2.0.3

The Obsidian plugin-review pass, and MCP goes HTTP-only. Cleanup and a removal, no new features.

MCP servers

• The stdio (local command) transport is gone. Smart Second Brain now connects to MCP servers over HTTP only (Streamable HTTP, with SSE fallback), the same on desktop and mobile. Any saved stdio server is removed by a data migration on first load. A server that only speaks stdio can still be used behind an HTTP bridge such as mcp-proxy or supergateway — see the MCP docs. This is what removes the plugin's ability to launch processes; see below. (#467)
• The server dialog checks the connection for you. No more Test connection button: like the provider setup modal, the connection is probed when you leave the URL or headers field, the verdict sits in the footer (checking / connected with the tool count and a list of the tools / the failure cause), and Add Server / Save unlock once the server has actually connected. Editing a server without touching its URL or headers can still be saved while the server happens to be unreachable. (#467)
• Probes never run mid-keystroke, and when editing a server that has headers, a URL on a different host than the saved one puts the probe on hold with an explicit check now — so stored credentials are never sent to a new host as a side effect of retyping a URL. (#467)
• The dialog's footer no longer leaves a gap above the buttons, and the confirm buttons stay together on one line. (#467)

Obsidian plugin review

Obsidian's automated review had flagged the plugin. Everything in that report that lives in our own code is resolved, and the two behaviour findings that came from bundled dependencies are resolved too:

• No process spawning or dynamic code execution in the bundle. The MCP SDK's stdio transport and ajv validator, the Anthropic SDK's local agent toolset, and Pixi's code generators are swapped for shims at build time; Pixi runs on its supported eval-free path and the MCP SDK validates tool results with its own interpreter-based provider. The build fails if any of these ever reappear. (#467)
• Language detection uses Obsidian's getLanguage(), and the bulk-indexing crash marker persists through Obsidian's vault-scoped storage instead of raw localStorage. (#465)
• Deprecated Obsidian and LangChain APIs replaced, DOM built through Obsidian's helpers, inline styles moved to CSS classes, promise handling made explicit, and IndexedDB failures always surface as real Errors. No user-visible change intended; the graph, search modal, diff action bars, indexing notice and phone-sheet modals were checked live. (#465)
• INFO-level plugin logging now goes to the console's Verbose level, per Obsidian's guidelines. Turn on Verbose in the developer console to see it. (#465)

Still flagged, by design

Vault enumeration (indexing needs it) and clipboard access (the copy-message button).