fxa

Generates a two-audience changelog from merged PRs in the FxA monorepo: a plain-language product summary and an engineer handoff with operational notes. Name a train (e.g. "341") or pass any git range; with no argument it defaults to the in-development train on main (the latest release tag up to HEAD — not a deployed stage/prod train), framed as the range the train owner is accountable for. Use for train-owner handoffs, train summaries, or "what shipped" questions.

Generates a daily FxA triage summary. Queries Jira, GitHub, Bugzilla, and optionally Sentry, then outputs a Slack-ready update with detailed analysis. Use when starting triage duties or preparing the daily triage post.

Simplifies and refines code in the FXA monorepo using project-specific conventions. Use when asked to simplify, clean up, or refine recently written code. Focuses on recently modified code unless instructed otherwise.

Reviews changed React/TSX code for component design, hooks misuse, performance, accessibility, and state management issues. Reports findings with severity and concrete fix recommendations. Operates on files changed vs main.

Fast single-pass FXA-specific commit review covering security, conventions, logic/bugs, tests, and migrations. No subagents — runs directly in the main context.

Thorough FXA-specific commit review using parallel specialist agents. Covers security, TypeScript, logic/bugs, test quality, and architecture. Agents explore call sites, git history, and monorepo conventions.

Drafts Jest tests for changed code. Defaults to staged/unstaged changes or the most recent commit. Output is a starting point for review, not final.

Reviews a test file for violations of FXA testing guidelines, then suggests concrete repairs. Does not auto-apply changes — output is a repair plan for engineer review.

Lists open FXA PRs matching a search term with a rich status table — file/line counts, draft state, review activity, and approval status. Defaults to all open PRs needing review.

Approves the on-hold "Approve Functional Tests (PR)" CircleCI job for the current PR branch, kicking off the gated Playwright functional tests. Requires CIRCLECI_TOKEN in the environment.

Validates that Jest tests in a given file pass both as a full suite and individually in isolation, catching hidden order dependencies and shared mutable state.

Drafts a Jira bug report for an FXA issue. Gathers repro steps, expected vs actual behaviour, and affected surface, outputs a structured report, and optionally files the ticket via the Atlassian MCP. Returns the new FXA-N key when filed.

Drafts a concise Jira description for an FXA task. Gathers context via targeted interview, researches relevant patterns in the repo, outputs a clean description, and optionally files the ticket via the Atlassian MCP. Returns the new FXA-N key when filed.

Drafts an FXA pull request title and body following the repo PR template and team conventions, then opens the PR as a draft after explicit confirmation. Use when a feature branch is ready and the user wants to open a PR. Do not invoke for edits to an existing PR.

EXPERIMENTAL — Guides an engineer through the FXA release process for stage. Walks through tagging, building, deploying, and smoke-testing step by step. NOT for auto mode; performs irreversible actions and requires confirmation at each step.

Improves documentation in changed files. Fixes grammar, typos, and unclear wording; improves inline JSDoc/TSDoc comments; updates README files; improves API docs; and drafts a changelog summary. Operates on files changed vs main.

Examines the git history of files changed in the current branch to identify potential regressions, re-introduced bugs, or changes that conflict with past fixes. Cross-references current changes against prior commits on the same code paths.

Reviews changed code for code smells across design, implementation, tests, and dependencies. Reports findings with severity and concrete fix recommendations. Operates on files changed vs main.

Explains code for experienced engineers. Covers what changed, why it works, non-obvious decisions, gotchas, and data/control flow. Defaults to git diff vs main; accepts an optional file or path argument.

Comprehensive security review of changed code. Checks for OWASP vulnerabilities, secrets leakage, XSS, SQL/Redis injection, CORS issues, insecure crypto, OTP/TOTP misuse, insufficient logging, Docker/CI exposure, and more. Use when landing changes that touch auth, payments, user data, or any security-sensitive path.