fix: isolate browser ability registration

[superdav42]

Summary

• keep browser-executed abilities in the existing page-local callback and descriptor registry
• stop enqueueing the WordPress abilities bridge and shared core store solely for browser abilities
• avoid duplicate sd-ai-agent-js category registration and isolate chat bootstrap from malformed third-party ability categories
• update unit and browser coverage for the page-local API and ensure it does not replace wp.abilities
• preserve ordinary screenshot-url targets while retaining sealed transport for explicitly marked private Elementor preview URLs

Reproduction

With WPForms Lite active, loading the SD AI Agent admin screen reproduced both reported failures:

• Category "sd-ai-agent-js" is already registered.
• Ability "wpforms/list-forms" references non-existent category "wpforms-forms".

After the change, the same screen loads with 13 standard local browser abilities and neither abilities fetch warning. Elementor 4.1.3 adds four optional in-editor MCP abilities through its public elementorV2.editorMcp adapter.

Live conversational ability matrix

Model-driven browser callback and tool-result records cover all 17 production abilities across sessions 48, 51, and 52:

• Navigation: navigate-to, refresh-page
• Screenshots: capture-screenshot, screenshot-url
• Gutenberg context: get-editor-selection, get-editor-capabilities, get-canonical-block-examples
• Gutenberg mutations: insert-block, insert-block-markup, replace-editor-selection, change-editor-history
• Validation: validate-page-quality, validate-theme-completion
• Elementor MCP: get-elementor-editor-mcp-context, list-elementor-editor-mcp-capabilities, read-elementor-editor-mcp-resource, call-elementor-editor-mcp-tool

Representative durable evidence:

• session 48: navigate-to reached /wp-admin/plugins.php and completed its tool-result continuation
• session 51: 36 call/response records, including successful ordinary URL screenshot capture at 768×576, editor mutations, refresh scheduling, and Elementor document-context discovery
• session 52: capability discovery reported 9 tools and bounded live resources; selected-element resource reading succeeded; the confirmed safe fixture lookup reached Elementor's public get-element-configuration-values tool and returned the expected missing-fixture result
• the screenshot regression was reproduced before the fix as URL is required; after the fix, screenshot-url retained http://wordpress.local:8080/, returned success=true, and attached the rendered image to the model
• the Elementor editor loaded both Elementor's public editor MCP package and this plugin's adapter; bridge state reported installed/active with live tools and resources

Worker self-verification

• PHPUnit: Tests: 4463, Assertions: 20870, Errors: 0, Failures: 0, Skipped: 139
• Lint: PHP/JS/CSS all clean
• PHPStan: 0 errors
• Build: succeeded
• Bundle: budgets passed

Additional checks:

• focused PHPUnit: ElementorCompletionGateTest — 9 tests, 50 assertions
• full pnpm run verify completed successfully
• manual browser matrix: all 17 production browser abilities produced model-selected browser callback/tool-result evidence
• manual console review: no relevant duplicate category or malformed third-party ability warnings

---

aidevops.sh v3.34.13 plugin for OpenCode v1.18.31 with gpt-5.6-sol spent 48m and 499,908 tokens on this with the user in an interactive session.

Summary by CodeRabbit

• New Features
  • Client-side abilities are available through a page-local API, with ability details and callbacks kept within the current page.
• Bug Fixes
  • Ordinary screenshot URLs in paused Elementor workflows remain usable.
  • Declared preview URL hashes are preserved when present; otherwise, a hash is derived from the preview URL.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6759a74d-4b8c-487f-949c-c00e87533b91

📥 Commits

Reviewing files that changed from the base of the PR and between 1dea0d4 and 9a947f1.

📒 Files selected for processing (11)

• assets/admin/abilities-global-bridge.js
• includes/Admin/FloatingWidget.php
• includes/Admin/UnifiedAdminMenu.php
• includes/Core/ElementorCompletionGate.php
• src/abilities/__tests__/registry.test.js
• src/abilities/index.js
• src/abilities/registry.js
• src/store/slices/sessionsSlice.js
• tests/SdAiAgent/Core/ElementorCompletionGateTest.php
• tests/e2e/chat-interactions.spec.js
• tests/e2e/client-abilities.spec.js

💤 Files with no reviewable changes (3)

• includes/Admin/UnifiedAdminMenu.php
• includes/Admin/FloatingWidget.php
• assets/admin/abilities-global-bridge.js

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The browser ability registry now stores callbacks and descriptors in page-local state, and admin enqueue paths no longer load the WordPress abilities modules or bridge. Preview URL hash extraction now distinguishes declared hashes from hashes derived from URLs.

Changes

Page-local browser abilities

Layer / File(s)	Summary
Local registry and registration flow src/abilities/*, src/store/slices/sessionsSlice.js, src/abilities/__tests__/registry.test.js	The registry stores callbacks and descriptors in page-level state. Registration and descriptor snapshots use that state, with tests for cross-bundle sharing, deduplication, and local execution.
Admin loading and browser API integration assets/admin/abilities-global-bridge.js, includes/Admin/FloatingWidget.php, includes/Admin/UnifiedAdminMenu.php, tests/e2e/*	Admin enqueue methods no longer load the WordPress abilities modules or bridge. End-to-end tests use window.sdAiAgentClientAbilities for ability discovery and execution.

Pending preview URL handling

Layer / File(s)	Summary
Declared preview hash detection includes/Core/ElementorCompletionGate.php, tests/SdAiAgent/Core/ElementorCompletionGateTest.php	Pending-call restoration checks for an explicitly declared preview URL hash. The test verifies that a screenshot URL without a declared hash remains unchanged.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant sessionsSlice
  participant abilitiesIndex
  participant registry
  sessionsSlice->>abilitiesIndex: ensureRegistered()
  abilitiesIndex->>registry: registerCategory()
  abilitiesIndex->>registry: registerClientAbility()
  registry-->>abilitiesIndex: local registration complete
  sessionsSlice->>registry: snapshotDescriptors()

Loading

Merge Risk: ⚪ Minimal · up to 9a947

Browser abilities now run from a page-local registry, and the admin screens no longer load the WordPress abilities modules. Ordinary screenshot URLs stay executable, and private Elementor preview URLs are still sealed before they are stored. No outstanding issue blocks merging this change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: isolating browser ability registration from the shared WordPress abilities system.
Docstring Coverage	✅ Passed	Docstring coverage is 94.44% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 8 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}