0.2.7

Vault Rooms 0.2.7

This release improves binary storage, offline editing reliability, LAN address recovery, and Obsidian settings compatibility.

Highlights

Binary storage and retention

• Whole-file content is now stored as immutable, content-addressed blobs outside SQLite.
• Superseded versions and unreferenced blobs are collected automatically.
• Binary files are stored as raw bytes instead of base64 inside the relay database.
• A default 256 MiB stored-content limit prevents unbounded relay growth.
• Existing content is migrated resumably in the background.
• Storage usage is visible per room and for the whole relay.
• Added Vault Rooms: Reclaim relay database space to return unused SQLite pages to disk.

If an existing relay is already over the new limit, reads, deletes, cleanup, and replacements that reduce usage remain available. Only writes that increase storage are rejected until usage is reduced or the owner raises the limit.

More reliable offline Markdown editing

• Markdown edits made before the relay starts are preserved when the connection becomes available.
• One-sided and concurrent offline edits no longer roll back during reconnect.
• Offline Markdown create and rename operations replay exactly once across reconnects and restarts.
• Document identity and CRDT history are preserved through offline renames.
• Old paths are no longer resurrected after an offline rename.

Live editing remains limited to Markdown notes and excludes *.excalidraw.md. Other files continue using whole-file synchronization.

DHCP-safe LAN recovery

• Hosts can advertise an existing .local hostname or an IP address.
• Existing IP and hostname connections continue working without migration.
• Changing the advertised address does not recreate the server, rooms, accounts, mounts, teams, or friendships.
• Pinned-TLS clients can use Find server on LAN to recover the same server after its DHCP address changes.
• Discovery runs only when the user presses the button.
• Every discovered endpoint is verified against the saved TLS identity, server ID, user ID, and device ID before it is stored.
• Legacy HTTP connections continue using manual Update address.

For the host’s own embedded server, change the advertised endpoint through Public URL override. The local owner connection remains loopback-only.

Obsidian UI improvements

• Settings now render as a normal vertical list in Obsidian 1.13 instead of overflowing horizontally.
• The local embedded-server card no longer shows misleading Test connection or Update address actions.
• Hosting status, LAN reachability, and discovery availability are shown separately.
• Remote saved servers retain their connection test and address-recovery actions.

Compatibility

• Existing rooms, permissions, accounts, mounts, teams, friendships, and device identities are preserved.
• Existing IP-based connections are not rewritten automatically.
• Existing hostname-based connections continue using normal DNS or mDNS resolution.
• Older clients remain compatible with their existing saved endpoint.
• Secure LAN discovery requires pinned TLS.

Known limitations

• Binary file synchronization still uses base64 over the current JSON/WebSocket wire format, adding roughly 33% transient transport overhead.
• Raw binary sync framing remains future work.
• LAN discovery is manual and does not run during automatic reconnect.
• SQLite only returns reclaimed pages to the filesystem after running the explicit reclaim command.

0.2.6

Every file in a shared folder now syncs

Vault Rooms used to sync a fixed list of file types and silently skip everything else — an audio clip, a video, a
.docx, or a file with no extension simply never reached your teammates, with nothing in the UI saying so.

• Markdown, .txt, .canvas, .json, .csv, and .excalidraw sync as text; everything else now syncs as
  binary, including images, PDFs, audio, video, Office documents, and unrecognized or extensionless files.
• Binary content counts against the server's size limit at roughly 1.33x its real size, so a large video or
  Office file hits the ceiling sooner than its size on disk suggests.
• Dotfiles and dotfolders never sync — any path segment starting with ., such as .env or a .secrets/
  folder. Sharing a folder should not risk shipping local credentials that happen to live inside it. This is the
  same rule that already excluded the vault's config folder, .git/, and node_modules/.
• Mixed versions stay safe rather than corrupting. A teammate still on 0.2.5 or older doesn't learn those new
  paths exist at all, instead of receiving content their build would write to disk incorrectly. Both devices need
  0.2.6 to exchange them; see the new Troubleshooting entry in the README.

Offline note creates and renames are no longer lost

Creating or renaming a Markdown note while the connection is down used to be forgotten — an already-open note kept
merging fine, but structural changes had no recovery, and restarting Obsidian discarded the intent entirely.

• The intent is now written to disk, survives a full Obsidian restart, and replays once the connection is back.
• A rename keeps the note's identity, epoch, and history at its new path.
• Rapid create → rename → delete sequences collapse to what you actually ended up with, so only the final path is
  created.
• A dropped acknowledgement can no longer produce a duplicate note. The relay records each structural
  operation's outcome in the same transaction as the change itself, so a retry returns the original result rather
  than repeating the mutation.
• Access revoked while you were offline rejects the pending change instead of honouring it.
• Turning Live editing off with a pending change converts it to normal whole-file sync rather than stranding it.
• Replay needs the relay on 0.2.6 or newer. Against an older host the change stays queued and you get one notice
  saying the server must be upgraded — nothing is lost in the meantime.

Live editing skips *.excalidraw.md

An .excalidraw.md file is a drawing stored as structured JSON inside a Markdown file. Merging that JSON
character by character can produce a drawing that no longer loads, so it now stays on the whole-file lane like
.canvas and .excalidraw. Ordinary Markdown notes are unaffected.

Update notifications

On load, Vault Rooms makes a single anonymous request to GitHub's public Releases API and tells you if a newer
version is out. It sends no vault content, no room or file names, and no identifier of you or your server, and it
fails silently when you're offline or the domain is blocked. Blocking api.github.com is safe and does not affect
sync. This is the only request that leaves your local network; it is documented in
SECURITY.md and can be blocked at your firewall if your environment
requires that.

Smaller fixes

• A conflict copy of a file without an extension (e.g. LICENSE) is now recognised as a conflict copy instead
  of being treated as a new file and pushed back to the server.
• Room settings now have a sticky "Save room settings" row at the bottom of the modal, so the action is always
  reachable without scrolling back up.
• The conflict-policy setting reads "If two people save a non-live file at once" and says plainly that it does
  not apply to Markdown notes using Live editing.
• Binary uploads are validated before they are stored, so a malformed payload is rejected rather than recorded with
  a hash that doesn't match what a receiving device would write.
• Dependency: fast-uri is pinned to a patched version (GHSA-7p8r-x3mc-p8w7). It only ever reached the optional
  standalone relay through Fastify - the plugin bundle contains no Fastify at all - so nothing that ships to
  Obsidian was affected.

Upgrading

Nothing to do. The database migration is additive, and existing servers, rooms, saved connections, per-room
live-editing values, and pending sync state are unchanged. Settings written by older builds load as-is; anything
unrecognized in the new pending-operation journal is discarded rather than executed.

For the two new features to work between two devices, both need 0.2.6: offline replay requires the relay side,
and the widened file types require both sides.

---

0.2.5

Vault Rooms 0.2.5 makes first-time setup and everyday room management much easier, especially for people who do not want to deal with server terminology or raw permission rules.

Guided onboarding

Setting up sharing is now one guided four-step flow:

1. Check the connection
2. Create your account
3. Choose a shared folder
4. Create an invite

The flow validates the sharing address before starting the server, explains problems in plain language, and safely resumes if you close it midway. Completed work is preserved, while computers that have lost owner access are sent to recovery instead of being offered a second owner account.

Invites now clearly explain that they:

• Work once
• Expire after 60 minutes
• Require Vault Rooms on the teammate’s computer

You can copy either a ready-to-send message or the link by itself.

Rooms-first panel

The Vault Rooms panel has been redesigned around one primary question: is your work syncing?

• One clear sync status: Syncing, Connecting, Reconnecting, Not syncing, No access, or Not set up
• Hosting information appears separately only when relevant
• Connection details are kept with the sync status instead of being mixed into Activity
• Rooms, People, and Activity are separated into focused tabs
• Tabs only show attention indicators when something actually requires action
• Saved servers use their owner’s name instead of the generic “Remote server”

Rooms now use plain actions such as Open, Add to this computer, and Remove from this computer. Open correctly opens the room’s folder rather than treating it as a note.

Clearer sharing and access

The People tab now answers who can access what instead of forcing users to understand the difference between Friends and Teams first.

• Access is grouped by effective room access
• Direct and team-based access are clearly distinguished
• People without room access appear separately
• Ordinary members see a clear read-only explanation
• Destructive actions have moved behind Manage and require confirmation
• Room and team management is shown only when the current user has permission

Room permissions are translated into human language such as:

• Can edit · everything here
• Can view · only Meetings
• Can edit · through a team

Custom rules and raw permission tokens remain available under Advanced when needed.

Improved room settings

Room management has been reorganized around three common jobs:

• Change the room name or local folder
• Turn Markdown live editing on or off
• Manage who can access the room

Technical settings—including teammate folder names, conflict handling, plugin suggestions, and raw permissions—are moved under Advanced.

The modal also received layout and usability fixes:

• Consistent padding and spacing
• No horizontal overflow
• Stable scrolling when Advanced sections change
• More compact plugin suggestions
• Clearer destructive actions and delete confirmation

Live editing enabled for new rooms

New rooms now start with Markdown live editing enabled, allowing teammates to type in the same note at the same time.

Existing rooms keep their saved setting and are not silently migrated. Room managers can still turn live editing off from Manage.

Other file types continue using normal file synchronization.

Better activity and diagnostics

Activity entries now describe actions in human language instead of showing raw event names and internal IDs.

Connection failures also show a readable explanation first, while the original technical error remains available under Technical details for troubleshooting.

Failed refreshes keep the previous information visible and clearly mark it as not current instead of replacing it with an empty screen.

Smaller fixes

• Corrected “1 file need a choice” to “1 file needs a choice”
• Improved room, team, connection, and empty-state copy
• Fixed modal padding, overflow, and unnecessary separators
• Prevented room-setting controls from being cut off in narrow sidebars
• Improved delete-button visibility and hover feedback

Upgrading

No migration is required.

Existing servers, saved connections, rooms, mounts, permissions, and per-room live-editing settings remain unchanged.

Vault Rooms remains desktop-only and requires Obsidian 1.12.7 or newer.

Full changelog: 0.2.4...0.2.5

0.2.4

Vault Rooms 0.2.4 — Live cursors and safer collaboration

Highlights

• Added live cursors and note presence for CRDT-enabled Markdown notes.
• See teammates’ authenticated display names, carets, and selections while editing the same note.
• Presence colors are assigned by the relay and remain unique among active users in the room session.
• Colors adapt to Obsidian light and dark themes.
• Presence is ephemeral and note-scoped: it disappears when the editor, session, or connection closes.
• V1 intentionally does not include a participant bar.

Sync reliability

• Fixed pinned WebSocket disconnects that could leave pending requests stranded.
• Prevented rejected updates from recreating documents at their old path after a rename.
• Improved CRDT recovery across rename, reconnect, unmount, and remount flows.
• Fixed editor rebinding after session resync.
• Fixed failed editor bindings being cached as rejected promises.
• Preserved exactly-once bidirectional editing while live cursors are active.

Security and protocol hardening

• Prevented identity changes on established WebSocket connections.
• Same-device re-authentication can no longer downgrade CRDT or presence capabilities.
• Invalid re-authentication tokens are still fully authenticated and rejected.
• Improved safe, user-facing validation errors while keeping raw network failures in diagnostic logs.

LAN sharing and diagnostics

• Improved LAN address validation and warnings for loopback, unspecified, stale, and link-local addresses.
• Expanded the live-editing diagnostics command with presence transport, publication, visible-peer, and bound-editor status.
• Added clearer troubleshooting messages for invite, connection, permission, and cursor failures.

Compatibility

• Both devices need Vault Rooms 0.2.4 or newer to exchange live cursors.
• The room must have CRDT live editing enabled.
• Both users must have the same Markdown note open and retain file:read permission for that path.
• Minimum supported Obsidian version remains 1.12.7.

Full changelog: 0.2.3...0.2.4

0.2.3

Live editing (CRDT sync) has been through extended two-device testing on a real LAN. That run found a
number of real defects that no automated test had caught; this release fixes all of them. If you use live
editing, upgrade both devices before using it again.

Fixed — data loss and corruption

• A note open in an editor could have its unsaved text deleted for everyone when the sync handshake
  ran. An open editor is now the source of truth for its own note: its on-disk copy is never reconciled
  back while it's open, because Obsidian's autosave is allowed to lag behind what you typed.
• Note content duplicated itself on every unmount/remount, compounding each cycle. A document is now
  only seeded from your local copy when the server confirms it genuinely created it.
• Unmounting a room left it subscribed, its editors still attached, and its retired document still
  sending updates — which produced a self-sustaining update loop between two devices. Unmounting is now a
  single atomic teardown.
• A CRDT note could become permanently undeletable, failing with "the file changed on the server
  before your edit was applied" on every attempt.
• Renaming a note could fork it into two files, or trigger a runaway rename loop that generated dozens of
  files with stacking names.
• Renaming a note onto a name that had merely been deleted failed with an opaque error.

Fixed — sync that silently didn't happen

• A newly created note is now announced immediately. Previously a note you created but hadn't typed in was
  invisible to everyone else until they reconnected.
• Edits no longer take ~3 seconds to appear. Live updates were being dropped by any device that didn't
  happen to have the note open, leaving it to wait for a slower fallback.
• After restarting the host, both vaults now agree on the file list without anyone having to open a file
  first.
• Edits are no longer stranded when the server reports it has no document at that path; the client
  re-establishes it and keeps your text.

Changed

• Two people creating a note at the same time now get two notes. Every new Obsidian note starts with
  the same default name, so the first to reach the relay keeps it and the other is filed under a name
  including its creator, with a notice explaining why. Their text is never merged together.
• A name you type is never rewritten. Renaming onto a name a teammate already used is refused with a
  notice so you can pick another.
• The "Live editing (CRDT sync)" toggle now applies immediately. It previously only took effect if you
  also pressed "Save room settings", so it could silently revert — which looked exactly like live editing
  being broken.

Added

• Command: "Vault Rooms: Diagnose live editing (CRDT) for the active note" — reports which link in the
  live-editing chain is missing (room, its setting, push permission, editor binding, session) instead of
  leaving you to guess.

Upgrade notes

• Copy main.js, manifest.json, and styles.css to both devices and fully restart Obsidian; the
  embedded relay holds state, so reloading the plugin alone isn't enough.
• Content that was already duplicated, or stray files created by the old rename bug, are real data on the
  server — this release stops producing them but does not clean them up. Delete them while connected so
  the deletion propagates.
• Live editing remains off by default, per room.

0.2.1

Vault Rooms 0.2.1

Pinned TLS/WSS for the embedded and standalone relay, safe in-place upgrades from any v0.1 database shape, and a raft of sync-reliability and Obsidian review fixes.

Added

• Pinned TLS/WSS. New embedded servers self-manage a private CA + leaf certificate and listen HTTPS/WSS only; invites carry the server's identity (SPKI pin) so a client verifies the server before ever sending credentials. The standalone relay supports pinned or OS-trusted TLS via TLS_MODE.
• Identity rotation. Signed, replay-protected rotation records let an owner rotate the server's TLS identity without breaking already-paired clients. A client that can't verify the rotation chain shows a blocking "pin mismatch" and never sends credentials over an unverified connection.
• Legacy plaintext migration. Existing v0.1 installs get an owner-controlled upgrade path (normal or strict mode) to pinned TLS, with a dual-stack transition window before the plaintext listener is closed for good.
• LAN share reachability. The panel automatically probes the advertised LAN URL after every start/migrate/rotate and blocks creating invites when it's unreachable, instead of only warning after the fact.

Changed

• v0.1 database upgrades are more robust: a shares-only legacy schema (no rooms table) now migrates instead of failing outright, and the one-time backup (relay.sqlite.bak-v1) is written atomically and tolerates a corrupted/foreign file at that path instead of permanently blocking startup.
• REST file writes/deletes now enforce the same sync:push permission the WebSocket path already required, closing a gap where the two transports could disagree on an ACL deny.

Fixed

• Live sync could silently stop delivering updates for a room if the connection dropped between subscribing and receiving its first snapshot - subscriptions now persist across reconnects instead of being dropped.
• A token-rotation race during plaintext-to-TLS migration could make the client think its access was revoked and abandon the migrated connection.
• A slow or failed pinned-transport retry could leave two live sockets on the same connection, causing duplicate applies of remote changes.
• One file failing to read during snapshot reconciliation no longer aborts reconciliation of every other file in that snapshot.
• An unauthenticated WebSocket connection could hold a connection slot indefinitely; the relay now times it out after 10 seconds.
• Obsidian community review findings resolved: createDiv()/createSpan() used instead of createEl("div"/"span"), and the standalone CLI's startup banner (bound URLs, TLS identity, bootstrap PIN) no longer goes through console.log.

---

0.1.6

0.1.6

Added

• Invites now support three types, chosen from a single "Invite" button in the panel header: Team (unchanged), Room (grants access to one room at a Reader/Editor preset on join), and Friend (adds the person to the server with no access yet — grant rooms/teams separately later).
• Invite link modal: one-click Copy button.

Changed

• Dropped the QR code from the invite modal — this plugin is desktop-only, so scanning it with a phone couldn't actually join anything; it only added a manual phone-to-desktop transfer step over plain copy/paste.

Fixed

• A "Forget server" / "Remove access" / "Delete room" button could crash with setDestructive is not a function on Obsidian versions older than 1.13. minAppVersion is now 1.12.7 and the destructive-button styling works correctly on that floor again.

0.1.0

Vault Rooms lets you share selected vault folders ("rooms") with trusted people on your local network — no cloud service, no telemetry, traffic stays between devices on your LAN.

Highlights

• Rooms — share any vault folder; each member mounts it at a local path of their choosing
• Invite links — join a server on the LAN with a single pasted link
• Fine-grained access control — grant read/write/delete to users or whole teams per path pattern, deny by default
• Teams — named permission groups with admin/member roles for team management
• Live sync — realtime updates over WebSocket, with full reconcile on reconnect
• Embedded or standalone relay — host a room from inside Obsidian, or run the relay on an always-on machine for better uptime

Notes

• Desktop only; requires Obsidian 1.8.0+
• v0.1 has no TLS — use on a trusted LAN only (see README → Security model)
• Synced file types: Markdown, .txt, .canvas, .json, .csv, .excalidraw, common images, and .pdf