[jeffpaul]

What?

Closes #1191

Fixes the four issues reported in #1191:

• Suggest Reply no longer sends the title or excerpt of private or password-protected posts.
• Comment Moderation only auto-analyzes regular comments.
• Uninstall removes Comment Moderation's comment meta.
• The duplicate experiment registrations are removed.

Why?

• Comment Moderation already promises that gated editorial content is never sent to the provider, and Suggest Reply didn't follow the same rule.
• Auto-analysis ran on every comment type, so each pingback, trackback and block editor note (including AI-authored Editorial Notes) triggered an AI request, and a note could be unapproved.
• The analysis meta has no meaning without the plugin but was left behind on uninstall.

How?

• Shared visibility check: new is_post_publicly_readable( WP_Post ) helper in includes/helpers.php. It holds the same logic as Comment Moderation's existing check, which now calls it. The wpai_comment_analysis_post_context_shareable filter is unchanged.
• Suggest Reply: a new private get_post_context() returns the post title and excerpt only when the post is publicly readable. A new wpai_suggest_reply_post_context_shareable filter lets sites opt in, for example on intranet sites. For gated posts, the reply is generated from the comment alone.
• Comment Moderation: a new should_moderate_comment_type() method, with a wpai_comment_moderation_comment_types filter (default array( 'comment' )). An empty legacy type counts as comment. Manual and bulk analysis from the Comments screen are unchanged.
• Uninstall: delete_meta() now deletes the five _wpai_* comment meta keys with delete_metadata( 'comment', 0, $key, '', true ). The docblock is updated. Generated content (wpai_generated_summary, wpai_note, wpai_generated) is still kept.
• Experiments: removed the duplicate Comment_Moderation and Key_Encryption lines.
• Docs: docs/experiments/suggest-reply.md and docs/experiments/comment-moderation.md describe the new behavior and filters.

Not changed here:

• Suggest Reply still uses the global moderate_comments capability rather than per-comment edit_comment.
• Auto-analysis still runs during imports.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Finding and confirming the issues, implementation, tests and docs. Reviewed by me.

Testing Instructions

1. Suggest Reply: enable Suggest Reply and AI Request Logging. Leave a logged-in comment on a private post with no excerpt and click Suggest reply. The logged request has no <post-title> or <post-context>, and a reply is still generated. Repeat on a public post: both tags are present.
2. Comment Moderation: enable it and add a block editor note to a draft, or send a pingback. No comment-analysis request is logged. A regular comment is still analyzed.
3. Uninstall: analyze a few comments, then delete the plugin. SELECT COUNT(*) FROM wp_commentmeta WHERE meta_key LIKE '\_wpai\_%' returns 0.
4. Experiments: Settings → AI lists each experiment once, as before.

Automated:

• New PHPUnit tests:
  • Suggest Reply context: public, password-protected, draft/private/pending, filter
  • Comment Moderation: pingback, trackback and note skipped; empty type analyzed; type filter
  • Uninstall: comment meta removed, and preserved when cleanup is filtered off
  • EXPERIMENT_CLASSES has no duplicates
• I confirmed each new test fails on develop and passes with this change.
• Not checked: CI and the JS/E2E suites. Some unrelated tests fail locally without a JS build, and fail the same way on develop.

Changelog Entry

Fixed - Suggest Reply no longer sends the title or excerpt of private or password-protected posts to the AI provider.
Fixed - Comment Moderation no longer automatically analyzes pingbacks, trackbacks or block editor notes.
Fixed - Uninstalling the plugin now removes Comment Moderation analysis data.

🤖 Generated with Claude Code

This response was drafted in consultation with AI and reviewed and approved by a human.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: dkotter <dkotter@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[github-actions]

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.36%. Comparing base (4d1940a) to head (150dbbb).

Additional details and impacted files

@@              Coverage Diff              @@
##             develop    #1192      +/-   ##
=============================================
+ Coverage      85.34%   85.36%   +0.01%     
- Complexity      4431     4435       +4     
=============================================
  Files            173      173              
  Lines          16435    16457      +22     
=============================================
+ Hits           14027    14049      +22     
  Misses          2408     2408              

Flag	Coverage Δ
unit	85.36% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dkotter]

Worth noting we decided to purposely not delete these when first working on this uninstall code. The idea being is that someone may have / want to build custom functionality that uses this information and it's a minor amount of data so no storage concerns there.

Doesn't mean we can't change our minds now but wanted to highlight the history here. Also likely other meta we decided to leave behind for the same reason.