Patch release: fix the mobile example-template viewer, which 1.4.0
shipped collapsed to ~2 lines. flex-shrink:0 stops the mobile modal's
flex column from squeezing the content box below its set height.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Highlights since 1.3.3:
- Transcript extraction reworked onto the YouTube iOS InnerTube
player API; the four broken free local fallbacks removed.
- OpenRouter model-list refresh with a vendor-grouped dropdown.
- Service-URL info icons for ScrapeCreators, Supadata, OpenRouter.
- Desktop processing no longer leaves a blank popup.
- Mobile example-template viewer enlarged so content is visible.
- UI primitives migrated to native Obsidian components (Tier A).
- README network/base64 disclosures completed.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Releases the current state as a stable before/after boundary:
- Copy template button restored (mobile users cannot scroll the
template example), plus a mobile touch-scroll hint.
- Settings info-icon tooltips fixed: native Obsidian setTooltip
replaces the flaky custom hover tooltip; OpenRouter reliability
note added to the LLM tooltip.
- Workflow and data-flow mermaid diagrams refreshed to current
architecture.
- README links made absolute so they resolve on the community site;
demo video linked.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Release of the vault-enumeration and clipboard surface reduction:
the plugin no longer calls getMarkdownFiles / getAllLoadedFiles or
navigator.clipboard, so the Obsidian scorecard's Vault Enumeration and
Clipboard Access flags clear.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace @langchain/core's tiktoken helper with a network-free stub via
an esbuild onLoad plugin. The upstream module lazy-fetches tokenizer
data from https://tiktoken.pages.dev; TubeSage never counts tokens, so
that path was unreachable, but the URL still sat in the bundle and
showed up as an external domain on the Obsidian plugin scorecard. The
stub removes it from main.js entirely.
- esbuild.config.mjs: add the stub-langchain-tiktoken onLoad plugin
- README.md: drop the tiktoken.pages.dev disclosure (no longer contacted)
- bump manifest.json / package.json / package-lock.json to 1.3.1
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Bump eslint-plugin-obsidianmd 0.2.9 -> 0.3.0 and typescript-eslint
8.58.2 -> 8.59.3. ESLint stays at 9.39.4: obsidianmd 0.3.0 peer-pins
@eslint/js ^9 and @eslint/json 0.14.0, so ESLint 10 is not yet
cleanly supported.
obsidianmd 0.3.0 adds two new rules. Fixes for the errors they raise:
- no-unnecessary-type-assertion: remove 4 redundant type assertions
(main.ts x3, fetch-shim.ts x1) - all compile-time-only, tsc confirms.
- prefer-window-timers: switch 11 activeWindow timer calls to window
(main.ts, form-utils.ts, processing-spinner.ts). TubeSage has no
popout-window feature, so window === activeWindow at every call site.
Note: obsidianmd 0.3.0's prefer-active-doc rule (warning) now flags
window.* as preferring activeWindow, directly contradicting the
error-level prefer-window-timers rule. window.* is kept because it
satisfies the error-level rule; the 11 advisory warnings are an
upstream rule conflict and cannot be resolved without suppression.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
langsmith 0.5.26 (transitive via @langchain/core) is vulnerable to
GHSA-3644-q5cj-c5c7 (public prompt pull deserializes untrusted manifests
without trust boundary warning). Patched in 0.6.0.
The previous override was pinning to ^0.5.18 which kept the vulnerable
0.5.x line — relaxed to >=0.6.0. Resolves to 0.6.3.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fast-uri 3.1.0 (transitive via eslint-plugin-obsidianmd → ajv) is
vulnerable to path traversal and host confusion via percent-encoded
segments. Pinned to 3.1.2 via npm overrides.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Aligns with graphify skill convention 'graphify <path> --update'
documented in lucasrosati/claude-code-memory-setup guide.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- postbuild: auto-run fallow audit after every build
- audit:fallow: standalone audit against main branch
- graph:update: refresh graphify knowledge graph
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reverting the lowercase 'api' from 1.2.26 — local
obsidianmd/ui/sentence-case rule wants uppercase 'API'. Local
linter is the bot's scanner, so aligning UI strings with what the
linter accepts is the correct path through bot review.
Lines 4072, 4073, 4106, 4134: 'api key' -> 'API key'.
Line 4222 keeps 'Openai' (no change).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The bot has been rejecting uppercase 'API' acronym casing in UI
strings; reverting to lowercase 'api' across the four bot-flagged
setting names and the description string. The local
obsidianmd/ui/sentence-case rule expects uppercase 'API', so 4
lint errors are expected on these lines and are NOT suppressed —
the bot is the authority we are trying to satisfy.
- 'Youtube data API key' -> 'Youtube data api key'
- 'Scrape creators API key' -> 'Scrape creators api key'
- 'Supa data API key' -> 'Supa data api key'
- 'Your Google cloud console API key for accessing public Youtube
transcripts...' -> '...console api key for accessing public Youtube
transcripts...'
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lowercase 'API' → 'api' across setName/setDesc UI strings:
- main.ts:4072 'YouTube data API key' → 'YouTube data api key'
- main.ts:4073 setDesc — 'API' lowercased
- main.ts:4106 'Scrapecreators API key' → 'Scrapecreators api key'
- main.ts:4134 'Supadata API key' → 'Supadata api key'
- main.ts:4272 '${displayName} API key' → '${displayName} api key'
Variable names, types, log strings, and comments retain 'API' —
only user-visible UI text is lowercased to satisfy the bot's
sentence-case rule.
Local eslint plugin 0.2.9 disagrees with the bot here and reports
4 sentence-case errors expecting 'API' capitalised. Build (tsc +
esbuild) is unaffected. Bot is the gatekeeper.
Collapsed history snapshot — represents the cumulative state of TubeSage
through 1.2.21. Earlier commit history (covering versions 1.2.0 through
1.2.20) was rewritten into this single root commit to remove tracking
of a personal deploy script that referenced local filesystem paths.
The current release content is unchanged. See manifest.json for the
plugin version. Older tags (1.2.0 through 1.2.20) have been retired.
Features in this release line:
- YouTube transcript extraction (ScrapeCreators API + local fallbacks)
- LLM-driven summarisation (OpenAI, Anthropic, Google, Ollama)
- Per-provider always-visible API key rows
- Selected-provider model controls with registry-aware overrides
- Custom-model parameter overrides with synchronous panel refresh
- Max tokens field with blur-commit and reset-on-blank
- Settings de-pollution migration on plugin load
- Summary-callout split for multi-section model output
- Security patches: fast-xml-parser >=5.7.0, uuid >=14.0.0
