shortcutxl 0.3.83 → 0.3.85

package/BINARY-INVENTORY.json

@@ -1,17 +1,17 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T08:00:44.785Z",
+  "generatedAt": "2026-08-20T19:59:33.921Z",
   "package": "shortcutxl",
   "build": {
     "builder": "github-actions",
     "repository": "lyfegame/shortcut",
-    "sourceRef": "refs/heads/fix/native-tab-lifecycle-e2e",
-    "sourceCommit": "05b4e8d19e60e7761e4839f723e34f10aec5732b",
-    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcutxl.yml@refs/heads/fix/native-tab-lifecycle-e2e",
-    "runId": "31782090568",
+    "sourceRef": "refs/heads/pwang724/fix-cli-app-approval-scrolling",
+    "sourceCommit": "9cc676833842002c8742057b44e12b6635f5888f",
+    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcutxl.yml@refs/heads/pwang724/fix-cli-app-approval-scrolling",
+    "runId": "32411468790",
     "runnerOs": "Windows",
     "runnerImage": "win25-vs2026",
-    "runnerImageVersion": "20260803.193.1"
+    "runnerImageVersion": "20260818.207.1"
   },
   "binaryExtensions": [
     ".dll",
@@ -20,9 +20,25 @@
     ".xll"
   ],
   "files": [
+    {
+      "path": "xll/ShortcutPowerPoint.dll",
+      "sha256": "5c5c7630cd30e36daaf85b944baee2bf84c1cb59c2dde40b05505b8dbf04239b",
+      "source": "ShortcutXL native PowerPoint COM add-in build",
+      "version": "package",
+      "builtBy": "shortcut",
+      "verification": "Built by shortcutXL/xll build scripts and hashed in BINARY-INVENTORY.json."
+    },
+    {
+      "path": "xll/ShortcutWord.dll",
+      "sha256": "2823c3604f6b7a6fdbabd3bedcdf31a66ec1d3dcd51e54284affb64969d8bcc5",
+      "source": "ShortcutXL native Word COM add-in build",
+      "version": "package",
+      "builtBy": "shortcut",
+      "verification": "Built by shortcutXL/xll build scripts and hashed in BINARY-INVENTORY.json."
+    },
     {
       "path": "xll/ShortcutXL.xll",
-      "sha256": "184bd94bf10a566d242761aed8036e3db819447dcf2f65c94b39a55d91985e68",
+      "sha256": "b1d14ede58224be66163f924bd2259bfc1c586849743c2b97bb28de77b4072e4",
       "source": "ShortcutXL native XLL build",
       "version": "package",
       "builtBy": "shortcut",
@@ -534,7 +550,7 @@
     },
     {
       "path": "xll/python/Scripts/httpx.exe",
-      "sha256": "65250768d249e621c8d772506fb01447e82fe9ee4f886e7652d20c76257df743",
+      "sha256": "6f8a9f92f6a4069c9563897fac73999dd5b2ca8243f4777913ae4100fb51eae8",
       "source": "httpx console launcher installed into embedded Python",
       "version": "see packaged httpx distribution",
       "builtBy": "third-party",
@@ -542,7 +558,7 @@
     },
     {
       "path": "xll/python/Scripts/idna.exe",
-      "sha256": "b62b33859e93f2f5e3aec1d90810fe89f3798c4b60e52e40587b134f87268241",
+      "sha256": "f2222ae2caf7c715f65ed4d7769e0eb047bfd8cdaa0e8bb1298ffd4f9c9f4914",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -550,7 +566,7 @@
     },
     {
       "path": "xll/python/Scripts/pip.exe",
-      "sha256": "cdf622bf555bb3f7d192501f331010f7ef29dd70a13dcec2df8e3e160cb5626e",
+      "sha256": "f60aaf7555f70c4076f52bf4bb58d6885273fe0dfd8dad13b5fbe6b46daa973b",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -558,7 +574,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.13.exe",
-      "sha256": "cdf622bf555bb3f7d192501f331010f7ef29dd70a13dcec2df8e3e160cb5626e",
+      "sha256": "f60aaf7555f70c4076f52bf4bb58d6885273fe0dfd8dad13b5fbe6b46daa973b",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -566,7 +582,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.exe",
-      "sha256": "cdf622bf555bb3f7d192501f331010f7ef29dd70a13dcec2df8e3e160cb5626e",
+      "sha256": "f60aaf7555f70c4076f52bf4bb58d6885273fe0dfd8dad13b5fbe6b46daa973b",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -574,7 +590,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_postinstall.exe",
-      "sha256": "05901aedb7c65ac48a31dede95ccc8a7daf8cef8cf923af364635310c57f2c45",
+      "sha256": "537ca79bfb736241887ca9017db7583dd6d566255d24f9005b598949ae1059d1",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -582,7 +598,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_testall.exe",
-      "sha256": "af7a61cb9722914d056923434850b756fda5cc388f6c9d3b47586efac880848c",
+      "sha256": "d0884c20bf24120ac7f100096f597452e5b01470bfdbc77c998fcc69ff58295a",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.3.85]
+
+- **Scrollable approval dialogs** - Long approval requests in the native app now remain fully accessible.
+
+## [0.3.84]
+
+- **UI improvements**
+- **Shared Office approvals** - Excel, Word, and PowerPoint now use one clearly labeled approval setting across the CLI and native app.
+
 ## [0.3.83]
 
 - **More reliable native app chats**

package/agent-docs/README.md

@@ -317,19 +317,19 @@ shortcut config                   # Enable/disable package resources
 
 ### Permission Options
 
-Shortcut has separate controls for runtime permissions and spreadsheet permissions. Use the flag that matches the permission boundary you want to bypass for a single session.
+Shortcut has separate controls for runtime permissions and Office permissions. Use the flag that matches the permission boundary you want to bypass for a single session.
 
 | Option | Description |
 |--------|-------------|
 | `--skip-runtime-permissions` | Bypass runtime filesystem and shell approval checks for this session |
-| `--skip-spreadsheet-permissions` | Allow headless spreadsheet auto-approval for this session |
+| `--skip-office-permissions` | Allow headless Excel, Word, and PowerPoint auto-approval for this session |
 
-Runtime and spreadsheet approvals are separate. `--skip-runtime-permissions` affects runtime-owned filesystem and shell checks; it does not change spreadsheet approvals. `--skip-spreadsheet-permissions` affects headless spreadsheet approval only; it does not bypass runtime filesystem or shell checks.
+Runtime and Office approvals are separate. `--skip-runtime-permissions` affects runtime-owned filesystem and shell checks; it does not change Office approvals. `--skip-office-permissions` affects headless Excel, Word, and PowerPoint approval only; it does not bypass runtime filesystem or shell checks.
 
-Use both flags when a non-interactive run needs both runtime access and spreadsheet auto-approval:
+Use both flags when a non-interactive run needs both runtime access and Office auto-approval:
 
 ```bash
-shortcut --skip-runtime-permissions --skip-spreadsheet-permissions -p "..."
+shortcut --skip-runtime-permissions --skip-office-permissions -p "..."
 ```
 
 In an interactive session, use `/permissions skip-runtime-permissions` to inspect or change the runtime bypass setting.

package/binary-provenance.json

@@ -8,6 +8,20 @@
       "builtBy": "shortcut",
       "verification": "Built by shortcutXL/xll build scripts and hashed in BINARY-INVENTORY.json."
     },
+    {
+      "pattern": "xll/ShortcutWord.dll",
+      "source": "ShortcutXL native Word COM add-in build",
+      "version": "package",
+      "builtBy": "shortcut",
+      "verification": "Built by shortcutXL/xll build scripts and hashed in BINARY-INVENTORY.json."
+    },
+    {
+      "pattern": "xll/ShortcutPowerPoint.dll",
+      "source": "ShortcutXL native PowerPoint COM add-in build",
+      "version": "package",
+      "builtBy": "shortcut",
+      "verification": "Built by shortcutXL/xll build scripts and hashed in BINARY-INVENTORY.json."
+    },
     {
       "pattern": "xll/python/python*.exe",
       "source": "CPython Windows embeddable runtime launcher",

package/dist/app/agent-session.d.ts

@@ -203,6 +203,8 @@ export declare class AgentSession {
     private _removeLastErrorGroup;
     /** Internal handler for agent events - shared by subscribe and reconnect */
     private _handleAgentLoopEvent;
+    /** Emit one canonical run_agent event when a delivered user message begins execution. */
+    private _handleUserMessageExecutionStart;
     /** True when the assistant message indicates the conversation has overflowed the model context. */
     private _checkContextOverflow;
     /** On agent_end, eagerly arm the recovery retry promise before queued event processing runs. */

package/dist/app/agent-session.js

@@ -35,7 +35,7 @@ import { formatRuntimePermissionBypassReminder } from './session/permission-cont
 import { PersistenceHandler } from './session/persistence-handler.js';
 import { assertNotExtensionCommand, buildMessageContent, normalizeUserContent, tryExtensionCommand } from './session/prompt-pipeline.js';
 import { QueueTracker } from './session/queue-tracker.js';
-import { buildRunAgentMetadata, emitRunAgent, summarizeDeliveredUserContent } from './session/run-agent-observability.js';
+import { buildRunAgentConfigMetadata, buildRunAgentMetadata, emitRunAgent, summarizeDeliveredUserContent } from './session/run-agent-observability.js';
 import { SessionBudgetContinuation } from './session/session-budget-continuation.js';
 import { executeNewSession, executeSwitchSession } from './session/session-lifecycle.js';
 import { getAvailableThinkingLevels, supportsThinking, supportsXhighThinking } from './session/session-models.js';
@@ -244,6 +244,9 @@ export class AgentSession {
         this._recovery.onEvent((event) => this._emit(event));
         this._compaction.onEvent((event) => this._emit(event));
         this._budgetContinuation.onEvent((event) => this._emit(event));
+        // The loop invokes this at the authoritative model-request boundary, before
+        // mutable session settings can drift from the active turn's frozen config.
+        this.agent.onUserMessageExecutionStart = this._handleUserMessageExecutionStart;
         // Always subscribe to agent events for internal handling
         // (session persistence, extensions, auto-compaction, retry logic)
         this._unsubscribeAgent = this.agent.subscribe(this._handleAgentLoopEvent);
@@ -302,6 +305,39 @@ export class AgentSession {
         // Keep queue alive if an event handler fails
         this._agentEventQueue.catch(() => { });
     };
+    /** Emit one canonical run_agent event when a delivered user message begins execution. */
+    _handleUserMessageExecutionStart = (execution) => {
+        const deliveredContent = summarizeDeliveredUserContent(execution.message.content);
+        const pendingMetadata = this._pendingImmediateRunAgentMetadata;
+        const conversationId = this.sessionManager.getSessionId();
+        const userMessageId = typeof execution.message.id === 'string' && execution.message.id.length > 0
+            ? execution.message.id
+            : undefined;
+        this._pendingImmediateRunAgentMetadata = undefined;
+        emitRunAgent(this._observability, {
+            ...(pendingMetadata ??
+                buildRunAgentMetadata({
+                    charCount: deliveredContent.charCount,
+                    imageCount: deliveredContent.imageCount,
+                    conversationId,
+                    userMessageId
+                })),
+            conversationId,
+            thread_id: conversationId,
+            platform: 'cli',
+            ...buildRunAgentConfigMetadata({
+                modelName: execution.modelName,
+                speedMode: execution.speedMode,
+                thinkingLevel: execution.thinkingLevel,
+                supportsReasoning: execution.supportsReasoning,
+                interactionMode: this._currentModeName
+            }),
+            char_count: deliveredContent.charCount,
+            message_length: deliveredContent.charCount,
+            image_count: deliveredContent.imageCount,
+            ...(userMessageId ? { user_message_id: userMessageId, turnId: userMessageId } : {})
+        });
+    };
     /** True when the assistant message indicates the conversation has overflowed the model context. */
     _checkContextOverflow = (msg) => {
         return isContextOverflow(msg, this.model?.contextWindow ?? 0);
@@ -351,32 +387,6 @@ export class AgentSession {
     async _processAgentLoopEvent(event) {
         // --- Step 1: Queue tracking (sync) ---
         this._queueTracker.handle(event);
-        if (event.type === 'message_start' && event.message.role === 'user') {
-            const deliveredContent = summarizeDeliveredUserContent(event.message.content);
-            const pendingMetadata = this._pendingImmediateRunAgentMetadata;
-            const conversationId = this.sessionManager.getSessionId();
-            const userMessageId = typeof event.message.id === 'string' && event.message.id.length > 0
-                ? event.message.id
-                : undefined;
-            this._pendingImmediateRunAgentMetadata = undefined;
-            emitRunAgent(this._observability, {
-                ...(pendingMetadata ??
-                    buildRunAgentMetadata({
-                        charCount: deliveredContent.charCount,
-                        imageCount: deliveredContent.imageCount,
-                        conversationId,
-                        modelName: this.agent.state.model?.id,
-                        userMessageId
-                    })),
-                conversationId,
-                thread_id: conversationId,
-                platform: 'cli',
-                char_count: deliveredContent.charCount,
-                message_length: deliveredContent.charCount,
-                image_count: deliveredContent.imageCount,
-                ...(userMessageId ? { user_message_id: userMessageId, turnId: userMessageId } : {})
-            });
-        }
         // --- Step 2: Extensions (async — must complete before persistence) ---
         // Reset turnIndex on agent_start BEFORE the snapshot so extensions see 0.
         if (event.type === 'agent_start') {
@@ -606,6 +616,9 @@ export class AgentSession {
      */
     dispose() {
         this._disconnectFromAgent();
+        if (this.agent.onUserMessageExecutionStart === this._handleUserMessageExecutionStart) {
+            this.agent.onUserMessageExecutionStart = undefined;
+        }
         this._summaryEmitter.abort();
         this._eventListeners = [];
     }
@@ -975,6 +988,11 @@ export class AgentSession {
             conversationId: this.sessionManager.getSessionId(),
             workbookDetails,
             modelName: this.agent.state.model?.id,
+            speedMode: this.agent.speed ?? 'standard',
+            thinkingLevel: this.agent.state.thinkingLevel,
+            supportsReasoning: this.agent.state.model
+                ? Boolean(this.agent.state.model.reasoning)
+                : undefined,
             userMessageId
         });
         this._pendingImmediateRunAgentMetadata = promptMetadata;

package/dist/app/approvals/runtime-approval-gates.d.ts

@@ -1,9 +1,9 @@
-import type { ExcelApprovalPayload } from '../local/tools/execute-code/approval-payload.js';
+import type { OfficeApprovalPayload } from '../local/tools/execute-code/approval-payload.js';
 import type { ApprovalGate, BashApprovalData, FileAccessApprovalData, SwitchModeApprovalData } from './types.js';
 /** Approval gates required by the local Shortcut runtime composition root. */
 export interface RuntimeApprovalGates {
     readonly bash: ApprovalGate<BashApprovalData>;
-    readonly excel: ApprovalGate<ExcelApprovalPayload>;
+    readonly office: ApprovalGate<OfficeApprovalPayload>;
     readonly fileAccess: ApprovalGate<FileAccessApprovalData>;
     readonly switchMode: ApprovalGate<SwitchModeApprovalData>;
 }

package/dist/app/extensions/types.d.ts

@@ -96,6 +96,12 @@ export interface ExtensionUIDialogOptions {
     signal?: AbortSignal;
     /** Timeout in milliseconds. Dialog auto-dismisses with live countdown display. */
     timeout?: number;
+    /** Optional host-facing context shown above a confirmation title. */
+    eyebrow?: string;
+    /** Optional host-facing confirmation action label. */
+    confirmLabel?: string;
+    /** Optional host-facing cancellation action label. */
+    cancelLabel?: string;
 }
 /**
  * UI context for extensions to request interactive UI.

package/dist/app/local/tools/execute-code/approval-payload.d.ts

@@ -1,4 +1,4 @@
-export interface ExcelApprovalOperation {
+export interface OfficeApprovalOperation {
     label: string;
     reason: string;
 }
@@ -6,12 +6,12 @@ export interface ExcelDiffApprovalPayload {
     kind: 'diff';
     description: string;
 }
-export interface ExcelDangerousApprovalPayload {
+export interface OfficeDangerousApprovalPayload {
     kind: 'dangerous';
     description: string;
     title: string;
     summary: string;
-    operations: ExcelApprovalOperation[];
+    operations: OfficeApprovalOperation[];
 }
-export type ExcelApprovalPayload = ExcelDiffApprovalPayload | ExcelDangerousApprovalPayload;
+export type OfficeApprovalPayload = ExcelDiffApprovalPayload | OfficeDangerousApprovalPayload;
 //# sourceMappingURL=approval-payload.d.ts.map

package/dist/app/local/tools/execute-code/executor.d.ts

@@ -12,7 +12,7 @@
 import { type ApprovalChoice, type ApprovalGate, type ApprovalRequest } from '../../../approvals/types.js';
 import type { ExtensionContext } from '../../../extensions/index.js';
 import type { ExcelHostEndpoint } from '../../../xll/host-registry.js';
-import type { ExcelApprovalPayload } from './approval-payload.js';
+import type { OfficeApprovalPayload } from './approval-payload.js';
 import { type DiffPayload } from './diff.js';
 import { type EditModeRetryTiming } from './edit-mode-retry.js';
 export interface ComExecResult {
@@ -30,11 +30,11 @@ export interface LocalExecResult {
     approvalSummaries?: string[];
 }
 export interface ExcelExecApprovalObservability {
-    onRequested?: (request: ApprovalRequest<ExcelApprovalPayload>) => void;
-    onAccepted?: (request: ApprovalRequest<ExcelApprovalPayload>, choice: ApprovalChoice) => void;
-    onRejected?: (request: ApprovalRequest<ExcelApprovalPayload>) => void;
-    onReverted?: (request: ApprovalRequest<ExcelApprovalPayload>) => void;
-    onRevertFailed?: (request: ApprovalRequest<ExcelApprovalPayload>) => void;
+    onRequested?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
+    onAccepted?: (request: ApprovalRequest<OfficeApprovalPayload>, choice: ApprovalChoice) => void;
+    onRejected?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
+    onReverted?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
+    onRevertFailed?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
 }
 interface ApprovalResolution {
     outcome: ApprovalOutcome;
@@ -45,7 +45,7 @@ export declare function isComExecResult(v: unknown): v is ComExecResult;
 /**
  * Resolve approval for cell changes: show UI if needed, then revert or cleanup.
  */
-export declare function resolveApproval(result: ComExecResult, approval: ApprovalGate<ExcelApprovalPayload> | undefined, postControl: (body: object) => Promise<Response>, ctx: ExtensionContext, description?: string, observability?: ExcelExecApprovalObservability, priorApprovalSummaries?: string[]): Promise<ApprovalResolution>;
+export declare function resolveApproval(result: ComExecResult, approval: ApprovalGate<OfficeApprovalPayload> | undefined, postControl: (body: object) => Promise<Response>, ctx: ExtensionContext, description?: string, observability?: ExcelExecApprovalObservability, priorApprovalSummaries?: string[]): Promise<ApprovalResolution>;
 /**
  * Execute code against the local XLL and run approval.
  *
@@ -53,7 +53,7 @@ export declare function resolveApproval(result: ComExecResult, approval: Approva
  * The selected XLL endpoint is always local to the machine running the agent.
  */
 export declare function executeComLocally(excelTarget: ExcelHostEndpoint, code: string, options?: {
-    approval?: ApprovalGate<ExcelApprovalPayload>;
+    approval?: ApprovalGate<OfficeApprovalPayload>;
     ctx?: ExtensionContext;
     description?: string;
     signal?: AbortSignal;

package/dist/app/local/tools/execute-code/executor.js

@@ -81,7 +81,7 @@ async function requestAlwaysConfirmApproval(approval, ctx, description, dangerou
         isSafe: false,
         isAutoApproved: approval?.isAutoApproved() ?? false,
         alwaysRequireExplicitApproval: true,
-        allowHeadlessApproval: ctx?.permissionPolicy?.spreadsheet.allowHeadlessApproval ?? false
+        allowHeadlessApproval: ctx?.permissionPolicy?.office.allowHeadlessApproval ?? false
     });
     if (decision !== 'prompt' || !approval || !ctx) {
         observability?.onRejected?.(request);
@@ -121,7 +121,7 @@ export async function resolveApproval(result, approval, postControl, ctx, descri
             isSafe: false,
             isAutoApproved: approval?.isAutoApproved() ?? false,
             alwaysRequireExplicitApproval: false,
-            allowHeadlessApproval: ctx.permissionPolicy?.spreadsheet.allowHeadlessApproval ?? false
+            allowHeadlessApproval: ctx.permissionPolicy?.office.allowHeadlessApproval ?? false
         });
         if (decision === 'prompt') {
             if (!approval) {
@@ -266,7 +266,7 @@ export async function executeComLocally(excelTarget, code, options) {
             isSafe: analysis.isReadOnly,
             isAutoApproved: approval?.isAutoApproved() ?? false,
             alwaysRequireExplicitApproval: false,
-            allowHeadlessApproval: ctx?.permissionPolicy?.spreadsheet.allowHeadlessApproval ?? false
+            allowHeadlessApproval: ctx?.permissionPolicy?.office.allowHeadlessApproval ?? false
         });
     if (executionDecision === 'deny') {
         return {

package/dist/app/local/tools/execute-code/tool.d.ts

@@ -8,12 +8,12 @@
 import type { ToolDefinition } from '../../../../core/core-types.js';
 import type { ApprovalGate } from '../../../approvals/types.js';
 import type { ExcelTargetResolver } from '../../../xll/excel-target.js';
-import type { ExcelApprovalPayload } from './approval-payload.js';
+import type { OfficeApprovalPayload } from './approval-payload.js';
 import { type ComExecResult, type ExcelExecApprovalObservability } from './executor.js';
 declare const schema: import("@sinclair/typebox").TObject<{
     description: import("@sinclair/typebox").TString;
     code: import("@sinclair/typebox").TString;
 }>;
-export declare function createExcelExecTool(resolveTarget: ExcelTargetResolver, approval?: ApprovalGate<ExcelApprovalPayload>, observability?: ExcelExecApprovalObservability): ToolDefinition<typeof schema, ComExecResult>;
+export declare function createExcelExecTool(resolveTarget: ExcelTargetResolver, approval?: ApprovalGate<OfficeApprovalPayload>, observability?: ExcelExecApprovalObservability): ToolDefinition<typeof schema, ComExecResult>;
 export {};
 //# sourceMappingURL=tool.d.ts.map

package/dist/app/local/tools/execute-code/tool.js

@@ -48,9 +48,9 @@ const schema = Type.Object({
     })
 });
 export function createExcelExecTool(resolveTarget, approval, observability) {
-    const assertSpreadsheetPolicy = (ctx) => {
-        const spreadsheetPolicy = ctx?.permissionPolicy?.spreadsheet;
-        if (!spreadsheetPolicy || spreadsheetPolicy.mutationBehavior !== 'deny') {
+    const assertOfficePolicy = (ctx) => {
+        const officePolicy = ctx?.permissionPolicy?.office;
+        if (!officePolicy || officePolicy.mutationBehavior !== 'deny') {
             return;
         }
         throw new Error('Spreadsheet execution is denied by the current permission policy.');
@@ -62,7 +62,7 @@ export function createExcelExecTool(resolveTarget, approval, observability) {
         description: TOOL_DESCRIPTION,
         parameters: schema,
         async execute(_toolCallId, { code, description }, signal, _onUpdate, ctx) {
-            assertSpreadsheetPolicy(ctx);
+            assertOfficePolicy(ctx);
             const excelTarget = await resolveTarget();
             const { result, outcome, approvalSummaries } = await executeComLocally(excelTarget, code, {
                 approval,

package/dist/app/local/tools/execute-code/write-analyzer.d.ts

@@ -12,7 +12,7 @@
  * This means comments or string literals containing write patterns will
  * trigger approval — that's fine.
  */
-import type { ExcelApprovalOperation } from './approval-payload.js';
+import type { OfficeApprovalOperation } from './approval-payload.js';
 /** Exported for the sync test to verify against Python source. */
 export declare const COM_WRAPPED_API_WRITE_OPS: string[];
 interface CodeAnalysis {
@@ -20,7 +20,7 @@ interface CodeAnalysis {
     /** First matched pattern label (for logging/debugging), or null if read-only. */
     matchedPattern: string | null;
     alwaysRequireApproval: boolean;
-    dangerousOperations: ExcelApprovalOperation[];
+    dangerousOperations: OfficeApprovalOperation[];
 }
 /**
  * Analyze COM-backed execute_code Python for write operations.

package/dist/app/local/tools/office-exec/analyzer.d.ts

@@ -0,0 +1,14 @@
+import type { DesktopOfficeApplication } from '../../../xll/office-target.js';
+export interface OfficeExecOperation {
+    label: string;
+    reason: string;
+}
+export interface OfficeCodeAnalysis {
+    isReadOnly: boolean;
+    alwaysRequireApproval: boolean;
+    matchedPattern: string | null;
+    dangerousOperations: OfficeExecOperation[];
+}
+/** Conservatively classify raw Word/PowerPoint COM code before execution. */
+export declare function analyzeOfficeCode(code: string, _application: DesktopOfficeApplication): OfficeCodeAnalysis;
+//# sourceMappingURL=analyzer.d.ts.map

package/dist/app/local/tools/office-exec/analyzer.js

@@ -0,0 +1,106 @@
+const ALWAYS_CONFIRM = [
+    {
+        label: 'Quit Office application',
+        reason: 'This closes the application and can discard unsaved document state.',
+        pattern: /\.Quit\s*\(/
+    },
+    {
+        label: 'Close document or presentation',
+        reason: 'This closes an Office file or window and can discard unsaved changes.',
+        pattern: /\.Close\s*\(/
+    }
+];
+const MUTATION_PATTERNS = [
+    /\.\w+(?:\.\w+)*\s*(?:\*\*|\/\/|<<|>>|[+\-*\/%@&|^])?=(?!=)/,
+    /\[[^\]]+\]\s*(?:\*\*|\/\/|<<|>>|[+\-*\/%@&|^])?=(?!=)/,
+    /\b(?:setattr|delattr|exec|eval)\s*\(/,
+    /\.(?:Add|Delete|Insert|InsertAfter|InsertBefore|TypeText|Paste|PasteSpecial)\s*\(/,
+    /\.(?:Save|SaveAs|SaveCopyAs|Export|ExportAsFixedFormat|PrintOut)\s*\(/,
+    /\.(?:Apply|Activate|Select|Move|Copy|Cut|Duplicate|Reset)\s*\(/
+];
+const READ_ONLY_METHODS = new Set([
+    'Item',
+    'Range',
+    'Cell',
+    'Characters',
+    'Words',
+    'Sentences',
+    'Paragraphs',
+    'Sections',
+    'ComputeStatistics'
+]);
+const SAFE_FUNCTIONS = new Set([
+    'print',
+    'len',
+    'str',
+    'int',
+    'float',
+    'bool',
+    'list',
+    'dict',
+    'tuple',
+    'set',
+    'range',
+    'enumerate',
+    'sorted',
+    'min',
+    'max',
+    'sum',
+    'any',
+    'all',
+    'isinstance',
+    'type',
+    'repr',
+    'round'
+]);
+/** Conservatively classify raw Word/PowerPoint COM code before execution. */
+export function analyzeOfficeCode(code, _application) {
+    const dangerousOperations = ALWAYS_CONFIRM.filter(({ pattern }) => pattern.test(code)).map(({ label, reason }) => ({ label, reason }));
+    if (dangerousOperations.length > 0) {
+        return {
+            isReadOnly: false,
+            alwaysRequireApproval: true,
+            matchedPattern: dangerousOperations[0]?.label ?? null,
+            dangerousOperations
+        };
+    }
+    for (const pattern of MUTATION_PATTERNS) {
+        if (pattern.test(code)) {
+            return {
+                isReadOnly: false,
+                alwaysRequireApproval: false,
+                matchedPattern: pattern.source,
+                dangerousOperations: []
+            };
+        }
+    }
+    for (const match of code.matchAll(/\.([A-Za-z_]\w*)\s*\(/g)) {
+        const method = match[1];
+        if (method && !READ_ONLY_METHODS.has(method)) {
+            return {
+                isReadOnly: false,
+                alwaysRequireApproval: false,
+                matchedPattern: `unknown COM method: ${method}`,
+                dangerousOperations: []
+            };
+        }
+    }
+    for (const match of code.matchAll(/(?<![.\w])([A-Za-z_]\w*)\s*\(/g)) {
+        const fn = match[1];
+        if (fn && !SAFE_FUNCTIONS.has(fn)) {
+            return {
+                isReadOnly: false,
+                alwaysRequireApproval: false,
+                matchedPattern: `unknown function: ${fn}`,
+                dangerousOperations: []
+            };
+        }
+    }
+    return {
+        isReadOnly: true,
+        alwaysRequireApproval: false,
+        matchedPattern: null,
+        dangerousOperations: []
+    };
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/app/local/tools/office-exec/tool.d.ts

@@ -0,0 +1,23 @@
+import type { ToolDefinition } from '../../../../core/core-types.js';
+import { type ApprovalGate } from '../../../approvals/types.js';
+import type { DesktopOfficeApplication, OfficeTargetResolver } from '../../../xll/office-target.js';
+import type { OfficeApprovalPayload } from '../execute-code/approval-payload.js';
+export declare const WORD_EXEC_TOOL_SUMMARY = "Execute raw Python against the local Microsoft Word COM application.";
+export declare const POWERPOINT_EXEC_TOOL_SUMMARY = "Execute raw Python against the local Microsoft PowerPoint COM application.";
+export interface OfficeExecResult {
+    ok: boolean;
+    output?: string;
+    error?: string;
+    host: {
+        application: DesktopOfficeApplication;
+        hostId: string;
+        pid: number;
+    };
+}
+declare const schema: import("@sinclair/typebox").TObject<{
+    description: import("@sinclair/typebox").TString;
+    code: import("@sinclair/typebox").TString;
+}>;
+export declare function createOfficeExecTool(application: DesktopOfficeApplication, resolveTarget: OfficeTargetResolver, approval?: ApprovalGate<OfficeApprovalPayload>): ToolDefinition<typeof schema, OfficeExecResult | undefined>;
+export {};
+//# sourceMappingURL=tool.d.ts.map