Conversation
Sets up the base project structure mirroring sisques-labs/daysoff: Astro/React/Tailwind, TS strict, ESLint/Prettier, Husky hooks, Docker (nginx) build, and the shared sisques-labs/workflows CI/CodeQL/PR-labeler/ release-train GitHub Actions. Landing page is an empty tools list with theme toggle and es/en language switcher, ready for individual tools to be added as new routes.
Restructures src/ to mirror sisques-labs/gardenia-web's conventions, adapted to a backend-less static Astro site: src/core/<feature>/ per feature (domain/application/infrastructure/presentation layers, added only as needed) and src/shared/ for cross-cutting chrome (app-shell, theme/locale providers, i18n plumbing, global styles). Adds the `@/*` path alias, Vitest + React Testing Library with a global jsdom environment, and unit/component tests (i18n parity, ThemeToggle, LanguageSwitcher, AppShell, HomeScreen). Adds AGENTS.md/CLAUDE.md documenting the architecture, naming, testing, and i18n conventions for future work.
chore: scaffold Astro + React + Tailwind base project
github-actions
Bot
added
documentation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Pure, unit-tested business logic for the 12 toolbox utilities (case conversion, slug, lorem ipsum, JSON, YAML, Base64, JWT decode, MD5/SHA hashing, UUID, password generation, timestamp conversion, subnet calculation).
…kboxField, Badge Reusable UI primitives for the toolbox panels, matching the existing Tailwind slate/indigo styling conventions.
en/es dictionary for the toolbox, tool icons, the sidebar navigation with search/filter, the header (reusing the existing theme toggle and language switcher), toast, and the shared panel frame/result-row layout pieces.
One panel per utility, each wiring its use-case to local state and the shared UI primitives.
Composes the sidebar, header, toast and per-tool panels into the full app, driven by locale/theme from the shared providers.
Renders ToolboxScreen from index.astro instead of the placeholder home page, removes the now-obsolete home feature and its unused AppShell, and updates AGENTS.md's architecture note accordingly.
Adds src/pages/[lang]/index.astro (mirroring gardenia-web's locale segment) that seeds ToolboxScreen with an initialLocale so the page renders in the URL's language on first paint. The unprefixed / keeps serving DEFAULT_LOCALE with the existing in-app toggle. LocaleProvider now accepts an initialLocale prop and skips its stored/browser-language auto-detection when one is given, since the URL is the source of truth on those pages.
Feature/design import toolbox
A production optimizeDeps cache left jsxDEV undefined, so the React island never hydrated and every button was inert in astro dev. Co-authored-by: Cursor <cursoragent@cursor.com>
fix(dev): restore React hydration so buttons work
Provide percent-encoding for query strings and paths without leaving the browser. Co-authored-by: Cursor <cursoragent@cursor.com>
Make it easy to escape and unescape HTML special characters in the browser. Co-authored-by: Cursor <cursoragent@cursor.com>
Convert between hex, RGB and HSL with a live preview swatch. Co-authored-by: Cursor <cursoragent@cursor.com>
Build 5-field cron expressions from presets or fields with a short description. Co-authored-by: Cursor <cursoragent@cursor.com>
Test patterns against sample text with g/i/m flags and listed matches. Co-authored-by: Cursor <cursoragent@cursor.com>
Generate Crockford Base32 ULIDs that sort by creation time. Co-authored-by: Cursor <cursoragent@cursor.com>
Centralize ToolId and ToolCategoryId as as-const maps so switches and catalogs reference named values instead of repeated magic strings. Co-authored-by: Cursor <cursoragent@cursor.com>
Compare two JSON documents and list added, removed and changed paths. Co-authored-by: Cursor <cursoragent@cursor.com>
Compare two texts line by line with added and removed highlighting. Co-authored-by: Cursor <cursoragent@cursor.com>
Convert between Unix permission checkboxes, octal and symbolic modes. Co-authored-by: Cursor <cursoragent@cursor.com>
Adds ua-parser-js since accurate UA parsing (thousands of device/OS patterns) isn't reasonable to hand-roll, mirroring the bcryptjs/uqr precedent for genuinely hard-to-implement algorithms.
Completes the web category (8 tools). Also fixes two astro check type errors introduced earlier (math evaluator token narrowing, wifi-qr spec discriminated union access) that vitest alone didn't catch — pnpm build is needed to surface these.
Starts the development category.
Hand-rolled keyword-based formatter (not a full SQL parser): breaks major clauses onto their own uppercased lines and indents AND/OR conditions and SELECT columns.
Completes the development category (7 tools).
Hand-rolled parser/stringifier for a practical TOML subset: key=value pairs (string/int/float/bool/primitive arrays) plus one level of [table] nesting.
Composes the existing TOML/JSON and YAML/JSON use-cases rather than reimplementing a TOML<->YAML transform directly.
Completes the converters category additions (8 tools).
Hand-rolled 3x5 dot-matrix font covering A-Z, 0-9 and space.
Completes it-tools parity: 43 new tools across crypto, network, math, measurement, images, web, development, converters, text and data categories, bringing the catalog to 75 tools total.
feat(toolbox): add 43 it-tools.tech parity tools
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| type JsonValue = string | { [key: string]: JsonValue | JsonValue[] }; | ||
|
|
||
| function isWellFormed(xml: string): boolean { | ||
| const doc = new DOMParser().parseFromString(xml, 'application/xml'); |
| xmlToJson(xml: string): XmlJsonResult { | ||
| if (!xml.trim() || !isWellFormed(xml)) return { ok: false }; | ||
|
|
||
| const doc = new DOMParser().parseFromString(xml, 'application/xml'); |
| } | ||
|
|
||
| function isWellFormed(xml: string): boolean { | ||
| const doc = new DOMParser().parseFromString(xml, 'application/xml'); |
- generate-random-port: replace modulo-biased random port selection with unbiased rejection sampling over crypto.getRandomValues - convert-xml-json: escape double/single quotes in generated XML attribute values to prevent attribute injection - format-xml: fix comment-detection regex to match comments spanning multiple lines - generate-svg-placeholder: escape backgroundColor/textColor before interpolating them into SVG attributes rendered via dangerouslySetInnerHTML, closing a DOM XSS vector - base64-file-panel: rebuild the download link's data URL from the validated mimeType/base64 parts instead of the raw pasted text - suppress the remaining js/xss-through-dom findings on the well-formedness DOMParser.parseFromString calls, which only read tagName/attributes/textContent into plain values and never insert parsed nodes into the live DOM
4 tasks
CodeQL still flagged the previous fix (rebuilding the data: URL from validated parts) because the taint tracker follows the mimeType/base64 match groups through the template literal regardless of the hardcoded scheme prefix. Decode the payload into a Blob and download it via URL.createObjectURL instead, matching the pattern already used by DownloadButton — the anchor's href is then a browser-generated blob: URL with no path for user-controlled text to reach it at all.
fix(security): resolve CodeQL alerts on develop→staging
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.