fix: address PR review feedback for JSON fallback

- Simplify escapeXml() using 'str == null' check (type narrowing)
- Add validation for extracted JSON before passing to specToXml()
- Prevents runtime errors when JSON doesn't match SpecOutput schema

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

apps/server/src/lib/app-spec-format.ts

@@ -14,10 +14,10 @@ export { specOutputSchema } from '@automaker/types';
  * Handles undefined/null values by converting them to empty strings
  */
 function escapeXml(str: string | undefined | null): string {
-  if (str === undefined || str === null) {
+  if (str == null) {
     return '';
   }
-  return String(str)
+  return str
     .replace(/&/g, '&')
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;')

apps/server/src/routes/app-spec/generate-spec.ts

@@ -205,7 +205,14 @@ Your entire response should be valid JSON starting with { and ending with }. No
       logger.warn('⚠️ No XML tags found, attempting JSON extraction...');
       const extractedJson = extractJson<SpecOutput>(responseText, { logger });
 
-      if (extractedJson) {
+      if (
+        extractedJson &&
+        typeof extractedJson.project_name === 'string' &&
+        typeof extractedJson.overview === 'string' &&
+        Array.isArray(extractedJson.technology_stack) &&
+        Array.isArray(extractedJson.core_capabilities) &&
+        Array.isArray(extractedJson.implemented_features)
+      ) {
         logger.info('✅ Successfully extracted JSON from response text');
         xmlContent = specToXml(extractedJson);
         logger.info(`✅ Converted extracted JSON to XML: ${xmlContent.length} chars`);