kanna-code 0.30.0 → 0.32.0

package/src/server/quick-response.test.ts

@@ -3,8 +3,56 @@ import { fallbackTitleFromMessage, generateTitleForChat, generateTitleForChatDet
 import { getQuickResponseWorkspace, QuickResponseAdapter } from "./quick-response"
 
 describe("QuickResponseAdapter", () => {
+  test("returns the SDK structured result when configured and it validates", async () => {
+    const adapter = new QuickResponseAdapter({
+      readLlmProvider: async () => ({
+        provider: "openai",
+        apiKey: "test-key",
+        model: "gpt-5-mini",
+        baseUrl: "",
+        resolvedBaseUrl: "https://api.openai.com/v1",
+        enabled: true,
+        warning: null,
+        filePathDisplay: "~/.kanna/llm-provider.json",
+      }),
+      runOpenAIStructured: async () => ({ title: "SDK title" }),
+      runClaudeStructured: async () => ({ title: "Claude title" }),
+      runCodexStructured: async () => ({ title: "Codex title" }),
+    })
+
+    const result = await adapter.generateStructured({
+      cwd: "/tmp/project",
+      task: "title generation",
+      prompt: "Generate a title",
+      schema: {
+        type: "object",
+        properties: {
+          title: { type: "string" },
+        },
+        required: ["title"],
+        additionalProperties: false,
+      },
+      parse: (value) => {
+        const output = value && typeof value === "object" ? value as { title?: unknown } : {}
+        return typeof output.title === "string" ? output.title : null
+      },
+    })
+
+    expect(result).toBe("SDK title")
+  })
+
   test("returns the Claude structured result when it validates", async () => {
     const adapter = new QuickResponseAdapter({
+      readLlmProvider: async () => ({
+        provider: "openai",
+        apiKey: "",
+        model: "",
+        baseUrl: "",
+        resolvedBaseUrl: "https://api.openai.com/v1",
+        enabled: false,
+        warning: null,
+        filePathDisplay: "~/.kanna/llm-provider.json",
+      }),
       runClaudeStructured: async () => ({ title: "Claude title" }),
       runCodexStructured: async () => ({ title: "Codex title" }),
     })
@@ -32,6 +80,16 @@ describe("QuickResponseAdapter", () => {
 
   test("falls back to Codex when Claude fails validation", async () => {
     const adapter = new QuickResponseAdapter({
+      readLlmProvider: async () => ({
+        provider: "openai",
+        apiKey: "",
+        model: "",
+        baseUrl: "",
+        resolvedBaseUrl: "https://api.openai.com/v1",
+        enabled: false,
+        warning: null,
+        filePathDisplay: "~/.kanna/llm-provider.json",
+      }),
       runClaudeStructured: async () => ({ bad: true }),
       runCodexStructured: async () => ({ title: "Codex title" }),
     })
@@ -59,6 +117,16 @@ describe("QuickResponseAdapter", () => {
 
   test("falls back to Codex when Claude throws", async () => {
     const adapter = new QuickResponseAdapter({
+      readLlmProvider: async () => ({
+        provider: "openai",
+        apiKey: "",
+        model: "",
+        baseUrl: "",
+        resolvedBaseUrl: "https://api.openai.com/v1",
+        enabled: false,
+        warning: null,
+        filePathDisplay: "~/.kanna/llm-provider.json",
+      }),
       runClaudeStructured: async () => {
         throw new Error("Not authenticated")
       },
@@ -93,6 +161,16 @@ describe("QuickResponseAdapter", () => {
     try {
       let claudeCwd = ""
       const adapter = new QuickResponseAdapter({
+        readLlmProvider: async () => ({
+          provider: "openai",
+          apiKey: "",
+          model: "",
+          baseUrl: "",
+          resolvedBaseUrl: "https://api.openai.com/v1",
+          enabled: false,
+          warning: null,
+          filePathDisplay: "~/.kanna-dev/llm-provider.json",
+        }),
         runClaudeStructured: async (args) => {
           claudeCwd = args.cwd
           return { title: "Claude title" }
@@ -131,6 +209,16 @@ describe("QuickResponseAdapter", () => {
   test("uses gpt-5.4-mini for Codex title generation fallback", async () => {
     const requests: Array<{ cwd: string; prompt: string; model?: string }> = []
     const adapter = new QuickResponseAdapter({
+      readLlmProvider: async () => ({
+        provider: "openai",
+        apiKey: "",
+        model: "",
+        baseUrl: "",
+        resolvedBaseUrl: "https://api.openai.com/v1",
+        enabled: false,
+        warning: null,
+        filePathDisplay: "~/.kanna/llm-provider.json",
+      }),
       codexManager: {
         async generateStructured(args: { cwd: string; prompt: string; model?: string }) {
           requests.push(args)
@@ -162,6 +250,48 @@ describe("QuickResponseAdapter", () => {
     expect(requests).toHaveLength(1)
     expect(requests[0]?.model).toBe("gpt-5.4-mini")
   })
+
+  test("falls through to Claude when the SDK is not configured", async () => {
+    let openAICalls = 0
+    const adapter = new QuickResponseAdapter({
+      readLlmProvider: async () => ({
+        provider: "openai",
+        apiKey: "",
+        model: "",
+        baseUrl: "",
+        resolvedBaseUrl: "https://api.openai.com/v1",
+        enabled: false,
+        warning: null,
+        filePathDisplay: "~/.kanna/llm-provider.json",
+      }),
+      runOpenAIStructured: async () => {
+        openAICalls += 1
+        return { title: "SDK title" }
+      },
+      runClaudeStructured: async () => ({ title: "Claude title" }),
+    })
+
+    const result = await adapter.generateStructured({
+      cwd: "/tmp/project",
+      task: "title generation",
+      prompt: "Generate a title",
+      schema: {
+        type: "object",
+        properties: {
+          title: { type: "string" },
+        },
+        required: ["title"],
+        additionalProperties: false,
+      },
+      parse: (value) => {
+        const output = value && typeof value === "object" ? value as { title?: unknown } : {}
+        return typeof output.title === "string" ? output.title : null
+      },
+    })
+
+    expect(result).toBe("Claude title")
+    expect(openAICalls).toBe(0)
+  })
 })
 
 describe("generateTitleForChat", () => {
@@ -170,6 +300,16 @@ describe("generateTitleForChat", () => {
       "hello",
       "/tmp/project",
       new QuickResponseAdapter({
+        readLlmProvider: async () => ({
+          provider: "openai",
+          apiKey: "",
+          model: "",
+          baseUrl: "",
+          resolvedBaseUrl: "https://api.openai.com/v1",
+          enabled: false,
+          warning: null,
+          filePathDisplay: "~/.kanna/llm-provider.json",
+        }),
         runClaudeStructured: async () => ({ title: "   Example\nTitle   " }),
       })
     )
@@ -182,6 +322,16 @@ describe("generateTitleForChat", () => {
       "hello",
       "/tmp/project",
       new QuickResponseAdapter({
+        readLlmProvider: async () => ({
+          provider: "openai",
+          apiKey: "",
+          model: "",
+          baseUrl: "",
+          resolvedBaseUrl: "https://api.openai.com/v1",
+          enabled: false,
+          warning: null,
+          filePathDisplay: "~/.kanna/llm-provider.json",
+        }),
         runClaudeStructured: async () => ({ title: "   " }),
         runCodexStructured: async () => ({ title: "New Chat" }),
       })
@@ -195,6 +345,16 @@ describe("generateTitleForChat", () => {
       "This message is definitely longer than thirty five characters",
       "/tmp/project",
       new QuickResponseAdapter({
+        readLlmProvider: async () => ({
+          provider: "openai",
+          apiKey: "",
+          model: "",
+          baseUrl: "",
+          resolvedBaseUrl: "https://api.openai.com/v1",
+          enabled: false,
+          warning: null,
+          filePathDisplay: "~/.kanna/llm-provider.json",
+        }),
         runClaudeStructured: async () => {
           throw new Error("Not authenticated")
         },
@@ -210,6 +370,16 @@ describe("generateTitleForChat", () => {
       "hello there",
       "/tmp/project",
       new QuickResponseAdapter({
+        readLlmProvider: async () => ({
+          provider: "openai",
+          apiKey: "",
+          model: "",
+          baseUrl: "",
+          resolvedBaseUrl: "https://api.openai.com/v1",
+          enabled: false,
+          warning: null,
+          filePathDisplay: "~/.kanna/llm-provider.json",
+        }),
         runClaudeStructured: async () => {
           throw new Error("Not authenticated")
         },
@@ -225,6 +395,38 @@ describe("generateTitleForChat", () => {
       failureMessage: "claude failed conversation title generation: Not authenticated; codex failed conversation title generation: Codex unavailable",
     })
   })
+
+  test("includes SDK failure details before Claude and Codex", async () => {
+    const result = await generateTitleForChatDetailed(
+      "hello there",
+      "/tmp/project",
+      new QuickResponseAdapter({
+        readLlmProvider: async () => ({
+          provider: "openai",
+          apiKey: "test-key",
+          model: "gpt-5-mini",
+          baseUrl: "",
+          resolvedBaseUrl: "https://api.openai.com/v1",
+          enabled: true,
+          warning: null,
+          filePathDisplay: "~/.kanna/llm-provider.json",
+        }),
+        runOpenAIStructured: async () => {
+          throw new Error("SDK unavailable")
+        },
+        runClaudeStructured: async () => {
+          throw new Error("Not authenticated")
+        },
+        runCodexStructured: async () => {
+          throw new Error("Codex unavailable")
+        },
+      })
+    )
+
+    expect(result.failureMessage).toBe(
+      "openai failed conversation title generation: SDK unavailable; claude failed conversation title generation: Not authenticated; codex failed conversation title generation: Codex unavailable"
+    )
+  })
 })
 
 describe("fallbackTitleFromMessage", () => {

package/src/server/quick-response.ts

@@ -1,7 +1,10 @@
 import { query } from "@anthropic-ai/claude-agent-sdk"
 import { homedir } from "node:os"
+import OpenAI from "openai"
 import { getDataRootDir } from "../shared/branding"
+import type { LlmProviderSnapshot } from "../shared/types"
 import { CodexAppServerManager } from "./codex-app-server"
+import { readLlmProviderSnapshot } from "./llm-provider"
 
 const CLAUDE_STRUCTURED_TIMEOUT_MS = 5_000
 
@@ -22,12 +25,17 @@ export interface StructuredQuickResponseArgs<T> {
 
 interface QuickResponseAdapterArgs {
   codexManager?: CodexAppServerManager
+  readLlmProvider?: () => Promise<LlmProviderSnapshot>
+  runOpenAIStructured?: (
+    config: LlmProviderSnapshot,
+    args: Omit<StructuredQuickResponseArgs<unknown>, "parse">
+  ) => Promise<unknown | null>
   runClaudeStructured?: (args: Omit<StructuredQuickResponseArgs<unknown>, "parse">) => Promise<unknown | null>
   runCodexStructured?: (args: Omit<StructuredQuickResponseArgs<unknown>, "parse">) => Promise<unknown | null>
 }
 
 export interface StructuredQuickResponseFailure {
-  provider: "claude" | "codex"
+  provider: "openai" | "claude" | "codex"
   reason: string
 }
 
@@ -133,6 +141,31 @@ export async function runClaudeStructured(args: Omit<StructuredQuickResponseArgs
   }
 }
 
+export async function runOpenAIStructured(
+  config: LlmProviderSnapshot,
+  args: Omit<StructuredQuickResponseArgs<unknown>, "parse">
+): Promise<unknown | null> {
+  const client = new OpenAI({
+    apiKey: config.apiKey,
+    baseURL: config.resolvedBaseUrl,
+  })
+
+  const response = await client.responses.create({
+    model: config.model,
+    input: args.prompt,
+    text: {
+      format: {
+        type: "json_schema",
+        name: "quick_response",
+        schema: args.schema,
+        strict: true,
+      },
+    },
+  })
+
+  return parseJsonText(response.output_text)
+}
+
 export async function runCodexStructured(
   codexManager: CodexAppServerManager,
   args: Omit<StructuredQuickResponseArgs<unknown>, "parse">
@@ -148,11 +181,18 @@ export async function runCodexStructured(
 
 export class QuickResponseAdapter {
   private readonly codexManager: CodexAppServerManager
+  private readonly readLlmProvider: () => Promise<LlmProviderSnapshot>
+  private readonly runOpenAIStructured: (
+    config: LlmProviderSnapshot,
+    args: Omit<StructuredQuickResponseArgs<unknown>, "parse">
+  ) => Promise<unknown | null>
   private readonly runClaudeStructured: (args: Omit<StructuredQuickResponseArgs<unknown>, "parse">) => Promise<unknown | null>
   private readonly runCodexStructured: (args: Omit<StructuredQuickResponseArgs<unknown>, "parse">) => Promise<unknown | null>
 
   constructor(args: QuickResponseAdapterArgs = {}) {
     this.codexManager = args.codexManager ?? new CodexAppServerManager()
+    this.readLlmProvider = args.readLlmProvider ?? (() => readLlmProviderSnapshot())
+    this.runOpenAIStructured = args.runOpenAIStructured ?? runOpenAIStructured
     this.runClaudeStructured = args.runClaudeStructured ?? runClaudeStructured
     this.runCodexStructured = args.runCodexStructured ?? ((structuredArgs) =>
       runCodexStructured(this.codexManager, structuredArgs))
@@ -171,6 +211,20 @@ export class QuickResponseAdapter {
     }
 
     const failures: StructuredQuickResponseFailure[] = []
+    const llmProvider = await this.readLlmProvider()
+    if (llmProvider.enabled) {
+      const openAIResult = await this.tryProvider("openai", args.task, args.parse, () => this.runOpenAIStructured(llmProvider, request))
+      if (openAIResult.value !== null) {
+        return {
+          value: openAIResult.value,
+          failures,
+        }
+      }
+      if (openAIResult.failure) {
+        failures.push(openAIResult.failure)
+      }
+    }
+
     const claudeResult = await this.tryProvider("claude", args.task, args.parse, () => this.runClaudeStructured(request))
     if (claudeResult.value !== null) {
       return {
@@ -200,7 +254,7 @@ export class QuickResponseAdapter {
   }
 
   private async tryProvider<T>(
-    provider: "claude" | "codex",
+    provider: "openai" | "claude" | "codex",
     task: string,
     parse: (value: unknown) => T | null,
     run: () => Promise<unknown | null>

package/src/server/read-models.test.ts

@@ -26,9 +26,12 @@ describe("read models", () => {
       lastTurnOutcome: null,
     })
 
-    const sidebar = deriveSidebarData(state, new Map())
+    const sidebar = deriveSidebarData(state, new Map(), 1_000_000)
     expect(sidebar.projectGroups[0]?.chats[0]?.provider).toBe("codex")
     expect(sidebar.projectGroups[0]?.chats[0]?.unread).toBe(true)
+    expect(sidebar.projectGroups[0]?.previewChats.map((chat) => chat.chatId)).toEqual(["chat-1"])
+    expect(sidebar.projectGroups[0]?.olderChats).toEqual([])
+    expect(sidebar.projectGroups[0]?.defaultCollapsed).toBe(false)
   })
 
   test("includes available providers in chat snapshots", () => {
@@ -171,4 +174,78 @@ describe("read models", () => {
     const sidebar = deriveSidebarData(state, new Map())
     expect(sidebar.projectGroups[0]?.chats.map((chat) => chat.chatId)).toEqual(["chat-new", "chat-old"])
   })
+
+  test("honors persisted project order before fallback updated-at ordering", () => {
+    const state = createEmptyState()
+    state.projectsById.set("project-1", {
+      id: "project-1",
+      localPath: "/tmp/project-1",
+      title: "One",
+      createdAt: 1,
+      updatedAt: 10,
+    })
+    state.projectsById.set("project-2", {
+      id: "project-2",
+      localPath: "/tmp/project-2",
+      title: "Two",
+      createdAt: 2,
+      updatedAt: 20,
+    })
+    state.projectsById.set("project-3", {
+      id: "project-3",
+      localPath: "/tmp/project-3",
+      title: "Three",
+      createdAt: 3,
+      updatedAt: 15,
+    })
+    state.sidebarProjectOrder = ["project-1"]
+
+    const sidebar = deriveSidebarData(state, new Map())
+
+    expect(sidebar.projectGroups.map((group) => group.groupKey)).toEqual(["project-1", "project-2", "project-3"])
+  })
+
+  test("builds preview and older chat slices using the current sidebar rules", () => {
+    const state = createEmptyState()
+    state.projectsById.set("project-1", {
+      id: "project-1",
+      localPath: "/tmp/project",
+      title: "Project",
+      createdAt: 1,
+      updatedAt: 1,
+    })
+    state.projectIdsByPath.set("/tmp/project", "project-1")
+    state.chatsById.set("chat-1", {
+      id: "chat-1",
+      projectId: "project-1",
+      title: "Recent",
+      createdAt: 10,
+      updatedAt: 10,
+      unread: false,
+      provider: "claude",
+      planMode: false,
+      sessionToken: null,
+      lastMessageAt: 1_000_000 - 60 * 60 * 1_000,
+      lastTurnOutcome: null,
+    })
+    state.chatsById.set("chat-2", {
+      id: "chat-2",
+      projectId: "project-1",
+      title: "Older",
+      createdAt: 20,
+      updatedAt: 20,
+      unread: false,
+      provider: "claude",
+      planMode: false,
+      sessionToken: null,
+      lastMessageAt: 1_000_000 - 26 * 60 * 60 * 1_000,
+      lastTurnOutcome: null,
+    })
+
+    const sidebar = deriveSidebarData(state, new Map(), 1_000_000)
+
+    expect(sidebar.projectGroups[0]?.previewChats.map((chat) => chat.chatId)).toEqual(["chat-1"])
+    expect(sidebar.projectGroups[0]?.olderChats.map((chat) => chat.chatId)).toEqual(["chat-2"])
+    expect(sidebar.projectGroups[0]?.defaultCollapsed).toBe(false)
+  })
 })

package/src/server/read-models.ts

@@ -11,6 +11,10 @@ import type { ChatRecord, StoreState } from "./events"
 import { resolveLocalPath } from "./paths"
 import { SERVER_PROVIDERS } from "./provider-catalog"
 
+const SIDEBAR_RECENT_WINDOW_MS = 24 * 60 * 60 * 1_000
+const SIDEBAR_RECENT_PREVIEW_LIMIT = 10
+const SIDEBAR_FALLBACK_PREVIEW_LIMIT = 5
+
 export function deriveStatus(chat: ChatRecord, activeStatus?: KannaStatus): KannaStatus {
   if (activeStatus) return activeStatus
   if (chat.lastTurnOutcome === "failed") return "failed"
@@ -21,17 +25,59 @@ function getSidebarChatSortTimestamp(chat: ChatRecord) {
   return chat.lastMessageAt ?? chat.createdAt
 }
 
+function getSidebarChatTimestamp(chat: Pick<SidebarChatRow, "lastMessageAt" | "_creationTime">) {
+  return chat.lastMessageAt ?? chat._creationTime
+}
+
+function isSidebarChatRecent(chat: Pick<SidebarChatRow, "lastMessageAt" | "_creationTime">, nowMs: number) {
+  return Math.max(0, nowMs - getSidebarChatTimestamp(chat)) < SIDEBAR_RECENT_WINDOW_MS
+}
+
+function getSidebarChatBuckets(chats: SidebarChatRow[], nowMs: number) {
+  const recentChats = chats.filter((chat) => isSidebarChatRecent(chat, nowMs))
+  const previewChats = recentChats.length > 0
+    ? recentChats.slice(0, SIDEBAR_RECENT_PREVIEW_LIMIT)
+    : chats.slice(0, Math.min(SIDEBAR_FALLBACK_PREVIEW_LIMIT, chats.length))
+  const previewChatIds = new Set(previewChats.map((chat) => chat.chatId))
+
+  return {
+    previewChats,
+    olderChats: chats.filter((chat) => !previewChatIds.has(chat.chatId)),
+  }
+}
+
 export function deriveSidebarData(
   state: StoreState,
-  activeStatuses: Map<string, KannaStatus>
+  activeStatuses: Map<string, KannaStatus>,
+  nowMs = Date.now()
 ): SidebarData {
-  const projects = [...state.projectsById.values()]
+  const chatsByProjectId = new Map<string, ChatRecord[]>()
+  for (const chat of state.chatsById.values()) {
+    if (chat.deletedAt) continue
+    const projectChats = chatsByProjectId.get(chat.projectId)
+    if (projectChats) {
+      projectChats.push(chat)
+      continue
+    }
+    chatsByProjectId.set(chat.projectId, [chat])
+  }
+
+  const allProjects = [...state.projectsById.values()]
     .filter((project) => !project.deletedAt)
+  const unorderedProjects = allProjects
     .sort((a, b) => b.updatedAt - a.updatedAt)
+  const projectById = new Map(unorderedProjects.map((project) => [project.id, project]))
+  const orderedProjects = state.sidebarProjectOrder
+    .map((projectId) => projectById.get(projectId))
+    .filter((project): project is NonNullable<typeof project> => Boolean(project))
+  const orderedProjectIds = new Set(orderedProjects.map((project) => project.id))
+  const projects = [
+    ...orderedProjects,
+    ...unorderedProjects.filter((project) => !orderedProjectIds.has(project.id)),
+  ]
 
   const projectGroups: SidebarProjectGroup[] = projects.map((project) => {
-    const chats: SidebarChatRow[] = [...state.chatsById.values()]
-      .filter((chat) => chat.projectId === project.id && !chat.deletedAt)
+    const chats = (chatsByProjectId.get(project.id) ?? [])
       .sort((a, b) => getSidebarChatSortTimestamp(b) - getSidebarChatSortTimestamp(a))
       .map((chat) => ({
         _id: chat.id,
@@ -45,11 +91,15 @@ export function deriveSidebarData(
         lastMessageAt: chat.lastMessageAt,
         hasAutomation: false,
       }))
+    const { previewChats, olderChats } = getSidebarChatBuckets(chats, nowMs)
 
     return {
       groupKey: project.id,
       localPath: project.localPath,
       chats,
+      previewChats,
+      olderChats,
+      defaultCollapsed: chats.every((chat) => !isSidebarChatRecent(chat, nowMs)),
     }
   })
 

package/src/server/server.ts

@@ -2,11 +2,13 @@ import path from "node:path"
 import { stat } from "node:fs/promises"
 import { APP_NAME, getRuntimeProfile } from "../shared/branding"
 import type { ChatAttachment } from "../shared/types"
+import { createAuthManager } from "./auth"
 import { EventStore } from "./event-store"
 import { AgentCoordinator } from "./agent"
 import { DiffStore } from "./diff-store"
 import { discoverProjects, type DiscoveredProject } from "./discovery"
 import { KeybindingsManager } from "./keybindings"
+import { readLlmProviderSnapshot, writeLlmProviderSnapshot } from "./llm-provider"
 import { getMachineDisplayName } from "./machine-name"
 import { TerminalManager } from "./terminal-manager"
 import { UpdateManager } from "./update-manager"
@@ -56,6 +58,7 @@ export async function persistUploadedFiles(args: {
 export interface StartKannaServerOptions {
   port?: number
   host?: string
+  password?: string | null
   strictPort?: boolean
   onMigrationProgress?: (message: string) => void
   update?: {
@@ -69,6 +72,7 @@ export async function startKannaServer(options: StartKannaServerOptions = {}) {
   const port = options.port ?? 3210
   const hostname = options.host ?? "127.0.0.1"
   const strictPort = options.strictPort ?? false
+  const auth = options.password ? createAuthManager(options.password) : null
   const store = new EventStore()
   const diffStore = new DiffStore(store.dataDir)
   const machineDisplayName = getMachineDisplayName()
@@ -117,6 +121,10 @@ export async function startKannaServer(options: StartKannaServerOptions = {}) {
     agent,
     terminals,
     keybindings,
+    llmProvider: {
+      read: readLlmProviderSnapshot,
+      write: writeLlmProviderSnapshot,
+    },
     refreshDiscovery,
     getDiscoveredProjects: () => discoveredProjects,
     machineDisplayName,
@@ -140,6 +148,45 @@ export async function startKannaServer(options: StartKannaServerOptions = {}) {
         async fetch(req, serverInstance) {
           const url = new URL(req.url)
 
+          if (url.pathname === "/auth/status") {
+            return auth
+              ? auth.handleStatus(req)
+              : Response.json({ enabled: false, authenticated: true })
+          }
+
+          if (url.pathname === "/auth/logout") {
+            if (req.method !== "POST") {
+              return new Response(null, { status: 405, headers: { Allow: "POST" } })
+            }
+
+            return auth
+              ? auth.handleLogout(req)
+              : Response.json({ ok: true })
+          }
+
+          if (auth) {
+            if (url.pathname === "/auth/login") {
+              if (req.method === "GET") {
+                return auth.renderLoginPage(req)
+              }
+              if (req.method === "POST") {
+                return auth.handleLogin(req, "/")
+              }
+              return new Response(null, { status: 405, headers: { Allow: "GET, POST" } })
+            }
+
+            if (url.pathname === "/ws") {
+              if (!auth.validateOrigin(req)) {
+                return new Response("Forbidden", { status: 403 })
+              }
+              if (!auth.isAuthenticated(req)) {
+                return new Response("Unauthorized", { status: 401 })
+              }
+            } else if (!auth.isAuthenticated(req)) {
+              return auth.unauthorizedResponse(req)
+            }
+          }
+
           if (url.pathname === "/ws") {
             const upgraded = serverInstance.upgrade(req, {
               data: {