fix(office-excel): support Office.js add-in embed and surface Graph errors

[waleedlatif1]

Summary

• Load Office.js and call Office.onReady() on /chat/[id]?embed=office so Excel/Word/PowerPoint/Outlook recognize the page as a valid add-in
• Patch the Office.js + Next.js router conflict by caching history.replaceState/pushState before Office.js loads and restoring after (documented community fix)
• Extend the chat embed CSP to allow https://appsforoffice.microsoft.com
• Add microsoft-graph-errors extractor and wire it through Excel tools (read, write, table_add, worksheet_add) so users see real Graph error messages instead of "We're sorry. We ran into a problem"
• Replace inline error parsing in /api/tools/microsoft_excel/{drives,sheets} routes with the shared extractGraphError helper
• Add retry config on read (idempotent-only) and write (PATCH range writes are semantically idempotent)

Type of Change

• Bug fix

Testing

• 37/37 unit tests pass (utils.test.ts 9, csp.test.ts 28)
• bun run check:api-validation passes
• Tested manually in Excel add-in

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 6, 2026 7:52pm

[cursor]

PR Summary

Medium Risk
Moderate risk because it relaxes chat-page CSP to allow Office.js from a new origin and changes Excel tool request behavior via new retry policies and error parsing, which could affect embedding security posture and API call patterns.

Overview
Adds an optional Office add-in embed mode for chat (/chat/[id]?embed=office) by loading office.js, calling Office.onReady(), and working around an Office.js/Next.js router conflict by restoring cached history.pushState/replaceState.

Extends the chat embed CSP (getChatEmbedCSPPolicy) to permit Office.js script/connect sources from https://appsforoffice.microsoft.com, with accompanying tests.

Standardizes Microsoft Graph error surfacing across Excel APIs/tools by adding shared Graph error parsers/extractors (extractGraphError, parseGraphErrorFromData) and wiring the new microsoft-graph-errors extractor + retry configs into Excel read/write/table/worksheet operations, while simplifying error handling in the drives/sheets selector routes.

^{Reviewed by Cursor Bugbot for commit 97e82d8. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds Office.js add-in support to the /chat/[id]?embed=office page and improves Microsoft Graph error surfacing across all Excel tools. It also consolidates previously duplicated inline error-parsing logic behind shared extractGraphError / parseGraphErrorFromData helpers.

• Office embed: A new OfficeEmbedInit client component loads Office.js and applies a known community fix that caches and restores history.replaceState/pushState around the Office.js load to prevent it from breaking Next.js's router; Office.onReady() is called after restore.
• Graph error extraction: parseGraphErrorFromData in utils.ts walks the innerError chain (depth-capped at 5) and aggregates details[] messages; the microsoft-graph-errors extractor delegates to it and is wired into all four Excel tool configs via errorExtractor.
• CSP & retry: getChatEmbedCSPPolicy extends buildTimeCSPDirectives with https://appsforoffice.microsoft.com for script-src and connect-src; retry configs are added to read (idempotent-only) and write (range PATCH, documented as semantically idempotent) tools.

Confidence Score: 5/5

Safe to merge; changes are well-scoped with good test coverage and no regressions to existing error paths.

The Graph error extraction logic is thoroughly unit-tested (9 cases covering chain depth, deduplication, fallback to code, non-JSON bodies). The framework's tool executor handles non-OK responses before calling transformResponse, so the removal of the manual !response.ok guard in worksheet_add.ts is correct. The Office.js history patch follows the documented community fix. The one inconsistency in csp.ts has no current production impact.

apps/sim/lib/core/security/csp.ts — script-src inconsistency is a latent risk if dynamic script sources are ever added.

Important Files Changed

Filename	Overview
apps/sim/tools/microsoft_excel/utils.ts	Adds parseGraphErrorFromData, parseGraphErrorMessage, and extractGraphError helpers; well-tested, depth-capped innerError chain walking, correct fallback order.
apps/sim/app/chat/[identifier]/office-embed-init.tsx	New client component that caches and restores history.replaceState/pushState around Office.js load; module-level window guard is correct for SSR.
apps/sim/lib/core/security/csp.ts	getChatEmbedCSPPolicy builds script-src from STATIC_SCRIPT_SRC instead of buildTimeCSPDirectives['script-src'], inconsistent with connect-src handling; could silently drop dynamically added script sources.
apps/sim/tools/microsoft_excel/worksheet_add.ts	Removed manual !response.ok guard from transformResponse; framework handles non-OK responses before transformResponse is called, so removal is correct.
apps/sim/tools/microsoft_excel/write.ts	Adds retry config with retryIdempotentOnly:false for PATCH range writes; documented as intentional since range writes are semantically idempotent.
apps/sim/app/chat/[identifier]/page.tsx	Adds searchParams handling for embed=office; correctly handles both string and string[] cases per prior thread fix.
apps/sim/app/api/tools/microsoft_excel/drives/route.ts	Replaces inline error parsing with extractGraphError helper; cleaner and consistent with other routes.

Sequence Diagram

sequenceDiagram
participant E as Excel Add-in
participant P as ChatPage (Server)
participant OI as OfficeEmbedInit (Client)
participant OJS as Office.js CDN
participant T as Excel Tool (executor)
participant G as Microsoft Graph API
E->>P: GET /chat/[id]?embed=office
P->>P: isOfficeEmbed = true
P->>OI: render OfficeEmbedInit
OI->>OI: cache history.replaceState & pushState
OI->>OJS: load office.js (afterInteractive)
OJS->>OJS: monkey-patches history methods
OJS-->>OI: onReady fires
OI->>OI: restore cached history methods
OI->>OJS: Office.onReady()
Note over T,G: Tool execution flow
T->>G: PATCH /workbook/range (with retry)
alt Success
G-->>T: 200 OK
T->>T: transformResponse
else Graph Error
G-->>T: 4xx/5xx + error body
T->>T: parseGraphErrorFromData
T-->>T: throw human-readable error
end

Loading

_{Reviews (2): Last reviewed commit: "fix(office-excel): delegate to parseGrap..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 97e82d8. Configure here.}