Add sharepoint domain skill: authenticated file downloads

[tcwarburton]

Field-tested pattern for pulling real file bytes out of SharePoint/OneDrive document libraries: open a tab on the tenant origin, page-context fetch with credentials, base64 back through js(). Documents the traps (http_get has no cookies; Graph/ms365 MCP read_resource returns extracted text, never bytes; personal OneDrive is a separate origin).

🤖 Generated with Claude Code

---

Summary by cubic

Adds a SharePoint/OneDrive domain skill for authenticated file downloads. Documents a tested way to fetch real binary bytes from document libraries using an in-page, cookie-carrying request.

• New Features
  • Guide added at domain-skills/sharepoint/download.md with a step-by-step snippet: open the tenant tab, fetch(..., { credentials: 'include' }), marshal via js(), decode to bytes.
  • Covers quoting URLs with spaces, verifying magic bytes, and handling multi‑MB files.
  • Notes personal OneDrive’s separate origin (<tenant>-my.sharepoint.com) and pitfalls: http_get() has no cookies; Graph/ms365 MCP read_resource returns extracted text, not bytes.

^{Written for commit dc508b8. Summary will update on new commits.}

[browser-harness-review]

✅ Skill review passed

Reviewed 1 file(s) — no findings.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="domain-skills/sharepoint/download.md">

<violation number="1" location="domain-skills/sharepoint/download.md:26">
P2: The documented error path is broken: when the fetch returns a non-OK status the JS yields `'ERR:'+r.status`, which is then passed straight into `base64.b64decode(...)`, raising a cryptic `binascii.Error` instead of surfacing the status. Guard the decode result for the `ERR:` prefix (and check it's a str) before decoding so real HTTP failures are reported clearly.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The documented error path is broken: when the fetch returns a non-OK status the JS yields 'ERR:'+r.status, which is then passed straight into base64.b64decode(...), raising a cryptic binascii.Error instead of surfacing the status. Guard the decode result for the ERR: prefix (and check it's a str) before decoding so real HTTP failures are reported clearly.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At domain-skills/sharepoint/download.md, line 26:

<comment>The documented error path is broken: when the fetch returns a non-OK status the JS yields `'ERR:'+r.status`, which is then passed straight into `base64.b64decode(...)`, raising a cryptic `binascii.Error` instead of surfacing the status. Guard the decode result for the `ERR:` prefix (and check it's a str) before decoding so real HTTP failures are reported clearly.</comment>

<file context>
@@ -0,0 +1,37 @@
+    bin += String.fromCharCode.apply(null, bytes.subarray(i, i + 0x8000));
+  return btoa(bin);
+})()""" % json.dumps(quote(url, safe=":/"))
+data = base64.b64decode(js(code))
+```
+
</file context>

[tcwarburton]

Closing this one, no longer pursuing upstream contributions. Thanks for the reviews.