Justin AI Client

Justin AI Client connects WordPress to the Justin AI Platform at ai.justin.my. All remote AI communication goes through juzhax/ai-client; the plugin never contacts model providers directly. Version 0.1 provides connection settings, connection testing, manual workflow execution, post-editor generation for review, private REST endpoints, and a small opt-in cron foundation.

Requirements and installation

• WordPress 6.5+
• PHP 8.3+ (the current juzhax/ai-client dev-main requires PHP 8.3)
• HTTPS AI Platform endpoint

Normal sites should install a release ZIP, which includes vendor/. Developers can clone the repository and run composer install, or use:

composer require juzhax/wp-ai-client

Do not install the source archive from GitHub as a WordPress plugin unless its Composer dependencies have been installed.

Configuration and connection testing

Open Settings → AI Platform. Configure the HTTPS base URL, API key, optional application identifier, and timeout. The password field is intentionally empty on every page load; leaving it blank preserves the stored key and the adjacent checkbox explicitly clears it. Save before testing, then select Test connection. A successful test calls the SDK's authenticated application identity endpoint and records the last successful UTC time.

WordPress has no universal secret vault. CredentialManager isolates access to the API key, but the key is still stored in the WordPress options database. Protect database backups and administrator accounts. Keys are never returned by REST, rendered into HTML/JavaScript, or included in logs.

Workflows and post editor

The settings page includes a manual runner. Enter a sanitized workflow slug and a JSON object. The installed SDK only exposes direct workflow submission, so there is no unsupported queue-mode toggle. The page shows the run ID, status, and a size-limited allowlist of useful result fields.

Posts and pages have an AI Platform meta box. Choose a workflow and task (draft, excerpt, or SEO metadata), then explicitly generate. The response is shown for review; the plugin never replaces editor content or publishes a post. It stores only identifiers and status—not raw provider responses:

• _ai_platform_request_id
• _ai_platform_workflow_run_id
• _ai_platform_workflow_slug
• _ai_platform_last_status
• _ai_platform_last_run_at

REST API

All routes use cookie authentication plus a WordPress REST nonce in the editor. They are never public:

• POST /wp-json/wp-ai-client/v1/connection/test — manage_options
• POST /wp-json/wp-ai-client/v1/workflows/run — manage_options; body: workflow_slug, input
• GET /wp-json/wp-ai-client/v1/requests/{request_id} — manage_options
• POST /wp-json/wp-ai-client/v1/posts/{post_id}/generate — permission to edit that exact post; body: workflow_slug, task, optional user_input

Errors are translated into safe WordPress errors for configuration, authentication, validation, rate limiting, network, and other API failures.

Scheduled workflows

Scheduling is disabled by default. When enabled, WordPress Cron runs only the comma-separated allowlist hourly, avoids duplicate events, skips incomplete connections, records safe summaries only when debug logging is enabled, and is cleared on deactivation/uninstall. WordPress Cron is traffic-driven and is not a precise scheduler.

Hooks

Filters:

• wp_ai_client_settings — sanitized settings before storage (take care never to leak its API key)
• wp_ai_client_workflow_input — workflow input and slug before submission
• wp_ai_client_generated_content — size-limited result fields, post ID, and task before REST response
• wp_ai_client_http_user_agent — SDK HTTP user agent

Actions:

• wp_ai_client_before_workflow_run — slug and filtered input
• wp_ai_client_after_workflow_run — slug and SDK response
• wp_ai_client_workflow_failed — slug and exception; handlers must not expose exception details

Development, testing, and releases

composer validate --strict
composer install
composer test
bin/build-release

Tests use a PSR-18 fake and make no network requests. The release builder installs production dependencies, copies only distributable files to build/wp-ai-client, retains vendor/, and produces wp-ai-client-0.1.0.zip without changing tracked source files. Keep secrets out of the repository.

To remove settings on uninstall, enable Delete settings on uninstall. Post metadata is deleted only when its separate explicit option is also enabled; posts and generated content are never deleted.

Changelog

0.1.0

• Initial secure WordPress foundation for settings, connection testing, workflows, editor generation, REST routes, opt-in cron, and release packaging.