[ForeignKeyCN]

Summary

Brings the Excel plugin in line with Outlook (#4163), Teams (#4164) and OneDrive (#4165), and with n8n's Microsoft Excel 365 node (v2). The plugin's code predated those: login and Graph hosts were hard-coded (common, global cloud), every tool built its own requests, and IDs and names went into URLs unencoded. So this PR first rebuilds the base, then adds the auth modes and the missing operations.

1. Base (no behaviour change for existing workflows)

• A shared tools/graph_client.py; the 8 existing tools keep their names, parameters, json and text output, and now go through it.
• Encoding: workbook IDs, worksheet names, table names and ranges are path-segment / OData-quoted. Before, a sheet named Q3's broke the request and an LLM-supplied ID or site_id could change the request path (e.g. ../users/...). SharePoint site IDs keep their commas, as Graph expects.
• OAuth tenant and national clouds: optional Tenant ID (default common, as before) and Microsoft Cloud on the OAuth client; scopes are qualified outside the global cloud, the Graph host is stored with the credential, and existing authorizations stay on the global cloud. The refresh still omits scope (kept from before).
• Typed output variables on every tool (success / error plus each tool's fields), as in the other Microsoft plugins.
• Fixed: search_worksheet_data reported wrong cell addresses when the range did not start at A1.

2. Auth modes (API Key credential)

• Service Principal (n8n v2 has it): application permission Files.ReadWrite.All; each call targets a SharePoint Site ID, the tool's Drive Owner setting (form-only, never chosen by the LLM) or the credential's default drive owner. Saving with a default drive owner opens that OneDrive to check the permission.
• Each user signs in, same design as the other three: authorization code + PKCE through a plugin endpoint (GET /excel/callback) that never holds the secret; per-user tokens Fernet-encrypted in plugin storage, keyed by a hash of client_id | Dify user ID; never in tool output or logs. Same delegated scopes as OAuth (a test keeps them equal). Sign Out of Excel (excel_sign_out).

3. n8n v2 parity (new tools carry an excel_ prefix: the new Agent rejects duplicate tool names across plugins)

n8n v2	Tool
Workbook: Get Many / Add Worksheet	list_workbooks / create_worksheet (existing)
Workbook: Delete	excel_delete_workbook
Worksheet: Get Many / Clear	list_worksheets / clear_worksheet_data (existing)
Worksheet: Get Rows	excel_get_rows: rows as objects keyed by the header row; used range unless a range is given; Header Row / First Data Row (read_worksheet_data stays for the raw grid)
Worksheet: Update	excel_update_rows: match on a key column, change only the given columns, never append, Update All Matches (write_worksheet_data stays for n8n's raw mode)
Worksheet: Append	excel_append_rows: objects keyed by header or cell lists; on an empty sheet the keys become the header
Worksheet: Append or Update	excel_upsert_rows, with Update All Matches
Worksheet: Delete	excel_delete_worksheet
Table: Add / Delete / Convert to Range / Get Columns / Get Rows / Append / Lookup	excel_add_table / excel_delete_table / excel_convert_table_to_range / excel_get_table_columns / excel_get_table_rows / excel_append_table_rows / excel_lookup_table (Return All Matches option)
(table picker)	excel_list_tables

Version 0.2.2 → 1.0.0, matching the other Microsoft plugins. README (setup for all three modes, tool table with the n8n mapping, output variables) and PRIVACY updated.

Release Notes

• Each user signs in: a new authorization for chat agents; each person signs in once with their own Microsoft account and the tools work on their own workbooks. Needs the new sign-in endpoint registered as a Web redirect URI on the app.
• Service Principal authorization (app-only), targeting a SharePoint site or a named user's OneDrive.
• OAuth: optional Tenant ID and Microsoft Cloud (US Government, DoD, China/21Vianet); existing authorizations are unchanged.
• New tools matching n8n: Get Rows, Update Rows, Append Rows, Append or Update Rows, Delete Worksheet, Delete Workbook, and the table tools (List / Add / Delete / Convert to Range / Get Columns / Get Rows / Append Rows / Lookup). Sign Out of Excel for the per-user mode.
• Every tool returns typed output variables.
• Fixed: worksheet and table names with quotes or special characters, and search cell addresses for ranges not starting at A1.

Change Type

• Documentation / non-plugin change
• Non-LLM plugin (tools, extensions, datasource, etc.)
• LLM plugin

Screenshots / Videos

Agent on a self-hosted Dify with Outlook, Teams, OneDrive and Excel, each using Each user signs in:

Each plugin with its own per-user authorization	Excel sign-in link	After signing in (account named)

Testing

• Unit tests: 104 passed (pytest). They cover: the Graph context for OAuth / Service Principal / per-user (drive and site resolution, national clouds, unknown-host refusal, Drive Owner rules); URL encoding of IDs, sheet names, ranges and site IDs, including path-climbing attempts; the address parser (sheet names such as Sheet1 are not cell references); every tool's output variables on success and on a Graph error (a test checks every tool in the provider is covered); append (header on an empty sheet, data not starting at A1, unknown keys), update and upsert (first match vs. all matches, untouched columns, unmatched keys reported or appended), get rows (header row, first data row, blank rows, limit), the table tools and lookup options; OAuth tenant/cloud URLs; per-user validation and the sign-in flow.
• End to end on a self-hosted Dify (Community 1.16.1) with an Agent that also uses Outlook, Teams and OneDrive per user: "List my Excel workbooks" → Excel sign-in link → Microsoft sign-in → callback → the tool answered as the signed-in user (named in the reply); the drive had no workbook at the time. Plugin storage holds only ciphertext.
• Not run end to end yet: reading and writing rows and the table tools against a real workbook, and Service Principal against a real site. They are covered by the unit tests above.

Checklist

• I have read the contribution guidelines
• Version bumped in manifest.yaml (0.2.2 → 1.0.0)