[varun-pahuja]

What does this change?

Adds startup security checks for session secrets and allowed origins as a new module `packages/server/src/security/startup-checks.ts`. Reports errors for: secrets < 32 bytes (UTF-8), secrets that match public env vars (NEXT_PUBLIC_, VITE_, PUBLIC_, NUXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_), origins not starting with http(s)://, origins with path/query/trailing slash, and `*` combined with other origins. Warns for: duplicate secrets, http:// origins not localhost/127.0.0.1. Not exported from `@chatcops/server` yet (will be called by handler in follow-up).

Closes #231

How I tested this

• `pnpm -r typecheck` — passes
• `pnpm test` — 575 passed, 10 skipped (Node 22, happy-dom works)
• `pnpm test:coverage` — passes thresholds (server/src/** ≥ 90% lines, 85% branches)
• `pnpm lint` — passes (pre-existing warnings only)
• Unit tests: one test per rule (7 rules), clean config returns [], secret-never-in-message test, UTF-8 byte counting, all public prefixes covered

AI assistance

Claude Code — wrote the implementation, tests, and changeset. I reviewed and ran all gates.

Checklist

• This PR targets `dev`
• I was assigned the linked issue
• `pnpm -r build`, `pnpm test` and `pnpm -r typecheck` pass locally
• Tests added or updated where it makes sense
• For a bug fix: the new test fails without my change
• Changeset added (`pnpm changeset`) if this changes `core`, `widget` or `server`
• Docs updated if behavior or options changed

[anurag629]

Thanks @varun-pahuja, this does everything #231 lists. There's one test per rule, a clean config returns [], and a test shows the secret never shows up in a message. Bytes are counted in UTF-8, env falls back safely where there's no process, nothing is exported yet, and the changeset is empty. I also tried a few origins the issue didn't name: https://*.acme.com and https://acme.com:8443 pass as they should. Locally the server suite passes (332 tests, 96% lines), and lint is unchanged from dev.

A small note on the PR description: it lists * together with other origins as an error, but the code reports it as a warning, which is what the issue asked for. The code is right.

Two things I'll handle when I wire this into the startup log (T4), so nothing to change here:

• The origin messages say "Allowed origin 2" rather than showing the origin. Origins aren't secret, so I'll put the value in the message so it's easier to act on.
• https://acme.com#x passes. A fragment is never part of an origin either, so I'll count it like a path.