Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cli/src/utils.ts`:
- Around line 792-862: Update invokeCapgoCliApi to reuse the result of
getRemoteConfig(true) across calls during the CLI process, while preserving
explicit supaHost/supaAnon behavior and avoiding stale configuration beyond that
process. Review the non-functions/v1 Authorization construction in
invokeCapgoCliApi against the Cloudflare API contract; use the required Bearer
format if the API validates Authorization, otherwise retain raw-key behavior
only when capgkey is intentionally the sole credential and ensure the
implementation reflects that contract.
- Around line 748-757: Validate the --supa-host value centrally before routing
or invoking the API, using isCapgoManagedSupabaseHost and the existing
host-normalization flow where appropriate. Reject malformed or unsupported hosts
with a clear CLI-facing error that states the required URL format, and ensure
this validation occurs inside invokeCapgoCliApi()’s error-handling path so raw
“Invalid URL” TypeErrors do not escape.

In `@package.json`:
- Around line 187-188: Make Supabase stale-function cleanup fail closed: in
package.json lines 187-188, remove unconditional success masking from
deploy:supabase:prod and deploy:supabase:preprod, ignoring deletion errors only
when the function is confirmed missing; in
.github/workflows/build_and_deploy.yml lines 97-109, ensure cleanup failures
propagate and fail the workflow rather than being masked; in README.md lines
467-470, document the full cleanup-aware deployment procedure or explicitly
state that the alternate command does not remove stale functions.

In `@README.md`:
- Around line 80-83: Correct the console/CLI routing description in the README
paragraph: limit SUPABASE_URL routing to self-hosted deployments and legacy CLI
compatibility through October 28, 2026. State that the migrated Capgo Cloud
console uses VITE_API_HOST and the new CLI uses Capgo API hosts, while
preserving the existing Supabase function and pg_net context.

In `@src/components/dashboard/AppOnboardingFlow.vue`:
- Around line 644-648: Update the organization-creation error handling in the
unified onboarding flow around the `if (error || !data?.id)` block to read the
duplicate-name code from the HTTP error body by parsing the `FunctionsHttpError`
response in `error.context` before checking for `23505`. Use the parsed body
code for the `org-with-this-name-exists` toast, while preserving the generic
`cannot-create-org` fallback.

In `@src/services/apikeys.ts`:
- Line 68: Update each invokeCapgoApi call in src/services/apikeys.ts:68-68 and
124-124, src/services/chartDataService.ts:39-39, src/utils/invites.ts:44-44, and
src/utils/onboardingAppCreateHelpers.ts:124-124 to pass the caller-supplied
Supabase client/context, preserving injected client, session, and configuration
behavior instead of resolving the global client.

In `@src/services/capgoApi.ts`:
- Line 4: Update the method type declaration to use the repository’s accepted
single-quote style for all HTTP method literals, without changing the allowed
values or optional property behavior.

In `@src/services/emailOtp.ts`:
- Around line 52-54: Update the invokeCapgoApi call in the email OTP
verification flow to pass allowAnonymous: true, preserving unauthenticated
access while keeping the existing token sanitization and
private/verify_email_otp endpoint unchanged.

In `@tests/apikeys-service.unit.test.ts`:
- Around line 32-40: Remove the concurrent modifier from the “creates a member
key with only the selected app bindings” test so it runs as a standard
sequential test, preserving the shared hoisted mocks and beforeEach resets.

In `@tests/supabase-cloud-functions.unit.test.ts`:
- Around line 39-41: Extend the existing buildCapgoCloudSupabaseDeployArgs test
coverage to assert that passing an empty array throws, preserving the
fail-closed guard while retaining the explicit-list expectation.

---

Outside diff comments:
In `@src/pages/app/`[app].channel.[channel].devices.vue:
- Around line 119-176: Update setChannelDeviceOverride to call invokeCapgoApi
for private/channel_device instead of fetch against defaultApiHost, preserving
the existing app, channel, and device request fields. Handle the returned error
in customDeviceOverwritePart5 through the existing overwrite-error path, and
remove the direct session/JWT and HTTP response handling.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/supabase-cloud-functions.unit.test.ts`:
- Around line 13-60: Run the independent test cases in this suite concurrently
by replacing each applicable `it` declaration with `it.concurrent`. Apply this
to the tests covering function lists, deploy arguments, empty selections, and
skipped local functions, without changing their assertions or shared behavior.

---

Outside diff comments:
In `@cli/src/utils.ts`:
- Around line 993-1002: Update the error handling around the
is_allowed_action_org_action RPC in the relevant utility so any PGRST202 error,
with or without appId, falls back to isAllowedActionOrg(supabase, orgId).
Preserve throwing formatted errors for all other failures, and add coverage for
both app-scoped and org-scoped calls.