Grimoire - Releases

Security patches from an external source-code audit (five findings — all addressed).

Fixed — security

• Rich text XSS (critical). Notes on the canvas were rendered with v-html unsanitized: any invited player could send/persist markup and run it in every viewer's Nextcloud-origin page. Rich text is now sanitized with DOMPurify (default safe profile — scripts, event handlers and javascript:/data: URLs stripped; heading/colour/list/link formatting preserved) at every entry point AND at render, so even previously-persisted malicious notes render inert.
• Scene-save takeover (high). The scene-save endpoint accepted a full document replacement from ANY invited player, including renaming the scene and wiping the map/fog/config. Player saves are now a server-side scoped merge: only keys whose permission layer allows updates pass through (tokens/blocks/maps/drawings/measurements), while name, gridConfig, mode and unknown keys remain GM-only and can no longer be overwritten or cleared. Also gained the standard raw-body fallback.
• ownerOnly token enforcement bypass (high). The token-ownership lookup queried a SCENE ROW by the token id (always missing), then fell back to the attacker-supplied owner field, and treated null (= unknown) as allowed — so ownerOnly token protection was effectively decorative and players could move or delete tokens of others. Ownership now resolves from the persisted scene document only, with no client fallback, and unknown ownership DENIES the action (deny by default).
• Third-party addon proxy / store endpoints removed (two highs). The iframe addon system was removed from the app in 0.7.1, but its server-side same-origin fetch proxy and store endpoints remained — serving attacker-controlled remote HTML from the Nextcloud origin and fetching attacker URLs with redirects left intact (SSRF class). Rather than hardening dead endpoints, they (and their DB entities, routes, and capability bridge references) are deleted outright.

Removed

• AddonProxyController, AddonController, Addon/AddonMapper entities and the /addon-proxy + /api/addons(-store) routes (dead since 0.7.1's addon consolidation; kept previously only for compatibility).

Dice physics/render fixes found by testing 0.7.8 in the field. (Repackaged in place after field-testing caught the d4's rest pose — see below.)

Fixed

• The d4 roll crashed at spawn and froze the table. Field-testing the first 0.7.9 packaging showed the d4 "spawning in the plane and doing nothing" (a half-buried wedge) in 3D and a frozen dice panel + stuck camera in 2D. Root cause, found by running the real module: _spawnDie never destructured labelValues — every d4 roll threw a ReferenceError AFTER the mesh was created but BEFORE the physics body existed, leaving a bodyless tetra at the scene origin (half of it below the floor — the wedge); the per-frame mesh sync then threw on d.body.position every frame, killing the render loop (room frozen at that frame; "does nothing"). Fixes: the destructure is complete; physics bodies are now created BEFORE cosmetic labels so a label failure can only log, never break the die or the loop; the per-frame sync skips body-less entries defensively; and the settle-snap block's stray CANNON reference (a second loop-killer at settle) now reads the stored this.CANNON. Verified by running the real module: dice tumble, settle at exact inradii (flush, apex up), sleep, and report values — d4, d8, d10, d20 in one batch.
• Settled dice now rest like real dice. The physics solver can stop a die mid-tilt (a tetra balancing on an edge/vertex contact) which read as "not a d4 at all" — and it leaves a small allowed penetration at rest (the d4 sank ~4% of its size — the "clips into the floor" look). On settle each die's most-downward face is rotated to exactly flat (apex straight up for the d4, crisp kites for the d10), residual sink is lifted out, and the pose is locked by sleeping the body. The result read runs on the snapped pose, so what you see and what is reported always agree.
• The d10's "wedge"/"no faces" and leaning rest. The trapezohedron's winding fix flipped only the FIRST triangle of each quad, leaving the other half of the kite faces wound inward. Consequences: cannon-es rejected those faces as pointing into the shape (the die could only rest on half of them, leaned/jittered and never went to sleep so rolls idled to the ~6s timeout), and the renderer BACKFACE-CULLED the inverted faces — the die looked like a half-missing "boat" wedge. The flip now reverses the entire quad cycle; verified numerically: no cannon warnings, the die sleeps after settling, and all faces render.
• Dice result view jumps back after ~half a second. The camera goal was dropped the moment it was reached, so the zoom snapped back to the overview immediately. The zoom now HOLDS until the next roll.
• Only one die showed when several rolled. The result camera now cycles through every resting die (~2.5s each, wrapping around) until the next roll.
• d4 numbers bigger and edge-adjacent to read like a physical d4.
• Striped/shadow-acne faces. The main light self-shadowed dice at ~0.04 units/texel, rendering dark diagonal stripes across faces ("texture issues"). Shadow bias + normalBias added.

Dice render fixes completing the 0.7.7 batch (kept 0.7.7's published tag intact; deploy 0.7.8 to get the whole batch).

Fixed

• d4 is a real, vertex-numbered d4. It rests on a face and the result is read at the TOP vertex (its direction points straight up when settled — verified numerically for all four settle states). Each face now prints THREE numbers near its edges — the value of each of its corners — exactly like a physical d4, so the result is legible from any viewing angle (the old face-centre labels were invisible when the upright face was seen edge-on, which is why numbers appeared only "from afar").
• d8 face map had duplicated values. The calibration call passed the FULL canonical list ([1,8,2,7,3,6,4,5]) where the pairing helper expects only the first half: pairs were built as (1→8), then (8→1), (2→7), then (7→2) — every value used twice, and 3/4/5/6 never appeared. Fixed to [1,2,3,4]; opposites now correctly sum to 9 with all eight values present.
• Face labels no longer land at arbitrary, upside-down twists. Label orientation is now canonical per face (the die's local up projected into the face plane, with a degeneracy fallback), shared by every die type — mirrored in the field as numbers reading "9" for a flipped "6", and the d10/d8 screenshots showing upside-down digits.
• Label textures skip mipmap generation (minor spawn-cost win).

The d10 die was geometrically wrong, 3D fog only appeared on mouse release and stuttered, and the draw tool was inert in 3D rooms.

Fixed — dice

• d10 rebuilt as a true pentagonal trapezohedron. The old construction was built with n=10 (a twenty-faced decagonal solid whose 0–9 values cycled across 20 faces, several doubled and mislabelled) and placed labels far off the faces. The new builder is exact: two apices, a 2n ring staggered between heights ±e, and the kite faces are provably planar for the exact stagger e = h(1−cos(π/n))/(1+cos(π/n)) — verified numerically (10 faces, each with an exact antipodal face, opposite values pairing to 0+9…4+5, labels sitting on the surface).

Fixed — 3D drawing & fog feel

• Strokes preview live in 3D. Fog brushes and the pencil now draw while you drag onto a live overlay canvas, instead of appearing only after the left button released.
• Laggy fog gone. Overlay textures upload at most once per frame via a dirty flag (a live stroke used to trigger a full 1024² texture re-upload per mouse-move); committed strokes redraw the canvas incrementally.
• The draw tool works in 3D rooms. Scene3D gained a drawings layer (pen/marker freehand, line/rect/ellipse/triangle/hexagon, polygon, and plain text notes) over the ground, in the same shared pixel stroke space and message formats as 2D — saves and live sync carry both room kinds' drawings.
• Rich text notes anchor and project correctly in 3D rooms (camera projection instead of the 2D stage transform).

Fixed

• File picker now works. Fixed OC.dialogs.filepicker call to use the correct 7-arg signature for Nextcloud 28+ — the picker shows a "Choose" button and the callback fires with the selected path.
• Permanent rulers no longer snap horizontal. In 3D the ruler stored y=0 (ground height) instead of z (depth), so all rulers appeared as flat horizontal lines. Now stores both y and z so the ruler renders at the correct depth in 3D mode.
• Render loop no longer steps dice in 2D mode. The 3D DiceRoller was stepping even in 2D mode; now only steps when mode is 3D (the DicePanel manages its own world in 2D).

Added

• DM Control Panel. A comprehensive left-side sidebar (🛠 in the toolbar, GM only) consolidating all DM controls:
• Scene: rename, grid type/size/line-width/opacity/style/colour, scale
• Layers: toggle visibility for grid, drawings, fog, fog preview
• Player permissions: per-layer create/update/delete/owner-only table
• Players: search Nextcloud users, invite, remove
• Session: send reminders, reveal all fog, delete scene Replaces the separate GridSettings and PermissionsPanel popovers.

Changed

• Consolidated dice UI. Replaced the separate floating DiceTray and DiceViewport with a single DicePanel sidebar. In 2D mode it shows a mini 3D canvas with the physics dice; in 3D mode it drives the main scene's DiceRoller. One panel, mode-appropriate behavior.
• Asset picker fixed. Rewrote AssetPicker to use Nextcloud's native OC.dialogs.filepicker and proper WebDAV URLs via generateRemoteUrl('dav'), so maps/tokens/models load with session auth. Removed the broken custom BrowseList.
• Addons inlined. Removed the iframe-based addon system. The initiative tracker is now a built-in Vue component toggled from the topbar (⚔).
• Nextcloud theming. All colors now use Nextcloud CSS variables (--color-primary-element, --color-main-background, --color-main-text, --color-border, etc.) so the app follows the user's light/dark theme and the admin's accent color automatically. No more hardcoded gold/blue.

Added

• Token health system. DM-controlled HP bars on every token (2D bar + 3D billboard). GM double-clicks a token to edit HP; quick ±1/±5 buttons. Synced + persisted; GM-only server-side.
• Measure modes. Transient ruler, permanent rulers (synced/persisted, right-click to delete), and movement mode (drag a token with a live ruler). Four measurement types: euclidean, chessboard, alternating-diagonal, manhattan. Per-scene ft/square scale.
• Grid controls. Square / hex-pointy / hex-flat grids, line style (solid/dashed/dotted), colour, opacity, width, per-scene scale. Grid settings popover (⊞ in the toolbar, GM only).
• Player permissions. Per-layer create/update/delete toggles for maps/tokens/drawings/fog, plus owner-only tokens. Enforced server-side on the room relay; GM bypasses. Permissions panel (🔒, GM only).
• Fog shapes & preview. Rect/circle/polygon fog modes (plus brush/eraser), cut/uncut toggle, fog preview (GM sees player view), configurable fog colour.
• Drawing modes. Pen, marker (closed freehand), line, rect, ellipse, triangle, hexagon, polygon (click-to-add, double-click to close), text. Separate stroke + fill colour pickers and width slider. Synced + persisted.
• Rich text on canvas. In-place contentEditable editor (bold/italic/ lists/headings/emoji) replacing the prompt() dialog; HTML overlay that tracks pan/zoom.
• Multiple maps per scene. Add maps without replacing (multi-floor / side-by-side), lock/unlock + scale each map for grid alignment. Synced + persisted.
• 2D dice viewport. A self-contained 3D physics dice tray in a corner canvas in 2D mode, so players roll and see the result without leaving the battlemap. Rolls broadcast to the room.
• Signed room tokens. HMAC-signed short-lived tokens; the relay verifies signature + expiry against a shared secret. Live multiplayer no longer needs DEV_TRUST.
• Nextcloud 34 support. Dependency max-version bumped to 34.
• Asset library. AssetController browses Nextcloud Files (folders, thumbnails, direct file serving) with a BrowseList picker.
• Addon store verification. Catalog entries validated server-side; verified badge in the UI; warns on non-catalog installs.
• Dice calibration. d8/d12/d20 canonical face maps (opposites sum to max+1); d10 rebuilt as a true pentagonal trapezohedron.
• App Store-ready metadata. info.xml now includes website, repository, documentation links, and uses the SPDX licence identifier (AGPL-3.0-or-later).

Security patches from an external source-code audit (five findings — all addressed).

Fixed — security

• Rich text XSS (critical). Notes on the canvas were rendered with v-html unsanitized: any invited player could send/persist markup and run it in every viewer's Nextcloud-origin page. Rich text is now sanitized with DOMPurify (default safe profile — scripts, event handlers and javascript:/data: URLs stripped; heading/colour/list/link formatting preserved) at every entry point AND at render, so even previously-persisted malicious notes render inert.
• Scene-save takeover (high). The scene-save endpoint accepted a full document replacement from ANY invited player, including renaming the scene and wiping the map/fog/config. Player saves are now a server-side scoped merge: only keys whose permission layer allows updates pass through (tokens/blocks/maps/drawings/measurements), while name, gridConfig, mode and unknown keys remain GM-only and can no longer be overwritten or cleared. Also gained the standard raw-body fallback.
• ownerOnly token enforcement bypass (high). The token-ownership lookup queried a SCENE ROW by the token id (always missing), then fell back to the attacker-supplied owner field, and treated null (= unknown) as allowed — so ownerOnly token protection was effectively decorative and players could move or delete tokens of others. Ownership now resolves from the persisted scene document only, with no client fallback, and unknown ownership DENIES the action (deny by default).
• Third-party addon proxy / store endpoints removed (two highs). The iframe addon system was removed from the app in 0.7.1, but its server-side same-origin fetch proxy and store endpoints remained — serving attacker-controlled remote HTML from the Nextcloud origin and fetching attacker URLs with redirects left intact (SSRF class). Rather than hardening dead endpoints, they (and their DB entities, routes, and capability bridge references) are deleted outright.

Removed

• AddonProxyController, AddonController, Addon/AddonMapper entities and the /addon-proxy + /api/addons(-store) routes (dead since 0.7.1's addon consolidation; kept previously only for compatibility).

Dice physics/render fixes found by testing 0.7.8 in the field. (Repackaged in place after field-testing caught the d4's rest pose — see below.)

Fixed

• The d4 roll crashed at spawn and froze the table. Field-testing the first 0.7.9 packaging showed the d4 "spawning in the plane and doing nothing" (a half-buried wedge) in 3D and a frozen dice panel + stuck camera in 2D. Root cause, found by running the real module: _spawnDie never destructured labelValues — every d4 roll threw a ReferenceError AFTER the mesh was created but BEFORE the physics body existed, leaving a bodyless tetra at the scene origin (half of it below the floor — the wedge); the per-frame mesh sync then threw on d.body.position every frame, killing the render loop (room frozen at that frame; "does nothing"). Fixes: the destructure is complete; physics bodies are now created BEFORE cosmetic labels so a label failure can only log, never break the die or the loop; the per-frame sync skips body-less entries defensively; and the settle-snap block's stray CANNON reference (a second loop-killer at settle) now reads the stored this.CANNON. Verified by running the real module: dice tumble, settle at exact inradii (flush, apex up), sleep, and report values — d4, d8, d10, d20 in one batch.
• Settled dice now rest like real dice. The physics solver can stop a die mid-tilt (a tetra balancing on an edge/vertex contact) which read as "not a d4 at all" — and it leaves a small allowed penetration at rest (the d4 sank ~4% of its size — the "clips into the floor" look). On settle each die's most-downward face is rotated to exactly flat (apex straight up for the d4, crisp kites for the d10), residual sink is lifted out, and the pose is locked by sleeping the body. The result read runs on the snapped pose, so what you see and what is reported always agree.
• The d10's "wedge"/"no faces" and leaning rest. The trapezohedron's winding fix flipped only the FIRST triangle of each quad, leaving the other half of the kite faces wound inward. Consequences: cannon-es rejected those faces as pointing into the shape (the die could only rest on half of them, leaned/jittered and never went to sleep so rolls idled to the ~6s timeout), and the renderer BACKFACE-CULLED the inverted faces — the die looked like a half-missing "boat" wedge. The flip now reverses the entire quad cycle; verified numerically: no cannon warnings, the die sleeps after settling, and all faces render.
• Dice result view jumps back after ~half a second. The camera goal was dropped the moment it was reached, so the zoom snapped back to the overview immediately. The zoom now HOLDS until the next roll.
• Only one die showed when several rolled. The result camera now cycles through every resting die (~2.5s each, wrapping around) until the next roll.
• d4 numbers bigger and edge-adjacent to read like a physical d4.
• Striped/shadow-acne faces. The main light self-shadowed dice at ~0.04 units/texel, rendering dark diagonal stripes across faces ("texture issues"). Shadow bias + normalBias added.

Dice render fixes completing the 0.7.7 batch (kept 0.7.7's published tag intact; deploy 0.7.8 to get the whole batch).

Fixed

• d4 is a real, vertex-numbered d4. It rests on a face and the result is read at the TOP vertex (its direction points straight up when settled — verified numerically for all four settle states). Each face now prints THREE numbers near its edges — the value of each of its corners — exactly like a physical d4, so the result is legible from any viewing angle (the old face-centre labels were invisible when the upright face was seen edge-on, which is why numbers appeared only "from afar").
• d8 face map had duplicated values. The calibration call passed the FULL canonical list ([1,8,2,7,3,6,4,5]) where the pairing helper expects only the first half: pairs were built as (1→8), then (8→1), (2→7), then (7→2) — every value used twice, and 3/4/5/6 never appeared. Fixed to [1,2,3,4]; opposites now correctly sum to 9 with all eight values present.
• Face labels no longer land at arbitrary, upside-down twists. Label orientation is now canonical per face (the die's local up projected into the face plane, with a degeneracy fallback), shared by every die type — mirrored in the field as numbers reading "9" for a flipped "6", and the d10/d8 screenshots showing upside-down digits.
• Label textures skip mipmap generation (minor spawn-cost win).

The d10 die was geometrically wrong, 3D fog only appeared on mouse release and stuttered, and the draw tool was inert in 3D rooms.

Fixed — dice

• d10 rebuilt as a true pentagonal trapezohedron. The old construction was built with n=10 (a twenty-faced decagonal solid whose 0–9 values cycled across 20 faces, several doubled and mislabelled) and placed labels far off the faces. The new builder is exact: two apices, a 2n ring staggered between heights ±e, and the kite faces are provably planar for the exact stagger e = h(1−cos(π/n))/(1+cos(π/n)) — verified numerically (10 faces, each with an exact antipodal face, opposite values pairing to 0+9…4+5, labels sitting on the surface).

Fixed — 3D drawing & fog feel

• Strokes preview live in 3D. Fog brushes and the pencil now draw while you drag onto a live overlay canvas, instead of appearing only after the left button released.
• Laggy fog gone. Overlay textures upload at most once per frame via a dirty flag (a live stroke used to trigger a full 1024² texture re-upload per mouse-move); committed strokes redraw the canvas incrementally.
• The draw tool works in 3D rooms. Scene3D gained a drawings layer (pen/marker freehand, line/rect/ellipse/triangle/hexagon, polygon, and plain text notes) over the ground, in the same shared pixel stroke space and message formats as 2D — saves and live sync carry both room kinds' drawings.
• Rich text notes anchor and project correctly in 3D rooms (camera projection instead of the 2D stage transform).

Fixed

• File picker now works. Fixed OC.dialogs.filepicker call to use the correct 7-arg signature for Nextcloud 28+ — the picker shows a "Choose" button and the callback fires with the selected path.
• Permanent rulers no longer snap horizontal. In 3D the ruler stored y=0 (ground height) instead of z (depth), so all rulers appeared as flat horizontal lines. Now stores both y and z so the ruler renders at the correct depth in 3D mode.
• Render loop no longer steps dice in 2D mode. The 3D DiceRoller was stepping even in 2D mode; now only steps when mode is 3D (the DicePanel manages its own world in 2D).

Added

• DM Control Panel. A comprehensive left-side sidebar (🛠 in the toolbar, GM only) consolidating all DM controls:
• Scene: rename, grid type/size/line-width/opacity/style/colour, scale
• Layers: toggle visibility for grid, drawings, fog, fog preview
• Player permissions: per-layer create/update/delete/owner-only table
• Players: search Nextcloud users, invite, remove
• Session: send reminders, reveal all fog, delete scene Replaces the separate GridSettings and PermissionsPanel popovers.

Changed

• Consolidated dice UI. Replaced the separate floating DiceTray and DiceViewport with a single DicePanel sidebar. In 2D mode it shows a mini 3D canvas with the physics dice; in 3D mode it drives the main scene's DiceRoller. One panel, mode-appropriate behavior.
• Asset picker fixed. Rewrote AssetPicker to use Nextcloud's native OC.dialogs.filepicker and proper WebDAV URLs via generateRemoteUrl('dav'), so maps/tokens/models load with session auth. Removed the broken custom BrowseList.
• Addons inlined. Removed the iframe-based addon system. The initiative tracker is now a built-in Vue component toggled from the topbar (⚔).
• Nextcloud theming. All colors now use Nextcloud CSS variables (--color-primary-element, --color-main-background, --color-main-text, --color-border, etc.) so the app follows the user's light/dark theme and the admin's accent color automatically. No more hardcoded gold/blue.

Added

• Token health system. DM-controlled HP bars on every token (2D bar + 3D billboard). GM double-clicks a token to edit HP; quick ±1/±5 buttons. Synced + persisted; GM-only server-side.
• Measure modes. Transient ruler, permanent rulers (synced/persisted, right-click to delete), and movement mode (drag a token with a live ruler). Four measurement types: euclidean, chessboard, alternating-diagonal, manhattan. Per-scene ft/square scale.
• Grid controls. Square / hex-pointy / hex-flat grids, line style (solid/dashed/dotted), colour, opacity, width, per-scene scale. Grid settings popover (⊞ in the toolbar, GM only).
• Player permissions. Per-layer create/update/delete toggles for maps/tokens/drawings/fog, plus owner-only tokens. Enforced server-side on the room relay; GM bypasses. Permissions panel (🔒, GM only).
• Fog shapes & preview. Rect/circle/polygon fog modes (plus brush/eraser), cut/uncut toggle, fog preview (GM sees player view), configurable fog colour.
• Drawing modes. Pen, marker (closed freehand), line, rect, ellipse, triangle, hexagon, polygon (click-to-add, double-click to close), text. Separate stroke + fill colour pickers and width slider. Synced + persisted.
• Rich text on canvas. In-place contentEditable editor (bold/italic/ lists/headings/emoji) replacing the prompt() dialog; HTML overlay that tracks pan/zoom.
• Multiple maps per scene. Add maps without replacing (multi-floor / side-by-side), lock/unlock + scale each map for grid alignment. Synced + persisted.
• 2D dice viewport. A self-contained 3D physics dice tray in a corner canvas in 2D mode, so players roll and see the result without leaving the battlemap. Rolls broadcast to the room.
• Signed room tokens. HMAC-signed short-lived tokens; the relay verifies signature + expiry against a shared secret. Live multiplayer no longer needs DEV_TRUST.
• Nextcloud 34 support. Dependency max-version bumped to 34.
• Asset library. AssetController browses Nextcloud Files (folders, thumbnails, direct file serving) with a BrowseList picker.
• Addon store verification. Catalog entries validated server-side; verified badge in the UI; warns on non-catalog installs.
• Dice calibration. d8/d12/d20 canonical face maps (opposites sum to max+1); d10 rebuilt as a true pentagonal trapezohedron.
• App Store-ready metadata. info.xml now includes website, repository, documentation links, and uses the SPDX licence identifier (AGPL-3.0-or-later).

Security patches from an external source-code audit (five findings — all addressed).

Fixed — security

• Rich text XSS (critical). Notes on the canvas were rendered with v-html unsanitized: any invited player could send/persist markup and run it in every viewer's Nextcloud-origin page. Rich text is now sanitized with DOMPurify (default safe profile — scripts, event handlers and javascript:/data: URLs stripped; heading/colour/list/link formatting preserved) at every entry point AND at render, so even previously-persisted malicious notes render inert.
• Scene-save takeover (high). The scene-save endpoint accepted a full document replacement from ANY invited player, including renaming the scene and wiping the map/fog/config. Player saves are now a server-side scoped merge: only keys whose permission layer allows updates pass through (tokens/blocks/maps/drawings/measurements), while name, gridConfig, mode and unknown keys remain GM-only and can no longer be overwritten or cleared. Also gained the standard raw-body fallback.
• ownerOnly token enforcement bypass (high). The token-ownership lookup queried a SCENE ROW by the token id (always missing), then fell back to the attacker-supplied owner field, and treated null (= unknown) as allowed — so ownerOnly token protection was effectively decorative and players could move or delete tokens of others. Ownership now resolves from the persisted scene document only, with no client fallback, and unknown ownership DENIES the action (deny by default).
• Third-party addon proxy / store endpoints removed (two highs). The iframe addon system was removed from the app in 0.7.1, but its server-side same-origin fetch proxy and store endpoints remained — serving attacker-controlled remote HTML from the Nextcloud origin and fetching attacker URLs with redirects left intact (SSRF class). Rather than hardening dead endpoints, they (and their DB entities, routes, and capability bridge references) are deleted outright.

Removed

• AddonProxyController, AddonController, Addon/AddonMapper entities and the /addon-proxy + /api/addons(-store) routes (dead since 0.7.1's addon consolidation; kept previously only for compatibility).

Dice physics/render fixes found by testing 0.7.8 in the field. (Repackaged in place after field-testing caught the d4's rest pose — see below.)

Fixed

• The d4 roll crashed at spawn and froze the table. Field-testing the first 0.7.9 packaging showed the d4 "spawning in the plane and doing nothing" (a half-buried wedge) in 3D and a frozen dice panel + stuck camera in 2D. Root cause, found by running the real module: _spawnDie never destructured labelValues — every d4 roll threw a ReferenceError AFTER the mesh was created but BEFORE the physics body existed, leaving a bodyless tetra at the scene origin (half of it below the floor — the wedge); the per-frame mesh sync then threw on d.body.position every frame, killing the render loop (room frozen at that frame; "does nothing"). Fixes: the destructure is complete; physics bodies are now created BEFORE cosmetic labels so a label failure can only log, never break the die or the loop; the per-frame sync skips body-less entries defensively; and the settle-snap block's stray CANNON reference (a second loop-killer at settle) now reads the stored this.CANNON. Verified by running the real module: dice tumble, settle at exact inradii (flush, apex up), sleep, and report values — d4, d8, d10, d20 in one batch.
• Settled dice now rest like real dice. The physics solver can stop a die mid-tilt (a tetra balancing on an edge/vertex contact) which read as "not a d4 at all" — and it leaves a small allowed penetration at rest (the d4 sank ~4% of its size — the "clips into the floor" look). On settle each die's most-downward face is rotated to exactly flat (apex straight up for the d4, crisp kites for the d10), residual sink is lifted out, and the pose is locked by sleeping the body. The result read runs on the snapped pose, so what you see and what is reported always agree.
• The d10's "wedge"/"no faces" and leaning rest. The trapezohedron's winding fix flipped only the FIRST triangle of each quad, leaving the other half of the kite faces wound inward. Consequences: cannon-es rejected those faces as pointing into the shape (the die could only rest on half of them, leaned/jittered and never went to sleep so rolls idled to the ~6s timeout), and the renderer BACKFACE-CULLED the inverted faces — the die looked like a half-missing "boat" wedge. The flip now reverses the entire quad cycle; verified numerically: no cannon warnings, the die sleeps after settling, and all faces render.
• Dice result view jumps back after ~half a second. The camera goal was dropped the moment it was reached, so the zoom snapped back to the overview immediately. The zoom now HOLDS until the next roll.
• Only one die showed when several rolled. The result camera now cycles through every resting die (~2.5s each, wrapping around) until the next roll.
• d4 numbers bigger and edge-adjacent to read like a physical d4.
• Striped/shadow-acne faces. The main light self-shadowed dice at ~0.04 units/texel, rendering dark diagonal stripes across faces ("texture issues"). Shadow bias + normalBias added.

Dice render fixes completing the 0.7.7 batch (kept 0.7.7's published tag intact; deploy 0.7.8 to get the whole batch).

Fixed

• d4 is a real, vertex-numbered d4. It rests on a face and the result is read at the TOP vertex (its direction points straight up when settled — verified numerically for all four settle states). Each face now prints THREE numbers near its edges — the value of each of its corners — exactly like a physical d4, so the result is legible from any viewing angle (the old face-centre labels were invisible when the upright face was seen edge-on, which is why numbers appeared only "from afar").
• d8 face map had duplicated values. The calibration call passed the FULL canonical list ([1,8,2,7,3,6,4,5]) where the pairing helper expects only the first half: pairs were built as (1→8), then (8→1), (2→7), then (7→2) — every value used twice, and 3/4/5/6 never appeared. Fixed to [1,2,3,4]; opposites now correctly sum to 9 with all eight values present.
• Face labels no longer land at arbitrary, upside-down twists. Label orientation is now canonical per face (the die's local up projected into the face plane, with a degeneracy fallback), shared by every die type — mirrored in the field as numbers reading "9" for a flipped "6", and the d10/d8 screenshots showing upside-down digits.
• Label textures skip mipmap generation (minor spawn-cost win).

The d10 die was geometrically wrong, 3D fog only appeared on mouse release and stuttered, and the draw tool was inert in 3D rooms.

Fixed — dice

• d10 rebuilt as a true pentagonal trapezohedron. The old construction was built with n=10 (a twenty-faced decagonal solid whose 0–9 values cycled across 20 faces, several doubled and mislabelled) and placed labels far off the faces. The new builder is exact: two apices, a 2n ring staggered between heights ±e, and the kite faces are provably planar for the exact stagger e = h(1−cos(π/n))/(1+cos(π/n)) — verified numerically (10 faces, each with an exact antipodal face, opposite values pairing to 0+9…4+5, labels sitting on the surface).

Fixed — 3D drawing & fog feel

• Strokes preview live in 3D. Fog brushes and the pencil now draw while you drag onto a live overlay canvas, instead of appearing only after the left button released.
• Laggy fog gone. Overlay textures upload at most once per frame via a dirty flag (a live stroke used to trigger a full 1024² texture re-upload per mouse-move); committed strokes redraw the canvas incrementally.
• The draw tool works in 3D rooms. Scene3D gained a drawings layer (pen/marker freehand, line/rect/ellipse/triangle/hexagon, polygon, and plain text notes) over the ground, in the same shared pixel stroke space and message formats as 2D — saves and live sync carry both room kinds' drawings.
• Rich text notes anchor and project correctly in 3D rooms (camera projection instead of the 2D stage transform).

Fixed

• File picker now works. Fixed OC.dialogs.filepicker call to use the correct 7-arg signature for Nextcloud 28+ — the picker shows a "Choose" button and the callback fires with the selected path.
• Permanent rulers no longer snap horizontal. In 3D the ruler stored y=0 (ground height) instead of z (depth), so all rulers appeared as flat horizontal lines. Now stores both y and z so the ruler renders at the correct depth in 3D mode.
• Render loop no longer steps dice in 2D mode. The 3D DiceRoller was stepping even in 2D mode; now only steps when mode is 3D (the DicePanel manages its own world in 2D).

Added

• DM Control Panel. A comprehensive left-side sidebar (🛠 in the toolbar, GM only) consolidating all DM controls:
• Scene: rename, grid type/size/line-width/opacity/style/colour, scale
• Layers: toggle visibility for grid, drawings, fog, fog preview
• Player permissions: per-layer create/update/delete/owner-only table
• Players: search Nextcloud users, invite, remove
• Session: send reminders, reveal all fog, delete scene Replaces the separate GridSettings and PermissionsPanel popovers.

Changed

• Consolidated dice UI. Replaced the separate floating DiceTray and DiceViewport with a single DicePanel sidebar. In 2D mode it shows a mini 3D canvas with the physics dice; in 3D mode it drives the main scene's DiceRoller. One panel, mode-appropriate behavior.
• Asset picker fixed. Rewrote AssetPicker to use Nextcloud's native OC.dialogs.filepicker and proper WebDAV URLs via generateRemoteUrl('dav'), so maps/tokens/models load with session auth. Removed the broken custom BrowseList.
• Addons inlined. Removed the iframe-based addon system. The initiative tracker is now a built-in Vue component toggled from the topbar (⚔).
• Nextcloud theming. All colors now use Nextcloud CSS variables (--color-primary-element, --color-main-background, --color-main-text, --color-border, etc.) so the app follows the user's light/dark theme and the admin's accent color automatically. No more hardcoded gold/blue.

Added

• Token health system. DM-controlled HP bars on every token (2D bar + 3D billboard). GM double-clicks a token to edit HP; quick ±1/±5 buttons. Synced + persisted; GM-only server-side.
• Measure modes. Transient ruler, permanent rulers (synced/persisted, right-click to delete), and movement mode (drag a token with a live ruler). Four measurement types: euclidean, chessboard, alternating-diagonal, manhattan. Per-scene ft/square scale.
• Grid controls. Square / hex-pointy / hex-flat grids, line style (solid/dashed/dotted), colour, opacity, width, per-scene scale. Grid settings popover (⊞ in the toolbar, GM only).
• Player permissions. Per-layer create/update/delete toggles for maps/tokens/drawings/fog, plus owner-only tokens. Enforced server-side on the room relay; GM bypasses. Permissions panel (🔒, GM only).
• Fog shapes & preview. Rect/circle/polygon fog modes (plus brush/eraser), cut/uncut toggle, fog preview (GM sees player view), configurable fog colour.
• Drawing modes. Pen, marker (closed freehand), line, rect, ellipse, triangle, hexagon, polygon (click-to-add, double-click to close), text. Separate stroke + fill colour pickers and width slider. Synced + persisted.
• Rich text on canvas. In-place contentEditable editor (bold/italic/ lists/headings/emoji) replacing the prompt() dialog; HTML overlay that tracks pan/zoom.
• Multiple maps per scene. Add maps without replacing (multi-floor / side-by-side), lock/unlock + scale each map for grid alignment. Synced + persisted.
• 2D dice viewport. A self-contained 3D physics dice tray in a corner canvas in 2D mode, so players roll and see the result without leaving the battlemap. Rolls broadcast to the room.
• Signed room tokens. HMAC-signed short-lived tokens; the relay verifies signature + expiry against a shared secret. Live multiplayer no longer needs DEV_TRUST.
• Nextcloud 34 support. Dependency max-version bumped to 34.
• Asset library. AssetController browses Nextcloud Files (folders, thumbnails, direct file serving) with a BrowseList picker.
• Addon store verification. Catalog entries validated server-side; verified badge in the UI; warns on non-catalog installs.
• Dice calibration. d8/d12/d20 canonical face maps (opposites sum to max+1); d10 rebuilt as a true pentagonal trapezohedron.
• App Store-ready metadata. info.xml now includes website, repository, documentation links, and uses the SPDX licence identifier (AGPL-3.0-or-later).

Security patches from an external source-code audit (five findings — all addressed).

Fixed — security

• Rich text XSS (critical). Notes on the canvas were rendered with v-html unsanitized: any invited player could send/persist markup and run it in every viewer's Nextcloud-origin page. Rich text is now sanitized with DOMPurify (default safe profile — scripts, event handlers and javascript:/data: URLs stripped; heading/colour/list/link formatting preserved) at every entry point AND at render, so even previously-persisted malicious notes render inert.
• Scene-save takeover (high). The scene-save endpoint accepted a full document replacement from ANY invited player, including renaming the scene and wiping the map/fog/config. Player saves are now a server-side scoped merge: only keys whose permission layer allows updates pass through (tokens/blocks/maps/drawings/measurements), while name, gridConfig, mode and unknown keys remain GM-only and can no longer be overwritten or cleared. Also gained the standard raw-body fallback.
• ownerOnly token enforcement bypass (high). The token-ownership lookup queried a SCENE ROW by the token id (always missing), then fell back to the attacker-supplied owner field, and treated null (= unknown) as allowed — so ownerOnly token protection was effectively decorative and players could move or delete tokens of others. Ownership now resolves from the persisted scene document only, with no client fallback, and unknown ownership DENIES the action (deny by default).
• Third-party addon proxy / store endpoints removed (two highs). The iframe addon system was removed from the app in 0.7.1, but its server-side same-origin fetch proxy and store endpoints remained — serving attacker-controlled remote HTML from the Nextcloud origin and fetching attacker URLs with redirects left intact (SSRF class). Rather than hardening dead endpoints, they (and their DB entities, routes, and capability bridge references) are deleted outright.

Removed

• AddonProxyController, AddonController, Addon/AddonMapper entities and the /addon-proxy + /api/addons(-store) routes (dead since 0.7.1's addon consolidation; kept previously only for compatibility).

Dice physics/render fixes found by testing 0.7.8 in the field. (Repackaged in place after field-testing caught the d4's rest pose — see below.)

Fixed

• The d4 roll crashed at spawn and froze the table. Field-testing the first 0.7.9 packaging showed the d4 "spawning in the plane and doing nothing" (a half-buried wedge) in 3D and a frozen dice panel + stuck camera in 2D. Root cause, found by running the real module: _spawnDie never destructured labelValues — every d4 roll threw a ReferenceError AFTER the mesh was created but BEFORE the physics body existed, leaving a bodyless tetra at the scene origin (half of it below the floor — the wedge); the per-frame mesh sync then threw on d.body.position every frame, killing the render loop (room frozen at that frame; "does nothing"). Fixes: the destructure is complete; physics bodies are now created BEFORE cosmetic labels so a label failure can only log, never break the die or the loop; the per-frame sync skips body-less entries defensively; and the settle-snap block's stray CANNON reference (a second loop-killer at settle) now reads the stored this.CANNON. Verified by running the real module: dice tumble, settle at exact inradii (flush, apex up), sleep, and report values — d4, d8, d10, d20 in one batch.
• Settled dice now rest like real dice. The physics solver can stop a die mid-tilt (a tetra balancing on an edge/vertex contact) which read as "not a d4 at all" — and it leaves a small allowed penetration at rest (the d4 sank ~4% of its size — the "clips into the floor" look). On settle each die's most-downward face is rotated to exactly flat (apex straight up for the d4, crisp kites for the d10), residual sink is lifted out, and the pose is locked by sleeping the body. The result read runs on the snapped pose, so what you see and what is reported always agree.
• The d10's "wedge"/"no faces" and leaning rest. The trapezohedron's winding fix flipped only the FIRST triangle of each quad, leaving the other half of the kite faces wound inward. Consequences: cannon-es rejected those faces as pointing into the shape (the die could only rest on half of them, leaned/jittered and never went to sleep so rolls idled to the ~6s timeout), and the renderer BACKFACE-CULLED the inverted faces — the die looked like a half-missing "boat" wedge. The flip now reverses the entire quad cycle; verified numerically: no cannon warnings, the die sleeps after settling, and all faces render.
• Dice result view jumps back after ~half a second. The camera goal was dropped the moment it was reached, so the zoom snapped back to the overview immediately. The zoom now HOLDS until the next roll.
• Only one die showed when several rolled. The result camera now cycles through every resting die (~2.5s each, wrapping around) until the next roll.
• d4 numbers bigger and edge-adjacent to read like a physical d4.
• Striped/shadow-acne faces. The main light self-shadowed dice at ~0.04 units/texel, rendering dark diagonal stripes across faces ("texture issues"). Shadow bias + normalBias added.

Dice render fixes completing the 0.7.7 batch (kept 0.7.7's published tag intact; deploy 0.7.8 to get the whole batch).

Fixed

• d4 is a real, vertex-numbered d4. It rests on a face and the result is read at the TOP vertex (its direction points straight up when settled — verified numerically for all four settle states). Each face now prints THREE numbers near its edges — the value of each of its corners — exactly like a physical d4, so the result is legible from any viewing angle (the old face-centre labels were invisible when the upright face was seen edge-on, which is why numbers appeared only "from afar").
• d8 face map had duplicated values. The calibration call passed the FULL canonical list ([1,8,2,7,3,6,4,5]) where the pairing helper expects only the first half: pairs were built as (1→8), then (8→1), (2→7), then (7→2) — every value used twice, and 3/4/5/6 never appeared. Fixed to [1,2,3,4]; opposites now correctly sum to 9 with all eight values present.
• Face labels no longer land at arbitrary, upside-down twists. Label orientation is now canonical per face (the die's local up projected into the face plane, with a degeneracy fallback), shared by every die type — mirrored in the field as numbers reading "9" for a flipped "6", and the d10/d8 screenshots showing upside-down digits.
• Label textures skip mipmap generation (minor spawn-cost win).

The d10 die was geometrically wrong, 3D fog only appeared on mouse release and stuttered, and the draw tool was inert in 3D rooms.

Fixed — dice

• d10 rebuilt as a true pentagonal trapezohedron. The old construction was built with n=10 (a twenty-faced decagonal solid whose 0–9 values cycled across 20 faces, several doubled and mislabelled) and placed labels far off the faces. The new builder is exact: two apices, a 2n ring staggered between heights ±e, and the kite faces are provably planar for the exact stagger e = h(1−cos(π/n))/(1+cos(π/n)) — verified numerically (10 faces, each with an exact antipodal face, opposite values pairing to 0+9…4+5, labels sitting on the surface).

Fixed — 3D drawing & fog feel

• Strokes preview live in 3D. Fog brushes and the pencil now draw while you drag onto a live overlay canvas, instead of appearing only after the left button released.
• Laggy fog gone. Overlay textures upload at most once per frame via a dirty flag (a live stroke used to trigger a full 1024² texture re-upload per mouse-move); committed strokes redraw the canvas incrementally.
• The draw tool works in 3D rooms. Scene3D gained a drawings layer (pen/marker freehand, line/rect/ellipse/triangle/hexagon, polygon, and plain text notes) over the ground, in the same shared pixel stroke space and message formats as 2D — saves and live sync carry both room kinds' drawings.
• Rich text notes anchor and project correctly in 3D rooms (camera projection instead of the 2D stage transform).

Fixed

• File picker now works. Fixed OC.dialogs.filepicker call to use the correct 7-arg signature for Nextcloud 28+ — the picker shows a "Choose" button and the callback fires with the selected path.
• Permanent rulers no longer snap horizontal. In 3D the ruler stored y=0 (ground height) instead of z (depth), so all rulers appeared as flat horizontal lines. Now stores both y and z so the ruler renders at the correct depth in 3D mode.
• Render loop no longer steps dice in 2D mode. The 3D DiceRoller was stepping even in 2D mode; now only steps when mode is 3D (the DicePanel manages its own world in 2D).

Added

• DM Control Panel. A comprehensive left-side sidebar (🛠 in the toolbar, GM only) consolidating all DM controls:
• Scene: rename, grid type/size/line-width/opacity/style/colour, scale
• Layers: toggle visibility for grid, drawings, fog, fog preview
• Player permissions: per-layer create/update/delete/owner-only table
• Players: search Nextcloud users, invite, remove
• Session: send reminders, reveal all fog, delete scene Replaces the separate GridSettings and PermissionsPanel popovers.

Changed

• Consolidated dice UI. Replaced the separate floating DiceTray and DiceViewport with a single DicePanel sidebar. In 2D mode it shows a mini 3D canvas with the physics dice; in 3D mode it drives the main scene's DiceRoller. One panel, mode-appropriate behavior.
• Asset picker fixed. Rewrote AssetPicker to use Nextcloud's native OC.dialogs.filepicker and proper WebDAV URLs via generateRemoteUrl('dav'), so maps/tokens/models load with session auth. Removed the broken custom BrowseList.
• Addons inlined. Removed the iframe-based addon system. The initiative tracker is now a built-in Vue component toggled from the topbar (⚔).
• Nextcloud theming. All colors now use Nextcloud CSS variables (--color-primary-element, --color-main-background, --color-main-text, --color-border, etc.) so the app follows the user's light/dark theme and the admin's accent color automatically. No more hardcoded gold/blue.

Added

• Token health system. DM-controlled HP bars on every token (2D bar + 3D billboard). GM double-clicks a token to edit HP; quick ±1/±5 buttons. Synced + persisted; GM-only server-side.
• Measure modes. Transient ruler, permanent rulers (synced/persisted, right-click to delete), and movement mode (drag a token with a live ruler). Four measurement types: euclidean, chessboard, alternating-diagonal, manhattan. Per-scene ft/square scale.
• Grid controls. Square / hex-pointy / hex-flat grids, line style (solid/dashed/dotted), colour, opacity, width, per-scene scale. Grid settings popover (⊞ in the toolbar, GM only).
• Player permissions. Per-layer create/update/delete toggles for maps/tokens/drawings/fog, plus owner-only tokens. Enforced server-side on the room relay; GM bypasses. Permissions panel (🔒, GM only).
• Fog shapes & preview. Rect/circle/polygon fog modes (plus brush/eraser), cut/uncut toggle, fog preview (GM sees player view), configurable fog colour.
• Drawing modes. Pen, marker (closed freehand), line, rect, ellipse, triangle, hexagon, polygon (click-to-add, double-click to close), text. Separate stroke + fill colour pickers and width slider. Synced + persisted.
• Rich text on canvas. In-place contentEditable editor (bold/italic/ lists/headings/emoji) replacing the prompt() dialog; HTML overlay that tracks pan/zoom.
• Multiple maps per scene. Add maps without replacing (multi-floor / side-by-side), lock/unlock + scale each map for grid alignment. Synced + persisted.
• 2D dice viewport. A self-contained 3D physics dice tray in a corner canvas in 2D mode, so players roll and see the result without leaving the battlemap. Rolls broadcast to the room.
• Signed room tokens. HMAC-signed short-lived tokens; the relay verifies signature + expiry against a shared secret. Live multiplayer no longer needs DEV_TRUST.
• Nextcloud 34 support. Dependency max-version bumped to 34.
• Asset library. AssetController browses Nextcloud Files (folders, thumbnails, direct file serving) with a BrowseList picker.
• Addon store verification. Catalog entries validated server-side; verified badge in the UI; warns on non-catalog installs.
• Dice calibration. d8/d12/d20 canonical face maps (opposites sum to max+1); d10 rebuilt as a true pentagonal trapezohedron.
• App Store-ready metadata. info.xml now includes website, repository, documentation links, and uses the SPDX licence identifier (AGPL-3.0-or-later).

Security patches from an external source-code audit (five findings — all addressed).

Fixed — security

• Rich text XSS (critical). Notes on the canvas were rendered with v-html unsanitized: any invited player could send/persist markup and run it in every viewer's Nextcloud-origin page. Rich text is now sanitized with DOMPurify (default safe profile — scripts, event handlers and javascript:/data: URLs stripped; heading/colour/list/link formatting preserved) at every entry point AND at render, so even previously-persisted malicious notes render inert.
• Scene-save takeover (high). The scene-save endpoint accepted a full document replacement from ANY invited player, including renaming the scene and wiping the map/fog/config. Player saves are now a server-side scoped merge: only keys whose permission layer allows updates pass through (tokens/blocks/maps/drawings/measurements), while name, gridConfig, mode and unknown keys remain GM-only and can no longer be overwritten or cleared. Also gained the standard raw-body fallback.
• ownerOnly token enforcement bypass (high). The token-ownership lookup queried a SCENE ROW by the token id (always missing), then fell back to the attacker-supplied owner field, and treated null (= unknown) as allowed — so ownerOnly token protection was effectively decorative and players could move or delete tokens of others. Ownership now resolves from the persisted scene document only, with no client fallback, and unknown ownership DENIES the action (deny by default).
• Third-party addon proxy / store endpoints removed (two highs). The iframe addon system was removed from the app in 0.7.1, but its server-side same-origin fetch proxy and store endpoints remained — serving attacker-controlled remote HTML from the Nextcloud origin and fetching attacker URLs with redirects left intact (SSRF class). Rather than hardening dead endpoints, they (and their DB entities, routes, and capability bridge references) are deleted outright.

Removed

• AddonProxyController, AddonController, Addon/AddonMapper entities and the /addon-proxy + /api/addons(-store) routes (dead since 0.7.1's addon consolidation; kept previously only for compatibility).

Dice physics/render fixes found by testing 0.7.8 in the field. (Repackaged in place after field-testing caught the d4's rest pose — see below.)

Fixed

• The d4 roll crashed at spawn and froze the table. Field-testing the first 0.7.9 packaging showed the d4 "spawning in the plane and doing nothing" (a half-buried wedge) in 3D and a frozen dice panel + stuck camera in 2D. Root cause, found by running the real module: _spawnDie never destructured labelValues — every d4 roll threw a ReferenceError AFTER the mesh was created but BEFORE the physics body existed, leaving a bodyless tetra at the scene origin (half of it below the floor — the wedge); the per-frame mesh sync then threw on d.body.position every frame, killing the render loop (room frozen at that frame; "does nothing"). Fixes: the destructure is complete; physics bodies are now created BEFORE cosmetic labels so a label failure can only log, never break the die or the loop; the per-frame sync skips body-less entries defensively; and the settle-snap block's stray CANNON reference (a second loop-killer at settle) now reads the stored this.CANNON. Verified by running the real module: dice tumble, settle at exact inradii (flush, apex up), sleep, and report values — d4, d8, d10, d20 in one batch.
• Settled dice now rest like real dice. The physics solver can stop a die mid-tilt (a tetra balancing on an edge/vertex contact) which read as "not a d4 at all" — and it leaves a small allowed penetration at rest (the d4 sank ~4% of its size — the "clips into the floor" look). On settle each die's most-downward face is rotated to exactly flat (apex straight up for the d4, crisp kites for the d10), residual sink is lifted out, and the pose is locked by sleeping the body. The result read runs on the snapped pose, so what you see and what is reported always agree.
• The d10's "wedge"/"no faces" and leaning rest. The trapezohedron's winding fix flipped only the FIRST triangle of each quad, leaving the other half of the kite faces wound inward. Consequences: cannon-es rejected those faces as pointing into the shape (the die could only rest on half of them, leaned/jittered and never went to sleep so rolls idled to the ~6s timeout), and the renderer BACKFACE-CULLED the inverted faces — the die looked like a half-missing "boat" wedge. The flip now reverses the entire quad cycle; verified numerically: no cannon warnings, the die sleeps after settling, and all faces render.
• Dice result view jumps back after ~half a second. The camera goal was dropped the moment it was reached, so the zoom snapped back to the overview immediately. The zoom now HOLDS until the next roll.
• Only one die showed when several rolled. The result camera now cycles through every resting die (~2.5s each, wrapping around) until the next roll.
• d4 numbers bigger and edge-adjacent to read like a physical d4.
• Striped/shadow-acne faces. The main light self-shadowed dice at ~0.04 units/texel, rendering dark diagonal stripes across faces ("texture issues"). Shadow bias + normalBias added.

Dice render fixes completing the 0.7.7 batch (kept 0.7.7's published tag intact; deploy 0.7.8 to get the whole batch).

Fixed

• d4 is a real, vertex-numbered d4. It rests on a face and the result is read at the TOP vertex (its direction points straight up when settled — verified numerically for all four settle states). Each face now prints THREE numbers near its edges — the value of each of its corners — exactly like a physical d4, so the result is legible from any viewing angle (the old face-centre labels were invisible when the upright face was seen edge-on, which is why numbers appeared only "from afar").
• d8 face map had duplicated values. The calibration call passed the FULL canonical list ([1,8,2,7,3,6,4,5]) where the pairing helper expects only the first half: pairs were built as (1→8), then (8→1), (2→7), then (7→2) — every value used twice, and 3/4/5/6 never appeared. Fixed to [1,2,3,4]; opposites now correctly sum to 9 with all eight values present.
• Face labels no longer land at arbitrary, upside-down twists. Label orientation is now canonical per face (the die's local up projected into the face plane, with a degeneracy fallback), shared by every die type — mirrored in the field as numbers reading "9" for a flipped "6", and the d10/d8 screenshots showing upside-down digits.
• Label textures skip mipmap generation (minor spawn-cost win).

The d10 die was geometrically wrong, 3D fog only appeared on mouse release and stuttered, and the draw tool was inert in 3D rooms.

Fixed — dice

• d10 rebuilt as a true pentagonal trapezohedron. The old construction was built with n=10 (a twenty-faced decagonal solid whose 0–9 values cycled across 20 faces, several doubled and mislabelled) and placed labels far off the faces. The new builder is exact: two apices, a 2n ring staggered between heights ±e, and the kite faces are provably planar for the exact stagger e = h(1−cos(π/n))/(1+cos(π/n)) — verified numerically (10 faces, each with an exact antipodal face, opposite values pairing to 0+9…4+5, labels sitting on the surface).

Fixed — 3D drawing & fog feel

• Strokes preview live in 3D. Fog brushes and the pencil now draw while you drag onto a live overlay canvas, instead of appearing only after the left button released.
• Laggy fog gone. Overlay textures upload at most once per frame via a dirty flag (a live stroke used to trigger a full 1024² texture re-upload per mouse-move); committed strokes redraw the canvas incrementally.
• The draw tool works in 3D rooms. Scene3D gained a drawings layer (pen/marker freehand, line/rect/ellipse/triangle/hexagon, polygon, and plain text notes) over the ground, in the same shared pixel stroke space and message formats as 2D — saves and live sync carry both room kinds' drawings.
• Rich text notes anchor and project correctly in 3D rooms (camera projection instead of the 2D stage transform).

Fixed

• File picker now works. Fixed OC.dialogs.filepicker call to use the correct 7-arg signature for Nextcloud 28+ — the picker shows a "Choose" button and the callback fires with the selected path.
• Permanent rulers no longer snap horizontal. In 3D the ruler stored y=0 (ground height) instead of z (depth), so all rulers appeared as flat horizontal lines. Now stores both y and z so the ruler renders at the correct depth in 3D mode.
• Render loop no longer steps dice in 2D mode. The 3D DiceRoller was stepping even in 2D mode; now only steps when mode is 3D (the DicePanel manages its own world in 2D).

Added

• DM Control Panel. A comprehensive left-side sidebar (🛠 in the toolbar, GM only) consolidating all DM controls:
• Scene: rename, grid type/size/line-width/opacity/style/colour, scale
• Layers: toggle visibility for grid, drawings, fog, fog preview
• Player permissions: per-layer create/update/delete/owner-only table
• Players: search Nextcloud users, invite, remove
• Session: send reminders, reveal all fog, delete scene Replaces the separate GridSettings and PermissionsPanel popovers.

Changed

• Consolidated dice UI. Replaced the separate floating DiceTray and DiceViewport with a single DicePanel sidebar. In 2D mode it shows a mini 3D canvas with the physics dice; in 3D mode it drives the main scene's DiceRoller. One panel, mode-appropriate behavior.
• Asset picker fixed. Rewrote AssetPicker to use Nextcloud's native OC.dialogs.filepicker and proper WebDAV URLs via generateRemoteUrl('dav'), so maps/tokens/models load with session auth. Removed the broken custom BrowseList.
• Addons inlined. Removed the iframe-based addon system. The initiative tracker is now a built-in Vue component toggled from the topbar (⚔).
• Nextcloud theming. All colors now use Nextcloud CSS variables (--color-primary-element, --color-main-background, --color-main-text, --color-border, etc.) so the app follows the user's light/dark theme and the admin's accent color automatically. No more hardcoded gold/blue.

Added

• Token health system. DM-controlled HP bars on every token (2D bar + 3D billboard). GM double-clicks a token to edit HP; quick ±1/±5 buttons. Synced + persisted; GM-only server-side.
• Measure modes. Transient ruler, permanent rulers (synced/persisted, right-click to delete), and movement mode (drag a token with a live ruler). Four measurement types: euclidean, chessboard, alternating-diagonal, manhattan. Per-scene ft/square scale.
• Grid controls. Square / hex-pointy / hex-flat grids, line style (solid/dashed/dotted), colour, opacity, width, per-scene scale. Grid settings popover (⊞ in the toolbar, GM only).
• Player permissions. Per-layer create/update/delete toggles for maps/tokens/drawings/fog, plus owner-only tokens. Enforced server-side on the room relay; GM bypasses. Permissions panel (🔒, GM only).
• Fog shapes & preview. Rect/circle/polygon fog modes (plus brush/eraser), cut/uncut toggle, fog preview (GM sees player view), configurable fog colour.
• Drawing modes. Pen, marker (closed freehand), line, rect, ellipse, triangle, hexagon, polygon (click-to-add, double-click to close), text. Separate stroke + fill colour pickers and width slider. Synced + persisted.
• Rich text on canvas. In-place contentEditable editor (bold/italic/ lists/headings/emoji) replacing the prompt() dialog; HTML overlay that tracks pan/zoom.
• Multiple maps per scene. Add maps without replacing (multi-floor / side-by-side), lock/unlock + scale each map for grid alignment. Synced + persisted.
• 2D dice viewport. A self-contained 3D physics dice tray in a corner canvas in 2D mode, so players roll and see the result without leaving the battlemap. Rolls broadcast to the room.
• Signed room tokens. HMAC-signed short-lived tokens; the relay verifies signature + expiry against a shared secret. Live multiplayer no longer needs DEV_TRUST.
• Nextcloud 34 support. Dependency max-version bumped to 34.
• Asset library. AssetController browses Nextcloud Files (folders, thumbnails, direct file serving) with a BrowseList picker.
• Addon store verification. Catalog entries validated server-side; verified badge in the UI; warns on non-catalog installs.
• Dice calibration. d8/d12/d20 canonical face maps (opposites sum to max+1); d10 rebuilt as a true pentagonal trapezohedron.
• App Store-ready metadata. info.xml now includes website, repository, documentation links, and uses the SPDX licence identifier (AGPL-3.0-or-later).

Security patches from an external source-code audit (five findings — all addressed).

Fixed — security

• Rich text XSS (critical). Notes on the canvas were rendered with v-html unsanitized: any invited player could send/persist markup and run it in every viewer's Nextcloud-origin page. Rich text is now sanitized with DOMPurify (default safe profile — scripts, event handlers and javascript:/data: URLs stripped; heading/colour/list/link formatting preserved) at every entry point AND at render, so even previously-persisted malicious notes render inert.
• Scene-save takeover (high). The scene-save endpoint accepted a full document replacement from ANY invited player, including renaming the scene and wiping the map/fog/config. Player saves are now a server-side scoped merge: only keys whose permission layer allows updates pass through (tokens/blocks/maps/drawings/measurements), while name, gridConfig, mode and unknown keys remain GM-only and can no longer be overwritten or cleared. Also gained the standard raw-body fallback.
• ownerOnly token enforcement bypass (high). The token-ownership lookup queried a SCENE ROW by the token id (always missing), then fell back to the attacker-supplied owner field, and treated null (= unknown) as allowed — so ownerOnly token protection was effectively decorative and players could move or delete tokens of others. Ownership now resolves from the persisted scene document only, with no client fallback, and unknown ownership DENIES the action (deny by default).
• Third-party addon proxy / store endpoints removed (two highs). The iframe addon system was removed from the app in 0.7.1, but its server-side same-origin fetch proxy and store endpoints remained — serving attacker-controlled remote HTML from the Nextcloud origin and fetching attacker URLs with redirects left intact (SSRF class). Rather than hardening dead endpoints, they (and their DB entities, routes, and capability bridge references) are deleted outright.

Removed

• AddonProxyController, AddonController, Addon/AddonMapper entities and the /addon-proxy + /api/addons(-store) routes (dead since 0.7.1's addon consolidation; kept previously only for compatibility).

Dice physics/render fixes found by testing 0.7.8 in the field. (Repackaged in place after field-testing caught the d4's rest pose — see below.)

Fixed

• The d4 roll crashed at spawn and froze the table. Field-testing the first 0.7.9 packaging showed the d4 "spawning in the plane and doing nothing" (a half-buried wedge) in 3D and a frozen dice panel + stuck camera in 2D. Root cause, found by running the real module: _spawnDie never destructured labelValues — every d4 roll threw a ReferenceError AFTER the mesh was created but BEFORE the physics body existed, leaving a bodyless tetra at the scene origin (half of it below the floor — the wedge); the per-frame mesh sync then threw on d.body.position every frame, killing the render loop (room frozen at that frame; "does nothing"). Fixes: the destructure is complete; physics bodies are now created BEFORE cosmetic labels so a label failure can only log, never break the die or the loop; the per-frame sync skips body-less entries defensively; and the settle-snap block's stray CANNON reference (a second loop-killer at settle) now reads the stored this.CANNON. Verified by running the real module: dice tumble, settle at exact inradii (flush, apex up), sleep, and report values — d4, d8, d10, d20 in one batch.
• Settled dice now rest like real dice. The physics solver can stop a die mid-tilt (a tetra balancing on an edge/vertex contact) which read as "not a d4 at all" — and it leaves a small allowed penetration at rest (the d4 sank ~4% of its size — the "clips into the floor" look). On settle each die's most-downward face is rotated to exactly flat (apex straight up for the d4, crisp kites for the d10), residual sink is lifted out, and the pose is locked by sleeping the body. The result read runs on the snapped pose, so what you see and what is reported always agree.
• The d10's "wedge"/"no faces" and leaning rest. The trapezohedron's winding fix flipped only the FIRST triangle of each quad, leaving the other half of the kite faces wound inward. Consequences: cannon-es rejected those faces as pointing into the shape (the die could only rest on half of them, leaned/jittered and never went to sleep so rolls idled to the ~6s timeout), and the renderer BACKFACE-CULLED the inverted faces — the die looked like a half-missing "boat" wedge. The flip now reverses the entire quad cycle; verified numerically: no cannon warnings, the die sleeps after settling, and all faces render.
• Dice result view jumps back after ~half a second. The camera goal was dropped the moment it was reached, so the zoom snapped back to the overview immediately. The zoom now HOLDS until the next roll.
• Only one die showed when several rolled. The result camera now cycles through every resting die (~2.5s each, wrapping around) until the next roll.
• d4 numbers bigger and edge-adjacent to read like a physical d4.
• Striped/shadow-acne faces. The main light self-shadowed dice at ~0.04 units/texel, rendering dark diagonal stripes across faces ("texture issues"). Shadow bias + normalBias added.

Dice render fixes completing the 0.7.7 batch (kept 0.7.7's published tag intact; deploy 0.7.8 to get the whole batch).

Fixed

• d4 is a real, vertex-numbered d4. It rests on a face and the result is read at the TOP vertex (its direction points straight up when settled — verified numerically for all four settle states). Each face now prints THREE numbers near its edges — the value of each of its corners — exactly like a physical d4, so the result is legible from any viewing angle (the old face-centre labels were invisible when the upright face was seen edge-on, which is why numbers appeared only "from afar").
• d8 face map had duplicated values. The calibration call passed the FULL canonical list ([1,8,2,7,3,6,4,5]) where the pairing helper expects only the first half: pairs were built as (1→8), then (8→1), (2→7), then (7→2) — every value used twice, and 3/4/5/6 never appeared. Fixed to [1,2,3,4]; opposites now correctly sum to 9 with all eight values present.
• Face labels no longer land at arbitrary, upside-down twists. Label orientation is now canonical per face (the die's local up projected into the face plane, with a degeneracy fallback), shared by every die type — mirrored in the field as numbers reading "9" for a flipped "6", and the d10/d8 screenshots showing upside-down digits.
• Label textures skip mipmap generation (minor spawn-cost win).

The d10 die was geometrically wrong, 3D fog only appeared on mouse release and stuttered, and the draw tool was inert in 3D rooms.

Fixed — dice

• d10 rebuilt as a true pentagonal trapezohedron. The old construction was built with n=10 (a twenty-faced decagonal solid whose 0–9 values cycled across 20 faces, several doubled and mislabelled) and placed labels far off the faces. The new builder is exact: two apices, a 2n ring staggered between heights ±e, and the kite faces are provably planar for the exact stagger e = h(1−cos(π/n))/(1+cos(π/n)) — verified numerically (10 faces, each with an exact antipodal face, opposite values pairing to 0+9…4+5, labels sitting on the surface).

Fixed — 3D drawing & fog feel

• Strokes preview live in 3D. Fog brushes and the pencil now draw while you drag onto a live overlay canvas, instead of appearing only after the left button released.
• Laggy fog gone. Overlay textures upload at most once per frame via a dirty flag (a live stroke used to trigger a full 1024² texture re-upload per mouse-move); committed strokes redraw the canvas incrementally.
• The draw tool works in 3D rooms. Scene3D gained a drawings layer (pen/marker freehand, line/rect/ellipse/triangle/hexagon, polygon, and plain text notes) over the ground, in the same shared pixel stroke space and message formats as 2D — saves and live sync carry both room kinds' drawings.
• Rich text notes anchor and project correctly in 3D rooms (camera projection instead of the 2D stage transform).

Fixed

• File picker now works. Fixed OC.dialogs.filepicker call to use the correct 7-arg signature for Nextcloud 28+ — the picker shows a "Choose" button and the callback fires with the selected path.
• Permanent rulers no longer snap horizontal. In 3D the ruler stored y=0 (ground height) instead of z (depth), so all rulers appeared as flat horizontal lines. Now stores both y and z so the ruler renders at the correct depth in 3D mode.
• Render loop no longer steps dice in 2D mode. The 3D DiceRoller was stepping even in 2D mode; now only steps when mode is 3D (the DicePanel manages its own world in 2D).

Added

• DM Control Panel. A comprehensive left-side sidebar (🛠 in the toolbar, GM only) consolidating all DM controls:
• Scene: rename, grid type/size/line-width/opacity/style/colour, scale
• Layers: toggle visibility for grid, drawings, fog, fog preview
• Player permissions: per-layer create/update/delete/owner-only table
• Players: search Nextcloud users, invite, remove
• Session: send reminders, reveal all fog, delete scene Replaces the separate GridSettings and PermissionsPanel popovers.

Changed

• Consolidated dice UI. Replaced the separate floating DiceTray and DiceViewport with a single DicePanel sidebar. In 2D mode it shows a mini 3D canvas with the physics dice; in 3D mode it drives the main scene's DiceRoller. One panel, mode-appropriate behavior.
• Asset picker fixed. Rewrote AssetPicker to use Nextcloud's native OC.dialogs.filepicker and proper WebDAV URLs via generateRemoteUrl('dav'), so maps/tokens/models load with session auth. Removed the broken custom BrowseList.
• Addons inlined. Removed the iframe-based addon system. The initiative tracker is now a built-in Vue component toggled from the topbar (⚔).
• Nextcloud theming. All colors now use Nextcloud CSS variables (--color-primary-element, --color-main-background, --color-main-text, --color-border, etc.) so the app follows the user's light/dark theme and the admin's accent color automatically. No more hardcoded gold/blue.

Added

• Token health system. DM-controlled HP bars on every token (2D bar + 3D billboard). GM double-clicks a token to edit HP; quick ±1/±5 buttons. Synced + persisted; GM-only server-side.
• Measure modes. Transient ruler, permanent rulers (synced/persisted, right-click to delete), and movement mode (drag a token with a live ruler). Four measurement types: euclidean, chessboard, alternating-diagonal, manhattan. Per-scene ft/square scale.
• Grid controls. Square / hex-pointy / hex-flat grids, line style (solid/dashed/dotted), colour, opacity, width, per-scene scale. Grid settings popover (⊞ in the toolbar, GM only).
• Player permissions. Per-layer create/update/delete toggles for maps/tokens/drawings/fog, plus owner-only tokens. Enforced server-side on the room relay; GM bypasses. Permissions panel (🔒, GM only).
• Fog shapes & preview. Rect/circle/polygon fog modes (plus brush/eraser), cut/uncut toggle, fog preview (GM sees player view), configurable fog colour.
• Drawing modes. Pen, marker (closed freehand), line, rect, ellipse, triangle, hexagon, polygon (click-to-add, double-click to close), text. Separate stroke + fill colour pickers and width slider. Synced + persisted.
• Rich text on canvas. In-place contentEditable editor (bold/italic/ lists/headings/emoji) replacing the prompt() dialog; HTML overlay that tracks pan/zoom.
• Multiple maps per scene. Add maps without replacing (multi-floor / side-by-side), lock/unlock + scale each map for grid alignment. Synced + persisted.
• 2D dice viewport. A self-contained 3D physics dice tray in a corner canvas in 2D mode, so players roll and see the result without leaving the battlemap. Rolls broadcast to the room.
• Signed room tokens. HMAC-signed short-lived tokens; the relay verifies signature + expiry against a shared secret. Live multiplayer no longer needs DEV_TRUST.
• Nextcloud 34 support. Dependency max-version bumped to 34.
• Asset library. AssetController browses Nextcloud Files (folders, thumbnails, direct file serving) with a BrowseList picker.
• Addon store verification. Catalog entries validated server-side; verified badge in the UI; warns on non-catalog installs.
• Dice calibration. d8/d12/d20 canonical face maps (opposites sum to max+1); d10 rebuilt as a true pentagonal trapezohedron.
• App Store-ready metadata. info.xml now includes website, repository, documentation links, and uses the SPDX licence identifier (AGPL-3.0-or-later).

Security patches from an external source-code audit (five findings — all addressed).

Fixed — security

• Rich text XSS (critical). Notes on the canvas were rendered with v-html unsanitized: any invited player could send/persist markup and run it in every viewer's Nextcloud-origin page. Rich text is now sanitized with DOMPurify (default safe profile — scripts, event handlers and javascript:/data: URLs stripped; heading/colour/list/link formatting preserved) at every entry point AND at render, so even previously-persisted malicious notes render inert.
• Scene-save takeover (high). The scene-save endpoint accepted a full document replacement from ANY invited player, including renaming the scene and wiping the map/fog/config. Player saves are now a server-side scoped merge: only keys whose permission layer allows updates pass through (tokens/blocks/maps/drawings/measurements), while name, gridConfig, mode and unknown keys remain GM-only and can no longer be overwritten or cleared. Also gained the standard raw-body fallback.
• ownerOnly token enforcement bypass (high). The token-ownership lookup queried a SCENE ROW by the token id (always missing), then fell back to the attacker-supplied owner field, and treated null (= unknown) as allowed — so ownerOnly token protection was effectively decorative and players could move or delete tokens of others. Ownership now resolves from the persisted scene document only, with no client fallback, and unknown ownership DENIES the action (deny by default).
• Third-party addon proxy / store endpoints removed (two highs). The iframe addon system was removed from the app in 0.7.1, but its server-side same-origin fetch proxy and store endpoints remained — serving attacker-controlled remote HTML from the Nextcloud origin and fetching attacker URLs with redirects left intact (SSRF class). Rather than hardening dead endpoints, they (and their DB entities, routes, and capability bridge references) are deleted outright.

Removed

• AddonProxyController, AddonController, Addon/AddonMapper entities and the /addon-proxy + /api/addons(-store) routes (dead since 0.7.1's addon consolidation; kept previously only for compatibility).

Dice physics/render fixes found by testing 0.7.8 in the field. (Repackaged in place after field-testing caught the d4's rest pose — see below.)

Fixed

• The d4 roll crashed at spawn and froze the table. Field-testing the first 0.7.9 packaging showed the d4 "spawning in the plane and doing nothing" (a half-buried wedge) in 3D and a frozen dice panel + stuck camera in 2D. Root cause, found by running the real module: _spawnDie never destructured labelValues — every d4 roll threw a ReferenceError AFTER the mesh was created but BEFORE the physics body existed, leaving a bodyless tetra at the scene origin (half of it below the floor — the wedge); the per-frame mesh sync then threw on d.body.position every frame, killing the render loop (room frozen at that frame; "does nothing"). Fixes: the destructure is complete; physics bodies are now created BEFORE cosmetic labels so a label failure can only log, never break the die or the loop; the per-frame sync skips body-less entries defensively; and the settle-snap block's stray CANNON reference (a second loop-killer at settle) now reads the stored this.CANNON. Verified by running the real module: dice tumble, settle at exact inradii (flush, apex up), sleep, and report values — d4, d8, d10, d20 in one batch.
• Settled dice now rest like real dice. The physics solver can stop a die mid-tilt (a tetra balancing on an edge/vertex contact) which read as "not a d4 at all" — and it leaves a small allowed penetration at rest (the d4 sank ~4% of its size — the "clips into the floor" look). On settle each die's most-downward face is rotated to exactly flat (apex straight up for the d4, crisp kites for the d10), residual sink is lifted out, and the pose is locked by sleeping the body. The result read runs on the snapped pose, so what you see and what is reported always agree.
• The d10's "wedge"/"no faces" and leaning rest. The trapezohedron's winding fix flipped only the FIRST triangle of each quad, leaving the other half of the kite faces wound inward. Consequences: cannon-es rejected those faces as pointing into the shape (the die could only rest on half of them, leaned/jittered and never went to sleep so rolls idled to the ~6s timeout), and the renderer BACKFACE-CULLED the inverted faces — the die looked like a half-missing "boat" wedge. The flip now reverses the entire quad cycle; verified numerically: no cannon warnings, the die sleeps after settling, and all faces render.
• Dice result view jumps back after ~half a second. The camera goal was dropped the moment it was reached, so the zoom snapped back to the overview immediately. The zoom now HOLDS until the next roll.
• Only one die showed when several rolled. The result camera now cycles through every resting die (~2.5s each, wrapping around) until the next roll.
• d4 numbers bigger and edge-adjacent to read like a physical d4.
• Striped/shadow-acne faces. The main light self-shadowed dice at ~0.04 units/texel, rendering dark diagonal stripes across faces ("texture issues"). Shadow bias + normalBias added.

Dice render fixes completing the 0.7.7 batch (kept 0.7.7's published tag intact; deploy 0.7.8 to get the whole batch).

Fixed

• d4 is a real, vertex-numbered d4. It rests on a face and the result is read at the TOP vertex (its direction points straight up when settled — verified numerically for all four settle states). Each face now prints THREE numbers near its edges — the value of each of its corners — exactly like a physical d4, so the result is legible from any viewing angle (the old face-centre labels were invisible when the upright face was seen edge-on, which is why numbers appeared only "from afar").
• d8 face map had duplicated values. The calibration call passed the FULL canonical list ([1,8,2,7,3,6,4,5]) where the pairing helper expects only the first half: pairs were built as (1→8), then (8→1), (2→7), then (7→2) — every value used twice, and 3/4/5/6 never appeared. Fixed to [1,2,3,4]; opposites now correctly sum to 9 with all eight values present.
• Face labels no longer land at arbitrary, upside-down twists. Label orientation is now canonical per face (the die's local up projected into the face plane, with a degeneracy fallback), shared by every die type — mirrored in the field as numbers reading "9" for a flipped "6", and the d10/d8 screenshots showing upside-down digits.
• Label textures skip mipmap generation (minor spawn-cost win).

The d10 die was geometrically wrong, 3D fog only appeared on mouse release and stuttered, and the draw tool was inert in 3D rooms.

Fixed — dice

• d10 rebuilt as a true pentagonal trapezohedron. The old construction was built with n=10 (a twenty-faced decagonal solid whose 0–9 values cycled across 20 faces, several doubled and mislabelled) and placed labels far off the faces. The new builder is exact: two apices, a 2n ring staggered between heights ±e, and the kite faces are provably planar for the exact stagger e = h(1−cos(π/n))/(1+cos(π/n)) — verified numerically (10 faces, each with an exact antipodal face, opposite values pairing to 0+9…4+5, labels sitting on the surface).

Fixed — 3D drawing & fog feel

• Strokes preview live in 3D. Fog brushes and the pencil now draw while you drag onto a live overlay canvas, instead of appearing only after the left button released.
• Laggy fog gone. Overlay textures upload at most once per frame via a dirty flag (a live stroke used to trigger a full 1024² texture re-upload per mouse-move); committed strokes redraw the canvas incrementally.
• The draw tool works in 3D rooms. Scene3D gained a drawings layer (pen/marker freehand, line/rect/ellipse/triangle/hexagon, polygon, and plain text notes) over the ground, in the same shared pixel stroke space and message formats as 2D — saves and live sync carry both room kinds' drawings.
• Rich text notes anchor and project correctly in 3D rooms (camera projection instead of the 2D stage transform).

Fixed

• File picker now works. Fixed OC.dialogs.filepicker call to use the correct 7-arg signature for Nextcloud 28+ — the picker shows a "Choose" button and the callback fires with the selected path.
• Permanent rulers no longer snap horizontal. In 3D the ruler stored y=0 (ground height) instead of z (depth), so all rulers appeared as flat horizontal lines. Now stores both y and z so the ruler renders at the correct depth in 3D mode.
• Render loop no longer steps dice in 2D mode. The 3D DiceRoller was stepping even in 2D mode; now only steps when mode is 3D (the DicePanel manages its own world in 2D).

Added

• DM Control Panel. A comprehensive left-side sidebar (🛠 in the toolbar, GM only) consolidating all DM controls:
• Scene: rename, grid type/size/line-width/opacity/style/colour, scale
• Layers: toggle visibility for grid, drawings, fog, fog preview
• Player permissions: per-layer create/update/delete/owner-only table
• Players: search Nextcloud users, invite, remove
• Session: send reminders, reveal all fog, delete scene Replaces the separate GridSettings and PermissionsPanel popovers.

Changed

• Consolidated dice UI. Replaced the separate floating DiceTray and DiceViewport with a single DicePanel sidebar. In 2D mode it shows a mini 3D canvas with the physics dice; in 3D mode it drives the main scene's DiceRoller. One panel, mode-appropriate behavior.
• Asset picker fixed. Rewrote AssetPicker to use Nextcloud's native OC.dialogs.filepicker and proper WebDAV URLs via generateRemoteUrl('dav'), so maps/tokens/models load with session auth. Removed the broken custom BrowseList.
• Addons inlined. Removed the iframe-based addon system. The initiative tracker is now a built-in Vue component toggled from the topbar (⚔).
• Nextcloud theming. All colors now use Nextcloud CSS variables (--color-primary-element, --color-main-background, --color-main-text, --color-border, etc.) so the app follows the user's light/dark theme and the admin's accent color automatically. No more hardcoded gold/blue.

Added

• Token health system. DM-controlled HP bars on every token (2D bar + 3D billboard). GM double-clicks a token to edit HP; quick ±1/±5 buttons. Synced + persisted; GM-only server-side.
• Measure modes. Transient ruler, permanent rulers (synced/persisted, right-click to delete), and movement mode (drag a token with a live ruler). Four measurement types: euclidean, chessboard, alternating-diagonal, manhattan. Per-scene ft/square scale.
• Grid controls. Square / hex-pointy / hex-flat grids, line style (solid/dashed/dotted), colour, opacity, width, per-scene scale. Grid settings popover (⊞ in the toolbar, GM only).
• Player permissions. Per-layer create/update/delete toggles for maps/tokens/drawings/fog, plus owner-only tokens. Enforced server-side on the room relay; GM bypasses. Permissions panel (🔒, GM only).
• Fog shapes & preview. Rect/circle/polygon fog modes (plus brush/eraser), cut/uncut toggle, fog preview (GM sees player view), configurable fog colour.
• Drawing modes. Pen, marker (closed freehand), line, rect, ellipse, triangle, hexagon, polygon (click-to-add, double-click to close), text. Separate stroke + fill colour pickers and width slider. Synced + persisted.
• Rich text on canvas. In-place contentEditable editor (bold/italic/ lists/headings/emoji) replacing the prompt() dialog; HTML overlay that tracks pan/zoom.
• Multiple maps per scene. Add maps without replacing (multi-floor / side-by-side), lock/unlock + scale each map for grid alignment. Synced + persisted.
• 2D dice viewport. A self-contained 3D physics dice tray in a corner canvas in 2D mode, so players roll and see the result without leaving the battlemap. Rolls broadcast to the room.
• Signed room tokens. HMAC-signed short-lived tokens; the relay verifies signature + expiry against a shared secret. Live multiplayer no longer needs DEV_TRUST.
• Nextcloud 34 support. Dependency max-version bumped to 34.
• Asset library. AssetController browses Nextcloud Files (folders, thumbnails, direct file serving) with a BrowseList picker.
• Addon store verification. Catalog entries validated server-side; verified badge in the UI; warns on non-catalog installs.
• Dice calibration. d8/d12/d20 canonical face maps (opposites sum to max+1); d10 rebuilt as a true pentagonal trapezohedron.
• App Store-ready metadata. info.xml now includes website, repository, documentation links, and uses the SPDX licence identifier (AGPL-3.0-or-later).