Recent Activities

fix(bulk): refuse a skill the queue cannot run on the chosen entity type

BulkConsumer::execute() routes on (skill, entity type) pairs and throws on
anything it has no handler for, but the scheduling controller accepted
whatever was posted. A request for a pair the consumer cannot route —
generate on cms_page, say, which the wizard hides but the form will still
carry — was answered with "has been scheduled", split into operations, and
failed one by one where only the bulk log would show it.

Save now checks the pair before it schedules anything, so the operator is
told no while still looking at the screen. The check runs before the entity
ids are resolved, which also spares a full-catalog id query for a request
that was never going to run.

QueueRoutes holds the pairs rather than inlining them, because the
consumer's routing table is the real authority and the two must not drift:
QueueRoutesTest reads the consumer's match arms and asserts they are
exactly the declared list.

It is deliberately not SkillSupport. That asks whether a skill can act on
an entity type at all and answers from getSupportedEntityTypes(); Generate
claims cms_page for the inline editor and is right to, but there is no
generate/cms_page route in the consumer. What a skill can do and what the
queue can carry out are separate facts, and only the second one decides
what may be scheduled.

370 unit tests pass. phpcs --standard=Magento2 reports 0 errors on the
touched files, and Save.php carries the same 10 warnings as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 600476

Merge pull request #47 from breezefront/fix/cms-page-translate-scope

fix(translate): stop writing CMS page translations into a category 219f60

fix(bulk): do not offer a task whose field panel has nothing in it

The wizard decides what step 2 may offer by asking whether a step 4 panel
exists for the pair. A panel could exist and still be empty: Generate
renders a row per attribute only when a prompt is bound to it, so with no
prompts configured the panel is a bare fieldset. The check said yes, the
operator picked Generate, and step 4 came up blank with a Run button that
never enabled — the dead end the panel check was meant to close, reached
from inside the panel instead of around it.

Prompts are now resolved once up front and an attribute without any is
dropped, which makes "the panel has fields" knowable before rendering.
A panel with no fields is not rendered, so the existing check reports the
truth for it. Translate gets the same treatment for symmetry, though its
field list is only empty on entity types nobody can select today.

That leaves step 2 able to come up with nothing at all in it, so it now
says why instead of showing an empty box.

phpcs --standard=Magento2 reports 0 errors on the touched file, the same
as before.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 1fe13b

fix(translate): refuse an unsupported entity type in the skill itself

Narrowing getSupportedEntityTypes() to product and category told the truth
but gated nothing. Three paths still reached a CMS page:

- McpServer::executeSkill() passes entityType straight to GenerateService;
the schema enum is a hint to the client, not a check. translate +
cms_page + targetStore>0 went through Translate::execute(), which took
the attribute list from the input field pool — and the pool still knows
the cms_page fields — translated the text, saved nothing, and reported
success. A silent no-op instead of an error.
- The CMS page form kept its "AI Translate" buttons. Block\Adminhtml\Js
hands translate.js every input field of the entity type, and the form
has no store switcher, so currentStore is always 0: every click ran
translateForAllStores() and died on the new save guard.
- That death cost one AI request. translateForAllStores() calls the skill
first and saves after, so the provider was paid before anything refused
the entity.

Translate::execute() now asserts the entity type against its own
getSupportedEntityTypes() right after resolving it — before the provider
call, so a refused entity costs nothing, and for every caller at once.
saveAttributeForStore() keeps its throw as the last line of defence.

SkillSupport answers "can this skill act on this entity type" for UI code;
Js publishes skills.translate and translate.js renders no buttons when it
is false. Generate still gets the full field list.

Js gained a constructor argument — setup:di:compile.

364 unit tests pass. phpcs --standard=Magento2 reports no errors on the
touched files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 551992

refactor(bulk): give the step 4 panel lookup one home

The panel query behind the wizard's "can this task run here" check was
written out three times over. wizardCanRun() and hasFieldSelection() ran
byte-identical selectors, each with its own empty-argument guard, so a
change to how a panel is addressed had to be made in more than one place
to hold.

findPanel() is now that one place, and both callers read as what they
ask: does a panel exist, and does the panel that exists have a selection.

The Build Landing Page panel also rendered unconditionally, though step 1
offers CMS pages only when the Content Builder is installed. Without it
the panel was unreachable markup in every admin; it now follows the same
condition as the content type it serves.

No behaviour change. 358 unit tests pass; phpcs --standard=Magento2
reports the same 0 errors as before on the touched file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 6d13ac

fix(translate): stop writing CMS page translations into a category

translateForAllStores() routes every non-product entity through
saveAttributeForStore()'s else branch, which loads a *category* by the entity's
id. For a CMS page that id is a page_id, so translating page 8 for all store
views wrote its translated meta_title onto category 8 — on this install, "New
Luma Yoga Collection". A silent write into an unrelated record, no error, no
trace.

Extending the branch is not the fix either: cms_page has nowhere to put a
per-store-view value. The table holds one row per page — title, meta and content
are not store-scoped — and the store assignment lives in cms_page_store. A
translated page in Magento is a separate page. So Translate stops claiming
cms_page, which also narrows the MCP tool's entityType enum, and
saveAttributeForStore() raises on anything it does not explicitly handle instead
of guessing: entity ids collide freely across tables, and guessing corrupts.

Generate keeps cms_page — that path is real. GenerateService::loadEntity()
already resolves pages through PageRepository, so the AI button works on the SEO
fields of the CMS page form. content_heading joins them: plain text, same
mechanics as product-name, and the one obvious gap. title and identifier are
left out on purpose (identifier drags url rewrites behind it), and content
belongs to the Build Landing Page skill, which writes the whole document.

Bulk is unaffected: BulkConsumer never handled generate/cms_page and still does
not, so the wizard offers Build Landing Page alone for CMS pages.

Verified against the compiled DI:

cms_page fields content_heading, meta_title, meta_keywords, meta_description
generate [product, category, cms_page]
translate [product, category]
build_page [cms_page]

360 unit tests pass, including one that pins the corruption: translating a CMS
page for all store views now raises and never touches the category repository.
phpcs --standard=Magento2 reports no errors on the touched files. afe08f

fix(bulk): decide the offered tasks by the step 4 panel, not the skill's word

Picking CMS Pages still listed Generate Content and Translate: both declare
cms_page in getSupportedEntityTypes() for the inline editor, so the filter added
in the previous commit let them through. Choosing either landed on an empty step
4 with no step 5 and no Run button — the exact dead end this branch set out to
remove, just reached by another route.

A skill's own entity list says nothing about whether this screen can drive it.
The wizard now asks the only thing that matters: does a step 4 panel exist for
this (content type, task) pair. That is the condition for not dead-ending, and it
stays true as panels are added or removed.

getSkillEntityTypes() existed only to feed the old check and is dropped with it.

Verified in the admin: CMS Pages now offers Build Landing Page alone, step 3 is
skipped, step 4 reads "Describe the page", step 5 lists the 84 pages and Run
schedules "AI Build Landing Page for 1 CMS page". 92afa6

fix(bulk): decide the offered tasks by the step 4 panel, not the skill's word

Picking CMS Pages still listed Generate Content and Translate: both declare
cms_page in getSupportedEntityTypes() for the inline editor, so the filter added
in the previous commit let them through. Choosing either landed on an empty step
4 with no step 5 and no Run button — the exact dead end this branch set out to
remove, just reached by another route.

A skill's own entity list says nothing about whether this screen can drive it.
The wizard now asks the only thing that matters: does a step 4 panel exist for
this (content type, task) pair. That is the condition for not dead-ending, and it
stays true as panels are added or removed.

getSkillEntityTypes() existed only to feed the old check and is dropped with it.

Verified in the admin: CMS Pages now offers Build Landing Page alone, step 3 is
skipped, step 4 reads "Describe the page", step 5 lists the 84 pages and Run
schedules "AI Build Landing Page for 1 CMS page". 7413c9

Merge pull request #45 from breezefront/feat/bulk-cms-landing-page

feat(bulk): build landing pages from the AI Bulk Action wizard eeabe7

fix(bulk): file the generated page draft under the scheduling admin

BCB drafts are per user: Content/Load reads getDraft($pageId, 0, $currentUserId)
and the collection filters on equality, so a draft written for anyone else is
invisible in the editor. bcb_page_content.user_id is also a foreign key on
admin_user, so the placeholder 0 the consumer was passing failed the insert
outright — every build_page operation died with an integrity violation and no
draft was ever stored. The unit tests missed it because DraftWriter is mocked.

The scheduling admin's id now travels in the payload and DraftWriter requires it,
rejecting 0 before touching the repository. Save refuses to schedule a page build
when the current user cannot be identified, rather than queueing work that cannot
land.

Alongside that:

- CMS Pages is only offered when the Content Builder is installed. Without it
nothing can store the document, so the wizard used to run the whole batch
through the AI only to fail on save. Step 1, the grids and the LISTING map are
all derived from ViewData::getEntityTypes() now.
- Step 4's heading follows the picked task: "Describe the page" for Build Landing
Page instead of the field-list copy, which still said "Select attributes such
as name, description, meta title".
- Operator messages use real names: "AI Build Landing Page for 3 CMS pages"
rather than "AI Build_page for 3 cms_page(s)".
- Step 4 warns that the run replaces the current draft on every selected page.
- Dropped the unused is_active column from the CMS page grid's select.

Tests: DraftWriterTest covers both guards and the write, SaveTest covers the
payload and the messages, BulkConsumerTest asserts the user id reaches the
writer and that a payload without one fails the operation. 359 pass; phpcs
--standard=Magento2 reports no errors. e8f294

feat(bulk): build landing pages from the AI Bulk Action wizard

Step 2 listed every registered skill, so Build Landing Page was offered for
products and categories. It declares cms_page and no attributes, leaving step 4
empty and step 5 unreachable — the wizard dead-ended with no error.

Tasks are now filtered by getSupportedEntityTypes() against the content type
picked in step 1, and CMS Pages joins that step so the skill has a real path:
a brief instead of the per-attribute field list, a CMS page grid, and no store
view step (Content Builder documents are store-agnostic).

The generated document is stored as the page's Content Builder draft. The BCB
page flag is left alone: turning it on with nothing published renders a blank
storefront page, so enabling the editor and publishing stay manual. The BCB
dependency stays soft — the repository is resolved by name behind
interface_exists(), like the component catalog reader.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> afe7f0

Version 1.0.13 43bc3d

Merge pull request #44 from breezefront/chore/mcp-graphql-review-followups

chore(mcp): document graphql guard params, look the tool up by name 4aade7

chore(mcp): document graphql guard params, look the tool up by name

Follow-ups from the review of #43.

`assertReadOnly()`, `getDefinitionKeywords()` and `skipStringValue()` were
missing `@param` annotations, which `phpcs --standard=Magento2` reports on
`Model/McpServer.php` (18 warnings before, 15 after — the rest are pre-existing).

`testGraphqlToolIsDocumentedAsReadOnly` picked the graphql tool out of
`tools/list` by its position in the array. The position shifts as soon as another
skill is registered, so the test would start asserting against the wrong tool
rather than failing for a reason anyone could read. It now looks the tool up by
name and asserts the entry exists.

No behaviour change. ./bin/test unit: OK (339 tests, 680 assertions).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> e3bc09

Merge pull request #43 from breezefront/fix/mcp-graphql-read-only

fix(mcp): reject mutations in the read-only graphql tool 84c5b5

fix(mcp): reject mutations in the read-only graphql tool

The `graphql` MCP tool is documented as "read-only catalog access" in its own
tool description, in the README and on breezefront.com, but `McpServer::graphql()`
forwarded the `query` argument to the storefront GraphQL endpoint verbatim. No
auth header is sent, so the document executes in guest scope — and guest scope is
not read-only: Magento accepts `createEmptyCart`, `addProductsToCart`,
`setGuestEmail` and the rest of the guest cart surface there. An agent connected
over MCP could therefore write to the store through a tool advertised as read-only.

`assertReadOnly()` now refuses any top-level definition other than `query` and
`fragment` before the request goes out.

The operation type is read from the definition position of the document rather
than by searching for the word "mutation", which would be both bypassable and
wrong. `getDefinitionKeywords()` walks the document tracking brace and paren
depth, skips comments and string literals (including block strings), and records
the keyword that opens each top-level definition — treating the anonymous
shorthand `{ ... }` as `query`. So a leading newline, a `# comment`, an operation
name, variable definitions with object default values or a directive cannot
smuggle a keyword past it, and `mutation` used as a field name, an alias or
inside a string argument is not mistaken for an operation.

What the check covers: every definition in the document, so a mutation appended
after a legitimate query is rejected regardless of `operationName`; mutations and
subscriptions; type-system definitions (an allowlist, so unknown keywords are
refused rather than passed through).

What it does not cover: field-level read restrictions — any data guest scope can
already read stays readable, which is what "read-only" claims and no more. It is
not a GraphQL validator either; a malformed document (an unterminated string, say)
may still be forwarded, and the endpoint rejects it before executing anything.

`/llms.txt` is a separate case. Its "read-only" claim describes the store's own
storefront `/graphql`, which Magento serves and this module cannot restrict, so
the wording is corrected there instead of enforced: the endpoint is unauthenticated
and does accept guest mutations, and the file documents read queries only.

Also corrects the assumption in docs/plan/mcp-server.md that seeded this —
"Catalog GraphQL is public/read-only, so no auth risk" conflated public with
read-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> a63cf6

Added Feature Left/Right layouts to Grid component b1b27c

Use banner text color for headings inside banner if set eb8b24

Version 1.0.10 86c7b3

Improved drag-and-drop in the components tree, closes #28 840287

Added list banner 5 config; updated installer, moved it to json a43985

Add new layout configuration and remove easybanner references; update footer content and styles 87165b

Refactor easybanner configuration and installer for product listing banners 8b1d0d

Installer. Listing grid banner added. 914c01

Add swatches variables and layout styles d59581

Update positioning for filter title and content in layered navigation 8cbd21

Add image dimensions for product listings and related widgets in view.xml 6985cd

layout and styles for category view, product toolbar, shop by button 08fd27

Add layered navigation styles and update imports 944ff1

Keep working on prodcut listing and category page. 411088

Keep working on product listing toolbar. ebcfac

Working on product listing and toolbar look. 1ab39d

Add Cooper* font 132906

Add listing item styles and variables e725b5

Product lisnting in progress - grey bg and border radius. 4e7c35

Add new variable files for colors, typography, header, footer, icons, navigation, popover, minisearch, and gradient ba122c

Refactor footer and newsletter styles for improved consistency and responsiveness d831e4

Footer top newsletter - some updates. 452ca5

Add footer top content block and styles for newsletter integration (WIP) 128131

Footer bottom. 8d58ea

Add footer content block and styles for enhanced footer layout 4d6b1b

Header. Hide menu on medium screens. Update search look on monile. e0146d

Installer. Add navigation slideout menu a89fd5

Add EasySlide functionality for header panel with custom slides and styles e55b0b

Add minisearch layout and styles to enhance search functionality 5c5aec

Update config.xml and LESS files for theme adjustments and styling improvements of search field 09f88d

Add Lexend font and related styles to the theme 0100e8

Create config.xml a78b04

Create installer.xml 073f18

Create view.xml baa3b6

Create theme.xml 440a18

Create registration.php 119b4f

Create README.md 2a5862

Create composer.json 16ec29

Version 3.2.1 9edea5

Added missing testimonials dependency 9932f3

Version 3.2.0 d9ca37

3.2.0 a5ebdc

Version 1.0.13 a97400

Version 1.0.12 61d9d2

Version 1.0.10 16076c

Version 1.0.9 7aba62

Version 1.1.1 5a2bcc

Improved drag-and-drop in the components tree 05a7f1

Version 1.1.0 1bcf8f

Added installer cfe73f

Disable Header/Footer feature 544da0

Fix Header logo publishing 71e7dd

Fixed header/footer publishing and preview 237ea4

Moved header/footer configuration to separate page b9b4cb

Version 3.2.0 4c4818

Per page limits according to design e54d9e

Fixed empty search slideout in Safari browser after closing keyboard cb1f77

Show testimonials block under category decsription, see #14 b30944

Theme Editor: Allow using gradients as bg color 3cb9ff

Improve recent products widget styles in sidebar 3d94fb

Revert "Move testimonials below category description"

This reverts commit 046f5bb650b031b250b05a0009b5ec2edc27a619. 66ab0d

Move testimonials below category description 046f5b

Use `apollo-` prefix for custom quote icon 7f3938

Prevent zoom om mobile devices when focusing quantity field 0de256

Limit upsell and related products to 6 items on the product page 94dd46

Added BLB installation: Testimonials widget on category pages 60339b

Testimonials and BCB slider styles bb8fa5

Fixed qty overlap with actions in minicart on small screens, see #16 96cd74

Enabled mobile slider layout for columns and grid 77cb58

Created separate mobile slider 8880b4

Sync products widget styles with product list. Closes #13 241874

Version 3.1.2 3731c1

Move dynamic js into separate file efb079

Version 1.0.2 5cbc85

Push uncommited changes d944d5