@andypai/agent-kanban 0.6.0 → 0.6.2

package/src/providers/postgres-local.ts

@@ -1,7 +1,8 @@
-import type { Sql } from 'postgres'
+import type { Sql, TransactionSql } from 'postgres'
 
 import { ErrorCode, KanbanError } from '../errors'
 import { generateId } from '../id'
+import { selectDoneColumnIds, selectInProgressColumnIds } from '../column-roles'
 import type {
   ActivityEntry,
   BoardBootstrap,
@@ -26,6 +27,10 @@ import type {
 import type { LocalTrackerConfig } from '../tracker-config'
 import { normalizeLabels, parseStoredLabels } from '../labels'
 
+// Accepts either the root connection or a scoped transaction handle so the
+// mutation helpers can run inside or outside a `sql.begin(...)` block.
+type Exec = Sql | TransactionSql
+
 const DEFAULT_COLUMNS = [
   { name: 'recurring', position: 0 },
   { name: 'backlog', position: 1 },
@@ -269,8 +274,9 @@ export class PostgresLocalProvider implements KanbanProvider {
     fieldChanged: string | null,
     oldValue: string | null,
     newValue: string | null,
+    exec: Exec = this.sql,
   ): Promise<void> {
-    await this.sql`
+    await exec`
       INSERT INTO activity_log (id, task_id, action, field_changed, old_value, new_value, timestamp)
       VALUES (${generateId('a')}, ${taskId}, ${action}, ${fieldChanged}, ${oldValue}, ${newValue}, ${nowIso()})
     `
@@ -360,23 +366,26 @@ export class PostgresLocalProvider implements KanbanProvider {
     const column = input.column
       ? await this.resolveColumn(input.column)
       : await this.resolveDefaultTaskColumn()
-    const [positionRow] = await this.sql<{ next: string | number }[]>`
-      SELECT COALESCE(MAX(position), -1) + 1 AS next FROM tasks WHERE column_id = ${column.id}
-    `
     const id = generateId('t')
     const timestamp = nowIso()
-    await this.sql`
-      INSERT INTO tasks (
-        id, title, description, column_id, position, priority, assignee, project, labels, metadata,
-        revision, created_at, updated_at
-      )
-      VALUES (
-        ${id}, ${input.title}, ${input.description ?? ''}, ${column.id}, ${Number(positionRow?.next ?? 0)},
-        ${priority}, ${input.assignee ?? ''}, ${input.project ?? ''}, ${JSON.stringify(labels)}, ${metadata},
-        0, ${timestamp}, ${timestamp}
-      )
-    `
-    await this.insertActivity(id, 'created', null, null, input.title)
+    await this.sql.begin(async (tx) => {
+      const [positionRow] = await tx<{ next: string | number }[]>`
+        SELECT COALESCE(MAX(position), -1) + 1 AS next FROM tasks WHERE column_id = ${column.id}
+      `
+      await tx`
+        INSERT INTO tasks (
+          id, title, description, column_id, position, priority, assignee, project, labels, metadata,
+          revision, created_at, updated_at
+        )
+        VALUES (
+          ${id}, ${input.title}, ${input.description ?? ''}, ${column.id}, ${Number(positionRow?.next ?? 0)},
+          ${priority}, ${input.assignee ?? ''}, ${input.project ?? ''}, ${JSON.stringify(labels)}, ${metadata},
+          0, ${timestamp}, ${timestamp}
+        )
+      `
+      await this.insertActivity(id, 'created', null, null, input.title, tx)
+      await this.enterColumn(id, column.id, tx)
+    })
     return this.getTask(id)
   }
 
@@ -403,39 +412,43 @@ export class PostgresLocalProvider implements KanbanProvider {
       project: input.project ?? current.project,
       metadata: metadata ?? current.metadata,
     }
-    await this.sql`
-      UPDATE tasks
-      SET title = ${next.title},
-          description = ${next.description},
-          priority = ${next.priority},
-          assignee = ${next.assignee},
-          project = ${next.project},
-          metadata = ${next.metadata},
-          revision = revision + 1,
-          updated_at = ${nowIso()}
-      WHERE id = ${current.id}
-    `
-    if (input.title !== undefined && input.title !== current.title) {
-      await this.insertActivity(current.id, 'updated', 'title', current.title, input.title)
-    }
-    if (input.assignee !== undefined && input.assignee !== current.assignee) {
-      await this.insertActivity(
-        current.id,
-        'assigned',
-        'assignee',
-        current.assignee,
-        input.assignee,
-      )
-    }
-    if (input.priority !== undefined && input.priority !== current.priority) {
-      await this.insertActivity(
-        current.id,
-        'prioritized',
-        'priority',
-        current.priority,
-        input.priority,
-      )
-    }
+    await this.sql.begin(async (tx) => {
+      await tx`
+        UPDATE tasks
+        SET title = ${next.title},
+            description = ${next.description},
+            priority = ${next.priority},
+            assignee = ${next.assignee},
+            project = ${next.project},
+            metadata = ${next.metadata},
+            revision = revision + 1,
+            updated_at = ${nowIso()}
+        WHERE id = ${current.id}
+      `
+      if (input.title !== undefined && input.title !== current.title) {
+        await this.insertActivity(current.id, 'updated', 'title', current.title, input.title, tx)
+      }
+      if (input.assignee !== undefined && input.assignee !== current.assignee) {
+        await this.insertActivity(
+          current.id,
+          'assigned',
+          'assignee',
+          current.assignee,
+          input.assignee,
+          tx,
+        )
+      }
+      if (input.priority !== undefined && input.priority !== current.priority) {
+        await this.insertActivity(
+          current.id,
+          'prioritized',
+          'priority',
+          current.priority,
+          input.priority,
+          tx,
+        )
+      }
+    })
     return this.getTask(current.id)
   }
 
@@ -443,23 +456,48 @@ export class PostgresLocalProvider implements KanbanProvider {
     await this.ready
     const current = await this.requireTask(idOrRef)
     const column = await this.resolveColumn(columnName)
-    const oldColumn = current.column_name ?? current.column_id
-    await this.sql`
-      UPDATE tasks
-      SET column_id = ${column.id},
-          revision = revision + 1,
-          updated_at = ${nowIso()}
-      WHERE id = ${current.id}
-    `
-    await this.insertActivity(current.id, 'moved', 'column', oldColumn, column.name)
+    const oldColumnId = current.column_id
+
+    // No-op move to the same column: skip the write so we don't fragment
+    // column-time tracking (spurious exit/enter) or re-append the task.
+    if (column.id === oldColumnId) return this.getTask(current.id)
+
+    await this.sql.begin(async (tx) => {
+      const [posRow] = await tx<{ next: string | number }[]>`
+        SELECT COALESCE(MAX(position), -1) + 1 AS next FROM tasks WHERE column_id = ${column.id}
+      `
+      await tx`
+        UPDATE tasks
+        SET column_id = ${column.id},
+            position = ${Number(posRow?.next ?? 0)},
+            revision = revision + 1,
+            updated_at = ${nowIso()}
+        WHERE id = ${current.id}
+      `
+      await this.renumberColumn(oldColumnId, tx)
+      await this.exitColumn(current.id, oldColumnId, tx)
+      await this.enterColumn(current.id, column.id, tx)
+      await this.insertActivity(
+        current.id,
+        'moved',
+        'column',
+        current.column_name ?? oldColumnId,
+        column.name,
+        tx,
+      )
+    })
     return this.getTask(current.id)
   }
 
   async deleteTask(idOrRef: string): Promise<Task> {
     await this.ready
     const task = await this.getTask(idOrRef)
-    await this.sql`DELETE FROM tasks WHERE id = ${task.id}`
-    await this.insertActivity(task.id, 'deleted', null, task.title, null)
+    await this.sql.begin(async (tx) => {
+      await this.exitColumn(task.id, task.column_id, tx)
+      await this.insertActivity(task.id, 'deleted', null, task.title, null, tx)
+      await tx`DELETE FROM tasks WHERE id = ${task.id}`
+      await this.renumberColumn(task.column_id, tx)
+    })
     return task
   }
 
@@ -529,14 +567,20 @@ export class PostgresLocalProvider implements KanbanProvider {
     const [total] = await this.sql<
       { count: string | number }[]
     >`SELECT COUNT(*) AS count FROM tasks`
-    const [doneColumn] = await this.sql<{ id: string }[]>`
-      SELECT id FROM columns WHERE LOWER(name) = 'done' LIMIT 1
+    // Classify columns by role (custom names / KANBAN_DEFAULT_COLUMNS) instead of
+    // matching the literal 'done' / 'in-progress'. Kept in lockstep with the
+    // SQLite copy in metrics.ts:getBoardMetrics.
+    const columns = await this.sql<{ id: string; name: string; position: number }[]>`
+      SELECT id, name, position FROM columns ORDER BY position
     `
-    const [completed] = doneColumn
-      ? await this.sql<{ count: string | number }[]>`
-          SELECT COUNT(*) AS count FROM tasks WHERE column_id = ${doneColumn.id}
+    const doneColumnIds = selectDoneColumnIds(columns)
+    const inProgressColumnIds = selectInProgressColumnIds(columns)
+    const [completed] =
+      doneColumnIds.length > 0
+        ? await this.sql<{ count: string | number }[]>`
+          SELECT COUNT(*) AS count FROM tasks WHERE column_id IN ${this.sql(doneColumnIds)}
         `
-      : [{ count: 0 }]
+        : [{ count: 0 }]
     const tasksByColumn = await this.sql<{ column_name: string; count: string | number }[]>`
       SELECT columns.name AS column_name, COUNT(tasks.id) AS count
       FROM columns
@@ -551,6 +595,39 @@ export class PostgresLocalProvider implements KanbanProvider {
     const projects = await this.discoveredProjects()
     const totalTasks = Number(total?.count ?? 0)
     const completedTasks = Number(completed?.count ?? 0)
+    // Average completion time = first tracked entry (creation) -> first time the
+    // task entered Done. Using the Done *entry* (not exit) counts tasks resting
+    // in Done; MIN() handles tasks that re-enter Done. Cast to timestamptz so the
+    // ISO-UTC strings compare correctly regardless of the server timezone. Kept
+    // in lockstep with the SQLite copy in metrics.ts:getBoardMetrics.
+    const [avgResult] =
+      doneColumnIds.length > 0
+        ? await this.sql<{ avg_hours: string | number | null }[]>`
+      SELECT AVG(
+        EXTRACT(EPOCH FROM (done_enter.entered_at - first_enter.entered_at)) / 3600
+      ) AS avg_hours
+      FROM (
+        SELECT ct.task_id, MIN(ct.entered_at::timestamptz) AS entered_at
+        FROM column_time_tracking ct
+        WHERE ct.column_id IN ${this.sql(doneColumnIds)}
+        GROUP BY ct.task_id
+      ) done_enter
+      JOIN (
+        SELECT task_id, MIN(entered_at::timestamptz) AS entered_at
+        FROM column_time_tracking GROUP BY task_id
+      ) first_enter ON first_enter.task_id = done_enter.task_id
+    `
+        : [{ avg_hours: null }]
+    const [weekCount] = await this.sql<{ count: string | number }[]>`
+      SELECT COUNT(*) AS count FROM tasks
+      WHERE created_at::timestamptz >= NOW() - INTERVAL '7 days'
+    `
+    const inProgressNames = new Set(
+      columns.filter((c) => inProgressColumnIds.includes(c.id)).map((c) => c.name),
+    )
+    const inProgressCount = tasksByColumn
+      .filter((row) => inProgressNames.has(row.column_name))
+      .reduce((sum, row) => sum + Number(row.count), 0)
     return {
       tasksByColumn: tasksByColumn.map((row) => ({
         column_name: row.column_name,
@@ -562,13 +639,10 @@ export class PostgresLocalProvider implements KanbanProvider {
       })),
       totalTasks,
       completedTasks,
-      avgCompletionHours: null,
-      recentActivity: await this.getActivity(10),
-      tasksCreatedThisWeek: 0,
-      inProgressCount:
-        tasksByColumn.find((row) => row.column_name === 'in-progress')?.count === undefined
-          ? 0
-          : Number(tasksByColumn.find((row) => row.column_name === 'in-progress')!.count),
+      avgCompletionHours: avgResult?.avg_hours != null ? Number(avgResult.avg_hours) : null,
+      recentActivity: await this.getActivity(20),
+      tasksCreatedThisWeek: Number(weekCount?.count ?? 0),
+      inProgressCount,
       completionPercent: totalTasks === 0 ? 0 : Math.round((completedTasks / totalTasks) * 100),
       assignees,
       projects,
@@ -589,6 +663,39 @@ export class PostgresLocalProvider implements KanbanProvider {
     return rows.map((row) => row.project)
   }
 
+  private async enterColumn(
+    taskId: string,
+    columnId: string,
+    exec: Exec = this.sql,
+  ): Promise<void> {
+    const id = generateId('ct')
+    await exec`
+      INSERT INTO column_time_tracking (id, task_id, column_id, entered_at)
+      VALUES (${id}, ${taskId}, ${columnId}, ${nowIso()})
+    `
+  }
+
+  private async exitColumn(taskId: string, columnId: string, exec: Exec = this.sql): Promise<void> {
+    await exec`
+      UPDATE column_time_tracking
+      SET exited_at = ${nowIso()}
+      WHERE task_id = ${taskId} AND column_id = ${columnId} AND exited_at IS NULL
+    `
+  }
+
+  // Compact positions to a contiguous 0..n-1 sequence in a single statement.
+  private async renumberColumn(columnId: string, exec: Exec = this.sql): Promise<void> {
+    await exec`
+      UPDATE tasks t
+      SET position = s.rn
+      FROM (
+        SELECT id, ROW_NUMBER() OVER (ORDER BY position, created_at, id) - 1 AS rn
+        FROM tasks WHERE column_id = ${columnId}
+      ) s
+      WHERE t.id = s.id AND t.position <> s.rn
+    `
+  }
+
   async getConfig(): Promise<BoardConfig> {
     await this.ready
     return {

package/src/providers/types.ts

@@ -55,28 +55,97 @@ export interface ProviderSyncStatus {
   lastWebhookAt: string | null
 }
 
-export interface KanbanProvider {
+/**
+ * The provider contract is composed from small, cohesive capability interfaces
+ * rather than one monolithic type. `KanbanProvider` is their intersection, so
+ * every existing consumer keeps the same surface; the split exists to document
+ * which operations belong together and to let internal code depend on just the
+ * capability it needs.
+ *
+ * Note on "unsupported" operations: providers that cannot perform a given
+ * operation (e.g. Jira/Linear `deleteTask`, `getMetrics`, `patchConfig`) still
+ * implement the method but throw `UNSUPPORTED_OPERATION` at runtime, and the
+ * UI hides those affordances via `ProviderCapabilities`. These members are
+ * therefore required on the contract — only the cache/webhook members below,
+ * which a provider may genuinely not have, are optional.
+ */
+
+/** Provider self-identification. */
+export interface ProviderIdentity {
   readonly type: 'local' | 'linear' | 'jira'
+}
 
+/** Board/context/config reads that materialize the current board view. */
+export interface BoardReader {
   getContext(): Promise<ProviderContext>
   getBootstrap(): Promise<BoardBootstrap>
   getBoard(): Promise<BoardView>
   listColumns(): Promise<Column[]>
+  getConfig(): Promise<BoardConfig>
+}
+
+/** Task reads. */
+export interface TaskReader {
   listTasks(filters?: TaskListFilters): Promise<Task[]>
   getTask(idOrRef: string): Promise<Task>
+}
+
+/** Task mutations. */
+export interface TaskWriter {
   createTask(input: CreateTaskInput): Promise<Task>
   updateTask(idOrRef: string, input: UpdateTaskInput): Promise<Task>
   moveTask(idOrRef: string, column: string): Promise<Task>
   deleteTask(idOrRef: string): Promise<Task>
+}
+
+/** Comment reads and writes. */
+export interface CommentCapability {
   listComments(idOrRef: string): Promise<TaskComment[]>
   getComment(idOrRef: string, commentId: string): Promise<TaskComment>
   comment(idOrRef: string, body: string): Promise<TaskComment>
   updateComment(idOrRef: string, commentId: string, body: string): Promise<TaskComment>
+}
+
+/** Activity-feed reads. */
+export interface ActivityReader {
   getActivity(limit?: number, taskId?: string): Promise<ActivityEntry[]>
+}
+
+/** Board-metrics reads. */
+export interface MetricsReader {
   getMetrics(): Promise<BoardMetrics>
-  getConfig(): Promise<BoardConfig>
+}
+
+/** Board-config mutations. */
+export interface ConfigWriter {
   patchConfig(input: Partial<BoardConfig>): Promise<BoardConfig>
+}
+
+/**
+ * Optional cache-management hooks used by the server's background warmer. Only
+ * providers backed by a cache (Linear/Jira) implement these; the local
+ * provider omits them and the server guards every call.
+ */
+export interface CacheManaged {
   syncCache?(): Promise<void>
+  // Signals that a background warmer owns cache refresh (server mode), so the
+  // provider may serve reads from the warm cache without a blocking foreground sync.
+  setBackgroundManaged?(managed: boolean): void
   getSyncStatus?(): Promise<ProviderSyncStatus | null>
+}
+
+/** Optional inbound-webhook handling (Linear/Jira only). */
+export interface WebhookReceiver {
   handleWebhook?(payload: WebhookRequest): Promise<WebhookResult>
 }
+
+export type KanbanProvider = ProviderIdentity &
+  BoardReader &
+  TaskReader &
+  TaskWriter &
+  CommentCapability &
+  ActivityReader &
+  MetricsReader &
+  ConfigWriter &
+  CacheManaged &
+  WebhookReceiver

package/src/server.ts

@@ -1,15 +1,30 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
+import { Buffer } from 'node:buffer'
+import { timingSafeEqual } from 'node:crypto'
 import { handleRequest } from './api'
 import type { ServerWebSocket } from 'bun'
 import type { KanbanProvider } from './providers/types'
 import { DEFAULT_POLLING_SYNC_INTERVAL_MS } from './sync-config'
 
-const wsClients = new Set<ServerWebSocket<unknown>>()
-const CORS_HEADERS = {
-  'Access-Control-Allow-Origin': '*',
-  'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, OPTIONS',
-  'Access-Control-Allow-Headers': 'Content-Type',
+// CORS is origin hygiene for cross-origin browser clients, never an auth control.
+// When no allowed origin is configured we emit no CORS headers (same-origin only),
+// which covers the bundled UI (served from this server) and the vite dev proxy.
+function buildCorsHeaders(allowedOrigin?: string): Record<string, string> {
+  if (!allowedOrigin) return {}
+  return {
+    'Access-Control-Allow-Origin': allowedOrigin,
+    'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    Vary: 'Origin',
+  }
+}
+
+function safeEqual(a: string, b: string): boolean {
+  const aBuf = Buffer.from(a)
+  const bBuf = Buffer.from(b)
+  if (aBuf.length !== bBuf.length) return false
+  return timingSafeEqual(aBuf, bBuf)
 }
 interface BackgroundSyncState {
   enabled: boolean
@@ -22,6 +37,16 @@ interface BackgroundSyncState {
 
 export interface StartServerOptions {
   syncIntervalMs?: number
+  /**
+   * When set, all `/api/*` routes (reads and mutations) and the `/ws` upgrade
+   * require `Authorization: Bearer <token>` (or `?token=` for the WebSocket,
+   * which cannot send headers). `/api/health` and `/api/webhooks/*` are exempt:
+   * health is a liveness probe and webhooks authenticate with the provider
+   * webhook secret instead. When unset, the API is open (localhost default).
+   */
+  authToken?: string
+  /** Allowed CORS origin; when unset, no CORS headers are emitted (same-origin). */
+  allowedOrigin?: string
 }
 
 export interface StartedServer {
@@ -29,22 +54,15 @@ export interface StartedServer {
   stop(closeActiveConnections?: boolean): void
 }
 
-function broadcast(data: unknown): void {
-  const msg = JSON.stringify(data)
-  for (const ws of wsClients) {
-    ws.send(msg)
-  }
-}
-
-function applyCorsHeaders(response: Response): void {
-  for (const [header, value] of Object.entries(CORS_HEADERS)) {
+function applyCorsHeaders(response: Response, corsHeaders: Record<string, string>): void {
+  for (const [header, value] of Object.entries(corsHeaders)) {
     response.headers.set(header, value)
   }
 }
 
-function jsonWithCors(body: unknown, status = 200): Response {
+function jsonWithCors(body: unknown, corsHeaders: Record<string, string>, status = 200): Response {
   const response = Response.json(body, { status })
-  applyCorsHeaders(response)
+  applyCorsHeaders(response, corsHeaders)
   return response
 }
 
@@ -66,6 +84,48 @@ export function startServer(
   const syncIntervalMs = opts.syncIntervalMs ?? DEFAULT_POLLING_SYNC_INTERVAL_MS
   const syncCache = provider.syncCache?.bind(provider)
   const getSyncStatus = provider.getSyncStatus?.bind(provider)
+  const corsHeaders = buildCorsHeaders(opts.allowedOrigin)
+  const authToken = opts.authToken
+
+  // Per-instance so multiple servers (e.g. in tests) don't share or cross-broadcast
+  // to each other's sockets.
+  const wsClients = new Set<ServerWebSocket<unknown>>()
+  const broadcast = (data: unknown): void => {
+    const msg = JSON.stringify(data)
+    for (const ws of wsClients) {
+      // A dead/closing socket must not abort the fan-out to the rest.
+      try {
+        ws.send(msg)
+      } catch {
+        wsClients.delete(ws)
+      }
+    }
+  }
+
+  const isAuthorized = (req: Request, url: URL, allowQueryToken: boolean): boolean => {
+    if (!authToken) return true
+    const header = req.headers.get('authorization')
+    // The `?token=` fallback exists only for the WebSocket handshake, which can't
+    // carry an Authorization header. HTTP API routes require the header so tokens
+    // don't end up in URLs, logs, or referrers.
+    const provided = header?.startsWith('Bearer ')
+      ? header.slice('Bearer '.length)
+      : allowQueryToken
+        ? url.searchParams.get('token')
+        : null
+    return provided ? safeEqual(provided, authToken) : false
+  }
+
+  // Health is a public liveness probe; webhooks authenticate with the provider
+  // webhook secret, not this token. Everything else under /api plus /ws is gated.
+  const pathRequiresAuth = (pathname: string): boolean => {
+    if (!authToken) return false
+    if (pathname === '/ws') return true
+    if (pathname === '/api/health') return false
+    if (pathname.startsWith('/api/webhooks/')) return false
+    return pathname.startsWith('/api/')
+  }
+
   const backgroundSync: BackgroundSyncState = {
     enabled: typeof syncCache === 'function',
     inFlight: false,
@@ -103,6 +163,9 @@ export function startServer(
   }
 
   if (syncCache) {
+    // The background warmer owns cache refresh; let the provider serve reads from
+    // the warm cache instead of blocking each request on a provider network sync.
+    provider.setBackgroundManaged?.(true)
     void runBackgroundSync('startup').finally(() => {
       scheduleBackgroundSync()
     })
@@ -110,6 +173,11 @@ export function startServer(
 
   const server = Bun.serve({
     port,
+    // Default is 10s; a cold-start provider sync (e.g. a Jira full reconcile) can
+    // exceed that and Bun would otherwise close the connection mid-flight, surfacing
+    // as ERR_EMPTY_RESPONSE. Steady-state reads are served from the warm cache and
+    // return well under this ceiling; this is just a safety net for slow cold starts.
+    idleTimeout: 255,
     websocket: {
       open(ws) {
         wsClients.add(ws)
@@ -129,7 +197,17 @@ export function startServer(
 
       // Handle OPTIONS preflight first (before /api routing)
       if (req.method === 'OPTIONS') {
-        return new Response(null, { headers: CORS_HEADERS })
+        return new Response(null, { headers: corsHeaders })
+      }
+
+      // Auth gate: protect all /api/* and /ws except the public health probe and
+      // webhook routes (which authenticate with the provider webhook secret).
+      if (pathRequiresAuth(pathname) && !isAuthorized(req, url, pathname === '/ws')) {
+        return jsonWithCors(
+          { ok: false, error: { code: 'UNAUTHORIZED', message: 'Missing or invalid API token' } },
+          corsHeaders,
+          401,
+        )
       }
 
       // WebSocket upgrade
@@ -140,10 +218,13 @@ export function startServer(
       }
 
       if (pathname === '/api/health') {
-        return jsonWithCors({
-          ok: true,
-          data: { status: 'running', wsClients: wsClients.size, provider: provider.type },
-        })
+        return jsonWithCors(
+          {
+            ok: true,
+            data: { status: 'running', wsClients: wsClients.size, provider: provider.type },
+          },
+          corsHeaders,
+        )
       }
 
       if (pathname === '/api/ready') {
@@ -157,22 +238,26 @@ export function startServer(
               backgroundSync,
             },
           },
+          corsHeaders,
           ready ? 200 : 503,
         )
       }
 
       if (pathname === '/api/sync-status') {
         const providerSync = (await getSyncStatus?.()) ?? null
-        return jsonWithCors({
-          ok: true,
-          data: {
-            status: 'running',
-            provider: provider.type,
-            wsClients: wsClients.size,
-            backgroundSync,
-            providerSync,
+        return jsonWithCors(
+          {
+            ok: true,
+            data: {
+              status: 'running',
+              provider: provider.type,
+              wsClients: wsClients.size,
+              backgroundSync,
+              providerSync,
+            },
           },
-        })
+          corsHeaders,
+        )
       }
 
       if (pathname.startsWith('/api/')) {
@@ -180,7 +265,7 @@ export function startServer(
         forwardedUrl.pathname = pathname
         const forwardedReq = new Request(forwardedUrl.toString(), req)
         const result = await handleRequest(provider, forwardedReq)
-        applyCorsHeaders(result.response)
+        applyCorsHeaders(result.response, corsHeaders)
         if (result.mutated && result.response.ok) {
           broadcast(result.event ?? { type: 'refresh' })
         }
@@ -212,7 +297,8 @@ export function startServer(
         clearTimeout(syncTimer)
         syncTimer = null
       }
-      server.stop(closeActiveConnections)
+      wsClients.clear()
+      void server.stop(closeActiveConnections)
     },
   }
 }