Add ticker name tooltips + external-PR CI gate

[furic]

Summary

• Threads tickerFullName (Yahoo longName) through the pipeline so email tickers get hover tooltips, and Gemini reasoning text references companies by full name. Supersedes Tooltip with full name added to email html #6 with HTML-attribute-safe escaping (escapeHtmlAttr covers & < > " ').
• Adds a CI gate (typecheck + Prettier + EditorConfig) so external PRs get automatic style/type signal — none existed before.

Changes

Feature (commit 2ec69f9):

• New src/util.ts — shared escapeHtmlAttr (5-char) and escapeHtmlText (3-char). telegram.ts now imports from it.
• New quote.longName field — kept quote.name priority unchanged (shortName ?? longName) so news-search behavior in fetchNews.ts is preserved.
• tickerFullName plumbed through analyze.ts → aiAnalysis.ts → intradayCompare.ts. Attached to AI recs server-side from price data, not from the model — deterministic.
• 6 title= interpolations escaped in email.ts, intradayEmail.ts, weeklyEmail.ts. Refresh email also gets a tooltip via quote.longName.
• AI prompts (Stage 1 + detailedAnalysis.ts) instruct Gemini to use full names in reasoning.

Tooling (commit 7c6521f):

• .editorconfig, .prettierrc.json, .prettierignore
• package.json — adds typecheck, format, format:check scripts + prettier devDep
• One-time prettier baseline reformat across all 16 src files

CI (commit dc79874):

• .github/workflows/ci.yml — runs on pull_request and push to main: npm ci → typecheck → format:check. No secrets, no pull_request_target (so untrusted fork code never runs with privileged tokens).

Docs (commit 84ebad9):

• README badge for the new CI workflow.

Test plan

• npm run typecheck — passes locally
• npm run format:check — passes locally
• CI runs on this PR and goes green (validate job, 13s)
• Synthetic smoke test (scratch/smoke-tooltip.ts, untracked) — fed MCD with "McDonald's Corporation" plus an adversarial Foo" onmouseover="alert(1) name through buildEmailHtml. Verified rendered HTML contains title="McDonald's Corporation" at every site (AI rec + allocation table + fallback table) and the injection attempt becomes title="Foo" onmouseover="alert(1)" — quote escaped, no live event handler.
• npm run dev end-to-end — Yahoo prices for 18/19 tickers, technicals for 19/19, macro indicators OK. Gemini was 503ing (Google capacity), so fallback gap-based recs path exercised — that's also a tooltip site, confirming wiring works on the fallback branch too. Email + Telegram delivered.
• Post-merge: open a test fork PR, confirm CI auto-triggers and gates style/type drift

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds full company-name tooltips for tickers (using Yahoo longName) across email/intraday outputs and nudges Gemini prompts to reference companies by full name, plus introduces basic CI gating for type/style consistency on PRs.

Changes:

• Introduces shared HTML escaping helpers (escapeHtmlAttr, escapeHtmlText) and uses them for ticker tooltip title attributes.
• Threads tickerFullName from price data through analysis → AI recs → intraday alerts and updates prompts to use full names in reasoning.
• Adds Prettier/EditorConfig config and a CI workflow to run tsc --noEmit + Prettier check.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/util.ts	Adds shared HTML escaping helpers for attributes and text nodes.
src/fetchPrices.ts	Adds QuoteData.longName sourced from Yahoo quote summary.
src/analyze.ts	Adds tickerFullName to AllocationItem sourced from QuoteData.longName.
src/aiAnalysis.ts	Adds tickerFullName to AI rec type; includes full name in prompt and attaches name deterministically from price data post-response.
src/intradayCompare.ts	Adds tickerFullName to intraday alerts, propagated from AI recs.
src/email.ts	Adds ticker title tooltips in daily email (plus Prettier reformat).
src/intradayEmail.ts	Adds ticker title tooltips in intraday + refresh emails (plus Prettier reformat).
src/weeklyEmail.ts	Adds ticker title tooltips in weekly email (plus Prettier reformat).
src/telegram.ts	Replaces local HTML escaping with shared helper; Prettier reformat.
src/detailedAnalysis.ts	Includes full name next to ticker in detailed prompt; adds instruction to use it in thesis.
src/fetchNews.ts	Prettier-only changes (formatting, trailing commas, line breaks).
src/fetchTechnicals.ts	Prettier-only changes (formatting, trailing commas, line breaks).
src/guards.ts	Prettier-only changes (formatting, trailing commas, line breaks).
src/state.ts	Prettier-only changes (formatting, trailing commas, line breaks).
src/index.ts	Prettier-only changes (formatting, trailing commas, line breaks).
src/config.ts	Prettier-only changes (formatting, trailing commas, line breaks).
package.json	Adds typecheck and Prettier scripts + Prettier dev dependency.
package-lock.json	Locks Prettier dependency.
README.md	Adds CI workflow badge.
.editorconfig	Adds EditorConfig baseline for consistent formatting in editors.
.prettierrc.json	Adds Prettier configuration.
.prettierignore	Adds ignore rules for Prettier.
.github/workflows/ci.yml	Adds CI job running npm ci, typecheck, and Prettier check on PRs/pushes.

Comments suppressed due to low confidence (1)

src/telegram.ts:104

• Telegram messages are sent with parse_mode: "HTML", but rec.reason is embedded directly inside an HTML tag (<i>...</i>) without escaping. If the model outputs &, <, or > (or accidentally includes tags), the message formatting can break or allow unintended markup. Apply escapeHtmlText(...) to rec.reason (and other free-text fields like limitPriceReason / bottomSignal) before embedding.

        lines.push(`   <i>${rec.reason}</i>`);
        // Technical insight for STRONG BUY only
        if (rec.action === "STRONG BUY") {
          const tech = technicals[rec.ticker];
          if (tech) {
            lines.push(
              `   📈 ${tech.momentumSignal} · RSI ${tech.rsi14} · 50MA $${tech.sma50} (${tech.priceVsSma50 > 0 ? "+" : ""}${tech.priceVsSma50}%)` +
                (tech.macdCrossover
                  ? ` · MACD ${tech.macdCrossover}`
                  : tech.macdHistogram != null
                    ? ` · MACD hist ${tech.macdHistogram > 0 ? "+" : ""}${tech.macdHistogram}`
                    : "") +
                (tech.bollPercentB != null ? ` · %B ${tech.bollPercentB}` : "") +
                (tech.bollSqueeze ? " · 🔸squeeze" : ""),
            );
          }
          if (rec.suggestedLimitPrice && rec.suggestedLimitPrice > 0) {
            lines.push(
              `   💡 Limit: $${rec.suggestedLimitPrice.toFixed(2)}` +
                (rec.limitPriceReason ? ` — ${rec.limitPriceReason}` : ""),
            );
          }
          if (rec.bottomSignal && rec.bottomSignal !== "") {
            lines.push(`   🔻 Bottom: ${rec.bottomSignal}`);
          }
          if (rec.analysisUrl) {
            lines.push(`   📋 <a href="${rec.analysisUrl}">More Details</a>`);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

CI sets up Node.js 20, but the repo’s other workflows (e.g. portfolio-monitor) and README indicate Node 22+. This can hide runtime/type differences between CI and production. Update this workflow to use the same Node major version as the rest of the repo (or derive from a single source, e.g. .nvmrc).

Suggested change

	node-version: "20"
	node-version: "22"

[Copilot]

rec.reason (and other model-supplied strings like limitPriceReason / bottomSignal) are interpolated directly into the email HTML without escaping, and rec.analysisUrl is injected into an href without attribute escaping. If any of these contain &, <, > or quotes, the email markup can break or allow HTML injection. Escape all untrusted text with escapeHtmlText(...) and all attribute values/URLs with escapeHtmlAttr(...) before embedding in HTML.

[Copilot]

News items (a.url, a.title, a.source) come from an external API but are embedded into the email HTML without escaping. This can break rendering (common with & in titles/URLs) and is an injection risk. Use escapeHtmlAttr(...) for the href value and escapeHtmlText(...) for a.title/a.source text content.

[Copilot]

Several fields in the intraday email HTML are interpolated without escaping (a.reason, a.limitPriceReason, a.bottomSignal, and a.analysisUrl in href). These values are model-supplied or external and can contain characters that break HTML or allow injection. Escape text nodes with escapeHtmlText(...) and attribute values/URLs with escapeHtmlAttr(...) before embedding.

[Copilot]

headline.url is inserted into an <a href="..."> in a Telegram HTML message without attribute escaping. URLs commonly contain & (query params) which should be encoded as & in HTML attributes, and quotes would break the attribute entirely. Use escapeHtmlAttr(...) (or otherwise properly encode) for headline.url before embedding in href.