fix: address review — PostHog key comment, flushTimer cleanup, TOCTOU, type guard

packages/core/src/studio-api/helpers/sourceMutation.ts

@@ -55,6 +55,11 @@ export function removeElementFromHtml(source: string, target: SourceMutationTarg
   return wrappedFragment ? document.body.innerHTML || "" : document.toString();
 }
 
+function isHTMLElement(el: Element): boolean {
+  const HTMLEl = el.ownerDocument.defaultView?.HTMLElement;
+  return HTMLEl ? el instanceof HTMLEl : "style" in el;
+}
+
 export interface PatchOperation {
   type: "inline-style" | "attribute" | "html-attribute" | "text-content";
   property: string;
@@ -68,7 +73,7 @@ export function patchElementInHtml(
 ): string {
   const { document, wrappedFragment } = parseSourceDocument(source);
   const el = findTargetElement(document, target);
-  if (!el || !(el instanceof (el.ownerDocument.defaultView?.HTMLElement ?? Element))) return source;
+  if (!el || !isHTMLElement(el)) return source;
   const htmlEl = el as unknown as HTMLElement;
 
   for (const op of operations) {

packages/studio/src/utils/studioTelemetry.ts

@@ -1,3 +1,4 @@
+// PostHog public ingest key — write-only, safe to ship in the client bundle
 const POSTHOG_API_KEY = "phc_zjjbX0PnWxERXrMHhkEJWj9A9BhGVLRReICgsfTMmpx";
 const POSTHOG_HOST = "https://us.i.posthog.com";
 const FLUSH_INTERVAL_MS = 30_000;
@@ -101,10 +102,13 @@ async function flushEvents(): Promise<void> {
   }
 }
 
-// Flush on page unload so we don't lose the last batch
 if (typeof window !== "undefined") {
   window.addEventListener("visibilitychange", () => {
     if (document.visibilityState === "hidden") {
+      if (flushTimer) {
+        clearInterval(flushTimer);
+        flushTimer = null;
+      }
       if (queue.length === 0) return;
       const batch = queue.map((e) => ({
         event: e.event,