Skip to content

VCST-4927: Add virto oz - #130

Open
basilkot wants to merge 33 commits into
devfrom
feat/VCST-4927-virto-oz
Open

VCST-4927: Add virto oz#130
basilkot wants to merge 33 commits into
devfrom
feat/VCST-4927-virto-oz

Conversation

@basilkot

@basilkot basilkot commented Apr 29, 2026

Copy link
Copy Markdown
Collaborator

Description

References

QA-test:

Jira-link:

https://virtocommerce.atlassian.net/browse/VCST-4927

Artifact URL:

https://vc3prerelease.blob.core.windows.net/packages/VirtoCommerce.PageBuilderModule_3.1011.0-pr-130-f33a.zip


Note

Medium Risk
Touches page persistence, export batching, and cross-origin iframe/postMessage auth; export debug logging and batch-size-1 change may affect backup performance and production logs.

Overview
Adds Virto OZ as an embedded AI assistant for Page Builder: authors can drive create/edit/diagnose/bulk page workflows via tool-backed REST calls, with new user docs (docs/ai-assistant.md) and a schema description authoring skill for theme catalogs.

Designer (Angular): New @ai-agent module wires a floating toggle, side panel (pin/overlay), sandboxed iframe, and postMessage transport that sends INIT_CONTEXT on CHAT_READY. Integration is gated by ozAgentUrl in data/settings.json; preview layout adjusts when the panel is pinned.

Admin shell (Vue / vc-shell): Bootstraps legacy JWT auth into vc-shell, loads OzAgentUrl from platform settings, and enables the framework AI agent plugin. useAiAgentContextWithStore injects pagebuilder.store and page list/detail items so OZ tools get storeId and page identity without guessing.

Backend: Registers OzAgentUrl, adds create/update request models and a write-only PageBuilderPage.Content path mapped through EF so content can persist atomically on create; content streaming skips null DB values. Export paging is reduced to batch size 1 with temporary Console.WriteLine logging (likely unintended for production).

Reviewed by Cursor Bugbot for commit 64f324d. Bugbot is set up for automated code reviews on this repo. Configure here.

- Implemented CreateGroupPage method in PageBuilderPageController to create a grouped page with draft content.
- Added CreateGroupedPageRequest model to encapsulate request data for creating grouped pages.
- Introduced OzAgentTransportService and OzContextService for handling communication with the OZ agent in the page builder designer.
- Defined types for OZ messaging in types.ts to facilitate structured communication.
- Created page-builder-expert.md to outline the AI-powered page generation process and rules.
- Added create-page.yaml tool definition for the new page creation API.
- Updated project file to include necessary content and configurations for AI integration.
basilkot and others added 7 commits May 1, 2026 20:13
- Added OzAgentUrl localization entries for Portuguese, Russian, Swedish, and Chinese.
- Expanded PageBuilder Expert agent capabilities with new intents: Diagnose and Bulk.
- Updated schema retrieval process to improve efficiency and clarity.
- Introduced new tools for fetching page metadata and publishing pages.
- Enhanced validation for page content envelopes with comprehensive unit tests.
- Bump @vc-shell/framework, @vc-shell/config-generator, @vc-shell/api-client-generator and @vc-shell/ts-config from 1.2.3 to 2.0.3
- Drop @vc-shell/release-config dependency and remove scripts/release.ts
- Regenerate api_client with --APP_TYPE_STYLE=Interface for vc-shell 2.0.3
- Adapt page-builder module (components, composables, pages, routes) to the new shell API
- Remove obsolete src/shims-vue.d.ts
- Reformat .github/COMMIT_CONVENTION.md and PULL_REQUEST_TEMPLATE.md
JsonSerializer jsonSerializer)
{
private const int BatchSize = 50;
private const int BatchSize = 1;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Debug batch size of 1 left in export

High Severity

BatchSize was changed from 50 to 1, which is clearly a debugging value left in. This causes the export to fetch pages one at a time instead of in batches of 50, resulting in ~50x more database round-trips and dramatically slower export performance for any non-trivial dataset.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a0f4b5c. Configure here.


for (criteria.Skip = 0; ; criteria.Skip += BatchSize)
{
Console.WriteLine(criteria.Skip);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Debug Console.WriteLine statements left in production code

Medium Severity

Two Console.WriteLine calls were added to the export loop — one printing criteria.Skip and another printing group.Name. These are debug statements that will pollute stdout in production and leak page metadata to server logs unnecessarily.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a0f4b5c. Configure here.

}
}
},
"ozAgentUrl": ""

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OZ URL not from platform

Medium Severity

The designer adds ozAgentUrl as a fixed empty string while the module registers VirtoCommerce.PageBuilderModule.General.OzAgentUrl. Unlike previewPath, it never loads the platform setting, so configuring OZ in admin leaves the designer integration disabled.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 81e1c13. Configure here.

if (saved) {
this._isOpen.set(!!saved.isOpen);
this._isPinned.set(!!saved.isPinned);
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Panel open without URL

Medium Severity

Saved UI state restores isOpen and isPinned even when agentUrl is missing. The panel host still applies open/pinned layout classes, reserving a 420px strip with no content and no close control because the toggle and header render only when a URL exists.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 81e1c13. Configure here.

buildInitPayload(): OzInitContextPayload {
const info = this.jwt.getInfo();
const accessToken = (info?.token as string | undefined) || FALLBACK_ACCESS_TOKEN;
const userId = (info?.userName as string | undefined) || FALLBACK_USER_ID;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dev token sent to OZ

Medium Severity

When no JWT is in storage, buildInitPayload still sends accessToken 'dev' and userId 'pagebuilder-user' to the OZ iframe via INIT_CONTEXT. That satisfies OZ validation but can authenticate the agent as a placeholder identity instead of failing closed when the designer has no real session.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 91cd7de. Configure here.

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
4 New Major Issues (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

- Replace legacy .eslintrc.js / .eslintignore with eslint.config.mjs (ESLint 9 flat config),
- Remove orphaned import/no-unresolved disable comments
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
4 New Major Issues (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

basilkot and others added 3 commits June 4, 2026 17:40
Require template/section keys passed to pagebuilder_get_section_schema to
appear verbatim in the Phase A catalog (validate before fetch), never derived
from a permalink/title. Treat a 404 as "no such key" -> pick a different valid
key (templates fall back to page) instead of retrying or inventing another.
Prevents the fabricated templates/blog-news-article 404 that aborted generation.

Refs: VCST-4927
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The schemas catalog shipped full per-entry descriptions (~1150 chars each;
141 sections ~= 169 KB) on every list call, dominating agent input tokens.
Derive a short head summary (text before "Use when:", capped at 200 chars) for
the catalog; the full description and field schema still come from
get_section_schema (Phase B). Cuts the vccom catalog ~169 KB -> ~34 KB (-80%)
with no theme changes. Updates the tool description and agent prompt to say the
catalog description is a summary, plus unit tests for DeriveCatalogSummary.

Refs: VCST-4927
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 6 total unresolved issues (including 5 from previous reviews).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit f33a9a0. Configure here.

blade: PAGE_BUILDER_BLADE,
contextType: 'list',
items: [],
};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OZ init lacks store context

Medium Severity

The designer sends INIT_CONTEXT with items: [] and never includes the current store or open page, though the new assistant docs require those context items for store-scoped tools and “edit this page.” The transport layer also never sends UPDATE_CONTEXT when the user changes pages.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f33a9a0. Configure here.


readonly safeUrl = computed<SafeResourceUrl | null>(() => {
const raw = this.url();
return raw ? this.sanitizer.bypassSecurityTrustResourceUrl(raw) : null;
@sonarqubecloud

sonarqubecloud Bot commented Jun 9, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
E Security Rating on New Code (required ≥ A)
1 New Blocker Issues (required ≤ 0)
1 New Critical Issues (required ≤ 0)
5 New Major Issues (required ≤ 0)
1 New Vulnerabilities (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants