v0.4.0

v0.4 makes failures fail loudly. v0.3 left a handful of silent failure modes — a typoed updated: value silently skewed sort and staleness filters; a wikilink alias didn't match area: queries despite literally naming the area; a timestamp with a TZ offset got UTC-sliced into a different calendar date. v0.4 makes each one either correct or loud.

Highlights:

• Every Obsidian wikilink shape for area: — bare, quoted, [[Foo]], [[Path/Foo]], [[Target|Alias]], plus the unquoted-array form — now collapses to one canonical form.
• Frontmatter dates with TZ offsets preserve the user's calendar date instead of UTC-slicing.
• Impossible dates (e.g. updated: 2026-13-45) surface in a new dateErrors response field rather than silently rolling over via new Date().
• CodeQL static analysis is on for application code and workflow YAML; supply-chain hardening pins the only third-party Action to a commit SHA.
• find_project caches parsed dates on each ProjectSummary; daily_review_status parallelizes its three independent I/O ops.

Breaking: The find_project response field lastReviewed is renamed to last_reviewed, matching the YAML field name (last-reviewed) and the snake_case MCP API convention. Clients reading the field by name will need to update; the sort token (the public API the field name didn't appear in) was already last_reviewed.

Security

• ci.yml test job declares an explicit permissions: contents: read block; the implicit broad GITHUB_TOKEN is no longer inherited (#22).
• pnpm/action-setup (the only third-party action) is pinned to a commit SHA in both ci.yml and release.yml; Dependabot's github-actions ecosystem keeps the SHA current (#23).
• CodeQL static analysis enabled for the javascript-typescript and actions language packs, using the security-and-quality query suite, scheduled weekly.
• Replaced the unmaintained gray-matter (pinned js-yaml@^3.13.1) with @11ty/gray-matter (js-yaml@^4.2.0), clearing GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in js-yaml v3 via repeated YAML merge keys).

Fixed

• find_project: area: [[Foo]] written unquoted in YAML — parsed by js-yaml as a nested array — no longer silently drops to undefined (#15).
• find_project: area: written as a wikilink alias ([[Areas/Health|Health]]) or path target ([[Areas/Health]]) now matches the alias / last path segment (#16).
• find_project: date fields carrying a timezone offset (e.g. due: 2026-06-30T20:00:00-08:00) now preserve the user's calendar date instead of UTC-slicing (#14).
• find_project: impossible dates in frontmatter no longer roll over silently via new Date(); the project still appears in unfiltered results but the bad value surfaces in the new dateErrors field (#18).
• parseFrontmatter: works around a latent @11ty/gray-matter bug where the library's cache stripped its own non-enumerable matter property on repeated parses of identical content.
• find_project: value instanceof Date fallback now caches local-midnight Date instead of js-yaml's UTC midnight, eliminating a residual TZ inconsistency in the updated_since filter.

Changed

• Breaking: find_project response: lastReviewed field renamed to last_reviewed (#20). The internal SORT_KEY_MAP indirection is gone; adding a new identity-mapped sort key now requires only the Zod enum and ProjectSortKey union.
• find_project response: new dateErrors?: Array<{field, value}> field carrying per-field date-parse failures.
• find_project tool description and parameter .describe() strings refreshed to reflect post-#18 exclusion criteria and the expanded area: normalization surface.

Performance

• daily_review_status: inboxStatus parallelizes its three independent I/O ops via Promise.all (#17).
• find_project: parsed Date objects are stashed on each ProjectSummary and reused by both daysSinceUpdate and the updated_since filter (#19).

---

See CHANGELOG.md for full notes.

v0.3.0

v0.3 makes review workflows direct. Together, the two changes collapse the daily-review opener from four Bash operations to two structured tool calls.

• find_project gains status, area, stale_days, updated_since, sort, order, limit params and lifts updated, lastReviewed, daysSinceUpdate into the response.
• daily_review_status returns inboxItems (mtime-sorted oldest-first) and previousDailyNotePath (handles weekly-review filename variants).

Added

• find_project: new optional filters (status, area, stale_days, updated_since), sort (sort, order), and limit params (#11). Inputs use snake_case; tool stays vocabulary-neutral on status — accepts any string for case-insensitive equality match rather than enumerating one user's PARA conventions.
• find_project: new response fields updated, lastReviewed, daysSinceUpdate lifted from frontmatter and computed against today (#11).
• find_project: area filter normalizes Obsidian [[wikilink]] brackets, quoting, and case before exact-matching (#11).
• daily_review_status: new inboxItems response field — every markdown file in the configured inbox folder as { name, path }, sorted by mtime oldest-first (#12).
• daily_review_status: new previousDailyNotePath response field — vault-relative path of the most recent daily note strictly before today, including weekly-review variants like YYYY-MM-DD — Weekly Review.md (#12).

Changed

• find_project: sort default 'name' is now deterministic regardless of platform. Previously ordering depended on globby's incidental filesystem traversal.

Fixed

• find_project: due: frontmatter values written unquoted in YAML are now correctly lifted. Previously silently dropped because the type check rejected js-yaml's parsed Date objects.
• daily_review_status: listInboxItems tolerates stat failures from disappearing files (sync race, broken symlink) — previously the whole tool call would throw ENOENT.
• daily_review_status: returned paths are POSIX-normalized so Windows users get forward-slash vault-relative paths matching the documented contract.
• daily_review_status: previousDailyNotePath tie-breaks deterministically when multiple files share a YYYY-MM-DD prefix (the suffixed variant — e.g. — Weekly Review.md — wins).

See CHANGELOG.md for full notes.

v0.2.0

v0.2 stops being maintainer-shaped. Section names and PARA folder paths are configurable via _system/PARA-conventions.md; defaults preserved. Published on npm as @robertwtucker/para-vault-mcp.

Install

npx -y @robertwtucker/para-vault-mcp

See the README for Claude Code / Claude Desktop wiring.

Added

• Configurable section names and folder paths via _system/PARA-conventions.md frontmatter (#2). Defaults preserved — a vault without the file behaves exactly as v0.1.
• Folder-path values are containment-checked at config load; absolute paths and values resolving outside OBSIDIAN_VAULT_PATH are rejected (#9).
• parseFrontmatter now surfaces YAML errors via an error field; find_project results include frontmatterError when a project's _project.md has malformed frontmatter (#1).

Changed

• capture inserts at the top of the section's primary bullet list rather than at section end (#8). log_work continues to append chronologically.
• Distributed on npm as @robertwtucker/para-vault-mcp; install is now npx -y @robertwtucker/para-vault-mcp (#5).

Fixed

• Parallel writes to the same daily note no longer drop entries — per-path in-process serialization protects the read-modify-write cycle (#3).

Full changelog: v0.1.0...v0.2.0

v0.1.0

Initial release — five tools, MIT-licensed, validated end-to-end against a real PARA vault. Known issues and roadmap tracked openly in GitHub Issues.

Added

• capture, daily_review_status, find_project, log_work, and next_action tools.
• Claude Code and Desktop installation instructions in README.
• PARA vault conventions documented in README.

See CHANGELOG.md for the full entry.