kiro-spec-engine 1.45.10 → 1.45.12

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.45.12] - 2026-02-13
+
+### Fixed
+- **Windows prompt validation**: `AgentSpawner.spawn()` now validates `stdinPrompt` after `finalArgs.pop()` to ensure it's a non-empty string before writing to temp file, preventing undefined/null values from causing silent failures (fixes issue where bootstrap prompt generation failures weren't caught, leading to empty temp files and `error: unexpected argument` errors)
+
+## [1.45.11] - 2026-02-13
+
+### Fixed
+- **Windows filename special characters**: `AgentSpawner.spawn()` now sanitizes agentId by removing Windows reserved characters `[:<>"|?*]` before using in temp file path, fixing file path parsing errors when agentId contains colon (e.g., `"zeno-v4-uuid:1"` format)
+
 ## [1.45.10] - 2026-02-13
 
 ### Fixed

package/lib/orchestrator/agent-spawner.js

@@ -119,6 +119,16 @@ class AgentSpawner extends EventEmitter {
       // Remove the prompt (last element of args portion) from command line
       // and deliver it via stdin to avoid cmd.exe length limit.
       stdinPrompt = finalArgs.pop(); // remove prompt
+      
+      // Validate stdinPrompt before proceeding
+      if (!stdinPrompt || typeof stdinPrompt !== 'string' || stdinPrompt.length === 0) {
+        throw new Error(
+          `Invalid bootstrap prompt: expected non-empty string, got ${typeof stdinPrompt} ` +
+          `with length ${stdinPrompt ? stdinPrompt.length : 0}. ` +
+          `This may indicate BootstrapPromptBuilder.buildPrompt() failed or args array is malformed.`
+        );
+      }
+      
       // If the prompt was quoted by the escaping above, unwrap it
       if (stdinPrompt.startsWith('"') && stdinPrompt.endsWith('"')) {
         stdinPrompt = stdinPrompt.slice(1, -1).replace(/\\"/g, '"');
@@ -134,7 +144,9 @@ class AgentSpawner extends EventEmitter {
     // write prompt → pass file path via shell read.
     let promptTmpFile = null;
     if (useStdinPrompt) {
-      promptTmpFile = path.join(os.tmpdir(), `kse-prompt-${agentId}-${Date.now()}.txt`);
+      // Sanitize agentId for use in filename - remove Windows reserved characters: < > : " | ? *
+      const safeAgentId = agentId.replace(/[:<>"|?*]/g, '-');
+      promptTmpFile = path.join(os.tmpdir(), `kse-prompt-${safeAgentId}-${Date.now()}.txt`);
       fs.writeFileSync(promptTmpFile, stdinPrompt, 'utf-8');
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiro-spec-engine",
-  "version": "1.45.10",
+  "version": "1.45.12",
   "description": "kiro-spec-engine (kse) - A CLI tool and npm package for spec-driven development with AI coding assistants. NOT the Kiro IDE desktop application.",
   "main": "index.js",
   "bin": {