[FR]: Separate local credentials and runtime state from shareable data.json settings

[Oriery]

Feature Description

Please provide separate storage for local credentials and runtime bookkeeping so that .obsidian/plugins/tasknotes/data.json can be safely versioned as shared configuration.

I keep my Obsidian vault and TaskNotes settings in Git. Tracking task statuses, priorities, custom properties, and other intentional settings is useful. However, the same file also contains local or frequently changing values:

• apiAuthToken.
• lastPomodoroDate.
• lastSeenVersion.
• lastNotifiedReleaseVersion.

This mixes deliberate configuration changes with routine bookkeeping and risks committing credentials when saving otherwise legitimate settings changes. Ignoring the entire file loses the settings I do want to track.

I still see bookkeeping-only changes to data.json in TaskNotes 4.13.1, so the unwanted configuration churn remains a problem for this Git-based workflow. On desktop, leaving apiAuthToken empty also causes the API server to generate a token and save it in the same file.

Suggested behavior

Keep shareable configuration in data.json, and move local-only values to a separate file, such as data.local.json, that users can exclude from Git or their chosen sync tool. Credentials could instead use Obsidian's secret storage.

Ideally, existing values would migrate without losing settings or unnecessarily rotating tokens; saving settings would not copy local values back into data.json; and API/MCP clients would have a documented way to obtain the local token. The documentation should identify which files are safe to version.

Some state may be useful across devices, so the precise classification is open to discussion. The goal is to version intentional configuration independently of credentials and runtime bookkeeping, without custom Git filters or sanitized settings import/export scripts.

Related discussion

• [Bug]: Data.json constantly being modified #1669 reports data.json constantly changing and causing configuration conflicts when two laptops sync through iCloud. It was closed with the expectation that release 4.8.0 would resolve it. Unwanted bookkeeping changes still occur in my Git-based workflow on 4.13.1. I have not established whether they share the same cause as that multi-device sync loop.
• Should data.json be config-only? (Move ephemeral session state out) #1637 proposed separating session state from configuration. I understand the migration, backup, and sync tradeoffs raised there, but reducing redundant writes still leaves local state and shared settings in the same file.

This request covers both the remaining bookkeeping churn and generated API credentials. Separating their storage would let users version intentional settings changes while excluding local state and secrets.