fix: address remaining PR review findings (bash 3.2 compat, has_jq regression, JSON escaping)

- Fix has_jq regression in create-new-feature.sh: the script does not
  source common.sh, so replace has_jq with inline command -v jq check
- Replace declare -A with linear array in update-agent-context.sh for
  bash 3.2 compatibility (macOS ships bash 3.2 by default)
- Add json_escape() helper and apply to all printf JSON fallback paths
  in check-prerequisites.sh, setup-plan.sh, and create-new-feature.sh
- Use printf '%q' for branch name in stdout text-mode output for
  consistency with the stderr persistence hint

Author: pierluigilenoci

scripts/bash/check-prerequisites.sh

@@ -99,7 +99,7 @@ if $PATHS_ONLY; then
                 '{REPO_ROOT:$repo_root,BRANCH:$branch,FEATURE_DIR:$feature_dir,FEATURE_SPEC:$feature_spec,IMPL_PLAN:$impl_plan,TASKS:$tasks}'
         else
             printf '{"REPO_ROOT":"%s","BRANCH":"%s","FEATURE_DIR":"%s","FEATURE_SPEC":"%s","IMPL_PLAN":"%s","TASKS":"%s"}\n' \
-                "$REPO_ROOT" "$CURRENT_BRANCH" "$FEATURE_DIR" "$FEATURE_SPEC" "$IMPL_PLAN" "$TASKS"
+                "$(json_escape "$REPO_ROOT")" "$(json_escape "$CURRENT_BRANCH")" "$(json_escape "$FEATURE_DIR")" "$(json_escape "$FEATURE_SPEC")" "$(json_escape "$IMPL_PLAN")" "$(json_escape "$TASKS")"
         fi
     else
         echo "REPO_ROOT: $REPO_ROOT"
@@ -171,7 +171,7 @@ if $JSON_MODE; then
             json_docs=$(printf '"%s",' "${docs[@]}")
             json_docs="[${json_docs%,}]"
         fi
-        printf '{"FEATURE_DIR":"%s","AVAILABLE_DOCS":%s}\n' "$FEATURE_DIR" "$json_docs"
+        printf '{"FEATURE_DIR":"%s","AVAILABLE_DOCS":%s}\n' "$(json_escape "$FEATURE_DIR")" "$json_docs"
     fi
 else
     # Text output

scripts/bash/common.sh

@@ -160,6 +160,18 @@ has_jq() {
     command -v jq >/dev/null 2>&1
 }
 
+# Escape a string for safe embedding in a JSON value (fallback when jq is unavailable).
+# Handles backslash, double-quote, and control characters (newline, tab, carriage return).
+json_escape() {
+    local s="$1"
+    s="${s//\\/\\\\}"
+    s="${s//\"/\\\"}"
+    s="${s//$'\n'/\\n}"
+    s="${s//$'\t'/\\t}"
+    s="${s//$'\r'/\\r}"
+    printf '%s' "$s"
+}
+
 check_file() { [[ -f "$1" ]] && echo "  ✓ $2" || echo "  ✗ $2"; }
 check_dir() { [[ -d "$1" && -n $(ls -A "$1" 2>/dev/null) ]] && echo "  ✓ $2" || echo "  ✗ $2"; }
 

scripts/bash/create-new-feature.sh

@@ -162,6 +162,17 @@ clean_branch_name() {
     echo "$name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/-\+/-/g' | sed 's/^-//' | sed 's/-$//'
 }
 
+# Escape a string for safe embedding in a JSON value (fallback when jq is unavailable).
+json_escape() {
+    local s="$1"
+    s="${s//\\/\\\\}"
+    s="${s//\"/\\\"}"
+    s="${s//$'\n'/\\n}"
+    s="${s//$'\t'/\\t}"
+    s="${s//$'\r'/\\r}"
+    printf '%s' "$s"
+}
+
 # Resolve repository root. Prefer git information when available, but fall back
 # to searching for repository markers so the workflow still functions in repositories that
 # were initialised with --no-git.
@@ -304,18 +315,18 @@ if [ -f "$TEMPLATE" ]; then cp "$TEMPLATE" "$SPEC_FILE"; else touch "$SPEC_FILE"
 printf '# To persist: export SPECIFY_FEATURE=%q\n' "$BRANCH_NAME" >&2
 
 if $JSON_MODE; then
-    if has_jq; then
+    if command -v jq >/dev/null 2>&1; then
         jq -cn \
             --arg branch_name "$BRANCH_NAME" \
             --arg spec_file "$SPEC_FILE" \
             --arg feature_num "$FEATURE_NUM" \
             '{BRANCH_NAME:$branch_name,SPEC_FILE:$spec_file,FEATURE_NUM:$feature_num}'
     else
-        printf '{"BRANCH_NAME":"%s","SPEC_FILE":"%s","FEATURE_NUM":"%s"}\n' "$BRANCH_NAME" "$SPEC_FILE" "$FEATURE_NUM"
+        printf '{"BRANCH_NAME":"%s","SPEC_FILE":"%s","FEATURE_NUM":"%s"}\n' "$(json_escape "$BRANCH_NAME")" "$(json_escape "$SPEC_FILE")" "$(json_escape "$FEATURE_NUM")"
     fi
 else
     echo "BRANCH_NAME: $BRANCH_NAME"
     echo "SPEC_FILE: $SPEC_FILE"
     echo "FEATURE_NUM: $FEATURE_NUM"
-    echo "# To persist in your shell: export SPECIFY_FEATURE=$BRANCH_NAME"
+    printf '# To persist in your shell: export SPECIFY_FEATURE=%q\n' "$BRANCH_NAME"
 fi

scripts/bash/setup-plan.sh

@@ -61,7 +61,7 @@ if $JSON_MODE; then
             '{FEATURE_SPEC:$feature_spec,IMPL_PLAN:$impl_plan,SPECS_DIR:$specs_dir,BRANCH:$branch,HAS_GIT:$has_git}'
     else
         printf '{"FEATURE_SPEC":"%s","IMPL_PLAN":"%s","SPECS_DIR":"%s","BRANCH":"%s","HAS_GIT":"%s"}\n' \
-            "$FEATURE_SPEC" "$IMPL_PLAN" "$FEATURE_DIR" "$CURRENT_BRANCH" "$HAS_GIT"
+            "$(json_escape "$FEATURE_SPEC")" "$(json_escape "$IMPL_PLAN")" "$(json_escape "$FEATURE_DIR")" "$(json_escape "$CURRENT_BRANCH")" "$(json_escape "$HAS_GIT")"
     fi
 else
     echo "FEATURE_SPEC: $FEATURE_SPEC"

scripts/bash/update-agent-context.sh

@@ -688,19 +688,23 @@ update_specific_agent() {
 
 update_all_existing_agents() {
     local found_agent=false
-    declare -A updated_paths
+    _updated_paths=()
 
     # Helper: skip non-existent files and files already updated (dedup by
     # realpath so that variables pointing to the same file — e.g. AMP_FILE,
     # KIRO_FILE, BOB_FILE all resolving to AGENTS_FILE — are only written once).
+    # Uses a linear array instead of associative array for bash 3.2 compatibility.
     update_if_new() {
         local file="$1" name="$2"
         [[ -f "$file" ]] || return 0
         local real_path
         real_path=$(realpath "$file" 2>/dev/null || echo "$file")
-        [[ -z "${updated_paths[$real_path]+x}" ]] || return 0
+        local p
+        for p in ${_updated_paths[@]+"${_updated_paths[@]}"}; do
+            [[ "$p" == "$real_path" ]] && return 0
+        done
         update_agent_file "$file" "$name" || return 1
-        updated_paths["$real_path"]=1
+        _updated_paths+=("$real_path")
         found_agent=true
     }