kushi-agents 5.8.2 → 5.8.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kushi-agents",
-  "version": "5.8.2",
+  "version": "5.8.3",
   "description": "Install Kushi — multi-source project evidence agent with Comprehensive Structured Capture (CSC) into weekly-only files across Email, Teams, OneNote, Loop, SharePoint, Meetings, CRM, ADO. Meetings retain a sibling verbatim/ audit folder. WorkIQ-only for M365 sources (Graph / m365_* FORBIDDEN as fallbacks; user-paste is first-class). Host-agnostic.",
   "type": "module",
   "bin": {

package/plugin/runners/lib/workiq.mjs

@@ -59,7 +59,11 @@ export async function ask(prompt, { bin, timeoutMs = 120_000, env = process.env,
     err.code = 'WORKIQ_NOT_FOUND';
     throw err;
   }
-  const { stdout, stderr, exitCode } = await runProcess(exe, ['ask', '-q', prompt], { timeoutMs, env, onHeartbeat, heartbeatMs });
+  // Pass prompt via stdin instead of `-q "<prompt>"` argument. Multi-line prompts
+  // with embedded quotes get mangled by cmd.exe's argument parser even with
+  // windowsVerbatimArguments, causing workiq to receive corrupted input and
+  // hang indefinitely. stdin is a clean byte channel.
+  const { stdout, stderr, exitCode } = await runProcess(exe, ['ask'], { timeoutMs, env, onHeartbeat, heartbeatMs, stdin: prompt });
   if (exitCode !== 0) {
     const err = new Error(`workiq exited ${exitCode}: ${stderr.slice(0, 1000)}`);
     err.code = 'WORKIQ_EXIT_NONZERO';
@@ -117,7 +121,7 @@ function parseKvLines(s) {
 
 async function pathExists(p) { try { await fs.access(p); return true; } catch { return false; } }
 
-function runProcess(exe, args, { timeoutMs, env, onHeartbeat = null, heartbeatMs = 10_000 }) {
+function runProcess(exe, args, { timeoutMs, env, onHeartbeat = null, heartbeatMs = 10_000, stdin = null }) {
   return new Promise((resolve, reject) => {
     // Node 20.12+ refuses to spawn .cmd/.bat on Windows without shell:true
     // (CVE-2024-27980). Detect and route through cmd.exe explicitly with
@@ -133,6 +137,10 @@ function runProcess(exe, args, { timeoutMs, env, onHeartbeat = null, heartbeatMs
       spawnOpts.windowsVerbatimArguments = true;
     }
     const child = spawn(spawnExe, spawnArgs, spawnOpts);
+    if (stdin != null) {
+      try { child.stdin.write(stdin); child.stdin.end(); }
+      catch (e) { /* if stdin already closed, child error handler will catch */ }
+    }
     let stdout = '';
     let stderr = '';
     let stdoutBytes = 0;