Changelog

What's new in Alex

v0.6.0March 2, 2026

Added reverse relay service for public access from the desktop app — flip a toggle in Settings and share a URL like gentle-morning-tide.alexreader.app
Relay streams PDFs and EPUBs in 64 KB chunks with automatic reconnection and persistent URLs
Added dual authentication so desktop (Electron session) and web (NextAuth credentials) auth coexist on the same server
Added collection sharing over relay with a simplified Users page showing your public server URL
Docker runtime now runs as a non-root user
Added security headers (CSP, X-Content-Type-Options, etc.) on all responses
Authenticated SSE endpoints to prevent unauthenticated access to library events
Added structured JSON logging for relay with client IP and request duration
Added conductor scripts (setup, dev, cleanup) for local development
Fixed relay dropping Set-Cookie headers that broke remote login
Fixed middleware redirects behind relay by honoring x-forwarded-* headers
Fixed desktop auth bypass with Electron session tokens

Added a reverse tunnel relay service (alex-relay) so the desktop app can be accessed publicly without port forwarding
Added dual authentication: NextAuth.js credential auth for web, per-session header-based token auth for Electron desktop
Pinned cookie configuration to prevent mismatches behind reverse proxies (relay, load balancers)
Added forwarded header support (X-Forwarded-Host, X-Forwarded-Proto) for correct redirects behind the relay
Added Storybook UI component library with stories for all components and Chromatic CI visual testing
Added security headers (CSP, X-Content-Type-Options, etc.) to Next.js responses
Added user management API endpoints (GET/POST /api/users, PATCH /api/users/[id])
Added collection book management endpoints (GET/POST /api/collections/[id]/books, DELETE .../books/[bookId])
Added admin library clear endpoint (POST /api/admin/library/clear)
Made admin seed idempotent with INSERT...ON CONFLICT DO UPDATE (safe to re-run on every launch)
Run Docker container as non-root user for improved security
Added structured JSON logging for relay with client IP and request duration
Added dev build workflow for integration testing
Stabilized Electron E2E tests with improved startup, port management, and platform skip handling
Desktop and web auth can now coexist on the same server
Bumped version to 0.5.0

Added an admin password reset flow in Settings → Users via a new Change Password action
Updated Electron desktop settings behavior so Settings opens at Users and hides General/Log out
Fixed a TypeScript dashboard navigation typing issue that caused CI build failures
Updated docs to reflect the new password reset path and desktop-mode settings behavior

Fixed Docker container not reachable over HTTP by binding the Next.js server to 0.0.0.0
Fixed 404 errors for all static assets (JS, CSS, fonts) in Docker by placing them where the standalone server expects them
Fixed runtime database access failure caused by the Next.js standalone server changing the working directory on startup

Hardened credentials authentication to handle missing users table initialization safely
Improved login resilience by normalizing legacy password field variants
Added automatic auth DB bootstrap/seeding fallback to prevent first-login configuration failures

Rewrites the file watcher and database layer in Rust (watcher-rs) for lower memory usage and faster startup
Replaces Chokidar with the Rust notify crate for file watching
Replaces better-sqlite3 and Drizzle ORM with rusqlite (statically linked SQLite) accessed through a Rust bridge binary
Replaces pdfjs-dist and @napi-rs/canvas cover generation with pdfium-render (Rust)
Replaces pdf-parse and epub2 metadata extraction with lopdf and quick-xml (Rust)
The watcher-rs binary now serves as both the file watcher and the database bridge for Next.js
Requires a Rust toolchain for building from source (Docker and desktop builds include the pre-compiled binary)

Adds end-to-end tests for web and Electron to ensure stability
Removes Windows builds for now
Fixes an issue in the watcher where duplicate entries would cause subsequent legitimate additions to fail

Switched macOS distribution from DMG to ZIP to avoid app damage errors
Added ad-hoc code signing for macOS desktop builds
Fixed missing ALEX_DESKTOP CI env var and bypassed auth middleware in desktop mode
Installed poppler in CI for PDF cover generation
Temporarily disabled Windows and Linux desktop builds

Stabilized EPUB chapter navigation, auto-advance, and position restore behavior
Improved EPUB theme colors and dark mode handling
Refined the monochrome UI redesign and shared branding components
Fixed PDF reader restore positioning
Added documentation and planning artifacts for public collections and OPDS feeds