zooqueenandHanzo Dev
f717dd89ad
28 apps told the user to paste an `hk-` key — input placeholders, settings help text, READMEs, the error thrown when the field is empty — and five of them validated that paste against /^hk-/ before sending it as a bearer. Nothing mints that prefix any more: cloud accepts pk- and sk-, IAM mints sk-. So the guard admitted a credential that authenticates nothing, and the panel failed later at the gateway with nothing on screen to explain it. The three leak detectors keep hk- and gain sk-. Salesforce's source scan and the two Zendesk tests exist to catch a key committed to source or echoed back through a request; retired keys are still in circulation and leak exactly as badly, while a detector that only knew hk- would have gone blind to every key minted from here on. `sk-` used to be the example of the foreign key the guard screened out — an OpenAI key. It cannot mean that now, and shape alone cannot tell one vendor's sk- from another's, so those comments say what the check really proves and point at the /v1/models call that proves the rest. The three tests that pinned "sk- is rejected" now pin "hk- is rejected", which is the invariant that survived. Verified: 2029 tests pass across the 28 packages; typecheck clean on 25 of them (hubspot, jupyter and teams fail identically at HEAD on JSX and ESM type conflicts in files this does not touch); salesforce validate-source green. Co-authored-by: Hanzo Dev <[email protected]>
2.1 KiB
Test Hanzo AI in Word/Excel on Windows
This is the localhost build of the Hanzo Office add-in — a self-contained kit
to try it on your own machine before it's on AppSource. No Hanzo infra, no IAM
setup: paste a Hanzo API key and go.
What's in this zip
manifest.xml— the add-in manifest (points athttps://localhost:3000)taskpane.html/taskpane.js/assets/— the add-in itselfserve.mjs— a tiny HTTPS server for the files above- this guide
Steps (5 minutes)
You need Node.js installed.
-
Trust a localhost HTTPS certificate (once per machine — Office refuses an untrusted task-pane origin):
npx office-addin-dev-certs install -
Serve the add-in from this folder:
node serve.mjsLeave it running. It serves
https://localhost:3000. -
Sideload the add-in. Easiest path — Word or Excel on the web (office.com): open a document → Home → Add-ins → More Add-ins → My Add-ins → Upload My Add-in → pick this folder's
manifest.xml.Desktop Word/Excel on Windows: put this folder on a network shared-folder catalog, trust it in File → Options → Trust Center → Trusted Add-in Catalogs, then Home → Add-ins → Shared Folder → Hanzo AI.
-
Use it. Click Hanzo AI on the Home tab to open the pane. Expand "Or use a Hanzo API key", paste your
sk-…key (from console.hanzo.ai → API keys), Save. Select text or a range, type an instruction, Ask Hanzo, then Insert.
Notes
- The API key is stored in your Office roaming settings (per-user, encrypted at rest by Office) — not in this folder.
- Sign-in with your Hanzo account (instead of an API key) works once the
production add-in is hosted at
office.hanzo.ai; the API key is the zero-setup path for local testing. - Model calls go to
https://api.hanzo.ai/v1— the same gateway the browser extension uses.