Problem
Agents can generate useful document-preview HTML artifacts, but buzz upload file currently rejects text/html outright:
buzz upload file --file REPOS/buzz-document-worker-xlsx/.runs/thread-card-real-xlsx-v2/c126147e120f-preview.html
Observed:
unsupported file type: text/html
That leaves document-card workflows with only PNG fallback previews. The PNG fallback is useful, but it cannot support selectable text, intra-document links, accessibility, or richer document inspection.
Why this is distinct from generic file uploads
HTML is active content, so this should not be treated as the same class of allowlist issue as Office/PDF/downloadable files. The request is not necessarily “serve arbitrary HTML inline.” The product need is a safe way for agents to attach or publish generated preview artifacts for documents.
Possible acceptable designs:
- Upload as an attachment-only artifact with
Content-Disposition: attachment, never inline.
- Sanitize and sandbox generated HTML before serving.
- Provide a first-class document-preview artifact/package format that can carry HTML plus assets safely.
- Explicitly document that HTML previews are unsupported and that agents should use PNG/PDF-only previews.
Environment
- Buzz CLI binary:
/Applications/Buzz.app/Contents/MacOS/buzz
buzz --version: not exposed; command fails with unexpected argument --version- OfficeCLI:
1.0.143
- Git:
2.50.1 (Apple Git-155)
- Relay:
space-cowboy.communities.buzz.xyz
Impact
This blocks the interactive-preview half of an agent document worker. The worker can currently post PNG previews for .pptx, .docx, and .xlsx, but cannot attach the generated HTML preview artifact. Edited-file delivery is covered separately by #3083 for Office MIME upload support.
Problem
Agents can generate useful document-preview HTML artifacts, but
buzz upload filecurrently rejectstext/htmloutright:Observed:
That leaves document-card workflows with only PNG fallback previews. The PNG fallback is useful, but it cannot support selectable text, intra-document links, accessibility, or richer document inspection.
Why this is distinct from generic file uploads
HTML is active content, so this should not be treated as the same class of allowlist issue as Office/PDF/downloadable files. The request is not necessarily “serve arbitrary HTML inline.” The product need is a safe way for agents to attach or publish generated preview artifacts for documents.
Possible acceptable designs:
Content-Disposition: attachment, never inline.Environment
/Applications/Buzz.app/Contents/MacOS/buzzbuzz --version: not exposed; command fails withunexpected argument --version1.0.1432.50.1 (Apple Git-155)space-cowboy.communities.buzz.xyzImpact
This blocks the interactive-preview half of an agent document worker. The worker can currently post PNG previews for
.pptx,.docx, and.xlsx, but cannot attach the generated HTML preview artifact. Edited-file delivery is covered separately by #3083 for Office MIME upload support.