Patch release: fix the mobile example-template viewer, which 1.4.0
shipped collapsed to ~2 lines. flex-shrink:0 stops the mobile modal's
flex column from squeezing the content box below its set height.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Highlights since 1.3.3:
- Transcript extraction reworked onto the YouTube iOS InnerTube
player API; the four broken free local fallbacks removed.
- OpenRouter model-list refresh with a vendor-grouped dropdown.
- Service-URL info icons for ScrapeCreators, Supadata, OpenRouter.
- Desktop processing no longer leaves a blank popup.
- Mobile example-template viewer enlarged so content is visible.
- UI primitives migrated to native Obsidian components (Tier A).
- README network/base64 disclosures completed.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Releases the current state as a stable before/after boundary:
- Copy template button restored (mobile users cannot scroll the
template example), plus a mobile touch-scroll hint.
- Settings info-icon tooltips fixed: native Obsidian setTooltip
replaces the flaky custom hover tooltip; OpenRouter reliability
note added to the LLM tooltip.
- Workflow and data-flow mermaid diagrams refreshed to current
architecture.
- README links made absolute so they resolve on the community site;
demo video linked.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Release of the vault-enumeration and clipboard surface reduction:
the plugin no longer calls getMarkdownFiles / getAllLoadedFiles or
navigator.clipboard, so the Obsidian scorecard's Vault Enumeration and
Clipboard Access flags clear.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace @langchain/core's tiktoken helper with a network-free stub via
an esbuild onLoad plugin. The upstream module lazy-fetches tokenizer
data from https://tiktoken.pages.dev; TubeSage never counts tokens, so
that path was unreachable, but the URL still sat in the bundle and
showed up as an external domain on the Obsidian plugin scorecard. The
stub removes it from main.js entirely.
- esbuild.config.mjs: add the stub-langchain-tiktoken onLoad plugin
- README.md: drop the tiktoken.pages.dev disclosure (no longer contacted)
- bump manifest.json / package.json / package-lock.json to 1.3.1
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Bump eslint-plugin-obsidianmd 0.2.9 -> 0.3.0 and typescript-eslint
8.58.2 -> 8.59.3. ESLint stays at 9.39.4: obsidianmd 0.3.0 peer-pins
@eslint/js ^9 and @eslint/json 0.14.0, so ESLint 10 is not yet
cleanly supported.
obsidianmd 0.3.0 adds two new rules. Fixes for the errors they raise:
- no-unnecessary-type-assertion: remove 4 redundant type assertions
(main.ts x3, fetch-shim.ts x1) - all compile-time-only, tsc confirms.
- prefer-window-timers: switch 11 activeWindow timer calls to window
(main.ts, form-utils.ts, processing-spinner.ts). TubeSage has no
popout-window feature, so window === activeWindow at every call site.
Note: obsidianmd 0.3.0's prefer-active-doc rule (warning) now flags
window.* as preferring activeWindow, directly contradicting the
error-level prefer-window-timers rule. window.* is kept because it
satisfies the error-level rule; the 11 advisory warnings are an
upstream rule conflict and cannot be resolved without suppression.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
langsmith 0.5.26 (transitive via @langchain/core) is vulnerable to
GHSA-3644-q5cj-c5c7 (public prompt pull deserializes untrusted manifests
without trust boundary warning). Patched in 0.6.0.
The previous override was pinning to ^0.5.18 which kept the vulnerable
0.5.x line — relaxed to >=0.6.0. Resolves to 0.6.3.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fast-uri 3.1.0 (transitive via eslint-plugin-obsidianmd → ajv) is
vulnerable to path traversal and host confusion via percent-encoded
segments. Pinned to 3.1.2 via npm overrides.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Collapsed history snapshot — represents the cumulative state of TubeSage
through 1.2.21. Earlier commit history (covering versions 1.2.0 through
1.2.20) was rewritten into this single root commit to remove tracking
of a personal deploy script that referenced local filesystem paths.
The current release content is unchanged. See manifest.json for the
plugin version. Older tags (1.2.0 through 1.2.20) have been retired.
Features in this release line:
- YouTube transcript extraction (ScrapeCreators API + local fallbacks)
- LLM-driven summarisation (OpenAI, Anthropic, Google, Ollama)
- Per-provider always-visible API key rows
- Selected-provider model controls with registry-aware overrides
- Custom-model parameter overrides with synchronous panel refresh
- Max tokens field with blur-commit and reset-on-blank
- Settings de-pollution migration on plugin load
- Summary-callout split for multi-section model output
- Security patches: fast-xml-parser >=5.7.0, uuid >=14.0.0
