mralaminahamed

Use when a pull request has QA failures, a "Testing Failed" label, or QA comments reporting broken features — reading QA feedback and PR comments, tracing root cause using root-cause-patterns.md, applying scoped conventional-commit fixes, swapping labels (Testing Failed to Need Testing), and posting a structured QA re-test comment. Triggers: "QA failed my PR", "Testing Failed label on my PR", "fix the QA comments on PR", "QA says feature X is broken", "post a re-test comment", "how do I respond to QA feedback", "CI is failing on my PR", "QA reopened the ticket", "update the PR label after fixing", "testing failed label", "QA comment says the button is broken", "phpcs failing in CI", "yarn lint error on the PR", "npm run build failing in CI", "root cause of the QA failure", "write a re-test instruction comment", "fix failing checks on this PR", "QA triage workflow", "phpcs prints nothing and exits 0", "composer run test produces no output", "phpstan workers keep crashing", "did my static checks actually run",

Use when building, extending, or debugging a WooCommerce plugin — custom product types, payment gateways (WC_Payment_Gateway, process_payment(), process_refund()), shipping methods (WC_Shipping_Method, calculate_shipping()), CRUD via WC_Product / WC_Order / WC_Customer (wc_get_product, wc_create_order, wc_get_orders, get_meta, update_meta_data), HPOS compatibility (FeaturesUtil::declare_compatibility, wc_get_orders instead of WP_Query on posts), REST API extensions (woocommerce_rest_prepare, woocommerce_rest_pre_insert, Store API woocommerce_store_api_register_endpoint_data), cart/checkout blocks (registerCheckoutFilters, extensionCartUpdate, SlotFills), key hooks (woocommerce_cart_calculate_fees, woocommerce_checkout_fields, woocommerce_order_status_changed, woocommerce_payment_gateways), or WooCommerce subscription/coupon/webhook logic. Triggers: "WooCommerce extension", "custom product type", "payment gateway", "hook into WooCommerce checkout", "WC_Order", "wc_create_order()", "wc_get_product()", "add a sh

Use when a WordPress plugin needs to run work outside the HTTP request cycle — scheduling async or recurring jobs with Action Scheduler (as_enqueue_async_action, as_schedule_single_action, as_schedule_recurring_action, as_unschedule_action), implementing WP_Background_Process (push_to_queue, save, dispatch, is_queue_empty), registering WP Cron events (wp_schedule_event, wp_clear_scheduled_hook), batch-processing large datasets without hitting PHP timeouts, tracking job progress, handling retries on failure, or debugging the actionscheduler_actions table. Triggers: "schedule this for later", "run this without hitting timeout", "queue these items for background processing", "why is my cron not running", "Action Scheduler job keeps failing", "as_enqueue_async_action", "WP_Background_Process", "push_to_queue", "dispatch the queue", "DISABLE_WP_CRON", "process records in batches", "send emails in the background", "WP Cron not firing", "batch import without timeout", "scheduled action not running", "background job

Use when setting up, configuring, or debugging the JavaScript/CSS build pipeline for a WordPress plugin — @wordpress/scripts, webpack (webpack.config.js, entry points, externals), Vite, block editor asset compilation with block.json, enqueueing built assets with .asset.php dependency files, wp_enqueue_script / wp_localize_script, Sass/SCSS/PostCSS compilation, TypeScript support, register_block_type, or reusing a JS/CSS library already bundled by a host plugin (EDD, WooCommerce, Elementor). Triggers: "npm run build fails", "webpack config error", "my script is not loading", "set up @wordpress/scripts", "enqueue my block assets", "why is my CSS not compiling", ".asset.php not found", "how do I reuse this bundled library", "TypeScript in a WP plugin", "block.json attributes", "missing dependency in build", "wp_enqueue_script not loading", "externals in webpack", "Vite for WordPress", "Sass not compiling", "PostCSS setup", "build output is in the wrong folder", "npm ci vs npm install", "externalize React from my

Use when setting up PHPCS with WordPress Coding Standards (WPCS), configuring phpcs.xml.dist, running phpcs/phpcbf, fixing sniff violations, adding PHPCS to CI (GitHub Actions), configuring IDE integration, or verifying a plugin meets WP.org code style requirements. Covers squizlabs/php_codesniffer, wp-coding-standards/wpcs, dealerdirect/phpcodesniffer-composer-installer, WordPress-Extra, WordPress-Docs, WooCommerce-Core rulesets. Triggers: "phpcs error", "WPCS violation", "fix my code style", "set up PHPCS", "configure phpcs.xml.dist", "my code fails PHPCS", "add linting to CI", "WordPress.Security.EscapeOutput sniff", "WordPress.WP.I18n error", "WordPress.NamingConventions sniff", "how do I ignore a phpcs rule", "phpcbf auto-fix", "phpcs in GitHub Actions", "add PHPCS to pre-commit hook", "vendor/bin/phpcs -i", "WordPress-Extra ruleset", "WordPress-Docs ruleset", "WooCommerce sniff", "phpcs.xml.dist example", "phpcs says my spacing is wrong", "fix indentation for WP standards", "PHPCS not finding WPCS", "de

Use when submitting a WordPress plugin to the WP.org directory for the first time, deploying a new version via SVN (plugins.svn.wordpress.org trunk, tags, assets), fixing a reviewer rejection (17-issue catalog with exact reviewer quotes), writing or correcting readme.txt (Stable tag, Changelog, Upgrade Notice, Requires, Tested up to, External services), or preparing WP.org assets (banner-772x250.png, banner-1544x500.png, icon-128x128.png, icon-256x256.png, icon.svg, screenshot-N.png). Triggers: "submit my plugin to WP.org", "SVN deploy", "reviewer rejected my plugin", "fix WP.org review feedback", "how do I set up the SVN repo", "WP.org assets", "prepare my plugin for the directory", "what does the reviewer want", "Stable tag", "readme.txt requirements", "WP.org banner dimensions", "fix this reviewer comment", "plugin zip for submission", "svn commit trunk", "svn cp trunk tags", "reviewer says missing nonce", "reviewer says not prefixed", "reviewer says missing sanitization", "Upgrade Notice section", "Extern

Use when auditing a WordPress plugin for security issues, code inconsistencies, or quality gaps — fans out parallel checks across four dimensions: A (version/metadata sync), B (naming/prefix/i18n), C (docs vs code), D (code conventions/security), verifies every finding with file:line references before reporting, and routes confirmed issues to the correct fix skill. Security patterns checked: XSS (missing esc_html/esc_attr), SQL injection (raw $wpdb), CSRF (missing nonce), missing capability checks, file upload validation, object unserialize, open redirect, path traversal, REST auth hardening. Triggers: "audit this plugin", "find inconsistencies in my plugin", "security review", "check my plugin for XSS", "is my escaping correct", "find missing nonces", "check capabilities in my plugin", "audit readme.txt", "find security issues", "plugin quality sweep", "are there SQL injection risks", "review my plugin before submission", "missing esc_html()", "raw wpdb query without prepare()", "missing current_user_can()",

Use when bumping a WordPress plugin version or cutting a release — syncing version across all sources: plugin header (Version: X.Y.Z), version constant (define MY_PLUGIN_VERSION), readme.txt (Stable tag + Changelog + Upgrade Notice), CHANGELOG.md, and .pot Project-Id-Version; following semver (major/minor/patch) rules; running pre-release checks (composer lint / analyze / test, grep for stale version strings); creating a git tag; and deciding what NOT to bump (DB schema version, historical changelog entries). Triggers: "release version 1.2.3", "bump the version", "update the changelog", "sync version numbers", "prepare the release", "tag this version", "version is out of sync", "update Stable tag", "what needs to change for a release", "changelog entry", "update readme.txt version", "bump to 2.0.0", "Version header in plugin file", "define MY_PLUGIN_VERSION", "semver patch vs minor vs major", "Project-Id-Version in POT", "grep for old version strings", "git tag for release", "Upgrade Notice section", "what to

Ship this extension — cut a release and publish to the Chrome Web Store, Microsoft Edge Add-ons, and Firefox Add-ons (AMO) — and reason about its permissions and privacy posture. Use when bumping the version, packaging store zips, updating listing/store metadata, tagging a release, working on the tag-triggered release.yml workflow, debugging a Chrome Web Store API publish failure (unauthorized_client, invalid_grant, publisherId, Unauthorized), editing manifest permissions, adding an API that needs a new permission, writing store justifications, or answering "what data does it collect / is this private". Covers the OAuth/credential setup the CWS publish needs.

Add or modify a platform/CDN media resolver (upgrade a thumbnail URL to its original, recognize a video poster, or fetch an exact original). Use when adding support for a new site (Twitter/X, Unsplash, Wallhaven, Pinterest, Shopify, etc.), fixing a wrong "original" URL, or touching packages/core/src/resolvers or imageUrl.ts.

Develop in this WXT Manifest-V3 yarn-workspaces monorepo — where code lives and the package import boundaries, the repo comment convention, how to build/dev/zip/load for Chrome/Firefox/Edge/Safari, the MV3 pitfalls specific to this repo, how to debug the loaded extension at runtime, and the performance guardrails. Use when deciding which package a new file belongs in, wiring a browser API, resolving a moved-module import, working on entrypoints/manifest/background/content scripts, chasing a bug that reproduces only in the loaded build, or keeping the content script / popup / deep-scan fast.

Work with this extension's persisted state — user settings (chrome.storage.sync), the bulk stores (download history, favourites, excluded, download queue in chrome.storage.local), and their durable IndexedDB write-through mirror — including defaults, tolerating legacy/corrupt shapes, the single-writer rule, the ephemeral-worker settings gate, durableSet, and the startup heal. Use when adding a setting, changing the history/favourites/queue model, touching anything under packages/storage/src/ (settings.ts, history.ts, idb.ts, sync.ts, ...), or reasoning about persistence/durability/migrations.

Write Vitest tests for this extension (background worker, content script, popup React UI) and verify UI/collection changes in a real browser. Use when adding tests, mocking chrome.* APIs, testing message handlers, or when asked to "verify in the browser" a popup/filter/collection change you can't see by loading the unpacked extension.

Style the popup / on-page bubble consistently using this repo's "precision-utility" design system (tokens, component classes, radius/height scale, dark mode). Use when editing any React component under apps/extension/src/extension/popup or apps/extension/src/extension/bubble, adding UI, changing colors/spacing/sizing, or when a height/width/color class "isn't applying".

Use when encountering unexpected behavior, failing tests, API errors, or runtime panics in Tundra — before proposing any fix

Use when you need to understand codebase structure, locate code, or trace relationships before making changes or answering architecture questions

Use when planning or executing a refactor — rename, extract, move, or delete code — to prevent breaking callers or missing affected files

Use after completing a feature or before merging to perform a risk-scored review of changed code, check test coverage, and assess blast radius