Add davemhammer/obsidian

[davemhammer]

Plugin

• Id: davemhammer/obsidian
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Daily note capture and git status/commit/pull/push for a local Obsidian vault; open notes via obsidian:// URIs.

Surfaces: widget status, panel manager, service service, launcher /ob (entry id ob).
Panel IPC: noctalia msg panel-toggle davemhammer/obsidian:manager

Version: 1.0.3 · plugin_api: 10 · license: MIT · author: davemhammer

External dependencies

• obsidian, git, xdg-open, find, sort, head (all declared in plugin.toml)

Trust / side effects

Filesystem: reads/writes markdown only under the configured vault (daily/note paths reject .. and absolute paths); scans recent *.md mtimes (skips .obsidian, .git, .claudian). Capture/open-daily refuse non-vault paths.
Processes: find/sort/head (recent notes); git status|add|commit|pull|push (pull uses --no-rebase --autostash); abort in-progress rebase/merge when requested; xdg-open for Obsidian URIs.
Network: only whatever git remote does on pull/push — no Obsidian Sync / cloud API.

Testing

Tested on Noctalia v5 / Niri with a git-backed vault: daily capture, dirty status, commit/pull/push, open daily note.

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: v5 (plugin_api 10)
• Plugin API level: 10

Screenshots / Videos

thumbnail.webp was created with the official thumbnail generator (title/tags/accent export, 960×540 WebP). Live UI screenshots can be added on request during review.

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - obsidian/service.luau:124

The daily path is built from the unvalidated daily_folder and daily_format settings, then passed to mkdirAll, readFile, and writeFile at obsidian/service.luau:463 and obsidian/service.luau:482. A value containing .. can escape the configured vault and create or modify Markdown files elsewhere.

Normalize the relative path and require the resolved daily path to remain beneath the vault root before reading, creating directories, writing, or opening it.

2. blocking - obsidian/service.luau:685

The open_daily action creates the configured directory and daily file without first checking isVault(vaultRoot()), unlike the capture path at obsidian/service.luau:476. The widget invokes this action unconditionally at obsidian/widget.luau:96, and IPC exposes it at obsidian/service.luau:768.
With the default or a stale path, a right-click or IPC call can create directories and a Markdown file outside any Obsidian vault.

Apply the same vault validation used by appendDaily before creating or opening the daily note, and return the missing-vault error when validation fails.

3. blocking - obsidian/plugin.toml:9

The manifest declares only obsidian and git, but the service directly executes xdg-open at obsidian/service.luau:221 and a find, sort, and head pipeline at obsidian/service.luau:425. The README Requirements section also does not list these as exact runtime dependencies. On systems missing them, opening notes or scanning recent notes fails despite the manifest reporting satisfied dependencies.

Declare every spawned executable required at runtime and align obsidian/README.md:13 with the manifest.

[davemhammer]

@ItsLemmy - fixes applied for blockers 1-3 as required.