Drive and Office
Glitr keeps a Drive vault in your mailbox — personal files, plus isolated trees per contact and group. Office editors open and save those bytes in-process. Drive and Office are not part of the recipient crypto cascade or the live WebRTC path. Sending a file to a peer still goes through the normal chat or live attachment flow.
This page is the office / office-ui sibling libraries and how whatsup hosts Drive. Record shapes stay on Data structures. How the shell sits on the rest of the stack is the Architecture product map.
The product path is closed-source. The office gallery is the public surface you can press: positive-intentions.github.io/office.
Product wiring
whatsup links Office on the GUI feature and hosts the Drive tab:
| Piece | Role |
|---|---|
| office | Platform-free engines: word, spreadsheet, slides, notes, blank templates, DOCX / XLSX / PPTX / .note I/O |
| office-ui | Dioxus hosts (MountPreparedApp), Monaco for text/markdown, ribbon chrome, office_new_file_kinds() |
glitr-client drive | List / upsert / delete / conflict / import over /resources/drive-* |
whatsup drive/ | Volume adapter + DrivePage at /drive |
| whatsup-ui | Explorer chrome only (VolumeExplorer, new-file dialog, open-with) — no link to office engines |
Cargo: the gui feature enables optional office and office-ui. Desktop and browser GUI builds get the full Drive tab. TUI and stub platforms do not mount the office hosts.
| Host module | Role |
|---|---|
drive/volume.rs | VolumeHandle over glitr-client::drive for the current scope |
drive/page.rs | Scope sidebar, explorer, open/save, conflict UI, send-from-Drive |
gui.rs | Route /drive, NavTarget::Drive, speed dial |
whatsup-ui owns navigation (NavTarget::Drive, contact/chat files routes) and the file explorer UI. whatsup registers the mailbox-backed volume, opens files through office-ui, and writes bytes back through glitr-client. UI details: UI/UX.
Open prepares bytes (or a blank seed), mounts a host, and on save upserts a DriveEntry (and blob or CAS file). Listing never loads file bytes.
office
office is the shared Rust core. No Dioxus or DOM dependencies. Consumers drive an editor model and paint results.
| Concern | Behavior |
|---|---|
| Word | Editor + DOCX import/export (best-effort OOXML) |
| Spreadsheet | SpreadsheetWorkbook + Formualizer formulas; CSV / JSON / XLSX |
| Slides | SlideEditor / Deck + PPTX import/export |
| Notes | NotesEditor / .note ZIP; Markdown / HTML / plain exports |
| Blank | blank_file_bytes seeds for new-file cards (.txt, .md, .docx, .xlsx, .pptx, .note) |
| Archive | ZIP helpers for demos and encrypted sample packs |
| Tools | OfficeSession / tool registry for gallery Local AI assistants (product host may leave this unused) |
Formats are file payloads inside Drive. They are not new GraphQL collections.
office-ui
office-ui is the shared GUI host layer for Drive and the office gallery.
| Surface | Role |
|---|---|
MountPreparedApp / PreparedOpen | Open a path + bytes into Word, Sheet, Slides, Notes, or text/markdown |
| Hosts | WordAppHost, SpreadsheetAppHost, SlideDeckAppHost, NotePadAppHost, TextMarkdownAppHost |
| Monaco | Plain text and Markdown editing in the browser/webview |
| New file | office_new_file_kinds() cards used by Drive and the Files story |
The gallery (office-gallery) uses the same hosts with story seeds. The product host wires a real mailbox volume instead of mock storage.
Drive vault
Drive is mailbox persistence (schema messaging v11). Paths and names live inside sealed JSON; the git tree only shows UUIDs under drive/ and drive-blobs/.
| Concern | Behavior |
|---|---|
| Scopes | personal, contact, or group (scopeId empty for personal) |
| Storage | inline (bytes in DriveBlob) or cas (password-sealed under .drive-cas/) |
| Sync | sync (may leave with the repo) or local (.drive-local/ — never leave this device) |
| Soft delete | deletedAt; trash views filter in the host |
| Import | Chat attachments can copy into a contact/group tree (importedFromMessageId for idempotency) |
| Conflicts | Host can keep local, take remote, or keep both as a sibling entry |
Large or local-only files stay out of git staging via .gitignore. Field-level shapes: Data structures. How sealing and git layout work: Persistence.
Gallery
| Piece | Role |
|---|---|
| office | Engine tests and blank/I/O helpers |
| office-ui | Hosts reused by product Drive and gallery stories |
| office-gallery | Dioxus stories: Word, Spreadsheet, Slide deck, Note Pad (plus Files explorer story) |
Gallery stories can dock a Local AI assistant (skills + MCP-shaped office::tools). The office crate stays tool-only; the gallery host wires ai-web / ai-core. Product Local AI chat is a separate route — see Local AI.
Privacy and network
| Claim | Meaning |
|---|---|
| Sealed at rest | Drive rows use the connect-password envelope (Argon2id then AES-GCM), same as other sealed mailbox types |
| Not recipient crypto | Opening a spreadsheet does not cascade to a peer; send is an explicit chat/live action |
| Scoped trees | Contact and group Drives are isolated; personal Drive is not auto-shared |
| Git host sees | UUID filenames and sizes for synced rows; paths and names stay inside sealed JSON |
| Local-only | syncPolicy: local and .drive-local/ stay on this device |
| Residual | A clone of your repo without the password sees envelopes; with the password, Drive contents are readable like other sealed docs |
Runtime and limits
- Browser and desktop GUI: Drive + office hosts on the
guifeature. - TUI / stub: no office mount; Drive is a graphical path.
- I/O: OOXML import/export is best-effort, not a fidelity claim against Microsoft Office.
- License: office code is AGPL-3.0-only; third-party crates keep their own licenses.
Next: Data structures for DriveEntry / DriveBlob fields. How the shell mounts Drive chrome is on UI/UX.