[Copilot]

This update targets two upgrade goals: make report generation safer under untrusted document content, and make diff behavior tunable for stricter or looser change detection. The result is a more production-ready CLI diff pipeline without changing the plugin architecture.

• CLI diff controls (advanced tuning)

  • Added --context-lines to control unified-diff context for text-based PDF changes.
  • Added --similarity-threshold (0.0..1.0) to control when a file is considered changed.
  • Wired both through DiffOptions so plugins consume a shared, explicit policy surface.

• Core model extension

  • Extended DiffOptions with similarity_threshold (default 0.99), replacing plugin-local hardcoded thresholds.

• Plugin behavior alignment

  • Image, PDF, and XLSX plugins now use options.similarity_threshold for changed determination.
  • Preserves existing output structure while making sensitivity externally configurable.

• HTML output hardening

  • Escaped dynamic PDF text-diff content before embedding in <pre>.
  • Escaped dynamic XLSX-derived content (sheet names, column labels, cell values, cell metadata) before embedding in HTML.
  • Prevents report-time HTML/script injection from document content.

# shared change policy now applied across plugins
options = DiffOptions(
    output_format="html",
    context_lines=5,
    similarity_threshold=0.995,
)
result = plugin.diff(path_a, path_b, options)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.