Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@commands/prp-implement.md`:
- Around line 18-31: Update the Phase 0 — DETECT documentation to explicitly
state that detection currently uses a lockfile-only approach: add a short note
above the package manager table in commands/prp-implement.md explaining that
only lockfiles are consulted, that the 6-step detection priority (environment
variable, project config, package.json field, global config, fallback) is not
implemented, and how to override detection by setting the CLAUDE_PACKAGE_MANAGER
environment variable or creating .claude/package-manager.json; mention the exact
env var name (CLAUDE_PACKAGE_MANAGER) and config file
(.claude/package-manager.json) so users know how to force a specific package
manager and that their preferences would otherwise be ignored.

---

Nitpick comments:
In `@commands/code-review.md`:
- Line 169: The Phase 6 REPORT step currently writes the review artifact at
`.claude/PRPs/reviews/pr-<NUMBER>-review.md` but doesn't ensure the target
directory exists; update the procedure that creates the review artifact (Phase 6
REPORT) to explicitly create the directory before writing by running a
recursive-make for `.claude/PRPs/reviews` (e.g., use mkdir -p semantics) so that
the file write to `pr-<NUMBER>-review.md` cannot fail due to a missing
directory.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="commands/prp-plan.md">

<violation number="1" location="commands/prp-plan.md:6">
P2: External repository link to unvetted repository violates supply-chain security policy. Remove the external link or port the referenced content into the main repository for version control and review.</violation>

<violation number="2" location="commands/prp-plan.md:217">
P2: Nested triple-backtick fences inside the outer triple-backtick `markdown` block will prematurely terminate the outer fence. In Markdown parsing, the first inner triple backticks close the outer fence because they have the same length. Use 4+ backticks for the outer fence to properly contain nested code blocks.</violation>
</file>

<file name="commands/prp-pr.md">

<violation number="1" location="commands/prp-pr.md:3">
P2: `$ARGUMENTS` is ambiguously used as both base-branch and `--draft` flag detection without defined parsing precedence. If a user runs `/prp-pr --draft`, the string `--draft` would be treated as the base branch name, causing invalid git commands.</violation>

<violation number="2" location="commands/prp-pr.md:8">
P2: User-facing external repository link violates team security policy against unvetted external repo links in high-visibility documentation</violation>

<violation number="3" location="commands/prp-pr.md:23">
P2: Hardcoded `origin` remote breaks fork-based contribution workflows. In fork setups, contributors often have `origin` pointing to upstream (read-only) and a separate remote for their writable fork. The commands `git push -u origin HEAD`, `git log origin/<base>..HEAD`, `git fetch origin`, and `git rebase origin/<base>` will fail or compute incorrect ranges. Consider detecting the appropriate remote dynamically or allowing it to be specified as an argument.</violation>

<violation number="4" location="commands/prp-pr.md:177">
P2: Workflow suggests code review without verifying CI checks pass, contradicting team workflow expectations</violation>
</file>

<file name="commands/prp-commit.md">

<violation number="1" location="commands/prp-commit.md:36">
P2: The `only new files` command uses shell-unsafe unquoted command substitution</violation>

<violation number="2" location="commands/prp-commit.md:36">
P2: Guard the `only new files` path against an empty `git ls-files` result; otherwise this can invoke `git add` without a pathspec and fail instead of cleanly reporting that there is nothing to stage.</violation>
</file>

<file name="commands/prp-implement.md">

<violation number="1" location="commands/prp-implement.md:6">
P2: External repository link may violate supply-chain policy - avoid linking to unvetted external repositories</violation>

<violation number="2" location="commands/prp-implement.md:50">
P2: Quote `$ARGUMENTS` when reading the plan file to avoid shell word-splitting and pathname expansion on paths that contain spaces or glob characters.</violation>

<violation number="3" location="commands/prp-implement.md:92">
P2: Git sync step suppresses errors while claiming success, allowing the workflow to continue on potentially stale or conflicted code</violation>

<violation number="4" location="commands/prp-implement.md:176">
P2: Avoid job-spec shutdown (`kill %1`) here; capture the server PID (`$!`) and kill that explicit process so integration cleanup does not target the wrong background job.</violation>

<violation number="5" location="commands/prp-implement.md:262">
P2: Quote `$ARGUMENTS` in the archive move command so plan files with spaces are moved reliably as a single path.</violation>
</file>

<file name="commands/prp-prd.md">

<violation number="1" location="commands/prp-prd.md:8">
P1: Link to unvetted external repository in user-facing command content</violation>
</file>

<file name="commands/code-review.md">

<violation number="1" location="commands/code-review.md:8">
P1: User-facing command includes external repo link that violates repository supply-chain/linking policy. The link to https://github.com/Wirasm/PRPs-agentic-eng should be removed or the content should be ported directly into this repository for version control and review.</violation>

<violation number="2" location="commands/code-review.md:92">
P1: PR review mode lacks mechanism to fetch full file contents at PR head revision before review. Phase 1 only gets diff hunks via `gh pr diff`, but Phase 3 requires reading full files. Without explicit checkout or content fetch steps, local file contents may differ from PR head, leading to inaccurate reviews.</violation>

<violation number="3" location="commands/code-review.md:137">
P1: Validation fallback logic using shell OR-chains (`||`) conflates command-not-found errors with actual validation failures, potentially masking real test/type/lint failures. When commands like `npm run typecheck` fail (e.g., due to type errors), the chain continues and a fallback command may pass, causing the overall validation to incorrectly report success. This contradicts the stated goal to accurately "Record pass/fail for each" command.</violation>

<violation number="4" location="commands/code-review.md:160">
P2: Workflow defines a BLOCK decision but publish phase has no corresponding gh pr review action</violation>

<violation number="5" location="commands/code-review.md:226">
P2: `gh pr comment` posts a top-level PR comment and cannot attach to a specific file/line. Replace this instruction with an inline-review API flow so file-level findings are actually anchored to diff hunks.</violation>
</file>

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@commands/prp-commit.md`:
- Line 35: The table row using the command "git add -A && git reset --
'**/*.test.*' '**/*.spec.*' '**/test_*'" can fail when no test files match;
change it to stage everything first, then compute the list of staged files
matching the test globs (using git diff --cached --name-only) and only invoke
git reset -- on that list (via xargs or a conditional) so the reset is skipped
when there are zero matches, making the flow tolerant of no matching test files.

In `@commands/prp-plan.md`:
- Line 430: The plan filename placeholder is inconsistent: replace all
occurrences of both "{kebab-case-feature-name}.plan.md" and "{name}.plan.md" in
commands/prp-plan.md with a single consistent placeholder (pick one, e.g.,
"{kebab-case-feature-name}.plan.md") so generation and reporting align; update
any example usages and any references to the CLI command "/prp-implement" that
rely on the placeholder to use the chosen symbol consistently.
- Line 32: Update the PR instruction "Read the PRD file with cat" to explicitly
require quoting the path when invoking cat so paths with spaces work; mention
using the PRD_PATH variable and instruct to pass it quoted to cat (i.e., quote
the PRD_PATH argument) to ensure correct handling of filenames containing
spaces.

In `@commands/prp-pr.md`:
- Line 180: Replace the external URL in the "No `gh` CLI" guidance by removing
the link and using a plain install instruction; update the line that currently
reads "GitHub CLI (`gh`) is required. Install: https://cli.github.com/" to
something like "GitHub CLI (`gh`) is required. Install GitHub CLI." so the
message contains no external URLs and remains clear to users.
- Line 34: The check for an existing PR is inverted: instead of stopping when
`gh pr list --head <branch> --json number` returns empty, change the decision
rule to stop only when that command returns a non-empty result (a PR number);
update the logic that emits the Stop: "PR already exists: #<number>. Use `gh pr
view <number> --web` to open it." to run when a number is present and allow the
flow to continue when the result is empty.

---

Nitpick comments:
In `@commands/prp-pr.md`:
- Around line 44-50: The current template discovery only checks a fixed list of
file paths (the four fallbacks) but does not enumerate
`.github/PULL_REQUEST_TEMPLATE/*.md`, so the "multiple templates" flow
referenced later (around the logic that prompts the user for choice at line
~183) can never be reached; update the discovery logic to first scan the
directory pattern `.github/PULL_REQUEST_TEMPLATE/*.md` (or equivalent directory
enumeration function used in this module) and collect all matching files, then
if multiple matches prompt the user as the existing choice logic expects,
otherwise fall back to the four fixed paths (`.github/PULL_REQUEST_TEMPLATE.md`,
`.github/pull_request_template.md`, `.github/PULL_REQUEST_TEMPLATE/default.md`,
`docs/pull_request_template.md`); ensure the code paths that currently handle
multiple templates (the user choice branch) are wired to the new directory-scan
result.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="commands/prp-implement.md">

<violation number="1" location="commands/prp-implement.md:177">
P1: Server readiness polling lacks failure check after timeout - integration tests may run against unavailable server</violation>
</file>

<file name="commands/code-review.md">

<violation number="1" location="commands/code-review.md:112">
P1: Unsafe shell word-splitting in file-fetch loop - filenames with spaces will be incorrectly parsed</violation>
</file>

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@commands/prp-plan.md`:
- Line 454: The placeholder at line with "Next step: Run `/prp-implement
.claude/PRPs/plans/{name}.plan.md`" is inconsistent with the other occurrences
using "{kebab-case-feature-name}.plan.md"; update the `{name}.plan.md`
placeholder to `{kebab-case-feature-name}.plan.md` so all instances (including
the ones referenced around lines 430 and 444) use the same placeholder format
for consistency in the output reporting.

In `@commands/prp-pr.md`:
- Line 34: The "No existing PR" check is inverted: change the logic that
evaluates the output of `gh pr list --head <branch> --json number` so that an
empty result continues the flow and a non-empty result triggers the stop. Update
the check labeled "No existing PR" to only stop with the message "PR already
exists: #<number>. Use `gh pr view <number> --web` to open it." when a PR number
is returned; otherwise allow the process to proceed when the command output is
empty.

---

Nitpick comments:
In `@commands/prp-plan.md`:
- Around line 217-420: The plan template (commands/prp-plan.md) includes many
more sections than the extractor expects (commands/prp-implement.md Phase 1
LOAD), which lists only Summary, Patterns to Mirror, Files to Change,
Step-by-Step Tasks, Validation Commands, and Acceptance Criteria; update
commands/prp-implement.md to explicitly enumerate which sections are REQUIRED vs
OPTIONAL/INFORMATIONAL (e.g., mark User Story, Metadata, UX Design, Mandatory
Reading, External Documentation, NOT Building, Testing Strategy, Completion
Checklist, Risks, Notes as informational), or alternatively trim/sync the
template in commands/prp-plan.md to output only the six required sections, and
add clear comments in both files (Phase 1 LOAD and the template) so future
changes stay aligned.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="commands/code-review.md">

<violation number="1" location="commands/code-review.md:112">
P2: PR file-fetch workflow example is missing URL encoding and deleted file handling, which can cause incomplete PR reviews or API errors</violation>

<violation number="2" location="commands/code-review.md:252">
P2: BLOCK decision is defined in the workflow but has no corresponding GitHub review command. The decision model includes BLOCK as an outcome for CRITICAL issues, but the publish section only provides commands for APPROVE (--approve), REQUEST CHANGES (--request-changes), and COMMENT (--comment). GitHub's API doesn't support a BLOCK state, leaving reviewers with no clear way to publish a BLOCK decision.</violation>

<violation number="3" location="commands/code-review.md:252">
P1: PR review workflow lacks required CI status and merge conflict checks before the review phase. According to team standards, reviewers expect green CI checks and conflict-free status before commencing detailed review. The current Phase 1 (FETCH) only retrieves basic metadata without checking `mergeable` status or CI status fields.</violation>
</file>