[piyusshhjangid]

Closes #460

What does this change?

Adds CSP nonce support for every widget-injected style. Script-tag installs read the nonce from their own script element; ESM and programmatic installs can set nonce in WidgetConfig. Documents the setup and adds unit and browser coverage under a nonce-only style-src policy.

How I tested this

• pnpm --filter @chatcops/widget test — 687 passed.
• pnpm --filter @chatcops/widget typecheck — passed.
• pnpm e2e --grep "script nonce allows" — passed.
• pnpm size — passed; panel is 16.65 kB gzipped against an 18 kB limit.
• Changed-file Biome check and git diff --check — passed.

The full docs sample check reports existing errors in unrelated workspace docs/packages. On Windows, the package build script’s final rm -f step is unsupported; the Vite builds and standalone widget declaration build passed.

AI assistance

OpenAI Codex assisted with implementation, tests, and documentation. I reviewed the changes and ran the checks above.

[anurag629]

Thanks @piyusshhjangid, this covers #460. All three style elements get the nonce, the script tag's .nonce property is the right thing to read (browsers hide the attribute but keep the property), and the e2e page with a nonce-only style-src checks every style element and that no violation fires. With current dev merged in: build, typecheck, test:coverage, lint (same as dev), api:check, docs:check, size (panel 16.65 kB, single file 18.69 kB) and the full e2e suite (70, in Chrome) pass.

One follow-up idea, not needed for this PR: a site that loads the script tag and then calls ChatCops.init({...}) itself, without nonce, gets unstyled widgets under a strict CSP. The loader could take document.currentScript?.nonce once at load and use it when the config leaves nonce out, so that case works without the site knowing. If you'd like that, open an issue and it's yours.

Merging once CI is green.

[anurag629]

Merged, thanks @piyusshhjangid.