[seanspeaks]

Stack 6 of 9. Stacked on #696.

Summary

These show how an integration appears inside the app it touches, before anything is installed.

• Renderers in renderers/ for Slack Block Kit, the HubSpot UI-extension component tree, and HTML. A definition's UI surfaces become what that app would display.
• Dry runs (preview.js). A workflow runs against sample data with no writes. The preview reports every call it would make and what each message would look like.
• Fix: Slack messages are escaped. A new mrkdwn template filter escapes record data. Before this, a deal named *x* <!channel> would have formatted the message or pinged the channel. The Slack examples now use the filter.

PR 8 checks the HubSpot component names against @hubspot/ui-extensions.

Test plan

• Same 31 pre-existing failures as next at this commit. Nothing new fails.
• Renderer and preview tests, plus a test for the escape filter.

---

Generated by Claude Code

---

Note

Medium Risk
Changes how Slack message text is built in production via the new mrkdwn filter and adds substantial preview/dry-run code paths that must stay non-executing and XSS-safe; misconfiguration could still leak unescaped template content if authors omit the filter.

Overview
Adds in-app preview rendering for data-defined integrations so authors can see UI surfaces and workflow side effects before anything is deployed to HubSpot, Slack, or other hosts.

New renderers/ turns resolved view trees into Slack Block Kit, a HubSpot UI-extension component tree, and sandboxed HTML (escaped data, http(s)-only links, Block Kit limits). previewSurface and previewWorkflow reuse the same query/view/workflow paths as production but swap in recordingPorts so capability calls are recorded and answered from fixtures—no real API writes. Public exports include viewToSlack, viewToHubSpot, viewToHtml, decodeAction, and related helpers; ADR-063 and the package README document preview vs future deployed host renderers.

Slack safety: a new mrkdwn template filter escapes interpolated record fields in outbound messages; HubSpot/Asana Slack examples now pipe user-controlled names/subjects through it. View-to-Slack rendering also escapes record-driven text and encodes userAction button payloads for round-trip decoding.

Coverage is a large renderers.test.js suite (escaping, limits, dry runs across examples, network traps).

^{Reviewed by Cursor Bugbot for commit 20e3e54. Bugbot is set up for automated code reviews on this repo. Configure here.}

📦 Published PR as canary version: 2.0.0--canary.697.20e3e54.0

✨ Test out this PR locally via:

npm install @friggframework/admin-scripts@2.0.0--canary.697.20e3e54.0
npm install @friggframework/core@2.0.0--canary.697.20e3e54.0
npm install @friggframework/devtools@2.0.0--canary.697.20e3e54.0
npm install @friggframework/eslint-config@2.0.0--canary.697.20e3e54.0
npm install @friggframework/prettier-config@2.0.0--canary.697.20e3e54.0
npm install @friggframework/schemas@2.0.0--canary.697.20e3e54.0
npm install @friggframework/serverless-plugin@2.0.0--canary.697.20e3e54.0
npm install @friggframework/test@2.0.0--canary.697.20e3e54.0
npm install @friggframework/ui@2.0.0--canary.697.20e3e54.0
# or 
yarn add @friggframework/admin-scripts@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/core@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/devtools@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/eslint-config@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/prettier-config@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/schemas@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/serverless-plugin@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/test@2.0.0--canary.697.20e3e54.0
yarn add @friggframework/ui@2.0.0--canary.697.20e3e54.0

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2348cde. Configure here.}

[seanspeaks]

ADR reconciliation needed after Stack A/B — drafted with Claude Code at Sean's request

Severity: cross-ref only.

• ADR-063 §16 still says "The renderers themselves are not in v0.1", and §19 lists host renderers as missing. This PR adds renderers/{slack,hubspot,html}.js and preview.js. Update §16/§19, or say these are preview renderers and not the deployed host renderers.
• Previews and dry runs add no route. If one is added later (for example "preview this definition" for an editor), it belongs under /api/v2 in the route registry (ADR-053, docs(adr): ADR-052 entity proxy security, ADR-053 Management API versioning #668), not beside the unprefixed routes from feat(core): run integration definitions in Frigg's real entry points, with persistence and publishing #693.
• The mrkdwn escape filter joins the closed filter set (063 §10). Keep the schema's filter list pinned to the runtime, as tests/schemas.test.js does for transforms.

[sonarqubecloud]

Quality Gate passed

Issues
47 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud