workbook-editor

name	workbook-editor
description	Use when inspecting, reading, rendering, editing, formatting, diffing, or validating local .xlsx and .xlsm Excel workbooks. Provides fail-closed workbook tools with dry-run planning, SHA-256 conflict protection, PNG previews, and byte-identity checks for VBA and other protected OOXML parts. Do not use for CSV-only work or for executing/editing VBA.

Workbook Editor

Use the six workbook_* tools for semantic and visual workbook work. Treat every workbook as potentially hostile active content.

Required workflow

1. Call workbook_inspect before editing an unfamiliar workbook. Review validation warnings, external relationships, protected parts, and engine capabilities.
2. Call workbook_read for the exact sheet/range. Call workbook_render whenever layout, fills, borders, dimensions, or visual comparison matter.
3. Build an ordered operation list and call workbook_edit with dryRun: true. Save the returned sourceSha256.
4. Commit to a new output path by default. Set dryRun: false and pass the exact expectedSha256 from the current inspection/dry run.
5. Call workbook_validate on the result, using the source as baselinePath for .xlsm or active-content work.
6. Call workbook_diff and render the affected range. Report the output and any recovery path.

Operation intent

• Use setValue for literal text, numbers, booleans, or null. Leading =, +, -, and @ remain text when passed as strings.
• Use setFormula only for formulas. External-workbook, URL, DDE, WEBSERVICE, FILTERXML, and RTD constructs are rejected.
• Use setStyle for explicit font, fill, border, alignment, number-format, or cell-protection patches.
• Use copyRange for same-sized range templates; set optional sourceSheet for cross-sheet copies. Use copyFormat when only styles should be reproduced and fillRange to translate ordinary relative A1 formulas from one source cell.
• Shared, array, data-table, and spill formula regions are preservation-only. Value/content edits that intersect them fail closed; inspect formula inventory before restructuring formula-heavy sheets.
• Use clear, dimensions, merge, and unmerge operations only after reading existing merges and layout.

Safety rules

• Never execute macros. Preservation does not imply that VBA was reviewed, trusted, or safe.
• Never request VBA source mutation or workbook macro execution through these tools; those capabilities are intentionally absent.
• Never refresh external links, Power Query, DDE, or data connections.
• Never silently convert .xlsm and .xlsx; output extension must match source.
• Never omit expectedSha256 on a commit or retry a conflict using an old hash.
• Never overwrite in place unless the user explicitly asked. In-place writes require overwrite: true and return a recovery copy.
• Do not suggest lossy fallback libraries when the engine rejects an unsupported operation.
• Keep ranges focused. Full structured results are stored in temporary artifacts when model-visible output is truncated.

Backend policy

The enabled backend is ooxml-safe, a bounded surgical implementation. It changes only operation-declared OOXML parts and verifies protected parts after saving; per-file package mutability checks can reject an otherwise supported operation. Native Excel may appear in /workbook-doctor, but mutation is disabled because the bounded bakeoff changed merged-cell styles during .xlsx no-op serialization and changed xl/vbaProject.bin during .xlsm no-op serialization. Aspose is an optional deferred tier.

Verification expectations

A successful edit is not complete until:

• workbook_validate reports ok: true;
• workbook_diff shows only operation-declared OOXML changes;
• protected-part changes are empty;
• the focused PNG preview is visually reasonable when formatting changed;
• any warnings, truncation, unsupported rich objects, or missing native Excel repair-prompt check are disclosed.