SuperBased Files

Fixed

• fix(cursor): Cursor-on-Windows capture restored end to end. The hook bridge had been dead since 2026-07-05 behind stale tee-shim entries; auto-register now self-heals that file shape (loud WARN + remediation on failure, last_result/last_error persisted to hook_checksums.json), the watcher resolves project roots from .workspace-trusted with stat-gated candidate expansion, and hook payloads carrying the IDE's Uri.fsPath spelling (/c:/…) now land on the same canonical /mnt/c/… root as the watcher's rows — one project identity instead of up to six spellings of one directory.
• fix(pathnorm): the /c:/ URI-fsPath drive spelling folds into the Windows-drive layer. Anchored lexical detection (never filepath.IsAbs, which is host-dependent); non-drive lookalikes (/cache/…, /cc:/…, bare /c:) are pinned untouched. Hook == watcher convergence is enforced by test.

Changed

• Tool count synced to 31 everywhere, from one generated manifest. tools/toolcountgen derives the editorial adapter count from the integration registry (fold rules explicit and tested); the website hero badge, docs, READMEs, npm and VS Code Marketplace descriptions, and the extension walkthrough all read 31 now, and the accuracy checker fails on bare "N tools"/"N integrations" drift, on registry↔prose disagreement, and on the distribution surfaces that previously sat outside its scan root.
• Version-scoped the stale "Cursor 3.4+ stopped writing transcripts" claims. True on 3.4.20–3.9.16 where it was measured; on 3.14.27 the transcript walker is live again and currently the sole Windows-IDE capture path.

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.30.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.30.0-* archives (attached below).

:::bash
docker pull ghcr.io/superbasedapp/observer-org:v1.30.0

The image is keyless-signed with cosign. Verify it:

:::bash
cosign verify ghcr.io/superbasedapp/observer-org:v1.30.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

:::bash
slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private