obsidian-mcp-server 3.5.0 → 3.5.2

package/AGENTS.md

@@ -1,11 +1,11 @@
 # Agent Protocol
 
 **Server:** obsidian-mcp-server
-**Version:** 3.5.0
-**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.12.3`
+**Version:** 3.5.2
+**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.12.8`
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0
-**Zod:** ^4.4.3
+**Zod:** ^4.5.4
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
 
@@ -189,7 +189,7 @@ The framework also provides `ctx.state`. It isn't used by this server — Obsidi
 
 Handlers throw — the framework catches, classifies, and formats.
 
-**Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive a typed `ctx.fail(reason, …)` keyed by the declared reason union. TypeScript catches `ctx.fail('typo')` at compile time, `data.reason` is auto-populated for observability, and the linter enforces conformance against the handler body. The `recovery` field is required descriptive metadata (≥ 5 words, lint-validated) — it's the single source of truth for the recovery hint that flows to the wire. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (the framework mirrors `data.recovery.hint` into `content[]` text). Override with explicit `{ recovery: { hint: '...' } }` when runtime context matters. Baseline codes (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) bubble freely and don't need declaring.
+**Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive a typed `ctx.fail(reason, …)` keyed by the declared reason union. TypeScript catches `ctx.fail('typo')` at compile time, `data.reason` is auto-populated for observability, and the linter enforces conformance against the handler body. The `recovery` field is required descriptive metadata (≥ 5 words, lint-validated) — it's the single source of truth for the recovery hint that flows to the wire. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (the framework mirrors `data.recovery.hint` into `content[]` text). Override with explicit `{ recovery: { hint: '...' } }` when runtime context matters. Baseline codes (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`, `RequestCancelled`) bubble freely and don't need declaring.
 
 ```ts
 errors: [
@@ -299,8 +299,9 @@ Available skills:
 | `tool-defs-analysis` | Read-only audit of MCP definition language across the surface — voice, leaks, defaults, recovery hints, output descriptions |
 | `code-simplifier` | Post-session cleanup against `git diff` — modernize syntax, consolidate duplication, align with the codebase |
 | `polish-docs-meta` | Finalize docs, README, metadata, and agent protocol for shipping |
-| `git-wrapup` | Land working-tree changes as a versioned commit + annotated tag — version bump, changelog, verify, tag. Local only. |
-| `release-and-publish` | Ship a release end-to-end across npm, MCP Registry, GitHub Releases (`.mcpb`), and GHCR |
+| `git-wrapup` | Land working-tree changes as a commit stack — version bump, changelog, verify, commit by concern, release commit on top. No tag, no push to main; opens the release PR when the project declares release PR mode |
+| `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixup commits autosquashed into the stack, PR body kept in sync. Release PR mode only |
+| `release-and-publish` | Fast-forward merge (release PR mode) + tag + push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
 | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
 | `orchestrations` | Chain task skills into a gated multi-phase pipeline — build-out, QA-fix, update-ship — when you can spawn sub-agents |
 | `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
@@ -380,7 +381,7 @@ security: false                            # optional — true ONLY for a source
 
 `agent-notes` is an optional free-form field for maintenance agents processing the release downstream. Content here won't appear in the rendered CHANGELOG — it's consumed by agents running the `maintenance` skill. Use it for adoption instructions that don't fit the human-facing sections: new files to create, fields to populate, one-time migration steps. Omit entirely when there's nothing to say.
 
-**Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Include only sections with entries — don't ship empty headers.
+**Section order:** the Keep a Changelog sequence — Added, Changed, Deprecated, Removed, Fixed, Security — then `Dependencies` last. Include only sections with entries — don't ship empty headers.
 
 **Tag annotations** render as GitHub Release bodies via `--notes-from-tag`. They must be structured markdown — never a flat comma-separated string. Subject omits the version number (GitHub prepends it). See `changelog/template.md` for the full format reference.
 

package/CLAUDE.md

@@ -1,11 +1,11 @@
 # Agent Protocol
 
 **Server:** obsidian-mcp-server
-**Version:** 3.5.0
-**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.12.3`
+**Version:** 3.5.2
+**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.12.8`
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0
-**Zod:** ^4.4.3
+**Zod:** ^4.5.4
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
 
@@ -189,7 +189,7 @@ The framework also provides `ctx.state`. It isn't used by this server — Obsidi
 
 Handlers throw — the framework catches, classifies, and formats.
 
-**Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive a typed `ctx.fail(reason, …)` keyed by the declared reason union. TypeScript catches `ctx.fail('typo')` at compile time, `data.reason` is auto-populated for observability, and the linter enforces conformance against the handler body. The `recovery` field is required descriptive metadata (≥ 5 words, lint-validated) — it's the single source of truth for the recovery hint that flows to the wire. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (the framework mirrors `data.recovery.hint` into `content[]` text). Override with explicit `{ recovery: { hint: '...' } }` when runtime context matters. Baseline codes (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) bubble freely and don't need declaring.
+**Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive a typed `ctx.fail(reason, …)` keyed by the declared reason union. TypeScript catches `ctx.fail('typo')` at compile time, `data.reason` is auto-populated for observability, and the linter enforces conformance against the handler body. The `recovery` field is required descriptive metadata (≥ 5 words, lint-validated) — it's the single source of truth for the recovery hint that flows to the wire. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (the framework mirrors `data.recovery.hint` into `content[]` text). Override with explicit `{ recovery: { hint: '...' } }` when runtime context matters. Baseline codes (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`, `RequestCancelled`) bubble freely and don't need declaring.
 
 ```ts
 errors: [
@@ -299,8 +299,9 @@ Available skills:
 | `tool-defs-analysis` | Read-only audit of MCP definition language across the surface — voice, leaks, defaults, recovery hints, output descriptions |
 | `code-simplifier` | Post-session cleanup against `git diff` — modernize syntax, consolidate duplication, align with the codebase |
 | `polish-docs-meta` | Finalize docs, README, metadata, and agent protocol for shipping |
-| `git-wrapup` | Land working-tree changes as a versioned commit + annotated tag — version bump, changelog, verify, tag. Local only. |
-| `release-and-publish` | Ship a release end-to-end across npm, MCP Registry, GitHub Releases (`.mcpb`), and GHCR |
+| `git-wrapup` | Land working-tree changes as a commit stack — version bump, changelog, verify, commit by concern, release commit on top. No tag, no push to main; opens the release PR when the project declares release PR mode |
+| `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixup commits autosquashed into the stack, PR body kept in sync. Release PR mode only |
+| `release-and-publish` | Fast-forward merge (release PR mode) + tag + push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
 | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
 | `orchestrations` | Chain task skills into a gated multi-phase pipeline — build-out, QA-fix, update-ship — when you can spawn sub-agents |
 | `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
@@ -380,7 +381,7 @@ security: false                            # optional — true ONLY for a source
 
 `agent-notes` is an optional free-form field for maintenance agents processing the release downstream. Content here won't appear in the rendered CHANGELOG — it's consumed by agents running the `maintenance` skill. Use it for adoption instructions that don't fit the human-facing sections: new files to create, fields to populate, one-time migration steps. Omit entirely when there's nothing to say.
 
-**Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Include only sections with entries — don't ship empty headers.
+**Section order:** the Keep a Changelog sequence — Added, Changed, Deprecated, Removed, Fixed, Security — then `Dependencies` last. Include only sections with entries — don't ship empty headers.
 
 **Tag annotations** render as GitHub Release bodies via `--notes-from-tag`. They must be structured markdown — never a flat comma-separated string. Subject omits the version number (GitHub prepends it). See `changelog/template.md` for the full format reference.
 

package/Dockerfile

@@ -110,7 +110,9 @@ ENV MCP_HTTP_PORT=${PORT:-3010}
 # bind exposes the upstream OBSIDIAN_API_KEY to any caller that can reach the port.
 ENV MCP_HTTP_HOST="0.0.0.0"
 ENV MCP_TRANSPORT_TYPE="http"
-ENV MCP_SESSION_MODE="stateless"
+# Stateful because obsidian_delete_note confirms via ctx.requestInput; the
+# elicitation round backing that gate is disabled in stateless mode.
+ENV MCP_SESSION_MODE="stateful"
 ENV MCP_LOG_LEVEL="info"
 ENV LOGS_DIR="/var/log/obsidian-mcp-server"
 ENV MCP_FORCE_CONSOLE_LOGGING="true"

package/README.md

@@ -7,7 +7,7 @@
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-3.5.0-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/obsidian-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.0.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/obsidian-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/obsidian-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0-blueviolet.svg?style=flat-square)](https://bun.sh/)
+[![Version](https://img.shields.io/badge/Version-3.5.2-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/obsidian-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.0.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/obsidian-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/obsidian-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0-blueviolet.svg?style=flat-square)](https://bun.sh/)
 
 </div>
 
@@ -49,7 +49,7 @@ Read a note in one of four projections, addressed by vault path, the active file
 - `format: "content"` — raw markdown body
 - `format: "full"` — content, frontmatter, tags, and file metadata; pass `includeLinks: true` to also parse outgoing wiki and markdown link references from the body (vault-internal only — external URLs are filtered)
 - `format: "document-map"` — catalog of headings, block references, and frontmatter fields
-- `format: "section"` — single heading/block/frontmatter section value (requires `section`); heading sections include the full subtree under that heading
+- `format: "section"` — single heading/block/frontmatter section value (requires `section`); heading sections include the full subtree under that heading. The response echoes the locator the read resolved to in `sectionTarget` as a full `Parent::Child` path, and when a bare leaf name matches several headings it lists every colliding path in `candidates` — the read still returns the first match
 
 Pair the document-map projection with `obsidian_patch_note` to discover edit targets before patching.
 
@@ -136,7 +136,9 @@ Add, remove, or list tags on a note. Operates on one of two representations, def
 - `location: 'inline'` — only inline `#tag` syntax in the body; `add` appends `#tag` at end-of-file
 - `location: 'both'` — opt-in reconciliation across both representations
 
-`add` ensures the tag is present in the requested location(s); `remove` strips it; `list` ignores the input `tags` array. Inline `#tag` occurrences inside fenced code blocks are intentionally left alone.
+`add` ensures the tag is present in the requested location(s); `remove` strips it; `list` ignores the input `tags` array.
+
+Inline `#tag` detection skips code spans (fenced and inline), link spans (`[[...]]`, `[text](...)`, `[text][ref]`) — so a heading anchor, block anchor, or wikilink alias is never read as a tag or rewritten by a removal — and a hash escaped as `\#`. A `#` inside an HTML comment or a math span is still counted. `list` and `remove` run the same detection, so what `list` reports is what `remove` can reach.
 
 Inline mode reads and writes the note body only — a `#` inside a YAML scalar is frontmatter, so it is neither listed as an inline tag nor rewritten by a removal. Removing an inline tag takes exactly one adjacent horizontal space with it — the one before the tag, or the one after when no space precedes it; every other byte survives, including nested list indentation, four-space indented code blocks, trailing two-space hard line breaks, and table cell padding.
 
@@ -210,7 +212,7 @@ Obsidian-specific:
 
 - Wraps the [Obsidian Local REST API](https://github.com/coddingtonbear/obsidian-local-rest-api) plugin — typed client, deterministic error mapping
 - Section-aware editing across headings, block references, and frontmatter fields via `PATCH`-with-target operations
-- Tag reconciliation across both representations: frontmatter `tags:` array and inline `#tag` syntax (skipping fenced code blocks)
+- Tag reconciliation across both representations: frontmatter `tags:` array and inline `#tag` syntax (skipping code spans, link spans, and hashes escaped as `\#`)
 - Search across up to three modes: text, JSONLogic, and (when the plugin is reachable) BM25-ranked Omnisearch — cursor-paginated per the MCP 2025-11-25 spec, with per-file match clipping in text mode
 - Required human-in-the-loop confirmation for destructive deletes — a multi-round-trip `input_required` round served on both protocol revisions, with no unconfirmed path through the tool
 - Folder-scoped read/write permissions via `OBSIDIAN_READ_PATHS` / `OBSIDIAN_WRITE_PATHS` and a global `OBSIDIAN_READ_ONLY` kill switch — denies are typed `path_forbidden` with the active scope echoed back in the error data
@@ -268,7 +270,7 @@ MCP_TRANSPORT_TYPE=http OBSIDIAN_API_KEY=... bun run start:http
 
 - [Bun v1.3.0](https://bun.sh/) or higher (or Node.js v24+).
 - The [Obsidian Local REST API](https://github.com/coddingtonbear/obsidian-local-rest-api) plugin, **v4.0.0 through v5.x**, installed and enabled in your vault. Generate an API key in **Settings → Community Plugins → Local REST API** and copy it into `OBSIDIAN_API_KEY`. Plugin v6.0 removes the markdown-patch 1.x wire format this server pins for section-targeted writes and the document map.
-- Periodic-note targets (`target: { "type": "periodic" }`) additionally need plugin **v5.0.1 or earlier** — v5.0.2 removed the built-in `/periodic/` routes. Every other target type is unaffected.
+- Periodic-note targets (`target: { "type": "periodic" }`) work across that whole range: natively on plugin **v5.0.1 and earlier**, and on **v5.0.2 and later** — which moved the `/periodic/` routes out of the plugin — once the companion [periodic-notes API extension](https://github.com/coddingtonbear/obsidian-local-rest-api-periodic-notes) is installed. Without that extension on v5.0.2+, periodic targets fail with a `periodic_unsupported` error naming it; `obsidian://status` lists the registered extensions if you want to check first. Every other target type is unaffected.
 - An MCP client that can answer an input request (elicitation). `obsidian_delete_note` always asks for confirmation before deleting, so a client without that support can read and write notes but cannot delete one.
 - This server defaults to `http://127.0.0.1:27123` for simplicity. Enable **"Non-encrypted (HTTP) Server"** in the plugin settings to use it. To use the always-on HTTPS port instead, set `OBSIDIAN_BASE_URL=https://127.0.0.1:27124`; the plugin's self-signed cert is handled by `OBSIDIAN_VERIFY_SSL=false` (the default).
 
@@ -316,6 +318,7 @@ MCP_TRANSPORT_TYPE=http OBSIDIAN_API_KEY=... bun run start:http
 | `MCP_HTTP_HOST` | Host for the HTTP server. | `127.0.0.1` |
 | `MCP_HTTP_PORT` | Port for the HTTP server. | `3010` |
 | `MCP_HTTP_ENDPOINT_PATH` | Endpoint path for the JSON-RPC handler. | `/mcp` |
+| `MCP_SESSION_MODE` | Session handling for the HTTP transport: `stateless`, `stateful`, or `auto`. Pinned to `stateful` — `obsidian_delete_note` confirms via an elicitation round, which `stateless` disables. | `stateful` |
 | `MCP_PUBLIC_URL` | Public origin override for TLS-terminating reverse-proxy deployments (landing page, Server Card, RFC 9728 metadata). | unset |
 | `MCP_AUTH_MODE` | Auth mode: `none`, `jwt`, or `oauth`. | `none` |
 | `MCP_AUTH_SECRET_KEY` | **Required when `MCP_AUTH_MODE=jwt`.** ≥32-char shared secret used to verify incoming JWTs. | — |

package/changelog/3.5.x/3.5.1.md

@@ -0,0 +1,27 @@
+---
+summary: "Upstream 500/501 now classify as ServiceUnavailable instead of InternalError, so a 500 on a retry-safe call is retried automatically; MCP_SESSION_MODE is pinned to stateful so obsidian_delete_note's confirmation round-trip actually works under Docker."
+breaking: true
+security: false
+---
+
+# 3.5.1 — 2026-09-04
+
+## Changed
+
+- **Upstream HTTP 500 and 501 now classify as `ServiceUnavailable` instead of `InternalError`** — `ObsidianService#throwForStatus`'s default branch adopts `mcp-ts-core`'s widened `httpStatusToErrorCode` mapping (502/503/other 5xx unchanged, 504 stays `Timeout`). `ServiceUnavailable` is in `withRetry`'s transient set, so a 500 on a retry-safe call (e.g. `obsidian_get_note`) is now retried automatically instead of failing on the first attempt. 501 keeps the shared `ServiceUnavailable` code but the service attaches `data.retryable: false` by hand, since a method the plugin declares unimplemented can't change on retry.
+- Framework-managed files under `skills/` resynced from the `mcp-ts-core` package — `api-errors` documents the same 5xx reclassification; `release-and-publish`, `maintenance`, `setup`, `add-tool`, and `api-config` pick up unrelated upstream fixes.
+
+## Fixed
+
+- **`MCP_SESSION_MODE` is pinned to `stateful`** across `.env.example`, the `Dockerfile`, and the README env table ([#120](https://github.com/cyanheads/obsidian-mcp-server/issues/120)) — the Docker image shipped `stateless` while `.env.example` documented the schema's `auto` default (which itself resolves to `stateful`), so the two surfaces disagreed. `obsidian_delete_note` gates on a `ctx.requestInput` confirmation round that a 2025-era HTTP client can't complete under `stateless` (no live session to carry the `elicitation/create` call), so the Docker default silently made the delete tool unusable for that client generation. All three surfaces now agree on `stateful`.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.12.3 → ^0.12.5
+- `js-yaml` ^5.3.0 → ^5.4.1
+- `undici` ^8.10.0 → ^8.10.1
+- `zod` ^4.4.3 → ^4.5.4
+- `@biomejs/biome` ^2.5.9 → ^2.5.11 (dev)
+- `@types/node` ^26.2.0 → ^26.4.0 (dev)
+- `ignore` ^7.0.6 → ^7.0.8 (dev)
+- `tsc-alias` ^1.9.2 → ^1.9.3 (dev)

package/changelog/3.5.x/3.5.2.md

@@ -0,0 +1,27 @@
+---
+summary: "Frontmatter boundary, inline tag detection, and section reads now share one consistent boundary and resolution logic; list_notes reports directory_missing/path_is_file instead of a generic note_missing; periodic-note targets get a periodic_unsupported error naming the missing plugin extension instead of a bare 404."
+breaking: false
+security: false
+---
+
+# 3.5.2 — 2026-09-09
+
+## Changed
+
+- **`obsidian_get_note` section reads echo the resolved heading path** — a bare leaf target reports back the full `Parent::Child` path it matched in `sectionTarget`, and every colliding heading in `candidates` when more than one shares that leaf; the read still returns the first match ([#107](https://github.com/cyanheads/obsidian-mcp-server/issues/107)).
+- **`obsidian_manage_tags` inline `#tag` detection skips link spans and escaped hashes** — `[[wikilink#Heading]]`, `[text](url#frag)`, and `[text][ref]` are no longer read or rewritten as tags, and a `\#` is recognized as an escaped literal hash; `list` and `remove` share the same detection so they agree on what a tag is ([#119](https://github.com/cyanheads/obsidian-mcp-server/issues/119)).
+- **`obsidian_list_notes` reports `directory_missing` and `path_is_file` in place of `note_missing`** — a folder that doesn't exist or holds no files gets `directory_missing`; a `path` that names a file gets `path_is_file` ([#105](https://github.com/cyanheads/obsidian-mcp-server/issues/105)).
+
+## Fixed
+
+- **The frontmatter fence regex now agrees with `splice()` on an empty properties block** — `section-extractor`'s line-scan boundary previously used a different rule than `frontmatter-ops`'s splice, so a note with an empty `---\n---` block or a fence carrying trailing whitespace could hide body content from section reads; both now resolve the boundary through the same `splice()` call ([#118](https://github.com/cyanheads/obsidian-mcp-server/issues/118)).
+- **Periodic-note targets get a typed `periodic_unsupported` error on Local REST API v5.0.2+ without the companion extension** — that plugin version removed the built-in `/periodic/` routes, and every periodic-target tool previously surfaced the resulting 404 as `periodic_not_found`, indistinguishable from "no note for that period." A memoized capability probe against `GET /`'s `apiExtensions` now tells the two apart and names `local-rest-api-periodic-notes` in the recovery hint ([#103](https://github.com/cyanheads/obsidian-mcp-server/issues/103)).
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.12.5 → ^0.12.8
+- `undici` ^8.10.1 → ^8.10.2
+- `@biomejs/biome` ^2.5.11 → ^2.5.12 (dev)
+- `@types/node` ^26.4.0 → ^26.4.1 (dev)
+- `tsc-alias` ^1.9.3 → ^1.9.4 (dev)
+- `vitest` ^4.1.11 → ^5.0.0 (dev)

package/dist/config/server-config.d.ts

@@ -6,14 +6,14 @@
 import { z } from '@cyanheads/mcp-ts-core';
 declare const ServerConfigSchema: z.ZodObject<{
     apiKey: z.ZodString;
-    baseUrl: z.ZodPreprocess<z.ZodDefault<z.ZodString>>;
+    baseUrl: z.ZodPreprocess<z.ZodDefault<z.ZodString>, unknown>;
     verifySsl: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCodec<z.ZodString, z.ZodBoolean>]>>;
     requestTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     enableCommands: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCodec<z.ZodString, z.ZodBoolean>]>>;
-    readPaths: z.ZodPreprocess<z.ZodPipe<z.ZodOptional<z.ZodArray<z.ZodString>>, z.ZodTransform<string[] | undefined, string[] | undefined>>>;
-    writePaths: z.ZodPreprocess<z.ZodPipe<z.ZodOptional<z.ZodArray<z.ZodString>>, z.ZodTransform<string[] | undefined, string[] | undefined>>>;
+    readPaths: z.ZodPreprocess<z.ZodPipe<z.ZodOptional<z.ZodArray<z.ZodString>>, z.ZodTransform<string[] | undefined, string[] | undefined>>, unknown>;
+    writePaths: z.ZodPreprocess<z.ZodPipe<z.ZodOptional<z.ZodArray<z.ZodString>>, z.ZodTransform<string[] | undefined, string[] | undefined>>, unknown>;
     readOnly: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCodec<z.ZodString, z.ZodBoolean>]>>;
-    omnisearchUrl: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    omnisearchUrl: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
 }, z.core.$strip>;
 export type ServerConfig = z.infer<typeof ServerConfigSchema>;
 export declare function getServerConfig(): ServerConfig;

package/dist/mcp-server/resources/definitions/index.d.ts

@@ -47,5 +47,10 @@ export declare const allResourceDefinitions: (import("@cyanheads/mcp-ts-core").R
         name: import("zod").ZodString;
         version: import("zod").ZodString;
     }, import("zod/v4/core").$strip>>;
+    apiExtensions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodOptional<import("zod").ZodString>;
+        version: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>>;
 }, import("zod/v4/core").$strip>, undefined>)[];
 //# sourceMappingURL=index.d.ts.map

package/dist/mcp-server/resources/definitions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+CAAoD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+CAAoD,CAAC"}

package/dist/mcp-server/resources/definitions/obsidian-status.resource.d.ts

@@ -1,8 +1,10 @@
 /**
- * @fileoverview obsidian://status — reachability + auth check for the Obsidian
- * Local REST API plugin. Issues an anonymous probe (so the resource still
- * works when the key is wrong) and a separate authenticated probe so the
- * `authenticated` field reflects whether the configured key is accepted.
+ * @fileoverview obsidian://status — reachability, auth, and capability report
+ * for the Obsidian Local REST API plugin. One authenticated `GET /`: the route
+ * answers `200` whatever the key is and self-reports whether it was accepted,
+ * so a misconfigured key still yields the full reachability payload, and
+ * `apiExtensions` — which the plugin omits from the unauthenticated response —
+ * comes back on the same request.
  * @module mcp-server/resources/definitions/obsidian-status.resource
  */
 import { z } from '@cyanheads/mcp-ts-core';
@@ -19,5 +21,10 @@ export declare const obsidianStatus: import("@cyanheads/mcp-ts-core").ResourceDe
         name: z.ZodString;
         version: z.ZodString;
     }, z.core.$strip>>;
+    apiExtensions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>, undefined>;
 //# sourceMappingURL=obsidian-status.resource.d.ts.map

package/dist/mcp-server/resources/definitions/obsidian-status.resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"obsidian-status.resource.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/obsidian-status.resource.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAY,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAGrD,eAAO,MAAM,cAAc;;;;;;;;;;;;;6BAwCzB,CAAC"}
+{"version":3,"file":"obsidian-status.resource.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/obsidian-status.resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAY,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAGrD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;6BAmDzB,CAAC"}

package/dist/mcp-server/resources/definitions/obsidian-status.resource.js

@@ -1,15 +1,17 @@
 /**
- * @fileoverview obsidian://status — reachability + auth check for the Obsidian
- * Local REST API plugin. Issues an anonymous probe (so the resource still
- * works when the key is wrong) and a separate authenticated probe so the
- * `authenticated` field reflects whether the configured key is accepted.
+ * @fileoverview obsidian://status — reachability, auth, and capability report
+ * for the Obsidian Local REST API plugin. One authenticated `GET /`: the route
+ * answers `200` whatever the key is and self-reports whether it was accepted,
+ * so a misconfigured key still yields the full reachability payload, and
+ * `apiExtensions` — which the plugin omits from the unauthenticated response —
+ * comes back on the same request.
  * @module mcp-server/resources/definitions/obsidian-status.resource
  */
 import { resource, z } from '@cyanheads/mcp-ts-core';
 import { getObsidianService } from '../../../services/obsidian/obsidian-service.js';
 export const obsidianStatus = resource('obsidian://status', {
     name: 'obsidian-status',
-    description: 'Server reachability, plugin version, and auth status of the Obsidian Local REST API. Reports the unauthenticated reachability info even when the API key is misconfigured; `authenticated` reflects whether the configured key is accepted by an authenticated probe.',
+    description: 'Server reachability, plugin version, auth status, and registered API extensions of the Obsidian Local REST API. Still reports reachability when the API key is misconfigured; `authenticated` reflects whether the plugin accepted the configured key. Check `apiExtensions` before using a `periodic` note target — on plugin v5.0.2 and later those routes are served only when `local-rest-api-periodic-notes` is registered.',
     mimeType: 'application/json',
     params: z.object({}),
     output: z.object({
@@ -17,7 +19,7 @@ export const obsidianStatus = resource('obsidian://status', {
         service: z.string().describe('Service identifier returned by the plugin.'),
         authenticated: z
             .boolean()
-            .describe('True when the configured OBSIDIAN_API_KEY is accepted by an authenticated request to the vault listing.'),
+            .describe('True when the plugin accepted the configured OBSIDIAN_API_KEY on this request.'),
         versions: z
             .object({
             obsidian: z.string().optional().describe('Obsidian app version, when reported.'),
@@ -33,15 +35,22 @@ export const obsidianStatus = resource('obsidian://status', {
         })
             .optional()
             .describe('Plugin manifest, when reported.'),
+        apiExtensions: z
+            .array(z
+            .object({
+            id: z
+                .string()
+                .describe('Extension manifest ID, e.g. `local-rest-api-periodic-notes` for the extension that serves `/periodic/` routes on plugin v5.0.2 and later.'),
+            name: z.string().optional().describe('Extension display name, when reported.'),
+            version: z.string().optional().describe('Extension version, when reported.'),
+        })
+            .describe('One registered API extension.'))
+            .optional()
+            .describe('API extensions registered against the plugin. An empty array means none are registered; the field is absent when the plugin did not report it at all, which it does only for a request whose API key was accepted.'),
     }),
     auth: ['resource:obsidian-status:read'],
     async handler(_params, ctx) {
-        const svc = getObsidianService();
-        const [status, authenticated] = await Promise.all([
-            svc.getStatus(ctx),
-            svc.probeAuthenticated(ctx),
-        ]);
-        return { ...status, authenticated };
+        return await getObsidianService().getStatus(ctx);
     },
 });
 //# sourceMappingURL=obsidian-status.resource.js.map

package/dist/mcp-server/resources/definitions/obsidian-status.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"obsidian-status.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/obsidian-status.resource.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,EAAE;IAC1D,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACT,uQAAuQ;IACzQ,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAC/D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QAC1E,aAAa,EAAE,CAAC;aACb,OAAO,EAAE;aACT,QAAQ,CACP,yGAAyG,CAC1G;QACH,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;SACtF,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CAAC,oDAAoD,CAAC;QACjE,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SAChD,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CAAC,iCAAiC,CAAC;KAC/C,CAAC;IACF,IAAI,EAAE,CAAC,+BAA+B,CAAC;IAEvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG;QACxB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;YAClB,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAC;IACtC,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"obsidian-status.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/obsidian-status.resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,EAAE;IAC1D,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACT,kaAAka;IACpa,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAC/D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QAC1E,aAAa,EAAE,CAAC;aACb,OAAO,EAAE;aACT,QAAQ,CAAC,gFAAgF,CAAC;QAC7F,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;SACtF,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CAAC,oDAAoD,CAAC;QACjE,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SAChD,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CAAC,iCAAiC,CAAC;QAC9C,aAAa,EAAE,CAAC;aACb,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,EAAE,EAAE,CAAC;iBACF,MAAM,EAAE;iBACR,QAAQ,CACP,2IAA2I,CAC5I;YACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SAC7E,CAAC;aACD,QAAQ,CAAC,+BAA+B,CAAC,CAC7C;aACA,QAAQ,EAAE;aACV,QAAQ,CACP,oNAAoN,CACrN;KACJ,CAAC;IACF,IAAI,EAAE,CAAC,+BAA+B,CAAC;IAEvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG;QACxB,OAAO,MAAM,kBAAkB,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;CACF,CAAC,CAAC"}