF / audit verification).
 
-### Routing tab
-
-Model routing's transparency + adoption surface. While routing is
-off, a **Preview savings** card replays your last 30 days under any
-policy template — read-only, nothing enabled. Once advise mode runs,
-the page shows the decisions feed (every decision expandable to its
-matched rule, reason codes, and cache economics), savings with CI95
-error bars, the expanded policy rule table (never a black box,
-demoted rules marked), the tier map with calibration overlays, the
-model health board, and the **advise-shadow readiness ladder** with
-its consent-gated promote control. The **Apply to tools** card turns
-observed sub-agent evidence into per-tool native config — dry-run
-preview, one consent per file write, backups + per-file revert, and
-an append-only audit ledger of everything observer changed.
-
 ### Settings tab
 
 <p align="center">
@@ -699,7 +690,7 @@ explaining the actual algorithm.
 
 Once you've run `observer init` (it's opt-in — `observer start`
 alone does NOT register the MCP server), every connected AI client
-gets these 13 tools registered as an MCP server — plus
+gets these 19 tools registered as an MCP server — plus
 `retrieve_stashed` when the proxy stash is configured. They're
 **read-only** queries against the unified database, so any agent
 can read any other agent's recorded work — true cross-platform
@@ -720,6 +711,12 @@ tool-call sharing.
 | `get_cost_summary`                | Daily / per-model / per-session cost rollups |
 | `get_redundancy_report`           | Stale rereads, repeated commands, cross-tool overlap for the project |
 | `list_actions_around`             | ±N actions adjacent to a pivot `action_id` — browse a session's local timeline cheaply |
+| `get_file`                        | The file's current bytes (or at a given commit), with a path-safety gate + audit |
+| `get_symbols`                     | Resolve a symbol name + range to its file path + body (codeintel-backed) |
+| `get_relations`                   | Codeintel BFS — who calls / is called by this symbol |
+| `search_symbols`                  | Fuzzy symbol search across the project's codeintel index (Tier-C) |
+| `cache_status`                    | Live prompt-cache health: which caches are warm, expiring, or cold, with value-at-risk |
+| `get_model_recommendation`        | Evidence-backed model suggestion per turn-kind, from the local Model Value Report |
 | `retrieve_stashed` _(conditional)_| Pulls original bytes of a tool_result the proxy compressed away. Only registered when `[compression.conversation].stash` is configured. |
 
 **Cost trade-off**: with the MCP registered, the AI client sends the
@@ -1035,54 +1032,6 @@ Full references:
 [guard-compliance.md](https://github.com/marmutapp/superbased-observer/blob/main/docs/guard-compliance.md)
 (SOC 2 / NIST mapping).
 
-## Model routing
-
-The routing layer selects the right model for each KIND of work —
-from your own observed evidence, never a brochure — through two
-channels: **A** writes each AI tool's own config (claude-code
-per-subagent `model:` frontmatter — dry-run first, backed up,
-revertable, audit-ledgered; other tools get exact paste-able
-snippets), and **B** rewrites the `model` field on requests already
-transiting the proxy. It is **opt-in, advise-first, and fail-open
-everywhere**: a routing failure can never break a turn that would
-have succeeded.
-
-The adoption ladder is deliberate, and every step has a dashboard
-surface: **preview** what a policy would have saved over your last 30
-days while routing is still off (a read-only replay of recorded
-turns) → enable **advise** (decision rows accrue; requests untouched)
-→ read the **shadow** (the §R22 readiness ladder: enough decisions,
-real net savings after cache forfeits, zero quality flags) →
-**promote** to enforce through a consent dialog that restates the
-evidence — and warns loudly when the gate is not met. Enforce
-rewrites within the same provider shape only, holds switches that
-would forfeit a warm prompt cache worth more than they save, and
-auto-demotes any rule whose downshifts grade as regressing
-(loudly, never silently). Custom `[[routing.rules]]` are editable in
-a lint-gated dashboard editor with a worked recipe gallery in the
-docs.
-
-Privacy posture: decision rows and calibration are **node-local**
-(never pushed to an org server); org-distributed policy fragments are
-signed and structurally cannot flip your enforce switch — **no remote
-enforce toggle exists, by design**.
-
-Quick start:
-
-```
-# Preview before enabling anything (CLI twin of the dashboard card):
-observer routing simulate --policy value --days 30
-# Then: dashboard → Routing → Preview savings → Enable advise mode.
-observer routing shadow    # the promotion evidence, any time
-observer routing apply --tool claude-code   # Channel A, dry-run default
-```
-
-Full reference:
-[model-routing.md](https://github.com/marmutapp/superbased-observer/blob/main/docs/model-routing.md)
-(operator guide + the first-30-days runbook + the rules recipe
-gallery).
-
-
 ## Terminology and glossary
 
 Quick reference; the in-platform help drawer (press `?` on the
@@ -1111,7 +1060,7 @@ dashboard) has the full versions with cross-links.
   bodies. Pass 1 = per-content-type compression, Pass 2 = drop with
   marker. See [Compression mechanisms](#compression-mechanisms).
 - **Cross-platform tool calling** — every AI client connected via
-  `observer init` can call the 12 MCP tools against the unified
+  `observer init` can call the 19 MCP tools against the unified
   database. So Cursor's `get_last_test_result` can return a `go test`
   Claude Code ran an hour earlier.
 - **Cross-thread reread** — the parent thread re-reads a file the
@@ -1387,7 +1336,7 @@ handler, dashboard, MCP server, and CLI never make an outbound network
 call on observer's behalf. The only code paths that touch the network
 are the optional API proxy (which forwards **your** requests unchanged
 to the AI provider you already use) and a handful of explicit opt-in
-features (message-summary LLM, codegraph MCP, Teams org-server).
+features (message-summary LLM, codeintel MCP, Teams org-server).
 
 The full privacy statement — what observer stores, what it reads,
 what it never stores, the explicit list of outbound-network call sites

package/README.template.md

@@ -8,9 +8,10 @@
 **Homepage:** [https://superbased.app/](https://superbased.app/)
 
 **Capture, normalize, compress, and analyze every AI coding tool call you
-run** — across Claude Code, Codex, Cursor, Cline / Roo Code, GitHub
-Copilot (VS Code), GitHub Copilot CLI, OpenCode, OpenClaw, Pi, Google
-Antigravity, Gemini CLI, and Cowork — in one local single-binary tool.
+run** — across Claude Code, Codex, Cursor, Cline / Roo Code + Cline CLI,
+GitHub Copilot (VS Code), GitHub Copilot CLI, OpenCode, OpenClaw, Pi,
+Google Antigravity, Gemini CLI, Cowork, Nous Research's Hermes Agent, and
+Kilo Code (legacy IDE extension + CLI) — in one local single-binary tool.
 No telemetry, no cloud, no data leaves your machine.
 
 <p align="center">
@@ -263,7 +264,7 @@ handler, dashboard, MCP server, and CLI never make an outbound network
 call on observer's behalf. The only code paths that touch the network
 are the optional API proxy (which forwards **your** requests unchanged
 to the AI provider you already use) and a handful of explicit opt-in
-features (message-summary LLM, codegraph MCP, Teams org-server).
+features (message-summary LLM, codeintel MCP, Teams org-server).
 
 The full privacy statement — what observer stores, what it reads,
 what it never stores, the explicit list of outbound-network call sites

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superbased/observer",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "SuperBased Observer — capture, normalize, compress, and analyze AI coding tool activity across Claude Code, Codex, Cursor, Cline/Roo, and Copilot.",
   "keywords": [
     "ai",
@@ -36,11 +36,11 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@superbased/observer-linux-x64": "1.10.0",
-    "@superbased/observer-linux-arm64": "1.10.0",
-    "@superbased/observer-darwin-x64": "1.10.0",
-    "@superbased/observer-darwin-arm64": "1.10.0",
-    "@superbased/observer-win32-x64": "1.10.0"
+    "@superbased/observer-linux-x64": "1.12.0",
+    "@superbased/observer-linux-arm64": "1.12.0",
+    "@superbased/observer-darwin-x64": "1.12.0",
+    "@superbased/observer-darwin-arm64": "1.12.0",
+    "@superbased/observer-win32-x64": "1.12.0"
   },
   "scripts": {
     "test": "node bin/observer.js --version"