0.1.7

Two changes you can see, and one you mostly cannot.

Settings are searchable. On Obsidian 1.13 and newer, searching Obsidian's own
settings for "Scriben", "folder" or "sync" now finds these settings directly,
instead of only finding the plugin and leaving you to hunt. Older Obsidian is
unaffected and keeps working exactly as before.

Scriben no longer lists the rest of your vault. Both directions used to start
from a list of every file in your vault and then narrow it down — which is a strange
thing for a plugin whose whole point is that it reads only the folders you name.
It now descends from the folders you named and nothing else. A folder you did not
name is never listed at all.

One consequence worth knowing: Scriben looks for its own notes inside the folder you
chose. If you move a synced meeting note somewhere else in your vault, the next sync
writes a fresh copy back into that folder.

Nothing else changed. Same note structure, same managed block that protects your
own writing, same default of sharing nothing until you name folders yourself, same
Obsidian 1.4.0 requirement.

---

For anyone reading the entry: this clears the last automated review warning and the
vault-enumeration disclosure. Neither was suppressed — the settings tab now
implements the declarative API alongside the older one, and the file walking was
genuinely narrowed.

Verified: 46/46 tests, clean tsc, zero lint errors, and main.js reproduces
byte-for-byte from source with a GitHub artifact attestation.

0.1.6

Three things people actually run into.

Meetings now arrive on their own. Previously the plugin synced when Obsidian
opened, or when you pressed the button — so a meeting recorded mid-morning was not
in your vault until you remembered to fetch it. Settings now has Keep syncing in
the background, with an interval from every 15 minutes to every 6 hours. Off by
default. When you share folders back to Scriben, the background run keeps those in
step too.

You can see whether it is working. The Connection line used to say "Connected".
It now says:

Connected as you@work.com · 23 meeting notes in this vault · last synced 5 minutes ago

And a sync tells you what happened in plain words — "3 new meeting notes", or "your
meetings are up to date" when you asked and nothing had changed. A background sync
that finds nothing stays silent rather than interrupting you every hour.

It installs on far more versions of Obsidian. This plugin required Obsidian
1.13.0, which turned out to be down to a single call used to colour the Disconnect
button red. The same result comes from a CSS class that has worked since 0.9.7, so
the real requirement is now Obsidian 1.4.0.

Nothing about your notes changed. Same note structure, same managed block, same
folder rules, same default of sharing nothing until you name folders yourself.

---

Because background syncing runs unattended, the paths it uses were hardened: sharing
cannot overlap with a manual share and double-send; changing the interval cannot
leave old timers running; the timer never starts without a connection and stops when
you disconnect; a background failure retries quietly instead of interrupting you; and
a corrupted interval in the settings file is clamped rather than becoming a request
loop.

Verified: 37/37 tests, clean tsc, zero lint errors, and main.js reproduces
byte-for-byte from source with a GitHub artifact attestation.

0.1.5

Clears the remaining review warnings. No behaviour change.

What changed

The warning list was mostly one omission repeated: unwrap() returned any, so
every field read off a pairing response, a summary or a note reached TypeScript
untyped, and each access was reported separately.

• ApiResult<T>, PairingStart, PairingToken and WhoAmI are declared, and the
  pairing calls and planPull() now say what they return.
• unwrap() returns unknown rather than any, so a caller has to state the
  shape it expects — that is what stops it spreading again.
• PairModal declares its fields instead of using constructor parameter
  properties, which no-unused-vars read as three dead parameters.
• Notice and modal copy no longer place the product name mid-sentence.

33 findings → 7, and zero errors throughout.

Still open, deliberately. The remaining seven are one cause: this plugin
declares minAppVersion 1.13.0, and on 1.13 the classic display() settings tab
is deprecated in favour of getSettingDefinitions(). Adopting it means rewriting
the settings tab — the only path a user has to connect the plugin — for warnings
that do not block installation. 1.13.0 itself is the honest floor: tested down the
range, 1.11.0 still reports an unsupported API.

Verified: 0 lint errors, 28/28 tests, clean tsc, and main.js reproduces
byte-for-byte from source with a GitHub artifact attestation.

0.1.4

Clears the last error from Obsidian's automated review, and adds the gate that
should have caught it before the tag.

Fixed

• Settings heading no longer repeats the plugin name — Obsidian already shows it
  beside the tab (obsidianmd/settings-tab/no-problematic-settings-headings).
• The pairing code element is built with createDiv() rather than
  createEl('div') (obsidianmd/prefer-create-el).
• Ribbon tooltip reads "Sync meetings" instead of "Sync Scriben meetings".

Why this release exists

0.1.2 failed review on three errors. 0.1.3 fixed all three, and introduced a
fourth: moving the hand-rolled <h4> to setHeading() kept the plugin name in
the heading text. Nothing in this repo could see that — the only feedback surface
was the listing page, hours later.

The findings come from eslint-plugin-obsidianmd, which is on npm. npm run lint
now runs before npm test in the release workflow, so a tag carrying an
obsidianmd error cannot produce a release.

Unchanged behaviour. No change to syncing, sharing, note structure, or the
managed region. Existing vaults and settings are unaffected.

Verified: 0 obsidianmd errors, 28/28 tests, clean tsc, and main.js
reproduces byte-for-byte from source with a GitHub artifact attestation.

0.1.3

Clears the automated review.

• Types across the module boundary — 25 of the 34 warnings were one omission repeated: the .mjs modules were untyped, so every field read off a note was an unsafe any access.
• Styles moved to styles.css — inline cssText cannot be overridden by a theme.
• Obsidian conventions — Setting().setHeading() for sections, setTitle() in the modal, setDestructive() instead of the deprecated setWarning(), window.setTimeout for popout windows.
• Command names no longer repeat the plugin name.
• minAppVersion 1.13.0, matching the APIs actually used.

No security findings in the previous review: attestations verified, no suspicious network patterns, no vulnerable dependencies, no obfuscation, and the build reproduced byte-for-byte.

0.1.2

A meeting note structured the way it gets read back

The synced note was a title, a summary and a flat list of action items. Opening
one the next morning, the thing you want first is what was decided, then what
you owe, then what is still unresolved — and none of that was distinguishable.

Sections now follow that order and empty ones are omitted rather than printed as
bare headings, which fills Obsidian's outline with dead entries and makes the
note look broken.

Three things the vault can do that a transcript cannot, now done:

  - People are wikilinks. The meeting appears in a person's backlinks without
    anyone filing it there, which is the whole reason to keep meetings in a
    vault at all.
  - `date:` is a bare yyyy-mm-dd, so Obsidian parses it as a real date property.
    Quoted, or left as a full ISO timestamp, it is only a string and silently
    drops out of every dated query.
  - What Scriben remembers about the meeting is written into the note, so the
    memory is readable where the meeting is, not only inside the app.

Action items carry an owner and a due date when the server sent them, and grow
neither an empty @ nor an empty date when it did not. Boxes are never
pre-ticked: Scriben has no completion state, so a tick would be a claim we
cannot back — and the box being the user's means ticking it survives a re-sync.

Also halves the round trips: get_summary already returns action_items, mentions
and flagged, and the plugin was asking a second tool for what the first reply
had already sent.

28 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

0.1.1

Do not open a file the user did not share

The push path called getMarkdownFiles() and then read EVERY markdown file in the
vault before handing the list to planPush, which discarded everything outside
the shared folders. The filter was correct and the reading was not: a note in a
private folder was opened and loaded into memory purely to be thrown away.

Obsidian's automated review flagged exactly this — "Enumerates all files in the
vault… gives the plugin access to every file path" — and it was right to. Scope
is now decided on the PATH, before anything is opened, so a folder the user did
not name is never read at all.

Also from the review: build provenance on the release assets, so a user can
verify main.js was built from this source rather than uploaded by hand.

And the plugin now carries the Scriben wordmark instead of a default icon.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

0.1.0

Scriben for Obsidian: meetings in, chosen notes out

Obsidian has no cloud API and no OAuth — the vault is a folder on the user's
machine — so the only shape that can sync automatically is a plugin running
inside Obsidian. A URL-scheme share needs a human tap every time and cannot run
after a recording finishes.

Two directions, and the second is off by default:

  Scriben -> vault  each recording becomes one markdown note with frontmatter,
                    a summary and unchecked action items.
  vault -> Scriben  only folders the user names, so the agent can answer with
                    their own context.

Three decisions worth reading the tests for:

The plugin owns the region between two markers and nothing else. Anything the
user writes above or below it survives a re-sync, and a file they created at our
path is appended to rather than replaced. A plugin that rewrites whole files
eats the annotation someone added under the summary, which is the entire reason
they filed the meeting in their vault.

Filenames carry the note's permanent ref, never its title. A re-summarised
meeting updates in place instead of filing a second copy, and a retitled note
keeps its old path so existing wikilinks keep resolving.

Nothing outside the named folders is ever sent, and the default is empty. A
folder whose name merely starts with a shared one is not in scope — the naive
prefix check would have uploaded MeetingsPrivate/ to anyone who shared
Meetings/, and there is a test that fails if it is reintroduced.

No node:crypto and no Buffer anywhere: neither exists on Obsidian mobile, and
this plugin is not desktop-only. Fingerprinting is plain JS so the same code
runs on a phone, a laptop and in the tests.

20 tests, no telemetry, no analytics.