- Flip isDesktopOnly to false in manifest.json; the runtime code uses
only platform-safe APIs (requestUrl, crypto.subtle, URLSearchParams).
- Register obsidian://ticktick-callback protocol handler so the OAuth
redirect returns directly into Obsidian on desktop and mobile,
removing the manual copy-paste step.
- Verify state parameter against tempState to mitigate CSRF, and clear
tempCodeVerifier/tempState after a successful exchange.
- Update Vercel callback pages (callback.html, index.html) to redirect
to the obsidian:// deep link instead of displaying the code as text.
Note: the deployed Vercel page must be redeployed for users to see
the new behavior.
- Drop the now-vestigial "Authorization code" paste field from the
settings UI.
