From 1833134559643c528e2a438cd6fdc5895b8019b1 Mon Sep 17 00:00:00 2001
From: Peter Wielander <mittgfu@gmail.com>
Date: Tue, 16 Dec 2025 13:36:22 +0100
Subject: [PATCH] [runtime] Add CORS headers and request handling to health
 check check response

---
 .changeset/twenty-parents-type.md |  5 +++++
 packages/core/src/runtime.ts      | 27 ++++++++++++++++++++++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/twenty-parents-type.md

diff --git a/.changeset/twenty-parents-type.md b/.changeset/twenty-parents-type.md
new file mode 100644
index 0000000000..d30babda94
--- /dev/null
+++ b/.changeset/twenty-parents-type.md
@@ -0,0 +1,5 @@
+---
+"@workflow/core": patch
+---
+
+Add CORS headers to endpoints health check response
diff --git a/packages/core/src/runtime.ts b/packages/core/src/runtime.ts
index f235bb182d..e0825ddb84 100644
--- a/packages/core/src/runtime.ts
+++ b/packages/core/src/runtime.ts
@@ -263,6 +263,16 @@ async function getAllWorkflowRunEvents(runId: string): Promise<Event[]> {
   return allEvents;
 }
 
+/**
+ * CORS headers for health check responses.
+ * Allows the observability UI to check endpoint health from a different origin.
+ */
+const HEALTH_CHECK_CORS_HEADERS = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'POST, OPTIONS',
+  'Access-Control-Allow-Headers': 'Content-Type',
+};
+
 /**
  * Wraps a request/response handler and adds a health check "mode"
  * based on the presence of a `__health` query parameter.
@@ -273,10 +283,25 @@ function withHealthCheck(
   return async (req) => {
     const url = new URL(req.url);
     const isHealthCheck = url.searchParams.has('__health');
+
     if (isHealthCheck) {
+      // Handle CORS preflight for health check
+      if (req.method === 'OPTIONS') {
+        return new Response(null, {
+          status: 204,
+          headers: HEALTH_CHECK_CORS_HEADERS,
+        });
+      }
+
       return new Response(
         `Workflow DevKit "${url.pathname}" endpoint is healthy`,
-        { status: 200, headers: { 'Content-Type': 'text/plain' } }
+        {
+          status: 200,
+          headers: {
+            'Content-Type': 'text/plain',
+            ...HEALTH_CHECK_CORS_HEADERS,
+          },
+        }
       );
     }
     return await handler(req);