Ideon v0.9.6

Security

• Fixed an SSRF protection bypass (GHSA-fwh7-rv72-xh5q) where IPv6 transition addresses could embed private IPv4 addresses and bypass the SSRF blocklist. Reported by @tonghuaroot.

Ideon v0.9.5

Security

• Fixed an unauthenticated SSRF relay (GHSA-vpc2-r395-534p) where the /api/links/preview endpoint accepted requests without a valid session, allowing anyone to use the server as an anonymous outbound HTTP relay. The endpoint now requires authentication. Additionally, closed a gap in the SSRF blocklist where 0.0.0.0 (and IPv6 :: / ::0) was not blocked — on Linux these addresses route to the loopback interface at the kernel level. Reported by @de3erve.

Ideon v0.9.4

Security

• Fixed a privilege escalation vulnerability (GHSA-v3qr-4v8m-29rh) where a read-only collaborator could perform write and delete operations on a project, including wiping and replacing the entire canvas. Reported by @tonghuaroot.
• Fixed an SSRF bypass (GHSA-cvcr-fcf6-366r) in the image proxy where IPv4-mapped IPv6 addresses (e.g. [::ffff:7f00:1]) could bypass the private IP blocklist and reach internal services. Reported by @tonghuaroot.

Ideon v0.9.3

Added

• Added MCP Server — Ideon now exposes a Model Context Protocol endpoint at POST /api/mcp (Streamable HTTP transport). AI agents from Claude Code, Cursor, or any MCP-compatible client can read and manipulate the canvas programmatically (See Guide).

Fixed

• Fixed Vim editor showing empty content on collaborative NoteBlocks after page refresh. Edits made in Vim mode now persist correctly and remain visible across reloads #111.
• Fixed file upload error handling crash when the server response is not valid JSON (e.g. proxy timeout, network interruption). The client now gracefully handles non-JSON error responses instead of throwing a SyntaxError #110.

Ideon v0.9.2

Added

• Added Inline Comments — select text in a NoteBlock to leave comments and start threaded discussions with collaborators. Sync in real-time, and are accessible via Ctrl+Alt+M.

Fixed

• Fixed NoteBlock collaborative editing architecture. Replaced the broken React state ↔ Yjs observer roundtrip with y-prosemirror's direct Y.XmlFragment binding, eliminating infinite loops and "Invalid string length" crashes. Content now flows directly between ProseMirror and Yjs without passing through React state #107.
• Fixed core block collision bounds not updating after resizing, which allowed blocks to overlap the core block or hit an invisible border #106.

Ideon v0.9.1

Added

• Added Calendar Block — a new block type for tracking events and deadlines on the canvas. Features a monthly view with event cards, color-coded events, completion status and .ics import support, allowing users to import events from calendar exports directly into Ideon.

Fixed

• Fixed reaction buttons being unclickable when a block is selected, and always unresponsive on the folder block #104.
• Fixed multi-block drag so all selected blocks move as a single rigid group, and hide alignment guides between selected blocks #105.

Ideon v0.9.0

The canvas starts acting on its own. Blocks can now listen for events, run on a schedule, and take action — no user session required.

New features

⚡ Webhook Block
Drop one on the canvas and it becomes a live HTTP endpoint. Any service capable of sending an HTTP POST — CI pipelines, form backends, payment providers, monitoring alerts, internal scripts — can drive it. Set conditions to filter events, choose what happens on a target block (change its visual state, update its color, create a Kanban task, prepend text to a note), and the block handles the rest. The endpoint URL and signing secret are shown inline. Last trigger time and status are visible at a glance. Runs server-side 24/7, no open browser required.

🕐 Cron Block
Same action set as the Webhook Block, but fired on a schedule instead of an event. Pick a preset (hourly, daily at 9 AM, every Monday morning) or write a custom cron expression. The job runs on the server — it doesn't need anyone logged in.

LaTeX Block
Write and display mathematical notation directly on the canvas. Use $...$ for inline expressions and $$...$$ for display equations in edit mode, then switch to preview to see them rendered. Supports Vim mode and the same Ctrl+P shortcut as the Note block.

🔐 Proxy / Header Authentication
A new authentication mode for self-hosted deployments behind a trusted reverse proxy (nginx mTLS, Traefik, Authelia, and similar stacks). When enabled, Ideon reads the user identity from configurable HTTP headers set by the proxy and signs in automatically — no OAuth round-trip, no password flow. All sign-in and provisioning events are recorded in the audit log.

Edge resize handles
Blocks can now be resized from any edge, not just corners. Edge handles resize in a single axis only and snap to neighboring block edges with the same alignment guides as dragging. Hold Shift to disable snapping.

---

Under the hood

• Server-side webhook and cron execution engine — no client connection required for triggers
• {{payload.field}} template resolution for passing incoming data into block actions
• Proxy auth header parsing integrated into the request pipeline, with full audit coverage

---

What's next

More event sources, richer condition logic, and actions that write back — closing the loop between what happens outside and what the canvas reflects.

Ideon v0.8.6

Fixed

• Fixed block titles and other fields being lost on first open of imported or newly created projects, caused by the Yjs SQL seed query missing the data column #96.

Ideon v0.8.5

Added

• Added project export and import. Right-click any project you own to download it as a .ideon file (a ZIP archive containing all blocks, links, and file attachments). An "Import project" button next to "New Project" on the dashboard lets you restore or migrate a project from that file — on import, you become the owner of all blocks #95.

Fixed

• Fixed an allocation size overflow crash caused by corrupted Yjs state accumulated in browser IndexedDB by the 0.8.4 rapid-input bug. The WebSocket connection is now deferred until after local IndexedDB loads and passes an encode validation, replacing the previous byte-size heuristic #91.
• Fixed note block title changes triggering canvas crashes by debouncing the title input handler and clamping oversized content before propagation #91.

Ideon v0.8.4

Added

• Added Frames, a new block type that lets you group blocks into named, colored zones on the canvas. Moving a frame moves all blocks inside it. Hold Shift while dragging to reposition the frame independently of its contents. Click the color swatch in the frame header to pick any color.

Fixed

• Fixed a canvas crash that occurred when holding Backspace in a note block #87.