fix(auth): hardcode secure cookie flag for production (AF-6)

[St0rmz1]

The old code checked if the request URL was https: to decide the Secure flag. That works in production (always behind Cloudflare, always HTTPS), but it's fragile because it relies on the request protocol rather than an explicit environment signal.

The new code uses WORKER_ENV !== 'development' — so the cookie is Secure in every environment except local dev. This means:

• Production (WORKER_ENV = 'production' or any non-'development' value): secure: true
• Local dev (WORKER_ENV = 'development'): secure: false (so HTTP still works locally)

This matches how the rest of kiloclaw already uses WORKER_ENV for environment detection (e.g., the dev- prefix logic in kiloclaw-app.ts:100).

The practical difference is small — production behavior is identical. It just removes the dependency on protocol sniffing, which AF-6 flagged as potentially risky if the worker ever received a non-HTTPS request in production.

[kiloconnect]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The change replaces protocol-based secure cookie detection (new URL(c.req.url).protocol === 'https:') with an environment-based check (c.env.WORKER_ENV !== 'development'). This is a sound improvement — it avoids relying on the request URL protocol, which can be unreliable behind reverse proxies or load balancers, and instead uses the explicit environment configuration.

Files Reviewed (1 file)

• kiloclaw/src/routes/access-gateway.ts