Copilot for Obsidian - Release v3.3.1 🔐

This release is all about keeping your API keys safe and your plugin running smoothly everywhere. API keys can now be stored in Obsidian's built-in Keychain so they never touch data.json, the encryption toggle is removed (it was more trouble than it was worth), and a wave of reliability fixes ensures chat works correctly on mobile, in popout windows, and with Plus mode. Underneath, @zeroliu landed nineteen back-to-back PRs of code-quality work — tightening ESLint, eliminating ~395 any types, swapping out unmaintained dependencies, and modernizing the React layer. Huge thanks to both @Emt-lin (Keychain) and @zeroliu (codebase hardening) for carrying this release. 🙌

⚠️ Requires Obsidian 1.11.4+. The minAppVersion is bumped from 1.7.2 to 1.11.4 because the Keychain feature relies on Obsidian's app.secretStorage API, which only exists in 1.11.4 and later.

• 🔐 API keys now live in the Obsidian Keychain — Fresh installs automatically store all API keys in Obsidian's vault-scoped Keychain instead of data.json. Existing users can opt in at any time via the new "API Key Storage" section in Advanced Settings. A guided migration wizard walks you through the move, and keys are stripped from data.json the moment migration completes. Each device has its own Keychain, so re-entering keys on a new device is expected. (@Emt-lin)
  • The Advanced Settings panel shows your current storage mode and surfaces a clear warning if a synced vault arrives on a device whose Keychain is empty.
  • A "Delete All Keys" option purges secrets from both the Keychain and data.json in one go.
  • The Reset Settings button no longer touches API keys. Use "Delete All Keys" if you want them gone.
• 🚫 Encryption toggle removed in favor of the Keychain — With API keys moving to the Obsidian Keychain, the standalone "Enable Encryption" toggle is no longer needed and has been retired. It also didn't survive a sync to mobile cleanly, which caused intermittent chat failures for some users. Migrate to the Keychain for proper secret storage; existing encrypted blobs are still decrypted transparently on read so nothing breaks. (@logancyang)
  • Mobile users whose vault contained desktop-encrypted keys now see a startup notice listing exactly which fields need to be re-entered.
• 📱 Image send on mobile is fixed — Sending images was broken for all mobile users since 3.3.0 due to a missing Buffer polyfill. Fixed. (@logancyang)
• ⌨️ Quick Command shortcuts and icons restored — The Cmd+Enter (Replace) and Cmd+Shift+Enter (Insert) shortcuts in the Quick Command result modal were broken if any global Obsidian hotkey was bound to Cmd+Enter. Fixed, and the inline shortcut glyphs are back too. (@zeroliu)
• 🧠 Plus mode: no more surprise getFileTree calls — When you have a note attached in context, the planner no longer fires a getFileTree tool call before answering. (@logancyang)
• 🏷️ Settings version chip and Reset button are visible again — Obsidian's own CSS was hiding them. Fixed. (@logancyang)
• 🛡️ Supply-chain attestations for release assets — Release artifacts are now cryptographically signed and published to Sigstore's transparency log. (@logancyang)
• 🧹 Major codebase hardening pass — @zeroliu landed a sustained ESLint and type-safety campaign across the repo: ~395 any types removed, dozens of type-aware rules turned on, unsafe assignments/returns/member-access/arguments locked down, floating promises explicitly handled, deprecated dependencies swapped, dead CSS removed, the global app reference replaced with a useApp() hook, and a long tail of smaller wins. See the full PR list below.

More details in the changelog:

Improvements

• #2364 feat(keychain): migrate API key storage to Obsidian Keychain @Emt-lin
• #2431 ci(release): publish artifact attestations for release assets @logancyang
• #2448 refactor(react): replace global app with useApp() hook @zeroliu

Bug Fixes

• #2457 fix(plus): planner skips getFileTree when active note is attached @logancyang
• #2455 fix(keychain): empty-keychain banner, reset modal copy, lifecycle reset @logancyang
• #2446 fix(encryption): deprecate encryption toggle; fix mobile chat failure on desktop-encrypted keys @logancyang
• #2445 fix(settings): restore version chip + reset button hidden by Obsidian h1 CSS @logancyang
• #2443 fix(mobile): import Buffer from the polyfill so image send works on mobile @logancyang
• #2442 fix(quick-command): restore Cmd+Enter shortcut and shortcut hint icons @zeroliu

Code Quality (@zeroliu)

• #2453 chore(lint): fix no-array-index-key and other React lint warnings
• #2452 chore(eslint): enable no-explicit-any; fix ~395 violations
• #2451 chore(styles): drop dead CSS, reduce !important, fix duplicate selectors
• #2450 chore(lint): fix deprecation and template-literal lint warnings
• #2449 chore(icons): drop deprecated lucide Youtube icon; reuse Globe
• #2447 chore(deps): swap unmaintained/legacy deps per e18e module-replacements
• #2444 chore(types): tighten any types and fix langchain getType deprecation
• #2441 chore(eslint): enable no-unnecessary-type-assertion and no-misused-promises
• #2440 chore(eslint): enable @typescript-eslint/no-unsafe-argument and fix violations
• #2439 chore(eslint): enable @typescript-eslint/unbound-method
• #2438 chore(eslint): enable no-unsafe-member-access; fix 124 violations
• #2437 chore(eslint): enable @typescript-eslint/no-floating-promises
• #2436 chore(eslint): enable @typescript-eslint/no-unsafe-return
• #2435 chore(test): type test mocks to satisfy @typescript-eslint/no-unsafe-call
• #2434 chore(eslint): enable no-unsafe-assignment for tests
• #2433 chore(eslint): remove redundant non-TS rule overrides
• #2424 chore(lint): enable 4 type-aware quick-win rules and fix violations

Troubleshoot

• If models are missing, navigate to Copilot settings -> Models tab and click "Refresh Built-in Models".
• Please report any issue you see in the member channel!

Generated by the release agent.