kiro-spec-engine 1.45.9 → 1.45.11

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.45.11] - 2026-02-13
+
+### Fixed
+- **Windows filename special characters**: `AgentSpawner.spawn()` now sanitizes agentId by removing Windows reserved characters `[:<>"|?*]` before using in temp file path, fixing file path parsing errors when agentId contains colon (e.g., `"zeno-v4-uuid:1"` format)
+
+## [1.45.10] - 2026-02-13
+
+### Fixed
+- **Windows prompt temp file write failure**: `AgentSpawner.spawn()` now performs shell argument escaping BEFORE extracting prompt from finalArgs, fixing empty temp file issue (0 bytes) that caused `error: unexpected argument 'Spec' found` in v1.45.9
+
 ## [1.45.9] - 2026-02-13
 
 ### Fixed

package/lib/orchestrator/agent-spawner.js

@@ -104,17 +104,6 @@ class AgentSpawner extends EventEmitter {
     let stdinPrompt = null;
     const finalArgs = [...prependArgs, ...args];
 
-    if (isWindows) {
-      // Remove the prompt (last element of args portion) from command line
-      // and deliver it via stdin to avoid cmd.exe length limit.
-      stdinPrompt = finalArgs.pop(); // remove prompt
-      // If the prompt was quoted by the escaping below, unwrap it
-      if (stdinPrompt.startsWith('"') && stdinPrompt.endsWith('"')) {
-        stdinPrompt = stdinPrompt.slice(1, -1).replace(/\\"/g, '"');
-      }
-      useStdinPrompt = true;
-    }
-
     // When shell: true, Node.js concatenates args into a single string without
     // escaping. Arguments containing spaces must be quoted so the shell does
     // not split them into separate tokens.
@@ -126,6 +115,17 @@ class AgentSpawner extends EventEmitter {
       }
     }
 
+    if (isWindows) {
+      // Remove the prompt (last element of args portion) from command line
+      // and deliver it via stdin to avoid cmd.exe length limit.
+      stdinPrompt = finalArgs.pop(); // remove prompt
+      // If the prompt was quoted by the escaping above, unwrap it
+      if (stdinPrompt.startsWith('"') && stdinPrompt.endsWith('"')) {
+        stdinPrompt = stdinPrompt.slice(1, -1).replace(/\\"/g, '"');
+      }
+      useStdinPrompt = true;
+    }
+
     const env = { ...process.env, [apiKeyEnvVar]: apiKey };
 
     // When using stdin for the prompt, write it to a temp file and pass
@@ -134,7 +134,9 @@ class AgentSpawner extends EventEmitter {
     // write prompt → pass file path via shell read.
     let promptTmpFile = null;
     if (useStdinPrompt) {
-      promptTmpFile = path.join(os.tmpdir(), `kse-prompt-${agentId}-${Date.now()}.txt`);
+      // Sanitize agentId for use in filename - remove Windows reserved characters: < > : " | ? *
+      const safeAgentId = agentId.replace(/[:<>"|?*]/g, '-');
+      promptTmpFile = path.join(os.tmpdir(), `kse-prompt-${safeAgentId}-${Date.now()}.txt`);
       fs.writeFileSync(promptTmpFile, stdinPrompt, 'utf-8');
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiro-spec-engine",
-  "version": "1.45.9",
+  "version": "1.45.11",
   "description": "kiro-spec-engine (kse) - A CLI tool and npm package for spec-driven development with AI coding assistants. NOT the Kiro IDE desktop application.",
   "main": "index.js",
   "bin": {