Module extract 

Everything derived from a non-image attachment: a short text preview for the tile, a text version of Office documents (no agent reads those), the page count of a PDF, and whether an Office file carries macros. docs/specs/SPEC_AGENT_PANE_FILE_ATTACHMENTS_2026_09_26.md §6.

Office files are ZIPs, so every read here is bounded: an entry-count cap, a declared compression-ratio cap, one decompressed-bytes budget shared by all parts (the zip crate never reads past an entry’s declared size, so the declared sizes bound the work), quick-xml with predefined entities only, a cap on the text produced, and a wall-clock deadline.

Parsing runs in a child process (CHILD_ARG): srv re-runs its own executable, reads the result from its stdout and kills it after DEADLINE. Whatever a hostile file does to a parser (panic, deep recursion, a sheet that loads for minutes, memory) happens to the child.

Structs

ExtractError

Why no text version was made.

PdfFacts

What can be read out of a PDF.

TextOutcome 🔒

What the child reports for a text version: the text, none for this kind, or why it failed.

Enums

ChildRun 🔒

How a child run ended.

OdfOrOoxml 🔒

Constants

CHILD_ARG

The hidden argument srv re-executes itself with to read a document in a separate process: srv __extract <pdf|text> <kind> <path> <name> (see run_child and main.rs).

DEADLINE

MAX_COMPRESSION_RATIO

An entry claiming more than this ratio of uncompressed to compressed size is treated as a bomb.

MAX_DECOMPRESSED_BYTES

Total bytes all parts of one document may decompress to.

MAX_PDF_BYTES_FOR_COUNT

PDFs larger than this aren’t opened for a page count.

MAX_TEXT_BYTES

Text versions are cut here (Codex refuses prompts over ~1M characters).

MAX_ZIP_ENTRIES

PREVIEW_BYTES

PREVIEW_LINES

Functions

cap_text 🔒

child_output 🔒

What the child prints for one request; None for a malformed request.

document_text

Text version of a Word/Excel/PowerPoint/RTF document, in this process. Production code calls document_text_isolated.

document_text_isolated

document_text in the child process.

docx_text 🔒

err 🔒

has_macros

Whether an OOXML package carries a VBA project, whatever its extension.

kind_from_str 🔒

office_text

Text version of an Office document (kind Word/Excel/PowerPoint), with a header saying where it came from. Ok(None) for kinds with no text version (legacy binary .doc/.ppt).

open_checked_zip 🔒

Open a ZIP after checking entry count and every entry’s declared ratio. Ok(None) if it isn’t a ZIP at all.

pdf_facts_in_process

Page count and text of a PDF, in this process. PDF parsers can panic or recurse deeply on malformed input: production code calls pdf_facts_isolated, which runs this in the child process.

pdf_facts_isolated

pdf_facts_in_process in the child process. A crash or timeout just means no facts.

pptx_text 🔒

Slides in presentation order: presentation.xml’s sldIdLst gives relationship ids, presentation.xml.rels maps them to slide parts.

read_part 🔒

Read one part as UTF-8, charging its bytes to budget.

relationship_targets 🔒

(Id, Target) pairs of a .rels part.

rtf_text

Plain text of an RTF document: control words dropped, {\*…} and a few non-text destinations skipped, \par/\line/\tab, \'hh and \uN decoded.

run_child

Entry point for the child process: srv __extract <mode> <kind> <path> <name>. Prints PdfFacts (pdf) or a text outcome (text) as JSON.

run_isolated 🔒

srv __extract <mode> <kind> <path> <name> with the deadline.

run_with_deadline 🔒

Run cmd with stdout piped, killing it after deadline.

spreadsheet_text 🔒

Every sheet as tab-separated rows under a ## Sheet heading. A ZIP workbook is checked with the same limits first; calamine then reads through the zip crate, which stops at each entry’s declared size. Loading one sheet can’t be interrupted, which is why this runs in the child process (document_text_isolated) that is killed at the deadline.

text_preview

The first lines of a text file, cut at a UTF-8 boundary.

xml_text 🔒

Plain text of one WordprocessingML, DrawingML or ODF part.