✅ Done! Approved ✅ — PR #5661 (fix(agent-server): keep sockets and /v1 closed until deferred init completes). It's a clean, well-scoped fix. The good parts: • Switching

require_initialized

to take an

HTTPConnection

is the right move so one dependency serves both HTTP and WebSocket routes, and raising

WebSocketException(1013)

rather than

HTTPException

correctly avoids the app's HTTP exception handler (which reads

request.method

). • The gate is applied at the router mount points, so events / session / bash sockets are all covered for both the local and Docker registries, and

/v1

is gated after

check_openai_api_key

— matching the existing

/api

ordering. • The two added end-to-end tests hit the real lifespan via

TestClient

, and the socket test's

marker

side-effect actually proves no command ran. Nice touch. I left non-blocking follow-ups in the review:

/app-backends/*

(the HTTP + WebSocket proxy) and the

/api

workspace static-file routes are still reachable while dormant — the app-backends proxy is worth gating in a follow-up since it forwards arbitrary upgrades to an owned backend. And #5660's edit to

init_router.py

is in a different hunk, so merge order is safe. The PR is currently

blocked

on mergeability (not on my review — all required checks are green), so you may need a rebase before it lands.

✅ Done! Done — I've posted the review on agent-sdk PR #5700. Verdict: the code change looks right. It reuses the shared

require_initialized

dependency from #5661 (now merged) and applies it to both

/app-backends/{extension_name}

WebSocket route forms, which closes the Canvas ingress gap. The new live-uvicorn regression is solid: it checks dormant rejection (1013 on

TestClient

/ 403 handshake in real uvicorn via wsproto), post-init acceptance, and a full bash-socket auth + command round-trip. Two things I flagged as blockers (both CI, not the code): 1.

Validate PR description

fails — the validator is picking up #5661 from the body and complaining it lacks

ready-for-dev

. Worth making the "Related to #5688" linkage unambiguous. 2.

agent-server-tests

is red, but on an unrelated, likely-flaky

test_list_models_filtered_by_openrouter_provider

(

assert 0 > 0

). A rerun should clear it. Non-blocking notes: the gate covers the WS routes but not the HTTP proxy /

/session

routes on the same router (those still rely on

_ready_endpoint

returning 503) — either widen the dependency to the whole router or add a note; the new test stubs out

proxy_app_backend_websocket

, so it validates gating rather than real post-init auth; and forcing

ws="wsproto"

now applies to every uvicorn config in that test module. Posted as a COMMENT review (not approve/request-changes) since the code itself is fine and only CI needs addressing — happy to re-review once the pipeline is green.