
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@office-agents/bridge
Advanced tools
Local HTTPS/WebSocket RPC bridge + CLI for developing and debugging Office Add-ins
Local development bridge for Office add-ins.
It lets a running add-in connect back to a local HTTPS/WebSocket server so external tools and CLIs can invoke real Office.js operations inside Excel, PowerPoint, or Word.
pnpm bridge:serve
pnpm bridge:stop
Or run the bridge CLI through the root script:
pnpm bridge -- list
pnpm bridge -- exec word --code "const body = context.document.body; body.load('text'); await context.sync(); return body.text;"
Package-local equivalents:
pnpm --filter @office-agents/bridge start
pnpm --filter @office-agents/bridge run cli -- list
The server defaults to:
https://localhost:4017wss://localhost:4017/wsIt expects the Office Add-in dev cert files at:
~/.office-addin-dev-certs/localhost.crt~/.office-addin-dev-certs/localhost.keyOverride with:
OFFICE_BRIDGE_CERTOFFICE_BRIDGE_KEYoffice-bridge list
office-bridge inspect word
office-bridge metadata excel
office-bridge events word --limit 20
office-bridge exec word --code "return { href: window.location.href, title: document.title }"
office-bridge exec word --sandbox --code "const body = context.document.body; body.load('text'); await context.sync(); return body.text;"
office-bridge tool excel screenshot_range --input '{"sheetId":1,"range":"A1:F20"}' --out range.png
office-bridge screenshot word --pages 1 --out page1.png
office-bridge screenshot excel --sheet-id 1 --range A1:F20 --out range.png
office-bridge screenshot powerpoint --slide-index 0 --out slide1.png
office-bridge vfs ls word /home/user
office-bridge vfs pull word /home/user/uploads/report.docx ./report.docx
office-bridge vfs push word ./local.txt /home/user/uploads/local.txt
If the bridge is already running, pnpm bridge:serve / office-bridge serve will report the existing healthy server instead of failing with EADDRINUSE.
To stop the bridge from another shell:
office-bridge stop
# or
pnpm bridge:stop
office-bridge exec uses unsafe direct evaluation by default so development agents can access the full taskpane runtime, browser globals, and Office host objects without going through sandboxedEval().
Use --sandbox if you explicitly want to run through the app's existing raw Office.js tool (eval_officejs / execute_office_js).
Use screenshot for a simpler image-to-file workflow:
office-bridge screenshot word --pages 1 --out page1.png
office-bridge screenshot excel --sheet-id 1 --range A1:F20 --out range.png
office-bridge screenshot powerpoint --slide-index 0 --out slide1.png
The CLI strips image base64 from printed JSON output, so screenshot commands don't flood stdout or model context windows.
You can also save image-returning tool calls directly with --out:
office-bridge tool excel screenshot_range --input '{"sheetId":1,"range":"A1:F20"}' --out range.png
The bridge can move files between the add-in VFS and your local filesystem:
office-bridge vfs ls word /home/user
office-bridge vfs pull word /home/user/uploads/report.docx ./report.docx
office-bridge vfs push word ./notes.txt /home/user/uploads/notes.txt
office-bridge vfs rm word /home/user/uploads/notes.txt
vfs ls currently enumerates files via a VFS snapshot in the add-in runtime, so it is meant for development/debugging rather than high-performance file browsing.
Apps import startOfficeBridge() from @office-agents/bridge/client and pass the current AppAdapter.
The client auto-enables on localhost by default. You can override with:
?office_bridge=1?office_bridge_url=wss://localhost:4017/wsoffice-agents-bridge-enabledoffice-agents-bridge-urlFAQs
Local HTTPS/WebSocket RPC bridge + CLI for developing and debugging Office Add-ins
The npm package @office-agents/bridge receives a total of 6 weekly downloads. As such, @office-agents/bridge popularity was classified as not popular.
We found that @office-agents/bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.