Task/obsidian review cleanup

.github/workflows/ci.yml

@@ -40,6 +40,14 @@ jobs:
       - name: Lint
         run: npm run lint
 
+      # Strict gates for the shipped code (no tests, no dev harness):
+      # zero warnings, mirroring the Obsidian community review.
+      - name: Lint shipped sources
+        run: npm run lint:src
+
+      - name: Lint CSS
+        run: npm run lint:css
+
       - name: Unit tests
         run: npm test
 

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- A quieter update than it looks: this round clears every community review warning — stricter typing, no deprecated calls — so future updates stay easy to ship.
+- Settings are now findable in Obsidian's settings search (1.13+): look for "Export folder" or "Diagnostic log" — both show your saved values right away.
+
+### Security
+
+- Pasting is safer: a crafted snippet pasted into a note can no longer smuggle in active markup.
+- Diagrams are rendered by a newer Mermaid engine, which also updates the maths renderer inside it.
+
 ## [0.11.0] - 2026-10-16
 
 ### Added

eslint.config.mts

@@ -36,7 +36,11 @@ export default defineConfig(
       },
       parserOptions: {
         projectService: {
-          allowDefaultProject: ["eslint.config.mts", "playwright.config.ts"],
+          allowDefaultProject: [
+            "eslint.config.mts",
+            "stylelint.config.mjs",
+            "playwright.config.ts",
+          ],
         },
         tsconfigRootDir: import.meta.dirname,
       },
@@ -66,6 +70,12 @@ export default defineConfig(
       "eslint-comments/no-restricted-disable": [
         "error",
         "obsidianmd/*",
+        // …except prefer-create-el: src/browser-harness/harness.ts IS the
+        // implementation of Obsidian's createEl/createDiv/createSpan, so the
+        // rule would flag its own implementation. The shim suppresses the
+        // rule locally with a described disable; every other obsidianmd rule
+        // stays non-disableable.
+        "!obsidianmd/prefer-create-el",
         "no-console",
         "no-restricted-globals",
         "@typescript-eslint/no-restricted-imports",
@@ -84,19 +94,12 @@ export default defineConfig(
       "@typescript-eslint/no-misused-promises": "warn",
       "@typescript-eslint/no-floating-promises": "warn",
       "@typescript-eslint/no-unnecessary-type-assertion": "warn",
-      "@typescript-eslint/no-empty-object-type": [
-        "warn",
-        // Extension command types use `declare global { interface Commands extends … {} }`
-        // as declaration-merging augmentation points — these must stay interfaces.
-        { allowInterfaces: "with-single-extends" },
-      ],
-      "@typescript-eslint/no-empty-interface": [
-        "warn",
-        // Same declaration-merging augmentation points (one `declare global
-        // { interface Commands extends … {} }` per extension); a type alias
-        // cannot merge into the global interface, so keep them.
-        { allowSingleExtends: true },
-      ],
+      // No option overrides: the review bot sees empty interfaces (the
+      // `declare global { interface Commands extends … {} }` merging points
+      // cannot be type aliases), so the local gate must see them too. Both
+      // rule names stay on — v8 merged no-empty-interface into
+      // no-empty-object-type, and the bot's naming is not visible to us;
+      // inline suppressions name both so they match either report.
       "@typescript-eslint/no-redundant-type-constituents": "warn",
       "@typescript-eslint/no-this-alias": "warn",
       "@typescript-eslint/no-unsafe-function-type": "warn",