securenow 7.7.2 → 7.7.4

package/NPM_README.md

@@ -1092,8 +1092,8 @@ On startup, you'll see:
 
 The firewall uses a version-based sync protocol for efficiency:
 
-1. **Version check** every 10 seconds (lightweight HEAD-like request with ETag)
-2. **Full blocklist sync** only when the version changes (or every 5 minutes as a safety net)
+1. **Version check** every 10 seconds (lightweight request with ETag; unchanged polls return 304 with no body)
+2. **Full blocklist sync** only when the version changes (or every hour as a safety net)
 3. **In-memory matching** with a pre-compiled set (exact IPs) and sorted CIDR list for sub-millisecond lookups
 4. **Exponential backoff** with jitter when the API is temporarily unreachable
 5. **Allowlist support** -- trusted IPs are never blocked, even if they appear on the blocklist
@@ -1244,8 +1244,8 @@ Legacy env fallback aliases are listed below for existing installs only.
 |----------|-------------|---------|
 | `SECURENOW_API_KEY` | Legacy firewall key override. Prefer `apiKey` in `.securenow/credentials.json`. | from creds file |
 | `SECURENOW_API_URL` | SecureNow API base URL. Auto-detected for co-located deployments (falls back to `http://localhost:4000` on ECONNREFUSED). | `https://api.securenow.ai` |
-| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between version checks (lightweight ETag-based). | `10` |
-| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Full blocklist refresh interval in seconds (safety net). | `300` |
+| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between lightweight ETag checks. | `10` |
+| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Safety-net full blocklist refresh interval in seconds. | `3600` |
 | `SECURENOW_FIREWALL_FAIL_MODE` | `open` (allow when unavailable) or `closed` (block all). | `open` |
 | `SECURENOW_FIREWALL_STATUS_CODE` | HTTP status code for blocked requests. | `403` |
 | `SECURENOW_FIREWALL_LOG` | Log blocked requests and sync events to console. Set to `0` to silence. | `1` |

package/SKILL-API.md

@@ -314,8 +314,8 @@ const appConfig = require('securenow/app-config');
 await firewall.init({
   ...appConfig.resolveFirewallOptions(),
   apiUrl: 'https://api.securenow.ai',
-  syncInterval: 300,        // full sync every 5 min
-  versionCheckInterval: 10, // lightweight version check every 10s
+  syncInterval: 3600,       // safety-net full sync every hour
+  versionCheckInterval: 10, // lightweight ETag check every 10s
   failMode: 'open',         // 'open' or 'closed'
   statusCode: 403,
   log: true,
@@ -504,8 +504,8 @@ Local development and production use `.securenow/credentials.json`. Every settin
 |----------|-------------|---------|
 | `SECURENOW_API_KEY` | Legacy env override for the `apiKey` field (`snk_live_...`). Since v7.5.1, login writes the scoped firewall key to `.securenow/credentials.json`. | - |
 | `SECURENOW_API_URL` | SecureNow API base URL | `https://api.securenow.ai` |
-| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between lightweight version checks | `10` |
-| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Full blocklist refresh interval in seconds | `300` |
+| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between lightweight ETag checks | `10` |
+| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Safety-net full blocklist refresh interval in seconds | `3600` |
 | `SECURENOW_FIREWALL_FAIL_MODE` | `open` (allow all when unavailable) or `closed` | `open` |
 | `SECURENOW_FIREWALL_STATUS_CODE` | HTTP status for blocked requests | `403` |
 | `SECURENOW_FIREWALL_LOG` | Log blocked requests | `1` |
@@ -515,7 +515,7 @@ Local development and production use `.securenow/credentials.json`. Every settin
 | `SECURENOW_FIREWALL_CLOUD_DRY_RUN` | `1` to log cloud pushes without applying | `0` |
 | `SECURENOW_TRUSTED_PROXIES` | Comma-separated trusted proxy IPs | — |
 
-**Resilience:** The firewall SDK includes a circuit breaker (opens after 5 consecutive errors, 2-min cooldown), in-flight request guards (prevents overlapping requests), 429 Retry-After support, and exponential backoff on both version checks and initial sync retries.
+**Resilience:** The firewall SDK includes a circuit breaker (opens after 5 consecutive errors, 2-min cooldown), in-flight request guards (prevents overlapping requests), 429 Retry-After support, and exponential backoff on both lightweight ETag checks and initial sync retries.
 
 ### Cloud WAF Provider Variables
 

package/app-config.js

@@ -60,7 +60,7 @@ const DEFAULT_CONFIG = Object.freeze({
     enabled: true,
     apiUrl: DEFAULT_API_URL,
     versionCheckInterval: 10,
-    syncInterval: 300,
+    syncInterval: 3600,
     failMode: 'open',
     statusCode: 403,
     log: true,
@@ -111,8 +111,8 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.runtime.hideBanner': 'Hide the free-trial response banner when using the managed free-trial collector.',
   'config.firewall.enabled': 'Secure default: app firewall enforcement starts when apiKey is present and the dashboard toggle is on.',
   'config.firewall.apiUrl': 'SecureNow API base URL for firewall sync.',
-  'config.firewall.versionCheckInterval': 'Seconds between lightweight firewall version checks.',
-  'config.firewall.syncInterval': 'Seconds between full firewall blocklist syncs.',
+  'config.firewall.versionCheckInterval': 'Seconds between lightweight firewall version/ETag checks.',
+  'config.firewall.syncInterval': 'Seconds between safety-net full firewall blocklist syncs.',
   'config.firewall.failMode': 'open allows traffic if SecureNow is temporarily unreachable; closed blocks all on sync failure.',
   'config.firewall.statusCode': 'HTTP status returned by application-layer firewall blocks.',
   'config.firewall.log': 'Log firewall decisions locally.',
@@ -680,7 +680,7 @@ function resolveFirewallOptions() {
     enabled: resolveFirewallEnabled(),
     apiUrl: env('SECURENOW_API_URL') || DEFAULT_API_URL,
     versionCheckInterval: numberEnv('SECURENOW_FIREWALL_VERSION_INTERVAL', 10, 1),
-    syncInterval: numberEnv('SECURENOW_FIREWALL_SYNC_INTERVAL', 300, 1),
+    syncInterval: numberEnv('SECURENOW_FIREWALL_SYNC_INTERVAL', 3600, 1),
     failMode: env('SECURENOW_FIREWALL_FAIL_MODE') || 'open',
     statusCode: numberEnv('SECURENOW_FIREWALL_STATUS_CODE', 403, 100),
     log: boolEnv('SECURENOW_FIREWALL_LOG', true),

package/console-instrumentation.js

@@ -43,13 +43,14 @@ if (console.__securenow_patched) {
 }
 
 // Store original console methods
-const originalConsole = {
+const originalConsole = console.__securenow_original || {
   log: console.log,
   info: console.info,
   warn: console.warn,
   error: console.error,
   debug: console.debug,
 };
+if (!console.__securenow_original) console.__securenow_original = originalConsole;
 
 // Map severity levels (OpenTelemetry standard)
 const SeverityNumber = {

package/firewall.js

@@ -10,9 +10,10 @@ let _matcher = null;
 let _syncTimer = null;
 let _pollTimer = null;
 let _lastModified = null;
-let _lastVersion = null;
-let _lastSyncEtag = null;
-let _initialized = false;
+let _lastVersion = null;
+let _lastSyncEtag = null;
+let _lastUnifiedEtag = null;
+let _initialized = false;
 let _consecutiveErrors = 0;
 let _layers = [];
 let _rawIps = [];
@@ -21,7 +22,7 @@ let _localhostFallbackTried = false;
 let _eventQueue = [];
 let _eventTimer = null;
 
-// Remote toggle — set by /firewall/sync when an appKey is in scope. Default
+// Remote toggle - set by /firewall/sync when an appKey is in scope. Default
 // true so a missing/unreachable backend fails open (matches pre-7.3 behavior).
 // When the dashboard / CLI flips this off, the next poll suppresses
 // enforcement without restarting the host process.
@@ -56,9 +57,29 @@ const EVENT_QUEUE_MAX = 1_000;
 const TRANSIENT_NETWORK_CODES = new Set(['ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'EAI_AGAIN']);
 
 // Unified sync uses /firewall/sync (v2). Falls back to legacy on 404.
-let _useUnifiedSync = true;
+let _useUnifiedSync = true;
+
+function originalConsoleMethod(method) {
+  const originals = console.__securenow_original || console.__securenowOriginalConsole;
+  return (originals && originals[method]) || console[method] || console.log;
+}
+
+function firewallConsole(method, ...args) {
+  if (!_options || !_options.log) return;
+  try {
+    originalConsoleMethod(method).apply(console, args);
+  } catch (_) {}
+}
+
+function fwLog(...args) {
+  firewallConsole('log', ...args);
+}
+
+function fwWarn(...args) {
+  firewallConsole('warn', ...args);
+}
 
-// ────── Circuit Breaker ──────
+// Circuit Breaker
 
 function maybeOpenCircuit() {
   if (_circuitState === 'open') return;
@@ -66,7 +87,7 @@ function maybeOpenCircuit() {
     _circuitState = 'open';
     _circuitOpenedAt = Date.now();
     if (_options && _options.log) {
-      console.warn('[securenow] Firewall: circuit breaker OPEN — pausing polling for %ds', CIRCUIT_OPEN_COOLDOWN_MS / 1000);
+      fwWarn('[securenow] Firewall: circuit breaker OPEN - pausing polling for %ds', CIRCUIT_OPEN_COOLDOWN_MS / 1000);
     }
   }
 }
@@ -74,7 +95,7 @@ function maybeOpenCircuit() {
 function resetCircuit() {
   if (_circuitState !== 'closed') {
     _circuitState = 'closed';
-    if (_options && _options.log) console.log('[securenow] Firewall: circuit breaker CLOSED — API healthy');
+    if (_options && _options.log) fwLog('[securenow] Firewall: circuit breaker CLOSED - API healthy');
   }
   _consecutiveErrors = 0;
 }
@@ -99,12 +120,12 @@ function handleRetryAfter(res) {
   if (secs > 0 && secs <= 300) {
     _retryAfterUntil = Date.now() + secs * 1000;
     if (_options && _options.log) {
-      console.warn('[securenow] Firewall: API returned 429, backing off for %ds', secs);
+      fwWarn('[securenow] Firewall: API returned 429, backing off for %ds', secs);
     }
   }
 }
 
-// ────── HTTP helpers ──────
+// HTTP helpers
 
 function buildUrl(apiUrl, path) {
   return apiUrl.replace(/\/+$/, '') + '/api/v1' + path;
@@ -193,7 +214,7 @@ function requestWithRetry(method, url, body, extraHeaders, timeout, callback) {
     if (!err || !isTransientNetworkError(err)) return callback(err, res, data);
 
     if (_options && _options.log) {
-      console.warn('[securenow] Firewall: transient API socket error, retrying once:', formatRequestError(err));
+      fwWarn('[securenow] Firewall: transient API socket error, retrying once:', formatRequestError(err));
     }
 
     const retryTimer = setTimeout(() => {
@@ -234,7 +255,7 @@ function flushFirewallEvents() {
     if (err || !res || res.statusCode >= 400) {
       if (_options.log) {
         const msg = err ? formatRequestError(err) : `API returned ${res.statusCode}`;
-        console.warn('[securenow] Firewall: failed to report blocked-request ledger:', msg);
+        fwWarn('[securenow] Firewall: failed to report blocked-request ledger:', msg);
       }
     }
     if (_eventQueue.length) scheduleEventFlush();
@@ -262,7 +283,7 @@ function reportFirewallEvent(event) {
   else scheduleEventFlush();
 }
 
-// ────── Unified Sync (v2 — single request for everything) ──────
+// Unified Sync (v2 - single request for everything)
 
 function doUnifiedSync(callback) {
   const query = new URLSearchParams();
@@ -272,21 +293,23 @@ function doUnifiedSync(callback) {
   const url = buildUrl(_options.apiUrl, '/firewall/sync') + suffix;
   const headers = {};
   if (_options.environment) headers['X-SecureNow-Environment'] = _options.environment;
-  if (_lastVersion) headers['X-Blocklist-Version'] = _lastVersion;
-  if (_lastAllowlistVersion) headers['X-Allowlist-Version'] = _lastAllowlistVersion;
-
-  httpGet(url, headers, 8000, (err, res, data) => {
-    if (err) return callback(err);
-
-    _stats.versionChecks++;
-
-    if (res.statusCode === 304) {
-      return callback(null, { blChanged: false, alChanged: false });
+  if (_lastVersion) headers['X-Blocklist-Version'] = _lastVersion;
+  if (_lastAllowlistVersion) headers['X-Allowlist-Version'] = _lastAllowlistVersion;
+  if (_lastUnifiedEtag) headers['If-None-Match'] = _lastUnifiedEtag;
+
+  httpGet(url, headers, 8000, (err, res, data) => {
+    if (err) return callback(err);
+
+    _stats.versionChecks++;
+    if (res.headers && res.headers.etag) _lastUnifiedEtag = res.headers.etag;
+
+    if (res.statusCode === 304) {
+      return callback(null, { blChanged: false, alChanged: false });
     }
 
     if (res.statusCode === 404) {
       _useUnifiedSync = false;
-      if (_options.log) console.log('[securenow] Firewall: /sync not available, using legacy endpoints');
+      if (_options.log) fwLog('[securenow] Firewall: /sync not available, using legacy endpoints');
       return callback(null, { blChanged: false, alChanged: false, useLegacy: true });
     }
 
@@ -304,30 +327,29 @@ function doUnifiedSync(callback) {
 
       // Apply remote per-app toggle. Absent body.app means the backend either
       // doesn't know about appKey-scoped sync (older API) or no appKey was
-      // sent — leave the previous value untouched (default true on first run).
+      // sent - leave the previous value untouched (default true on first run).
       if (body.app && typeof body.app.firewallEnabled === 'boolean') {
         const next = body.app.firewallEnabled;
         if (next !== _lastRemoteEnabled) {
           _remoteEnabled = next;
           if (_options.log) {
-            console.log('[securenow] Firewall: remote toggle → %s (app=%s)',
+            fwLog('[securenow] Firewall: remote toggle -> %s (app=%s)',
               next ? 'ENABLED' : 'DISABLED', body.app.key || _options.appKey);
           }
           _lastRemoteEnabled = next;
         }
       }
 
-      // Update blocklist version + data
-      if (body.blocklist) {
-        const newVer = body.blocklist.version;
-        if (newVer !== _lastVersion) {
-          _lastVersion = newVer;
-          blChanged = true;
-        }
-      }
-
-      if (body.blocklistIps) {
-        _rawIps = body.blocklistIps;
+      // Update blocklist version + data
+      if (body.blocklist) {
+        const newVer = body.blocklist.version;
+        if (newVer !== _lastVersion) {
+          _lastVersion = newVer;
+        }
+      }
+
+      if (body.blocklistIps) {
+        _rawIps = body.blocklistIps;
         _matcher = createMatcher(body.blocklistIps);
         _stats.syncs++;
         notifyLayers(body.blocklistIps);
@@ -335,13 +357,12 @@ function doUnifiedSync(callback) {
       }
 
       // Update allowlist version + data
-      if (body.allowlist) {
-        const newVer = body.allowlist.version;
-        if (newVer !== _lastAllowlistVersion) {
-          _lastAllowlistVersion = newVer;
-          alChanged = true;
-        }
-      }
+      if (body.allowlist) {
+        const newVer = body.allowlist.version;
+        if (newVer !== _lastAllowlistVersion) {
+          _lastAllowlistVersion = newVer;
+        }
+      }
 
       if (body.allowlistIps) {
         _allowlistRawIps = body.allowlistIps;
@@ -356,7 +377,7 @@ function doUnifiedSync(callback) {
   });
 }
 
-// ────── Legacy Sync (v1 — separate endpoints, kept for backward compat) ──────
+// Legacy Sync (v1 - separate endpoints, kept for backward compat)
 
 function legacyBlocklistSync(callback) {
   const url = buildFirewallUrl('/firewall/blocklist');
@@ -481,15 +502,15 @@ function doLegacyPoll(callback) {
 
     if (blChanged) {
       legacyBlocklistSync((err, changed, stats) => {
-        if (err && _options.log) console.warn('[securenow] Firewall: sync failed (using stale list):', formatRequestError(err));
-        else if (changed && stats && _options.log) console.log('[securenow] Firewall: re-synced %d blocked IPs', stats.total);
+        if (err && _options.log) fwWarn('[securenow] Firewall: sync failed (using stale list):', formatRequestError(err));
+        else if (changed && stats && _options.log) fwLog('[securenow] Firewall: re-synced %d blocked IPs', stats.total);
         syncDone();
       });
     }
     if (alChanged) {
       legacyAllowlistSync((err, changed, stats) => {
-        if (err && _options.log) console.warn('[securenow] Firewall: allowlist sync failed:', formatRequestError(err));
-        else if (changed && stats && _options.log) console.log('[securenow] Firewall: re-synced %d allowed IPs', stats.total);
+        if (err && _options.log) fwWarn('[securenow] Firewall: allowlist sync failed:', formatRequestError(err));
+        else if (changed && stats && _options.log) fwLog('[securenow] Firewall: re-synced %d allowed IPs', stats.total);
         syncDone();
       });
     }
@@ -508,7 +529,7 @@ function doLegacyPoll(callback) {
   });
 }
 
-// ────── Unified poll loop ──────
+// Unified poll loop
 
 function notifyLayers(ips) {
   for (const layer of _layers) {
@@ -526,7 +547,7 @@ function pollOnce(callback) {
       _consecutiveErrors++;
       _stats.errors++;
       maybeOpenCircuit();
-      if (_options.log) console.warn('[securenow] Firewall: poll failed:', formatRequestError(err));
+      if (_options.log) fwWarn('[securenow] Firewall: poll failed:', formatRequestError(err));
       return callback(err);
     }
     _consecutiveErrors = 0;
@@ -534,11 +555,11 @@ function pollOnce(callback) {
     if (result) {
       if (result.blChanged && _options.log && _matcher) {
         const s = _matcher.stats();
-        console.log('[securenow] Firewall: re-synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        fwLog('[securenow] Firewall: re-synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
       if (result.alChanged && _options.log && _allowlistMatcher) {
         const s = _allowlistMatcher.stats();
-        console.log('[securenow] Firewall: re-synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        fwLog('[securenow] Firewall: re-synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
     }
     callback(null);
@@ -586,7 +607,7 @@ function startSyncLoop() {
           _localhostFallbackTried = true;
           const origUrl = _options.apiUrl;
           _options.apiUrl = 'http://localhost:4000';
-          if (_options.log) console.log('[securenow] Firewall: %s unreachable, trying http://localhost:4000', origUrl);
+          if (_options.log) fwLog('[securenow] Firewall: %s unreachable, trying http://localhost:4000', origUrl);
           const retryTimer = setTimeout(initialSync, 1000);
           if (retryTimer.unref) retryTimer.unref();
           return;
@@ -596,7 +617,7 @@ function startSyncLoop() {
           if (retryTimer.unref) retryTimer.unref();
           return;
         }
-        if (_options.log) console.warn('[securenow] Firewall: initial sync failed:', formatRequestError(err));
+        if (_options.log) fwWarn('[securenow] Firewall: initial sync failed:', formatRequestError(err));
         if (_options.failMode === 'closed') {
           _matcher = { isBlocked: () => true, stats: () => ({ exact: 0, cidr: 0, total: 0 }) };
         }
@@ -616,11 +637,11 @@ function startSyncLoop() {
       _initialized = true;
       if (_options.log && _matcher) {
         const s = _matcher.stats();
-        console.log('[securenow] Firewall: synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        fwLog('[securenow] Firewall: synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
       if (_options.log && _allowlistMatcher) {
         const s = _allowlistMatcher.stats();
-        if (s.total > 0) console.log('[securenow] Firewall: synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        if (s.total > 0) fwLog('[securenow] Firewall: synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
     });
   }
@@ -631,22 +652,25 @@ function startSyncLoop() {
   // Safety-net full sync timer (less frequent, uses same path)
   _syncTimer = setInterval(() => {
     if (shouldSkipRequest()) return;
-    // Force a full re-fetch by clearing versions so unified endpoint returns full data
-    const savedBlVer = _lastVersion;
-    const savedAlVer = _lastAllowlistVersion;
-    _lastVersion = null;
-    _lastAllowlistVersion = null;
-    pollOnce((err) => {
-      if (err) {
-        _lastVersion = savedBlVer;
-        _lastAllowlistVersion = savedAlVer;
-      }
-    });
-  }, fullSyncIntervalMs);
+    // Force a full re-fetch by clearing versions so unified endpoint returns full data
+    const savedBlVer = _lastVersion;
+    const savedAlVer = _lastAllowlistVersion;
+    const savedUnifiedEtag = _lastUnifiedEtag;
+    _lastVersion = null;
+    _lastAllowlistVersion = null;
+    _lastUnifiedEtag = null;
+    pollOnce((err) => {
+      if (err) {
+        _lastVersion = savedBlVer;
+        _lastAllowlistVersion = savedAlVer;
+        _lastUnifiedEtag = savedUnifiedEtag;
+      }
+    });
+  }, fullSyncIntervalMs);
   if (_syncTimer.unref) _syncTimer.unref();
 }
 
-// ────── Layer 1: HTTP Handler ──────
+// Layer 1: HTTP Handler
 
 const _origHttpCreate = http.createServer;
 const _origHttpsCreate = https.createServer;
@@ -658,7 +682,7 @@ function blockedHtml(ip) {
 <html lang="en">
 <head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Access Blocked — Security Alert</title>
+<title>Access Blocked - Security Alert</title>
 <style>
 *{margin:0;padding:0;box-sizing:border-box}
 body{min-height:100vh;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#0a0a0a;color:#e5e5e5}
@@ -729,7 +753,7 @@ function firewallRequestHandler(req, res) {
   if (_allowlistMatcher && _allowlistMatcher.stats().total > 0) {
     if (!_allowlistMatcher.isBlocked(ip)) {
       _stats.blocked++;
-      if (_options && _options.log) console.log('[securenow] Firewall: blocked %s via HTTP (not in allowlist)', ip);
+      if (_options && _options.log) fwLog('[securenow] Firewall: blocked %s via HTTP (not in allowlist)', ip);
       reportFirewallEvent({
         source: 'allowlist',
         ip,
@@ -747,7 +771,7 @@ function firewallRequestHandler(req, res) {
   // Blocklist check
   if (_matcher && _matcher.isBlocked(ip)) {
     _stats.blocked++;
-    if (_options && _options.log) console.log('[securenow] Firewall: blocked %s via HTTP', ip);
+    if (_options && _options.log) fwLog('[securenow] Firewall: blocked %s via HTTP', ip);
     reportFirewallEvent({
       source: 'blocklist',
       ip,
@@ -801,28 +825,28 @@ function patchHttpLayer() {
   Object.assign(https.createServer, _origHttpsCreate);
 }
 
-// ────── Init ──────
+// Init
 
 function init(options) {
   _options = options;
 
-  if (_options.log) console.log('[securenow] Firewall: ENABLED');
-  if (_options.log && _options.environment) console.log('[securenow] Firewall: environment=%s', _options.environment);
+  if (_options.log) fwLog('[securenow] Firewall: ENABLED');
+  if (_options.log && _options.environment) fwLog('[securenow] Firewall: environment=%s', _options.environment);
 
   patchHttpLayer();
-  if (_options.log) console.log('[securenow] Firewall: Layer 1 (HTTP 403)      active');
+  if (_options.log) fwLog('[securenow] Firewall: Layer 1 (HTTP 403)      active');
 
   if (_options.tcp) {
     try {
       const tcpLayer = require('./firewall-tcp');
       tcpLayer.init(() => _matcher, _options, () => _allowlistMatcher);
       _layers.push(tcpLayer);
-      if (_options.log) console.log('[securenow] Firewall: Layer 2 (TCP drop)       active');
+      if (_options.log) fwLog('[securenow] Firewall: Layer 2 (TCP drop)       active');
     } catch (e) {
-      if (_options.log) console.warn('[securenow] Firewall: Layer 2 (TCP drop)       failed:', e.message);
+      if (_options.log) fwWarn('[securenow] Firewall: Layer 2 (TCP drop)       failed:', e.message);
     }
   } else {
-    if (_options.log) console.log('[securenow] Firewall: Layer 2 (TCP drop)       disabled (set config.firewall.tcp=true)');
+    if (_options.log) fwLog('[securenow] Firewall: Layer 2 (TCP drop)       disabled (set config.firewall.tcp=true)');
   }
 
   if (_options.iptables) {
@@ -830,12 +854,12 @@ function init(options) {
       const iptablesLayer = require('./firewall-iptables');
       iptablesLayer.init(_options);
       _layers.push(iptablesLayer);
-      if (_options.log) console.log('[securenow] Firewall: Layer 3 (iptables)       active');
+      if (_options.log) fwLog('[securenow] Firewall: Layer 3 (iptables)       active');
     } catch (e) {
-      if (_options.log) console.warn('[securenow] Firewall: Layer 3 (iptables)       failed:', e.message);
+      if (_options.log) fwWarn('[securenow] Firewall: Layer 3 (iptables)       failed:', e.message);
     }
   } else {
-    if (_options.log) console.log('[securenow] Firewall: Layer 3 (iptables)       disabled (set config.firewall.iptables=true)');
+    if (_options.log) fwLog('[securenow] Firewall: Layer 3 (iptables)       disabled (set config.firewall.iptables=true)');
   }
 
   if (_options.cloud) {
@@ -843,12 +867,12 @@ function init(options) {
       const cloudLayer = require('./firewall-cloud');
       cloudLayer.init(_options);
       _layers.push(cloudLayer);
-      if (_options.log) console.log('[securenow] Firewall: Layer 4 (Cloud WAF)      active (%s)', _options.cloud);
+      if (_options.log) fwLog('[securenow] Firewall: Layer 4 (Cloud WAF)      active (%s)', _options.cloud);
     } catch (e) {
-      if (_options.log) console.warn('[securenow] Firewall: Layer 4 (Cloud WAF)      failed:', e.message);
+      if (_options.log) fwWarn('[securenow] Firewall: Layer 4 (Cloud WAF)      failed:', e.message);
     }
   } else {
-    if (_options.log) console.log('[securenow] Firewall: Layer 4 (Cloud WAF)      disabled (set config.firewall.cloud=cloudflare|aws|gcp)');
+    if (_options.log) fwLog('[securenow] Firewall: Layer 4 (Cloud WAF)      disabled (set config.firewall.cloud=cloudflare|aws|gcp)');
   }
 
   startSyncLoop();
@@ -907,4 +931,4 @@ function getMatcher() { return _remoteEnabled === false ? null : _matcher; }
 function getAllowlistMatcher() { return _remoteEnabled === false ? null : _allowlistMatcher; }
 function isRemoteEnabled() { return _remoteEnabled !== false; }
 
-module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, isRemoteEnabled };
+module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, isRemoteEnabled };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "7.7.2",
+  "version": "7.7.4",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",

package/tracing.js

@@ -521,7 +521,8 @@ if (loggingEnabled) {
 
   // Auto-patch console.* so every log/warn/error becomes an OTel log record
   const _logger = loggerProvider.getLogger('console', '1.0.0');
-  const _orig = { log: console.log, info: console.info, warn: console.warn, error: console.error, debug: console.debug };
+  const _orig = console.__securenow_original || { log: console.log, info: console.info, warn: console.warn, error: console.error, debug: console.debug };
+  if (!console.__securenow_original) console.__securenow_original = _orig;
   const SEV = { DEBUG: 5, INFO: 9, WARN: 13, ERROR: 17 };
   function _emit(sn, st, args) {
     try {