# XHTheme AI Toolbox development build

Version: **2.3.1-dev.5** (2026-11-08).

This update is intended for staging and acceptance testing. The WordPress.org Stable tag remains **2.3**.

## Changes since 2.3.1-dev.4

- Persist full-post image batches in the task table with per-batch identity, conditional writes, worker leases, bounded storage and independent expiry cleanup. Preserve original provider tasks and saved media across retries.
- Preserve untitled drafts and missing-target tasks when viewing the queue. Validate target IDs before loading posts or comments; show an untitled or missing-target notice without deleting tasks.
- Mark confirmed image-batch JSON parse failures as terminal errors immediately. Retain their original bytes for five days, then conditionally remove only the state row. Repeated reads do not renew retention; concurrent repairs prevent deletion.
- Calculate comment scheduling from real Unix timestamps, parsing explicit dates in the WordPress timezone. Keep newly generated dates within the selected duration while retaining quiet hours and sorting.

## Verification and operating notes

The final implementation passed 54 regression suites with 4,236 assertions, ten real WordPress/MySQL integration combinations with 1,640 assertions, and 24 date-compatibility combinations with 1,080 assertions and 120,000 generated timestamps on 2026-11-08. The final frontend change was followed by another successful run of all 20 JavaScript suites. These are the verified implementation results; release packaging separately checks matching source hashes, build output, translations, syntax and archive contents.

Native integration covered WordPress 6.6 and 7.1.4 with PHP 7.4.33, 8.1.33, 8.2.29, 8.3.27 and 8.5.4. PHP.wasm 7.3.33, 8.0.30-dev and 8.4.10-dev covered syntax and the date functions, not a full MySQL deployment. The in-app browser verified repeated queue reads and desktop/mobile rendering. External AI and email calls were blocked or simulated; no live billing or provider availability claim is made.

Corrupt batches still count toward the per-post 60-batch cap during retention. The five-day deadline starts at detection; physical cleanup depends on WP-Cron and cursor progress. JSON that parses but fails identity/schema validation is retained for investigation. Healthy batches retain their existing 24-hour lifecycle and valid worker-lease protection. Saved media and article content are retained. Existing comment dates and queue schedules are not rewritten.

Old transient image batches require explicit verified migration with old workers stopped; do not recreate them as new operations. Use the operator migration command only after draining old workers and establishing the original expiry. Unknown or already-running legacy work must not be restarted automatically. Version 3 clients require an editor reload.

Known issues outside this release's requested fixes remain tracked: ordinary queue replacement/timeout-claim races, comment-ID versus post-ID task aggregation, expired workflow lock owners releasing replacement locks, incomplete success envelopes resetting gateway failure state, and configured summary length enforcement. Companion cloud cached-search ownership validation remains a separate concern. These were not declared fixed by the regression results. Image download still depends on public-IP DNS; some local Gutenberg canvas environments have a separately observed blank-canvas limitation.

## Current source and rebuilding

The repository retains its historical `src/` directory as required by the existing release workflow. **The source corresponding to this build is `development-source/`.** The runtime loads the compiled `build/` files and minified assets. Root `package.json`, `package-lock.json`, `webpack.config.js`, `postcss.config.js` and `tailwind.config.js` are the current build inputs. The readable inputs for minified thread assets are in `assets/css/thread-page.css` and `assets/js/thread-page.js`.

Rebuild only in a separate development copy of this checkout. Move the historical source outside the project before installing the current source:

```sh
legacy_source_dir="$(mktemp -d)"
mv src "$legacy_source_dir/src"
cp -R development-source src
npm ci
npm run build
```

The published build was produced with Node.js 20.15.0 and npm 10.7.0. Toolchain and absolute dependency paths may change generated module identifiers. Keep the lockfile and verify the rebuilt behavior before distributing another build. Rebuilding is not required to install and test this ZIP.

## External services

This plugin connects to the XHTheme AI API and the text-to-image platform selected by the administrator when users request AI features or enabled scheduled tasks run.

* AI requests use https://ai.xhtheme.com/airest/chat (or the administrator-defined API endpoint). Depending on the requested feature, requests include the APPID credential, site address, plugin/API version, article title/content, selected model, generation instructions and image references. Server-side model/account refreshes send the APPID and version information to retrieve the current model list and account balances.
* Image compression and temporary uploads use https://imager.cxory.com. When enabled, compression sends the source image URL; temporary uploads send image bytes for AI vision, generated-image processing, or screenshots explicitly attached to a support request. Remote avatar and generated-image URLs are fetched when their corresponding features need local images.
* Configured text-to-image providers (including Zhipu at open.bigmodel.cn and Alibaba Cloud DashScope) receive the configured provider key, model, prompt and requested image settings. These requests are made only for the corresponding selected image-generation service.

Cloud requests verify HTTPS certificates and do not follow credential-bearing redirects. Remote image downloads require PHP cURL, a direct connection, and DNS records pointing only to public Internet addresses. Private networks and proxy Fake-IP ranges are rejected; correct the DNS/proxy configuration instead of disabling validation.

Terms of Service: https://www.xhtheme.com/agreement/
Privacy Policy: https://www.xhtheme.com/privacy-policy/