Obsidian Plum Box Sync

Sync your Obsidian vault to your own Plum Box — no third-party cloud, no server that can read your notes.

You sign in on plumbox.me in your browser (like "Sign in with Google"), so this plugin never sees your password — only a scoped, revocable token. The notes live on hardware you own.

How it works

1. Connect (Settings → Plum Box Sync → Connect). Your browser opens plumbox.me, you sign in and approve access. The box hands Obsidian back a scoped read/write token via a PKCE-protected redirect — the password is typed only on Plum's own page.
2. Your vault maps to a drive folder on the box (default /Obsidian/<vault>).
3. Sync copies changes both ways: uploads local edits, downloads remote edits, propagates deletions to the recoverable trash on each side, and keeps both copies when a file changed on both sides at once.

Sync runs when you click Sync now (ribbon or command palette), on a timer (default every 15 min), and a few seconds after you edit the vault.

Security

• The password is entered only on plumbox.me, in your system browser — never inside Obsidian. This plugin receives a token, not credentials.
• The token is read/write only; admin is never requested and the box refuses it. Revoke it any time in your box settings — sync stops working, your account is untouched.
• The token is stored in this plugin's data.json (plaintext at rest, like other sync plugins). Treat your vault device accordingly.
• Deletions go to a recoverable trash on both sides (Obsidian's .trash locally, the box trash remotely), not a hard delete.

Install (manual, during development)

1. Build: npm install && npm run build.
2. Copy manifest.json, main.js, versions.json into <vault>/.obsidian/plugins/plum-sync/.
3. Enable Plum Box Sync in Settings → Community plugins.

Conflict handling

If a note changed on both the box and this device since the last sync, the plugin keeps both: your local version stays at the original name, and the box's version is written alongside as note (conflict <date>).md. Nothing is lost; you merge and delete the extra copy.

Built on @plumbox/client

This plugin is a thin client over the @plumbox/client SDK (delegated OAuth + Drive API), using Obsidian's requestUrl transport so it works on desktop and mobile without isDesktopOnly.

License

MIT — see LICENSE.