{"owner":"nextcloud","repo":"server","hasSkills":true,"totalSkillsCount":2,"totalTokensCount":2170,"categories":["root-instruction","project-spec"],"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md","DESIGN.md"],"skills":{"AGENTS.md":"\n\n# Agent Guidelines for Nextcloud Server\n\nThis file provides instructions for AI coding agents (Claude Code, GitHub Copilot, Cursor, Windsurf, and others) operating on this repository. Read it before generating any code, commits, or pull requests.\n\n---\n\n## Nextcloud Contribution Policy\n\nAll contributions generated or assisted by this agent must fully comply with:\n\n- **[AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)** - the primary reference for AI-specific rules, covering disclosure, author accountability, communication, security, licensing, code quality, and autonomous agent behavior.\n- **[Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)** - covering testing requirements, the Developer Certificate of Origin (DCO), license headers, conventional commits, and translations. These apply in full to all contributions regardless of how they were produced.\n\n### What this agent must always do\n\n- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` git trailer to every commit containing AI-assisted content.\n- Ensure every pull request includes a disclosure of AI tool use in the PR description.\n- Produce focused, scoped pull requests that address exactly one concern. Do not touch unrelated files or introduce incidental refactors.\n- Verify all dependencies against actual package registries before suggesting them. Do not use hallucinated or unverified package names.\n- Write code comments that document the code, never the process that produced it:\n - Comments describe what the code does - method signatures, behavior, and constraints the code itself cannot express (e.g. a non-obvious invariant or workaround).\n - Never add comments that document progress, decisions, or changes (e.g. \"changed X to Y\", \"as requested\", \"this fixes ...\", \"previously this did ...\"). That belongs in the commit message or PR discussion; in the code it goes stale and becomes misleading.\n - Do not narrate self-explanatory code. If the code is readable without a comment, omit the comment.\n - Keep comments brief - short and simple, matching the comment density of the surrounding code.\n- Reuse existing helper functions and utilities instead of re-implementing their logic inline. When fixing a flawed pattern, fix every occurrence of it across the changed code, not only the instance that was pointed out.\n- Run permission and access-control checks before the operation they guard, never after it and never only in the UI layer.\n- When adding or changing user-facing functionality, wire it up in every context where the affected component is used - the default authenticated view, public share pages, and embedded contexts such as the Smart Picker and reference widgets. When emitting new events, verify that every consumer of the component subscribes to and handles them.\n- Explicitly inform the contributor when any action they are about to take, or have taken, would violate the AI Contribution Policy or the Contribution Guidelines. Do not silently proceed. State which rule is at risk and what the contributor should do instead.\n- Warn the contributor if a pull request is growing too large. A PR approaching several thousand lines of changed code is a signal that it should be split into smaller, focused PRs. Suggest a logical split before the PR is opened, not after.\n- Recommend opening a ticket for discussion before starting implementation whenever a feature or change is sufficiently complex - for example when it touches multiple subsystems, requires architectural decisions, or the right approach is not yet clear. A ticket allows maintainers and the contributor to align on direction before code is written, avoiding wasted effort on a PR that may be rejected or require fundamental rework.\n- When adding a new PHP file, run build/autoloaderchecker.sh\n\n### What this agent must never do\n\n- Open issues, submit pull requests, post review comments, or send security reports autonomously. Every contribution must be reviewed and submitted by a human.\n- Add `Signed-off-by` tags to commits. Only the human contributor can certify the Developer Certificate of Origin.\n- Generate or submit security reports without independent human verification. Report verified vulnerabilities via [HackerOne](https://hackerone.com/nextcloud), not as GitHub issues.\n- Write PR descriptions, review comments, or issue reports on behalf of the contributor. These must be in the contributor's own words.\n- Fully automate the resolution of issues labeled [`good first issue`](https://github.com/issues?q=org%3Anextcloud+label%3A%22good+first+issue%22) or similar beginner-friendly labels.\n- Submit code that has not been reviewed and cleaned up by the contributor. Dead code, redundant logic, excessive comments, malformed or garbled characters (e.g. `�` replacement characters), and unrelated changes must be removed before submission.\n\n---\n\n## Repository-Specific Requirements\n\n### Commit format\n\nUse [Conventional Commits](https://www.conventionalcommits.org) for all commit messages:\n\n```\n(): \n\n[optional body]\n\nAssisted-by: AGENT_NAME:MODEL_VERSION\n```\n\nCommon types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `perf`, `build`, `ci`. \nThe scope should match the affected component or app (e.g. `files_sharing`, `core`, `encryption`).\n\nIn the `Assisted-by` trailer, `AGENT_NAME` is the tool or harness that produced the change (e.g. `ClaudeCode`, `Copilot`, `Cursor`, `omp`), not the model vendor. `MODEL_VERSION` is the exact model identifier. Do not copy the example values.\n\nExample:\n```\nfeat(files_sharing): allow sharing with contacts\n\nAssisted-by: ClaudeCode:claude-sonnet-4-6\n```\n\n### Tests\n\n- Every changed or added code segment must be covered by unit tests. Pull requests without tests for new or modified logic will not be accepted.\n- In areas where unit testing is currently difficult, refactoring to enable testability is encouraged alongside the bug fix.\n- New features must be manually tested on a live Nextcloud instance by the human contributor before submission. Providing test steps for an agent to execute is not a substitute.\n- You can run tests with `NOCOVERAGE=0 ./autotest.sh ` with db being either sqlite or pgsql\n\n### Developer Certificate of Origin (DCO)\n\nThe project uses the DCO as an additional safeguard. Only the human contributor may add the `Signed-off-by` trailer - agents must not add it:\n\n```\nSigned-off-by: Random J Developer \n```\n\nContributors can sign automatically with `git commit -s` after configuring `user.name` and `user.email`.\n\n### License headers\n\nEvery new file must include the correct SPDX license header. For AGPL-3.0-or-later (the default for this repository):\n\n```php\n/**\n * SPDX-FileCopyrightText: \n * SPDX-License-Identifier: AGPL-3.0-or-later\n */\n```\n\nSee [HowToApplyALicense.md](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md) for details on per-language formats. AI-generated code must not include material from sources incompatible with AGPL-3.0-or-later.\n\n### Security\n\n- Do not open GitHub issues for potential vulnerabilities. Report them via [HackerOne](https://hackerone.com/nextcloud) following the [security policy](https://nextcloud.com/security/).\n- AI-generated security reports must be independently verified by the human contributor before submission.\n- Manually verify all access control logic, authentication patterns, and dependency names - AI tools are known to hallucinate package names and reproduce vulnerable patterns.\n\n### Scope of this repository\n\nThis repository covers the Nextcloud server core and the bundled apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth. Issues and changes for other components belong in their respective repositories under the [Nextcloud GitHub organization](https://github.com/nextcloud/).\n\n---\n\n## Further Reading\n\n- [Local CONTRIBUTING.md](.github/CONTRIBUTING.md)\n- [Nextcloud Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)\n- [AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)\n- [Developer Certificate of Origin](https://github.com/nextcloud/server/blob/master/contribute/developer-certificate-of-origin)\n- [How to Apply a License](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md)\n- [Developer Manual](https://docs.nextcloud.com/server/latest/developer_manual/)\n- [Security Vulnerability Reporting (HackerOne)](https://hackerone.com/nextcloud)\n","DESIGN.md":"\n# Nextcloud Design contribution guidelines\n\n## 👋 Welcome\n\nAt Nextcloud we want to make sure to have everything in place to enable designers to contribute – making our apps universally accessible and easy to use.\n\n## 🚢 How to contribute design\n\nWe have a dedicated page with more in-detail guidelines on our website: \nhttps://nextcloud.com/design/\n\n**TL;DR**\n\n1. Check out open [issues](https://github.com/nextcloud/server/issues) here on GitHub (we label them with `design`)\n2. Make sure create publicly accessible assets \n3. Add your contributions to an issue and we promise we will review your contribution carefully and foster discussions\n\n[This issue](https://github.com/nextcloud/desktop/issues/877) has examples of other apps, some simple mockups, and specifications about the design. In the discussions in the comments there are updates to the design as well.\n\n[This pull request](https://github.com/nextcloud/desktop/pull/1565) by a developer has the implementation of that issue, the changes they made, and more design discussions and adjustments.\n\n**We encourage you to:**\n\n- Get in touch with the team by joining our [public Talk channel](https://cloud.nextcloud.com/call/gqff69i8)\n"},"files":{"AGENTS.md":"\n\n# Agent Guidelines for Nextcloud Server\n\nThis file provides instructions for AI coding agents (Claude Code, GitHub Copilot, Cursor, Windsurf, and others) operating on this repository. Read it before generating any code, commits, or pull requests.\n\n---\n\n## Nextcloud Contribution Policy\n\nAll contributions generated or assisted by this agent must fully comply with:\n\n- **[AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)** - the primary reference for AI-specific rules, covering disclosure, author accountability, communication, security, licensing, code quality, and autonomous agent behavior.\n- **[Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)** - covering testing requirements, the Developer Certificate of Origin (DCO), license headers, conventional commits, and translations. These apply in full to all contributions regardless of how they were produced.\n\n### What this agent must always do\n\n- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` git trailer to every commit containing AI-assisted content.\n- Ensure every pull request includes a disclosure of AI tool use in the PR description.\n- Produce focused, scoped pull requests that address exactly one concern. Do not touch unrelated files or introduce incidental refactors.\n- Verify all dependencies against actual package registries before suggesting them. Do not use hallucinated or unverified package names.\n- Write code comments that document the code, never the process that produced it:\n - Comments describe what the code does - method signatures, behavior, and constraints the code itself cannot express (e.g. a non-obvious invariant or workaround).\n - Never add comments that document progress, decisions, or changes (e.g. \"changed X to Y\", \"as requested\", \"this fixes ...\", \"previously this did ...\"). That belongs in the commit message or PR discussion; in the code it goes stale and becomes misleading.\n - Do not narrate self-explanatory code. If the code is readable without a comment, omit the comment.\n - Keep comments brief - short and simple, matching the comment density of the surrounding code.\n- Reuse existing helper functions and utilities instead of re-implementing their logic inline. When fixing a flawed pattern, fix every occurrence of it across the changed code, not only the instance that was pointed out.\n- Run permission and access-control checks before the operation they guard, never after it and never only in the UI layer.\n- When adding or changing user-facing functionality, wire it up in every context where the affected component is used - the default authenticated view, public share pages, and embedded contexts such as the Smart Picker and reference widgets. When emitting new events, verify that every consumer of the component subscribes to and handles them.\n- Explicitly inform the contributor when any action they are about to take, or have taken, would violate the AI Contribution Policy or the Contribution Guidelines. Do not silently proceed. State which rule is at risk and what the contributor should do instead.\n- Warn the contributor if a pull request is growing too large. A PR approaching several thousand lines of changed code is a signal that it should be split into smaller, focused PRs. Suggest a logical split before the PR is opened, not after.\n- Recommend opening a ticket for discussion before starting implementation whenever a feature or change is sufficiently complex - for example when it touches multiple subsystems, requires architectural decisions, or the right approach is not yet clear. A ticket allows maintainers and the contributor to align on direction before code is written, avoiding wasted effort on a PR that may be rejected or require fundamental rework.\n- When adding a new PHP file, run build/autoloaderchecker.sh\n\n### What this agent must never do\n\n- Open issues, submit pull requests, post review comments, or send security reports autonomously. Every contribution must be reviewed and submitted by a human.\n- Add `Signed-off-by` tags to commits. Only the human contributor can certify the Developer Certificate of Origin.\n- Generate or submit security reports without independent human verification. Report verified vulnerabilities via [HackerOne](https://hackerone.com/nextcloud), not as GitHub issues.\n- Write PR descriptions, review comments, or issue reports on behalf of the contributor. These must be in the contributor's own words.\n- Fully automate the resolution of issues labeled [`good first issue`](https://github.com/issues?q=org%3Anextcloud+label%3A%22good+first+issue%22) or similar beginner-friendly labels.\n- Submit code that has not been reviewed and cleaned up by the contributor. Dead code, redundant logic, excessive comments, malformed or garbled characters (e.g. `�` replacement characters), and unrelated changes must be removed before submission.\n\n---\n\n## Repository-Specific Requirements\n\n### Commit format\n\nUse [Conventional Commits](https://www.conventionalcommits.org) for all commit messages:\n\n```\n(): \n\n[optional body]\n\nAssisted-by: AGENT_NAME:MODEL_VERSION\n```\n\nCommon types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `perf`, `build`, `ci`. \nThe scope should match the affected component or app (e.g. `files_sharing`, `core`, `encryption`).\n\nIn the `Assisted-by` trailer, `AGENT_NAME` is the tool or harness that produced the change (e.g. `ClaudeCode`, `Copilot`, `Cursor`, `omp`), not the model vendor. `MODEL_VERSION` is the exact model identifier. Do not copy the example values.\n\nExample:\n```\nfeat(files_sharing): allow sharing with contacts\n\nAssisted-by: ClaudeCode:claude-sonnet-4-6\n```\n\n### Tests\n\n- Every changed or added code segment must be covered by unit tests. Pull requests without tests for new or modified logic will not be accepted.\n- In areas where unit testing is currently difficult, refactoring to enable testability is encouraged alongside the bug fix.\n- New features must be manually tested on a live Nextcloud instance by the human contributor before submission. Providing test steps for an agent to execute is not a substitute.\n- You can run tests with `NOCOVERAGE=0 ./autotest.sh ` with db being either sqlite or pgsql\n\n### Developer Certificate of Origin (DCO)\n\nThe project uses the DCO as an additional safeguard. Only the human contributor may add the `Signed-off-by` trailer - agents must not add it:\n\n```\nSigned-off-by: Random J Developer \n```\n\nContributors can sign automatically with `git commit -s` after configuring `user.name` and `user.email`.\n\n### License headers\n\nEvery new file must include the correct SPDX license header. For AGPL-3.0-or-later (the default for this repository):\n\n```php\n/**\n * SPDX-FileCopyrightText: \n * SPDX-License-Identifier: AGPL-3.0-or-later\n */\n```\n\nSee [HowToApplyALicense.md](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md) for details on per-language formats. AI-generated code must not include material from sources incompatible with AGPL-3.0-or-later.\n\n### Security\n\n- Do not open GitHub issues for potential vulnerabilities. Report them via [HackerOne](https://hackerone.com/nextcloud) following the [security policy](https://nextcloud.com/security/).\n- AI-generated security reports must be independently verified by the human contributor before submission.\n- Manually verify all access control logic, authentication patterns, and dependency names - AI tools are known to hallucinate package names and reproduce vulnerable patterns.\n\n### Scope of this repository\n\nThis repository covers the Nextcloud server core and the bundled apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth. Issues and changes for other components belong in their respective repositories under the [Nextcloud GitHub organization](https://github.com/nextcloud/).\n\n---\n\n## Further Reading\n\n- [Local CONTRIBUTING.md](.github/CONTRIBUTING.md)\n- [Nextcloud Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)\n- [AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)\n- [Developer Certificate of Origin](https://github.com/nextcloud/server/blob/master/contribute/developer-certificate-of-origin)\n- [How to Apply a License](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md)\n- [Developer Manual](https://docs.nextcloud.com/server/latest/developer_manual/)\n- [Security Vulnerability Reporting (HackerOne)](https://hackerone.com/nextcloud)\n","DESIGN.md":"\n# Nextcloud Design contribution guidelines\n\n## 👋 Welcome\n\nAt Nextcloud we want to make sure to have everything in place to enable designers to contribute – making our apps universally accessible and easy to use.\n\n## 🚢 How to contribute design\n\nWe have a dedicated page with more in-detail guidelines on our website: \nhttps://nextcloud.com/design/\n\n**TL;DR**\n\n1. Check out open [issues](https://github.com/nextcloud/server/issues) here on GitHub (we label them with `design`)\n2. Make sure create publicly accessible assets \n3. Add your contributions to an issue and we promise we will review your contribution carefully and foster discussions\n\n[This issue](https://github.com/nextcloud/desktop/issues/877) has examples of other apps, some simple mockups, and specifications about the design. In the discussions in the comments there are updates to the design as well.\n\n[This pull request](https://github.com/nextcloud/desktop/pull/1565) by a developer has the implementation of that issue, the changes they made, and more design discussions and adjustments.\n\n**We encourage you to:**\n\n- Get in touch with the team by joining our [public Talk channel](https://cloud.nextcloud.com/call/gqff69i8)\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","rawUrl":"https://raw.githubusercontent.com/nextcloud/server/HEAD/AGENTS.md","title":"AI Agent Protocol & Instructions","category":"root-instruction","format":"markdown","content":"\n\n# Agent Guidelines for Nextcloud Server\n\nThis file provides instructions for AI coding agents (Claude Code, GitHub Copilot, Cursor, Windsurf, and others) operating on this repository. Read it before generating any code, commits, or pull requests.\n\n---\n\n## Nextcloud Contribution Policy\n\nAll contributions generated or assisted by this agent must fully comply with:\n\n- **[AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)** - the primary reference for AI-specific rules, covering disclosure, author accountability, communication, security, licensing, code quality, and autonomous agent behavior.\n- **[Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)** - covering testing requirements, the Developer Certificate of Origin (DCO), license headers, conventional commits, and translations. These apply in full to all contributions regardless of how they were produced.\n\n### What this agent must always do\n\n- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` git trailer to every commit containing AI-assisted content.\n- Ensure every pull request includes a disclosure of AI tool use in the PR description.\n- Produce focused, scoped pull requests that address exactly one concern. Do not touch unrelated files or introduce incidental refactors.\n- Verify all dependencies against actual package registries before suggesting them. Do not use hallucinated or unverified package names.\n- Write code comments that document the code, never the process that produced it:\n - Comments describe what the code does - method signatures, behavior, and constraints the code itself cannot express (e.g. a non-obvious invariant or workaround).\n - Never add comments that document progress, decisions, or changes (e.g. \"changed X to Y\", \"as requested\", \"this fixes ...\", \"previously this did ...\"). That belongs in the commit message or PR discussion; in the code it goes stale and becomes misleading.\n - Do not narrate self-explanatory code. If the code is readable without a comment, omit the comment.\n - Keep comments brief - short and simple, matching the comment density of the surrounding code.\n- Reuse existing helper functions and utilities instead of re-implementing their logic inline. When fixing a flawed pattern, fix every occurrence of it across the changed code, not only the instance that was pointed out.\n- Run permission and access-control checks before the operation they guard, never after it and never only in the UI layer.\n- When adding or changing user-facing functionality, wire it up in every context where the affected component is used - the default authenticated view, public share pages, and embedded contexts such as the Smart Picker and reference widgets. When emitting new events, verify that every consumer of the component subscribes to and handles them.\n- Explicitly inform the contributor when any action they are about to take, or have taken, would violate the AI Contribution Policy or the Contribution Guidelines. Do not silently proceed. State which rule is at risk and what the contributor should do instead.\n- Warn the contributor if a pull request is growing too large. A PR approaching several thousand lines of changed code is a signal that it should be split into smaller, focused PRs. Suggest a logical split before the PR is opened, not after.\n- Recommend opening a ticket for discussion before starting implementation whenever a feature or change is sufficiently complex - for example when it touches multiple subsystems, requires architectural decisions, or the right approach is not yet clear. A ticket allows maintainers and the contributor to align on direction before code is written, avoiding wasted effort on a PR that may be rejected or require fundamental rework.\n- When adding a new PHP file, run build/autoloaderchecker.sh\n\n### What this agent must never do\n\n- Open issues, submit pull requests, post review comments, or send security reports autonomously. Every contribution must be reviewed and submitted by a human.\n- Add `Signed-off-by` tags to commits. Only the human contributor can certify the Developer Certificate of Origin.\n- Generate or submit security reports without independent human verification. Report verified vulnerabilities via [HackerOne](https://hackerone.com/nextcloud), not as GitHub issues.\n- Write PR descriptions, review comments, or issue reports on behalf of the contributor. These must be in the contributor's own words.\n- Fully automate the resolution of issues labeled [`good first issue`](https://github.com/issues?q=org%3Anextcloud+label%3A%22good+first+issue%22) or similar beginner-friendly labels.\n- Submit code that has not been reviewed and cleaned up by the contributor. Dead code, redundant logic, excessive comments, malformed or garbled characters (e.g. `�` replacement characters), and unrelated changes must be removed before submission.\n\n---\n\n## Repository-Specific Requirements\n\n### Commit format\n\nUse [Conventional Commits](https://www.conventionalcommits.org) for all commit messages:\n\n```\n(): \n\n[optional body]\n\nAssisted-by: AGENT_NAME:MODEL_VERSION\n```\n\nCommon types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `perf`, `build`, `ci`. \nThe scope should match the affected component or app (e.g. `files_sharing`, `core`, `encryption`).\n\nIn the `Assisted-by` trailer, `AGENT_NAME` is the tool or harness that produced the change (e.g. `ClaudeCode`, `Copilot`, `Cursor`, `omp`), not the model vendor. `MODEL_VERSION` is the exact model identifier. Do not copy the example values.\n\nExample:\n```\nfeat(files_sharing): allow sharing with contacts\n\nAssisted-by: ClaudeCode:claude-sonnet-4-6\n```\n\n### Tests\n\n- Every changed or added code segment must be covered by unit tests. Pull requests without tests for new or modified logic will not be accepted.\n- In areas where unit testing is currently difficult, refactoring to enable testability is encouraged alongside the bug fix.\n- New features must be manually tested on a live Nextcloud instance by the human contributor before submission. Providing test steps for an agent to execute is not a substitute.\n- You can run tests with `NOCOVERAGE=0 ./autotest.sh ` with db being either sqlite or pgsql\n\n### Developer Certificate of Origin (DCO)\n\nThe project uses the DCO as an additional safeguard. Only the human contributor may add the `Signed-off-by` trailer - agents must not add it:\n\n```\nSigned-off-by: Random J Developer \n```\n\nContributors can sign automatically with `git commit -s` after configuring `user.name` and `user.email`.\n\n### License headers\n\nEvery new file must include the correct SPDX license header. For AGPL-3.0-or-later (the default for this repository):\n\n```php\n/**\n * SPDX-FileCopyrightText: \n * SPDX-License-Identifier: AGPL-3.0-or-later\n */\n```\n\nSee [HowToApplyALicense.md](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md) for details on per-language formats. AI-generated code must not include material from sources incompatible with AGPL-3.0-or-later.\n\n### Security\n\n- Do not open GitHub issues for potential vulnerabilities. Report them via [HackerOne](https://hackerone.com/nextcloud) following the [security policy](https://nextcloud.com/security/).\n- AI-generated security reports must be independently verified by the human contributor before submission.\n- Manually verify all access control logic, authentication patterns, and dependency names - AI tools are known to hallucinate package names and reproduce vulnerable patterns.\n\n### Scope of this repository\n\nThis repository covers the Nextcloud server core and the bundled apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth. Issues and changes for other components belong in their respective repositories under the [Nextcloud GitHub organization](https://github.com/nextcloud/).\n\n---\n\n## Further Reading\n\n- [Local CONTRIBUTING.md](.github/CONTRIBUTING.md)\n- [Nextcloud Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)\n- [AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)\n- [Developer Certificate of Origin](https://github.com/nextcloud/server/blob/master/contribute/developer-certificate-of-origin)\n- [How to Apply a License](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md)\n- [Developer Manual](https://docs.nextcloud.com/server/latest/developer_manual/)\n- [Security Vulnerability Reporting (HackerOne)](https://hackerone.com/nextcloud)\n","isInternal":false,"tokens":1873,"sizeBytes":8751},{"name":"DESIGN.md","path":"DESIGN.md","rawUrl":"https://raw.githubusercontent.com/nextcloud/server/HEAD/DESIGN.md","title":"UI Design System & Style Tokens","category":"project-spec","format":"markdown","content":"\n# Nextcloud Design contribution guidelines\n\n## 👋 Welcome\n\nAt Nextcloud we want to make sure to have everything in place to enable designers to contribute – making our apps universally accessible and easy to use.\n\n## 🚢 How to contribute design\n\nWe have a dedicated page with more in-detail guidelines on our website: \nhttps://nextcloud.com/design/\n\n**TL;DR**\n\n1. Check out open [issues](https://github.com/nextcloud/server/issues) here on GitHub (we label them with `design`)\n2. Make sure create publicly accessible assets \n3. Add your contributions to an issue and we promise we will review your contribution carefully and foster discussions\n\n[This issue](https://github.com/nextcloud/desktop/issues/877) has examples of other apps, some simple mockups, and specifications about the design. In the discussions in the comments there are updates to the design as well.\n\n[This pull request](https://github.com/nextcloud/desktop/pull/1565) by a developer has the implementation of that issue, the changes they made, and more design discussions and adjustments.\n\n**We encourage you to:**\n\n- Get in touch with the team by joining our [public Talk channel](https://cloud.nextcloud.com/call/gqff69i8)\n","isInternal":false,"tokens":297,"sizeBytes":1330}],"systemPromptSnippet":"\n\n\n\n# Agent Guidelines for Nextcloud Server\n\nThis file provides instructions for AI coding agents (Claude Code, GitHub Copilot, Cursor, Windsurf, and others) operating on this repository. Read it before generating any code, commits, or pull requests.\n\n---\n\n## Nextcloud Contribution Policy\n\nAll contributions generated or assisted by this agent must fully comply with:\n\n- **[AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)** - the primary reference for AI-specific rules, covering disclosure, author accountability, communication, security, licensing, code quality, and autonomous agent behavior.\n- **[Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)** - covering testing requirements, the Developer Certificate of Origin (DCO), license headers, conventional commits, and translations. These apply in full to all contributions regardless of how they were produced.\n\n### What this agent must always do\n\n- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` git trailer to every commit containing AI-assisted content.\n- Ensure every pull request includes a disclosure of AI tool use in the PR description.\n- Produce focused, scoped pull requests that address exactly one concern. Do not touch unrelated files or introduce incidental refactors.\n- Verify all dependencies against actual package registries before suggesting them. Do not use hallucinated or unverified package names.\n- Write code comments that document the code, never the process that produced it:\n - Comments describe what the code does - method signatures, behavior, and constraints the code itself cannot express (e.g. a non-obvious invariant or workaround).\n - Never add comments that document progress, decisions, or changes (e.g. \"changed X to Y\", \"as requested\", \"this fixes ...\", \"previously this did ...\"). That belongs in the commit message or PR discussion; in the code it goes stale and becomes misleading.\n - Do not narrate self-explanatory code. If the code is readable without a comment, omit the comment.\n - Keep comments brief - short and simple, matching the comment density of the surrounding code.\n- Reuse existing helper functions and utilities instead of re-implementing their logic inline. When fixing a flawed pattern, fix every occurrence of it across the changed code, not only the instance that was pointed out.\n- Run permission and access-control checks before the operation they guard, never after it and never only in the UI layer.\n- When adding or changing user-facing functionality, wire it up in every context where the affected component is used - the default authenticated view, public share pages, and embedded contexts such as the Smart Picker and reference widgets. When emitting new events, verify that every consumer of the component subscribes to and handles them.\n- Explicitly inform the contributor when any action they are about to take, or have taken, would violate the AI Contribution Policy or the Contribution Guidelines. Do not silently proceed. State which rule is at risk and what the contributor should do instead.\n- Warn the contributor if a pull request is growing too large. A PR approaching several thousand lines of changed code is a signal that it should be split into smaller, focused PRs. Suggest a logical split before the PR is opened, not after.\n- Recommend opening a ticket for discussion before starting implementation whenever a feature or change is sufficiently complex - for example when it touches multiple subsystems, requires architectural decisions, or the right approach is not yet clear. A ticket allows maintainers and the contributor to align on direction before code is written, avoiding wasted effort on a PR that may be rejected or require fundamental rework.\n- When adding a new PHP file, run build/autoloaderchecker.sh\n\n### What this agent must never do\n\n- Open issues, submit pull requests, post review comments, or send security reports autonomously. Every contribution must be reviewed and submitted by a human.\n- Add `Signed-off-by` tags to commits. Only the human contributor can certify the Developer Certificate of Origin.\n- Generate or submit security reports without independent human verification. Report verified vulnerabilities via [HackerOne](https://hackerone.com/nextcloud), not as GitHub issues.\n- Write PR descriptions, review comments, or issue reports on behalf of the contributor. These must be in the contributor's own words.\n- Fully automate the resolution of issues labeled [`good first issue`](https://github.com/issues?q=org%3Anextcloud+label%3A%22good+first+issue%22) or similar beginner-friendly labels.\n- Submit code that has not been reviewed and cleaned up by the contributor. Dead code, redundant logic, excessive comments, malformed or garbled characters (e.g. `�` replacement characters), and unrelated changes must be removed before submission.\n\n---\n\n## Repository-Specific Requirements\n\n### Commit format\n\nUse [Conventional Commits](https://www.conventionalcommits.org) for all commit messages:\n\n```\n(): \n\n[optional body]\n\nAssisted-by: AGENT_NAME:MODEL_VERSION\n```\n\nCommon types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `perf`, `build`, `ci`. \nThe scope should match the affected component or app (e.g. `files_sharing`, `core`, `encryption`).\n\nIn the `Assisted-by` trailer, `AGENT_NAME` is the tool or harness that produced the change (e.g. `ClaudeCode`, `Copilot`, `Cursor`, `omp`), not the model vendor. `MODEL_VERSION` is the exact model identifier. Do not copy the example values.\n\nExample:\n```\nfeat(files_sharing): allow sharing with contacts\n\nAssisted-by: ClaudeCode:claude-sonnet-4-6\n```\n\n### Tests\n\n- Every changed or added code segment must be covered by unit tests. Pull requests without tests for new or modified logic will not be accepted.\n- In areas where unit testing is currently difficult, refactoring to enable testability is encouraged alongside the bug fix.\n- New features must be manually tested on a live Nextcloud instance by the human contributor before submission. Providing test steps for an agent to execute is not a substitute.\n- You can run tests with `NOCOVERAGE=0 ./autotest.sh ` with db being either sqlite or pgsql\n\n### Developer Certificate of Origin (DCO)\n\nThe project uses the DCO as an additional safeguard. Only the human contributor may add the `Signed-off-by` trailer - agents must not add it:\n\n```\nSigned-off-by: Random J Developer \n```\n\nContributors can sign automatically with `git commit -s` after configuring `user.name` and `user.email`.\n\n### License headers\n\nEvery new file must include the correct SPDX license header. For AGPL-3.0-or-later (the default for this repository):\n\n```php\n/**\n * SPDX-FileCopyrightText: \n * SPDX-License-Identifier: AGPL-3.0-or-later\n */\n```\n\nSee [HowToApplyALicense.md](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md) for details on per-language formats. AI-generated code must not include material from sources incompatible with AGPL-3.0-or-later.\n\n### Security\n\n- Do not open GitHub issues for potential vulnerabilities. Report them via [HackerOne](https://hackerone.com/nextcloud) following the [security policy](https://nextcloud.com/security/).\n- AI-generated security reports must be independently verified by the human contributor before submission.\n- Manually verify all access control logic, authentication patterns, and dependency names - AI tools are known to hallucinate package names and reproduce vulnerable patterns.\n\n### Scope of this repository\n\nThis repository covers the Nextcloud server core and the bundled apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth. Issues and changes for other components belong in their respective repositories under the [Nextcloud GitHub organization](https://github.com/nextcloud/).\n\n---\n\n## Further Reading\n\n- [Local CONTRIBUTING.md](.github/CONTRIBUTING.md)\n- [Nextcloud Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)\n- [AI Contribution Policy](https://github.com/nextcloud/.github/blob/master/AI_POLICY.md)\n- [Developer Certificate of Origin](https://github.com/nextcloud/server/blob/master/contribute/developer-certificate-of-origin)\n- [How to Apply a License](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md)\n- [Developer Manual](https://docs.nextcloud.com/server/latest/developer_manual/)\n- [Security Vulnerability Reporting (HackerOne)](https://hackerone.com/nextcloud)\n\n\n\n# Nextcloud Design contribution guidelines\n\n## 👋 Welcome\n\nAt Nextcloud we want to make sure to have everything in place to enable designers to contribute – making our apps universally accessible and easy to use.\n\n## 🚢 How to contribute design\n\nWe have a dedicated page with more in-detail guidelines on our website: \nhttps://nextcloud.com/design/\n\n**TL;DR**\n\n1. Check out open [issues](https://github.com/nextcloud/server/issues) here on GitHub (we label them with `design`)\n2. Make sure create publicly accessible assets \n3. Add your contributions to an issue and we promise we will review your contribution carefully and foster discussions\n\n[This issue](https://github.com/nextcloud/desktop/issues/877) has examples of other apps, some simple mockups, and specifications about the design. In the discussions in the comments there are updates to the design as well.\n\n[This pull request](https://github.com/nextcloud/desktop/pull/1565) by a developer has the implementation of that issue, the changes they made, and more design discussions and adjustments.\n\n**We encourage you to:**\n\n- Get in touch with the team by joining our [public Talk channel](https://cloud.nextcloud.com/call/gqff69i8)\n"}