mixdog 1.2.1 → 1.2.3

package/src/runtime/office/README.md

@@ -10,14 +10,14 @@ Microsoft Office installed.
 | --- | --- |
 | `(root)` | Public surface only: `index.mjs` (tool executor), `tool-defs.mjs`, `capabilities.mjs`. Test suites and `office-test-support.mjs` also live here. |
 | `authoring/` | The `author` action — the only way a deck is made: `pptx-script-contract.mjs` (what a script may require and how long it may run; the model-facing guide is the built-in `pptx` skill in `src/defaults/skills/pptx`), `pptx-script-runner.mjs` (runs a pptxgenjs script in-process with a scoped `require`, injecting `MEASURE` and `ICON`), `pptx-script-normalize.mjs` (paragraph properties, hanging punctuation, accent-series merge), `pptx-html-runner.mjs` + `pptx-html-measure.mjs` + `pptx-html-build.mjs` (the HTML input: a local Chrome/Edge lays the slides out, the measurement becomes native text boxes, shapes, tables, charts, and pictures, and the browser's pages are kept for the HTML-beside-PPTX comparison), `pptx-author-action.mjs` (writes the deck, opens an `authored` session, renders, returns the composition receipt and contact sheet), `pptx-receipt.mjs`, `pptx-contact-sheet.mjs`, `pptx-icons.mjs` + `pptx-icons.json` (offline Lucide subset built by `npm run office:icons`), `pptx-brief.mjs`. Sits beside the root and imports `core`. |
-| `core/` | Sessions, transactions, journal, snapshot pagination, tabular sessions, and the action pipeline (`office-actions-*.mjs`). |
+| `core/` | Sessions, transactions, journal, snapshot pagination, tabular sessions, the action pipeline (`office-actions-*.mjs`), and the write ledger (`office-write-ledger.mjs`: every route that writes a workspace file reports it with `noteOfficeWrite` before writing; `index.mjs` records the reported files that changed in the session's turn review as its own changes). |
 | `com/` | Windows-native path: `com-adapter.mjs` plus the PowerShell hosts `office-com-host.ps1` and `office-com-session-host.ps1`. |
 | `portable/` | OOXML read/write without Office, package validation, XLSX contracts, the backend-neutral XLSX audits shared by portable `issues`, Excel's `issues` merge, and the quality review (`xlsx-audit-support.mjs` cell reading and the capped issue list, `xlsx-sheet-hygiene.mjs` every-profile hygiene and layout information, `xlsx-formula-audit.mjs` the financial-model discipline and the orchestration), the workbook conventions summary a snapshot carries (`xlsx-conventions.mjs`), LibreOffice recalculation with its error summary (`portable-soffice.mjs` holds one private user profile for the life of the process, runs conversions one at a time behind it, and drops the profile after a failed run; `xlsx-recalculate.mjs` asks LibreOffice first and falls back to `xlsx-formula-engine.mjs`, which evaluates the formulas in this process and refuses — never guesses — the ones it cannot read; `portable-shared-formulas.mjs` gives every cell a shared or array formula covers the formula it actually holds, so a filled-down column is never read as pasted numbers), the sheet content audits (`portable-sheet-audits.mjs`: percent scale, column fit, protected inputs, unreadable ink, a hardcode inside a row of formulas), the leftover scan (`placeholder-scan.mjs`: template wording and tools' citation markers, read on slides, a document's body, headers and footers, and PDF pages), `convertLegacyOffice` in `portable-soffice.mjs` (a `.doc`/`.xls`/`.ppt` saved once as its package beside the original when `open` meets one), text and image metrics. |
 | `pdf/` | `pdf-adapter.mjs` (session surface: snapshot, batch — including the marks `highlight`, `add_link`, `preview_fields` — validate, issues; re-exports `createPdf`), `pdf-writer.mjs` (blocks → pages, tables, page numbers), `pdf-forms.mjs` (field lint, add, describe, fill), `pdf-draw.mjs` (colors, page sizes, wrapping, images), `pdf-fonts.mjs` (system Unicode font fallback shared by create, marks, forms, and OCR), `pdf-analysis.mjs` (text layout with rules, boxes, and links, ruled and aligned tables, images, OCR), `pdf-search.mjs` (text search over a layout: lines from runs, glyph-width placement, whole words), `pdf-safety.mjs` (active-content report: JavaScript, Launch, non-web links), `pdf-render.mjs`, `pdf-security.mjs` (qpdf), `document-preview.mjs`. |
 | `design/` | Design tokens, content model, composition, creative direction for the Word and Excel composers (`compose_document`, `compose_sheet`); `design-discipline.mjs` owns the safe typeface list, palette repair (tinted dark fields, WCAG contrast, paired accent tints), and the brief rules; `docx/`, `xlsx/` format compilers; `library/` template library with the bundled `templates/`. Decks are never composed here — a slide is authored by the model as a script (`authoring/`), and `compose_slide` is refused with that route. |
 | `quality/` | Reviews and gates: `assurance-*.mjs` (trust, structure, rendered pages, checklist), aesthetics, design review, scoring, visual diff. |
 | `bench/` | Benchmarks behind `npm run bench:office*`; `bench-support.mjs` holds the shared tool-call helpers. |
-| `shared/` | Tiny helpers used across folders: `values.mjs` (`plainObject`, `clone`, `stableValue`, `sha256`, `clamp`, `compact`, `imageBuffer`), `page-sizes.mjs` (the paper sizes PDF create and Word `set_page` share), `column-widths.mjs` (the widths a Word or PDF table given none takes from its text), and `asar-path.mjs`. |
+| `shared/` | Tiny helpers used across folders: `values.mjs` (`plainObject`, `clone`, `stableValue`, `sha256`, `clamp`, `compact`), `page-sizes.mjs` (the paper sizes PDF create and Word `set_page` share), `column-widths.mjs` (the widths a Word or PDF table given none takes from its text), and `asar-path.mjs`. |
 
 ## Dependency direction
 

package/src/runtime/office/authoring/html-document-author.mjs

@@ -8,6 +8,7 @@ import { render } from '../core/office-actions.mjs';
 import { documentFormat, officeSessionForDocument } from '../core/office-core.mjs';
 import { createAuthoredSession, exists, fullPath, validatePptxAuthorMode } from '../core/office-sessions.mjs';
 import { inlineOfficeAudit } from '../quality/inline-audit.mjs';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 import { parseAuthoringBrief } from './pptx-brief.mjs';
 import { htmlBriefScript } from './pptx-html-runner.mjs';
 import {
@@ -68,6 +69,7 @@ async function writeComparisons(target, htmlPages, officePages) {
       (await scaled(officePages.find((image) => image.page === page && (image.pages?.length || 1) === 1))) ||
       (await blank(left.width));
     const path = `${target}.mixdog-compare-page-${page}.png`;
+    noteOfficeWrite(path);
     await sharp({ create: { width: left.width + right.width + gap, height, channels: 3, background: '#808080' } })
       .composite([
         { input: left.data, left: 0, top: 0 },

package/src/runtime/office/authoring/pptx-contact-sheet.mjs

@@ -7,6 +7,7 @@
 import { writeFile } from 'node:fs/promises';
 import { basename, dirname, extname, join } from 'node:path';
 import { createCanvas, loadImage } from '@napi-rs/canvas';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 
 function pageImages(images = []) {
   const pages = [];
@@ -51,6 +52,7 @@ export async function writeContactSheet(images, output, { width = 1600 } = {}) {
   const data = sheet.toBuffer('image/png');
   const stem = basename(output, extname(output));
   const path = join(dirname(output), `${stem}.mixdog-contact.png`);
+  noteOfficeWrite(path);
   await writeFile(path, data);
   return {
     path,

package/src/runtime/office/authoring/pptx-html-measure.mjs

@@ -9,6 +9,7 @@ import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 
 import { launchHtmlBrowser, runInBrowser } from './html-browser.mjs';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 import { iconGlobal } from './pptx-icons.mjs';
 import { GEOMETRY_TOLERANCE_PX, NEAR_MISS_PX, readGeometry } from './pptx-html-geometry.mjs';
 
@@ -598,6 +599,7 @@ export async function measureHtmlDeck(
         );
       }
       const shot = shotPath(index + 1);
+      noteOfficeWrite(shot);
       await element.screenshot({ path: shot });
       shots.push(shot);
       const measured = await page.evaluate(extractSlide, index);

package/src/runtime/office/authoring/pptx-html-runner.mjs

@@ -6,6 +6,7 @@ import { dirname } from 'node:path';
 import { createRequire } from 'node:module';
 
 import { HTML_CANVAS, measureHtmlDeck } from './pptx-html-measure.mjs';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 import { buildPptxFromMeasure } from './pptx-html-build.mjs';
 import { normalizeAuthoredPptx } from './pptx-script-normalize.mjs';
 
@@ -312,6 +313,7 @@ export async function writeHtmlComparisons(target, htmlShots, renderedImages) {
     const left = await sharp(html).resize(width, height, { fit: 'fill' }).png().toBuffer();
     const right = await sharp(image.path).resize(width, height, { fit: 'fill' }).png().toBuffer();
     const path = artifacts.compare(image.page);
+    noteOfficeWrite(path);
     await sharp({ create: { width: width * 2 + gap, height, channels: 3, background: '#808080' } })
       .composite([
         { input: left, left: 0, top: 0 },

package/src/runtime/office/authoring/xlsx-html-runner.mjs

@@ -6,6 +6,7 @@ import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 import { htmlFailure, launchHtmlBrowser, photographCaptures, runInBrowser } from './html-browser.mjs';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 import { iconTable, injectIcons } from './pptx-html-measure.mjs';
 import { extractXlsxSheets } from './xlsx-html-measure.mjs';
 import { drawDataCharts } from './pdf-html-charts.mjs';
@@ -106,6 +107,7 @@ export async function runXlsxHtmlAuthoring(html, output, { target, signal = null
     const htmlPages = [];
     for (const [index, clip] of extents.entries()) {
       const path = artifacts.shot(index + 1);
+      noteOfficeWrite(path);
       await page.screenshot({ path, clip, captureBeyondViewport: true });
       htmlPages.push({ page: index + 1, path });
     }

package/src/runtime/office/core/office-actions-read.mjs

@@ -2,6 +2,7 @@ import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { extractPdfImages, extractPdfTextLayout, findPdfText, inferPdfTables } from '../pdf/pdf-analysis.mjs';
 import { findByDocumentPath, fullPath, queryObject, snapshot, snapshotSelectionForTarget } from './office-sessions.mjs';
+import { noteOfficeWrite } from './office-write-ledger.mjs';
 
 /** RFC 4180 quoting so a table cell that contains a comma or quote round-trips. */
 export function csvCell(text) {
@@ -94,6 +95,7 @@ async function queryPdfTables(session, args, cwd, signal) {
       const ordinal = (counters.get(table.page) || 0) + 1;
       counters.set(table.page, ordinal);
       const file = join(directory, `page-${table.page}-table-${ordinal}.csv`);
+      noteOfficeWrite(file);
       await writeFile(
         file,
         `${table.rows.map((row) => row.map((cell) => csvCell(String(cell ?? ''))).join(',')).join('\r\n')}\r\n`,
@@ -115,6 +117,7 @@ async function queryPdfImages(session, args, cwd, signal) {
     const written = [];
     for (const image of extracted._images) {
       const file = join(directory, `page-${image.page}-image-${image.index}.png`);
+      noteOfficeWrite(file);
       await writeFile(file, Buffer.from(image.data, 'base64'));
       written.push(file);
     }

package/src/runtime/office/core/office-render-preview.mjs

@@ -8,6 +8,7 @@ import { resolveOfficeRenderOutput } from '../quality/quality-pipeline.mjs';
 import { defaultRenderOutput, exists, fullPath } from './office-sessions.mjs';
 import { completePageCoverage, pptxPageSignatures, reusablePptxPages } from './pptx-page-cache.mjs';
 import { numberDocxTableOfContents } from './docx-toc-pages.mjs';
+import { noteOfficeWrite } from './office-write-ledger.mjs';
 
 function request(session, args, cwd) {
   return {
@@ -136,6 +137,7 @@ export async function renderOfficePreview(
   const exportKey = `${session.target}\0${Number(session.snapshotVersion || 0)}\0${requested.output}`;
   if (!incremental || session.previewExportKey !== exportKey || !(await exists(requested.output))) {
     session.previewExportKey = null;
+    noteOfficeWrite(requested.output);
     await exportPreview(session, requested.output);
     if (incremental) session.previewExportKey = exportKey;
   }

package/src/runtime/office/core/office-session-dispatch.mjs

@@ -9,6 +9,7 @@ import { describeOfficeCapabilities } from '../capabilities.mjs';
 import { applyBatch, closeSession, finalize, issues, qa, render, save, validate } from './office-actions.mjs';
 import { getOfficeElement, queryOfficeDocument } from './office-actions-read.mjs';
 import { snapshot } from './office-sessions.mjs';
+import { noteOfficeWrite } from './office-write-ledger.mjs';
 import { noteBatchAgainstHtml } from '../authoring/html-source-drift.mjs';
 import {
   assertTransactionUnchanged,
@@ -59,7 +60,13 @@ async function batchAction(session, args, cwd, signal) {
   };
 }
 
+// Verbs that never write the session's document.
+const READ_ACTIONS = new Set(['describe', 'begin', 'diff', 'snapshot', 'get', 'query', 'issues', 'validate']);
+
 export async function dispatchOfficeSessionAction({ action, session, args, cwd, signal }) {
+  // Write receipt: every other verb may write the session's document (an
+  // edit, save, rollback, autoFix, or a render that numbers its contents).
+  if (!READ_ACTIONS.has(action)) noteOfficeWrite(session.target);
   if (action === 'describe') {
     return describeOfficeCapabilities({
       format: session.format,

package/src/runtime/office/core/office-sessionless-actions.mjs

@@ -29,6 +29,7 @@ import {
   toolResult,
 } from './office-core.mjs';
 import { fullPath, selectMode } from './office-sessions.mjs';
+import { noteOfficeWrite } from './office-write-ledger.mjs';
 import { pendingOfficeTransactions, recoverOfficeTransaction } from './office-transactions.mjs';
 
 async function detectAction(args, cwd, dataDir) {
@@ -102,6 +103,13 @@ async function authorAction(args, cwd, dataDir, signal, startedAt) {
   const extension = extname(String(args.path || args.output || '')).toLowerCase();
   const author =
     { '.pdf': authorPdf, '.docx': authorHtmlDocument, '.xlsx': authorHtmlDocument }[extension] || authorPptx;
+  // Write receipts: the authored document and the sidecars kept beside it
+  // (its HTML source and print); per-page images report themselves.
+  for (const value of [args.path, args.output]) {
+    if (!String(value || '').trim()) continue;
+    const target = fullPath(String(value).trim(), cwd);
+    for (const path of [target, `${target}.mixdog-source.html`, `${target}.mixdog-html.pdf`]) noteOfficeWrite(path);
+  }
   const authored = await author(args, { cwd, dataDir, signal });
   const images = Array.isArray(authored?._images) ? authored._images : [];
   delete authored._images;

package/src/runtime/office/core/office-sessions.mjs

@@ -4,6 +4,7 @@ import { basename, dirname, extname, isAbsolute, join, resolve } from 'node:path
 import { tmpdir } from 'node:os';
 import { randomUUID } from 'node:crypto';
 import { assertOfficeOperationContracts } from '../capabilities.mjs';
+import { noteOfficeWrite } from './office-write-ledger.mjs';
 import {
   callMicrosoftOffice,
   detectMicrosoftOffice,
@@ -258,6 +259,7 @@ async function packageSource(path, signal) {
       `${path} is a legacy binary file and ${converted} already exists; open ${converted} directly, or move it aside to convert again.`
     );
   }
+  noteOfficeWrite(converted);
   await convertLegacyOffice(path, converted, { signal });
   return { source: converted, convertedFrom: path };
 }
@@ -280,6 +282,7 @@ export async function openSession(args, cwd, dataDir, { readOnly = false } = {})
   if (existing) return existing;
   if (copies) {
     await mkdir(dirname(target), { recursive: true });
+    noteOfficeWrite(target);
     await copyFile(source, target);
   }
   const designContext = await resolveOfficeDesignContext({
@@ -533,6 +536,7 @@ export async function createSession(args, cwd, dataDir) {
   // Whether this call brings the file into being decides what a failed create
   // may clean up afterwards: a file it wrote itself, never one already there.
   const targetExisted = await exists(target);
+  noteOfficeWrite(target);
   const designContext = await resolveOfficeDesignContext({ args, dataDir, target, format, created: true });
   const creation = { target, fileKind, format, dataDir, targetExisted, designContext };
   await releaseOverwrittenSession(target, args.overwrite);
@@ -645,6 +649,7 @@ export async function materializeWorkingCopy(session) {
     throw new Error('portable editing requires an output path different from the source');
   }
   await mkdir(dirname(target), { recursive: true });
+  noteOfficeWrite(target);
   await copyFile(session.source, target);
   if (documentSessions.get(documentSessionKey(session.target)) === session.id) {
     documentSessions.delete(documentSessionKey(session.target));

package/src/runtime/office/core/office-transactions.mjs

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { randomUUID } from 'node:crypto';
 import { callMicrosoftOffice, detectMicrosoftOffice, openMicrosoftOfficeSession } from '../com/com-adapter.mjs';
 import { listOfficeJournals, readOfficeJournal, removeOfficeJournal, writeOfficeJournal } from './journal.mjs';
+import { noteOfficeWrite } from './office-write-ledger.mjs';
 import {
   OfficeConflictError,
   documentFingerprint,
@@ -299,6 +300,8 @@ export async function rollbackTransaction(session) {
   transaction.diff = transactionDocumentDiff(transaction, current.document);
   transaction.phase = 'rolling_back';
   await persistOfficeTransaction(session);
+  // A recovered rollback restores the document outside any session verb.
+  noteOfficeWrite(session.target);
   if (isMicrosoftOfficeSession(session)) {
     const result = await callMicrosoftOffice(
       {

package/src/runtime/office/core/office-write-ledger.mjs

@@ -0,0 +1,98 @@
+/**
+ * office-write-ledger.mjs — the workspace files one Office Use call wrote,
+ * with their exact before/after state, so the session's turn review counts
+ * them as its own changes and Undo can restore them.
+ *
+ * Ownership is never inferred from the folder: every route that writes a
+ * workspace file — the session's working copy, a created or converted
+ * document, a render's preview and page images, a split/extract/query output,
+ * an authored document and its sidecars, a secured PDF — hands the path to
+ * noteOfficeWrite BEFORE it writes, which captures the file's prior state.
+ * After the call, only noted files whose bytes changed are recorded. Scratch
+ * files outside the workspace (the system temp folder, the Office data
+ * folder) are never noted.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { isAbsolute, relative, resolve } from 'node:path';
+import {
+  PATCH_EDIT_BUDGET_BYTES,
+  createSnapshotBudget,
+  reviewFileContent,
+} from '../../shared/bounded-file-read.mjs';
+
+const ledgers = new AsyncLocalStorage();
+
+const pathKey = (path) => (process.platform === 'win32' ? path.toLowerCase() : path);
+
+function inside(parent, child) {
+  if (!parent) return false;
+  const rel = relative(resolve(parent), child);
+  return !rel || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+
+function fileStamp(path) {
+  try {
+    const info = statSync(path);
+    return info.isFile() ? { size: info.size, mtimeMs: info.mtimeMs } : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Run one Office call with a ledger its write routes report into. */
+export function runWithOfficeWriteLedger({ cwd, dataDir }, task) {
+  const ledger = {
+    cwd: resolve(cwd || process.cwd()),
+    dataDir: dataDir ? resolve(dataDir) : '',
+    budget: createSnapshotBudget(PATCH_EDIT_BUDGET_BYTES),
+    before: new Map(),
+  };
+  return { ledger, run: ledgers.run(ledger, task) };
+}
+
+/** A write receipt: the call is about to write `path`. The first receipt of a
+ *  path captures its state before the write; a call without a ledger (no
+ *  session to credit) and scratch paths are ignored. */
+export function noteOfficeWrite(path) {
+  const ledger = ledgers.getStore();
+  const text = typeof path === 'string' ? path.trim() : '';
+  if (!ledger || !text) return;
+  const fullPath = resolve(ledger.cwd, text);
+  const key = pathKey(fullPath);
+  if (ledger.before.has(key)) return;
+  if (inside(ledger.dataDir, fullPath)) return;
+  if (inside(tmpdir(), fullPath) && !inside(ledger.cwd, fullPath)) return;
+  let content;
+  try {
+    content = reviewFileContent(fullPath, { budget: ledger.budget });
+  } catch {
+    return; // not a regular file: never recorded
+  }
+  ledger.before.set(key, { fullPath, content, stamp: fileStamp(fullPath) });
+}
+
+const sameBytes = (left, right) => Buffer.isBuffer(left) && Buffer.isBuffer(right) && left.equals(right);
+
+/** Every noted file the call created, changed or removed, as
+ *  `{ fullPath, before, after }` (null = absent). */
+export function officeWriteChanges(ledger) {
+  const changes = [];
+  for (const { fullPath, content: before, stamp: priorStamp } of ledger.before.values()) {
+    const stamp = fileStamp(fullPath);
+    if (!priorStamp && !stamp) continue;
+    // Uncaptured bytes compare by their stamp; captured ones byte for byte.
+    const untouched = priorStamp && stamp && priorStamp.size === stamp.size && priorStamp.mtimeMs === stamp.mtimeMs;
+    if (untouched && !Buffer.isBuffer(before)) continue;
+    let after = null;
+    try {
+      after = stamp ? reviewFileContent(fullPath) : null;
+    } catch {
+      continue;
+    }
+    if (sameBytes(before, after)) continue;
+    changes.push({ fullPath, before, after });
+  }
+  return changes;
+}

package/src/runtime/office/index.mjs

@@ -14,6 +14,7 @@ import {
   toolResult,
 } from './core/office-core.mjs';
 import { resolveSession } from './core/office-sessions.mjs';
+import { officeWriteChanges, runWithOfficeWriteLedger } from './core/office-write-ledger.mjs';
 
 // Office work is minutes of real application time, and guessing which action carries it is how
 // tuning goes wrong. MIXDOG_OFFICE_TRACE writes one line per call so a slow run maps itself; it
@@ -27,6 +28,35 @@ const OFFICE_TRACE = process.env.MIXDOG_OFFICE_TRACE || '';
 const READ_ONLY_ACTIONS = new Set(['snapshot', 'get', 'query', 'issues', 'validate', 'describe', 'render', 'qa']);
 
 export async function executeOfficeTool(args = {}, context = {}) {
+  const sessionId = String(context.sessionId || '');
+  if (!sessionId) return await tracedOfficeTool(args, context);
+  const cwd = context.cwd || process.cwd();
+  const { ledger, run } = runWithOfficeWriteLedger(
+    { cwd, dataDir: context.dataDir || defaultOfficeDataDir() },
+    () => tracedOfficeTool(args, context)
+  );
+  try {
+    return await run;
+  } finally {
+    await recordOfficeWrites(ledger, sessionId, cwd);
+  }
+}
+
+// The files this call's write routes reported join the session's turn review
+// as its own changes (counted, and undoable where their bytes were captured).
+// The recorder is loaded on first use; recording never affects the result.
+async function recordOfficeWrites(ledger, sessionId, cwd) {
+  try {
+    const changes = officeWriteChanges(ledger);
+    if (changes.length === 0) return;
+    const { recordToolFileChanges } = await import('../agent/orchestrator/tools/patch/ui-diff.mjs');
+    recordToolFileChanges({ sessionId, basePath: cwd, changes });
+  } catch {
+    /* best-effort review channel */
+  }
+}
+
+async function tracedOfficeTool(args, context) {
   if (!OFFICE_TRACE) return await runOfficeTool(args, context);
   const startedAt = performance.now();
   try {

package/src/runtime/office/pdf/pdf-edit-document.mjs

@@ -5,6 +5,7 @@
  */
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 import {
   PDFDocument,
   PDFArray,
@@ -130,6 +131,7 @@ export async function writeSibling(path, target, bytes) {
   if (output.toLowerCase() === resolve(path).toLowerCase())
     throw new Error('output must differ from the document being edited');
   await mkdir(dirname(output), { recursive: true });
+  noteOfficeWrite(output);
   await writeFile(output, bytes);
   return output;
 }

package/src/runtime/office/pdf/pdf-render.mjs

@@ -5,6 +5,7 @@ import { createCanvas, loadImage } from '@napi-rs/canvas';
 import { pdfjsStandardFontDataUrl, resolvedPdfJs } from '../../attachments/pdfjs-runtime.mjs';
 import { installPdfGlobals } from './pdf-document.mjs';
 import { workerExecArgv } from '../../shared/worker-exec-argv.mjs';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 
 const PAGE_NUMBER_PATTERN = /^\s*(?:(?:page\s*)?\d+\s*(?:of|\/)\s*\d+|페이지\s*\d+|\d+\s*페이지)\s*$/i;
 
@@ -144,8 +145,8 @@ async function runPdfRenderWorker(data, signal = null) {
 }
 
 // Many pages are reviewed as contact sheets: one labelled grid image per group
-// of pages, written next to the PDF.
-async function writeContactSheet(group, width, imagePath, renderPage) {
+// of pages, for a file next to the PDF.
+async function contactSheet(group, width, imagePath, renderPage) {
   const columns = group.length <= 2 ? 1 : Math.max(2, Math.ceil(Math.sqrt(group.length * 0.75)));
   const rows = Math.ceil(group.length / columns);
   const gap = 12;
@@ -182,7 +183,6 @@ async function writeContactSheet(group, width, imagePath, renderPage) {
     context.strokeRect(x, y + labelHeight, image.width, image.height);
   }
   const data = sheet.toBuffer('image/png');
-  await writeFile(imagePath, data);
   return {
     page: group[0],
     pages: group,
@@ -204,7 +204,18 @@ async function writeContactSheet(group, width, imagePath, renderPage) {
   };
 }
 
-async function renderPdfPagesDirect(path, { pages = null, maxWidth = 1400, maximumScale = 2, signal = null } = {}) {
+// The page images land beside the PDF, each reported as an Office write first.
+async function writePageImages(images) {
+  for (const image of images) {
+    noteOfficeWrite(image.path);
+    await writeFile(image.path, Buffer.from(image.data, 'base64'));
+  }
+}
+
+async function renderPdfPagesDirect(
+  path,
+  { pages = null, maxWidth = 1400, maximumScale = 2, signal = null, writeImages = true } = {}
+) {
   if (signal?.aborted) throw new Error('PDF rendering was cancelled');
   installPdfGlobals();
   const { getDocument, VerbosityLevel } = await resolvedPdfJs();
@@ -248,7 +259,6 @@ async function renderPdfPagesDirect(path, { pages = null, maxWidth = 1400, maxim
       for (const pageNumber of selected) {
         const { canvas, data } = await renderPage(pageNumber, maxWidth);
         const imagePath = join(dirname(path), `${stem}-page-${pageNumber}.png`);
-        await writeFile(imagePath, data);
         output.push({
           page: pageNumber,
           path: imagePath,
@@ -264,9 +274,10 @@ async function renderPdfPagesDirect(path, { pages = null, maxWidth = 1400, maxim
       for (let offset = 0; offset < selected.length; offset += pagesPerSheet) {
         const group = selected.slice(offset, offset + pagesPerSheet);
         const imagePath = join(dirname(path), `${stem}-pages-${group[0]}-${group.at(-1)}.png`);
-        output.push(await writeContactSheet(group, width, imagePath, renderPage));
+        output.push(await contactSheet(group, width, imagePath, renderPage));
       }
     }
+    if (writeImages) await writePageImages(output);
     const reviewedPages = output.flatMap((image) => image.pages || [image.page]);
     const reviewedPageSet = new Set(reviewedPages);
     return {
@@ -293,7 +304,9 @@ export async function renderPdfPages(path, options = {}) {
   const signal = options.signal || null;
   if (signal?.aborted) throw new Error('PDF rendering was cancelled');
   if (!isMainThread) return await renderPdfPagesDirect(path, options);
-  return await runPdfRenderWorker(
+  // The worker rasterizes; this thread writes the images, where the call's
+  // write ledger can see each one before it lands.
+  const rendered = await runPdfRenderWorker(
     {
       kind: PDF_RENDER_WORKER_KIND,
       path,
@@ -301,10 +314,13 @@ export async function renderPdfPages(path, options = {}) {
         pages: options.pages ?? null,
         maxWidth: options.maxWidth ?? 1400,
         maximumScale: options.maximumScale ?? 2,
+        writeImages: false,
       },
     },
     signal
   );
+  await writePageImages(rendered.images);
+  return rendered;
 }
 
 if (!isMainThread && [PDF_RENDER_WORKER_KIND, PDF_RENDER_PAGE_WORKER_KIND].includes(workerData?.kind)) {

package/src/runtime/office/pdf/pdf-security.mjs

@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { writeFile, rm, rename } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 
 // qpdf on PATH, or wherever MIXDOG_QPDF_PATH points (the Windows installer
 // does not add itself to PATH).
@@ -89,6 +90,7 @@ export async function securePdf({ input, output, mode, password = '', ownerPassw
       ? ['--encrypt', password, ownerPassword || password, '256', '--', input, target]
       : [`--password=${password}`, '--decrypt', input, target];
   await writeFile(responsePath, `${args.join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
+  noteOfficeWrite(output);
   try {
     await run(QPDF, [`@${responsePath}`]);
     if (samePath) await rename(target, output);

package/src/runtime/office/portable/portable-opc.mjs

@@ -1,6 +1,7 @@
 import { posix } from 'node:path';
 import { createHash } from 'node:crypto';
 import { readFile, writeFile } from 'node:fs/promises';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 import { koreanParticleReplacements } from '../shared/korean-particles.mjs';
 import { presetLabels } from '../shared/labels.mjs';
 import {
@@ -137,7 +138,9 @@ export async function packageBuffer(zip) {
 }
 
 export async function savePackage(zip, path) {
-  await writeFile(path, await packageBuffer(zip));
+  const bytes = await packageBuffer(zip);
+  noteOfficeWrite(path);
+  await writeFile(path, bytes);
 }
 
 export function relationshipMap(xml) {

package/src/runtime/office/quality/visual-diff.mjs

@@ -1,6 +1,7 @@
 import { writeFile } from 'node:fs/promises';
 import { dirname, extname, basename, join } from 'node:path';
 import { createCanvas, loadImage } from '@napi-rs/canvas';
+import { noteOfficeWrite } from '../core/office-write-ledger.mjs';
 
 function imageByPage(images) {
   return new Map((images || []).map((image) => [Number(image.page), image]));
@@ -61,6 +62,7 @@ export async function compareRenderedPages(beforeImages, afterImages, outputPdf)
     diffContext.putImageData(diff, 0, 0);
     const data = diffCanvas.toBuffer('image/png');
     const path = join(dirname(outputPdf), `${stem}-visual-diff-page-${page}.png`);
+    noteOfficeWrite(path);
     await writeFile(path, data);
     const total = width * height;
     metrics.push({

package/src/runtime/office/shared/values.mjs

@@ -32,8 +32,3 @@ export function compact(value, maximum = 120) {
     .replace(/\s+/g, ' ')
     .slice(0, maximum);
 }
-
-export function imageBuffer(image) {
-  if (Buffer.isBuffer(image?.data)) return image.data;
-  return Buffer.from(String(image?.data || ''), 'base64');
-}