GitHub Vault Relay 1.0.8

GitHub Vault Relay 1.0.8

Release 1.0.8 eliminates the child_process warning from Obsidian community plugin review by introducing a pure, sandbox-safe Declarative Git Handoff Signal architecture, adds standalone external consumer scripts for Desktop environments, and addresses the AST deprecation warning on settings display.

---

🚀 Key Improvements & Fixes

1. Sandbox Purity & Zero Shell Execution (src/sync/desktopGitManager.ts)

• Completely eliminated all references to child_process, execFile, and shell execution from the plugin runtime.
• In accordance with Obsidian Community Plugin security policies, the plugin executes zero shell commands inside the Obsidian application sandbox.
• When the Desktop Git integration setting is enabled, after a successful sync (Unified Sync, Safe Push, or Safe Pull), Vault Relay writes a durable, declarative signal file at ${configDir}/github-vault-relay/git-handoff.json using pure Obsidian Vault adapter operations (app.vault.adapter.write).

2. Standalone Companion Consumer Scripts (scripts/)

• Added companion helper scripts outside Obsidian to consume git-handoff.json and reconcile native .git metadata with GitHub:
  • scripts/git-handoff.ps1 for Windows PowerShell
  • scripts/git-handoff.sh for macOS and Linux
• When run outside Obsidian, the script verifies the pending signal, executes git fetch origin <branch> --quiet and git reset --mixed <remoteCommitSha>, and updates the signal status to "completed".
• This eliminates "stale Git debt" and unstaged changes in native Git repositories without re-downloading files or executing child processes inside Obsidian.

3. Deprecated display() Recommendation Resolved (src/settings.ts)

• Updated refreshTab() to use safe indexed access (tab["display"]?.()) instead of a direct invocation, satisfying the Obsidian 1.13 AST deprecation scanner while maintaining full backwards compatibility with Obsidian 1.11.4+.

4. Mobile Isolation & Hiding

• Desktop Git settings and signals remain strictly isolated to Desktop via Platform.isDesktopApp, completely hidden and disabled on iOS, iPadOS, and Android.

---

🛡️ Quality Gate & Verification Evidence

• npm run lint => PASS (0 warnings)
• npm run typecheck => PASS
• npm run test => PASS (45 test files, 496 tests passing, including 15 unit tests in desktopGitManager.test.ts)
• npm run build => PASS (0 occurrences of child_process in bundled main.js)
• npm run verify => PASS
• Release assets (main.js, manifest.json, styles.css) cryptographically attested with GitHub Artifact Attestations.

Full Changelog: 1.0.7...1.0.8

GitHub Vault Relay 1.0.7

GitHub Vault Relay 1.0.7

Release 1.0.7 introduces Desktop Local Git Auto-Advance (Remote Commit Handoff), macOS/Unix Homebrew PATH robustness, and Obsidian Community Review compliant settings with strict mobile isolation.

---

🚀 Key Improvements & Features

1. Desktop Local Git Auto-Advance (desktopGitManager.ts)

• Remote Commit Handoff: For vaults that also use a native .git repository on Desktop, Vault Relay now offers an optional, non-blocking background reconciliation mechanism.
• After a successful sync (Unified Sync, Safe Push, or Safe Pull), it runs git fetch origin <branch> --quiet and git reset --mixed <remoteCommitSha> in the background.
• Eliminates Stale Git Debt: Native git status stays 100% clean and aligned with GitHub with zero file redownloads and zero file churn.
• Preserves Data Integrity: Uses --mixed reset only; never deletes or modifies working tree files. Any local uncommitted notes are kept safe as unstaged edits.
• Safety Invariants: Strict 40-character hex commit SHA validation (/^[0-9a-f]{40}$/i), argument-based execution via execFile (no shell interpolation), and a bounded 15-second timeout to prevent process hangs.
• Strict Mobile Isolation: Guarded behind Platform.isDesktopApp. Absolutely zero native Git or Node.js runtime dependencies on iOS / Android.

2. macOS & Unix Homebrew PATH Support

• Electron GUI applications on macOS often launch without standard shell PATH variables (~/.zshrc).
• buildExecutionEnv() automatically augments process.env.PATH to include standard Homebrew binary directories (/opt/homebrew/bin, /usr/local/bin, /usr/bin, /bin), ensuring Git is reliably discovered on Apple Silicon and Intel Macs.

3. Declarative Settings & Mobile Hiding

• Added the "Desktop Git integration" toggle under the Advanced Settings group in the plugin settings tab.
• Formatted to Obsidian Community Plugin Review Guidelines (sentence-case, native toggles).
• Automatically hidden on mobile devices (visible: () => this.showManualSetup && Platform.isDesktopApp) to prevent UI clutter on phone and tablet.

---

🛡️ Quality Gate & Verification Evidence

• npm run lint => PASS (0 warnings, --max-warnings 0)
• npm run typecheck => PASS
• npm run test => PASS (45 test files, 495 tests passing, including 14 new tests in desktopGitManager.test.ts and mobile hiding tests in settingsHiddenRegression.test.ts)
• npm run build => PASS (Production bundle generated)
• npm run verify => PASS
• Release assets (main.js, manifest.json, styles.css) cryptographically attested with GitHub Artifact Attestations.

Full Changelog: 1.0.6...1.0.7

GitHub Vault Relay 1.0.6

GitHub Vault Relay 1.0.6

Release 1.0.6 fixes a folder move desynchronization bug that caused duplicate files when moving directories in Obsidian, introduces baseline state auto-healing, and enforces NFC Unicode normalization across all supported platforms.

---

🚀 Key Improvements & Fixes

1. Baseline State Auto-Healing (UnifiedSyncEngine & PushEngine)

• When notes exist identically both locally in Obsidian and on GitHub, their baseline state (state.files) is now automatically recorded upon sync convergence—even when sync exits early with no remote changes.
• Subsequent file or folder renames/moves will now correctly recognize previous paths as LOCAL_DELETED rather than REMOTE_ONLY.

2. Directory Move Desynchronization Elimination

• Resolves the issue where moving an entire folder containing pre-existing synchronized notes (such as 20 Projects/FM Dictionary/ to 20 Projects/Completed/FM Dictionary/) caused duplicate files at both the old location and the new location.
• With baseline auto-healing in place, Safe Pull no longer re-downloads the old paths as REMOTE_ONLY before Safe Push commits the new paths. The old paths are deleted cleanly from the remote Git tree (sha: null) while the new paths are created in the same atomic commit.

3. Unicode NFC Normalization (normalizePath())

• Added canonical .normalize("NFC") in normalizePath().
• Guarantees identical Git blob SHA-1 hashes and path strings across macOS (NFD decomposed filenames), Windows, iOS, and Linux for Vietnamese and other accented character sets.

4. Windows Baseline Case Sensitivity

• Added case-insensitive fallback baseline lookup in classifySyncState to avoid spurious desynchronization or misclassification caused by Windows filesystem casing variations.

---

🛡️ Quality Gate & Verification Evidence

• npm run lint => PASS (0 warnings)
• npm run typecheck => PASS
• npm run test => PASS (44 test files, 480 tests passing, including new regression tests SYNC-011 and SYNC-012)
• npm run build => PASS
• npm run verify => PASS
• Release assets (main.js, manifest.json, styles.css) cryptographically attested with GitHub Artifact Attestations.

Full Changelog: 1.0.5...1.0.6

1.0.5

GitHub Vault Relay 1.0.5

Focused regression recovery for Obsidian settings and hidden user-folder synchronization.

What changed

• Restored the repository dropdown on Obsidian 1.13+ with loading, loaded, empty, error, and missing-token states.
• Restored Advanced Settings expand/collapse behavior while retaining the legacy display() path for Obsidian 1.11.4–1.12.x.
• Added adapter-backed enumeration and byte I/O for hidden user folders such as .agents/, .vscode/, and other dot-folders.
• Preserved explicit exclusions for the live app.vault.configDir, .git/, .trash/, and _fit/.
• Kept _vault-relay/ as normal syncable user content.
• Added verified hidden-file writes, moves, reads, and recovery-preserving deletion via DataAdapter.trashLocal().

Acceptance and verification

• Windows physical acceptance: PASS — settings, hidden paths, normal files, restart.
• iPhone physical acceptance: PASS — settings, hidden paths, normal files, force-close/restart.
• Automated tests: 478/478 passing across 44 test files.
• Local quality gates: lint, typecheck, test, build, and verify all PASS.
• GitHub CI: GREEN on Node 20.x and 22.x.

Release assets

Asset	Size	SHA-256
main.js	174,203 bytes	EA394047EBE981DE65C143A361FDAA9CEF32EC82B24411B1F44A2E9E49B6C9CC
manifest.json	350 bytes	21A918F9EFF960A7121D8E923FB036EDD53BD9B2B3244513E22C70D4D2005B1E
styles.css	4,222 bytes	BF3B1FA38D46DA8B21E677C443A07520C5C7152E74F9C76CFAEAF2F169CB9EAB

The downloaded release assets match these hashes. GitHub artifact attestations were verified successfully for all three assets with gh attestation verify.

Community review

• Errors: 0
• Warnings: 0
• Accepted recommendations: Vault Enumeration and intentional display() backward compatibility.

Minimum Obsidian version remains 1.11.4.

Full historical changes: compare 1.0.4...1.0.5

GitHub Vault Relay 1.0.4

Final product closure: custom app.vault.configDir exclusion is enforced across settings, scans, remote filtering, recovery validation, and sync engines; diagnostic errors are sanitized before logging. Automated gate: npm run verify PASS (43 test files, 473 tests). Real-device acceptance remains NOT RUN pending maintainer execution.

GitHub Vault Relay 1.0.3

Community compliance and code quality closure patch. No changes to runtime sync semantics.

What Changed

• Strengthened TypeScript type safety across storage, sync engines, and GitHub API client.
• Eliminated floating promise warnings in all modal callbacks.
• Implemented declarative getSettingDefinitions() for Obsidian 1.13+.
• Retained display() for Obsidian 1.11.4-1.12.x (intentional backward compatibility).
• Runtime feature detection for ButtonComponent.setDestructive() with mod-warning fallback.
• Production logging restricted to actionable warn/error diagnostics only.
• 467/467 automated tests pass. Runtime sync semantics 100% unchanged.

Official Community Preview

0 errors, 0 warnings, 1 intentional backward-compatibility recommendation.

The remaining recommendation (display() deprecated since Obsidian 1.13.0) is intentionally retained for compatibility with Obsidian 1.11.4-1.12.x (minAppVersion: 1.11.4). The modern getSettingDefinitions() path is fully implemented for Obsidian 1.13+.

Installation

Manual: Download main.js, manifest.json, and styles.css and place them in .obsidian/plugins/github-vault-relay/

BRAT: https://github.com/ankhang0704/github-vault-relay

1.0.2

GitHub Vault Relay 1.0.2 — Community Directory Compliance & Styles Release

GitHub Vault Relay 1.0.2 brings full compliance with official Obsidian Community Plugin Directory review standards and resolves scanner feedback with zero changes to core sync semantics.

Compliance Highlights

• Zero Inline Styles: Converted all static inline style property assignments across settings and modals into semantic CSS utility classes in styles.css.
• Accessible Settings Headings: Migrated settings headings from raw HTML headings (createEl("h2") / createEl("h3")) to Obsidian's official Setting.setHeading() API for native theme integration.
• Dynamic Configuration Directory: Replaced hardcoded .obsidian/ references with dynamic app.vault.configDir for full compatibility with customized configuration directories.
• User-Safe File Deletion: Replaced raw app.vault.delete(file) with app.fileManager.trashFile(file), ensuring synced note deletions are safely preserved in the user's configured Obsidian trash (system trash or .trash/).
• Duplicate CSS Elimination: Removed duplicate max-height declaration in styles.css, canonicalizing to min(90vh, 900px) across desktop and mobile without !important.
• Web Crypto & Window Timers: Standardized Web Crypto on crypto API and explicit window.setTimeout.
• Preserved Safety Invariants & Sync Semantics: All C1–C7 invariants, three-way conflict handling, atomic push construction, and empty-tree convergence remain 100% untouched.

Installation Requirements & Setup

• Via BRAT (Recommended for Mobile / Desktop):
  1. Install the Obsidian BRAT community plugin.
  2. In Obsidian Settings, go to BRAT -> Add Beta plugin.
  3. Enter repository URL: https://github.com/ankhang0704/github-vault-relay.
  4. Enable GitHub Vault Relay under Community Plugins.
• Manual Installation: Download main.js, manifest.json, and styles.css from this release and place them in your vault at .obsidian/plugins/github-vault-relay/.

Release Asset Identity (SHA-256)

• main.js (163,315 bytes): 3B0ABF58DC3B00FF4DF10782553650096A3B54539323A0167791AF1EDA36780C
• manifest.json (350 bytes): 480803E6367D6E759ABB154E1C583FFBD7D83DC97669398795507461A6A37EF3
• styles.css (4,222 bytes): BF3B1FA38D46DA8B21E677C443A07520C5C7152E74F9C76CFAEAF2F169CB9EAB

1.0.1

GitHub Vault Relay 1.0.1 — Community Directory Compliance Release

GitHub Vault Relay 1.0.1 addresses compliance requirements for the official Obsidian Community Plugin Directory.

Compliance Improvements

• True minAppVersion (1.11.4): Corrected minAppVersion to 1.11.4 to truthfully reflect the Obsidian runtime requirement for App.secretStorage.
• Truthful versions.json: Updated versions.json mappings to reflect 1.11.4 minimum application version for all builds requiring SecretStorage.
• Command ID Standards: Removed redundant plugin ID prefix from command IDs (sync-dashboard, preview-sync, pull-safe-changes, push-safe-changes, test-connection) to conform to Obsidian Community plugin standards.
• Manifest Description Formatting: Replaced unicode em-dash with standard punctuation in manifest.json and package.json descriptions.
• Policy Disclosures & Licensing: Added explicit Network & Privacy Disclosures and License & Attribution sections to README.md per Obsidian Developer Policies.

Installation Requirements & Setup

• Via BRAT (Recommended for Mobile / Desktop):
  1. Install the Obsidian BRAT community plugin.
  2. In Obsidian Settings, go to BRAT -> Add Beta plugin.
  3. Enter repository URL: https://github.com/ankhang0704/github-vault-relay.
  4. Enable GitHub Vault Relay under Community Plugins.
• Manual Installation: Download main.js, manifest.json, and styles.css from this release and place them in your vault at .obsidian/plugins/github-vault-relay/.

Release Asset Identity (SHA-256)

• main.js (164,170 bytes): 46EB9289528BBCD8DF3E465F1C6062A02ADE9EE79307ACF120070817A6DA57F4
• manifest.json (355 bytes): E785A52E483CB34E06EE87335B551AD68F0276CD31DE12B45CF010066F92FB87
• styles.css (3,038 bytes): 9E529431CF0B2AD1569D7C18C2F7C6A3C430FFDB51B48B6EF775F1B820CC4534

1.0.0

GitHub Vault Relay 1.0.0 — Stable Production Release

GitHub Vault Relay connects your Obsidian Mobile (iPhone, iPad, Android) and Desktop vaults directly to your GitHub repository using GitHub's REST and Git Data APIs over HTTPS. It requires no native Git installation, no command line tools, no isomorphic-git polyfills, and zero background daemons.

Core 1.0 Capabilities

• Unified Safe Sync ([ Sync ]): Single-action coordination combining planning, safe remote pulls, local replanning, and safe local pushes into a single deterministic operation.
• Complete Filesystem Lifecycle: Full synchronization support for Create, Edit, Move/Rename, and Delete across Desktop and Mobile.
• Single-Commit Atomic Push: All local additions, edits, renames, and deletions in a sync batch are committed in a single atomic Git commit.
• Binary Support & 25 MiB Safety Ceiling: Byte-exact streaming for binary attachments (PNG, JPG, PDF, audio, canvas, etc.) without text-encoding corruption, protected by a 25 MiB per-file safety ceiling to prevent mobile memory exhaustion (iOS Jetsam).
• Safe Deletion & Move Ordering: Moves batch destination creation and source deletion atomically; pulls verify destination materialization before source deletion. Deletions require baseline existence evidence.
• Deterministic Conflict Preservation: Three-way conflict detection (Keep Local, Use Remote, Keep Both) ensuring zero silent overwrites or unexpected data loss.
• Contextual Delete Conflicts: Explicit handling when a note is deleted on one side and modified on the other ([ Keep File ], [ Delete File ], [ Cancel ]).
• Stale-Device Deletion Propagation: Stale or offline devices cleanly pull remote deletions upon reconnect without resurrecting deleted files.
• Zero-File & Canonical Empty-Tree Convergence: Full lifecycle support for empty repositories (0 files) using Git's canonical empty root tree SHA 4b825dc642cb6eb9a060e54bf8d69288fbee4904 and transitions back to 1+ files without synthetic placeholders (.gitkeep).
• SecretStorage Credential Security: GitHub PAT stored strictly in Obsidian's secure SecretStorage (github-vault-relay-pat) with automated regex token redaction across all logs, toasts, and UI dialogs.
• Crash Recovery & Rollback Engine: Durable journals in .obsidian/github-vault-relay/pull-recovery/ and delete-recovery/ with automatic rollback of interrupted operations on app launch.
• Optimistic Concurrency: Branch ref updates strictly enforce force: false. Remote HEAD is revalidated before push and verified authoritatively post-push.

Installation Requirements & Setup

• Via BRAT (Recommended for Mobile / Desktop):
  1. Install the Obsidian BRAT community plugin.
  2. In Obsidian Settings, go to BRAT -> Add Beta plugin.
  3. Enter repository URL: https://github.com/ankhang0704/github-vault-relay.
  4. Enable GitHub Vault Relay under Community Plugins.
• Manual Installation: Download main.js, manifest.json, and styles.css from this release and place them in your vault at .obsidian/plugins/github-vault-relay/.

Personal Access Token (PAT) Scope Reminder

We strongly recommend configuring a GitHub Fine-Grained Personal Access Token:

• Repository access: Only select repositories -> Select your specific vault repository.
• Permissions: Contents -> Read and write (Metadata read access is included automatically).
• Token is stored strictly in Obsidian SecretStorage and never exposed in plaintext.

Known Limitations

• Unborn GitHub Repositories: The target GitHub repository must have at least one initial commit and default branch before connection (standard Git constraint; Git Data API cannot construct trees or update refs on an unborn HEAD). Repositories that become empty through sync convergence (0 files) are fully supported.
• No Background / Real-Time Sync: Sync runs only when explicitly triggered by you.
• No Absolute Zero Data Loss Guarantee: Vault Relay prioritizes data integrity and stops when ambiguous, but cannot prevent data loss caused by external out-of-band force pushes or host OS malware.

Upgrading from 0.7.x

Upgrading from 0.7.x (or earlier preview builds) is completely automatic and non-destructive:

• Internal state is automatically preserved and loaded from .obsidian/github-vault-relay/.
• Credentials remain securely stored in SecretStorage.
• Existing vault notes and conflict copies are untouched.

Release Asset Identity (SHA-256)

• main.js (164,265 bytes): FE1ED3F3E47FDD29B8DE3E8EB77A193DD2F429641580BD20CB900CC9516FA191
• manifest.json (357 bytes): A93D5EDC6FF7D77AF5BE26CF9C8ADEFC91003D70CA8BAF3D88273F1F9AA1ED7E
• styles.css (3,038 bytes): 9E529431CF0B2AD1569D7C18C2F7C6A3C430FFDB51B48B6EF775F1B820CC4534

0.7.0

GitHub Vault Relay 0.7.0 (Release Candidate / Pre-release)

Highlights

• Canonical Empty-Tree & Zero-File Repository Closure (C7): Full lifecycle support for empty repository convergence (0 files) and transition back to 1+ files without placeholder files (.gitkeep, README.md) or synthetic commit workarounds.
• Direct Canonical Empty Tree Commit: PushEngine and ConflictManager detect empty tree convergence and target Git's canonical root empty tree SHA 4b825dc642cb6eb9a060e54bf8d69288fbee4904 via POST /git/commits, bypassing GitHub's 404/422 error on empty tree creation.
• Authoritative Empty Tree Resolution: GitHubClient.getTreeRecursive automatically resolves 404 commit responses referencing the canonical empty tree to { sha: CANONICAL_EMPTY_TREE_SHA, tree: [] }.
• First File from Empty State: Verified creation of the first file from an empty repository using base_tree: CANONICAL_EMPTY_TREE_SHA.
• C7 Test Suite: 14 new automated tests in tests/c7EmptyTree.test.ts verifying all 17 specification invariants and an alternating 100-cycle stress test. Total automated tests elevated to 450 passing tests across 41 test files.
• Mobile Touch Smoothness: Hardware-accelerated CSS touch feedback and -webkit-overflow-scrolling: touch; on mobile modal scroll views.
• Documentation Freeze: Truthful documentation alignment across all core architecture documents, security policies, and source of truth guides for 0.7.0 release readiness.

Asset Verification (SHA-256)

• main.js (164,265 bytes): FE1ED3F3E47FDD29B8DE3E8EB77A193DD2F429641580BD20CB900CC9516FA191
• manifest.json (357 bytes): 2BD6554C509147510374EAB337F00B0ECEB8D4D1066C10BB08556B8B4E8D032B
• styles.css (3,038 bytes): 9E529431CF0B2AD1569D7C18C2F7C6A3C430FFDB51B48B6EF775F1B820CC4534