sync: upstream GenOffice main (v0.10.x, ~900 commits) into HermesOffice

.gitattributes

@@ -7,6 +7,7 @@
 *.docx binary
 *.xlsx binary
 *.pptx binary
+*.ods binary
 *.pdf binary
 *.png binary
 *.ico binary

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
   - name: Security vulnerability
-    url: https://github.com/genspark-ai/hermesoffice/security/advisories/new
+    url: https://github.com/criptogus/HermesOffice/security/advisories/new
     about: Please report security issues privately, never as a public issue.

.github/workflows/ci.yml

@@ -48,6 +48,17 @@ jobs:
         with:
           workspaces: apps/sheets/native/xlsx-engine
 
+      # electron's postinstall downloads its binary from GitHub Releases on every
+      # fresh install; a cache hit skips the download (and its 5xx flakes)
+      - name: Cache electron binaries
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/electron
+          # own prefix: the build workflows' electron-* entries also hold
+          # ~/.cache/electron-builder, and a saved key is never updated
+          key: electron-bin-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: electron-bin-${{ runner.os }}-
+
       - name: Install dependencies
         run: npm ci
 
@@ -88,6 +99,78 @@ jobs:
           fi
           npm run check:theme-colors
 
+      # Inline text-layout decisions (script tests, face predicates, CJK ranges,
+      # compat reads) stay in apps/docs/src/renderer/text-layout/, not in the emitters.
+      - name: Check inline text-layout rules
+        env:
+          FORMAT_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            FORMAT_BASE_REF=$(git rev-parse HEAD^1)
+          fi
+          npm run check:inline-rules
+
+      # Line-metric numbers (fonts.css size-adjust/overrides, knownLineFactor)
+      # must cite the Word measurement they came from.
+      - name: Check font-metric provenance
+        env:
+          FORMAT_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            FORMAT_BASE_REF=$(git rev-parse HEAD^1)
+          fi
+          npm run check:font-metrics-provenance
+
+      # fonts.generated.css / line-factors.generated.ts must match the measurement
+      # manifest; metric values are never hand-written outside it.
+      - name: Check generated font metrics
+        env:
+          FORMAT_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            FORMAT_BASE_REF=$(git rev-parse HEAD^1)
+          fi
+          npm run check:generated-fonts
+
+      # docs/word-truths-index.json and the coverage doc must match the fixtures;
+      # a recently dated truths section needs a fixture or a prose-only marker.
+      - name: Check Word truths coverage
+        run: npm run check:word-truths
+
+      # skills/*/SKILL.md ship to users' agent directories; a body change
+      # without a metadata.version bump would never be offered as an update.
+      - name: Check skill versions
+        env:
+          FORMAT_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            FORMAT_BASE_REF=$(git rev-parse HEAD^1)
+          fi
+          npm run check:skill-version
+
+      # Whole-tree, not changed-files: every one of the manual's 21 languages
+      # has to match the English article's structure. A language that quietly
+      # falls behind is exactly what no reviewer sees, and it is invisible in a
+      # diff — the change that causes it looks like an ordinary translation.
+      - name: Check manual language coverage
+        run: npm run check:help-langs
+
+      # Added lines only: Han text outside locale tables, review-tool tags,
+      # feedback-ledger ids, sample-corpus ids, internal PR numbers, personal
+      # paths/e-mails, credentials, NUL bytes (tools/check-public-hygiene.mjs).
+      - name: Check public-repo hygiene
+        env:
+          FORMAT_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            FORMAT_BASE_REF=$(git rev-parse HEAD^1)
+          fi
+          if [ -f tools/check-public-hygiene.mjs ]; then
+            node tools/check-public-hygiene.mjs
+          else
+            echo "public-hygiene gate not present in this checkout; skipped"
+          fi
+
       # Keep tracked code comments and contributor-facing documentation
       # English-only; functional CJK strings and AI prompt examples are allowed.
       - name: Check comments/docs are English-only
@@ -108,10 +191,22 @@ jobs:
       - name: Check committed fixtures match the generator
         run: git diff --exit-code -- fixtures/generated
 
-      # CLI XLSX tests run before the Sheets workspace tests in npm test.
-      - name: Prepare Sheets engine and fixtures for CLI tests
+      # pptx-engine's OOXML schema gate validates saved decks with xmllint
+      # (tools/ooxml-validate); the runner image is not guaranteed to have it.
+      - name: Install xmllint
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libxml2-utils
+
+      # `sheet apply`'s dependent-cache audit lives in the Rust xlsx-sidecar, and
+      # the CLI suite skips its sidecar-backed tests (`it.skipIf(!sidecar)`) when
+      # the binary is missing. Only the sheets package's test script builds it,
+      # and the root `test` script runs @hermesoffice/cli before @hermesoffice/sheets —
+      # so build the sidecar up front or CI's pass proves nothing about the
+      # audit. The cargo cache above holds the target dir, so this is cheap.
+      - name: Build xlsx-sidecar (the CLI audit tests run against it)
         run: |
           npm run native:build -w @hermesoffice/sheets
+          # the sidecar-gated CLI tests read the generated compatibility fixture
+          # (gitignored, normally produced by the sheets gate below)
           npm run fixtures -w @hermesoffice/sheets
 
       - name: Test
@@ -150,6 +245,17 @@ jobs:
         with:
           workspaces: apps/sheets/native/xlsx-engine
 
+      # electron's postinstall downloads its binary from GitHub Releases on every
+      # fresh install; a cache hit skips the download (and its 5xx flakes)
+      - name: Cache electron binaries
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/electron
+          # own prefix: the build workflows' electron-* entries also hold
+          # ~/.cache/electron-builder, and a saved key is never updated
+          key: electron-bin-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: electron-bin-${{ runner.os }}-
+
       - name: Install dependencies
         run: npm ci
 
@@ -197,7 +303,7 @@ jobs:
 
       - name: Upload E2E artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-artifacts
           path: |

.prettierignore

@@ -10,6 +10,11 @@ coverage/
 package-lock.json
 apps/*/build/
 apps/shell/build/THIRD-PARTY-NOTICES.txt
+packages/font-metrics/word-faces.json
+apps/docs/src/renderer/fonts/stand-in-boxes.json
+apps/docs/tests/fixtures/font-metrics/
+apps/docs/src/renderer/fonts/fonts.generated.css
+apps/docs/src/renderer/line-factors.generated.ts
 
 # Local-only acceptance drivers are intentionally outside CI.
 scripts/drivers/driver.*.mjs

NOTICE

@@ -13,6 +13,27 @@ checkout.
 Bundled fonts and their licenses are documented in
 apps/docs/src/renderer/fonts/README.md.
 
+Downloadable fonts
+
+Any app can offer additional font families, at the reader's request, from the
+build-injected font mirror. Those families are not in the bundle and so are not
+in that README; the catalogue is
+packages/electron-utils/src/font-catalog.ts, and every family there carries its
+SPDX licence id in a `license` field, checked against a permissive allowlist by
+packages/electron-utils/tests/font-store.test.ts.
+
+All of them are licensed under the SIL Open Font License, Version 1.1
+(https://openfontlicense.org), which permits the bundling and redistribution
+this application performs. The families are: Open Sans, Roboto, Lato,
+Montserrat, Poppins, Inter, Source Sans 3, Oswald, Raleway, Nunito,
+Merriweather, Playfair Display, Work Sans, Rubik, Noto Sans JP, Noto Sans KR,
+Noto Sans SC, Noto Sans TC, Nanum Gothic, Noto Serif SC, Noto Serif TC,
+Noto Serif JP, Noto Serif KR, Nanum Myeongjo.
+
+Each downloaded file is verified against the sha256 recorded in the catalogue
+before it is installed, and the catalogue states each family's size so an app
+can ask before fetching tens of megabytes.
+
 Unicode Character Database
 
 apps/pdf/src/shared/radicals.ts contains a generated mapping derived from

PRIVACY.md

@@ -1,9 +1,9 @@
-# GenOffice Privacy
+# HermesOffice Privacy
 
 Last updated: August 26, 2026
 
-GenOffice opens, edits, and saves documents locally. Document editing does not
-upload files to GenOffice. AI features require a network connection and send
+HermesOffice opens, edits, and saves documents locally. Document editing does not
+upload files to HermesOffice. AI features require a network connection and send
 requests only when you use them.
 
 ## Usage analytics
@@ -49,12 +49,12 @@ email address.
 Events are sent to Google Analytics 4 using the Measurement Protocol over
 HTTPS. As the HTTPS recipient, Google necessarily sees the connection's public
 IP address and transport metadata, and may use them for coarse geolocation and
-security or spam-abuse processing. GenOffice does not add an IP address to the
+security or spam-abuse processing. HermesOffice does not add an IP address to the
 event payload.
 
 ## Data not collected by analytics
 
-GenOffice analytics never sends:
+HermesOffice analytics never sends:
 
 - document content
 - file names

SECURITY.md

@@ -67,13 +67,22 @@ If you find a way for a layout script to reach anything beyond the injected
 primitives (network, storage, IPC channels not reachable by design, or the
 main process), that is a vulnerability — please report it.
 
-## Threat Model: Rendering AI-Generated HTML (slides export)
+## Threat Model: Rendering AI-Generated HTML
 
-The HTML-to-pptx export pipeline renders AI-generated HTML in a hidden
-`BrowserWindow`. That window is treated as hostile content: full renderer
+Three pipelines render AI-generated or untrusted HTML in a hidden
+`BrowserWindow`. Every window is treated as hostile content: full renderer
 lockdown (`sandbox: true`, `contextIsolation: true`, `nodeIntegration: false`),
-no preload script, no IPC surface — the main process drives it exclusively
-through `executeJavaScript` and destroys it under a watchdog timeout.
+no preload script, no IPC surface. The slides hidden windows only load the
+app's own renderer and print HTML (PDF export, print, headless export); the
+AI-HTML-to-pptx conversion runs inside the slides renderer, never in a hidden
+window. The HTML app's DOCX export and the docs altChunk conversion drive their
+windows exclusively through `executeJavaScript` under a watchdog timeout
+(`Promise.race` against a fixed timeout, then `destroy()`), so a page whose
+scripts never yield cannot strand the hidden window. HTML→DOCX
+conversion renders the page with scripts enabled and does not sanitize the
+markup before conversion — the output is a document, not a sandbox escape;
+report it as a vulnerability if you find a way from the converted page into
+the main process.
 
 ## Out of Scope
 

apps/docs/electron.vite.config.ts

@@ -30,6 +30,7 @@ export default defineConfig({
           '@hermesoffice/docx-engine',
           '@hermesoffice/electron-utils',
           '@hermesoffice/font-metrics',
+          '@hermesoffice/xlsx-gateway',
         ],
       }),
     ],
@@ -44,7 +45,7 @@ export default defineConfig({
     plugins: [react()],
     resolve: { alias: localAlias },
     server: {
-      // Overridable so multiple genoffice dev instances can coexist (default 5173).
+      // Overridable so multiple hermesoffice dev instances can coexist (default 5173).
       port: Number(process.env.DOCS_DEV_PORT) || 5173,
       strictPort: Boolean(process.env.DOCS_DEV_PORT),
     },

apps/docs/package.json

@@ -34,22 +34,21 @@
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.0.4",
-    "electron": "^43.3.0",
+    "electron": "^43.8.3",
     "electron-builder": "^26.0.12",
     "electron-vite": "^5.0.0",
     "jsdom": "^28.0.0",
     "marked": "^17.0.6",
-    "officecrypto-tool": "^0.0.19",
     "opentype.js": "^2.0.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vitest": "^4.1.11"
+    "vite": "^7.3.7",
+    "vitest": "^4.1.12"
   },
-  "author": "GenOffice",
+  "author": "HermesOffice",
   "build": {
-    "appId": "com.genoffice.docs",
+    "appId": "com.hermesoffice.docs",
     "productName": "HermesOffice Docs",
     "electronVersion": "43.3.0",
     "artifactName": "AIDocx-${version}-${arch}.${ext}",
@@ -96,6 +95,8 @@
     "electron-updater": "^6.8.9",
     "pdf-lib": "^1.17.1",
     "pdfjs-dist": "^6.2.108",
-    "@hermesoffice/pptx-render": "*"
+    "@hermesoffice/pptx-render": "*",
+    "@hermesoffice/xlsx-gateway": "*",
+    "@hermesoffice/agent-core": "*"
   }
 }

apps/docs/src/main/atomic-write.ts

@@ -1,50 +1,7 @@
-import { randomBytes } from 'node:crypto'
-import { rename, unlink, writeFile } from 'node:fs/promises'
-import { basename, dirname, join } from 'node:path'
-
-/** Transient Windows codes: antivirus/indexer briefly locks the rename target. */
-const RETRYABLE_RENAME_CODES = new Set(['EPERM', 'EACCES', 'EBUSY'])
-const RENAME_RETRIES = 4
-
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms))
-
-/**
- * Same-dir temp file + rename, so a crash mid-write can't truncate the target.
- * Rename-over-existing fails transiently on Windows under Defender/indexer
- * locks: retry with backoff, then fall back to an in-place write — losing
- * atomicity for that one save beats failing a save the previous plain
- * writeFileSync would have completed.
- */
-export async function atomicWriteFile(filePath: string, data: Buffer): Promise<void> {
-  const tmp = join(
-    dirname(filePath),
-    `.${basename(filePath)}.${randomBytes(6).toString('hex')}.tmp`,
-  )
-  try {
-    await writeFile(tmp, data)
-    for (let attempt = 0; ; attempt++) {
-      try {
-        await rename(tmp, filePath)
-        return
-      } catch (err) {
-        const code = (err as NodeJS.ErrnoException).code ?? ''
-        if (!RETRYABLE_RENAME_CODES.has(code) || attempt >= RENAME_RETRIES) throw err
-        await sleep(50 * 2 ** attempt)
-      }
-    }
-  } catch (err) {
-    try {
-      await unlink(tmp)
-    } catch {
-      /* tmp never created */
-    }
-    if (RETRYABLE_RENAME_CODES.has((err as NodeJS.ErrnoException).code ?? '')) {
-      await writeFile(filePath, data)
-      return
-    }
-    throw err
-  }
-}
+/// Imported from its own electron-utils subpath rather than the package
+/// barrel: the barrel drags Electron-only modules into headless bundles, and
+/// tests that mock the barrel would otherwise have to mock this helper too.
+export { atomicWriteFile } from '@hermesoffice/electron-utils/atomic-write'
 
 /** 'PK\x03\x04' local-file-header check — cheap docx/zip sanity test. */
 export function looksLikeZip(bytes: Buffer): boolean {