mixdog 0.9.175 → 1.0.1

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -174,6 +174,23 @@ function hasMultipleAbsoluteWindowsPaths(value) {
   return Array.isArray(matches) && matches.length > 1;
 }
 
+// A string that only lists absolute Windows paths ("C:\a C:\b", "C:\a,C:\b",
+// "[C:/a, C:/b]", '["C:/a", "D:/b"]') splits exactly: every piece starts at a
+// drive root, and no drive root can occur inside a Windows path, so spaces
+// within a path stay put. Any other text around the paths returns null.
+function splitListedAbsoluteWindowsPaths(value) {
+  const body = value
+    .trim()
+    .replace(/^\[([\s\S]*)\]$/, '$1')
+    .replace(/^[\s,;]+|[\s,;]+$/g, '');
+  const pieces = body
+    .split(/[\s,;]+(?=["']?[A-Za-z]:[\\/])/)
+    .map((piece) => piece.replace(/^(["'])(.*)\1$/, '$2'));
+  return pieces.every((piece) => /^[A-Za-z]:[\\/]/.test(piece) && !/[A-Za-z]:[\\/]/.test(piece.slice(3)))
+    ? pieces
+    : null;
+}
+
 function isFiniteInt(v) {
   return typeof v === 'number' && Number.isFinite(v) && Math.floor(v) === v;
 }
@@ -418,8 +435,17 @@ function guardGrep(a) {
       return `Error: grep arg "${k}" must be string (got ${describeType(a[k])})`;
     }
   }
-  // Independent explicit scopes share one request; no inferred path splitting.
+  // Independent explicit scopes share one request. A string that only lists
+  // absolute paths is those scopes; any other string holding several drive
+  // roots is refused rather than guessed at.
   for (const k of ['path', 'root']) {
+    if (hasOwn(a, k) && hasMultipleAbsoluteWindowsPaths(a[k])) {
+      const listed = splitListedAbsoluteWindowsPaths(a[k]);
+      if (!listed) {
+        return `Error: grep arg "${k}" contains multiple absolute paths in one string. Use one common parent path plus glob, or separate grep calls.`;
+      }
+      a[k] = listed;
+    }
     if (hasOwn(a, k) && Array.isArray(a[k])) {
       if (a[k].length === 0 || a[k].length > PUBLIC_PATH_BATCH_LIMIT || !a[k].every(isNonEmptyString)) {
         return `Error: grep arg "${k}" must contain 1-${PUBLIC_PATH_BATCH_LIMIT} non-empty path strings`;
@@ -429,9 +455,6 @@ function guardGrep(a) {
     if (hasOwn(a, k) && !isString(a[k])) {
       return `Error: grep arg "${k}" must be string or string[] (got ${describeType(a[k])})`;
     }
-    if (hasOwn(a, k) && hasMultipleAbsoluteWindowsPaths(a[k])) {
-      return `Error: grep arg "${k}" contains multiple absolute paths in one string. Use one common parent path plus glob, or separate grep calls.`;
-    }
   }
   for (const k of ['head_limit', 'offset']) {
     const err = checkIntInRange(a, k, 0, MAX_INT);

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/benign-exit.mjs

@@ -14,6 +14,8 @@ import {
 // shared shell tokenizers, so quoted/commented `;` `|` `grep` can never
 // masquerade as a connector/command and hide a real failure.
 const _SEARCH_HEADS = new Set(['select-string', 'sls', 'grep', 'egrep', 'fgrep', 'findstr']);
+// `git diff` flags whose exit 1 reports a difference, not a failure.
+export const GIT_DIFF_EXIT_SIGNAL_FLAGS = new Set(['--exit-code', '--quiet', '--check']);
 const _GIT_GLOBAL_VALUE_OPTS = new Set([
   '-c',
   '-C',
@@ -75,12 +77,14 @@ export function _isBenignSearchExitOne(command, exitCode, signal, stderr) {
   const head = _normalizeHead(tokens[0]);
   if (_SEARCH_HEADS.has(head)) return true;
   if (head !== 'git') return false;
-  // `git [global-opts] diff ...` only — exact `diff` subcommand, never
-  // diff-index/diff-files/difftool — with exit-code semantics.
+  // `git [global-opts] grep ...` (no match), or `git [global-opts] diff ...`
+  // only — exact `diff` subcommand, never diff-index/diff-files/difftool —
+  // with exit-code semantics.
   let i = 1;
   while (i < tokens.length && tokens[i].startsWith('-')) {
     i += _GIT_GLOBAL_VALUE_OPTS.has(tokens[i]) && !tokens[i].includes('=') ? 2 : 1;
   }
+  if (tokens[i] === 'grep') return true;
   if (tokens[i] !== 'diff') return false;
-  return tokens.slice(i + 1).some((t) => t === '--exit-code' || t === '--quiet' || t === '--check');
+  return tokens.slice(i + 1).some((t) => GIT_DIFF_EXIT_SIGNAL_FLAGS.has(t));
 }

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -58,6 +58,7 @@ export const BUILTIN_TOOLS = [
             {
               type: 'array',
               minItems: 1,
+              maxItems: PUBLIC_PATH_BATCH_LIMIT,
               items: {
                 anyOf: [
                   { type: 'string' },

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -3,6 +3,7 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 import { tokenizeDirectArgv } from './shell-direct-exe.mjs';
+import { GIT_DIFF_EXIT_SIGNAL_FLAGS } from './bash-tool/benign-exit.mjs';
 import { withBuiltinPathLocks } from './path-locks.mjs';
 import { withAdvisoryLocks } from './advisory-lock.mjs';
 import { withGitRepoReadLock, withGitRepoWriteLock } from './git-repo-rw-lock.mjs';
@@ -154,8 +155,13 @@ function commandResult(plan, result, limit) {
   const output = capOutput(appendText(String(result.stdout || ''), String(result.stderr || '')), limit);
   if (succeeded(result)) return { text: output, failed: false };
   const processError = result.error || result.timedOut || result.aborted || result.overflow || result.exitCode == null;
+  // An exit signal is still a non-zero exit, so a command array stops on it;
+  // the outcome line only keeps the card from reporting a failure.
+  const exitHeader = exitSignal(plan, result)
+    ? `exit ${result.exitCode}\n[outcome: no-match]`
+    : `exit ${result.exitCode}`;
   return {
-    text: appendText(processError ? fail(gitFailureReason(plan, result)) : `exit ${result.exitCode}`, output),
+    text: appendText(processError ? fail(gitFailureReason(plan, result)) : exitHeader, output),
     failed: true,
   };
 }
@@ -337,6 +343,18 @@ function succeeded(result) {
   return result?.exitCode === 0 && !result.error && !result.timedOut && !result.aborted && !result.overflow;
 }
 
+// `git grep` exits 1 for no match and `git diff --exit-code/--quiet/--check`
+// exits 1 to report a difference; the shell tool marks the same exits as
+// signals, so the git tool does too.
+function exitSignal(plan, result) {
+  if (result.exitCode !== 1 || String(result.stderr || '').trim()) return false;
+  if (plan.operation === 'grep') return true;
+  if (plan.operation !== 'diff') return false;
+  const separator = plan.args.indexOf('--');
+  const options = separator === -1 ? plan.args : plan.args.slice(0, separator);
+  return options.some((arg) => GIT_DIFF_EXIT_SIGNAL_FLAGS.has(arg));
+}
+
 // ENOENT from the spawn itself is a capability fact, not a git error: the
 // executable is absent. Naming it stops the caller from re-running git a
 // different way to find out.
@@ -780,8 +798,26 @@ function splitChainedGitCommands(command) {
   return commands.length > 1 ? commands : null;
 }
 
-export async function executeGitTool(input, workDir, options = {}) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) return fail('git requires an arguments object');
+// The tool only runs git, so a submitted command that omits the leading `git`
+// ("status --short") gets it instead of a rejection. Only whole submitted
+// commands are prefixed; a `&&` piece after the first still has to be a full
+// git command, so non-git chain segments stay refused.
+function withGitPrefix(command) {
+  if (typeof command !== 'string') return command;
+  const text = String(unwrapQuotedCommand(command)).trim();
+  const first = text ? tokenizeDirectArgv(text)?.[0] : '';
+  if (!first || /(^|[\\/])git(?:\.exe)?$/i.test(first)) return command;
+  return `git ${text}`;
+}
+
+export async function executeGitTool(rawInput, workDir, options = {}) {
+  if (!rawInput || typeof rawInput !== 'object' || Array.isArray(rawInput))
+    return fail('git requires an arguments object');
+  const input = {
+    ...rawInput,
+    command: Array.isArray(rawInput.command) ? rawInput.command.map(withGitPrefix) : withGitPrefix(rawInput.command),
+  };
+  if (rawInput.command === undefined) delete input.command;
   const action = input.action ?? 'command';
   if (action === 'stage') {
     if (input.command !== undefined || input.include_stage_ids !== undefined) {

package/src/runtime/agent/orchestrator/tools/builtin/read-batch.mjs

@@ -33,7 +33,9 @@ export function sliceReadBodyByLines(body, origOffset, origLimit, readOffsetBase
       if (ln < minSeen) minSeen = ln;
       if (ln > maxSeen) maxSeen = ln;
       if (ln >= firstLine && ln <= lastLine) kept.push(line);
-    } else if (kept.length === 0 && footerIdx === -1) {
+    } else if (kept.length === 0 && footerIdx === -1 && !Number.isFinite(maxSeen)) {
+      // Only a preamble before the first numbered row; a blank line or a
+      // truncation marker after the rows is not this slot's content.
       kept.push(line);
     }
   }

package/src/runtime/agent/orchestrator/tools/builtin/read-tool/batch-dispatch.mjs

@@ -42,7 +42,8 @@ async function estimateTaskBytes(entry, workDir) {
   if (!st?.isFile()) return Infinity;
   const lines = Math.max(1, st.size / AVG_LINE_BYTES);
   let need = st.size + st.size / MIN_LINE_BYTES * LINE_PREFIX_BYTES;
-  const limit = Number(entry?.limit);
+  // A coalesced entry reads its whole union window, not only its own slot.
+  const limit = Number(readEntryCoalescedDiskWindow(entry)?.limit ?? entry?.limit);
   if (Number.isFinite(limit) && limit > 0) need *= Math.min(1, limit / lines);
   return Math.ceil(need) + READ_RENDER_SLACK_BYTES;
 }

package/src/runtime/agent/orchestrator/tools/code-graph/build.mjs

@@ -100,9 +100,12 @@ function _throwIfAborted(signal) {
   if (signal?.aborted) throw new Error('aborted');
 }
 
-function codeGraphBuildInvalidatedError() {
+// `graph` is the build that finished anyway: the tree as of its own manifest,
+// never cached as current. The last retry answers from it instead of failing.
+function codeGraphBuildInvalidatedError(graph = null) {
   const error = new Error('code-graph build invalidated during prewarm');
   error.code = 'ERR_CODE_GRAPH_BUILD_INVALIDATED';
+  if (graph) error.graph = graph;
   return error;
 }
 
@@ -115,7 +118,12 @@ export async function _retryCodeGraphBuildAfterInvalidation(run, { signal = null
     try {
       return await run(attempt);
     } catch (error) {
-      if (signal?.aborted || !isCodeGraphBuildInvalidatedError(error) || attempt === 1) {
+      if (signal?.aborted || !isCodeGraphBuildInvalidatedError(error)) throw error;
+      // Files kept changing through the retry too (another session editing
+      // the same tree). The finished graph is a consistent snapshot a few
+      // seconds old; answer this query from it rather than fail it.
+      if (attempt === 1) {
+        if (error.graph) return error.graph;
         throw error;
       }
     }
@@ -159,7 +167,7 @@ async function _validateDiskCodeGraphHit({
   if (diskEntry.signature !== signature) return { graph: null, manifest, signature };
   const graph = deserializeGraph(graphCwd, diskEntry);
   if (!graph) return { graph: null, manifest, signature };
-  if (getGeneration(graphCwd) !== genAtStart) return { invalidated: true };
+  if (getGeneration(graphCwd) !== genAtStart) return { invalidated: true, graph };
   setMemoryCache(graphCwd, { ts: now, signature, graph });
   return { graph, manifest, signature };
 }
@@ -195,7 +203,7 @@ export async function _runDiskCodeGraphFastPath({
     _throwIfAborted(signal);
     const hit = await validateDiskHit({ graphCwd, diskEntry, genAtStart, signal });
     _throwIfAborted(signal);
-    if (hit?.invalidated) throw codeGraphBuildInvalidatedError();
+    if (hit?.invalidated) throw codeGraphBuildInvalidatedError(hit.graph);
     if (hit?.graph) return hit.graph;
     _throwIfAborted(signal);
     const workerPromise = spawnWorker(release, hit?.manifest || null, hit?.signature || null);
@@ -463,7 +471,7 @@ export function _spawnCodeGraphWorker(
               // manifest lock.
               setDiskCache(graphCwd, msg.graph, { persist: false });
             }
-            settle(genStillCurrent ? msg.graph : codeGraphBuildInvalidatedError());
+            settle(genStillCurrent ? msg.graph : codeGraphBuildInvalidatedError(msg.graph));
           } else {
             settle(_codeGraphWorkerFailure(msg));
           }

package/src/runtime/computer-bridge/error-recovery.mjs

@@ -79,7 +79,7 @@ function recoveryForCode(code, args) {
       code,
       next: 'wait_for_user',
       guidance:
-        'Computer Use yielded to the user. Call wait_for_user for bounded waiting. Ordinary physical input may resume after the host-configured quiet interval (default 5 seconds); explicit stops and uncertain cleanup/observation require the user. Timeout does not authorize input. After resumed, capture fresh state; never replay interrupted input. Manual Resume is also available on the overlay.',
+        "Computer Use yielded to the user. Call wait_for_user for bounded waiting. The user's Resume on the overlay continues the pause, and ordinary physical input may also resume after the host-configured quiet interval (default 5 seconds); explicit stops and uncertain cleanup/observation require the user. Stop cancels the task. Timeout does not authorize input. After resumed, capture fresh state; never replay interrupted input.",
     };
   }
   if (DIAGNOSE_CODES.has(code)) {

package/src/runtime/memory/lib/runtime-fetcher.mjs

@@ -7,9 +7,12 @@ import { __mixdogMemoryLog } from './memory-log.mjs';
 // Downloads and verifies a prebuilt native PG runtime from the mixdog GitHub
 // release manifest.
 //
-// Layout: <dataDir>/runtime/runtime-{ver}/  +  <dataDir>/runtime/active-version
+// Layout: <dataDir>/runtime/runtime-{key}/  +  <dataDir>/runtime/active-version
+// holding {key}. New installs key the directory by version plus asset digest;
+// installs from before that keep their bare-version key and stay valid.
 // Atomic swap: write active-version.tmp then rename → active-version.
-// GC: removes stale runtime-* dirs and staging-* dirs on every ensureRuntime call.
+// GC: removes stale runtime-* dirs and staging-* dirs on every ensureRuntime
+// call, but only a dir that can be moved aside whole (never one in use).
 //
 // Public API: ensureRuntime(dataDir) → { runtimeDir, pgBinDir, libDir, sharePath, version }
 
@@ -21,6 +24,7 @@ import {
   openSync,
   readFileSync,
   readdirSync,
+  renameSync,
   rmSync,
   statSync,
   unlinkSync,
@@ -109,6 +113,38 @@ function runtimeVerDir(runtimeDir, ver) {
   return join(runtimeDir, `runtime-${ver}`);
 }
 
+// A rebuilt asset of the same version gets its own directory, so installing it
+// never touches the tree a still-running PostgreSQL may hold open.
+function runtimeInstallKey(version, sha256) {
+  return `${version}-${String(sha256).slice(0, 12)}`;
+}
+
+// True while a PostgreSQL from this runtime is running: a running executable
+// cannot be opened for writing (EBUSY on Windows, ETXTBSY on Linux).
+function runtimeDirInUse(dir) {
+  const exe = join(dir, 'bin', process.platform === 'win32' ? 'postgres.exe' : 'postgres');
+  try {
+    closeSync(openSync(exe, 'r+'));
+    return false;
+  } catch (error) {
+    return error?.code === 'EBUSY' || error?.code === 'ETXTBSY';
+  }
+}
+
+// Remove a runtime dir only when nothing runs from it, moving it aside whole
+// first. Deleting in place could strip a running PostgreSQL's files and the
+// sha stamp while the locked binaries survive, leaving a tree that looks
+// installed but is not; an in-use dir makes this throw and stays intact.
+function discardRuntimeDir(runtimeDir, dir) {
+  if (runtimeDirInUse(dir)) throw new Error(`[runtime-fetcher] runtime dir is in use: ${dir}`);
+  const trash = join(
+    runtimeDir,
+    `staging-discard-${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`
+  );
+  renameSync(dir, trash);
+  rmSync(trash, { recursive: true, force: true });
+}
+
 function runtimePaths(verDir) {
   return {
     pgBinDir: join(verDir, 'bin'),
@@ -370,9 +406,11 @@ function gcRuntimeDir(runtimeDir, keepVer) {
           continue;
         }
         const dir = join(runtimeDir, name);
-        const lockPath = stagingLockPath(dir);
-        // Never wipe a staging dir guarded by a LIVE lock — that is a sibling
-        // process mid-extract/swap.
+        // A download (staging-{tag}.tar.gz) is guarded by its staging dir's lock.
+        const guardName = name.endsWith('.tar.gz') ? name.slice(0, -'.tar.gz'.length) : name;
+        const lockPath = stagingLockPath(join(runtimeDir, guardName));
+        // Never wipe a staging dir or download guarded by a LIVE lock — that is
+        // a sibling process mid-download/extract/swap.
         if (_stagingLockIsLive(lockPath)) continue;
         try {
           rmSync(dir, { recursive: true, force: true });
@@ -382,8 +420,10 @@ function gcRuntimeDir(runtimeDir, keepVer) {
           if (existsSync(lockPath)) unlinkSync(lockPath);
         } catch {}
       } else if (name.startsWith('runtime-') && name !== `runtime-${keepVer}`) {
+        const path = join(runtimeDir, name);
         try {
-          rmSync(join(runtimeDir, name), { recursive: true, force: true });
+          if (statSync(path).isDirectory()) discardRuntimeDir(runtimeDir, path);
+          else rmSync(path, { force: true });
         } catch {}
       }
     }
@@ -451,11 +491,36 @@ function selectRuntimeAsset(manifest, pkey) {
 /** Fast path: the active-version pointer names this version and the extracted
  *  tree carries the expected sha256. Returns the reusable dir, else null. */
 function cachedRuntimeDir(runtimeBaseDir, version, sha256) {
-  if (readActiveVersion(runtimeBaseDir) !== version) return null;
-  const verDir = runtimeVerDir(runtimeBaseDir, version);
-  if (!existsSync(join(verDir, '.version-sha256'))) return null;
-  const stored = readFileSync(join(verDir, '.version-sha256'), 'utf8').trim();
-  return stored === sha256 ? verDir : null;
+  const key = readActiveVersion(runtimeBaseDir);
+  if (key !== version && key !== runtimeInstallKey(version, sha256)) return null;
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
+  return readRuntimeStamp(verDir) === sha256 ? verDir : null;
+}
+
+// The asset digest stamped into a complete runtime tree, '' when absent.
+function readRuntimeStamp(verDir) {
+  try {
+    return readFileSync(join(verDir, '.version-sha256'), 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+// Publish an extracted, stamped staging tree as runtime-{key} and point
+// active-version at it. A sibling that raced this install may already have
+// published the same asset: that tree is kept (it may be running) and this
+// copy dropped. Any other runtime-{key} tree is an interrupted install of this
+// asset; it is moved aside whole, and an in-use one fails the publish intact.
+function publishRuntimeDir(runtimeBaseDir, stagingDir, key, sha256) {
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
+  if (readRuntimeStamp(verDir) === sha256) {
+    rmSync(stagingDir, { recursive: true, force: true });
+  } else {
+    if (existsSync(verDir)) discardRuntimeDir(runtimeBaseDir, verDir);
+    renameWithRetrySync(stagingDir, verDir);
+  }
+  writeFileAtomicSync(activeVersionPath(runtimeBaseDir), key, { fsyncDir: true });
+  return verDir;
 }
 
 /**
@@ -476,10 +541,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
   // process fail to obtain the lock for its own staging dir).
   const stagingTag = `${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
   const stagingDir = join(runtimeBaseDir, `staging-${stagingTag}`);
-  const tarPath = join(runtimeBaseDir, `runtime-${pkey}-${stagingTag}.tar.gz`);
+  // Named after the staging dir so the same live lock guards it from GC.
+  const tarPath = `${stagingDir}.tar.gz`;
 
-  const verDir = runtimeVerDir(runtimeBaseDir, version);
-  const avPath = activeVersionPath(runtimeBaseDir);
+  const key = runtimeInstallKey(version, sha256);
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
 
   // Cross-process lock: hold the staging lockfile (O_EXCL) for the WHOLE
   // download → extract → swap lifetime. GC in any concurrently-booting sibling
@@ -527,16 +593,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
     normalizeBinExecBit(stagingDir);
 
     // Atomic swap:
-    // 1. Rename staging → runtime-{ver}
+    // 1. Rename staging → runtime-{key} (or reuse a sibling's identical publish)
     // 2. Write active-version.tmp → rename to active-version
     // Stale dirs cleaned up by GC after.
     try {
-      // If a prior runtime-{ver} dir exists (interrupted earlier run), remove it.
-      if (existsSync(verDir)) {
-        rmSync(verDir, { recursive: true, force: true });
-      }
-      renameWithRetrySync(stagingDir, verDir);
-      writeFileAtomicSync(avPath, version, { fsyncDir: true });
+      publishRuntimeDir(runtimeBaseDir, stagingDir, key, sha256);
     } catch (swapErr) {
       __mixdogMemoryLog(`[runtime-fetcher] atomic swap failed: ${swapErr.message}\n`);
       // Attempt to leave things in a recoverable state: if verDir landed but
@@ -544,10 +605,10 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
       throw swapErr;
     }
 
-    // GC: remove stale runtime-* dirs (anything that isn't runtime-{version}).
+    // GC: remove stale runtime-* dirs (anything that isn't runtime-{key}).
     // Still under the lock so the just-swapped staging lockfile reap below sees
     // a consistent view.
-    gcRuntimeDir(runtimeBaseDir, version);
+    gcRuntimeDir(runtimeBaseDir, key);
   } finally {
     releaseStagingLock(stagingLock);
   }
@@ -556,6 +617,16 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
   return verDir;
 }
 
+export const _runtimeLayoutInternals = {
+  acquireStagingLock,
+  cachedRuntimeDir,
+  discardRuntimeDir,
+  gcRuntimeDir,
+  publishRuntimeDir,
+  releaseStagingLock,
+  runtimeInstallKey,
+};
+
 export async function ensureRuntime(dataDir) {
   const key = resolve(dataDir);
   if (runtimeCache.has(key)) return runtimeCache.get(key);

package/src/runtime/office/capabilities-catalog.mjs

@@ -139,6 +139,7 @@ export const CATALOG = {
     properties: {
       paragraph: ['style'],
       font: ['name', 'nameEastAsia', 'size', 'bold', 'italic', 'underline', 'color', 'hidden'],
+      documentFont: ['name', 'nameEastAsia', 'size', 'color'],
       page: [
         'pageSize',
         'orientation',
@@ -169,6 +170,7 @@ export const CATALOG = {
         'headerRows',
         'keepWithNext',
       ],
+      tableStyle: ['style', 'alignment', 'columnAlignments', 'columnWidths', 'borders', 'shading'],
       tableCell: [
         'fillColor',
         'horizontalAlignment',

package/src/runtime/office/capabilities-signatures.mjs

@@ -1,8 +1,13 @@
 // Operation input signatures: which fields each Office operation requires,
 // accepts, or takes as alternatives, per format.
+import { XLSX_VALIDATION_OPERATORS, XLSX_VALIDATION_TYPES } from './portable/xlsx-contract.mjs';
 
-export function signature(required = [], optional = [], { oneOf = [], propertySets = [], notes = '' } = {}) {
-  return { required, optional, oneOf, propertySets, notes };
+export function signature(
+  required = [],
+  optional = [],
+  { oneOf = [], propertySets = [], propertyBackends = {}, notes = '' } = {}
+) {
+  return { required, optional, oneOf, propertySets, propertyBackends, notes };
 }
 
 export const COMMON_SIGNATURES = {
@@ -66,9 +71,10 @@ export const FORMAT_SIGNATURES = {
         'properties.alignment places the table on the page (left, center, right); properties.columnAlignments sets the text of each column (one of left, center, right, justify per column); without it a column of figures (184,200, 2.1%, 2.6억 원) sets right and the rest left. Without style, borders, or shading the table takes a bold header row with a rule under it and hairlines between rows; headerBold:false keeps the header plain. properties.headerRows (default 1) is how many rows the header takes: a two-level header, its group label merged across the columns it spans (merge_table_cells), is headerRows:2, and every header row is set bold on its bottom edge and repeats on a continuation page.',
     }),
     set_table_style: signature(['table', 'properties'], [], {
-      propertySets: ['table'],
+      propertySets: ['tableStyle'],
+      propertyBackends: { columnWidths: ['microsoft-office-com'] },
       notes:
-        'Replaces the table-level properties; columnAlignments re-aligns the text of every existing cell in each column.',
+        'Replaces table-level properties; columnAlignments re-aligns existing cells. columnWidths is Microsoft Office only. For existing cell fonts or fills use set_table_cell_style, not set_table_style.',
     }),
     merge_table_cells: signature(['table', 'row', 'col'], ['rowSpan', 'colSpan'], {
       notes:
@@ -91,7 +97,7 @@ export const FORMAT_SIGNATURES = {
     move_paragraph: signature(['paragraph', 'index']),
     set_paragraph_style: signature(['paragraph', 'style']),
     set_document_font: signature(['properties'], [], {
-      propertySets: ['font'],
+      propertySets: ['documentFont'],
       notes:
         "The document's own face, size, and ink — what every paragraph without its own reads, and what a paragraph added later in Word or by append_text starts from. properties: name, nameEastAsia, size, color.",
     }),
@@ -325,7 +331,7 @@ export const FORMAT_SIGNATURES = {
       ['sheet', 'type', 'operator', 'formula2', 'inputMessage', 'errorMessage'],
       {
         notes:
-          'type is list, whole, decimal, date, time, textLength, or custom; without it a formula naming choices ("a,b,c" or $A$1:$A$9) becomes a list and any other formula a custom rule. A ranged kind takes operator (between by default with formula2) and its bounds. Under protect_sheet the entry cells need set_style properties { locked: false } or nobody can type in them.',
+          `type: ${XLSX_VALIDATION_TYPES.join(', ')}. Without type, choices ("a,b,c" or $A$1:$A$9) mean list; other formulas mean custom. Numeric/date/time/textLength rules take operator: ${XLSX_VALIDATION_OPERATORS.join(', ')} (default between). between/notBetween require formula2; other operators use formula1. Example: type:"whole", operator:"greaterThanOrEqual", formula1:"0". Under protect_sheet unlock entry cells with set_style properties:{ locked:false }.`,
       }
     ),
     freeze_panes: signature([], ['sheet', 'row', 'column'], {

package/src/runtime/office/capabilities.mjs

@@ -3,6 +3,7 @@ import { plainObject } from './shared/values.mjs';
 import { FIELD_ALIASES, OPERATION_ALIASES, PROPERTY_ALIASES } from './capabilities-aliases.mjs';
 import { BACKENDS, CATALOG, COMMON, VIRTUAL_OPERATIONS } from './capabilities-catalog.mjs';
 import { COMMON_SIGNATURES, FORMAT_SIGNATURES, signature } from './capabilities-signatures.mjs';
+import { normalizeXlsxValidation } from './portable/xlsx-contract.mjs';
 
 export { OFFICE_ACTIONS } from './capabilities-catalog.mjs';
 
@@ -141,6 +142,19 @@ function describeHint(format, backend, operation) {
   })}.`;
 }
 
+function operationProperties(catalog, signatureValue, backend) {
+  return Object.fromEntries(
+    signatureValue.propertySets
+      .filter((name) => catalog.properties[name])
+      .map((name) => [
+        name,
+        catalog.properties[name].filter(
+          (field) => !backend || !signatureValue.propertyBackends[field] || signatureValue.propertyBackends[field].includes(backend)
+        ),
+      ])
+  );
+}
+
 function operationDescription(format, backend, catalog, requested) {
   const knownOperations = catalogOperations(format);
   const operation = resolveOperationAlias(format, requested);
@@ -152,11 +166,7 @@ function operationDescription(format, backend, catalog, requested) {
   }
   const available = operationsForBackend(format, backend);
   const signatureValue = operationSignature(format, operation);
-  const properties = Object.fromEntries(
-    signatureValue.propertySets
-      .filter((name) => catalog.properties[name])
-      .map((name) => [name, catalog.properties[name]])
-  );
+  const properties = operationProperties(catalog, signatureValue, backend);
   return {
     name: operation,
     ...(VIRTUAL_OPERATIONS.has(operation) || VIRTUAL_OPERATIONS.has(`${format}:${operation}`) ? { virtual: true } : {}),
@@ -311,10 +321,10 @@ function hoistGeometryProperties(signatureValue, operation, allowed) {
   delete operation.properties;
 }
 
-function propertyKeySet(catalog, signatureValue) {
+function propertyKeySet(catalog, signatureValue, backend) {
   return new Set(
-    signatureValue.propertySets
-      .flatMap((set) => catalog.properties?.[set] || [])
+    Object.values(operationProperties(catalog, signatureValue, backend))
+      .flat()
       .map((entry) => String(entry).split('.')[0])
   );
 }
@@ -474,14 +484,24 @@ function operationContractFaults(batch, operation, index) {
   if (cellFault) return [cellFault];
   hoistComposeSheetTable(format, name, operation);
   hoistGeometryProperties(signatureValue, operation, allowed);
-  const propertyKeys = propertyKeySet(catalog, signatureValue);
+  const propertyKeys = propertyKeySet(catalog, signatureValue, backend);
   const missing = signatureValue.required.filter((field) => !suppliedField(operation, field, stableTargets));
-  return [
+  const faults = [
     unknownFieldsFault(batch, name, operation, index, { allowed, propertyKeys, missing }),
     unknownPropertiesFault(batch, name, operation, index, propertyKeys),
     ...docxTableAlignmentFaults(format, name, operation, index),
     requiredInputFault(batch, name, operation, index, signatureValue, stableTargets),
   ].filter(Boolean);
+  if (!faults.length && format === 'xlsx' && name === 'add_validation') {
+    try {
+      Object.assign(operation, normalizeXlsxValidation(operation));
+    } catch (error) {
+      faults.push(
+        `XLSX operation "${name}" at operation ${index + 1}: ${error.message}. ${describeHint(format, backend, name)}`
+      );
+    }
+  }
+  return faults;
 }
 
 export function assertOfficeOperationContracts({ format = '', backend = '', operations = [] } = {}) {

package/src/runtime/office/core/office-actions-open.mjs

@@ -10,12 +10,7 @@ import {
   releaseOfficeSession,
   toolResult,
 } from './office-core.mjs';
-import { createSession, openSession, snapshot } from './office-sessions.mjs';
-
-function initialOfficeOperations(args) {
-  if (Array.isArray(args.operations) && args.operations.length) return args.operations;
-  return Array.isArray(args.design?.operations) ? args.design.operations : [];
-}
+import { createSession, initialOfficeOperations, openSession, snapshot } from './office-sessions.mjs';
 
 async function discardFailedOfficeSession(session, { action, initialEditSettled }) {
   if (session.reused) return;

package/src/runtime/office/core/office-sessions.mjs

@@ -3,6 +3,7 @@ import { constants as fsConstants } from 'node:fs';
 import { basename, dirname, extname, isAbsolute, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { randomUUID } from 'node:crypto';
+import { assertOfficeOperationContracts } from '../capabilities.mjs';
 import {
   callMicrosoftOffice,
   detectMicrosoftOffice,
@@ -496,6 +497,11 @@ async function createMicrosoftOfficeSession(creation, args, mode) {
   });
 }
 
+export function initialOfficeOperations(args) {
+  if (Array.isArray(args.operations) && args.operations.length) return args.operations;
+  return Array.isArray(args.design?.operations) ? args.design.operations : [];
+}
+
 export async function createSession(args, cwd, dataDir) {
   const requestedPath = String(args.path || args.output || '').trim();
   if (!requestedPath) throw new Error('create requires path or output');
@@ -506,6 +512,8 @@ export async function createSession(args, cwd, dataDir) {
   if (format !== inferredFormat)
     throw new Error(`Office create format ${args.format} does not match target .${fileKind}`);
   assertCreateContentFields(format, args);
+  const initialOperations = initialOfficeOperations(args);
+  assertOfficeOperationContracts({ format, operations: initialOperations });
   // Whether this call brings the file into being decides what a failed create
   // may clean up afterwards: a file it wrote itself, never one already there.
   const targetExisted = await exists(target);
@@ -528,6 +536,7 @@ export async function createSession(args, cwd, dataDir) {
     throw new Error('Office create requires visible, background, or portable mode');
   }
   const selected = await selectMode(requestedMode, format, target);
+  assertOfficeOperationContracts({ format, backend: selected.backend, operations: initialOperations });
   if (selected.backend === 'mixdog-ooxml') return createPortableOoxmlSession(creation);
   return createMicrosoftOfficeSession(creation, args, selected.mode);
 }