xlsx-for-ai 2.20.0 → 2.22.0

package/README.md

@@ -189,6 +189,13 @@ For custom MCP clients, the binary is `xlsx-for-ai-mcp` (stdio transport). Overr
 | `xlsx_form_controls` | Interactive widgets — checkboxes, buttons, drop-downs, spinners, scroll bars, list boxes — with linked cell + bounds. |
 | `xlsx_macros` | VBA macro presence + module-name heuristics + safety advice (does NOT extract source by policy). |
 
+### Integrations
+
+| Tool | What it does |
+|---|---|
+| `xlsx_post_slack` | Post a workbook to a Slack channel as a file attachment with an optional message. BYOA — the agent supplies the user's Slack bot token (`xoxb-…`); the token is forwarded to Slack and never persisted. Uses Slack's external upload flow. |
+| `xlsx_post_teams` | Post a workbook to a Microsoft Teams channel as a file attachment in a channel message, with an optional message. BYOA — the agent supplies the user's Microsoft Graph access token (JWT); the token is forwarded to Microsoft and never persisted. Uses Graph's filesFolder + upload-session + post-message flow. |
+
 Tool responses include a citation footer and a `_meta` block (tool name, version, tier, request ID, `powered_by`). Both pass through verbatim; nothing is stripped.
 
 ---

package/lib/client.js

@@ -12,6 +12,7 @@
  */
 
 const { readConfig } = require('./config');
+const { version: CLIENT_VERSION } = require('../package.json');
 
 const DEFAULT_API = 'https://api.xlsx-for-ai.dev';
 const TIMEOUT_MS  = 30_000;
@@ -32,7 +33,10 @@ async function fetchWithTimeout(url, init) {
 
 async function post(path, body, opts = {}) {
   const url = apiBase() + path;
-  const headers = { 'Content-Type': 'application/json' };
+  const headers = {
+    'Content-Type': 'application/json',
+    'X-Client-Version': CLIENT_VERSION,
+  };
 
   if (opts.auth !== false) {
     const cfg = readConfig();

package/mcp.js

@@ -827,6 +827,51 @@ const TOOLS = [
       required: ['file_path'],
     },
   },
+
+  {
+    name: 'xlsx_post_slack',
+    description:
+      'xlsx-for-ai — read, write, diff, redact, supervise .xlsx files locally.\n' +
+      'This tool: upload a local .xlsx file to a Slack channel as a file attachment, with an optional accompanying message. BYOA — the agent must pass the user\'s Slack bot token (xoxb-…). The token is forwarded to Slack and never stored server-side.\n' +
+      'Posts via Slack\'s 3-step external upload flow (files.getUploadURLExternal → upload → files.completeUploadExternal), which is the only sanctioned path as of 2024+.\n\n' +
+      'USE WHEN: the user asks "post this workbook to #channel," "share this with the team in Slack," or any other outbound-file-to-Slack request. The agent has just produced or modified a workbook and wants to deliver it. ' +
+      'Free tier — counts against the 10k/mo cap.\n\n' +
+      'DO NOT USE WHEN: the file lives in a Slack channel and you want to READ it (that\'s the inbound Manual-Mode-Detector pattern, not this). Or when there is no Slack bot token available — the user must have installed a Slack app with files:write scope.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        file_path: { type: 'string', description: 'Absolute path to the .xlsx file to post.' },
+        channel: { type: 'string', description: 'Slack channel ID (C…/G…) the file should land in. Channel names like #general are NOT accepted — resolve to a channel ID first.' },
+        slack_token: { type: 'string', description: 'Slack bot token (xoxb-…). Forwarded to Slack; never persisted by us.' },
+        message: { type: 'string', description: 'Optional: message to post alongside the file (Slack\'s initial_comment).' },
+        filename: { type: 'string', description: 'Optional: filename Slack will display. Defaults to the basename of file_path.' },
+      },
+      required: ['file_path', 'channel', 'slack_token'],
+    },
+  },
+
+  {
+    name: 'xlsx_post_teams',
+    description:
+      'xlsx-for-ai — read, write, diff, redact, supervise .xlsx files locally.\n' +
+      'This tool: upload a local .xlsx file to a Microsoft Teams channel as a file attachment in a channel message, with an optional accompanying message. BYOA — the agent must pass the user\'s Microsoft Graph access token (a JWT starting with "eyJ"). The token is forwarded to Microsoft Graph and never stored server-side.\n' +
+      'Uses Microsoft Graph\'s 4-step flow: locate the channel\'s filesFolder driveItem, create an upload session, upload the bytes, then post a chatMessage with the file as an inline attachment.\n\n' +
+      'USE WHEN: the user asks "post this workbook to my Teams channel," "share this with the team in Teams," or any other outbound-file-to-Teams request. The agent has just produced or modified a workbook and wants to deliver it to a Microsoft Teams channel. ' +
+      'Free tier — counts against the 10k/mo cap.\n\n' +
+      'DO NOT USE WHEN: posting to Slack (use xlsx_post_slack). Or when there is no Microsoft Graph token available — the user must have an Entra ID app registration with Group.ReadWrite.All or Files.ReadWrite.All + ChannelMessage.Send scopes, AND a valid access token for that app.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        file_path: { type: 'string', description: 'Absolute path to the .xlsx file to post.' },
+        team_id: { type: 'string', description: 'Microsoft Teams team ID (GUID). Find via Graph: GET /me/joinedTeams.' },
+        channel_id: { type: 'string', description: 'Microsoft Teams channel ID. Find via Graph: GET /teams/{team-id}/channels.' },
+        graph_token: { type: 'string', description: 'Microsoft Graph access token (JWT). Forwarded to Microsoft; never persisted by us. Must have file-upload + channel-message-send scopes.' },
+        message: { type: 'string', description: 'Optional: message to post alongside the file. Plain text; will be HTML-escaped server-side.' },
+        filename: { type: 'string', description: 'Optional: filename Teams will display. Defaults to the basename of file_path.' },
+      },
+      required: ['file_path', 'team_id', 'channel_id', 'graph_token'],
+    },
+  },
 ];
 
 // ---------------------------------------------------------------------------
@@ -1040,6 +1085,34 @@ async function dispatchTool(name, args) {
     });
   }
 
+  // xlsx_post_slack: outbound file-to-Slack. Top-level fields, not the
+  // standard {file_b64, options} shape — channel + slack_token + message
+  // + filename live alongside file_b64 in the server route's body schema.
+  if (name === 'xlsx_post_slack') {
+    const body = {
+      file_b64: fileToB64(args.file_path),
+      channel: args.channel,
+      slack_token: args.slack_token,
+    };
+    if (args.message !== undefined) body.message = args.message;
+    body.filename = args.filename || path.basename(args.file_path);
+    return callTool('xlsx_post_slack', body);
+  }
+
+  // xlsx_post_teams: outbound file-to-Teams. Same shape as Slack but with
+  // Microsoft Graph fields (team_id + channel_id + graph_token).
+  if (name === 'xlsx_post_teams') {
+    const body = {
+      file_b64: fileToB64(args.file_path),
+      team_id: args.team_id,
+      channel_id: args.channel_id,
+      graph_token: args.graph_token,
+    };
+    if (args.message !== undefined) body.message = args.message;
+    body.filename = args.filename || path.basename(args.file_path);
+    return callTool('xlsx_post_teams', body);
+  }
+
   // All other tools (list_sheets, schema, hyperlinks, conditional_formats,
   // styles, etc.) — single-file relay. Forward any common option keys the
   // routes accept so we don't silently drop them. New keys added here as

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "xlsx-for-ai",
   "mcpName": "io.github.senoff/xlsx-for-ai",
-  "version": "2.20.0",
+  "version": "2.22.0",
   "description": "The MCP server that makes LLMs reliable on real-world Excel spreadsheets. Thin npm client over a hosted API — read, write, diff, redact, and supervise .xlsx files from any MCP-aware agent.",
   "main": "index.js",
   "bin": {