Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.claude/skills/pr-workflow/SKILL.md:
- Around line 5-8: Update the hard-coded guidance that says "Appwrite does NOT
use `main` as the primary development branch" so it doesn't force contributors
to never target main; instead, change the wording in SKILL.md to a generic,
accurate instruction that tells contributors to check the repository's current
target branch (e.g., consult CONTRIBUTING or the repo's branch naming/versioning
policy) and to open PRs against the appropriate version or default branch
(examples: `1.8.x`, `1.9.x`, or the repo default). Locate and edit the exact
text block that contains the sentence "Appwrite does NOT use `main` as the
primary development branch" and the surrounding lines referred to in the comment
(the sections around lines 5–8, 17–25, and 29–31) to make the guidance
conditional and repository-agnostic. Ensure the new text removes the absolute
"never target main" phrasing and replaces it with concise, actionable guidance
to verify the correct base branch before creating a PR.

In @.env:
- Around line 42-45: The .env now sets COMPOSE_PROFILES=mongodb and
_APP_DB_ADAPTER=mongodb pointing to _APP_DB_HOST=mongodb:_APP_DB_PORT=27017 but
docker-compose.yml still only defines the mariadb service, so running
docker-compose will fail; either revert the .env to the mariadb defaults (set
COMPOSE_PROFILES to empty or remove, and set _APP_DB_ADAPTER to mariadb with
_APP_DB_HOST=mariadb and _APP_DB_PORT=3306) or complete the migration by
updating docker-compose.yml to replace the mariadb service with a mongodb
service and ensure all service dependencies and env references now point to the
mongodb service name; make sure to remove or update the "Change default to
'mongodb' after next release" TODO consistently across config and code.

In @.github/workflows/specs.yml:
- Around line 81-83: The copy can silently skip if the destination directory
doesn't exist; before the cp command inside the if [ "${VERSION}" = "latest" ]
block, ensure the target directory "specs/latest" exists (mkdir -p
"specs/latest") and remove the trailing "|| true" so failures surface; update
the block around VERSION and SPECS_DIR to create the directory first, then run
cp ${GITHUB_WORKSPACE}/${SPECS_DIR}/*latest*.json "specs/latest/".
- Around line 55-69: The workflow uses the repository-scoped GH_TOKEN env (env:
GH_TOKEN) for cross-repo operations (see git clone
"https://x-access-token:${GH_TOKEN}@github.com/appwrite/specs.git" with TARGET).
Replace GH_TOKEN with a repository-scoped secret that has access to
appwrite/specs (e.g., SPECS_REPO_TOKEN stored in repository secrets or
organization secrets), update the env entries and all other occurrences (the
other block at lines ~98–109) to use SPECS_REPO_TOKEN, and ensure the token has
repo write permissions and the workflow includes appropriate permissions
(contents: write) so clone/push/PR actions to appwrite/specs succeed.

In @.github/workflows/tests.yml:
- Around line 295-297: The workflow is using GitHub Actions expression
interpolation in the php-retry action command for container env vars
(_APP_DB_ADAPTER, _APP_DB_HOST, _APP_DB_PORT); instead replace the `${{ env.*
}}` interpolation with runtime shell variable pass-through by either using
Docker's name-only `-e _APP_DB_ADAPTER -e _APP_DB_HOST -e _APP_DB_PORT` or
referencing the shell variables directly (`-e
_APP_DB_ADAPTER="${_APP_DB_ADAPTER}"` etc.) in the php-retry command so the
matrix-set values from GITHUB_ENV propagate reliably at execution time.

In `@AGENTS.md`:
- Around line 65-73: Remove the stray orphaned path
`docs/specs/authentication.drawio.svg` from the "Pull Request Guidelines" ->
"Before Submitting" checklist (it currently appears as an isolated line after
the checklist items); edit the AGENTS.md content near the "Before Submitting"
heading to delete that lone path so the checklist reads cleanly and
consistently.

In `@app/config/collections/platform.php`:
- Around line 1941-1964: The code appends attributes to
$platformCollections['teams'] and $platformCollections['users'] without checking
those keys exist, which can silently fail if merge order changes; update the
block that adds the 'keys' attribute (the entries with ID::custom('keys') and
filters 'subQueryOrganizationKeys' and 'subQueryAccountKeys') to first assert or
initialize the target collections—e.g., check
isset($platformCollections['teams']) and isset($platformCollections['users'])
and throw or create the collection array before pushing attributes—so the
mutation is explicit and fails fast if the collections are missing.

In `@app/config/collections/projects.php`:
- Around line 571-579: The schema currently allows negative deploymentRetention
because 'signed' => true for the field with '$id' =>
ID::custom('deploymentRetention'); update both occurrences of that field to set
'signed' => false and add a schema-level minimum constraint (e.g., 'minimum' =>
0) or equivalent validation rule so the integer cannot be negative; change the
entries for the deploymentRetention field (the array containing '$id' =>
ID::custom('deploymentRetention'), 'type' => Database::VAR_INTEGER) accordingly.

In `@app/config/sdks.php`:
- Around line 273-310: Add the missing 'package' key to the two SDK array
entries identified by 'key' => 'agent-skills' and 'key' => 'cursor-plugin';
follow the same naming convention used by other SDK entries (e.g., the package
string used elsewhere for console SDKs) and place it alongside 'name',
'version', 'url', etc., so each entry includes a 'package' field consistent with
the rest of the sdks structure.

In `@app/controllers/api/projects.php`:
- Around line 1104-1109: The handler type for the 'scopes' parameter must be
made nullable to match the route validator: change the action signatures that
currently use array $scopes to ?array $scopes (the handlers defined as function
(..., array $scopes, ?string $expire, ...) in the key endpoints), and in both
endpoints referenced update any downstream use of $scopes to safely handle null
(e.g. treat null as an empty array or check for null before iterating) so
runtime TypeError is avoided; apply this change to both key-related action
handlers mentioned in the review.

In `@app/controllers/general.php`:
- Around line 1137-1142: The ownership check using str_ends_with($domain->get(),
$appwriteDomain) can false-positive match subdomains (e.g.,
notfunctions.example.com vs functions.example.com); update the foreach block
that iterates $appwriteDomains to only mark owner as 'Appwrite' when the domain
exactly equals $appwriteDomain or when it ends with a dot plus the appwrite
domain (use $domain->get() === $appwriteDomain || str_ends_with($domain->get(),
'.' . $appwriteDomain)); adjust the condition in the loop that references
$appwriteDomains, $domain->get(), and $appwriteDomain accordingly.
- Around line 105-116: The subdomain check using str_ends_with($host,
$denyDomain) can falsely match unrelated domains (e.g., "notexample.com");
update the second condition inside the foreach over $denyDomains to check for a
dot-prefixed suffix boundary, e.g. use str_ends_with($host, '.' . $denyDomain)
(or normalize $denyDomain to avoid double dots) so only true subdomains match;
keep the existing exact-match branch (if ($host === $denyDomain)) as-is and
throw the same AppwriteException when the dot-prefixed check passes.

In `@app/controllers/mock.php`:
- Line 193: Update the call in mock controller so
Config::getParam('projectScopes') provides a defensive default; replace the
current call used to set $scopes with a call that passes an empty array as the
second argument (i.e., use Config::getParam('projectScopes', [])) so array_keys
always receives an array and $scopes is safe; locate the usage in the mock
controller where $scopes is assigned and update it accordingly.

In `@CHANGES.md`:
- Around line 7-98: The 1.8.1 release notes in CHANGES.md are missing the
backup-policy migration change; update the 1.8.1 section to mention the
migration behavior change that adds policies.read / policies.write scope support
and the new backup-policy report resource so users know to expect the migration;
insert a succinct bullet under the 1.8.1 Fixes/Miscellaneous area referencing
"backup-policy migration: add policies.read/policies.write scopes and
backup-policy report resource" and ensure the phrasing matches surrounding
bullets for consistency.

In `@CONTRIBUTING.md`:
- Line 254: Replace the incorrect ASCII pipe character with the box-drawing
vertical bar in the file tree block: locate the line containing "├── DSN"
(currently preceded by "|") in CONTRIBUTING.md and change the leading "|" to "│"
so the tree uses consistent box-drawing characters and renders correctly.

In `@Dockerfile`:
- Around line 40-42: Remove the development-only artifacts from the base image:
delete the three COPY directives that add ./dev, mongo-init.js, and
mongo-entrypoint.sh from the base stage so they are not inherited by production;
then add those three COPY directives into the development stage (and remove any
duplicate COPY ./dev there) so the files are present only for the development
image. Locate the COPY lines referencing "./dev", "mongo-init.js", and
"mongo-entrypoint.sh" in the Dockerfile and move them from the base stage to the
development stage (ensuring no duplicate COPY ./dev remains).

---

Outside diff comments:
In `@app/cli.php`:
- Around line 206-233: The closure assigned to $setResource('getLogsDB')
captures $database by value so reassignments inside the closure don't persist;
change the capture to a reference (use (&$database, ...) instead of use (...,
$database, ...)) so the newly constructed Database instance stored at line where
$database is assigned persists across invocations and the early-return block
(checking $database !== null) works as intended; mirror the pattern used by
getProjectDB to ensure connection reuse.

In `@app/config/locale/templates/email-base.tpl`:
- Around line 13-35: The dark-mode media query selectors target unscoped
elements (e.g., a.button, a, .button) while the light-mode rules are scoped
under the .main container (e.g., .main a.button), causing specificity conflicts;
update the dark-mode selectors inside the `@media` (prefers-color-scheme: dark)
block to mirror the .main scoping (e.g., .main a.button, .main a, .main
h1/h2/h3, .main p.security-phrase, .main hr) so they have matching specificity
to the light-mode rules and retain the intended overrides across email clients.

In `@app/config/templates/function.php`:
- Around line 1530-1539: The template ID "generate-with-replicate" is duplicated
(seen in the block with 'id' => 'generate-with-replicate' and again later),
which can cause selection/collision issues; update one of the template entries
to a unique identifier (e.g., 'generate-with-replicate-v2' or similar) and
propagate that change wherever that template ID is referenced (SDK/UI mapping,
lookups, or filters). Locate the entries by the 'id' =>
'generate-with-replicate' symbol and the surrounding metadata (e.g., 'name' =>
'Generate with Replicate', 'useCases' => [FunctionUseCases::AI]) to ensure you
change the correct block and update any dependent code or documentation that
references the old ID.

In `@app/config/templates/site.php`:
- Around line 253-259: Replace the duplicated 'outputDirectory' => '404.html'
entry inside the getFramework('VITE', ...) override with 'fallbackFile' =>
'404.html' so the Vitepress template uses a fallback file instead of silently
overwriting outputDirectory; apply the same change to the corresponding
getFramework override entries for Vuepress and Docusaurus where the duplicate
'outputDirectory' is present (replace that duplicate key with 'fallbackFile' =>
'404.html').

In `@app/controllers/api/account.php`:
- Around line 706-709: The code sets $queueForEvents->setParam('sessionId',
$session->getId()) using $session outside the loop which can be undefined or the
wrong session; change it to use the actual session id that corresponds to the
payload/delete operation (e.g. use the $sessionId variable coming from the
request/payload or set the param inside the loop using the loop-scoped
$session->getId()), and if there may be no session ensure you pass null or skip
setting 'sessionId' to avoid referencing an undefined $session; update the call
sites around $queueForEvents, setParam, and any loop that deletes sessions
accordingly.

In `@app/controllers/api/messaging.php`:
- Around line 2504-2510: The code treats $cursorDocument (returned by
$dbForProject->getDocument('topics', $topicId)) like a collection and uses
$cursorDocument[0], which is wrong; update the cursor assignment to use the
Document directly by passing $cursorDocument into $cursor->setValue (keep the
existing existence check using $cursorDocument->isEmpty()), i.e., replace the
indexed access with $cursor->setValue($cursorDocument) so topic pagination uses
the actual Document returned by getDocument.

In `@app/controllers/api/migrations.php`:
- Around line 453-457: The CSV import queue trigger currently calls
->setProject($project) twice and omits ->setPlatform($platform) and
->setUser($user); update the endpoint to include ->inject('user') so a $user is
available, replace the duplicate ->setProject call with
->setPlatform($platform), and add ->setUser($user) before ->trigger() (refer to
the methods setProject, setPlatform, setUser and the trigger call to locate the
code and to the endpoint declaration to add inject('user')).

In `@app/controllers/api/vcs.php`:
- Around line 637-645: The PATCH endpoint's DI chain is missing
->inject('request') while the action closure declares Request $request and
passes it to $createGitDeployments; add ->inject('request') into the inject
chain (e.g., alongside ->inject('gitHub')->inject('response')... before
->action) so the framework can resolve the Request parameter used in the action
and when calling $createGitDeployments.

In `@app/controllers/general.php`:
- Line 1662: The path traversal check uses incorrect operator precedence:
`!\substr($absolute, 0, \strlen($base)) === $base` is always false. Replace this
with a proper string-prefix comparison such as `\substr($absolute, 0,
\strlen($base)) !== $base` or `\strncmp($absolute, $base, \strlen($base)) !== 0`
(or `strpos($absolute, $base) !== 0`) so the condition correctly detects when
$absolute does not start with $base; update the if that references \substr,
$absolute and $base accordingly.

---

Nitpick comments:
In `@app/cli.php`:
- Around line 144-204: The duplicated shared-tables configuration in the
getProjectDB resource (the explode/check/in_array +
setSharedTables/setTenant/setNamespace logic present in both the reuse branch
and the new-connection branch) should be extracted into a small helper closure
(e.g., $configureSharedTables) that accepts (Database $database, DSN $dsn,
Document $project) and performs the
explode(System::getEnv('_APP_DATABASE_SHARED_TABLES','')), in_array check and
the two set* branches; then replace the duplicated blocks by calling
$configureSharedTables($database, $dsn, $project) in both the reuse path (where
$database is taken from $databases[$dsn->getHost()]) and the new-connection path
(after creating $database and storing it in $databases).

In `@app/config/cors.php`:
- Around line 10-48: In the 'allowedHeaders' array in app/config/cors.php,
remove the response-only header 'Set-Cookie' and add the 'Authorization' header
so browser preflight requests allow bearer tokens; update the 'allowedHeaders'
entry (the array assigned to the 'allowedHeaders' key) to drop 'Set-Cookie' and
include 'Authorization' alongside the other headers referenced for SDK and
server-to-server requests (this affects endpoints that use bearer auth, e.g.,
the executor service).

In `@app/config/platform.php`:
- Around line 7-14: The code stores comma-separated env tokens into $sitesDomain
and $functionsDomain without trimming, which can leave leading/trailing
whitespace and break host/schema comparisons; update the assignments to trim the
environment value and the selected token: use $sitesDomain =
trim(System::getEnv('_APP_DOMAIN_SITES', '')); and when splitting use
$sitesDomain = trim(explode(',', $sitesDomain)[0]); do the same for
$functionsDomain, and apply the same trim pattern to the other similar
assignment referenced (the token on line 27) so all stored domain/schema
variables are whitespace-trimmed.

In `@app/config/templates/site.php`:
- Around line 28-31: The PHPDoc above the public static function getAll(): array
incorrectly uses the `@var` tag; change it to `@return` to correctly document the
method's return type. Locate the docblock for the getAll method and replace the
`@var` string annotation with `@return` array<string> (matching the declared return
type) so the docblock accurately reflects the method signature.

In `@app/config/variables.php`:
- Around line 473-479: The _APP_REDIS_PASS variable metadata currently has an
empty 'filter' and should be treated as a secret like other password fields:
update the metadata for the '_APP_REDIS_PASS' entry (the associative array with
keys 'name' => '_APP_REDIS_PASS', 'description', 'default', etc.) to set
'filter' => 'password' so tooling will treat it as secret; keep 'required' =>
false and other fields unchanged to preserve behavior.

In `@app/controllers/general.php`:
- Line 65: The router() function has an unused $utopia parameter; remove $utopia
from the function signature in the router declaration and then update all call
sites that pass a $utopia argument to stop passing it (or adjust argument order
accordingly). Search for references to the router function and update
invocations, unit tests, and any dependency injection/container bindings that
list the $utopia parameter so the parameter list and calls remain consistent;
ensure no other code inside router still expects $utopia before committing.
- Around line 1559-1592: Extract the repeated injection list and router
invocation into a shared helper to avoid duplicated .inject(...) chains and long
action signatures: create a function (e.g., registerRouterWrappedRoute or
routerInjectedAction) that accepts the Http route builder (or route path) and
sets the common injections (the ~18 symbols used now) once, then installs an
action which calls router(...) with the shared argument list; update handlers
like Http::get('/robots.txt'), the init and options and humans.txt routes to
call this helper instead of repeating the .inject(...) calls and the full action
signature so future router signature changes are made in one place.
- Line 1507: The code uses two different checks for development mode (static
Http::isDevelopment() at the $output assignment and instance
$utopia->isDevelopment() later); make them consistent by picking one approach
and updating the other call to match (e.g., replace Http::isDevelopment() with
$utopia->isDevelopment(), or vice versa) so both checks use the same symbol
(Http::isDevelopment() or $utopia->isDevelopment()) throughout the method.
- Around line 959-967: The migration host from
System::getEnv('_APP_MIGRATION_HOST') is being treated as a local host (added to
$localHosts) which disables HTTPS enforcement via the $isLocalHost check;
restrict adding the migration host by validating it against a trusted allowlist
or explicit opt-in before pushing it into $localHosts — for example, only append
$migrationHost (and $migrationHost.':'.$request->getPort()) if it matches a
configured TRUSTED_MIGRATION_HOSTS list or if an explicit flag like
_APP_MIGRATION_HOST_TRUSTED is set to true; update the logic around
System::getEnv('_APP_MIGRATION_HOST'), $localHosts and $isLocalHost accordingly
and document the new requirement so only internal/trusted values can bypass
HTTPS.

In `@app/controllers/shared/api.php`:
- Around line 298-320: The suffix extraction for project-scoped roles is
fragile: instead of using substr($adminRole, strrpos($adminRole, '-') + 1)
inside the match branch that handles project-scoped roles, strip the known
prefix ("project-" plus the project id and the following hyphen) to obtain the
full role name (e.g., remove "project-{$projectId}-" from $adminRole) so
hyphenated role names (like "team-lead") are preserved; update the code in the
block that computes $role (the match on str_starts_with($adminRole,
'project-')), ensure $roles[$role]['scopes'] and $authorization->addRole($role)
continue to work with the new extraction, and fall back to the existing branch
for team-wide roles.