[nkwib]

PDF and Office viewer: 0.6.0 to 0.7.0. Documents open in Paseo's file tab on Paseo 0.13.0 and later, and the plugin now requires Paseo 0.13.0. New listing image for the file tab.

Release: https://github.com/nkwib/paseo-doc-viewer/releases/tag/v0.7.0

[paseo-bot]

PDF and Office viewer 0.7.0 is approved, @nkwib. I refreshed the review date and retained your updated overview, description and seven listing images. No changes are required from you.

For the next release, remove the old “Files tree does not open it here” bullet under Limits in OVERVIEW.md, since this release adds that support. This will keep the listing’s limitations consistent with its opening instructions. Overview guidance.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head bff2d08d2616e2ec84534c508bb18a0be9f915f4. Read the PR, all discussion/reviews (none), original submissions #551 and #545, current main and record history. Existing submitter/repository attribution matches.
• Independently fetched both Git artifacts from https://github.com/nkwib/paseo-doc-viewer.git: old 163b524b649d163dd493f702e3dc3b584389b2f5 (0.6.0), new 0f39c81883aef30711e0c5bce4fb2d41a544de0d (0.7.0). Annotated tag v0.7.0 resolves to the new commit. Inspected all 342 old and 361 new archive paths/types before confined extraction; regular files/directories only, no hooks or submodules. Archive SHA-256: old 9f54fb34d39dfb39faa5111e78556468248547d52eacb08eb9f02dcd717d4971, new e8317227f6b28bbd0093e6899a7fa497902664b1c4c9efa50615e653d2e391f2 (local evidence, not upstream signatures).
• Read the complete production delta, new file-panel registration/reader, absolute-to-workspace path mapping and RPC, affected reader/layout/settings paths, manifest, package/lock and displayed overview. Traced FilePanelReader → doc.locate → host-resolved workspace root → realpath containment → existing document RPC/readers. Absolute paths and symlink targets outside the workspace are rejected; missing leaves resolve existing ancestors before reporting outside/not-found. Content reading performs the existing containment checks again. The panel watches change/deletion events and unsubscribes on cleanup, with existing polling as fallback. No new independent network destination, credential read, project-file mutation, subprocess or runtime software installer in the production delta.
• Existing explicit Send review sends notes and selected PDF page images through Paseo to the chosen agent/provider, disclosed in the overview. Existing viewer state remains local to the daemon; existing PDFium worker evaluation receives pinned dependency glue rather than document text. Unchanged format readers/dependency internals were not exhaustively re-audited. Static path checks do not establish immunity to concurrent same-user filesystem changes.
• Preparation remains npm ci --omit=dev --ignore-scripts, with no root install lifecycle scripts. All 618 locked package entries have exact versions, HTTPS npm registry sources and SHA-512 integrity. All 38 production entries are unchanged; added/updated SDK and testing tools are development-only. Root dependency sections match package.json. No production entry declares an install script. Runtime entries and static local production imports exist. No plugin/dependency installation, build, import, test or execution performed.
• Shipped English overview/description/icon and seven images retained; no translations or redundant registry fallback. Viewed both changed listing PNGs, showing sample document/chat and file-tab interfaces. Trusted current-main online validation passes: 435 well-formed records, one matching artifact, including listing checks. Exact-head Validate passed. Registry edit beyond the proposed artifact pin: refreshed reviewedAt only.
• Limits: static bump review; no live browser/device/UI/provider test. The artifact includes an author QA report and screenshots, not independently reproduced here. No blocking safety finding, author requirement or factory-policy incompatibility identified.