From 501d8ba4e075281d5d7ea97b59cbac810ef12d89 Mon Sep 17 00:00:00 2001
From: finn763 <165816600+finn763@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:37:57 +0800
Subject: [PATCH] fix(gateway): cut api-server startup cost Closes #79047

---
 tests/tools/test_browser_extension_router.py | 23 +++++++++++++++++++-
 tools/registry.py                            |  7 +++++-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/tests/tools/test_browser_extension_router.py b/tests/tools/test_browser_extension_router.py
index cbbbbd6220..5fb7d1add0 100644
--- a/tests/tools/test_browser_extension_router.py
+++ b/tests/tools/test_browser_extension_router.py
@@ -425,10 +425,12 @@ def test_routeable_browser_tools_preserve_legacy_gate_without_bound_identity(mon
     assert browser_tool.check_browser_snapshot_requirements() is False
 
 
-def test_bound_browser_request_bypasses_availability_caches():
+def test_bound_browser_request_bypasses_availability_caches(monkeypatch):
+    from gateway import browser_control_broker
     from gateway.session_context import clear_session_vars, set_session_vars
     from tools.registry import CHECK_FN_CACHE_BYPASS, check_fn_cache_scope
 
+    monkeypatch.setattr(browser_control_broker, "browser_control_enabled", lambda: True)
     tokens = set_session_vars(
         session_id="session-fixture",
         browser_control_principal="principal-fixture",
@@ -440,6 +442,25 @@ def test_bound_browser_request_bypasses_availability_caches():
         clear_session_vars(tokens)
 
 
+def test_bound_identity_without_extension_control_keeps_cache_scope(monkeypatch):
+    """api_server binds a principal on every request; without the feature flag
+    that identity must not bypass the availability caches (#79047)."""
+    from gateway import browser_control_broker
+    from gateway.session_context import clear_session_vars, set_session_vars
+    from tools.registry import CHECK_FN_CACHE_BYPASS, check_fn_cache_scope
+
+    monkeypatch.setattr(browser_control_broker, "browser_control_enabled", lambda: False)
+    tokens = set_session_vars(
+        session_id="session-fixture",
+        browser_control_principal="principal-fixture",
+        browser_control_transport_family="local-api",
+    )
+    try:
+        assert check_fn_cache_scope() != CHECK_FN_CACHE_BYPASS
+    finally:
+        clear_session_vars(tokens)
+
+
 def test_registry_advertises_snapshot_through_extension_when_legacy_backend_is_down(
     monkeypatch,
 ):
diff --git a/tools/registry.py b/tools/registry.py
index a59f0f9e16..fccfb2d448 100644
--- a/tools/registry.py
+++ b/tools/registry.py
@@ -269,7 +269,12 @@ def check_fn_cache_scope() -> Optional[str]:
     try:
         from gateway.session_context import get_session_env
         if all(str(get_session_env(k, "") or "").strip() for k in _BROWSER_IDENTITY_KEYS):
-            return CHECK_FN_CACHE_BYPASS
+            # api_server binds a server-derived principal + transport family on EVERY request, so
+            # identity-present != controller-attached; only bypass when the extension-control
+            # feature is actually on (#79047).
+            from gateway.browser_control_broker import browser_control_enabled
+            if browser_control_enabled():
+                return CHECK_FN_CACHE_BYPASS
     except Exception:
         pass
     try: