From 0ef421c8a6f2a75ecb9c421a3aa9dced0e6c0ffb Mon Sep 17 00:00:00 2001
From: piotrnowakowski <61783713+piotrnowakowski@users.noreply.github.com>
Date: Tue, 13 Oct 2026 20:05:49 +0200
Subject: [PATCH 1/4] feat(files): preview Word documents and Excel workbooks

---
 .../features/files/AttachmentFileScreen.tsx   |   3 +-
 apps/server/src/assets/AssetAccess.test.ts    |  40 +++++
 apps/server/src/assets/AssetAccess.ts         |  42 +++--
 apps/web/package.json                         |   2 +
 .../files/AttachmentFilePreview.tsx           |  10 ++
 apps/web/src/components/files/DocxPreview.tsx |  42 +++++
 .../src/components/files/FilePreviewPanel.tsx | 155 +++++++++++++++++-
 .../components/files/OfficeFilePreview.tsx    |  74 +++++++++
 .../components/files/SpreadsheetPreview.tsx   | 135 +++++++++++++++
 .../src/components/files/docxDocument.test.ts |  32 ++++
 apps/web/src/components/files/docxDocument.ts |  24 +++
 .../components/files/officeArchive.test.ts    |  41 +++++
 .../web/src/components/files/officeArchive.ts |  58 +++++++
 .../files/spreadsheetDocument.test.ts         | 107 ++++++++++++
 .../components/files/spreadsheetDocument.ts   |  54 ++++++
 .../files/spreadsheetPreview.worker.ts        |  29 ++++
 .../files/spreadsheetPreviewModel.ts          |  14 ++
 docs/user/composer.md                         |  12 ++
 .../client-runtime/src/filePreview.test.ts    |  44 ++++-
 packages/client-runtime/src/filePreview.ts    |  32 +++-
 packages/shared/src/filePreview.test.ts       |  18 ++
 packages/shared/src/filePreview.ts            |  27 ++-
 pnpm-lock.yaml                                |  78 ++++++---
 23 files changed, 1021 insertions(+), 52 deletions(-)
 create mode 100644 apps/web/src/components/files/DocxPreview.tsx
 create mode 100644 apps/web/src/components/files/OfficeFilePreview.tsx
 create mode 100644 apps/web/src/components/files/SpreadsheetPreview.tsx
 create mode 100644 apps/web/src/components/files/docxDocument.test.ts
 create mode 100644 apps/web/src/components/files/docxDocument.ts
 create mode 100644 apps/web/src/components/files/officeArchive.test.ts
 create mode 100644 apps/web/src/components/files/officeArchive.ts
 create mode 100644 apps/web/src/components/files/spreadsheetDocument.test.ts
 create mode 100644 apps/web/src/components/files/spreadsheetDocument.ts
 create mode 100644 apps/web/src/components/files/spreadsheetPreview.worker.ts
 create mode 100644 apps/web/src/components/files/spreadsheetPreviewModel.ts

diff --git a/apps/mobile/src/features/files/AttachmentFileScreen.tsx b/apps/mobile/src/features/files/AttachmentFileScreen.tsx
index e877b165eb9f..366e088da514 100644
--- a/apps/mobile/src/features/files/AttachmentFileScreen.tsx
+++ b/apps/mobile/src/features/files/AttachmentFileScreen.tsx
@@ -49,7 +49,8 @@ type AttachmentFileScreenProps = StaticScreenProps<AttachmentFileRouteParams>;
 function nativeViewerKind(kind: ReturnType<typeof useAttachmentDocument>["kind"]) {
   if (kind === "image") return "image" as const;
   if (kind === "pdf") return "pdf" as const;
-  if (kind === "video" || kind === "unsupported") return "document" as const;
+  if (kind === "video" || kind === "unsupported" || kind === "docx" || kind === "xlsx")
+    return "document" as const;
   return null;
 }
 
diff --git a/apps/server/src/assets/AssetAccess.test.ts b/apps/server/src/assets/AssetAccess.test.ts
index e32f41372528..150f0ac8c74d 100644
--- a/apps/server/src/assets/AssetAccess.test.ts
+++ b/apps/server/src/assets/AssetAccess.test.ts
@@ -919,6 +919,46 @@ describe("AssetAccess", () => {
     }).pipe(Effect.provide(layerTest)),
   );
 
+  it.effect(
+    "serves Office workspace and host files through exact signed URLs without exposing siblings",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-office-preview-" });
+        const bytes = Uint8Array.from([0x50, 0x4b, 0, 255, 1]);
+        for (const [extension, mimeType] of [
+          ["docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document"],
+          ["xlsx", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],
+        ]) {
+          const name = `report#final.${extension}`;
+          const filePath = path.join(root, name);
+          yield* fs.writeFile(filePath, bytes);
+          yield* fs.writeFileString(path.join(root, `sibling.${extension}`), "private sibling");
+          for (const resource of [
+            {
+              _tag: "workspace-file" as const,
+              threadId: ThreadId.make("thread-1"),
+              path: filePath,
+            },
+            { _tag: "media-file" as const, threadId: ThreadId.make("thread-1"), path: filePath },
+            { _tag: "draft-workspace-file" as const, cwd: root, path: filePath },
+          ]) {
+            const issued = yield* issueAssetUrl({ resource, workspaceRoot: root });
+            const suffix = issued.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length);
+            const separator = suffix.indexOf("/");
+            const token = suffix.slice(0, separator);
+            const resolved = yield* resolveAsset(token, suffix.slice(separator + 1));
+            expect(resolved).toMatchObject({ kind: "file", mimeType });
+            expect(Array.from(yield* fs.readFile(filePath))).toEqual(Array.from(bytes));
+            expect(yield* resolveAsset(token, `sibling.${extension}`)).toBeNull();
+            expect(yield* resolveAsset(token, `../${name}`)).toBeNull();
+            expect(yield* resolveAsset(`${token}tampered`, name)).toBeNull();
+          }
+        }
+      }).pipe(Effect.provide(layerTest)),
+  );
+
   it.effect("previews workspace files with literal fragment characters in their paths", () =>
     Effect.gen(function* () {
       const fileSystem = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/assets/AssetAccess.ts b/apps/server/src/assets/AssetAccess.ts
index 6b736c68f74e..39631b736a13 100644
--- a/apps/server/src/assets/AssetAccess.ts
+++ b/apps/server/src/assets/AssetAccess.ts
@@ -20,6 +20,8 @@ import {
 import {
   audioMimeTypeFromExtension,
   hostPreviewMimeTypeFromExtension,
+  officeFilePreviewKind,
+  OFFICE_PREVIEW_MIME_TYPES,
   isWorkspaceImagePreviewPath,
   isWorkspacePreviewEntryPath,
   WORKSPACE_BROWSER_PREVIEW_EXTENSIONS,
@@ -479,21 +481,23 @@ const finalizeWorkspaceFileAsset = Effect.fn("AssetAccess.finalizeWorkspaceFileA
       ? yield* readImageDimensionsFromHeader(canonicalFile)
       : null;
     return {
-      claims: isWorkspaceImagePreviewPath(resolved.relativePath)
-        ? {
-            version: 1 as const,
-            kind: "workspace-file-exact" as const,
-            workspaceRoot: canonicalWorkspaceRoot,
-            relativePath: resolved.relativePath,
-            expiresAt: input.expiresAt,
-          }
-        : {
-            version: 1 as const,
-            kind: "workspace-file" as const,
-            workspaceRoot: canonicalWorkspaceRoot,
-            baseRelativePath: path.dirname(resolved.relativePath),
-            expiresAt: input.expiresAt,
-          },
+      claims:
+        isWorkspaceImagePreviewPath(resolved.relativePath) ||
+        officeFilePreviewKind(resolved.relativePath) !== null
+          ? {
+              version: 1 as const,
+              kind: "workspace-file-exact" as const,
+              workspaceRoot: canonicalWorkspaceRoot,
+              relativePath: resolved.relativePath,
+              expiresAt: input.expiresAt,
+            }
+          : {
+              version: 1 as const,
+              kind: "workspace-file" as const,
+              workspaceRoot: canonicalWorkspaceRoot,
+              baseRelativePath: path.dirname(resolved.relativePath),
+              expiresAt: input.expiresAt,
+            },
       fileName: path.basename(resolved.relativePath),
       imageDimensions,
     };
@@ -967,8 +971,14 @@ export const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (
       workspaceRoot: claims.workspaceRoot,
       relativePath: claims.relativePath,
     });
+    const officeKind =
+      exactWorkspaceFile === null ? null : officeFilePreviewKind(exactWorkspaceFile);
     return exactWorkspaceFile
-      ? ({ kind: "file", path: exactWorkspaceFile } satisfies ResolvedAsset)
+      ? ({
+          kind: "file",
+          path: exactWorkspaceFile,
+          ...(officeKind === null ? {} : { mimeType: OFFICE_PREVIEW_MIME_TYPES[officeKind] }),
+        } satisfies ResolvedAsset)
       : null;
   }
   const segments = decodedPath.split(/[\\/]/);
diff --git a/apps/web/package.json b/apps/web/package.json
index b4ef7684a006..de06177fdd9e 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -52,6 +52,7 @@
     "@tiptap/starter-kit": "^3.31.3",
     "class-variance-authority": "^0.7.1",
     "culori": "^4.0.2",
+    "docx-preview": "0.4.1",
     "dompurify": "^3.4.16",
     "effect": "catalog:",
     "hast-util-to-html": "^9.0.5",
@@ -70,6 +71,7 @@
     "remark-gfm": "catalog:",
     "tailwind-merge": "^3.4.0",
     "unbash": "^5.0.0",
+    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "zustand": "^5.0.11"
   },
   "devDependencies": {
diff --git a/apps/web/src/components/files/AttachmentFilePreview.tsx b/apps/web/src/components/files/AttachmentFilePreview.tsx
index 68b186d3a04e..7c55b824e374 100644
--- a/apps/web/src/components/files/AttachmentFilePreview.tsx
+++ b/apps/web/src/components/files/AttachmentFilePreview.tsx
@@ -19,6 +19,7 @@ import { cn } from "~/lib/utils";
 import { AudioPreview } from "./AudioPreview";
 import { BrowserDocumentFrame } from "./BrowserDocumentFrame";
 import { DelimitedTablePreview } from "./DelimitedTablePreview";
+import { OfficeFilePreview } from "./OfficeFilePreview";
 import {
   FILE_SURFACE_SUBHEADER_CLASS,
   FileSurfaceAction,
@@ -244,6 +245,15 @@ export function AttachmentFilePreview(props: {
     ) : (
       <ReadOnlySourcePreview name={props.name} text={content.text} />
     )
+  ) : kind === "docx" || kind === "xlsx" ? (
+    <OfficeFilePreview
+      key={`${url}:${revision}`}
+      src={url}
+      name={props.name}
+      kind={kind}
+      sizeBytes={props.sizeBytes}
+      onRetry={() => setRevision((value) => value + 1)}
+    />
   ) : kind === "pdf" || kind === "html" ? (
     <BrowserDocumentFrame
       src={url}
diff --git a/apps/web/src/components/files/DocxPreview.tsx b/apps/web/src/components/files/DocxPreview.tsx
new file mode 100644
index 000000000000..c0ea11edd6df
--- /dev/null
+++ b/apps/web/src/components/files/DocxPreview.tsx
@@ -0,0 +1,42 @@
+import { useEffect, useState } from "react";
+import { FileSurfaceFailure, FileSurfaceLoading } from "./fileSurfaceChrome";
+import { renderDocxDocument } from "./docxDocument";
+
+export default function DocxPreview(props: {
+  readonly bytes: Uint8Array;
+  readonly name: string;
+  readonly onRetry: () => void;
+}) {
+  const [result, setResult] = useState<{ html: string | null; error: string | null }>({
+    html: null,
+    error: null,
+  });
+  useEffect(() => {
+    let cancelled = false;
+    void renderDocxDocument(props.bytes)
+      .then((html) => {
+        if (!cancelled) setResult({ html, error: null });
+      })
+      .catch((cause: unknown) => {
+        if (!cancelled)
+          setResult({
+            html: null,
+            error: cause instanceof Error ? cause.message : "Could not render this Word document.",
+          });
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [props.bytes]);
+  if (result.error !== null)
+    return <FileSurfaceFailure message={result.error} onRetry={props.onRetry} />;
+  if (result.html === null) return <FileSurfaceLoading />;
+  return (
+    <iframe
+      title={props.name}
+      srcDoc={result.html}
+      sandbox=""
+      className="min-h-0 flex-1 border-0 bg-white scheme-light"
+    />
+  );
+}
diff --git a/apps/web/src/components/files/FilePreviewPanel.tsx b/apps/web/src/components/files/FilePreviewPanel.tsx
index efd7a7fbc90f..62797d46b6f7 100644
--- a/apps/web/src/components/files/FilePreviewPanel.tsx
+++ b/apps/web/src/components/files/FilePreviewPanel.tsx
@@ -12,6 +12,7 @@ import {
   isWorkspaceAudioPreviewPath,
   isWorkspaceImagePreviewPath,
   isWorkspaceVideoPreviewPath,
+  officeFilePreviewKind,
 } from "@t3tools/shared/filePreview";
 import {
   DEFAULT_TOKENIZE_MAX_LENGTH,
@@ -37,7 +38,7 @@ import {
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
 import { mediaFileReference } from "@t3tools/client-runtime/media-reference";
-import { FolderTree, Globe2, WrapTextIcon } from "lucide-react";
+import { DownloadIcon, FolderTree, Globe2, WrapTextIcon } from "lucide-react";
 import { Code2, Eye, Table2 } from "lucide";
 import * as Schema from "effect/Schema";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
@@ -75,6 +76,7 @@ import { AttachmentFilePreview } from "./AttachmentFilePreview";
 import { AudioPreview } from "./AudioPreview";
 import { BrowserDocumentFrame, isPdfPreviewFile } from "./BrowserDocumentFrame";
 import { DelimitedTablePreview } from "./DelimitedTablePreview";
+import { OfficeFilePreview } from "./OfficeFilePreview";
 import FileBrowserPanel from "./FileBrowserPanel";
 import { FileBreadcrumbs } from "./FileBreadcrumbs";
 import { FileMarkdownPreview } from "./FileMarkdownPreview";
@@ -268,6 +270,130 @@ function WorkspaceBrowserPreview(props: {
   );
 }
 
+function WorkspaceOfficePreview(props: {
+  readonly environmentId: EnvironmentId;
+  readonly threadRef: ScopedThreadRef;
+  readonly draft: boolean;
+  readonly absolutePath: string;
+  readonly workspaceRoot: string;
+  readonly name: string;
+  readonly kind: "docx" | "xlsx";
+  readonly workspaceMutationId: string | null;
+}) {
+  const insideWorkspace =
+    mediaFileReference(props.absolutePath, props.workspaceRoot).relativePath !== undefined;
+  const resource = useMemo(
+    () =>
+      workspaceAssetResource({
+        kind: insideWorkspace ? "workspace-file" : "media-file",
+        threadRef: props.threadRef,
+        draft: props.draft,
+        workspaceRoot: props.workspaceRoot,
+        absolutePath: props.absolutePath,
+      }),
+    [insideWorkspace, props.threadRef, props.draft, props.workspaceRoot, props.absolutePath],
+  );
+  const refresh = useAssetUrlRefresh(props.environmentId, resource);
+  const [revision, setRevision] = useState(0);
+  const [result, setResult] = useState<{ url: string | null; error: string | null }>({
+    url: null,
+    error: null,
+  });
+  useEffect(() => {
+    let cancelled = false;
+    // oxlint-disable-next-line react/set-state-in-effect -- Reauthorize after a file update or retry; never keep a stale preview URL.
+    setResult({ url: null, error: null });
+    void refresh()
+      .then((url) => {
+        if (!url) throw new Error("Reconnect to the environment and try again.");
+        if (!cancelled)
+          setResult({
+            url: `${url}${url.includes("?") ? "&" : "?"}workspace-revision=${encodeURIComponent(props.workspaceMutationId ?? "")}&office-revision=${revision}`,
+            error: null,
+          });
+      })
+      .catch((cause: unknown) => {
+        if (!cancelled)
+          setResult({
+            url: null,
+            error: cause instanceof Error ? cause.message : "Could not load this file.",
+          });
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [refresh, props.workspaceMutationId, revision]);
+  const retry = () => setRevision((value) => value + 1);
+  if (result.error) return <FileSurfaceFailure message={result.error} onRetry={retry} />;
+  if (!result.url) return <FileSurfaceLoading />;
+  return (
+    <OfficeFilePreview
+      key={result.url}
+      src={result.url}
+      name={props.name}
+      kind={props.kind}
+      onRetry={retry}
+    />
+  );
+}
+
+function WorkspaceOfficeDownload(props: {
+  readonly environmentId: EnvironmentId;
+  readonly threadRef: ScopedThreadRef;
+  readonly draft: boolean;
+  readonly absolutePath: string;
+  readonly workspaceRoot: string;
+  readonly name: string;
+}) {
+  const insideWorkspace =
+    mediaFileReference(props.absolutePath, props.workspaceRoot).relativePath !== undefined;
+  const resource = useMemo(
+    () =>
+      workspaceAssetResource({
+        kind: insideWorkspace ? "workspace-file" : "media-file",
+        threadRef: props.threadRef,
+        draft: props.draft,
+        workspaceRoot: props.workspaceRoot,
+        absolutePath: props.absolutePath,
+      }),
+    [insideWorkspace, props.threadRef, props.draft, props.workspaceRoot, props.absolutePath],
+  );
+  const refresh = useAssetUrlRefresh(props.environmentId, resource);
+  const [saving, setSaving] = useState(false);
+  const save = () => {
+    setSaving(true);
+    void (async () => {
+      const src = await refresh();
+      if (!src) throw new Error("Reconnect to the environment and try again.");
+      const response = await fetch(src);
+      if (!response.ok) throw new Error("Could not save this file.");
+      const url = URL.createObjectURL(await response.blob());
+      const anchor = document.createElement("a");
+      anchor.href = url;
+      anchor.download = props.name;
+      anchor.click();
+      setTimeout(() => URL.revokeObjectURL(url), 30_000);
+    })()
+      .catch((cause: unknown) => {
+        toastManager.add({
+          type: "error",
+          title: "Could not save file",
+          description: cause instanceof Error ? cause.message : "Please try again.",
+        });
+      })
+      .finally(() => setSaving(false));
+  };
+  return (
+    <FileSurfaceAction
+      label={saving ? "Preparing file…" : "Save file"}
+      disabled={saving}
+      onPress={save}
+    >
+      <DownloadIcon className="size-3.5" />
+    </FileSurfaceAction>
+  );
+}
+
 function WorkspaceVideoPreview(props: {
   readonly environmentId: EnvironmentId;
   readonly threadRef: ScopedThreadRef;
@@ -1063,6 +1189,7 @@ export default function FilePreviewPanel({
   const isAudio = relativePath !== null && !isVideo && isWorkspaceAudioPreviewPath(relativePath);
   const isImage = relativePath !== null && !isVideo && isWorkspaceImagePreviewPath(relativePath);
   const isMedia = isImage || isVideo || isAudio;
+  const officeKind = relativePath === null ? null : officeFilePreviewKind(relativePath);
   // PDFs have no text to show; HTML has, and can toggle between page and source.
   const isPdf = relativePath !== null && isPdfPreviewFile(relativePath);
   const isHtml = relativePath !== null && !isPdf && isBrowserPreviewFile(relativePath);
@@ -1080,7 +1207,7 @@ export default function FilePreviewPanel({
     environmentId,
     cwd,
     relativePath,
-    attachment === undefined && relativePath !== null,
+    attachment === undefined && relativePath !== null && officeKind === null,
   );
   const attemptedPath = file.readError?.resolvedPath ?? file.readError?.operationPath;
   // A chat link cannot tell a folder from a file, so a folder arrives here as
@@ -1148,6 +1275,7 @@ export default function FilePreviewPanel({
     file.data !== null &&
     !(isMarkdown && renderMarkdown) &&
     !(tableDelimiter && renderTable) &&
+    officeKind === null &&
     !renderBrowserFile;
   const rendered = isMarkdown ? renderMarkdown : tableDelimiter ? renderTable : renderBrowserFile;
   const setRenderedPreferred = isMarkdown
@@ -1301,6 +1429,16 @@ export default function FilePreviewPanel({
               />
             </FileSurfaceAction>
           ) : null}
+          {officeKind !== null && absolutePath ? (
+            <WorkspaceOfficeDownload
+              environmentId={environmentId}
+              threadRef={threadRef}
+              draft={draft}
+              absolutePath={absolutePath}
+              workspaceRoot={cwd}
+              name={relativePath.split(/[\\/]/).at(-1) ?? relativePath}
+            />
+          ) : null}
           {showsRawText ? (
             <FileSurfaceAction
               label={wordWrap ? "Disable word wrap" : "Enable word wrap"}
@@ -1334,6 +1472,7 @@ export default function FilePreviewPanel({
       {previewPath &&
       attachment === undefined &&
       !isMedia &&
+      officeKind === null &&
       !renderBrowserFile &&
       file.data?.truncated ? (
         <div className="shrink-0 border-b border-warning/20 bg-warning-surface px-3 py-1.5 text-2xs text-warning-foreground">
@@ -1353,6 +1492,18 @@ export default function FilePreviewPanel({
               asset={{ environmentId, attachmentId: attachment.id }}
               htmlRender={attachment.htmlRender === true}
             />
+          ) : relativePath && officeKind !== null && absolutePath ? (
+            <WorkspaceOfficePreview
+              key={`${environmentId}:${absolutePath}`}
+              environmentId={environmentId}
+              threadRef={threadRef}
+              draft={draft}
+              absolutePath={absolutePath}
+              workspaceRoot={cwd}
+              name={relativePath}
+              kind={officeKind}
+              workspaceMutationId={workspaceMutationId}
+            />
           ) : relativePath && isVideo && absolutePath ? (
             <WorkspaceVideoPreview
               key={`${environmentId}:${threadRef.threadId}:${absolutePath}`}
diff --git a/apps/web/src/components/files/OfficeFilePreview.tsx b/apps/web/src/components/files/OfficeFilePreview.tsx
new file mode 100644
index 000000000000..617a90c34eb2
--- /dev/null
+++ b/apps/web/src/components/files/OfficeFilePreview.tsx
@@ -0,0 +1,74 @@
+import { readOfficePreviewResponse } from "@t3tools/client-runtime/file-preview";
+import { FILE_OFFICE_PREVIEW_MAX_BYTES } from "@t3tools/shared/filePreview";
+import { lazy, Suspense, useEffect, useState } from "react";
+
+import { FileSurfaceFailure, FileSurfaceLoading } from "./fileSurfaceChrome";
+import { validateOfficeArchive, type OfficePreviewKind } from "./officeArchive";
+
+const DocxPreview = lazy(() => import("./DocxPreview"));
+const SpreadsheetPreview = lazy(() => import("./SpreadsheetPreview"));
+
+/** The same binary reader handles workspace URLs and local or uploaded attachments. */
+export function OfficeFilePreview(props: {
+  readonly src: string;
+  readonly name: string;
+  readonly kind: OfficePreviewKind;
+  readonly sizeBytes?: number;
+  readonly onRetry?: () => void;
+}) {
+  const [result, setResult] = useState<{ bytes: Uint8Array | null; error: string | null }>({
+    bytes: null,
+    error: null,
+  });
+  const [revision, setRevision] = useState(0);
+  useEffect(() => {
+    const controller = new AbortController();
+    // oxlint-disable-next-line react/set-state-in-effect -- Switching files invalidates the last document before loading new bytes.
+    setResult({ bytes: null, error: null });
+    void (async () => {
+      if ((props.sizeBytes ?? 0) > FILE_OFFICE_PREVIEW_MAX_BYTES)
+        throw new Error(
+          "Office previews support files up to 10 MB. Save this file to open it in another app.",
+        );
+      const response = await fetch(props.src, {
+        signal: controller.signal,
+        cache: revision > 0 ? "reload" : "default",
+      });
+      const bytes = await readOfficePreviewResponse(response, controller.signal);
+      validateOfficeArchive(bytes, props.kind);
+      if (!controller.signal.aborted) setResult({ bytes, error: null });
+    })().catch((cause: unknown) => {
+      if (!controller.signal.aborted)
+        setResult({
+          bytes: null,
+          error: cause instanceof Error ? cause.message : "Could not preview this document.",
+        });
+    });
+    return () => controller.abort();
+  }, [props.src, props.kind, props.sizeBytes, revision]);
+  const retry = () => {
+    props.onRetry?.();
+    setRevision((value) => value + 1);
+  };
+  if (result.error !== null) return <FileSurfaceFailure message={result.error} onRetry={retry} />;
+  if (result.bytes === null) return <FileSurfaceLoading />;
+  return (
+    <Suspense fallback={<FileSurfaceLoading />}>
+      {props.kind === "docx" ? (
+        <DocxPreview
+          key={`${props.src}:${revision}`}
+          bytes={result.bytes}
+          name={props.name}
+          onRetry={retry}
+        />
+      ) : (
+        <SpreadsheetPreview
+          key={`${props.src}:${revision}`}
+          bytes={result.bytes}
+          name={props.name}
+          onRetry={retry}
+        />
+      )}
+    </Suspense>
+  );
+}
diff --git a/apps/web/src/components/files/SpreadsheetPreview.tsx b/apps/web/src/components/files/SpreadsheetPreview.tsx
new file mode 100644
index 000000000000..288efa78fec9
--- /dev/null
+++ b/apps/web/src/components/files/SpreadsheetPreview.tsx
@@ -0,0 +1,135 @@
+/* oxlint-disable react/no-array-index-key -- Spreadsheet coordinates are stable, including blank cells. */
+import { useEffect, useId, useRef, useState } from "react";
+import { FileSurfaceFailure, FileSurfaceLoading, FileSurfaceNotice } from "./fileSurfaceChrome";
+import {
+  SPREADSHEET_PREVIEW_COLUMNS,
+  SPREADSHEET_PREVIEW_ROWS,
+  SPREADSHEET_PREVIEW_CELL_CHARACTERS,
+  type SpreadsheetRequest,
+  type SpreadsheetResponse,
+  type SpreadsheetTable,
+} from "./spreadsheetPreviewModel";
+
+export default function SpreadsheetPreview(props: {
+  readonly bytes: Uint8Array;
+  readonly name: string;
+  readonly onRetry: () => void;
+}) {
+  const workerRef = useRef<Worker | null>(null);
+  const worksheetId = useId();
+  const selectedRef = useRef<string | null>(null);
+  const [sheets, setSheets] = useState<string[]>([]);
+  const [table, setTable] = useState<SpreadsheetTable | null>(null);
+  const [selected, setSelected] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  useEffect(() => {
+    // Parsing stays off the chat renderer's main thread. A private copy also survives StrictMode's remount.
+    const worker = new Worker(new URL("./spreadsheetPreview.worker.ts", import.meta.url), {
+      type: "module",
+    });
+    workerRef.current = worker;
+    worker.addEventListener("message", (event: MessageEvent<SpreadsheetResponse>) => {
+      if ("error" in event.data) {
+        setError(event.data.error);
+        return;
+      }
+      const response = event.data;
+      if (selectedRef.current !== null && response.table.name !== selectedRef.current) return;
+      selectedRef.current = response.table.name;
+      setSheets(response.sheets);
+      setSelected(response.table.name);
+      setTable(response.table);
+    });
+    worker.addEventListener("error", () =>
+      setError("Could not render this workbook. Save it to open it in another app."),
+    );
+    const bytes = props.bytes.slice();
+    worker.postMessage({ type: "load", bytes } satisfies SpreadsheetRequest, [bytes.buffer]);
+    return () => {
+      worker.terminate();
+      workerRef.current = null;
+      selectedRef.current = null;
+    };
+  }, [props.bytes]);
+  if (error !== null) return <FileSurfaceFailure message={error} onRetry={props.onRetry} />;
+  return (
+    <div className="flex min-h-0 flex-1 flex-col">
+      {sheets.length > 1 ? (
+        <div className="flex shrink-0 items-center gap-2 border-b px-3 py-2 text-xs">
+          <label htmlFor={worksheetId}>Worksheet</label>
+          <select
+            id={worksheetId}
+            aria-label="Worksheet"
+            value={selected ?? ""}
+            className="min-w-0 flex-1 rounded border bg-background px-2 py-1"
+            onChange={(event) => {
+              const name = event.target.value;
+              selectedRef.current = name;
+              setSelected(name);
+              setTable(null);
+              workerRef.current?.postMessage({ type: "sheet", name } satisfies SpreadsheetRequest);
+            }}
+          >
+            {sheets.map((name) => (
+              <option key={name} value={name}>
+                {name}
+              </option>
+            ))}
+          </select>
+        </div>
+      ) : null}
+      {table === null ? (
+        <FileSurfaceLoading />
+      ) : table.rows.length === 0 ? (
+        <FileSurfaceNotice>This worksheet is empty.</FileSurfaceNotice>
+      ) : (
+        <>
+          {table.truncated ? (
+            <FileSurfaceNotice>
+              Preview limited to {SPREADSHEET_PREVIEW_ROWS} rows and {SPREADSHEET_PREVIEW_COLUMNS}{" "}
+              columns, with {SPREADSHEET_PREVIEW_CELL_CHARACTERS.toLocaleString()} characters per
+              cell. Save the workbook to view the rest.
+            </FileSurfaceNotice>
+          ) : null}
+          <div className="min-h-0 flex-1 overflow-auto [scrollbar-gutter:stable_both-edges]">
+            <table
+              className="min-w-full border-separate border-spacing-0 text-xs"
+              aria-label={`${props.name}: ${table.name}`}
+            >
+              <thead className="sticky top-0 z-10">
+                <tr>
+                  <th aria-label="Row number" className="border-b bg-muted px-3 py-2" />
+                  {table.columns.map((column) => (
+                    <th key={column} scope="col" className="border-b bg-muted px-3 py-2 text-left">
+                      {column}
+                    </th>
+                  ))}
+                </tr>
+              </thead>
+              <tbody>
+                {table.rows.map((row) => (
+                  <tr key={row.number} className="even:bg-muted/30">
+                    <th
+                      scope="row"
+                      className="sticky left-0 border-b bg-muted px-3 py-1.5 font-normal text-muted-foreground"
+                    >
+                      {row.number}
+                    </th>
+                    {row.cells.map((cell, index) => (
+                      <td
+                        key={index}
+                        className="max-w-80 border-b border-border/60 px-3 py-1.5 align-top whitespace-pre-wrap break-words tabular-nums"
+                      >
+                        {cell}
+                      </td>
+                    ))}
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        </>
+      )}
+    </div>
+  );
+}
diff --git a/apps/web/src/components/files/docxDocument.test.ts b/apps/web/src/components/files/docxDocument.test.ts
new file mode 100644
index 000000000000..6bd65eb08bfe
--- /dev/null
+++ b/apps/web/src/components/files/docxDocument.test.ts
@@ -0,0 +1,32 @@
+// @vitest-environment jsdom
+import JSZip from "jszip";
+import { describe, expect, it } from "vite-plus/test";
+import { renderDocxDocument } from "./docxDocument";
+
+describe("Word document rendering", () => {
+  it("renders actual OOXML text and tables with document styles in a standalone inert page", async () => {
+    const zip = new JSZip();
+    zip.file(
+      "[Content_Types].xml",
+      '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/></Types>',
+    );
+    zip.file(
+      "_rels/.rels",
+      '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>',
+    );
+    zip.file(
+      "word/document.xml",
+      '<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:body><w:p><w:r><w:rPr><w:b/></w:rPr><w:t>Łódź Word preview</w:t></w:r></w:p><w:tbl><w:tr><w:tc><w:p><w:r><w:t>Table cell</w:t></w:r></w:p></w:tc></w:tr></w:tbl><w:sectPr><w:pgSz w:w="11906" w:h="16838"/></w:sectPr></w:body></w:document>',
+    );
+    const html = await renderDocxDocument(await zip.generateAsync({ type: "uint8array" }));
+    const preview = new DOMParser().parseFromString(html, "text/html");
+    expect(preview.body.textContent).toContain("Łódź Word preview");
+    expect(preview.querySelector("td")?.textContent).toContain("Table cell");
+    expect(preview.querySelector("section.docx")).not.toBeNull();
+    expect(preview.head.querySelectorAll("style").length).toBeGreaterThan(1);
+    expect(
+      preview.querySelector('meta[http-equiv="Content-Security-Policy"]')?.getAttribute("content"),
+    ).toContain("default-src 'none'");
+    expect(preview.querySelector("script,iframe,object,embed")).toBeNull();
+  });
+});
diff --git a/apps/web/src/components/files/docxDocument.ts b/apps/web/src/components/files/docxDocument.ts
new file mode 100644
index 000000000000..c9f346a60388
--- /dev/null
+++ b/apps/web/src/components/files/docxDocument.ts
@@ -0,0 +1,24 @@
+import DOMPurify from "dompurify";
+import { renderAsync } from "docx-preview";
+
+/** Render outside the app DOM, then isolate document styles and content in an inert frame. */
+export async function renderDocxDocument(bytes: Uint8Array) {
+  const body = document.createElement("div");
+  const styles = document.createElement("div");
+  await renderAsync(bytes, body, styles, {
+    useBase64URL: true,
+    ignoreLastRenderedPageBreak: false,
+    renderAltChunks: false,
+    experimental: false,
+  });
+  const content = DOMPurify.sanitize(body.innerHTML, {
+    FORBID_TAGS: ["style", "iframe", "object", "embed", "form"],
+    FORBID_ATTR: ["srcset"],
+  });
+  const css = DOMPurify.sanitize(styles.innerHTML, {
+    FORCE_BODY: true,
+    ADD_TAGS: ["style"],
+    FORBID_TAGS: ["iframe", "object", "embed", "form"],
+  });
+  return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src data:; font-src data:; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'"><style>html,body{margin:0}body{background:#e5e7eb}.docx-wrapper{padding:16px!important;overflow:auto;align-items:flex-start!important}.docx-wrapper>section.docx{flex-shrink:0}</style>${css}</head><body>${content}</body></html>`;
+}
diff --git a/apps/web/src/components/files/officeArchive.test.ts b/apps/web/src/components/files/officeArchive.test.ts
new file mode 100644
index 000000000000..7b79a36c8152
--- /dev/null
+++ b/apps/web/src/components/files/officeArchive.test.ts
@@ -0,0 +1,41 @@
+import JSZip from "jszip";
+import { describe, expect, it } from "vite-plus/test";
+import { validateOfficeArchive } from "./officeArchive";
+
+const archive = async (part: string) => {
+  const zip = new JSZip();
+  zip.file("[Content_Types].xml", "<Types />");
+  zip.file(part, "<document />");
+  return zip.generateAsync({ type: "uint8array" });
+};
+
+describe("Office archive validation", () => {
+  it.each([
+    ["docx", "word/document.xml"],
+    ["xlsx", "xl/workbook.xml"],
+  ] as const)("accepts a complete %s package", async (kind, part) => {
+    const bytes = await archive(part);
+    expect(() => validateOfficeArchive(bytes, kind)).not.toThrow();
+  });
+  it("rejects non-Office archives, encrypted containers, and truncated ZIPs", async () => {
+    const bytes = await archive("word/document.xml");
+    expect(() => validateOfficeArchive(bytes, "xlsx")).toThrow("cannot be previewed");
+    expect(() => validateOfficeArchive(new Uint8Array([0xd0, 0xcf, 0x11, 0xe0]), "docx")).toThrow(
+      "cannot be previewed",
+    );
+    expect(() => validateOfficeArchive(bytes.subarray(0, bytes.length - 1), "docx")).toThrow(
+      "cannot be previewed",
+    );
+  });
+  it("rejects excessive declared expansion before decompressing content", async () => {
+    const bytes = await archive("word/document.xml");
+    const view = new DataView(bytes.buffer);
+    for (let index = 0; index < bytes.length - 46; index++) {
+      if (view.getUint32(index, true) === 0x02014b50) {
+        view.setUint32(index + 24, 65 * 1024 * 1024, true);
+        break;
+      }
+    }
+    expect(() => validateOfficeArchive(bytes, "docx")).toThrow("too large");
+  });
+});
diff --git a/apps/web/src/components/files/officeArchive.ts b/apps/web/src/components/files/officeArchive.ts
new file mode 100644
index 000000000000..fc8351c9bf68
--- /dev/null
+++ b/apps/web/src/components/files/officeArchive.ts
@@ -0,0 +1,58 @@
+import type { filePreviewKind } from "@t3tools/shared/filePreview";
+
+export type OfficePreviewKind = Extract<ReturnType<typeof filePreviewKind>, "docx" | "xlsx">;
+
+/** Check the ZIP directory before a renderer expands XML, images or shared strings. */
+export function validateOfficeArchive(bytes: Uint8Array, kind: OfficePreviewKind) {
+  const fail = () => {
+    throw new Error(
+      "This file cannot be previewed. It may be damaged, encrypted, or use an unsupported Office format. Save it to open it in another app.",
+    );
+  };
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let end = -1;
+  for (let offset = bytes.length - 22; offset >= Math.max(0, bytes.length - 65557); offset--) {
+    if (
+      view.getUint32(offset, true) === 0x06054b50 &&
+      offset + 22 + view.getUint16(offset + 20, true) === bytes.length
+    ) {
+      end = offset;
+      break;
+    }
+  }
+  if (end < 0) return fail();
+  const entries = view.getUint16(end + 10, true);
+  const size = view.getUint32(end + 12, true);
+  let offset = view.getUint32(end + 16, true);
+  if (
+    entries === 0 ||
+    entries > 10000 ||
+    offset + size > end ||
+    view.getUint32(end + 4, true) !== 0
+  )
+    return fail();
+  let expanded = 0;
+  let hasDocument = false;
+  let hasContentTypes = false;
+  const requiredPart = kind === "docx" ? "word/document.xml" : "xl/workbook.xml";
+  for (let index = 0; index < entries; index++) {
+    if (offset + 46 > end || view.getUint32(offset, true) !== 0x02014b50) return fail();
+    if ((view.getUint16(offset + 8, true) & 1) !== 0) return fail();
+    expanded += view.getUint32(offset + 24, true);
+    if (expanded > 64 * 1024 * 1024)
+      throw new Error("This document is too large to preview. Save it to open it in another app.");
+    const nameLength = view.getUint16(offset + 28, true);
+    const next =
+      offset +
+      46 +
+      nameLength +
+      view.getUint16(offset + 30, true) +
+      view.getUint16(offset + 32, true);
+    if (next > end) return fail();
+    const name = new TextDecoder().decode(bytes.subarray(offset + 46, offset + 46 + nameLength));
+    hasDocument ||= name === requiredPart;
+    hasContentTypes ||= name === "[Content_Types].xml";
+    offset = next;
+  }
+  if (!hasDocument || !hasContentTypes) return fail();
+}
diff --git a/apps/web/src/components/files/spreadsheetDocument.test.ts b/apps/web/src/components/files/spreadsheetDocument.test.ts
new file mode 100644
index 000000000000..acc2142cf9e0
--- /dev/null
+++ b/apps/web/src/components/files/spreadsheetDocument.test.ts
@@ -0,0 +1,107 @@
+import JSZip from "jszip";
+import { utils, write, type WorkBook } from "xlsx";
+import { describe, expect, it } from "vite-plus/test";
+import {
+  readSpreadsheetDocument,
+  spreadsheetTable,
+  visibleSpreadsheetSheets,
+} from "./spreadsheetDocument";
+import { SPREADSHEET_PREVIEW_ROWS, SPREADSHEET_PREVIEW_COLUMNS } from "./spreadsheetPreviewModel";
+
+function roundTrip(workbook: WorkBook) {
+  return readSpreadsheetDocument(
+    new Uint8Array(write(workbook, { type: "array", bookType: "xlsx" })),
+  );
+}
+
+describe("read-only Excel preview", () => {
+  it("shows formulas whose OOXML value element is empty rather than dropping the cell", async () => {
+    const workbook = utils.book_new();
+    utils.book_append_sheet(workbook, utils.aoa_to_sheet([[123]]), "Formula");
+    const zip = await JSZip.loadAsync(write(workbook, { type: "array", bookType: "xlsx" }));
+    const sheet = zip.file("xl/worksheets/sheet1.xml");
+    if (!sheet) throw new Error("Missing test worksheet");
+    zip.file(
+      "xl/worksheets/sheet1.xml",
+      (await sheet.async("string")).replace(
+        /<c\b[^>]*r="A1"[^>]*>.*?<\/c>/,
+        '<c r="A1"><f>SUM(1,2,3)</f><v></v></c>',
+      ),
+    );
+    const decoded = readSpreadsheetDocument(await zip.generateAsync({ type: "uint8array" }));
+    expect(spreadsheetTable(decoded, "Formula").rows[0]?.cells).toEqual(["=SUM(1,2,3)"]);
+  });
+  it("reads multiple sheets, saved formula results, number formats, Unicode and literal markup", () => {
+    const workbook = utils.book_new();
+    const sheet = utils.aoa_to_sheet([
+      ["Firm", "Revenue", "Total", "Missing result"],
+      ["Łódź <script>alert(1)</script>", 1234.5, 6, null],
+    ]);
+    sheet.B2!.z = '"£"#,##0.00';
+    sheet.C2!.f = "SUM(1,2,3)";
+    sheet.D2 = { t: "n", f: "SUM(1,2)" };
+    utils.book_append_sheet(workbook, sheet, "Prospects");
+    utils.book_append_sheet(workbook, utils.aoa_to_sheet([["Another sheet"]]), "Notes");
+    const decoded = roundTrip(workbook);
+    expect(visibleSpreadsheetSheets(decoded)).toEqual(["Prospects", "Notes"]);
+    const table = spreadsheetTable(decoded, "Prospects");
+    expect(table.columns).toEqual(["A", "B", "C", "D"]);
+    expect(table.rows[1]?.cells).toEqual([
+      "Łódź <script>alert(1)</script>",
+      "£1,234.50",
+      "6",
+      "=SUM(1,2)",
+    ]);
+    expect(spreadsheetTable(decoded, "Notes").rows[0]?.cells).toEqual(["Another sheet"]);
+  });
+  it("preserves sparse cell coordinates and empty worksheets", () => {
+    const workbook = utils.book_new();
+    utils.book_append_sheet(
+      workbook,
+      { C7: { t: "s", v: "Offset" }, E7: { t: "s", v: "Last" }, "!ref": "C7:E7" },
+      "Sparse",
+    );
+    utils.book_append_sheet(workbook, {}, "Empty");
+    const decoded = roundTrip(workbook);
+    expect(spreadsheetTable(decoded, "Sparse")).toMatchObject({
+      columns: ["C", "D", "E"],
+      rows: [{ number: 7, cells: ["Offset", "", "Last"] }],
+    });
+    expect(spreadsheetTable(decoded, "Empty").rows).toEqual([]);
+  });
+  it("finds content below row 500 and bounds oversized cell text", () => {
+    const workbook = utils.book_new();
+    utils.book_append_sheet(
+      workbook,
+      {
+        C9000: { t: "s", v: "Far row" },
+        D9000: { t: "s", v: "x".repeat(5000) },
+        "!ref": "C9000:D9000",
+      },
+      "Offset",
+    );
+    const table = spreadsheetTable(roundTrip(workbook), "Offset");
+    expect(table.rows[0]?.number).toBe(9000);
+    expect(table.rows[0]?.cells[0]).toBe("Far row");
+    expect(table.rows[0]?.cells[1]).toHaveLength(2000);
+    expect(table.truncated).toBe(true);
+  });
+  it("bounds large sheets and exposes only visible worksheets", () => {
+    const workbook = utils.book_new();
+    const sheet = utils.aoa_to_sheet([["Start"]]);
+    sheet["!ref"] = "A1:XFD1048576";
+    utils.book_append_sheet(workbook, sheet, "Large");
+    utils.book_append_sheet(workbook, {}, "Hidden");
+    workbook.Workbook = {
+      Sheets: [
+        { name: "Large", Hidden: 0 },
+        { name: "Hidden", Hidden: 1 },
+      ],
+    };
+    const table = spreadsheetTable(workbook, "Large");
+    expect(table.truncated).toBe(true);
+    expect(table.rows).toHaveLength(SPREADSHEET_PREVIEW_ROWS);
+    expect(table.columns).toHaveLength(SPREADSHEET_PREVIEW_COLUMNS);
+    expect(visibleSpreadsheetSheets(workbook)).toEqual(["Large"]);
+  });
+});
diff --git a/apps/web/src/components/files/spreadsheetDocument.ts b/apps/web/src/components/files/spreadsheetDocument.ts
new file mode 100644
index 000000000000..14656d6a2e98
--- /dev/null
+++ b/apps/web/src/components/files/spreadsheetDocument.ts
@@ -0,0 +1,54 @@
+import { read, utils, type WorkBook } from "xlsx";
+
+import {
+  SPREADSHEET_PREVIEW_ROWS,
+  SPREADSHEET_PREVIEW_COLUMNS,
+  SPREADSHEET_PREVIEW_CELL_CHARACTERS,
+  type SpreadsheetTable,
+} from "./spreadsheetPreviewModel";
+
+export function readSpreadsheetDocument(bytes: Uint8Array) {
+  return read(bytes, { type: "array", cellHTML: false, cellFormula: true, sheetStubs: true });
+}
+
+export function visibleSpreadsheetSheets(workbook: WorkBook) {
+  return workbook.SheetNames.filter((name, index) => !workbook.Workbook?.Sheets?.[index]?.Hidden);
+}
+
+/** Preserve cell coordinates and formatted values; formulas without a saved value show their expression. */
+export function spreadsheetTable(workbook: WorkBook, name: string): SpreadsheetTable {
+  const sheet = workbook.Sheets[name];
+  if (!sheet) throw new Error("This worksheet is unavailable.");
+  const ref = sheet["!ref"];
+  if (!ref) return { name, columns: [], rows: [], truncated: false };
+  const range = utils.decode_range(ref);
+  const fullRange = utils.decode_range(sheet["!fullref"] ?? ref);
+  let truncated = false;
+  const endRow = Math.min(range.e.r, range.s.r + SPREADSHEET_PREVIEW_ROWS - 1);
+  const endColumn = Math.min(range.e.c, range.s.c + SPREADSHEET_PREVIEW_COLUMNS - 1);
+  const columns = Array.from({ length: endColumn - range.s.c + 1 }, (_, index) =>
+    utils.encode_col(range.s.c + index),
+  );
+  const rows = Array.from({ length: endRow - range.s.r + 1 }, (_, index) => {
+    const row = range.s.r + index;
+    return {
+      number: row + 1,
+      cells: columns.map((_, column) => {
+        const cell = sheet[utils.encode_cell({ r: row, c: range.s.c + column })];
+        if (!cell) return "";
+        const text =
+          (cell.v === undefined || cell.t === "z") && cell.f
+            ? `=${cell.f}`
+            : utils.format_cell(cell);
+        if (text.length > SPREADSHEET_PREVIEW_CELL_CHARACTERS) truncated = true;
+        return text.slice(0, SPREADSHEET_PREVIEW_CELL_CHARACTERS);
+      }),
+    };
+  });
+  return {
+    name,
+    columns,
+    rows,
+    truncated: truncated || fullRange.e.r > endRow || fullRange.e.c > endColumn,
+  };
+}
diff --git a/apps/web/src/components/files/spreadsheetPreview.worker.ts b/apps/web/src/components/files/spreadsheetPreview.worker.ts
new file mode 100644
index 000000000000..9333a181bba7
--- /dev/null
+++ b/apps/web/src/components/files/spreadsheetPreview.worker.ts
@@ -0,0 +1,29 @@
+import type { WorkBook } from "xlsx";
+import {
+  readSpreadsheetDocument,
+  spreadsheetTable,
+  visibleSpreadsheetSheets,
+} from "./spreadsheetDocument";
+import { type SpreadsheetRequest, type SpreadsheetResponse } from "./spreadsheetPreviewModel";
+
+let workbook: WorkBook | undefined;
+let sheets: string[] = [];
+self.addEventListener("message", (event: MessageEvent<SpreadsheetRequest>) => {
+  let result: SpreadsheetResponse;
+  try {
+    if (event.data.type === "load") {
+      workbook = readSpreadsheetDocument(event.data.bytes);
+      sheets = visibleSpreadsheetSheets(workbook);
+    }
+    if (!workbook || sheets.length === 0)
+      throw new Error("This workbook has no visible worksheets.");
+    const name = event.data.type === "sheet" ? event.data.name : sheets[0];
+    if (name === undefined || !sheets.includes(name))
+      throw new Error("This worksheet is unavailable.");
+    result = { sheets, table: spreadsheetTable(workbook, name) };
+  } catch (cause) {
+    result = { error: cause instanceof Error ? cause.message : "Could not read this workbook." };
+  }
+  // oxlint-disable-next-line unicorn/require-post-message-target-origin -- A worker posts to its owner, with no Window target origin.
+  self.postMessage(result);
+});
diff --git a/apps/web/src/components/files/spreadsheetPreviewModel.ts b/apps/web/src/components/files/spreadsheetPreviewModel.ts
new file mode 100644
index 000000000000..8d53c3922237
--- /dev/null
+++ b/apps/web/src/components/files/spreadsheetPreviewModel.ts
@@ -0,0 +1,14 @@
+export const SPREADSHEET_PREVIEW_ROWS = 500;
+export const SPREADSHEET_PREVIEW_COLUMNS = 50;
+export const SPREADSHEET_PREVIEW_CELL_CHARACTERS = 2000;
+
+export type SpreadsheetTable = {
+  name: string;
+  columns: string[];
+  rows: { number: number; cells: string[] }[];
+  truncated: boolean;
+};
+export type SpreadsheetRequest =
+  | { type: "load"; bytes: Uint8Array }
+  | { type: "sheet"; name: string };
+export type SpreadsheetResponse = { sheets: string[]; table: SpreadsheetTable } | { error: string };
diff --git a/docs/user/composer.md b/docs/user/composer.md
index 831a8ac9792d..eabbfd79cd7b 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -305,6 +305,18 @@ Follow an agent's file link to read a report or other file outside the workspace
 These files open read-only. An HTML file outside the workspace cannot load scripts,
 styles, or images from neighboring files.
 
+## Word and Excel previews
+
+On web and desktop, select a `.docx` or `.xlsx` file in Files, a chat link, or an
+attachment to open a read-only preview. Word documents show pages, text, tables,
+and images; their layout may differ from Word. Excel workbooks show formatted
+cell values and let you select a worksheet. Charts and workbook styling are not
+shown. Formulas use their saved results, or show the expression when no saved
+result is available; the preview does not recalculate them.
+
+Office previews support files up to 10 MB. Large worksheets show a limited
+preview. Save the original file to inspect its full content in another app.
+
 ## HTML and PDF files in the file viewer
 
 On web and desktop, HTML and PDF files open as rendered pages. Switch an HTML
diff --git a/packages/client-runtime/src/filePreview.test.ts b/packages/client-runtime/src/filePreview.test.ts
index 5177e24b372c..f3aaf8712943 100644
--- a/packages/client-runtime/src/filePreview.test.ts
+++ b/packages/client-runtime/src/filePreview.test.ts
@@ -1,6 +1,46 @@
 import { describe, expect, it } from "vite-plus/test";
-import { FILE_TEXT_PREVIEW_MAX_BYTES } from "@t3tools/shared/filePreview";
-import { readFilePreviewResponse } from "./filePreview.ts";
+import {
+  FILE_TEXT_PREVIEW_MAX_BYTES,
+  FILE_OFFICE_PREVIEW_MAX_BYTES,
+} from "@t3tools/shared/filePreview";
+import { readFilePreviewResponse, readOfficePreviewResponse } from "./filePreview.ts";
+
+describe("Office binary downloads", () => {
+  it("preserves ZIP bytes instead of decoding binary data", async () => {
+    const bytes = new Uint8Array([0x50, 0x4b, 0, 255, 0, 1]);
+    expect(
+      await readOfficePreviewResponse(new Response(bytes), new AbortController().signal),
+    ).toEqual(bytes);
+  });
+  it("rejects oversized streams, cancels them, and never hands a partial archive to a renderer", async () => {
+    let cancelled = false;
+    const body = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        controller.enqueue(new Uint8Array(FILE_OFFICE_PREVIEW_MAX_BYTES));
+      },
+      cancel() {
+        cancelled = true;
+      },
+    });
+    await expect(
+      readOfficePreviewResponse(new Response(body), new AbortController().signal),
+    ).rejects.toThrow("10 MB");
+    expect(cancelled).toBe(true);
+  });
+  it("cancels a pending binary download when the preview closes", async () => {
+    const controller = new AbortController();
+    let cancelled = false;
+    const body = new ReadableStream<Uint8Array>({
+      cancel() {
+        cancelled = true;
+      },
+    });
+    const result = readOfficePreviewResponse(new Response(body), controller.signal);
+    controller.abort();
+    await expect(result).rejects.toThrow("cancelled");
+    expect(cancelled).toBe(true);
+  });
+});
 
 describe("readFilePreviewResponse", () => {
   it("cancels a pending read when its preview closes", async () => {
diff --git a/packages/client-runtime/src/filePreview.ts b/packages/client-runtime/src/filePreview.ts
index 433e253d185c..1ea2937aa022 100644
--- a/packages/client-runtime/src/filePreview.ts
+++ b/packages/client-runtime/src/filePreview.ts
@@ -1,9 +1,36 @@
-import { decodeFilePreviewText, FILE_TEXT_PREVIEW_MAX_BYTES } from "@t3tools/shared/filePreview";
+import {
+  decodeFilePreviewText,
+  FILE_TEXT_PREVIEW_MAX_BYTES,
+  FILE_OFFICE_PREVIEW_MAX_BYTES,
+} from "@t3tools/shared/filePreview";
 
 /** Consume only a bounded prefix, even when a host ignores the requested HTTP range. */
 export async function readFilePreviewResponse(
   response: Pick<Response, "ok" | "body">,
   signal: AbortSignal,
+) {
+  return decodeFilePreviewText(
+    await readPreviewBytes(response, signal, FILE_TEXT_PREVIEW_MAX_BYTES + 1),
+  );
+}
+
+/** Office archives need every byte; a truncated ZIP is not a usable preview. */
+export async function readOfficePreviewResponse(
+  response: Pick<Response, "ok" | "body">,
+  signal: AbortSignal,
+) {
+  const bytes = await readPreviewBytes(response, signal, FILE_OFFICE_PREVIEW_MAX_BYTES + 1);
+  if (bytes.length > FILE_OFFICE_PREVIEW_MAX_BYTES)
+    throw new Error(
+      "Office previews support files up to 10 MB. Save this file to open it in another app.",
+    );
+  return bytes;
+}
+
+async function readPreviewBytes(
+  response: Pick<Response, "ok" | "body">,
+  signal: AbortSignal,
+  limit: number,
 ) {
   if (!response.ok) {
     // A streamed error body holds the connection open until GC otherwise.
@@ -11,7 +38,6 @@ export async function readFilePreviewResponse(
     throw new Error("The file could not be loaded. Reconnect and try again.");
   }
   if (signal.aborted) throw new Error("Preview cancelled.");
-  const limit = FILE_TEXT_PREVIEW_MAX_BYTES + 1;
   const reader = response.body?.getReader();
   if (!reader) throw new Error("Streaming file previews are unavailable in this runtime.");
   const cancel = () => {
@@ -40,5 +66,5 @@ export async function readFilePreviewResponse(
     bytes.set(chunk, offset);
     offset += chunk.length;
   }
-  return decodeFilePreviewText(bytes);
+  return bytes;
 }
diff --git a/packages/shared/src/filePreview.test.ts b/packages/shared/src/filePreview.test.ts
index 602fb8299cdd..112a09c6424c 100644
--- a/packages/shared/src/filePreview.test.ts
+++ b/packages/shared/src/filePreview.test.ts
@@ -11,9 +11,27 @@ import {
   isWorkspacePreviewEntryPath,
   isWorkspaceVideoPreviewPath,
   mediaKindFromPath,
+  officeFilePreviewKind,
+  OFFICE_PREVIEW_MIME_TYPES,
 } from "./filePreview.ts";
 
 describe("workspace file previews", () => {
+  it.each(["docx", "xlsx"] as const)(
+    "recognizes %s without treating it as text or a browser document",
+    (kind) => {
+      const path = `outputs#draft/report?final.${kind.toUpperCase()}`;
+      expect(officeFilePreviewKind(path)).toBe(kind);
+      expect(isWorkspacePreviewEntryPath(path)).toBe(true);
+      expect(isWorkspaceBrowserPreviewPath(path)).toBe(false);
+      expect(hostPreviewMimeTypeFromExtension(`.${kind}`)).toBe(OFFICE_PREVIEW_MIME_TYPES[kind]);
+      expect(filePreviewKind({ name: path, mimeType: "application/octet-stream" })).toBe(kind);
+      expect(filePreviewKind({ name: "upload", mimeType: OFFICE_PREVIEW_MIME_TYPES[kind] })).toBe(
+        kind,
+      );
+      expect(filePreviewKind({ name: path, mimeType: "application/zip" })).toBe("unsupported");
+      expect(officeFilePreviewKind(`${path}.exe`)).toBeNull();
+    },
+  );
   it.each(["report.html", "report.HTM", "document#draft.pdf", "reports?old/document.pdf"])(
     "recognizes browser preview path %s",
     (path) => {
diff --git a/packages/shared/src/filePreview.ts b/packages/shared/src/filePreview.ts
index b35b8a7ecd59..c6848c2f7961 100644
--- a/packages/shared/src/filePreview.ts
+++ b/packages/shared/src/filePreview.ts
@@ -28,6 +28,8 @@ export type FilePreviewKind =
   | "pdf"
   | "html"
   | "markdown"
+  | "docx"
+  | "xlsx"
   | "text"
   | "unsupported";
 
@@ -43,10 +45,14 @@ export function filePreviewKind(file: {
   if (mime === "application/pdf") return "pdf";
   if (mime === "text/html") return "html";
   if (mime === "text/markdown" || mime === "text/x-markdown") return "markdown";
+  if (mime === OFFICE_PREVIEW_MIME_TYPES.docx) return "docx";
+  if (mime === OFFICE_PREVIEW_MIME_TYPES.xlsx) return "xlsx";
   if (mime.startsWith("image/")) return "image";
   if (mime.startsWith("video/")) return "video";
   if (mime.startsWith("audio/")) return "audio";
   if (generic) {
+    const officeKind = officeFilePreviewKind(name);
+    if (officeKind !== null) return officeKind;
     if (extension === ".pdf") return "pdf";
     if (/^\.html?$/.test(extension)) return "html";
     if (/^\.(md|markdown|mdown|mkd|mdx)$/.test(extension)) return "markdown";
@@ -75,6 +81,19 @@ export function filePreviewKind(file: {
 }
 
 export const FILE_TEXT_PREVIEW_MAX_BYTES = 1024 * 1024;
+export const FILE_OFFICE_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
+
+export const OFFICE_PREVIEW_MIME_TYPES = {
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+} as const;
+
+/** A literal filesystem path, including filenames containing # or ?. */
+export function officeFilePreviewKind(path: string): "docx" | "xlsx" | null {
+  if (/\.docx$/i.test(path)) return "docx";
+  if (/\.xlsx$/i.test(path)) return "xlsx";
+  return null;
+}
 
 /** Reject binary data rather than displaying replacement characters as a document. */
 export function decodeFilePreviewText(bytes: Uint8Array, truncated = false) {
@@ -152,10 +171,12 @@ export function mediaMimeTypeFromExtension(extension: string): string | null {
 /** Files the server serves in place from anywhere on its host: media, audio and browser documents. */
 export function hostPreviewMimeTypeFromExtension(extension: string): string | null {
   if (!/^\.[a-z0-9]+$/i.test(extension)) return null;
+  const officeKind = officeFilePreviewKind(extension);
   return (
     mediaMimeTypeFromExtension(extension) ??
     audioMimeTypeFromExtension(extension) ??
     BROWSER_MIME_TYPE_BY_EXTENSION.get(extension.toLowerCase()) ??
+    (officeKind === null ? null : OFFICE_PREVIEW_MIME_TYPES[officeKind]) ??
     null
   );
 }
@@ -215,5 +236,9 @@ export function isWorkspaceAudioPreviewPath(path: string): boolean {
 }
 
 export function isWorkspacePreviewEntryPath(path: string): boolean {
-  return isWorkspaceBrowserPreviewPath(path) || isWorkspaceImagePreviewPath(path);
+  return (
+    isWorkspaceBrowserPreviewPath(path) ||
+    isWorkspaceImagePreviewPath(path) ||
+    officeFilePreviewKind(path) !== null
+  );
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fdb699e66b36..dfa29877ec14 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -586,7 +586,7 @@ importers:
         version: 4.0.2(patch_hash=595b7d26fb635caba9c3d39fcb189bb78a000192f8d3b60ead7174b310d1ade9)(@types/node@24.12.4)(@vitest/ui@5.0.1)(bufferutil@4.1.0)(effect@4.0.2(patch_hash=ec61ee307eaec3e17f757e0e6a16296ea4b7a8c3188df0c6ec5e66301fd78688))(esbuild@0.28.2)(jiti@2.7.0)(jsdom@30.1.0(@noble/hashes@1.8.0))(msw@2.12.11(@types/node@24.12.4)(typescript@7.0.2))(terser@5.48.0)(typescript@7.0.2)(unrun@0.2.39)(utf-8-validate@6.0.6)(yaml@2.9.0)
       '@pierre/trees':
         specifier: 1.0.0-beta.6
-        version: 1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
+        version: 1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
       '@types/mdast':
         specifier: ^4.0.4
         version: 4.0.4
@@ -797,7 +797,7 @@ importers:
         version: 1.5.2(patch_hash=298e94372dbd51846a4e26ece2ecc3e22eb1f94b0450b1f1a9c6fec127809be7)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@pierre/trees':
         specifier: 1.0.0-beta.6
-        version: 1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
+        version: 1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
       '@t3tools/client-runtime':
         specifier: workspace:*
         version: link:../../packages/client-runtime
@@ -876,6 +876,9 @@ importers:
       culori:
         specifier: ^4.0.2
         version: 4.0.2
+      docx-preview:
+        specifier: 0.4.1
+        version: 0.4.1
       dompurify:
         specifier: ^3.4.16
         version: 3.4.16
@@ -930,6 +933,9 @@ importers:
       unbash:
         specifier: ^5.0.0
         version: 5.0.0
+      xlsx:
+        specifier: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
+        version: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
       zustand:
         specifier: ^5.0.11
         version: 5.0.14(@types/react@19.3.0)(react@19.2.6)(use-sync-external-store@1.6.0(react@19.2.6))
@@ -8139,6 +8145,9 @@ packages:
   dnssd-advertise@1.1.6:
     resolution: {integrity: sha512-Ndrrf6BMPalkQPd/zubL+4YghH2J9NspapQ09uDXwYbvOPkP0oaqf5CkcwJ0b50kS2O3ul6yVu+jz+RY62Cejg==}
 
+  docx-preview@0.4.1:
+    resolution: {integrity: sha512-Dv4g+LeE0swHpPvNC0lAT0YsR5Zq5pAxw7d3vHQ8EChBLgIrqqe9VPL5nVt2HBJap8bEZbXUI0TJob7kBeNU9w==}
+
   dom-accessibility-api@0.5.16:
     resolution: {integrity: sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==}
 
@@ -8155,6 +8164,9 @@ packages:
   dompurify@3.4.16:
     resolution: {integrity: sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==}
 
+  dompurify@3.4.17:
+    resolution: {integrity: sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==}
+
   domutils@3.2.2:
     resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
 
@@ -12267,6 +12279,12 @@ packages:
     resolution: {integrity: sha512-kCz5k7J7XbJtjABOvkc5lJmkiDh8VhjVCGNiqdKCscmVpdVUpEAyXv1xmCLkQJ5dsHqx3IPO4XW+NTDhU/fatA==}
     engines: {node: '>=10.0.0'}
 
+  xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz:
+    resolution: {integrity: sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==, tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz}
+    version: 0.20.3
+    engines: {node: '>=0.8'}
+    hasBin: true
+
   xml-name-validator@5.0.0:
     resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==}
     engines: {node: '>=18'}
@@ -15823,20 +15841,20 @@ snapshots:
 
   '@pierre/theme@2.0.0': {}
 
-  '@pierre/theming@1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
+  '@pierre/theming@1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
     optionalDependencies:
       '@pierre/theme': 1.1.0
-      '@shikijs/themes': 4.3.0
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@shikijs/themes': 4.2.0
+      react: 19.3.0
+      react-dom: 19.3.0(react@19.3.0)
       shiki: 4.2.0
 
-  '@pierre/theming@1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
+  '@pierre/theming@1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
     optionalDependencies:
       '@pierre/theme': 2.0.0
-      '@shikijs/themes': 4.2.0
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@shikijs/themes': 4.3.0
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
       shiki: 4.2.0
 
   '@pierre/theming@1.0.1(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
@@ -15863,25 +15881,25 @@ snapshots:
       react-dom: 19.3.0(react@19.3.0)
       shiki: 4.2.0
 
-  '@pierre/trees@1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
+  '@pierre/trees@1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
     dependencies:
-      '@pierre/theming': 1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
+      '@pierre/theming': 1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
       preact: 11.0.0-beta.0
       preact-render-to-string: 6.6.5(preact@11.0.0-beta.0)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.3.0
+      react-dom: 19.3.0(react@19.3.0)
     transitivePeerDependencies:
       - '@pierre/theme'
       - '@shikijs/themes'
       - shiki
 
-  '@pierre/trees@1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
+  '@pierre/trees@1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
     dependencies:
-      '@pierre/theming': 1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
+      '@pierre/theming': 1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
       preact: 11.0.0-beta.0
       preact-render-to-string: 6.6.5(preact@11.0.0-beta.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
     transitivePeerDependencies:
       - '@pierre/theme'
       - '@shikijs/themes'
@@ -16307,7 +16325,7 @@ snapshots:
   '@shikijs/types@4.2.0':
     dependencies:
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
 
   '@shikijs/types@4.3.0':
     dependencies:
@@ -18767,6 +18785,10 @@ snapshots:
 
   dnssd-advertise@1.1.6: {}
 
+  docx-preview@0.4.1:
+    dependencies:
+      jszip: 3.10.1
+
   dom-accessibility-api@0.5.16: {}
 
   dom-serializer@2.0.0:
@@ -18785,6 +18807,10 @@ snapshots:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
+  dompurify@3.4.17:
+    optionalDependencies:
+      '@types/trusted-types': 2.0.7
+
   domutils@3.2.2:
     dependencies:
       dom-serializer: 2.0.0
@@ -19589,10 +19615,6 @@ snapshots:
     dependencies:
       walk-up-path: 4.0.0
 
-  fdir@6.5.0(picomatch@4.0.4):
-    optionalDependencies:
-      picomatch: 4.0.4
-
   fdir@6.5.0(picomatch@4.0.7):
     optionalDependencies:
       picomatch: 4.0.7
@@ -20686,7 +20708,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.23
-      dompurify: 3.4.16
+      dompurify: 3.4.17
       es-toolkit: 1.52.0
       fastdom: 1.0.12
       katex: 0.16.47
@@ -22696,7 +22718,7 @@ snapshots:
       '@shikijs/themes': 4.2.0
       '@shikijs/types': 4.2.0
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.4
+      '@types/hast': 3.0.5
 
   should-equal@2.0.0:
     dependencies:
@@ -23044,8 +23066,8 @@ snapshots:
 
   tinyglobby@0.2.17:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.4)
-      picomatch: 4.0.4
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
 
   tinypool@2.1.2: {}
 
@@ -23730,6 +23752,8 @@ snapshots:
       simple-plist: 1.3.1
       uuid: 7.0.3
 
+  xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz: {}
+
   xml-name-validator@5.0.0: {}
 
   xml-naming@0.1.0:

From 5f3f1f410cd4c29c273aa3d1d39ea80d8c1d9d79 Mon Sep 17 00:00:00 2001
From: piotrnowakowski <61783713+piotrnowakowski@users.noreply.github.com>
Date: Tue, 13 Oct 2026 23:40:33 +0200
Subject: [PATCH 2/4] fix(files): bound Office previews and preserve refreshed
 documents

Office preview validation trusted ZIP metadata, repeated workspace updates reparsed unchanged files, and closing Word previews left queued rendering work. Validate actual archive expansion in a cancellable worker, bound and cancel Word phases, refresh by file identity, stream remote saves, and route mobile workspace Office files to the native viewer fallback.

Keep spreadsheet payload and full-workbook parsing changes deferred for separate approval. Focused validation passed 167 tests across 12 files, scoped checks, and a production web build; browser fixtures and resource measurements are recorded in the PR evidence.

Model: GPT-6.1-Sol. Harness: Codex desktop.
---
 apps/mobile/package.json                      |   2 +
 .../features/files/ThreadFilesRouteScreen.tsx |  51 +++++-
 .../files/WorkspaceOfficeDocument.test.tsx    |  55 ++++++
 .../files/WorkspaceOfficeDocument.tsx         |  39 ++++
 .../features/files/preload-workspace-file.ts  |   2 +
 apps/server/src/assets/AssetAccess.test.ts    |  40 +++++
 apps/server/src/assets/AssetAccess.ts         |  53 +++++-
 apps/web/package.json                         |   1 +
 apps/web/src/assets/assetUrls.ts              |  12 +-
 .../files/AttachmentFilePreview.tsx           |   6 +-
 apps/web/src/components/files/DocxPreview.tsx |  10 +-
 .../src/components/files/FilePreviewPanel.tsx | 114 +++---------
 .../components/files/OfficeFilePreview.tsx    |   7 +-
 .../files/WorkspaceOfficePreview.test.tsx     |  92 ++++++++++
 .../files/WorkspaceOfficePreview.tsx          | 100 +++++++++++
 .../files/checkOfficeArchive.test.ts          |  50 ++++++
 .../components/files/checkOfficeArchive.ts    |  49 +++++
 .../src/components/files/docxDocument.test.ts |  19 +-
 apps/web/src/components/files/docxDocument.ts |  54 +++++-
 apps/web/src/components/files/downloadFile.ts |  14 ++
 .../components/files/officeArchive.test.ts    | 112 +++++++++++-
 .../web/src/components/files/officeArchive.ts | 169 +++++++++++++-----
 .../components/files/officeArchive.worker.ts  |  18 ++
 .../components/files/officeArchiveContents.ts |  76 ++++++++
 docs/user/composer.md                         |   3 +
 packages/contracts/src/assets.ts              |   6 +
 pnpm-lock.yaml                                | 118 +++++++-----
 27 files changed, 1062 insertions(+), 210 deletions(-)
 create mode 100644 apps/mobile/src/features/files/WorkspaceOfficeDocument.test.tsx
 create mode 100644 apps/mobile/src/features/files/WorkspaceOfficeDocument.tsx
 create mode 100644 apps/web/src/components/files/WorkspaceOfficePreview.test.tsx
 create mode 100644 apps/web/src/components/files/WorkspaceOfficePreview.tsx
 create mode 100644 apps/web/src/components/files/checkOfficeArchive.test.ts
 create mode 100644 apps/web/src/components/files/checkOfficeArchive.ts
 create mode 100644 apps/web/src/components/files/downloadFile.ts
 create mode 100644 apps/web/src/components/files/officeArchive.worker.ts
 create mode 100644 apps/web/src/components/files/officeArchiveContents.ts

diff --git a/apps/mobile/package.json b/apps/mobile/package.json
index 16eccc711442..b367c713433f 100644
--- a/apps/mobile/package.json
+++ b/apps/mobile/package.json
@@ -144,8 +144,10 @@
     "@types/mdast": "^4.0.4",
     "@types/react": "~19.3.0",
     "@types/react-dom": "~19.2.3",
+    "@types/react-test-renderer": "19.1.0",
     "babel-preset-expo": "~58.0.8",
     "jsdom": "^30.0.1",
+    "react-test-renderer": "19.3.0",
     "tailwindcss": "^4.0.0",
     "typescript": "catalog:"
   },
diff --git a/apps/mobile/src/features/files/ThreadFilesRouteScreen.tsx b/apps/mobile/src/features/files/ThreadFilesRouteScreen.tsx
index ca9adeaea165..16d3a48c0f49 100644
--- a/apps/mobile/src/features/files/ThreadFilesRouteScreen.tsx
+++ b/apps/mobile/src/features/files/ThreadFilesRouteScreen.tsx
@@ -12,6 +12,8 @@ import {
   isWorkspaceBrowserPreviewPath,
   isWorkspaceImagePreviewPath,
   mediaMimeTypeFromExtension,
+  officeFilePreviewKind,
+  OFFICE_PREVIEW_MIME_TYPES,
 } from "@t3tools/shared/filePreview";
 import { mediaFileReference } from "@t3tools/client-runtime/media-reference";
 
@@ -55,6 +57,7 @@ import { WorkspaceFileImagePreview } from "./WorkspaceFileImagePreview";
 import { WorkspaceFilePreviewError } from "./WorkspaceFilePreviewError";
 import { WorkspaceFileVideoPreview } from "./WorkspaceFileVideoPreview";
 import { WorkspaceFileWebPreview } from "./WorkspaceFileWebPreview";
+import { WorkspaceOfficeDocument } from "./WorkspaceOfficeDocument";
 import {
   basename,
   fileHeaderSubtitle,
@@ -227,6 +230,7 @@ function FileContent(props: {
   readonly initialLine: number | null;
   readonly truncated: boolean;
   readonly onRefresh?: () => Promise<void> | void;
+  readonly onDocumentClose: () => void;
 }) {
   // Reopening a mutable host file must not reuse a poster from an earlier visit.
   const thumbnailInstanceId = useId();
@@ -239,8 +243,10 @@ function FileContent(props: {
   const isImageFile = isWorkspaceImagePreviewPath(props.relativePath);
   const isVideoFile = isVideoPreviewFile(props.relativePath);
   const isAudioFile = isAudioPreviewFile(props.relativePath);
+  const officeKind = officeFilePreviewKind(props.relativePath);
   // Only the surfaces that wait on a signed asset URL can be blocked by one.
   const needsAssetUrl =
+    officeKind !== null ||
     isVideoFile ||
     isAudioFile ||
     (props.activeMode === "preview" && (isImageFile || isBrowserFile));
@@ -267,6 +273,14 @@ function FileContent(props: {
     );
   }
 
+  if (officeKind !== null) {
+    return props.previewUri === null || props.mediaSource === undefined ? (
+      <FilePreviewLoading message="Loading document..." />
+    ) : (
+      <WorkspaceOfficeDocument source={props.mediaSource} onClose={props.onDocumentClose} />
+    );
+  }
+
   if (isAudioFile) {
     return props.previewUri === null ? (
       <FilePreviewLoading message="Loading file..." />
@@ -608,6 +622,7 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
   const [fullScreenPreview, setFullScreenPreview] = useState<FilePreviewSource | null>(null);
   const isVideoFile = relativePath !== null && isVideoPreviewFile(relativePath);
   const isAudioFile = relativePath !== null && !isVideoFile && isAudioPreviewFile(relativePath);
+  const officeKind = relativePath === null ? null : officeFilePreviewKind(relativePath);
   const isBrowserFile =
     relativePath !== null && !isVideoFile && isWorkspaceBrowserPreviewPath(relativePath);
   const isImageFile =
@@ -626,7 +641,9 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
   const resolvedActiveMode =
     isVideoFile || isAudioFile ? "preview" : canPreview ? activeMode : "source";
   const assetPreviewPath =
-    isBrowserFile || isImageFile || isVideoFile || isAudioFile ? relativePath : null;
+    isBrowserFile || isImageFile || isVideoFile || isAudioFile || officeKind !== null
+      ? relativePath
+      : null;
   const assetPreview = useWorkspaceFileAssetUrlState({
     cwd,
     environmentId,
@@ -643,19 +660,29 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
       assetPreview.resource !== null &&
       "path" in assetPreview.resource &&
       typeof assetPreview.resource.path === "string" &&
-      (isImageFile || isVideoFile)
+      (isImageFile || isVideoFile || officeKind !== null)
         ? {
             reference: mediaFileReference(assetPreview.resource.path, cwd),
             name: basename(relativePath),
             mimeType:
-              mediaMimeTypeFromExtension(relativePath.slice(relativePath.lastIndexOf("."))) ??
-              "application/octet-stream",
+              (officeKind === null
+                ? mediaMimeTypeFromExtension(relativePath.slice(relativePath.lastIndexOf(".")))
+                : OFFICE_PREVIEW_MIME_TYPES[officeKind]) ?? "application/octet-stream",
             environmentId,
             ...(threadId === null ? {} : { threadId }),
             resource: assetPreview.resource,
           }
         : undefined,
-    [assetPreview.resource, cwd, environmentId, isImageFile, isVideoFile, relativePath, threadId],
+    [
+      assetPreview.resource,
+      cwd,
+      environmentId,
+      isImageFile,
+      isVideoFile,
+      officeKind,
+      relativePath,
+      threadId,
+    ],
   );
   const mediaActions = useMediaActions(mediaSource);
   const videoSource = useMemo<MediaVideoPreviewSource | null>(
@@ -685,6 +712,7 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
   };
   const needsFileContents =
     relativePath !== null &&
+    officeKind === null &&
     !isVideoFile &&
     !isAudioFile &&
     (resolvedActiveMode === "source" || isMarkdownPreviewFile(relativePath));
@@ -793,7 +821,7 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
           } as const)
         : null,
       // Only the source body wraps; a rendered preview lays itself out.
-      resolvedActiveMode === "source"
+      resolvedActiveMode === "source" && officeKind === null
         ? ({
             id: "word-wrap",
             title: appearance.codeWordBreak ? "Disable word wrap" : "Enable word wrap",
@@ -847,6 +875,15 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
               }),
           } as const)
         : null,
+      officeKind !== null && mediaSource !== undefined
+        ? ({
+            id: "open-document",
+            title: "Open in file viewer",
+            icon: "arrow.up.left.and.arrow.down.right",
+            inline: false,
+            onPress: () => setFullScreenPreview({ ...mediaSource, kind: "document" }),
+          } as const)
+        : null,
       isBrowserFile && typeof assetPreviewUri === "string"
         ? ({
             id: "open-browser",
@@ -885,6 +922,7 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
     resolvedActiveMode,
     mediaSource,
     mediaActions.actions,
+    officeKind,
     fileData?.contents,
     fileData?.truncated,
   ]);
@@ -968,6 +1006,7 @@ export function ThreadFileScreen(props: ThreadFileRouteScreenProps) {
           threadId={threadId}
           truncated={fileData?.truncated ?? false}
           onRefresh={() => fileQuery.refresh()}
+          onDocumentClose={handleBack}
         />
       </MaterialScreenContent>
       <FilePreviewModal
diff --git a/apps/mobile/src/features/files/WorkspaceOfficeDocument.test.tsx b/apps/mobile/src/features/files/WorkspaceOfficeDocument.test.tsx
new file mode 100644
index 000000000000..ebae1b491a9c
--- /dev/null
+++ b/apps/mobile/src/features/files/WorkspaceOfficeDocument.test.tsx
@@ -0,0 +1,55 @@
+import { EnvironmentId, ThreadId } from "@t3tools/contracts";
+import { act } from "react";
+import { create, type ReactTestRenderer } from "react-test-renderer";
+import { afterEach, beforeEach, expect, it, vi } from "vite-plus/test";
+import { WorkspaceOfficeDocument } from "./WorkspaceOfficeDocument";
+import { FilePreviewModal } from "../../components/FilePreviewModal";
+
+vi.mock("react-native", () => ({ View: ({ children }: { children: unknown }) => children }));
+vi.mock("../../components/EmptyState", () => ({
+  EmptyState: ({ title, detail }: { title: string; detail: string }) => (
+    <div>
+      {title}: {detail}
+    </div>
+  ),
+}));
+vi.mock("../../components/FilePreviewModal", () => ({ FilePreviewModal: () => null }));
+let renderer: ReactTestRenderer | undefined;
+beforeEach(() => vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true));
+afterEach(async () => {
+  if (renderer) await act(() => renderer!.unmount());
+  renderer = undefined;
+  vi.unstubAllGlobals();
+});
+const source = {
+  name: "report.xlsx",
+  mimeType: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  environmentId: EnvironmentId.make("test"),
+  resource: {
+    _tag: "workspace-file" as const,
+    threadId: ThreadId.make("thread"),
+    path: "/workspace/report.xlsx",
+  },
+};
+it("keeps a useful save/share fallback when the device cannot open Office files", async () => {
+  const onClose = vi.fn();
+  await act(() => {
+    renderer = create(<WorkspaceOfficeDocument source={source} onClose={onClose} />);
+  });
+  await act(() => {
+    const modal = renderer!.root.findByType(FilePreviewModal);
+    modal.props.onOpenError(new Error("Install a compatible viewer or use Save or share."));
+    modal.props.onRequestClose();
+  });
+  expect(onClose).not.toHaveBeenCalled();
+  expect(JSON.stringify(renderer!.toJSON())).toContain("No compatible document viewer");
+  expect(JSON.stringify(renderer!.toJSON())).toContain("Save or share");
+});
+it("returns from the file screen after a successful native visit", async () => {
+  const onClose = vi.fn();
+  await act(() => {
+    renderer = create(<WorkspaceOfficeDocument source={source} onClose={onClose} />);
+  });
+  await act(() => renderer!.root.findByType(FilePreviewModal).props.onRequestClose());
+  expect(onClose).toHaveBeenCalledOnce();
+});
diff --git a/apps/mobile/src/features/files/WorkspaceOfficeDocument.tsx b/apps/mobile/src/features/files/WorkspaceOfficeDocument.tsx
new file mode 100644
index 000000000000..7a9e8338d254
--- /dev/null
+++ b/apps/mobile/src/features/files/WorkspaceOfficeDocument.tsx
@@ -0,0 +1,39 @@
+import { useRef, useState } from "react";
+import { View } from "react-native";
+import { FilePreviewModal } from "../../components/FilePreviewModal";
+import { EmptyState } from "../../components/EmptyState";
+import type { MediaActionsSource } from "../../lib/mediaActionsSource";
+
+/** Workspace Office files share the same native viewer and save/share fallback as attachments. */
+export function WorkspaceOfficeDocument(props: {
+  readonly source: MediaActionsSource;
+  readonly onClose: () => void;
+}) {
+  const [open, setOpen] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const pendingError = useRef<string | null>(null);
+  return (
+    <View className="flex-1 items-center justify-center px-6">
+      <EmptyState
+        title={error ? "No compatible document viewer" : "Opening document"}
+        detail={error ?? "Use Save or share in File actions to open the original in another app."}
+      />
+      <FilePreviewModal
+        source={open ? { ...props.source, kind: "document" } : null}
+        onOpenError={(cause: unknown) => {
+          pendingError.current =
+            cause instanceof Error
+              ? cause.message
+              : "This device could not open the document. Use Save or share in File actions.";
+        }}
+        onRequestClose={() => {
+          setOpen(false);
+          if (pendingError.current) {
+            setError(pendingError.current);
+            pendingError.current = null;
+          } else props.onClose();
+        }}
+      />
+    </View>
+  );
+}
diff --git a/apps/mobile/src/features/files/preload-workspace-file.ts b/apps/mobile/src/features/files/preload-workspace-file.ts
index 4ae4f507caa0..5442d6d84296 100644
--- a/apps/mobile/src/features/files/preload-workspace-file.ts
+++ b/apps/mobile/src/features/files/preload-workspace-file.ts
@@ -5,6 +5,7 @@ import type { EnvironmentId } from "@t3tools/contracts";
 import {
   isWorkspaceBrowserPreviewPath,
   isWorkspaceImagePreviewPath,
+  officeFilePreviewKind,
 } from "@t3tools/shared/filePreview";
 
 import { appAtomRegistry } from "../../state/atom-registry";
@@ -35,6 +36,7 @@ export function preloadWorkspaceFileContents(input: {
     !readEnvironmentScope(input.environmentId, AuthFilesystemReadScope) ||
     isWorkspaceBrowserPreviewPath(input.relativePath) ||
     isWorkspaceImagePreviewPath(input.relativePath) ||
+    officeFilePreviewKind(input.relativePath) !== null ||
     isVideoPreviewFile(input.relativePath)
   ) {
     return;
diff --git a/apps/server/src/assets/AssetAccess.test.ts b/apps/server/src/assets/AssetAccess.test.ts
index 150f0ac8c74d..eca709506444 100644
--- a/apps/server/src/assets/AssetAccess.test.ts
+++ b/apps/server/src/assets/AssetAccess.test.ts
@@ -293,6 +293,46 @@ describe("AssetAccess", () => {
     }).pipe(Effect.provide(layerTest)),
   );
 
+  it.effect("versions Office files without reading contents and streams exact-file downloads", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-office-version-" });
+      const filePath = path.join(root, "report.xlsx");
+      yield* fs.writeFileString(filePath, "first");
+      const resource = {
+        _tag: "workspace-file" as const,
+        threadId: ThreadId.make("thread-1"),
+        path: filePath,
+      };
+      const first = yield* issueAssetUrl({ resource, workspaceRoot: root });
+      const unchanged = yield* issueAssetUrl({ resource, workspaceRoot: root });
+      expect(first.byteLength).toBe(5);
+      expect(first.fileVersion).toBeDefined();
+      expect(unchanged.fileVersion).toBe(first.fileVersion);
+      yield* fs.writeFileString(filePath, "other");
+      const changed = yield* issueAssetUrl({ resource, workspaceRoot: root });
+      expect(changed.byteLength).toBe(5);
+      expect(changed.fileVersion).not.toBe(first.fileVersion);
+      const download = yield* issueAssetUrl({
+        resource: { ...resource, disposition: "attachment" },
+        workspaceRoot: root,
+      });
+      const suffix = download.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length);
+      const separator = suffix.indexOf("/");
+      expect(
+        yield* resolveAsset(suffix.slice(0, separator), suffix.slice(separator + 1)),
+      ).toMatchObject({ download: true, fileName: "report.xlsx" });
+      expect(yield* resolveAsset(suffix.slice(0, separator), "sibling.xlsx")).toBeNull();
+      const outside = yield* issueAssetUrl({
+        resource: { ...resource, _tag: "media-file" },
+        workspaceRoot: root,
+      });
+      expect(outside.fileVersion).toBe(changed.fileVersion);
+      expect(outside.byteLength).toBe(5);
+    }).pipe(Effect.provide(layerTest)),
+  );
+
   it.effect("reports pixel dimensions from an image header and nothing for other files", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/assets/AssetAccess.ts b/apps/server/src/assets/AssetAccess.ts
index 39631b736a13..1e51a55923f1 100644
--- a/apps/server/src/assets/AssetAccess.ts
+++ b/apps/server/src/assets/AssetAccess.ts
@@ -109,6 +109,7 @@ const AssetClaimsSchema = Schema.Union([
   Schema.Struct({
     version: Schema.Literal(1),
     kind: Schema.Literal("workspace-file-exact"),
+    download: Schema.optionalKey(Schema.Boolean),
     workspaceRoot: Schema.String,
     relativePath: Schema.String,
     expiresAt: Schema.Number,
@@ -116,6 +117,7 @@ const AssetClaimsSchema = Schema.Union([
   Schema.Struct({
     version: Schema.Literal(1),
     kind: Schema.Literal("media-file-exact"),
+    download: Schema.optionalKey(Schema.Boolean),
     filePath: Schema.String,
     device: Schema.String,
     inode: Schema.String,
@@ -365,6 +367,17 @@ const readImageDimensionsFromHeader = (filePath: string) =>
     Effect.orElseSucceed((): ImageDimensions | null => null),
   );
 
+const officeFileMetadata = (file: OpenMediaFile) => ({
+  fileVersion: [
+    file.info.dev,
+    file.info.ino,
+    file.info.size,
+    file.info.mtimeNs,
+    file.info.ctimeNs,
+  ].join(":"),
+  byteLength: Number(file.info.size),
+});
+
 const finalizeAbsoluteMediaFileAsset = Effect.fn("AssetAccess.finalizeAbsoluteMediaFileAsset")(
   function* (input: {
     readonly requestedPath: string;
@@ -395,6 +408,8 @@ const finalizeAbsoluteMediaFileAsset = Effect.fn("AssetAccess.finalizeAbsoluteMe
               (dimensions) => ({
                 identity: { device: file.info.dev.toString(), inode: file.info.ino.toString() },
                 dimensions,
+                fileMetadata:
+                  officeFilePreviewKind(canonicalFile) === null ? null : officeFileMetadata(file),
               }),
             ),
       ),
@@ -416,6 +431,7 @@ const finalizeAbsoluteMediaFileAsset = Effect.fn("AssetAccess.finalizeAbsoluteMe
       },
       fileName: path.basename(canonicalFile),
       imageDimensions: opened.dimensions,
+      fileMetadata: opened.fileMetadata,
     };
   },
 );
@@ -480,10 +496,22 @@ const finalizeWorkspaceFileAsset = Effect.fn("AssetAccess.finalizeWorkspaceFileA
     )
       ? yield* readImageDimensionsFromHeader(canonicalFile)
       : null;
+    const fileMetadata =
+      officeFilePreviewKind(resolved.relativePath) === null
+        ? null
+        : yield* openMediaFile(canonicalFile).pipe(
+            Effect.map((file) => (file === null ? null : officeFileMetadata(file))),
+            Effect.scoped,
+            Effect.mapError(
+              (cause) =>
+                new AssetWorkspaceAssetInspectionError({ resource: input.resource, cause }),
+            ),
+          );
     return {
       claims:
         isWorkspaceImagePreviewPath(resolved.relativePath) ||
-        officeFilePreviewKind(resolved.relativePath) !== null
+        officeFilePreviewKind(resolved.relativePath) !== null ||
+        ("disposition" in input.resource && input.resource.disposition === "attachment")
           ? {
               version: 1 as const,
               kind: "workspace-file-exact" as const,
@@ -500,6 +528,7 @@ const finalizeWorkspaceFileAsset = Effect.fn("AssetAccess.finalizeWorkspaceFileA
             },
       fileName: path.basename(resolved.relativePath),
       imageDimensions,
+      fileMetadata,
     };
   },
 );
@@ -519,6 +548,7 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
   let fileName: string;
   let sourcePath: string | undefined;
   let imageDimensions: ImageDimensions | null = null;
+  let fileMetadata: ReturnType<typeof officeFileMetadata> | null = null;
 
   switch (input.resource._tag) {
     case "media-file": {
@@ -545,6 +575,7 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
       claims = finalized.claims;
       fileName = finalized.fileName;
       imageDimensions = finalized.imageDimensions;
+      fileMetadata = finalized.fileMetadata;
       break;
     }
     case "workspace-file": {
@@ -571,6 +602,7 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
       claims = finalized.claims;
       fileName = finalized.fileName;
       imageDimensions = finalized.imageDimensions;
+      fileMetadata = finalized.fileMetadata;
       break;
     }
     case "draft-workspace-file": {
@@ -607,6 +639,7 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
       claims = finalized.claims;
       fileName = finalized.fileName;
       imageDimensions = finalized.imageDimensions;
+      fileMetadata = finalized.fileMetadata;
       break;
     }
     case "attachment": {
@@ -829,6 +862,12 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
       PROJECT_FAVICON_TOKEN_BUCKET_MS;
     claims = { ...claims, expiresAt };
   }
+  if (
+    (claims.kind === "workspace-file-exact" || claims.kind === "media-file-exact") &&
+    "disposition" in input.resource &&
+    input.resource.disposition === "attachment"
+  )
+    claims = { ...claims, download: true };
   const encodedPayload = base64UrlEncode(encodeAssetClaims(claims));
   const token = `${encodedPayload}.${signPayload(encodedPayload, signingSecret)}`;
   return {
@@ -836,6 +875,7 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
     expiresAt,
     ...(sourcePath !== undefined ? { sourcePath } : {}),
     ...(imageDimensions !== null ? { imageDimensions } : {}),
+    ...fileMetadata,
   };
 });
 
@@ -962,7 +1002,13 @@ export const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (
       Effect.orElseSucceed(() => null),
     );
     return file
-      ? ({ kind: "file", path: canonicalFile, mimeType, file } satisfies ResolvedAsset)
+      ? ({
+          kind: "file",
+          path: canonicalFile,
+          mimeType,
+          file,
+          ...(claims.download ? { download: true, fileName: path.basename(claims.filePath) } : {}),
+        } satisfies ResolvedAsset)
       : null;
   }
   if (claims.kind === "workspace-file-exact") {
@@ -977,6 +1023,9 @@ export const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (
       ? ({
           kind: "file",
           path: exactWorkspaceFile,
+          ...(claims.download
+            ? { download: true, fileName: path.basename(claims.relativePath) }
+            : {}),
           ...(officeKind === null ? {} : { mimeType: OFFICE_PREVIEW_MIME_TYPES[officeKind] }),
         } satisfies ResolvedAsset)
       : null;
diff --git a/apps/web/package.json b/apps/web/package.json
index de06177fdd9e..23c264680c9e 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -55,6 +55,7 @@
     "docx-preview": "0.4.1",
     "dompurify": "^3.4.16",
     "effect": "catalog:",
+    "fflate": "0.8.3",
     "hast-util-to-html": "^9.0.5",
     "hast-util-to-jsx-runtime": "^2.3.6",
     "heic-to": "^1.5.2",
diff --git a/apps/web/src/assets/assetUrls.ts b/apps/web/src/assets/assetUrls.ts
index e401135d21d5..967edf0b1a9a 100644
--- a/apps/web/src/assets/assetUrls.ts
+++ b/apps/web/src/assets/assetUrls.ts
@@ -44,6 +44,15 @@ export function useAssetUrlRefresh(
   environmentId: EnvironmentId | null,
   resource: AssetResource | null,
 ): () => Promise<string | null> {
+  const refreshAsset = useAssetRefresh(environmentId, resource);
+  return useCallback(async () => (await refreshAsset())?.url ?? null, [refreshAsset]);
+}
+
+/** Reauthorization returns metadata too, without downloading the mutable file. */
+export function useAssetRefresh(
+  environmentId: EnvironmentId | null,
+  resource: AssetResource | null,
+) {
   const connection = usePreparedConnection(environmentId);
   const httpBaseUrl = connection._tag === "Some" ? connection.value.httpBaseUrl : null;
   const refresh = useAtomQueryRunner(assetEnvironment.createUrl, {
@@ -54,7 +63,8 @@ export function useAssetUrlRefresh(
     if (environmentId === null || resource === null || httpBaseUrl === null) return null;
     const result = await refresh({ environmentId, input: { resource } });
     if (result._tag === "Failure") throw squashAtomCommandFailure(result);
-    return resolveAssetUrl(httpBaseUrl, result.value.relativeUrl);
+    const url = resolveAssetUrl(httpBaseUrl, result.value.relativeUrl);
+    return url === null ? null : { ...result.value, url };
   }, [environmentId, resource, refresh, httpBaseUrl]);
 }
 
diff --git a/apps/web/src/components/files/AttachmentFilePreview.tsx b/apps/web/src/components/files/AttachmentFilePreview.tsx
index fcb9ce155799..be894ea517d3 100644
--- a/apps/web/src/components/files/AttachmentFilePreview.tsx
+++ b/apps/web/src/components/files/AttachmentFilePreview.tsx
@@ -20,6 +20,7 @@ import { AudioPreview } from "./AudioPreview";
 import { BrowserDocumentFrame } from "./BrowserDocumentFrame";
 import { DelimitedTablePreview } from "./DelimitedTablePreview";
 import { OfficeFilePreview } from "./OfficeFilePreview";
+import { downloadFile } from "./downloadFile";
 import {
   FILE_SURFACE_SUBHEADER_CLASS,
   FileSurfaceAction,
@@ -198,9 +199,8 @@ export function AttachmentFilePreview(props: {
         if (!file) {
           const target = await prepareDownload();
           if (!target) throw new Error("Reconnect to the environment and try again.");
-          const response = await fetch(target);
-          if (!response.ok) throw new Error("The file could not be loaded. Try again.");
-          file = await response.blob();
+          await downloadFile(target, props.name);
+          return;
         }
         // A Blob keeps cross-origin downloads inside the desktop client instead of
         // navigating its custom app scheme to an external browser.
diff --git a/apps/web/src/components/files/DocxPreview.tsx b/apps/web/src/components/files/DocxPreview.tsx
index c0ea11edd6df..8efb267f279a 100644
--- a/apps/web/src/components/files/DocxPreview.tsx
+++ b/apps/web/src/components/files/DocxPreview.tsx
@@ -12,20 +12,20 @@ export default function DocxPreview(props: {
     error: null,
   });
   useEffect(() => {
-    let cancelled = false;
-    void renderDocxDocument(props.bytes)
+    const controller = new AbortController();
+    void renderDocxDocument(props.bytes, controller.signal)
       .then((html) => {
-        if (!cancelled) setResult({ html, error: null });
+        if (!controller.signal.aborted) setResult({ html, error: null });
       })
       .catch((cause: unknown) => {
-        if (!cancelled)
+        if (!controller.signal.aborted)
           setResult({
             html: null,
             error: cause instanceof Error ? cause.message : "Could not render this Word document.",
           });
       });
     return () => {
-      cancelled = true;
+      controller.abort();
     };
   }, [props.bytes]);
   if (result.error !== null)
diff --git a/apps/web/src/components/files/FilePreviewPanel.tsx b/apps/web/src/components/files/FilePreviewPanel.tsx
index f61787544d62..56b5e0bf71fe 100644
--- a/apps/web/src/components/files/FilePreviewPanel.tsx
+++ b/apps/web/src/components/files/FilePreviewPanel.tsx
@@ -76,7 +76,8 @@ import { AttachmentFilePreview } from "./AttachmentFilePreview";
 import { AudioPreview } from "./AudioPreview";
 import { BrowserDocumentFrame, isPdfPreviewFile } from "./BrowserDocumentFrame";
 import { DelimitedTablePreview } from "./DelimitedTablePreview";
-import { OfficeFilePreview } from "./OfficeFilePreview";
+import { WorkspaceOfficePreview, useWorkspaceOfficeResource } from "./WorkspaceOfficePreview";
+import { downloadFile } from "./downloadFile";
 import FileBrowserPanel from "./FileBrowserPanel";
 import { FileBreadcrumbs } from "./FileBreadcrumbs";
 import { FileMarkdownPreview } from "./FileMarkdownPreview";
@@ -270,73 +271,6 @@ function WorkspaceBrowserPreview(props: {
   );
 }
 
-function WorkspaceOfficePreview(props: {
-  readonly environmentId: EnvironmentId;
-  readonly threadRef: ScopedThreadRef;
-  readonly draft: boolean;
-  readonly absolutePath: string;
-  readonly workspaceRoot: string;
-  readonly name: string;
-  readonly kind: "docx" | "xlsx";
-  readonly workspaceMutationId: string | null;
-}) {
-  const insideWorkspace =
-    mediaFileReference(props.absolutePath, props.workspaceRoot).relativePath !== undefined;
-  const resource = useMemo(
-    () =>
-      workspaceAssetResource({
-        kind: insideWorkspace ? "workspace-file" : "media-file",
-        threadRef: props.threadRef,
-        draft: props.draft,
-        workspaceRoot: props.workspaceRoot,
-        absolutePath: props.absolutePath,
-      }),
-    [insideWorkspace, props.threadRef, props.draft, props.workspaceRoot, props.absolutePath],
-  );
-  const refresh = useAssetUrlRefresh(props.environmentId, resource);
-  const [revision, setRevision] = useState(0);
-  const [result, setResult] = useState<{ url: string | null; error: string | null }>({
-    url: null,
-    error: null,
-  });
-  useEffect(() => {
-    let cancelled = false;
-    // oxlint-disable-next-line react/set-state-in-effect -- Reauthorize after a file update or retry; never keep a stale preview URL.
-    setResult({ url: null, error: null });
-    void refresh()
-      .then((url) => {
-        if (!url) throw new Error("Reconnect to the environment and try again.");
-        if (!cancelled)
-          setResult({
-            url: `${url}${url.includes("?") ? "&" : "?"}workspace-revision=${encodeURIComponent(props.workspaceMutationId ?? "")}&office-revision=${revision}`,
-            error: null,
-          });
-      })
-      .catch((cause: unknown) => {
-        if (!cancelled)
-          setResult({
-            url: null,
-            error: cause instanceof Error ? cause.message : "Could not load this file.",
-          });
-      });
-    return () => {
-      cancelled = true;
-    };
-  }, [refresh, props.workspaceMutationId, revision]);
-  const retry = () => setRevision((value) => value + 1);
-  if (result.error) return <FileSurfaceFailure message={result.error} onRetry={retry} />;
-  if (!result.url) return <FileSurfaceLoading />;
-  return (
-    <OfficeFilePreview
-      key={result.url}
-      src={result.url}
-      name={props.name}
-      kind={props.kind}
-      onRetry={retry}
-    />
-  );
-}
-
 function WorkspaceOfficeDownload(props: {
   readonly environmentId: EnvironmentId;
   readonly threadRef: ScopedThreadRef;
@@ -345,34 +279,22 @@ function WorkspaceOfficeDownload(props: {
   readonly workspaceRoot: string;
   readonly name: string;
 }) {
-  const insideWorkspace =
-    mediaFileReference(props.absolutePath, props.workspaceRoot).relativePath !== undefined;
-  const resource = useMemo(
-    () =>
-      workspaceAssetResource({
-        kind: insideWorkspace ? "workspace-file" : "media-file",
-        threadRef: props.threadRef,
-        draft: props.draft,
-        workspaceRoot: props.workspaceRoot,
-        absolutePath: props.absolutePath,
-      }),
-    [insideWorkspace, props.threadRef, props.draft, props.workspaceRoot, props.absolutePath],
-  );
+  const original = useWorkspaceOfficeResource(props);
+  const resource = useMemo(() => ({ ...original, disposition: "attachment" as const }), [original]);
   const refresh = useAssetUrlRefresh(props.environmentId, resource);
   const [saving, setSaving] = useState(false);
+  const controller = useRef<AbortController | null>(null);
+  useEffect(() => () => controller.current?.abort(), []);
   const save = () => {
+    if (controller.current) return;
+    const request = new AbortController();
+    controller.current = request;
     setSaving(true);
     void (async () => {
       const src = await refresh();
+      if (request.signal.aborted) return;
       if (!src) throw new Error("Reconnect to the environment and try again.");
-      const response = await fetch(src);
-      if (!response.ok) throw new Error("Could not save this file.");
-      const url = URL.createObjectURL(await response.blob());
-      const anchor = document.createElement("a");
-      anchor.href = url;
-      anchor.download = props.name;
-      anchor.click();
-      setTimeout(() => URL.revokeObjectURL(url), 30_000);
+      await downloadFile(src, props.name);
     })()
       .catch((cause: unknown) => {
         toastManager.add({
@@ -381,7 +303,10 @@ function WorkspaceOfficeDownload(props: {
           description: cause instanceof Error ? cause.message : "Please try again.",
         });
       })
-      .finally(() => setSaving(false));
+      .finally(() => {
+        if (controller.current === request) controller.current = null;
+        if (!request.signal.aborted) setSaving(false);
+      });
   };
   return (
     <FileSurfaceAction
@@ -1190,6 +1115,7 @@ export default function FilePreviewPanel({
   const isImage = relativePath !== null && !isVideo && isWorkspaceImagePreviewPath(relativePath);
   const isMedia = isImage || isVideo || isAudio;
   const officeKind = relativePath === null ? null : officeFilePreviewKind(relativePath);
+  const [officeRefreshRevision, setOfficeRefreshRevision] = useState(0);
   // PDFs have no text to show; HTML has, and can toggle between page and source.
   const isPdf = relativePath !== null && isPdfPreviewFile(relativePath);
   const isHtml = relativePath !== null && !isPdf && isBrowserPreviewFile(relativePath);
@@ -1503,6 +1429,7 @@ export default function FilePreviewPanel({
               workspaceRoot={cwd}
               name={relativePath}
               kind={officeKind}
+              refreshRevision={officeRefreshRevision}
               workspaceMutationId={workspaceMutationId}
             />
           ) : relativePath && isVideo && absolutePath ? (
@@ -1648,7 +1575,12 @@ export default function FilePreviewPanel({
               onOpenFile={onOpenFile}
               workspaceMutationId={workspaceMutationId}
               {...(previewPath && !isMedia && !isPdf
-                ? { onRefreshSelectedFile: file.refresh }
+                ? {
+                    onRefreshSelectedFile:
+                      officeKind === null
+                        ? file.refresh
+                        : () => setOfficeRefreshRevision((value) => value + 1),
+                  }
                 : {})}
             />
           </aside>
diff --git a/apps/web/src/components/files/OfficeFilePreview.tsx b/apps/web/src/components/files/OfficeFilePreview.tsx
index 617a90c34eb2..9245f74bdea1 100644
--- a/apps/web/src/components/files/OfficeFilePreview.tsx
+++ b/apps/web/src/components/files/OfficeFilePreview.tsx
@@ -3,7 +3,8 @@ import { FILE_OFFICE_PREVIEW_MAX_BYTES } from "@t3tools/shared/filePreview";
 import { lazy, Suspense, useEffect, useState } from "react";
 
 import { FileSurfaceFailure, FileSurfaceLoading } from "./fileSurfaceChrome";
-import { validateOfficeArchive, type OfficePreviewKind } from "./officeArchive";
+import { type OfficePreviewKind } from "./officeArchive";
+import { checkOfficeArchive } from "./checkOfficeArchive";
 
 const DocxPreview = lazy(() => import("./DocxPreview"));
 const SpreadsheetPreview = lazy(() => import("./SpreadsheetPreview"));
@@ -34,8 +35,8 @@ export function OfficeFilePreview(props: {
         signal: controller.signal,
         cache: revision > 0 ? "reload" : "default",
       });
-      const bytes = await readOfficePreviewResponse(response, controller.signal);
-      validateOfficeArchive(bytes, props.kind);
+      const fetched = await readOfficePreviewResponse(response, controller.signal);
+      const bytes = await checkOfficeArchive(fetched, props.kind, controller.signal);
       if (!controller.signal.aborted) setResult({ bytes, error: null });
     })().catch((cause: unknown) => {
       if (!controller.signal.aborted)
diff --git a/apps/web/src/components/files/WorkspaceOfficePreview.test.tsx b/apps/web/src/components/files/WorkspaceOfficePreview.test.tsx
new file mode 100644
index 000000000000..f913f4f26305
--- /dev/null
+++ b/apps/web/src/components/files/WorkspaceOfficePreview.test.tsx
@@ -0,0 +1,92 @@
+import { EnvironmentId, ThreadId } from "@t3tools/contracts";
+import { act, useState } from "react";
+import { create, type ReactTestRenderer } from "react-test-renderer";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+import { WorkspaceOfficePreview } from "./WorkspaceOfficePreview";
+
+const { refresh } = vi.hoisted(() => ({ refresh: vi.fn() }));
+vi.mock("~/assets/assetUrls", () => ({ useAssetRefresh: () => refresh }));
+vi.mock("./OfficeFilePreview", () => ({
+  OfficeFilePreview: ({ src }: { src: string }) => {
+    const [sheet, setSheet] = useState("First");
+    return <select aria-label={src} value={sheet} onChange={() => setSheet("Second")} />;
+  },
+}));
+vi.mock("./fileSurfaceChrome", () => ({
+  FileSurfaceLoading: () => <div>Loading</div>,
+  FileSurfaceFailure: ({ message }: { message: string }) => <div role="alert">{message}</div>,
+}));
+
+describe("Office workspace refresh", () => {
+  let renderer: ReactTestRenderer | undefined;
+  const props = {
+    environmentId: EnvironmentId.make("test-environment"),
+    threadRef: {
+      environmentId: EnvironmentId.make("test-environment"),
+      threadId: ThreadId.make("thread-1"),
+    },
+    draft: false,
+    absolutePath: "/workspace/report.xlsx",
+    workspaceRoot: "/workspace",
+    name: "report.xlsx",
+    kind: "xlsx" as const,
+    workspaceMutationId: null as string | null,
+    refreshRevision: 0,
+  };
+  const render = async (overrides = {}) => {
+    await act(async () => {
+      if (renderer) renderer.update(<WorkspaceOfficePreview {...props} {...overrides} />);
+      else renderer = create(<WorkspaceOfficePreview {...props} {...overrides} />);
+      await vi.advanceTimersByTimeAsync(150);
+    });
+    await act(() => vi.advanceTimersByTimeAsync(150));
+  };
+  beforeEach(() => {
+    vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
+    vi.useFakeTimers();
+    refresh.mockReset().mockResolvedValue({
+      url: "https://host.test/report.xlsx",
+      fileVersion: "version-1",
+      byteLength: 123,
+    });
+  });
+  afterEach(async () => {
+    if (renderer) await act(() => renderer!.unmount());
+    renderer = undefined;
+    vi.useRealTimers();
+    vi.unstubAllGlobals();
+  });
+  it("preserves the chosen worksheet after an unchanged workspace command", async () => {
+    await render();
+    await act(() => renderer!.root.findByType("select").props.onChange());
+    refresh.mockResolvedValue({
+      url: "https://host.test/renewed.xlsx",
+      fileVersion: "version-1",
+      byteLength: 123,
+    });
+    await render({ workspaceMutationId: "read-only-command" });
+    expect(renderer!.root.findByType("select").props.value).toBe("Second");
+    expect(renderer!.root.findByType("select").props["aria-label"]).toContain("report.xlsx");
+  });
+  it("reloads changed content and explicit refreshes", async () => {
+    await render();
+    await act(() => renderer!.root.findByType("select").props.onChange());
+    refresh.mockResolvedValue({
+      url: "https://host.test/changed.xlsx",
+      fileVersion: "version-2",
+      byteLength: 123,
+    });
+    await render({ workspaceMutationId: "file-update" });
+    expect(renderer!.root.findByType("select").props.value).toBe("First");
+    await act(() => renderer!.root.findByType("select").props.onChange());
+    await render({ workspaceMutationId: "file-update", refreshRevision: 1 });
+    expect(renderer!.root.findByType("select").props.value).toBe("First");
+  });
+  it("does not replace a successful preview while an update check is pending", async () => {
+    await render();
+    await act(() => renderer!.root.findByType("select").props.onChange());
+    refresh.mockImplementation(() => new Promise(() => {}));
+    await render({ workspaceMutationId: "another-command" });
+    expect(renderer!.root.findByType("select").props.value).toBe("Second");
+  });
+});
diff --git a/apps/web/src/components/files/WorkspaceOfficePreview.tsx b/apps/web/src/components/files/WorkspaceOfficePreview.tsx
new file mode 100644
index 000000000000..6c882bb36c82
--- /dev/null
+++ b/apps/web/src/components/files/WorkspaceOfficePreview.tsx
@@ -0,0 +1,100 @@
+import type { EnvironmentId, ScopedThreadRef } from "@t3tools/contracts";
+import { mediaFileReference } from "@t3tools/client-runtime/media-reference";
+import { useEffect, useMemo, useState } from "react";
+import { useAssetRefresh } from "~/assets/assetUrls";
+import { workspaceAssetResource } from "./filePreviewMode";
+import { OfficeFilePreview } from "./OfficeFilePreview";
+import { FileSurfaceFailure, FileSurfaceLoading } from "./fileSurfaceChrome";
+
+export function useWorkspaceOfficeResource(props: {
+  readonly threadRef: ScopedThreadRef;
+  readonly draft: boolean;
+  readonly absolutePath: string;
+  readonly workspaceRoot: string;
+}) {
+  const { environmentId, threadId } = props.threadRef;
+  const { draft, absolutePath, workspaceRoot } = props;
+  const inside = mediaFileReference(absolutePath, workspaceRoot).relativePath !== undefined;
+  return useMemo(
+    () =>
+      workspaceAssetResource({
+        threadRef: { environmentId, threadId },
+        draft,
+        absolutePath,
+        workspaceRoot,
+        kind: inside ? "workspace-file" : "media-file",
+      }),
+    [inside, environmentId, threadId, draft, absolutePath, workspaceRoot],
+  );
+}
+
+export function WorkspaceOfficePreview(props: {
+  readonly environmentId: EnvironmentId;
+  readonly threadRef: ScopedThreadRef;
+  readonly draft: boolean;
+  readonly absolutePath: string;
+  readonly workspaceRoot: string;
+  readonly name: string;
+  readonly kind: "docx" | "xlsx";
+  readonly workspaceMutationId: string | null;
+  readonly refreshRevision: number;
+}) {
+  const resource = useWorkspaceOfficeResource(props);
+  const refresh = useAssetRefresh(props.environmentId, resource);
+  const [retryRevision, setRetryRevision] = useState(0);
+  const [result, setResult] = useState<{
+    url: string;
+    version: string | undefined;
+    sizeBytes: number | undefined;
+    explicitRevision: string;
+  } | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const explicitRevision = `${props.refreshRevision}:${retryRevision}`;
+  useEffect(() => {
+    let cancelled = false;
+    const check = async () => {
+      const asset = await refresh();
+      if (cancelled) return;
+      if (!asset) throw new Error("Reconnect to the environment and try again.");
+      setError(null);
+      setResult((previous) => {
+        if (
+          asset.fileVersion !== undefined &&
+          previous?.version === asset.fileVersion &&
+          previous.explicitRevision === explicitRevision
+        )
+          return previous;
+        return {
+          url: `${asset.url}${asset.url.includes("?") ? "&" : "?"}office-version=${encodeURIComponent(asset.fileVersion ?? props.workspaceMutationId ?? "")}&office-revision=${explicitRevision}`,
+          version: asset.fileVersion,
+          sizeBytes: asset.byteLength,
+          explicitRevision,
+        };
+      });
+    };
+    // Coalesce tool completions; keep the last successful document visible while checking metadata.
+    const timeout = setTimeout(() => {
+      void check().catch((cause: unknown) => {
+        if (!cancelled)
+          setError(cause instanceof Error ? cause.message : "Could not load this file.");
+      });
+    }, 150);
+    return () => {
+      cancelled = true;
+      clearTimeout(timeout);
+    };
+  }, [refresh, props.workspaceMutationId, explicitRevision]);
+  const retry = () => setRetryRevision((value) => value + 1);
+  if (error) return <FileSurfaceFailure message={error} onRetry={retry} />;
+  if (!result) return <FileSurfaceLoading />;
+  return (
+    <OfficeFilePreview
+      key={result.url}
+      src={result.url}
+      name={props.name}
+      kind={props.kind}
+      {...(result.sizeBytes === undefined ? {} : { sizeBytes: result.sizeBytes })}
+      onRetry={retry}
+    />
+  );
+}
diff --git a/apps/web/src/components/files/checkOfficeArchive.test.ts b/apps/web/src/components/files/checkOfficeArchive.test.ts
new file mode 100644
index 000000000000..1e7ae1b75797
--- /dev/null
+++ b/apps/web/src/components/files/checkOfficeArchive.test.ts
@@ -0,0 +1,50 @@
+import { beforeEach, afterEach, describe, expect, it, vi } from "vite-plus/test";
+import { checkOfficeArchive } from "./checkOfficeArchive";
+
+class TestWorker {
+  static instances: TestWorker[] = [];
+  listeners = new Map<string, (event: { data: unknown }) => void>();
+  terminate = vi.fn();
+  postMessage = vi.fn();
+  constructor() {
+    TestWorker.instances.push(this);
+  }
+  addEventListener(name: string, callback: (event: { data: unknown }) => void) {
+    this.listeners.set(name, callback);
+  }
+}
+describe("archive worker lifetime", () => {
+  beforeEach(() => {
+    TestWorker.instances = [];
+    vi.stubGlobal("Worker", TestWorker);
+    vi.useFakeTimers();
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.unstubAllGlobals();
+  });
+  it("stops actual inflation on cancellation", async () => {
+    const controller = new AbortController();
+    const result = checkOfficeArchive(new Uint8Array(5), "docx", controller.signal);
+    const rejection = expect(result).rejects.toThrow();
+    controller.abort();
+    await rejection;
+    expect(TestWorker.instances[0]!.terminate).toHaveBeenCalledOnce();
+  });
+  it("terminates a stalled validator and offers an external-viewer fallback", async () => {
+    const result = checkOfficeArchive(new Uint8Array(5), "xlsx", new AbortController().signal);
+    const rejection = expect(result).rejects.toThrow("too long");
+    await vi.advanceTimersByTimeAsync(15000);
+    await rejection;
+    expect(TestWorker.instances[0]!.terminate).toHaveBeenCalledOnce();
+  });
+  it("releases the worker after transferring the validated buffer back", async () => {
+    const bytes = new Uint8Array(5);
+    const result = checkOfficeArchive(bytes, "xlsx", new AbortController().signal);
+    const worker = TestWorker.instances[0]!;
+    worker.listeners.get("message")!({ data: { bytes } });
+    await expect(result).resolves.toBe(bytes);
+    expect(worker.terminate).toHaveBeenCalledOnce();
+    expect(vi.getTimerCount()).toBe(0);
+  });
+});
diff --git a/apps/web/src/components/files/checkOfficeArchive.ts b/apps/web/src/components/files/checkOfficeArchive.ts
new file mode 100644
index 000000000000..19d128a87d68
--- /dev/null
+++ b/apps/web/src/components/files/checkOfficeArchive.ts
@@ -0,0 +1,49 @@
+import type { OfficePreviewKind } from "./officeArchive";
+
+/** Closing a preview terminates inflation as well as the fetch that supplied it. */
+export function checkOfficeArchive(
+  bytes: Uint8Array,
+  kind: OfficePreviewKind,
+  signal: AbortSignal,
+): Promise<Uint8Array> {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(new URL("./officeArchive.worker.ts", import.meta.url), {
+      type: "module",
+    });
+    const cleanup = () => {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", abort);
+      worker.terminate();
+    };
+    const fail = (cause: unknown) => {
+      cleanup();
+      reject(cause);
+    };
+    const abort = () => fail(signal.reason);
+    const timeout = setTimeout(
+      () =>
+        fail(
+          new Error("This document took too long to validate. Save it to open it in another app."),
+        ),
+      15_000,
+    );
+    signal.addEventListener("abort", abort, { once: true });
+    worker.addEventListener("error", () =>
+      fail(new Error("Could not validate this document. Save it to open it in another app.")),
+    );
+    worker.addEventListener(
+      "message",
+      (event: MessageEvent<{ bytes: Uint8Array } | { error: string }>) => {
+        if ("error" in event.data) return fail(new Error(event.data.error));
+        cleanup();
+        resolve(event.data.bytes);
+      },
+    );
+    try {
+      worker.postMessage({ bytes, kind }, [bytes.buffer]);
+    } catch (cause) {
+      fail(cause);
+    }
+  });
+}
diff --git a/apps/web/src/components/files/docxDocument.test.ts b/apps/web/src/components/files/docxDocument.test.ts
index 6bd65eb08bfe..6846c2474b5f 100644
--- a/apps/web/src/components/files/docxDocument.test.ts
+++ b/apps/web/src/components/files/docxDocument.test.ts
@@ -1,9 +1,26 @@
 // @vitest-environment jsdom
 import JSZip from "jszip";
-import { describe, expect, it } from "vite-plus/test";
+import { describe, expect, it, vi } from "vite-plus/test";
 import { renderDocxDocument } from "./docxDocument";
 
 describe("Word document rendering", () => {
+  it("does not parse or create document nodes after cancellation", async () => {
+    const controller = new AbortController();
+    controller.abort();
+    const create = vi.spyOn(document, "createElement");
+    await expect(renderDocxDocument(new Uint8Array(), controller.signal)).rejects.toThrow();
+    expect(create).not.toHaveBeenCalled();
+    create.mockRestore();
+  });
+  it("cancels a queued render before its first DOM phase", async () => {
+    const controller = new AbortController();
+    const create = vi.spyOn(document, "createElement");
+    const rendering = renderDocxDocument(new Uint8Array(), controller.signal);
+    controller.abort();
+    await expect(rendering).rejects.toThrow();
+    expect(create).not.toHaveBeenCalled();
+    create.mockRestore();
+  });
   it("renders actual OOXML text and tables with document styles in a standalone inert page", async () => {
     const zip = new JSZip();
     zip.file(
diff --git a/apps/web/src/components/files/docxDocument.ts b/apps/web/src/components/files/docxDocument.ts
index c9f346a60388..02e0c1f32f3c 100644
--- a/apps/web/src/components/files/docxDocument.ts
+++ b/apps/web/src/components/files/docxDocument.ts
@@ -1,24 +1,66 @@
 import DOMPurify from "dompurify";
-import { renderAsync } from "docx-preview";
+import { defaultOptions, parseAsync, renderDocument } from "docx-preview";
+
+/** Yield between DOM phases so a close or file switch can cancel the next phase. */
+async function documentPhase(signal: AbortSignal) {
+  signal.throwIfAborted();
+  await new Promise<void>((resolve, reject) => {
+    const abort = () => {
+      clearTimeout(timer);
+      reject(signal.reason);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", abort);
+      resolve();
+    }, 0);
+    signal.addEventListener("abort", abort, { once: true });
+  });
+  signal.throwIfAborted();
+}
 
 /** Render outside the app DOM, then isolate document styles and content in an inert frame. */
-export async function renderDocxDocument(bytes: Uint8Array) {
+export async function renderDocxDocument(bytes: Uint8Array, signal = new AbortController().signal) {
+  await documentPhase(signal);
   const body = document.createElement("div");
   const styles = document.createElement("div");
-  await renderAsync(bytes, body, styles, {
+  let nodes = 0;
+  let characters = 0;
+  const options = {
     useBase64URL: true,
     ignoreLastRenderedPageBreak: false,
     renderAltChunks: false,
     experimental: false,
-  });
-  const content = DOMPurify.sanitize(body.innerHTML, {
+    h: (element: Parameters<typeof defaultOptions.h>[0]) => {
+      signal.throwIfAborted();
+      if (typeof element === "string") characters += element.length;
+      if (++nodes > 20_000 || characters > 2 * 1024 * 1024)
+        throw new Error(
+          "This Word document is too complex to preview. Save it to open it in another app.",
+        );
+      return defaultOptions.h(element);
+    },
+  };
+  const parsed = await parseAsync(bytes, options);
+  await documentPhase(signal);
+  const rendered = await renderDocument(parsed, options);
+  await documentPhase(signal);
+  for (const node of rendered) (node.nodeName === "STYLE" ? styles : body).appendChild(node);
+  const markup = body.innerHTML;
+  const styleMarkup = styles.innerHTML;
+  if (markup.length + styleMarkup.length > 8 * 1024 * 1024)
+    throw new Error(
+      "This Word document is too complex to preview. Save it to open it in another app.",
+    );
+  const content = DOMPurify.sanitize(markup, {
     FORBID_TAGS: ["style", "iframe", "object", "embed", "form"],
     FORBID_ATTR: ["srcset"],
   });
-  const css = DOMPurify.sanitize(styles.innerHTML, {
+  await documentPhase(signal);
+  const css = DOMPurify.sanitize(styleMarkup, {
     FORCE_BODY: true,
     ADD_TAGS: ["style"],
     FORBID_TAGS: ["iframe", "object", "embed", "form"],
   });
+  signal.throwIfAborted();
   return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src data:; font-src data:; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'"><style>html,body{margin:0}body{background:#e5e7eb}.docx-wrapper{padding:16px!important;overflow:auto;align-items:flex-start!important}.docx-wrapper>section.docx{flex-shrink:0}</style>${css}</head><body>${content}</body></html>`;
 }
diff --git a/apps/web/src/components/files/downloadFile.ts b/apps/web/src/components/files/downloadFile.ts
new file mode 100644
index 000000000000..5eac1ad8ed0c
--- /dev/null
+++ b/apps/web/src/components/files/downloadFile.ts
@@ -0,0 +1,14 @@
+import { isElectron } from "~/env";
+import { readLocalApi } from "~/localApi";
+
+/** Let the browser or native download manager stream the signed attachment response. */
+export async function downloadFile(url: string, name: string) {
+  const api = isElectron ? readLocalApi() : null;
+  if (api) return api.shell.openExternal(url);
+  const anchor = document.createElement("a");
+  anchor.href = url;
+  anchor.download = name;
+  anchor.target = "_blank";
+  anchor.rel = "noopener noreferrer";
+  anchor.click();
+}
diff --git a/apps/web/src/components/files/officeArchive.test.ts b/apps/web/src/components/files/officeArchive.test.ts
index 7b79a36c8152..3878f27fedc9 100644
--- a/apps/web/src/components/files/officeArchive.test.ts
+++ b/apps/web/src/components/files/officeArchive.test.ts
@@ -1,14 +1,31 @@
 import JSZip from "jszip";
 import { describe, expect, it } from "vite-plus/test";
 import { validateOfficeArchive } from "./officeArchive";
+import { validateOfficeArchiveContents } from "./officeArchiveContents";
 
-const archive = async (part: string) => {
+const archive = async (part: string, compressed = false) => {
   const zip = new JSZip();
   zip.file("[Content_Types].xml", "<Types />");
   zip.file(part, "<document />");
-  return zip.generateAsync({ type: "uint8array" });
+  return zip.generateAsync({ type: "uint8array", compression: compressed ? "DEFLATE" : "STORE" });
 };
 
+function directoryOffsets(bytes: Uint8Array) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const end = bytes.length - 22;
+  let pos = view.getUint32(end + 16, true);
+  const result: number[] = [];
+  while (pos < end) {
+    result.push(pos);
+    pos +=
+      46 +
+      view.getUint16(pos + 28, true) +
+      view.getUint16(pos + 30, true) +
+      view.getUint16(pos + 32, true);
+  }
+  return result;
+}
+
 describe("Office archive validation", () => {
   it.each([
     ["docx", "word/document.xml"],
@@ -38,4 +55,95 @@ describe("Office archive validation", () => {
     }
     expect(() => validateOfficeArchive(bytes, "docx")).toThrow("too large");
   });
+  it("rejects a second end-marker hidden in a ZIP comment", async () => {
+    const original = await archive("xl/workbook.xml");
+    const zip = new Uint8Array(original.length + 22);
+    zip.set(original);
+    const view = new DataView(zip.buffer);
+    view.setUint16(original.length - 2, 22, true);
+    // A parser scanning for the last signature would treat the comment as another directory.
+    view.setUint32(original.length, 0x06054b50, true);
+    expect(() => validateOfficeArchive(zip, "xlsx")).toThrow("cannot be previewed");
+    view.setUint32(original.length, 0, true);
+    expect(() => validateOfficeArchive(zip, "xlsx")).not.toThrow();
+    view.setUint32(zip.length - 4, 0x06054b50, true);
+    expect(() => validateOfficeArchive(zip, "xlsx")).toThrow("cannot be previewed");
+  });
+  it("rejects a local size that would allocate past the central-directory budget", async () => {
+    const bytes = await archive("xl/workbook.xml", true);
+    const view = new DataView(bytes.buffer);
+    const entry = directoryOffsets(bytes)[0]!;
+    const local = view.getUint32(entry + 42, true);
+    view.setUint32(local + 22, 65 * 1024 * 1024, true);
+    expect(() => validateOfficeArchive(bytes, "xlsx")).toThrow("cannot be previewed");
+  });
+  it("checks actual DEFLATE output when both headers lie consistently", async () => {
+    const bytes = await archive("xl/workbook.xml", true);
+    const view = new DataView(bytes.buffer);
+    const entry = directoryOffsets(bytes)[0]!;
+    const local = view.getUint32(entry + 42, true);
+    view.setUint32(entry + 24, 1, true);
+    view.setUint32(local + 22, 1, true);
+    expect(() => validateOfficeArchive(bytes, "xlsx")).not.toThrow();
+    expect(() => validateOfficeArchiveContents(bytes, "xlsx")).toThrow("cannot be previewed");
+  });
+  it("checks a local filename and compression method before inflation", async () => {
+    const bytes = await archive("xl/workbook.xml", true);
+    const view = new DataView(bytes.buffer);
+    const local = view.getUint32(directoryOffsets(bytes)[0]! + 42, true);
+    const renamed = bytes.slice();
+    renamed[local + 30] = 120;
+    expect(() => validateOfficeArchive(renamed, "xlsx")).toThrow("cannot be previewed");
+    view.setUint16(local + 8, 99, true);
+    expect(() => validateOfficeArchive(bytes, "xlsx")).toThrow("cannot be previewed");
+  });
+  it("accepts streamed data descriptors and rejects a forged descriptor", async () => {
+    const zip = new JSZip();
+    zip.file("[Content_Types].xml", "<Types />");
+    zip.file("xl/workbook.xml", "<workbook />");
+    const bytes = await zip.generateAsync({
+      type: "uint8array",
+      streamFiles: true,
+      compression: "DEFLATE",
+    });
+    expect(() => validateOfficeArchiveContents(bytes, "xlsx")).not.toThrow();
+    const entry = validateOfficeArchive(bytes, "xlsx")[0]!;
+    bytes[entry.end + 4] = bytes[entry.end + 4]! ^ 1;
+    expect(() => validateOfficeArchive(bytes, "xlsx")).toThrow("cannot be previewed");
+  });
+  it("rejects overlapping or duplicate local entries", async () => {
+    const bytes = await archive("xl/workbook.xml");
+    const view = new DataView(bytes.buffer);
+    const offsets = directoryOffsets(bytes);
+    view.setUint32(offsets[1]! + 42, view.getUint32(offsets[0]! + 42, true), true);
+    expect(() => validateOfficeArchive(bytes, "xlsx")).toThrow("cannot be previewed");
+  });
+  it("caps Word nodes and decoded image pixels before constructing a DOM", async () => {
+    const zip = new JSZip();
+    zip.file("[Content_Types].xml", "<Types />");
+    zip.file(
+      "word/document.xml",
+      `<document>${"<p><r><t>Text</t></r></p>".repeat(5000)}</document>`,
+    );
+    const bytes = await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" });
+    expect(() => validateOfficeArchiveContents(bytes, "docx")).toThrow("too complex");
+    zip.file("word/document.xml", "<document />");
+    const png = new Uint8Array(24);
+    png.set([0x89, 0x50, 0x4e, 0x47], 0);
+    png.set([0x49, 0x48, 0x44, 0x52], 12);
+    const view = new DataView(png.buffer);
+    view.setUint32(16, 100000);
+    view.setUint32(20, 100000);
+    zip.file("word/media/image.png", png);
+    const imageBytes = await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" });
+    expect(() => validateOfficeArchiveContents(imageBytes, "docx")).toThrow("too complex");
+  });
+  it("does not count unused Word style catalogs as rendered document nodes", async () => {
+    const zip = new JSZip();
+    zip.file("[Content_Types].xml", "<Types />");
+    zip.file("word/document.xml", "<document><p>One page</p></document>");
+    zip.file("word/styles.xml", `<styles>${"<style><rPr /></style>".repeat(9000)}</styles>`);
+    const bytes = await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" });
+    expect(() => validateOfficeArchiveContents(bytes, "docx")).not.toThrow();
+  });
 });
diff --git a/apps/web/src/components/files/officeArchive.ts b/apps/web/src/components/files/officeArchive.ts
index fc8351c9bf68..45bcc73859a1 100644
--- a/apps/web/src/components/files/officeArchive.ts
+++ b/apps/web/src/components/files/officeArchive.ts
@@ -1,58 +1,143 @@
 import type { filePreviewKind } from "@t3tools/shared/filePreview";
 
 export type OfficePreviewKind = Extract<ReturnType<typeof filePreviewKind>, "docx" | "xlsx">;
+export const OFFICE_ARCHIVE_MAX_EXPANDED_BYTES = 64 * 1024 * 1024;
 
-/** Check the ZIP directory before a renderer expands XML, images or shared strings. */
+export function invalidOfficeArchive(): never {
+  throw new Error(
+    "This file cannot be previewed. It may be damaged, encrypted, or use an unsupported Office format. Save it to open it in another app.",
+  );
+}
+
+/** Inspect both ZIP directories before an inflater can trust a size or offset. */
 export function validateOfficeArchive(bytes: Uint8Array, kind: OfficePreviewKind) {
-  const fail = () => {
-    throw new Error(
-      "This file cannot be previewed. It may be damaged, encrypted, or use an unsupported Office format. Save it to open it in another app.",
-    );
-  };
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
   let end = -1;
-  for (let offset = bytes.length - 22; offset >= Math.max(0, bytes.length - 65557); offset--) {
-    if (
-      view.getUint32(offset, true) === 0x06054b50 &&
-      offset + 22 + view.getUint16(offset + 20, true) === bytes.length
-    ) {
-      end = offset;
+  // SheetJS selects the last end-marker even in a ZIP comment; validate that same marker.
+  for (let pos = bytes.length - 4; pos >= Math.max(0, bytes.length - 65557); pos--) {
+    if (view.getUint32(pos, true) === 0x06054b50) {
+      if (pos + 22 > bytes.length || pos + 22 + view.getUint16(pos + 20, true) !== bytes.length)
+        return invalidOfficeArchive();
+      end = pos;
       break;
     }
   }
-  if (end < 0) return fail();
-  const entries = view.getUint16(end + 10, true);
-  const size = view.getUint32(end + 12, true);
-  let offset = view.getUint32(end + 16, true);
+  if (end < 0) return invalidOfficeArchive();
+  const count = view.getUint16(end + 10, true);
+  const directorySize = view.getUint32(end + 12, true);
+  const directory = view.getUint32(end + 16, true);
   if (
-    entries === 0 ||
-    entries > 10000 ||
-    offset + size > end ||
-    view.getUint32(end + 4, true) !== 0
+    !count ||
+    count > 10000 ||
+    view.getUint32(end + 4, true) !== 0 ||
+    view.getUint16(end + 8, true) !== count ||
+    directory + directorySize !== end
   )
-    return fail();
+    return invalidOfficeArchive();
+  const entries: {
+    name: string;
+    method: number;
+    start: number;
+    end: number;
+    size: number;
+    localStart: number;
+    localEnd: number;
+  }[] = [];
+  const names = new Set<string>();
+  const decoder = new TextDecoder();
   let expanded = 0;
-  let hasDocument = false;
-  let hasContentTypes = false;
-  const requiredPart = kind === "docx" ? "word/document.xml" : "xl/workbook.xml";
-  for (let index = 0; index < entries; index++) {
-    if (offset + 46 > end || view.getUint32(offset, true) !== 0x02014b50) return fail();
-    if ((view.getUint16(offset + 8, true) & 1) !== 0) return fail();
-    expanded += view.getUint32(offset + 24, true);
-    if (expanded > 64 * 1024 * 1024)
+  let pos = directory;
+  const inspectExtra = (start: number, length: number) => {
+    const stop = start + length;
+    while (start < stop) {
+      if (start + 4 > stop) return invalidOfficeArchive();
+      // ZIP64 changes the meaning of the 32-bit sizes and is outside the preview budget.
+      if (view.getUint16(start, true) === 1) return invalidOfficeArchive();
+      start += 4 + view.getUint16(start + 2, true);
+      if (start > stop) return invalidOfficeArchive();
+    }
+  };
+  for (let index = 0; index < count; index++) {
+    if (pos + 46 > end || view.getUint32(pos, true) !== 0x02014b50) return invalidOfficeArchive();
+    const flags = view.getUint16(pos + 8, true);
+    const method = view.getUint16(pos + 10, true);
+    const crc = view.getUint32(pos + 16, true);
+    const compressed = view.getUint32(pos + 20, true);
+    const size = view.getUint32(pos + 24, true);
+    const nameLength = view.getUint16(pos + 28, true);
+    const extraLength = view.getUint16(pos + 30, true);
+    const next = pos + 46 + nameLength + extraLength + view.getUint16(pos + 32, true);
+    const local = view.getUint32(pos + 42, true);
+    if (
+      (flags & ~0x080e) !== 0 ||
+      (method !== 0 && method !== 8) ||
+      view.getUint16(pos + 34, true) !== 0 ||
+      next > end ||
+      local + 30 > directory
+    )
+      return invalidOfficeArchive();
+    expanded += size;
+    if (expanded > OFFICE_ARCHIVE_MAX_EXPANDED_BYTES)
       throw new Error("This document is too large to preview. Save it to open it in another app.");
-    const nameLength = view.getUint16(offset + 28, true);
-    const next =
-      offset +
-      46 +
-      nameLength +
-      view.getUint16(offset + 30, true) +
-      view.getUint16(offset + 32, true);
-    if (next > end) return fail();
-    const name = new TextDecoder().decode(bytes.subarray(offset + 46, offset + 46 + nameLength));
-    hasDocument ||= name === requiredPart;
-    hasContentTypes ||= name === "[Content_Types].xml";
-    offset = next;
+    const rawName = bytes.subarray(pos + 46, pos + 46 + nameLength);
+    const name = decoder.decode(rawName);
+    if (
+      !name ||
+      names.has(name) ||
+      name.startsWith("/") ||
+      name.includes("\\") ||
+      name.split("/").some((part) => part === "." || part === "..")
+    )
+      return invalidOfficeArchive();
+    names.add(name);
+    inspectExtra(pos + 46 + nameLength, extraLength);
+    if (
+      view.getUint32(local, true) !== 0x04034b50 ||
+      view.getUint16(local + 6, true) !== flags ||
+      view.getUint16(local + 8, true) !== method ||
+      view.getUint16(local + 26, true) !== nameLength
+    )
+      return invalidOfficeArchive();
+    const localExtra = view.getUint16(local + 28, true);
+    const start = local + 30 + nameLength + localExtra;
+    const dataEnd = start + compressed;
+    if (dataEnd > directory || (method === 0 && compressed !== size)) return invalidOfficeArchive();
+    for (let n = 0; n < nameLength; n++)
+      if (bytes[local + 30 + n] !== rawName[n]) return invalidOfficeArchive();
+    inspectExtra(local + 30 + nameLength, localExtra);
+    const descriptor = (flags & 8) !== 0;
+    for (const [offset, expected] of [
+      [14, crc],
+      [18, compressed],
+      [22, size],
+    ] as const) {
+      const actual = view.getUint32(local + offset, true);
+      if (actual !== expected && !(descriptor && actual === 0)) return invalidOfficeArchive();
+    }
+    let localEnd = dataEnd;
+    if (descriptor) {
+      if (localEnd + 12 > directory) return invalidOfficeArchive();
+      if (view.getUint32(localEnd, true) === 0x08074b50) localEnd += 4;
+      if (
+        localEnd + 12 > directory ||
+        view.getUint32(localEnd, true) !== crc ||
+        view.getUint32(localEnd + 4, true) !== compressed ||
+        view.getUint32(localEnd + 8, true) !== size
+      )
+        return invalidOfficeArchive();
+      localEnd += 12;
+    }
+    entries.push({ name, method, start, end: dataEnd, size, localStart: local, localEnd });
+    pos = next;
   }
-  if (!hasDocument || !hasContentTypes) return fail();
+  if (
+    pos !== end ||
+    !names.has("[Content_Types].xml") ||
+    !names.has(kind === "docx" ? "word/document.xml" : "xl/workbook.xml")
+  )
+    return invalidOfficeArchive();
+  const byOffset = entries.toSorted((a, b) => a.localStart - b.localStart);
+  for (let index = 1; index < byOffset.length; index++)
+    if (byOffset[index]!.localStart < byOffset[index - 1]!.localEnd) return invalidOfficeArchive();
+  return entries;
 }
diff --git a/apps/web/src/components/files/officeArchive.worker.ts b/apps/web/src/components/files/officeArchive.worker.ts
new file mode 100644
index 000000000000..da25e33ce721
--- /dev/null
+++ b/apps/web/src/components/files/officeArchive.worker.ts
@@ -0,0 +1,18 @@
+/* oxlint-disable unicorn/require-post-message-target-origin -- Dedicated workers post to their owner without a Window target origin. */
+import { validateOfficeArchiveContents } from "./officeArchiveContents";
+import type { OfficePreviewKind } from "./officeArchive";
+
+self.addEventListener(
+  "message",
+  (event: MessageEvent<{ bytes: Uint8Array; kind: OfficePreviewKind }>) => {
+    const { bytes, kind } = event.data;
+    try {
+      validateOfficeArchiveContents(bytes, kind);
+      self.postMessage({ bytes }, { transfer: [bytes.buffer] });
+    } catch (cause) {
+      self.postMessage({
+        error: cause instanceof Error ? cause.message : "Could not read this document.",
+      });
+    }
+  },
+);
diff --git a/apps/web/src/components/files/officeArchiveContents.ts b/apps/web/src/components/files/officeArchiveContents.ts
new file mode 100644
index 000000000000..c12669ee9ee7
--- /dev/null
+++ b/apps/web/src/components/files/officeArchiveContents.ts
@@ -0,0 +1,76 @@
+import { readImageDimensions } from "@t3tools/shared/imageDimensions";
+import { Inflate } from "fflate";
+import {
+  invalidOfficeArchive,
+  validateOfficeArchive,
+  OFFICE_ARCHIVE_MAX_EXPANDED_BYTES,
+  type OfficePreviewKind,
+} from "./officeArchive";
+
+const WORD_MAX_XML_BYTES = 2 * 1024 * 1024;
+const WORD_MAX_ELEMENTS = 12000;
+const WORD_MAX_MEDIA_BYTES = 4 * 1024 * 1024;
+const WORD_MAX_IMAGE_PIXELS = 16_000_000;
+const complexWord = () => {
+  throw new Error(
+    "This Word document is too complex to preview. Save it to open it in another app.",
+  );
+};
+
+/** Streaming inflation verifies actual sizes with bounded input chunks, in a disposable worker. */
+export function validateOfficeArchiveContents(bytes: Uint8Array, kind: OfficePreviewKind) {
+  const entries = validateOfficeArchive(bytes, kind);
+  let total = 0;
+  let xmlBytes = 0;
+  let elements = 0;
+  let mediaBytes = 0;
+  let pixels = 0;
+  for (const entry of entries) {
+    let written = 0;
+    const isWordXml =
+      kind === "docx" && entry.name.startsWith("word/") && entry.name.endsWith(".xml");
+    const isWordMedia = kind === "docx" && entry.name.startsWith("word/media/") && entry.size > 0;
+    const isWordFont = kind === "docx" && entry.name.startsWith("word/fonts/");
+    if (isWordXml && (xmlBytes += entry.size) > WORD_MAX_XML_BYTES) return complexWord();
+    if ((isWordMedia || isWordFont) && (mediaBytes += entry.size) > WORD_MAX_MEDIA_BYTES)
+      return complexWord();
+    const capture = isWordXml || isWordMedia;
+    const chunks: Uint8Array[] = [];
+    const consume = (data: Uint8Array) => {
+      written += data.length;
+      total += data.length;
+      if (written > entry.size || total > OFFICE_ARCHIVE_MAX_EXPANDED_BYTES)
+        return invalidOfficeArchive();
+      if (capture) chunks.push(data.slice());
+    };
+    if (entry.method === 0) consume(bytes.subarray(entry.start, entry.end));
+    else {
+      const inflater = new Inflate(consume);
+      // A forged DEFLATE stream cannot produce an unbounded chunk before our counter runs.
+      for (let pos = entry.start; pos < entry.end; pos += 256)
+        inflater.push(bytes.subarray(pos, Math.min(pos + 256, entry.end)), pos + 256 >= entry.end);
+      if (entry.start === entry.end) inflater.push(new Uint8Array(), true);
+    }
+    if (written !== entry.size) return invalidOfficeArchive();
+    if (capture) {
+      const content = new Uint8Array(written);
+      let offset = 0;
+      for (const chunk of chunks) {
+        content.set(chunk, offset);
+        offset += chunk.length;
+      }
+      if (isWordXml) {
+        const xml = new TextDecoder().decode(content);
+        // Default Word catalogs contain thousands of unused styles; count renderable content.
+        if (/^word\/(document|header\d*|footer\d*|footnotes|endnotes)\.xml$/.test(entry.name)) {
+          for (const _match of xml.matchAll(/<[A-Za-z_][^>]*>/g))
+            if (++elements > WORD_MAX_ELEMENTS) return complexWord();
+        }
+      } else {
+        const dimensions = readImageDimensions(content);
+        if (!dimensions || (pixels += dimensions.width * dimensions.height) > WORD_MAX_IMAGE_PIXELS)
+          return complexWord();
+      }
+    }
+  }
+}
diff --git a/docs/user/composer.md b/docs/user/composer.md
index 523a496a1537..4262e551ffaf 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -331,6 +331,9 @@ result is available; the preview does not recalculate them.
 
 Office previews support files up to 10 MB. Large worksheets show a limited
 preview. Save the original file to inspect its full content in another app.
+Complex Word documents may need another app to keep the conversation responsive.
+On mobile, Word and Excel files from Files or chat links open in the device's
+document viewer. If no compatible viewer is installed, use **Save or share**.
 
 ## HTML and PDF files in the file viewer
 
diff --git a/packages/contracts/src/assets.ts b/packages/contracts/src/assets.ts
index dd7d3eb7c542..0752a5dd5bb7 100644
--- a/packages/contracts/src/assets.ts
+++ b/packages/contracts/src/assets.ts
@@ -15,6 +15,7 @@ export const AssetResource = Schema.Union([
   Schema.TaggedStruct("workspace-file", {
     threadId: ThreadId,
     path: TrimmedNonEmptyString.check(Schema.isMaxLength(ASSET_PATH_MAX_LENGTH)),
+    disposition: Schema.optionalKey(Schema.Literals(["inline", "attachment"])),
   }),
   // One file served in place from anywhere the environment host can read:
   // images, videos, HTML, and PDF. An absolute path may lie outside the
@@ -22,12 +23,14 @@ export const AssetResource = Schema.Union([
   Schema.TaggedStruct("media-file", {
     threadId: ThreadId,
     path: TrimmedNonEmptyString.check(Schema.isMaxLength(ASSET_PATH_MAX_LENGTH)),
+    disposition: Schema.optionalKey(Schema.Literals(["inline", "attachment"])),
   }),
   // A workspace file named by a draft that has no thread yet. The draft names
   // its workspace root explicitly instead of resolving one from a thread.
   Schema.TaggedStruct("draft-workspace-file", {
     cwd: TrimmedNonEmptyString.check(Schema.isMaxLength(ASSET_PATH_MAX_LENGTH)),
     path: TrimmedNonEmptyString.check(Schema.isMaxLength(ASSET_PATH_MAX_LENGTH)),
+    disposition: Schema.optionalKey(Schema.Literals(["inline", "attachment"])),
   }),
   Schema.TaggedStruct("attachment", {
     attachmentId: TrimmedNonEmptyString.check(Schema.isMaxLength(256)),
@@ -88,6 +91,9 @@ export const AssetCreateUrlResult = Schema.Struct({
   ),
   /** Pixel size read from the image header, so a client can reserve the exact box before the bytes arrive. */
   imageDimensions: Schema.optional(AssetImageDimensions),
+  /** Cheap mutable-file identity for clients checking whether an Office preview changed. */
+  fileVersion: Schema.optional(TrimmedNonEmptyString.check(Schema.isMaxLength(256))),
+  byteLength: Schema.optional(NonNegativeInt),
 });
 export type AssetCreateUrlResult = typeof AssetCreateUrlResult.Type;
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index dfa29877ec14..ef7308aa695e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -586,7 +586,7 @@ importers:
         version: 4.0.2(patch_hash=595b7d26fb635caba9c3d39fcb189bb78a000192f8d3b60ead7174b310d1ade9)(@types/node@24.12.4)(@vitest/ui@5.0.1)(bufferutil@4.1.0)(effect@4.0.2(patch_hash=ec61ee307eaec3e17f757e0e6a16296ea4b7a8c3188df0c6ec5e66301fd78688))(esbuild@0.28.2)(jiti@2.7.0)(jsdom@30.1.0(@noble/hashes@1.8.0))(msw@2.12.11(@types/node@24.12.4)(typescript@7.0.2))(terser@5.48.0)(typescript@7.0.2)(unrun@0.2.39)(utf-8-validate@6.0.6)(yaml@2.9.0)
       '@pierre/trees':
         specifier: 1.0.0-beta.6
-        version: 1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
+        version: 1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
       '@types/mdast':
         specifier: ^4.0.4
         version: 4.0.4
@@ -596,6 +596,12 @@ importers:
       '@types/react-dom':
         specifier: ~19.2.3
         version: 19.2.3(@types/react@19.3.0)
+      '@types/react-test-renderer':
+        specifier: 19.1.0
+        version: 19.1.0
+      react-test-renderer:
+        specifier: 19.3.0
+        version: 19.3.0(react@19.3.0)
       babel-preset-expo:
         specifier: ~58.0.8
         version: 58.0.8(@babel/core@7.29.7)(@babel/runtime@7.29.7)(expo-widgets@58.0.11)(expo@58.0.2)(react-refresh@0.14.2)
@@ -797,7 +803,7 @@ importers:
         version: 1.5.2(patch_hash=298e94372dbd51846a4e26ece2ecc3e22eb1f94b0450b1f1a9c6fec127809be7)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@pierre/trees':
         specifier: 1.0.0-beta.6
-        version: 1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
+        version: 1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
       '@t3tools/client-runtime':
         specifier: workspace:*
         version: link:../../packages/client-runtime
@@ -879,6 +885,12 @@ importers:
       docx-preview:
         specifier: 0.4.1
         version: 0.4.1
+      fflate:
+        specifier: 0.8.3
+        version: 0.8.3
+      xlsx:
+        specifier: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
+        version: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
       dompurify:
         specifier: ^3.4.16
         version: 3.4.16
@@ -933,9 +945,6 @@ importers:
       unbash:
         specifier: ^5.0.0
         version: 5.0.0
-      xlsx:
-        specifier: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
-        version: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
       zustand:
         specifier: ^5.0.11
         version: 5.0.14(@types/react@19.3.0)(react@19.2.6)(use-sync-external-store@1.6.0(react@19.2.6))
@@ -1894,6 +1903,23 @@ importers:
 
 packages:
 
+  xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz:
+    resolution: {integrity: sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==, tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz}
+    version: 0.20.3
+    engines: {node: '>=0.8'}
+    hasBin: true
+
+  react-test-renderer@19.3.0:
+    resolution: {integrity: sha512-AUxgv+hRbqjRgx4xVwiWL6cvDDKPAva1VWLXQIMoevqQn9us//C5TX9LEnBGH47D0zvJpjwjxb1umzgOMvE8Wg==}
+    peerDependencies:
+      react: ^19.3.0
+
+  react-is@19.3.0:
+    resolution: {integrity: sha512-UpMYezM4v5/18F28aC66AEsjXIgE02kyEMH6yLdgLXu/UTfa1Ntwck/nNLrbqJsEXW7gPb0coNO9FQse9WTovA==}
+
+  docx-preview@0.4.1:
+    resolution: {integrity: sha512-Dv4g+LeE0swHpPvNC0lAT0YsR5Zq5pAxw7d3vHQ8EChBLgIrqqe9VPL5nVt2HBJap8bEZbXUI0TJob7kBeNU9w==}
+
   2g@0.4.4:
     resolution: {integrity: sha512-ZwH02IRQicm+92YzJZMS8imSAJaqTPI+VASb1zMnisotnWcEP4e7nb57Mr8C2dGAA5G8ZmialbMmpkGLWgAY/w==}
     hasBin: true
@@ -8145,9 +8171,6 @@ packages:
   dnssd-advertise@1.1.6:
     resolution: {integrity: sha512-Ndrrf6BMPalkQPd/zubL+4YghH2J9NspapQ09uDXwYbvOPkP0oaqf5CkcwJ0b50kS2O3ul6yVu+jz+RY62Cejg==}
 
-  docx-preview@0.4.1:
-    resolution: {integrity: sha512-Dv4g+LeE0swHpPvNC0lAT0YsR5Zq5pAxw7d3vHQ8EChBLgIrqqe9VPL5nVt2HBJap8bEZbXUI0TJob7kBeNU9w==}
-
   dom-accessibility-api@0.5.16:
     resolution: {integrity: sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==}
 
@@ -8164,9 +8187,6 @@ packages:
   dompurify@3.4.16:
     resolution: {integrity: sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==}
 
-  dompurify@3.4.17:
-    resolution: {integrity: sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==}
-
   domutils@3.2.2:
     resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
 
@@ -12279,12 +12299,6 @@ packages:
     resolution: {integrity: sha512-kCz5k7J7XbJtjABOvkc5lJmkiDh8VhjVCGNiqdKCscmVpdVUpEAyXv1xmCLkQJ5dsHqx3IPO4XW+NTDhU/fatA==}
     engines: {node: '>=10.0.0'}
 
-  xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz:
-    resolution: {integrity: sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==, tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz}
-    version: 0.20.3
-    engines: {node: '>=0.8'}
-    hasBin: true
-
   xml-name-validator@5.0.0:
     resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==}
     engines: {node: '>=18'}
@@ -12432,6 +12446,20 @@ packages:
 
 snapshots:
 
+  xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz: {}
+
+  react-test-renderer@19.3.0(react@19.3.0):
+    dependencies:
+      react: 19.3.0
+      react-is: 19.3.0
+      scheduler: 0.28.0
+
+  react-is@19.3.0: {}
+
+  docx-preview@0.4.1:
+    dependencies:
+      jszip: 3.10.1
+
   2g@0.4.4(typescript@7.0.2):
     optionalDependencies:
       typescript: 7.0.2
@@ -15841,20 +15869,20 @@ snapshots:
 
   '@pierre/theme@2.0.0': {}
 
-  '@pierre/theming@1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
+  '@pierre/theming@1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
     optionalDependencies:
       '@pierre/theme': 1.1.0
-      '@shikijs/themes': 4.2.0
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@shikijs/themes': 4.3.0
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
       shiki: 4.2.0
 
-  '@pierre/theming@1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
+  '@pierre/theming@1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
     optionalDependencies:
       '@pierre/theme': 2.0.0
-      '@shikijs/themes': 4.3.0
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@shikijs/themes': 4.2.0
+      react: 19.3.0
+      react-dom: 19.3.0(react@19.3.0)
       shiki: 4.2.0
 
   '@pierre/theming@1.0.1(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
@@ -15881,25 +15909,25 @@ snapshots:
       react-dom: 19.3.0(react@19.3.0)
       shiki: 4.2.0
 
-  '@pierre/trees@1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
+  '@pierre/trees@1.0.0-beta.6(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
     dependencies:
-      '@pierre/theming': 1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
+      '@pierre/theming': 1.0.0(@pierre/theme@1.1.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
       preact: 11.0.0-beta.0
       preact-render-to-string: 6.6.5(preact@11.0.0-beta.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
     transitivePeerDependencies:
       - '@pierre/theme'
       - '@shikijs/themes'
       - shiki
 
-  '@pierre/trees@1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)':
+  '@pierre/trees@1.0.0-beta.6(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)':
     dependencies:
-      '@pierre/theming': 1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.3.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(shiki@4.2.0)
+      '@pierre/theming': 1.0.0(@pierre/theme@2.0.0)(@shikijs/themes@4.2.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(shiki@4.2.0)
       preact: 11.0.0-beta.0
       preact-render-to-string: 6.6.5(preact@11.0.0-beta.0)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.3.0
+      react-dom: 19.3.0(react@19.3.0)
     transitivePeerDependencies:
       - '@pierre/theme'
       - '@shikijs/themes'
@@ -16325,7 +16353,7 @@ snapshots:
   '@shikijs/types@4.2.0':
     dependencies:
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.5
+      '@types/hast': 3.0.4
 
   '@shikijs/types@4.3.0':
     dependencies:
@@ -18785,10 +18813,6 @@ snapshots:
 
   dnssd-advertise@1.1.6: {}
 
-  docx-preview@0.4.1:
-    dependencies:
-      jszip: 3.10.1
-
   dom-accessibility-api@0.5.16: {}
 
   dom-serializer@2.0.0:
@@ -18807,10 +18831,6 @@ snapshots:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
-  dompurify@3.4.17:
-    optionalDependencies:
-      '@types/trusted-types': 2.0.7
-
   domutils@3.2.2:
     dependencies:
       dom-serializer: 2.0.0
@@ -19615,6 +19635,10 @@ snapshots:
     dependencies:
       walk-up-path: 4.0.0
 
+  fdir@6.5.0(picomatch@4.0.4):
+    optionalDependencies:
+      picomatch: 4.0.4
+
   fdir@6.5.0(picomatch@4.0.7):
     optionalDependencies:
       picomatch: 4.0.7
@@ -20708,7 +20732,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.23
-      dompurify: 3.4.17
+      dompurify: 3.4.16
       es-toolkit: 1.52.0
       fastdom: 1.0.12
       katex: 0.16.47
@@ -22718,7 +22742,7 @@ snapshots:
       '@shikijs/themes': 4.2.0
       '@shikijs/types': 4.2.0
       '@shikijs/vscode-textmate': 10.0.2
-      '@types/hast': 3.0.5
+      '@types/hast': 3.0.4
 
   should-equal@2.0.0:
     dependencies:
@@ -23066,8 +23090,8 @@ snapshots:
 
   tinyglobby@0.2.17:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.7)
-      picomatch: 4.0.7
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
 
   tinypool@2.1.2: {}
 
@@ -23752,8 +23776,6 @@ snapshots:
       simple-plist: 1.3.1
       uuid: 7.0.3
 
-  xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz: {}
-
   xml-name-validator@5.0.0: {}
 
   xml-naming@0.1.0:

From 85dc36ca5276026bdfdd0a2dfa4d1f8847a3391b Mon Sep 17 00:00:00 2001
From: piotrnowakowski <61783713+piotrnowakowski@users.noreply.github.com>
Date: Wed, 14 Oct 2026 00:58:55 +0200
Subject: [PATCH 3/4] perf(files): bound and paginate Excel previews

Excel previews retained every worksheet and could transfer 50 million characters into 25,000 table cells. Read workbook metadata first, inflate only the selected worksheet and required strings/styles, and bound the cell slice before SheetJS materializes it. Preserve sparse C9000 coordinates and formatting, cap retained/serialized text, and send 100-row pages from one selected-sheet cache.

Coalesce obsolete sheet requests, terminate stalled workers, and guard formatting amplification. Focused validation passed 185 tests across 14 files and scoped checks; production-app pagination, source coordinates, switching, cleanup, and resource samples are recorded in the PR evidence.

Model: GPT-6.1-Sol. Harness: Codex desktop.
---
 apps/web/package.json                         |   1 +
 .../files/SpreadsheetPreview.test.tsx         | 159 +++++++
 .../components/files/SpreadsheetPreview.tsx   |  91 +++-
 .../components/files/spreadsheetArchive.ts    | 395 ++++++++++++++++++
 .../files/spreadsheetDocument.test.ts         | 256 ++++++++++--
 .../components/files/spreadsheetDocument.ts   | 102 +++--
 .../files/spreadsheetPreview.worker.test.ts   |  62 +++
 .../files/spreadsheetPreview.worker.ts        |  83 +++-
 .../files/spreadsheetPreviewModel.ts          |  19 +-
 docs/user/composer.md                         |   6 +-
 pnpm-lock.yaml                                |   3 +
 third-party-licenses.config.json              |  21 +
 12 files changed, 1092 insertions(+), 106 deletions(-)
 create mode 100644 apps/web/src/components/files/SpreadsheetPreview.test.tsx
 create mode 100644 apps/web/src/components/files/spreadsheetArchive.ts
 create mode 100644 apps/web/src/components/files/spreadsheetPreview.worker.test.ts

diff --git a/apps/web/package.json b/apps/web/package.json
index 23c264680c9e..2a8e0977b67c 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -70,6 +70,7 @@
     "react-dom": "19.2.6",
     "react-markdown": "^10.1.0",
     "remark-gfm": "catalog:",
+    "saxes": "6.0.0",
     "tailwind-merge": "^3.4.0",
     "unbash": "^5.0.0",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
diff --git a/apps/web/src/components/files/SpreadsheetPreview.test.tsx b/apps/web/src/components/files/SpreadsheetPreview.test.tsx
new file mode 100644
index 000000000000..79d3829832fd
--- /dev/null
+++ b/apps/web/src/components/files/SpreadsheetPreview.test.tsx
@@ -0,0 +1,159 @@
+import { act, type ReactNode } from "react";
+import { create, type ReactTestRenderer } from "react-test-renderer";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+import SpreadsheetPreview from "./SpreadsheetPreview";
+import { spreadsheetTable, spreadsheetWindow } from "./spreadsheetDocument";
+import { utils } from "xlsx";
+import {
+  SPREADSHEET_PREVIEW_TIMEOUT_MS,
+  type SpreadsheetRequest,
+  type SpreadsheetResponse,
+} from "./spreadsheetPreviewModel";
+
+vi.mock("~/components/ui/button", () => ({
+  Button: (props: Record<string, unknown>) => <button {...props} />,
+}));
+vi.mock("./fileSurfaceChrome", () => ({
+  FileSurfaceFailure: ({ message, onRetry }: { message: string; onRetry: () => void }) => (
+    <button onClick={onRetry}>{message}</button>
+  ),
+  FileSurfaceLoading: () => <div>Loading</div>,
+  FileSurfaceNotice: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+}));
+
+class FakeWorker {
+  static current: FakeWorker;
+  messages: SpreadsheetRequest[] = [];
+  terminate = vi.fn();
+  listeners = new Map<string, (event: { data: SpreadsheetResponse }) => void>();
+  constructor() {
+    FakeWorker.current = this;
+  }
+  addEventListener(type: string, listener: (event: { data: SpreadsheetResponse }) => void) {
+    this.listeners.set(type, listener);
+  }
+  postMessage(message: SpreadsheetRequest) {
+    this.messages.push(message);
+  }
+  respond(response: SpreadsheetResponse) {
+    this.listeners.get("message")?.({ data: response });
+  }
+}
+const wb = utils.book_new();
+utils.book_append_sheet(
+  wb,
+  utils.aoa_to_sheet(Array.from({ length: 250 }, (_, r) => [`Row ${r + 1}`])),
+  "Data",
+);
+utils.book_append_sheet(wb, utils.aoa_to_sheet([["Other sheet"]]), "Other");
+const window = spreadsheetWindow(wb, "Data");
+let renderer: ReactTestRenderer | undefined;
+const response = (id: number, page = 0): SpreadsheetResponse => ({
+  id,
+  sheets: ["Data", "Other"],
+  table: spreadsheetTable(window, page),
+});
+const render = async () => {
+  await act(() => {
+    renderer = create(
+      <SpreadsheetPreview bytes={new Uint8Array([1])} name="test.xlsx" onRetry={() => {}} />,
+    );
+  });
+  const worker = FakeWorker.current;
+  await act(() => worker.respond(response(worker.messages[0]!.id)));
+  return worker;
+};
+beforeEach(() => {
+  vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
+  vi.stubGlobal("Worker", FakeWorker);
+  vi.useFakeTimers();
+});
+afterEach(async () => {
+  if (renderer) await act(() => renderer!.unmount());
+  renderer = undefined;
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+});
+describe("spreadsheet lifecycle and pagination", () => {
+  it("keeps the replacement worker's watchdog when an obsolete worker fails", async () => {
+    const previous = await render();
+    await act(() =>
+      renderer!.update(
+        <SpreadsheetPreview
+          bytes={new Uint8Array([2])}
+          name="replacement.xlsx"
+          onRetry={() => {}}
+        />,
+      ),
+    );
+    const current = FakeWorker.current;
+    await act(() =>
+      previous.listeners.get("error")!({ data: { id: -1, error: "Obsolete error" } }),
+    );
+    expect(vi.getTimerCount()).toBe(1);
+    await act(() => vi.advanceTimersByTime(SPREADSHEET_PREVIEW_TIMEOUT_MS));
+    expect(current.terminate).toHaveBeenCalledOnce();
+    expect(JSON.stringify(renderer!.toJSON())).toContain("too long to preview");
+  });
+  it("displays 100 rows and changes to the next page with preserved coordinates", async () => {
+    const worker = await render();
+    expect(renderer!.root.findAllByType("td")).toHaveLength(100);
+    expect(renderer!.root.findAllByType("td")[0]!.children).toEqual(["Row 1"]);
+    await act(() =>
+      renderer!.root
+        .findAllByType("button")
+        .find((b) => b.children.includes("Next page"))!
+        .props.onClick(),
+    );
+    const request = worker.messages.at(-1)!;
+    expect(request).toMatchObject({ type: "page", name: "Data", page: 1 });
+    await act(() => worker.respond(response(request.id, 1)));
+    expect(renderer!.root.findAllByType("td")).toHaveLength(100);
+    expect(renderer!.root.findAllByType("td")[0]!.children).toEqual(["Row 101"]);
+  });
+  it("ignores stale pages and errors after changing the worksheet", async () => {
+    const worker = await render();
+    await act(() =>
+      renderer!.root
+        .findAllByType("button")
+        .find((b) => b.children.includes("Next page"))!
+        .props.onClick(),
+    );
+    const old = worker.messages.at(-1)!;
+    await act(() =>
+      renderer!.root.findByType("select").props.onChange({ target: { value: "Other" } }),
+    );
+    const next = worker.messages.at(-1)!;
+    await act(() => worker.respond({ id: old.id, error: "Stale error" }));
+    await act(() =>
+      worker.respond({
+        id: next.id,
+        sheets: ["Data", "Other"],
+        table: spreadsheetTable(spreadsheetWindow(wb, "Other")),
+      }),
+    );
+    await act(() => worker.respond(response(old.id, 1)));
+    expect(renderer!.root.findAllByType("td")[0]!.children).toEqual(["Other sheet"]);
+    expect(renderer!.root.findByType("select").props.value).toBe("Other");
+  });
+  it("terminates a stalled worker and offers a recoverable failure", async () => {
+    await act(() => {
+      renderer = create(
+        <SpreadsheetPreview bytes={new Uint8Array([1])} name="test.xlsx" onRetry={() => {}} />,
+      );
+    });
+    const worker = FakeWorker.current;
+    await act(() => vi.advanceTimersByTime(SPREADSHEET_PREVIEW_TIMEOUT_MS));
+    expect(worker.terminate).toHaveBeenCalledOnce();
+    expect(JSON.stringify(renderer!.toJSON())).toContain("too long to preview");
+    await act(() => worker.respond(response(worker.messages[0]!.id)));
+    expect(JSON.stringify(renderer!.toJSON())).toContain("too long to preview");
+  });
+  it("clears the watchdog and releases the worker when closed", async () => {
+    const worker = await render();
+    await act(() => renderer!.unmount());
+    renderer = undefined;
+    expect(worker.terminate).toHaveBeenCalledOnce();
+    expect(vi.getTimerCount()).toBe(0);
+  });
+});
diff --git a/apps/web/src/components/files/SpreadsheetPreview.tsx b/apps/web/src/components/files/SpreadsheetPreview.tsx
index 288efa78fec9..936b81dcf76e 100644
--- a/apps/web/src/components/files/SpreadsheetPreview.tsx
+++ b/apps/web/src/components/files/SpreadsheetPreview.tsx
@@ -1,10 +1,12 @@
 /* oxlint-disable react/no-array-index-key -- Spreadsheet coordinates are stable, including blank cells. */
-import { useEffect, useId, useRef, useState } from "react";
+import { useCallback, useEffect, useId, useRef, useState } from "react";
+import { Button } from "~/components/ui/button";
 import { FileSurfaceFailure, FileSurfaceLoading, FileSurfaceNotice } from "./fileSurfaceChrome";
 import {
   SPREADSHEET_PREVIEW_COLUMNS,
   SPREADSHEET_PREVIEW_ROWS,
   SPREADSHEET_PREVIEW_CELL_CHARACTERS,
+  SPREADSHEET_PREVIEW_TIMEOUT_MS,
   type SpreadsheetRequest,
   type SpreadsheetResponse,
   type SpreadsheetTable,
@@ -16,12 +18,35 @@ export default function SpreadsheetPreview(props: {
   readonly onRetry: () => void;
 }) {
   const workerRef = useRef<Worker | null>(null);
+  const scrollRef = useRef<HTMLDivElement | null>(null);
   const worksheetId = useId();
-  const selectedRef = useRef<string | null>(null);
+  const requestId = useRef(0);
+  const watchdog = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
   const [sheets, setSheets] = useState<string[]>([]);
   const [table, setTable] = useState<SpreadsheetTable | null>(null);
   const [selected, setSelected] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(true);
+  const startWatchdog = useCallback(() => {
+    clearTimeout(watchdog.current);
+    watchdog.current = setTimeout(() => {
+      workerRef.current?.terminate();
+      workerRef.current = null;
+      requestId.current++;
+      setPending(false);
+      setError("This worksheet took too long to preview. Save it to open it in another app.");
+    }, SPREADSHEET_PREVIEW_TIMEOUT_MS);
+  }, []);
+  const request = (
+    message: { type: "sheet"; name: string } | { type: "page"; name: string; page: number },
+  ) => {
+    setPending(true);
+    startWatchdog();
+    workerRef.current?.postMessage({
+      ...message,
+      id: ++requestId.current,
+    } satisfies SpreadsheetRequest);
+  };
   useEffect(() => {
     // Parsing stays off the chat renderer's main thread. A private copy also survives StrictMode's remount.
     const worker = new Worker(new URL("./spreadsheetPreview.worker.ts", import.meta.url), {
@@ -29,28 +54,41 @@ export default function SpreadsheetPreview(props: {
     });
     workerRef.current = worker;
     worker.addEventListener("message", (event: MessageEvent<SpreadsheetResponse>) => {
+      if (event.data.id !== requestId.current) return;
+      clearTimeout(watchdog.current);
+      setPending(false);
       if ("error" in event.data) {
         setError(event.data.error);
         return;
       }
       const response = event.data;
-      if (selectedRef.current !== null && response.table.name !== selectedRef.current) return;
-      selectedRef.current = response.table.name;
+      setError(null);
       setSheets(response.sheets);
       setSelected(response.table.name);
       setTable(response.table);
+      scrollRef.current?.scrollTo({ top: 0 });
+    });
+    worker.addEventListener("error", () => {
+      if (workerRef.current !== worker) return;
+      clearTimeout(watchdog.current);
+      worker.terminate();
+      workerRef.current = null;
+      setPending(false);
+      setError("Could not render this workbook. Save it to open it in another app.");
     });
-    worker.addEventListener("error", () =>
-      setError("Could not render this workbook. Save it to open it in another app."),
-    );
     const bytes = props.bytes.slice();
-    worker.postMessage({ type: "load", bytes } satisfies SpreadsheetRequest, [bytes.buffer]);
+    startWatchdog();
+    worker.postMessage(
+      { type: "load", id: ++requestId.current, bytes } satisfies SpreadsheetRequest,
+      [bytes.buffer],
+    );
     return () => {
+      clearTimeout(watchdog.current);
       worker.terminate();
       workerRef.current = null;
-      selectedRef.current = null;
+      requestId.current++;
     };
-  }, [props.bytes]);
+  }, [props.bytes, startWatchdog]);
   if (error !== null) return <FileSurfaceFailure message={error} onRetry={props.onRetry} />;
   return (
     <div className="flex min-h-0 flex-1 flex-col">
@@ -64,10 +102,9 @@ export default function SpreadsheetPreview(props: {
             className="min-w-0 flex-1 rounded border bg-background px-2 py-1"
             onChange={(event) => {
               const name = event.target.value;
-              selectedRef.current = name;
               setSelected(name);
               setTable(null);
-              workerRef.current?.postMessage({ type: "sheet", name } satisfies SpreadsheetRequest);
+              request({ type: "sheet", name });
             }}
           >
             {sheets.map((name) => (
@@ -89,9 +126,13 @@ export default function SpreadsheetPreview(props: {
               Preview limited to {SPREADSHEET_PREVIEW_ROWS} rows and {SPREADSHEET_PREVIEW_COLUMNS}{" "}
               columns, with {SPREADSHEET_PREVIEW_CELL_CHARACTERS.toLocaleString()} characters per
               cell. Save the workbook to view the rest.
+              {table.contentLimited ? " The preview's total content budget was reached." : ""}
             </FileSurfaceNotice>
           ) : null}
-          <div className="min-h-0 flex-1 overflow-auto [scrollbar-gutter:stable_both-edges]">
+          <div
+            ref={scrollRef}
+            className="min-h-0 flex-1 overflow-auto [scrollbar-gutter:stable_both-edges]"
+          >
             <table
               className="min-w-full border-separate border-spacing-0 text-xs"
               aria-label={`${props.name}: ${table.name}`}
@@ -128,6 +169,30 @@ export default function SpreadsheetPreview(props: {
               </tbody>
             </table>
           </div>
+          {table.pageCount > 1 ? (
+            <div className="flex shrink-0 items-center justify-between gap-2 border-t px-3 py-2 text-xs">
+              <Button
+                variant="outline"
+                size="sm"
+                disabled={pending || table.page === 0}
+                onClick={() => request({ type: "page", name: table.name, page: table.page - 1 })}
+              >
+                Previous page
+              </Button>
+              <span role="status">
+                Page {table.page + 1} of {table.pageCount} · Rows {table.rows[0]?.number}–
+                {table.rows.at(-1)?.number}
+              </span>
+              <Button
+                variant="outline"
+                size="sm"
+                disabled={pending || table.page + 1 >= table.pageCount}
+                onClick={() => request({ type: "page", name: table.name, page: table.page + 1 })}
+              >
+                Next page
+              </Button>
+            </div>
+          ) : null}
         </>
       )}
     </div>
diff --git a/apps/web/src/components/files/spreadsheetArchive.ts b/apps/web/src/components/files/spreadsheetArchive.ts
new file mode 100644
index 000000000000..d9e74850354a
--- /dev/null
+++ b/apps/web/src/components/files/spreadsheetArchive.ts
@@ -0,0 +1,395 @@
+import JSZip from "jszip";
+import { zipSync } from "fflate";
+import { SaxesParser, type SaxesTagNS } from "saxes";
+import { read, utils } from "xlsx";
+import { validateOfficeArchive } from "./officeArchive";
+import { SPREADSHEET_PREVIEW_COLUMNS, SPREADSHEET_PREVIEW_ROWS } from "./spreadsheetPreviewModel";
+
+const XML_BYTES = 24 * 1024 * 1024;
+const PART_BYTES = 2 * 1024 * 1024;
+const SLICE_CHARACTERS = 2 * 1024 * 1024;
+const complex = () => {
+  throw new Error("This worksheet is too complex to preview. Save it to open it in another app.");
+};
+const invalid = () => {
+  throw new Error(
+    "This workbook contains an unsupported worksheet. Save it to open it in another app.",
+  );
+};
+function parser() {
+  const sax = new SaxesParser({ xmlns: true });
+  sax.on("doctype", invalid);
+  return sax;
+}
+function escapeXml(value: string) {
+  return value.replace(
+    /[&<>"']/g,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[char]!,
+  );
+}
+function opening(tag: SaxesTagNS) {
+  return `<${tag.name}${Object.values(tag.attributes)
+    .map((a) => ` ${a.name}="${escapeXml(a.value)}"`)
+    .join("")}>`;
+}
+function scan(xml: string, onOpen: (tag: SaxesTagNS) => void) {
+  const sax = parser();
+  sax.on("opentag", onOpen);
+  sax.write(xml).close();
+}
+
+/** Walk cells without materializing their values, including sheets whose first cell is C9000. */
+function cells(
+  xml: string,
+  visit: (
+    cell: { r: number; c: number },
+    tag: SaxesTagNS,
+    sax: SaxesParser<{ xmlns: true }>,
+  ) => void,
+) {
+  const sax = parser();
+  let row = -1;
+  let column = -1;
+  let inData = false;
+  let root = "";
+  let rootName = "worksheet";
+  let data = "";
+  let dataName = "sheetData";
+  let rowStart = -1;
+  let actualRow: number | undefined;
+  let firstRow = Infinity;
+  const spans = new Map<number, { start: number; end: number }>();
+  sax.on("opentag", (tag) => {
+    if (!root) {
+      root = opening(tag);
+      rootName = tag.name;
+    }
+    if (tag.local === "sheetData") {
+      inData = true;
+      data = opening(tag);
+      dataName = tag.name;
+    }
+    if (!inData) return;
+    if (tag.local === "row") {
+      row = tag.attributes.r ? Number(tag.attributes.r.value) - 1 : row + 1;
+      column = -1;
+      actualRow = undefined;
+      rowStart = xml.lastIndexOf("<", sax.position - 1);
+    }
+    if (tag.local !== "c") return;
+    const reference = tag.attributes.r?.value;
+    if (reference && !/^[A-Z]{1,3}[1-9]\d{0,6}$/.test(reference)) return invalid();
+    const coord = reference ? utils.decode_cell(reference) : { r: row, c: column + 1 };
+    if (
+      !Number.isInteger(coord.r) ||
+      !Number.isInteger(coord.c) ||
+      coord.r < 0 ||
+      coord.r >= 1048576 ||
+      coord.c < 0 ||
+      coord.c >= 16384
+    )
+      return invalid();
+    if (actualRow !== undefined && actualRow !== coord.r) return invalid();
+    actualRow = coord.r;
+    if (coord.r < firstRow) {
+      firstRow = coord.r;
+      for (const retained of spans.keys())
+        if (retained >= firstRow + SPREADSHEET_PREVIEW_ROWS) spans.delete(retained);
+    }
+    column = coord.c;
+    visit(coord, tag, sax);
+  });
+  sax.on("closetag", (tag) => {
+    if (
+      tag.local === "row" &&
+      actualRow !== undefined &&
+      actualRow < firstRow + SPREADSHEET_PREVIEW_ROWS
+    )
+      spans.set(actualRow, { start: rowStart, end: sax.position });
+    if (tag.local === "sheetData") inData = false;
+  });
+  sax.write(xml).close();
+  // The second pass sees only the bounded row window, rather than scanning every cell twice.
+  return `${root}${data || "<sheetData>"}${Array.from(spans.values())
+    .map((span) => xml.slice(span.start, span.end))
+    .join("")}</${dataName}></${rootName}>`;
+}
+
+function worksheetSlice(xml: string) {
+  let range: ReturnType<typeof utils.decode_range> | undefined;
+  xml = cells(xml, (coord) => {
+    if (!range) range = { s: { ...coord }, e: { ...coord } };
+    range.s.r = Math.min(range.s.r, coord.r);
+    range.s.c = Math.min(range.s.c, coord.c);
+    range.e.r = Math.max(range.e.r, coord.r);
+    range.e.c = Math.max(range.e.c, coord.c);
+  });
+  const fullRange = range;
+  const sax = parser();
+  let root = "";
+  let rootName = "worksheet";
+  let dataName = "sheetData";
+  let dataOpen = "<sheetData>";
+  let rowOpen = "";
+  let rowName = "row";
+  let rowNumber = -1;
+  let column = -1;
+  let start = -1;
+  let coordinate = "";
+  let shared = false;
+  let style = 0;
+  let inData = false;
+  let length = 0;
+  let limited = false;
+  const rows: string[] = [];
+  let rowCells: string[] = [];
+  const sharedIds = new Map<number, number>();
+  const styleIds = new Set<number>();
+  sax.on("opentag", (tag) => {
+    if (!root) {
+      root = opening(tag);
+      rootName = tag.name;
+    }
+    if (tag.local === "sheetData") {
+      inData = true;
+      dataName = tag.name;
+      dataOpen = opening(tag);
+    }
+    if (!inData) return;
+    if (tag.local === "row") {
+      rowNumber = tag.attributes.r ? Number(tag.attributes.r.value) - 1 : rowNumber + 1;
+      column = -1;
+      rowOpen = opening(tag);
+      rowName = tag.name;
+      rowCells = [];
+    }
+    if (tag.local !== "c" || !fullRange) return;
+    const ref = tag.attributes.r?.value;
+    const coord = ref ? utils.decode_cell(ref) : { r: rowNumber, c: column + 1 };
+    column = coord.c;
+    if (
+      coord.r >= fullRange.s.r + SPREADSHEET_PREVIEW_ROWS ||
+      coord.c >= fullRange.s.c + SPREADSHEET_PREVIEW_COLUMNS ||
+      limited
+    )
+      return;
+    coordinate = utils.encode_cell(coord);
+    start = xml.lastIndexOf("<", sax.position - 1);
+    shared = tag.attributes.t?.value === "s";
+    style = Number(tag.attributes.s?.value ?? 0);
+    if (!Number.isSafeInteger(style) || style < 0) return invalid();
+  });
+  sax.on("closetag", (tag) => {
+    if (tag.local === "c" && start >= 0) {
+      let cell = xml.slice(start, sax.position);
+      start = -1;
+      if (cell.length > 16 * 1024 || length + cell.length > SLICE_CHARACTERS) {
+        if (length === 0) return complex();
+        limited = true;
+        return;
+      }
+      // Restore implicit coordinates when omitted in the source before passing the slice to SheetJS.
+      if (!/\br\s*=/.test(cell.slice(0, cell.indexOf(">"))))
+        cell = cell.replace(/^<([^\s>]+)/, `<$1 r="${coordinate}"`);
+      if (shared) {
+        cell = cell.replace(
+          /(<(?:[\w.-]+:)?v\b[^>]*>)([^<]*)(<\/(?:[\w.-]+:)?v>)/,
+          (_, open: string, text: string, close: string) => {
+            const id = Number(text);
+            if (!Number.isSafeInteger(id) || id < 0) return invalid();
+            if (!sharedIds.has(id)) sharedIds.set(id, sharedIds.size);
+            return `${open}${sharedIds.get(id)}${close}`;
+          },
+        );
+      }
+      length += cell.length;
+      styleIds.add(style);
+      rowCells.push(cell);
+    }
+    if (tag.local === "row" && rowCells.length)
+      rows.push(`${rowOpen}${rowCells.join("")}</${rowName}>`);
+    if (tag.local === "sheetData") inData = false;
+  });
+  sax.write(xml).close();
+  return {
+    xml: `${root}${dataOpen}${rows.join("")}</${dataName}></${rootName}>`,
+    range: fullRange,
+    sharedIds,
+    styleIds,
+    limited,
+  };
+}
+
+function sharedStringSlice(xml: string, needed: Map<number, number>) {
+  const sax = parser();
+  let root = "";
+  let rootName = "sst";
+  let index = -1;
+  let start = -1;
+  let length = 0;
+  const entries = Array<string>(needed.size);
+  sax.on("opentag", (tag) => {
+    if (!root) {
+      root = opening(tag);
+      rootName = tag.name;
+    }
+    if (tag.local === "si") {
+      index++;
+      if (needed.has(index)) start = xml.lastIndexOf("<", sax.position - 1);
+    }
+  });
+  sax.on("closetag", (tag) => {
+    if (tag.local !== "si" || start < 0) return;
+    const entry = xml.slice(start, sax.position);
+    start = -1;
+    if ((length += entry.length) > SLICE_CHARACTERS || entry.length > 16 * 1024) return complex();
+    entries[needed.get(index)!] = entry;
+  });
+  sax.write(xml).close();
+  if (entries.filter(Boolean).length !== needed.size) return invalid();
+  // Counts describe the filtered dictionary, not the source workbook's full shared-string table.
+  root = root.replace(/\s(?:uniqueCount|count)="[^"]*"/g, "");
+  return `${root} count="${entries.length}" uniqueCount="${entries.length}">${entries.join("")}</${rootName}>`.replace(
+    /> count=/,
+    " count=",
+  );
+}
+
+/** Keep the compressed archive; inflate metadata and the selected worksheet only. */
+export async function openSpreadsheetDocument(bytes: Uint8Array) {
+  const sizes = new Map(
+    validateOfficeArchive(bytes, "xlsx").map((entry) => [entry.name, entry.size]),
+  );
+  const zip = await JSZip.loadAsync(bytes);
+  const part = async (name: string, max: number) => {
+    const file = zip.file(name);
+    if (!file) return invalid();
+    if ((sizes.get(name) ?? Infinity) > max) return complex();
+    return file.async("string");
+  };
+  const workbookXml = await part("xl/workbook.xml", PART_BYTES);
+  const relationships = await part("xl/_rels/workbook.xml.rels", PART_BYTES);
+  const contentTypes = await part("[Content_Types].xml", PART_BYTES);
+  const targets = new Map<string, string>();
+  const optionalParts = new Map<string, string>();
+  scan(relationships, (tag) => {
+    if (tag.local !== "Relationship" || tag.attributes.TargetMode?.value === "External") return;
+    const id = tag.attributes.Id?.value;
+    const target = tag.attributes.Target?.value;
+    const type = tag.attributes.Type?.value;
+    if (!id || !target || target.includes("\\") || target.includes(":")) return;
+    const pieces = (target.startsWith("/") ? target.slice(1) : `xl/${target}`).split("/");
+    const normalized: string[] = [];
+    for (const piece of pieces) {
+      if (piece === "..") normalized.pop();
+      else if (piece && piece !== ".") normalized.push(piece);
+    }
+    const name = normalized.join("/");
+    targets.set(id, name);
+    if (type?.endsWith("/styles")) optionalParts.set("styles", name);
+    if (type?.endsWith("/sharedStrings")) optionalParts.set("sharedStrings", name);
+  });
+  const sheets: { name: string; path: string }[] = [];
+  scan(workbookXml, (tag) => {
+    if (tag.local !== "sheet" || (tag.attributes.state && tag.attributes.state.value !== "visible"))
+      return;
+    const name = tag.attributes.name?.value;
+    const id = Object.values(tag.attributes).find((a) => a.local === "id")?.value;
+    const path = id === undefined ? undefined : targets.get(id);
+    if (
+      !name ||
+      name.length > 31 ||
+      !path ||
+      sheets.length >= 512 ||
+      sheets.some((s) => s.name === name)
+    )
+      return invalid();
+    sheets.push({ name, path });
+  });
+  if (!sheets.length) throw new Error("This workbook has no visible worksheets.");
+  return {
+    sheets: sheets.map((s) => s.name),
+    readSheet: async (name: string, signal?: AbortSignal) => {
+      const currentPart = async (path: string, max: number) => {
+        signal?.throwIfAborted();
+        const xml = await part(path, max);
+        signal?.throwIfAborted();
+        return xml;
+      };
+      const sheet = sheets.find((s) => s.name === name);
+      if (!sheet) throw new Error("This worksheet is unavailable.");
+      const slice = worksheetSlice(await currentPart(sheet.path, XML_BYTES));
+      const files: Record<string, Uint8Array> = {};
+      const encoder = new TextEncoder();
+      files["xl/workbook.xml"] = encoder.encode(workbookXml);
+      files["xl/_rels/workbook.xml.rels"] = encoder.encode(relationships);
+      files[sheet.path] = encoder.encode(slice.xml);
+      const stylePath = optionalParts.get("styles");
+      if (stylePath) {
+        const styles = await currentPart(stylePath, PART_BYTES);
+        let formats = 0;
+        let inCellFormats = false;
+        let index = 0;
+        const codes = new Map<number, string>();
+        const usedFormats = new Set<number>();
+        const sax = parser();
+        sax.on("opentag", (tag) => {
+          if (tag.local === "numFmt")
+            codes.set(
+              Number(tag.attributes.numFmtId?.value),
+              tag.attributes.formatCode?.value ?? "",
+            );
+          if (tag.local === "cellXfs") inCellFormats = true;
+          if (tag.local === "xf" && ++formats > 16384) return complex();
+          if (tag.local === "xf" && inCellFormats) {
+            if (slice.styleIds.has(index))
+              usedFormats.add(Number(tag.attributes.numFmtId?.value ?? 0));
+            index++;
+          }
+        });
+        sax.on("closetag", (tag) => {
+          if (tag.local === "cellXfs") inCellFormats = false;
+        });
+        sax.write(styles).close();
+        // Only formats used by this slice can amplify its values; unused catalogs stay harmless.
+        for (const id of usedFormats) if ((codes.get(id)?.length ?? 0) > 1024) return complex();
+        files[stylePath] = encoder.encode(styles);
+      }
+      if (slice.sharedIds.size) {
+        const stringPath = optionalParts.get("sharedStrings");
+        if (!stringPath) return invalid();
+        files[stringPath] = encoder.encode(
+          sharedStringSlice(await currentPart(stringPath, XML_BYTES), slice.sharedIds),
+        );
+      }
+      let typesRoot = "";
+      let typesName = "Types";
+      const types: string[] = [];
+      scan(contentTypes, (tag) => {
+        if (!typesRoot) {
+          typesRoot = opening(tag);
+          typesName = tag.name;
+          return;
+        }
+        if (
+          tag.local === "Default" ||
+          (tag.local === "Override" &&
+            files[tag.attributes.PartName?.value.replace(/^\//, "") ?? ""])
+        )
+          types.push(`${opening(tag).slice(0, -1)}/>`);
+      });
+      files["[Content_Types].xml"] = encoder.encode(`${typesRoot}${types.join("")}</${typesName}>`);
+      // SheetJS sees a small package with one bounded cell slice and its required strings/styles.
+      const workbook = read(zipSync(files, { level: 0 }), {
+        type: "array",
+        sheets: name,
+        cellHTML: false,
+        cellFormula: true,
+        sheetStubs: true,
+      });
+      if (slice.range && workbook.Sheets[name])
+        workbook.Sheets[name]["!fullref"] = utils.encode_range(slice.range);
+      return { workbook, limited: slice.limited };
+    },
+  };
+}
diff --git a/apps/web/src/components/files/spreadsheetDocument.test.ts b/apps/web/src/components/files/spreadsheetDocument.test.ts
index acc2142cf9e0..7ced8c11d7f9 100644
--- a/apps/web/src/components/files/spreadsheetDocument.test.ts
+++ b/apps/web/src/components/files/spreadsheetDocument.test.ts
@@ -1,20 +1,210 @@
 import JSZip from "jszip";
 import { utils, write, type WorkBook } from "xlsx";
 import { describe, expect, it } from "vite-plus/test";
+import { openSpreadsheetDocument } from "./spreadsheetArchive";
+import { spreadsheetTable, spreadsheetWindow } from "./spreadsheetDocument";
 import {
-  readSpreadsheetDocument,
-  spreadsheetTable,
-  visibleSpreadsheetSheets,
-} from "./spreadsheetDocument";
-import { SPREADSHEET_PREVIEW_ROWS, SPREADSHEET_PREVIEW_COLUMNS } from "./spreadsheetPreviewModel";
+  SPREADSHEET_PREVIEW_ROWS,
+  SPREADSHEET_PREVIEW_COLUMNS,
+  SPREADSHEET_PREVIEW_TEXT_CHARACTERS,
+  SPREADSHEET_PREVIEW_PAYLOAD_BYTES,
+} from "./spreadsheetPreviewModel";
 
 function roundTrip(workbook: WorkBook) {
-  return readSpreadsheetDocument(
+  return openSpreadsheetDocument(
     new Uint8Array(write(workbook, { type: "array", bookType: "xlsx" })),
   );
 }
+const table = (workbook: WorkBook, name: string, page = 0) =>
+  spreadsheetTable(spreadsheetWindow(workbook, name), page);
 
 describe("read-only Excel preview", () => {
+  it("offers a complexity fallback instead of claiming an oversized first cell is empty", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([["x".repeat(20000)]]), "Oversized cell");
+    const doc = await roundTrip(wb);
+    await expect(doc.readSheet("Oversized cell")).rejects.toThrow("too complex");
+  });
+  it("allows unused large formats belonging to another worksheet", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([[1]]), "Normal");
+    const styled = utils.aoa_to_sheet([[1]]);
+    styled.A1!.z = `"${"x".repeat(1500)}"`;
+    utils.book_append_sheet(wb, styled, "Large format");
+    const doc = await roundTrip(wb);
+    expect(table((await doc.readSheet("Normal")).workbook, "Normal").rows[0]?.cells).toEqual(["1"]);
+    await expect(doc.readSheet("Large format")).rejects.toThrow("too complex");
+  });
+  it("bounds custom formats before they can amplify every numeric cell", async () => {
+    const wb = utils.book_new();
+    const sheet = utils.aoa_to_sheet([[1]]);
+    sheet.A1!.z = `"${"x".repeat(1500)}"`;
+    utils.book_append_sheet(wb, sheet, "Format");
+    const doc = await roundTrip(wb);
+    await expect(doc.readSheet("Format")).rejects.toThrow("too complex");
+  });
+  it("cancels an obsolete worksheet before inflating its XML", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([["Cancelled"]]), "Data");
+    const doc = await roundTrip(wb);
+    const controller = new AbortController();
+    controller.abort();
+    await expect(doc.readSheet("Data", controller.signal)).rejects.toMatchObject({
+      name: "AbortError",
+    });
+  });
+  it("preserves date formats and the 1904 date system", async () => {
+    const wb = utils.book_new();
+    const sheet = utils.aoa_to_sheet([[1]]);
+    sheet.A1!.z = "yyyy-mm-dd";
+    utils.book_append_sheet(wb, sheet, "Dates");
+    wb.Workbook = { WBProps: { date1904: true } };
+    const doc = await roundTrip(wb);
+    expect(table((await doc.readSheet("Dates")).workbook, "Dates").rows[0]?.cells).toEqual([
+      "1904-01-02",
+    ]);
+  });
+  it("rejects worksheet XML over the parse budget before constructing cells", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([["Small"]]), "Large XML");
+    const zip = await JSZip.loadAsync(write(wb, { type: "array", bookType: "xlsx" }));
+    zip.file("xl/worksheets/sheet1.xml", " ".repeat(24 * 1024 * 1024 + 1));
+    const doc = await openSpreadsheetDocument(
+      await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" }),
+    );
+    await expect(doc.readSheet("Large XML")).rejects.toThrow("too complex");
+  });
+  it("keeps prefixed worksheet tags and implicit cell coordinates", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([["😀 Łódź", "Second"]]), "Prefix");
+    const zip = await JSZip.loadAsync(write(wb, { type: "array", bookType: "xlsx" }));
+    let xml = await zip.file("xl/worksheets/sheet1.xml")!.async("string");
+    xml = xml
+      .replace(/xmlns="([^"]*)"/, 'xmlns:x="$1"')
+      .replace(
+        /<(\/?)(worksheet|dimension|sheetViews|sheetView|sheetFormatPr|sheetData|row|c|v|is|t|ignoredErrors|ignoredError)\b/g,
+        "<$1x:$2",
+      )
+      .replace(/ r="[AB]1"/g, "");
+    zip.file("xl/worksheets/sheet1.xml", xml);
+    const doc = await openSpreadsheetDocument(await zip.generateAsync({ type: "uint8array" }));
+    expect(table((await doc.readSheet("Prefix")).workbook, "Prefix").rows[0]?.cells).toEqual([
+      "😀 Łódź",
+      "Second",
+    ]);
+  });
+  it("parses only the selected sheet and ignores malformed unselected/hidden worksheets", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([["Selected"]]), "First");
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([["Unused"]]), "Other");
+    utils.book_append_sheet(wb, utils.aoa_to_sheet([["Hidden"]]), "Hidden");
+    wb.Workbook = {
+      Sheets: [
+        { name: "First", Hidden: 0 },
+        { name: "Other", Hidden: 0 },
+        { name: "Hidden", Hidden: 1 },
+      ],
+    };
+    const zip = await JSZip.loadAsync(write(wb, { type: "array", bookType: "xlsx" }));
+    zip.file("xl/worksheets/sheet2.xml", "<malformed>");
+    zip.file("xl/worksheets/sheet3.xml", "<malformed>");
+    const doc = await openSpreadsheetDocument(await zip.generateAsync({ type: "uint8array" }));
+    expect(doc.sheets).toEqual(["First", "Other"]);
+    const result = await doc.readSheet("First");
+    expect(Object.keys(result.workbook.Sheets)).toEqual(["First"]);
+    expect(table(result.workbook, "First").rows[0]?.cells).toEqual(["Selected"]);
+    await expect(doc.readSheet("Other")).rejects.toThrow();
+    await expect(doc.readSheet("Hidden")).rejects.toThrow("unavailable");
+  });
+  it("bounds parsed cells before SheetJS and paginates the selected window", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(
+      wb,
+      utils.aoa_to_sheet(
+        Array.from({ length: 650 }, (_, r) =>
+          Array.from({ length: 60 }, (_, c) => `${r + 1}:${c + 1}`),
+        ),
+      ),
+      "Data",
+    );
+    const doc = await roundTrip(wb);
+    const result = await doc.readSheet("Data");
+    expect(
+      Object.keys(result.workbook.Sheets.Data!).filter((key) => !key.startsWith("!")),
+    ).toHaveLength(500 * 50);
+    const window = spreadsheetWindow(result.workbook, "Data");
+    expect(spreadsheetTable(window).rows).toHaveLength(100);
+    expect(spreadsheetTable(window, 1).rows[0]?.number).toBe(101);
+    expect(spreadsheetTable(window, 4).rows.at(-1)?.number).toBe(500);
+    expect(spreadsheetTable(window).truncated).toBe(true);
+    expect(() => spreadsheetTable(window, 5)).toThrow("unavailable");
+  });
+  it("caps aggregate long shared-string content and serialized output", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(
+      wb,
+      utils.aoa_to_sheet(Array.from({ length: 500 }, () => Array(50).fill("x".repeat(2000)))),
+      "Long",
+    );
+    const doc = await openSpreadsheetDocument(
+      new Uint8Array(
+        write(wb, { type: "array", bookType: "xlsx", bookSST: true, compression: true }),
+      ),
+    );
+    const { workbook } = await doc.readSheet("Long");
+    const window = spreadsheetWindow(workbook, "Long");
+    expect(
+      window.rows.reduce((n, r) => n + r.cells.reduce((s, c) => s + c.length, 0), 0),
+    ).toBeLessThanOrEqual(SPREADSHEET_PREVIEW_TEXT_CHARACTERS);
+    expect(window.contentLimited).toBe(true);
+    expect(window.truncated).toBe(true);
+    const response = { id: 1, sheets: doc.sheets, table: spreadsheetTable(window) };
+    expect(new TextEncoder().encode(JSON.stringify(response)).length).toBeLessThan(
+      SPREADSHEET_PREVIEW_PAYLOAD_BYTES,
+    );
+  });
+  it("applies the serialization budget to escaping-heavy text", () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(
+      wb,
+      utils.aoa_to_sheet(Array.from({ length: 500 }, () => Array(50).fill("\u0001".repeat(2000)))),
+      "Escape",
+    );
+    const window = spreadsheetWindow(wb, "Escape");
+    expect(window.contentLimited).toBe(true);
+    expect(
+      new TextEncoder().encode(
+        JSON.stringify({ id: 1, sheets: ["Escape"], table: spreadsheetTable(window) }),
+      ).length,
+    ).toBeLessThan(SPREADSHEET_PREVIEW_PAYLOAD_BYTES);
+  });
+  it("prunes and remaps shared strings while preserving rich text and C9000 despite an A1 dimension", async () => {
+    const wb = utils.book_new();
+    utils.book_append_sheet(
+      wb,
+      { C9000: { t: "s", v: "Needed" }, "!ref": "C9000:C9000" },
+      "Sparse",
+    );
+    const zip = await JSZip.loadAsync(
+      write(wb, { type: "array", bookType: "xlsx", bookSST: true }),
+    );
+    zip.file(
+      "xl/sharedStrings.xml",
+      '<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="2" uniqueCount="2"><si><t>Unused</t></si><si><r><t>Łódź </t></r><r><t>&amp; legal</t></r></si></sst>',
+    );
+    const xml = await zip.file("xl/worksheets/sheet1.xml")!.async("string");
+    zip.file(
+      "xl/worksheets/sheet1.xml",
+      xml
+        .replace('<dimension ref="C9000"', '<dimension ref="A1:C9000"')
+        .replace("<v>0</v>", "<v>1</v>"),
+    );
+    const doc = await openSpreadsheetDocument(await zip.generateAsync({ type: "uint8array" }));
+    const result = await doc.readSheet("Sparse");
+    expect(table(result.workbook, "Sparse").rows).toEqual([
+      { number: 9000, cells: ["Łódź & legal"] },
+    ]);
+  });
   it("shows formulas whose OOXML value element is empty rather than dropping the cell", async () => {
     const workbook = utils.book_new();
     utils.book_append_sheet(workbook, utils.aoa_to_sheet([[123]]), "Formula");
@@ -28,10 +218,12 @@ describe("read-only Excel preview", () => {
         '<c r="A1"><f>SUM(1,2,3)</f><v></v></c>',
       ),
     );
-    const decoded = readSpreadsheetDocument(await zip.generateAsync({ type: "uint8array" }));
-    expect(spreadsheetTable(decoded, "Formula").rows[0]?.cells).toEqual(["=SUM(1,2,3)"]);
+    const decoded = await openSpreadsheetDocument(await zip.generateAsync({ type: "uint8array" }));
+    expect(table((await decoded.readSheet("Formula")).workbook, "Formula").rows[0]?.cells).toEqual([
+      "=SUM(1,2,3)",
+    ]);
   });
-  it("reads multiple sheets, saved formula results, number formats, Unicode and literal markup", () => {
+  it("reads multiple sheets, saved formula results, number formats, Unicode and literal markup", async () => {
     const workbook = utils.book_new();
     const sheet = utils.aoa_to_sheet([
       ["Firm", "Revenue", "Total", "Missing result"],
@@ -42,19 +234,21 @@ describe("read-only Excel preview", () => {
     sheet.D2 = { t: "n", f: "SUM(1,2)" };
     utils.book_append_sheet(workbook, sheet, "Prospects");
     utils.book_append_sheet(workbook, utils.aoa_to_sheet([["Another sheet"]]), "Notes");
-    const decoded = roundTrip(workbook);
-    expect(visibleSpreadsheetSheets(decoded)).toEqual(["Prospects", "Notes"]);
-    const table = spreadsheetTable(decoded, "Prospects");
-    expect(table.columns).toEqual(["A", "B", "C", "D"]);
-    expect(table.rows[1]?.cells).toEqual([
+    const decoded = await roundTrip(workbook);
+    expect(decoded.sheets).toEqual(["Prospects", "Notes"]);
+    const preview = table((await decoded.readSheet("Prospects")).workbook, "Prospects");
+    expect(preview.columns).toEqual(["A", "B", "C", "D"]);
+    expect(preview.rows[1]?.cells).toEqual([
       "Łódź <script>alert(1)</script>",
       "£1,234.50",
       "6",
       "=SUM(1,2)",
     ]);
-    expect(spreadsheetTable(decoded, "Notes").rows[0]?.cells).toEqual(["Another sheet"]);
+    expect(table((await decoded.readSheet("Notes")).workbook, "Notes").rows[0]?.cells).toEqual([
+      "Another sheet",
+    ]);
   });
-  it("preserves sparse cell coordinates and empty worksheets", () => {
+  it("preserves sparse cell coordinates and empty worksheets", async () => {
     const workbook = utils.book_new();
     utils.book_append_sheet(
       workbook,
@@ -62,14 +256,14 @@ describe("read-only Excel preview", () => {
       "Sparse",
     );
     utils.book_append_sheet(workbook, {}, "Empty");
-    const decoded = roundTrip(workbook);
-    expect(spreadsheetTable(decoded, "Sparse")).toMatchObject({
+    const decoded = await roundTrip(workbook);
+    expect(table((await decoded.readSheet("Sparse")).workbook, "Sparse")).toMatchObject({
       columns: ["C", "D", "E"],
       rows: [{ number: 7, cells: ["Offset", "", "Last"] }],
     });
-    expect(spreadsheetTable(decoded, "Empty").rows).toEqual([]);
+    expect(table((await decoded.readSheet("Empty")).workbook, "Empty").rows).toEqual([]);
   });
-  it("finds content below row 500 and bounds oversized cell text", () => {
+  it("finds content below row 500 and bounds oversized cell text", async () => {
     const workbook = utils.book_new();
     utils.book_append_sheet(
       workbook,
@@ -80,11 +274,12 @@ describe("read-only Excel preview", () => {
       },
       "Offset",
     );
-    const table = spreadsheetTable(roundTrip(workbook), "Offset");
-    expect(table.rows[0]?.number).toBe(9000);
-    expect(table.rows[0]?.cells[0]).toBe("Far row");
-    expect(table.rows[0]?.cells[1]).toHaveLength(2000);
-    expect(table.truncated).toBe(true);
+    const doc = await roundTrip(workbook);
+    const preview = table((await doc.readSheet("Offset")).workbook, "Offset");
+    expect(preview.rows[0]?.number).toBe(9000);
+    expect(preview.rows[0]?.cells[0]).toBe("Far row");
+    expect(preview.rows[0]?.cells[1]).toHaveLength(2000);
+    expect(preview.truncated).toBe(true);
   });
   it("bounds large sheets and exposes only visible worksheets", () => {
     const workbook = utils.book_new();
@@ -98,10 +293,11 @@ describe("read-only Excel preview", () => {
         { name: "Hidden", Hidden: 1 },
       ],
     };
-    const table = spreadsheetTable(workbook, "Large");
-    expect(table.truncated).toBe(true);
-    expect(table.rows).toHaveLength(SPREADSHEET_PREVIEW_ROWS);
-    expect(table.columns).toHaveLength(SPREADSHEET_PREVIEW_COLUMNS);
-    expect(visibleSpreadsheetSheets(workbook)).toEqual(["Large"]);
+    const window = spreadsheetWindow(workbook, "Large");
+    expect(window.truncated).toBe(true);
+    expect(window.rows).toHaveLength(SPREADSHEET_PREVIEW_ROWS);
+    expect(window.columns).toHaveLength(SPREADSHEET_PREVIEW_COLUMNS);
+    expect(spreadsheetTable(window).rows).toHaveLength(100);
+    expect(spreadsheetTable(window).pageCount).toBe(5);
   });
 });
diff --git a/apps/web/src/components/files/spreadsheetDocument.ts b/apps/web/src/components/files/spreadsheetDocument.ts
index 14656d6a2e98..138bef7cb007 100644
--- a/apps/web/src/components/files/spreadsheetDocument.ts
+++ b/apps/web/src/components/files/spreadsheetDocument.ts
@@ -1,54 +1,84 @@
-import { read, utils, type WorkBook } from "xlsx";
-
+import { utils, type WorkBook } from "xlsx";
 import {
   SPREADSHEET_PREVIEW_ROWS,
   SPREADSHEET_PREVIEW_COLUMNS,
   SPREADSHEET_PREVIEW_CELL_CHARACTERS,
+  SPREADSHEET_PREVIEW_TEXT_CHARACTERS,
+  SPREADSHEET_PREVIEW_PAYLOAD_BYTES,
+  SPREADSHEET_PREVIEW_PAGE_ROWS,
   type SpreadsheetTable,
+  type SpreadsheetWindow,
 } from "./spreadsheetPreviewModel";
 
-export function readSpreadsheetDocument(bytes: Uint8Array) {
-  return read(bytes, { type: "array", cellHTML: false, cellFormula: true, sheetStubs: true });
-}
-
-export function visibleSpreadsheetSheets(workbook: WorkBook) {
-  return workbook.SheetNames.filter((name, index) => !workbook.Workbook?.Sheets?.[index]?.Hidden);
-}
-
-/** Preserve cell coordinates and formatted values; formulas without a saved value show their expression. */
-export function spreadsheetTable(workbook: WorkBook, name: string): SpreadsheetTable {
+/** Bound retained formatted strings and serialized size before posting any page. */
+export function spreadsheetWindow(
+  workbook: WorkBook,
+  name: string,
+  contentLimited = false,
+): SpreadsheetWindow {
   const sheet = workbook.Sheets[name];
   if (!sheet) throw new Error("This worksheet is unavailable.");
   const ref = sheet["!ref"];
-  if (!ref) return { name, columns: [], rows: [], truncated: false };
+  if (!ref) return { name, columns: [], rows: [], truncated: contentLimited, contentLimited };
   const range = utils.decode_range(ref);
   const fullRange = utils.decode_range(sheet["!fullref"] ?? ref);
-  let truncated = false;
   const endRow = Math.min(range.e.r, range.s.r + SPREADSHEET_PREVIEW_ROWS - 1);
   const endColumn = Math.min(range.e.c, range.s.c + SPREADSHEET_PREVIEW_COLUMNS - 1);
-  const columns = Array.from({ length: endColumn - range.s.c + 1 }, (_, index) =>
-    utils.encode_col(range.s.c + index),
+  const columns = Array.from({ length: endColumn - range.s.c + 1 }, (_, i) =>
+    utils.encode_col(range.s.c + i),
   );
-  const rows = Array.from({ length: endRow - range.s.r + 1 }, (_, index) => {
-    const row = range.s.r + index;
-    return {
-      number: row + 1,
-      cells: columns.map((_, column) => {
-        const cell = sheet[utils.encode_cell({ r: row, c: range.s.c + column })];
-        if (!cell) return "";
-        const text =
-          (cell.v === undefined || cell.t === "z") && cell.f
-            ? `=${cell.f}`
-            : utils.format_cell(cell);
-        if (text.length > SPREADSHEET_PREVIEW_CELL_CHARACTERS) truncated = true;
-        return text.slice(0, SPREADSHEET_PREVIEW_CELL_CHARACTERS);
-      }),
-    };
-  });
+  const rows: SpreadsheetWindow["rows"] = [];
+  const encoder = new TextEncoder();
+  let characters = 0;
+  // Reserve response metadata, worksheet names, labels, and JSON punctuation.
+  let payloadBytes = 128 * 1024;
+  let truncated = contentLimited || fullRange.e.r > endRow || fullRange.e.c > endColumn;
+  outer: for (let row = range.s.r; row <= endRow; row++) {
+    const cells: string[] = [];
+    payloadBytes += 64 + columns.length;
+    for (let column = range.s.c; column <= endColumn; column++) {
+      const cell = sheet[utils.encode_cell({ r: row, c: column })];
+      const text = cell
+        ? (cell.v === undefined || cell.t === "z") && cell.f
+          ? `=${cell.f}`
+          : utils.format_cell(cell)
+        : "";
+      const clipped = text.slice(0, SPREADSHEET_PREVIEW_CELL_CHARACTERS);
+      if (text.length > clipped.length) truncated = true;
+      const cost = encoder.encode(JSON.stringify(clipped)).length + 1;
+      if (
+        characters + clipped.length > SPREADSHEET_PREVIEW_TEXT_CHARACTERS ||
+        payloadBytes + cost > SPREADSHEET_PREVIEW_PAYLOAD_BYTES
+      ) {
+        contentLimited = truncated = true;
+        if (cells.length)
+          rows.push({
+            number: row + 1,
+            cells: cells.concat(Array<string>(columns.length - cells.length).fill("")),
+          });
+        break outer;
+      }
+      characters += clipped.length;
+      payloadBytes += cost;
+      cells.push(clipped);
+    }
+    rows.push({ number: row + 1, cells });
+  }
+  return { name, columns, rows, truncated, contentLimited };
+}
+
+export function spreadsheetTable(window: SpreadsheetWindow, page = 0): SpreadsheetTable {
+  const pageCount = Math.max(1, Math.ceil(window.rows.length / SPREADSHEET_PREVIEW_PAGE_ROWS));
+  if (!Number.isInteger(page) || page < 0 || page >= pageCount)
+    throw new Error("This worksheet page is unavailable.");
   return {
-    name,
-    columns,
-    rows,
-    truncated: truncated || fullRange.e.r > endRow || fullRange.e.c > endColumn,
+    ...window,
+    rows: window.rows.slice(
+      page * SPREADSHEET_PREVIEW_PAGE_ROWS,
+      (page + 1) * SPREADSHEET_PREVIEW_PAGE_ROWS,
+    ),
+    page,
+    pageCount,
+    totalRows: window.rows.length,
   };
 }
diff --git a/apps/web/src/components/files/spreadsheetPreview.worker.test.ts b/apps/web/src/components/files/spreadsheetPreview.worker.test.ts
new file mode 100644
index 000000000000..47072b204323
--- /dev/null
+++ b/apps/web/src/components/files/spreadsheetPreview.worker.test.ts
@@ -0,0 +1,62 @@
+import { utils } from "xlsx";
+import { expect, it, vi } from "vite-plus/test";
+import type { SpreadsheetRequest, SpreadsheetResponse } from "./spreadsheetPreviewModel";
+
+const { readSheet } = vi.hoisted(() => ({ readSheet: vi.fn() }));
+vi.mock("./spreadsheetArchive", () => ({
+  openSpreadsheetDocument: async () => ({
+    sheets: ["First", "Slow", "Skipped", "Last"],
+    readSheet,
+  }),
+}));
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+it("coalesces rapid switches without inflating multiple worksheets concurrently", async () => {
+  let listener!: (event: { data: SpreadsheetRequest }) => void;
+  const first = deferred<SpreadsheetResponse>();
+  const last = deferred<SpreadsheetResponse>();
+  const started = deferred<void>();
+  const resume = deferred<void>();
+  const posts: SpreadsheetResponse[] = [];
+  readSheet.mockImplementation(async (name: string) => {
+    if (name === "Slow") {
+      started.resolve();
+      await resume.promise;
+    }
+    const workbook = utils.book_new();
+    utils.book_append_sheet(workbook, utils.aoa_to_sheet([[name]]), name);
+    return { workbook, limited: false };
+  });
+  vi.stubGlobal("self", {
+    addEventListener: (_type: string, callback: typeof listener) => {
+      listener = callback;
+    },
+    postMessage: (response: SpreadsheetResponse) => {
+      posts.push(response);
+      if (response.id === 1) first.resolve(response);
+      if (response.id === 4) last.resolve(response);
+    },
+  });
+  try {
+    vi.resetModules();
+    await import("./spreadsheetPreview.worker");
+    listener({ data: { type: "load", id: 1, bytes: new Uint8Array() } });
+    await first.promise;
+    listener({ data: { type: "sheet", id: 2, name: "Slow" } });
+    await started.promise;
+    listener({ data: { type: "sheet", id: 3, name: "Skipped" } });
+    listener({ data: { type: "sheet", id: 4, name: "Last" } });
+    resume.resolve();
+    expect(await last.promise).toMatchObject({ id: 4, table: { name: "Last" } });
+    expect(readSheet.mock.calls.map(([name]) => name)).toEqual(["First", "Slow", "Last"]);
+    expect(readSheet.mock.calls[1]![1].aborted).toBe(true);
+    expect(posts.map((p) => p.id)).toEqual([1, 4]);
+  } finally {
+    vi.unstubAllGlobals();
+  }
+});
diff --git a/apps/web/src/components/files/spreadsheetPreview.worker.ts b/apps/web/src/components/files/spreadsheetPreview.worker.ts
index 9333a181bba7..00f7f23309a4 100644
--- a/apps/web/src/components/files/spreadsheetPreview.worker.ts
+++ b/apps/web/src/components/files/spreadsheetPreview.worker.ts
@@ -1,29 +1,68 @@
-import type { WorkBook } from "xlsx";
+/* oxlint-disable unicorn/require-post-message-target-origin -- This worker posts to its owner, with no Window target origin. */
+import { openSpreadsheetDocument } from "./spreadsheetArchive";
+import { spreadsheetWindow, spreadsheetTable } from "./spreadsheetDocument";
 import {
-  readSpreadsheetDocument,
-  spreadsheetTable,
-  visibleSpreadsheetSheets,
-} from "./spreadsheetDocument";
-import { type SpreadsheetRequest, type SpreadsheetResponse } from "./spreadsheetPreviewModel";
+  type SpreadsheetRequest,
+  type SpreadsheetResponse,
+  type SpreadsheetWindow,
+} from "./spreadsheetPreviewModel";
 
-let workbook: WorkBook | undefined;
-let sheets: string[] = [];
-self.addEventListener("message", (event: MessageEvent<SpreadsheetRequest>) => {
-  let result: SpreadsheetResponse;
+let document: Awaited<ReturnType<typeof openSpreadsheetDocument>> | undefined;
+let selected: SpreadsheetWindow | undefined;
+let latestId = 0;
+let pending: { request: SpreadsheetRequest; signal: AbortSignal } | undefined;
+let running = false;
+let controller: AbortController | undefined;
+async function respond(request: SpreadsheetRequest, signal: AbortSignal) {
   try {
-    if (event.data.type === "load") {
-      workbook = readSpreadsheetDocument(event.data.bytes);
-      sheets = visibleSpreadsheetSheets(workbook);
+    if (request.type === "load") {
+      selected = undefined;
+      document = await openSpreadsheetDocument(request.bytes);
+    }
+    if (latestId !== request.id) return;
+    const archive = document;
+    if (!archive) throw new Error("This workbook is unavailable.");
+    const name = request.type === "load" ? archive.sheets[0] : request.name;
+    if (!name || !archive.sheets.includes(name)) throw new Error("This worksheet is unavailable.");
+    if (request.type !== "page") {
+      selected = undefined;
+      const result = await archive.readSheet(name, signal);
+      if (latestId !== request.id) return;
+      selected = spreadsheetWindow(result.workbook, name, result.limited);
     }
-    if (!workbook || sheets.length === 0)
-      throw new Error("This workbook has no visible worksheets.");
-    const name = event.data.type === "sheet" ? event.data.name : sheets[0];
-    if (name === undefined || !sheets.includes(name))
-      throw new Error("This worksheet is unavailable.");
-    result = { sheets, table: spreadsheetTable(workbook, name) };
+    if (!selected || selected.name !== name) throw new Error("This worksheet is unavailable.");
+    const result: SpreadsheetResponse = {
+      id: request.id,
+      sheets: archive.sheets,
+      table: spreadsheetTable(selected, request.type === "page" ? request.page : 0),
+    };
+    self.postMessage(result);
   } catch (cause) {
-    result = { error: cause instanceof Error ? cause.message : "Could not read this workbook." };
+    if (latestId !== request.id) return;
+    const result: SpreadsheetResponse = {
+      id: request.id,
+      error: cause instanceof Error ? cause.message : "Could not read this workbook.",
+    };
+    self.postMessage(result);
   }
-  // oxlint-disable-next-line unicorn/require-post-message-target-origin -- A worker posts to its owner, with no Window target origin.
-  self.postMessage(result);
+}
+self.addEventListener("message", (event: MessageEvent<SpreadsheetRequest>) => {
+  controller?.abort();
+  controller = new AbortController();
+  latestId = event.data.id;
+  pending = { request: event.data, signal: controller.signal };
+  if (running) return;
+  running = true;
+  // Coalesce rapid switches and keep only one XML inflation/materialization active at a time.
+  void (async () => {
+    try {
+      while (pending) {
+        const next = pending;
+        pending = undefined;
+        await respond(next.request, next.signal);
+      }
+    } finally {
+      running = false;
+    }
+  })();
 });
diff --git a/apps/web/src/components/files/spreadsheetPreviewModel.ts b/apps/web/src/components/files/spreadsheetPreviewModel.ts
index 8d53c3922237..7cdbac79fb58 100644
--- a/apps/web/src/components/files/spreadsheetPreviewModel.ts
+++ b/apps/web/src/components/files/spreadsheetPreviewModel.ts
@@ -1,14 +1,27 @@
 export const SPREADSHEET_PREVIEW_ROWS = 500;
 export const SPREADSHEET_PREVIEW_COLUMNS = 50;
 export const SPREADSHEET_PREVIEW_CELL_CHARACTERS = 2000;
+export const SPREADSHEET_PREVIEW_PAGE_ROWS = 100;
+export const SPREADSHEET_PREVIEW_TEXT_CHARACTERS = 512 * 1024;
+export const SPREADSHEET_PREVIEW_PAYLOAD_BYTES = 2 * 1024 * 1024;
+export const SPREADSHEET_PREVIEW_TIMEOUT_MS = 15_000;
 
 export type SpreadsheetTable = {
   name: string;
   columns: string[];
   rows: { number: number; cells: string[] }[];
   truncated: boolean;
+  contentLimited: boolean;
+  page: number;
+  pageCount: number;
+  totalRows: number;
 };
+export type SpreadsheetWindow = Omit<SpreadsheetTable, "page" | "pageCount" | "totalRows">;
 export type SpreadsheetRequest =
-  | { type: "load"; bytes: Uint8Array }
-  | { type: "sheet"; name: string };
-export type SpreadsheetResponse = { sheets: string[]; table: SpreadsheetTable } | { error: string };
+  | { type: "load"; id: number; bytes: Uint8Array }
+  | { type: "sheet"; id: number; name: string }
+  | { type: "page"; id: number; name: string; page: number };
+export type SpreadsheetResponse = { id: number } & (
+  | { sheets: string[]; table: SpreadsheetTable }
+  | { error: string }
+);
diff --git a/docs/user/composer.md b/docs/user/composer.md
index 4262e551ffaf..08cf6c6e2c6a 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -329,8 +329,10 @@ cell values and let you select a worksheet. Charts and workbook styling are not
 shown. Formulas use their saved results, or show the expression when no saved
 result is available; the preview does not recalculate them.
 
-Office previews support files up to 10 MB. Large worksheets show a limited
-preview. Save the original file to inspect its full content in another app.
+Office previews support files up to 10 MB. Excel shows 100-row pages from the
+first 500 rows and 50 columns of a worksheet's content. Long cells and large
+amounts of text are shortened to keep the preview responsive. Save the original
+file to inspect its full content in another app.
 Complex Word documents may need another app to keep the conversation responsive.
 On mobile, Word and Excel files from Files or chat links open in the device's
 document viewer. If no compatible viewer is installed, use **Save or share**.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ef7308aa695e..a22b68414244 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -939,6 +939,9 @@ importers:
       remark-gfm:
         specifier: 'catalog:'
         version: 4.0.1
+      saxes:
+        specifier: 6.0.0
+        version: 6.0.0
       tailwind-merge:
         specifier: ^3.4.0
         version: 3.6.0
diff --git a/third-party-licenses.config.json b/third-party-licenses.config.json
index f247cf5c17c8..2441c8083ffb 100644
--- a/third-party-licenses.config.json
+++ b/third-party-licenses.config.json
@@ -150,6 +150,27 @@
     }
   ],
   "packageOverrides": [
+    {
+      "name": "saxes",
+      "version": "6.0.0",
+      "sourceUrl": "https://github.com/lddubeau/saxes/blob/v6.0.0/LICENSE",
+      "generatedNotices": [
+        {
+          "licenseId": "ISC",
+          "copyrights": [
+            "Copyright (c) Contributors",
+            "Copyright (c) Isaac Z. Schlueter and Contributors"
+          ]
+        },
+        {
+          "licenseId": "MIT",
+          "copyrights": ["Copyright Mathias Bynens <https://mathiasbynens.be/>"],
+          "preamble": [
+            "Retained from the upstream notice for the historical String.fromCodePoint implementation."
+          ]
+        }
+      ]
+    },
     {
       "name": "@bufbuild/protobuf",
       "version": "1.10.0",

From 3dc994059624a5744d9df88ae58276e25edd25c4 Mon Sep 17 00:00:00 2001
From: piotrnowakowski <61783713+piotrnowakowski@users.noreply.github.com>
Date: Wed, 14 Oct 2026 19:02:26 +0200
Subject: [PATCH 4/4] fix(files): harden Office budgets and reduce preview CPU

---
 .../src/components/files/FilePreviewPanel.tsx |  24 ++-
 .../src/components/files/docxDocument.test.ts |  59 ++++---
 .../components/files/officeArchive.test.ts    | 153 ++++++++++++++++
 .../web/src/components/files/officeArchive.ts |  55 +++++-
 .../files/officeArchiveContents.test.ts       | 109 ++++++++++++
 .../components/files/officeArchiveContents.ts | 165 ++++++++++++++----
 .../files/projectFilesQueryState.test.tsx     |  42 ++++-
 .../files/projectFilesQueryState.ts           |  19 ++
 .../components/files/spreadsheetArchive.ts    |  18 +-
 .../files/spreadsheetDocument.test.ts         |  73 ++++++--
 10 files changed, 628 insertions(+), 89 deletions(-)
 create mode 100644 apps/web/src/components/files/officeArchiveContents.test.ts

diff --git a/apps/web/src/components/files/FilePreviewPanel.tsx b/apps/web/src/components/files/FilePreviewPanel.tsx
index 56b5e0bf71fe..9a90f8150256 100644
--- a/apps/web/src/components/files/FilePreviewPanel.tsx
+++ b/apps/web/src/components/files/FilePreviewPanel.tsx
@@ -117,6 +117,7 @@ import {
   getProjectFileContents,
   setProjectFileQueryData,
   useProjectFileQuery,
+  useProjectFileMetadataQuery,
 } from "./projectFilesQueryState";
 
 interface FilePreviewPanelProps {
@@ -1125,6 +1126,12 @@ export default function FilePreviewPanel({
   const fileAccess = useFilesystemReadAccess(environmentId);
   const { canReadFiles } = fileAccess;
   const canWriteFiles = useEnvironmentScope(environmentId, AuthFilesystemWriteScope);
+  const absolutePath =
+    relativePath && attachment === undefined ? resolvePathLinkTarget(relativePath, cwd) : null;
+  const officeMetadata = useProjectFileMetadataQuery(
+    environmentId,
+    officeKind === null ? null : absolutePath,
+  );
   // Media and PDFs render from their absolute path, so their contents are never
   // shown. The read still runs: a folder named `assets.png` is only knowable as a
   // folder from the read failure, and the server stats before reading, so a folder
@@ -1141,7 +1148,7 @@ export default function FilePreviewPanel({
   // pane, and let the tree fill the surface with the folder revealed. Mutation
   // refresh stays on so the surface notices if the path becomes a file. A host
   // path cannot be revealed in the workspace tree, so it keeps the read error.
-  const isDirectory = file.isNotFile && !isHostFile;
+  const isDirectory = (file.isNotFile || officeMetadata.data?.kind === "directory") && !isHostFile;
   // Everything preview-related keys off previewPath; a folder has no preview.
   const previewPath = isDirectory ? null : relativePath;
   const [explorerOpen, setExplorerOpen] = useState(initialExplorerOpen);
@@ -1216,8 +1223,6 @@ export default function FilePreviewPanel({
     !isVideo &&
     previewAvailable &&
     isBrowserPreviewFile(previewPath);
-  const absolutePath =
-    relativePath && attachment === undefined ? resolvePathLinkTarget(relativePath, cwd) : null;
   const onFilePostRender = useFileLineReveal(relativePath, revealLine, revealRequestId);
   useWorkspaceMutationRefresh({
     enabled:
@@ -1229,7 +1234,7 @@ export default function FilePreviewPanel({
       (isDirectory || (!isMedia && !isPdf)) &&
       !selectedFilePending,
     mutationId: workspaceMutationId,
-    refresh: file.refresh,
+    refresh: officeKind === null ? file.refresh : officeMetadata.refresh,
     resourceKey: `file:${environmentId}:${cwd}:${relativePath ?? ""}`,
   });
 
@@ -1355,7 +1360,7 @@ export default function FilePreviewPanel({
               />
             </FileSurfaceAction>
           ) : null}
-          {officeKind !== null && absolutePath ? (
+          {officeKind !== null && absolutePath && !isDirectory ? (
             <WorkspaceOfficeDownload
               environmentId={environmentId}
               threadRef={threadRef}
@@ -1419,6 +1424,8 @@ export default function FilePreviewPanel({
               htmlRender={attachment.htmlRender === true}
               threadRef={threadRef}
             />
+          ) : officeKind !== null && officeMetadata.isPending && !officeMetadata.data ? (
+            <FileSurfaceLoading />
           ) : relativePath && officeKind !== null && absolutePath ? (
             <WorkspaceOfficePreview
               key={`${environmentId}:${absolutePath}`}
@@ -1574,12 +1581,15 @@ export default function FilePreviewPanel({
               selectedPathRevealId={revealRequestId}
               onOpenFile={onOpenFile}
               workspaceMutationId={workspaceMutationId}
-              {...(previewPath && !isMedia && !isPdf
+              {...((previewPath || officeKind !== null) && !isMedia && !isPdf
                 ? {
                     onRefreshSelectedFile:
                       officeKind === null
                         ? file.refresh
-                        : () => setOfficeRefreshRevision((value) => value + 1),
+                        : () => {
+                            officeMetadata.refresh();
+                            setOfficeRefreshRevision((value) => value + 1);
+                          },
                   }
                 : {})}
             />
diff --git a/apps/web/src/components/files/docxDocument.test.ts b/apps/web/src/components/files/docxDocument.test.ts
index 6846c2474b5f..8ab1c35926b0 100644
--- a/apps/web/src/components/files/docxDocument.test.ts
+++ b/apps/web/src/components/files/docxDocument.test.ts
@@ -2,6 +2,7 @@
 import JSZip from "jszip";
 import { describe, expect, it, vi } from "vite-plus/test";
 import { renderDocxDocument } from "./docxDocument";
+import { validateOfficeArchiveContents } from "./officeArchiveContents";
 
 describe("Word document rendering", () => {
   it("does not parse or create document nodes after cancellation", async () => {
@@ -21,29 +22,37 @@ describe("Word document rendering", () => {
     expect(create).not.toHaveBeenCalled();
     create.mockRestore();
   });
-  it("renders actual OOXML text and tables with document styles in a standalone inert page", async () => {
-    const zip = new JSZip();
-    zip.file(
-      "[Content_Types].xml",
-      '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/></Types>',
-    );
-    zip.file(
-      "_rels/.rels",
-      '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>',
-    );
-    zip.file(
-      "word/document.xml",
-      '<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:body><w:p><w:r><w:rPr><w:b/></w:rPr><w:t>Łódź Word preview</w:t></w:r></w:p><w:tbl><w:tr><w:tc><w:p><w:r><w:t>Table cell</w:t></w:r></w:p></w:tc></w:tr></w:tbl><w:sectPr><w:pgSz w:w="11906" w:h="16838"/></w:sectPr></w:body></w:document>',
-    );
-    const html = await renderDocxDocument(await zip.generateAsync({ type: "uint8array" }));
-    const preview = new DOMParser().parseFromString(html, "text/html");
-    expect(preview.body.textContent).toContain("Łódź Word preview");
-    expect(preview.querySelector("td")?.textContent).toContain("Table cell");
-    expect(preview.querySelector("section.docx")).not.toBeNull();
-    expect(preview.head.querySelectorAll("style").length).toBeGreaterThan(1);
-    expect(
-      preview.querySelector('meta[http-equiv="Content-Security-Policy"]')?.getAttribute("content"),
-    ).toContain("default-src 'none'");
-    expect(preview.querySelector("script,iframe,object,embed")).toBeNull();
-  });
+  it.each(["word/document.xml", "custom.data"])(
+    "renders actual OOXML text and tables from %s in a standalone inert page",
+    async (documentPath) => {
+      const zip = new JSZip();
+      zip.file(
+        "[Content_Types].xml",
+        '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/></Types>',
+      );
+      zip.file(
+        "_rels/.rels",
+        `<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="${documentPath}"/></Relationships>`,
+      );
+      zip.file("word/document.xml", "<document />");
+      zip.file(
+        documentPath,
+        '<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:body><w:p><w:r><w:rPr><w:b/></w:rPr><w:t>Łódź Word preview</w:t></w:r></w:p><w:tbl><w:tr><w:tc><w:p><w:r><w:t>Table cell</w:t></w:r></w:p></w:tc></w:tr></w:tbl><w:sectPr><w:pgSz w:w="11906" w:h="16838"/></w:sectPr></w:body></w:document>',
+      );
+      const bytes = await zip.generateAsync({ type: "uint8array" });
+      expect(() => validateOfficeArchiveContents(bytes, "docx")).not.toThrow();
+      const html = await renderDocxDocument(bytes);
+      const preview = new DOMParser().parseFromString(html, "text/html");
+      expect(preview.body.textContent).toContain("Łódź Word preview");
+      expect(preview.querySelector("td")?.textContent).toContain("Table cell");
+      expect(preview.querySelector("section.docx")).not.toBeNull();
+      expect(preview.head.querySelectorAll("style").length).toBeGreaterThan(1);
+      expect(
+        preview
+          .querySelector('meta[http-equiv="Content-Security-Policy"]')
+          ?.getAttribute("content"),
+      ).toContain("default-src 'none'");
+      expect(preview.querySelector("script,iframe,object,embed")).toBeNull();
+    },
+  );
 });
diff --git a/apps/web/src/components/files/officeArchive.test.ts b/apps/web/src/components/files/officeArchive.test.ts
index 3878f27fedc9..25db9644b21f 100644
--- a/apps/web/src/components/files/officeArchive.test.ts
+++ b/apps/web/src/components/files/officeArchive.test.ts
@@ -1,4 +1,5 @@
 import JSZip from "jszip";
+import { zipSync } from "fflate";
 import { describe, expect, it } from "vite-plus/test";
 import { validateOfficeArchive } from "./officeArchive";
 import { validateOfficeArchiveContents } from "./officeArchiveContents";
@@ -26,7 +27,159 @@ function directoryOffsets(bytes: Uint8Array) {
   return result;
 }
 
+function unicodePath(raw: string, effective: string) {
+  const encoder = new TextEncoder();
+  let crc = -1;
+  for (const byte of encoder.encode(raw)) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit++) crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
+  }
+  const result = new Uint8Array(5 + encoder.encode(effective).length);
+  result[0] = 1;
+  new DataView(result.buffer).setUint32(1, (crc ^ -1) >>> 0, true);
+  result.set(encoder.encode(effective), 5);
+  return result;
+}
+
+function aliasedArchive(effective: string, contents = "<document />", duplicate = false) {
+  const encoder = new TextEncoder();
+  return zipSync({
+    "[Content_Types].xml": encoder.encode("<Types />"),
+    ...(duplicate ? { "word/document.xml": encoder.encode("<document />") } : {}),
+    "payload.xml": [
+      encoder.encode(contents),
+      { extra: { 0x7075: unicodePath("payload.xml", effective) } },
+    ],
+  });
+}
+
 describe("Office archive validation", () => {
+  it.each(["custom.data", "payload.rels"])(
+    "budgets Word content selected through relationships at %s",
+    async (target) => {
+      const zip = new JSZip();
+      zip.file("[Content_Types].xml", "<Types />");
+      zip.file("word/document.xml", "<document />");
+      zip.file(target, `<document>${"<p><r><t>Text</t></r></p>".repeat(5000)}</document>`);
+      zip.file(
+        "_rels/.rels",
+        `<Relationships><Relationship Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="${target}"/></Relationships>`,
+      );
+      const bytes = await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" });
+      expect(() => validateOfficeArchiveContents(bytes, "docx")).toThrow("too complex");
+    },
+  );
+  it("budgets images reached through relative Word relationships outside word/media", async () => {
+    const zip = new JSZip();
+    zip.file("[Content_Types].xml", "<Types />");
+    zip.file("word/document.xml", "<document />");
+    zip.file(
+      "word/_rels/document.xml.rels",
+      '<Relationships><Relationship Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../picture.bin"/></Relationships>',
+    );
+    const png = new Uint8Array(24);
+    png.set([0x89, 0x50, 0x4e, 0x47], 0);
+    png.set([0x49, 0x48, 0x44, 0x52], 12);
+    const view = new DataView(png.buffer);
+    view.setUint32(16, 100000);
+    view.setUint32(20, 100000);
+    zip.file("picture.bin", png);
+    const bytes = await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" });
+    expect(() => validateOfficeArchiveContents(bytes, "docx")).toThrow("too complex");
+  });
+  it("budgets the effective Unicode part name used by the renderer", async () => {
+    const bytes = aliasedArchive(
+      "word/document.xml",
+      `<document>${"<p><r><t>Text</t></r></p>".repeat(5000)}</document>`,
+    );
+    expect(validateOfficeArchive(bytes, "docx").at(-1)?.name).toBe("word/document.xml");
+    expect((await JSZip.loadAsync(bytes)).file("word/document.xml")).not.toBeNull();
+    expect(() => validateOfficeArchiveContents(bytes, "docx")).toThrow("too complex");
+    expect(() =>
+      validateOfficeArchiveContents(
+        aliasedArchive("word/document.xml", "x".repeat(2 * 1024 * 1024 + 1)),
+        "docx",
+      ),
+    ).toThrow("too complex");
+  });
+  it("rejects effective-name collisions before a parser can replace a budgeted part", () => {
+    expect(() =>
+      validateOfficeArchive(aliasedArchive("word/document.xml", "<document />", true), "docx"),
+    ).toThrow("cannot be previewed");
+  });
+  it.each([
+    "word//document.xml",
+    "word/../word/document.xml",
+    "/word/document.xml",
+    "word\\document.xml",
+    "word/\0document.xml",
+  ])("rejects unsafe effective names: %s", (name) => {
+    expect(() => validateOfficeArchive(aliasedArchive(name), "docx")).toThrow(
+      "cannot be previewed",
+    );
+  });
+  it("preserves Unicode legacy names and central-only Unicode metadata", async () => {
+    const zip = new JSZip();
+    zip.file("[Content_Types].xml", "<Types />");
+    zip.file("word/document.xml", "<document />");
+    zip.file("word/café.xml", "<custom />");
+    const bytes = await zip.generateAsync({
+      type: "uint8array",
+      encodeFileName: (name) => name.replaceAll("é", "\x82"),
+    });
+    expect(
+      validateOfficeArchive(bytes, "docx").some((entry) => entry.name === "word/café.xml"),
+    ).toBe(true);
+    expect((await JSZip.loadAsync(bytes)).file("word/café.xml")).not.toBeNull();
+    const alias = aliasedArchive("word/document.xml");
+    const view = new DataView(alias.buffer);
+    const central = directoryOffsets(alias).at(-1)!;
+    const local = view.getUint32(central + 42, true);
+    view.setUint16(local + 30 + view.getUint16(local + 26, true), 0x9999, true);
+    expect(() => validateOfficeArchiveContents(alias, "docx")).not.toThrow();
+    expect((await JSZip.loadAsync(alias)).file("word/document.xml")).not.toBeNull();
+  });
+  it.each(["crc", "version", "utf8"])(
+    "matches JSZip when Unicode metadata is ignored: %s",
+    async (mode) => {
+      const bytes = aliasedArchive("word/document.xml", "<custom />", true);
+      const view = new DataView(bytes.buffer);
+      const central = directoryOffsets(bytes).at(-1)!;
+      const local = view.getUint32(central + 42, true);
+      const extra = central + 46 + view.getUint16(central + 28, true);
+      if (mode === "crc") bytes[extra + 5]! ^= 1;
+      if (mode === "version") bytes[extra + 4] = 2;
+      if (mode === "utf8") {
+        view.setUint16(central + 8, 0x800, true);
+        view.setUint16(local + 6, 0x800, true);
+      }
+      expect(validateOfficeArchive(bytes, "docx").at(-1)?.name).toBe("payload.xml");
+      expect((await JSZip.loadAsync(bytes)).file("payload.xml")).not.toBeNull();
+    },
+  );
+  it.each([
+    [0xc0, 0xaf],
+    [0xe0, 0x80],
+    [0xff, 0xff],
+  ])(
+    "rejects malformed name bytes even when a browser decoder would accept them: %j",
+    async (...malformed) => {
+      const zip = await JSZip.loadAsync(await archive("word/document.xml"));
+      zip.file("wordXXdocument.xml", "<document />");
+      const bytes = await zip.generateAsync({ type: "uint8array" });
+      const view = new DataView(bytes.buffer);
+      const central = directoryOffsets(bytes).at(-1)!;
+      const local = view.getUint32(central + 42, true);
+      bytes.set(malformed, central + 46 + 4);
+      bytes.set(malformed, local + 30 + 4);
+      expect(() => validateOfficeArchive(bytes, "docx")).toThrow("cannot be previewed");
+    },
+  );
+  it("does not strip a filename BOM that JSZip preserves", () => {
+    expect(() => validateOfficeArchive(aliasedArchive("\ufeffword/document.xml"), "docx")).toThrow(
+      "cannot be previewed",
+    );
+  });
   it.each([
     ["docx", "word/document.xml"],
     ["xlsx", "xl/workbook.xml"],
diff --git a/apps/web/src/components/files/officeArchive.ts b/apps/web/src/components/files/officeArchive.ts
index 45bcc73859a1..4b57dc8f2452 100644
--- a/apps/web/src/components/files/officeArchive.ts
+++ b/apps/web/src/components/files/officeArchive.ts
@@ -3,6 +3,16 @@ import type { filePreviewKind } from "@t3tools/shared/filePreview";
 export type OfficePreviewKind = Extract<ReturnType<typeof filePreviewKind>, "docx" | "xlsx">;
 export const OFFICE_ARCHIVE_MAX_EXPANDED_BYTES = 64 * 1024 * 1024;
 
+const crcTable = Uint32Array.from({ length: 256 }, (_, value) => {
+  for (let bit = 0; bit < 8; bit++) value = (value >>> 1) ^ (value & 1 ? 0xedb88320 : 0);
+  return value;
+});
+function filenameCrc(bytes: Uint8Array) {
+  let crc = -1;
+  for (const byte of bytes) crc = (crc >>> 8) ^ crcTable[(crc ^ byte) & 255]!;
+  return (crc ^ -1) >>> 0;
+}
+
 export function invalidOfficeArchive(): never {
   throw new Error(
     "This file cannot be previewed. It may be damaged, encrypted, or use an unsupported Office format. Save it to open it in another app.",
@@ -44,18 +54,42 @@ export function validateOfficeArchive(bytes: Uint8Array, kind: OfficePreviewKind
     localEnd: number;
   }[] = [];
   const names = new Set<string>();
-  const decoder = new TextDecoder();
+  // JSZip's browser decoder tolerates overlong encodings. Reject those rather than
+  // budgeting a replacement-character name that the renderer interprets as a path.
+  const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+  const decodeName = (value: Uint8Array) => {
+    try {
+      return decoder.decode(value);
+    } catch {
+      return invalidOfficeArchive();
+    }
+  };
   let expanded = 0;
   let pos = directory;
-  const inspectExtra = (start: number, length: number) => {
+  const inspectExtra = (start: number, length: number, rawName: Uint8Array) => {
     const stop = start + length;
+    let unicodeName: Uint8Array | undefined;
+    let seenUnicode = false;
     while (start < stop) {
       if (start + 4 > stop) return invalidOfficeArchive();
+      const id = view.getUint16(start, true);
+      const size = view.getUint16(start + 2, true);
+      const next = start + 4 + size;
+      if (next > stop) return invalidOfficeArchive();
       // ZIP64 changes the meaning of the 32-bit sizes and is outside the preview budget.
-      if (view.getUint16(start, true) === 1) return invalidOfficeArchive();
-      start += 4 + view.getUint16(start + 2, true);
-      if (start > stop) return invalidOfficeArchive();
+      if (id === 1) return invalidOfficeArchive();
+      if (id === 0x7075) {
+        if (seenUnicode || size < 1) return invalidOfficeArchive();
+        seenUnicode = true;
+        if (bytes[start + 4] === 1) {
+          if (size < 5) return invalidOfficeArchive();
+          if (view.getUint32(start + 5, true) === filenameCrc(rawName))
+            unicodeName = bytes.subarray(start + 9, next);
+        }
+      }
+      start = next;
     }
+    return unicodeName;
   };
   for (let index = 0; index < count; index++) {
     if (pos + 46 > end || view.getUint32(pos, true) !== 0x02014b50) return invalidOfficeArchive();
@@ -80,17 +114,21 @@ export function validateOfficeArchive(bytes: Uint8Array, kind: OfficePreviewKind
     if (expanded > OFFICE_ARCHIVE_MAX_EXPANDED_BYTES)
       throw new Error("This document is too large to preview. Save it to open it in another app.");
     const rawName = bytes.subarray(pos + 46, pos + 46 + nameLength);
-    const name = decoder.decode(rawName);
+    const unicodeName = inspectExtra(pos + 46 + nameLength, extraLength, rawName);
+    // JSZip uses the central Unicode Path field only when the UTF-8 flag is clear.
+    // Budget and deduplicate that effective name, including legacy-codepage ZIPs.
+    const name = decodeName((flags & 0x800) === 0 && unicodeName ? unicodeName : rawName);
     if (
       !name ||
       names.has(name) ||
       name.startsWith("/") ||
       name.includes("\\") ||
+      name.includes("//") ||
+      name.includes("\0") ||
       name.split("/").some((part) => part === "." || part === "..")
     )
       return invalidOfficeArchive();
     names.add(name);
-    inspectExtra(pos + 46 + nameLength, extraLength);
     if (
       view.getUint32(local, true) !== 0x04034b50 ||
       view.getUint16(local + 6, true) !== flags ||
@@ -104,7 +142,8 @@ export function validateOfficeArchive(bytes: Uint8Array, kind: OfficePreviewKind
     if (dataEnd > directory || (method === 0 && compressed !== size)) return invalidOfficeArchive();
     for (let n = 0; n < nameLength; n++)
       if (bytes[local + 30 + n] !== rawName[n]) return invalidOfficeArchive();
-    inspectExtra(local + 30 + nameLength, localExtra);
+    // JSZip skips local Unicode names; only the central directory can rename an entry.
+    inspectExtra(local + 30 + nameLength, localExtra, rawName);
     const descriptor = (flags & 8) !== 0;
     for (const [offset, expected] of [
       [14, crc],
diff --git a/apps/web/src/components/files/officeArchiveContents.test.ts b/apps/web/src/components/files/officeArchiveContents.test.ts
new file mode 100644
index 000000000000..f74b50ab42e5
--- /dev/null
+++ b/apps/web/src/components/files/officeArchiveContents.test.ts
@@ -0,0 +1,109 @@
+import { Inflate, zipSync } from "fflate";
+import { beforeEach, describe, expect, it, vi } from "vite-plus/test";
+import { validateOfficeArchive, OFFICE_ARCHIVE_MAX_EXPANDED_BYTES } from "./officeArchive";
+import { validateOfficeArchiveContents } from "./officeArchiveContents";
+
+const observed = vi.hoisted(() => ({ inputs: [] as number[], outputs: [] as number[] }));
+vi.mock("fflate", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("fflate")>();
+  return {
+    ...actual,
+    Inflate: class extends actual.Inflate {
+      constructor(consume: NonNullable<InstanceType<typeof actual.Inflate>["ondata"]>) {
+        super((data, final) => {
+          observed.outputs.push(data.length);
+          consume(data, final);
+        });
+      }
+      override push(data: Uint8Array, final?: boolean) {
+        observed.inputs.push(data.length);
+        super.push(data, final);
+      }
+    },
+  };
+});
+
+function archive(size: number, level: 0 | 6 = 6) {
+  return zipSync(
+    {
+      "[Content_Types].xml": new TextEncoder().encode("<Types/>"),
+      "xl/workbook.xml": new Uint8Array(size),
+    },
+    { level },
+  );
+}
+
+function forgeSize(bytes: Uint8Array, size: number) {
+  const view = new DataView(bytes.buffer);
+  let central = view.getUint32(bytes.length - 6, true);
+  while (central < bytes.length - 22) {
+    const local = view.getUint32(central + 42, true);
+    if (view.getUint32(central + 24, true) > 100) {
+      view.setUint32(central + 24, size, true);
+      view.setUint32(local + 22, size, true);
+    }
+    central +=
+      46 +
+      view.getUint16(central + 28, true) +
+      view.getUint16(central + 30, true) +
+      view.getUint16(central + 32, true);
+  }
+}
+
+describe("bounded archive inflation", () => {
+  beforeEach(() => {
+    observed.inputs.length = 0;
+    observed.outputs.length = 0;
+  });
+
+  it("rejects a forged tiny size at the original small-chunk granularity", () => {
+    const bytes = archive(8 * 1024 * 1024);
+    forgeSize(bytes, 1);
+    expect(() => validateOfficeArchiveContents(bytes, "xlsx")).toThrow("cannot be previewed");
+    expect(Math.max(...observed.inputs)).toBeLessThanOrEqual(256);
+    expect(Math.max(...observed.outputs)).toBeLessThan(300 * 1024);
+  });
+
+  it("bounds high-ratio expansion and rejects forged sizes near the aggregate limit", () => {
+    const bytes = archive(80 * 1024 * 1024);
+    forgeSize(bytes, OFFICE_ARCHIVE_MAX_EXPANDED_BYTES - 8);
+    expect(() => validateOfficeArchive(bytes, "xlsx")).not.toThrow();
+    expect(() => validateOfficeArchiveContents(bytes, "xlsx")).toThrow("cannot be previewed");
+    expect(Math.max(...observed.inputs)).toBe(4096);
+    expect(Math.max(...observed.outputs)).toBeLessThan(4 * 1024 * 1024 + 65536);
+    expect(observed.outputs.reduce((sum, size) => sum + size, 0)).toBeLessThan(
+      OFFICE_ARCHIVE_MAX_EXPANDED_BYTES + 300 * 1024,
+    );
+  });
+
+  it.each([0, 6] as const)("accepts valid large stored/deflated content at level %s", (level) => {
+    expect(() =>
+      validateOfficeArchiveContents(archive(9 * 1024 * 1024, level), "xlsx"),
+    ).not.toThrow();
+  });
+
+  it("handles stored DEFLATE blocks across chunk boundaries", () => {
+    // A non-compressing DEFLATE stream still buffers a whole stored block.
+    const bytes = archive(100000, 0);
+    const entry = validateOfficeArchive(bytes, "xlsx").at(-1)!;
+    const payload = bytes.subarray(entry.start, entry.end);
+    const stream = new Uint8Array(payload.length + 10);
+    const view = new DataView(stream.buffer);
+    for (const [offset, length, final] of [
+      [0, 65535, 0],
+      [65540, 34465, 1],
+    ]) {
+      stream[offset!] = final!;
+      view.setUint16(offset! + 1, length!, true);
+      view.setUint16(offset! + 3, length! ^ 65535, true);
+    }
+    let written = 0;
+    const inflate = new Inflate((data) => {
+      written += data.length;
+    });
+    for (let pos = 0; pos < stream.length; pos += 4096)
+      inflate.push(stream.subarray(pos, pos + 4096), pos + 4096 >= stream.length);
+    expect(written).toBe(100000);
+    expect(Math.max(...observed.outputs)).toBeLessThanOrEqual(65535);
+  });
+});
diff --git a/apps/web/src/components/files/officeArchiveContents.ts b/apps/web/src/components/files/officeArchiveContents.ts
index c12669ee9ee7..bbcf9478eac5 100644
--- a/apps/web/src/components/files/officeArchiveContents.ts
+++ b/apps/web/src/components/files/officeArchiveContents.ts
@@ -1,5 +1,6 @@
 import { readImageDimensions } from "@t3tools/shared/imageDimensions";
 import { Inflate } from "fflate";
+import { SaxesParser } from "saxes";
 import {
   invalidOfficeArchive,
   validateOfficeArchive,
@@ -11,6 +12,33 @@ const WORD_MAX_XML_BYTES = 2 * 1024 * 1024;
 const WORD_MAX_ELEMENTS = 12000;
 const WORD_MAX_MEDIA_BYTES = 4 * 1024 * 1024;
 const WORD_MAX_IMAGE_PIXELS = 16_000_000;
+const INFLATE_CHUNK_BYTES = 4096;
+const DEFLATE_MAX_EXPANSION_RATIO = 1032;
+const WORD_XML_RELATIONSHIPS = new Set([
+  "officeDocument",
+  "fontTable",
+  "numbering",
+  "styles",
+  "theme",
+  "footnotes",
+  "endnotes",
+  "footer",
+  "header",
+  "core-properties",
+  "extended-properties",
+  "custom-properties",
+  "settings",
+  "comments",
+  "commentsExtended",
+]);
+const WORD_CONTENT_RELATIONSHIPS = new Set([
+  "officeDocument",
+  "footnotes",
+  "endnotes",
+  "footer",
+  "header",
+  "comments",
+]);
 const complexWord = () => {
   throw new Error(
     "This Word document is too complex to preview. Save it to open it in another app.",
@@ -21,20 +49,8 @@ const complexWord = () => {
 export function validateOfficeArchiveContents(bytes: Uint8Array, kind: OfficePreviewKind) {
   const entries = validateOfficeArchive(bytes, kind);
   let total = 0;
-  let xmlBytes = 0;
-  let elements = 0;
-  let mediaBytes = 0;
-  let pixels = 0;
-  for (const entry of entries) {
+  const inflate = (entry: (typeof entries)[number], capture: boolean) => {
     let written = 0;
-    const isWordXml =
-      kind === "docx" && entry.name.startsWith("word/") && entry.name.endsWith(".xml");
-    const isWordMedia = kind === "docx" && entry.name.startsWith("word/media/") && entry.size > 0;
-    const isWordFont = kind === "docx" && entry.name.startsWith("word/fonts/");
-    if (isWordXml && (xmlBytes += entry.size) > WORD_MAX_XML_BYTES) return complexWord();
-    if ((isWordMedia || isWordFont) && (mediaBytes += entry.size) > WORD_MAX_MEDIA_BYTES)
-      return complexWord();
-    const capture = isWordXml || isWordMedia;
     const chunks: Uint8Array[] = [];
     const consume = (data: Uint8Array) => {
       written += data.length;
@@ -46,31 +62,114 @@ export function validateOfficeArchiveContents(bytes: Uint8Array, kind: OfficePre
     if (entry.method === 0) consume(bytes.subarray(entry.start, entry.end));
     else {
       const inflater = new Inflate(consume);
-      // A forged DEFLATE stream cannot produce an unbounded chunk before our counter runs.
-      for (let pos = entry.start; pos < entry.end; pos += 256)
-        inflater.push(bytes.subarray(pos, Math.min(pos + 256, entry.end)), pos + 256 >= entry.end);
+      // Larger pushes avoid copying the 32 KiB history on every 256 input bytes.
+      // DEFLATE emits at most 258 bytes per length/distance pair (at least two bits).
+      // A 4 KiB push therefore emits about 4 MiB at worst, independently of forged
+      // headers. Near the declared budget retain the smaller rejection granularity.
+      for (let pos = entry.start; pos < entry.end;) {
+        const remaining = Math.min(entry.size - written, OFFICE_ARCHIVE_MAX_EXPANDED_BYTES - total);
+        const chunk = Math.min(
+          INFLATE_CHUNK_BYTES,
+          Math.max(256, Math.floor(remaining / DEFLATE_MAX_EXPANSION_RATIO)),
+        );
+        const end = Math.min(pos + chunk, entry.end);
+        inflater.push(bytes.subarray(pos, end), end === entry.end);
+        pos = end;
+      }
       if (entry.start === entry.end) inflater.push(new Uint8Array(), true);
     }
     if (written !== entry.size) return invalidOfficeArchive();
-    if (capture) {
-      const content = new Uint8Array(written);
-      let offset = 0;
-      for (const chunk of chunks) {
-        content.set(chunk, offset);
-        offset += chunk.length;
-      }
-      if (isWordXml) {
-        const xml = new TextDecoder().decode(content);
-        // Default Word catalogs contain thousands of unused styles; count renderable content.
-        if (/^word\/(document|header\d*|footer\d*|footnotes|endnotes)\.xml$/.test(entry.name)) {
-          for (const _match of xml.matchAll(/<[A-Za-z_][^>]*>/g))
-            if (++elements > WORD_MAX_ELEMENTS) return complexWord();
+    if (!capture) return new Uint8Array();
+    const content = new Uint8Array(written);
+    let offset = 0;
+    for (const chunk of chunks) {
+      content.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return content;
+  };
+
+  const xmlParts = new Set<string>();
+  const contentParts = new Set<string>();
+  const imageParts = new Set<string>();
+  const fontParts = new Set<string>();
+  const relationships = new Map<string, Uint8Array>();
+  let relationshipBytes = 0;
+  // Relationships choose parser roles independently of filenames. Resolve every
+  // role first, including relationships that refer to another .rels file.
+  if (kind === "docx") {
+    for (const entry of entries) {
+      if (!entry.name.endsWith(".rels")) continue;
+      if ((relationshipBytes += entry.size) > WORD_MAX_XML_BYTES) return complexWord();
+      const content = inflate(entry, true);
+      relationships.set(entry.name, content);
+      const sax = new SaxesParser({ xmlns: true });
+      sax.on("doctype", invalidOfficeArchive);
+      sax.on("opentag", (tag) => {
+        const attr = (name: string) =>
+          Object.values(tag.attributes).find((a) => a.local === name)?.value;
+        const target = attr("Target");
+        const type = attr("Type")?.split("/").at(-1);
+        if (!target || !type) return;
+        const folder = entry.name.includes("/_rels/")
+          ? entry.name.slice(0, entry.name.lastIndexOf("/_rels/") + 1)
+          : "";
+        // Match docx-preview's root targets and URL-based relative resolution.
+        let path = target;
+        if (entry.name !== "_rels/.rels") {
+          try {
+            path = new URL(target, `http://docx/${folder}`).toString().slice("http://docx/".length);
+          } catch {
+            path = folder + target;
+          }
         }
-      } else {
-        const dimensions = readImageDimensions(content);
-        if (!dimensions || (pixels += dimensions.width * dimensions.height) > WORD_MAX_IMAGE_PIXELS)
-          return complexWord();
+        path = path.replace(/^\//, "");
+        if (WORD_XML_RELATIONSHIPS.has(type)) xmlParts.add(path);
+        if (WORD_CONTENT_RELATIONSHIPS.has(type)) contentParts.add(path);
+        if (type === "image") imageParts.add(path);
+        if (type === "font") fontParts.add(path);
+      });
+      sax.write(new TextDecoder().decode(content)).close();
+    }
+  }
+
+  let xmlBytes = 0;
+  let elements = 0;
+  let mediaBytes = 0;
+  let pixels = 0;
+  for (const entry of entries) {
+    const isWordXml =
+      kind === "docx" &&
+      (entry.name.endsWith(".xml") || relationships.has(entry.name) || xmlParts.has(entry.name));
+    const isWordMedia =
+      kind === "docx" &&
+      (entry.name.startsWith("word/media/") || imageParts.has(entry.name)) &&
+      entry.size > 0;
+    const isWordFont =
+      kind === "docx" && (entry.name.startsWith("word/fonts/") || fontParts.has(entry.name));
+    if (isWordXml && (xmlBytes += entry.size) > WORD_MAX_XML_BYTES) return complexWord();
+    if ((isWordMedia || isWordFont) && (mediaBytes += entry.size) > WORD_MAX_MEDIA_BYTES)
+      return complexWord();
+    const content = relationships.get(entry.name) ?? inflate(entry, isWordXml || isWordMedia);
+    if (isWordXml) {
+      const renderable =
+        contentParts.has(entry.name) ||
+        /^word\/(document|header\d*|footer\d*|footnotes|endnotes)\.xml$/.test(entry.name);
+      // Default style catalogs contain thousands of unused styles; only parts
+      // that can supply document content consume the element budget.
+      if (renderable) {
+        const sax = new SaxesParser({ xmlns: true });
+        sax.on("doctype", invalidOfficeArchive);
+        sax.on("opentag", () => {
+          if (++elements > WORD_MAX_ELEMENTS) return complexWord();
+        });
+        sax.write(new TextDecoder().decode(content)).close();
       }
     }
+    if (isWordMedia) {
+      const dimensions = readImageDimensions(content);
+      if (!dimensions || (pixels += dimensions.width * dimensions.height) > WORD_MAX_IMAGE_PIXELS)
+        return complexWord();
+    }
   }
 }
diff --git a/apps/web/src/components/files/projectFilesQueryState.test.tsx b/apps/web/src/components/files/projectFilesQueryState.test.tsx
index 4a7f70a988f6..08fa2615ff5e 100644
--- a/apps/web/src/components/files/projectFilesQueryState.test.tsx
+++ b/apps/web/src/components/files/projectFilesQueryState.test.tsx
@@ -34,8 +34,12 @@ const projectMocks = vi.hoisted(() => ({
   listEntries: vi.fn(),
   optimisticFile: vi.fn(),
   readFile: vi.fn(),
+  fileMetadata: vi.fn(),
+  invalidateFileMetadata: vi.fn(),
 }));
 
+vi.mock("~/state/use-atom-command", () => ({ useAtomCommand: (command: unknown) => command }));
+
 const atomHooks = vi.hoisted(() => ({
   registry: null as {
     get(atom: object): unknown;
@@ -100,7 +104,11 @@ vi.mock("~/state/queries", () => ({
 
 import { useWorkspaceMutationRefresh } from "~/hooks/useWorkspaceMutationRefresh";
 import { useT3ProjectFileState } from "~/hooks/useT3ProjectFileScripts";
-import { useProjectEntriesQuery, useProjectFileQuery } from "./projectFilesQueryState";
+import {
+  useProjectEntriesQuery,
+  useProjectFileQuery,
+  useProjectFileMetadataQuery,
+} from "./projectFilesQueryState";
 
 const environmentId = EnvironmentId.make("environment-1");
 const decodeReadError = Schema.decodeSync(ProjectReadFileError);
@@ -144,9 +152,41 @@ describe("project query refresh", () => {
     projectMocks.listEntries.mockReset();
     projectMocks.optimisticFile.mockReset();
     projectMocks.readFile.mockReset();
+    projectMocks.fileMetadata.mockReset();
+    projectMocks.invalidateFileMetadata.mockReset();
     reactHooks.reset();
   });
 
+  it("resolves Office-looking folders and refreshes their type without reading contents", () => {
+    const registry = AtomRegistry.make();
+    atomHooks.registry = registry;
+    const metadata = Atom.make(AsyncResult.success({ kind: "directory" as "directory" | "file" }));
+    projectMocks.fileMetadata.mockReturnValue(metadata);
+    try {
+      const folder = useProjectFileMetadataQuery(environmentId, "/repo/reports.xlsx");
+      expect(folder.data?.kind).toBe("directory");
+      folder.refresh();
+      expect(projectMocks.invalidateFileMetadata).toHaveBeenCalledWith({
+        environmentId,
+        input: { paths: ["/repo/reports.xlsx"] },
+      });
+      registry.set(metadata, AsyncResult.success({ kind: "file" }));
+      expect(useProjectFileMetadataQuery(environmentId, "/repo/reports.xlsx").data?.kind).toBe(
+        "file",
+      );
+      expect(projectMocks.readFile).not.toHaveBeenCalled();
+      authorizationMocks.sessionAtom = Atom.make(
+        AsyncResult.success({ authenticated: true, scopes: [] }),
+      );
+      projectMocks.fileMetadata.mockClear();
+      expect(useProjectFileMetadataQuery(environmentId, "/repo/reports.xlsx").data).toBeNull();
+      expect(projectMocks.fileMetadata).not.toHaveBeenCalled();
+    } finally {
+      registry.dispose();
+      atomHooks.registry = null;
+    }
+  });
+
   it("does not query or expose optimistic file contents without read permission", () => {
     authorizationMocks.sessionAtom = Atom.make(
       AsyncResult.success({ authenticated: true, scopes: [] }),
diff --git a/apps/web/src/components/files/projectFilesQueryState.ts b/apps/web/src/components/files/projectFilesQueryState.ts
index 1b91e7d7f848..77b215cca1f0 100644
--- a/apps/web/src/components/files/projectFilesQueryState.ts
+++ b/apps/web/src/components/files/projectFilesQueryState.ts
@@ -15,6 +15,8 @@ import { appAtomRegistry } from "~/rpc/atomRegistry";
 import { useFilesystemReadAccess } from "~/state/filesystem";
 import { projectEnvironment } from "~/state/projects";
 import { useProjectPathSearch } from "~/state/queries";
+import { useEnvironmentQuery } from "~/state/query";
+import { useAtomCommand } from "~/state/use-atom-command";
 import { executeAtomQuery } from "@t3tools/client-runtime/state/runtime";
 
 const EMPTY_PROJECT_FILE_PATH = "";
@@ -287,3 +289,20 @@ export function useProjectFileQuery(
     refresh,
   };
 }
+
+/** Resolve Office-looking folders without loading a binary file into the text cache. */
+export function useProjectFileMetadataQuery(environmentId: EnvironmentId, path: string | null) {
+  const { canReadFiles } = useFilesystemReadAccess(environmentId);
+  const query = useEnvironmentQuery(
+    path && canReadFiles
+      ? projectEnvironment.fileMetadata({ environmentId, input: { path } })
+      : null,
+  );
+  const invalidate = useAtomCommand(projectEnvironment.invalidateFileMetadata, {
+    reportFailure: false,
+  });
+  const refresh = useCallback(() => {
+    if (path && canReadFiles) void invalidate({ environmentId, input: { paths: [path] } });
+  }, [environmentId, path, canReadFiles, invalidate]);
+  return { ...query, refresh };
+}
diff --git a/apps/web/src/components/files/spreadsheetArchive.ts b/apps/web/src/components/files/spreadsheetArchive.ts
index d9e74850354a..6f04447f8deb 100644
--- a/apps/web/src/components/files/spreadsheetArchive.ts
+++ b/apps/web/src/components/files/spreadsheetArchive.ts
@@ -55,10 +55,11 @@ function cells(
   let rootName = "worksheet";
   let data = "";
   let dataName = "sheetData";
-  let rowStart = -1;
+  let rowContentStart = -1;
+  let rowOpen = "";
   let actualRow: number | undefined;
   let firstRow = Infinity;
-  const spans = new Map<number, { start: number; end: number }>();
+  const spans = new Map<number, { open: string; start: number; end: number }>();
   sax.on("opentag", (tag) => {
     if (!root) {
       root = opening(tag);
@@ -74,7 +75,8 @@ function cells(
       row = tag.attributes.r ? Number(tag.attributes.r.value) - 1 : row + 1;
       column = -1;
       actualRow = undefined;
-      rowStart = xml.lastIndexOf("<", sax.position - 1);
+      rowContentStart = sax.position;
+      rowOpen = opening(tag).replace(/\sr="[^"]*"/, "");
     }
     if (tag.local !== "c") return;
     const reference = tag.attributes.r?.value;
@@ -91,6 +93,7 @@ function cells(
       return invalid();
     if (actualRow !== undefined && actualRow !== coord.r) return invalid();
     actualRow = coord.r;
+    row = coord.r;
     if (coord.r < firstRow) {
       firstRow = coord.r;
       for (const retained of spans.keys())
@@ -105,13 +108,18 @@ function cells(
       actualRow !== undefined &&
       actualRow < firstRow + SPREADSHEET_PREVIEW_ROWS
     )
-      spans.set(actualRow, { start: rowStart, end: sax.position });
+      spans.set(actualRow, {
+        open: `${rowOpen.slice(0, -1)} r="${actualRow + 1}">`,
+        start: rowContentStart,
+        end: sax.position,
+      });
     if (tag.local === "sheetData") inData = false;
   });
   sax.write(xml).close();
   // The second pass sees only the bounded row window, rather than scanning every cell twice.
   return `${root}${data || "<sheetData>"}${Array.from(spans.values())
-    .map((span) => xml.slice(span.start, span.end))
+    // Resolve implicit row positions before removing empty or out-of-window rows.
+    .map((span) => span.open + xml.slice(span.start, span.end))
     .join("")}</${dataName}></${rootName}>`;
 }
 
diff --git a/apps/web/src/components/files/spreadsheetDocument.test.ts b/apps/web/src/components/files/spreadsheetDocument.test.ts
index 7ced8c11d7f9..e5f7e06e7266 100644
--- a/apps/web/src/components/files/spreadsheetDocument.test.ts
+++ b/apps/web/src/components/files/spreadsheetDocument.test.ts
@@ -19,6 +19,39 @@ const table = (workbook: WorkBook, name: string, page = 0) =>
   spreadsheetTable(spreadsheetWindow(workbook, name), page);
 
 describe("read-only Excel preview", () => {
+  it.each([
+    [
+      '<row r="8999"></row><row><c t="inlineStr"><is><t>Sparse</t></is></c></row>',
+      "A9000",
+      "Sparse",
+    ],
+    [
+      '<row><c><v>1</v></c></row><row></row><row><c t="inlineStr"><is><t>Third</t></is></c></row>',
+      "A3",
+      "Third",
+    ],
+    [
+      '<row r="8999"/><row><c r="C9000" t="inlineStr"><is><t>Mixed</t></is></c><c><v>2</v></c></row><row><c><v>3</v></c></row>',
+      "A9001",
+      3,
+    ],
+  ])(
+    "preserves absolute coordinates before filtering empty rows: %s",
+    async (rows, address, value) => {
+      const wb = utils.book_new();
+      utils.book_append_sheet(wb, utils.aoa_to_sheet([[1]]), "Sparse");
+      const zip = await JSZip.loadAsync(write(wb, { type: "array", bookType: "xlsx" }));
+      zip.file(
+        "xl/worksheets/sheet1.xml",
+        `<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"><sheetData>${rows}</sheetData></worksheet>`,
+      );
+      const doc = await openSpreadsheetDocument(await zip.generateAsync({ type: "uint8array" }));
+      const { workbook } = await doc.readSheet("Sparse");
+      expect(workbook.Sheets.Sparse![address as string]?.v).toBe(value);
+      expect(workbook.Sheets.Sparse!["!ref"]).toBe(workbook.Sheets.Sparse!["!fullref"]);
+      if (address === "A9001") expect(workbook.Sheets.Sparse!.D9000?.v).toBe(2);
+    },
+  );
   it("offers a complexity fallback instead of claiming an oversized first cell is empty", async () => {
     const wb = utils.book_new();
     utils.book_append_sheet(wb, utils.aoa_to_sheet([["x".repeat(20000)]]), "Oversized cell");
@@ -64,16 +97,36 @@ describe("read-only Excel preview", () => {
       "1904-01-02",
     ]);
   });
-  it("rejects worksheet XML over the parse budget before constructing cells", async () => {
-    const wb = utils.book_new();
-    utils.book_append_sheet(wb, utils.aoa_to_sheet([["Small"]]), "Large XML");
-    const zip = await JSZip.loadAsync(write(wb, { type: "array", bookType: "xlsx" }));
-    zip.file("xl/worksheets/sheet1.xml", " ".repeat(24 * 1024 * 1024 + 1));
-    const doc = await openSpreadsheetDocument(
-      await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" }),
-    );
-    await expect(doc.readSheet("Large XML")).rejects.toThrow("too complex");
-  });
+  it.each([false, true])(
+    "rejects worksheet XML over the parse budget before constructing cells (Unicode alias: %s)",
+    async (alias) => {
+      const wb = utils.book_new();
+      utils.book_append_sheet(wb, utils.aoa_to_sheet([["Small"]]), "Large XML");
+      const zip = await JSZip.loadAsync(write(wb, { type: "array", bookType: "xlsx" }));
+      const sheetPath = alias ? "xl/worksheets/shéet1.xml" : "xl/worksheets/sheet1.xml";
+      if (alias) {
+        zip.remove("xl/worksheets/sheet1.xml");
+        const relationships = await zip.file("xl/_rels/workbook.xml.rels")!.async("string");
+        zip.file(
+          "xl/_rels/workbook.xml.rels",
+          relationships.replace("worksheets/sheet1.xml", "worksheets/shéet1.xml"),
+        );
+      }
+      zip.file(sheetPath, " ".repeat(24 * 1024 * 1024 + 1));
+      const doc = await openSpreadsheetDocument(
+        await zip.generateAsync({
+          type: "uint8array",
+          compression: "DEFLATE",
+          ...(alias
+            ? {
+                encodeFileName: (name: string) => (name === sheetPath ? "payload.xml" : name),
+              }
+            : {}),
+        }),
+      );
+      await expect(doc.readSheet("Large XML")).rejects.toThrow("too complex");
+    },
+  );
   it("keeps prefixed worksheet tags and implicit cell coordinates", async () => {
     const wb = utils.book_new();
     utils.book_append_sheet(wb, utils.aoa_to_sheet([["😀 Łódź", "Second"]]), "Prefix");