Basalt Sync 0.9.0

What's new

• The headless CLI now exposes a separately paired vault through MCP, over local stdio or Streamable HTTP behind Tailscale Serve or another HTTPS proxy.
• Agents can search and read notes, inspect sync and history, create notes, append text, make exact old-to-new edits, and restore a version to a new path. HTTP MCP is read-only by default; --writable enables supported mutations. Stdio follows the paired device's read-only setting.
• Existing-note edits require the current content base and a verified, flushed before-image before changing the original. Whole-file replacement is intentionally absent. Backups remain ordinary synced files that MCP cannot change.
• HTTP access uses an independent, revocable bearer key. Rotation retires old sessions without changing the vault's device or encryption credentials.
• Obsidian setup now accepts an invite, recovery key or server setup line in one field. Device naming moves under More options, and the unnamed default vault is no longer presented as a user-chosen name.

Upgrade

Update the Obsidian plugin normally, preserving its settings and pairing. It still requires Obsidian 1.7.2 or newer. The matching CLI is available with npm install -g basalt-sync@0.9.0 and now requires Node.js 22 or newer.

All 0.8.x and 0.9.0 components use protocol 7. Existing pairings and encrypted server data remain compatible; there is no re-pairing or data migration. The server 0.9.0 release accompanies this release but has no runtime changes from 0.8.5.

For MCP, follow the CLI setup guide. Pair a separate local directory; never run the headless client against the same directory as a running Obsidian plugin. Keep HTTP on loopback behind an HTTPS proxy, and export its key outside the vault.

Verification and limits

The local gate covers real server exchanges, packaged CLI execution, concurrent edits, crash recovery, backup retention and HTTP authentication. Real Tailscale HTTPS, credential rotation and restart were also exercised with official SDK clients; Mac and Android devices running plugin 0.8.6 received the exact edited note and its original before-image.

MCP remains experimental. Cloudflare Tunnel, Collie and a specific phone MCP app have not been tested. Static bearer authentication is supported; OAuth discovery is not. A lost response can follow a completed edit, so inspect the note before retrying. Process-kill tests do not establish power-loss durability, and Android retains its existing filesystem flush limitations.

The release includes checksums and build provenance:

shasum -a 256 -c SHA256SUMS
gh attestation verify main.js --repo waynehoover/basalt-sync