Repository navigation
feat: document deliverables (PPT/Word/Excel build route) + interactive spreadsheet viewer - #606
Conversation
…eadsheet viewer ux-gap-roadmap-01 + 12. Deliverables: versioned DeckSpec/DocSpec/WorkbookSpec contracts with bounded parsing; daemon builders via pptxgenjs/docx/exceljs writing real .pptx/.docx/.xlsx files into the workspace deliverables directory through POST /deliverables/build. Spreadsheet viewer: sync sheet-name extraction from the workbook zip for the preview envelope, a workspace-bound windowed /previews/spreadsheet route (formulas are served for reference and never evaluated), and a web SpreadsheetGrid with sheet tabs, sticky headers, cell selection, formula bar and load-more windowing so large workbooks never load whole. Unit tests: builder round-trips (pptx zip structure + speaker notes, docx content, xlsx re-read via exceljs), spec validation, window clamping, extraction windows, API routes incl. workspace-bound escape rejection. Playwright spec with screenshot evidence covers sheet tab switching, cell selection and the formula bar.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 25f5cb4aa0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
chainsaw (MIT/X11) and buffers (MIT, incomplete npm metadata) enter the production tree via exceljs -> unzipper -> binary. Both are reviewed MIT-licensed packages by the same upstream author; the policy script now carries an explicit, documented exception map naming the verification source for each, instead of widening the blanket allowlist.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0c1fa88cf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The keychain bounded-read fixture loads keychain-secret-store dist inside a module.registerHooks ESM sandbox whose loader crashes on exceljs's deep CJS chain (unzipper -> binary -> chainsaw -> traverse -> es-abstract -> is-generator-function, ERR_VM_MODULE_LINK_FAILURE). The preview envelope pulled exceljs in via content-preview. Split the sync zip-manifest extraction (fflate only) into spreadsheet-manifest.ts so the preview graph stays lean; the ExcelJS-dependent windowed extraction moves to spreadsheet-extract.ts used only by the windowed route.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 987ffb1b5c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…readsheet preview P1: /deliverables/build and /previews/spreadsheet now require the same allowLocalWorkspaceRequest origin+workspace guard as /workspace-files — on the wildcard-CORS loopback daemon a foreign page could previously read workbook cells or write files in caller-selected directories. P1: the spreadsheet grid is reachable through real preview APIs — buildWorkspaceFilePreview classifies workspace .xlsx/.xlsm as spreadsheet, and the grid no longer refuses artifact/attachment refs (the windowed route resolves any ref path against the workspace root). P2: workspace containment now resolves real paths (symlinks included) and uses relative-path containment instead of a string-prefix check that sibling directories and symlinks could fool. P2: CSV keeps its textual preview until a dedicated CSV reader exists, and the zip manifest extraction decompresses only xl/workbook.xml so a compressed bomb cannot exhaust daemon memory.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 399ba8a21c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b9066efc8a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Summary
Implements roadmap items 01 (document deliverables) + 12 (interactive spreadsheet viewer) from the UX gap roadmap. Rebased onto current main (post #599/#603/#604).
Document deliverables (#1)
DeckSpec/DocSpec/WorkbookSpec(specVersion 1) with bounded parsing (slide/block/sheet caps) and versioned builders, so old artifacts are never re-rendered..ling-stack/deliverables/directory viaPOST /deliverables/build.Spreadsheet viewer (#12)
fflate) for the preview envelope — a preview never pays for a full ExcelJS parse.GET /previews/spreadsheet(path traversal rejected with 403); formulas are served for reference and never evaluated.SpreadsheetGrid: sheet tabs, sticky headers, cell selection with coordinate + formula bar, load-more windowing so a 500k-row sheet never loads whole.Test evidence
output/playwright/spreadsheet-viewer/): sheet tab switching, cell selection, formula display; adjacent preview suites (local-file, artifact-preview, gen-ui) pass with no regressions.