Catch Obsidian review regressions and clear low-risk warnings

[logancyang]

Fixes logancyang/obsidian-copilot-preview#285

Why

The authenticated Obsidian reviewer found inputs and dependency guidance that our required local gate did not reproduce. CI could therefore pass a commit that Obsidian rejected. The same report contains warning-only findings that are safe to remove mechanically, while other warnings would require risky runtime or UI changes.

What

Situation	Before	After
Tracked source hidden by local ESLint or CSS outside the main Tailwind file	The local gate could miss it	The fixture stage rejects hidden tracked source, and Stylelint scans all source/gallery CSS
Runtime dependency covered by Obsidian's replacement guidance	Test-only allowances could hide it	The package stage applies the pinned upstream rule to production dependencies only and reports it without blocking
Low-risk review warning	Remained in the hosted report	22 warnings and two recommendations are removed through behavior-equivalent type, callback, schema, dependency-scope, and element-helper changes
Risky warning	Tempted broad compliance rewrites	It remains visible and nonblocking for a separately verified follow-up

Agent and maintainer guidance now requires the same preflight and tells reviewers how to classify findings without suppressing rules or changing behavior for a green result.

Non goal

• Change visible UI, runtime behavior, prompts, provider networking, persisted settings, credentials, or data formats.
• Rewrite desktop Node boundaries, streaming fetch, async UI handlers, settings search, or risky CSS selectors in this PR.
• Scrape or authenticate against Obsidian's private community-review service.
• Block warning-only findings or noncritical production advisories.

Screenshot

Not applicable — this PR has no intended visual change. The element-helper substitutions create the same tags, classes, text, and controls.

Risk

Low

Criterion	Status	Reason
No behavior change, or a cosmetic/copy/docs/config change visible where it renders, or deterministic tests cover the changed behavior	✅	Review fixtures cover every new gate path, and the write-file schema test proves arbitrary object content remains accepted
A defect would fail CI or be obvious on first use	✅	The required review job runs the package, source, CSS, audit, and fixture stages
A revert fully restores prior state, including persisted data	✅	No migration or persisted write is introduced
No auth, permissions, secrets, or input-handling surface changes	✅	The schema syntax change preserves the existing accepted content, covered by a round-trip assertion
No public API, plugin API, message, or on-disk contract changes	✅	Internal type annotations now match existing runtime promises; external shapes are unchanged
No core-path concurrency, async-lifecycle, or state-machine changes	✅	Callback changes preserve receiver binding and explicitly discard the same returned promises
No hot-path behavior lacks deterministic coverage	✅	Changed runtime paths are exercised by the existing test suite and mobile-load smoke test
No new dependency	✅	dotenv is reclassified from runtime to development-only; its resolved version is unchanged
Human-only behavior stays in one feature area and surfaces quickly	✅	There is no intended human-only change; equivalent DOM helpers retain the same rendered structure

Review: run Verification steps 1–3; inspect lintRuntimeDependencies in scripts/review-obsidian-package.mjs, its runtime/development fixtures in scripts/review-obsidian-fixtures.mjs, compactXmlBlock in src/context/L2ContextCompactor.ts, and the writeFileSchema content branch in src/tools/ComposerTools.ts.

Verification

1. Run npm run review:obsidian:fixtures; it must pass while proving invalid source/style/manifest inputs are rejected and runtime dependency guidance remains warning-only.
2. Run npm run review:obsidian; it must finish with zero errors while retaining warning output and blocking only critical production advisories.
3. Run npm run test:mobile-load; the production bundle must build and pass the mobile-load smoke test.

Note

CLAUDE.md is a symlink to AGENTS.md, so the new Obsidian review guidance has one canonical source and is read by both Claude and other repository agents.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc2bab701c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Group the write-file case under its callable

This new case is placed directly in a topic-based suite and uses test(...), so coverage for createWriteFileTool() is not organized under the required single describe("createWriteFileTool()", ...) callable group. This makes callable ownership ambiguous as this shared schema suite grows; move the case into the callable group and express the behavior with it(...).

AGENTS.md reference: AGENTS.md:L25-L25

Useful? React with 👍 / 👎.