fix security

chat/public/builder.js

@@ -16,7 +16,27 @@ function loadBuilderState() {
   return null;
 }
 
+let builderStateSaveTimer = null;
+let pendingBuilderState = null;
+
 function saveBuilderState(state) {
+  pendingBuilderState = state;
+  if (builderStateSaveTimer) {
+    clearTimeout(builderStateSaveTimer);
+  }
+  builderStateSaveTimer = setTimeout(() => {
+    try {
+      if (pendingBuilderState) {
+        localStorage.setItem(BUILDER_STATE_KEY, JSON.stringify(pendingBuilderState));
+      }
+    } catch (e) {
+      console.warn('Failed to save builder state:', e);
+    }
+    builderStateSaveTimer = null;
+  }, 500); // Debounce 500ms
+}
+
+function saveBuilderStateImmediate(state) {
   try {
     localStorage.setItem(BUILDER_STATE_KEY, JSON.stringify(state));
   } catch (e) {
@@ -36,7 +56,7 @@ const builderState = savedState || {
   externalTestingEnabled: false
 };
 
-// Auto-save builderState changes to localStorage
+// Auto-save builderState changes to localStorage with debouncing
 const builderStateProxy = new Proxy(builderState, {
   set(target, prop, value) {
     target[prop] = value;
@@ -61,7 +81,7 @@ window.clearBuilderState = function() {
     subsequentPrompt: preservedSubsequentPrompt
   };
   Object.assign(builderState, resetState);
-  saveBuilderState(builderState);
+  saveBuilderStateImmediate(builderState);
   console.log('[BUILDER] Builder state cleared');
 };