# AI Flashcard Generator Generate flashcards from the current note or selection with Google Gemini, review and edit the result, and save a new Markdown deck for [Spaced Repetition](https://github.com/st3v3nmw/obsidian-spaced-repetition). [Русская документация](README.ru.md) · [Installation: desktop and mobile](docs/INSTALLATION.md) · [Security review](docs/SECURITY-AUDIT.md) ## Features - Uses selected text, or the current editor text including unsaved changes. - Atomic notes, English vocabulary, and one saved custom prompt. Custom prompts support `{{count}}` and `{{targetLanguage}}`. - Mandatory preview with editable fronts/backs, inclusion checkboxes and evidence quotes. - Local evidence matching, duplicate/conflict detection and length warnings. Evidence supports human review; it does not prove a card is correct. - Safe Gemini diagnostics show the provider error code and HTTP status without reflecting provider-controlled messages. - Uses Gemini's current structured-output contract and a one-time JSON-mode fallback when that contract is rejected with HTTP 400. - English pairs are saved as native bidirectional cards: `break the ice:::разрядить обстановку`. - Reads basic/reversed separators from Spaced Repetition; an explicit manual override is available. - Exact deck tags, a chosen folder and filename, and collision-safe creation of new files only. - Touch-friendly layout and ribbon button. One bundle for desktop (Windows, macOS, Linux), Android and iOS. The plugin does not implement scheduling. Spaced Repetition provides the review experience. ## Requirements and installation - Obsidian **1.13.0 or newer**, including on your phone/tablet. - Spaced Repetition enabled with a matching root tag. Compatibility targets canonical upstream 1.15.4. - A Google account and a Gemini API key from [Google AI Studio](https://aistudio.google.com/). Gemini quotas and charges depend on your model, region and billing settings; check [pricing](https://ai.google.dev/gemini-api/docs/pricing). Install **AI Flashcard Generator** from Obsidian's Community plugins directory. For a manual or test installation, use the release ZIP and copy `main.js`, `manifest.json` and `styles.css` into `//plugins/ai-flashcard-generator/`. The configuration directory is normally `.obsidian`. Reload Obsidian and enable the plugin. For a manual update, replace these three files and keep your existing `data.json`. See [platform instructions](docs/INSTALLATION.md) for Linux, Android and iOS. Node.js is needed only to build from source, never to use the plugin. ## Usage 1. Select your Gemini secret in the plugin settings. Only its identifier is saved in plugin settings. 2. Open a Markdown note and optionally select the desired passage. 3. Use the ribbon button or the command **Generate flashcards from current note**. On mobile, use the command palette or add this command to the mobile toolbar. 4. Check the source size, profile, limit, output path, tag and separators. Click **Generate** to send the source to Gemini. 5. Review the cards. Edit, select or clear them, inspect evidence, or regenerate. No file is created during preview. 6. Click **Create N cards** (or **Create N bidirectional pairs**) to save. A collision adds `(2)`, `(3)`, etc.; existing cards and SR schedules are not modified. `Atomic notes` and `Custom prompt` use the basic separator, normally `::`. The built-in English profile uses the reversed separator, normally `:::`. Ten English pairs produce ten Markdown lines with two review directions each. **Refresh** only rereads SR separators and never contacts Gemini. The default root tag is `#flashcards/generated`. If you use another root tag in Spaced Repetition, set it here too; a tag such as `generated` is only discoverable when configured in SR. ## Privacy and security Clicking Generate/Regenerate sends the selected source text and chosen prompt instructions directly to the standard Gemini `generateContent` endpoint at `https://generativelanguage.googleapis.com/v1beta/models/:generateContent`. An API key is sent in the `x-goog-api-key` header. No other vault notes are read for generation; no client telemetry, advertising, remote code or automatic plugin updates are included. Generation is stateless and does not create an Interactions conversation. A rejected structured-output request may be repeated once in JSON MIME mode; explicit 429/5xx responses can also be retried as documented below. This does not override Google's data policies. In particular, free-service content may be used to improve Google products. Do not submit sensitive notes unless your Google terms and data controls are appropriate. Read the [Gemini API terms](https://ai.google.dev/gemini-api/terms). API keys use Obsidian Secret Storage; select/create the secret separately on each device as needed. Other installed plugins share Obsidian's privileges: Secret Storage is not a sandbox against malicious plugins. Generated HTML, embeds, Markdown links and tags are neutralized before saving. The source link is generated by Obsidian. Evidence is shown as text and is never written to the deck. Unsupported/conflicting cards start unchecked; a user may explicitly approve a warning. Limits: 100,000 source characters; 8,000 prompt characters after substitution; 1 MiB successful JSON response; 2,000 characters per field; 8,192 maximum output tokens. Oversized inputs are rejected, not silently truncated. Cancellation prevents further work and ignores late results, but Obsidian's `requestUrl` does not abort the underlying transport, so a sent request may still be processed/billed. A 90-second timeout is applied per attempt. Explicit HTTP 429/5xx may be retried up to three times; ambiguous network failures and timeouts are not automatically retried. Once you confirm saving and `vault.create` starts, closing the window cannot undo that committed write. Destination validation excludes hidden/config folders and traversal, and checks Unicode filename byte limits for Linux/mobile. No access outside the vault is requested. SR's saved settings may be read from the vault's configured plugin directory to resolve separators. See the [dated audit and test limitations](docs/SECURITY-AUDIT.md). Native Linux, Android and iOS testing is still pending; browser viewport checks are not device certification. ## Development Use Node.js 22.12+ and the committed lockfile: ```sh npm ci npm run check npm audit ``` `check` runs regression tests, TypeScript, the production bundle and a release verifier. The verifier checks reproducibility, metadata and that Obsidian is the only external runtime dependency. `npm run dev` watches source; `npm run ui:smoke` starts a localhost-only mock UI for responsive and cancellation checks (no real vault or Gemini). GitHub Actions is configured to run tests/build/audit on Ubuntu and Windows. Those jobs only run after the repository is published. They test the code, not the native Obsidian application. ## License [MIT](LICENSE). This is an independent plugin. It integrates with Spaced Repetition's Markdown format; its scheduler and source code are not bundled.