Skip to content

Docx Editor

v@eigenpal/[email protected] Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

docx docx-editor editor javascript msword next
+7 more
prosemirror react vite vue word word-editor wysiwyg

Summary

AI summary

Minor changes across DocxEditorRef API, live agent chat bridge, MCP server hardening and demos.

Full changelog

Minor Changes

  • c81fdd3: # Live agent chat + server-side MCP support

    A Word-API-style bridge that lets an AI agent read a DOCX, comment on it, suggest tracked changes, and scroll the view — live in a running editor, or server-side against a parsed file. Same tool catalog, same shape, two transports.

    The pattern

    Locate, then mutate. The agent calls a locate tool (read_document, read_selection, find_text) which returns paragraphs tagged with their stable Word w14:paraId. It passes those paraIds to mutate tools. paraIds survive concurrent edits and tool-loop iterations; ordinal indices don't.

    Ten agent tools

    OpenAI function-calling format (also accepted by Anthropic / Vercel AI SDK):

    • Locateread_document, read_selection, find_text, read_comments, read_changes
    • Mutateadd_comment, suggest_change (one tool, three modes via empty-string semantics: replacement / deletion / insertion at paragraph end), reply_comment, resolve_comment
    • Navigatescroll

    Exported from @eigenpal/docx-editor-agents as agentTools, getToolSchemas(), executeToolCall(name, args, bridge).

    Two bridges, same interface

    Everything wires into an EditorBridge interface. Two implementations ship:

    // Live editor in a browser
    import { useAgentChat } from '@eigenpal/docx-editor-agents/bridge';
    const { executeToolCall, toolSchemas } = useAgentChat({ editorRef, author: 'AI' });
    
    // Server-side, against a parsed DOCX
    import { DocxReviewer, createReviewerBridge } from '@eigenpal/docx-editor-agents';
    const reviewer = await DocxReviewer.fromBuffer(buffer, 'AI');
    const bridge = createReviewerBridge(reviewer);
    const result = executeToolCall('add_comment', { paraId, text }, bridge);
    

    Both expose the same 10 tools to the agent. The bridge layer abstracts the transport.

    MCP server (built-in, spec 2025-06-18)

    import { McpServer, createReviewerBridge, DocxReviewer } from '@eigenpal/docx-editor-agents';
    import { McpServer as _ } from '@eigenpal/docx-editor-agents/mcp';
    
    const server = new McpServer(bridge, { name: 'my-saas', version: '1.0.0' });
    const reply = server.handle(jsonRpcMessage); // sync, transport-free, never throws
    
    • Transport-agnostic core: wire server.handle() to HTTP-SSE, WebSocket, your queue worker, or a managed stdio process. The library does not pick a transport.
    • stdio adapter for customers who want to run the server inside a worker pool: runStdioServer(bridge) (Node-only).
    • Spec compliance: initialize / tools/list / tools/call / ping. Tool failures use the spec's {isError: true, content: [...]} envelope inside a successful JSON-RPC response; JSON-RPC errors are reserved for protocol-level problems. Includes UTF-8-safe chunk decoding (multi-byte codepoints don't break across stdio chunks) and a buffer cap to prevent memory DoS.

    A local-install stdio bin was prototyped and removed: one-document-per-config is the wrong shape for a contract-review product. The right deployment is a hosted MCP service the customer operates with their own auth + storage.

    Events

    bridge.onContentChange(listener) and bridge.onSelectionChange(listener) (both return unsubscribe functions) let host apps and MCP servers react to edits without owning the single React callback prop.

    • ContentChangeEvent ships { commentCount, changeCount, comments, changes }.
    • SelectionChangeEvent ships the current SelectionInfo or null. (Reviewer bridge: never fires — no caret in headless mode.)

    New on DocxEditorRef

    addComment({ paraId, text, author, search? }) → number | null
    replyToComment(commentId, text, author)        → number | null
    resolveComment(commentId)                       → void
    proposeChange({ paraId, search, replaceWith, author }) → boolean
    findInDocument(query, { caseSensitive?, limit? }) → FoundMatch[]
    getSelectionInfo()                              → SelectionInfo | null
    getComments()                                   → Comment[]
    onContentChange(listener)                       → () => void
    onSelectionChange(listener)                     → () => void
    

    scrollToParaId was already public.

    New on @eigenpal/docx-core

    findParagraphByParaId(doc, paraId) returns the PM range for a paragraph by paraId.

    Word JS API parity contract

    WordCompatBridge (exported type from the package root) formally documents every Office.js Word API method we mirror. A compile-time static assertion enforces that EditorBridge satisfies it. If we drop or change a method that's part of the public Word-API mirror, typecheck breaks.

    Demos

    • examples/agent-use-demo (roast-my-doc) — server-side demo of the canonical "build your own MCP-shaped agent server" pattern: parse → createReviewerBridgeagentTools → tool-call loop with executeToolCalltoBuffer(). The route's preamble shows the one-line diff to convert it to a real MCP server.
    • examples/agent-chat-demo (chat with your doc) — live editor + chat panel. Demonstrates useAgentChat against a running <DocxEditor>.

    Both demos support ALLOWED_ORIGINS env var for production deployments (open by default for local dev), forward client AbortSignal to OpenAI calls, and cap upload size.

    Hardening

    • proposeChange refuses to layer onto an existing tracked-change run (would produce invalid OOXML).
    • Ambiguous search arguments return an error instead of silently mistargeting.
    • scroll does not steal the user's caret.
    • Comment IDs and tracked-change revisionIds use the shared monotonic counter to avoid collisions in OOXML.
    • Mark guards if a host StarterKit omits comment / insertion / deletion extensions.

    Spec

    specs/live-agent-chat.md.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Docx Editor

Get notified when new releases ship.

Sign up free

About Docx Editor

All releases →

Related context

Earlier breaking changes

Beta — feedback welcome: [email protected]