feat/codions tools platform

[fabioassuncao]

No description provided.

[fabioassuncao]

Code review

Found 2 issues:

1. </script> breakout in generated CDN snippets — unescaped user config values are embedded inside a literal <script>…</script> block, so a value containing </script> closes the tag early in the customer's page and the remainder becomes live HTML markup (e.g. an injected <img onerror=…>). formatValue/formatString only escape for JS-string-literal safety (\, ', \n, \r), not for HTML; the sibling htmlAttr() in the same files does escape </>/&, showing the escaping gap is an oversight rather than intentional. Reachable via the hasCallback branch of the floating-contact-button cdn snippet, and the else branch of the consent-manager cdn snippet (when dataAttributes() returns empty).

codions-tools/apps/web/app/tools/floating-contact-button/codegen.ts

Lines 19 to 32 in c37a453

	function formatValue(val: any): string {
	if (typeof val === 'string') {
	const escaped = val
	.replace(/\\/g, '\\\\')
	.replace(/'/g, "\\'")
	.replace(/\n/g, '\\n')
	.replace(/\r/g, '\\r')
	return `'${escaped}'`
	}
	if (typeof val === 'boolean' || typeof val === 'number') return String(val)
	return String(val)
	}

codions-tools/apps/web/app/tools/consent-manager/codegen.ts

Lines 34 to 43 in c37a453

	function formatString(value: string): string {
	const escaped = value
	.replace(/\\/g, '\\\\')
	.replace(/'/g, "\\'")
	.replace(/\n/g, '\\n')
	.replace(/\r/g, '\\r')
	return `'${escaped}'`
	}

2. Production deploy is not gated on CI. deploy.yml and ci.yml both trigger independently on push: branches: [main], and deploy.yml has no needs/workflow_run dependency on ci.yml's verify job — it runs npx wrangler deploy straight after npm run build, so a push to main can deploy even if lint/typecheck/tests fail. It also has no concurrency group (unlike ci.yml), so two rapid pushes can race and an older build can overwrite a newer deploy.

https://github.com/codions/codions-tools/blob/c37a453bc94ac0b63c1574c469a93ba0b912d4ee/.github/workflows/deploy.yml#L1-L30

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}