feat(ai-smart-file-tagger-qa): add AI Smart File Tagger

[LukasHirt]

AI-generated · OSPO-50 · Gate: ✅ 1.00

Problem

Files accumulate without tags, making search and filter ineffective.
Manual tagging at scale doesn't happen — it requires opening every file individually.

Solution

A sparkle icon appears inline in each file row. Clicking it sends the file's
content (txt/md/pdf) or just its name and type (all others) to the configured
LLM, which returns 3–5 suggested tags shown in a lightweight confirmation
popover. The user accepts, deselects, or dismisses. With structured-output
models, tags include a confidence score; with basic text models, a flat list.
Without a configured LLM, the button shows a tooltip describing the required
admin setup.

Extension points

app.files.quick-actions

Why ship this now

As oCIS deployments scale, findability suffers first. This is the lowest-friction
path to enriched metadata, meeting users exactly where they already are.

What was built

packages/web-app-ai-smart-file-tagger-qa adds an inline "suggest tags" action to the files app, sending a file's content or name/MIME type to a configured LLM and returning suggested tags for the user to accept or dismiss. Because app.files.quick-actions doesn't exist in the installed @ownclouders/web-pkg (v12.3.2), the action is registered on global.files.context-actions instead — accessible from the file's context menu rather than as an inline row icon. src/index.ts reads applicationConfig.llm, builds the LLM config, and wires the ActionExtension registration.

The core logic lives in src/composables/useTagSuggestions.ts, which pulls file content over WebDAV for .txt/.md/.pdf (PDF text extraction via pdfjs-dist with a fake worker) and falls back to filename + MIME type for everything else, gated by src/utils/file-support.ts. It calls the existing useLLM.complete() composable with a structured JSON prompt and parses a { tags: [{ name, confidence }] } response, with a plain-text comma/newline fallback for models that don't support structured output — matching the two-tier degradation already established by web-app-ai-doc-summary. Accepted tags are applied via clientService.graphAuthenticated.tags.assignTags(). src/components/TagSuggestionModal.vue renders the suggestion UI: a loading spinner, an unconfigured-LLM notice, toggleable OcTag chips with confidence badges (selection state is tracked via a CSS class since this OcTag version has no native selected prop), an error banner, and its own Apply/Dismiss controls since the modal is launched with hideConfirmButton: true.

Test coverage includes 36 unit tests across the composable (prompt construction, structured/plain-text parsing, confidence normalization, tag application, and 401/429/network error handling) and the modal component (state rendering, chip toggling, confirm/dismiss behavior), plus a Playwright acceptance spec that mocks the LLM proxy, uploads a test file, triggers the action from the context menu, and verifies the modal's chip rendering, toggle, and confirm-close flow. The acceptance spec and its page object live inside the package rather than shared support/pages/, per the per-extension page-object convention. A known limitation, documented in the package README, is that tag suggestions surface from the file context menu rather than as an inline quick-action icon, since the originally spec'd extension point isn't available in this web-pkg version.

Gate

Check	Result
Hygiene	✅ ok
Build	✅ ok
Lint	✅ ok
Unit tests	✅ ok
E2E tests	✅ ok
Score	1.00

---

_{Effort: S · 🤖 Generated by extctl}

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[dj4oC]

Adds a context-menu "Suggest tags" action for single files that calls a same-origin ai-llm-proxy, renders chip selection in a modal, and applies confirmed tags via assignTags (Graph API).

• Security: no findings — same-origin enforcement correct (CWE-918 gated), bearer token protected, tag normalization (lowercase, 30-char cap) appropriate ✅
• Stability: no findings — assignTags merge into local store rather than overwrite is correct ✅
• Performance: PDF.js client-side extraction is scoped and capped (12,000 chars); no unbounded allocation ✅
• Test coverage: unit + e2e tests present ✅
• TODOs found: 1 — "description": "CANDIDATE" in package.json (tracking issue to follow)
• Dependency: pdfjs-dist@^6.1.200 (Apache-2.0) added — covered by existing dependabot.yml npm config ✅
• CI status: all green per Snyk ✅ (build verification not possible in cloud review environment)
• Stale review: ⚠️ This PR has been awaiting review since 2026-06-30 — exceeded 48h threshold by 8 days

No blocking findings. This can proceed to human sign-off once the package.json description placeholder is resolved (see tracking issue).

🤖 Automated review by Claude Code (security · stability · performance · coverage)

[dj4oC]

TODO tracking: issue #501 opened to replace the "description": "CANDIDATE" placeholder in package.json before publish.

[dj4oC]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Addressed in 45e96c7. The branch now includes the merge conflict resolution against main.

[LukasHirt]

Branch was stale — rebased onto origin/main to resolve conflicts with the newly-merged web-app-ai-multi-doc-synthesizer package (PR #466), which touched the same shared config files (docker-compose.yml, dev/docker/ocis.apps.yaml, support/actions/ocis.apps.yaml, .github/workflows/test.yml). All conflicts were additive (both packages appending their own entries) and resolved by keeping both.

Also addressed the review's open item:

• @ownclouders/web-client, @ownclouders/web-pkg, and @ownclouders/extension-sdk bumped from 12.3.2 to 12.5.0 to match the rest of the monorepo.
• Replaced the placeholder "description": "CANDIDATE" in package.json (closes web-app-ai-smart-file-tagger-qa: replace placeholder package description #501).

Verified post-rebase: check:types, build, lint, and test:unit (39 tests) all pass for this package.