[feather2222]

Fixes #26158

What

Guard the XML-RPC remote construction in -[BlogService remoteForBlog:] so it is only created when the blog actually has XML-RPC credentials:

if (blog.xmlrpcApi && blog.username.length > 0 && blog.password.length > 0) {

Why

When a wpcom blog's auth token is unreadable from the keychain (observed as repeated Error while retrieving WordPressComOAuthKeychainServiceName token log entries), blog.wordPressComRestApi is nil and remoteForBlog: falls through to the XML-RPC path. A wpcom blog has no username/password, so -[ServiceRemoteWordPressXMLRPC initWithApi:username:password:] hits NSParameterAssert(password != nil) and crashes every debug launch until the app data is wiped. Release builds survive because the assert is compiled out, but the resulting remote is useless anyway.

Returning nil degrades the broken blog to "doesn't sync" instead of crashing; all callers tolerate a nil remote via Objective-C nil messaging.

Testing

• Built the WordPress scheme locally (Xcode 26.2).
• The crash was not reliably reproducible (see Debug crash: wpcom blog without a readable auth token falls through to the XML-RPC remote and hits NSParameterAssert #26158 for the investigation), so this is a defensive fix verified by code review of the call chain: BlogDetailsViewController.preloadMetadata() → syncBlogAndAllMetadata:completionHandler: → remoteForBlog:.

[crazytonyli]

Thanks for the PR. The issue has been fixed in #26132. I'm going to close this one. But feel free to let me know if you think otherwise.

[feather2222]

No worries at all — #26132 is a much more thorough fix. Glad the report was useful!