[djleamen]

Summary

Two small, self-contained correctness fixes found during a cross-repo maintenance review. No behavior change on the normal (online) path.

1. Offline benzene fallback drew bonds between the wrong atoms

createBenzene() in src/utils/moleculeParser.ts built the atoms array interleaved (C0, H6, C1, H7, …), so carbon i landed at array index 2*i. But the bond list references atoms by array index (atomIndex1: i, atomIndex2: i + 6), and Molecule3DComponent consumes those indices directly (centeredAtoms[bond.atomIndex1]). The result: every bond in the offline benzene fallback was drawn between the wrong atoms (e.g. the C0–C1 bond went from C0 to H6). All the other fallbacks use sequential ids where id === index, so only benzene was affected.

Fix: push all six carbons first, then all six hydrogens, so each atom's array index matches the index the bond list references. Coordinates and bond orders are unchanged.

2. Corrupted localStorage could white-screen the app

loadHistory() / loadFavourites() in src/utils/storage.ts only guarded JSON.parse in their try/catch. A value that is valid JSON but not an array (e.g. {} after tampering or a schema change) was returned as MoleculeEntry[], then crashed at render when useFavourites/useMoleculeHistory called .some/.filter/.map on it. Now the parsed value's shape is validated and a non-array falls back to [].

Testing

• tsc --noEmit — passes
• eslint on both changed files — passes (0 warnings)

Notes

The scan also flagged a stale-closure history entry in App.tsx and a per-hover console.log in AtomTooltip.tsx; both are cosmetic and left out to keep this PR to correctness fixes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRqVTYbgdzZKc9kB55P8w4

---

Generated by Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[Copilot]

🟢 Approval recommended

The changes are small, self-contained, and directly address confirmed correctness issues without introducing new external dependencies or behavioral changes on the normal path.

Pull request overview

This PR applies two small correctness fixes in core utilities: it corrects atom indexing in the offline benzene fallback so bonds render between the intended atoms, and it hardens localStorage history/favourites loading against non-array JSON values to prevent runtime crashes.

Changes:

• Fix offline benzene atom ordering so bond indices align with the atoms array indices.
• Validate parsed localStorage values are arrays before returning them from loadHistory() / loadFavourites().

File summaries

File	Description
src/utils/storage.ts	Ensures parsed localStorage values are arrays (otherwise returns []) to avoid .map/.filter/.some crashes on non-arrays.
src/utils/moleculeParser.ts	Reorders benzene atom construction (carbons first, then hydrogens) so bond indices reference the intended atoms in the offline fallback.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[djleamen]

The SonarCloud Code Analysis check is failing its Quality Gate on one condition: "B Security Rating on New Code" (required ≥ A). All other checks (Node.js CI, Dependency Review, Copilot review) are green.

I wasn't able to pin down the specific finding from this environment:

• sonarcloud.io is unreachable here (blocked by the network egress proxy), so I can't open the dashboard or query the issues API.
• The failed check run exposes no output.text and no inline annotations, and SonarCloud runs as an app integration (not a GitHub Actions workflow), so there are no job logs to inspect either.

Reviewing the diff itself, I don't see a security vulnerability introduced by this PR. The two changes are:

1. createBenzene() — reordering two loops so atom array indices line up with the bond list (pure logic reorder, no new APIs).
2. loadHistory() / loadFavourites() — adding an Array.isArray(...) guard around the pre-existing JSON.parse(localStorage.getItem(...)) (my edit touches that line, which likely re-dates it as "new code" for the gate).

Could you take a look at the finding on the SonarCloud dashboard? If it's the JSON.parse line being re-flagged as new code (or a rule you're comfortable accepting), it can be marked accordingly there; if it points to a genuine issue in the diff I've missed, tell me the rule/line and I'll push a fix. I'll keep watching this PR.

---

Generated by Claude Code