Show HN：面向 AI 的开源 Microsoft 与 Google Office 替代方案

InjOffice 是一组用于编辑办公文档产物的浏览器和服务器库。它提供纯 JSON 模型、纯转换引擎、与提供商无关的 Agent 变更集、可选编辑器集成，以及精细化的 OOXML 修补。不要求使用托管的 InjOffice 服务：使用者可以采用浏览器本地 WASM 引擎、离线运行、注入自己的后端，或选择使用仓库内的 injoffice-server。

该仓库是一个 monorepo，包含可独立使用的 TypeScript 包、私有应用和 Go 模块。TypeScript 包面向 Node.js 22 或更高版本及现代打包器。UI 集成使用 React，并在注明的情况下将 Univer OSS 作为可选编辑器外壳。Univer 并非文件权威来源。原生绘制编译器目前属于预览模式。

发布状态（2026-09-08）：源代码采用 Apache-2.0 许可证；26 个 npm 包中已有 25 个以 0.1.0 版本发布。@injoffice/xlsx-wasm 尚未发布。参见发布检查清单。限定范围内的 v3 Native Office 完成度矩阵已完成；更广泛的格式覆盖仍不完整，这并不等同于实现 Microsoft Office 兼容性。

原始 OOXML 字节始终是权威来源。支持的路径以 XLSX 为优先，文档和演示文稿采用相同的结构：

1. Go Extract* 读取包字节（xlsxpatch.ExtractNativeWorkbookV1 / ExtractNativeWorkbookV2、docxpatch.ExtractNativeDocumentV1、pptxpatch.ExtractNativePPTX）。
2. 结果是由 @injoffice/sheets、@injoffice/docs 和 @injoffice/pptx-native 消费的带版本原生 JSON。
3. TypeScript 绘制编译器输出与渲染器无关的预览命令。绘制不是保存路径。
4. 编辑器输出变更 JSON。
5. Go Apply* 将这些变更写回原始归档文件。

React、Konva、DOM/HTML 布局、截图和 Univer 都不得决定文件身份或通过/失败语义。

packages/ 下有 26 个 TypeScript 包：

私有工作区应用（未发布）：

go/ 下的 Go 模块包括精细化文件写入器、原生提取/应用引擎、验证器、可选的进程内协作中心以及可选 HTTP 服务器：

每个 TypeScript 包都有自己的 README 和五分钟示例。

对于使用 Univer 0.25.1 的 npm 使用者（包括协作包的 peer dependency），请在应用根目录的 package.json 中添加 "overrides": { "@univerjs/core": { "nanoid": "5.1.16" } }，运行 npm install，并检查 npm audit。仓库自身的 override 不会传播到使用者。参见依赖项公告与缓解措施。

前置条件：Node.js 22+，以及各模块 go.mod 中声明的 Go 版本。

npm ci
npm run typecheck
npm test
npm run build
npm run check:packages

check:packages 会导入每个已构建的 ESM 入口并检查每个 npm pack 载荷，从而让仅含源代码或内容不完整的发布在 CI 中失败。

按以下方式运行浏览器 playground：

直接打开 http://127.0.0.1:3100，将进入 Sheets——四个完整工作区中的第一个，另外三个为 Docs、Slides 和 PDF。介绍页已移除；旧版 #/overview 链接会打开 Sheets。26 个 TypeScript 包的现有能力被归入这些示例中，而非单独的侧边栏页面。高级视图在不共享文档产物模型时，会使用明确标记的独立示例。

创建和编辑：

• #/sheets：实时工作簿，以及原生 XLSX 检查和受限写回
• #/docs：浏览器本地真实 DOCX 提取、受保护的文本写回、精确字节读回，以及明确的保留/拒绝证据；它不声称支持 Word 分页或页面绘制
• #/slides：DeckSpec 创作、主题、可编辑转场、布局 QC 和画布编辑
• #/pdf：真实文件 PDF 查看、高 DPI 渲染、导航、缩放、文本搜索、大纲检查、当前页旋转和下载

在 Sheets 中，Analyze 和 More 工具包括：

• #/sheets?feature=charts、pivots、shapes、connectors 和 formulas（旧版独立 hash 仍可作为兼容书签使用）。

其他功能仍位于各自相关的工具工作区内；以下旧版书签仍会选择对应的内部视图：

• #/agent：跨 XLSX、DOCX、PPTX 和 PDF 形态文档产物的、与提供商无关的能力发现、受限检查、不可变规划、预览/差异比较、验证、人工审批、原子提交、核验和拒绝证明
• #/history：结构化工作簿和文档差异比较
• #/pptx-authored、#/pptx-native 和 #/pptx-render：包括浏览器本地受限 PPTX 文本和 AutoShape 变更、精确字节重新提取验证和下载
• #/font-metrics：具有明确 Node 字形塑造边界的浏览器安全布局契约
• #/collab：面向工作表、文档、演示文稿和 PDF 注释的零配置双编辑器浏览器协作模拟，并提供 HTTP + SSE sidecar 验证作为一种集成模式

playground 会在每条路由上标记运行时边界。多数验证完全在浏览器中运行。原生 XLSX、DOCX 和 PPTX 提取/应用默认使用浏览器 Worker 中版本匹配的 Go WASM 引擎；其服务器回退路径需明确选择，绝不会自动启用。服务器集成协作模式仍运行在可选 Go sidecar 上。React 外壳不是第二个 OPC 写入器。

可选的 injoffice-server 会复用相同的提取/变更处理程序，并将包存储在不透明文档产物 ID 下（默认 localhost）：

cd go/injoffice-server
go run ./cmd/injoffice-server

或者，在仓库根目录执行：

docker compose up --build

Vite 会将 /healthz、/v1/capabilities、/v1/xlsx、/v1/docx、/v1/pptx 和 /v1/collab 代理至服务器。Compose 仅发布服务器，不运行 playground。请单独启动 Vite playground，将 VITE_INJOFFICE_API_BASE 设置为明确的服务器源地址以启用 XLSX、DOCX 和 PPTX 回退功能，然后在 #/sheets、#/docs 或 #/pptx-native 中选择它；或者将 #/collab 切换至 HTTP + SSE 集成模式。空 API base 永远不会启用同源回退。该服务器是一个本地开发 sidecar，不具备身份验证、授权、租户隔离或限流能力；请勿将其直接暴露到互联网。

静态部署不包含该本地代理，但默认 XLSX、DOCX 和 PPTX 浏览器路径不需要 API。自托管构建可将 VITE_INJOFFICE_API_BASE 设置为受保护且 API 兼容宿主的 HTTPS 源地址，以启用明确的服务器回退。

可选的 @injoffice/xlsx-wasm、@injoffice/docx-wasm 和 @injoffice/pptx-wasm 包将相应的 Go 提取/应用函数封装在浏览器 Worker 中，使受支持的本地工作流无需 Go sidecar 即可运行。playground 默认使用 XLSX、DOCX 和 PPTX 浏览器路径，除非用户选择已明确配置的服务器回退，否则不会上传包字节。请参阅每个包的 README，以及对应的 go/*patch/cmd/*nativewasm/README.md 绑定文档。

独立运行一个 Go 模块，例如：

cd go/xlsxpatch
go test ./...

• **原生文件 API。**Go Extract* → 原生 JSON（@injoffice/sheets、@injoffice/docs、@injoffice/pptx-native）→ TypeScript 绘制编译器（预览）→ 变更 JSON → Go Apply*。
• **纯数据契约。**原生 JSON、ChartSpec、PivotSpec、DeckSpec 和 wire 类型均兼容 JSON，且独立于特定宿主。
• Agent 变更集。@injoffice/agent-tools 管理与提供商无关的检查 → 规划 → 预览/差异比较 → 验证 → 审批 → 提交 → 核验生命周期。格式适配器会声明精确的 JSON Schema 能力，并拒绝不受支持的工作；应用保留对模型、提示词、授权、存储和 UI 的控制权。
• **纯核心，可选外壳。**聚合、提取、差异比较、分页、绘制编译和变更可以在没有 React、Univer 或 DOM 的情况下运行。Univer 是可选编辑器外壳，而非文件权威来源。
• **可选运行时。**库可离线运行，也可使用宿主注入的后端。XLSX、DOCX 和 PPTX WASM 运行时是 playground 的浏览器本地默认选项；仓库内的 injoffice-server 仍是用于存储、协作和集中式信任或策略执行的可选组件。公开发布内容仅包含通用库和服务器组件，绝不包含使用者专属后端代码、身份验证配置、租户数据或凭据。
• **失败即关闭的保真度。**精细化写入器从原始 OOXML 字节开始，并保留未改动的 ZIP 部件。如果请求的编辑无法安全完成，应返回错误，而非静默重建并丢弃不受支持的内容。

限定范围内的 v3 完成度矩阵所列能力已经完成，但该范围之外的原生格式覆盖仍不完整。请勿假定具备 Microsoft Office、LibreOffice 或无限制 Excel 往返处理的兼容性。有关精确状态，请参阅Native Office 完成度和公开发布。

InjOffice 仍处于 1.0 之前阶段。在公开契约稳定之前，API 可能会在次要版本之间演进。各包均记录了其能力和限制；路线图文字不构成兼容性保证。

InjOffice is a set of browser and server libraries for editing office artifacts. It adds plain-JSON models, pure transformation engines, provider-neutral agent change sets, optional editor integrations, and surgical OOXML patching. A hosted InjOffice service is not required: consumers can use the browser-local WASM engine, run offline, inject their own backend, or opt into the in-repo injoffice-server.

The repository is a monorepo with independently consumable TypeScript packages, private apps, and Go modules. The TypeScript packages target Node.js 22 or newer and modern bundlers. UI integrations use React and, where noted, Univer OSS as an optional editor shell. Univer is not the file authority. Native paint compilers are a preview mode.

Release status (2026-09-08): the source is licensed under Apache-2.0; 25 of 26 npm packages are published at 0.1.0. @injoffice/xlsx-wasm is not yet published. See the release checklist. The scoped v3 Native Office completion matrix is complete; broader format coverage remains partial and this is not Microsoft Office parity.

The original OOXML bytes remain the authority. The supported path is XLSX-first and the same shape for documents and presentations:

1. Go Extract* reads package bytes (xlsxpatch.ExtractNativeWorkbookV1 / ExtractNativeWorkbookV2, docxpatch.ExtractNativeDocumentV1, pptxpatch.ExtractNativePPTX).
2. The result is versioned native JSON consumed by @injoffice/sheets, @injoffice/docs, and @injoffice/pptx-native.
3. TypeScript paint compilers emit renderer-neutral preview commands. Paint is not a save path.
4. Editors emit mutation JSON.
5. Go Apply* writes those mutations back into the original archive.

React, Konva, DOM/HTML layout, screenshots, and Univer must not decide file identity or pass/fail semantics.

Twenty-six TypeScript packages under packages/:

Private workspace apps (not published):

Go modules under go/ are surgical file writers, native extract/apply engines, validators, an optional in-process collaboration hub, and an optional HTTP server:

Each TypeScript package has its own README and five-minute example.

For npm consumers using Univer 0.25.1 (including the collaboration package's peer dependency), add "overrides": { "@univerjs/core": { "nanoid": "5.1.16" } } to your application's root package.json, run npm install, and check npm audit. The repository's override does not propagate to consumers. See the dependency advisory and mitigation.

Prerequisites: Node.js 22+ and the Go versions declared by each module's go.mod.

npm ci
npm run typecheck
npm test
npm run build
npm run check:packages

check:packages imports every built ESM entry and inspects every npm pack payload so source-only or incomplete releases fail in CI.

Run the browser playground with:

Open http://127.0.0.1:3100 directly into Sheets, the first of four comprehensive workspaces: Sheets, Docs, Slides, and PDF. The introduction is removed; legacy #/overview links open Sheets. Existing capabilities from the twenty-six TypeScript packages are grouped inside those examples, not separate sidebar pages. Advanced views use explicitly labelled independent samples where they do not share an artifact model.

Create and edit:

• #/sheets live workbook plus native XLSX inspection and bounded write-back
• #/docs browser-local real DOCX extraction, guarded text write-back, exact-byte readback, and explicit preservation/refusal evidence; it does not claim Word pagination or page-paint
• #/slides DeckSpec authoring, themes, editable transitions, layout QC, and canvas editing
• #/pdf real-file PDF viewing, high-DPI rendering, navigation, zoom, text search, outline inspection, current-page rotation, and download

Within Sheets, Analyze and More tools include:

• #/sheets?feature=charts, pivots, shapes, connectors, and formulas (the old standalone hashes remain compatible bookmarks).

Other capabilities remain inside their relevant tool workspace; these legacy bookmarks still select the corresponding internal view:

• #/agent provider-independent capability discovery, bounded inspection, immutable planning, preview/diff, validation, human approval, atomic commit, verification, and refusal proofs across XLSX, DOCX, PPTX, and PDF-shaped artifacts
• #/history structured workbook and document diffs
• #/pptx-authored, #/pptx-native, and #/pptx-render, including browser-local bounded PPTX text and AutoShape mutation, exact-byte re-extraction verification, and download
• #/font-metrics browser-safe layout contracts with an explicit Node shaping boundary
• #/collab zero-setup, two-editor browser collaboration simulation for sheets, documents, decks, and PDF annotations, with the HTTP + SSE sidecar proof available as an integration mode

The playground labels the runtime boundary on every route. Most proofs run entirely in the browser. Native XLSX, DOCX, and PPTX extract/apply use version-matched Go WASM engines in browser Workers by default; their server fallbacks are explicit and never automatic. The server-integration collaboration mode stays on the optional Go sidecar. The React shell is not a second OPC writer.

An optional injoffice-server reuses those same extract/mutation handlers and stores packages under opaque artifact IDs (localhost by default):

cd go/injoffice-server
go run ./cmd/injoffice-server

Or, from the repository root:

docker compose up --build

Vite proxies /healthz, /v1/capabilities, /v1/xlsx, /v1/docx, /v1/pptx, and /v1/collab to the server. Compose publishes the server only; it does not run the playground. Start the Vite playground separately, set VITE_INJOFFICE_API_BASE to an explicit server origin to enable XLSX, DOCX, and PPTX fallback, then select it under #/sheets, #/docs, or #/pptx-native; or switch #/collab to its HTTP + SSE integration mode. An empty API base never enables a same-origin fallback. The server is a local development sidecar with no authentication, authorization, tenant isolation, or rate limiting; do not expose it directly to the internet.

Static deployments do not include that local proxy, but the default XLSX, DOCX, and PPTX browser paths need no API. A self-hosted build can set VITE_INJOFFICE_API_BASE to the HTTPS origin of a secured, API-compatible host for the explicit server fallback.

The optional @injoffice/xlsx-wasm, @injoffice/docx-wasm, and @injoffice/pptx-wasm packages wrap the corresponding Go extract/apply functions in browser workers, allowing supported local workflows without the Go sidecar. The playground uses XLSX, DOCX, and PPTX browser paths by default and does not upload package bytes unless the user selects an explicitly configured server fallback. See each package README and the matching go/*patch/cmd/*nativewasm/README.md binding documentation.

Run a Go module independently, for example:

cd go/xlsxpatch
go test ./...

• Native file API. Go Extract* → native JSON (@injoffice/sheets, @injoffice/docs, @injoffice/pptx-native) → TypeScript paint compilers (preview) → mutation JSON → Go Apply*.
• Plain data contracts. Native JSON, ChartSpec, PivotSpec, DeckSpec, and the wire types are JSON-compatible and independent of a particular host.
• Agent change sets. @injoffice/agent-tools owns a provider-neutral inspect → plan → preview/diff → validate → approve → commit → verify lifecycle. Format adapters advertise exact JSON-schema capabilities and refuse unsupported work; applications retain model, prompt, authorization, storage, and UI control.
• Pure core, optional shell. Aggregation, extraction, diffing, pagination, paint compilation, and mutations can run without React, Univer, or the DOM. Univer is an optional editor shell, not the file authority.
• Optional runtime. Libraries work offline or with a host-injected backend. The XLSX, DOCX, and PPTX WASM runtimes are the playground's browser-local defaults; the in-repo injoffice-server remains optional for storage, collaboration, and centralized trust or policy enforcement. Public releases contain only generic library and server components, never consumer-specific backend code, authentication configuration, tenant data, or credentials.
• Fail-closed fidelity. Surgical writers start from original OOXML bytes and preserve untouched ZIP parts. If a requested edit cannot be performed safely, it should return an error rather than silently rebuild and discard unsupported content.

The capabilities enumerated by the scoped v3 completion matrix are complete, but native format coverage outside that scope remains partial. Do not assume Microsoft Office, LibreOffice, or unrestricted Excel round-trip parity. See Native Office completion and Public release for the precise status.

InjOffice is pre-1.0. APIs may evolve between minor versions until the public contracts stabilize. Capabilities and limitations are documented per package; roadmap text is not a compatibility guarantee.