claudian - Moses Yebei

The Problem

Claude Code and Codex are powerful terminal tools, but they operate outside your notes. Claudian embeds them directly in Obsidian, making your vault the agent's working directory. Users avoid context-switching to a terminal and get AI assistance where their knowledge lives.

What This Does

Claudian is an Obsidian plugin that runs Claude Code and Codex as AI collaborators. It provides a chat sidebar, inline editing with word-level diffs, slash commands, skills, MCP server support, and multi-tab conversation management. The vault becomes the agent's workspace — it can read, write, and search files there.

The codebase is substantial: 430 TypeScript files, with src/main.ts as the plugin entry point. A provider abstraction in src/core/providers/ handles both Claude and Codex runtimes, each with their own chat runtime, history store, and settings. The UI layer in src/features/chat/ manages tabs, input, rendering, and controllers.

How It Is Wired

Control flow starts at src/main.ts (onload), which sets up the view and commands. The applyEnvironmentVariables function at src/main.ts:357 reaches 342 functions and reads the filesystem via fs.promises.unlink after routing through saveMetadata and deleteLegacyMetadataIfPresent. deleteConversation at src/main.ts:573 reaches 294 functions and deletes session files via fs.unlink.

The core hub is src/core/types/index.ts — 73 modules depend on it, making changes there high-blast-radius. src/core/providers/types.ts is similar with 62 dependents, but it's inside a circular dependency cycle along with src/main.ts and ProviderRegistry.ts. Breaking that cycle requires extracting shared types or deferring imports.

The runtime layer is where the real work happens. src/providers/claude/runtime/ClaudeChatRuntime.ts (73 functions) and src/providers/codex/runtime/CodexChatRuntime.ts (72 functions) orchestrate agent sessions, with the Codex runtime handling file I/O directly. The CodexHistoryStore.ts manages conversation persistence. The InputController.ts coordinates the chat input, reading and writing files as part of its work.

Filesystem effects are concentrated in src/core/storage/HomeFileAdapter.ts (40 callers) and src/utils/path.ts (21 callers). The McpTester.ts entry point (start) reaches 57 functions and resolves the Claude CLI path through findClaudeCLIPath, ultimately reading fs.readFileSync on the nvm alias file.

How To Use It

Setup: Clone and build from source:

cd /path/to/vault/.obsidian/plugins
git clone https://github.com/moses-y/claudian.git
cd claudian
npm install
npm run build

Configuration: Requires the Claude Code CLI installed (native install recommended). Codex is optional. Copy .env.local.example to .env.local to configure the vault path for development auto-copy.

Running: Enable the plugin in Obsidian Settings → Community plugins. Open the chat sidebar via the ribbon icon or command palette. Select text and use the hotkey for inline edit. Use Shift+Tab for Plan Mode, / or $ for slash commands and skills.

Real-World Use

A researcher keeps meeting notes, literature reviews, and code snippets in a vault. With Claudian, they select a paragraph in a draft and hit the inline-edit hotkey — the agent rewrites it with word-level diff preview. They can also ask the agent to summarize all notes from the last week, with the agent reading and cross-referencing files across the vault.

Code Health & Issues

Static analysis found 193 issues: 122 high, 68 medium, 3 low. Key findings:

High - Import cycle members (38 instances) — src/core/providers/types.ts, src/main.ts, src/core/providers/ProviderRegistry.ts participate in circular imports. Fix: extract shared types or invert dependencies.
High - Hub modules (9) — src/core/types/index.ts has 73 dependents; changes ripple widely. Keep it stable and small.
High - Oversized files (8) — MessageRenderer.ts (626 lines), CodexHistoryStore.ts, ToolCallRenderer.ts are hard to maintain. Split by responsibility.
Medium - High branching density (5) — src/utils/path.ts, src/utils/env.ts, claude/settings.ts have 85 branch points over 270 lines. Consider strategy dispatch.

SDLC observations from the workflow files:

Critical - CLAUDE_CODE_OAUTH_TOKEN exposed in .github/workflows/claude.yml — a fork-triggered PR could exfiltrate publish/cloud credentials. Move secret-using steps to workflow_run.
High - Third-party actions unpinned (anthropics/claude-code-action@v1) in workflows — tag moves are a known supply-chain vector. Pin to commit SHAs.
Medium - CI lacks dependency vulnerability scanning, persist-credentials: false, and least-privilege GITHUB_TOKEN permissions.
Medium - postinstall script in package.json — disable scripts in CI and run explicitly.

The Bottom Line

Claudian is a serious, well-tested plugin (197 test files) that bridges Obsidian and AI coding agents. The architecture is sound but the circular imports and hub modules will make changes costly. The CI secrets issue is the one thing to fix before using this in any shared or public context.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

526 files

TypeScript430
CSS43
JSON17
Markdown8
YAML6
JavaScript4

React

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["src<br/>244 modules"] g1["tests<br/>186 modules"] g2["scripts<br/>6 modules"] g3["(root)<br/>3 modules"] g1 -->|13| g0 g3 -->|1| g2 g1 -->|1| g2

Module dependencies

The 10 most depended-upon modules of 439, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_core_types_index["index"] n1_src_core_providers_types["types"] n2_src_main["main"] n3_src_utils_path["path"] n4_src_utils_env["env"] n5_src_core_tools_toolNames["toolNames"] n6_e_providers_ProviderRegistry["ProviderRegistry"] n7_ore_storage_VaultFileAdapter["VaultFileAdapter"] n8_src_core_types_settings["settings"] n9_src_i18n_i18n["i18n"] n6_e_providers_ProviderRegistry --> n2_src_main n6_e_providers_ProviderRegistry --> n1_src_core_providers_types n1_src_core_providers_types --> n2_src_main n1_src_core_providers_types --> n7_ore_storage_VaultFileAdapter n1_src_core_providers_types --> n0_src_core_types_index n0_src_core_types_index --> n8_src_core_types_settings n2_src_main --> n6_e_providers_ProviderRegistry n2_src_main --> n1_src_core_providers_types n2_src_main --> n0_src_core_types_index n2_src_main --> n8_src_core_types_settings n2_src_main --> n9_src_i18n_i18n n2_src_main --> n3_src_utils_path n4_src_utils_env --> n3_src_utils_path classDef cyc stroke:#ef4444,stroke-width:2px; class n1_src_core_providers_types,n2_src_main,n6_e_providers_ProviderRegistry cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high1

medium5

low2

Keep secrets out of workflows a fork can triggercritical

.github/workflows/claude.yml

CLAUDE_CODE_OAUTH_TOKEN (publish or cloud scope)

Contributor-controlled input reaches a job holding a publish token or cloud credential, so a pull request becomes credential exfiltration.

Fix: Move secret-using steps into a workflow_run job that never checks out pull request code, or gate on an environment with required reviewers.

Pin third-party GitHub Actions to a commit SHAhigh2 occurrences

.github/workflows

anthropics/claude-code-action@v1, softprops/action-gh-release@v1

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Review the install lifecycle script and disable scripts in CImedium

package.json

postinstall

Install scripts are the execution vector for every npm compromise from event-stream onward, and a postinstall that fetches a binary makes the build depend on a URL nobody reviews.

Fix: Move the work into an explicit build step, or set ignore-scripts in CI and run it by name.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/ci.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.