Release Codeian 0.2.23 and resolve community review findings

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.2.23 - 2026-08-06
+
+### Added
+
+- Added a session-scoped FIFO message queue for follow-up prompts submitted while Codex is running.
+- Added per-message Guide and remove actions; Guide interrupts the active turn and sends the selected queued prompt next.
+- Added declarative settings definitions so Codeian settings appear in settings search on Obsidian 1.13 and later while retaining the legacy settings UI for older versions.
+
+### Changed
+
+- Updated the repository lint configuration to the current Obsidian community review rules.
+- Updated Obsidian API and test dependencies and resolved all dependency audit findings.
+- Documented the plugin's local process, filesystem, environment, and GitHub update behavior for security review.
+
+### Fixed
+
+- Fixed the manifest description rejected by the community scanner because it contained the reserved product name.
+- Replaced global timers and direct DOM creation with APIs compatible with Obsidian pop-out windows.
+- Removed CSS overrides flagged by the community scanner without changing the composer or template-list layout.
+
 ## 0.2.22 - 2026-07-19
 
 ### Changed

README.md

@@ -17,6 +17,7 @@ Codeian is a desktop-only Obsidian plugin that embeds a Codex prompt surface ins
 - Keep one live run synchronized across every open surface
 - Switch workspace conversations between full chat and focused reading modes
 - Run prompts from inside Obsidian
+- Queue follow-up prompts while Codex is running, or guide with one immediately
 - Stream Codex output back into the conversation
 - Render final answers as Markdown
 - Choose model and reasoning effort from the sidebar
@@ -32,7 +33,9 @@ Codeian is a desktop-only Obsidian plugin that embeds a Codex prompt surface ins
 
 Open Codeian from the ribbon icon or `Codeian: Open sidebar`. Use `Codeian: Open conversation in main area` for a full workspace tab, `Codeian: Open conversation in pop-out` for a native desktop window, and `Codeian: Toggle conversation reading mode` to switch the active conversation between chat and focused reading. When the current Obsidian version cannot open a pop-out leaf, Codeian opens the same session in the main area and shows a notice.
 
-Type a prompt in the composer at the bottom of the sidebar and press `Enter` to run it. Use `Shift` + `Enter` when you want to add a line break instead of running the prompt.
+Type a prompt in the composer at the bottom of the sidebar and press `Enter` to run it. While that session is already running, pressing `Enter` adds the prompt to its message queue instead. Queued prompts run automatically in order after the active task finishes. Use `Shift` + `Enter` when you want to add a line break instead of sending the prompt.
+
+Each queued message has a `Guide` action and a remove action. `Guide` stops the current Codex turn, moves the selected message to the front, and sends it as soon as the process exits. Cancelling a run manually pauses its queue so pending messages are not started unexpectedly; use `Guide` on a queued message to resume. Queues stay available across Codeian views for the current plugin runtime and are cleared when the plugin unloads.
 
 Use the library button in the composer to open prompt templates. Selecting a template fills the composer and keeps focus there; it does not run Codex until you press `Enter` or the run button. The same window lets you add, edit, and delete templates.
 
@@ -45,7 +48,7 @@ When typing a prompt:
 | `/` | Shows dynamically discovered Codex CLI commands from the local `codex --help` output. |
 | `$` | Shows dynamically discovered local skills from the machine's Codex skill registry. |
 | `@` | Shows Markdown files from the active vault and inserts `@<vault-relative-path>`. |
-| `Enter` | Runs the current prompt. |
+| `Enter` | Sends the current prompt, or queues it when the session is running. |
 | `Shift` + `Enter` | Inserts a new line. |
 
 ## Features
@@ -54,7 +57,7 @@ When typing a prompt:
 
 The sidebar keeps session management, messages, and the composer usable in a 320 by 600 pixel pane. Session metadata stays behind the session menu so it does not consume transcript space. Main and pop-out surfaces expose the complete chat workflow; reading mode hides editing and run configuration while retaining the transcript, response actions, and a return-to-chat control.
 
-Every surface subscribes to the same plugin-owned session controller. A session can have only one Codex process, so opening, switching, or closing a view never duplicates or cancels an active run. Plugin unload still cancels active processes.
+Every surface subscribes to the same plugin-owned session controller. A session can have only one Codex process, so opening, switching, or closing a view never duplicates or cancels an active run. Follow-up prompts use the same session-scoped FIFO queue in every surface. Plugin unload still cancels active processes and clears pending queue items.
 
 ### Local CLI execution
 
@@ -174,6 +177,10 @@ Codeian warns before running when the configured command is not `codex`, when `-
 - No telemetry is collected by this plugin.
 - Settings are stored through Obsidian's plugin data APIs.
 - The default execution posture uses Codex non-interactively with workspace-write sandbox access, so Codex can modify files in the vault or configured working directory.
+- Codeian launches the configured Codex executable directly with `shell: false`; it does not pass prompts through a shell.
+- To locate and run Codex, Codeian checks executable paths and passes only an allowlist of environment variables required by the CLI, including Codex/OpenAI configuration, locale, certificate, temporary-directory, home, and path variables.
+- Local filesystem reads are limited to executable discovery, configured Codex skill metadata, and files explicitly opened from conversation links. Vault writes use Obsidian APIs for archives and release updates.
+- The built-in updater connects only to the Codeian repository on GitHub and writes exactly `main.js`, `manifest.json`, and `styles.css` into this plugin's directory.
 
 Codex itself may send prompts, attached/context files, and tool outputs to the provider configured by your local Codex environment. Review your Codex configuration before using Codeian with sensitive vaults.
 

eslint.config.mjs

@@ -1,8 +1,11 @@
-import eslint from "@eslint/js";
 import globals from "globals";
 import tseslint from "typescript-eslint";
 import obsidianmd from "eslint-plugin-obsidianmd";
 
+const obsidianRulesOff = Object.fromEntries(
+	Object.keys(obsidianmd.rules).map((rule) => [`obsidianmd/${rule}`, "off"]),
+);
+
 export default tseslint.config(
 	{
 		ignores: [
@@ -11,8 +14,7 @@ export default tseslint.config(
 			"node_modules",
 		],
 	},
-	eslint.configs.recommended,
-	...tseslint.configs.recommended,
+	...obsidianmd.configs.recommended,
 	{
 		files: ["src/**/*.ts"],
 		languageOptions: {
@@ -25,11 +27,7 @@ export default tseslint.config(
 				...globals.node,
 			},
 		},
-		plugins: {
-			obsidianmd,
-		},
 		rules: {
-			...obsidianmd.configs.recommended,
 			"no-alert": "error",
 			"@typescript-eslint/await-thenable": "error",
 			"@typescript-eslint/no-base-to-string": "error",
@@ -41,11 +39,22 @@ export default tseslint.config(
 		},
 	},
 	{
-		files: ["scripts/**/*.mjs"],
+		files: ["tests/**/*.ts", "*.ts"],
+		...tseslint.configs.disableTypeChecked,
+		rules: {
+			...tseslint.configs.disableTypeChecked.rules,
+			...obsidianRulesOff,
+		},
+	},
+	{
+		files: ["eslint.config.mjs", "scripts/**/*.mjs"],
 		languageOptions: {
 			globals: {
 				...globals.node,
 			},
 		},
+		rules: {
+			...obsidianRulesOff,
+		},
 	},
 );