chore: bump version to 1.1.6 and update CHANGELOG

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

CHANGELOG.md

@@ -73,6 +73,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Comprehensive input schema definitions
 - Security audit of parameter handling
 
+## [1.1.6] - 2026-04-30
+
+### Fixed
+- **`obsidian_create_note` parameter semantics**: Fixed issue #8 where ambiguous `path` description led callers to pass the full file path (including filename) in `path`, causing the CLI to misbehave and the `overwrite` flag to auto-suffix filenames instead of replacing them
+  - `name` is now clearly documented as the **filename only** (e.g. `"My Note.md"`)
+  - `path` is now clearly documented as the **folder only** (e.g. `"Projects/Work"`) — never include the filename
+  - Added `required: ['name']` to the input schema
+
+## [1.1.5] - 2026-04-28
+
+### Fixed
+- **Mermaid Arrows and HTML Preserved**: Fixed issue #7 where `<` and `>` were being stripped from note content, breaking Mermaid diagram connectors (`->>`, `-->`, `<|`, `>>`) and HTML tags
+  - `<` and `>` are only meaningful as shell redirects at the command level — inside double-quoted strings (how all values are passed) they are completely inert
+  - Removed from `DANGEROUS_CHARS` in both `sanitizeString` and `sanitizePath`
+
 ## [1.1.4] - 2026-04-28
 
 ### Fixed
@@ -136,6 +151,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Version History
 
+- **1.1.6** - Bug fix release: Clarify `name` vs `path` semantics in `obsidian_create_note` (fixes #8)
+- **1.1.5** - Bug fix release: Preserve `<` and `>` in note content for Mermaid/HTML (fixes #7)
+- **1.1.4** - Bug fix release: Preserve Markdown code fences (fixes #6)
 - **1.1.3** - Bug fix release: Large file chunking for obsidian_read_note; docs clarification for Obsidian must be running (fixes #4, #5)
 - **1.1.2** - Bug fix release: Ampersand support in filenames (fixes #2)
 - **1.1.1** - Bug fix release: Quote escaping in note content
@@ -145,6 +163,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Search & Discovery (12 tools)
   - Task & Property Management (8 tools)
 
+[1.1.6]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.6
+[1.1.5]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.5
 [1.1.4]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.4
 [1.1.3]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.3
 [1.1.2]: https://git.mortons.site/Peter.Morton/obsidian-mcp/releases/tag/v1.1.2

manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "obsidian-mcp",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "display_name": "Obsidian CLI Bundle",
   "description": "MCP Bundle for Obsidian CLI - Enable AI assistants to manage Obsidian vaults through conversational interface",
   "long_description": "This MCP bundle provides a comprehensive set of tools for AI assistants to interact with and manage Obsidian vaults. It includes capabilities for creating, reading, updating, and deleting notes, managing links and tags, handling tasks, and more. With this bundle, AI assistants can seamlessly integrate with Obsidian to help users organize their knowledge and workflows.",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "obsidian-mcp",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "MCP Bundle for Obsidian CLI - Enable AI assistants to manage Obsidian vaults through Model Context Protocol",
   "type": "module",
   "main": "dist/index.js",

src/tools/file-operations.ts

@@ -28,17 +28,18 @@ export async function registerFileOperationTools(server: ObsidianMCPServer): Pro
   // T029: Create note tool
   server.registerTool(
     'obsidian_create_note',
-    'Create a new note in the Obsidian vault. Optionally specify path, content, template, and whether to overwrite existing notes or open after creation.',
+    'Create a new note in the Obsidian vault. "name" is the filename only (e.g. "My Note.md"). "path" is the folder only (e.g. "Projects/Work") — do not include the filename in path. When overwrite is true the existing file is replaced.',
     {
       type: 'object',
+      required: ['name'],
       properties: {
         name: {
           type: 'string',
-          description: 'File name for the new note',
+          description: 'Filename for the new note (e.g. "My Note.md"). Do not include folder path here.',
         },
         path: {
           type: 'string',
-          description: 'Full file path (alternative to name)',
+          description: 'Folder path where the note will be created (e.g. "Projects/Work"). Do not include the filename here. Omit for vault root.',
         },
         content: {
           type: 'string',
@@ -50,7 +51,7 @@ export async function registerFileOperationTools(server: ObsidianMCPServer): Pro
         },
         overwrite: {
           type: 'boolean',
-          description: 'Overwrite if file exists (optional)',
+          description: 'Replace the file if it already exists (optional)',
         },
         open: {
           type: 'boolean',
@@ -66,14 +67,15 @@ export async function registerFileOperationTools(server: ObsidianMCPServer): Pro
       'Create a new note in the Obsidian vault',
       {
         type: 'object',
+        required: ['name'],
         properties: {
           name: {
             type: 'string',
-            description: 'File name for the new note',
+            description: 'Filename for the new note (e.g. "My Note.md"). Do not include folder path here.',
           },
           path: {
             type: 'string',
-            description: 'Full file path (alternative to name)',
+            description: 'Folder path where the note will be created (e.g. "Projects/Work"). Do not include the filename here. Omit for vault root.',
           },
           content: {
             type: 'string',
@@ -85,7 +87,7 @@ export async function registerFileOperationTools(server: ObsidianMCPServer): Pro
           },
           overwrite: {
             type: 'boolean',
-            description: 'Overwrite if file exists (optional)',
+            description: 'Replace the file if it already exists (optional)',
           },
           open: {
             type: 'boolean',
@@ -102,8 +104,6 @@ export async function registerFileOperationTools(server: ObsidianMCPServer): Pro
         const sanitized = sanitizeParameters(validated) as any;
 
         const cmdArgs: string[] = [];
-        
-        // Add name or path parameter
         if (sanitized.name) cmdArgs.push(formatParam('name', sanitized.name as string));
         if (sanitized.path) cmdArgs.push(formatParam('path', sanitized.path as string));
         if (sanitized.content) cmdArgs.push(formatParam('content', sanitized.content as string));

src/validation/sanitizer.ts

@@ -13,10 +13,12 @@ import { logger } from '../utils/logger.js';
  * Note: Single & is safe in quoted args (filenames like "Research & Development.md")
  * Note: Backticks are safe because formatParam escapes them as \` inside double-quoted strings,
  *       preventing shell command substitution while preserving Markdown code fences (``` ```)
- * We only block: ; | $ < > (command separators, pipes, substitution, redirects)
+ * Note: < and > are safe inside double-quoted strings — shell redirection only applies at the
+ *       command level, not inside quotes. Stripping them breaks Mermaid arrows (->>, -->) and HTML.
+ * We only block: ; | $ (command separators, pipes, variable substitution)
  * Command injection patterns (&&, ||, etc.) are handled separately
  */
-const DANGEROUS_CHARS = /[;|$<>]/g;
+const DANGEROUS_CHARS = /[;|$]/g;
 const COMMAND_INJECTION_PATTERNS = [
   /\$\(/g,      // Command substitution $(...)
   /\|\|/g,      // OR operator
@@ -74,7 +76,8 @@ export function sanitizePath(path: string): string {
 
   // Remove dangerous characters but allow path separators
   // Note: Brackets, parentheses, braces, and single & are safe in paths (quoted args)
-  sanitized = sanitized.replace(/[;|`$<>]/g, '');
+  // Note: < and > are safe inside double-quoted strings (not shell redirects)
+  sanitized = sanitized.replace(/[;|`$]/g, '');
 
   return sanitized;
 }