[jeffpaul]

What?

Closes #1016
Closes #203

Brings @whyisjake's Abilities Explorer rewrite from #1074 (DataViews and REST) onto develop. The work is his. #1074 was squash-merged into feat/ai-workspace as 0c96aabb, stacked on the AI Workspace branch (#1004), which is not on develop and is in Future Release. This PR cherry-picks that commit with -x, so Jake stays its author. A follow-up commit removes the AI Workspace dependency, so the Explorer rewrite can ship in 1.5.0 without the Workspace.

Props @whyisjake

Why?

The Explorer was the plugin's last admin screen on WP_List_Table, vanilla JS and admin-ajax. Its hand-written search, sort and filters kept needing repair (#883, #641, #648, #344, #588). #1016 is in the 1.5.0 milestone, but #1074 landed on a branch that is not.

#203 asked for a PHP hook to swap the Ability_Table class. That table is removed here, so #203 is resolved by the ai.abilitiesExplorer.fields JavaScript filter instead: a plugin that depends on wp-hooks can add read-only DataViews columns. Each row carries the ability's meta, so the MCP column from #203 could look like this:

wp.hooks.addFilter( 'ai.abilitiesExplorer.fields', 'my-plugin/mcp', ( fields ) => [
	...fields,
	{
		id: 'my-plugin/mcp',
		label: 'MCP',
		type: 'boolean',
		enableSorting: true,
		getValue: ( { item } ) =>
			true === ( item.meta?.mcp?.public ?? item.meta?.public ),
	},
] );

Enqueueing and the full rules are in docs/experiments/abilities-explorer.md under "Adding fields to the table". @raftaar1191, could you confirm this covers your use case?

How?

Three commits change code:

1. Abilities Explorer: move to DataViews and REST (#1074): the cherry-pick, authored by Jake Spurlock. Conflict resolution only:
   • Ability_Table.php, src/experiments/abilities-explorer/index.js, Ability_TableTest.php and abilities-explorer.spec.js: kept Abilities Explorer: move to DataViews and REST #1074's deletions. I diffed each against develop first. Nothing develop added since the branch point is lost:
     • index.js only gained Abilities Explorer: Make the input validation messages translatable #1146's translated validation messages, which validate.ts already has.
     • The old spec only lost Remove Enable AI header toggle #985's global-toggle steps.
     • Ability_Table.php and Ability_TableTest.php had no develop changes.
   • .wp-env.test.json: added only ./tests/e2e-plugins/abilities-explorer-field. The ai-provider-for-anthropic zip came from the Workspace branch and no test here needs it.
   • Admin_Page.php, Ability_Handler.php, index.scss: took Abilities Explorer: move to DataViews and REST #1074's side.
   • Ability_HandlerTest.php: kept Abilities Explorer: accept input properties that list several types #1073's test_validate_input_validates_type_list next to Abilities Explorer: move to DataViews and REST #1074's test_validate_input_accepts_a_type_list, and changed Abilities Explorer: accept input properties that list several types #1073's expected message to Abilities Explorer: move to DataViews and REST #1074's wording (see below).
2. Abilities Explorer: remove the AI Workspace dependency (mine). Details below.
3. Abilities Explorer: adapt the tests to develop (mine). Details below.

Two more commits add the screenshots below under pr-screenshots/ and remove them again, so the description can link them by commit. They leave no files behind.

Removed for develop (the AI Workspace dependency)

WordPress\AI\Experiments\AI_Workspace\Tool_Policy does not exist on develop, and the picked code would fatal on it. Removed:

• PHP:
  • the Tool_Policy import and calls in REST/Abilities_Controller.php and Ability_Handler.php
  • the ai/v1/abilities/surface route and its SURFACE_ROUTE and SURFACE_CHANGES constants
  • change_surface(), policy_state(), and the policy and sequence fields of the list response. The sequence numbers existed only so a late list refresh could not undo a surface change. Refresh is disabled while a load is in flight, so list requests can't overlap.
  • get_surface_reason_labels(), get_surface_reason_label() and the surfaceReasonLabels localized setting
  • the list item fields conversational_surface, surface_reason, surface_reason_label and owner_excluded, plus show_in_rest and show_in_mcp. The last two only fed the "Exposed in" column's REST and MCP badges. Each row still carries meta.
• React:
  • the "Exposed in" field and filter (components/list/ExposedIn.tsx), SurfaceActions.tsx and PolicyToggle.tsx
  • their uses in fields.tsx, NameCell.tsx, ListView.tsx, App.tsx, api.ts (changeSurface() and the response sequencer) and types.ts
  • the column's minimum-width layout style, the focus-recovery logic for surface changes, and the related SCSS
• Tests:
  • tests/e2e/specs/experiments/abilities-explorer-surface.spec.js
  • the surface constants and payloadRow in tests/e2e/utils/abilities-explorer.js
  • the assistant fixtures, admission and withheld filters, and surface-option reset in tests/e2e-testing/e2e-testing.php
  • the list spec's "Exposed in" test
  • the PHPUnit cases for:
    • the surface route
    • assistant state and reasons
    • model declarations
    • the description shared with Streaming_Turn_Driver
    • REST and MCP exposure
    • the reason labels
• Docs: the Workspace text and the "Exposed in" and policy steps in docs/experiments/abilities-explorer.md.

The code has no class_exists() guards or dead branches. The ai.abilitiesExplorer.fields filter stays, so the Workspace can add its column back from its own code.

Adapted for develop

• Remove Enable AI header toggle #985 removed the global "Enable AI" option. Abilities Explorer: move to DataViews and REST #1074's "is unreachable when AI is globally off" e2e test set wpai_features_enabled: false through /wp/v2/settings. That setting is no longer registered, so the Explorer stayed reachable and the test failed (checked). AI is now globally off only through the wpai_features_enabled filter. The E2E Testing plugin gets an ai-e2e/v1/ai-disabled switch that turns that filter on.
• Markdown Feeds is on develop. test_no_route_is_registered_as_an_ability boots every experiment, and Markdown Feeds adds its feed to the global $wp_rewrite, which WP_UnitTestCase doesn't restore. Markdown_FeedsTest::test_singular_markdown_feed_url_is_not_redirected then failed later in the run. The test now restores $wp_rewrite->feeds.
• Abilities Explorer: accept input properties that list several types #1073's type-list message. Abilities Explorer: accept input properties that list several types #1073 (in 1.4.0) reported a type list as should be of type "string" or "object". Abilities Explorer: move to DataViews and REST #1074 uses "string, object" on both the server and the client validator, and treats an empty list or a non-string entry as no constraint, as the client does. I kept Abilities Explorer: move to DataViews and REST #1074's implementation so server and client agree, and updated Abilities Explorer: accept input properties that list several types #1073's test to the new message. Its other cases pass unchanged.

Fixes on develop since the branch point

git log d0b54f07..origin/develop -- includes/Experiments/Abilities_Explorer src/experiments/abilities-explorer tests lists 33 commits. Five touch files #1074 changes:

• Abilities Explorer: accept input properties that list several types #1073 (ac5920c8, type lists): covered by Abilities Explorer: move to DataViews and REST #1074's Ability_Handler::validate_property() and validate.ts. Its test is kept, adapted as above.
• Abilities Explorer: Make the input validation messages translatable #1146 (c7159935, translatable validation messages): every user-facing string in validate.ts goes through __() or sprintf( __() ) with the ai text domain. The old "AJAX request failed" string went away with admin-ajax.
• Remove Enable AI header toggle #985 (a8809576): adapted as above. develop's Abilities_ExplorerTest setup, without the global option, is kept.
• Rename the settings ability to core/settings-get #1087 (04e09f0f): its comment rename in e2e-testing.php is kept.
• 1.4.0 (2ed5642f): its @since 1.4.0 on Abilities Explorer: accept input properties that list several types #1073's test is kept.

The other 28 commits touch none of the files #1074 changes.

REST routes

All three are registered only while the experiment is on, and none is registered as an ability:

Route	Method	Purpose
ai/v1/abilities	GET	every registered ability, including ones without show_in_rest
ai/v1/abilities/item?name=	GET	one ability with schemas, raw data and example input
ai/v1/abilities/invoke	POST	runs the ability through WP_Ability::execute(), so its own permission check still applies

They share one permission check:

• the user has manage_options
• cookie authentication
• a wp_rest nonce, checked in the callback itself
• no application passwords

Abilities_ControllerTest still covers each refusal on every route. Abilities_ExplorerTest covers registration with the experiment on and off, and the navigation e2e spec covers the screen being unreachable with the experiment off and with AI globally off.

Behavior changes worth knowing

• Invoke now runs under REST, where is_admin() is false. The route loads wp-admin/includes/admin.php first.
• The list is built from a REST request too, so an ability a plugin registers only when is_admin() is true no longer appears.
• Errors show the ability's code, message and data instead of the always-null trace.
• The admin-ajax action ai_ability_explorer_invoke and the Ability_Table class are removed.
• Old list bookmarks with s, orderby or filter args land on the unfiltered list.
• Back to List keeps the view's layout, columns, sort and page size. Search and filters reset.
• Row actions (View and Test) sit under each ability's name and show on hover or keyboard focus, as in WP_List_Table. They are always shown below 782px.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: The cherry-pick's conflict resolution, removing the AI Workspace dependency, adapting the tests to develop, running the checks, and drafting this description. #1074's own code was also written with Claude Code, per its disclosure.

Testing Instructions

1. Enable the Abilities Explorer experiment, then open Tools > Abilities Explorer.
2. Filter by Provider and Category, search, sort and page. The statistics should not change with search or filters.
3. Open an ability's detail view, copy a schema, then open Test Ability. With Content Classification enabled, for ai/content-classification, max_suggestions 11 should report "must be at most 10", and 5 should validate.
4. Use browser Back and reload on each view.
5. Turn the experiment off. The menu item should be gone, and tools.php?page=ai-abilities-explorer should report that you are not allowed to access the page.

Checks run

wp-env could not start in the environment I worked in: its network policy blocks wordpress.org and the Alpine package mirror the wp-env images build from. I ran the same tools directly instead, so CI on this PR is the authoritative run.

• npm run build, npm run typecheck: pass.
• npm run lint:js: 0 errors. The one new warning (jsdoc/reject-function-type) is on restRoute() in tests/e2e/utils/abilities-explorer.js, from Abilities Explorer: move to DataViews and REST #1074.
• lint:php (composer run-script lint) and lint:php:stan (composer run-script phpstan), run on local PHP 8.3 rather than in the wp-env container: pass, PHPStan with no errors.
• test:php: run against the WordPress 7.1.3 PHPUnit suite on the SQLite database drop-in, not MySQL.
  • The Explorer tests in tests/Integration/Includes/Experiments/Abilities_Explorer/: 76 tests, all pass.
  • The full suite: 1952 tests, with 45 errors and failures in other features. All 45 also fail on develop in the same setup. They come from SQLite (table schema checks) and plugin path detection. No test fails only on this branch.
• test:e2e: run against WordPress 7.1.3 on PHP's built-in server with SQLite, Chromium, with the OpenAI and Google provider plugins taken from their GitHub repos.
  • The three Explorer specs (list, runner, navigation): 17 tests, all pass.
  • The full suite: 215 passed, 1 failed. The failure is connector-approval.spec.js:23 ("Can use the Connector Approval Experiment", its .notice-warning never appears), which fails the same way on develop here.
• Manual smoke test, scripted with Playwright, following the testing steps above:
  • The list shows the statistics and the Name, Slug and Provider columns.
  • Neither the Provider (Core) filter, the Category filter nor search changes the statistics.
  • Sort descending works. Paging was not exercised: the site had 14 abilities, under one page.
  • The detail view's Copy works.
  • max_suggestions 11 reports Field "max_suggestions" must be at most 10, and 5 reports "Input is valid according to the schema".
  • Back and reload keep the view, with one h1.

Screenshots or screencast

Same site and abilities, WordPress 7.1.3. Before is develop, after is this branch.

	Before	After
List
Detail view
Test runner, max_suggestions 11

Changelog Entry

Changed - Rebuilt the Abilities Explorer on DataViews and three ai/v1 REST routes, with an ai.abilitiesExplorer.fields JavaScript filter for adding read-only table columns. The ai_ability_explorer_invoke admin-ajax action and the Ability_Table class are removed, abilities registered only when is_admin() is true no longer appear, and old bookmarked filter URLs open the unfiltered list.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DM4Q4KoGRf8wxhcCQy1hfA

[github-actions]

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

[codecov]

Codecov Report

❌ Patch coverage is 89.62656% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.74%. Comparing base (5bfb356) to head (4ee5785).

Files with missing lines	Patch %	Lines
...Experiments/Abilities_Explorer/Ability_Handler.php	58.82%	21 Missing ⚠️
...udes/Experiments/Abilities_Explorer/Admin_Page.php	91.42%	3 Missing ⚠️
...s/Abilities_Explorer/REST/Abilities_Controller.php	99.35%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop    #1181      +/-   ##
=============================================
+ Coverage      82.25%   83.74%   +1.49%     
+ Complexity      3403     3388      -15     
=============================================
  Files            136      136              
  Lines          13225    13062     -163     
=============================================
+ Hits           10878    10939      +61     
+ Misses          2347     2123     -224     

Flag	Coverage Δ
unit	83.74% <89.62%> (+1.49%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[whyisjake]

Thanks for carrying this over, @jeffpaul. Approving.

I checked the cherry-pick (a51a92e) against the original squash commit (0c96aab): the only differences are the conflict resolutions listed in the description. The Workspace removal in b6c78b5 is complete. Nothing in the Explorer's code, tests or docs still refers to Tool_Policy, AI_Workspace, the surface route, or the response sequence numbers. Dropping the sequencer is safe, since Refresh is disabled while a load is in flight and the surface writes it guarded against are gone. The ai.abilitiesExplorer.fields filter stays, so #1004 can add the "Exposed in" column back from its own code. The test adaptations in 2a77b4b look right: the AI-off switch goes through the same wpai_features_enabled filter Features\Loader checks, and restoring $wp_rewrite->feeds fixes real cross-test pollution.

One optional suggestion: ai_e2e_ai_disabled is a persistent option. If a run is killed while it's on, every later run starts with AI globally off and fails in ways that look unrelated. Deleting it in tests/e2e/config/global-setup.ts, next to the credentials seed, would prevent that.

AI assistance: Yes. Tool(s): Claude Code. Used for: comparing the cherry-pick to the original commit and checking for leftover AI Workspace references.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @claude.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: claude.

Co-authored-by: whyisjake <whyisjake@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: dkotter <dkotter@git.wordpress.org>
Co-authored-by: raftaar1191 <raftaar1191@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[jeffpaul]

@whyisjake thanks. Your suggestion is in as d997063: tests/e2e/config/global-setup.ts now switches ai_e2e_ai_disabled off right after seeding the credentials.

I checked it by turning the switch on and then running a spec that never touches it (core-settings-get, "filters by fields"). Without the change the switch stayed on and that spec failed. With it, global setup cleared the option and the spec passed.

---

Generated by Claude Code

[jeffpaul]

Test PHP 7.4 WP 7.0.4 and Test PHP 8.0 WP trunk failed on d997063 before any test ran, and the failure isn't this PR's.

Both jobs failed while wp-env built its PHP Docker image. The image is based on Debian bullseye. At RUN apt-get -qy install git, archive.debian.org returned 404 for xauth_1.1-1_amd64.deb, on all three of the workflow's own start attempts:

E: Failed to fetch http://archive.debian.org/debian/pool/main/x/xauth/xauth_1.1-1_amd64.deb  404  Not Found
ERROR: process "/bin/sh -c apt-get -qy install git" did not complete successfully: exit code: 100

This commit only changes tests/e2e/config/global-setup.ts, which PHPUnit never loads. The same jobs passed on the previous head, af66bc8, and the image build lives in @wordpress/env, not in this repo. No fix exists to port yet. If the Debian archive stays broken, the fix belongs upstream in wp-env's Dockerfile, for example installing git with --no-install-recommends, or in a separate PR here. I'll re-run the failed jobs once when this run finishes.

---

Generated by Claude Code

[jeffpaul]

Tested and this works as expected, opening up for review.

[dkotter]

Couple flags around what I'd consider AI slop but otherwise things test well.

Beyond those things, I have some suggestions on the UI:

1. Currently there's no spacing between the main page header and the content below it:

2. Personal opinion but I don't love the fixed header as you scroll. Not sure if provides much value here as there's not much in that header. I'd suggest we keep that at the top instead of having it scroll with you.

3. There's a lot of whitespace now in the table. Can we show the Abilities descriptions in a column? That fills the space and provides some nice details:

4. Not sure we need a Refresh button in the header. Do Abilities change often enough that someone would want a button they can click, especially when they can just use the browser refresh button?

5. Might be nice to move the help context menu into the new UI. Right now that sticks out a bit compared to how the rest of the page looks.

[whyisjake]

Thanks for the review @dkotter. I opened stacked draft PR #1193 against this branch with the UI fixes. Merging it lands the commits here. It has three commits:

• Header spacing: 24px of padding above the content.
• Description column: the description is now shown by default, as a hideable column after Provider. It wraps (24em to 48em wide) and is never trimmed, per Abilities Explorer: Descriptions are excessively trimmed depending on the language #588.
• Refresh button: removed. The list loads once, and Retry still covers a failed first load.

Before	After (#1193)

The Abilities Explorer e2e specs pass locally (17 passed).

Two things I need your input on before I touch them:

• Fixed header: I read "I'd suggest we keep that fixed" as "not fixed". Did you mean the header should scroll away with the page?
• Help tab: what do you have in mind? Fold its content into the page (a panel or a link in the header, say), or drop it?

You're right about the tests and the docblocks, so I'll do those in a separate follow-up pass:

• Go through the tests and keep the ones that guard real behaviour (the REST controller, input validation, the test runner).
• Fold the field fixture into the existing tests/e2e-testing plugin.
• Drop the plumbing-only tests.
• Trim docblocks to the ones that add something, starting with includes/Experiments/Abilities_Explorer/REST/Abilities_Controller.php.

_{AI assistance: Yes. Tool(s): Claude Code. Used for: the changes in #1193 and drafting this comment.}

[whyisjake]

@dkotter the follow-up on the tests and comments is up in two more PRs, alongside #1193:

• Abilities Explorer: trim the tests to the behavior they guard #1194, test cleanup (stacked on this branch). It removes 1,608 lines of tests and adds 635.
  • The e2e tests are back in one spec, and the Explorer-only utilities are gone.
  • The separate field fixture plugin now lives in the existing tests/e2e-testing plugin.
  • The REST on/off switches in the test plugin are gone.
  • 17 e2e tests become 12, and 9 integration tests that only checked wiring are removed. The PR lists each cut and why.
• Abilities Explorer: trim the comments to the ones that explain why #1196, comment trim (stacked on Abilities Explorer: header spacing, description column, no Refresh button #1193, because it touches the same files). Comments only: 403 lines removed, 107 added.
  • Kept: each docblock's summary and required tags, plus one-line notes where the reason isn't visible in the code.
  • Cut: the rest. Abilities_Controller.php is included.

All three pass the Explorer's PHPUnit and e2e tests locally. The open questions on the fixed header and the Help tab still stand.

_{AI assistance: Yes. Tool(s): Claude Code. Used for: the changes in #1194 and #1196 and drafting this comment.}

Changes addressed.

[dkotter]

Fixed header: I read "I'd suggest we keep that fixed" as "not fixed". Did you mean the header should scroll away with the page?

Sorry, typo on my part. I've fixed this myself so we're good here.

Help tab: what do you have in mind? Fold its content into the page (a panel or a link in the header, say), or drop it?

This requires some exploration/trying things out. I'm assuming there's a component in the @wordpress/admin-ui/@wordpress/ui package we could use that would better fit the new DataViews experience but I don't know off the top of my head.

Fine to leave as-is for now, was flagging as it would have been nice to tackle now instead of pushing off for later.