@qvac/harness 0.8.0 → 0.8.5

package/CHANGELOG.md

@@ -8,6 +8,47 @@ While the major version is `0`, a breaking change bumps the minor version.
 
 ## [Unreleased]
 
+## [0.8.5] - 2026-10-06
+
+### Added
+
+- Skill-gated `pptx`, `docx` and `xlsx` tools on the office engine. A call takes
+  an `attachmentId` (or `create` options), `ops` that name engine methods with
+  named arguments, and an `output` file name; with an `attachmentId` alone it
+  returns the file's contents. The first failing op saves nothing and returns
+  the engine's error. An edit is never saved under the attached file's own
+  name. Saving the same file again in one turn answers with the one already
+  attached, and a changed file under that name is refused. The one-line answer
+  comes back as `reply`. These are the tools the presentations, word and excel
+  skills in `@qvac/skills` 0.1.12 call. (#286)
+
+### Changed
+
+- **Breaking:** `@qvac/skills` is now 0.1.12, whose office and pdf skills run on
+  the `pptx`, `docx`, `xlsx` and `pdf` tools instead of Python. A host that
+  passes its own `skillsDir` needs 0.1.12 as well: older office skills import
+  Python libraries this release no longer ships. (#286)
+- `extractOfficeText` and `extractDocxText` read .docx, .xlsx and .pptx in
+  process on the engine instead of starting Pyodide, and read at most 1M cells
+  across a workbook. Extracted workbook booleans read `true`/`false` instead of
+  `True`/`False`. `closeOfficeWorker` and `closeDocxWorker` remain as no-ops.
+  (#286)
+- `exec` refuses Python that imports `pptx`, `docx` or `openpyxl`, or declares
+  their packages, before it runs, and names the tool (or the skill that grants
+  it) to use instead. (#287)
+- **Breaking:** Python run through `exec` asks for approval like any other
+  write, including a run that only builds a new PDF. (#289)
+
+### Removed
+
+- **Breaking:** the vendored Python wheels for python-pptx, python-docx,
+  openpyxl, fpdf2 and pypdf, and their dependencies. Only micropip is still
+  seeded; any other package installs from PyPI, which sandbox mode refuses.
+  Use the office and `pdf` tools. (#286, #289)
+- The `exec` guidance written for python-pptx, python-docx and fpdf2 code:
+  their error hints and source checks, and the shrink-to-fit pass on saved
+  decks. (#288, #289)
+
 ## [0.8.0] - 2026-10-05
 
 ### Added
@@ -1108,7 +1149,8 @@ Tagged but never published to npm; these changes first shipped in 0.2.12.
 - GPU stats are read through `bare-gpu-info`, so every dependency installs from
   the public npm registry. (#12)
 
-[Unreleased]: https://github.com/tetherto/qvac-harness/compare/v0.8.0...HEAD
+[Unreleased]: https://github.com/tetherto/qvac-harness/compare/v0.8.5...HEAD
+[0.8.5]: https://github.com/tetherto/qvac-harness/compare/v0.8.0...v0.8.5
 [0.8.0]: https://github.com/tetherto/qvac-harness/compare/v0.7.3...v0.8.0
 [0.7.3]: https://github.com/tetherto/qvac-harness/compare/v0.7.2...v0.7.3
 [0.7.2]: https://github.com/tetherto/qvac-harness/compare/v0.7.1...v0.7.2

package/dist-lib/lib/docx/index.d.ts

@@ -1,5 +1,5 @@
 import type { AbortSignal } from 'bare-abort-controller';
-export { closePythonWorker as closeDocxWorker } from '../tools/exec/adapters/python/worker/active.ts';
+export declare function closeDocxWorker(): Promise<void>;
 export interface DocxExtractOptions {
     readonly signal?: AbortSignal;
 }

package/dist-lib/lib/docx/index.js

@@ -1,26 +1,18 @@
-import { extractWithPython } from '../office/python.js';
-export { closePythonWorker as closeDocxWorker } from '../tools/exec/adapters/python/worker/active.js';
-const PACKAGES = ['python-docx==1.2.0'];
-const EXTRACT = `from docx import Document
-from docx.text.paragraph import Paragraph
-from pathlib import Path
-
-def text(container):
-    for block in container.iter_inner_content():
-        if isinstance(block, Paragraph):
-            if block.text.strip():
-                yield block.text
-        else:
-            for row in block.rows:
-                yield " | ".join(" ".join(text(cell)) for cell in row.cells)
-
-Path("extracted.txt").write_text("\\n".join(text(Document("input.docx"))), encoding="utf-8")
-`;
+import { docx } from '../office/engine/index.js';
+import { cellText, extractWith } from '../office/extract.js';
+export async function closeDocxWorker() { }
+function documentText(bytes) {
+    const lines = [];
+    for (const block of docx.open(bytes).read().blocks) {
+        if (block.type === 'table') {
+            lines.push(...block.rows.map((row) => row.map(cellText).join(' | ')));
+        }
+        else if (block.type === 'paragraph' && block.text.trim()) {
+            lines.push(block.text);
+        }
+    }
+    return lines.join('\n');
+}
 export async function extractDocxText(bytes, fileName, options = {}) {
-    return extractWithPython(bytes, fileName, {
-        format: 'DOCX',
-        packages: PACKAGES,
-        source: EXTRACT,
-        signal: options.signal
-    });
+    return extractWith(bytes, { fileName, signal: options.signal, extract: documentText });
 }

package/dist-lib/lib/office/extract.d.ts

@@ -0,0 +1,9 @@
+import type { AbortSignal } from 'bare-abort-controller';
+export type Extract = (bytes: Uint8Array) => string;
+export interface ExtractJob {
+    readonly fileName: string;
+    readonly signal: AbortSignal | undefined;
+    readonly extract: Extract;
+}
+export declare function extractWith(bytes: Uint8Array, { fileName, signal, extract }: ExtractJob): string;
+export declare function cellText(value: unknown): string;

package/dist-lib/lib/office/extract.js

@@ -0,0 +1,19 @@
+import { errorMessage } from '../guards.js';
+const MAX_OFFICE_BYTES = 20 * 1024 * 1024;
+export function extractWith(bytes, { fileName, signal, extract }) {
+    if (bytes.byteLength > MAX_OFFICE_BYTES) {
+        throw new Error(`document is too large to extract: ${bytes.byteLength} bytes, limit ${MAX_OFFICE_BYTES}`);
+    }
+    if (signal?.aborted) {
+        throw new Error(`${fileName}: extraction aborted`);
+    }
+    try {
+        return extract(bytes);
+    }
+    catch (err) {
+        throw new Error(`${fileName}: ${errorMessage(err)}`);
+    }
+}
+export function cellText(value) {
+    return value === null || value === undefined ? '' : String(value).replaceAll('\n', ' ');
+}

package/dist-lib/lib/office/index.d.ts

@@ -1,5 +1,5 @@
 import type { AbortSignal } from 'bare-abort-controller';
-export { closePythonWorker as closeOfficeWorker } from '../tools/exec/adapters/python/worker/active.ts';
+export { closeDocxWorker as closeOfficeWorker } from '../docx/index.ts';
 export interface OfficeExtractOptions {
     readonly signal?: AbortSignal | undefined;
     readonly mimeType?: string | undefined;

package/dist-lib/lib/office/index.js

@@ -1,14 +1,81 @@
 import path from 'path';
 import { extractDocxText } from '../docx/index.js';
-import { extractWithPython } from './python.js';
-import { XLSX_EXTRACT } from './xlsx.js';
-import { PPTX_EXTRACT } from './pptx.js';
-export { closePythonWorker as closeOfficeWorker } from '../tools/exec/adapters/python/worker/active.js';
+import { pptx, xlsx } from './engine/index.js';
+import { cellText, extractWith } from './extract.js';
+export { closeDocxWorker as closeOfficeWorker } from '../docx/index.js';
 const OFFICE_MIME_EXTENSIONS = {
     'application/vnd.openxmlformats-officedocument.wordprocessingml.document': '.docx',
     'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': '.xlsx',
     'application/vnd.openxmlformats-officedocument.presentationml.presentation': '.pptx'
 };
+const EXTRACT_CELL_LIMIT = 1_000_000;
+function columnIndex(letters) {
+    let index = 0;
+    for (const char of letters) {
+        index = index * 26 + char.charCodeAt(0) - 64;
+    }
+    return index;
+}
+function columnName(index) {
+    let name = '';
+    for (let n = index; n > 0; n = Math.floor((n - 1) / 26)) {
+        name = String.fromCharCode(65 + ((n - 1) % 26)) + name;
+    }
+    return name;
+}
+function trimmedRow(values) {
+    const row = [...values];
+    while (row.length && !cellText(row.at(-1)).trim()) {
+        row.pop();
+    }
+    return row;
+}
+function workbookText(bytes) {
+    const book = xlsx.open(bytes);
+    let output = '';
+    let budget = EXTRACT_CELL_LIMIT;
+    for (const sheet of book.sheets()) {
+        if (sheet.kind !== 'worksheet' || budget <= 0)
+            continue;
+        const { range, rows, formulas } = book.read(sheet.index, { limit: budget });
+        budget -= rows.length * (rows[0]?.length ?? 0);
+        const [, letters = 'A', digits = '1'] = /^([A-Z]+)(\d+)/.exec(range ?? 'A1') ?? [];
+        const firstColumn = columnIndex(letters);
+        const firstRow = Number(digits);
+        const lines = rows
+            .map((row, r) => trimmedRow(row.map((value, c) => value ?? formulas[`${columnName(firstColumn + c)}${firstRow + r}`] ?? null)))
+            .filter((row) => row.length)
+            .map((row) => row.map(cellText).join(' | '));
+        if (lines.length) {
+            output += `Sheet: ${sheet.name}\n${lines.join('\n')}\n`;
+        }
+    }
+    return output;
+}
+function shapeBlocks(shape) {
+    if (shape.paragraphs) {
+        const text = shape.paragraphs.map((paragraph) => paragraph.text).join('\n');
+        return text.trim() ? [text] : [];
+    }
+    return (shape.rows ?? [])
+        .map((row) => row.map(cellText))
+        .filter((cells) => cells.some((cell) => cell.trim()))
+        .map((cells) => cells.join(' | '));
+}
+function deckText(bytes) {
+    let output = '';
+    for (const slide of pptx.open(bytes).read()) {
+        const blocks = slide.shapes.flatMap(shapeBlocks);
+        if (blocks.length) {
+            output += `Slide ${slide.index + 1}\n${blocks.join('\n')}\n`;
+        }
+    }
+    return output;
+}
+const EXTRACTORS = new Map([
+    ['.xlsx', workbookText],
+    ['.pptx', deckText]
+]);
 export async function extractOfficeText(bytes, fileName, options = {}) {
     const mimeType = options.mimeType?.split(';')[0]?.trim().toLowerCase();
     const suffix = path.extname(fileName).toLowerCase();
@@ -18,21 +85,9 @@ export async function extractOfficeText(bytes, fileName, options = {}) {
     if (extension === '.docx') {
         return extractDocxText(bytes, fileName, options);
     }
-    if (extension === '.xlsx') {
-        return extractWithPython(bytes, fileName, {
-            format: 'XLSX',
-            packages: ['openpyxl==3.1.5'],
-            source: XLSX_EXTRACT,
-            signal: options.signal
-        });
-    }
-    if (extension === '.pptx') {
-        return extractWithPython(bytes, fileName, {
-            format: 'PPTX',
-            packages: ['python-pptx==1.0.2'],
-            source: PPTX_EXTRACT,
-            signal: options.signal
-        });
+    const extract = EXTRACTORS.get(extension ?? '');
+    if (extract) {
+        return extractWith(bytes, { fileName, signal: options.signal, extract });
     }
     throw new Error(`Unsupported Office document: ${fileName}`);
 }

package/dist-lib/lib/tools/exec/adapters/python/module-distributions.js

@@ -20,12 +20,10 @@ export const MODULE_DISTRIBUTIONS = {
     cvxpy: 'cvxpy-base',
     dateutil: 'python-dateutil',
     dns: 'dnspython',
-    docx: 'python-docx',
     erfa: 'pyerfa',
     fitz: 'PyMuPDF',
     flint: 'python-flint',
     flirt: 'python-flirt',
-    fpdf: 'fpdf2',
     google: 'protobuf',
     gridfs: 'pymongo',
     isympy: 'sympy',
@@ -33,7 +31,6 @@ export const MODULE_DISTRIBUTIONS = {
     mpl_toolkits: 'matplotlib',
     mypyc: 'mypy',
     nacl: 'pynacl',
-    pptx: 'python-pptx',
     pygame: 'pygame-ce',
     pylab: 'matplotlib',
     pysat: 'python-sat',

package/dist-lib/lib/tools/exec/adapters/python/python-adapter.d.ts

@@ -1,8 +1,7 @@
-import type { ExecAttachment } from '../../runner.ts';
 import type { ExecutionAdapter } from '../adapter.ts';
 import { type ExecInput } from './attachments.ts';
 import { type ExecError } from './output-policy.ts';
-import { type LoadPyodideFn, type PythonRunResult } from './pyodide.ts';
+import { type LoadPyodideFn } from './pyodide.ts';
 export declare function isPythonLanguage(language: unknown): boolean;
 export declare function runsThroughPyodide(language: unknown, disablePyodide: boolean): boolean;
 export declare function unwrapPythonSource(command: string): string | null;
@@ -20,70 +19,28 @@ export interface PipFromSourceHintOptions {
 export declare function pipFromSourceHint(stderr: string, source: string, { packages, sandbox }?: PipFromSourceHintOptions): string | null;
 export declare function stringLiteralProgramHint(source: string): string | null;
 export declare function checkCollapsedCompound(source: string): string | null;
-export declare function mangledPptxApiHint(source: string): string | null;
-export declare function wrongRgbColorHint(source: string): string | null;
-export declare function fpdfSizeKeywordHint(source: string): string | null;
-export declare function fpdfKeywordErrorHint(stderr: string): string | null;
-export declare function normalizeFpdfSource(source: string): string;
-export declare function fpdfTextCallHint(source: string): string | null;
-export declare function fpdfTextErrorHint(stderr: string): string | null;
-export declare function fpdfNonLatin1Hint(source: string): string | null;
-export declare function fpdfUnicodeErrorHint(stderr: string): string | null;
-export declare function fpdfHorizontalSpaceHint(stderr: string): string | null;
-export declare function rgbColorImportHint(stderr: string): string | null;
 export declare function checkPythonSource(command: string): string | null;
 export declare function syntaxErrorHint(stderr: string, source: string): string | null;
-export declare function checkPptxBuildSource(source: string, outputs: readonly string[] | undefined, packages?: readonly string[] | undefined): string | null;
-export declare function tripleQuoteAt(source: string, index: number): string | null;
-export declare function isEscaped(source: string, index: number): boolean;
-export declare function checkBareLengthArgs(source: string, packages?: readonly string[] | undefined): string | null;
-export declare function checkPdfBuildSource(source: string, outputs: readonly string[] | undefined, packages?: readonly string[] | undefined): string | null;
-export declare function stripCommentsAndDocstrings(source: string): string;
-export declare const PDF_READ: RegExp;
-export declare const OFFICE_READ: RegExp;
-export declare function checkUnstagedRead(source: string, inputs: readonly Pick<ExecInput, 'path'>[] | undefined): string | null;
 export declare function missingFileHint(stderr: string): string | null;
 export declare function parsePackages(value: unknown): string[] | ExecError | undefined;
 export declare function parseInputs(value: unknown): ExecInput[] | ExecError | undefined;
 export declare function parseOutputs(value: unknown): string[] | ExecError | undefined;
 export declare function parseWorkdir(value: unknown): string | ExecError | undefined;
+export interface OfficeImportContext {
+    readonly packages: readonly string[] | undefined;
+    readonly toolNames: readonly string[] | undefined;
+}
+export declare function officeModuleHint(stderr: string, toolNames: readonly string[] | undefined): string | null;
+export declare function officeImportError(source: string, { packages, toolNames }: OfficeImportContext): string | null;
 export interface MissingModuleHintOptions {
     readonly packages?: readonly string[] | undefined;
     readonly sandbox?: boolean;
     readonly network?: boolean;
 }
 export declare function missingModuleHint(stderr: string, { packages, sandbox, network }?: MissingModuleHintOptions): string | null;
-export declare function nonePlaceholderHint(stderr: string): string | null;
-export declare function slideShapesHint(stderr: string): string | null;
-export declare function shapeFontHint(stderr: string): string | null;
-export declare function shapesBackgroundHint(stderr: string): string | null;
-export declare function paragraphFillHint(stderr: string): string | null;
-export declare function readOnlyPropertyHint(stderr: string): string | null;
-export declare function paragraphIndexHint(stderr: string, outputs: readonly string[]): string | null;
 export declare function shellNameHint(stderr: string): string | null;
 export declare function noProcessHint(stderr: string, sandbox?: boolean): string | null;
 export declare function noNetworkHint(stderr: string, tools?: readonly string[], network?: boolean): string | null;
 export declare function nativeWheelHint(stderr: string): string | null;
 export declare function packageFetchFailedHint(stderr: string): string | null;
-export declare const IMAGE_INPUT: RegExp;
-export declare function pptxHasEmbeddedMedia(bytes: Uint8Array): boolean;
-export declare function softFailedDeckHint(stdout: string, exitCode: number, source: string): string | null;
-export interface DeckImagesOptions {
-    readonly inputs: readonly {
-        path: string;
-    }[] | undefined;
-    readonly outputs: readonly string[] | undefined;
-    readonly source: string;
-}
-export declare function stagedImagesMissingFromDeck(result: Pick<PythonRunResult, 'exitCode' | 'files'>, { inputs, outputs, source }: DeckImagesOptions): string | null;
-export declare function checkStagedImagesUsed(source: string, inputs: readonly Pick<ExecInput, 'path'>[] | undefined, outputs: readonly string[] | undefined): string | null;
-export interface TurnImagesStagedOptions {
-    readonly inputs: readonly ExecInput[] | undefined;
-    readonly outputs: readonly string[] | undefined;
-    readonly turnImages: readonly {
-        path: string;
-    }[] | undefined;
-}
-export declare function checkTurnImagesStaged(source: string, { inputs, outputs, turnImages }: TurnImagesStagedOptions): string | null;
-export declare function deckDeliveredStop(attachments: readonly Pick<ExecAttachment, 'fileName'>[] | undefined, exitCode: number, source?: string): string | null;
 export declare function createPythonAdapter(disabled: boolean, loadPyodide?: LoadPyodideFn, network?: boolean): ExecutionAdapter;