[nicklongmore86]

Design PR 4 of the document-reading plan (docs/document-reader.md): Word, Excel, PowerPoint and OpenDocument support in the sandboxed document reader (worker + broker from #52), exposed through read_document and attachments.

What changed

Readers (all inside the sandboxed worker, same 30 s timeout and memory ceiling)

• xml.ts: our own XML parser for hostile input. It refuses any DOCTYPE, so there is no XXE and no entity expansion (billion laughs). Only predefined entities and character references are decoded. Nesting depth is capped at 256 and elements per part at 4M. Names are namespace-resolved, and each reader keeps only the elements it uses.
• package.ts: OOXML/ODF packages go through the existing guarded zip.ts (entry count, declared sizes and ratios, real inflated bytes counted). New limits.office caps sit on top: 64 MB per part and 256 MB per package, uncompressed.
• docx.ts:
  • Output is Markdown-like text: headings (from style names, outline levels and basedOn), bullet and numbered lists from numbering.xml, tables as Markdown (spans padded, nested tables flattened), text boxes, and [Image: alt] placeholders.
  • Deleted text, field codes and mc:Fallback are dropped.
  • Positions are characters of that text, with start/next continuation cut at line breaks.
• pptx.ts: slides in sldIdLst order, each with its title, shape text, tables, pictures and speaker notes; hidden slides are marked.
• sheets.ts:
  • SheetJS CE 0.20.3 reads .xlsx, .xlsm, .xls and .ods. It never sees the ZIP: parts are inflated by the guarded reader and handed to parse_zip as an in-memory container.
  • Parts with a DTD are refused, and vbaProject.bin, media and embedded objects are never handed over. Macros are never run or read.
  • Each sheet is a Markdown table with column letters and row numbers (cell addresses). The default view is the sheet list plus the first 20×30 cells of each sheet.
  • A1 ranges are accepted: Sheet1!A1:H200, 'Q3 sales'!B2:F40, A:C, 5:20, A21:H.
  • Each call is capped at 10,000 cells and the text budget, and names the next range to read.
  • Cell values are cached values; include_formulas adds the formula text. sheetRows bounds parsing.
  • CSV/TSV is read by name with our own RFC 4180 parser.
• odf.ts: .odt reads like Word and .odp like PowerPoint; .ods goes through SheetJS.
• ole.ts:
  • .xls goes to SheetJS.
  • .doc gets best-effort text from the piece table (8-bit and UTF-16 pieces, field instructions dropped).
  • .ppt, .xlsb and Word 95 get a clear "save it as .pptx/.xlsx/.docx" message.
  • An encrypted OOXML package is reported as password-protected.
• reply.ts checks the new shapes:
  • new units: slide (treated like page) and sheet;
  • meta.sheets: at most 200, consistent with the position;
  • section.sheet ranges must be A1 references (regex) and sheet names at most 200 characters;
  • sheet data is allowed only on workbooks.

Tool and attachments

• read_document takes new sheet, range and include_formulas arguments. These are exclusive with pages, start and region, and recorded in the audit entry.
• Output gains slide headers, a sheet list, per-sheet tables and lines naming where to continue. The "not supported yet" message is gone for these types.
• Office/ODF attachments, plus Word and Excel 97-2003, are matched by READABLE_DOCUMENT_MIMES. They are sent as fenced untrusted text, with no images, through the existing byte-bounded cache (cachedPdfReading, which now takes a MIME type).
• The chip rule is updated: canReceive(kind, vision, mime). Older PowerPoint, RTF and mail are still greyed.

Dependencies added

• xlsx 0.20.3 (SheetJS Community Edition), Apache-2.0:
  • Installed from the official tarball https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz, not the outdated npm package.
  • Pinned by version in package.json and by its sha512 integrity in pnpm-lock.yaml; I checked the hash against the downloaded tarball.
  • It is a devDependency, bundled into the worker only. It adds about 500 KB minified (about 160 KB gzipped) to out/document-worker/assets/index.js.
  • Its LICENSE ships in out/document-worker/licenses/sheetjs-LICENSE.txt, and THIRD-PARTY-NOTICES.md is updated.
  • The bundle has no eval or new Function, so the worker's CSP is unchanged.

How I verified

• pnpm typecheck, pnpm lint, pnpm format:check: clean.
• pnpm test: 2865 test cases passed (34 skipped) across 133 test files. New coverage:
  • xml.test.ts and office.test.ts: every format from real files built in memory (workbooks written by SheetJS; Word, PowerPoint and ODF from their XML parts; .doc and .ppt as OLE files), plus ranges, cell caps and continuation.
  • Hostile files in office.test.ts: zip bombs by ratio and by a lying entry, XXE, billion laughs, a DTD in a part handed to SheetJS, oversized shared strings, tables nested past the depth cap, too many elements. Every view is also put through checkReply.
  • Plus Office cases in reply.test.ts, read-document.test.ts, attachments.test.ts and the renderer chip tests.
• pnpm build, then xvfb-run -a pnpm test:e2e: all 132 passed. e2e/document-worker.spec.ts covers every format and the hostile Office corpus inside the real sandboxed worker. e2e/read-document.spec.ts covers Word, a workbook listing followed by a range, and slide-by-slide continuation through the tool.
• I also ran the readers locally against files produced by python-docx, python-pptx and openpyxl. Those files are not committed.

🤖 Generated with Claude Code