Sites run as "production", so Application Passwords cannot be tested #598

Description

@nimesh-xecurify reported that a contributor at the WordCamp Rajasthan Contributor Day could not test a Trac ticket about Application Passwords: the feature was not available in their site, and they could not set WP_ENVIRONMENT_TYPE to local because there is no wp-config.php to edit. The question reached us through Slack.

Application Passwords are only available over HTTPS or when the environment type is local (wp_is_application_passwords_supported()). The dev server runs on plain http://127.0.0.1, and the environment type falls back to production, so the feature is off and the ticket cannot be tested.

The contributor cannot change it themselves. Playground generates wp-config.php inside its virtual filesystem, and the only constants it gets are the ones the app passes in the blueprint (src/server-runner.js): the fixed debug set in src/wp-debug-constants.js, the mail settings, and the strategy extras.

Core's own Docker environment defaults to WP_ENVIRONMENT_TYPE=local and WP_DEVELOPMENT_MODE=core (.env.example, applied by tools/local-env/scripts/install.js). A site set up by the app behaves differently from the environment the Core handbook documents, and anything gated on the environment type or development mode behaves differently too.

Proposed fix: add WP_ENVIRONMENT_TYPE: 'local' and WP_DEVELOPMENT_MODE: 'core' to WP_DEBUG_CONSTANTS, keeping the rule that these values are not configurable. WP_DEVELOPMENT_MODE: 'core' needs a check for Gutenberg sites, which also receive this set but run a stock WordPress with the plugin mounted.

Workaround until then: create build/wp-content/mu-plugins/local-env.php in the site folder containing <?php define( 'WP_ENVIRONMENT_TYPE', 'local' );. The constant is defined early enough because default-constants.php only calls wp_get_environment_type() when WP_DEBUG is undefined, and the app always defines it. A rebuild of build/ may remove the file.

Step-by-step reproduction instructions

1. Open any Core site in the app and click Start dev server.
2. Log in and go to Users > Profile.
3. Expected: an Application Passwords section. Actual: there is none, and wp_get_environment_type() returns production.

Operating system

Any

App version

v1.2.1