Project page

Integrate artificial intelligence in the form of Large Language Models (LLMs) into the XWiki platform.

Release Notes

This release contains security fixes, with the highest severity being 7.4/10. The fixed issues are listed below once their embargo ends.

Upgrade notes

• Collections are re-indexed once. At the first start after the upgrade, every chunk indexed from wiki pages is dropped and the collections on the XWiki document store are queued for re-indexing. Their search results are empty until the re-embedding completes. A wiki whose re-indexing fails is named in an ERROR log line and needs a manual reindex from its collection page.
• Guest access to the MCP endpoint is opt-in (LLMAI-182). Unauthenticated callers receive a 401 unless the per-wiki "Guest access" option is enabled, with or without an OIDC provider. Installs without an OIDC provider that served guests before the upgrade stop doing so until an administrator enables the option, in the wiki's MCP administration section or on the main wiki's farm dashboard. Authoring tools are never offered to guests, and a wiki id in the endpoint URL must match the exact wiki id.
• The MCP configuration of a wiki is applied only when an administrator saved it. If the configuration page was last saved by an account without administration right, the endpoint is off and the farm dashboard shows the wiki as "configuration not trusted" with a Reset button. Reset replaces the configuration page with the shipped one (the previous page goes to the recycle bin) and takes ownership. An empty configuration field is now read as unset, which keeps the endpoint on.
• Collection rights are checked per page. Collections on the XWiki document store check the caller's view right on each source page with every rights-check method, and the xwiki method honours rights set on the page itself. No reindex is needed. The collectionManager.search(solrQuery, ...) script method requires programming right.
• Collection writes are attributed to the acting user. Documents created or changed through the collection REST API, sheet or script service carry the acting user as author. A wiki-page script without programming right that writes collection documents or saves a collection needs its author to hold edit right on the target, and the written page is attributed to that author.
• The "Add" controls of the LLM administration sections require a CSRF token. Bookmarked "add" links stop working; use the buttons.

Other changes

• "Clear index" clears the current wiki only, and collectionManager.getCollections() lists the canonical collection pages (LLMAI-206).
• The "Document" entry type is removed from the create dialog; documents are created from their collection page (LLMAI-206).
• REST: a hidden page of an XWiki-store collection answers 404, and PUT/DELETE on such a collection answers 405; an unknown document id answers 404 (LLMAI-206).
• Editing a page no longer removes unrelated documents from the search index (LLMAI-205).
• The chat script URL carries the page version, so browsers pick up the new version after an upgrade (LLMAI-216).
• A provider authentication failure (401/403) shows a fixed credentials message to chat users instead of the provider's text.
• get_tree lists a space's home reference only when the caller may view it, and lists the viewable pages of a partly denied space.