IntroVox - Releases

IntroVox grows from one welcome tour into tours for Nextcloud and its apps. The major version marks that, and a few changes to the app's HTTP routes that a script outside the app could notice; the stored tours, steps and settings carry over as they are.

Upgrade notes

• Nothing new reaches users until an admin switches it on. App tours, the built-in tours for Files, Talk, Deck and Calendar, and the Dashboard checklist all start switched off. The one exception is Tours in the user menu, which everyone sees; hide it under Settings.
• The personal "disable the tour" switch now covers every tour. A repair step (IntroduceTours) turns tours off for people who had switched the welcome tour off without finishing it; people who finished or skipped it will get app tours once an admin switches one on.
• Telemetry waits for an admin. It is sent only after an admin has opened IntroVox's settings and been asked, once per instance. Until then an updated instance sends nothing.
• Changes for scripts that call IntroVox's routes directly:
• POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id} are gone; use POST /admin/steps (see Removed).
• GET /api/steps needs a logged-in user and the CSRF request token; it was public.
• The admin GET routes, the personal settings and POST /api/wizard/{start,complete,skip} need the request token too.
• POST /admin/settings ignores showToAll; use POST /admin/tours/welcome/reshow.
• Older step exports still import, but a step is now checked like one saved in the editor: an id of letters, digits, _, . and -, a title of at most 500 characters, a known position, and a file of at most 1 MB. Exports made with IntroVox pass; a hand-made file may be refused.

Added

• Tours for apps and pages. Besides the welcome tour, an admin can make a short tour that starts the first time someone opens an app, such as Talk or Deck, or another page of Nextcloud. Each tour has its own steps and languages, can be limited to groups, and can go to everyone or only to people who log in for the first time after it was switched on. It starts once per user, once the app has loaded, and never on top of another tour: someone new gets the welcome tour first. A new tour starts switched off. See Tours.
• Users can start every tour themselves, from a list in their personal settings that says which ones they have seen.
• Statistics per tour, and how far people get. The Statistics pane shows each tour on its own: how many people started, finished and skipped it, and for every step how many got at least that far, so you can see where people stop. Counted per person, only for runs that started by themselves, and only as totals; none of it is sent with the usage statistics. See Statistics.
• Move a whole tour to another Nextcloud. Export tour downloads one .zip with the tour's settings, its steps in every language and its images and videos; Import tour adds it as a new tour, switched off, uploaded or from your own Files. Groups and media this Nextcloud cannot take are left out and named. A package is checked as strictly as an upload. See Move a tour to another Nextcloud.
• Built-in tours for Files, Talk, Deck and Calendar, switched off until you switch them on, and translated like the welcome tour. Each lets users do the app's main job once with their own work (make and share a folder, set up a team conversation, add a card with a due date, plan an event) and then shows what matters most at work, in 11 steps, written from the Nextcloud documentation and reviewed for adoption, accuracy and robust selectors. Their steps can be changed per language and reset; who gets them and when can be set like for any tour. See Built-in tours.
• Share a tour with a link. Copy link in a tour's menu gives a link that opens the tour's page and starts the tour there, for a welcome mail or a message to a team. It works like a start by hand: also for people who saw the tour, only for people who may get it, and not counted in the statistics. While the tour is switched off, Copy link says the link starts nothing yet. See Share a tour with a link.
• "Tours" in the user menu, just above Help, leads everyone to their tours in the personal settings. An admin can hide it under Settings.
• When a tour starts by itself: not before a number of days after someone's first login, and only between two dates. Starting it by hand or with a link always works.
• Tours that start anywhere, on whichever page someone opens next: with a number of days, a tip that comes once someone has found their way.
• Steps that wait for the user. A step whose element only appears after the user did something (a conversation they create, a file's sharing they open) stands aside in the corner, leaves the page usable, and moves to the element as soon as it is there. Together with "Click on the element", a tour can now lead someone through creating a conversation and adding people, in any app. The element picker says so when the element was reached by using the page. Continue with: Filling in the field keeps Next off until a field has text, such as a new conversation's name. The element a step points at has a clear outline and a blinking arrow, also inside dialogs. See Steps that wait for the user.
• "Getting started" on the Dashboard. An admin can offer everyone a checklist of first things to do: take the welcome tour, upload a file, add a profile picture, install the app, send a message in Talk, secure the account with two-factor authentication. Each task links to where it is done and ticks itself off once the user did it. Admins can add tasks of their own, such as "Open Talk" or the folder with the handbook, ticked off once opened from the list. Off by default; the admin picks the tasks and can put the list on every Dashboard, and everyone can remove it under Customize. See Checklist on the Dashboard.
• Translate a tour, or write its steps, with AI. With a provider for the Nextcloud Assistant set up, Translate with AI translates a tour's steps into other languages, words only, and Write steps with AI writes new steps from a description. You check and can change every step before it is saved. See Write or translate steps with AI.

• Images, GIFs and videos in steps. A step can show one image (PNG, JPEG), animated GIF or video (MP4, WebM) above its text: uploaded, chosen from the admin's own Files, or pasted as a screenshot. A description is required unless the image is decorative; videos play with a play button or silently like a GIF, and can have captions. Anything that moves can be paused, and stays still for people with reduced motion. Only files from this Nextcloud: IntroVox keeps its own copy, checks the real file type and strips metadata such as location, and only users who get the step can load the file. See Image or video and the threat model.

• Pick the element a step points at instead of typing a CSS selector. Pick element in the step editor opens Nextcloud full-screen on the settings page: click the element, and a selector that survives reloads, other languages and most updates is filled in, with a matching tooltip position. To pick something inside a menu, open the menu in Browse mode and Shift-click the item; the step then opens that menu itself before it shows (new Open first field).

• Tours can span apps. A step can belong to a page, such as /apps/spreed/ for Talk; the tour opens that app when it gets there and carries on, with Back working the same way. Pick element fills the page in. Steps in an app a user can't open are skipped, and a tour that went to other apps returns to the homepage on Done.

• Steps that continue on a click. With Continue with: Click on the element, users click the highlighted element ("Click New conversation") instead of a Next button, and the step tells them so. If the element is missing, a Next button appears instead.

• Preview the tour before users get it. Preview tour runs the tour for the language being edited, optionally as a member of one group; Test this step shows a single step, unsaved edits included. A preview is not counted in the statistics and does not mark the tour as seen for the admin.

• Step texts are written with formatting instead of HTML. The Text field is an editor that shows the text as the tour will, with a toolbar for bold, italic, a heading, lists, links, code and emoji; the title has an emoji button too. Links open in a new tab, so the tour stays where it is. Edit as HTML shows the HTML itself. HTML that users never see, because the tour removes it, is left out of the editor with a line saying what; it only goes from the stored text once the text is changed. Texts are still stored as HTML: exports, imports and the translated default steps are unaffected.

• A short tour of the admin page for every admin, the first time they open IntroVox's settings: the parts of the page, languages, how to make a step in four moves, the preview, and a link to the manual. It uses the same tour users get. Show the admin tour again under Support runs it again.

• Steps can be reordered without a mouse. Every step has Move up and Move down buttons beside the drag handle. Reordering was drag-only, so it could not be done from the keyboard or with a screen reader at all — the two buttons save the new order the same way a drag does.

• Translations in 105 languages, from Transifex as they stood on release day. Danish is complete; Spanish, Dutch and French are largely translated, partly by machine and not yet reviewed by their language teams. Languages with only a few translated strings are included too: what is not translated shows in English.

Changed

• The Steps pane is now Tours: a list of the tours, each with a switch, Edit steps, a preview, Show again to everyone and, for app tours, Delete. The step editor opens from there. The main switch is called Tours for everyone.
• "Permanently disable the introduction tour" in the personal settings is now "Start tours by themselves", and covers every tour. Users who had switched the tour off there keep tours off after the update; users who finished or skipped it get app tours.
• Show wizard to all users is now Show again to everyone, in the welcome tour's menu under Tours, like for every other tour. It no longer overrides people who switched tours off; everyone else who saw the welcome tour gets it again, as before.
• The Statistics pane counts people, not clicks, for skipping too: "Times skipped" is now "Users skipped".
• Pages load less. The script every page loads is 18 KB instead of 252 KB, and asks the server nothing: it decides from what the page already carries whether a tour starts, and only then loads the tour itself.
• A same-origin frame of another app starts no tour inside it.
• Wording follows Nextcloud's own terms: people and accounts instead of "users" where it means everyone, and no contractions such as "don't" in the new strings.

• The English source strings use American spelling, as Nextcloud itself does: "customise" became "customize". Until translators catch up, that one string shows in English in the languages that had it translated.

• Every change to the steps is saved straight away: saving a step, deleting, reordering and switching a step on or off. The Save changes button only appears to retry a save that failed. The personal "disable the tour" switch saves straight away too.

• Steps are edited in a dialog, a page at a time: content, element, behavior and who sees it. New steps walk through the pages; existing ones can be saved from any page. Element, page and menu are summarised next to Pick element, with the fields folded away under Edit by hand. The step list itself no longer expands an editor.

• The admin and personal settings pages use Nextcloud's own components and icons instead of emoji buttons and plain form fields. Buttons show their intended colours again; with @nextcloud/vue 9 every one of them had rendered as a plain grey button.

• The tabs across the top of the admin page are Nextcloud's own pane switcher, the control core uses for a settings page with several parts. They were hand-built buttons: a screen reader heard four loose buttons with nothing saying they belonged together or which one was open. On a phone the row no longer runs off the side of the screen — the fourth tab used to be unreachable, because the page does not scroll sideways.

• Text in the tour and on both settings pages follows the sizes the theme sets. Sizes were fixed in the code, four of them smaller than Nextcloud's smallest — a size no display setting could enlarge. They now scale with the rest of the interface.

• Lists in a step show bullets. Nextcloud's stylesheet takes them off every list, so a list in the tour looked like a column of indented lines. This shows in the default steps too.

• Telemetry is only sent once an admin has been asked. The admin tour ends with the question, with a list of what is sent; it is asked once per instance. After that telemetry is on unless an admin chose not to share, as before. Instances where nobody opened IntroVox's settings since the update send nothing. The list of what is sent now also names the tour counts, the country, Docker and the license key.

Removed

• Three unused admin endpoints: POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id}. The app has always saved the step list as a whole through POST /admin/steps; nothing called these. Anything outside the app that did call them must move to POST /admin/steps.

Fixed

• A fallback selector won over the main one: with an element such as .cards, #navigation a, a step pointed at whichever came first in the page, here the navigation. The selectors are now tried in the order they were written.
• People with a regional language, such as pt_BR, zh_CN or es_419, got the welcome tour in English: only the first two letters of a language were used, so a translation or an administrator's own steps for the full language were never shown. Now the full language comes first, then its base language.

• A welcome tour with every step switched off, or only with steps for other groups, showed the built-in steps to the people it was meant to show nothing. It shows nothing now.

• Edited and new steps were gone after a reload. Save in the step editor only updated the list in the browser; nothing reached the server until a separate Save changes button at the top of the list was clicked, and leaving the page did not warn.

• Cancel deleted saved steps. Cancelling the editor removed any step that had once been created with Add step, even one saved long before.

• The tour started about ten seconds late on Nextcloud 34 and 35, also after "Restart tour now". It waited for the inline app bar of older versions, which no longer exists, until a timeout.

• A new element for the Files, Search or Settings default step was ignored; the tour kept pointing at the built-in one.

• Steps pointing into the apps menu lost it as soon as the mouse moved to the tour's tooltip: Nextcloud 35 closes that menu 180 ms after the pointer leaves it. The tour now keeps the menu open for as long as the step shows. This affected the built-in Files step too.

• On instances installed in a subdirectory or without pretty URLs, users could get the built-in tour instead of the admin's. The tour fetched its steps from a hard-coded address that does not exist there, and fell back to the bundled defaults.

• Bold words in a step looked like links. They were shown in the same blue as a real link, so in the built-in "Important features" step "apps menu", "avatar" and "search bar" invited a click that did nothing. Bold is now bold: the colour is the text colour, and blue again means a link. This applies to every step, including ones written by an admin or a translator.

• The highlight around the element a step points at follows the server's colour. It was always Nextcloud blue, so on an instance with its own brand colour the outline took the brand colour and the glow around it stayed blue.

• The language picker in the step editor had no name a screen reader could read. It is labelled "Language" now, as is the one in the Add language override dialog.

• The close button in the tour showed its own tooltip on hover, which repeated the label a screen reader already reads and could not be dismissed with Escape. The button keeps its name; the extra tooltip is gone.

• The tour dialog and the settings pages line up with the rest of Nextcloud again. The tour's header was a grey band with a blue title; the tabs, the step list and the Support page each started at a different distance from the left edge of the page.

• A failed load of the step list looked like an empty tour. Adding a step to it would have replaced the whole tour for that language. The admin page now shows an error with a Try again button, and adding steps or previewing waits until the list has loaded.

• The text field of a step showed "HTML content placeholder" as its placeholder, a translation key that never got a text.

• Less motion where people asked for it. With reduced motion switched on, the tour and the step list jump to a step instead of scrolling smoothly. The arrow and the outline around a step's element blink a few times and then stay still, for everyone, instead of blinking for as long as the step shows.

• The full-screen Nextcloud page of Pick element and Preview tour kept the admin page reachable: Tab and a screen reader could leave the overlay for the page underneath. That page is now out of reach until the overlay closes.

• The pause button of a GIF or video kept a blue tint after a click, and showed a tooltip that repeated its label.

• The app's icon was a solid disc in the app list, and white on white where Nextcloud shows it on a light background. It is drawn again from filled shapes, for 20 pixels.

Security

• Media in steps is checked by its content. The type of an image or video is taken from its bytes, never from its name; SVG, HTML and every type other than PNG, JPEG, GIF, MP4, WebM and WebVTT captions are refused. Location and other metadata are stripped before the file is stored, and size, pixels, frames and total storage are limited. See the threat model.
• Media is only served to people who get the step, as a download that can do nothing on its own: nosniff, Content-Security-Policy: default-src 'none'; sandbox and Cross-Origin-Resource-Policy: same-origin.
• Step text is sanitized in the browser as well, with DOMPurify and a strict allowlist, wherever it is shown as HTML: in the tour, in the step list and in the AI review.
• Tour packages trust nothing. File names, sizes and the number of files are checked before anything is unpacked, and every tour, step and file goes through the same checks as one made in the editor.
• Rate limits on the tracking routes and on the AI routes.
• Every route needs the CSRF request token, also the ones that only read, except two that cannot send one and only read or redirect: GET /media/{file}, which an <img> or <video> loads, and GET /tour/{id}, a tour's share link.

Fixed

• The admin and personal settings pages were stuck in English, whatever language the account used. The tour itself translated correctly, which made the screens look half-finished: a French tour wrapped in an English settings page. 120 of the app's 207 texts had never reached the translators at all — the tabs, "Global settings", "Enable wizard for all users" and every confirmation and error message on those pages. All 205 translatable texts are now in the template, and the newly exposed ones will appear language by language as translators work through them.

• Seven messages in the admin settings showed a literal %s instead of the value they were meant to insert: importing a tour reported Successfully imported %s steps for language %s rather than the number of steps and the language, and the four error messages on that page ended in a bare %s where the reason for the failure should have been. All seven now show the actual values.

Added

• A continuous-integration pipeline runs on every push: a PHP syntax check, the JavaScript unit tests, a production build, a security scan of the backend, and guards that assert every text the settings screens use is actually collected for translation. The failure fixed above went unnoticed for three months because nothing ever checked it.

Changed

• Nine texts were reworded for the Nextcloud style guidelines: a non-breaking space before an ellipsis so the dots never wrap onto their own line ("Saving …", "Loading …"), sentence case for "Anonymous usage statistics", and no more "successfully" in success messages, which appear in a success-styled notification anyway. The import message became Imported {count} steps ({language}). Texts that had translations revert to English until translators pick up the new wording.

• Two more languages: Indonesian and Slovak, both fully translated. They were available from the translation service but had been left out of the shipped set by an oversight in the previous release. The app ships languages that pass the 25% translation threshold.

Added

• More translated strings in Danish, German (both variants), Estonian and Brazilian Portuguese — mostly the Support tab introduced in 1.7.7.

Fixed

• A customized tour showed default steps the admin had deleted. An admin who removed default steps from their tour — say search, settings and intro — still saw them appear in the running tour, in the bundled default wording rather than their own. The steps were re-inserted in the browser: enrichSteps() re-attached the behavioral fields the API cannot send (function selectors, beforeShowPromise, when) and, while doing so, also injected every bundled default step whose id was absent from the API response. Because they were spliced in after the step preceding them in the default order, they surfaced as a block in the middle of the tour, with default copy and default tone-of-voice — an informal address in languages that distinguish it. The API was right all along: it returned only the configured steps, with useDefault: false. The injection is gone; the server is now solely authoritative over which steps exist and in what order, and enrichSteps() only restores behaviors onto steps the server actually sent. Removing a default step is now what it looks like. Introduced in 1.7.4; 1.7.4 through 1.7.7 are affected.

• The "Your account & settings" step highlighted the wrong area on Nextcloud 32 and 33. Its selector chain led with .header-menu__trigger, a class Nextcloud 34 introduced. On 32 and 33 that class does not exist (the markup is #user-menu.account-menu > button > .account-menu__avatar), so every specific link in the chain missed and it fell through to the bare #user-menu wrapper — putting the spotlight around the whole header container instead of the avatar. The chain now tries the avatar itself before falling back, which is the same class on 32 through 35. The English-only [aria-label="Settings menu"] match was also demoted: core renders that label through the translation layer, so it never matched on a non-English instance anyway. Nextcloud 34 and 35 keep using the trigger they always did. Fixed in both the bundled tour and the server-side defaults. Introduced in 1.7.4.

• Usage reporting could count one server as two, which left the figures on the licence server stale. Affected instances correct themselves at the next report; nothing needs to be reconfigured. Reporting only — nothing in the app behaves differently.

Added

• Nextcloud 35 support. max-version raised from 34 to 35 so the app installs on Nextcloud 35. Nextcloud 32 remains the minimum — 32, 33 and 34 are all still maintained, and PHP stays at 8.1 because Nextcloud 32 runs on it (Nextcloud 35 enforces PHP 8.3 itself).

Changed

• Controller access rules now use PHP attributes. All 19 PHPDoc annotations (@NoAdminRequired, @NoCSRFRequired, @PublicPage) became #[NoAdminRequired], #[NoCSRFRequired] and #[PublicPage]. Nextcloud 35 still reads the old annotations, so this changes no behaviour today — it is the form that will keep working. Verified per method that every endpoint kept exactly the same access rules.

• IntroVox is free, and the Support tab now says so. The tab offered a subscription key, per-language progress bars ("0 / 10 steps") and a warning that new steps required a subscription. None of that reflected reality — IntroVox is free at every tier and no code path ever blocked a save — so the key field, the progress bars and the limit warning are gone. In their place: what the app is (free, open source, no user limit, no paid features), a pointer to the other VoxCloud apps for Nextcloud, and where to get help. Step counts per language remain visible on the Steps tab. Existing installations with a stored subscription key are unaffected; the licensing endpoints still exist and simply have no UI.

Fixed

• The tour named a specific Nextcloud version. The Files step read "On Nextcloud 34 it lives in the apps menu", which was simply wrong on Nextcloud 35. The layout is identical on 34 and 35, so the version number is gone: "You will find it in the apps menu (top left)". The admin hint about selectors lost its version reference too.

• Telemetry logged an hourly warning that said nothing. TelemetryJob: Telemetry report failed appeared every hour with no reason attached, because both failure paths in sendReport() returned silently. The cause turned out to be the license server's rate limit: it accepts one report per instance per hour and answers HTTP 429, while the job runs more often. That expected case is now a debug line instead of a warning, and every real failure logs what actually went wrong (status code plus response, or the exception).

• Telemetry mis-detected Nextcloud Enterprise. The subscription check read the Extended Support add-on rather than the subscription itself, so instances with a plain Enterprise subscription were reported as Community. It now uses IRegistry::delegateHasValidSubscription() (public API since NC 17). This only affects the usage figures reported back to VoxCloud; nothing in the app behaves differently.

IntroVox grows from one welcome tour into tours for Nextcloud and its apps. The major version marks that, and a few changes to the app's HTTP routes that a script outside the app could notice; the stored tours, steps and settings carry over as they are.

Upgrade notes

• Nothing new reaches users until an admin switches it on. App tours, the built-in tours for Files, Talk, Deck and Calendar, and the Dashboard checklist all start switched off. The one exception is Tours in the user menu, which everyone sees; hide it under Settings.
• The personal "disable the tour" switch now covers every tour. A repair step (IntroduceTours) turns tours off for people who had switched the welcome tour off without finishing it; people who finished or skipped it will get app tours once an admin switches one on.
• Telemetry waits for an admin. It is sent only after an admin has opened IntroVox's settings and been asked, once per instance. Until then an updated instance sends nothing.
• Changes for scripts that call IntroVox's routes directly:
• POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id} are gone; use POST /admin/steps (see Removed).
• GET /api/steps needs a logged-in user and the CSRF request token; it was public.
• The admin GET routes, the personal settings and POST /api/wizard/{start,complete,skip} need the request token too.
• POST /admin/settings ignores showToAll; use POST /admin/tours/welcome/reshow.
• Older step exports still import, but a step is now checked like one saved in the editor: an id of letters, digits, _, . and -, a title of at most 500 characters, a known position, and a file of at most 1 MB. Exports made with IntroVox pass; a hand-made file may be refused.

Added

• Tours for apps and pages. Besides the welcome tour, an admin can make a short tour that starts the first time someone opens an app, such as Talk or Deck, or another page of Nextcloud. Each tour has its own steps and languages, can be limited to groups, and can go to everyone or only to people who log in for the first time after it was switched on. It starts once per user, once the app has loaded, and never on top of another tour: someone new gets the welcome tour first. A new tour starts switched off. See Tours.
• Users can start every tour themselves, from a list in their personal settings that says which ones they have seen.
• Statistics per tour, and how far people get. The Statistics pane shows each tour on its own: how many people started, finished and skipped it, and for every step how many got at least that far, so you can see where people stop. Counted per person, only for runs that started by themselves, and only as totals; none of it is sent with the usage statistics. See Statistics.
• Move a whole tour to another Nextcloud. Export tour downloads one .zip with the tour's settings, its steps in every language and its images and videos; Import tour adds it as a new tour, switched off, uploaded or from your own Files. Groups and media this Nextcloud cannot take are left out and named. A package is checked as strictly as an upload. See Move a tour to another Nextcloud.
• Built-in tours for Files, Talk, Deck and Calendar, switched off until you switch them on, and translated like the welcome tour. Each lets users do the app's main job once with their own work (make and share a folder, set up a team conversation, add a card with a due date, plan an event) and then shows what matters most at work, in 11 steps, written from the Nextcloud documentation and reviewed for adoption, accuracy and robust selectors. Their steps can be changed per language and reset; who gets them and when can be set like for any tour. See Built-in tours.
• Share a tour with a link. Copy link in a tour's menu gives a link that opens the tour's page and starts the tour there, for a welcome mail or a message to a team. It works like a start by hand: also for people who saw the tour, only for people who may get it, and not counted in the statistics. While the tour is switched off, Copy link says the link starts nothing yet. See Share a tour with a link.
• "Tours" in the user menu, just above Help, leads everyone to their tours in the personal settings. An admin can hide it under Settings.
• When a tour starts by itself: not before a number of days after someone's first login, and only between two dates. Starting it by hand or with a link always works.
• Tours that start anywhere, on whichever page someone opens next: with a number of days, a tip that comes once someone has found their way.
• Steps that wait for the user. A step whose element only appears after the user did something (a conversation they create, a file's sharing they open) stands aside in the corner, leaves the page usable, and moves to the element as soon as it is there. Together with "Click on the element", a tour can now lead someone through creating a conversation and adding people, in any app. The element picker says so when the element was reached by using the page. Continue with: Filling in the field keeps Next off until a field has text, such as a new conversation's name. The element a step points at has a clear outline and a blinking arrow, also inside dialogs. See Steps that wait for the user.
• "Getting started" on the Dashboard. An admin can offer everyone a checklist of first things to do: take the welcome tour, upload a file, add a profile picture, install the app, send a message in Talk, secure the account with two-factor authentication. Each task links to where it is done and ticks itself off once the user did it. Admins can add tasks of their own, such as "Open Talk" or the folder with the handbook, ticked off once opened from the list. Off by default; the admin picks the tasks and can put the list on every Dashboard, and everyone can remove it under Customize. See Checklist on the Dashboard.
• Translate a tour, or write its steps, with AI. With a provider for the Nextcloud Assistant set up, Translate with AI translates a tour's steps into other languages, words only, and Write steps with AI writes new steps from a description. You check and can change every step before it is saved. See Write or translate steps with AI.

• Images, GIFs and videos in steps. A step can show one image (PNG, JPEG), animated GIF or video (MP4, WebM) above its text: uploaded, chosen from the admin's own Files, or pasted as a screenshot. A description is required unless the image is decorative; videos play with a play button or silently like a GIF, and can have captions. Anything that moves can be paused, and stays still for people with reduced motion. Only files from this Nextcloud: IntroVox keeps its own copy, checks the real file type and strips metadata such as location, and only users who get the step can load the file. See Image or video and the threat model.

• Pick the element a step points at instead of typing a CSS selector. Pick element in the step editor opens Nextcloud full-screen on the settings page: click the element, and a selector that survives reloads, other languages and most updates is filled in, with a matching tooltip position. To pick something inside a menu, open the menu in Browse mode and Shift-click the item; the step then opens that menu itself before it shows (new Open first field).

• Tours can span apps. A step can belong to a page, such as /apps/spreed/ for Talk; the tour opens that app when it gets there and carries on, with Back working the same way. Pick element fills the page in. Steps in an app a user can't open are skipped, and a tour that went to other apps returns to the homepage on Done.

• Steps that continue on a click. With Continue with: Click on the element, users click the highlighted element ("Click New conversation") instead of a Next button, and the step tells them so. If the element is missing, a Next button appears instead.

• Preview the tour before users get it. Preview tour runs the tour for the language being edited, optionally as a member of one group; Test this step shows a single step, unsaved edits included. A preview is not counted in the statistics and does not mark the tour as seen for the admin.

• Step texts are written with formatting instead of HTML. The Text field is an editor that shows the text as the tour will, with a toolbar for bold, italic, a heading, lists, links, code and emoji; the title has an emoji button too. Links open in a new tab, so the tour stays where it is. Edit as HTML shows the HTML itself. HTML that users never see, because the tour removes it, is left out of the editor with a line saying what; it only goes from the stored text once the text is changed. Texts are still stored as HTML: exports, imports and the translated default steps are unaffected.

• A short tour of the admin page for every admin, the first time they open IntroVox's settings: the parts of the page, languages, how to make a step in four moves, the preview, and a link to the manual. It uses the same tour users get. Show the admin tour again under Support runs it again.

• Steps can be reordered without a mouse. Every step has Move up and Move down buttons beside the drag handle. Reordering was drag-only, so it could not be done from the keyboard or with a screen reader at all — the two buttons save the new order the same way a drag does.

• Translations in 105 languages, from Transifex as they stood on release day. Danish is complete; Spanish, Dutch and French are largely translated, partly by machine and not yet reviewed by their language teams. Languages with only a few translated strings are included too: what is not translated shows in English.

Changed

• The Steps pane is now Tours: a list of the tours, each with a switch, Edit steps, a preview, Show again to everyone and, for app tours, Delete. The step editor opens from there. The main switch is called Tours for everyone.
• "Permanently disable the introduction tour" in the personal settings is now "Start tours by themselves", and covers every tour. Users who had switched the tour off there keep tours off after the update; users who finished or skipped it get app tours.
• Show wizard to all users is now Show again to everyone, in the welcome tour's menu under Tours, like for every other tour. It no longer overrides people who switched tours off; everyone else who saw the welcome tour gets it again, as before.
• The Statistics pane counts people, not clicks, for skipping too: "Times skipped" is now "Users skipped".
• Pages load less. The script every page loads is 18 KB instead of 252 KB, and asks the server nothing: it decides from what the page already carries whether a tour starts, and only then loads the tour itself.
• A same-origin frame of another app starts no tour inside it.
• Wording follows Nextcloud's own terms: people and accounts instead of "users" where it means everyone, and no contractions such as "don't" in the new strings.

• The English source strings use American spelling, as Nextcloud itself does: "customise" became "customize". Until translators catch up, that one string shows in English in the languages that had it translated.

• Every change to the steps is saved straight away: saving a step, deleting, reordering and switching a step on or off. The Save changes button only appears to retry a save that failed. The personal "disable the tour" switch saves straight away too.

• Steps are edited in a dialog, a page at a time: content, element, behavior and who sees it. New steps walk through the pages; existing ones can be saved from any page. Element, page and menu are summarised next to Pick element, with the fields folded away under Edit by hand. The step list itself no longer expands an editor.

• The admin and personal settings pages use Nextcloud's own components and icons instead of emoji buttons and plain form fields. Buttons show their intended colours again; with @nextcloud/vue 9 every one of them had rendered as a plain grey button.

• The tabs across the top of the admin page are Nextcloud's own pane switcher, the control core uses for a settings page with several parts. They were hand-built buttons: a screen reader heard four loose buttons with nothing saying they belonged together or which one was open. On a phone the row no longer runs off the side of the screen — the fourth tab used to be unreachable, because the page does not scroll sideways.

• Text in the tour and on both settings pages follows the sizes the theme sets. Sizes were fixed in the code, four of them smaller than Nextcloud's smallest — a size no display setting could enlarge. They now scale with the rest of the interface.

• Lists in a step show bullets. Nextcloud's stylesheet takes them off every list, so a list in the tour looked like a column of indented lines. This shows in the default steps too.

• Telemetry is only sent once an admin has been asked. The admin tour ends with the question, with a list of what is sent; it is asked once per instance. After that telemetry is on unless an admin chose not to share, as before. Instances where nobody opened IntroVox's settings since the update send nothing. The list of what is sent now also names the tour counts, the country, Docker and the license key.

Removed

• Three unused admin endpoints: POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id}. The app has always saved the step list as a whole through POST /admin/steps; nothing called these. Anything outside the app that did call them must move to POST /admin/steps.

Fixed

• A fallback selector won over the main one: with an element such as .cards, #navigation a, a step pointed at whichever came first in the page, here the navigation. The selectors are now tried in the order they were written.
• People with a regional language, such as pt_BR, zh_CN or es_419, got the welcome tour in English: only the first two letters of a language were used, so a translation or an administrator's own steps for the full language were never shown. Now the full language comes first, then its base language.

• A welcome tour with every step switched off, or only with steps for other groups, showed the built-in steps to the people it was meant to show nothing. It shows nothing now.

• Edited and new steps were gone after a reload. Save in the step editor only updated the list in the browser; nothing reached the server until a separate Save changes button at the top of the list was clicked, and leaving the page did not warn.

• Cancel deleted saved steps. Cancelling the editor removed any step that had once been created with Add step, even one saved long before.

• The tour started about ten seconds late on Nextcloud 34 and 35, also after "Restart tour now". It waited for the inline app bar of older versions, which no longer exists, until a timeout.

• A new element for the Files, Search or Settings default step was ignored; the tour kept pointing at the built-in one.

• Steps pointing into the apps menu lost it as soon as the mouse moved to the tour's tooltip: Nextcloud 35 closes that menu 180 ms after the pointer leaves it. The tour now keeps the menu open for as long as the step shows. This affected the built-in Files step too.

• On instances installed in a subdirectory or without pretty URLs, users could get the built-in tour instead of the admin's. The tour fetched its steps from a hard-coded address that does not exist there, and fell back to the bundled defaults.

• Bold words in a step looked like links. They were shown in the same blue as a real link, so in the built-in "Important features" step "apps menu", "avatar" and "search bar" invited a click that did nothing. Bold is now bold: the colour is the text colour, and blue again means a link. This applies to every step, including ones written by an admin or a translator.

• The highlight around the element a step points at follows the server's colour. It was always Nextcloud blue, so on an instance with its own brand colour the outline took the brand colour and the glow around it stayed blue.

• The language picker in the step editor had no name a screen reader could read. It is labelled "Language" now, as is the one in the Add language override dialog.

• The close button in the tour showed its own tooltip on hover, which repeated the label a screen reader already reads and could not be dismissed with Escape. The button keeps its name; the extra tooltip is gone.

• The tour dialog and the settings pages line up with the rest of Nextcloud again. The tour's header was a grey band with a blue title; the tabs, the step list and the Support page each started at a different distance from the left edge of the page.

• A failed load of the step list looked like an empty tour. Adding a step to it would have replaced the whole tour for that language. The admin page now shows an error with a Try again button, and adding steps or previewing waits until the list has loaded.

• The text field of a step showed "HTML content placeholder" as its placeholder, a translation key that never got a text.

• Less motion where people asked for it. With reduced motion switched on, the tour and the step list jump to a step instead of scrolling smoothly. The arrow and the outline around a step's element blink a few times and then stay still, for everyone, instead of blinking for as long as the step shows.

• The full-screen Nextcloud page of Pick element and Preview tour kept the admin page reachable: Tab and a screen reader could leave the overlay for the page underneath. That page is now out of reach until the overlay closes.

• The pause button of a GIF or video kept a blue tint after a click, and showed a tooltip that repeated its label.

• The app's icon was a solid disc in the app list, and white on white where Nextcloud shows it on a light background. It is drawn again from filled shapes, for 20 pixels.

Security

• Media in steps is checked by its content. The type of an image or video is taken from its bytes, never from its name; SVG, HTML and every type other than PNG, JPEG, GIF, MP4, WebM and WebVTT captions are refused. Location and other metadata are stripped before the file is stored, and size, pixels, frames and total storage are limited. See the threat model.
• Media is only served to people who get the step, as a download that can do nothing on its own: nosniff, Content-Security-Policy: default-src 'none'; sandbox and Cross-Origin-Resource-Policy: same-origin.
• Step text is sanitized in the browser as well, with DOMPurify and a strict allowlist, wherever it is shown as HTML: in the tour, in the step list and in the AI review.
• Tour packages trust nothing. File names, sizes and the number of files are checked before anything is unpacked, and every tour, step and file goes through the same checks as one made in the editor.
• Rate limits on the tracking routes and on the AI routes.
• Every route needs the CSRF request token, also the ones that only read, except two that cannot send one and only read or redirect: GET /media/{file}, which an <img> or <video> loads, and GET /tour/{id}, a tour's share link.

Fixed

• The admin and personal settings pages were stuck in English, whatever language the account used. The tour itself translated correctly, which made the screens look half-finished: a French tour wrapped in an English settings page. 120 of the app's 207 texts had never reached the translators at all — the tabs, "Global settings", "Enable wizard for all users" and every confirmation and error message on those pages. All 205 translatable texts are now in the template, and the newly exposed ones will appear language by language as translators work through them.

• Seven messages in the admin settings showed a literal %s instead of the value they were meant to insert: importing a tour reported Successfully imported %s steps for language %s rather than the number of steps and the language, and the four error messages on that page ended in a bare %s where the reason for the failure should have been. All seven now show the actual values.

Added

• A continuous-integration pipeline runs on every push: a PHP syntax check, the JavaScript unit tests, a production build, a security scan of the backend, and guards that assert every text the settings screens use is actually collected for translation. The failure fixed above went unnoticed for three months because nothing ever checked it.

Changed

• Nine texts were reworded for the Nextcloud style guidelines: a non-breaking space before an ellipsis so the dots never wrap onto their own line ("Saving …", "Loading …"), sentence case for "Anonymous usage statistics", and no more "successfully" in success messages, which appear in a success-styled notification anyway. The import message became Imported {count} steps ({language}). Texts that had translations revert to English until translators pick up the new wording.

• Two more languages: Indonesian and Slovak, both fully translated. They were available from the translation service but had been left out of the shipped set by an oversight in the previous release. The app ships languages that pass the 25% translation threshold.

Added

• More translated strings in Danish, German (both variants), Estonian and Brazilian Portuguese — mostly the Support tab introduced in 1.7.7.

Fixed

• A customized tour showed default steps the admin had deleted. An admin who removed default steps from their tour — say search, settings and intro — still saw them appear in the running tour, in the bundled default wording rather than their own. The steps were re-inserted in the browser: enrichSteps() re-attached the behavioral fields the API cannot send (function selectors, beforeShowPromise, when) and, while doing so, also injected every bundled default step whose id was absent from the API response. Because they were spliced in after the step preceding them in the default order, they surfaced as a block in the middle of the tour, with default copy and default tone-of-voice — an informal address in languages that distinguish it. The API was right all along: it returned only the configured steps, with useDefault: false. The injection is gone; the server is now solely authoritative over which steps exist and in what order, and enrichSteps() only restores behaviors onto steps the server actually sent. Removing a default step is now what it looks like. Introduced in 1.7.4; 1.7.4 through 1.7.7 are affected.

• The "Your account & settings" step highlighted the wrong area on Nextcloud 32 and 33. Its selector chain led with .header-menu__trigger, a class Nextcloud 34 introduced. On 32 and 33 that class does not exist (the markup is #user-menu.account-menu > button > .account-menu__avatar), so every specific link in the chain missed and it fell through to the bare #user-menu wrapper — putting the spotlight around the whole header container instead of the avatar. The chain now tries the avatar itself before falling back, which is the same class on 32 through 35. The English-only [aria-label="Settings menu"] match was also demoted: core renders that label through the translation layer, so it never matched on a non-English instance anyway. Nextcloud 34 and 35 keep using the trigger they always did. Fixed in both the bundled tour and the server-side defaults. Introduced in 1.7.4.

• Usage reporting could count one server as two, which left the figures on the licence server stale. Affected instances correct themselves at the next report; nothing needs to be reconfigured. Reporting only — nothing in the app behaves differently.

Added

• Nextcloud 35 support. max-version raised from 34 to 35 so the app installs on Nextcloud 35. Nextcloud 32 remains the minimum — 32, 33 and 34 are all still maintained, and PHP stays at 8.1 because Nextcloud 32 runs on it (Nextcloud 35 enforces PHP 8.3 itself).

Changed

• Controller access rules now use PHP attributes. All 19 PHPDoc annotations (@NoAdminRequired, @NoCSRFRequired, @PublicPage) became #[NoAdminRequired], #[NoCSRFRequired] and #[PublicPage]. Nextcloud 35 still reads the old annotations, so this changes no behaviour today — it is the form that will keep working. Verified per method that every endpoint kept exactly the same access rules.

• IntroVox is free, and the Support tab now says so. The tab offered a subscription key, per-language progress bars ("0 / 10 steps") and a warning that new steps required a subscription. None of that reflected reality — IntroVox is free at every tier and no code path ever blocked a save — so the key field, the progress bars and the limit warning are gone. In their place: what the app is (free, open source, no user limit, no paid features), a pointer to the other VoxCloud apps for Nextcloud, and where to get help. Step counts per language remain visible on the Steps tab. Existing installations with a stored subscription key are unaffected; the licensing endpoints still exist and simply have no UI.

Fixed

• The tour named a specific Nextcloud version. The Files step read "On Nextcloud 34 it lives in the apps menu", which was simply wrong on Nextcloud 35. The layout is identical on 34 and 35, so the version number is gone: "You will find it in the apps menu (top left)". The admin hint about selectors lost its version reference too.

• Telemetry logged an hourly warning that said nothing. TelemetryJob: Telemetry report failed appeared every hour with no reason attached, because both failure paths in sendReport() returned silently. The cause turned out to be the license server's rate limit: it accepts one report per instance per hour and answers HTTP 429, while the job runs more often. That expected case is now a debug line instead of a warning, and every real failure logs what actually went wrong (status code plus response, or the exception).

• Telemetry mis-detected Nextcloud Enterprise. The subscription check read the Extended Support add-on rather than the subscription itself, so instances with a plain Enterprise subscription were reported as Community. It now uses IRegistry::delegateHasValidSubscription() (public API since NC 17). This only affects the usage figures reported back to VoxCloud; nothing in the app behaves differently.

Fixed

• Imported wizard steps saved in a non-UTF-8 encoding showed "mojibake" (e.g. één instead of één). The browser's file.text() always decodes an uploaded import file as UTF-8, so a file that was actually saved as Windows-1252/Latin-1 arrived as valid-but-wrong UTF-8 and was stored (and displayed in the tour) verbatim. Step title/text are now passed through a conservative mojibake repair in sanitizeStep() (so it covers import and any manual save/paste): a string is only rewritten when it carries a mojibake signature and reinterpreting its code points as the CP1252 bytes they were mis-read from yields a different, still-valid UTF-8 string. Correctly-accented copy (café, naïef, Übung, —, →) fails that guard and is left untouched. Existing corrupted steps are healed on the next save/re-import; already-stored values are not rewritten in place.
• Tour copy saved by IntroVox ≤ 1.6.x showed literal <p>/<strong> tags. Those versions ran wizard step title/text through \OCP\Util::sanitizeHTML() on save, which HTML-escaped the admin's markup (<p> → <p>); since 1.7.0 the copy is stored as-is and rendered as HTML by Shepherd.js, so instances upgrading from an older version kept showing the escaped tags until each step was re-saved by hand. A new one-time repair step (UnescapeLegacyWizardStepHtml) un-escapes those stored rows automatically on upgrade. It only touches values carrying the pre-1.7.0 fingerprint (escaped angle brackets and no raw </>), so correctly-stored 1.7.x HTML is never altered and the step is idempotent; a recoverable copy is saved to legacy_html_backup_<key> first.

Fixed

• Upgrade to 1.7.4 could silently delete an admin-customized tour (data loss). The RemoveStaleDefaultWizardSteps repair step — meant to clear only the pre-1.7.4 auto-saved default tour so the new NC 34 defaults take over — detected "untouched defaults" by merely checking that a legacy calendar step and a legacy search step were both present. An admin who kept those two steps but extended the tour (e.g. added a custom video step) still matched, so their entire wizard_steps_<lang> override was wiped on upgrade. The step now requires the stored step ids to match the legacy fingerprint exactly (same eight ids, same order, nothing added, removed, renamed or reordered) before also checking the legacy selectors — so any customized tour is left untouched. As an extra safety net, a recoverable copy is now saved to stale_wizard_backup_<key> before any deletion. (#21)

Fixed

• Upgrade to 1.7.4 could silently delete an admin-customized tour (data loss). The RemoveStaleDefaultWizardSteps repair step — meant to clear only the pre-1.7.4 auto-saved default tour so the new NC 34 defaults take over — detected "untouched defaults" by merely checking that a legacy calendar step and a legacy search step were both present. An admin who kept those two steps but extended the tour (e.g. added a custom video step) still matched, so their entire wizard_steps_<lang> override was wiped on upgrade. The step now requires the stored step ids to match the legacy fingerprint exactly (same eight ids, same order, nothing added, removed, renamed or reordered) before also checking the legacy selectors — so any customized tour is left untouched. As an extra safety net, a recoverable copy is now saved to stale_wizard_backup_<key> before any deletion. (#21)

Fixed

• Tour steps pointed at the wrong header elements on Nextcloud 34. NC 34 ("Hub 26 Spring") restructured the top header: the search became an always-visible inline searchbar (.unified-search-input, replacing the .unified-search__trigger icon button), and the app navigation (Files, Calendar, …) plus the personal settings moved behind the apps "waffle" menu and the account/avatar menu — those items no longer exist in the DOM until their menu is opened. As a result the Search step highlighted the notifications bell, and the Files/Calendar steps either highlighted nothing (centered fallback) or a random sidebar link. (#19)

Changed

• Wizard targets are now resolved lazily and degrade gracefully. WizardManager previously resolved each step's selector once at tour-build time, so any target behind a menu was permanently nulled to a centered popup. Targets are now resolved at show-time (Shepherd accepts a function attachTo), so a step can point at an element a menu reveals — and a genuinely missing target still centers cleanly.
• Nav steps retargeted for NC 34, with NC ≤ 33 fallbacks. The old separate Files and Calendar steps are merged into one 📁 Files & apps step: on NC 34 it opens the apps "waffle" menu (beforeShowPromise), highlights the Files entry inside it with the tooltip beside the open menu, and closes the menu again afterward (with cancel/complete cleanup safety nets); on NC ≤ 33 — which has no waffle — the same step simply highlights the always-visible inline Files icon. The Search step leads with .unified-search-input (NC 34) and falls back to #unified-search (NC ≤ 33); a new ⚙️ Settings step highlights the always-visible account/avatar menu (#user-menu on NC ≤ 33). The features step copy was updated to match the NC 34 layout. All targeting is selector-presence driven — no hard version checks. Verified live on NC 34.0.0 and NC 33.0.1.
• Function-valued step behavior (lazy attachTo, beforeShowPromise, when, canClickTarget) lives only in the client; since the API serves the default steps inline, the client now re-attaches these behaviors onto the server-provided steps by id (enrichSteps), keeping server copy/translations/ordering authoritative.
• Admin Steps editor now documents NC 34 menu targeting: the CSS-selector field's example is updated (.app-menu__waffle, .unified-search-input, #user-menu) and a tip explains that menu items only exist once their menu is opened, so steps should point at the always-visible trigger button.

Fixed

• App Store install/update failed with "App with id introvox has invalid signature". The signature registered for the 1.7.1 release in the Nextcloud App Store carried a stray trailing marker, so Nextcloud's base64_decode produced a 522-byte signature instead of 512 bytes and verification failed on every instance (reproduced on NC 33.0.1, 33.0.5 and 34.0.0). Re-released as 1.7.2 with a correctly generated signature. No functional changes compared to 1.7.1. (#19)

Fixed

• Nextcloud 34 compatibility. Replaced the removed \OC::$server->getURLGenerator() service-locator call in LicenseService with a proper IURLGenerator constructor injection. On NC 34 the legacy \OC::$server accessor is gone, which broke license validation and telemetry (both rely on the instance URL hash).

Added

• Synced translations from Transifex. Pulled the full nextcloud:introvox resource (110 source strings) and regenerated l10n/*.js|*.json for 89 languages. German is now 100 % translated and Dutch 95 %; the complete tour content, PWA install flow and subscription UI are now localized instead of falling back to English.
• scripts/po2l10n.py + scripts/sync-translations.sh — pull translations from Transifex (tx pull) and convert the .po files into the Nextcloud l10n/<lang>.js + .json format, so the sync can be re-run before each release without depending on the upstream bot.

Upgrade notes

• Stale wizard_steps_<lang> rows from 1.6.x are kept as-is. Versions before 1.7.0 auto-persisted the default tour content into oc_appconfig the first time the admin opened the Steps tab, so most 1.6.x installs have six rows (en/nl/de/da/fr/sv) that are byte-identical to the bundled defaults at the time. After upgrade, those rows show up in the Steps-tab dropdown as "overrides". The wizard keeps working and end users see no difference, but those six languages will no longer pick up new Transifex translations until the admin clicks Reset on each one — that deletes the row and lets the Transifex-translated defaults take over. Languages that were never touched on the old install have no row and are unaffected; their users get fresh Transifex translations automatically. No data is lost either way.
• Obsolete enabled_languages appconfig key is ignored, not deleted. Left in place so a downgrade to 1.6.x stays functional. Can be removed manually with occ config:app:delete introvox enabled_languages if desired; harmless if left.

Added

• Language-override workflow for admins (#17) — Steps tab gains an explicit "Add language override" flow. A searchable dropdown shows every Transifex-supported language; admins pick one and start authoring custom copy. No DB rows are created until first save. New GET /admin/overrides endpoint returns the list of languages with admin-authored overrides.
• DefaultStepsService — Single source of truth for the eight built-in tour steps. Both AdminController (editor view) and ApiController (end-user fetch) consume the same Transifex-translated defaults via this service. Removes a previously duplicated step-builder.

Changed

• Wizard is automatically available in every Transifex-translated language (#17) — Default tour content is auto-translated; end users always see the wizard in their Nextcloud locale (fallback chain: user lang → base lang → English). The admin no longer needs to opt languages in. API path: when no admin override exists for a user's language, /api/steps now returns the Transifex-translated defaults inline instead of useDefault:true + empty array.
• Settings tab simplified — The language checkbox grid is replaced by a single hint line stating how many languages have overrides. Wizard-on/off switch and "Show wizard to all users" button remain.
• Reset semantics for a per-language override — "Reset to default" now deletes the override row entirely; the next request serves Transifex-translated defaults. Previously the row was re-saved with defaults baked into the DB.
• License/telemetry payload field rename — enabledLanguages → languagesWithOverrides. Same data shape, more honest name.
• Documentation restructured to match IntraVox/MetaVox layout — Replaced the four flat doc files (ADMINISTRATOR_GUIDE.md, ADMIN_MANUAL.md, USER_MANUAL.md, APP_STORE_SUBMISSION.md) with a nested structure: docs/index.md hub, docs/getting-started.md, plus admin/, user/, features/, architecture/, and deployment/ subdirectories. The two admin monoliths (which largely duplicated each other) were deduplicated into nine topic-scoped files. README and appinfo/info.xml <documentation> block updated to point at the new paths.

Removed

• "Enable languages" concept (#17) — The Settings tab's per-language checkbox grid is gone, and the enabled_languages appconfig key is no longer read or written. Existing rows are left in place on upgrade (harmless; ignored). Existing wizard_steps_<lang> override rows are preserved and now displayed in the Steps-tab dropdown.
• "Tour not available in your language" personal-settings branch — Since every Transifex-translated language is auto-available, this branch was always dead post-upgrade. Removed from lib/Settings/PersonalSettings.php, templates/personal.php, and src/personal.js.
• Auto-persist of default steps on first GET — AdminController::getSteps used to write defaults to oc_appconfig on first read; this artificially inflated the override-list. Defaults are now persisted only when an admin explicitly saves changes.

Fixed

• l10n source-string adaptations for Transifex (#18) — Replaced triple-dot ellipses with U+2026 + nbsp (Saving …, Validating …, Activating …, Restarting tour …) per Nextcloud translation dos-and-don'ts. Dropped "successfully" from Settings saved per Nextcloud writing guidelines. Existing translations for the renamed keys are preserved.
• App description no longer claims a fixed 6-language limit (#17) — appinfo/info.xml description rewritten to reflect Transifex-driven language coverage; removed the "Language-specific tour availability management" bullet.
• Admin-saved step content rendered with literal <p> tags — AdminController::sanitizeStep ran OCP\Util::sanitizeHTML() on every save, which escapes HTML rather than sanitising it; admin-authored copy ended up in the DB as <p>...</p> and Shepherd surfaced the raw tags to end users. Replaced with a plain trim(). Admin-authored wizard copy is intentionally HTML and admins are already trusted.
• End-user wizard could be served in the wrong language — ApiController used IL10N::getLanguageCode() which returns NC's validated language (the one with a translation file), silently rerouting e.g. an Italian user to Dutch when no Italian IntroVox translation existed. Switched to IFactory::findLanguage(null) so the raw user preference is used, and the defaults service falls back to English (not the system default language) when the user's language has no translation file.
• Wizard client ignored server-provided default steps and re-translated locally — src/components/wizardSteps.js discarded data.steps whenever the response had useDefault:true, then rebuilt the eight default steps in the browser via t('introvox', '<English source>'). Combined with the wrong-language IL10N bug above, this meant a non-translated user's wizard came out in the system default language. The client now uses the server's full step list directly.

Added

• Enterprise subscription support - IntroVox can now be activated with a subscription key from VoxCloud
• New "Support" tab in admin settings with subscription management UI
• Per-language step-count progress bars showing free-tier (10 steps per language) vs. licensed limits
• Automatic daily license sync via background job (with stable jitter to spread load across installations)
• License status and limits sourced from licenses.voxcloud.nl; full feature set remains available on free tier — only volume is limited
• Nextcloud 34 support - Declared compatibility for NC 32–34
• Explicit PHP 8.1 minimum declared in appinfo/info.xml

Changed

• Telemetry payload includes license key + Enterprise detection - Reports now include the configured subscription key and hasExtendedSupport flag (detected via OCP\Util::hasExtendedSupport) so the license server can verify Enterprise claims server-side
• 27 new translation strings for the Support tab across all 6 languages (EN/NL/DE/FR/DA/SV)

Fixed

• Long wizard steps trapped users on mobile (#14) - When step content exceeded the screen height on mobile, the modal overlay blocked page scroll while the step itself did not scroll either, leaving the cancel (×) button and primary action buttons unreachable. Users had to disable the offending step in the admin panel to escape the tour.
• Added max-height: calc(100vh - 32px) (or 100dvh - 16px on mobile, accounting for browser chrome) to the step container
• Header and footer are now pinned via flex-shrink: 0 so the close icon and action buttons remain visible
• The body text area scrolls internally (overflow-y: auto with overscroll-behavior: contain)
• Verified at 375×667 (iPhone 6/7/8) and 320×568 (iPhone SE)

Security

• CSRF protection restored on state-changing admin endpoints - Removed @NoCSRFRequired from 7 POST endpoints (saveSteps, resetToDefault, saveSettings, exportSteps, importSteps, toggleTelemetry, sendTelemetryNow) that were previously vulnerable to cross-site request forgery
• Defensive admin checks added to all admin controller endpoints - All 13 admin endpoints now double-check admin privileges via IGroupManager::isAdmin() in addition to the framework's annotation-based check, preventing accidental exposure if annotations are misconfigured
• HTML sanitization on step content - Step title and text fields are now sanitized via OCP\Util::sanitizeHTML on save/update/import to prevent stored XSS
• HTTP response validation on license-server calls - LicenseService now checks status codes and JSON shape before trusting responses, preventing false-positive license validations on transient server errors

IntroVox grows from one welcome tour into tours for Nextcloud and its apps. The major version marks that, and a few changes to the app's HTTP routes that a script outside the app could notice; the stored tours, steps and settings carry over as they are.

Upgrade notes

• Nothing new reaches users until an admin switches it on. App tours, the built-in tours for Files, Talk, Deck and Calendar, and the Dashboard checklist all start switched off. The one exception is Tours in the user menu, which everyone sees; hide it under Settings.
• The personal "disable the tour" switch now covers every tour. A repair step (IntroduceTours) turns tours off for people who had switched the welcome tour off without finishing it; people who finished or skipped it will get app tours once an admin switches one on.
• Telemetry waits for an admin. It is sent only after an admin has opened IntroVox's settings and been asked, once per instance. Until then an updated instance sends nothing.
• Changes for scripts that call IntroVox's routes directly:
• POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id} are gone; use POST /admin/steps (see Removed).
• GET /api/steps needs a logged-in user and the CSRF request token; it was public.
• The admin GET routes, the personal settings and POST /api/wizard/{start,complete,skip} need the request token too.
• POST /admin/settings ignores showToAll; use POST /admin/tours/welcome/reshow.
• Older step exports still import, but a step is now checked like one saved in the editor: an id of letters, digits, _, . and -, a title of at most 500 characters, a known position, and a file of at most 1 MB. Exports made with IntroVox pass; a hand-made file may be refused.

Added

• Tours for apps and pages. Besides the welcome tour, an admin can make a short tour that starts the first time someone opens an app, such as Talk or Deck, or another page of Nextcloud. Each tour has its own steps and languages, can be limited to groups, and can go to everyone or only to people who log in for the first time after it was switched on. It starts once per user, once the app has loaded, and never on top of another tour: someone new gets the welcome tour first. A new tour starts switched off. See Tours.
• Users can start every tour themselves, from a list in their personal settings that says which ones they have seen.
• Statistics per tour, and how far people get. The Statistics pane shows each tour on its own: how many people started, finished and skipped it, and for every step how many got at least that far, so you can see where people stop. Counted per person, only for runs that started by themselves, and only as totals; none of it is sent with the usage statistics. See Statistics.
• Move a whole tour to another Nextcloud. Export tour downloads one .zip with the tour's settings, its steps in every language and its images and videos; Import tour adds it as a new tour, switched off, uploaded or from your own Files. Groups and media this Nextcloud cannot take are left out and named. A package is checked as strictly as an upload. See Move a tour to another Nextcloud.
• Built-in tours for Files, Talk, Deck and Calendar, switched off until you switch them on, and translated like the welcome tour. Each lets users do the app's main job once with their own work (make and share a folder, set up a team conversation, add a card with a due date, plan an event) and then shows what matters most at work, in 11 steps, written from the Nextcloud documentation and reviewed for adoption, accuracy and robust selectors. Their steps can be changed per language and reset; who gets them and when can be set like for any tour. See Built-in tours.
• Share a tour with a link. Copy link in a tour's menu gives a link that opens the tour's page and starts the tour there, for a welcome mail or a message to a team. It works like a start by hand: also for people who saw the tour, only for people who may get it, and not counted in the statistics. While the tour is switched off, Copy link says the link starts nothing yet. See Share a tour with a link.
• "Tours" in the user menu, just above Help, leads everyone to their tours in the personal settings. An admin can hide it under Settings.
• When a tour starts by itself: not before a number of days after someone's first login, and only between two dates. Starting it by hand or with a link always works.
• Tours that start anywhere, on whichever page someone opens next: with a number of days, a tip that comes once someone has found their way.
• Steps that wait for the user. A step whose element only appears after the user did something (a conversation they create, a file's sharing they open) stands aside in the corner, leaves the page usable, and moves to the element as soon as it is there. Together with "Click on the element", a tour can now lead someone through creating a conversation and adding people, in any app. The element picker says so when the element was reached by using the page. Continue with: Filling in the field keeps Next off until a field has text, such as a new conversation's name. The element a step points at has a clear outline and a blinking arrow, also inside dialogs. See Steps that wait for the user.
• "Getting started" on the Dashboard. An admin can offer everyone a checklist of first things to do: take the welcome tour, upload a file, add a profile picture, install the app, send a message in Talk, secure the account with two-factor authentication. Each task links to where it is done and ticks itself off once the user did it. Admins can add tasks of their own, such as "Open Talk" or the folder with the handbook, ticked off once opened from the list. Off by default; the admin picks the tasks and can put the list on every Dashboard, and everyone can remove it under Customize. See Checklist on the Dashboard.
• Translate a tour, or write its steps, with AI. With a provider for the Nextcloud Assistant set up, Translate with AI translates a tour's steps into other languages, words only, and Write steps with AI writes new steps from a description. You check and can change every step before it is saved. See Write or translate steps with AI.

• Images, GIFs and videos in steps. A step can show one image (PNG, JPEG), animated GIF or video (MP4, WebM) above its text: uploaded, chosen from the admin's own Files, or pasted as a screenshot. A description is required unless the image is decorative; videos play with a play button or silently like a GIF, and can have captions. Anything that moves can be paused, and stays still for people with reduced motion. Only files from this Nextcloud: IntroVox keeps its own copy, checks the real file type and strips metadata such as location, and only users who get the step can load the file. See Image or video and the threat model.

• Pick the element a step points at instead of typing a CSS selector. Pick element in the step editor opens Nextcloud full-screen on the settings page: click the element, and a selector that survives reloads, other languages and most updates is filled in, with a matching tooltip position. To pick something inside a menu, open the menu in Browse mode and Shift-click the item; the step then opens that menu itself before it shows (new Open first field).

• Tours can span apps. A step can belong to a page, such as /apps/spreed/ for Talk; the tour opens that app when it gets there and carries on, with Back working the same way. Pick element fills the page in. Steps in an app a user can't open are skipped, and a tour that went to other apps returns to the homepage on Done.

• Steps that continue on a click. With Continue with: Click on the element, users click the highlighted element ("Click New conversation") instead of a Next button, and the step tells them so. If the element is missing, a Next button appears instead.

• Preview the tour before users get it. Preview tour runs the tour for the language being edited, optionally as a member of one group; Test this step shows a single step, unsaved edits included. A preview is not counted in the statistics and does not mark the tour as seen for the admin.

• Step texts are written with formatting instead of HTML. The Text field is an editor that shows the text as the tour will, with a toolbar for bold, italic, a heading, lists, links, code and emoji; the title has an emoji button too. Links open in a new tab, so the tour stays where it is. Edit as HTML shows the HTML itself. HTML that users never see, because the tour removes it, is left out of the editor with a line saying what; it only goes from the stored text once the text is changed. Texts are still stored as HTML: exports, imports and the translated default steps are unaffected.

• A short tour of the admin page for every admin, the first time they open IntroVox's settings: the parts of the page, languages, how to make a step in four moves, the preview, and a link to the manual. It uses the same tour users get. Show the admin tour again under Support runs it again.

• Steps can be reordered without a mouse. Every step has Move up and Move down buttons beside the drag handle. Reordering was drag-only, so it could not be done from the keyboard or with a screen reader at all — the two buttons save the new order the same way a drag does.

• Translations in 105 languages, from Transifex as they stood on release day. Danish is complete; Spanish, Dutch and French are largely translated, partly by machine and not yet reviewed by their language teams. Languages with only a few translated strings are included too: what is not translated shows in English.

Changed

• The Steps pane is now Tours: a list of the tours, each with a switch, Edit steps, a preview, Show again to everyone and, for app tours, Delete. The step editor opens from there. The main switch is called Tours for everyone.
• "Permanently disable the introduction tour" in the personal settings is now "Start tours by themselves", and covers every tour. Users who had switched the tour off there keep tours off after the update; users who finished or skipped it get app tours.
• Show wizard to all users is now Show again to everyone, in the welcome tour's menu under Tours, like for every other tour. It no longer overrides people who switched tours off; everyone else who saw the welcome tour gets it again, as before.
• The Statistics pane counts people, not clicks, for skipping too: "Times skipped" is now "Users skipped".
• Pages load less. The script every page loads is 18 KB instead of 252 KB, and asks the server nothing: it decides from what the page already carries whether a tour starts, and only then loads the tour itself.
• A same-origin frame of another app starts no tour inside it.
• Wording follows Nextcloud's own terms: people and accounts instead of "users" where it means everyone, and no contractions such as "don't" in the new strings.

• The English source strings use American spelling, as Nextcloud itself does: "customise" became "customize". Until translators catch up, that one string shows in English in the languages that had it translated.

• Every change to the steps is saved straight away: saving a step, deleting, reordering and switching a step on or off. The Save changes button only appears to retry a save that failed. The personal "disable the tour" switch saves straight away too.

• Steps are edited in a dialog, a page at a time: content, element, behavior and who sees it. New steps walk through the pages; existing ones can be saved from any page. Element, page and menu are summarised next to Pick element, with the fields folded away under Edit by hand. The step list itself no longer expands an editor.

• The admin and personal settings pages use Nextcloud's own components and icons instead of emoji buttons and plain form fields. Buttons show their intended colours again; with @nextcloud/vue 9 every one of them had rendered as a plain grey button.

• The tabs across the top of the admin page are Nextcloud's own pane switcher, the control core uses for a settings page with several parts. They were hand-built buttons: a screen reader heard four loose buttons with nothing saying they belonged together or which one was open. On a phone the row no longer runs off the side of the screen — the fourth tab used to be unreachable, because the page does not scroll sideways.

• Text in the tour and on both settings pages follows the sizes the theme sets. Sizes were fixed in the code, four of them smaller than Nextcloud's smallest — a size no display setting could enlarge. They now scale with the rest of the interface.

• Lists in a step show bullets. Nextcloud's stylesheet takes them off every list, so a list in the tour looked like a column of indented lines. This shows in the default steps too.

• Telemetry is only sent once an admin has been asked. The admin tour ends with the question, with a list of what is sent; it is asked once per instance. After that telemetry is on unless an admin chose not to share, as before. Instances where nobody opened IntroVox's settings since the update send nothing. The list of what is sent now also names the tour counts, the country, Docker and the license key.

Removed

• Three unused admin endpoints: POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id}. The app has always saved the step list as a whole through POST /admin/steps; nothing called these. Anything outside the app that did call them must move to POST /admin/steps.

Fixed

• A fallback selector won over the main one: with an element such as .cards, #navigation a, a step pointed at whichever came first in the page, here the navigation. The selectors are now tried in the order they were written.
• People with a regional language, such as pt_BR, zh_CN or es_419, got the welcome tour in English: only the first two letters of a language were used, so a translation or an administrator's own steps for the full language were never shown. Now the full language comes first, then its base language.

• A welcome tour with every step switched off, or only with steps for other groups, showed the built-in steps to the people it was meant to show nothing. It shows nothing now.

• Edited and new steps were gone after a reload. Save in the step editor only updated the list in the browser; nothing reached the server until a separate Save changes button at the top of the list was clicked, and leaving the page did not warn.

• Cancel deleted saved steps. Cancelling the editor removed any step that had once been created with Add step, even one saved long before.

• The tour started about ten seconds late on Nextcloud 34 and 35, also after "Restart tour now". It waited for the inline app bar of older versions, which no longer exists, until a timeout.

• A new element for the Files, Search or Settings default step was ignored; the tour kept pointing at the built-in one.

• Steps pointing into the apps menu lost it as soon as the mouse moved to the tour's tooltip: Nextcloud 35 closes that menu 180 ms after the pointer leaves it. The tour now keeps the menu open for as long as the step shows. This affected the built-in Files step too.

• On instances installed in a subdirectory or without pretty URLs, users could get the built-in tour instead of the admin's. The tour fetched its steps from a hard-coded address that does not exist there, and fell back to the bundled defaults.

• Bold words in a step looked like links. They were shown in the same blue as a real link, so in the built-in "Important features" step "apps menu", "avatar" and "search bar" invited a click that did nothing. Bold is now bold: the colour is the text colour, and blue again means a link. This applies to every step, including ones written by an admin or a translator.

• The highlight around the element a step points at follows the server's colour. It was always Nextcloud blue, so on an instance with its own brand colour the outline took the brand colour and the glow around it stayed blue.

• The language picker in the step editor had no name a screen reader could read. It is labelled "Language" now, as is the one in the Add language override dialog.

• The close button in the tour showed its own tooltip on hover, which repeated the label a screen reader already reads and could not be dismissed with Escape. The button keeps its name; the extra tooltip is gone.

• The tour dialog and the settings pages line up with the rest of Nextcloud again. The tour's header was a grey band with a blue title; the tabs, the step list and the Support page each started at a different distance from the left edge of the page.

• A failed load of the step list looked like an empty tour. Adding a step to it would have replaced the whole tour for that language. The admin page now shows an error with a Try again button, and adding steps or previewing waits until the list has loaded.

• The text field of a step showed "HTML content placeholder" as its placeholder, a translation key that never got a text.

• Less motion where people asked for it. With reduced motion switched on, the tour and the step list jump to a step instead of scrolling smoothly. The arrow and the outline around a step's element blink a few times and then stay still, for everyone, instead of blinking for as long as the step shows.

• The full-screen Nextcloud page of Pick element and Preview tour kept the admin page reachable: Tab and a screen reader could leave the overlay for the page underneath. That page is now out of reach until the overlay closes.

• The pause button of a GIF or video kept a blue tint after a click, and showed a tooltip that repeated its label.

• The app's icon was a solid disc in the app list, and white on white where Nextcloud shows it on a light background. It is drawn again from filled shapes, for 20 pixels.

Security

• Media in steps is checked by its content. The type of an image or video is taken from its bytes, never from its name; SVG, HTML and every type other than PNG, JPEG, GIF, MP4, WebM and WebVTT captions are refused. Location and other metadata are stripped before the file is stored, and size, pixels, frames and total storage are limited. See the threat model.
• Media is only served to people who get the step, as a download that can do nothing on its own: nosniff, Content-Security-Policy: default-src 'none'; sandbox and Cross-Origin-Resource-Policy: same-origin.
• Step text is sanitized in the browser as well, with DOMPurify and a strict allowlist, wherever it is shown as HTML: in the tour, in the step list and in the AI review.
• Tour packages trust nothing. File names, sizes and the number of files are checked before anything is unpacked, and every tour, step and file goes through the same checks as one made in the editor.
• Rate limits on the tracking routes and on the AI routes.
• Every route needs the CSRF request token, also the ones that only read, except two that cannot send one and only read or redirect: GET /media/{file}, which an <img> or <video> loads, and GET /tour/{id}, a tour's share link.

Fixed

• The admin and personal settings pages were stuck in English, whatever language the account used. The tour itself translated correctly, which made the screens look half-finished: a French tour wrapped in an English settings page. 120 of the app's 207 texts had never reached the translators at all — the tabs, "Global settings", "Enable wizard for all users" and every confirmation and error message on those pages. All 205 translatable texts are now in the template, and the newly exposed ones will appear language by language as translators work through them.

• Seven messages in the admin settings showed a literal %s instead of the value they were meant to insert: importing a tour reported Successfully imported %s steps for language %s rather than the number of steps and the language, and the four error messages on that page ended in a bare %s where the reason for the failure should have been. All seven now show the actual values.

Added

• A continuous-integration pipeline runs on every push: a PHP syntax check, the JavaScript unit tests, a production build, a security scan of the backend, and guards that assert every text the settings screens use is actually collected for translation. The failure fixed above went unnoticed for three months because nothing ever checked it.

Changed

• Nine texts were reworded for the Nextcloud style guidelines: a non-breaking space before an ellipsis so the dots never wrap onto their own line ("Saving …", "Loading …"), sentence case for "Anonymous usage statistics", and no more "successfully" in success messages, which appear in a success-styled notification anyway. The import message became Imported {count} steps ({language}). Texts that had translations revert to English until translators pick up the new wording.

• Two more languages: Indonesian and Slovak, both fully translated. They were available from the translation service but had been left out of the shipped set by an oversight in the previous release. The app ships languages that pass the 25% translation threshold.

Added

• More translated strings in Danish, German (both variants), Estonian and Brazilian Portuguese — mostly the Support tab introduced in 1.7.7.

Fixed

• A customized tour showed default steps the admin had deleted. An admin who removed default steps from their tour — say search, settings and intro — still saw them appear in the running tour, in the bundled default wording rather than their own. The steps were re-inserted in the browser: enrichSteps() re-attached the behavioral fields the API cannot send (function selectors, beforeShowPromise, when) and, while doing so, also injected every bundled default step whose id was absent from the API response. Because they were spliced in after the step preceding them in the default order, they surfaced as a block in the middle of the tour, with default copy and default tone-of-voice — an informal address in languages that distinguish it. The API was right all along: it returned only the configured steps, with useDefault: false. The injection is gone; the server is now solely authoritative over which steps exist and in what order, and enrichSteps() only restores behaviors onto steps the server actually sent. Removing a default step is now what it looks like. Introduced in 1.7.4; 1.7.4 through 1.7.7 are affected.

• The "Your account & settings" step highlighted the wrong area on Nextcloud 32 and 33. Its selector chain led with .header-menu__trigger, a class Nextcloud 34 introduced. On 32 and 33 that class does not exist (the markup is #user-menu.account-menu > button > .account-menu__avatar), so every specific link in the chain missed and it fell through to the bare #user-menu wrapper — putting the spotlight around the whole header container instead of the avatar. The chain now tries the avatar itself before falling back, which is the same class on 32 through 35. The English-only [aria-label="Settings menu"] match was also demoted: core renders that label through the translation layer, so it never matched on a non-English instance anyway. Nextcloud 34 and 35 keep using the trigger they always did. Fixed in both the bundled tour and the server-side defaults. Introduced in 1.7.4.

• Usage reporting could count one server as two, which left the figures on the licence server stale. Affected instances correct themselves at the next report; nothing needs to be reconfigured. Reporting only — nothing in the app behaves differently.

Added

• Nextcloud 35 support. max-version raised from 34 to 35 so the app installs on Nextcloud 35. Nextcloud 32 remains the minimum — 32, 33 and 34 are all still maintained, and PHP stays at 8.1 because Nextcloud 32 runs on it (Nextcloud 35 enforces PHP 8.3 itself).

Changed

• Controller access rules now use PHP attributes. All 19 PHPDoc annotations (@NoAdminRequired, @NoCSRFRequired, @PublicPage) became #[NoAdminRequired], #[NoCSRFRequired] and #[PublicPage]. Nextcloud 35 still reads the old annotations, so this changes no behaviour today — it is the form that will keep working. Verified per method that every endpoint kept exactly the same access rules.

• IntroVox is free, and the Support tab now says so. The tab offered a subscription key, per-language progress bars ("0 / 10 steps") and a warning that new steps required a subscription. None of that reflected reality — IntroVox is free at every tier and no code path ever blocked a save — so the key field, the progress bars and the limit warning are gone. In their place: what the app is (free, open source, no user limit, no paid features), a pointer to the other VoxCloud apps for Nextcloud, and where to get help. Step counts per language remain visible on the Steps tab. Existing installations with a stored subscription key are unaffected; the licensing endpoints still exist and simply have no UI.

Fixed

• The tour named a specific Nextcloud version. The Files step read "On Nextcloud 34 it lives in the apps menu", which was simply wrong on Nextcloud 35. The layout is identical on 34 and 35, so the version number is gone: "You will find it in the apps menu (top left)". The admin hint about selectors lost its version reference too.

• Telemetry logged an hourly warning that said nothing. TelemetryJob: Telemetry report failed appeared every hour with no reason attached, because both failure paths in sendReport() returned silently. The cause turned out to be the license server's rate limit: it accepts one report per instance per hour and answers HTTP 429, while the job runs more often. That expected case is now a debug line instead of a warning, and every real failure logs what actually went wrong (status code plus response, or the exception).

• Telemetry mis-detected Nextcloud Enterprise. The subscription check read the Extended Support add-on rather than the subscription itself, so instances with a plain Enterprise subscription were reported as Community. It now uses IRegistry::delegateHasValidSubscription() (public API since NC 17). This only affects the usage figures reported back to VoxCloud; nothing in the app behaves differently.

Fixed

• Imported wizard steps saved in a non-UTF-8 encoding showed "mojibake" (e.g. één instead of één). The browser's file.text() always decodes an uploaded import file as UTF-8, so a file that was actually saved as Windows-1252/Latin-1 arrived as valid-but-wrong UTF-8 and was stored (and displayed in the tour) verbatim. Step title/text are now passed through a conservative mojibake repair in sanitizeStep() (so it covers import and any manual save/paste): a string is only rewritten when it carries a mojibake signature and reinterpreting its code points as the CP1252 bytes they were mis-read from yields a different, still-valid UTF-8 string. Correctly-accented copy (café, naïef, Übung, —, →) fails that guard and is left untouched. Existing corrupted steps are healed on the next save/re-import; already-stored values are not rewritten in place.
• Tour copy saved by IntroVox ≤ 1.6.x showed literal <p>/<strong> tags. Those versions ran wizard step title/text through \OCP\Util::sanitizeHTML() on save, which HTML-escaped the admin's markup (<p> → <p>); since 1.7.0 the copy is stored as-is and rendered as HTML by Shepherd.js, so instances upgrading from an older version kept showing the escaped tags until each step was re-saved by hand. A new one-time repair step (UnescapeLegacyWizardStepHtml) un-escapes those stored rows automatically on upgrade. It only touches values carrying the pre-1.7.0 fingerprint (escaped angle brackets and no raw </>), so correctly-stored 1.7.x HTML is never altered and the step is idempotent; a recoverable copy is saved to legacy_html_backup_<key> first.

Fixed

• Upgrade to 1.7.4 could silently delete an admin-customized tour (data loss). The RemoveStaleDefaultWizardSteps repair step — meant to clear only the pre-1.7.4 auto-saved default tour so the new NC 34 defaults take over — detected "untouched defaults" by merely checking that a legacy calendar step and a legacy search step were both present. An admin who kept those two steps but extended the tour (e.g. added a custom video step) still matched, so their entire wizard_steps_<lang> override was wiped on upgrade. The step now requires the stored step ids to match the legacy fingerprint exactly (same eight ids, same order, nothing added, removed, renamed or reordered) before also checking the legacy selectors — so any customized tour is left untouched. As an extra safety net, a recoverable copy is now saved to stale_wizard_backup_<key> before any deletion. (#21)

Fixed

• Upgrade to 1.7.4 could silently delete an admin-customized tour (data loss). The RemoveStaleDefaultWizardSteps repair step — meant to clear only the pre-1.7.4 auto-saved default tour so the new NC 34 defaults take over — detected "untouched defaults" by merely checking that a legacy calendar step and a legacy search step were both present. An admin who kept those two steps but extended the tour (e.g. added a custom video step) still matched, so their entire wizard_steps_<lang> override was wiped on upgrade. The step now requires the stored step ids to match the legacy fingerprint exactly (same eight ids, same order, nothing added, removed, renamed or reordered) before also checking the legacy selectors — so any customized tour is left untouched. As an extra safety net, a recoverable copy is now saved to stale_wizard_backup_<key> before any deletion. (#21)

Fixed

• Tour steps pointed at the wrong header elements on Nextcloud 34. NC 34 ("Hub 26 Spring") restructured the top header: the search became an always-visible inline searchbar (.unified-search-input, replacing the .unified-search__trigger icon button), and the app navigation (Files, Calendar, …) plus the personal settings moved behind the apps "waffle" menu and the account/avatar menu — those items no longer exist in the DOM until their menu is opened. As a result the Search step highlighted the notifications bell, and the Files/Calendar steps either highlighted nothing (centered fallback) or a random sidebar link. (#19)

Changed

• Wizard targets are now resolved lazily and degrade gracefully. WizardManager previously resolved each step's selector once at tour-build time, so any target behind a menu was permanently nulled to a centered popup. Targets are now resolved at show-time (Shepherd accepts a function attachTo), so a step can point at an element a menu reveals — and a genuinely missing target still centers cleanly.
• Nav steps retargeted for NC 34, with NC ≤ 33 fallbacks. The old separate Files and Calendar steps are merged into one 📁 Files & apps step: on NC 34 it opens the apps "waffle" menu (beforeShowPromise), highlights the Files entry inside it with the tooltip beside the open menu, and closes the menu again afterward (with cancel/complete cleanup safety nets); on NC ≤ 33 — which has no waffle — the same step simply highlights the always-visible inline Files icon. The Search step leads with .unified-search-input (NC 34) and falls back to #unified-search (NC ≤ 33); a new ⚙️ Settings step highlights the always-visible account/avatar menu (#user-menu on NC ≤ 33). The features step copy was updated to match the NC 34 layout. All targeting is selector-presence driven — no hard version checks. Verified live on NC 34.0.0 and NC 33.0.1.
• Function-valued step behavior (lazy attachTo, beforeShowPromise, when, canClickTarget) lives only in the client; since the API serves the default steps inline, the client now re-attaches these behaviors onto the server-provided steps by id (enrichSteps), keeping server copy/translations/ordering authoritative.
• Admin Steps editor now documents NC 34 menu targeting: the CSS-selector field's example is updated (.app-menu__waffle, .unified-search-input, #user-menu) and a tip explains that menu items only exist once their menu is opened, so steps should point at the always-visible trigger button.

Fixed

• App Store install/update failed with "App with id introvox has invalid signature". The signature registered for the 1.7.1 release in the Nextcloud App Store carried a stray trailing marker, so Nextcloud's base64_decode produced a 522-byte signature instead of 512 bytes and verification failed on every instance (reproduced on NC 33.0.1, 33.0.5 and 34.0.0). Re-released as 1.7.2 with a correctly generated signature. No functional changes compared to 1.7.1. (#19)

Fixed

• Nextcloud 34 compatibility. Replaced the removed \OC::$server->getURLGenerator() service-locator call in LicenseService with a proper IURLGenerator constructor injection. On NC 34 the legacy \OC::$server accessor is gone, which broke license validation and telemetry (both rely on the instance URL hash).

Added

• Synced translations from Transifex. Pulled the full nextcloud:introvox resource (110 source strings) and regenerated l10n/*.js|*.json for 89 languages. German is now 100 % translated and Dutch 95 %; the complete tour content, PWA install flow and subscription UI are now localized instead of falling back to English.
• scripts/po2l10n.py + scripts/sync-translations.sh — pull translations from Transifex (tx pull) and convert the .po files into the Nextcloud l10n/<lang>.js + .json format, so the sync can be re-run before each release without depending on the upstream bot.

Upgrade notes

• Stale wizard_steps_<lang> rows from 1.6.x are kept as-is. Versions before 1.7.0 auto-persisted the default tour content into oc_appconfig the first time the admin opened the Steps tab, so most 1.6.x installs have six rows (en/nl/de/da/fr/sv) that are byte-identical to the bundled defaults at the time. After upgrade, those rows show up in the Steps-tab dropdown as "overrides". The wizard keeps working and end users see no difference, but those six languages will no longer pick up new Transifex translations until the admin clicks Reset on each one — that deletes the row and lets the Transifex-translated defaults take over. Languages that were never touched on the old install have no row and are unaffected; their users get fresh Transifex translations automatically. No data is lost either way.
• Obsolete enabled_languages appconfig key is ignored, not deleted. Left in place so a downgrade to 1.6.x stays functional. Can be removed manually with occ config:app:delete introvox enabled_languages if desired; harmless if left.

Added

• Language-override workflow for admins (#17) — Steps tab gains an explicit "Add language override" flow. A searchable dropdown shows every Transifex-supported language; admins pick one and start authoring custom copy. No DB rows are created until first save. New GET /admin/overrides endpoint returns the list of languages with admin-authored overrides.
• DefaultStepsService — Single source of truth for the eight built-in tour steps. Both AdminController (editor view) and ApiController (end-user fetch) consume the same Transifex-translated defaults via this service. Removes a previously duplicated step-builder.

Changed

• Wizard is automatically available in every Transifex-translated language (#17) — Default tour content is auto-translated; end users always see the wizard in their Nextcloud locale (fallback chain: user lang → base lang → English). The admin no longer needs to opt languages in. API path: when no admin override exists for a user's language, /api/steps now returns the Transifex-translated defaults inline instead of useDefault:true + empty array.
• Settings tab simplified — The language checkbox grid is replaced by a single hint line stating how many languages have overrides. Wizard-on/off switch and "Show wizard to all users" button remain.
• Reset semantics for a per-language override — "Reset to default" now deletes the override row entirely; the next request serves Transifex-translated defaults. Previously the row was re-saved with defaults baked into the DB.
• License/telemetry payload field rename — enabledLanguages → languagesWithOverrides. Same data shape, more honest name.
• Documentation restructured to match IntraVox/MetaVox layout — Replaced the four flat doc files (ADMINISTRATOR_GUIDE.md, ADMIN_MANUAL.md, USER_MANUAL.md, APP_STORE_SUBMISSION.md) with a nested structure: docs/index.md hub, docs/getting-started.md, plus admin/, user/, features/, architecture/, and deployment/ subdirectories. The two admin monoliths (which largely duplicated each other) were deduplicated into nine topic-scoped files. README and appinfo/info.xml <documentation> block updated to point at the new paths.

Removed

• "Enable languages" concept (#17) — The Settings tab's per-language checkbox grid is gone, and the enabled_languages appconfig key is no longer read or written. Existing rows are left in place on upgrade (harmless; ignored). Existing wizard_steps_<lang> override rows are preserved and now displayed in the Steps-tab dropdown.
• "Tour not available in your language" personal-settings branch — Since every Transifex-translated language is auto-available, this branch was always dead post-upgrade. Removed from lib/Settings/PersonalSettings.php, templates/personal.php, and src/personal.js.
• Auto-persist of default steps on first GET — AdminController::getSteps used to write defaults to oc_appconfig on first read; this artificially inflated the override-list. Defaults are now persisted only when an admin explicitly saves changes.

Fixed

• l10n source-string adaptations for Transifex (#18) — Replaced triple-dot ellipses with U+2026 + nbsp (Saving …, Validating …, Activating …, Restarting tour …) per Nextcloud translation dos-and-don'ts. Dropped "successfully" from Settings saved per Nextcloud writing guidelines. Existing translations for the renamed keys are preserved.
• App description no longer claims a fixed 6-language limit (#17) — appinfo/info.xml description rewritten to reflect Transifex-driven language coverage; removed the "Language-specific tour availability management" bullet.
• Admin-saved step content rendered with literal <p> tags — AdminController::sanitizeStep ran OCP\Util::sanitizeHTML() on every save, which escapes HTML rather than sanitising it; admin-authored copy ended up in the DB as <p>...</p> and Shepherd surfaced the raw tags to end users. Replaced with a plain trim(). Admin-authored wizard copy is intentionally HTML and admins are already trusted.
• End-user wizard could be served in the wrong language — ApiController used IL10N::getLanguageCode() which returns NC's validated language (the one with a translation file), silently rerouting e.g. an Italian user to Dutch when no Italian IntroVox translation existed. Switched to IFactory::findLanguage(null) so the raw user preference is used, and the defaults service falls back to English (not the system default language) when the user's language has no translation file.
• Wizard client ignored server-provided default steps and re-translated locally — src/components/wizardSteps.js discarded data.steps whenever the response had useDefault:true, then rebuilt the eight default steps in the browser via t('introvox', '<English source>'). Combined with the wrong-language IL10N bug above, this meant a non-translated user's wizard came out in the system default language. The client now uses the server's full step list directly.

Added

• Enterprise subscription support - IntroVox can now be activated with a subscription key from VoxCloud
• New "Support" tab in admin settings with subscription management UI
• Per-language step-count progress bars showing free-tier (10 steps per language) vs. licensed limits
• Automatic daily license sync via background job (with stable jitter to spread load across installations)
• License status and limits sourced from licenses.voxcloud.nl; full feature set remains available on free tier — only volume is limited
• Nextcloud 34 support - Declared compatibility for NC 32–34
• Explicit PHP 8.1 minimum declared in appinfo/info.xml

Changed

• Telemetry payload includes license key + Enterprise detection - Reports now include the configured subscription key and hasExtendedSupport flag (detected via OCP\Util::hasExtendedSupport) so the license server can verify Enterprise claims server-side
• 27 new translation strings for the Support tab across all 6 languages (EN/NL/DE/FR/DA/SV)

Fixed

• Long wizard steps trapped users on mobile (#14) - When step content exceeded the screen height on mobile, the modal overlay blocked page scroll while the step itself did not scroll either, leaving the cancel (×) button and primary action buttons unreachable. Users had to disable the offending step in the admin panel to escape the tour.
• Added max-height: calc(100vh - 32px) (or 100dvh - 16px on mobile, accounting for browser chrome) to the step container
• Header and footer are now pinned via flex-shrink: 0 so the close icon and action buttons remain visible
• The body text area scrolls internally (overflow-y: auto with overscroll-behavior: contain)
• Verified at 375×667 (iPhone 6/7/8) and 320×568 (iPhone SE)

Security

• CSRF protection restored on state-changing admin endpoints - Removed @NoCSRFRequired from 7 POST endpoints (saveSteps, resetToDefault, saveSettings, exportSteps, importSteps, toggleTelemetry, sendTelemetryNow) that were previously vulnerable to cross-site request forgery
• Defensive admin checks added to all admin controller endpoints - All 13 admin endpoints now double-check admin privileges via IGroupManager::isAdmin() in addition to the framework's annotation-based check, preventing accidental exposure if annotations are misconfigured
• HTML sanitization on step content - Step title and text fields are now sanitized via OCP\Util::sanitizeHTML on save/update/import to prevent stored XSS
• HTTP response validation on license-server calls - LicenseService now checks status codes and JSON shape before trusting responses, preventing false-positive license validations on transient server errors

Fixed

• Wizard endpoint crashed with array_filter() null error - When the wizard_steps_<lang> config blob existed but did not decode to a JSON array (corrupt value or legacy non-array data), GET /apps/introvox/api/steps returned HTTP 500 for every logged-in user, blocking the onboarding tour
• Added is_array() guard after json_decode in ApiController::getWizardSteps(); falls back to the existing useDefault: true response so the frontend uses built-in defaults
• Mirrors the defensive pattern already used in TelemetryService

Changed

• Telemetry user-count uses callForAllUsers instead of callForSeenUsers - User count now reflects all provisioned users, not only those who have logged in at least once; minimum returned value is 1 (was 0) so downstream consumers cannot receive a zero count

Fixed

• Tour never starting on some Nextcloud versions - The app-menu readiness check introduced in v1.4.1 used CSS selectors that didn't match all Nextcloud versions, causing the tour to hang indefinitely
• Added multiple fallback selectors for app-menu detection across Nextcloud versions
• Added 10-second timeout fallback to prevent tour from never starting if menu selectors don't match

Fixed

• Tour steps skipped when target element not yet rendered - Steps with a valid attachTo selector were silently skipped if the DOM element hadn't been rendered by Vue at tour start time (e.g., Dashboard step on page load)
• Steps now fall back to centered display instead of being skipped when their target element is not found
• Added app-menu readiness check to waitForNextcloudReady — tour now waits for .app-menu-list .app-menu-entry elements before starting
• Fixes issue where early steps (Dashboard, Activity) were skipped while later steps (Files) worked, due to Vue render timing

Fixed

• Dark mode theme compliance - Wizard modal now correctly follows the active Nextcloud theme (#13)
• Fixed CSS load order: Shepherd.js default styles no longer override custom theme-aware styles
• Moved Shepherd.js CSS import to main.js (before wizard.css) to ensure correct cascade order
• Removed duplicate Shepherd.js CSS import from WizardManager.vue
• Modal background, header, arrow, and all elements now adapt to light, dark, and high contrast themes

Improved

• CSS architecture refactor - Replaced all !important overrides with proper CSS specificity
• Reduced !important usage from 70 to 5 (only prefers-reduced-motion for a11y best practice)
• Uses compound selectors (e.g. .nextcloud-wizard-step.shepherd-element) to win specificity naturally over Shepherd.js defaults
• Added targeted selectors for Shepherd's .shepherd-has-title variants to properly override header and cancel icon styling
• Overlay selector now targets .shepherd-modal-is-visible state for correct specificity
• More maintainable and future-proof: easier to override in downstream themes
• Removed redundant dark mode CSS - Eliminated ~60 lines of duplicate dark mode overrides
• Header background/color and title color overrides in dark mode blocks were redundant (CSS variables already adapt automatically)
• Dark mode blocks now only contain properties that genuinely differ per theme (box-shadow, overlay opacity, glow colors)
• Removed empty CSS rulesets - Cleaned up unused hover/active placeholder rules

Fixed

• Group limitation support - Wizard no longer shown to users outside the app's "Limit to groups" setting (#12)
• LoadScripts.php now checks IAppManager::isEnabledForUser() before loading scripts
• Prevents AppNotEnabledException errors in server log for users outside allowed groups
• Added defensive error handling in WizardManager.vue: HTTP 412/403 responses now correctly disable the wizard instead of falling through to show it

Added

• Nextcloud 33 compatibility - App now supports Nextcloud 32 and 33

Changed

• Migrated admin UI toast notifications - Replaced legacy OCP.Toast globals with showSuccess, showError, showWarning, showInfo from @nextcloud/dialogs in admin interface
• Migrated admin confirm dialogs - Replaced legacy OC.dialogs.confirm() with promise-based showConfirmation() from @nextcloud/dialogs in admin interface (5 locations)
• Migrated personal settings redirect - Replaced OC.generateUrl() and OC.appswebroots with @nextcloud/router imports for tour restart redirect
• Improved dependency injection - Replaced direct \OC::$server->getL10NFactory() access with proper constructor injection of IL10NFactory in AdminController

Removed

• Unused @nextcloud/files dependency - Removed from package.json (was never imported in source code)

Technical

• Added webpack resolve.fallback for path module (required by @nextcloud/dialogs transitive dependency)
• Admin bundle uses @nextcloud/dialogs for all toast and confirmation dialogs
• Personal settings bundle retains lightweight OCP.Toast usage to avoid bundle bloat

IntroVox grows from one welcome tour into tours for Nextcloud and its apps. The major version marks that, and a few changes to the app's HTTP routes that a script outside the app could notice; the stored tours, steps and settings carry over as they are.

Upgrade notes

• Nothing new reaches users until an admin switches it on. App tours, the built-in tours for Files, Talk, Deck and Calendar, and the Dashboard checklist all start switched off. The one exception is Tours in the user menu, which everyone sees; hide it under Settings.
• The personal "disable the tour" switch now covers every tour. A repair step (IntroduceTours) turns tours off for people who had switched the welcome tour off without finishing it; people who finished or skipped it will get app tours once an admin switches one on.
• Telemetry waits for an admin. It is sent only after an admin has opened IntroVox's settings and been asked, once per instance. Until then an updated instance sends nothing.
• Changes for scripts that call IntroVox's routes directly:
• POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id} are gone; use POST /admin/steps (see Removed).
• GET /api/steps needs a logged-in user and the CSRF request token; it was public.
• The admin GET routes, the personal settings and POST /api/wizard/{start,complete,skip} need the request token too.
• POST /admin/settings ignores showToAll; use POST /admin/tours/welcome/reshow.
• Older step exports still import, but a step is now checked like one saved in the editor: an id of letters, digits, _, . and -, a title of at most 500 characters, a known position, and a file of at most 1 MB. Exports made with IntroVox pass; a hand-made file may be refused.

Added

• Tours for apps and pages. Besides the welcome tour, an admin can make a short tour that starts the first time someone opens an app, such as Talk or Deck, or another page of Nextcloud. Each tour has its own steps and languages, can be limited to groups, and can go to everyone or only to people who log in for the first time after it was switched on. It starts once per user, once the app has loaded, and never on top of another tour: someone new gets the welcome tour first. A new tour starts switched off. See Tours.
• Users can start every tour themselves, from a list in their personal settings that says which ones they have seen.
• Statistics per tour, and how far people get. The Statistics pane shows each tour on its own: how many people started, finished and skipped it, and for every step how many got at least that far, so you can see where people stop. Counted per person, only for runs that started by themselves, and only as totals; none of it is sent with the usage statistics. See Statistics.
• Move a whole tour to another Nextcloud. Export tour downloads one .zip with the tour's settings, its steps in every language and its images and videos; Import tour adds it as a new tour, switched off, uploaded or from your own Files. Groups and media this Nextcloud cannot take are left out and named. A package is checked as strictly as an upload. See Move a tour to another Nextcloud.
• Built-in tours for Files, Talk, Deck and Calendar, switched off until you switch them on, and translated like the welcome tour. Each lets users do the app's main job once with their own work (make and share a folder, set up a team conversation, add a card with a due date, plan an event) and then shows what matters most at work, in 11 steps, written from the Nextcloud documentation and reviewed for adoption, accuracy and robust selectors. Their steps can be changed per language and reset; who gets them and when can be set like for any tour. See Built-in tours.
• Share a tour with a link. Copy link in a tour's menu gives a link that opens the tour's page and starts the tour there, for a welcome mail or a message to a team. It works like a start by hand: also for people who saw the tour, only for people who may get it, and not counted in the statistics. While the tour is switched off, Copy link says the link starts nothing yet. See Share a tour with a link.
• "Tours" in the user menu, just above Help, leads everyone to their tours in the personal settings. An admin can hide it under Settings.
• When a tour starts by itself: not before a number of days after someone's first login, and only between two dates. Starting it by hand or with a link always works.
• Tours that start anywhere, on whichever page someone opens next: with a number of days, a tip that comes once someone has found their way.
• Steps that wait for the user. A step whose element only appears after the user did something (a conversation they create, a file's sharing they open) stands aside in the corner, leaves the page usable, and moves to the element as soon as it is there. Together with "Click on the element", a tour can now lead someone through creating a conversation and adding people, in any app. The element picker says so when the element was reached by using the page. Continue with: Filling in the field keeps Next off until a field has text, such as a new conversation's name. The element a step points at has a clear outline and a blinking arrow, also inside dialogs. See Steps that wait for the user.
• "Getting started" on the Dashboard. An admin can offer everyone a checklist of first things to do: take the welcome tour, upload a file, add a profile picture, install the app, send a message in Talk, secure the account with two-factor authentication. Each task links to where it is done and ticks itself off once the user did it. Admins can add tasks of their own, such as "Open Talk" or the folder with the handbook, ticked off once opened from the list. Off by default; the admin picks the tasks and can put the list on every Dashboard, and everyone can remove it under Customize. See Checklist on the Dashboard.
• Translate a tour, or write its steps, with AI. With a provider for the Nextcloud Assistant set up, Translate with AI translates a tour's steps into other languages, words only, and Write steps with AI writes new steps from a description. You check and can change every step before it is saved. See Write or translate steps with AI.

• Images, GIFs and videos in steps. A step can show one image (PNG, JPEG), animated GIF or video (MP4, WebM) above its text: uploaded, chosen from the admin's own Files, or pasted as a screenshot. A description is required unless the image is decorative; videos play with a play button or silently like a GIF, and can have captions. Anything that moves can be paused, and stays still for people with reduced motion. Only files from this Nextcloud: IntroVox keeps its own copy, checks the real file type and strips metadata such as location, and only users who get the step can load the file. See Image or video and the threat model.

• Pick the element a step points at instead of typing a CSS selector. Pick element in the step editor opens Nextcloud full-screen on the settings page: click the element, and a selector that survives reloads, other languages and most updates is filled in, with a matching tooltip position. To pick something inside a menu, open the menu in Browse mode and Shift-click the item; the step then opens that menu itself before it shows (new Open first field).

• Tours can span apps. A step can belong to a page, such as /apps/spreed/ for Talk; the tour opens that app when it gets there and carries on, with Back working the same way. Pick element fills the page in. Steps in an app a user can't open are skipped, and a tour that went to other apps returns to the homepage on Done.

• Steps that continue on a click. With Continue with: Click on the element, users click the highlighted element ("Click New conversation") instead of a Next button, and the step tells them so. If the element is missing, a Next button appears instead.

• Preview the tour before users get it. Preview tour runs the tour for the language being edited, optionally as a member of one group; Test this step shows a single step, unsaved edits included. A preview is not counted in the statistics and does not mark the tour as seen for the admin.

• Step texts are written with formatting instead of HTML. The Text field is an editor that shows the text as the tour will, with a toolbar for bold, italic, a heading, lists, links, code and emoji; the title has an emoji button too. Links open in a new tab, so the tour stays where it is. Edit as HTML shows the HTML itself. HTML that users never see, because the tour removes it, is left out of the editor with a line saying what; it only goes from the stored text once the text is changed. Texts are still stored as HTML: exports, imports and the translated default steps are unaffected.

• A short tour of the admin page for every admin, the first time they open IntroVox's settings: the parts of the page, languages, how to make a step in four moves, the preview, and a link to the manual. It uses the same tour users get. Show the admin tour again under Support runs it again.

• Steps can be reordered without a mouse. Every step has Move up and Move down buttons beside the drag handle. Reordering was drag-only, so it could not be done from the keyboard or with a screen reader at all — the two buttons save the new order the same way a drag does.

• Translations in 105 languages, from Transifex as they stood on release day. Danish is complete; Spanish, Dutch and French are largely translated, partly by machine and not yet reviewed by their language teams. Languages with only a few translated strings are included too: what is not translated shows in English.

Changed

• The Steps pane is now Tours: a list of the tours, each with a switch, Edit steps, a preview, Show again to everyone and, for app tours, Delete. The step editor opens from there. The main switch is called Tours for everyone.
• "Permanently disable the introduction tour" in the personal settings is now "Start tours by themselves", and covers every tour. Users who had switched the tour off there keep tours off after the update; users who finished or skipped it get app tours.
• Show wizard to all users is now Show again to everyone, in the welcome tour's menu under Tours, like for every other tour. It no longer overrides people who switched tours off; everyone else who saw the welcome tour gets it again, as before.
• The Statistics pane counts people, not clicks, for skipping too: "Times skipped" is now "Users skipped".
• Pages load less. The script every page loads is 18 KB instead of 252 KB, and asks the server nothing: it decides from what the page already carries whether a tour starts, and only then loads the tour itself.
• A same-origin frame of another app starts no tour inside it.
• Wording follows Nextcloud's own terms: people and accounts instead of "users" where it means everyone, and no contractions such as "don't" in the new strings.

• The English source strings use American spelling, as Nextcloud itself does: "customise" became "customize". Until translators catch up, that one string shows in English in the languages that had it translated.

• Every change to the steps is saved straight away: saving a step, deleting, reordering and switching a step on or off. The Save changes button only appears to retry a save that failed. The personal "disable the tour" switch saves straight away too.

• Steps are edited in a dialog, a page at a time: content, element, behavior and who sees it. New steps walk through the pages; existing ones can be saved from any page. Element, page and menu are summarised next to Pick element, with the fields folded away under Edit by hand. The step list itself no longer expands an editor.

• The admin and personal settings pages use Nextcloud's own components and icons instead of emoji buttons and plain form fields. Buttons show their intended colours again; with @nextcloud/vue 9 every one of them had rendered as a plain grey button.

• The tabs across the top of the admin page are Nextcloud's own pane switcher, the control core uses for a settings page with several parts. They were hand-built buttons: a screen reader heard four loose buttons with nothing saying they belonged together or which one was open. On a phone the row no longer runs off the side of the screen — the fourth tab used to be unreachable, because the page does not scroll sideways.

• Text in the tour and on both settings pages follows the sizes the theme sets. Sizes were fixed in the code, four of them smaller than Nextcloud's smallest — a size no display setting could enlarge. They now scale with the rest of the interface.

• Lists in a step show bullets. Nextcloud's stylesheet takes them off every list, so a list in the tour looked like a column of indented lines. This shows in the default steps too.

• Telemetry is only sent once an admin has been asked. The admin tour ends with the question, with a list of what is sent; it is asked once per instance. After that telemetry is on unless an admin chose not to share, as before. Instances where nobody opened IntroVox's settings since the update send nothing. The list of what is sent now also names the tour counts, the country, Docker and the license key.

Removed

• Three unused admin endpoints: POST /admin/step, PUT /admin/step/{id} and DELETE /admin/step/{id}. The app has always saved the step list as a whole through POST /admin/steps; nothing called these. Anything outside the app that did call them must move to POST /admin/steps.

Fixed

• A fallback selector won over the main one: with an element such as .cards, #navigation a, a step pointed at whichever came first in the page, here the navigation. The selectors are now tried in the order they were written.
• People with a regional language, such as pt_BR, zh_CN or es_419, got the welcome tour in English: only the first two letters of a language were used, so a translation or an administrator's own steps for the full language were never shown. Now the full language comes first, then its base language.

• A welcome tour with every step switched off, or only with steps for other groups, showed the built-in steps to the people it was meant to show nothing. It shows nothing now.

• Edited and new steps were gone after a reload. Save in the step editor only updated the list in the browser; nothing reached the server until a separate Save changes button at the top of the list was clicked, and leaving the page did not warn.

• Cancel deleted saved steps. Cancelling the editor removed any step that had once been created with Add step, even one saved long before.

• The tour started about ten seconds late on Nextcloud 34 and 35, also after "Restart tour now". It waited for the inline app bar of older versions, which no longer exists, until a timeout.

• A new element for the Files, Search or Settings default step was ignored; the tour kept pointing at the built-in one.

• Steps pointing into the apps menu lost it as soon as the mouse moved to the tour's tooltip: Nextcloud 35 closes that menu 180 ms after the pointer leaves it. The tour now keeps the menu open for as long as the step shows. This affected the built-in Files step too.

• On instances installed in a subdirectory or without pretty URLs, users could get the built-in tour instead of the admin's. The tour fetched its steps from a hard-coded address that does not exist there, and fell back to the bundled defaults.

• Bold words in a step looked like links. They were shown in the same blue as a real link, so in the built-in "Important features" step "apps menu", "avatar" and "search bar" invited a click that did nothing. Bold is now bold: the colour is the text colour, and blue again means a link. This applies to every step, including ones written by an admin or a translator.

• The highlight around the element a step points at follows the server's colour. It was always Nextcloud blue, so on an instance with its own brand colour the outline took the brand colour and the glow around it stayed blue.

• The language picker in the step editor had no name a screen reader could read. It is labelled "Language" now, as is the one in the Add language override dialog.

• The close button in the tour showed its own tooltip on hover, which repeated the label a screen reader already reads and could not be dismissed with Escape. The button keeps its name; the extra tooltip is gone.

• The tour dialog and the settings pages line up with the rest of Nextcloud again. The tour's header was a grey band with a blue title; the tabs, the step list and the Support page each started at a different distance from the left edge of the page.

• A failed load of the step list looked like an empty tour. Adding a step to it would have replaced the whole tour for that language. The admin page now shows an error with a Try again button, and adding steps or previewing waits until the list has loaded.

• The text field of a step showed "HTML content placeholder" as its placeholder, a translation key that never got a text.

• Less motion where people asked for it. With reduced motion switched on, the tour and the step list jump to a step instead of scrolling smoothly. The arrow and the outline around a step's element blink a few times and then stay still, for everyone, instead of blinking for as long as the step shows.

• The full-screen Nextcloud page of Pick element and Preview tour kept the admin page reachable: Tab and a screen reader could leave the overlay for the page underneath. That page is now out of reach until the overlay closes.

• The pause button of a GIF or video kept a blue tint after a click, and showed a tooltip that repeated its label.

• The app's icon was a solid disc in the app list, and white on white where Nextcloud shows it on a light background. It is drawn again from filled shapes, for 20 pixels.

Security

• Media in steps is checked by its content. The type of an image or video is taken from its bytes, never from its name; SVG, HTML and every type other than PNG, JPEG, GIF, MP4, WebM and WebVTT captions are refused. Location and other metadata are stripped before the file is stored, and size, pixels, frames and total storage are limited. See the threat model.
• Media is only served to people who get the step, as a download that can do nothing on its own: nosniff, Content-Security-Policy: default-src 'none'; sandbox and Cross-Origin-Resource-Policy: same-origin.
• Step text is sanitized in the browser as well, with DOMPurify and a strict allowlist, wherever it is shown as HTML: in the tour, in the step list and in the AI review.
• Tour packages trust nothing. File names, sizes and the number of files are checked before anything is unpacked, and every tour, step and file goes through the same checks as one made in the editor.
• Rate limits on the tracking routes and on the AI routes.
• Every route needs the CSRF request token, also the ones that only read, except two that cannot send one and only read or redirect: GET /media/{file}, which an <img> or <video> loads, and GET /tour/{id}, a tour's share link.

Fixed

• The admin and personal settings pages were stuck in English, whatever language the account used. The tour itself translated correctly, which made the screens look half-finished: a French tour wrapped in an English settings page. 120 of the app's 207 texts had never reached the translators at all — the tabs, "Global settings", "Enable wizard for all users" and every confirmation and error message on those pages. All 205 translatable texts are now in the template, and the newly exposed ones will appear language by language as translators work through them.

• Seven messages in the admin settings showed a literal %s instead of the value they were meant to insert: importing a tour reported Successfully imported %s steps for language %s rather than the number of steps and the language, and the four error messages on that page ended in a bare %s where the reason for the failure should have been. All seven now show the actual values.

Added

• A continuous-integration pipeline runs on every push: a PHP syntax check, the JavaScript unit tests, a production build, a security scan of the backend, and guards that assert every text the settings screens use is actually collected for translation. The failure fixed above went unnoticed for three months because nothing ever checked it.

Changed

• Nine texts were reworded for the Nextcloud style guidelines: a non-breaking space before an ellipsis so the dots never wrap onto their own line ("Saving …", "Loading …"), sentence case for "Anonymous usage statistics", and no more "successfully" in success messages, which appear in a success-styled notification anyway. The import message became Imported {count} steps ({language}). Texts that had translations revert to English until translators pick up the new wording.

• Two more languages: Indonesian and Slovak, both fully translated. They were available from the translation service but had been left out of the shipped set by an oversight in the previous release. The app ships languages that pass the 25% translation threshold.

Added

• More translated strings in Danish, German (both variants), Estonian and Brazilian Portuguese — mostly the Support tab introduced in 1.7.7.

Fixed

• A customized tour showed default steps the admin had deleted. An admin who removed default steps from their tour — say search, settings and intro — still saw them appear in the running tour, in the bundled default wording rather than their own. The steps were re-inserted in the browser: enrichSteps() re-attached the behavioral fields the API cannot send (function selectors, beforeShowPromise, when) and, while doing so, also injected every bundled default step whose id was absent from the API response. Because they were spliced in after the step preceding them in the default order, they surfaced as a block in the middle of the tour, with default copy and default tone-of-voice — an informal address in languages that distinguish it. The API was right all along: it returned only the configured steps, with useDefault: false. The injection is gone; the server is now solely authoritative over which steps exist and in what order, and enrichSteps() only restores behaviors onto steps the server actually sent. Removing a default step is now what it looks like. Introduced in 1.7.4; 1.7.4 through 1.7.7 are affected.

• The "Your account & settings" step highlighted the wrong area on Nextcloud 32 and 33. Its selector chain led with .header-menu__trigger, a class Nextcloud 34 introduced. On 32 and 33 that class does not exist (the markup is #user-menu.account-menu > button > .account-menu__avatar), so every specific link in the chain missed and it fell through to the bare #user-menu wrapper — putting the spotlight around the whole header container instead of the avatar. The chain now tries the avatar itself before falling back, which is the same class on 32 through 35. The English-only [aria-label="Settings menu"] match was also demoted: core renders that label through the translation layer, so it never matched on a non-English instance anyway. Nextcloud 34 and 35 keep using the trigger they always did. Fixed in both the bundled tour and the server-side defaults. Introduced in 1.7.4.

• Usage reporting could count one server as two, which left the figures on the licence server stale. Affected instances correct themselves at the next report; nothing needs to be reconfigured. Reporting only — nothing in the app behaves differently.

Added

• Nextcloud 35 support. max-version raised from 34 to 35 so the app installs on Nextcloud 35. Nextcloud 32 remains the minimum — 32, 33 and 34 are all still maintained, and PHP stays at 8.1 because Nextcloud 32 runs on it (Nextcloud 35 enforces PHP 8.3 itself).

Changed

• Controller access rules now use PHP attributes. All 19 PHPDoc annotations (@NoAdminRequired, @NoCSRFRequired, @PublicPage) became #[NoAdminRequired], #[NoCSRFRequired] and #[PublicPage]. Nextcloud 35 still reads the old annotations, so this changes no behaviour today — it is the form that will keep working. Verified per method that every endpoint kept exactly the same access rules.

• IntroVox is free, and the Support tab now says so. The tab offered a subscription key, per-language progress bars ("0 / 10 steps") and a warning that new steps required a subscription. None of that reflected reality — IntroVox is free at every tier and no code path ever blocked a save — so the key field, the progress bars and the limit warning are gone. In their place: what the app is (free, open source, no user limit, no paid features), a pointer to the other VoxCloud apps for Nextcloud, and where to get help. Step counts per language remain visible on the Steps tab. Existing installations with a stored subscription key are unaffected; the licensing endpoints still exist and simply have no UI.

Fixed

• The tour named a specific Nextcloud version. The Files step read "On Nextcloud 34 it lives in the apps menu", which was simply wrong on Nextcloud 35. The layout is identical on 34 and 35, so the version number is gone: "You will find it in the apps menu (top left)". The admin hint about selectors lost its version reference too.

• Telemetry logged an hourly warning that said nothing. TelemetryJob: Telemetry report failed appeared every hour with no reason attached, because both failure paths in sendReport() returned silently. The cause turned out to be the license server's rate limit: it accepts one report per instance per hour and answers HTTP 429, while the job runs more often. That expected case is now a debug line instead of a warning, and every real failure logs what actually went wrong (status code plus response, or the exception).

• Telemetry mis-detected Nextcloud Enterprise. The subscription check read the Extended Support add-on rather than the subscription itself, so instances with a plain Enterprise subscription were reported as Community. It now uses IRegistry::delegateHasValidSubscription() (public API since NC 17). This only affects the usage figures reported back to VoxCloud; nothing in the app behaves differently.

Fixed

• Imported wizard steps saved in a non-UTF-8 encoding showed "mojibake" (e.g. één instead of één). The browser's file.text() always decodes an uploaded import file as UTF-8, so a file that was actually saved as Windows-1252/Latin-1 arrived as valid-but-wrong UTF-8 and was stored (and displayed in the tour) verbatim. Step title/text are now passed through a conservative mojibake repair in sanitizeStep() (so it covers import and any manual save/paste): a string is only rewritten when it carries a mojibake signature and reinterpreting its code points as the CP1252 bytes they were mis-read from yields a different, still-valid UTF-8 string. Correctly-accented copy (café, naïef, Übung, —, →) fails that guard and is left untouched. Existing corrupted steps are healed on the next save/re-import; already-stored values are not rewritten in place.
• Tour copy saved by IntroVox ≤ 1.6.x showed literal <p>/<strong> tags. Those versions ran wizard step title/text through \OCP\Util::sanitizeHTML() on save, which HTML-escaped the admin's markup (<p> → <p>); since 1.7.0 the copy is stored as-is and rendered as HTML by Shepherd.js, so instances upgrading from an older version kept showing the escaped tags until each step was re-saved by hand. A new one-time repair step (UnescapeLegacyWizardStepHtml) un-escapes those stored rows automatically on upgrade. It only touches values carrying the pre-1.7.0 fingerprint (escaped angle brackets and no raw </>), so correctly-stored 1.7.x HTML is never altered and the step is idempotent; a recoverable copy is saved to legacy_html_backup_<key> first.

Fixed

• Upgrade to 1.7.4 could silently delete an admin-customized tour (data loss). The RemoveStaleDefaultWizardSteps repair step — meant to clear only the pre-1.7.4 auto-saved default tour so the new NC 34 defaults take over — detected "untouched defaults" by merely checking that a legacy calendar step and a legacy search step were both present. An admin who kept those two steps but extended the tour (e.g. added a custom video step) still matched, so their entire wizard_steps_<lang> override was wiped on upgrade. The step now requires the stored step ids to match the legacy fingerprint exactly (same eight ids, same order, nothing added, removed, renamed or reordered) before also checking the legacy selectors — so any customized tour is left untouched. As an extra safety net, a recoverable copy is now saved to stale_wizard_backup_<key> before any deletion. (#21)

Fixed

• Upgrade to 1.7.4 could silently delete an admin-customized tour (data loss). The RemoveStaleDefaultWizardSteps repair step — meant to clear only the pre-1.7.4 auto-saved default tour so the new NC 34 defaults take over — detected "untouched defaults" by merely checking that a legacy calendar step and a legacy search step were both present. An admin who kept those two steps but extended the tour (e.g. added a custom video step) still matched, so their entire wizard_steps_<lang> override was wiped on upgrade. The step now requires the stored step ids to match the legacy fingerprint exactly (same eight ids, same order, nothing added, removed, renamed or reordered) before also checking the legacy selectors — so any customized tour is left untouched. As an extra safety net, a recoverable copy is now saved to stale_wizard_backup_<key> before any deletion. (#21)

Fixed

• Tour steps pointed at the wrong header elements on Nextcloud 34. NC 34 ("Hub 26 Spring") restructured the top header: the search became an always-visible inline searchbar (.unified-search-input, replacing the .unified-search__trigger icon button), and the app navigation (Files, Calendar, …) plus the personal settings moved behind the apps "waffle" menu and the account/avatar menu — those items no longer exist in the DOM until their menu is opened. As a result the Search step highlighted the notifications bell, and the Files/Calendar steps either highlighted nothing (centered fallback) or a random sidebar link. (#19)

Changed

• Wizard targets are now resolved lazily and degrade gracefully. WizardManager previously resolved each step's selector once at tour-build time, so any target behind a menu was permanently nulled to a centered popup. Targets are now resolved at show-time (Shepherd accepts a function attachTo), so a step can point at an element a menu reveals — and a genuinely missing target still centers cleanly.
• Nav steps retargeted for NC 34, with NC ≤ 33 fallbacks. The old separate Files and Calendar steps are merged into one 📁 Files & apps step: on NC 34 it opens the apps "waffle" menu (beforeShowPromise), highlights the Files entry inside it with the tooltip beside the open menu, and closes the menu again afterward (with cancel/complete cleanup safety nets); on NC ≤ 33 — which has no waffle — the same step simply highlights the always-visible inline Files icon. The Search step leads with .unified-search-input (NC 34) and falls back to #unified-search (NC ≤ 33); a new ⚙️ Settings step highlights the always-visible account/avatar menu (#user-menu on NC ≤ 33). The features step copy was updated to match the NC 34 layout. All targeting is selector-presence driven — no hard version checks. Verified live on NC 34.0.0 and NC 33.0.1.
• Function-valued step behavior (lazy attachTo, beforeShowPromise, when, canClickTarget) lives only in the client; since the API serves the default steps inline, the client now re-attaches these behaviors onto the server-provided steps by id (enrichSteps), keeping server copy/translations/ordering authoritative.
• Admin Steps editor now documents NC 34 menu targeting: the CSS-selector field's example is updated (.app-menu__waffle, .unified-search-input, #user-menu) and a tip explains that menu items only exist once their menu is opened, so steps should point at the always-visible trigger button.

Fixed

• App Store install/update failed with "App with id introvox has invalid signature". The signature registered for the 1.7.1 release in the Nextcloud App Store carried a stray trailing marker, so Nextcloud's base64_decode produced a 522-byte signature instead of 512 bytes and verification failed on every instance (reproduced on NC 33.0.1, 33.0.5 and 34.0.0). Re-released as 1.7.2 with a correctly generated signature. No functional changes compared to 1.7.1. (#19)

Fixed

• Nextcloud 34 compatibility. Replaced the removed \OC::$server->getURLGenerator() service-locator call in LicenseService with a proper IURLGenerator constructor injection. On NC 34 the legacy \OC::$server accessor is gone, which broke license validation and telemetry (both rely on the instance URL hash).

Added

• Synced translations from Transifex. Pulled the full nextcloud:introvox resource (110 source strings) and regenerated l10n/*.js|*.json for 89 languages. German is now 100 % translated and Dutch 95 %; the complete tour content, PWA install flow and subscription UI are now localized instead of falling back to English.
• scripts/po2l10n.py + scripts/sync-translations.sh — pull translations from Transifex (tx pull) and convert the .po files into the Nextcloud l10n/<lang>.js + .json format, so the sync can be re-run before each release without depending on the upstream bot.

Upgrade notes

• Stale wizard_steps_<lang> rows from 1.6.x are kept as-is. Versions before 1.7.0 auto-persisted the default tour content into oc_appconfig the first time the admin opened the Steps tab, so most 1.6.x installs have six rows (en/nl/de/da/fr/sv) that are byte-identical to the bundled defaults at the time. After upgrade, those rows show up in the Steps-tab dropdown as "overrides". The wizard keeps working and end users see no difference, but those six languages will no longer pick up new Transifex translations until the admin clicks Reset on each one — that deletes the row and lets the Transifex-translated defaults take over. Languages that were never touched on the old install have no row and are unaffected; their users get fresh Transifex translations automatically. No data is lost either way.
• Obsolete enabled_languages appconfig key is ignored, not deleted. Left in place so a downgrade to 1.6.x stays functional. Can be removed manually with occ config:app:delete introvox enabled_languages if desired; harmless if left.

Added

• Language-override workflow for admins (#17) — Steps tab gains an explicit "Add language override" flow. A searchable dropdown shows every Transifex-supported language; admins pick one and start authoring custom copy. No DB rows are created until first save. New GET /admin/overrides endpoint returns the list of languages with admin-authored overrides.
• DefaultStepsService — Single source of truth for the eight built-in tour steps. Both AdminController (editor view) and ApiController (end-user fetch) consume the same Transifex-translated defaults via this service. Removes a previously duplicated step-builder.

Changed

• Wizard is automatically available in every Transifex-translated language (#17) — Default tour content is auto-translated; end users always see the wizard in their Nextcloud locale (fallback chain: user lang → base lang → English). The admin no longer needs to opt languages in. API path: when no admin override exists for a user's language, /api/steps now returns the Transifex-translated defaults inline instead of useDefault:true + empty array.
• Settings tab simplified — The language checkbox grid is replaced by a single hint line stating how many languages have overrides. Wizard-on/off switch and "Show wizard to all users" button remain.
• Reset semantics for a per-language override — "Reset to default" now deletes the override row entirely; the next request serves Transifex-translated defaults. Previously the row was re-saved with defaults baked into the DB.
• License/telemetry payload field rename — enabledLanguages → languagesWithOverrides. Same data shape, more honest name.
• Documentation restructured to match IntraVox/MetaVox layout — Replaced the four flat doc files (ADMINISTRATOR_GUIDE.md, ADMIN_MANUAL.md, USER_MANUAL.md, APP_STORE_SUBMISSION.md) with a nested structure: docs/index.md hub, docs/getting-started.md, plus admin/, user/, features/, architecture/, and deployment/ subdirectories. The two admin monoliths (which largely duplicated each other) were deduplicated into nine topic-scoped files. README and appinfo/info.xml <documentation> block updated to point at the new paths.

Removed

• "Enable languages" concept (#17) — The Settings tab's per-language checkbox grid is gone, and the enabled_languages appconfig key is no longer read or written. Existing rows are left in place on upgrade (harmless; ignored). Existing wizard_steps_<lang> override rows are preserved and now displayed in the Steps-tab dropdown.
• "Tour not available in your language" personal-settings branch — Since every Transifex-translated language is auto-available, this branch was always dead post-upgrade. Removed from lib/Settings/PersonalSettings.php, templates/personal.php, and src/personal.js.
• Auto-persist of default steps on first GET — AdminController::getSteps used to write defaults to oc_appconfig on first read; this artificially inflated the override-list. Defaults are now persisted only when an admin explicitly saves changes.

Fixed

• l10n source-string adaptations for Transifex (#18) — Replaced triple-dot ellipses with U+2026 + nbsp (Saving …, Validating …, Activating …, Restarting tour …) per Nextcloud translation dos-and-don'ts. Dropped "successfully" from Settings saved per Nextcloud writing guidelines. Existing translations for the renamed keys are preserved.
• App description no longer claims a fixed 6-language limit (#17) — appinfo/info.xml description rewritten to reflect Transifex-driven language coverage; removed the "Language-specific tour availability management" bullet.
• Admin-saved step content rendered with literal <p> tags — AdminController::sanitizeStep ran OCP\Util::sanitizeHTML() on every save, which escapes HTML rather than sanitising it; admin-authored copy ended up in the DB as <p>...</p> and Shepherd surfaced the raw tags to end users. Replaced with a plain trim(). Admin-authored wizard copy is intentionally HTML and admins are already trusted.
• End-user wizard could be served in the wrong language — ApiController used IL10N::getLanguageCode() which returns NC's validated language (the one with a translation file), silently rerouting e.g. an Italian user to Dutch when no Italian IntroVox translation existed. Switched to IFactory::findLanguage(null) so the raw user preference is used, and the defaults service falls back to English (not the system default language) when the user's language has no translation file.
• Wizard client ignored server-provided default steps and re-translated locally — src/components/wizardSteps.js discarded data.steps whenever the response had useDefault:true, then rebuilt the eight default steps in the browser via t('introvox', '<English source>'). Combined with the wrong-language IL10N bug above, this meant a non-translated user's wizard came out in the system default language. The client now uses the server's full step list directly.

Added

• Enterprise subscription support - IntroVox can now be activated with a subscription key from VoxCloud
• New "Support" tab in admin settings with subscription management UI
• Per-language step-count progress bars showing free-tier (10 steps per language) vs. licensed limits
• Automatic daily license sync via background job (with stable jitter to spread load across installations)
• License status and limits sourced from licenses.voxcloud.nl; full feature set remains available on free tier — only volume is limited
• Nextcloud 34 support - Declared compatibility for NC 32–34
• Explicit PHP 8.1 minimum declared in appinfo/info.xml

Changed

• Telemetry payload includes license key + Enterprise detection - Reports now include the configured subscription key and hasExtendedSupport flag (detected via OCP\Util::hasExtendedSupport) so the license server can verify Enterprise claims server-side
• 27 new translation strings for the Support tab across all 6 languages (EN/NL/DE/FR/DA/SV)

Fixed

• Long wizard steps trapped users on mobile (#14) - When step content exceeded the screen height on mobile, the modal overlay blocked page scroll while the step itself did not scroll either, leaving the cancel (×) button and primary action buttons unreachable. Users had to disable the offending step in the admin panel to escape the tour.
• Added max-height: calc(100vh - 32px) (or 100dvh - 16px on mobile, accounting for browser chrome) to the step container
• Header and footer are now pinned via flex-shrink: 0 so the close icon and action buttons remain visible
• The body text area scrolls internally (overflow-y: auto with overscroll-behavior: contain)
• Verified at 375×667 (iPhone 6/7/8) and 320×568 (iPhone SE)

Security

• CSRF protection restored on state-changing admin endpoints - Removed @NoCSRFRequired from 7 POST endpoints (saveSteps, resetToDefault, saveSettings, exportSteps, importSteps, toggleTelemetry, sendTelemetryNow) that were previously vulnerable to cross-site request forgery
• Defensive admin checks added to all admin controller endpoints - All 13 admin endpoints now double-check admin privileges via IGroupManager::isAdmin() in addition to the framework's annotation-based check, preventing accidental exposure if annotations are misconfigured
• HTML sanitization on step content - Step title and text fields are now sanitized via OCP\Util::sanitizeHTML on save/update/import to prevent stored XSS
• HTTP response validation on license-server calls - LicenseService now checks status codes and JSON shape before trusting responses, preventing false-positive license validations on transient server errors

Fixed

• Wizard endpoint crashed with array_filter() null error - When the wizard_steps_<lang> config blob existed but did not decode to a JSON array (corrupt value or legacy non-array data), GET /apps/introvox/api/steps returned HTTP 500 for every logged-in user, blocking the onboarding tour
• Added is_array() guard after json_decode in ApiController::getWizardSteps(); falls back to the existing useDefault: true response so the frontend uses built-in defaults
• Mirrors the defensive pattern already used in TelemetryService

Changed

• Telemetry user-count uses callForAllUsers instead of callForSeenUsers - User count now reflects all provisioned users, not only those who have logged in at least once; minimum returned value is 1 (was 0) so downstream consumers cannot receive a zero count

Fixed

• Tour never starting on some Nextcloud versions - The app-menu readiness check introduced in v1.4.1 used CSS selectors that didn't match all Nextcloud versions, causing the tour to hang indefinitely
• Added multiple fallback selectors for app-menu detection across Nextcloud versions
• Added 10-second timeout fallback to prevent tour from never starting if menu selectors don't match

Fixed

• Tour steps skipped when target element not yet rendered - Steps with a valid attachTo selector were silently skipped if the DOM element hadn't been rendered by Vue at tour start time (e.g., Dashboard step on page load)
• Steps now fall back to centered display instead of being skipped when their target element is not found
• Added app-menu readiness check to waitForNextcloudReady — tour now waits for .app-menu-list .app-menu-entry elements before starting
• Fixes issue where early steps (Dashboard, Activity) were skipped while later steps (Files) worked, due to Vue render timing

Fixed

• Dark mode theme compliance - Wizard modal now correctly follows the active Nextcloud theme (#13)
• Fixed CSS load order: Shepherd.js default styles no longer override custom theme-aware styles
• Moved Shepherd.js CSS import to main.js (before wizard.css) to ensure correct cascade order
• Removed duplicate Shepherd.js CSS import from WizardManager.vue
• Modal background, header, arrow, and all elements now adapt to light, dark, and high contrast themes

Improved

• CSS architecture refactor - Replaced all !important overrides with proper CSS specificity
• Reduced !important usage from 70 to 5 (only prefers-reduced-motion for a11y best practice)
• Uses compound selectors (e.g. .nextcloud-wizard-step.shepherd-element) to win specificity naturally over Shepherd.js defaults
• Added targeted selectors for Shepherd's .shepherd-has-title variants to properly override header and cancel icon styling
• Overlay selector now targets .shepherd-modal-is-visible state for correct specificity
• More maintainable and future-proof: easier to override in downstream themes
• Removed redundant dark mode CSS - Eliminated ~60 lines of duplicate dark mode overrides
• Header background/color and title color overrides in dark mode blocks were redundant (CSS variables already adapt automatically)
• Dark mode blocks now only contain properties that genuinely differ per theme (box-shadow, overlay opacity, glow colors)
• Removed empty CSS rulesets - Cleaned up unused hover/active placeholder rules

Fixed

• Group limitation support - Wizard no longer shown to users outside the app's "Limit to groups" setting (#12)
• LoadScripts.php now checks IAppManager::isEnabledForUser() before loading scripts
• Prevents AppNotEnabledException errors in server log for users outside allowed groups
• Added defensive error handling in WizardManager.vue: HTTP 412/403 responses now correctly disable the wizard instead of falling through to show it

Added

• Nextcloud 33 compatibility - App now supports Nextcloud 32 and 33

Changed

• Migrated admin UI toast notifications - Replaced legacy OCP.Toast globals with showSuccess, showError, showWarning, showInfo from @nextcloud/dialogs in admin interface
• Migrated admin confirm dialogs - Replaced legacy OC.dialogs.confirm() with promise-based showConfirmation() from @nextcloud/dialogs in admin interface (5 locations)
• Migrated personal settings redirect - Replaced OC.generateUrl() and OC.appswebroots with @nextcloud/router imports for tour restart redirect
• Improved dependency injection - Replaced direct \OC::$server->getL10NFactory() access with proper constructor injection of IL10NFactory in AdminController

Removed

• Unused @nextcloud/files dependency - Removed from package.json (was never imported in source code)

Technical

• Added webpack resolve.fallback for path module (required by @nextcloud/dialogs transitive dependency)
• Admin bundle uses @nextcloud/dialogs for all toast and confirmation dialogs
• Personal settings bundle retains lightweight OCP.Toast usage to avoid bundle bloat

Added

• Telemetry expansion: Added 3 new server configuration fields to anonymous usage statistics
• OS family, web server type, Docker detection
• Send report now button: Manual telemetry report trigger in admin Statistics tab
• Responsive admin tabs: Tab navigation stacks vertically on mobile screens (< 768px)

Fixed

• Telemetry timezone fallback: Timezone uses smarter fallback: Nextcloud config → php.ini → UTC (instead of always falling back to UTC)

Changed

• Telemetry enabled by default - Anonymous usage statistics are now opt-out instead of opt-in
• Helps developers improve IntroVox with anonymous usage data
• Administrators can still disable telemetry in admin panel (Statistics tab)
• No personal data is ever collected - only aggregate statistics

Added

• Extended telemetry data - New privacy-friendly server environment fields
• serverRegion - Country code from admin-configured default_phone_region (ISO 3166-1)
• defaultLanguage - Server's default language setting
• defaultTimezone - Server's timezone (e.g., "Europe/Amsterdam")
• databaseType - Database type (mysql/pgsql/sqlite)
• totalGroups - Number of Nextcloud groups (count only, no names)
• groupVisibilityUsed - Whether group-based step visibility is used (boolean)
• All new fields are privacy-friendly: admin-configured values only, no personal data

Added

• Group-based step visibility - Control which user groups can see specific wizard steps
• New "Visible to groups" multi-select dropdown in step editor
• Select one or more Nextcloud groups per step
• Empty selection (default) means visible to all users
• Steps are filtered on the backend before being sent to users
• Users only see steps they have access to based on their group membership
• Perfect for role-based onboarding (e.g., different steps for admins vs regular users)
• Groups API endpoint - New /admin/groups endpoint to fetch available Nextcloud groups
• Automatic migration - Existing steps automatically get visibleToGroups: [] (visible to all)
• Admin statistics dashboard - New "Statistics" tab in admin interface
• Wizard usage metrics: users started, users completed, times skipped, completion rate
• Instance information: total users, active users (30d), total steps, enabled languages
• Real-time statistics loaded from server
• Anonymous telemetry system - Optional anonymous usage statistics
• Opt-in telemetry sharing with developers (disabled by default)
• Sends anonymous data to licenses.voxcloud.nl/api/telemetry/introvox
• Instance identified by SHA-256 hash (never sends actual URL)
• Collects: user counts, step counts, wizard usage, NC/PHP versions
• Does NOT collect: server URL, usernames, personal data, step content
• Manual "Send now" button for immediate sending
• Background job runs every 24 hours (with random jitter) when enabled
• Wizard tracking - Track wizard start, completion, and skip events per user
• New user preferences: wizard_started, wizard_completed timestamps
• Aggregated statistics visible in admin dashboard
• Privacy-friendly: only totals shown, no individual user tracking visible

Changed

• Admin interface restructured with tabs - Improved organization
• Tab 1: "Settings" - Global settings (wizard enabled, languages, show to all)
• Tab 2: "Steps" - Step editor (language selector, drag-drop steps, group visibility)
• Tab 3: "Statistics" - Usage metrics and telemetry settings
• Improved admin UI navigation - Clean tab-based interface with visual tab indicators

Technical

• Added IGroupManager and IUserSession dependencies to ApiController and AdminController
• Group filtering happens server-side in ApiController::getWizardSteps() for security
• Steps without visibleToGroups or with empty array are visible to everyone
• NcSelect component used for group selection with multi-select support
• Export/import functionality automatically includes group visibility settings
• New TelemetryService class for collecting and sending anonymous statistics
• New TelemetryJob background job (extends TimedJob) for scheduled telemetry
• New API endpoints:
• GET /admin/statistics - Fetch statistics for admin dashboard
• POST /admin/telemetry - Enable/disable telemetry
• POST /admin/telemetry/send - Manual telemetry send
• POST /api/wizard/start - Track wizard start event
• POST /api/wizard/complete - Track wizard completion event
• POST /api/wizard/skip - Track wizard skip event
• Background job registered in info.xml for automatic execution
• 35+ new translation keys added to all 6 language files (EN, NL, DE, DA, FR, SV)

Fixed

• Auto-scroll to new steps - When adding a new step in admin interface, the page now automatically scrolls to show the newly created step
• Backdrop filter blur removed - Fixed text readability issues on small UI elements (buttons) by removing the backdrop blur effect from the wizard overlay (PR #10)

Documentation

• Emoji reference link - Added link to Emojipedia in admin manual for users wanting to use emojis in step titles

Changed

• App icon - Updated to compass design with black color for better visibility in light theme
• Sidebar settings icons now use dark variant for proper contrast

Added

• Documentation link - Added link to Administrator Guide in app info.xml for easy access from App Store

Fixed

• Multi-language wizard support - Wizard now starts for users with any enabled language (not just English)
• Admin language selection - Admin panel now automatically selects first available language if English is disabled
• Step visibility bug - Fixed issue where enabled steps were incorrectly hidden after reordering
• Changed from index-based to ID-based checkbox binding using v-model
• Improved Sortable.js reactivity by creating new array instead of direct mutation
• CSS selector improvements - Updated default step selectors to match multiple UI element variations
• Search step: Added fallback selectors for unified search button
• Files/Calendar: Added data-id attribute selectors for better element detection
• Prevents steps from being skipped due to element not found errors

Improved

• Language detection - Backend now checks if user's language is enabled in admin settings
• Debug logging - Added console logging for step filtering to help troubleshoot visibility issues
• Admin panel initialization - Global settings now load before steps to ensure correct language selection

Changed

• App Store screenshot - Changed primary screenshot to welcome-step.png to better showcase the wizard experience
• Reordered screenshots: welcome-step.png (primary), admin-interface.png, personal-settings.png

Changed

• App Store metadata sync - Force refresh of App Store metadata to display correct author information