Branch: refs/heads/main Home: https://github.com/xwiki-contrib/ai-llm Commit: 2717eb5663fe3fcec2219d80cc84ec3250413094 https://github.com/xwiki-contrib/ai-llm/commit/2717eb5663fe3fcec2219d80cc84e... Author: Paul Pantiru <[email protected]> Date: 2026-10-05 (Mon, 05 Oct 2026) Changed paths: M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/MCPResource.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/internal/server/DefaultMCPResource.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/internal/server/MCPServerConfiguration.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/script/MCPFarmScriptService.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/internal/server/DefaultMCPResourceTest.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/internal/server/MCPServerConfigurationTest.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/script/MCPFarmScriptServiceTest.java M application-ai-llm-mcp/application-ai-llm-mcp-ui/src/main/resources/AI/MCP/Code/MCPServerConfig.xml M application-ai-llm-mcp/application-ai-llm-mcp-ui/src/main/resources/AI/MCP/Code/MCPServerConfigClass.xml M application-ai-llm-mcp/application-ai-llm-mcp-ui/src/main/resources/AI/MCP/Code/MCPServerConfigSheet.xml M application-ai-llm-mcp/application-ai-llm-mcp-ui/src/main/resources/AI/MCP/Code/Translations.xml Log Message: ----------- LLMAI-182: Make allowGuest the single guest gate and add its farm controls * Unauthenticated callers are refused with 401 whenever the wiki's allowGuest flag is off, with or without an OIDC Provider; the Bearer challenge with the protected-resource metadata is sent only when a provider is registered, otherwise the 401 carries no challenge * A guest request presenting an Authorization header is always refused, so an expired or invalid token is not silently served as guest * A wiki id that is not the exact id of an existing wiki answers 404 on the endpoint and the OAuth metadata URL, and is refused by the dashboard's script methods; previously a case variant of the main wiki id reached the main wiki under its own cache key * The admin section shows the guest checkbox on subwikis only; the main wiki is controlled from the farm dashboard, which gains a Guest access column backed by isGuestAccessAllowed / setGuestAccessAllowed / applyGuestAccess on the mcp script service (admin right on the wiki) * The class hint, dashboard intro and status messages describe the posture; the embedded class copy of the shipped config document now defines allowGuest Commit: e2a6972c9cc5f96078c7bb99d158a2bd876cd212 https://github.com/xwiki-contrib/ai-llm/commit/e2a6972c9cc5f96078c7bb99d158a... Author: Paul Pantiru <[email protected]> Date: 2026-10-05 (Mon, 05 Oct 2026) Changed paths: M application-ai-llm-mcp/application-ai-llm-mcp-api/src/main/java/org/xwiki/contrib/llm/mcp/MCPTool.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/internal/server/XWikiMCPServerManager.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPManTool.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/internal/server/XWikiMCPServerManagerTest.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPManToolTest.java Log Message: ----------- LLMAI-182: Serve guest callers only the tools they can use * The server manager caches two variants per wiki; the guest variant does not register authoring tools (MCPTool#isWrite), so tools/list and the man catalog never show them to an unauthenticated caller * The call middleware still refuses an authoring tool for a guest as defence in depth, audited with the distinct outcome "refused", and fails closed when the caller cannot be resolved * MCPTool#isWrite documents the contract: a tool that changes content must return true, or it is offered to guests Commit: 2e769cb5f6bb900d764fe39c51563bed45cc6544 https://github.com/xwiki-contrib/ai-llm/commit/2e769cb5f6bb900d764fe39c51563... Author: Paul Pantiru <[email protected]> Date: 2026-10-05 (Mon, 05 Oct 2026) Changed paths: M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPGetSchemaTool.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPQueryDocumentsTool.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPGetSchemaToolTest.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPQueryDocumentsToolTest.java Log Message: ----------- LLMAI-182: Hide unfiltered counts from guest callers * query_documents no longer tells a guest how many documents matched before the rights filter: an empty page reads as "No documents found" whether or not hidden matches exist, an offset past the last match is not an error, and the footer reports only the viewable documents shown plus an unconditional continue offset * get_schema lists class names without instance counts for a guest and omits the Instances line of the class view; the count query is not run * Authenticated callers keep the upper-bound counts; both man pages state the guest behaviour Commit: e3c0e015bbafde71ad817079044e72adc1fd831e https://github.com/xwiki-contrib/ai-llm/commit/e3c0e015bbafde71ad817079044e7... Author: Paul Pantiru <[email protected]> Date: 2026-10-05 (Mon, 05 Oct 2026) Changed paths: M application-ai-llm-mcp/application-ai-llm-mcp-server/src/main/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPGetTreeTool.java M application-ai-llm-mcp/application-ai-llm-mcp-server/src/test/java/org/xwiki/contrib/llm/mcp/internal/tool/MCPGetTreeToolTest.java Log Message: ----------- LLMAI-182: Let the get_tree survey lead to pages under an unviewable space home * A survey line carries its [Space.WebHome] ref only when the caller may view that home; otherwise the space is named without a ref and the legend explains that the pages listed under it are the way in * A space with denied pages is expanded inline like any other small space, so the caller's viewable pages are reachable; counts were already the caller's viewable counts Compare: https://github.com/xwiki-contrib/ai-llm/compare/c23905d9ed2a...e3c0e015bbaf To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/ai-llm/settings/notifications