# Journal — 2026-03-11

## 2026-03-11 — Obsidian Plugin Hardening & Release

Big session: addressed 30+ Copilot code review comments on the Obsidian plugin, then published v0.1.0.

**Security fixes:** Token via env var instead of CLI args, YAML injection prevention with JSON.stringify, path traversal protection in urlToFileName, version parsing validation with Number.isFinite.

**Quality fixes:** Preserve user frontmatter (tags, aliases) on fetch and publish via buildMergedFrontmatter, handle arrays/objects in YAML serialization, quote YAML-unsafe keys, strip double-frontmatter from fetched docs, multi-line stderr parsing for CLI warnings, concurrent folder creation race handling, shallow copy DEFAULT_SETTINGS, remove stale bun.lock, update tsconfig lib to ES2018, extract writeFetchedDocument helper to deduplicate code, disable CLI cache with -no-cache.

**Release:** Created standalone repo `latebit-io/obsidian-demarkus`, pushed source + built assets, created GitHub release 0.1.0. Installable via BRAT.

**Build system:** Standardized on npm (removed bun.lock), pinned obsidian dependency to ^1.12.0.

## Related documents

- Obsidian plugin plan: the plugin hardened and released here