feat(files): preview Word documents and Excel workbooks

[piotrnowakowski]

Read-only Word (.docx) and Excel (.xlsx) previews are available from Files, chat file links, and attachments beside the conversation.

Preview behavior

• Word displays document pages, text, tables, images, headers, and footers through a lazy-loaded renderer. Sanitized output runs in a sandboxed frame.
• Excel offers visible-sheet selection and 100-row pages within a preview window of up to 500 rows and 50 columns. It preserves absolute cell coordinates, including sparse C9000 content and implicit rows, number/date formats, Unicode, rich text, cached formula results, and formula-expression fallback.
• File refresh reloads the document. Workspace-change checks compare file identity, size, and timestamps so unchanged content retains its selected worksheet and page.
• Directories with Office-like extensions open in the file tree. Original files can be saved through signed asset URLs and streaming downloads.
• Mobile workspace links and attachments use the native viewer and Save/share fallback. Office renderer dependencies are confined to web.

Resource management

• Preview input is capped at 10 MiB and expanded archive content at 64 MiB. Validation checks ZIP headers, offsets, descriptors, effective Unicode filenames, duplicate paths, and actual decompressed sizes before rendering.
• Word XML, element, media, and decoded-image budgets apply to the parts selected by document relationships, including nonstandard part names.
• Excel retains the compressed archive and parses the selected worksheet into a bounded cell slice with its required strings and styles. Archive validation still checks every entry. Cells are limited to 2,000 characters, aggregate cell text to 1 MiB of UTF-16 content, and serialized output to 2 MiB.
• Only the requested page crosses from the worker to the UI. Page changes reuse the selected-sheet window. Rapid sheet changes are coalesced, obsolete work is cancelled, and stale responses are ignored.
• Validation transfers buffers without an additional copy and uses adaptive decompression chunks up to 4 KiB, with smaller chunks near the remaining size budget. Stalled workers terminate after 15 seconds; closing a preview releases its workers and rendered content.
• Office file-type checks use metadata without loading binary contents into the text cache. The license generator includes the renderer dependencies and SAX parser notices.

Verification

• 231 tests pass across 17 focused files, covering parsing, archive and payload limits, Unicode filenames, sparse coordinates, pagination, selected-sheet isolation, permissions, refresh, signing/downloads, cancellation, watchdogs, cleanup, and native fallback lifecycle.
• Scoped web typecheck, targeted formatting/lint, diff checks, and production web build pass. One existing breadcrumb effect-dependency lint warning remains.
• The running production web app displays a two-page Word document with its table, image, headers/footers, and Unicode text. Excel checks cover C9000 pages through row 9249, selected-sheet behavior, content limits, and malformed-file fallbacks. Office-looking folders display the tree without a Save action or Office worker.
• Closing previews leaves zero Office workers, iframes, and table cells.
• Three browser trials on a 250,000-cell workbook measured median CPU time of 2.33 seconds and retained main-page heap of 38.59 MiB. The sampled main-renderer working set was 365.02 MiB. CPU includes browser overhead; heap is measured after diagnostic garbage collection and excludes workers. Working-set samples include caches/shared pages and are not peak-memory measurements.

Scope and limits

This draft provides read-only previews. Document editing, Excel charts and workbook styling, and formula recalculation are outside its scope. Documents exceeding preview budgets offer the original file for opening in another app.

Large worksheet XML and shared-string parts require bounded scans. Word DOM work runs on the main thread, with complexity limits and cancellation between rendering phases.

Runtime verification covers the local production web build. Native lifecycle tests pass, but live Android verification is blocked by Windows native dependency/build issues. Native-device behavior, Electron-specific downloads/performance, and relay/tunnel modes are unverified.

Evidence

Word beside chat	Sparse Excel pagination

Pagination and sheet-selection recording · Chat preview recording

Model: GPT-6.1-Sol. Harness: Codex desktop.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Thanks for proposing Word and Excel previews. This exceeds our current 500-changed-line intake limit for unvouched contributors, with new renderers, archive workers, dependencies, and mobile viewer support across 44 files. As Read this first explains, review capacity is limited, and right now we are only taking focused bug fixes from outside contributors. Please bring the proposal to an Ideas discussion and agree on a smaller approved scope before requesting reconsideration.