From 61d6f0e551d110e8a3fd39548edfea6fbc1b71a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gil=20Assun=C3=A7=C3=A3o?= <gil.assuncao@parceiros.nos.pt>
Date: Fri, 9 Oct 2026 12:12:37 +0100
Subject: [PATCH] feat: Support XLSB (Excel Binary Workbook) Sandbox Artifacts

Add .xlsb to the hardened egress gateway's artifact policy and the
sandboxed Python image's spreadsheet packages, so Code Interpreter
sessions can produce and read Excel Binary Workbook files end to end.

- protocol.ts: add .xlsb to BRIDGE_ARTIFACT_EXTENSIONS (the egress
  gateway's output allow-list) and map it to
  application/vnd.ms-excel.sheet.binary.macroenabled.12 in
  BRIDGE_ARTIFACT_MEDIA_TYPES, next to the existing .xls/.xlsx entries.
  Without the first change, a sandboxed script that writes a .xlsb
  output would have it rejected by the gateway with a generic
  'unsupported file type' error.
- build-packages.sh / docker/package-init.sh: add python-calamine next
  to the existing xlrd entry in both the Docker-image-bake and
  PVC/direct-NsJail install paths (hand-maintained parallel lists, not
  generated from one another). pandas cannot auto-detect the .xlsb
  engine the way it does for .xlsx/.xls, so sandboxed code reads these
  files via pd.read_excel(path, engine='calamine'). calamine was
  chosen over pyxlsb (the other common option) because it's a single,
  faster, Rust-backed engine that also already handles
  .xlsx/.xls/.ods, rather than adding a second, XLSB-only dependency.
- protocol.test.ts: extend the existing bridge-artifact-policy test
  with explicit .xlsb assertions covering both the extension allow-list
  and the media-type mapping.

No change needed on the librechat side's code-interpreter integration:
once librechat's own XLSB support lands, the existing text-extraction
path already calls into this same engine.
---
 build-packages.sh                  | 1 +
 docker/package-init.sh             | 1 +
 packages/code/src/protocol.test.ts | 9 +++++++++
 packages/code/src/protocol.ts      | 5 +++--
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/build-packages.sh b/build-packages.sh
index 1d635297..9ebd90d7 100755
--- a/build-packages.sh
+++ b/build-packages.sh
@@ -188,6 +188,7 @@ install_python_packages() {
         beautifulsoup4 \
         tabulate \
         xlrd \
+        python-calamine \
         numba \
         patsy \
         numexpr \
diff --git a/docker/package-init.sh b/docker/package-init.sh
index 4b96305f..19ad83c3 100644
--- a/docker/package-init.sh
+++ b/docker/package-init.sh
@@ -208,6 +208,7 @@ if [ -f "$PIP_PATH" ]; then
         beautifulsoup4 \
         tabulate \
         xlrd \
+        python-calamine \
         numba \
         patsy \
         numexpr \
diff --git a/packages/code/src/protocol.test.ts b/packages/code/src/protocol.test.ts
index 25c00cf3..9e1ac2b3 100644
--- a/packages/code/src/protocol.test.ts
+++ b/packages/code/src/protocol.test.ts
@@ -988,6 +988,15 @@ test('bridge artifact policy and media types match the hardened gateway contract
   assert.equal(bridgeArtifactMediaType('preview.png'), 'image/png');
   assert.equal(bridgeArtifactMediaType('reports/result.json'), 'application/json');
   assert.equal(bridgeArtifactMediaType('Dockerfile'), 'application/octet-stream');
+  // XLSB (Excel Binary Workbook) — sandboxed code can produce these via
+  // `pd.read_excel(path, engine='calamine')`-backed workflows; the egress
+  // gateway must accept them with the correct Content-Type rather than
+  // falling back to application/octet-stream.
+  assert.equal(isSupportedBridgeArtifactName('report.xlsb'), true);
+  assert.equal(
+    bridgeArtifactMediaType('report.xlsb'),
+    'application/vnd.ms-excel.sheet.binary.macroenabled.12',
+  );
 });
 
 test('linked-worktree lanes nest beneath their checkout key and conflict only with it', () => {
diff --git a/packages/code/src/protocol.ts b/packages/code/src/protocol.ts
index 1451986d..e6488c66 100644
--- a/packages/code/src/protocol.ts
+++ b/packages/code/src/protocol.ts
@@ -111,6 +111,7 @@ const BRIDGE_ARTIFACT_EXTENSIONS = new Set([
     '.pptx',
     '.xls',
     '.xlsx',
+    '.xlsb',
     '.odt',
     '.ods',
     '.odp',
@@ -241,8 +242,8 @@ const BRIDGE_ARTIFACT_MEDIA_TYPES: Readonly<Record<string, string>> = {
   '.woff': 'font/woff',
   '.woff2': 'font/woff2',
   '.xls': 'application/vnd.ms-excel',
-    '.xlsx':
-        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  '.xlsb': 'application/vnd.ms-excel.sheet.binary.macroenabled.12',
   '.xml': 'application/xml',
   '.yaml': 'application/yaml',
   '.yml': 'application/yaml',