v0.1.0-beta.4

Docker /data self-heal + server boot diagnostics

The image now fixes volume ownership at every start (root entrypoint → chown → drop to the app user), so pre-created empty volumes (Coolify-style, where Docker skips image copy-up) no longer fail admin creation with EACCES. The server also diagnoses /data problems at boot instead of surfacing them only at setup time.

🐛 Bug Fixes

• EACCES on admin creation with pre-created volumes — root-owned /data failed config.json writes. New root entrypoint (docker-entrypoint.sh) chowns /data then drops to the docubook user via su-exec — idempotent, fixes fresh/legacy volumes at every start; no manual docker run --rm chown needed

🚀 Features

• Boot-time /data diagnostics — startup logs warn when config.json is missing (fresh /data — volume not persisted across redeploys) and when /data is not writable (volume ownership), each with the exact fix command

🧪 Testing

• E2E redeploy persistence — web-smoke restarts the server with the same DATA_DIR after setup and asserts the admin survives (setupRequired=false, login page instead of the setup wizard) — covers the "admin lost after docker pull/redeploy" scenario

---

macOS (Apple Silicon — *-arm64.dmg): first run may show “app
is damaged.” Clear the quarantine flag once:

xattr -cr "/Applications/DocuBook.app"

macOS (Intel — *-amd64.dmg): right-click the app → Open →
Open Anyway on the Gatekeeper dialog.

v0.1.0-beta.3

Named themes + project layout refactor

Theme system migrates to Tailwind v4 @theme tokens with two named themes (Midnight / Bright Surfaces), the desktop titlebar finally follows the app theme, and the repository layout is reorganized (frontend/ + server/ + flattened src-tauri/).

🚀 Features

• Named themes (Zed-style) — Settings → Appearance: pick Midnight (dark, default) or Bright Surfaces (light). Palettes live in @theme tokens (bg-background, text-foreground, …); light mode corrects the hardcoded zinc text that was invisible on white
• Titlebar follows the app theme — Tauri window theme: Dark config + window.setTheme() runtime; fixed the ACL gap (core:window:allow-set-theme) that silently blocked theme switching; meta theme-color drives the web browser chrome
• Show/hide password — new PasswordInput on the web login and change-password forms (eye toggle, type="button", aria-labeled)
• E2E Playwright suites — theme-check (12 assertions: dark/light/picker/persist) + web-smoke (4 assertions: health, setup wizard, logout, login against the real server)

🔄 Refactor

• Layout — src/ → frontend/, src-tauri-server/ → server/ (flattened, [[bin]] path = main.rs), src-tauri/src/ flattened to crate root; all configs, CI, Dockerfile, docs updated; server reuses desktop modules via #[path]
• Markdown module deduped — markdown.rs shared by desktop + server via #[path] include (was copy-pasted twice); snapshot tests lock the HTML contract for both
• Testing hardening — 9 API integration tests (axum tower::oneshot: setup token gate, rate limits, session, path allowlist), store tests now exercise the real useAiSettings (was a copy), regression tests for setup-token + git-poll skip, tsc/clippy CI blockers fixed
• Zinc → tokens — hardcoded zinc text/hover colors migrated to theme tokens (light-theme visibility)

---

macOS (Apple Silicon — *-arm64.dmg): first run may show “app
is damaged.” Clear the quarantine flag once:

xattr -cr "/Applications/DocuBook.app"

macOS (Intel — *-amd64.dmg): right-click the app → Open →
Open Anyway on the Gatekeeper dialog.

v0.1.0-beta.2

Setup-token guard completed (UI + docs)

DB_SETUP_TOKEN now works end-to-end: the setup wizard asks for the token when the server requires it, and the token format is documented.

🚀 Features

• Setup wizard token field — setup_status reports whether a token is required (setupToken); the wizard shows the "Setup token" input only then and submits it with setup_admin. Previously the wizard could never complete when DB_SETUP_TOKEN was set
• Token format documented — DB_SETUP_TOKEN is a plain secret string (not a JWT), compared verbatim; openssl rand -hex 32 example in .env.example / docker-compose.yml

🔄 Version

• Bumped to 0.1.0-beta.2 across package.json, src-tauri/Cargo.toml, src-tauri-server/Cargo.toml, src-tauri/tauri.conf.json, lock files (package-lock was stale at alpha.6 — synced)

---

macOS (Apple Silicon — *-arm64.dmg): first run may show “app
is damaged.” Clear the quarantine flag once:

xattr -cr "/Applications/DocuBook.app"

macOS (Intel — *-amd64.dmg): right-click the app → Open →
Open Anyway on the Gatekeeper dialog.

v0.1.0-beta.1

Web (Docker) distribution + admin account

Same codebase now ships as a self-hosted web server (docubook/editor image): the React frontend served over HTTP, backed by the same Rust modules as the desktop app — no extra build steps, docker pull and run. Desktop distribution (DMG) is unchanged.

🚀 Features

• Web server (src-tauri-server) — axum HTTP server reusing the desktop vault/wiki/git/search/agent modules via #[path] includes; single binary serving the built frontend + /api/*; SSE streaming for AI
• Setup wizard on first run — create the admin account (Argon2id, session cookie HttpOnly/SameSite=Strict, login rate-limited 5×/min). Headless provisioning via DB_ADMIN_EMAIL/DB_ADMIN_PASSWORD env; DB_NO_AUTH=1 keeps open access (pre-web behavior)
• Settings → System (web only) — change password, sign out, toggle login requirement, session TTL. Precedence: env var > /data/config.json > default; env-sourced values shown locked ("from env")
• Vault picker modal (web) — replaces the browser prompt() with an in-app modal (list / open / create), same contract as the native folder dialog
• Docker packaging — multi-stage build (node → rust musl → alpine), non-root user, /data volume, HEALTHCHECK on /api/health, GHCR publish on tags (ghcr.io/docubook/editor); all server env vars documented in .env.example

🛡️ Security

• Setup-takeover guard — optional DB_SETUP_TOKEN (required in the wizard when set) + rate-limited setup_admin; closes the pre-auth admin-claim race on public deployments (backward compatible: no env = previous behavior)
• Server path allowlist — vault paths must resolve inside DATA_DIR; closes arbitrary file read via the API (desktop unaffected — it still opens any local folder)
• Security headers — CSP, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy on static and API responses

⚡ Performance

• git_status: 1 subprocess instead of 2 — --porcelain=v2 -b mapped back to v1 output; desktop command now async (off the UI thread); ~38% cheaper per 3s poll
• AI request timeouts — 30s budget for response headers and first token; frontend watchdog aborts stalled streams after 60s; generic API calls time out after 30s
• Smaller image — strip = "debuginfo" release profile (symbols kept for RUST_BACKTRACE)

🐛 Bug Fixes

• Static assets gated by auth — the middleware wrapped the whole router incl. the frontend, so after setup the app shell returned 401 and the UI never loaded; non-/api paths are now always public (data access stays gated)
• SPA fallback returned 404 — not_found_service forces 404; switched to fallback() so deep links serve index.html with 200
• System tab on desktop showed endless loading — web-only tab is now hidden in the Tauri app
• Deadlock on first setup — setup_admin re-locked the non-reentrant config mutex; lock released before issuing the session cookie

🔧 CI

• Docker image built on every PR (push only on tags) with a Report image size step — Dockerfile breakage is caught before merge

🔄 Renames

• Desktop crate: DocuBook → docubook-desktop; web server crate: docubook-server (CI/Docker paths updated)

---

macOS (Apple Silicon — *-arm64.dmg): first run may show “app
is damaged.” Clear the quarantine flag once:

xattr -cr "/Applications/DocuBook.app"

macOS (Intel — *-amd64.dmg): right-click the app → Open →
Open Anyway on the Gatekeeper dialog.