mirror of
https://github.com/aaronsb/obsidian-mcp-plugin.git
synced 2026-07-22 06:45:14 +00:00
2b4ef6a9b4
Blocking — userSuppliedCert discriminator: - Was: certificateConfig.selfSigned === false (never set false in UI; rows 5/7/9 of the ADR-107 table unreachable, defaulting to over-warn). - Now: !!(certPath && keyPath) — actual cert provenance signal. Fixed in src/mcp-server.ts and src/main.ts settings UI badge. Non-blocking #1 — migration Notice race: - Was: isExistingPreBindModeInstall() re-read data.json after loadSettings() may have already persisted bindMode='loopback' as part of the apiKey auto-save. - Now: snapshot raw loadData() before loadSettings(), test the snapshot. Non-blocking #2 — loopback host matcher tightened: - Was: startsWith('127.') accepted '127.evil.com'. - Now: strict dotted-quad regex /^127(\.\d{1,3}){3}$/ with octet range. New tests cover hostile inputs (127.evil.com, 127.0.0.1.attacker.tld, 127.300.0.1, 1270.0.0.1). Non-blocking #3 — Reconfigure hint: - ADR-107 specifies the 🔴 badge includes a Reconfigure hint; implementation now renders 'Reconfigure: switch the bind address below to Loopback, or enable HTTPS.' beneath the verdict reason. Non-blocking #4 — empty custom host UX: - When bindMode='custom' && customBindHost is empty, render an explicit Notice that the server will fall back to loopback until a host is entered (resolves the silent 🟢 OK in that state). Lint clean, 296/296 tests pass. |
||
|---|---|---|
| .. | ||
| config | ||
| formatters | ||
| indexing | ||
| security | ||
| semantic | ||
| tools | ||
| types | ||
| utils | ||
| validation | ||
| browser-mcp-server.ts | ||
| main-complex.ts | ||
| main-simple.ts | ||
| main.ts | ||
| mcp-server.ts | ||
| node-mcp-server.ts | ||
| version.ts | ||