obsidian-mcp-pro 2.1.0 → 4.0.0

package/README.md

@@ -18,9 +18,9 @@
 [![npm downloads](https://img.shields.io/npm/dm/obsidian-mcp-pro.svg)](https://www.npmjs.com/package/obsidian-mcp-pro)
 [![GitHub stars](https://img.shields.io/github/stars/rps321321/obsidian-mcp-pro?style=flat&logo=github)](https://github.com/rps321321/obsidian-mcp-pro)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-[![Node >= 18](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](https://nodejs.org/)
-[![Tests](https://img.shields.io/badge/tests-449_passing-brightgreen.svg)](https://github.com/rps321321/obsidian-mcp-pro)
-[![Tool Quality](https://img.shields.io/badge/Glama-23_tools_A--grade-success)](https://glama.ai/mcp/servers/rps321321/obsidian-mcp-pro)
+[![Node >= 24](https://img.shields.io/badge/node-%3E%3D24-brightgreen.svg)](https://nodejs.org/)
+[![Tests](https://img.shields.io/badge/tests-664_passing-brightgreen.svg)](https://github.com/rps321321/obsidian-mcp-pro)
+[![Tool Quality](https://img.shields.io/badge/Glama-41_tools_A--grade-success)](https://glama.ai/mcp/servers/rps321321/obsidian-mcp-pro)
 
 Give AI assistants deep, structured access to your Obsidian knowledge base. Read, write, search, tag, analyze links, traverse graphs, manipulate canvases, query Bases, edit by heading or block reference, run semantic search, and pull binary attachments. All through the [Model Context Protocol](https://modelcontextprotocol.io/).
 
@@ -50,7 +50,7 @@ Give AI assistants deep, structured access to your Obsidian knowledge base. Read
 ## Features
 
 ### Read & Search
-- Full-text search across all vault notes (cached: re-runs only re-read changed files)
+- Focus-ranked full-text search across all vault notes, with query-centered snippets (cached: re-runs only re-read changed files)
 - Read individual notes whole, or as a fragment by heading path, block id, or line range
 - List and filter notes by folder, date, or pattern
 - Search by frontmatter fields and values
@@ -86,7 +86,7 @@ Give AI assistants deep, structured access to your Obsidian knowledge base. Read
 ### Bases (Obsidian 1.10+)
 - `list_bases` enumerates `.base` files
 - `read_base` returns the parsed YAML (filters, properties, views)
-- `query_base` runs the filter DSL against the vault and returns matching notes; supports `taggedWith()`, `file.hasTag()`, `file.inFolder()`, comparison operators, and `and`/`or`/`not` combinators
+- `query_base` runs the filter DSL against the vault and returns matching notes; supports `taggedWith()`, `file.hasTag()`, `file.inFolder()`, comparison operators, and `and`/`or`/`not` combinators. Unsupported filters warn and fail closed instead of broadening results.
 
 ### Attachments
 - `list_attachments` enumerates every non-md/canvas/base file with a per-extension count summary
@@ -95,8 +95,10 @@ Give AI assistants deep, structured access to your Obsidian knowledge base. Read
 
 ### Semantic Search (optional, Ollama or OpenAI)
 - `index_vault` chunks each note (heading-aware), embeds via the configured provider, persists vectors to `<vault>/.obsidian/cache/`, and incrementally re-embeds only changed notes
+- Because indexing sends readable note chunks to the configured embedding provider, `index_vault` requires `confirm: "send-vault-text-to-embedding-provider"` on each call
 - `search_semantic` ranks notes by cosine similarity against an embedded query
-- `find_similar_notes` reuses an existing note's embeddings to surface neighbors without a live API call
+- `find_similar_notes` reuses an existing note's embeddings, with source-topic anchoring, to surface neighbors without a live API call
+- Stored snippets are returned only while the current note content hash still matches the indexed text; stale chunks are pruned on search
 
 ### MCP Resources
 - `obsidian://note/{path}` reads any note by its vault-relative path
@@ -114,9 +116,9 @@ The server exposes five starter prompts that clients (Claude Desktop, Cursor) su
 
 ### Operational features
 - **Folder-scoped permissions**: `OBSIDIAN_READ_PATHS` / `OBSIDIAN_WRITE_PATHS` allowlists gate every tool at the path-resolution choke point
-- **Persistent mtime cache** at `<vault>/.obsidian/cache/mcp-pro-index-cache.json` survives restarts; subsequent vault scans serve from cache after one stat-pass
+- **In-memory mtime cache** speeds repeated vault scans within a running process without persisting note bodies to disk
 - **Progress notifications** (`notifications/progress`) on `rename_tag`, `find_unused_attachments`, and `index_vault` when the client subscribes via `_meta.progressToken`
-- **Elicitation** prompts the user to retype the note path on `delete_note(permanent: true)` when the client supports it
+- **Hard bulk-write latches** require `confirmPath` for default `move_note` reference rewrites, `confirmTag` for non-dry-run `rename_tag`, and `confirm=true` for permanent deletion; clients with elicitation support also get typed prompts
 
 ---
 
@@ -178,22 +180,22 @@ claude mcp add obsidian-mcp-pro -- npx -y obsidian-mcp-pro
 ### HTTP Transport (Remote Clients, Cursor, ChatGPT, Web)
 
 ```bash
-npx -y obsidian-mcp-pro --transport=http --port=3333
+MCP_HTTP_TOKEN=your-secret npx -y obsidian-mcp-pro --transport=http --port=3333
 ```
 
-Endpoint: `http://127.0.0.1:3333/mcp` (Streamable HTTP). Protect with a bearer token:
+Endpoint: `http://127.0.0.1:3333/mcp` (Streamable HTTP). HTTP transport requires a bearer token:
 
 ```bash
-npx -y obsidian-mcp-pro --transport=http --token=your-secret
-# or: MCP_HTTP_TOKEN=your-secret npx -y obsidian-mcp-pro --transport=http
+MCP_HTTP_TOKEN=your-secret npx -y obsidian-mcp-pro --transport=http
 ```
 
 The HTTP server binds to `127.0.0.1` by default with DNS rebinding protection enabled.
+Startup always requires `MCP_HTTP_TOKEN`, including loopback-only local servers. The old `--token` flag was removed because command-line secrets can be exposed through OS process listings.
 
 > [!WARNING]
-> **Never bind `--host=0.0.0.0` directly to the public internet.** Doing so exposes your entire Obsidian vault to anyone who can reach the port. If you need remote access:
+> **Never bind `--host=0.0.0.0` directly to the public internet.** Doing so exposes your entire Obsidian vault to anyone who can reach the port. The server refuses HTTP startup without a bearer token, but if you need remote access:
 > - Put the server behind a reverse proxy (nginx, Caddy, Cloudflare Tunnel) that terminates TLS, **and**
-> - Require `--token=<secret>` (or `MCP_HTTP_TOKEN`), **and**
+> - Set `MCP_HTTP_TOKEN`, **and**
 > - Restrict `--allow-origin` to the specific origins you trust, **and**
 > - Set `--rate-limit` to cap request volume per IP.
 >
@@ -203,17 +205,17 @@ Additional hardening flags:
 
 | Flag | Purpose |
 |------|---------|
-| `--allow-origin=<csv>` | Restrict CORS to an allowlist (e.g. `https://claude.ai,https://chat.openai.com`). Default is `*`. |
+| `--allow-origin=<csv>` | Restrict CORS to an allowlist (e.g. `https://claude.ai,https://chat.openai.com`). Default is localhost-only; `*` requires bearer auth. |
 | `--rate-limit=<n>` | Cap requests per minute per client IP. `/health` and `/version` are exempt. Default is unlimited. |
 
 Operational endpoints (no auth required):
 
 | Endpoint | Returns |
 |----------|---------|
-| `GET /health` | `{ status: "ok", sessions: <n>, version: <string> }` — liveness + session count. |
+| `GET /health` | `{ status: "ok", version: <string> }` — liveness for monitoring. |
 | `GET /version` | `{ version: <string> }` — package version, for rollout auditing. |
 
-Structured logging is controlled by `LOG_LEVEL` (`debug`/`info`/`warn`/`error`/`silent`, default `info`) and `LOG_FORMAT` (`text`/`json`, default `text`). All logs go to stderr so the stdio transport on stdout is never polluted.
+Structured logging is controlled by `LOG_LEVEL` (`debug`/`info`/`warn`/`error`/`silent`, default `info`) and `LOG_FORMAT` (`text`/`json`, default `text`). All logs go to stderr so the stdio transport on stdout is never polluted, with absolute paths, vault-relative path fields, secret-bearing URLs, and control characters redacted before write.
 
 ---
 
@@ -303,18 +305,22 @@ Restrict the tools' read/write surface to specific folders without exposing the
 | `OBSIDIAN_READ_PATHS` | Comma- or colon-separated list of folders that read tools may access. Unset means unrestricted. Use `.` to mean the vault root. |
 | `OBSIDIAN_WRITE_PATHS` | Same shape, but for mutations (create / append / update / delete / move / surgical edits). |
 
-Read and write are independent, so an audit account can be read-only on most of the vault but write-only to a `Drafts/` folder. The startup log line and `--help` advertise the active scope. The allowlist is enforced at a single path-resolution choke point so every tool inherits it.
+Read and write are independent, so an audit account can be read-only on most of the vault but write-only to a `Drafts/` folder. Moving a note requires read access to the source and write access to the destination, because the move carries the source content into its new folder. Surgical edits (`replace_in_note`, `update_section`, `insert_at_section`, and `edit_block`) require read access to the target plus write access because they inspect existing content before writing. In-vault symlinks are checked against their real target before the allowlist decision is finalized. The startup log line and `--help` advertise the active scope. The allowlist is enforced at a single path-resolution choke point so every tool inherits it.
 
-### Persistent Caches
+### Caches
 
-Two caches live under `<vault>/.obsidian/cache/`:
+The note-content mtime cache is in-memory only. It speeds repeated vault-wide scans
+inside the running process, but it does not persist note bodies or absolute paths to
+disk. Any legacy `<vault>/.obsidian/cache/mcp-pro-index-cache.json` snapshot is
+ignored and removed on first cache use.
+
+Semantic embeddings live under `<vault>/.obsidian/cache/`:
 
 | File | Purpose |
 |------|---------|
-| `mcp-pro-index-cache.json` | mtime-keyed snapshot of recently read notes. The next process start hydrates from this and stat-passes against the live filesystem; only changed notes are re-read. |
-| `mcp-pro-embeddings.json` | Persisted embeddings for semantic search (only present once `index_vault` has run). Vault-relocation safe via an embedded `vaultRoot` check; switching providers / models invalidates entries automatically. |
+| `mcp-pro-embeddings.json` | Persisted embeddings for semantic search (only present once `index_vault` has run). Vault-relocation safe via an embedded `vaultRoot` check; switching providers/models or stale note content invalidates entries automatically. |
 
-Both are vault-local, are excluded from vault scans (`.obsidian/` is pruned), and can be deleted at any time. Persistence can be turned off entirely with `OBSIDIAN_CACHE_DISABLED=1`.
+The embedding cache is vault-local, excluded from vault scans (`.obsidian/` is pruned), and can be deleted at any time. Persistence can be turned off with `OBSIDIAN_CACHE_DISABLED=1`.
 
 ### Semantic Search Provider
 
@@ -329,9 +335,17 @@ The semantic-search tools (`index_vault`, `search_semantic`, `find_similar_notes
 
 For local Ollama: install [Ollama](https://ollama.com/), then `ollama pull nomic-embed-text`. The semantic tools register even when no provider is configured, so they're discoverable; calls return a configuration hint until set up.
 
+`index_vault` sends readable note chunks to that provider. Calls must include:
+
+```json
+{ "confirm": "send-vault-text-to-embedding-provider" }
+```
+
+This latch is per call so scripted index refreshes have to keep the privacy decision visible.
+
 ### Observability
 
-Logs stream to stderr as either plain text (default) or single-line JSON, controlled by `LOG_LEVEL` (`debug`/`info`/`warn`/`error`/`silent`) and `LOG_FORMAT` (`text`/`json`).
+Logs stream to stderr as either plain text (default) or single-line JSON, controlled by `LOG_LEVEL` (`debug`/`info`/`warn`/`error`/`silent`) and `LOG_FORMAT` (`text`/`json`). Local stderr and MCP-forwarded log payloads both redact absolute paths, vault-relative path fields, secret-bearing URLs, and control characters.
 
 The server also declares the MCP [`logging` capability](https://modelcontextprotocol.io/specification), so every log line is forwarded to the connected client as a `notifications/message` frame alongside tool responses. Clients that honor `logging/setLevel` can filter server-side logs at runtime without restarting. Claude Desktop surfaces these in its MCP DevTools pane; most other clients currently ignore them, so this is useful primarily for self-hosters and tooling authors.
 
@@ -339,12 +353,22 @@ The server also declares the MCP [`logging` capability](https://modelcontextprot
 
 ## Security
 
-- **Vault boundary** — every tool and resource routes through a single path resolver that rejects `..` traversal, null-byte injection, and symlinks pointing outside the vault (ancestor-realpath check).
+- **Vault boundary** — every tool and resource routes through a single path resolver that rejects `..` traversal, null-byte injection, and symlinks pointing outside the vault (ancestor-realpath check). On Windows it also rejects reserved device names, alternate data stream syntax, and trailing-dot/space filename aliases.
+- **Note/file boundary** — note read and edit surfaces only target `.md` files; attachments, Canvas files, and Bases stay on their dedicated tools with their own caps and parsers.
+- **Full-note cap** — full `.md` note reads and read-modify-write helpers refuse notes over 5 MiB before materializing them; `get_note` line fragments still stream from large notes for targeted inspection.
 - **Excluded directories** — `.obsidian`, `.git`, and `.trash` are pruned at traversal time and at resolution time, so nested occurrences never leak back to clients.
-- **HTTP transport** — binds to `127.0.0.1` by default with DNS rebinding protection (host-header allowlist). Optional `--token=<secret>` requires `Authorization: Bearer <secret>` on every `/mcp` request; compared in constant time.
-- **Error sanitization** — filesystem error messages are stripped of absolute host paths before being returned to MCP clients. Uncaught HTTP errors respond with a generic `Internal server error` body; full detail stays in the server log.
+- **HTTP transport** — requires a bearer token at startup and binds to `127.0.0.1` by default with DNS rebinding protection (host-header allowlist). `/mcp` requests must send `Authorization: Bearer <secret>`, compared in constant time. Malformed request URL or Host data is rejected before routing.
+- **Attachment safety** — executable extensions are blocked, SVGs are returned as `text/plain`, and active text formats such as HTML/XML/CSS are served with `text/plain` resource metadata.
+- **Canvas link safety** — Canvas link nodes added through the server accept only absolute `http://` and `https://` URLs, preventing local file and application-protocol links from being persisted by tool calls.
+- **Regex edit safety** — `replace_in_note` caps regex pattern/input size and rejects backtracking-prone repeated groups before matching.
+- **Error and log sanitization** — filesystem error messages are stripped of absolute host paths before being returned to MCP clients, local stderr and MCP-forwarded logs redact paths and secret-bearing URLs, ASCII control bytes and Unicode bidi controls are escaped in displayed values, and note-derived duplicate-alias text is not copied into graph warnings. Uncaught HTTP errors respond with a generic `Internal server error` body while server logs keep sanitized diagnostics.
+- **Untrusted vault text boundaries** — tool outputs that include note bodies, read, search result, semantic result, semantic index failure, write rewrite-warning, link-graph, attachment, Base, and Canvas path summaries, attachment extension summaries, search snippets, semantic snippets and heading paths, tag lists, tag search result paths and previews, tag rename skipped-note rows, frontmatter values, Base data, wikilink targets in link-analysis output, SVG attachment text, section headings, Canvas node identities, colors, previews, edge endpoints, and edge labels, or backlink context wrap those vault-authored portions in `[BEGIN UNTRUSTED VAULT CONTENT: ...]` / `[END UNTRUSTED VAULT CONTENT: ...]` markers before they enter an MCP client's model context. Note and daily resources use the same visible boundaries for markdown bodies and carry `_meta["obsidian-mcp-pro/contentTrust"] = "untrusted-vault-content"`.
+- **YAML parser boundaries** — Obsidian properties are parsed only from `---` YAML delimiter lines; non-YAML gray-matter language blocks stay as body text, oversized frontmatter is skipped on reads and refused for metadata updates, and note/Base YAML containing anchors or aliases is not parsed.
+- **Semantic index freshness** — `search_semantic` and `find_similar_notes` re-check current note content hashes before returning stored snippets or source-note embeddings, pruning stale cache entries instead of surfacing old note text.
+- **Semantic indexing confirmation** — `index_vault` refuses to read and embed vault notes unless the call includes `confirm: "send-vault-text-to-embedding-provider"`, making provider-bound note transfer explicit.
+- **Bulk-write confirmations** — `move_note` reference rewrites require `confirmPath` to match the destination path, and non-dry-run `rename_tag` requires `confirmTag` to match the new tag. Clients that support MCP elicitation are also asked to re-type the destination path or new tag before the rewrite runs.
 - **Atomic writes** — every note write (`create_note`, `append`, `prepend`, `update_frontmatter`, canvas mutations) stages content to a sibling temp file then renames onto the target, so a crash or kill mid-write never leaves a truncated file. Combined with per-path locks for the full read-modify-write cycle, concurrent callers can't lose each other's updates. The `install` subcommand uses the same pattern and keeps a backup of the previous config.
-- **Rate limiting + CORS allowlist** — optional `--rate-limit` caps per-IP request volume; `--allow-origin` restricts browser-facing CORS. `/health` and `/version` stay reachable under load for monitoring.
+- **Rate limiting + CORS allowlist** — optional `--rate-limit` caps per-IP request volume; `--allow-origin` restricts browser-facing CORS and refuses `*` unless bearer auth is enabled. `/health` and `/version` stay reachable under load for monitoring.
 - **Request timeout** — HTTP POST requests are capped at 2 minutes of wall-clock time. Long-lived SSE GET streams are exempt so idle clients aren't reaped.
 - **Process supervision** — `uncaughtException` exits cleanly so systemd/Docker/npx supervisors can restart; `unhandledRejection` logs but doesn't kill the process.
 
@@ -369,11 +393,11 @@ Tag extraction is similarly case-tolerant: `tags`, `Tags`, `TAGS`, `tag`, and `T
 
 | Tool | Description | Key Parameters |
 |------|-------------|----------------|
-| `search_notes` | Full-text search across all notes (cached) | `query`, `caseSensitive`, `maxResults`, `folder` |
+| `search_notes` | Focus-ranked full-text search with query-centered snippets (cached) | `query`, `caseSensitive`, `maxResults`, `folder` |
 | `get_note` | Read a note whole, or by `section` / `block` / `lines` | `path`, `section`, `block`, `lines` |
 | `list_notes` | List notes in the vault or a folder | `folder`, `limit` |
 | `get_daily_note` | Get today's (or a specific date's) daily note | `date` |
-| `search_by_frontmatter` | Find notes by frontmatter property values | `property`, `value`, `folder` |
+| `search_by_frontmatter` | Find notes by frontmatter property values with case-insensitive key/value matching | `property`, `value`, `folder` |
 | `get_recent_notes` | Notes sorted by mtime; optional ISO-or-relative `since` filter | `limit`, `since`, `folder` |
 | `get_vault_stats` | Vault counts, bytes, words, tag coverage, most-recent note | `folder` |
 | `resolve_alias` | Translate frontmatter alias (or basename) to note path | `name`, `includeBasename` |
@@ -387,7 +411,7 @@ Tag extraction is similarly case-tolerant: `tags`, `Tags`, `TAGS`, `tag`, and `T
 | `prepend_to_note` | Prepend content after frontmatter | `path`, `content` |
 | `update_frontmatter` | Update frontmatter properties on a note | `path`, `properties` |
 | `create_daily_note` | Create today's daily note from template | `date`, `content`, `templatePath` |
-| `move_note` | Move or rename a note; rewrites references across the vault | `oldPath`, `newPath`, `updateLinks` |
+| `move_note` | Move or rename a note; rewrites references across the vault | `oldPath`, `newPath`, `updateLinks`, `confirmPath` |
 | `delete_note` | Delete a note (trash by default); optional elicitation on permanent | `path`, `permanent`, `removeReferences` |
 
 ### Section-level edits
@@ -406,7 +430,7 @@ Tag extraction is similarly case-tolerant: `tags`, `Tags`, `TAGS`, `tag`, and `T
 |------|-------------|----------------|
 | `get_tags` | Get all tags and their usage counts | `sortBy` |
 | `search_by_tag` | Find all notes with a specific tag | `tag`, `includeContent` |
-| `rename_tag` | Rewrite inline + frontmatter occurrences vault-wide; hierarchical | `oldName`, `newName`, `hierarchical`, `dryRun` |
+| `rename_tag` | Rewrite inline + frontmatter occurrences vault-wide; hierarchical | `oldName`, `newName`, `hierarchical`, `dryRun`, `confirmTag` |
 
 ### Links & graph
 
@@ -423,7 +447,7 @@ Tag extraction is similarly case-tolerant: `tags`, `Tags`, `TAGS`, `tag`, and `T
 | Tool | Description | Key Parameters |
 |------|-------------|----------------|
 | `list_canvases` | List all `.canvas` files in the vault | (none) |
-| `read_canvas` | Read a `.canvas` file's nodes and edges | `path` |
+| `read_canvas` | Read a bounded `.canvas` node/edge summary | `path` |
 | `add_canvas_node` | Add a node to a canvas | `canvasPath`, `type`, `content`, `x`, `y` |
 | `add_canvas_edge` | Add an edge between two canvas nodes | `canvasPath`, `fromNode`, `toNode` |
 
@@ -433,7 +457,7 @@ Tag extraction is similarly case-tolerant: `tags`, `Tags`, `TAGS`, `tag`, and `T
 |------|-------------|----------------|
 | `list_bases` | Enumerate `.base` files in the vault | (none) |
 | `read_base` | Parse a Base file (filters, properties, views) | `path` |
-| `query_base` | Run a Base's filter DSL against the vault | `path`, `view`, `limit`, `includeFrontmatter` |
+| `query_base` | Run a Base's filter DSL against the vault; unsupported filters warn and fail closed | `path`, `view`, `limit`, `includeFrontmatter` |
 
 ### Attachments
 
@@ -447,9 +471,9 @@ Tag extraction is similarly case-tolerant: `tags`, `Tags`, `TAGS`, `tag`, and `T
 
 | Tool | Description | Key Parameters |
 |------|-------------|----------------|
-| `index_vault` | Build / refresh the embedding index (incremental, progress events) | `force`, `folder` |
+| `index_vault` | Build / refresh the embedding index (incremental, progress events) | `force`, `folder`, `confirm` |
 | `search_semantic` | Cosine search the embedding index for a natural-language query | `query`, `limit`, `folder`, `includeSnippet` |
-| `find_similar_notes` | Surface notes most similar to a source note (no live API call) | `path`, `limit` |
+| `find_similar_notes` | Surface notes most similar to a source note, anchored to its opening topic (no live API call) | `path`, `limit` |
 
 ---
 
@@ -487,7 +511,7 @@ All tool paths must be **vault-relative** (e.g. `notes/hello.md`), never absolut
 
 ### HTTP Transport Returns `401 Unauthorized`
 
-The server was started with `--token=<secret>` (or `MCP_HTTP_TOKEN` is set in the environment) but the client isn't sending a matching `Authorization: Bearer <secret>` header. Verify the token value and that the header is present — comparison is case-sensitive and constant-time.
+The server was started with `MCP_HTTP_TOKEN` but the client isn't sending a matching `Authorization: Bearer <secret>` header. Verify the token value and that the header is present — comparison is case-sensitive and constant-time.
 
 ### HTTP Transport Returns `429 Too Many Requests`
 
@@ -520,6 +544,9 @@ npm install
 # Build
 npm run build
 
+# Run the full local maintenance gate
+npm run verify
+
 # Run in development (watch mode)
 npm run dev
 
@@ -527,6 +554,10 @@ npm run dev
 OBSIDIAN_VAULT_PATH=/path/to/vault npm start
 ```
 
+For the company-grade maintenance and R&D operating plan, see [docs/DEVELOPMENT_GOAL.md](./docs/DEVELOPMENT_GOAL.md).
+
+GitHub Actions workflows are manual-only in this repository. Use `npm run verify` as the required local gate before merging or publishing.
+
 ### Project Structure
 
 ```
@@ -548,7 +579,7 @@ src/
     chunker.ts            # Heading-aware chunking for embeddings
     embedding-providers.ts# Ollama + OpenAI providers
     embedding-store.ts    # Persistent vector index, cosine search
-    index-cache.ts        # mtime-keyed content cache (in-memory + on-disk)
+    index-cache.ts        # mtime-keyed content cache (in-memory)
     progress.ts           # MCP progress-notification helper
     mime.ts               # extension -> MIME map for attachments
     dates.ts              # Moment-style date format for daily-note filenames
@@ -621,8 +652,8 @@ npm run lint:fix   # auto-fix
   block (and don't expose subsequent content to wikilink rewriting).
 - **`/health` no longer leaks the live session count when a Bearer
   token is configured.** Status + version stay public for monitoring;
-  `sessions` is dropped in authenticated deployments. Local-only
-  setups still see it.
+  `sessions` is dropped in authenticated deployments. In 4.0.0 and
+  later, HTTP always starts with bearer auth, so the field stays hidden.
 - **`constantTimeEqual` is now fully length-safe** (pads both inputs
   to a fixed width before comparing), and the regex / parser hardening
   list also closed: `resolveWikilink` proximity tie-break for
@@ -665,11 +696,11 @@ npm run lint:fix   # auto-fix
 - **Attachments.** `list_attachments`, `find_unused_attachments`, `get_attachment` (returns image / audio / blob bytes inline).
 - **Tag renames vault-wide.** `rename_tag` rewrites both inline `#tag` and frontmatter `tags:` (hierarchical mode rebases nested sub-tags).
 - **Folder-scoped permissions.** `OBSIDIAN_READ_PATHS` / `OBSIDIAN_WRITE_PATHS` allowlists.
-- **Persistent mtime cache.** Vault-wide scans (`get_tags`, `search_notes`, `search_by_tag`) hydrate from `<vault>/.obsidian/cache/mcp-pro-index-cache.json` after a restart and stat-pass against current state, only re-reading changed notes.
+- **In-memory mtime cache.** Vault-wide scans (`get_tags`, `search_notes`, `search_by_tag`) reuse unchanged note content within the running process without persisting note bodies to disk.
 - **Quick wins.** `get_recent_notes`, `get_vault_stats`, `resolve_alias`.
 - **MCP prompts.** `daily-review`, `weekly-rollup`, `find-stale-notes`, `extract-action-items`, `build-moc`.
 - **Progress notifications** on `rename_tag`, `find_unused_attachments`, `index_vault`.
-- **Elicitation** on `delete_note(permanent: true)` for clients that support it.
+- **Bulk-write confirmation latches** on `delete_note(permanent: true)`, `move_note` reference rewrites, and non-dry-run `rename_tag`, plus elicitation prompts for clients that support them.
 - **eslint** wired up with typescript-eslint flat config; `npm run lint` and `lint:fix`.
 
 **v1.7.0** — `delete_note` reference handling:

package/build/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAwK/D,wBAAgB,cAAc,IAAI,WAAW,CAsB5C;AAED,wBAAsB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwCrF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAuL/D,wBAAgB,cAAc,IAAI,WAAW,CAsB5C;AAED,wBAAsB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwDrF"}

package/build/config.js

@@ -1,8 +1,11 @@
 import * as fs from "fs";
-import * as fsp from "fs/promises";
 import * as path from "path";
 import * as os from "os";
 import { log } from "./lib/logger.js";
+import { openVaultInternalFileForRead } from "./lib/vault.js";
+const DAILY_NOTES_CONFIG_REL_PATH = ".obsidian/daily-notes.json";
+const MAX_DAILY_NOTES_CONFIG_BYTES = 64 * 1024;
+const MAX_DAILY_NOTES_CONFIG_FIELD_CHARS = 500;
 function getObsidianConfigPath() {
     const platform = os.platform();
     if (platform === "win32") {
@@ -35,6 +38,18 @@ function isObsidianConfig(value) {
     }
     return true;
 }
+function isPlainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function boundedDailyConfigString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    if (value.length > MAX_DAILY_NOTES_CONFIG_FIELD_CHARS)
+        return undefined;
+    if (value.includes("\0"))
+        return undefined;
+    return value;
+}
 function isValidVaultPath(vaultPath) {
     try {
         const obsidianDir = path.join(vaultPath, ".obsidian");
@@ -54,9 +69,8 @@ function resolveVaultFromEnv() {
     }
     const resolved = path.resolve(envPath);
     if (!isValidVaultPath(resolved)) {
-        // Log the configured path (not sanitized) because this is an operator-
-        // facing diagnostic — they already know the path, and hiding it would
-        // make the error useless. This never goes into a tool response.
+        // The logger redacts the path before writing to stderr or forwarding to
+        // MCP clients, so this stays useful without leaking host layout.
         log.warn("OBSIDIAN_VAULT_PATH is not a valid vault (missing .obsidian dir)", {
             vaultPath: resolved,
         });
@@ -160,10 +174,26 @@ export async function getDailyNoteConfig(vaultPath) {
         format: "YYYY-MM-DD",
     };
     const resolvedVaultPath = vaultPath ?? getVaultConfig().vaultPath;
-    const dailyNotesConfigPath = path.join(resolvedVaultPath, ".obsidian", "daily-notes.json");
+    let dailyNotesConfigPath = "";
     let raw;
     try {
-        raw = await fsp.readFile(dailyNotesConfigPath, "utf-8");
+        const opened = await openVaultInternalFileForRead(resolvedVaultPath, DAILY_NOTES_CONFIG_REL_PATH);
+        dailyNotesConfigPath = opened.fullPath;
+        const stats = opened.stats;
+        if (stats.size > MAX_DAILY_NOTES_CONFIG_BYTES) {
+            await opened.handle.close();
+            log.warn("Daily notes config exceeds size cap; using defaults", {
+                bytes: stats.size,
+                max: MAX_DAILY_NOTES_CONFIG_BYTES,
+            });
+            return defaults;
+        }
+        try {
+            raw = await opened.handle.readFile("utf-8");
+        }
+        finally {
+            await opened.handle.close();
+        }
     }
     catch (err) {
         if (err.code === "ENOENT")
@@ -176,10 +206,15 @@ export async function getDailyNoteConfig(vaultPath) {
     }
     try {
         const parsed = JSON.parse(raw);
+        if (!isPlainObject(parsed))
+            return defaults;
+        const folder = boundedDailyConfigString(parsed.folder);
+        const format = boundedDailyConfigString(parsed.format);
+        const template = boundedDailyConfigString(parsed.template);
         return {
-            folder: typeof parsed.folder === "string" ? parsed.folder : defaults.folder,
-            format: typeof parsed.format === "string" ? parsed.format : defaults.format,
-            template: typeof parsed.template === "string" ? parsed.template : undefined,
+            folder: folder ?? defaults.folder,
+            format: format ?? defaults.format,
+            template,
         };
     }
     catch (err) {

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAYtC,SAAS,qBAAqB;IAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAE/B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,OAAO,EAAE,EACZ,SAAS,EACT,qBAAqB,EACrB,UAAU,EACV,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;IACrD,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,OAAO,CACL,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YACxB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YACpC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YAC1B,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,uEAAuE;QACvE,sEAAsE;QACtE,gEAAgE;QAChE,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE;YAC3E,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,8BAA8B;IACrC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,qBAAqB,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,GAAG,EAAE,GAAY,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAClF,UAAU;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,GAAY,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAElD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAEpD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,SAAS,KAAK,WAAW,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBACxE,SAAS,EAAE,WAAW;gBACtB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE;YACvE,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,2GAA2G,EAAE;oBACpH,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,mCAAmC;IACnC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,MAAM,aAAa,GAAG,8BAA8B,EAAE,CAAC;IACvD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oJAAoJ,CACrJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAkB;IACzD,MAAM,QAAQ,GAAoB;QAChC,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,YAAY;KACrB,CAAC;IAEF,MAAM,iBAAiB,GAAG,SAAS,IAAI,cAAc,EAAE,CAAC,SAAS,CAAC;IAClE,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CACpC,iBAAiB,EACjB,WAAW,EACX,kBAAkB,CACnB,CAAC;IAEF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC5C,UAAU,EAAE,oBAAoB;YAChC,GAAG,EAAE,GAAY;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC3E,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC3E,QAAQ,EACN,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACpE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAC7C,UAAU,EAAE,oBAAoB;YAChC,GAAG,EAAE,GAAY;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAE9D,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACjE,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAY/C,SAAS,qBAAqB;IAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAE/B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,OAAO,EAAE,EACZ,SAAS,EACT,qBAAqB,EACrB,UAAU,EACV,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;IACrD,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,GAAG,kCAAkC;QAAE,OAAO,SAAS,CAAC;IACxE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,OAAO,CACL,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YACxB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YACpC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YAC1B,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,iEAAiE;QACjE,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE;YAC3E,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,8BAA8B;IACrC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,qBAAqB,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,GAAG,EAAE,GAAY,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAClF,UAAU;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,GAAY,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAElD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAEpD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,SAAS,KAAK,WAAW,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBACxE,SAAS,EAAE,WAAW;gBACtB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE;YACvE,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,2GAA2G,EAAE;oBACpH,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,mCAAmC;IACnC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,MAAM,aAAa,GAAG,8BAA8B,EAAE,CAAC;IACvD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oJAAoJ,CACrJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAkB;IACzD,MAAM,QAAQ,GAAoB;QAChC,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,YAAY;KACrB,CAAC;IAEF,MAAM,iBAAiB,GAAG,SAAS,IAAI,cAAc,EAAE,CAAC,SAAS,CAAC;IAClE,IAAI,oBAAoB,GAAG,EAAE,CAAC;IAC9B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,iBAAiB,EACjB,2BAA2B,CAC5B,CAAC;QACF,oBAAoB,GAAG,MAAM,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,GAAG,4BAA4B,EAAE,CAAC;YAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBAC9D,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,GAAG,EAAE,4BAA4B;aAClC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC5C,UAAU,EAAE,oBAAoB;YAChC,GAAG,EAAE,GAAY;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM;YACjC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM;YACjC,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAC7C,UAAU,EAAE,oBAAoB;YAChC,GAAG,EAAE,GAAY;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/build/http-server.d.ts

@@ -2,7 +2,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 export interface HttpServerOptions {
     host: string;
     port: number;
-    bearerToken?: string;
+    /** Required for HTTP transport. Use MCP_HTTP_TOKEN in the CLI path. */
+    bearerToken: string;
     buildMcpServer: () => McpServer;
     /** Install SIGINT/SIGTERM handlers + exit the process on shutdown. Default
      *  `true` for CLI use. Set `false` when embedding (e.g. inside an Obsidian
@@ -13,7 +14,8 @@ export interface HttpServerOptions {
     /** Allowed CORS origins. Defaults to localhost-only patterns
      *  (`["http://localhost:*", "http://127.0.0.1:*", "http://[::1]:*"]`).
      *  Use an explicit list (e.g. `["https://claude.ai"]`) for browser-facing
-     *  deployments. Pass `["*"]` to allow all origins (a warning is logged).
+     *  deployments. Pass `["*"]` to allow all origins only when Bearer auth is
+     *  configured.
      *  Requests from other origins still succeed (CORS is a browser-only
      *  restriction) but the browser will reject the response. */
     allowedOrigins?: string[];

package/build/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,SAAS,CAAC;IAChC;;wEAEoE;IACpE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;iEAK6D;IAC7D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AA4LD,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8UxF"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,SAAS,CAAC;IAChC;;wEAEoE;IACpE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;iEAM6D;IAC7D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAkND,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyVxF"}

package/build/http-server.js

@@ -21,29 +21,42 @@ class BodyTooLargeError extends Error {
         this.name = "BodyTooLargeError";
     }
 }
+function declaredBodyTooLarge(req) {
+    const contentLength = req.headers["content-length"];
+    if (typeof contentLength !== "string" || !/^\d+$/.test(contentLength))
+        return false;
+    return BigInt(contentLength) > BigInt(MAX_BODY_BYTES);
+}
 function readBody(req) {
     return new Promise((resolve, reject) => {
         let size = 0;
-        let exceeded = false;
+        let settled = false;
         const chunks = [];
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            chunks.length = 0;
+            reject(err);
+        };
         req.on("data", (chunk) => {
-            if (exceeded)
+            if (settled)
                 return;
             size += chunk.length;
             if (size > MAX_BODY_BYTES) {
-                // Stop buffering but keep reading + discarding so the request stream
-                // drains cleanly. Destroying the socket here races with the 413
-                // response write and produces noisy `write after end` errors.
-                exceeded = true;
-                chunks.length = 0;
+                // Stop buffering and let the caller return 413 immediately; keep the
+                // request stream flowing so the socket can drain without a hard reset.
+                fail(new BodyTooLargeError());
+                req.resume();
             }
             else {
                 chunks.push(chunk);
             }
         });
         req.on("end", () => {
-            if (exceeded)
-                return reject(new BodyTooLargeError());
+            if (settled)
+                return;
+            settled = true;
             const raw = Buffer.concat(chunks).toString("utf-8");
             if (!raw)
                 return resolve(undefined);
@@ -54,7 +67,7 @@ function readBody(req) {
                 reject(err instanceof Error ? err : new Error("Invalid JSON body"));
             }
         });
-        req.on("error", reject);
+        req.on("error", (err) => fail(err));
     });
 }
 function setSecurityHeaders(req, res) {
@@ -73,6 +86,14 @@ function sendJson(res, status, body) {
     res.writeHead(status, { "Content-Type": "application/json" });
     res.end(JSON.stringify(body));
 }
+function parseRequestUrl(req) {
+    try {
+        return new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    }
+    catch {
+        return null;
+    }
+}
 // Constant-time string compare that does not leak the expected token's
 // length. Both inputs are padded to a fixed comparison width (the longer
 // of the two) before `timingSafeEqual`, so the compare time is the same
@@ -189,6 +210,12 @@ export async function startHttpServer(opts) {
     if (opts.bearerToken !== undefined && !bearerToken) {
         throw new Error("HTTP bearer token cannot be empty");
     }
+    if (!bearerToken) {
+        throw new Error("HTTP bearer token is required. Set MCP_HTTP_TOKEN in the CLI or pass bearerToken when embedding.");
+    }
+    const allowedOrigins = opts.allowedOrigins && opts.allowedOrigins.length > 0
+        ? opts.allowedOrigins
+        : ["http://localhost:*", "http://127.0.0.1:*", "http://[::1]:*"];
     const transports = new Map();
     const lastActivity = new Map();
     const touch = (sid) => { lastActivity.set(sid, Date.now()); };
@@ -198,9 +225,6 @@ export async function startHttpServer(opts) {
     // `initialize` builds a fresh server below; GC reclaims it once the
     // transport closes (Protocol._onclose clears the transport reference).
     // See https://github.com/rps321321/obsidian-mcp-pro/issues/8.
-    const allowedOrigins = opts.allowedOrigins && opts.allowedOrigins.length > 0
-        ? opts.allowedOrigins
-        : ["http://localhost:*", "http://127.0.0.1:*", "http://[::1]:*"];
     if (allowedOrigins.includes("*")) {
         log.warn("CORS configured with wildcard origin '*'. Consider restricting to specific origins for production deployments.");
     }
@@ -254,6 +278,16 @@ export async function startHttpServer(opts) {
         }
         setCors(req, res, allowedOrigins);
         setSecurityHeaders(req, res);
+        const url = parseRequestUrl(req);
+        if (!url) {
+            log.warn("Rejected malformed HTTP request URL", {
+                method: req.method,
+                path: req.url ?? "",
+                ip: clientIp(req),
+            });
+            sendJson(res, 400, { error: "Malformed request URL" });
+            return;
+        }
         const requestOrigin = req.headers.origin;
         if (typeof requestOrigin === "string" && !originAllowed(requestOrigin, allowedOrigins)) {
             log.warn("Rejected request from disallowed Origin", {
@@ -275,7 +309,6 @@ export async function startHttpServer(opts) {
         // need to stay reachable for monitoring even under load.
         if (rateLimiter) {
             const ip = clientIp(req);
-            const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
             const exempt = url.pathname === "/health" || url.pathname === "/version";
             if (!exempt && !rateLimiter.check(ip)) {
                 res.setHeader("Retry-After", "60");
@@ -283,7 +316,6 @@ export async function startHttpServer(opts) {
                 return;
             }
         }
-        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
         if (url.pathname !== "/mcp") {
             if (url.pathname === "/health") {
                 // When a Bearer token is configured (production deployments),
@@ -294,8 +326,6 @@ export async function startHttpServer(opts) {
                     status: "ok",
                     version: opts.version ?? "",
                 };
-                if (!bearerToken)
-                    body.sessions = transports.size;
                 sendJson(res, 200, body);
                 return;
             }
@@ -352,6 +382,11 @@ export async function startHttpServer(opts) {
                     sendJson(res, 415, { error: "Unsupported Media Type: expected application/json" });
                     return;
                 }
+                if (declaredBodyTooLarge(req)) {
+                    req.resume();
+                    sendJson(res, 413, { error: "Request body too large" });
+                    return;
+                }
                 let body;
                 try {
                     body = await readBody(req);
@@ -450,9 +485,6 @@ export async function startHttpServer(opts) {
         allowedOrigins: allowedOrigins.join(","),
         rateLimitPerMinute: opts.rateLimitPerMinute ?? 0,
     });
-    if (!bearerToken) {
-        log.warn("WARNING: HTTP server starting without authentication. Set MCP_HTTP_TOKEN to enable bearer token auth.");
-    }
     const installSignals = opts.installSignalHandlers ?? true;
     const onSignal = () => {
         void stop().finally(() => {