* xtask: probe keytip commands without file access, and refuse text that could escape generated code
cargo xtask keytips ran every command keytips.json names, with its
params, under the user's file permissions (file.exportPdf could replace
any file, also during --check). It also wrote target, excel and note
strings into generated Rust without escaping. Probes now run inside the
engine's ScriptSandbox, and those fields may not hold quotes,
backslashes, braces or control characters.
* address review: make ScriptSandbox !Send so it drops on the thread that entered it
- #3223: sniff the first 64 KiB for a web page and skip JSON and files over the text-import cap, so
every CSV/TSV is no longer decoded in full before the size check.
- #3253: SYLK relative offsets use checked arithmetic (no overflow on R[9223372036854775807]); at
most 1024 column-width records are kept; regression test.
- #3254: a single selected merged cell searches the whole sheet, as one selected cell does.
- #3252: the formula bar's height cap is half the room below the ribbon, not half the window, so
the worksheet stays visible in a short window (CodeRabbit Major).
- #3239, #3244, #3252, #3268: es/de/cs/zh/ko/ru/pt entries for the new interface strings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A small reader for the SYLK text format: cell values (numbers, text,
booleans, errors), formulas converted from R1C1 to A1 as Excel does
(relative/absolute references, ranges, whole rows and columns, shared
formulas) with their cached results, number formats (P / F;P) and
column widths (F;W). Import only; saving as .slk says so. The sheet is
named after the file, and damaged records are skipped with a warning.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Addresses CodeRabbit review on #3223:
- "Skip leading HTML comments before the prefix check": a page starting
with an exporter's <!-- comment --> was read as CSV text. Complete
leading comments are now skipped before looking for the page's start.
- "Preserve nonbreaking spaces in HTML text imports": split_whitespace
turned New York into "New York". The decoded cell text is
used as is (ordinary whitespace is already collapsed), so the
non-breaking spaces stay, as Excel keeps them.
Test: a_web_page_table_opens_after_a_leading_comment_and_keeps_nonbreaking_spaces.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Addresses CodeRabbit review on #3223:
- "Decode HTML before parsing its cells": a page in Windows-1252 read as
lossy UTF-8, so "Café" lost its é. The page is now decoded as a CSV is
(BOM, UTF-8, else Windows-1252/1256); decode_text is exported for it.
- "Keep visible cell text when csv_as_text is enabled": opened as text, a
cell with x:num took the recorded number ("4,50" became "4.5"). The
recorded number is used only when values are read.
- "Preserve the imported format when styling a header": a date in a <th>
lost its date format when made bold and centred. Header styling now
builds on the style the CSV reader gave the cell.
Test: a_web_page_table_keeps_its_characters_text_and_header_formats.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Web apps' "Export to Excel" often writes an HTML table and names it
.xls. GridCraft read such a file as CSV text, so it opened as lines of
markup in column A. Excel opens the table (after warning that the
format and the extension don't match).
Opening a file whose bytes are a web page with a table now reads the
first table as a sheet, through the clipboard HTML table reader: the
cells go through the CSV reader, so values read as they do in a CSV
(and stay text with csvAsText); <th> cells are bold and centred; the
sheet takes the page's <x:Name> or the file's name. A page that isn't
named .htm/.html opens with a warning saying what it is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A formula calling a Google-only function (GOOGLETRANSLATE, QUERY,
ARRAYFORMULA...) opened as #NAME? where the wrapper had shown the cached
value, as Excel does. The XLSX reader now unwraps a cell formula only when
every function inside is known: read_xlsx_with takes the predicate (the
xlsx crate can't depend on the function library) and the engine passes
gridcraft_calc::is_known_function. Unwrapping stays in the reader so shared
formulas are shifted from the unwrapped master.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`save_fails_upfront_when_the_temp_name_is_taken` calls
`std::os::unix::fs::symlink` but was only gated on non-wasm, so the
engine crate's lib tests did not compile on Windows. Gate it `cfg(unix)`
like the neighbouring permissions test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dylan M. Taylor
Brandon ThomasandClaude Opus 5.5
Hector VillarrealandClaude Opus 5.5
prxnvt
Harrison SmithandClaude Opus 5.5
Max Murphy
Higgs32584andClaude Opus 5.5
aiongg