chore: bump version to 1.1.4 and update CHANGELOG

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

CHANGELOG.md

@@ -73,6 +73,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Comprehensive input schema definitions
 - Security audit of parameter handling
 
+## [1.1.4] - 2026-04-28
+
+### Fixed
+- **Markdown Code Fence Preservation**: Fixed issue #6 where backticks were being stripped from note content, destroying Markdown code fences (` ``` `)
+  - Backticks are now escaped as `` \` `` inside double-quoted CLI parameter strings instead of being removed
+  - This preserves code fences and inline code in note content while still preventing shell command substitution via backticks
+  - Affects all tools that pass content: create, append, prepend, etc.
+
 ## [1.1.3] - 2026-04-17
 
 ### Fixed
@@ -137,6 +145,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Search & Discovery (12 tools)
   - Task & Property Management (8 tools)
 
+[1.1.4]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.4
 [1.1.3]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.3
 [1.1.2]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.2
 [1.1.1]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.1

manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "obsidian-mcp",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "display_name": "Obsidian CLI Bundle",
   "description": "MCP Bundle for Obsidian CLI - Enable AI assistants to manage Obsidian vaults through conversational interface",
   "long_description": "This MCP bundle provides a comprehensive set of tools for AI assistants to interact with and manage Obsidian vaults. It includes capabilities for creating, reading, updating, and deleting notes, managing links and tags, handling tasks, and more. With this bundle, AI assistants can seamlessly integrate with Obsidian to help users organize their knowledge and workflows.",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "obsidian-mcp",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "MCP Bundle for Obsidian CLI - Enable AI assistants to manage Obsidian vaults through Model Context Protocol",
   "type": "module",
   "main": "dist/index.js",

src/utils/cli-helpers.ts

@@ -14,9 +14,12 @@ export function formatParam(key: string, value: string | number): string {
   // Always quote string values to handle spaces and special characters safely
   // Note: Obsidian CLI docs say: "Quote values with spaces: name="My Note""
   
-  // Escape any double quotes in the value to prevent shell interpretation issues
-  // This prevents truncation when content contains quotes like "Bot QM"
-  const escapedValue = String(value).replace(/"/g, '\\"');
+  // Escape double quotes and backticks to prevent shell interpretation inside double-quoted strings.
+  // In bash double-quoted strings: \" prevents quote termination, \` prevents command substitution.
+  // This preserves Markdown code fences (``` ` ```) while blocking injection via backticks.
+  const escapedValue = String(value)
+    .replace(/"/g, '\\"')
+    .replace(/`/g, '\\`');
   
   return `${key}="${escapedValue}"`;
 }

src/validation/sanitizer.ts

@@ -11,13 +11,14 @@ import { logger } from '../utils/logger.js';
  * Note: Brackets [], parentheses (), and braces {} are safe because values are quoted and passed as array args
  * They're essential for Obsidian markdown (wikilinks [[link]], tasks - [ ] Task, templates {{...}}, etc.)
  * Note: Single & is safe in quoted args (filenames like "Research & Development.md")
- * We only block: ; | ` $ < > (command separators, pipes, substitution, redirects)
+ * Note: Backticks are safe because formatParam escapes them as \` inside double-quoted strings,
+ *       preventing shell command substitution while preserving Markdown code fences (``` ```)
+ * We only block: ; | $ < > (command separators, pipes, substitution, redirects)
  * Command injection patterns (&&, ||, etc.) are handled separately
  */
-const DANGEROUS_CHARS = /[;|`$<>]/g;
+const DANGEROUS_CHARS = /[;|$<>]/g;
 const COMMAND_INJECTION_PATTERNS = [
   /\$\(/g,      // Command substitution $(...)
-  /`[^`]*`/g,   // Command substitution `...`
   /\|\|/g,      // OR operator
   /&&/g,        // AND operator
   /;/g,         // Command separator