' . esc_html__( 'Agent Toolbelt', 'agent-toolbelt' ) . '

<?php
/**
 * Admin page: Tools -> Agent Toolbelt (spec §5). Shows the ability checklist
 * (enable/disable, persisted to the plugin option), the audit-log table, and a
 * status line. The checklist is the only setting in v1 — defaults are the
 * product.
 */

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

if ( ! class_exists( 'Agent_Toolbelt_Admin' ) ) {
    class Agent_Toolbelt_Admin
    {
        const NONCE_ACTION = 'agent_toolbelt_save';
        const NONCE_FIELD  = 'agent_toolbelt_nonce';
        const AUDIT_LIMIT  = 20;

        /**
         * Adds the Tools -> Agent Toolbelt submenu page.
         */
        public static function register_menu()
        {
            add_management_page(
                __( 'Agent Toolbelt', 'agent-toolbelt' ),
                __( 'Agent Toolbelt', 'agent-toolbelt' ),
                'manage_options',
                'agent-toolbelt',
                array( __CLASS__, 'render_page' )
            );
        }

        /**
         * Renders the admin page: status line, ability checklist, audit table.
         */
        public static function render_page()
        {
            if ( ! current_user_can( 'manage_options' ) ) {
                return;
            }

            $atb_saved = self::maybe_save();

            echo '<div class="wrap">';
            echo '<h1>' . esc_html__( 'Agent Toolbelt', 'agent-toolbelt' ) . '</h1>';

            if ( $atb_saved ) {
                echo '<div class="notice notice-success is-dismissible"><p>' . esc_html__( 'Abilities updated.', 'agent-toolbelt' ) . '</p></div>';
            }

            self::render_status();
            self::render_checklist();
            self::render_audit_log();

            echo '</div>';
        }

        /**
         * Persists the checklist on a valid POST. Only toggles the operations
         * shown in the form; any disabled slug that is not currently a
         * registered operation (e.g. an ability shipped in a later version) is
         * preserved, so its opt-in default is never silently cleared.
         *
         * @return bool True when a save happened.
         */
        protected static function maybe_save()
        {
            $atb_method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '';
            if ( 'POST' !== $atb_method ) {
                return false;
            }
            if ( ! isset( $_POST[ self::NONCE_FIELD ] ) || ! check_admin_referer( self::NONCE_ACTION, self::NONCE_FIELD ) ) {
                return false;
            }
            if ( ! current_user_can( 'manage_options' ) ) {
                return false;
            }

            $atb_shown = array_keys( Agent_Toolbelt::get_operations( true ) );

            $atb_checked = isset( $_POST['agent_toolbelt_enabled'] )
                ? array_map( 'sanitize_key', (array) wp_unslash( $_POST['agent_toolbelt_enabled'] ) )
                : array();

            // A shown operation left unchecked becomes disabled.
            $atb_disabled = array_values( array_diff( $atb_shown, $atb_checked ) );

            // Preserve disabled entries for slugs not shown in this form.
            $atb_options   = Agent_Toolbelt::get_options();
            $atb_existing  = isset( $atb_options['disabled_abilities'] ) ? (array) $atb_options['disabled_abilities'] : array();
            $atb_preserved = array_diff( $atb_existing, $atb_shown );

            $atb_options['disabled_abilities'] = array_values( array_unique( array_merge( $atb_disabled, $atb_preserved ) ) );
            update_option( Agent_Toolbelt::OPTION_NAME, $atb_options );

            return true;
        }

        /**
         * Status line (spec §5c): Abilities API present? kill switch? MCP hint.
         */
        protected static function render_status()
        {
            $atb_abilities_available = function_exists( 'wp_register_ability' );
            $atb_kill_switch_active  = Agent_Toolbelt::is_kill_switch_active();

            echo '<h2>' . esc_html__( 'Status', 'agent-toolbelt' ) . '</h2>';
            echo '<p>';
            echo esc_html__( 'Abilities API available:', 'agent-toolbelt' ) . ' <strong>' . ( $atb_abilities_available ? esc_html__( 'yes', 'agent-toolbelt' ) : esc_html__( 'no', 'agent-toolbelt' ) ) . '</strong><br />';
            echo esc_html__( 'Kill switch (AGENT_TOOLBELT_DISABLED):', 'agent-toolbelt' ) . ' <strong>' . ( $atb_kill_switch_active ? esc_html__( 'active', 'agent-toolbelt' ) : esc_html__( 'inactive', 'agent-toolbelt' ) ) . '</strong>';
            echo '</p>';

            if ( ! $atb_abilities_available ) {
                echo '<p>' . esc_html__( 'This site does not expose the WordPress Abilities API (requires WordPress 6.9+). The operations still work via WP-CLI.', 'agent-toolbelt' ) . '</p>';
            }
            if ( $atb_kill_switch_active ) {
                echo '<p>' . esc_html__( 'The kill switch is on: no abilities are registered and agents cannot call any operation.', 'agent-toolbelt' ) . '</p>';
            }

            // Accuracy note (2026-07): core ships the Abilities API and its
            // REST endpoints; MCP exposure needs a bridge plugin (the official
            // `ai` plugin lists MCP as upcoming). Don't promise a "core MCP adapter".
            echo '<p>' . esc_html__( 'AI agents can call the enabled abilities below through the WordPress REST API (wp-abilities/v1, application-password auth) or through any MCP bridge that exposes WordPress Abilities. Only the enabled abilities are visible to them.', 'agent-toolbelt' ) . '</p>';
        }

        /**
         * Ability checklist with risk badges and one-line descriptions.
         */
        protected static function render_checklist()
        {
            echo '<h2>' . esc_html__( 'Abilities', 'agent-toolbelt' ) . '</h2>';
            echo '<form method="post">';
            wp_nonce_field( self::NONCE_ACTION, self::NONCE_FIELD );

            echo '<table class="widefat striped">';
            echo '<thead><tr>';
            echo '<th>' . esc_html__( 'Enabled', 'agent-toolbelt' ) . '</th>';
            echo '<th>' . esc_html__( 'Ability', 'agent-toolbelt' ) . '</th>';
            echo '<th>' . esc_html__( 'Risk', 'agent-toolbelt' ) . '</th>';
            echo '<th>' . esc_html__( 'What it does', 'agent-toolbelt' ) . '</th>';
            echo '</tr></thead><tbody>';

            foreach ( Agent_Toolbelt::get_operations( true ) as $atb_slug => $atb_operation ) {
                $atb_meta     = $atb_operation->describe();
                $atb_enabled  = ! Agent_Toolbelt::is_ability_disabled( $atb_slug );
                $atb_risk     = isset( $atb_meta['risk'] ) ? (string) $atb_meta['risk'] : 'none';
                $atb_summary  = isset( $atb_meta['summary'] ) ? (string) $atb_meta['summary'] : '';

                echo '<tr>';
                echo '<td><input type="checkbox" name="agent_toolbelt_enabled[]" value="' . esc_attr( $atb_slug ) . '"' . checked( $atb_enabled, true, false ) . ' /></td>';
                echo '<td><code>' . esc_html( Agent_Toolbelt_Abilities::NAMESPACE_PREFIX . $atb_slug ) . '</code></td>';
                echo '<td>' . wp_kses( self::risk_badge( $atb_risk ), array( 'span' => array( 'style' => true ) ) ) . '</td>';
                echo '<td>' . esc_html( $atb_summary ) . '</td>';
                echo '</tr>';
            }

            echo '</tbody></table>';
            submit_button( __( 'Save abilities', 'agent-toolbelt' ) );
            echo '</form>';
        }

        /**
         * Renders a small colored risk badge.
         *
         * @param string $atb_risk
         * @return string Escaped HTML.
         */
        protected static function risk_badge( $atb_risk )
        {
            $atb_colors = array(
                'none'   => '#3858e9',
                'low'    => '#00a32a',
                'medium' => '#dba617',
                'high'   => '#d63638',
            );
            $atb_color = isset( $atb_colors[ $atb_risk ] ) ? $atb_colors[ $atb_risk ] : '#787c82';

            return '<span style="display:inline-block;padding:1px 8px;border-radius:9px;color:#fff;font-size:11px;background:'
                . esc_attr( $atb_color ) . '">' . esc_html( $atb_risk ) . '</span>';
        }

        /**
         * Audit-log table (newest first, spec §4/§5).
         */
        protected static function render_audit_log()
        {
            echo '<h2>' . esc_html__( 'Audit log', 'agent-toolbelt' ) . '</h2>';

            $atb_rows = class_exists( 'Agent_Toolbelt_Log' ) ? Agent_Toolbelt_Log::read( array( 'limit' => self::AUDIT_LIMIT ) ) : array();

            if ( empty( $atb_rows ) ) {
                echo '<p>' . esc_html__( 'No operations have been recorded yet.', 'agent-toolbelt' ) . '</p>';
                return;
            }

            echo '<table class="widefat striped">';
            echo '<thead><tr>';
            $atb_headers = array(
                __( 'When (UTC)', 'agent-toolbelt' ),
                __( 'Ability', 'agent-toolbelt' ),
                __( 'Caller', 'agent-toolbelt' ),
                __( 'User', 'agent-toolbelt' ),
                __( 'Dry run', 'agent-toolbelt' ),
                __( 'Result', 'agent-toolbelt' ),
                __( 'ms', 'agent-toolbelt' ),
                __( 'Summary', 'agent-toolbelt' ),
            );
            foreach ( $atb_headers as $atb_head ) {
                echo '<th>' . esc_html( $atb_head ) . '</th>';
            }
            echo '</tr></thead><tbody>';

            foreach ( $atb_rows as $atb_row ) {
                echo '<tr>';
                echo '<td>' . esc_html( isset( $atb_row['created_at'] ) ? $atb_row['created_at'] : '' ) . '</td>';
                echo '<td><code>' . esc_html( isset( $atb_row['ability'] ) ? $atb_row['ability'] : '' ) . '</code></td>';
                echo '<td>' . esc_html( isset( $atb_row['caller'] ) ? $atb_row['caller'] : '' ) . '</td>';
                echo '<td>' . esc_html( isset( $atb_row['user_id'] ) ? $atb_row['user_id'] : '0' ) . '</td>';
                echo '<td>' . ( empty( $atb_row['dry_run'] ) ? esc_html__( 'no', 'agent-toolbelt' ) : esc_html__( 'yes', 'agent-toolbelt' ) ) . '</td>';
                echo '<td>' . esc_html( isset( $atb_row['result'] ) ? $atb_row['result'] : '' ) . '</td>';
                echo '<td>' . esc_html( isset( $atb_row['duration_ms'] ) ? $atb_row['duration_ms'] : '0' ) . '</td>';
                echo '<td>' . esc_html( isset( $atb_row['summary'] ) ? $atb_row['summary'] : '' ) . '</td>';
                echo '</tr>';
            }

            echo '</tbody></table>';
        }
    }
}