fix(hardening): defensive JSON.parse in undo restore() + interval-handle cleanup + parameter_memory DB row guards

3 CRIT defects (would crash entire LiteGraph canvas on corrupted widget data):
- js/spline_mask_tracker.js: restore() now try/catches malformed snapshots, validates shape
- js/points_bbox_editor.js:  same defensive pattern in restore()
- js/spline_mask_editor.js:  same defensive pattern in restore()

2 HIGH memory leaks (interval kept polling after page unload):
- js/mec_complexity_hud.js: setInterval handle stored + cleared on beforeunload
- js/mec_token_counter.js:  setInterval handle stored + cleared on beforeunload

2 HIGH DB hazards (one corrupted row would abort entire history query):
- nodes/parameter_memory.py: try/catch json.loads in _get_history and _diff_runs;
  malformed rows are now skipped with a warning instead of crashing the node.

Author: Code2Collapse

js/mec_complexity_hud.js

@@ -165,8 +165,12 @@ app.registerExtension({
         _update();
 
         // Periodic safety refresh — in case some custom op mutates the graph
-        // without going through the hooked methods.
-        setInterval(_update, 2000);
+        // without going through the hooked methods. Store the handle so the
+        // interval can be torn down (e.g. on hot-reload of the extension or
+        // when the page navigates away).
+        const _t = setInterval(_update, 2000);
+        window.addEventListener("beforeunload", () => clearInterval(_t), { once: true });
+        window.__MEC_COMPLEXITY_HUD_INTERVAL = _t;
 
         console.log("[MEC.ComplexityHUD] Loaded.");
     },

js/mec_token_counter.js

@@ -175,7 +175,10 @@ app.registerExtension({
     async setup() {
         _injectStyle();
         _scanAll();
-        setInterval(_scanAll, 4000);  // catch nodes added by graph load
+        // Store the handle so the interval can be torn down on page unload.
+        const _t = setInterval(_scanAll, 4000);  // catch nodes added by graph load
+        window.addEventListener("beforeunload", () => clearInterval(_t), { once: true });
+        window.__MEC_TOKEN_COUNTER_INTERVAL = _t;
         console.log("[MEC.TokenCounter] Loaded.");
     },
 });

js/points_bbox_editor.js

@@ -111,7 +111,15 @@ class Editor {
         if (this.undoStack.length > HISTORY_LIMIT) this.undoStack.shift();
         this.redoStack.length = 0;
     }
-    restore(s) { const o = JSON.parse(s); this.points = o.p || []; this.bboxes = o.b || []; }
+    restore(s) {
+        // Defensive: corrupted snapshot would crash entire canvas.
+        let o;
+        try { o = JSON.parse(s); }
+        catch (e) { console.warn("[MEC.PointsBBoxEditor] restore: malformed snapshot, ignored", e); return; }
+        if (!o) return;
+        this.points = Array.isArray(o.p) ? o.p : [];
+        this.bboxes = Array.isArray(o.b) ? o.b : [];
+    }
     undo() {
         if (!this.undoStack.length) return false;
         this.redoStack.push(this.snapshot());

js/spline_mask_editor.js

@@ -93,9 +93,13 @@ class Editor {
         this.redoStack.length = 0;
     }
     restore(s) {
-        const o = JSON.parse(s);
-        this.shapes = o.s || [];
-        this.active = o.a ?? -1;
+        // Defensive: corrupted snapshot would crash entire canvas.
+        let o;
+        try { o = JSON.parse(s); }
+        catch (e) { console.warn("[MEC.SplineMaskEditor] restore: malformed snapshot, ignored", e); return; }
+        if (!o) return;
+        this.shapes = Array.isArray(o.s) ? o.s : [];
+        this.active = Number.isFinite(o.a) ? o.a : -1;
     }
     undo() {
         if (!this.undoStack.length) return false;

js/spline_mask_tracker.js

@@ -108,11 +108,21 @@ class TrackerState {
         this.redoStack.length = 0;
     }
     restore(s) {
-        const o = JSON.parse(s);
-        this.keyframes = new Map(o.k.map(([f, pts]) =>
-            [Number(f), pts.map(p => ({ x: +p.x, y: +p.y }))]
-        ));
-        this.curFrame = o.f ?? 0;
+        // Guard: undo/redo snapshots are produced by snapshot() so they
+        // SHOULD be valid JSON, but a corrupted widget value or a runaway
+        // dev-tools manipulation would crash the entire LiteGraph canvas.
+        let o;
+        try { o = JSON.parse(s); }
+        catch (e) { console.warn("[MEC.SplineMaskTracker] restore: malformed snapshot, ignored", e); return; }
+        if (!o || !Array.isArray(o.k)) return;
+        try {
+            this.keyframes = new Map(o.k.map(([f, pts]) =>
+                [Number(f), (pts || []).map(p => ({ x: +p.x, y: +p.y }))]
+            ));
+            this.curFrame = Number(o.f) || 0;
+        } catch (e) {
+            console.warn("[MEC.SplineMaskTracker] restore: malformed snapshot shape, ignored", e);
+        }
     }
     undo() {
         if (!this.undoStack.length) return false;

nodes/parameter_memory.py

@@ -141,10 +141,20 @@ def _query_history(node_class: str = "", last_n_runs: int = 10) -> list[dict]:
 
         results = []
         for r in rows:
+            # Defensive: a corrupted delta_json row would otherwise abort the
+            # entire history query. Skip the bad row and log it.
+            try:
+                delta = json.loads(r[5])
+            except (json.JSONDecodeError, TypeError) as e:
+                logger.warning(
+                    f"[MEC] param_history: dropping row ts={r[0]} run_id={r[1]} "
+                    f"node_id={r[2]} with malformed delta_json ({e})"
+                )
+                continue
             results.append({
                 "ts": r[0], "run_id": r[1], "node_id": r[2],
                 "node_title": r[3], "node_class": r[4],
-                "delta": json.loads(r[5]),
+                "delta": delta,
             })
         return results
     except Exception as e:
@@ -165,9 +175,17 @@ def _get_run_deltas(rid):
             ).fetchall()
             nodes = {}
             for r in rows:
+                try:
+                    delta = json.loads(r[3])
+                except (json.JSONDecodeError, TypeError) as e:
+                    logger.warning(
+                        f"[MEC] _diff_runs: dropping node_id={r[0]} with "
+                        f"malformed delta_json ({e})"
+                    )
+                    continue
                 nodes[r[0]] = {
                     "node_id": r[0], "node_title": r[1],
-                    "node_class": r[2], "delta": json.loads(r[3]),
+                    "node_class": r[2], "delta": delta,
                 }
             return nodes