The Obsidian preview scan flags three real capabilities: filesystem access
(outside-vault media download), vault file enumeration (dedup + folder
auto-complete), and clipboard (copy debug log, write only). All are legitimate
and necessary or opt-in. Document each plainly in a README Permissions section
and reconcile PRIVACY.md (add device-access detail, fix the enumeration nuance,
drop the BRAT reference, bump the date) rather than removing the functionality.
Bring back the badge row, fixed properly instead of removed. CI and Release
status now use GitHub native badge.svg endpoints (served by GitHub, no
shields.io token pool). Downloads, stars, and latest release use badgen.net,
which does not share shields.io rate-limited token pool that was rendering
"Unable to select next GitHub token from pool". License and Obsidian version
stay static since their values are constant.
The GitHub-API-backed shields badges (downloads, stars, latest, license, CI and
release status) intermittently render "unable to select next github token from
the pool" when shields.io is rate-limited, which looks broken on a marketplace
README. Keep only the two static badges (Obsidian version, MIT license) that do
not depend on the GitHub API. Dropping the CI/release status badges also keeps
CI internals off the public README.
The plugin goes straight to the Community plugins store, so lead Installation
with the in-app Browse flow and keep manual install as the fallback. Remove the
BRAT section and the not-yet-in-store / beta wording.
Drop the early-development warning now that 1.0 is stable. Document this
cycle's import-window additions: endless scroll, Select all, loaded/selected
counts, and the per-feed Re-detect source button.
A newly disclosed moderate DoS in js-yaml (<= 4.1.1) is flagged by OSV-Scanner
against js-yaml@3.14.2, a deep transitive dev dependency from the test-coverage
toolchain (ts-jest -> istanbul -> load-nyc-config -> js-yaml). It is never in
the shipped main.js and only parses our own trusted coverage config. The patch
is js-yaml 4.2.0, but load-nyc-config needs the removed 3.x safeLoad API, so no
non-breaking override exists. Document the acceptance in osv-scanner.toml and
point the scanner at it, rather than dropping the severity gate.
First stable release of the free and public-content importer. Bundles this
cycle's import-window work (endless scroll, select-all, loaded and selected
counts), custom-domain Substack detection via the feed generator marker, and a
per-feed Re-detect button to upgrade a feed saved as generic in place.
Importing full bodies of paid Substack posts is deferred to a later release.
Import window:
- Endless scroll: an IntersectionObserver auto-loads older Substack archive
pages as a bottom sentinel scrolls into view. The "Load older" button stays
as a fallback and end-of-archive indicator.
- Select-all toggle that checks every available (not imported, not dismissed)
loaded item and flips to "Deselect all" once all are selected.
- Toolbar counts: a running loaded count that reads "All N items" once the
archive is exhausted, and an "x of y selected" count beside the toggle.
Resolver:
- Detect a custom-domain Substack by its <generator>Substack</generator> feed
marker, so it classifies as substack (and gains archive backfill) instead of
falling back to generic. Backward compatible: feeds without the marker stay
generic.
Settings:
- A "Re-detect" button on each feed editor page re-resolves the feed and
updates its source type in place, upgrading a feed saved as generic without
removing and re-adding it. feedId is left untouched so dedup and dismissals
stay valid.
Adds unit coverage for selectableItemIds, selectAllControlState, and the
generator-marker detection on both the probe and explicit-feed-url paths.
State clearly that the plugin is in early development, not production-ready, use
at own risk, keep backups, and not yet in the Community Plugins store (install via
BRAT or manually). Add a Requirements section (Obsidian 1.13.0+, desktop only).
Expand Features to everything shipped through 0.4.0 (media download, archive
backfill, per-feed cleanup + command, feed-tags property, per-feed overrides).
Add Changelog pointer.
Strip promotional clutter from note bodies by LINK TARGET and structure, never by
body wording (so rules survive rewording). Per-feed link-host list (e.g.
buymeacoffee.com, substack.com/app, /subscribe) removes short CTA/footer blocks;
an optional trim-after-last-horizontal-rule drops a trailing footer region. Long
real paragraphs that merely cite such a link are preserved. Rules apply at import
and via a new 'Clean up imported notes' command that re-cleans existing notes with
frontmatter untouched. cleanup.ts is pure + idempotent. +32 tests (323 total).
A 'Load older' control in the import window pages back through a Substack
publication's archive (/api/v1/archive?offset=) beyond the ~20-item RSS window,
fetching each older post's body on demand (/api/v1/posts/<slug>). ListItemsOptions
gains an offset; offset 0 keeps the inline-body RSS path. Generic RSS feeds expose
only their recent window, so the control is Substack-only. Defensive JSON parsing;
selection preserved across paged loads. +20 tests.
Imported items now show the imported badge right after import instead of only
after reopening: the metadataCache index updates asynchronously, so the just-
written notes are marked imported directly from the import result. The result
summary now shows a one-line count plus failures only, instead of listing every
item (which overflowed the modal).
Download podcast/audio/video enclosures into a vault subfolder (vault.createBinary)
or to an outside-vault folder (Node fs, desktop-only, behind a Platform.isDesktop
guard) for media you do not want syncing. Global defaults plus per-feed overrides
(download on/off, location, subfolder). Notes record a media-file frontmatter line
and point the body link at the local file. Failures are best-effort (logged, never
abort the item). +20 tests.
Feed and item tags now go to a plain feed-tags frontmatter property instead of the
global Obsidian tags, so they no longer flood the tag pane, search, and graph. A
new 'Tag destination' setting switches back to Obsidian tags when wanted. A
leading '#' is now stripped from a tag (a #-prefixed tag could previously turn
'tags: [#x]' into a YAML comment and drop every tag, the likely cause of tags not
appearing). Tests added for both destinations and the # case.
Remove email-truncation and 'read in the app' promos, subscribe forms, and CTA
buttons by their Substack data-component-name (InstallSubstackAppToDOM,
SubscribeWidgetToDOM, ButtonCreateButton) plus the matching class families
(install-substack-app, subscription-widget, preamble, digest-post-embed,
fake-input/button, cta-caption). Real images (Image2ToDOM) and prose are kept.
Structural match only, never body text. Test added.
Selection lived only in the checkbox DOM, so toggleDismiss and the post-import
refresh (both re-render the whole list) reset every checkbox. Track selected ids
in a Set restored on each render; dismiss drops only its own item and imported
items leave the selection. (DOM-level selection still needs a jsdom UI harness to
unit-test; logic verified manually for now.)
Save mixed ButtonComponent.setDisabled() with raw toggleAttribute() and required
a separate Resolve click, so it could stay disabled/unresponsive. Save is now
always enabled and resolves the feed on demand before saving, with a re-entry
guard. Added a regression test for the resolve-on-save path.
RssImporterSettingTab declared a getter-only `get plugin()`, but the
PluginSettingTab base constructor assigns `this.plugin = plugin`, which throws
'Cannot set property plugin which has only a getter' -- the plugin was disabled
on load before any UI registered. Use a plain typed field (the shell-path-copy
pattern) instead. onload now wraps its body in a guard that surfaces a Notice on
failure instead of failing silently. Added a regression test that constructs the
settings tab against the faithful base mock (no test did before).
Correctness: resolver classifies /p/ as Substack only on a substack.com host;
redirect cap aligned to 5; extractFeedItemId unescapes in a single pass (round
trips literal backslash escapes). Feature: podcast/media notes now record
media-url frontmatter and append an [Episode audio]/[Media] body link. Safety:
the import command guards synchronous NoteWriter construction (a bad destination
folder now surfaces a Notice, not a silent throw); loadSettings validates
per-feed literal fields from data.json. Diagnosability: empty-body imports and
skipped image downloads are logged. Structure: FeedPickerModal and
DuplicatePromptModal moved to their own files; id non-empty guard at the mapping
boundary; doc + type-dedup cleanups. 244 tests; build + lint green.
Deferred (low/cosmetic): shared header helper, Atom updated-vs-published date
precedence, the sanctioned settings-tab cast.
Wires real source + converter + note-writer + vault-index against the captured
fixtures: generic feed maps podcast/article correctly, a written note round-trips
through the dedup index so re-import is a no-op, a Substack paid teaser is flagged
truncated with the warning note shape, and conversion is deterministic.
README gains Features/Usage and the correct minAppVersion badge (1.13.0).
PRIVACY/SECURITY replace the template's no-network-code default with the real
on-device flow: requests only to user-configured feed hosts, redirect targets,
the Substack public profile API, and referenced image/media URLs; no telemetry,
no maintainer server.
- source-common: fetchAndParseFeed, mapRawItemToFeedItem (the shared
RawFeedItem to FeedItem mapping), buildResolvedFeed, applyLimit, FeedFetchError
- source-generic: GenericRssFeedSource (RSS/Atom/podcast, body from RSS)
- source-substack: SubstackFeedSource (free RSS bodies, paywall detection sets
audience/isTruncated; section deferred to the JSON API in a later release)
32 source tests; 194 total green; tsc + eslint clean.
Bootstrap obsidian-rss-importer from plugin-templates/standard: placeholders
substituted, isDesktopOnly set true, Turndown + jsdom test deps added, esbuild
bumped to 0.28.1 to clear advisory GHSA-gv7w-rqvm-qjhr (matches shell-path-copy).
Build and lint green; main.ts is a wiring-only stub pending feature phases.
