CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The Ideon project follows the Keep a Changelog format and uses Semantic Versioning.

[0.9.6] - 2026-07-26

Security

• Fixed an SSRF protection bypass (GHSA-fwh7-rv72-xh5q) where IPv6 transition addresses could embed private IPv4 addresses and bypass the SSRF blocklist. Reported by @tonghuaroot.

[0.9.5] - 2026-07-10

Security

• Fixed an unauthenticated SSRF relay (GHSA-vpc2-r395-534p) where the /api/links/preview endpoint accepted requests without a valid session, allowing anyone to use the server as an anonymous outbound HTTP relay. The endpoint now requires authentication. Additionally, closed a gap in the SSRF blocklist where 0.0.0.0 (and IPv6 :: / ::0) was not blocked — on Linux these addresses route to the loopback interface at the kernel level. Reported by @de3erve.

[0.9.4] - 2026-07-03

Security

• Fixed a privilege escalation vulnerability (GHSA-v3qr-4v8m-29rh) where a read-only collaborator could perform write and delete operations on a project, including wiping and replacing the entire canvas. Reported by @tonghuaroot.
• Fixed an SSRF bypass (GHSA-cvcr-fcf6-366r) in the image proxy where IPv4-mapped IPv6 addresses (e.g. [::ffff:7f00:1]) could bypass the private IP blocklist and reach internal services. Reported by @tonghuaroot.

[0.9.3] - 2026-07-01

Added

• Added MCP Server — Ideon now exposes a Model Context Protocol endpoint at POST /api/mcp (Streamable HTTP transport). AI agents from Claude Code, Cursor, or any MCP-compatible client can read and manipulate the canvas programmatically (See Guide).

Fixed

• Fixed Vim editor showing empty content on collaborative NoteBlocks after page refresh. Edits made in Vim mode now persist correctly and remain visible across reloads #111.
• Fixed file upload error handling crash when the server response is not valid JSON (e.g. proxy timeout, network interruption). The client now gracefully handles non-JSON error responses instead of throwing a SyntaxError #110.

[0.9.2] - 2026-06-19

Added

• Added Inline Comments — select text in a NoteBlock to leave comments and start threaded discussions with collaborators. Comments can be resolved and reopened, sync in real-time, and are accessible via Ctrl+Alt+M.

Fixed

• Fixed NoteBlock collaborative editing architecture. Replaced the broken React state ↔ Yjs observer roundtrip with y-prosemirror's direct Y.XmlFragment binding, eliminating infinite loops and "Invalid string length" crashes. Content now flows directly between ProseMirror and Yjs without passing through React state #107.
• Fixed core block collision bounds not updating after resizing, which allowed blocks to overlap the core block or hit an invisible border #106.

[0.9.1] - 2026-06-07

Added

• Added Calendar Block — a new block type for tracking events and deadlines on the canvas. Features a monthly view with event cards, color-coded events, completion status and .ics import support, allowing users to import events from calendar exports directly into Ideon.

Fixed

• Fixed reaction buttons being unclickable when a block is selected, and always unresponsive on the folder block #104.
• Fixed multi-block drag so all selected blocks move as a single rigid group, and hide alignment guides between selected blocks #105.

[0.9.0] - 2026-05-30

Added

• Added Webhook Block — a new block type you drop on the canvas that becomes a live HTTP endpoint. Any service capable of sending an HTTP POST can drive it: CI systems, form submissions, payment providers, monitoring tools, internal scripts, or anything else. Configure conditions to filter events, then choose what happens on the target block — set its visual state, update its color, create a Kanban task, or prepend text to a note. The block displays the endpoint URL and secret inline, shows the last trigger timestamp and status, and runs server-side 24/7 with no user connection required. Payload fields are accessible in action parameters using {{payload.field}} templates.
• Added Cron Block — a new block type that fires an action on a configurable schedule. Pick a preset (hourly, daily at 9 AM, every Monday morning, or a custom cron expression) and a target block, and the action executes automatically on the server. Supports the same action set as Webhook Block (visual state, color, Kanban task, note).
• Added LaTeX Block — a new block type for writing and displaying mathematical notation on the canvas. Write raw LaTeX in edit mode using $...$ for inline math and $$...$$ for display equations, then switch to preview mode to see them rendered. Supports vim mode and the same Ctrl+P shortcut as the Note block #102.
• Added Proxy / Header Authentication — a new authentication mode for self-hosted deployments behind a trusted reverse proxy (nginx mTLS, Traefik, Authelia, etc.). When enabled, Ideon reads the user identity from configurable HTTP headers injected by the proxy and signs in automatically, without an OAuth or password flow. Configure via environment variables. All sign-in and provisioning events are recorded in the audit log #103.
• Blocks can now be resized from any edge in addition to corners, resizing in a single axis only. Resizing snaps to other blocks edges the same way dragging does, with alignment guides and Shift to disable #100.

[0.8.6] - 2026-05-25

Fixed

• Fixed block titles and other fields being lost on first open of imported or newly created projects, caused by the Yjs SQL seed query missing the data column #96.

[0.8.5] - 2026-05-20

Added

• Added project export and import. Right-click any project you own to download it as a .ideon file (a ZIP archive containing all blocks, links, and file attachments). An "Import project" button next to "New Project" on the dashboard lets you restore or migrate a project from that file — on import, you become the owner of all blocks #95.

Fixed

• Fixed an allocation size overflow crash caused by corrupted Yjs state accumulated in browser IndexedDB by the 0.8.4 rapid-input bug. The WebSocket connection is now deferred until after local IndexedDB loads and passes an encode validation, replacing the previous byte-size heuristic #91.
• Fixed note block title changes triggering canvas crashes by debouncing the title input handler and clamping oversized content before propagation #91.

[0.8.4] - 2026-05-01

Added

• Added Frames, a new block type that lets you group blocks into named, colored zones on the canvas.

Fixed

• Fixed a canvas crash that occurred when holding Backspace in a note block #87.

[0.8.3] - 2026-04-19

Added

• Redesigned the home page into a proper dashboard so you land somewhere useful every time you open Ideon.
• Added a search bar to the dashboard.
• Added a project tab bar at the top of the workspace showing all projects in the selected folder, making it easy to switch between projects without navigating back to the dashboard.
• Added a collapsible folder tree in the sidebar under "My Projects", listing your folders for quick one-click navigation.
• Added multi-selection in the dashboard: Ctrl+Click or checkbox to select multiple projects and folders, then press Delete/Suppr or use the floating bar to delete them in bulk.
• Added the ability to choose where a new project should be created, so you can place it in the right folder.

[0.8.2] - 2026-04-15

Added

• Added task relationships across Kanban boards so you can link work between tasks anywhere in the same project #71.
• Added canvas search to quickly find and focus blocks and Kanban tasks from the top bar or advanced modal #83.

Fixed

• Fixed note blocks losing focus immediately on click, requiring users to hold LMB to type #84.

[0.8.1] - 2026-04-08

Fixed

• Improved canvas undo/redo behavior to make action history more precise and more reliable during everyday editing.
• Fixed intermittent Allocation Size Overflow canvas freezes by clamping oversized note sync payloads, guarding Yjs text reads, and auto-repairing poisoned project content on load/save #67.
• Fixed Kanban task descriptions not rendering on cards by adding snippet display. Task description field now supports view/edit toggle with markdown rendering #80.

[0.8.0] - 2026-04-03

Added

• Introduced a major Kanban block overhaul with richer task management, including assignees, custom fields/labels, and expanded board interactions.
• Added support for exporting Excalidraw sketches as .excalidraw files.
• Split block locking into separate content and position controls to prevent accidental moves during collaboration while preserving edit control #78.

Fixed

• Completed the viewer block-move fix by preventing local drag interactions and forcing viewer canvas state to reset from synced project state on open.
• Fixed note content loss when previewing or applying temporal snapshots #76.
• Fixed markdown table persistence in note blocks so tables no longer degrade to [Table] when toggling Preview/Edit, including Vim-mode workflows #79

[0.7.7] - 2026-03-30

Fixed

• Prevented invited users with view-only permissions from moving blocks on the canvas #74

[0.7.6] - 2026-03-29

Added

• Added Ability to copy multiple blocks content by concatenating them in the order they were selected.
• Added ability to set the application's log level via environment variables.
• Added Ctrl+E and Ctrl+P note block shortcuts to switch between edit and preview modes while preserving inline code formatting and command palette conflicts.
• Added Duplicate option in the block context menu to quickly duplicate a block.

Fixed

• Fixed blurry content when zooming out in the canvas.
• Fixed OIDC/SSO login lockout for invited or existing users when the provider returned email_verified=false #62.

[0.7.5] - 2026-03-23

Fixed

• Fixed a memory leak in the block editors when Vim mode is enabled.
• Minor fixes and improvements to enhance the user experience.

[0.7.4] - 2026-03-20

Fixed

• Fixed poor readability of folder cards in light mode dashboard view #61.

[0.7.3] - 2026-03-19

Added

• Updated sync indicator to accurately reflect WebSocket connection issues #59.

[0.7.2] - 2026-03-18

Added

• Create blocks and folders by dragging an arrow onto the canvas #57.

[0.7.1] - 2026-03-16

Fixed

• Fixed an issue where the markdown bubble menu would not appear when expected.
• Fixed UUID generation in non secure contexts by replacing "crypto.randomUUID" with "uuidv4"
• Fixed Vercel integration to always keep PAT enabled, with optional OAuth.
• Fixed touch gestures experience on mobile and touchscreen devices.

[0.7.0] - 2026-03-16

Added

• Our First Integration: Obsidian Import: Ideon now supports importing Obsidian vaults directly into projects.
• Vercel Integration: Ideon now supports deploying and monitoring Vercel projects directly from the canvas.
• Excalidraw Block (SDK expanded): Replaced the old Sketch Block with a full Excalidraw integration, expanding the block SDK to support more drawing tools and collaborative features.
• Folder Block: Added a new folder block to group related blocks and quickly collapse or expand them for a cleaner, more organized canvas.
• Drag and Drop Import: You can now drag and drop files, text, folders, and even Excalidraw sketches directly onto the project canvas. Imported content is automatically recognized and added as the appropriate block type, with real-time progress and visual feedback.
• Audio and Video Support: Added native playback support for common audio and video files directly inside the File Block.
• Vim Mode: Added an optional Vim mode for text editors (Note Block and Snippet Block), which can be toggled in the Account settings.

[0.6.2] - 2026-03-12

Fixed

• Fixed multiple issues related to Link block metadata handling and rendering behavior.
• Fixed block teleportation during canvas resize when another block was focused.
• Fixed canvas crashes caused by malformed or incomplete block metadata by normalizing parsed metadata shapes and by hardening canvas hydration.

[0.6.1] - 2026-03-09

Added

• Alignment Helper Lines: Visual guide lines now appear when dragging nodes to help align them with other blocks. Shows horizontal and vertical alignment guides.
• Sketch Block Custom Color Picker: Added an option allowing users to select any custom color using hex input or gradient picker.

[0.6.0] - 2026-03-07

Added

• NEW Kanban Block: Added a minimal Kanban block with customizable columns and drag and drop support for tasks between the Kanban and checklist blocks.
• Improved Mobile Experience: Completely improved the mobile UI and layout to ensure the application works smoothly on smartphone portrait screens.
• Camera Centering on Keyboard Navigation: the viewport now smoothly centers on blocks when navigating with arrow keys or vim keys (h/j/k/l), making it easier to follow focus across the canvas.

Fixed

• Fixed multiple sketch block issues, including disappearing or delayed drawings, and improved real-time rendering.
• Fixed security audit logging failures in Docker PostgreSQL deployments by preventing nested transaction conflicts. Audit events for project operations (create, delete, etc.) now log successfully.

[0.5.4] - 2026-03-04

Added

• Automated Snapshots: the canvas now automatically saves snapshots after significant actions.
• Sync Status Indicator: a real-time connection indicator shows the current sync state.
• Sketch Block Eraser Customization: the eraser tool now supports custom size input (1-100px) in addition to the preset sizes.

[0.5.3] - 2026-03-02

Changed

• PostgreSQL 16 → 18: upgraded the officially supported PostgreSQL version. Existing PostgreSQL 16 deployments continue to work without any changes. If you want to upgrade, see the migration guide.

Fixed

• Fixed all remaining Row-Level Security (RLS) issues, including critical failures when running on PostgreSQL 18. These fixes pave the way for migrating Ideon's officially supported PostgreSQL version from 16 to 18.
• Improved overall CPU usage when working inside the canvas.

[0.5.2] - 2026-03-02

Added

• Create Block Modal — replaced the context menu block list with a searchable grid modal (Ctrl+A) for adding blocks. Features all block types with icons and a search input
• Shell Block — a fully interactive terminal embedded in the canvas, powered by xterm.js and node-pty. Supports start/stop/kill lifecycle: Stop pauses the session while preserving the scrollback buffer for instant resume, Kill destroys the session entirely. Zero RAM consumption when stopped. Restricted to project creators and owners.
• Changelog Viewer — when an update is available, the version badge tooltip now includes a "See changes" link. Clicking it opens a modal that fetches the changelog directly from Internet, with all versions newer than the current one subtly highlighted.

[0.5.1] - 2026-02-28

Added

• Added a Command Palette (Ctrl+P) displaying all keyboard shortcuts in a searchable card grid, with a discreet hint button on the canvas.

[0.5.0] - 2026-02-27

Added

• Added drag-and-drop reordering for checklist items.
• Added keyboard navigation for the canvas (Arrow keys and Vim keys h/j/k/l).
• Added Enter shortcut to enter edit mode on a selected block.
• Added Escape shortcut to unselect all blocks.
• Added common keyboard shortcuts (Ctrl+B/I/U/K, Undo/Redo) to the Markdown editor.
• Added GIT_ALLOWED_HOSTS environment variable to allow fetching stats from internal/private Git repositories (bypassing SSRF protection for specified hosts).

Improved

• Improved block title layout to handle long text gracefully (ellipsis, better resizing).
• Improved scrolling behavior in Account settings with better section positioning.

Fixed

• Fixed Git block stats not refreshing correctly by disabling aggressive caching and ensuring timestamp updates even when stats are unchanged. Added error indicator for failed fetches.

[0.4.5] - 2026-02-25

Added

• Added support for Tables and Task Lists (checkboxes) in the Markdown editor (Note Block).

Fixed

• Fixed a critical issue where project pages would return 404 on PostgreSQL by ensuring all queries run within an authenticated RLS session (#46).
• Resolved Docker permission issues and significantly improved build times by optimizing the entrypoint script (#45).

[0.4.4] - 2026-02-23

Fixed

• Resolved a race condition during project loading where blocks would briefly appear and then disappear. The system now waits for remote synchronization before initializing the canvas, ensuring a stable and consistent view for large projects.

[0.4.3] - 2026-02-21

Added

• Introduced 4 distinct project roles (Creator, Owner, Editor, Viewer) to separate management privileges from content editing and read-only access.

• A new "Request Access" workflow allows users to ask for an invitation to private projects. Owners can now approve or reject these requests directly from the project settings.

Fixed

• Resolved a critical privacy issue where private projects could be incorrectly visible to other users on the dashboard. Your projects are now properly secured and only visible to you and your team.

[0.4.2] - 2026-02-19

Improved

• Light theme readability and small comfort improvements across the interface.
• General UX polish to make interactions feel smoother.

Changed

• Large internal refactor to improve maintainability.
• Split oversized files into smaller modules and removed redundant code.
• Simplified structure to make future contributions easier.

[0.4.1] - 2026-02-17

Security

Fixed several vulnerabilities:

• SSRF Protection: Implemented strict validation on the image proxy to block private IP access and enforce HTTPS (OWASP SSRF, CWE-918).
• WebSocket Security: Added strict Origin validation to prevent Cross-Site WebSocket Hijacking (OWASP CSWSH, CWE-346).
• IP Spoofing: Implemented trusted proxy-aware IP extraction for accurate client identification (OWASP Logging, RFC 7239).

[0.4.0] - 2026-02-15

Added

• Emoji reactions on blocks to enable quick feedback during collaboration without editing content
• Edge labels to clarify relationships between blocks and improve visual structure.
• Permanent “Empty Trash” option allowing users to fully clear deleted items and remove all related project content in one action.

Improved

• Performance improvements across the app.
• UX refinements to make interactions smoother and more responsive.
• Overall user experience enhancements.

Fixed

• Fixed project creation failure due to missing ownerId in session by implementing robust token fallback (#42).

[0.3.4] - 2026-02-13

Fixed

• Resolved an infinite recursion error in PostgreSQL RLS policies that prevented project creation in v0.3.3 (#40).

[0.3.3] - 2026-02-13

Added

• Support for touch devices with long-press gestures, allowing access to all context menus (including block creation on the canvas) (#37).

Fixed

• Resolved permission issues when using bind mounts by implementing a dynamic entrypoint script that automatically manages directory ownership (#38).

[0.3.2] - 2026-02-12

Added

• New Sketch block type for freehand drawing and annotations.

[0.3.1] - 2026-02-11

Added

• Added support for private repositories using personal access tokens.
• Compatible with GitHub, GitLab, Gitea, and Forgejo (including self-hosted instances).

[0.3.0] - 2026-02-10

Added

• Public project sharing via shareable links
• Project organization using folders
• Full project export as a single image

Fixed

• Resolved an issue where opening large projects could cause the application to crash.

[0.2.8] - 2026-02-07

Added

• Miscellaneous bug fixes and performance improvements.

[0.2.7] - 2026-02-06

Added

• Checklist Progress: Added visual progress tracking to checklist blocks with dynamic color indicators to easily monitor task completion.
• Application Version Tracking: Added a new system directly in the sidebar to monitor your current application version and instantly check for available updates.

[0.2.6] - 2026-02-05

Added

• New Dashboard Navigation: Introduced a unified "Home" section with collapsible views for streamlined access.
• New Project Views:
  • My Projects: Displays only the projects owned by you.
  • Shared with me: Dedicated view for projects shared with you as a collaborator.
  • Starred: Mark important projects as favorites for instant access.
  • Recent: Automatically tracks and lists your most recently opened projects.
  • Trash: Safe deletion workflow with options to restore or permanently delete projects.

[0.2.5] - 2026-02-04

Added

• Implemented Undo/Redo system with keyboard shortcuts (Ctrl+Z/Y) and UI controls.
• Added "Don't ask again" option to the block deletion confirmation modal, allowing users to skip future confirmations.
• Added Tab shortcut for creating child blocks. Pressing Tab on a selected block now creates a connected child block in the appropriate direction.

[0.2.4] - 2026-02-03

Security

• Fixed Server-Side Request Forgery (SSRF) vulnerability in the link metadata service by implementing strict URL validation and blocking private IP ranges.
• Enforced mandatory SECRET_KEY or AUTH_SECRET environment variables. The application will now fail to start if no secret is configured, preventing insecure deployments.

Fixed

• Fixed metadata fetching for bare domains (e.g., google.com) by automatically normalizing URLs to use HTTPS.

[0.2.3] - 2026-02-03

Fixed

• Fixed CI/CD workflow to prevent incomplete Docker builds on documentation changes (#18)
• Quoted OpenSSL string generation to prevent escape character issues during setup

Added

• Added a hover badge on git, link, and contact blocks to make editing more discoverable and intuitive

[0.2.2] - 2026-02-02

Fixed

• Fixed context menu behavior and right-click interactions on blocks.
• Fixed critical JWTSessionError where Edge Middleware and Node.js Runtime were using mismatched secret configurations, causing login loops and WebSocket rejections.

[0.2.1] - 2026-02-02

Security

• Removed INTERNAL_SECRET environment variable and legacy key derivation logic to prevent potential authentication bypass.

Fixed

• Fixed MIDDLEWARE_INVOCATION_FAILED error on Edge Runtime (Vercel) by removing Node.js-specific dependencies from middleware.
• Resolved system setup check failures by moving verification logic from client-side to server-side layout.

[0.2.0] - 2026-02-01

Added

• Added dynamic language loading system: new languages can now be added simply by dropping a JSON file into the i18n directory.

• Added Prettier integration in Snippet Blocks for automatic code formatting.

• Added Tiptap bubble menu for text formatting (bold, italic, etc.) to assist users unfamiliar with Markdown.

• Added support for top and bottom connectors on blocks to allow more flexible flow layouts.

• Support for self-hosted Git providers (GitLab, Gitea, Forgejo) in addition to GitHub. Auto-detection of Git provider based on URL.

• Enhanced OIDC compatibility: added support for multiple profile picture fields (picture, avatar, avatar_url) to handle diverse OIDC providers (e.g., Keycloak, Authentik).

• Added option to authorize SSO and block public registration page separately.

[0.1.0] - 2026-01-24

Vision

Ideon addresses the cognitive load of modern software development. By bringing code, design, and decision-making into a single spatial interface, it transforms abstract project metadata into a tangible, navigable map. The goal is to maintain a shared mental model across the entire lifecycle of a product, ensuring that the "why" and "how" remain accessible alongside the "what".

Technology Stack

Built on a bleeding-edge foundation to ensure performance, security, and type safety:

• Framework: Next.js 16 (App Router) & React 19
• Language: TypeScript
• Data Layer: PostgreSQL with Kysely
• Real-time Engine: Yjs (CRDTs) over WebSockets
• Authentication: NextAuth.js v5
• Security: HKDF key derivation & AES-256-GCM encryption

Core Features

• Spatial Workspace: An infinite canvas powered by ReactFlow for organizing project components visually
• Universal Blocks: First-class support for diverse content types:
  • Rich Text & Markdown
  • GitHub Repositories
  • Code Snippets
  • File Attachments
  • External Links
  • Color Palettes
  • Contact Cards
• Multiplayer Collaboration: Real-time cursor tracking and concurrent editing enabled by CRDTs
• Temporal State: Comprehensive history tracking to view and revert project evolution over time
• Security:
  • Field-level encryption with Argon2id for sensitive data
  • Comprehensive audit logging for all critical actions
• Internationalization: Native i18n support: English and French (for now...)
• Deployment: Fully dockerized with Docker Compose for easy self-hosting