[Bug] Encrypted/password-protected files report "File contains corrupted data" instead of being detected as encrypted

[hribcek]

Summary

Opening a password-protected (encrypted) Office file fails with Error: ... File contains corrupted data. The file is not corrupted — it is a valid OOXML encryption container (CDFV2 / "Encrypted"). The message misdirects the user/agent, and there is no option to supply a password.

Environment

• OfficeCLI v1.0.110, officecli-mac-x64
• macOS (Intel x86_64)

Repro

# create a small xlsx, then encrypt it with a password (msoffcrypto-tool -e)
pip install msoffcrypto-tool
msoffcrypto-tool -e -p secret123 plain.xlsx encrypted.xlsx
file encrypted.xlsx          # -> "CDFV2 Encrypted"

officecli get encrypted.xlsx /
officecli validate encrypted.xlsx

Observed

Error: Cannot open encrypted.xlsx: File contains corrupted data.

(Fails gracefully and quickly — no crash/hang — but the cause is wrong.)

Expected

• Detect the encryption container and report it clearly, e.g.
  Error: <file> is password-protected/encrypted. Supply a password with --password.
• Ideally support a --password / OFFICECLI_PASSWORD option to open encrypted files (decrypt in-memory).

Why it matters

For AI-agent use especially, a "corrupted data" message leads the agent down the wrong path (retry/repair) instead of prompting for a password. Even without full decryption support, distinguishing encrypted from corrupted would be a meaningful UX improvement.

[dragonwhites]

PR #148 addresses this. Using your exact repro (msoffcrypto-tool -e -p secret123 …):

Before → Error: Cannot open encrypted.xlsx: File contains corrupted data.

After:

$ officecli get encrypted.xlsx /
Error: encrypted.xlsx is password-protected. Re-run with --password <password> (or set OFFICECLI_PASSWORD).

$ officecli get encrypted.xlsx / --password secret123
/ (workbook) …                       # opens

$ OFFICECLI_PASSWORD=secret123 officecli get encrypted.xlsx /Sheet1/A1
/Sheet1/A1 (cell) "hi"               # env-var path (keeps the secret out of argv)

It covers both asks:

• Encrypted ≠ corrupted: CDFV2 files are now detected and reported clearly with the password_required code, on every document command.
• --password / OFFICECLI_PASSWORD: open and edit encrypted files — edits re-save still encrypted under the same password (decrypt is in-memory; the plaintext only ever lands in a temp file that's deleted on close).

Scope: modern Agile encryption (Office 2013+, the default). Legacy "Standard"/RC4 is recognised and reported as unsupported_encryption rather than read as corrupt. Validated against an independent decryptor (msoffcrypto-tool) and confirmed opening in real Excel/Word.

[hiSandog]

A useful next step might be to separate the repro into input, state/cache update, and final output for Error: ... File contains corrupted data.. That would make it clearer whether “Encrypted/password-protected files report "File contains corrupted data" instead of being detected as encrypte” is failing during parsing/configuration, during internal state updates, or only at the user-visible result.