## Summary A detailed code review of the modeler module was carried out after the recent large refactoring, covering the PHP plugin code (`src/`) and the React/TypeScript UI (`ui/src/`). The review looked for dead code, redundant code, inefficient structures, security issues, memory leaks, and other quality problems. This issue tracks the resulting fixes. ## Findings addressed ### Memory leaks (React hooks) Several hooks attached document listeners, timers, or abort controllers without tearing them down on unmount. Added unmount cleanup to: - `useControlPointDrag`, `useEndpointDrag`, `usePanelResize`, `useVerticalPanelResize` — stray `mousemove`/`mouseup` document listeners removed on unmount (drag abandoned mid-gesture). - `useReplayLoader`, `useConfigurationLoader` — pending `AbortController` aborted on unmount. - `useReplayCoordination`, `useStatusAnnouncer` — outstanding timeouts cleared on unmount; corrected a timer type to `ReturnType<typeof setTimeout>`. ### State management (Zustand stores) - `useHistoryStore`: undo/redo snapshots used shallow array spreads, pinning deleted nodes' large `configuration` objects (and edges' `replayData`) in memory across up to 50 snapshots. Snapshots now break structural sharing via a guarded `structuredClone` of the heavy plain-data fields while preserving edge callback props. The 50-entry cap is unchanged. - `useErrorStore`: the error log grew unbounded; it is now capped using the existing `MAX_ERROR_LOG_SIZE` constant. - `usePanelStore`: `setPropertyPanelCollapsed` did not persist to localStorage like every sibling setter, so the collapsed state was lost on reload (it is used in `Flow.tsx`). Persistence restored. - `useSelectionStore`: removed genuinely dead multi-selection API (`addToSelectedNodes`, `removeFromSelectedNodes`, `addToSelectedEdges`, `removeFromSelectedEdges`), the unused `lastSelectionSource` state/setter, and the unused `SelectionSource` type, plus their now-obsolete tests (verified unused outside the store's own test). ### Security hardening (utils) - Added a shared `safeJsonParse` helper (JSON.parse reviver that drops `__proto__`/`constructor`/`prototype` keys) and applied it to untrusted JSON parsing in `clipboardUtils`, `tokenUtils` (drag data), and `modelUtils` (model-data string) to defend against prototype pollution. - `tokenUtils.convertHTMLToTokens` now sanitizes with `sanitizeTokenHtml` before assigning to `innerHTML`. - `svgExport.escapeXml` now also escapes single quotes for safe single-quoted XML attribute values. ### PHP (WorkflowModeler / src) - Replaced the `\Drupal::service()` service-locator call with the base class's sanctioned `getContainer()->get()` getter injection (constructor injection is not possible because `ModelerBase` declares `__construct()`/`create()` as final by design). - Added `JSON_THROW_ON_ERROR` to all three `json_encode()` calls so failures throw instead of silently returning `false`. - Removed a dead/confusing `$edgeId` reassignment. - Added an `is_array()` guard on the decoded `contextConfig` query parameter. ### Components (performance / dead code) - Added `React.memo` to `NodePropertiesPanel`, `MultiSelectionPanel`, `YamlEditor`, and `TokenPicker` to prevent cascading re-renders from the property panel. (`PlaceholderNode` was already memoized; `SearchBar`/`StartFlowFilter` already use narrow store selectors.) - Marked two no-longer-consumed props (`onNodeUpdate`, `onReplayEntriesLoaded`) as `@deprecated` in place rather than removing them, since external callers and tests still pass them. ### Build break (regression found and fixed during verification) The `useHistoryStore` fix introduced a generic arrow function `const cloneHeavy = <T>(...)`. The esbuild build loads `.ts` files with the TSX loader (`--loader:.ts=tsx`), which parses bare `<T>` as a JSX element and fails the build, leaving a stale bundle. Fixed by using the TSX-safe `<T,>` form (behavior-identical). Note: lint, `tsc --noEmit`, and Jest all passed because they use TypeScript's `.ts` parser; only the esbuild build surfaced this. The build is now part of the verification gate. ## Verification - ESLint: 0 errors. - TypeScript: `tsc --noEmit` passes. - Jest: 3387 tests / 116 suites pass. - Build: `npm run build` and `npm run build:production` both succeed with freshly generated bundles.