fix(server): apply cors before legacy auth (#26092)

packages/opencode/src/server/server.ts

@@ -107,10 +107,10 @@ function createHono(opts: CorsOptions, selection: ServerBackend.Selection = Serv
   const backendAttributes = ServerBackend.attributes(selection)
   const app = new Hono()
     .onError(ErrorMiddleware)
-    .use(AuthMiddleware)
-    .use(LoggerMiddleware(backendAttributes))
-    .use(CompressionMiddleware)
     .use(CorsMiddleware(opts))
+    .use(LoggerMiddleware(backendAttributes))
+    .use(AuthMiddleware)
+    .use(CompressionMiddleware)
     .route("/global", GlobalRoutes())
 
   const runtime = adapter.create(app)

packages/opencode/test/server/httpapi-cors.test.ts

@@ -63,6 +63,19 @@ describe("HttpApi CORS", () => {
     }),
   )
 
+  it.live("adds CORS headers to legacy unauthorized responses", () =>
+    Effect.gen(function* () {
+      const response = yield* Effect.promise(async () =>
+        Server.Legacy().app.request("/global/config", {
+          headers: { origin: "https://app.opencode.ai" },
+        }),
+      )
+
+      expect(response.status).toBe(401)
+      expect(response.headers.get("access-control-allow-origin")).toBe("https://app.opencode.ai")
+    }),
+  )
+
   it.live("uses custom CORS origins passed to the server", () =>
     Effect.gen(function* () {
       const listener = yield* Effect.acquireRelease(