Search/Sync: fix feature flag option read in Sync, add sanitize callbacks, fix SSE abort race

- Fix 1: Sync module now passes the WP option value as the filter default in
  both add_ai_answer_post_types() and add_ai_answer_post_meta(), so enabling
  via get_option() actually enables sync (was always passing false before).
- Fix 2: Add test_ai_cpts_in_whitelist_when_option_set() to cover the common
  option-only enablement path that would have caught Fix 1.
- Fix 3: Add sanitize_callback to _jstopic_keywords (sanitize_text_field) and
  _jstopic_url (esc_url_raw) register_post_meta() calls.
- Fix 4: Capture local controller reference before the fetchEventSource call so
  the .catch() handler checks the correct (now-finished) AbortController signal
  rather than the replacement controller from any subsequent request.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gibrown

projects/packages/search/src/class-ai-answers.php

@@ -66,10 +66,11 @@ public function register_post_types() {
 			self::TOPIC_CPT,
 			'_jstopic_keywords',
 			array(
-				'single'        => true,
-				'type'          => 'string',
-				'show_in_rest'  => true,
-				'auth_callback' => function () {
+				'single'            => true,
+				'type'              => 'string',
+				'show_in_rest'      => true,
+				'sanitize_callback' => 'sanitize_text_field',
+				'auth_callback'     => function () {
 					return current_user_can( 'edit_posts' );
 				},
 			)
@@ -79,10 +80,11 @@ public function register_post_types() {
 			self::TOPIC_CPT,
 			'_jstopic_url',
 			array(
-				'single'        => true,
-				'type'          => 'string',
-				'show_in_rest'  => true,
-				'auth_callback' => function () {
+				'single'            => true,
+				'type'              => 'string',
+				'show_in_rest'      => true,
+				'sanitize_callback' => 'esc_url_raw',
+				'auth_callback'     => function () {
 					return current_user_can( 'edit_posts' );
 				},
 			)

projects/packages/search/src/instant-search/components/search-app.jsx

@@ -266,6 +266,7 @@ class SearchApp extends Component {
 			this.aiController.abort();
 		}
 		this.aiController = new AbortController();
+		const controller = this.aiController; // local capture to avoid race in .catch()
 
 		this.setState( { aiStatus: 'loading', aiText: '', aiCitations: [] } );
 
@@ -282,7 +283,7 @@ class SearchApp extends Component {
 				filters: this.props.filters,
 				locale: options.locale || 'en',
 			} ),
-			signal: this.aiController.signal,
+			signal: controller.signal,
 			onopen: async response => {
 				if ( ! response.ok ) {
 					throw new Error( `HTTP ${ response.status }` );
@@ -310,7 +311,7 @@ class SearchApp extends Component {
 				throw new Error( 'SSE error' );
 			},
 		} ).catch( () => {
-			if ( ! this.aiController?.signal?.aborted ) {
+			if ( ! controller.signal.aborted ) {
 				this.setState( { aiStatus: 'error' } );
 			}
 		} );

projects/packages/sync/src/modules/class-search.php

@@ -1817,7 +1817,7 @@ public function add_search_options_whitelist( $list ) {
 	 * @return array Updated whitelist.
 	 */
 	public function add_ai_answer_post_types( $list ) {
-		if ( ! apply_filters( 'jetpack_search_ai_answers_enabled', false ) ) {
+		if ( ! apply_filters( 'jetpack_search_ai_answers_enabled', (bool) get_option( 'jetpack_search_ai_answers_enabled', false ) ) ) {
 			return $list;
 		}
 		$list[] = 'jp_search_behavior';
@@ -1832,7 +1832,7 @@ public function add_ai_answer_post_types( $list ) {
 	 * @return array Updated whitelist.
 	 */
 	public function add_ai_answer_post_meta( $list ) {
-		if ( ! apply_filters( 'jetpack_search_ai_answers_enabled', false ) ) {
+		if ( ! apply_filters( 'jetpack_search_ai_answers_enabled', (bool) get_option( 'jetpack_search_ai_answers_enabled', false ) ) ) {
 			return $list;
 		}
 		$list[] = '_jstopic_keywords';

projects/packages/sync/tests/php/modules/Search_Module_Test.php

@@ -72,4 +72,15 @@ public function test_ai_topic_meta_in_whitelist_when_search_enabled() {
 		$this->assertContains( '_jstopic_keywords', $list );
 		$this->assertContains( '_jstopic_url', $list );
 	}
+
+	/**
+	 * AI Answer CPTs should be in the whitelist when enabled via WP option only (no filter).
+	 */
+	public function test_ai_cpts_in_whitelist_when_option_set() {
+		update_option( 'jetpack_search_ai_answers_enabled', 1 );
+		$list = apply_filters( 'jetpack_sync_post_types_whitelist', array() );
+		delete_option( 'jetpack_search_ai_answers_enabled' );
+		$this->assertContains( 'jp_search_behavior', $list );
+		$this->assertContains( 'jetpack_search_topic', $list );
+	}
 }