0.1.0

What's Change

🔤 Base32768 Filename Encoding (Rclone Parity)

• Added full Base32768 filename encoding support for complete parity with rclone crypt.
• Expanded integration tests validating compatibility against rclone CLI.

🌐 Multi-Language Documentation

• Added translated README documentation across 10 supported locales:
  • Arabic (ar), German (de), Spanish (es), French (fr), Hebrew (he), Japanese (ja), Korean (ko), Russian (ru), Simplified Chinese (zh-CN), and Traditional Chinese (zh-TW).

🔒 Nested & Multi-Layer Encryption

• Introduced support for nested file encryption with inner-layer detection and localized notifications.

---

🛠️ Enhancements & Breaking Defaults

• Default Extension Change: Updated the default encrypted file suffix from .rcrypt to .bin for direct alignment with standard rclone CLI setups. Existing custom extension settings will remain unaffected.
• Streamlined Documentation: Reorganized the main README structure, clarified rclone.conf parameter mappings/placeholders, and added instructions for Obsidian Community Plugin installation.
• UI & Modal Improvements: Updated passphrase entry and confirmation modals to correctly display Base32768 encoding status and active encryption modes.

---

🐛 Bug Fixes

• Click Interceptor Gate Fix: Replaced the previous hardcoded extension allowlist with a dynamic positive-match check for configured profile extensions.
  • Resolves an issue where native non-encrypted Obsidian extensions (e.g. .bases, .txt, .json, .yaml) were mistakenly intercepted and opened in external system applications instead of Obsidian.
• Cleaned Up Codebase: Removed unused linter variables and standardized plugin naming to RCrypt.

Full Changelog: 0.0.16...0.1.0

0.0.16

What's Change

🚨 Critical Bug Fix: Dragging encrypted files to the tab bar caused permanent file corruption

When an encrypted file was dragged onto the Obsidian tab bar or into a split pane, Obsidian would open it in a standard Markdown editor leaf. This caused Obsidian to read the raw binary ciphertext as plain text and immediately overwrite the file on auto-save — permanently corrupting it and making decryption impossible from that point on, regardless of the passphrase or profile used.

The fix intercepts any leaf attempting to open an encrypted file in a writable view, closes it before any write-back can occur, and then triggers the decryption modal — exactly the same as a regular left-click. No extra steps, no new UI.

Note for affected users: Files corrupted before this fix cannot be recovered. The original ciphertext was overwritten. This scenario is fully prevented going forward.

---

🐛 Bug Fix: Default salt description was misleading across all languages

The salt field previously showed rclone as its placeholder and described it as the default value, implying that typing the string "rclone" is equivalent to leaving the field blank. This was incorrect.

The actual default is rclone's internal 16-byte binary constant — not the literal text "rclone". Entering "rclone" as a custom salt produces an entirely different key, which would cause files encrypted by one tool to be unreadable by the other.

The placeholder, description, and warning text have been corrected across all 11 supported languages (EN, ZH-CN, ZH-TW, ES, FR, DE, JA, KO, RU, AR, HE) to make clear that leaving the field blank is what uses rclone's built-in default.

---

Full Changelog: 0.0.14...0.0.16

0.0.14

What's Change

• Folder Profile Mapping & Command Palette Integration:
  • Automatically map vault folders to specific Crypt Profiles in settings.
  • Added quick-access commands to the Obsidian Command Palette for executing profile actions directly.
  • Enhanced folder path resolution to handle encrypted folder names during batch processing.
• In-Memory Session Security & Decryption Choices:
  • Added per-file, in-memory session password caching to reduce repeated passphrase prompts while keeping passwords secure in memory.
  • Updated context menu actions to provide explicit decrypt choices (e.g., decrypting in-place vs. opening temporary decrypted views).
• Password Hints for Crypt Profiles:
  • Added optional password hint configuration when editing or creating Crypt Profiles.
  • Displays password hints in the decryption modal to assist with key retrieval.
• UI & Modal Polish:
  • Added progress modals for folder & batch operation tracking.
  • Scoped and responsive CSS styling fixes across custom modals and settings tabs.

Bug Fixes & Reliability Improvements

• Batch Processing & Pre-filtering:
  • Automatically pre-filters already unencrypted/plaintext files during batch decryption actions to avoid redundant operations or errors.
  • Resolved path resolution issues when navigating mapped folders containing encrypted sub-paths.
• Atomic Batch Source Cleanup:
  • Enforced atomic deletion of original files during batch operations so source files are safely retained if an error occurs during partial batch encryption.
• Scrypt Key Derivation:
  • Fixed handling for empty/blank passphrases during Scrypt derivation.
• Settings UI & Passphrase Inputs:
  • Fixed automatic refreshing of settings views when session memory is cleared manually.
  • Corrected input visibility behavior for existing profile credentials within the passphrase modal.

Full Changelog: 0.0.12...0.0.13

0.0.11

What's Change

• Context Menu Decrypt Prompt: Context menu Decrypt file and Decrypt folder options now always prompt the passphrase modal (PassphraseModal) instead of triggering an automatic background decryption.
• Clean Custom Profile Initialization: Fixed ConfirmEncryptModal so selecting Custom... configuration starts with empty passphrase and salt inputs rather than populating active profile credentials.

Full Changelog: 0.0.10...0.0.11

0.0.9

🚀 Highlights & New Features

🏷️ Dynamic Active Profile Command Titles

• Live Command Palette Updates: Commands in the Obsidian Command Palette now dynamically append the currently active Crypt Profile name (e.g., Encrypt specific file/folder (Standard) / Encrypt active file (Standard)).
• Auto-Synchronization: Command names instantly refresh whenever you switch active profiles or update profile names in settings.

🔒 Refined Passphrase & Custom Configuration Modals

• Fresh Custom Credentials: Selecting Custom... in passphrase modals resets transient fields, ensuring stale credentials from prior custom sessions are never inadvertently reused.
• Context-Sensitive Suffix Controls: The Encrypted File Suffix text field is shown specifically when creating/encrypting files with filename mode OFF or custom suffixes, while decryption operations rely on automated filename extension stripping.
• Live File/Folder Tree Preview: Inspect a formatted tree structure of selected files and nested folders directly inside passphrase confirmation modals.
• Password Visibility Toggles: Quickly toggle visibility on passphrase and salt fields with inline eye icons.

🛡️ Rclone Technical Standard Alignment & Decoupling

• Independent Key Derivation Fix: Resolved an issue where transient Custom profile configurations did not properly pass custom filename modes (OFF or Obfuscate) to the filename cipher. Filenames now encrypt and decrypt cleanly under all custom profile configurations.
• Decoupled Payload & Filename Decryption: Documented Rclone's dual-key derivation architecture (dataKey vs nameKey). Payload decryption strictly depends on matching passphrase/salt parameters, while filename decryption operates independently.

---

🛠️ Bug Fixes & Technical Improvements

• Context Menu Context Filtering: Fixed an issue where unencrypted files could display a failing Decrypt menu item; context menus now strictly display Decrypt only when encrypted content is present.
• Obfuscate Extension Preservation: Fixed a filename decoding bug in Obfuscate and Standard mode during decryption so the full encrypted segment is passed to the cipher, preserving original extensions.
• Full Type & Health Verification: Passed all tsc compilation, zero-warning ESLint checks, and vitest unit test suites.

---

📖 Technical Documentation

Added explicit documentation to README.md detailing Rclone Crypt's dual-key derivation standard (dataKey for payload encryption and nameKey for filename encryption), explaining why file contents unlock as long as passphrase and salt match, even if filename encryption modes differ.

Full Changelog: 0.0.8...0.0.9

0.0.8

Obsidian RCrypt Initial Release

obsidian-rcrypt provides native, client-side file and directory encryption inside Obsidian with 100% specification compatibility with official Rclone Crypt.

The plugin operates completely offline using pure JS cryptographic primitives (@noble/ciphers and @noble/hashes), eliminating external binary dependencies (rclone) across Desktop (macOS, Windows, Linux) and Mobile (Android, iOS) platforms.

---

⚡ Key Features & Capabilities

• 100% Rclone Crypt Interoperability: Encrypt files directly within your Obsidian vault and seamlessly mount, inspect, or decrypt them using standard Rclone CLI commands (rclone cat, rclone mount, rclone copy).
• Profile Management System:
  • Configure multiple crypt profiles with independent parameters.
  • Set per-profile encryption passphrases, salt credentials, filename encryption algorithms, and encoding schemes.
  • Quick-switch active profiles or specify target profiles directly from context menus.
• Native Context Menu Integration:
  • Perform single-file, multi-file selection, or recursive folder tree encryption/decryption via Obsidian's file explorer context menu.
  • Support for custom one-time credentials (Encrypt with custom passphrase...) without modifying saved profiles.
• Granular Filename Encryption Engine:
  • Standard: Wide-block cipher encryption (AES-256-EME with PKCS#7 padding).
  • Obfuscate: Rclone key-based character rotation cipher preserving original file extension and filename length.
  • Off: Plaintext filename preservation with optional append extension suffixing (e.g. .rcrypt).
• Encoding Formats: Support for both Base32 (unpadded lowercase, Rclone default) and Base64 (URL-safe unpadded).
• Fault-Tolerant Bulk Processing: Automatic payload header inspection gracefully skips non-encrypted files, corrupt blocks, or already-decrypted files during recursive directory operations without halting batch execution.
• Security & Storage Modes:
  • RAM-Only Session Mode (Default/Recommended): Credentials remain strictly in volatile memory and are auto-wiped on plugin unload, session exit, or via command palette execution (Clear session credentials).
  • Obscured Storage (data.json): Persistent storage using Rclone's official rclone obscure algorithm (AES-256-CTR with 16-byte random IV and internal Rclone fixed key).
• Internationalization (i18n): Multilingual UI localization with automatic locale detection and Right-to-Left (RTL) layout support.

---

🔬 Cryptographic Architecture & Specifications

1. Key Derivation (scrypt)

Key material is derived from the user passphrase and salt (defaulting to "rclone") using scrypt:

• N = 16384 (CPU/Memory cost factor)
• r = 8 (Block size)
• p = 1 (Parallelization factor)
• Derived Buffer: 64-byte key material divided into:
  • dataKey: Bytes 0–31 (32 bytes used for payload encryption)
  • nameKey: Bytes 32–63 (32 bytes used for filename encryption)

2. Payload Encryption (XSalsa20-Poly1305 / NaCl SecretBox)

Encrypted file payloads strictly follow the Rclone Crypt binary format:

• Header: 8-byte magic header (RCLONE\x00\x00) followed by a 24-byte cryptographically secure random base nonce.
• Block Chunking: Plaintext is processed in 64 KiB (65,536 bytes) data blocks.
• Block Nonce & Cipher: Each 64 KiB chunk is encrypted using XSalsa20 with a block nonce derived by incrementing the 24-byte base nonce by the block index, authenticated via a 16-byte Poly1305 MAC tag.
• Block Overhead: Each encrypted 64 KiB block produces 65,552 bytes on disk (+16 bytes per block MAC tag overhead).

3. Filename Encryption Ciphers

• Standard (AES-256-EME Wide-Block):
  • Plaintext filenames are padded using PKCS#7 to 16-byte multiples.
  • Encrypted via AES-256-EME (Encrypt-Mix-Encrypt wide-block mode) using nameKey.
  • Serialized via Base32 (unpadded) or Base64 (URL-safe unpadded).
• Obfuscate (Character Rotation):
  • Rotates ASCII/UTF-8 character tables using a deterministic 256-bit key offset to obscure filename text while keeping length constant.
• Off:
  • Leaves original filename intact, optionally appending a custom suffix.

---

🖥️ Rclone CLI Configuration Interoperability

Files encrypted by obsidian-rcrypt are 100% compatible with an Rclone CLI crypt remote configured in rclone.conf:

[my-vault-crypt]
type = crypt
remote = /path/to/obsidian/vault
password = <your-obscured-or-plaintext-password>
password2 = <your-obscured-or-plaintext-salt>
filename_encryption = standard # standard | obfuscate | off
filename_encoding = base32     # base32 | base64