0.2.1

Hardening release driven by the Obsidian community-plugin review. No new features; the Reload skills command is the only user-visible addition.

User-facing

• Skill auto-discovery now subscribes to Obsidian vault events instead of fs.watch. Cross-platform (works on Linux), no more fs.watch({recursive:true}) limitation. Added a Reload skills command as an explicit fallback for vaults where .agents/ isn't indexed.
• minAppVersion raised to 1.7.2 so the awaited Workspace.revealLeaf signature matches the running Obsidian.

Internals / review fixes

• Command id no longer carries the redundant sillage- prefix.
• Settings heading rendered via new Setting().setHeading() instead of a raw <h2>.
• Notice click target switched from deprecated noticeEl to messageEl.
• All setTimeout/clearTimeout calls routed through window.* for popout-window compatibility.
• MarkdownRenderer.render is now tied to the chat view's component lifecycle (was leaking under the plugin's lifetime).
• Floating Promise<void> calls in event handlers explicitly voided.
• Subprocess data callbacks and vibe session-meta JSON typed; no more any propagation.
• builtin-modules dependency replaced with the native node:module.builtinModules.

Supply chain

• Release artifacts (main.js, styles.css) now carry a signed SLSA build-provenance attestation. Verify with:

  gh attestation verify main.js -R J3F3H/sillage

Host access disclosures

The README now has a dedicated Host access (Obsidian review disclosures) section explicitly enumerating the three flagged behaviors:

• child_process.spawn for the user-configured vibe binary.
• fs.promises read of $VIBE_HOME/logs/session/*/meta.json (the only path Sillage touches outside the vault).
• navigator.clipboard.writeText from the explicit Copy button on assistant bubbles.