fraim-hub 2.0.274 → 2.0.276

package/dist/src/ai-hub/catalog.js

@@ -379,6 +379,27 @@ function readJobFrontmatter(filePath) {
         return null;
     }
 }
+/**
+ * Issue #1246: resolve the stub whose phase graph actually governs this job.
+ * A personalized override that is `extends`-only (no `phases`/`initialPhase`
+ * of its own) wins the layer-precedence override chain in findJobStubPath,
+ * but declares no phase graph AND has no `## Steps` section for
+ * loadJobPhasesFromSteps to fall back to either — every phase-derivation
+ * caller silently degraded to zero phases. Follow `extends` to the baseline
+ * stub when the resolved stub itself declares no phase graph.
+ */
+function resolveDeclaredPhaseStub(stubPath, projectPath) {
+    const fm = readJobFrontmatter(stubPath);
+    if (fm?.initialPhase && fm.phases)
+        return { fm, path: stubPath };
+    const extendsValue = typeof fm?.extends === 'string' ? fm.extends.trim() : '';
+    if (!extendsValue)
+        return { fm, path: stubPath };
+    const basePath = resolveExtendedStubPath(projectPath, extendsValue);
+    if (!basePath)
+        return { fm, path: stubPath };
+    return { fm: readJobFrontmatter(basePath), path: basePath };
+}
 function findJobStubPath(projectPath, jobId) {
     // Walk both employee and manager layer sets. The analytics surfaces can
     // inspect any FRAIM job run, including manager-side jobs such as
@@ -432,9 +453,9 @@ function loadJobPhases(jobId, projectPath, discriminant = 'feature') {
     const stubPath = findJobStubPath(projectPath, jobId);
     if (!stubPath)
         return [];
-    const fm = readJobFrontmatter(stubPath);
+    const { fm, path: declaredPath } = resolveDeclaredPhaseStub(stubPath, projectPath);
     if (!fm || !fm.initialPhase || !fm.phases)
-        return loadJobPhasesFromSteps(stubPath);
+        return loadJobPhasesFromSteps(declaredPath);
     const visited = new Set();
     const ordered = [];
     let cursor = fm.initialPhase;
@@ -461,7 +482,7 @@ function resolveJobPhaseTransition(jobId, projectPath, phaseId, outcome, discrim
     const stubPath = findJobStubPath(projectPath, jobId);
     if (!stubPath)
         return null;
-    const fm = readJobFrontmatter(stubPath);
+    const { fm } = resolveDeclaredPhaseStub(stubPath, projectPath);
     if (!fm || !fm.phases)
         return null;
     const phaseDef = fm.phases[phaseId];
@@ -474,9 +495,9 @@ function loadAllJobPhaseIds(jobId, projectPath) {
     const stubPath = findJobStubPath(projectPath, jobId);
     if (!stubPath)
         return new Set();
-    const fm = readJobFrontmatter(stubPath);
+    const { fm, path: declaredPath } = resolveDeclaredPhaseStub(stubPath, projectPath);
     if (!fm || !fm.phases) {
-        const phases = loadJobPhasesFromSteps(stubPath);
+        const phases = loadJobPhasesFromSteps(declaredPath);
         return new Set(phases.map((p) => p.id));
     }
     return new Set(Object.keys(fm.phases));

package/dist/src/ai-hub/configured-agent-command.js

@@ -0,0 +1,152 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseConfiguredCommand = parseConfiguredCommand;
+exports.describeConfiguredCommandInvocationProblem = describeConfiguredCommandInvocationProblem;
+exports.commandContainsLiteralSecret = commandContainsLiteralSecret;
+exports.decorateHostPlanWithConfiguredAgent = decorateHostPlanWithConfiguredAgent;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
+const BASH_ENV_PREFIX = /^([A-Za-z_][A-Za-z0-9_]*)=(?:\$\([^)]*\)|"[^"]*"|'[^']*'|\S*)\s+/;
+// The value may be a parenthesized PowerShell expression followed by a
+// property-access chain (e.g. `(Get-Content ... | ConvertFrom-Json).api_key`),
+// a quoted string, or a bare token — always terminated by the statement `;`.
+const POWERSHELL_ENV_PREFIX = /^\$env:[A-Za-z_][A-Za-z0-9_]*\s*=\s*(?:\([^)]*\)(?:\.[A-Za-z_][A-Za-z0-9_]*)*|"[^"]*"|'[^']*'|\S+?)\s*;\s*/;
+function parseConfiguredCommand(runner, commandText) {
+    let rest = String(commandText || '').trim();
+    const prefixPattern = runner === 'powershell' ? POWERSHELL_ENV_PREFIX : BASH_ENV_PREFIX;
+    let prefixEnd = 0;
+    while (true) {
+        const match = rest.slice(prefixEnd).match(prefixPattern);
+        if (!match)
+            break;
+        prefixEnd += match[0].length;
+    }
+    const envPrefixText = rest.slice(0, prefixEnd).trim();
+    const invocation = rest.slice(prefixEnd).trim();
+    const tokens = tokenizeShellLike(invocation);
+    return { envPrefixText, extraArgs: tokens.slice(1), invocationHead: tokens[0] || '' };
+}
+// Reviewer finding (PR #1209, Round 3): parseConfiguredCommand's leniency is
+// intentional for *parsing* (it never throws), but that leniency means a
+// structurally wrong command — most dangerously a shell built-in like `.`
+// (source) or `source` at the head, meant to load a setup script into the
+// current shell — parses "successfully" into a garbage invocationHead that
+// decorateHostPlanWithConfiguredAgent then silently discards, appending only
+// the path/args that followed it as bogus positional arguments to the real
+// agent binary instead of ever sourcing the script. Since the invocation
+// head is always discarded and replaced with Hub's own known base binary,
+// the only way to catch this class of error is to check, at readiness time,
+// that what the user typed there actually was that same base binary — not
+// to attempt to execute or otherwise interpret it.
+function describeConfiguredCommandInvocationProblem(parsed, baseHostId) {
+    if (!parsed.invocationHead) {
+        return 'Command has no invocation to run after the environment prefix.';
+    }
+    if (parsed.invocationHead !== baseHostId) {
+        return `Command must invoke "${baseHostId}" (found "${parsed.invocationHead}"). A setup script should be registered as a setup script, not composed into this field — see hub-configured-agent-setup.md.`;
+    }
+    return null;
+}
+function tokenizeShellLike(text) {
+    const tokens = [];
+    const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    let match;
+    while ((match = re.exec(text)) !== null) {
+        tokens.push(match[1] ?? match[2] ?? match[3]);
+    }
+    return tokens;
+}
+// Issue #1201 (R2.3): UX safety net only — flags what pattern-matches as a
+// literal high-entropy secret pasted into the command field. Not a substitute
+// for the routing skill never generating such a command in the first place.
+const LITERAL_SECRET_TOKEN = /^[A-Za-z0-9+/_.=-]{20,}$/;
+function commandContainsLiteralSecret(commandText) {
+    for (const token of String(commandText || '').split(/\s+/)) {
+        const eq = token.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const value = token.slice(eq + 1);
+        if (!value || value.startsWith('$') || value.startsWith('`') || value.startsWith('('))
+            continue;
+        if (LITERAL_SECRET_TOKEN.test(value))
+            return true;
+    }
+    return false;
+}
+// The env-prefix assignment is evaluated as a bash "temporary environment"
+// directly attached to the `exec` command on the same line (`VAR=$(...) exec
+// "$@"`), not as a separate statement before it. A bare `VAR=value` on its
+// own line only sets a local shell variable — it is NOT exported, so it
+// would silently vanish from the real binary's environment once `exec`
+// replaces this process image. Attaching it to the same command line is
+// exactly what a terminal user's `VAR=$(...) codex ...` already does.
+const BASH_LAUNCH_WRAPPER = [
+    '#!/usr/bin/env bash',
+    'set -e',
+    'if [ -n "$FRAIM_CONFIGURED_AGENT_ENV_PREFIX" ]; then',
+    '  eval "$FRAIM_CONFIGURED_AGENT_ENV_PREFIX exec \\"\\$@\\""',
+    'else',
+    '  exec "$@"',
+    'fi',
+    '',
+].join('\n');
+const POWERSHELL_LAUNCH_WRAPPER = [
+    '$ErrorActionPreference = "Stop"',
+    'if ($env:FRAIM_CONFIGURED_AGENT_ENV_PREFIX) {',
+    '  Invoke-Expression $env:FRAIM_CONFIGURED_AGENT_ENV_PREFIX',
+    '}',
+    '$exe = $args[0]',
+    'if ($args.Length -gt 1) { $rest = $args[1..($args.Length - 1)] } else { $rest = @() }',
+    '& $exe @rest',
+    'exit $LASTEXITCODE',
+    '',
+].join('\r\n');
+// Writes the small, fixed wrapper script that lets a configured-agent's
+// env-prefix (which may contain `$(...)`/`(...)` substitutions) resolve in a
+// real shell at spawn time, then `exec`s Hub's own required invocation with
+// the parsed extra CLI args appended. Content-checked so it self-heals like
+// any other FRAIM-generated artifact (issue #1206 precedent) rather than
+// silently going stale if regenerated with different logic.
+//
+// Security review (issue #1201): written under the per-user FRAIM home
+// (`getUserFraimDirPath()`), NOT `os.tmpdir()`. A predictable filename in a
+// shared, world-writable OS temp directory is a symlink-race target on
+// multi-user machines — another local user could pre-place a symlink at the
+// predictable path, and `fs.writeFileSync` would follow it and overwrite an
+// arbitrary file the *victim* user can write to. The per-user FRAIM home is
+// not shared across OS accounts, closing that class of attack.
+function ensureConfiguredAgentLaunchWrapper(runner) {
+    const content = runner === 'bash' ? BASH_LAUNCH_WRAPPER : POWERSHELL_LAUNCH_WRAPPER;
+    const filePath = path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), runner === 'bash' ? 'hub-configured-agent-launch.sh' : 'hub-configured-agent-launch.ps1');
+    const existing = fs_1.default.existsSync(filePath) ? fs_1.default.readFileSync(filePath, 'utf8') : null;
+    if (existing !== content) {
+        fs_1.default.writeFileSync(filePath, content, { encoding: 'utf8', mode: 0o755 });
+    }
+    return filePath;
+}
+function decorateHostPlanWithConfiguredAgent(plan, agent, agentEnv = {}) {
+    if (!agent)
+        return plan;
+    const withEnv = { ...plan, env: { ...(plan.env || {}), ...agentEnv } };
+    if (!agent.command)
+        return withEnv;
+    const parsed = parseConfiguredCommand(agent.command.runner, agent.command.command);
+    if (!parsed.envPrefixText && parsed.extraArgs.length === 0)
+        return withEnv;
+    const wrapperPath = ensureConfiguredAgentLaunchWrapper(agent.command.runner);
+    const realInvocation = [plan.command, ...plan.args, ...parsed.extraArgs];
+    const decoratedEnv = { ...withEnv.env, FRAIM_CONFIGURED_AGENT_ENV_PREFIX: parsed.envPrefixText };
+    if (agent.command.runner === 'bash') {
+        return { ...withEnv, command: 'bash', args: [wrapperPath, ...realInvocation], env: decoratedEnv };
+    }
+    return {
+        ...withEnv,
+        command: 'powershell.exe',
+        args: ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', wrapperPath, ...realInvocation],
+        env: decoratedEnv,
+    };
+}

package/dist/src/ai-hub/configured-agents.js

@@ -3,18 +3,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AiHubConfiguredAgentStore = void 0;
+exports.describeConfiguredCommandInvocationProblem = exports.decorateHostPlanWithConfiguredAgent = exports.commandContainsLiteralSecret = exports.parseConfiguredCommand = exports.AiHubConfiguredAgentStore = void 0;
 exports.synthesizeDefaultConfiguredAgents = synthesizeDefaultConfiguredAgents;
 exports.checkConfiguredAgentAvailability = checkConfiguredAgentAvailability;
 exports.checkConfiguredAgentReadiness = checkConfiguredAgentReadiness;
 exports.projectConfiguredAgent = projectConfiguredAgent;
 exports.resolveConfiguredAgentForHost = resolveConfiguredAgentForHost;
 exports.resolveConfiguredAgentEnv = resolveConfiguredAgentEnv;
-exports.decorateHostPlanWithConfiguredAgent = decorateHostPlanWithConfiguredAgent;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
+const configured_agent_command_1 = require("./configured-agent-command");
 const VALID_HOSTS = ['codex', 'claude', 'gemini', 'copilot'];
 const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function nowIso() {
@@ -48,6 +48,9 @@ function normalizeAgent(input) {
     const setupScript = normalizeSetupScript(input.setupScript);
     if (input.setupScript && !setupScript)
         return { ok: false, error: 'Setup script command is required.' };
+    const command = normalizeCommand(input.command);
+    if (input.command && !command)
+        return { ok: false, error: 'Command is required.' };
     const createdAt = input.createdAt || nowIso();
     return {
         ok: true,
@@ -57,6 +60,7 @@ function normalizeAgent(input) {
             ...(input.description && String(input.description).trim() ? { description: String(input.description).trim() } : {}),
             baseHostId,
             enabled: input.enabled !== false,
+            ...(command ? { command } : {}),
             ...(setupScript ? { setupScript } : {}),
             createdAt,
             updatedAt: nowIso(),
@@ -77,6 +81,24 @@ function normalizeSetupScript(value) {
         timeoutMs: typeof value.timeoutMs === 'number' && value.timeoutMs > 0 ? Math.min(value.timeoutMs, 120_000) : 30_000,
     };
 }
+// Issue #1201 (R2.1): the single-text-field setup surface. `runner` is an
+// internal execution detail — callers that omit it get the current platform's
+// default shell so the UI never has to ask the user to pick one.
+function normalizeCommand(value) {
+    if (!value)
+        return null;
+    const command = String(value.command || '').trim();
+    if (!command)
+        return null;
+    const runner = value.runner === 'bash' || value.runner === 'powershell'
+        ? value.runner
+        : (process.platform === 'win32' ? 'powershell' : 'bash');
+    return {
+        runner,
+        command,
+        timeoutMs: typeof value.timeoutMs === 'number' && value.timeoutMs > 0 ? Math.min(value.timeoutMs, 120_000) : 30_000,
+    };
+}
 function synthesizeDefaultConfiguredAgents(employees) {
     const timestamp = '1970-01-01T00:00:00.000Z';
     return employees
@@ -152,7 +174,12 @@ function checkConfiguredAgentAvailability(agent, employees, env = process.env) {
         reasons.push('Configured agent is disabled.');
     if (!employee?.available)
         reasons.push(`${employee?.label || agent.baseHostId} is not available on this machine.`);
-    if (agent.setupScript) {
+    if (agent.command) {
+        if (!agent.command.command.trim()) {
+            reasons.push('Command is empty.');
+        }
+    }
+    else if (agent.setupScript) {
         const command = agent.setupScript.command;
         const isPathLike = /[\\/]/.test(command) || /^[A-Za-z]:[\\/]/.test(command);
         if (isPathLike && !fs_1.default.existsSync(command)) {
@@ -160,13 +187,35 @@ function checkConfiguredAgentAvailability(agent, employees, env = process.env) {
         }
     }
     else if (!agent.id.endsWith('-default')) {
-        warnings.push('No setup script configured; this profile launches the base CLI unchanged.');
+        warnings.push('No command configured; this profile launches the base CLI unchanged.');
     }
     return { id: agent.id, label: agent.label, baseHostId: agent.baseHostId, enabled: agent.enabled, available: reasons.length === 0, reasons, warnings };
 }
 function checkConfiguredAgentReadiness(agent, employees, env = process.env) {
     const check = checkConfiguredAgentAvailability(agent, employees, env);
-    if (!check.available || !agent.setupScript)
+    if (!check.available)
+        return check;
+    if (agent.command) {
+        try {
+            const parsed = (0, configured_agent_command_1.parseConfiguredCommand)(agent.command.runner, agent.command.command);
+            const problem = (0, configured_agent_command_1.describeConfiguredCommandInvocationProblem)(parsed, agent.baseHostId);
+            if (problem) {
+                return { ...check, available: false, reasons: [...check.reasons, problem] };
+            }
+            return check;
+        }
+        catch (error) {
+            return {
+                ...check,
+                available: false,
+                reasons: [
+                    ...check.reasons,
+                    error instanceof Error ? error.message : 'Configured agent command could not be parsed.',
+                ],
+            };
+        }
+    }
+    if (!agent.setupScript)
         return check;
     try {
         resolveConfiguredAgentEnv(agent);
@@ -191,6 +240,7 @@ function projectConfiguredAgent(agent, employees) {
         ...(agent.description ? { description: agent.description } : {}),
         baseHostId: agent.baseHostId,
         enabled: agent.enabled,
+        ...(agent.command ? { command: { ...agent.command } } : {}),
         ...(agent.setupScript ? { setupScript: { ...agent.setupScript, args: [...(agent.setupScript.args || [])] } } : {}),
         createdAt: agent.createdAt,
         updatedAt: agent.updatedAt,
@@ -295,11 +345,13 @@ function filterSafeEnv(env) {
     }
     return safe;
 }
-function decorateHostPlanWithConfiguredAgent(plan, agent, agentEnv = {}) {
-    if (!agent)
-        return plan;
-    return {
-        ...plan,
-        env: { ...(plan.env || {}), ...agentEnv },
-    };
-}
+// Issue #1201: command parsing, secret detection, and launch decoration for
+// the single-command configured-agent surface live in their own module
+// (kept a cohesive, separately-testable unit rather than growing this file
+// past the 500-line quality threshold) — re-exported here so existing
+// callers importing from `./configured-agents` are unaffected.
+var configured_agent_command_2 = require("./configured-agent-command");
+Object.defineProperty(exports, "parseConfiguredCommand", { enumerable: true, get: function () { return configured_agent_command_2.parseConfiguredCommand; } });
+Object.defineProperty(exports, "commandContainsLiteralSecret", { enumerable: true, get: function () { return configured_agent_command_2.commandContainsLiteralSecret; } });
+Object.defineProperty(exports, "decorateHostPlanWithConfiguredAgent", { enumerable: true, get: function () { return configured_agent_command_2.decorateHostPlanWithConfiguredAgent; } });
+Object.defineProperty(exports, "describeConfiguredCommandInvocationProblem", { enumerable: true, get: function () { return configured_agent_command_2.describeConfiguredCommandInvocationProblem; } });

package/dist/src/ai-hub/desktop-main.js

@@ -107,7 +107,7 @@ function configureAutoUpdater() {
 function ensureWordSideload(projectPath, httpsPort) {
     // Flag version bump: bump this string when new manifests are added so all
     // users get re-sideloaded on their next launch.
-    const FLAG_VERSION = 'v5-https-port';
+    const FLAG_VERSION = 'v6-excel-addin';
     const expectedFlag = `${FLAG_VERSION}:${httpsPort}`;
     const flagPath = path_1.default.join(electron_1.app.getPath('userData'), 'word-sideloaded.flag');
     const existingFlag = fs_1.default.existsSync(flagPath) ? fs_1.default.readFileSync(flagPath, 'utf8') : null;

package/dist/src/ai-hub/hub-latest-version.js

@@ -4,28 +4,57 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLatestPublishedVersion = getLatestPublishedVersion;
+exports.getCachedLatestPublishedVersion = getCachedLatestPublishedVersion;
+exports.refreshLatestPublishedVersionInBackground = refreshLatestPublishedVersionInBackground;
 exports.__resetLatestVersionCache = __resetLatestVersionCache;
 const https_1 = __importDefault(require("https"));
 // Issue #755: best-effort "latest published fraim version" for the Hub's
 // update-available nudge. Cached in-process (1h TTL) and never throws — returns
 // null when offline or the registry is unreachable, so the nudge simply hides.
 const TTL_MS = 60 * 60 * 1000;
+const FAILED_RETRY_MS = 5 * 60 * 1000;
 const REGISTRY_URL = 'https://registry.npmjs.org/fraim/latest';
 let cache = { value: null, at: 0 };
+let lastAttemptAt = 0;
+let inFlight = null;
 async function getLatestPublishedVersion() {
     const now = Date.now();
     if (cache.at !== 0 && now - cache.at < TTL_MS)
         return cache.value;
-    const value = await fetchNpmLatest();
-    // Only cache successful lookups; a failed fetch retries next call rather than
-    // caching a null for an hour.
-    if (value !== null)
-        cache = { value, at: now };
-    return value ?? cache.value;
+    return refreshLatestPublishedVersion();
+}
+function getCachedLatestPublishedVersion() {
+    return cache.value;
+}
+function refreshLatestPublishedVersionInBackground() {
+    void refreshLatestPublishedVersion();
+}
+async function refreshLatestPublishedVersion() {
+    const now = Date.now();
+    if (cache.at !== 0 && now - cache.at < TTL_MS)
+        return cache.value;
+    if (inFlight)
+        return inFlight;
+    if (cache.value === null && lastAttemptAt !== 0 && now - lastAttemptAt < FAILED_RETRY_MS) {
+        return null;
+    }
+    lastAttemptAt = now;
+    inFlight = fetchNpmLatest()
+        .then((value) => {
+        if (value !== null)
+            cache = { value, at: Date.now() };
+        return value ?? cache.value;
+    })
+        .finally(() => {
+        inFlight = null;
+    });
+    return inFlight;
 }
 /** Test-only: reset the module cache. */
 function __resetLatestVersionCache() {
     cache = { value: null, at: 0 };
+    lastAttemptAt = 0;
+    inFlight = null;
 }
 function fetchNpmLatest() {
     return new Promise((resolve) => {

package/dist/src/ai-hub/office-sideload.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
- * Sideloads Office add-in manifests (Word + PowerPoint) so they appear under
- * Insert > My Add-ins > Developer Add-ins without admin rights or AppSource.
+ * Sideloads Office add-in manifests (Word + PowerPoint + Excel) so they appear
+ * under Insert > My Add-ins > Developer Add-ins without admin rights or AppSource.
  *
  * Windows: writes HKCU\SOFTWARE\Microsoft\Office\16.0\WEF\Developer\{<guid>}
  *          (Default) = ABSOLUTE FILE PATH to manifest.xml. This is the registry
@@ -52,6 +52,15 @@ const MANIFESTS = [
         ],
         macContainer: 'com.microsoft.Powerpoint',
     },
+    {
+        guid: 'da8d22c7-2c00-485a-bdc9-13dda7f80c48',
+        candidates: (base) => [
+            path_1.default.resolve(base, 'public/ai-hub/excel-taskpane/manifest.xml'),
+            path_1.default.resolve(__dirname, '..', '..', 'public/ai-hub/excel-taskpane/manifest.xml'),
+            path_1.default.resolve(__dirname, '..', '..', '..', 'public/ai-hub/excel-taskpane/manifest.xml'),
+        ],
+        macContainer: 'com.microsoft.Excel',
+    },
 ];
 function resolveManifestPath(entry, projectPath) {
     return entry.candidates(projectPath).find(c => fs_1.default.existsSync(c)) ?? null;
@@ -157,7 +166,7 @@ function sideloadManifest(projectPath, options = {}) {
     for (const entry of MANIFESTS) {
         const manifestPath = resolveManifestPath(entry, projectPath);
         if (!manifestPath) {
-            return { ok: false, reason: `Manifest not found for GUID ${entry.guid} — check extensions/office-word/ and public/ai-hub/powerpoint-taskpane/` };
+            return { ok: false, reason: `Manifest not found for GUID ${entry.guid} — check extensions/office-word/, public/ai-hub/powerpoint-taskpane/, and public/ai-hub/excel-taskpane/` };
         }
         const sideloadPath = prepareManifestForSideload(entry, manifestPath, options);
         if (process.platform === 'win32') {