insights

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189). Starts by asking which scope to tackle (critical, high, medium/low, or specific advisories) with checkboxes. Fetches open alerts, dedupes them, classifies each by origin (submodule vs local, dev-only vs runtime), then fans out one break-risk agent per package that must PROVE the update is safe for this codebase before any fix is applied. Applies safe fixes one at a time with incremental validation and ends with a report of what was fixed and what needs a human. Fixing only: NEVER runs git operations (no branch, commit, push, or PR) and produces no commit/PR drafts — reviewing and shipping the changes is entirely up to the user. Never dismisses alerts or auto-applies major version bumps. Use when the user says "fix vulns", "fix vulnerabilities", "dependabot alerts", "security audit fix", or invokes /fix-vulns.

Record an architecture decision as an ADR in docs/adr/. Use when choosing between frameworks, libraries, databases, or architectural patterns; stating a decision with reasoning ("we decided X instead of Y because..."); or querying past decisions ("why did we choose X?").

Generate a commit message and commit staged changes using git commit -s -S.

Pre-PR validation — license headers, format, lint, TypeScript check, build, and protected file check. Use before submitting any PR, to check if code is ready, validate changes, or verify a branch before review.

Review a pull request against Insights architecture standards — fetches PR diff, verifies previous comments are addressed, validates PR metadata (title, branch, JIRA, size), runs a code-standards check against every file in `.claude/rules/` and `.claude/hooks/guard-protected-files.sh`, and drafts inline review comments with suggested fixes. NEVER auto-posts comments or submits reviews — always presents a draft in the terminal for user approval before any comment lands on the PR. Use when reviewing PRs, checking PR quality, validating code changes, or when the user says "review", "check this PR", or "audit code".

Run the docs site, blog, or Storybook locally. Use when contributing to documentation, previewing blog posts, or developing UI components in isolation. Not needed for regular frontend development.

Full development environment setup from scratch — prerequisites, dependencies, .env file, optional local PostgreSQL database (for auth/collections/chat work), and dev server. Use for first-time setup, broken environments, missing env vars, or when the app won't start.