fix(sdk): generate server password so serve starts without configuration

[cyb3rAcad3my]

Summary

Fixes Error: CYBERSTRIKE_SERVER_PASSWORD is required when starting a server through the JS SDK (createCyberstrike / createCyberstrikeServer), which broke script/duplicate-pr.ts — the script .github/workflows/pr-management.yml invokes with no password secret configured.

Root cause

packages/cyberstrike/src/cli/cmd/serve.ts refuses to start without CYBERSTRIKE_SERVER_PASSWORD (by design — the password protects non-loopback access, see SECURITY.md). However, createCyberstrikeServer spawned cyberstrike serve without ever supplying one, so every SDK-managed startup failed immediately with:

Error: CYBERSTRIKE_SERVER_PASSWORD is required.

Fix

In packages/sdk/js/src/{server,index}.ts and their v2/ twins:

• Resolve a password with precedence options.password → CYBERSTRIKE_SERVER_PASSWORD → randomUUID() (node:crypto, 122-bit CSPRNG), so explicit overrides and existing env-based setups keep working, while zero-configuration startup now just works.
• Pass it to the child via env only (never argv), so it can't surface in ps output or logs.
• Send the matching Authorization: Basic header from createCyberstrike so the client is authenticated for non-loopback use.
• Server-side auth middleware is unchanged: loopback trust, forwarded-request (x-forwarded-for / cf-connecting-ip) detection, and Basic auth enforcement all behave exactly as before. No authentication is disabled or weakened; the only change is that the SDK now supplies the credential the server demands.

Security considerations

• Generated passwords are per-run, unpredictable (UUIDv4 from node:crypto), and never written to disk, logs, or git.
• The server continues to bind 127.0.0.1 by default; the password additionally protects proxied/tunneled access per existing middleware.
• New tests assert that forwarded requests without credentials get 401 and only the matching credentials get 200.

Tests

packages/sdk/js: bun test src/server.test.ts → 6 pass, 0 fail (13 expect calls) — startup without the env var, 401 on unauthorized forwarded requests, 200 with the generated password, options.password precedence over env, env password compatibility, and v1/v2 client reachability. bun run typecheck clean; prettier clean; bun install --frozen-lockfile (CI mode) accepts the lockfile.

Note: script/duplicate-pr.ts's server now starts correctly, but the full duplicate-check workflow additionally requires the upstream duplicate-pr agent and CYBERSTRIKE_API_KEY, which are only available in CI — the model-response path could not be exercised locally and is not claimed to pass here.

@types/bun was added to the SDK's devDependencies (already in the workspace catalog) for the bun:test import; the lockfile diff is that single line.

Fixes #167

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.