In `@src/setup/prompts.ts`:
- Around line 136-142: The cleanup() function currently calls
process.stdin.removeAllListeners('data') which removes every 'data' listener;
instead remove only the specific listener you originally registered for stdin by
keeping a reference to that callback (the function you passed to
process.stdin.on('data', ...)) and calling process.stdin.removeListener('data',
yourCallback). Update the code to store the handler in a const (e.g.,
dataHandler) where you attach it, use process.stdin.on('data', dataHandler), and
replace removeAllListeners('data') in cleanup() with
process.stdin.removeListener('data', dataHandler) while keeping the existing
pause() and setRawMode(false) logic.
- Around line 47-75: The regex literals in stripEscapeCodes that include control
characters should be replaced with RegExp constructors to satisfy Biome's rule:
replace the /\x1b\[[0-9;?]*[a-zA-Z]/g literal with new
RegExp('\\x1b\\[[0-9;?]*[a-zA-Z]', 'g'), replace the
/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g literal with new
RegExp('\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)', 'g'), and replace
/[\x00-\x1F\x7F]/g with new RegExp('[\\x00-\\x1F\\x7F]', 'g'); keep the same
flags and assign results back to cleaned exactly as before so stripEscapeCodes
behavior is unchanged.

In `@src/setup/prompts.ts`:
- Around line 164-167: The code builds a dynamic RegExp from options.pattern
inside the prompt validation (when options.pattern && value) without error
handling; wrap the RegExp construction in a try/catch around new
RegExp(options.pattern) (referencing options.pattern and value) so invalid
patterns don’t throw: on catch, log or print a clear warning (using the same
colors/logger used in this module), and either treat the input as invalid (ask
user to retry) or skip pattern validation to continue gracefully; ensure the
rest of the validation flow (the regex.test(value) branch) only runs when the
RegExp was successfully created.
- Around line 149-154: The onData handler's regex in src/setup/prompts.ts
currently matches numbers without semicolons and can drop legitimate input like
"10m"; update the regex used in onData to only match SGR mouse codes by
requiring at least one semicolon and anchoring to the end (i.e., require the
pattern to include `;` between numbers and end with `M` or `m`), so only true
mouse-tracking sequences are ignored and normal inputs are preserved.

In `@src/setup/prompts.ts`:
- Around line 51-58: The mouse-code stripping regex in stripEscapeCodes is too
permissive and removes valid inputs (e.g., "10m"); update the pattern to require
at least one semicolon to match the safer onData check by replacing
/\d+(?:;\d+)*[Mm]/g with /\d+(?:;\d+)+[Mm]/g so only sequences like "35;106;28M"
are removed; ensure this change applies where stripEscapeCodes is used by
promptBoolean, promptSelect, and promptNumber.

In `@src/setup/prompts.ts`:
- Around line 56-57: The current aggressive semicolon removal uses cleaned =
cleaned.replace(/;+/g, ''); which will strip valid semicolons from user input
(URLs, code, configs); either remove that replacement entirely or replace it
with a targeted removal that only deletes semicolons directly adjacent to
previously-removed mouse-code fragments (e.g., only where the mouse-code regex
matched boundaries), updating the logic around the variable cleaned in this
module (the cleaned variable post-mouse-code stripping) so legitimate semicolons
remain intact.

In `@src/prd/parser.ts`:
- Around line 422-438: The parser currently only exits the User Stories block
for a fixed list of non-story headers; update the logic in the parsing loop that
uses inUserStoriesSection and currentStory so any new H1/H2 that is not a
recognized story header forces an exit. Replace the isNonStorySection check with
a condition that treats /^#{1,2}\s+/ lines as section boundaries unless they
match the story header pattern (the same pattern used to detect stories earlier
in this parser), then save currentStory (using
lines.slice(currentStory.startIndex, i) and push into sections) and break;
ensure the change references the same variables currentStory,
inUserStoriesSection, sections, and lines so behavior is consistent.
- Around line 42-50: USER_STORY_HEADER_PATTERN is too permissive because the
generic prefix `[A-Z]+-\d+` will also match US- variants like US-1 or US-9999;
update the regex to exclude the "US-" prefix from the generic case and keep the
intended US formats. Replace `[A-Z]+-\d+` with a negative-lookahead form like
`(?!US-)[A-Z]+-\d+` (or similar) so the overall constant
USER_STORY_HEADER_PATTERN still matches the explicit US formats (`US-\d{3}` and
`US-\d+(?:\.\d+)+`) but prevents the generic branch from capturing US-* IDs.

In `@src/prd/parser.ts`:
- Around line 101-113: normalizeStoryId fails to normalize headers like "feature
1.1" because the Feature regex is case-sensitive; update the feature matcher in
normalizeStoryId to be case-insensitive (use the /i flag) and trim rawId first,
then build the normalized ID as `FEAT-{major}-{minor}` (use featureMatch[1] and
featureMatch[2]) to ensure spaces/casing are normalized consistently.