rps321321/obsidian-mcp-pro

Third-pass audit fixes — all user-facing correctness issues, plus expanded regression test coverage and cross-platform CI.

Fixes

• Alias-aware wikilink resolution — resolveWikilink now falls back to frontmatter aliases when no filename matches. find_orphans no longer reports notes linked by alias as orphans.
• Proximity-based tie-break — when multiple notes share a basename, [[foo]] resolves to the one nearest to the linking note (deepest shared path prefix), matching Obsidian's real resolver instead of "shortest from vault root".
• Full moment-token support — daily-note filename rendering now handles every token Obsidian uses: YYYY/YY, MMMM/MMM/MM/M/Mo, DDDD/DDD/DD/D/Do, dddd/ddd/dd, HH/H/hh/h, mm/m, ss/s, Q, and [literal] brackets. Previous impl silently produced literal strings like "2026-[Q]Q-09" for non-default formats.
• Canvas round-trip fidelity — updateCanvasFile preserves unknown top-level keys (viewport, future metadata) instead of dropping them on the first add_canvas_node / add_canvas_edge call.
• Case-insensitive frontmatter probe — extractTags / extractAliases match tags/Tags/TAGS (and aliases/Aliases/ALIASES). Hand-edited vaults no longer silently lose metadata.
• Clearer update_frontmatter description — explicitly notes that YAML comments, quoting, ordering, and blank lines are normalized on update.

Tests + CI

• New src/__tests__/semantics.test.ts — 18 tests covering all above fixes.
• New src/__tests__/security.test.ts — regression guards for symlink escape, case-rename deadlock, case-collision writes, sanitizeError.
• New src/__tests__/http-server.test.ts — Bearer auth, oversize-body 413, CORS preflight, /health open.
• Expanded CI matrix: ubuntu/macos/windows × Node 20/22, with CI_SYMLINKS=1 enabling the symlink regression tests on Windows runners.

153 tests pass, 3 skipped (symlink tests on non-privileged Windows); tsc clean.