Update server.js

server.js

@@ -71,7 +71,9 @@ const RECOMMENDED_CMDS = [
 ];
 const BLOCKED_CMDS = ["sudo","su","reboot","shutdown","mkfs","fdisk"];
 function isSafeCmd(cmd) {
+  if (cmd == null || typeof cmd !== "string") return false;
   const name = cmd.trim().split(/\s+/)[0];
+  if (!name) return false;
   return !BLOCKED_CMDS.includes(name);
 }
 
@@ -162,8 +164,13 @@ const DESTRUCTIVE_PATTERNS = [
 function filterCommands(commands, alreadyRun = []) {
   const safe = [];
   const skipped = [];
-  const runSet = new Set(alreadyRun.map(c => c.trim()));
-  for (const cmd of commands) {
+  const runSet = new Set(alreadyRun.map(c => (typeof c === "string" ? c.trim() : "")));
+  // Normalise input: flatten, unwrap {cmd} objects, drop anything not a string
+  const flat = (Array.isArray(commands) ? commands : [])
+    .flat(3)
+    .map(c => (c != null && typeof c === "object" && typeof c.cmd === "string") ? c.cmd : c)
+    .filter(c => c != null && typeof c === "string");
+  for (const cmd of flat) {
     const trimmed = cmd.trim();
     if (!trimmed) continue;
     if (runSet.has(trimmed)) { skipped.push({ cmd: trimmed, reason: "duplicate" }); continue; }
@@ -235,7 +242,31 @@ function parseJSON(raw) {
   return null;
 }
 
-// ── EXTRACT COMMANDS FROM TEXT ─────────────────────────────────────────────
+// ── SANITIZE AI RESPONSE ───────────────────────────────────────────────────
+// Ensures "commands" is always a flat array of non-empty strings.
+// The AI occasionally returns nulls, objects, nested arrays, or step-label strings.
+function sanitizeAIResponse(parsed) {
+  if (!parsed) return parsed;
+  if (parsed.commands !== undefined) {
+    const raw = Array.isArray(parsed.commands) ? parsed.commands : [];
+    parsed.commands = raw
+      .flat(5)
+      .map(c => {
+        if (c == null) return null;
+        if (typeof c === "string") return c.trim() || null;
+        // Unwrap {cmd: "..."} or {command: "..."} objects
+        if (typeof c === "object") {
+          const v = c.cmd || c.command || c.shell || c.run || c.exec;
+          return typeof v === "string" ? v.trim() || null : null;
+        }
+        return null;
+      })
+      .filter(c => c != null && c.length > 0 && isSafeCmd(c));
+  }
+  return parsed;
+}
+
+
 // When AI returns markdown/prose instead of JSON, pull shell commands from it
 function extractCommandsFromText(text) {
   const cmds = [];
@@ -629,8 +660,13 @@ async function runAgentLoop(opts) {
   // Deduplicates against already-run commands, structures output, guards retries
   const cmdRetryCount = {}; // tracks per-cmd-pattern retry attempts
   async function runBatch(commands) {
+    // Normalise before anything else — AI sometimes returns nulls, objects, nested arrays
+    const normalised = (Array.isArray(commands) ? commands : [])
+      .flat(3)
+      .map(c => (c != null && typeof c === "object" && typeof c.cmd === "string") ? c.cmd : c)
+      .filter(c => c != null && typeof c === "string" && c.trim().length > 0);
     const alreadyRunCmds = allCommandResults.map(r => r.cmd);
-    const { safe, skipped } = filterCommands(commands, alreadyRunCmds);
+    const { safe, skipped } = filterCommands(normalised, alreadyRunCmds);
 
     // Notify about skipped commands so AI sees them in history
     for (const s of skipped) {
@@ -809,10 +845,16 @@ Respond with ONLY raw JSON:
   "commands": ["cp ${filePath} ${filePath}.bak", "..."],
   "reasoning": "what sections you need to read and why",
   "done": false
-}`;
+}
+
+COMMANDS FORMAT RULES — VIOLATIONS WILL CRASH THE SYSTEM:
+- "commands" MUST be a flat array of plain strings only
+- NEVER put null, objects, or nested arrays inside "commands"
+- NEVER omit "commands" — use [] if no commands needed this round
+- Every entry must be a complete, executable bash command string`;
 
   const planRaw = await callAI(planPrompt, "", modelKey, transcript);
-  let plan = parseJSON(planRaw);
+  let plan = sanitizeAIResponse(parseJSON(planRaw));
 
   if (!plan || (!plan.commands && !plan.read_file)) {
     const extracted = extractCommandsFromText(planRaw || "");
@@ -892,10 +934,17 @@ B) Full file rewrite (for major changes like library swaps):
   "reasoning": "why a full rewrite is needed"
 }
 
+COMMANDS FORMAT RULES — VIOLATIONS WILL CRASH THE SYSTEM:
+- "commands" MUST be a flat array of plain strings. Example: ["sed -i '7s/get/head/' bot.js"]
+- NEVER put objects, null, arrays-within-arrays, or non-strings in "commands"
+- NEVER omit "commands" — use [] if you have no commands to run
+- EVERY command must be a complete shell command runnable in bash
+- NEVER include comments, explanations, or step labels inside the commands array
+
 CRITICAL: done:true only when sed -n CONFIRMS the change is physically in the file, OR full_rewrite:true is set.`;
 
     const contRaw = await callAI(continuePrompt, "", modelKey, transcript);
-    let cont = parseJSON(contRaw);
+    let cont = sanitizeAIResponse(parseJSON(contRaw));
 
     if (!cont) {
       const extracted = extractCommandsFromText(contRaw || "");