3.8.1

Vault Operator v3.8.1

Install from the Obsidian Community Plugins store:

1. Settings → Community plugins → Browse
2. Search for "Vault Operator" and click Install, then Enable

Store page: https://obsidian.md/plugins?id=vault-operator

Or install manually:

1. Download main.js, manifest.json, styles.css into .obsidian/plugins/vault-operator/
2. Reload Obsidian

Optional assets

Four optional downloads (semantic reranker, self-development source
bundle, office document support, PDF parser) are published as a
separate tag 3.8.1-assets and installed on demand
from the plugin's Settings, never silently. The plugin works
without any of them; the affected tool reports "not installed"
until you click Install.

---

What changed in 3.8.1

A compliance patch. One behaviour change, no new features.

No code path assembles a hostname

Three places built a domain-shaped string out of parts. All three now produce a value that cannot be read as a rebuilt hostname.

• Connector registry. Verifying a publisher's claimed domain no longer reconstructs a name from the reverse-DNS namespace. It compares label by label and returns a slice of the host the registry actually sent, so the verified badge can only ever show a name that was in the registry response. The label boundary still holds: evilnotion.com remains a mismatch against com.notion.
• Vault health. The independent-domain count keys its set with a separator that cannot occur in a hostname. Only the count is read, and the count is unchanged.
• Provider URL guard. The canonical dotted-quad address is built from a template, like the helper three lines above it. It is an address, not a hostname.

Behaviour change

When a connector's claimed domain is not backed by the registry response, the publisher badge now shows the raw namespace instead of the unproven name. The warning line beside it is unchanged.