Merge remote-tracking branch 'origin/master' into docs/login-flow-v2-and-astrolabe-cloud

# Conflicts:
#	README.md

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,145 @@
+name: Bug report
+description: Report a bug, crash, or unexpected behavior in nextcloud-mcp-server
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report.
+
+        **Before submitting**, please check that:
+        - You're running a recent version (`uvx nextcloud-mcp-server --version` or check the Docker tag).
+        - The issue isn't already reported in [open issues](https://github.com/cbcoutinho/nextcloud-mcp-server/issues).
+        - Security issues should **not** be filed here — use [private vulnerability reporting](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new) or see [SECURITY.md](https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md).
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: One or two sentences describing what went wrong.
+      placeholder: "nc_contacts_create silently drops EMAIL/TEL/ORG fields — only the full name is saved."
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps to trigger the bug. Include the exact MCP tool call(s) and arguments where relevant.
+      placeholder: |
+        1. Call `nc_contacts_create` with `full_name`, `email`, `phone`
+        2. Inspect the contact in the Nextcloud web UI
+        3. Only the name is present
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected vs actual behavior
+      placeholder: |
+        Expected: All provided fields are written to the vCard.
+        Actual: Only FN is saved; EMAIL, TEL, ORG are silently dropped.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs and error output
+      description: |
+        Include the full error message / stack trace from the MCP server.
+        If running with Docker, also include any relevant entries from
+        `docker compose exec app cat /var/www/html/data/nextcloud.log | jq | tail`
+        (Nextcloud side). For other install methods, attach the equivalent
+        Nextcloud log excerpt if available.
+        Redact tokens, passwords, and personal data.
+      render: shell
+    validations:
+      required: false
+
+  - type: input
+    id: mcp_server_version
+    attributes:
+      label: nextcloud-mcp-server version
+      description: e.g. `0.73.0`, Docker tag, or git SHA.
+      placeholder: "0.73.0"
+    validations:
+      required: true
+
+  - type: input
+    id: nextcloud_version
+    attributes:
+      label: Nextcloud server version
+      placeholder: "Nextcloud 30.0.2"
+    validations:
+      required: true
+
+  - type: input
+    id: nextcloud_app_versions
+    attributes:
+      label: Affected Nextcloud app version(s)
+      description: |
+        For bugs in a specific app integration, list the installed app version(s) — e.g. Notes 5.0.0, Deck 1.13.0,
+        Cookbook 0.11.2. Run `docker compose exec app php occ app:list` or check Apps in the Nextcloud UI.
+      placeholder: "Notes 5.0.0"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: deployment_mode
+    attributes:
+      label: Deployment mode
+      options:
+        - Single-user (BasicAuth)
+        - Multi-user BasicAuth (pass-through)
+        - Login Flow v2
+        - OAuth / OIDC (Nextcloud user_oidc)
+        - OAuth / OIDC (external IdP, e.g. Keycloak)
+        - Other / not sure
+    validations:
+      required: true
+
+  - type: dropdown
+    id: transport
+    attributes:
+      label: MCP transport
+      options:
+        - stdio
+        - streamable-http
+        - sse (legacy)
+        - Other / not sure
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install_method
+    attributes:
+      label: How are you running the server?
+      options:
+        - uvx
+        - Docker / docker compose
+        - Helm chart on Kubernetes
+        - Local checkout (`uv run`)
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: mcp_client
+    attributes:
+      label: MCP client
+      description: e.g. Claude Desktop, Claude Code, an IDE extension, custom client + LLM.
+      placeholder: "Claude Code"
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Anything else that might help — workarounds you found, related issues, suspected root cause, etc.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability (private report)
+    url: https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new
+    about: Do not file security issues publicly. Use GitHub's private vulnerability reporting, or see SECURITY.md for the email fallback.
+  - name: Question or discussion
+    url: https://github.com/cbcoutinho/nextcloud-mcp-server/discussions
+    about: For general questions, deployment help, or open-ended discussion, please use Discussions instead of opening an issue.

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,29 @@
+name: Documentation issue
+description: Report unclear, missing, or incorrect documentation
+title: "[Docs]: "
+labels: ["documentation"]
+body:
+  - type: input
+    id: location
+    attributes:
+      label: Where is the issue?
+      description: File path, doc URL, or section heading.
+      placeholder: "docs/authentication.md — 'Multi-User OAuth' section"
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What's wrong or missing?
+      description: Describe what was confusing, incorrect, or absent. If something didn't work as documented, include what you tried.
+    validations:
+      required: true
+
+  - type: textarea
+    id: suggestion
+    attributes:
+      label: Suggested improvement
+      description: Optional — proposed wording, missing example, or a link to a better explanation.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,58 @@
+name: Feature request
+description: Suggest a new Nextcloud app integration, MCP tool, or capability
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting an improvement! See the [Supported Apps table](https://github.com/cbcoutinho/nextcloud-mcp-server#supported-apps)
+        for what's already covered.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the use case from the user's perspective. What can't you do today?
+      placeholder: "I want to start Nextcloud Talk calls and post messages to rooms from an AI assistant."
+    validations:
+      required: true
+
+  - type: input
+    id: nextcloud_app
+    attributes:
+      label: Nextcloud app or feature involved
+      description: If this is about a specific Nextcloud app (Talk, Photos, Mail, etc.) or API, name it here.
+      placeholder: "Talk (spreed)"
+    validations:
+      required: false
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: |
+        What would the MCP tool(s) look like? Include suggested tool names, inputs/outputs, and any relevant
+        Nextcloud API endpoints if you've researched them.
+      placeholder: |
+        - `nc_talk_list_rooms()` — returns rooms the user is a member of
+        - `nc_talk_send_message(room_token, message)`
+        - Backed by the OCS Talk API: /ocs/v2.php/apps/spreed/api/v4/...
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Any workarounds you've tried, or other tools/projects that solve a similar problem.
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Screenshots, links to Nextcloud API docs, related issues, etc.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/question.yml

@@ -0,0 +1,81 @@
+name: Question / setup help
+description: Configuration, deployment, or "how do I…" questions
+title: "[Question]: "
+labels: ["question"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For open-ended discussion, please consider [GitHub Discussions](https://github.com/cbcoutinho/nextcloud-mcp-server/discussions) instead.
+        Use this template for specific, answerable questions about configuration or behavior.
+
+  - type: textarea
+    id: question
+    attributes:
+      label: Your question
+      description: What are you trying to do, and what's not working or unclear?
+    validations:
+      required: true
+
+  - type: textarea
+    id: tried
+    attributes:
+      label: What have you tried?
+      description: Commands run, config files, docs you've already read.
+    validations:
+      required: false
+
+  - type: input
+    id: mcp_server_version
+    attributes:
+      label: nextcloud-mcp-server version
+      placeholder: "0.73.0"
+    validations:
+      required: true
+
+  - type: input
+    id: nextcloud_version
+    attributes:
+      label: Nextcloud server version
+      placeholder: "Nextcloud 30.0.2"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: deployment_mode
+    attributes:
+      label: Deployment mode
+      options:
+        - Single-user (BasicAuth)
+        - Multi-user BasicAuth (pass-through)
+        - Login Flow v2
+        - OAuth / OIDC (Nextcloud user_oidc)
+        - OAuth / OIDC (external IdP, e.g. Keycloak)
+        - Other / not sure
+    validations:
+      required: true
+
+  - type: dropdown
+    id: transport
+    attributes:
+      label: MCP transport
+      options:
+        - stdio
+        - streamable-http
+        - sse (legacy)
+        - Other / not sure
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install_method
+    attributes:
+      label: How are you running the server?
+      options:
+        - uvx
+        - Docker / docker compose
+        - Helm chart on Kubernetes
+        - Local checkout (`uv run`)
+        - Other
+    validations:
+      required: true

README.md

@@ -138,7 +138,7 @@ Contributions are welcome!
 
 [![MseeP.ai Security Assessment](https://mseep.net/pr/cbcoutinho-nextcloud-mcp-server-badge.png)](https://mseep.ai/app/cbcoutinho-nextcloud-mcp-server)
 
-Found a security issue? Please report it privately to the maintainers.
+Found a security issue? **Do not open a public GitHub issue.** Use GitHub's [private vulnerability reporting](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new), or email **security@astrolabecloud.com** if you can't use GitHub. See [SECURITY.md](./SECURITY.md) for details.
 
 ## License
 

SECURITY.md

@@ -0,0 +1,45 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are issued only against the latest released version. Older
+versions do not receive backported patches — please upgrade before reporting,
+and confirm the issue still reproduces on the latest release where possible.
+
+| Version  | Supported |
+|----------|-----------|
+| latest   | ✅        |
+| < latest | ❌        |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+### Preferred: GitHub Private Vulnerability Reporting
+
+Use GitHub's built-in private reporting workflow:
+
+➡️ **[Report a vulnerability](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new)**
+
+This opens a private draft security advisory visible only to the repository maintainers. You can also reach the same form from the **Security** tab → **Report a vulnerability**.
+
+### Fallback: Email
+
+If you cannot use GitHub's private reporting (for example, you don't have a GitHub account), email:
+
+**security@astrolabecloud.com**
+
+### What to include
+
+Whichever channel you use, please include as much of the following as you can to help us triage:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce (proof-of-concept code, if applicable)
+- The version(s) of the project affected
+- Any known mitigations or workarounds
+
+We aim to:
+
+- Acknowledge reports within 5 business days.
+- Provide a fix or mitigation timeline within 30 days.
+- Work with you on coordinated disclosure.