OmniSync - 1.0.5

Obsidian Plugin

OmniSync - 1.0.4

OmniSync v1.0.4 — Changes & Fixes

Bug fixes

Wizard manual step (Windows): the step-by-step path did not include creating the R2 bucket or the 10-day lifecycle rule; users on that flow would never get automatic storage cleanup. Now includes both commands in all 4 languages.
Tidy attachments — Obsidian API guard: if the installed version of Obsidian does not expose getConfig/setConfig, the plugin was hiding the "Adjuntos" folder in the file explorer without having actually configured it. Now does nothing when the API is absent.
Worker mailbox check — transient errors: checkWorkerMailbox was marking itself as done on any non-OK HTTP response (e.g. a 503), so a temporary server error would silently suppress the "missing mailbox" warning for the rest of the session. Now retries on error.
Settings sanitizer: tidyAttachments was not going through the boolean sanitizer that protects against a tampered data.json, unlike every other boolean setting. Fixed.
CI / distribution artifact: the zip/ folder was not included in the last commit, causing the distribution test to fail in CI. Fixed and synced.
New

Regression test test:attachment-tidy-runtime: exercises the tidy-attachments feature on the real plugin class with a simulated DOM and vault (configure, hide, toggle off/on, user-chosen folder, API-absent Obsidian).
Known limitation (no patch)

A file between 100 MB − 28 bytes and exactly 100 MB fails to upload when the limit is set to "100 MB": encryption adds 28 bytes and Cloudflare's hard cap is 100 MB. Fails cleanly with a message; the affected window is minimal and the Cloudflare cap cannot be raised.

OmniSync - 1.0.3

🧰 Sync fixes

Notes written while the other device was off now arrive through the mailbox (Cloudflare, your own Worker, or a Nostr relay). The mailbox is checked on every connection, every 60 s, when the app comes back and when the network returns.
Dual path: each edit goes to the mailbox and, if a peer is connected, directly over P2P. There is also a "Pure P2P" mode.
Failed sends are retried automatically (2, 5, 15, then every 60 s), kept across restarts, and flushed when the app is hidden or closed, including the last 350 ms of typing. At startup, unsynced local edits are re-queued.
The "pending" notice appears at most once every 10 minutes. Notes over 64 KB without Blossom show a short notice to enable it.
Cloudflare Worker

Root cause found: Workers deployed from an older template had no mailbox, so notes were never stored and the failure was silent. The plugin now detects this at startup and in the Cloudflare wizard, and the current template deploys the mailbox.
Worker JSON responses now send X-Content-Type-Options: nosniff and Cache-Control: no-store.
Security audit fixes

A-01 to A-04: stale versions pushed to the relay, an unserialized resend queue, a reconnect loop against unstable relays, and closing the mailbox before pending sends finished.
B-01 to B-08: false conflicts, retries ignored, costly snapshot pruning, rename retry, and the Worker-without-mailbox failure.
L-01: CI actions pinned to commit SHAs and a 7-day Dependabot cooldown.
Accepted risks: intentional open CORS, per-isolate anti-replay, Cloudflare's TLS 1.0/1.1 on workers.dev, and server-visible metadata (timing and approximate size).
Verification

Tools: Semgrep, CodeQL, gitleaks, dependency scanners, ESLint and tsc found no secrets, no vulnerable dependencies and no real code findings.
Live end to end test: real disposable Cloudflare Workers were tested with the other device offline. Attachments up to 95 MB came back byte for byte identical, and 101 MB was rejected cleanly.
Encryption check: the server logs showed only opaque identifiers and AES-256-GCM ciphertext, with no paths, names or text.
DAST: a custom fuzzer, nuclei, OWASP ZAP and testssl.sh ran in containers with 0 failures and 0 server errors.
Automated tests: npm test, lint and typecheck pass.

OmniSync - 1.0.1

Sync fixes

Notes written while the other device was off now arrive via the relay (Cloudflare, your own Worker, or any Nostr relay). The mailbox is pulled on every connection, every 60 s, on app resume and when the network returns.
Dual path: each edit goes to the relay and, if a peer is connected, over P2P. A "Pure P2P" mode is available in settings.
Failed relay sends are retried (2/5/15/60 s), persist across restarts, and are flushed on hide/close, including edits still inside the 350 ms debounce. At startup, unsynced local edits are re-queued.
The "P2P sync" notices are limited to one every 10 minutes. Notes over 64 KB without Blossom show a short notice to enable Blossom.
Audit and bugs

Fixed A-01 to A-04 (stale pushes, unserialized resend, reconnect loop, unload order) and B-01 to B-07.
Full tool baseline: no secrets, no dependency vulnerabilities, no real code findings. One low CI finding (L-01) was fixed by pinning actions to SHAs and adding a 7-day Dependabot cooldown.
New test:dual-path suite (7 cases). Full npm test, lint and typecheck pass.
Repo and docs

Version 1.0.1; changelog and package regenerated. CI lint errors fixed.
README: new title, a Tests badge, a free real-time sync highlight.
Developer Guide rewritten (EN/ES). SECURITY.md is now English, with the Spanish version in SECURITY_ES.md.
Security and test docs updated.

OmniSync - 1.0.0

*Stable version