authgear

Produce a structured code review report for the current branch's PR (purpose, API interface changes, code quality, bugs, security, performance), with a mandatory second verification pass. Use when the user asks "what does this PR do", "review this branch/PR", or asks to confirm/double-check review findings and look for more issues.

Guidelines for updating or designing pages in the portal React frontend (portal/src). Covers component conventions, link rendering rules, i18n patterns, and common pitfalls.

Set up a fresh authgear-server development environment from scratch. Use when onboarding a new contributor, setting up a new machine, or when the user says "set up local dev from scratch" / "first-time setup". Covers the asdf + Homebrew install path on macOS; Nix users should follow CONTRIBUTING.md directly.

Audit and fix dependency vulnerabilities in Go and Node.js packages. Runs govulncheck for Go and npm audit for each package.json directory. Commits fixes directory by directory.

Update Authgear email templates using the correct source files, translation files, and commit order. Use when editing email wording, email structure, or subject lines.

Write or extend Go unit tests in this repo. Use when the user asks to add or update Go tests.

Draft or update detailed implementation plans for authgear-server specs, design changes, and docs/plans files. Use when Codex needs to turn a spec or outdated plan into a concrete implementation plan with exact files, exact methods, runtime call flow, compatibility requirements, test coverage, and atomic commit steps.

Write end-to-end (e2e) tests for authgear-server. Use when the user asks to write, add, or create e2e tests. The tests live in e2e/tests/ and are YAML-driven.

Wire a frontend page in the Authgear Site Admin Portal to the real Site Admin API, replacing mock data from src/data/. Use this skill when asked to connect a page to the API, replace dummy/mock data with live data, implement an API call on a screen, or fetch real data for any page in this project.

Rules for writing correct date code in this project. The server stores all data in UTC — all date arithmetic, comparisons, and state must use UTC methods, never local time methods.

Update vulnerable npm dependencies safely. Only applies non-breaking changes. Prefers lock-file-only fixes via `npm audit fix`. Generates a summary of what was updated, what was skipped, and why. Use when asked to fix security vulnerabilities, run dependabot-style updates, or update vulnerable packages.

Write unit tests for API integration code. Required for all changes to src/api/

Add or update entries in the repo's hand-maintained CHANGELOG.md, and stamp the "Unreleased" section with a version and date when cutting a release. Use when asked to update the changelog, document a change for release notes, record a breaking change, or prepare CHANGELOG.md for a new version.

Audit JavaScript and TypeScript dependencies across every directory in this repository that contains a package.json, using the correct install root for each project, apply non-breaking security upgrades, and stop to summarize any fixes that require a major-version change. Use when asked to run dependency audits, update vulnerable npm or yarn packages, reduce JavaScript dependency CVEs, or review whether vulnerable dependency fixes can be applied safely without breaking changes.

Audit and fix Go dependency vulnerabilities. Runs govulncheck and upgrades affected modules.

Audit npm dependencies across all workspaces and fix vulnerabilities. Use when the user asks to audit deps, check for vulnerabilities, run npm audit, or fix security issues in packages.

Scan this Go module's dependencies for known vulnerabilities with govulncheck, upgrade any that have a non-breaking fix available, leave breaking ones untouched, and produce a report of what was vulnerable/fixed/still-needs-manual-upgrade. Use when asked to check for vulnerable dependencies, run a dependency security audit, update vulnerable packages, or generate a vulnerability report for this repo.