fix: guard JSON parse and validate Claude tool output in quality-check route

app/api/incidents/ai/quality-check/route.ts

@@ -9,7 +9,12 @@ export async function POST(request: NextRequest) {
   const { data: { user }, error: authError } = await supabase.auth.getUser()
   if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const body = await request.json() as { description?: string; incident_type?: string }
+  let body: { description?: string; incident_type?: string }
+  try {
+    body = await request.json()
+  } catch {
+    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
+  }
   if (!body.description || !body.incident_type) {
     return NextResponse.json({ error: 'description and incident_type required' }, { status: 422 })
   }
@@ -53,5 +58,19 @@ Score 1–10 based on: specificity (location, time, persons involved), completen
     return NextResponse.json({ error: 'AI assessment failed' }, { status: 500 })
   }
 
-  return NextResponse.json(toolBlock.input)
+  const input = toolBlock.input as {
+    score?: unknown
+    passes?: unknown
+    feedback?: unknown
+    suggestions?: unknown
+  }
+  if (
+    typeof input.score !== 'number' ||
+    typeof input.passes !== 'boolean' ||
+    typeof input.feedback !== 'string' ||
+    !Array.isArray(input.suggestions)
+  ) {
+    return NextResponse.json({ error: 'AI returned unexpected structure' }, { status: 500 })
+  }
+  return NextResponse.json(input)
 }