@andypai/agent-kanban 0.6.0 → 0.6.1

package/src/__tests__/metrics.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test, beforeEach } from 'bun:test'
 import { Database } from 'bun:sqlite'
-import { initSchema, seedDefaultColumns, addTask } from '../db'
+import { initSchema, seedDefaultColumns, addTask, addColumn, moveTask } from '../db'
 import { getBoardMetrics } from '../metrics'
 
 let db: Database
@@ -62,3 +62,39 @@ describe('getBoardMetrics', () => {
     expect(metrics.tasksByPriority).toHaveLength(0)
   })
 })
+
+describe('getBoardMetrics with custom column names', () => {
+  function customBoard(columnNames: string[]): Database {
+    const db = new Database(':memory:')
+    db.run('PRAGMA foreign_keys = ON')
+    initSchema(db)
+    for (const name of columnNames) addColumn(db, name)
+    return db
+  }
+
+  test('classifies done/in-progress by role despite custom case and spacing', () => {
+    const db = customBoard(['Todo', 'In Progress', 'Human Review', 'Merging', 'Done'])
+    addTask(db, 'a', { column: 'Todo' })
+    const b = addTask(db, 'b', { column: 'Todo' })
+    const c = addTask(db, 'c', { column: 'Todo' })
+    moveTask(db, b.id, 'In Progress')
+    moveTask(db, c.id, 'Done')
+
+    const metrics = getBoardMetrics(db)
+    // 'In Progress' (space + caps) used to never match the literal 'in-progress'.
+    expect(metrics.inProgressCount).toBe(1)
+    expect(metrics.completedTasks).toBe(1)
+    expect(metrics.completionPercent).toBe(33)
+  })
+
+  test('falls back to the terminal column for completed when no done-named column', () => {
+    const db = customBoard(['Todo', 'Doing', 'Shipping'])
+    const t = addTask(db, 'a', { column: 'Todo' })
+    moveTask(db, t.id, 'Shipping')
+
+    const metrics = getBoardMetrics(db)
+    expect(metrics.completedTasks).toBe(1)
+    // 'Doing' is a recognized in-progress synonym.
+    expect(metrics.inProgressCount).toBe(0)
+  })
+})

package/src/__tests__/postgres-local-provider.test.ts

@@ -2,7 +2,8 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import postgres from 'postgres'
 
 import { run } from '../index'
-import type { Task, TaskComment, TaskWithColumn } from '../types'
+import { openKanbanRuntime } from '../provider-runtime'
+import type { BoardMetrics, Task, TaskComment, TaskWithColumn } from '../types'
 
 const databaseUrl = process.env['KANBAN_PG_TEST_URL'] ?? process.env['DATABASE_URL']
 const pgTest = databaseUrl ? test : test.skip
@@ -131,4 +132,92 @@ describe('postgres local provider', () => {
 
     expect(created.column_name).toBe('Todo')
   })
+
+  async function positionsInColumn(
+    columnName: string,
+  ): Promise<Array<{ id: string; position: number }>> {
+    if (!sql) throw new Error('sql not initialized')
+    return sql<Array<{ id: string; position: number }>>`
+      SELECT t.id, t.position FROM tasks t
+      JOIN columns c ON t.column_id = c.id
+      WHERE c.name = ${columnName}
+      ORDER BY t.position
+    `
+  }
+
+  pgTest('move renumbers the source column and records column-time tracking', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    const b = expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+    const c = expectOk<TaskWithColumn>(await run(['task', 'add', 'C', '-c', 'backlog']))
+    expect((await positionsInColumn('backlog')).map((r) => r.id)).toEqual([a.id, b.id, c.id])
+
+    expectOk<Task>(await run(['task', 'move', b.id, 'in-progress']))
+
+    // Source column compacted to 0..n-1 with no gap left by B.
+    expect(await positionsInColumn('backlog')).toEqual([
+      { id: a.id, position: 0 },
+      { id: c.id, position: 1 },
+    ])
+
+    // B has a closed backlog interval and an open in-progress interval.
+    const tracking = await sql!<Array<{ column_name: string; exited_at: string | null }>>`
+      SELECT c.name AS column_name, ct.exited_at
+      FROM column_time_tracking ct JOIN columns c ON ct.column_id = c.id
+      WHERE ct.task_id = ${b.id}
+      ORDER BY ct.entered_at
+    `
+    expect(tracking.map((r) => r.column_name)).toEqual(['backlog', 'in-progress'])
+    expect(tracking[0]!.exited_at).not.toBeNull()
+    expect(tracking[1]!.exited_at).toBeNull()
+  })
+
+  pgTest('move to the same column is a no-op (no extra tracking, no reorder)', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    const b = expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+
+    expectOk<Task>(await run(['task', 'move', a.id, 'backlog']))
+
+    // Order preserved (no re-append of A to the end).
+    expect((await positionsInColumn('backlog')).map((r) => r.id)).toEqual([a.id, b.id])
+    // Only the single creation interval exists for A.
+    const trackingRows = await sql!<Array<{ count: string | number }>>`
+      SELECT COUNT(*) AS count FROM column_time_tracking WHERE task_id = ${a.id}
+    `
+    expect(Number(trackingRows[0]?.count ?? 0)).toBe(1)
+  })
+
+  pgTest('delete renumbers the remaining tasks in the column', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    const b = expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+    const c = expectOk<TaskWithColumn>(await run(['task', 'add', 'C', '-c', 'backlog']))
+
+    expectOk<Task>(await run(['task', 'delete', b.id]))
+
+    expect(await positionsInColumn('backlog')).toEqual([
+      { id: a.id, position: 0 },
+      { id: c.id, position: 1 },
+    ])
+  })
+
+  pgTest('getMetrics reports completion time for tasks that reached Done', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+    expectOk<Task>(await run(['task', 'move', a.id, 'done']))
+
+    const runtime = await openKanbanRuntime()
+    let metrics: BoardMetrics
+    try {
+      metrics = await runtime.provider.getMetrics()
+    } finally {
+      await runtime.close()
+    }
+
+    expect(metrics.completedTasks).toBe(1)
+    // Bug fix: a task resting in Done now contributes to the average (no longer
+    // requires exited_at), and the value is a real number, not a string.
+    expect(typeof metrics.avgCompletionHours).toBe('number')
+    expect(metrics.avgCompletionHours!).toBeGreaterThanOrEqual(0)
+    expect(metrics.tasksCreatedThisWeek).toBe(2)
+    expect(metrics.inProgressCount).toBe(0)
+  })
 })

package/src/__tests__/server.test.ts

@@ -289,3 +289,129 @@ describe('startServer', () => {
     expect(syncCalls).toBeGreaterThanOrEqual(2)
   })
 })
+
+describe('startServer auth + CORS', () => {
+  const TOKEN = 'secret-token'
+
+  test('without a token, the API stays open (localhost default)', async () => {
+    const runtime = startServer(makeProvider(), 0)
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`)
+    expect(res.status).toBe(200)
+  })
+
+  test('with a token, protected routes require Bearer auth', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+
+    const noAuth = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`)
+    expect(noAuth.status).toBe(401)
+    const noAuthBody = (await noAuth.json()) as { ok: boolean; error: { code: string } }
+    expect(noAuthBody.ok).toBe(false)
+    expect(noAuthBody.error.code).toBe('UNAUTHORIZED')
+
+    const wrong = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`, {
+      headers: { Authorization: 'Bearer nope' },
+    })
+    expect(wrong.status).toBe(401)
+
+    const ok = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`, {
+      headers: { Authorization: `Bearer ${TOKEN}` },
+    })
+    expect(ok.status).toBe(200)
+  })
+
+  test('?token= does NOT authorize HTTP API routes (header only)', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap?token=${TOKEN}`)
+    expect(res.status).toBe(401)
+  })
+
+  test('/ws requires the token and accepts it as a query param', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+
+    // Plain GET (no upgrade) exercises the auth gate before the upgrade attempt.
+    const noToken = await fetch(`http://127.0.0.1:${runtime.port}/ws`)
+    expect(noToken.status).toBe(401)
+
+    // Correct query token passes the gate; the non-WebSocket request then fails
+    // the upgrade (400) rather than auth (401).
+    const withToken = await fetch(`http://127.0.0.1:${runtime.port}/ws?token=${TOKEN}`)
+    expect(withToken.status).not.toBe(401)
+  })
+
+  test('with a token, /api/health stays public', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/health`)
+    expect(res.status).toBe(200)
+  })
+
+  test('with a token, webhook routes are exempt (provider secret guards them)', async () => {
+    const runtime = startServer(
+      makeProvider({
+        type: 'local',
+        async handleWebhook() {
+          return { handled: true }
+        },
+      }),
+      0,
+      { authToken: TOKEN },
+    )
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/webhooks/local`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}',
+    })
+    // Reaches the provider handler instead of being rejected by bearer auth.
+    expect(res.status).not.toBe(401)
+  })
+
+  test('wsClients are tracked per server instance, not shared globally', async () => {
+    const a = startServer(makeProvider(), 0)
+    runtimes.push(a)
+    const b = startServer(makeProvider(), 0)
+    runtimes.push(b)
+
+    const ws = new WebSocket(`ws://127.0.0.1:${a.port}/ws`)
+    await new Promise<void>((resolve, reject) => {
+      ws.onopen = () => resolve()
+      ws.onerror = () => reject(new Error('ws connection failed'))
+    })
+    // Let server A's open handler register the socket.
+    await sleep(25)
+
+    const healthA = (await (await fetch(`http://127.0.0.1:${a.port}/api/health`)).json()) as {
+      data: { wsClients: number }
+    }
+    const healthB = (await (await fetch(`http://127.0.0.1:${b.port}/api/health`)).json()) as {
+      data: { wsClients: number }
+    }
+    expect(healthA.data.wsClients).toBe(1)
+    // Before per-instance scoping, B shared A's global set and also reported 1.
+    expect(healthB.data.wsClients).toBe(0)
+    ws.close()
+  })
+
+  test('CORS headers are emitted only when an allowed origin is configured', async () => {
+    const withOrigin = startServer(makeProvider(), 0, {
+      allowedOrigin: 'https://kanban.example',
+    })
+    runtimes.push(withOrigin)
+    const res = await fetch(`http://127.0.0.1:${withOrigin.port}/api/health`)
+    expect(res.headers.get('access-control-allow-origin')).toBe('https://kanban.example')
+
+    const preflight = await fetch(`http://127.0.0.1:${withOrigin.port}/api/bootstrap`, {
+      method: 'OPTIONS',
+    })
+    expect(preflight.headers.get('access-control-allow-origin')).toBe('https://kanban.example')
+
+    const noOrigin = startServer(makeProvider(), 0)
+    runtimes.push(noOrigin)
+    const bare = await fetch(`http://127.0.0.1:${noOrigin.port}/api/health`)
+    expect(bare.headers.get('access-control-allow-origin')).toBeNull()
+  })
+})

package/src/__tests__/use-cases.test.ts

@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, test } from 'bun:test'
+import { Database } from 'bun:sqlite'
+import { initSchema, seedDefaultColumns } from '../db'
+import { createProvider } from '../providers/index'
+import type { KanbanProvider } from '../providers/types'
+import * as useCases from '../use-cases'
+
+let db: Database
+let provider: KanbanProvider
+
+beforeEach(() => {
+  db = new Database(':memory:')
+  db.run('PRAGMA foreign_keys = ON')
+  initSchema(db)
+  seedDefaultColumns(db)
+  provider = createProvider(db, { provider: 'local' }, ':memory:')
+})
+
+describe('use-cases label normalization', () => {
+  // The use-case layer owns label normalization so every transport feeds raw
+  // labels in its own shape and gets the same result.
+  test('normalizes CLI-style nested flag arrays', async () => {
+    const task = await useCases.createTask(provider, {
+      title: 'cli',
+      labels: [['bug', 'ui'], undefined],
+    })
+    expect(task.labels).toEqual(['bug', 'ui'])
+  })
+
+  test('normalizes HTTP-style string arrays', async () => {
+    const task = await useCases.createTask(provider, {
+      title: 'http',
+      labels: ['bug', 'ui'],
+    })
+    expect(task.labels).toEqual(['bug', 'ui'])
+  })
+
+  test('normalizes a comma-separated string and de-dupes', async () => {
+    const task = await useCases.createTask(provider, {
+      title: 'csv',
+      labels: 'bug, ui, bug',
+    })
+    expect(task.labels).toEqual(['bug', 'ui'])
+  })
+
+  test('treats omitted labels as none', async () => {
+    const task = await useCases.createTask(provider, { title: 'none' })
+    expect(task.labels).toEqual([])
+  })
+})
+
+describe('use-cases provider forwarding', () => {
+  test('createTask then getTask/listTasks round-trip', async () => {
+    const created = await useCases.createTask(provider, { title: 'roundtrip', column: 'backlog' })
+    const fetched = await useCases.getTask(provider, created.id)
+    expect(fetched.id).toBe(created.id)
+    const all = await useCases.listTasks(provider)
+    expect(all.map((t) => t.id)).toContain(created.id)
+  })
+
+  test('moveTask forwards to the target column and returns the task', async () => {
+    const created = await useCases.createTask(provider, { title: 'mover', column: 'backlog' })
+    const columns = await useCases.listColumns(provider)
+    const target = columns.find((c) => c.name.toLowerCase() === 'in-progress')!
+    const moved = await useCases.moveTask(provider, created.id, target.name)
+    expect(moved.column_id).toBe(target.id)
+  })
+
+  test('addComment / listComments / updateComment forward correctly', async () => {
+    const task = await useCases.createTask(provider, { title: 'commented' })
+    const comment = await useCases.addComment(provider, task.id, 'first')
+    const listed = await useCases.listComments(provider, task.id)
+    expect(listed.map((c) => c.body)).toContain('first')
+    const updated = await useCases.updateComment(provider, task.id, comment.id, 'edited')
+    expect(updated.body).toBe('edited')
+  })
+})

package/src/__tests__/webhooks.test.ts

@@ -27,6 +27,18 @@ function hmac(secret: string, body: string): string {
   return createHmac('sha256', secret).update(body).digest('hex')
 }
 
+const JIRA_TEST_SECRET = 'topsecret'
+const LINEAR_TEST_SECRET = 'hushhush'
+
+// Sign for both providers; each handler only reads its own header, so this works
+// regardless of which provider the test exercises.
+function signedHeaders(body: string): Record<string, string> {
+  return {
+    'x-hub-signature': `sha256=${hmac(JIRA_TEST_SECRET, body)}`,
+    'linear-signature': hmac(LINEAR_TEST_SECRET, body),
+  }
+}
+
 function jsonResponse(body: unknown, status = 200): Response {
   return new Response(JSON.stringify(body), {
     status,
@@ -108,7 +120,7 @@ describe('Jira webhook', () => {
   test('issue_created upserts the task', async () => {
     const db = new Database(':memory:')
     seedJira(db)
-    delete process.env['JIRA_WEBHOOK_SECRET']
+    process.env['JIRA_WEBHOOK_SECRET'] = JIRA_TEST_SECRET
     const client = new JiraClient({
       baseUrl: jiraConfig.baseUrl,
       email: jiraConfig.email,
@@ -133,7 +145,7 @@ describe('Jira webhook', () => {
         },
       },
     })
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
     expect(result.handled).toBe(true)
     const tasks = getCachedJiraTasks(db)
     expect(tasks.find((t) => t.externalRef === 'ENG-100')?.title).toBe('New issue')
@@ -142,7 +154,7 @@ describe('Jira webhook', () => {
   test('issue_created accepts Jira webhook string descriptions', async () => {
     const db = new Database(':memory:')
     seedJira(db)
-    delete process.env['JIRA_WEBHOOK_SECRET']
+    process.env['JIRA_WEBHOOK_SECRET'] = JIRA_TEST_SECRET
     const client = new JiraClient({
       baseUrl: jiraConfig.baseUrl,
       email: jiraConfig.email,
@@ -170,7 +182,7 @@ describe('Jira webhook', () => {
       },
     })
 
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
 
     expect(result.handled).toBe(true)
     expect(getCachedJiraTasks(db).find((t) => t.externalRef === 'ENG-101')?.description).toBe(
@@ -193,7 +205,7 @@ describe('Jira webhook', () => {
         updatedAt: '2025-02-01',
       },
     ])
-    delete process.env['JIRA_WEBHOOK_SECRET']
+    process.env['JIRA_WEBHOOK_SECRET'] = JIRA_TEST_SECRET
     const client = new JiraClient({
       baseUrl: jiraConfig.baseUrl,
       email: jiraConfig.email,
@@ -214,7 +226,7 @@ describe('Jira webhook', () => {
         },
       },
     })
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
     expect(result.handled).toBe(true)
     expect(getCachedJiraTasks(db).find((t) => t.externalRef === 'ENG-200')).toBeUndefined()
   })
@@ -298,7 +310,7 @@ describe('Jira webhook', () => {
   test('ignores issue updates from other projects', async () => {
     const db = new Database(':memory:')
     seedJira(db)
-    delete process.env['JIRA_WEBHOOK_SECRET']
+    process.env['JIRA_WEBHOOK_SECRET'] = JIRA_TEST_SECRET
     const client = new JiraClient({
       baseUrl: jiraConfig.baseUrl,
       email: jiraConfig.email,
@@ -323,7 +335,7 @@ describe('Jira webhook', () => {
       },
     })
 
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
 
     expect(result.handled).toBe(false)
     expect(result.message).toContain('Ignoring issue from project')
@@ -333,7 +345,7 @@ describe('Jira webhook', () => {
   test('issue_updated backfills activity immediately', async () => {
     const db = new Database(':memory:')
     seedJira(db)
-    delete process.env['JIRA_WEBHOOK_SECRET']
+    process.env['JIRA_WEBHOOK_SECRET'] = JIRA_TEST_SECRET
     const originalFetch = globalThis.fetch
     globalThis.fetch = (async (input) => {
       const url =
@@ -381,7 +393,7 @@ describe('Jira webhook', () => {
         },
       })
 
-      const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+      const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
 
       expect(result.handled).toBe(true)
       expect(getCachedJiraTasks(db).find((task) => task.externalRef === 'ENG-600')?.column_id).toBe(
@@ -434,7 +446,7 @@ describe('Linear webhook', () => {
   test('Issue.create upserts the task', async () => {
     const db = new Database(':memory:')
     seedLinear(db)
-    delete process.env['LINEAR_WEBHOOK_SECRET']
+    process.env['LINEAR_WEBHOOK_SECRET'] = LINEAR_TEST_SECRET
     const provider = new LinearProvider(db, 'tid', 'key')
     const body = JSON.stringify({
       action: 'create',
@@ -454,7 +466,7 @@ describe('Linear webhook', () => {
         commentCount: 1,
       },
     })
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
     expect(result.handled).toBe(true)
     const tasks = getCachedLinearTasks(db)
     const issue = tasks.find((t) => t.externalRef === 'DX-1')
@@ -479,14 +491,14 @@ describe('Linear webhook', () => {
         updatedAt: '2025-01',
       },
     ])
-    delete process.env['LINEAR_WEBHOOK_SECRET']
+    process.env['LINEAR_WEBHOOK_SECRET'] = LINEAR_TEST_SECRET
     const provider = new LinearProvider(db, 'tid', 'key')
     const body = JSON.stringify({
       action: 'remove',
       type: 'Issue',
       data: { id: 'ix', identifier: 'DX-9' },
     })
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
     expect(result.handled).toBe(true)
     expect(getCachedLinearTasks(db).find((t) => t.externalRef === 'DX-9')).toBeUndefined()
   })
@@ -494,7 +506,7 @@ describe('Linear webhook', () => {
   test('ignores create/update events from another team', async () => {
     const db = new Database(':memory:')
     seedLinear(db)
-    delete process.env['LINEAR_WEBHOOK_SECRET']
+    process.env['LINEAR_WEBHOOK_SECRET'] = LINEAR_TEST_SECRET
     const provider = new LinearProvider(db, 'tid', 'key')
     const body = JSON.stringify({
       action: 'update',
@@ -510,7 +522,7 @@ describe('Linear webhook', () => {
       },
     })
 
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
 
     expect(result.handled).toBe(false)
     expect(result.message).toContain("Ignoring issue from team 'other-team'")
@@ -520,7 +532,7 @@ describe('Linear webhook', () => {
   test('falls back to issue-team lookup when the webhook payload omits team info', async () => {
     const db = new Database(':memory:')
     seedLinear(db)
-    delete process.env['LINEAR_WEBHOOK_SECRET']
+    process.env['LINEAR_WEBHOOK_SECRET'] = LINEAR_TEST_SECRET
     globalThis.fetch = (async (_input: string | URL | Request, init?: RequestInit) => {
       const body = JSON.parse(String(init?.body)) as {
         query: string
@@ -559,7 +571,7 @@ describe('Linear webhook', () => {
       },
     })
 
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
 
     expect(result.handled).toBe(false)
     expect(result.message).toContain("Ignoring issue from team 'OPS'")
@@ -583,7 +595,7 @@ describe('Linear webhook', () => {
         updatedAt: '2025-02-01T00:00:00.000Z',
       },
     ])
-    delete process.env['LINEAR_WEBHOOK_SECRET']
+    process.env['LINEAR_WEBHOOK_SECRET'] = LINEAR_TEST_SECRET
     const provider = new LinearProvider(db, 'tid', 'key')
     const body = JSON.stringify({
       action: 'update',
@@ -599,7 +611,7 @@ describe('Linear webhook', () => {
       },
     })
 
-    const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+    const result = await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
 
     expect(result.handled).toBe(true)
     expect(
@@ -610,7 +622,7 @@ describe('Linear webhook', () => {
   test('create event stamps lastWebhookAt without clobbering team/lastSyncAt', async () => {
     const db = new Database(':memory:')
     seedLinear(db)
-    delete process.env['LINEAR_WEBHOOK_SECRET']
+    process.env['LINEAR_WEBHOOK_SECRET'] = LINEAR_TEST_SECRET
     const provider = new LinearProvider(db, 'tid', 'key')
     const body = JSON.stringify({
       action: 'create',
@@ -626,7 +638,7 @@ describe('Linear webhook', () => {
       },
     })
     const before = Date.now()
-    await provider.handleWebhook({ headers: {}, rawBody: body })
+    await provider.handleWebhook({ headers: signedHeaders(body), rawBody: body })
     const meta = loadSyncMeta(db)
     expect(meta.lastWebhookAt).not.toBeNull()
     expect(new Date(meta.lastWebhookAt!).getTime()).toBeGreaterThanOrEqual(before)
@@ -677,3 +689,44 @@ describe('Linear webhook', () => {
     expect(result.unauthorized).toBe(true)
   })
 })
+
+describe('webhook fail-closed when secret is unset', () => {
+  test('Jira rejects unauthenticated webhooks when JIRA_WEBHOOK_SECRET is unset', async () => {
+    const prev = process.env['JIRA_WEBHOOK_SECRET']
+    delete process.env['JIRA_WEBHOOK_SECRET']
+    try {
+      const db = new Database(':memory:')
+      seedJira(db)
+      const client = new JiraClient({
+        baseUrl: jiraConfig.baseUrl,
+        email: jiraConfig.email,
+        apiToken: jiraConfig.apiToken,
+      })
+      const provider = new JiraProvider(db, jiraConfig, client)
+      const body = JSON.stringify({ webhookEvent: 'jira:issue_created', issue: { id: '1' } })
+      const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+      expect(result.handled).toBe(false)
+      expect(result.unauthorized).toBe(true)
+    } finally {
+      if (prev === undefined) delete process.env['JIRA_WEBHOOK_SECRET']
+      else process.env['JIRA_WEBHOOK_SECRET'] = prev
+    }
+  })
+
+  test('Linear rejects unauthenticated webhooks when LINEAR_WEBHOOK_SECRET is unset', async () => {
+    const prev = process.env['LINEAR_WEBHOOK_SECRET']
+    delete process.env['LINEAR_WEBHOOK_SECRET']
+    try {
+      const db = new Database(':memory:')
+      seedLinear(db)
+      const provider = new LinearProvider(db, 'tid', 'key')
+      const body = JSON.stringify({ action: 'create', type: 'Issue', data: { id: 'i1' } })
+      const result = await provider.handleWebhook({ headers: {}, rawBody: body })
+      expect(result.handled).toBe(false)
+      expect(result.unauthorized).toBe(true)
+    } finally {
+      if (prev === undefined) delete process.env['LINEAR_WEBHOOK_SECRET']
+      else process.env['LINEAR_WEBHOOK_SECRET'] = prev
+    }
+  })
+})