* fix(plus): planner skips getFileTree when active note is attached (fixes#2456)
In Plus mode, the lightweight tool-planning step in
CopilotPlusChainRunner.planToolCalls() always runs regardless of the
Agent toggle. Its candidate-tools list includes getFileTree, and the
planning prompt guideline ("For file structure queries, use getFileTree
to explore the vault") was vague enough that asking "what's this note
about?" with a note already attached would trigger getFileTree before
the model answered — wasteful and surprising.
The planner had no awareness of attached context: it received only the
bare user message string, so it couldn't tell the difference between
"what's this note" (note attached → answer from context) and
"what's this note" (no attachment → maybe search for it).
Fix:
1. planToolCalls takes a new `hasActiveContextNote` parameter.
2. Caller derives the flag from the envelope's L3_TURN layer by
testing for `<active_note` markers.
3. Planning prompt:
- The existing getFileTree guideline tightened from "file structure
queries" to "ONLY when the user wants to discover or list notes/
folders" so the planner doesn't read "note" as a file-structure
cue when content is already in context.
- When hasActiveContextNote is true, append an explicit hint telling
the model not to call getFileTree just because the user says "this
note" / "this file" — and that it should still call getFileTree
when the user explicitly wants OTHER notes / folders / paths.
This preserves the legitimate cases ("are there other notes similar
to this", "create a new note in the same folder", "list folders in
projects/") because those phrases override the context hint.
Verified:
- npm run lint: pre-existing warnings only
- npm test: 116 suites / 2105 tests pass
- npm run build: succeeds
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(plus): scope active-note detection to current-turn segments
Address Codex P2: regexing the entire L3_TURN text is too permissive
because compacted envelopes merge prior-turn context into a single
"compacted_context" segment. An <active_note> tag from an earlier turn
would falsely set hasActiveContextNote=true and incorrectly suppress
getFileTree.
Inspect L3_TURN segments instead and only count those with
metadata.source === "current_turn" (the marker emitted by
parseContextIntoSegments for non-stable, this-turn parsing).
Compacted segments use source: "compacted" and won't match, so the
optimization falls back to the safe default in compacted chats.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(keychain): empty-keychain banner, reset modal copy, lifecycle reset (followup to #2364)
Three issues flagged during inline review of #2364, applied as a
followup. Each addresses a concrete user-facing risk and is mechanical.
1. **Empty-keychain banner** (AdvancedSettings.tsx)
The five-state storage status machine didn't distinguish "keychain-
only mode, keychain available, but this device's keychain is empty".
The result was a green "Obsidian Keychain" pill and no banner — even
though the user has no usable keys.
Hits three real scenarios:
- Desktop migrates → Sync ships stripped data.json to mobile →
mobile keychain is empty.
- User restores a vault backup with `_keychainOnly: true` to a new
device.
- User opens a synced vault on a third device for the first time.
Fix: new `keychainAppearsEmpty` derived state. When true, the API
Key Storage description renders a warning ("No API keys found in
this device's Obsidian Keychain — re-enter your API keys… this
device's keychain is separate from other devices.") instead of the
default "stored in this device's Obsidian Keychain" message.
2. **Reset Settings modal copy** (ResetSettingsConfirmModal.tsx)
The modal told users that resetting would "lose any custom settings
you have made including the API keys" — but in keychain-only mode,
`resetSettings()` deliberately does not touch the keychain (per the
DESIGN NOTE in model.ts). After reset, keys re-hydrate from the
keychain on next load, leading to "ghost key" reports and a privacy
expectation mismatch.
Fix: rewrite the copy so the user knows API keys are *not* cleared
and points them at "Delete All Keys" in Advanced Settings → API Key
Storage if they want the dedicated path.
3. **Module-level state lifecycle** (settingsPersistence.ts, main.ts)
`writeQueue`, `diskHasSecrets`, `lastPersistedSettings`,
`suppressNextPersist`, `transactionEpoch`, `pendingTombstones`,
`persistHadUndecryptableSecrets` are all module singletons. Plugin
disable→enable doesn't reset them (Node / Electron require cache
keeps the module instance alive), so a mid-migration disable
poisons the next session with stale epoch + tombstone state.
Switching vaults via "Open another vault" without restarting also
inherits stale baseline state until the next save refreshes it.
Fix: new exported `resetPersistenceState()` clears every module-
level variable. Called from `main.ts onunload()` alongside the
existing `KeychainService.resetInstance()` static method. Cheap
insurance, no behavioral change for the happy path.
Verification:
- npm run lint: pre-existing warnings only
- npm test: 116 suites / 2105 tests pass
- npm run build: succeeds
- Manual mobile test confirmed (empty-keychain banner appears on
freshly-synced device; reset copy reads correctly).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(keychain): move state reset from onunload to onload (addresses Codex P1)
Codex review caught a real race: onunload is fire-and-forget from
Obsidian's perspective (the method is typed void), so the `await
flushPersistence()` continuation can run AFTER the next onload has
already initialized a fresh KeychainService instance. Our late reset
would then null out the *new* instance, breaking saves and the settings
UI until another full reload.
Same intent (next session starts from clean state), no race: move the
reset to the START of onload instead.
- onload: resetPersistenceState() + KeychainService.resetInstance()
fire before KeychainService.getInstance(this.app), so the next
session always starts with a clean slate regardless of what the
previous onunload's tail did.
- onunload: keep the flushPersistence() but drop the reset calls;
inline comment explains the move and points back to onload.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(keychain): migrate API key storage to Obsidian Keychain
Replaces the legacy disk-encryption flow with Obsidian's vault-scoped
Keychain (SecretStorage) as the source of truth for API keys. Migration
is explicit and opt-in via Advanced Settings; existing vaults stay on
disk mode until the user clicks "Migrate to Obsidian Keychain".
Architecture
- `KeychainService` (singleton) wraps Obsidian's SecretStorage with a
per-vault namespace (`copilot-v{8hex}-{field}`) so multiple vaults on
one device cannot collide.
- `settingsPersistence` is the single owner of load/save:
- `loadSettingsWithKeychain()` dispatches by `_keychainOnly` flag.
- `doPersist()` writes either keychain (stripped data.json) or disk
(plaintext data.json, never new `enc_*`).
- Write queue + transaction epoch serialise every persist with
dedicated transactions (forgetAllSecrets, migrate).
- `settingsSecretTransforms` provides the pure helpers shared by both
sides (stripKeychainFields, cleanupLegacyFields, isKeychainOnly, ...).
- `encryptionService` shrinks to decrypt-only + base64/sensitive-key
helpers; new encryption writes are gone.
Migration model
- Fresh installs auto-opt-in to keychain mode; existing installs stay
disk-mode until the user clicks Migrate.
- `migrateDiskSecretsToKeychain()` is a single transaction: write
keychain -> strip data.json -> flip `_keychainOnly`. Rolls back the
keychain on partial-write or disk-save failure, and re-derives from
live settings at transaction end so concurrent edits are preserved.
- Undecryptable legacy `enc_*` values are cleared and reported via
`MigrationResult.fieldsRequiringReentry`.
Persist hardening
- Stranded vaults (keychain-only mode on a non-SecretStorage build)
preserve `_keychainOnly` and never load plaintext from disk or
silently downgrade to disk mode.
- `persistHadUndecryptableSecrets` fail-closed guard blocks disk-clear
when the last keychain save did not complete safely; a clean
disk-mode save lifts the lock so migration retry works.
- Destructive flows (clearAllVaultSecrets, forgetAllSecrets) feature-
detect `listSecrets()` and refuse before stripping disk on builds
where keychain entries cannot be enumerated.
UI
- New `MigrateConfirmModal` gates migration behind an acknowledgement
checkbox surfacing the multi-device trade-off.
- API Key Storage panel exposes active / standard / blocked /
unavailable / stranded states.
- `canClearDiskSecrets()` falls back to in-memory settings so the
Migrate / Delete-All CTAs surface immediately after a key is typed.
Testing
- New suites for keychainService, settingsPersistence,
settingsSecretTransforms, MigrateConfirmModal, password-input;
encryptionService tests rewritten for the decrypt-only surface.
- DESIGN NOTEs lock the trade-offs triaged during review (sparse
bootstrap write, rollback enc_* replay, hasEncryptionPrefix guard,
unconditional epoch bump, etc.) to prevent future review churn.
* docs(keychain): document intentional first-stage migration residue
Add a DESIGN NOTE in migrateDiskSecretsToKeychain explaining why
keychain residue from a failed first-stage persist is intentionally
left uncleaned: it stays dormant in disk-mode and self-heals on the
next successful migration or Delete All Keys.
* docs(keychain): clarify Reset Settings does not clear keychain secrets
Reset Settings rewrites data.json to defaults but does not enumerate or
remove Obsidian Keychain entries. The troubleshooting doc still promised
Reset would delete all API keys, which is false for keychain-only vaults.
- Correct the Reset warning to point users to "Delete All Keys" for
erasing keychain secrets
- Add a DESIGN NOTE on resetSettings() explaining the omission is
intentional for the first-stage migration
* style(keychain): emphasize data.json and Keychain labels in migrate modal
Add subtle background and accent coloring to the `data.json` and
`Obsidian Keychain` inline code labels so the source and destination
of the migration read more clearly.
* chore(lint): fix no-array-index-key and other React lint warnings
Re-enable @eslint-react/no-array-index-key, replace index keys with stable
ids where possible (capability enum, action label, file paths, computed
coords), and add per-line eslint-disable with rationale where index is
intentional (diff parts, append-only steps, parsed markdown, duplicate-
tolerant context badges).
Also addresses adjacent React lint warnings: useMemo for context provider
values, stable module-scope defaults for empty array props, lazy useState
initializers, and explicit type="button" on non-submit buttons. Surface
no-direct-set-state-in-use-effect as a warning for follow-up triage.
* fix: dedupe selected image files
* chore(eslint): enable no-explicit-any; fix ~395 violations
Switches @typescript-eslint/no-explicit-any from "off" to "error" and
replaces explicit `any` with proper types or `unknown` + narrowing
across ~100 source files and 15 test files. Eleven eslint-disable
comments remain: one for a BaseLanguageModel prototype patch and ten
for Orama<any> API surfaces where typed alternatives poison Orama's
internal inference to `never`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(scripts): cast chainContext to ChainManager in printPromptDebugEntry
The earlier `as any` → `as unknown` rewrite left buildAgentPromptDebugReport's
chainManager argument typed as `unknown`, which CI's `tsc -noEmit` (without
`--skipLibCheck`) flagged. Restore the cast through the real ChainManager type.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(eslint): fix remaining no-explicit-any and unnecessary-type-assertion errors
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(eslint): drop redundant no-explicit-any rule
Already set to "error" by typescript-eslint/recommendedTypeChecked via
obsidianmd's recommended config.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(styles): drop dead CSS, reduce !important, fix duplicate selectors
Removed orphaned chains (.remove-note, .chat-icon-button/.submit-button/.chain-select-button etc., .model-settings-table) that haven't had JSX consumers since PRs #1055 and #1074. Cuts !important from 23 to 14, eliminates two duplicate-selector lint warnings (.message-content pre merged; the dead .submit-button svg duplicate removed), and moves the live .message-content wrapper styles inline so the surviving rule no longer needs !important.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(eslint): whitelist Obsidian's 'clickable-icon' for tailwindcss/no-custom-classname
The eslint-plugin-tailwindcss `no-custom-classname` rule treats classes mentioned anywhere in the configured cssFiles as known. Removing the dead `.chat-icon-button.clickable-icon` selector dropped `clickable-icon` from that scanned set, which then failed lint in `button.tsx` and `dialog.tsx` where the Obsidian-provided utility is still used. Whitelist it explicitly so the lint rule no longer relies on a CSS-file mention to recognize it.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(lint): address deprecation and template-literal lint warnings
- Replace deprecated `workspace.activeLeaf` with `workspace.getActiveLeaf()`
- Convert `colorOpacityPlugin` callback to arrow function
- Pass `failedItem.type` as a separate `logWarn` arg to avoid
`never`-in-template-literal warning in exhaustive switch default
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(ci): revert activeLeaf -> getActiveLeaf swap
The installed obsidian types don't yet expose `Workspace.getActiveLeaf()`,
causing TS2551. Revert to `workspace.activeLeaf`; the deprecation notice in
the JSDoc is benign at runtime and the recommended replacements
(`getActiveViewOfType`, `getLeaf`) don't fit this use case (we need the
currently active leaf of any view type).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The `Youtube` brand icon from lucide-react is deprecated and slated for
removal. The YouTube section header and per-row icon already sit next to
the "YouTube" label or full URL, so the brand mark is redundant — collapse
both web and youtube items to the existing `Globe` icon.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
First wave of eliminating global `app` references (per Obsidian's
`obsidianmd/no-restricted-globals` rule). Adds a `useApp()` hook that
reads from `AppContext` and throws if no provider is in scope, then
converts the React layer to use it. Modals that render React content
now wrap their tree with `<AppContext.Provider value={this.app}>` so
descendants pick up the modal-owned app rather than the global one,
which matters in popout windows.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(types): tighten any types and fix langchain getType deprecation
- Replace `message.getType()` with `message.type` in BedrockChatModel
- Type `docToSave` as `OramaDocument` and `explanation` as `SearchExplanation`
- Extract a typed `fallbackMetadata` to avoid `any` union warnings
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(lint): drop unnecessary `as unknown` cast on upsert return
Now that `docToSave` is typed as `OramaDocument`, it's already assignable
to the `Promise<unknown>` return type without an explicit cast.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(mobile): handle desktop-encrypted API keys on mobile (follow-up to #2443)
PR #2443 added the Buffer polyfill to base64.ts, utils.ts, and
BedrockChatModel.ts but missed src/encryptionService.ts:119. My
original write-up incorrectly claimed mobile never enters the
DESKTOP_PREFIX branch of getDecryptedKey — it does, whenever a user
encrypts their API keys on desktop and then syncs the vault to mobile
via Obsidian Sync. Mobile reads the same encrypted blob, enters the
DESKTOP_PREFIX branch, and hits `Buffer.from(...)`, which throws
"Can't find variable: Buffer" on iOS WebKit.
User reproducer: "Model request failed: Can't find variable: Buffer"
during normal chat send on mobile after PR #2443 merged.
Two-part fix:
1. Add `import { Buffer } from "buffer"` (the npm polyfill, already in
dependencies and used in PR #2443) so the literal ReferenceError is
gone. The legacy ENCRYPTION_PREFIX branch at line 137 also benefits.
2. Even with Buffer available, the next line
`getSafeStorage()!.decryptString(buffer)` cannot succeed on mobile
because there is no Electron safeStorage there. The encrypted blob
uses OS-level encryption (Keychain on macOS, DPAPI on Windows,
libsecret on Linux) that cannot be replayed from mobile. Add a
Platform.isMobile guard that throws a clear, actionable error
asking the user to re-enter their API key on this device instead
of crashing on the unreachable decryption call.
Out of scope:
- The DESKTOP_PREFIX-on-mobile situation requires the user to re-save
their key in mobile settings (which will re-encrypt with
WEBCRYPTO_PREFIX, the cross-platform path that Web Crypto handles).
Surfacing a clear error is the right user experience until the
plugin auto-migrates on first mobile launch — that's a larger
follow-up not appropriate for a same-day hotfix.
- The legacy ENCRYPTION_PREFIX branch at line 137 still references
Buffer, but it's already gated by
`getSafeStorage()?.isEncryptionAvailable()` which returns false on
mobile, so mobile never enters it. The new import covers it
defensively if that gate ever changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(mobile): list desktop-encrypted keys on mobile load + block desktop encryption
Two additions on top of the existing fix in this PR:
1. **Guard the encryption side with Platform.isDesktop.** Mobile should
NEVER produce DESKTOP_PREFIX keys, even if `require("electron")`
happens to return a truthy shim. Before this change, the only gate
was `getSafeStorage()?.isEncryptionAvailable()` — fragile, since
any mobile environment that exposes a partial Electron-like shim
could slip through and save a key as DESKTOP_PREFIX that the same
device then can't decrypt.
2. **Surface a Notice on mobile load** listing every key field that's
still DESKTOP_PREFIX-encrypted. Without this, the user only finds
out which key needs re-entry by hitting a chat error and having to
guess. With it, they see the full list at startup:
"Copilot: 3 API key(s) encrypted on desktop and unusable on
mobile. Re-enter in Copilot settings: plusLicenseKey,
openAIApiKey, activeModels[gpt-5.5]"
Notice has timeout 0 so it stays until dismissed.
The new exported `findDesktopEncryptedKeyFields(settings)` walks:
- All top-level string settings (catches plusLicenseKey,
openAIApiKey, anthropicApiKey, githubCopilotToken, etc.)
- settings.activeModels[*].apiKey (per-model custom keys)
- settings.activeEmbeddingModels[*].apiKey
The exact field names returned match the keys in data.json so the
user can grep / inspect / re-enter them confidently.
This addresses the user report after the first commit in this PR:
"despite reentering api key on mobile" — which happened because they
re-entered one key but a *different* key (likely plusLicenseKey or
a model-specific apiKey) was still DESKTOP_PREFIX, causing the chat
to fail on that other key.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(encryption): deprecate encryption-at-rest; make encrypt/save a no-op
The encryption toggle has created repeated incidents:
1. Mobile cannot decrypt DESKTOP_PREFIX (Electron safeStorage) keys
that synced over from desktop, because mobile has no safeStorage.
2. The WebCrypto path is security theater — the AES-GCM key is a
hardcoded "obsidian-copilot-v1" string, so anyone with data.json
can decrypt every "encrypted" key in seconds.
3. PRs #2401 and #2403 (3.3.0) introduced bare `Buffer.from` in the
encryption + base64 paths, which crashed mobile WebView with
"Can't find variable: Buffer" — see #2443 and earlier commits in
this PR.
4. Even with that fixed, the eager dispatch-map builders in
chatModelManager / embeddingManager await getDecryptedKey for
every provider; a throw on the one bad desktop-encrypted key
killed chats that used a different provider with a valid key.
Rather than continue patching, deprecate the toggle and stop adding
encryption to new keys. Existing encrypted blobs in data.json remain
readable via getDecryptedKey (for all three legacy formats:
DESKTOP_PREFIX, WEBCRYPTO_PREFIX, and the original `enc_`); they
migrate organically to plaintext the next time the user re-saves any
given key.
Changes:
- `encryptAllKeys` → no-op (returns settings unchanged). 6+ lines of
per-field encryption gone.
- `getEncryptedKey` → no-op (returns plaintext, strips `dec_` marker
if present). 25 lines of safeStorage / WebCrypto / DESKTOP_PREFIX
branching gone.
- `main.ts` settings-save → unconditionally `saveData(next)` instead
of branching on `enableEncryption`. The setting field stays in the
CopilotSettings interface for backwards-compat with existing
data.json files but is no longer read or written.
- `AdvancedSettings.tsx` → "Enable Encryption" toggle removed from
the UI. Users who had it on get no further encryption; users who
had it off see no change.
Mobile-specific path inside `getDecryptedKey`:
- DESKTOP_PREFIX keys on mobile return `DESKTOP_KEY_ON_MOBILE_SENTINEL`
(no longer throw). chatModelManager / embeddingManager's eager
dispatch-map construction completes; the sentinel sits harmlessly
in unused config slots; providers actually being used with valid
plaintext keys work. The startup Notice (already in this PR)
surfaces which fields the user must re-enter.
Tests:
- `getEncryptedKey` test suite rewritten to verify the new no-op
behavior (plaintext passthrough, dec_ stripping, empty-string).
- `encryptAllKeys` test suite shrunk to one identity-return assertion.
- Cross-platform encrypt/decrypt round-trip tests removed (encryption
is gone). Added a legacy WebCrypto decrypt test to confirm we can
still read existing enc_web_* blobs.
- 1974 tests pass (was 1975; -1 for the dropped round-trip test).
Net change: encryptionService.ts down from 207 to 130 lines.
Risk:
- `data.json` now contains plaintext API keys after first re-save.
Worth saying explicitly in release notes. The previous "encryption"
was indistinguishable from plaintext for anyone with filesystem
access (hardcoded WebCrypto key), so this is a documentation
change more than a security change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(mobile): simplify to a throw; drop sentinel + Notice + helper
User feedback: the sentinel + startup-Notice approach added 70+ lines of
transitional code that we'd have to delete later. Replace with the
lightest viable shape.
- Mobile DESKTOP_PREFIX branch in getDecryptedKey now throws a generic
but actionable error ("re-enter your API keys on this device") and
nothing else.
- Removed DESKTOP_KEY_ON_MOBILE_SENTINEL constant.
- Removed findDesktopEncryptedKeyFields function.
- Removed the startup Notice block in main.ts and its import.
Trade-off accepted: with multiple desktop-encrypted keys present, the
chat fails on the first one the eager dispatch-map encounters; user
re-enters that key, retries, hits the next bad key, repeats. The
generic message tells them what to do; they iterate rather than seeing
the full list up front.
Net: -71 lines vs. previous approach. Future cleanup (when no users
have desktop-encrypted keys anymore) is one small if-branch in
getDecryptedKey instead of a sentinel + assert + helper + Notice
spread across four files.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(settings): restore version chip + reset button hidden by Obsidian h1 CSS
The top-of-settings row (Copilot Settings title, version chip, "(up to
date)" annotation, Reset Settings button) is rendered but invisible in
current Obsidian releases. DOM inspection confirms the <h1> wrapping
the row has `display: none` applied with `height: 0`:
h1Texts: ["Copilot Settingsv3.3.0 (up to date)Reset Settings"]
h1Styles: [{ display: "none", height: 0, visibility: "visible" }]
Cause: Obsidian's settings modal CSS hides plugin-rendered <h1> elements
because Obsidian reserves the top-level heading slot in a settings tab
for itself. This convention was tightened in a recent Obsidian release,
so the same code that worked at <h1>'s introduction (PR #1194) and
update-notification addition (PR #1415) now silently renders zero-height.
Fix: replace the <h1> with a <div role="heading" aria-level={1}> that
carries the same heading-style classes (tw-text-2xl tw-font-bold) plus
the existing flex/layout classes. The accessibility role/level preserves
the heading semantic for screen readers without triggering Obsidian's
display:none on real <h1>. The small-text version chip is now explicitly
tw-font-normal so it doesn't inherit the wrapper's tw-font-bold.
Verified by DOM diagnostic in live Obsidian: <h1> was being hidden;
<div role="heading"> is not affected by the same CSS rule.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(settings): shrink restored heading and add spacing below
Per request: make the restored title row much smaller (tw-text-2xl
tw-font-bold → tw-text-base tw-font-semibold) and add tw-mb-4 spacing
below it so it sits comfortably above the tabs row.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces `any`-typed mock objects in 26 test files with structured
types using `jest.Mock`, casts requireMock results to typed shapes,
and introduces `internals()` helpers for private-method access. No
production code changes; eliminates 487 of 679 no-unsafe-call
violations in preparation for enabling the rule.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mobile Obsidian runs on Capacitor + WebView (no Node.js runtime), so the
bare `Buffer` global is undefined. On iOS WebKit this surfaces as the
runtime error "Can't find variable: Buffer" the moment the image
processing path fires. Desktop is unaffected because Electron exposes
Node globals.
Two PRs in 3.3.0 introduced direct `Buffer.from(...)` calls in
image-handling paths assuming "Buffer is global":
- #2403 rewrote src/utils/base64.ts from btoa/atob to bare Buffer.from
- #2401 did the same in src/utils.ts safeFetch arrayBuffer branch and
src/LLMProviders/BedrockChatModel.ts decodeBase64ToUint8Array
Result: any image attachment on mobile fails with "failed to send
image, please try again". Confirmed via user log:
ERROR Error sending message: Can't find variable: Buffer
The fix is an explicit `import { Buffer } from "buffer"` in each
affected file. The `buffer` npm package (already in dependencies) is a
browser-compatible polyfill that esbuild bundles into main.js, so the
same Buffer code path works on desktop (where it's effectively the
Electron-provided Buffer) and on mobile (where it's the polyfill).
Two lint rules complicate this:
- Obsidian's official scorecard flags btoa/atob as deprecated and
asks for Buffer.from. That rules out reverting to btoa/atob.
- The repo's own `import/no-nodejs-modules` rule blocks `import from
"buffer"`. Suppressed inline at each import site with justification,
because `buffer` here is the npm polyfill (in package.json
dependencies), not Node's built-in being used at runtime.
Files touched:
- src/utils/base64.ts (arrayBufferToBase64 / base64ToArrayBuffer)
This is the call site the image processor hits and the path
encryptionService.ts uses for WEBCRYPTO_PREFIX (mobile encryption),
so mobile encryption is also fixed transitively.
- src/utils.ts (safeFetch arrayBuffer fallback)
- src/LLMProviders/BedrockChatModel.ts (decodeBase64ToUint8Array)
Regression test:
- src/utils/base64.test.ts deletes globalThis.Buffer before exercising
the helpers to confirm the imported polyfill binding is what gets
used (not a bare global reference). Catches any future regression
where someone replaces the import with a bare global usage.
Out of scope:
- src/encryptionService.ts has Buffer.from references but they sit
inside desktop-only branches (`getSafeStorage().isEncryptionAvailable()`
/ DESKTOP_PREFIX) that mobile never enters. Touching them from a
mobile hotfix would expand blast radius unnecessarily.
- src/LLMProviders/BedrockChatModel.ts:835 is already guarded with
`typeof Buffer !== "undefined"` so mobile skips it; left alone.
Bundle size unchanged at 3.3 MB (buffer polyfill is small).
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a test-only override enforcing @typescript-eslint/no-unsafe-assignment
on **/*.test.{ts,tsx} and fixes all 378 violations across 44 test files.
Production code (~499 violations) remains a follow-up PR — the rule stays
"off" globally, with the violation count comment updated to reflect that.
Common fix patterns applied:
- Typed accessor helpers (asInternal) for private-method access via
`as unknown as Shape`, replacing `(instance as any).method(...)`.
- Inline `as <Type>` on mock indexing (mock.calls[i][j]), JSON.parse,
and jest.requireMock results.
- mockTFile()/mockTFolder() from @/__tests__/mockObsidian replacing
`Object.create(TFile.prototype)` (also avoids obsidianmd/no-tfile-tfolder-cast).
- `as unknown as RealType` for mock-object casts where `as any` previously
masked the assignment.
Enables @typescript-eslint/no-unsafe-member-access globally. Tests and 41
heavy source files (>5 violations each) are exempted via per-file overrides
with current violation counts annotated for follow-up PRs. Fixes 124
violations across 51 source files using narrow type assertions, instanceof
Error guards, and proper structural types instead of blanket any casts.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(quick-command): restore Cmd+Enter shortcut and shortcut hint icons
The Quick Ask/Command revamp (#2139) replaced an Obsidian Modal with a
standalone DraggableModal. Two regressions slipped through:
- The new modal didn't push a Scope, so any user-bound global Cmd+Enter
hotkey would fire instead of Replace. Push a Scope in
`CustomCommandChatModal.open()` that registers Mod+Enter and
Mod+Shift+Enter as no-op consumers (the React onKeyDown does the real
work) and pop it in close(), matching what `Modal` did automatically.
- The Insert/Replace buttons lost the inline ⌘↩ / ⌘⇧↩ glyph hints that
existed in the pre-revamp modal. Re-add them with Lucide icons
(`Command`, `ArrowBigUp`, `CornerDownLeft`) in `action-buttons.tsx`,
with a Ctrl-text fallback on non-mac.
Also move the shortcut handler from a document-level keydown listener
back to a React `onKeyDown` on the modal subtree — same pattern as the
original implementation — so it can't be pre-empted by capture-phase
listeners.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(quick-command): widen dialog so footer fits Note checkbox + shortcut glyphs
Quick Command mode renders an extra "Note" context checkbox alongside the
model selector and action buttons. With the restored ⌘⇧↩ / ⌘↩ glyphs on
Insert/Replace, the default 500px footer overflows. Bump the initial
width to `min(620px, 92vw)` only when `hideContentAreaOnIdle` (the
Quick Command signal) is set; Custom Commands keep the original width.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(quick-command): widen modal unconditionally instead of gating on mode
Apply the wider footer to Custom Commands too — same overflow potential
once the Insert/Replace glyph hints are present.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Enabled in the TS-only override block. Disabled for test files since
jest assertion patterns (`expect(mock.method).toHaveBeenCalled()`)
reference methods unbound by design and have no clean workaround.
Fixed the single real source violation in colorOpacityPlugin by
calling addUtilities through the plugin API object instead of
destructuring it.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Moves the rule into the TS-only config block (the plugin is only registered
for .ts/.tsx). Fixes 187 violations across 74 files using narrow `as` casts,
explicit return-type annotations on callbacks, typed intermediate variables,
and tightening parameter types from `any` to `unknown` where it didn't break
callers. Also replaces the `@ts-ignore`'d `Electron.SafeStorage` reference
with a local `SafeStorage` interface in `encryptionService.ts`. No prompt
content modified; no `eslint-disable` comments added.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The four obsidianmd typed rules (no-view-references-in-plugin,
no-unsupported-api, prefer-file-manager-trash-file, prefer-instanceof)
are already gated to **/*.ts(x) by the plugin's hybridRecommendedConfig,
so disabling them on non-TS files is a no-op. Only no-plugin-as-component
and @typescript-eslint/no-deprecated actually leak onto non-TS files.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Turns on no-unsafe-enum-comparison, no-base-to-string,
no-redundant-type-constituents, and restrict-template-expressions.
Fixes all 24 violations across 13 source files.
Removes the `off` override and fixes all 368 violations via type casts,
widened parameter types (unknown / string|null|undefined for functions
that defensively handle non-string inputs), and concrete types in place
of `any` for Lexical nodes, mock objects, and option handlers.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(eslint): enable no-unnecessary-type-assertion and no-misused-promises
Auto-fixed all 40 no-unnecessary-type-assertion violations via `eslint --fix`.
For no-misused-promises, configured `checksVoidReturn` with two relaxations
(documented inline):
- `attributes: false` — `onClick={async () => ...}` is the standard React pattern
- `inheritedMethods: false` — Obsidian's Plugin.onload/onunload are async
Fixed the remaining 10 violations by hand:
- Wrapped async subscribers/listeners with `void` (projectManager, useChatFileDrop,
main.ts, webViewerServiceSelection)
- Widened ConfirmModal subclass callback types to `() => void | Promise<void>`
- Widened MobileCardDropdownAction.onClick to match parent prop types
- Made SettingsMainV2 handleReset sync (it never awaited anything)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(eslint): move no-misused-promises to TS-only config block
The @typescript-eslint plugin is registered only for .ts/.tsx files via
obsidianmd's recommendedTypeChecked. Enabling the rule in the
JS+TS-shared block caused CI to fail with "could not find plugin
@typescript-eslint" because the plugin isn't loaded for .js/.mjs files.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add a step that signs main.js, manifest.json, and styles.css with the
workflow's OIDC identity and publishes the attestation to Sigstore's
public transparency log via actions/attest-build-provenance@v2.
Why: Obsidian's plugin review tooling flags release assets without an
attestation as a soft warning. Attestations cryptographically prove the
asset was built by this workflow on this commit, defending against an
attacker who gains release-asset-replace permissions and silently swaps
in a compromised main.js. Verification post-release:
gh attestation verify main.js --owner logancyang --repo logancyang/obsidian-copilot
Placement: the new step runs AFTER the prerelease manifest swap and
BEFORE gh release create. That way the attested manifest.json is
exactly the bytes that get uploaded — for stable releases that's
the committed manifest.json; for prereleases it's the in-runner
copy of manifest-beta.json.
Permissions: adds attestations: write and id-token: write to the job.
The id-token: write permission is what allows the workflow to request
an OIDC token from GitHub; the attest action uses that token as proof
of identity when signing. No secrets to manage.
Free for public repos.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(release): make prerelease tooling stop poisoning master's manifest.json
Background: Obsidian's community plugin store reads manifest.json from master
to decide which GitHub Release to serve installers. The prerelease agent's
npm version bump was rewriting manifest.json with a prerelease version, which
broke plugin installs until hotfix #2428 reverted master's manifest.json to
the stable version.
This PR fixes the underlying tooling so it can't recur.
Changes:
- version-bump.mjs now branches on whether npm_package_version is a prerelease
(contains a hyphen). Stable: writes to manifest.json + versions.json. Prerelease:
writes to manifest-beta.json + versions.json, leaving manifest.json untouched.
Seeds manifest-beta.json from manifest.json when it doesn't exist yet.
On a stable bump that finds a stale manifest-beta.json, removes it (git rm)
because the new stable supersedes the in-flight beta. Stages the right files
itself; package.json no longer needs the explicit git-add step.
- package.json: simplifies the "version" lifecycle script to just
"node version-bump.mjs" since the script now stages files itself.
- release.yml:
* "Verify version matches manifest" step now selects the file based on
is_prerelease (manifest.json for stable, manifest-beta.json for prerelease).
For stable runs nothing changes.
* Adds a "Prepare release-asset manifest" step before the release upload that
copies manifest-beta.json over manifest.json IN THE RUNNER only when the
release is a prerelease. This makes the uploaded manifest.json asset carry
the prerelease version so testers sideloading the assets get a consistent
manifest. The committed master manifest.json is never touched by the
workflow (the workflow doesn't push back).
- .claude/agents/release.md: adds a Step 0 pre-flight assertion that master's
manifest.json.version equals the latest non-prerelease GitHub Release tag.
Catches drift loudly before doing any work. Notes the manifest-beta.json
auto-removal in the rules.
- .claude/agents/prerelease.md: documents the manifest.json / manifest-beta.json
split. Adds the same Step 0 drift assertion. Updates the git add step to
stage manifest-beta.json instead of manifest.json. Adds an explicit guard
rule that manifest.json must not change during a prerelease bump.
Verified locally by exercising version-bump.mjs in a throwaway repo:
- Stable 3.2.8 -> 3.2.9: writes manifest.json + versions.json, no beta side
- Prerelease 3.2.8 -> 3.2.9-beta.0: creates manifest-beta.json, manifest.json untouched
- Prerelease iteration 3.2.9-beta.0 -> 3.2.9-beta.1: updates manifest-beta.json,
manifest.json untouched
- Stable supersedes beta 3.2.9-beta.1 -> 3.2.9: writes manifest.json,
git-rm's manifest-beta.json
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(release): address Codex review on PR #2429
1. release.yml: when verifying a prerelease, also assert that the committed
manifest.json on the merge commit still equals the latest non-prerelease
GitHub Release tag. This catches an old-style version bump or hand edit
that accidentally modified master's manifest.json — without this guard,
the verify step only inspected manifest-beta.json so a poisoned
manifest.json could merge unnoticed and break the Obsidian plugin store.
2. version-bump.mjs: don't fail stable bumps when manifest-beta.json exists
on disk but is untracked (or has local modifications). Check git
trackedness first; use `git rm -f` only when tracked, fall back to a
plain unlink for working-tree-only files. Logs which path it took.
Verified both scenarios in a throwaway repo:
- Untracked manifest-beta.json + stable bump: unlinked, no git rm error
- Tracked manifest-beta.json + stable bump: staged deletion via git rm -f
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(release): use /releases/latest API for stable-drift guard
gh release list defaults to 30 results, so a cluster of 30+ prereleases
since the last stable would make the prerelease drift guard return empty
and fail valid prerelease publishes. Switch to GitHub's /releases/latest
endpoint instead, which by design returns only the most-recent
non-prerelease, non-draft release in a single call regardless of how
many prereleases have accumulated.
Applied the same fix to the Step 0 drift check in both the release agent
and prerelease agent doc for consistency.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
URGENT FIX. The prerelease agent's npm version run on PR #2427 left master's
manifest.json with version "3.2.9-beta.0", but Obsidian's community plugin
store reads manifest.json on master to determine which GitHub Release to
serve to new installers. With the stable release at 3.2.8 and master's
manifest pointing at a prerelease tag, plugin installs and updates were
breaking for users.
Fix:
- manifest.json on master: version back to "3.2.8" (the latest stable
release). minAppVersion 1.7.2 and isDesktopOnly:false are preserved.
- manifest-beta.json (new): full manifest for 3.2.9-beta.0 so BRAT and
similar beta-installer tools can locate the prerelease without us
poisoning master's stable manifest.
The longer-term fix (version-bump.mjs + prerelease agent updates so
this can't recur) follows in a separate PR.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(release): add prerelease agent + workflow support, harden release agent pre-flight
- release.yml: accept prerelease semver in PR titles (X.Y.Z-tag.N) and
pass --prerelease to gh release create so prereleases are not offered
as stable updates via Obsidian's plugin browser.
- .claude/agents/release.md: add a Step 0 pre-flight (clean tree, full
project check, bundle size guard, manifest integrity, non-empty diff
since last tag) and explicit rules against silently changing
minAppVersion/isDesktopOnly or shipping with broken checks.
- .claude/agents/prerelease.md: new agent. Mirrors the stable release
flow but bumps via npm version prepatch/prerelease with --preid, emits
prerelease-shaped semver titles, and produces testing-focused release
notes with explicit "What to Test" and "How to Install" sections.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(release): make prerelease regex match full SemVer 2.0.0 grammar
Previous pattern '^[0-9]+\.[0-9]+\.[0-9]+-[a-zA-Z0-9.]+$' rejected hyphens
inside prerelease identifiers, so valid SemVer titles like '3.2.9-beta-hotfix.1'
would fall through to the reject branch and the merged PR would silently skip
publishing a GitHub Release.
New pattern '^[0-9]+\.[0-9]+\.[0-9]+-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*$' allows:
- hyphens within identifiers (e.g. beta-hotfix)
- dot-separated multiple identifiers
- single identifier (e.g. 3.2.9-alpha)
And still rejects malformed cases: '3.2.9-', '3.2.9-.1', '3.2.9-x.', '3.2.9-x..y'.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(release): tighten prerelease title to require numeric counter
Previous pattern accepted any SemVer prerelease suffix, including bare
labels like '3.2.9-beta' or '3.2.9-feature' with no counter. That broadened
the workflow's release-trigger surface beyond the documented agent
contract of 'X.Y.Z-<tag>.<N>'.
New pattern '^[0-9]+\.[0-9]+\.[0-9]+-[0-9A-Za-z-]+\.[0-9]+$' requires
exactly one alphanumeric (hyphen-allowed) identifier followed by a
numeric counter, which is what 'npm version prepatch/prerelease --preid=...'
actually emits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- minAppVersion 1.4.0 -> 1.7.2: matches the actual Obsidian APIs the code
already calls (Workspace.revealLeaf needs 1.7.2; FileManager.processFrontMatter
needs 1.4.4). Users on Obsidian < 1.7.2 were already hitting runtime errors
on those code paths; stating an honest minimum prevents the install.
- Add isDesktopOnly: false: Chat, Vault QA, and Plus modes work on mobile
(extensive Platform.isMobile guards already in place across dbOperations,
vectorStoreManager, indexEventHandler, CopilotView, etc.).
Addresses two warnings from the Obsidian plugin preview check:
* "Manifest is missing optional but recommended field: isDesktopOnly"
* "'Workspace.revealLeaf' requires Obsidian v1.7.2, but minAppVersion is 1.4.0"
* "'FileManager.processFrontMatter' requires Obsidian v1.4.4, but minAppVersion is 1.4.0"
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes the `no-restricted-imports: off` override so the obsidianmd recommended
rule applies (bans axios/node-fetch/moment/etc.). Replaces the two `moment(...)`
call sites in `src/utils.ts` with `luxon`'s `DateTime` (already a dep) and adds
unit tests covering local/UTC formatting, zero-padding, immutability, and the
invalid-input fallback. Integration tests get a per-file override since they
need `node-fetch` to polyfill jsdom fetch. `no-restricted-globals` stays
disabled — banning the global `app` will land in a separate PR.
Removes the "off" overrides for depend/ban-dependencies, configures the
package.json check with an allowed-list for deps we deliberately keep
(crypto-js, lodash.debounce, eslint-plugin-react, lint-staged, npm-run-all),
and drops three unused direct deps: axios, builtin-modules, and node-fetch
(plus @types/node-fetch). The integration-test fetch polyfills are no longer
needed in Node 18+ jsdom.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes the deferred "off" overrides from eslint.config.mjs so the
obsidianmd recommended config's "error" severity applies. Scopes
import/no-nodejs-modules off for test setup, mocks, and Node-context
build scripts (e.g. jest.setup.js polyfills TextEncoder/TextDecoder
from node:util). import/no-extraneous-dependencies is now enabled
everywhere; declared js-yaml, dotenv, and @jest/globals as explicit
devDependencies so transitive uses pass.
Fixes the one real violation in src/utils.ts by migrating two moment
call sites (formatDateTime, stringToFormattedDateTime) to Luxon, which
is already in dependencies. Adds 10 unit tests covering UTC/local
formatting, zero-padding, round-tripping, and invalid-input fallback.
Remove the explicit "off" overrides in eslint.config.mjs so the rules
from obsidianmd.configs.recommended apply. Add a scoped disable for the
sole violation in scripts/printPromptDebug.js, where the dynamic import
targets a controlled path under os.tmpdir() produced by esbuild.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Group the 14 disabled @typescript-eslint rules into Heavy / Medium / Quick-win
buckets with inline violation counts measured against src/**/*.{ts,tsx}. Makes
it obvious which rules (e.g. restrict-template-expressions at 1, no-base-to-string
at 7) are cheap follow-ups vs. the no-unsafe-* family that dominates the block.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drops the `off` override so the rule (set to `error` by obsidianmd's
recommended config) is enforced. Fixes the one production violation in
markdown-preview by using `replaceChildren()` instead of clearing via
`innerHTML`. Rewrites test fixtures to use `DOMParser` and mock impls
to use `textContent` so the rule is on for tests too.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(lint): enable obsidianmd/rule-custom-message and fix violations
Turn on the obsidianmd/rule-custom-message ESLint rule (which wraps no-console
to enforce logInfo/logWarn/logError over console.log per AGENTS.md). Swap
console.log → logInfo across LLMProviders/ and search/, and delete console.log
noise from test files.
src/logger.ts, src/chainFactory.ts (circular import with constants), and
scripts/** are exempted via narrow file overrides.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(lint): enable obsidianmd/no-unsupported-api (#2414)
Removes the deferred "off" override so the rule runs at the recommended
severity on .ts/.tsx. With manifest.minAppVersion=1.4.0 and obsidian@1.2.5
(no @since tags) the rule fires on nothing today — it acts as a guard for
future obsidian type-stub bumps.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(lint): enable obsidianmd/object-assign rule (#2415)
Follow-up to #2410. The rule only flags `Object.assign(<ident-containing-default>, <non-object-literal>)` — the Obsidian anti-pattern of mutating DEFAULT_SETTINGS. No call sites in this repo match, so enabling produces zero new errors.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: extract ChainType into src/chainType.ts to break import cycle
constants.ts → chainFactory.ts → logger.ts → settings/model.ts → constants.ts
formed a runtime cycle because chainFactory.ts (a heavy LangChain module) re-
exported the ChainType enum that constants.ts needed at module load. Move the
enum into a tiny standalone file, update all 26 importers, and restore
logInfo in chainFactory.ts. The eslint override for chainFactory.ts is no
longer needed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Follow-up to #2410. The rule only flags `Object.assign(<ident-containing-default>, <non-object-literal>)` — the Obsidian anti-pattern of mutating DEFAULT_SETTINGS. No call sites in this repo match, so enabling produces zero new errors.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes the deferred "off" override so the rule runs at the recommended
severity on .ts/.tsx. With manifest.minAppVersion=1.4.0 and obsidian@1.2.5
(no @since tags) the rule fires on nothing today — it acts as a guard for
future obsidian type-stub bumps.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes the deferred `"off"` override and rewrites the 55 violations
(all in test/mocks/Node-script files) to use `window.*` instead of
`global.*`. Production code was already cleaned up in #2401.
- 18 test files + __mocks__/obsidian.js + jest.setup.js: mechanical
`global.X` → `window.X` (Jest runs under jsdom, so window === globalThis)
- scripts/printPromptDebugEntry.ts: inline eslint-disable — Node-only
debug script with no window available
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Flip the rule from "off" to "error" to catch accidental references to
the global `document` (which always points at the main window even when
the user is interacting with a popout).
The only flagged site was a `document` field on the `RelevantNoteEntry`
type — not a DOM reference, but the rule pattern-matches the identifier.
Rename it to `note` so `entry.note.path/title` reads naturally next to
`entry.metadata.*`, and remove the suppression.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace `app.vault.getFiles().find(f => f.path === id)` lookups in the
Project Context Manage modal with `getAbstractFileByPath` + `instanceof
TFile` narrowing — direct hash lookup vs full-vault scan.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- CONTRIBUTING.md: new "Commit Signing" section with the 4-step SSH
signing setup so future protection rules requiring signed commits
can be turned on with team-ready instructions in place.
- README.md: remove the abbreviated ToC, promote the comprehensive
one to the top, drop the self-referencing entry.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(vault): respect user trash preference via FileManager.trashFile (W7/9)
Eighth of nine workspaces splitting #2397. Intentional behavior change:
file deletions now honor the user's Settings -> Files and links ->
Deleted files preference (system trash / .trash / permanent), instead
of unconditionally calling vault.delete(file, true).
- src/utils/vaultAdapterUtils.ts: add trashFile(app, file) helper that
casts past the missing app.fileManager.trashFile typedef.
createSyntheticTFile now uses Object.create(TFile.prototype) so
instanceof TFile returns true.
- src/projects/ProjectFileManager.ts: constructor takes App instead
of Vault; all vault.delete(file, true) -> trashFile(app, file).
Project create rollback now trashes partial files (was permanent-
delete before).
- src/projects/projectRegister.ts: constructor takes App.
- src/projects/projectMigration.ts: rollbackCreatedFile(app, ...),
ensureProjectsMigratedIfNeeded(app), all delete sites use trashFile.
- src/main.ts: deleteChatHistory uses trashFile; ProjectRegister
constructed with this.app.
- src/system-prompts/systemPromptManager.ts: prompt delete via trashFile.
- src/commands/customCommandManager.ts: command delete via trashFile.
- src/LLMProviders/projectManager.ts, src/components/Chat.tsx,
src/components/chat-components/ProjectList.tsx: pass app (not vault)
to ProjectFileManager.getInstance.
- __mocks__/obsidian.js: app.fileManager.trashFile jest mock.
- Tests updated to expect trashFile + App constructor arg.
W0, W1, and #2402 already merged. Behavior change requires manual
verification (test plan section 1 + 6).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore(manifest): bump minAppVersion to 1.4.0
FileManager.trashFile (used by the vault deletion helper introduced in
W7/9) requires Obsidian 1.4+. Bumping minAppVersion ensures the plugin
store only offers this and future releases to compatible app versions;
users on older Obsidian builds stay on their current Copilot version
instead of receiving an update that would crash on delete.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Seventh of nine workspaces splitting #2397. Picks up provider-file
changes W1 deferred — primarily LangChain public-API renames that
aren't pure type changes.
- src/LLMProviders/BedrockChatModel.ts: _getType() -> getType()
(non-deprecated method, same behavior)
- src/LLMProviders/BedrockChatModel.test.ts: matching mock-message
rename across all streaming-decode tests
- src/LLMProviders/chainRunner/CopilotPlusChainRunner.ts: stringify
non-string response.content via JSON.stringify instead of String()
(avoids [object Object] when content is structured)
No semantic message-handling changes. All behavior preserved.
W0, W1, and #2402 already merged.
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
