1 files changed, 29 insertions, 7 deletions
diff --git a/modules/core/terminal.js b/modules/core/terminal.js
index c586538..ad4b105 100644
--- a/modules/core/terminal.js
+++ b/modules/core/terminal.js
@@ -157,7 +157,14 @@
                 return args;
             }
             _classify(raw) {
-                const parts = this._parseArgs(raw.trim());
+                const parts = this._parseArgs(String(raw || '').trim());
+                // `help |` and `| wc -l` produce an empty pipeline stage; parts[0] was undefined
+                // and every such invocation threw TypeError from this line (989 occurrences,
+                // first filed 2026-10-20). Classify the empty command as inert instead.
+                if (!parts.length) {
+                    return { cmd: '', args: [], known: true, destructive: false, system: false,
+                             unknown: false, hasSuspicious: false };
+                }
                 const cmd = parts[0].toLowerCase();
                 const args = parts.slice(1);
                 // Internal commands always allowed at terminal level, but security still classifies
@@ -1532,12 +1539,27 @@
                 return parts;
             }
             async executePipeChain(pipeParts) {
+                // Parse every stage once, then drop the ones with no argv. `help |` splits to
+                // ['help',''], `help | ""` to ['help',''] and `| wc -l` to ['','wc -l'] — all three
+                // produced an empty argv whose parts[0] was undefined and threw TypeError from
+                // parts[0].toLowerCase() (989 occurrences, first filed 2026-10-20). Filtering on
+                // argv (not just the string) also keeps the LAST real stage final, so its output is
+                // never swallowed by a trailing empty segment.
+                const stages = pipeParts
+                    .map(t => this.security._parseArgs(String(t || '').trim()))
+                    .filter(argv => argv.length > 0);
+                if (!stages.length) {
+                    this.print('⚠️ Empty pipeline — nothing to run', 'warning');
+                    return;
+                }
                 let pipeInput = null;
-                for (let i = 0; i < pipeParts.length; i++) {
-                    const cmdText = pipeParts[i];
-                    const parts = this.security._parseArgs(cmdText);
-                    const cmd = parts[0].toLowerCase();
-                    const args = parts.slice(1);
+                for (let i = 0; i < stages.length; i++) {
+                    const argv = stages[i];
+                    const cmd = argv[0].toLowerCase();
+                    const args = argv.slice(1);
+                    // Rebuilt from argv so the security classifier sees the same tokenisation the
+                    // dispatcher will use (quotes already stripped by _parseArgs).
+                    const cmdText = argv.join(' ');
                     // v4.5.67: Security gate for pipe stages — was completely bypassed
                     const cls = this.security._classify(cmdText);
                     if (cls.destructive && this.security.level > 0) {
@@ -1553,7 +1575,7 @@
                         return;
                     }
                     this._pipeInput = pipeInput;
-                    if (i < pipeParts.length - 1) {
+                    if (i < stages.length - 1) {
                         pipeInput = await this.capturePipeOutput(cmd, args);
                     } else {
                         await this.dispatchCommand(cmd, args);