// Step 1: Discover components
  log('📦', 'Discovering components...');
  exec('npx tsx scripts/discover-components.ts');

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.claude/commands/review-pr.md:
- Around line 85-86: The comment "Replace OWNER/REPO with the actual repository"
is outdated because the script already sets REPO dynamically using the command
REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner); update or remove
that comment near the REPO assignment in .claude/commands/review-pr.md so it
reflects the dynamic resolution (e.g., "Repository is resolved dynamically via
gh repo view") or delete the line to avoid confusion, ensuring the REPO variable
and the gh repo view command remain unchanged.
- Around line 115-119: The GraphQL snippets use single-quoted query bodies so
shell vars $PR_NUMBER and $THREAD_ID are not interpolated; update the gh api
calls that build the GraphQL query (the commands invoking gh api graphql -f
query=...) to use GraphQL variables instead (pass -F prNumber="$PR_NUMBER" and
-F threadId="$THREAD_ID" and declare variables in the query signature like
query($prNumber: Int!, $threadId: ID!) ), then replace inline
$PR_NUMBER/$THREAD_ID occurrences in the query with $prNumber/$threadId and
adjust the selection/mutation fields that reference those variables (e.g., the
pullRequest(number: $prNumber) and thread(id: $threadId) usages) so the shell
interpolation issue is resolved.
- Around line 81-89: The script uses $PR_NUMBER in sections 6.1–6.3 but never
defines it; normalize the input in $ARGUMENTS into PR_NUMBER before any API
calls by invoking the GitHub CLI to resolve the PR (e.g., use `gh pr view` on
"$ARGUMENTS" and extract the numeric .number) and assign that to PR_NUMBER, then
place this assignment near the start of the script before the first usage in the
Get Inline Review Comments block; update the same pattern before the blocks in
6.2 and 6.3 so all calls like gh api "repos/$REPO/pulls/$PR_NUMBER/..." use a
defined PR_NUMBER.

In @.github/workflows/ci.yml:
- Around line 80-86: The "Clone cpk-ui" step currently always checks out default
HEAD; change that step to consume github.event.client_payload.ref or .sha from
the repository_dispatch payload and use it when cloning (or clone then checkout
the provided sha/ref) so dispatched workflows pin the intended cpk-ui revision;
keep the "Get cpk-ui commit hash" step as-is but ensure it runs after the
clone/checkout in the ../cpk-ui directory. Use the step name "Clone cpk-ui" and
reference github.event.client_payload.ref (fallback to github.ref_name) or
github.event.client_payload.sha when implementing the change.
- Around line 98-111: Remove the partial restore behavior and use the cache
step's cache-hit output to decide whether to rebuild: in the "Cache Storybook
build" step (actions/cache@v4) remove the restore-keys field and add an id
(e.g., id: cpk-ui-cache) so you can reference outputs; then update the "Build
cpk-ui Storybook" step to check steps.cpk-ui-cache.outputs.cache-hit (if not
'true' then run cd ../cpk-ui && CI=1 STORYBOOK=1 npx storybook build -o
storybook-static, else echo "Using cached Storybook build") instead of checking
for ../cpk-ui/storybook-static/index.json; keep the same cache path and key but
rely only on exact key hits.

In `@cpk-e2e.config.ts`:
- Around line 8-10: The JSDoc on CpkE2eConfig.targetRoot incorrectly states
paths are "relative to this config file" while scripts/run-e2e.ts resolves them
relative to process.cwd() (see ROOT and TARGET_ROOT); either update the JSDoc to
state that targetRoot is resolved relative to the current working directory
(process.cwd()), or change the resolution in scripts/run-e2e.ts to resolve
targetRoot relative to the config file location (e.g., derive the config file
directory via import.meta.url or the module filename and use path.resolve(dir,
config.targetRoot)); update the CpkE2eConfig.targetRoot comment or the PATH
resolution logic consistently so the doc and implementation match.

In `@scripts/check-coverage.ts`:
- Around line 39-47: The substring fallback in the hasCoverage check is too
permissive (title.includes(nameLower)); change it to match a normalized leaf
story title or use an explicit mapping: for each title in storyTitlesArray
derive a normalizedLeaf (e.g.,
title.split('/').pop().toLowerCase().replace(/[-_]/g, '')) and then check
normalizedLeaf === nameLower (or consult a prebuilt component->story mapping)
instead of title.includes(nameLower); update the logic in the hasCoverage
expression that references storyTitlesArray, nameLower, and comp.hasStory to use
this stricter comparison.

In `@scripts/discover-components.ts`:
- Around line 344-348: The testFiles array currently includes path.join(dir,
'__tests__', `${name}.test.tsx`) but omits pure TypeScript tests under
__tests__; update the testFiles constant to also include path.join(dir,
'__tests__', `${name}.test.ts`) so the helper scans both .test.tsx and .test.ts
in the __tests__ directory (locate the testFiles declaration and add the
additional path.join entry).
- Around line 264-278: The blacklist check that returns false for names ending
with 'Item' is too broad and excludes real components; update the filter in the
block that uses name.endsWith('Item') so it no longer rejects all '*Item' names
— either remove the 'Item' entry from the list or move that specific check to
run after the source-definition check (so actual exported/component definitions
are preserved); edit the code that references name.endsWith('Item') in
scripts/discover-components.ts to implement one of these two options and ensure
legitimate components like ListItem/MenuItem are not filtered out.

In `@tests/components.spec.ts`:
- Around line 159-176: The root-content non-empty render assertion is only
executed when theme === 'light', so move or duplicate that check to run for dark
mode as well: update the block that queries page.locator('#storybook-root,
`#root`') and inspects innerHTML (currently guarded by if (theme === 'light')) so
it executes regardless of theme (or add an explicit branch for theme === 'dark')
and still pushes 'Component rendered empty content' onto the errors array when
innerHTML is empty and errors.length === 0; keep the existing try/catch behavior
and use the same root, rootCount, innerHTML, and errors symbols to locate and
modify the code.

---

Nitpick comments:
In @.claude/commands/review-pr.md:
- Around line 86-87: Extract the duplicated repository lookup into a single
variable declared once (e.g., REPO=$(gh repo view --json nameWithOwner -q
.nameWithOwner)) and reuse it for subsequent calls; replace the repeated
assignments before the two gh api invocations with references to that single
REPO variable so both usages (the gh api "repos/$REPO/pulls/$PR_NUMBER/comments"
call and the other gh api call at the later duplicate) read from the same shared
variable.

In `@scripts/cli.ts`:
- Line 18: restArgs is built by joining user arguments (args.slice(1).join(' '))
and then passed to a shell command, which risks shell metacharacter injection;
change this to pass arguments as an array to a spawn/spawnSync or
execFile/execFileSync call (instead of building a single string) so each token
is passed as a distinct argument, or apply a robust escaping utility before
joining; update the code that constructs restArgs and the subsequent
child_process invocation to use the array form (e.g., keep args.slice(1) as the
arg array) and eliminate join(' ') to ensure safe execution.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/ci.yml:
- Around line 102-115: Remove the restore-keys entry from the "Cache Storybook
build" step (actions/cache@v4) and give that step an id (e.g., id:
storybook-cache) so you can read its outputs.cache-hit; then change the "Build
cpk-ui Storybook" step to rely on the cache-hit output
(steps.storybook-cache.outputs.cache-hit) instead of checking for
../cpk-ui/storybook-static/index.json so a partial restore won't skip a fresh
build. Ensure the cache key remains storybook-${{ steps.cpk-ui-hash.outputs.hash
}} and update the conditional in the build step to run the build when cache-hit
!= 'true'.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 64-78: The Playwright browser cache key can mismatch Playwright
versions; update the workflow to include the Playwright version in the cache key
and restore-keys so cached browsers match the installed `@playwright/test`
version: add a step that determines the Playwright version (e.g., from
package.json or via npx/playwright) and exports it to the environment, then
change the cache step key from playwright-${{ hashFiles('bun.lock') }} to
include that version (e.g., playwright-${{ env.PLAYWRIGHT_VERSION }}-${{
hashFiles('bun.lock') }}) and update restore-keys to playwright-${{
env.PLAYWRIGHT_VERSION }}- so restore only uses same-version caches; keep the
existing install/restore conditionals (steps named "Cache Playwright browsers",
"Install Playwright browsers", "Install Playwright system deps") intact.

In `@scripts/discover-components.ts`:
- Around line 283-298: The interpolated regexes in compPatterns (constructed
using the variable name) are triggering static ReDoS warnings; to fix, validate
the name before interpolation in the code that builds compPatterns (the variable
name used there) by ensuring it matches a JS identifier pattern like
/^[A-Za-z_$][A-Za-z0-9_$]*$/ and only build the RegExp entries when the check
passes (or alternatively escape the name with a safe escape function before
creating RegExp); update the code that constructs compPatterns to perform this
pre-validation (or escaping) so the interpolated values are provably safe to
include in new RegExp(...) calls.

  // Step 1: Discover components
  log('📦', 'Discovering components...');
  exec('npx tsx scripts/discover-components.ts');