OfficeCLI

The build workflow defaults to contents: read and confines release write access to the release job; macOS artifacts are signed, entitlement-checked, and notarized, while npm publishing uses short-lived OIDC and provenance and releases include SHA-256 checksums. The documentation identifies file mutation, deferred resident-session flushes, a local preview server, automatic updates, PATH installation, and agent-skill installation, and explains how to disable updates. Deductions apply because a bare invocation can trigger installation and no per-effect confirmation is shown for overwriting files, changing PATH, installing skills, or updating. Data flows for updates, installers, MCP, external images, and rendering resources are not fully mapped, and handling of sensitive documents in logs, temporary files, network isolation, and cleanup is unspecified. Atomic batch rollback is strong but limited to batch mode; ordinary edits, installation, and updates lack a general undo or backup mechanism. Apache-2.0, the project name, website, and repository organization provide attribution, but the publisher remains unverified and the responsible legal or maintenance entity is not fully identified.

The README, build matrix, and release workflows are broadly consistent about platform artifacts, installation channels, and core commands. Multi-platform smoke tests cover creating, editing, reading, closing, and installing, while installer tests exercise the production mirror and GitHub fallback. Self-contained binaries and several package channels provide good ordinary-use availability evidence. Deductions apply because the extensive feature surface is not matched by source-provided tests, and absolute claims such as no dependencies and works everywhere are not qualified against browser rendering, network installation, or platform constraints. Workflows contain explicit version validation, file-existence checks, and failing exits, but the material lacks a systematic account of CLI error schemas, troubleshooting, or common runtime messages.

The material explicitly addresses AI agents, humans, developers, and teams, with concrete scenarios including report generation, batch processing, CI/CD, containers, template population, and quality checks. The three-layer architecture, format matrix, platform binaries, environment controls, resident and batch modes, MCP integration, and raw-XML fallback demonstrate strong environment fit. Deductions apply because capability boundaries are expressed mostly as broad support lists, with little treatment of unsupported or partial OOXML features, compatibility differences, or resource ceilings. Selectors and commands are precise, but agent-facing trigger conditions, hazardous-operation constraints, and mandatory confirmation points are not comprehensively defined.

The README has strong audience-oriented organization, quick starts, capability sections, use cases, installation guidance, architecture, integration material, multilingual entry points, and numerous focused examples. Installation channels, artifact names, verification commands, configuration location, and update controls are specific, and the complete Apache-2.0 license agrees with the metadata. Deductions apply because officecli, @officecli/officecli, and @aionui/officecli create multiple naming surfaces without a stated compatibility or deprecation policy. Limitations are scattered through resident-flush, signing, and npm notes rather than collected in a limitations or FAQ section. Tag-based releases, generated release notes, and a version command establish an update path, but the supplied material has no standalone changelog, support lifecycle, or named maintainers; the security policy promises only a reasonable acknowledgement timeframe.

Plain text, structured JSON, HTML, PNG, live preview, template merging, replayable batch JSON, and granular DOM/XML operations are directly usable by agents and automation pipelines, with clear representative examples. Consolidating three Office formats, rendering, formulas, and pivot operations in one CLI offers substantial potential marginal value over several format-specific libraries. Deductions apply because claims of being first, best, high fidelity, universal, and able to modify any element are chiefly self-asserted. Binary size, startup and rendering cost, large-document performance, resource consumption, compatibility loss, and adoption risk are not quantified, leaving the cost-benefit case strong in concept but incomplete.

Installation, release, signing, notarization, checksum, platform-matrix, and smoke-test claims can be traced across workflows, the security policy, and the license, while the README points many features to focused documentation. Deductions apply because the supplied evidence omits implementation code, linked wiki contents, test results, and auditable generation fixtures, so most fine-grained format claims remain traceable only to README assertions. Several files corroborate the installation and publishing story, but functionality, fidelity, and coverage lack independent in-source corroboration. Marketing facts and inference are not cleanly separated, particularly the world's first and best and entirely AI-created showcase claims, for which no substantiation method is provided.