Privacy-first ToolStack architecture refresh and local tools

[surajverma]

Summary

This PR refactors ToolStack around an explicit local-processing privacy contract, modernizes the project to Next.js 16, hardens existing browser tools, and adds a substantial set of new local-only utilities.

Architecture and maintainability

• Centralized tool metadata in src/config/tools.ts
• Added shared Tool, category and privacy metadata types
• Added reusable local-tool layout and privacy badge components
• Removed homepage-owned tool typing and catalog coupling
• Kept the homepage centered on the original stable category filters instead of duplicating navigation with tag/Featured/New sections
• Added clearer category styling on tool cards
• Updated tsconfig.json for Next 16 (react-jsx and .next/dev/types/**/*.ts)
• Updated ESLint to Next 16 native flat config

Privacy and security

• Added scripts/check-privacy.mjs to reject direct network-capable APIs across src/
• Added security/privacy response headers
• CSP keeps unsafe-eval disabled in production but enables it in next dev, where React requires it for debugging
• Replaced Showdown with Marked + DOMPurify and made Markdown sanitization prerender-safe
• Added a visible local/no-upload/no-tracking privacy contract
• Production dependency audit reports 0 vulnerabilities

New local-only tools

• PDF Toolkit: merge, reorder, extract/delete/rotate pages, split to ZIP, metadata editing, images to PDF
• Content Credentials / C2PA Inspector using bundled inline WASM
• File Type & Signature Inspector
• File Hash & Checksum
• JSON Toolbox + structural JSON diff
• XML Toolbox
• YAML ↔ JSON Converter
• Tracking URL Cleaner
• Password & Passphrase Generator
• Encoder / Decoder
• JWT Inspector
• Timestamp & Date Toolkit
• UUID / ULID Generator
• Browser Privacy Inspector
• Text Privacy Cleaner
• Image Format Converter
• AES-GCM File Encryption
• CSP Builder & Analyzer
• HMAC Generator & Verifier
• Cron Expression Explainer

Correctness and UX fixes

• PDF uploads now explicitly support multiple files and append later selections instead of replacing the current list
• CSV to XML escapes XML characters and normalizes invalid element names
• Unit Converter distinguishes decimal SI storage units from binary IEC units
• Regex Tester runs potentially expensive expressions in a disposable Web Worker with a timeout
• Data Anonymizer custom regex work also uses the worker path; UUID/MAC and Luhn-valid payment-card detection added
• CSS specificity now uses a selector parser with modern :where(), :is(), :not() and :has() behavior
• Image Compressor cleans object URLs, adds batch limits and improves keyboard/ARIA behavior
• Fixed React/Next 16 lint issues in browser privacy, color conversion, anonymization, find/replace, JWT, Lorem Ipsum and timestamp tools
• Fixed README clone path, production start behavior, license wording and stale default assets
• Added same-origin PWA/offline caching without caching user-selected files

Verification

CI now runs:

privacy-check → ESLint → TypeScript → Vitest → Next production build

Current result: all stages pass, including 18 unit tests and the production build.

Deliberately not added

• Claude watermark remover: not included because removing provenance marks is not a good fit for the privacy/trust direction of ToolStack.
• QR generator/scanner: deferred for now rather than expanding the dependency surface further in this PR.

[Copilot]

🟡 Changes recommended

The new privacy-check script currently uses a URL with path.join, which will throw at runtime and break the CI/privacy enforcement.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR refreshes ToolStack’s architecture around a strict “local processing / no network” privacy contract, centralizes tool metadata, and adds several new browser-only utilities while standardizing tool page layout.

Changes:

• Introduces shared tool metadata/types (src/types/tool.ts, src/config/tools.ts) and updates the homepage/components to use categories instead of tag shuffling.
• Adds reusable “local tool” UI building blocks (LocalToolLayout, ToolPage, PrivacyBadge) and updates multiple tools to the new layout.
• Adds privacy/security enforcement and hardening (privacy-check script, security headers, CI verify workflow, markdown preview escaping) plus several new local-only tool pages.

File summaries

File	Description
src/types/tool.ts	Adds shared Tool / ToolCategory types with local-only privacy contract fields.
src/config/tools.ts	Centralizes tool catalog and category list generation.
src/components/ToolPage.tsx	New standardized tool-page wrapper including privacy badge + back link.
src/components/ToolList.tsx	Simplifies tool list rendering and switches to shared Tool type.
src/components/ToolCard.tsx	Updates card UI to show category and “Local” badge; uses shared Tool type.
src/components/PrivacyBadge.tsx	Adds reusable “Processed locally / No upload / No tracking” badge.
src/components/LocalToolLayout.tsx	Adds a reusable layout for local-only tool pages (Navbar/Breadcrumbs/Footer + ToolPage).
src/app/page.tsx	Replaces homepage-owned catalog with centralized TOOLS; adds category filtering and privacy badge.
src/app/sitemap.ts	Adds sitemap route built from centralized tool list.
src/app/robots.ts	Adds robots route referencing sitemap.
src/app/unit-converter/page.tsx	Refactors converter UI/logic; separates SI vs IEC storage units.
src/app/regex-tester/page.tsx	Refactors regex tester to avoid state mutation in useMemo and handle non-global regexes.
src/app/markdown-editor/page.tsx	Refactors markdown editor and escapes raw HTML before rendering preview.
src/app/csv-converter/page.tsx	Fixes CSV→XML output by escaping XML and normalizing element names.
src/app/file-hash/page.tsx	Adds new local file hashing tool using Web Crypto.
src/app/url-cleaner/page.tsx	Adds new tracking URL cleaner tool.
src/app/password-generator/page.tsx	Adds new password/passphrase generator using crypto.getRandomValues.
src/app/jwt-inspector/page.tsx	Adds new JWT decoding/inspection tool (decode-only).
src/app/timestamp-tool/page.tsx	Adds new timestamp/date conversion tool.
src/app/uuid-generator/page.tsx	Adds new UUID/ULID generator + UUID validator.
src/app/text-privacy-cleaner/page.tsx	Adds new hidden/control character detector + cleaner.
src/app/encoder-decoder/page.tsx	Adds new Base64/URL/HTML encoder-decoder tool.
src/app/image-converter/page.tsx	Adds new image format conversion/download tool.
src/app/file-encryption/page.tsx	Adds local AES-GCM file encrypt/decrypt tool with PBKDF2-derived key.
src/app/json-toolbox/page.tsx	Adds new JSON validate/format/minify/sort tool.
src/app/browser-privacy/page.tsx	Adds browser privacy inspector showing readable browser-exposed values.
scripts/check-privacy.mjs	Adds a script to reject network-capable APIs in src/app.
next.config.ts	Adds security/privacy response headers including CSP and Permissions-Policy.
.github/workflows/ci.yml	Adds CI workflow to run privacy check, lint, typecheck, and build.
package.json	Updates scripts (start, lint, typecheck, privacy-check, verify) and bumps version.
README.md	Updates privacy contract, tool listing, dev instructions, and verification guidance.

Review details

• Files reviewed: 31/31 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.