Function prepareObsidianProfile

scripts/start-obsidian-e2e-instance.mjs:214–253

(options)

}

export async function prepareObsidianProfile(options) {
	// Fail closed if our profile tree is not a private directory we own
	// (temp-squat / TOCTOU guard). Secure the root before the instance dir so the
	// instance dir is created inside an already-validated 0o700 tree.
	await ensureSecureDir(options.profileRoot);
	await ensureSecureDir(options.instancePath);

	const userDataPath = path.join(options.obsidianHome, "Library", "Application Support", "obsidian");
	await fs.mkdir(userDataPath, { recursive: true, mode: 0o700 });
	await fs.mkdir(path.join(options.obsidianHome, "Library", "Logs"), { recursive: true, mode: 0o700 });
	await linkHostKeychains(options);

	const vaultId = stableVaultId(options.vaultPath);
	const obsidianJsonPath = path.join(userDataPath, "obsidian.json");
	await writeJson(obsidianJsonPath, {
		cli: true,
		updateDisabled: true,
		vaults: {
			[vaultId]: {
				open: true,
				path: options.vaultPath,
				ts: Date.now(),
			},
		},
	});

	// Record which worktree this instance belongs to so the teardown reaper can
	// reap it once that worktree is removed (see INSTANCE_MARKER_FILE).
	await writeJson(path.join(options.instancePath, INSTANCE_MARKER_FILE), {
		worktreePath: options.worktreePath,
		vaultName: options.vaultName,
		vaultPath: options.vaultPath,
	});

	return {
		obsidianJsonPath,
		userDataPath,
		vaultId,
	};
}

async function linkHostKeychains(options) {
	const realHome = process.env.HOME;