chore(deps): upgrade docx to 9.15.2

docx 9.15 packs with fflate and encodes base64 with the global btoa, which
the isolated-vm sandbox does not provide, so the docx-generate finalize
(Packer.toBase64String + hand-rolled decode) threw ReferenceError. Pack with
Packer.toArrayBuffer instead, like the pptx/pdf tasks, and cover the real
bundle + bootstrap + finalize in a bare isolate-shaped context.

docx now drops XML-1.0-illegal control characters itself, so the Word
block's pre-strip before Markdown parsing is removed. Regenerated the
docx sandbox bundle.

Author: waleedlatif1

apps/sim/lib/execution/sandbox/bundles/build.ts

@@ -9,7 +9,7 @@
  *
  * Every bundle is evaluated in a bare context before it is written: the
  * bundler can emit a reference to a runtime helper it never defines (Bun does
- * this for docx's inlined CommonJS shim), and nothing else loads these files
+ * this for an inlined CommonJS shim), and nothing else loads these files
  * before a production document generation does.
  *
  * Run via: `bun run build:sandbox-bundles`.

apps/sim/lib/execution/sandbox/bundles/docx.cjs

@@ -24,11 +24,10 @@ if (typeof g.global === 'undefined') g.global = globalThis
 
 /**
  * A library that inlines a CommonJS dependency ships esbuild's `__require`
- * helper around it (docx >= 9.7.1 does this for JSZip's UMD build). Bun's
- * browser/iife build rewrites the bare `require` references inside that helper
- * to its own `__require` runtime helper and then never emits it, so the bundle
- * throws `ReferenceError: __require is not defined` while it is still being
- * evaluated. The isolate has no `require` at all, so the only correct answer
+ * helper around it. Bun's browser/iife build rewrites the bare `require`
+ * references inside that helper to its own `__require` runtime helper and
+ * then never emits it, so the bundle throws `ReferenceError: __require is not
+ * defined` while it is still being evaluated. The isolate has no `require` at all, so the only correct answer
  * to a dynamic require is the one esbuild's helper gives when `require` is
  * absent: throw. Defining it here keeps every bundle self-contained; `build.ts`
  * evaluates each bundle in a bare context so a new variant of the defect fails

apps/sim/lib/execution/sandbox/bundles/isolate-polyfills.ts

@@ -1,7 +1,13 @@
 import { readFileSync } from 'node:fs'
+import vm from 'node:vm'
+import JSZip from 'jszip'
 import { describe, expect, it } from 'vitest'
-import { evaluateSandboxBundle } from '@/lib/execution/sandbox/bundles/verify'
+import {
+  createBareSandboxContext,
+  evaluateSandboxBundle,
+} from '@/lib/execution/sandbox/bundles/verify'
 import type { SandboxBundleName } from '@/lib/execution/sandbox/types'
+import { docxGenerateTask } from '@/sandboxes/docx-generate'
 
 function loadCheckedInBundle(name: SandboxBundleName): Record<string, unknown> {
   const source = readFileSync(new URL(`./${name}.cjs`, import.meta.url), 'utf-8')
@@ -23,6 +29,26 @@ describe('sandbox bundles', () => {
     expect(typeof docx.Paragraph).toBe('function')
   })
 
+  it('docx-generate packs a document with the checked-in bundle in a bare context', async () => {
+    const context = createBareSandboxContext()
+    evaluateSandboxBundle(
+      readFileSync(new URL('./docx.cjs', import.meta.url), 'utf-8'),
+      'docx',
+      context
+    )
+    const runAsync = (body: string) => vm.runInContext(`(async () => { ${body} })()`, context)
+
+    await runAsync(docxGenerateTask.bootstrap)
+    await runAsync(
+      "addSection({ children: [new docx.Paragraph({ children: [new docx.TextRun('R&D <ok>')] })] })"
+    )
+    const bytes: unknown = await runAsync(docxGenerateTask.finalize)
+
+    expect(ArrayBuffer.isView(bytes)).toBe(true)
+    const zip = await JSZip.loadAsync(bytes as Uint8Array)
+    expect(await zip.file('word/document.xml')?.async('string')).toContain('R&amp;D &lt;ok&gt;')
+  })
+
   it('pdf-lib evaluates in a bare context and exposes the pdf-generate surface', () => {
     const pdfLib = loadCheckedInBundle('pdf-lib')
     expect(typeof pdfLib.PDFDocument).toBe('function')

apps/sim/lib/execution/sandbox/bundles/verify.test.ts

@@ -2,15 +2,12 @@ import vm from 'node:vm'
 import type { SandboxBundleName } from '@/lib/execution/sandbox/types'
 
 /**
- * Evaluates a built sandbox bundle the way the isolated-vm worker will: as a
- * classic script in a context that has timers, `console`, and the text codecs
- * but no `require`, `process`, or `Buffer` of its own. Returns the export the
- * bundle registered on `globalThis.__bundles`, or throws with the bundle's own
- * error, so a bundle that references a helper the bundler never emitted fails
- * at build time and in the test suite instead of on the first document
- * generated in production.
+ * A context shaped like the isolated-vm worker's: timers, `console`, and the
+ * text codecs, but no `require`, `process`, `Buffer`, `atob`, or `btoa` of its
+ * own. Code that reaches for any other Node or browser global fails here the
+ * same way it fails inside the isolate.
  */
-export function evaluateSandboxBundle(source: string, name: SandboxBundleName): unknown {
+export function createBareSandboxContext(): vm.Context {
   const context: Record<string, unknown> = {
     setTimeout,
     clearTimeout,
@@ -22,7 +19,22 @@ export function evaluateSandboxBundle(source: string, name: SandboxBundleName):
     TextDecoder,
   }
   context.globalThis = context
-  vm.createContext(context)
+  return vm.createContext(context)
+}
+
+/**
+ * Evaluates a built sandbox bundle the way the isolated-vm worker will: as a
+ * classic script in a {@link createBareSandboxContext} context. Returns the
+ * export the bundle registered on `globalThis.__bundles`, or throws with the
+ * bundle's own error, so a bundle that references a helper the bundler never
+ * emitted fails at build time and in the test suite instead of on the first
+ * document generated in production.
+ */
+export function evaluateSandboxBundle(
+  source: string,
+  name: SandboxBundleName,
+  context: vm.Context = createBareSandboxContext()
+): unknown {
   vm.runInContext(source, context, { filename: `sandbox/${name}.cjs` })
 
   const bundles = context.__bundles

apps/sim/lib/execution/sandbox/bundles/verify.ts

@@ -91,8 +91,6 @@ describe('buildDocxFromContent', () => {
   })
 
   it('strips control characters that would make the package unopenable', async () => {
-    // The docx package writes run text into the XML verbatim, so a forbidden
-    // character reaching it produces invalid XML 1.0 rather than a rendering bug.
     const buffer = await buildDocxFromContent(`before${String.fromCharCode(8)}after`)
     const xml = await readDocumentXml(buffer)
 

apps/sim/lib/microsoft-word/document.server.test.ts

@@ -83,12 +83,7 @@ function parseInlineRuns(line: string): ContentRun[] {
 function parseContentBlocks(content: string): ContentBlock[] {
   const blocks: ContentBlock[] = []
 
-  // Stripped once here rather than per run: the `docx` package writes run text
-  // into the XML verbatim, so a stray control character from an upstream block
-  // would produce a package Word refuses to open. Tab, newline, and carriage
-  // return are legal XML and are outside the class, so the split below is
-  // unaffected.
-  for (const rawLine of stripInvalidXmlChars(content).replace(/\r\n?/g, '\n').split('\n')) {
+  for (const rawLine of content.replace(/\r\n?/g, '\n').split('\n')) {
     const line = rawLine.trimEnd()
     if (line.trim().length === 0) continue
 

apps/sim/lib/microsoft-word/document.server.ts

@@ -211,7 +211,7 @@
     "date-fns": "4.4.0",
     "decimal.js": "10.6.0",
     "diff": "9.0.0",
-    "docx": "^9.6.1",
+    "docx": "^9.15.2",
     "docx-preview": "^0.4.1",
     "drizzle-orm": "^0.45.4",
     "echarts": "6.1.0",

apps/sim/package.json

@@ -78,8 +78,6 @@ export const docxGenerateTask = defineSandboxTask<SandboxTaskInput>({
       }));
     };
   `,
-  // JSZip's browser build doesn't support nodebuffer output, so we go through
-  // base64 and decode back to bytes inside the isolate (avoids DataURL / Blob).
   finalize: `
     let doc = globalThis.doc;
     if (!doc && globalThis.__docxSections.length > 0) {
@@ -91,23 +89,7 @@ export const docxGenerateTask = defineSandboxTask<SandboxTaskInput>({
     if (!doc) {
       throw new Error('No document created. Use addSection({ children: [...] }) for chunked writes, or set globalThis.doc = new docx.Document({...}) for a single write.');
     }
-    const b64 = await globalThis.docx.Packer.toBase64String(doc);
-    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
-    const lookup = new Uint8Array(128);
-    for (let i = 0; i < alphabet.length; i++) lookup[alphabet.charCodeAt(i)] = i;
-    const clean = b64.replace(/=+$/, '');
-    const out = new Uint8Array(Math.floor((clean.length * 3) / 4));
-    let pos = 0;
-    for (let i = 0; i < clean.length; i += 4) {
-      const c0 = lookup[clean.charCodeAt(i)];
-      const c1 = lookup[clean.charCodeAt(i + 1)];
-      const c2 = lookup[clean.charCodeAt(i + 2)];
-      const c3 = lookup[clean.charCodeAt(i + 3)];
-      out[pos++] = (c0 << 2) | (c1 >> 4);
-      if (i + 2 < clean.length) out[pos++] = ((c1 & 0x0f) << 4) | (c2 >> 2);
-      if (i + 3 < clean.length) out[pos++] = ((c2 & 0x03) << 6) | c3;
-    }
-    return out.subarray(0, pos);
+    return new Uint8Array(await globalThis.docx.Packer.toArrayBuffer(doc));
   `,
   toResult: (bytes) => Buffer.from(bytes),
 })