Journal — 2026-03-11

2026-03-11 — Obsidian Plugin Hardening & Release

Big session: addressed 30+ Copilot code review comments on the Obsidian plugin, then published v0.1.0.

Security fixes: Token via env var instead of CLI args, YAML injection prevention with JSON.stringify, path traversal protection in urlToFileName, version parsing validation with Number.isFinite.

Quality fixes: Preserve user frontmatter (tags, aliases) on fetch and publish via buildMergedFrontmatter, handle arrays/objects in YAML serialization, quote YAML-unsafe keys, strip double-frontmatter from fetched docs, multi-line stderr parsing for CLI warnings, concurrent folder creation race handling, shallow copy DEFAULT_SETTINGS, remove stale bun.lock, update tsconfig lib to ES2018, extract writeFetchedDocument helper to deduplicate code, disable CLI cache with -no-cache.

Release: Created standalone repo latebit-io/obsidian-demarkus, pushed source + built assets, created GitHub release 0.1.0. Installable via BRAT.

Build system: Standardized on npm (removed bun.lock), pinned obsidian dependency to ^1.12.0.