1 files changed, 37 insertions, 8 deletions

diff --git a/modules/core/core-bundle.js b/modules/core/core-bundle.js
index 212573d..67747bf 100644
--- a/modules/core/core-bundle.js
+++ b/modules/core/core-bundle.js
@@ -2609,7 +2609,14 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
                 return args;
             }
             _classify(raw) {
-                const parts = this._parseArgs(raw.trim());
+                const parts = this._parseArgs(String(raw || '').trim());
+                // `help |` and `| wc -l` produce an empty pipeline stage; parts[0] was undefined
+                // and every such invocation threw TypeError from this line (989 occurrences,
+                // first filed 2026-10-20). Classify the empty command as inert instead.
+                if (!parts.length) {
+                    return { cmd: '', args: [], known: true, destructive: false, system: false,
+                             unknown: false, hasSuspicious: false };
+                }
                 const cmd = parts[0].toLowerCase();
                 const args = parts.slice(1);
                 // Internal commands always allowed at terminal level, but security still classifies
@@ -3984,12 +3991,27 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
                 return parts;
             }
             async executePipeChain(pipeParts) {
+                // Parse every stage once, then drop the ones with no argv. `help |` splits to
+                // ['help',''], `help | ""` to ['help',''] and `| wc -l` to ['','wc -l'] — all three
+                // produced an empty argv whose parts[0] was undefined and threw TypeError from
+                // parts[0].toLowerCase() (989 occurrences, first filed 2026-10-20). Filtering on
+                // argv (not just the string) also keeps the LAST real stage final, so its output is
+                // never swallowed by a trailing empty segment.
+                const stages = pipeParts
+                    .map(t => this.security._parseArgs(String(t || '').trim()))
+                    .filter(argv => argv.length > 0);
+                if (!stages.length) {
+                    this.print('⚠️ Empty pipeline — nothing to run', 'warning');
+                    return;
+                }
                 let pipeInput = null;
-                for (let i = 0; i < pipeParts.length; i++) {
-                    const cmdText = pipeParts[i];
-                    const parts = this.security._parseArgs(cmdText);
-                    const cmd = parts[0].toLowerCase();
-                    const args = parts.slice(1);
+                for (let i = 0; i < stages.length; i++) {
+                    const argv = stages[i];
+                    const cmd = argv[0].toLowerCase();
+                    const args = argv.slice(1);
+                    // Rebuilt from argv so the security classifier sees the same tokenisation the
+                    // dispatcher will use (quotes already stripped by _parseArgs).
+                    const cmdText = argv.join(' ');
                     // v4.5.67: Security gate for pipe stages — was completely bypassed
                     const cls = this.security._classify(cmdText);
                     if (cls.destructive && this.security.level > 0) {
@@ -4005,7 +4027,7 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
                         return;
                     }
                     this._pipeInput = pipeInput;
-                    if (i < pipeParts.length - 1) {
+                    if (i < stages.length - 1) {
                         pipeInput = await this.capturePipeOutput(cmd, args);
                     } else {
                         await this.dispatchCommand(cmd, args);
@@ -5820,6 +5842,10 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
                             message: String(e.message || e.msg || '').slice(0, 300),
                             source: String(e.source || e.url || '').slice(0, 200),
                             count: Number(e.count) || 1,
+                            // The stack is the only thing that makes a report actionable; it was
+                            // dropped here while ingest kept it, which is why the 2026-10-20
+                            // `toLowerCase` report could not be localised for three days.
+                            stack: e.stack ? String(e.stack).split('\n').slice(0, 10).join('\n').slice(0, 1200) : null,
                         }));
                     } catch (_e) {}
                     try {
@@ -20332,7 +20358,7 @@ class DebugSupervisorModule {
 
         // v4.6.38 (A5): auto-file fatal/error-class failures, max 3 per day, deduped by hash.
         if (classification.severity === 'fatal' || classification.severity === 'error') {
-            this._maybeAutoFile({ hash, message, source, type: classification.type, severity: classification.severity });
+            this._maybeAutoFile({ hash, message, source, type: classification.type, severity: classification.severity, stack });
         }
     }
 
@@ -20376,6 +20402,9 @@ class DebugSupervisorModule {
                     type: e.type,
                     severity: e.severity,
                     count: 1,
+                    // Auto-filed reports are the majority of the inbox; without the stack they are
+                    // a message with no location (the 2026-10-20 `toLowerCase` report proved it).
+                    stack: e.stack ? String(e.stack).split('\n').slice(0, 10).join('\n').slice(0, 1200) : null,
                 }],
             },
         };