securenow 7.7.3 → 7.7.5

package/NPM_README.md

@@ -1092,8 +1092,8 @@ On startup, you'll see:
 
 The firewall uses a version-based sync protocol for efficiency:
 
-1. **Version check** every 10 seconds (lightweight HEAD-like request with ETag)
-2. **Full blocklist sync** only when the version changes (or every 5 minutes as a safety net)
+1. **Version check** every 10 seconds (lightweight request with ETag; unchanged polls return 304 with no body)
+2. **Full blocklist sync** only when the version changes (or every hour as a safety net)
 3. **In-memory matching** with a pre-compiled set (exact IPs) and sorted CIDR list for sub-millisecond lookups
 4. **Exponential backoff** with jitter when the API is temporarily unreachable
 5. **Allowlist support** -- trusted IPs are never blocked, even if they appear on the blocklist
@@ -1244,8 +1244,8 @@ Legacy env fallback aliases are listed below for existing installs only.
 |----------|-------------|---------|
 | `SECURENOW_API_KEY` | Legacy firewall key override. Prefer `apiKey` in `.securenow/credentials.json`. | from creds file |
 | `SECURENOW_API_URL` | SecureNow API base URL. Auto-detected for co-located deployments (falls back to `http://localhost:4000` on ECONNREFUSED). | `https://api.securenow.ai` |
-| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between version checks (lightweight ETag-based). | `10` |
-| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Full blocklist refresh interval in seconds (safety net). | `300` |
+| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between lightweight ETag checks. | `10` |
+| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Safety-net full blocklist refresh interval in seconds. | `3600` |
 | `SECURENOW_FIREWALL_FAIL_MODE` | `open` (allow when unavailable) or `closed` (block all). | `open` |
 | `SECURENOW_FIREWALL_STATUS_CODE` | HTTP status code for blocked requests. | `403` |
 | `SECURENOW_FIREWALL_LOG` | Log blocked requests and sync events to console. Set to `0` to silence. | `1` |
@@ -1261,7 +1261,7 @@ Use `npx securenow help firewall` for complete details on all layers.
 
 | Variable | Description | Default |
 |----------|-------------|---------|
-| `OTEL_LOG_LEVEL` | OpenTelemetry SDK log level. Options: `debug`, `info`, `warn`, `error` | `none` |
+| `OTEL_LOG_LEVEL` | OpenTelemetry diagnostic override. Options: `debug`, `info`, `warn`, `error`, `none`. Overrides `config.otel.logLevel` for emergency debugging. | `error` |
 | `SECURENOW_TEST_SPAN` | Set to `1` to emit a test span on startup. | `0` |
 
 #### Environment
@@ -1600,7 +1600,16 @@ curl http://localhost:4318/v1/traces
 # Should return 200 or 405 (method not allowed)
 ```
 
-**Check 3: Enable debug logging in credentials**
+**Check 3: Run doctor and enable debug diagnostics**
+
+```bash
+npx securenow doctor --json
+OTEL_LOG_LEVEL=debug node -r securenow/register app.js
+```
+
+Doctor checks OTLP reachability and flags duplicate `@opentelemetry/api` versions that can silently leave tracing on the OpenTelemetry noop provider.
+
+For a persistent setting, update credentials:
 
 ```json
 {

package/SKILL-API.md

@@ -314,8 +314,8 @@ const appConfig = require('securenow/app-config');
 await firewall.init({
   ...appConfig.resolveFirewallOptions(),
   apiUrl: 'https://api.securenow.ai',
-  syncInterval: 300,        // full sync every 5 min
-  versionCheckInterval: 10, // lightweight version check every 10s
+  syncInterval: 3600,       // safety-net full sync every hour
+  versionCheckInterval: 10, // lightweight ETag check every 10s
   failMode: 'open',         // 'open' or 'closed'
   statusCode: 403,
   log: true,
@@ -495,7 +495,7 @@ Local development and production use `.securenow/credentials.json`. Every settin
 | `SECURENOW_DISABLE_INSTRUMENTATIONS` | Comma-separated packages to skip (e.g. `fs,dns`) | — |
 | `SECURENOW_TEST_SPAN` | `1` to emit a test span on startup | `0` |
 | `SECURENOW_HIDE_BANNER` | `1` to suppress free-trial upgrade banner | `0` |
-| `OTEL_LOG_LEVEL` | SDK log level: `none`, `error`, `warn`, `info`, `debug` | `none` |
+| `OTEL_LOG_LEVEL` | SDK diagnostic override: `error`, `warn`, `info`, `debug`, or `none` | `error` |
 | `SECURENOW_ENVIRONMENT` / `SECURENOW_DEPLOYMENT_ENVIRONMENT` / `NODE_ENV` | Legacy fallback for `config.runtime.deploymentEnvironment` | `production` |
 
 ### Firewall
@@ -504,8 +504,8 @@ Local development and production use `.securenow/credentials.json`. Every settin
 |----------|-------------|---------|
 | `SECURENOW_API_KEY` | Legacy env override for the `apiKey` field (`snk_live_...`). Since v7.5.1, login writes the scoped firewall key to `.securenow/credentials.json`. | - |
 | `SECURENOW_API_URL` | SecureNow API base URL | `https://api.securenow.ai` |
-| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between lightweight version checks | `10` |
-| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Full blocklist refresh interval in seconds | `300` |
+| `SECURENOW_FIREWALL_VERSION_INTERVAL` | Seconds between lightweight ETag checks | `10` |
+| `SECURENOW_FIREWALL_SYNC_INTERVAL` | Safety-net full blocklist refresh interval in seconds | `3600` |
 | `SECURENOW_FIREWALL_FAIL_MODE` | `open` (allow all when unavailable) or `closed` | `open` |
 | `SECURENOW_FIREWALL_STATUS_CODE` | HTTP status for blocked requests | `403` |
 | `SECURENOW_FIREWALL_LOG` | Log blocked requests | `1` |
@@ -515,7 +515,7 @@ Local development and production use `.securenow/credentials.json`. Every settin
 | `SECURENOW_FIREWALL_CLOUD_DRY_RUN` | `1` to log cloud pushes without applying | `0` |
 | `SECURENOW_TRUSTED_PROXIES` | Comma-separated trusted proxy IPs | — |
 
-**Resilience:** The firewall SDK includes a circuit breaker (opens after 5 consecutive errors, 2-min cooldown), in-flight request guards (prevents overlapping requests), 429 Retry-After support, and exponential backoff on both version checks and initial sync retries.
+**Resilience:** The firewall SDK includes a circuit breaker (opens after 5 consecutive errors, 2-min cooldown), in-flight request guards (prevents overlapping requests), 429 Retry-After support, and exponential backoff on both lightweight ETag checks and initial sync retries.
 
 ### Cloud WAF Provider Variables
 
@@ -634,7 +634,7 @@ On startup, securenow logs its configuration:
 [securenow] Firewall: synced 142 blocked IPs
 ```
 
-Set `config.otel.logLevel` to `debug` in `.securenow/credentials.json` or run `securenow test-span --env <env>` to troubleshoot connectivity issues.
+Set `config.otel.logLevel` to `debug`, or temporarily run with `OTEL_LOG_LEVEL=debug`, and run `securenow doctor --json` to troubleshoot connectivity, duplicate OpenTelemetry API packages, and provider registration issues.
 
 **CLI equivalent** (works without booting the SDK — useful when the app won't start):
 

package/app-config.js

@@ -46,7 +46,7 @@ const DEFAULT_CONFIG = Object.freeze({
     tracesEndpoint: null,
     logsEndpoint: null,
     headers: {},
-    logLevel: 'none',
+    logLevel: 'error',
     disableInstrumentations: [],
   },
   runtime: {
@@ -60,7 +60,7 @@ const DEFAULT_CONFIG = Object.freeze({
     enabled: true,
     apiUrl: DEFAULT_API_URL,
     versionCheckInterval: 10,
-    syncInterval: 300,
+    syncInterval: 3600,
     failMode: 'open',
     statusCode: 403,
     log: true,
@@ -102,7 +102,7 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.otel.tracesEndpoint': 'Optional full traces endpoint override, for split collectors.',
   'config.otel.logsEndpoint': 'Optional full logs endpoint override, for split collectors.',
   'config.otel.headers': 'Optional OTLP headers. The SDK auto-adds x-api-key from app.key when missing.',
-  'config.otel.logLevel': 'OpenTelemetry diagnostic log level: none, error, warn, info, or debug.',
+  'config.otel.logLevel': 'OpenTelemetry diagnostic log level: error, warn, info, debug, or none.',
   'config.otel.disableInstrumentations': 'Optional OTel instrumentation package names to disable.',
   'config.runtime.deploymentEnvironment': 'deployment.environment resource attribute. Set this in the credentials file for production.',
   'config.runtime.noUuid': 'null means auto: true when app.key is present. Set true/false only for advanced routing needs.',
@@ -111,8 +111,8 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.runtime.hideBanner': 'Hide the free-trial response banner when using the managed free-trial collector.',
   'config.firewall.enabled': 'Secure default: app firewall enforcement starts when apiKey is present and the dashboard toggle is on.',
   'config.firewall.apiUrl': 'SecureNow API base URL for firewall sync.',
-  'config.firewall.versionCheckInterval': 'Seconds between lightweight firewall version checks.',
-  'config.firewall.syncInterval': 'Seconds between full firewall blocklist syncs.',
+  'config.firewall.versionCheckInterval': 'Seconds between lightweight firewall version/ETag checks.',
+  'config.firewall.syncInterval': 'Seconds between safety-net full firewall blocklist syncs.',
   'config.firewall.failMode': 'open allows traffic if SecureNow is temporarily unreachable; closed blocks all on sync failure.',
   'config.firewall.statusCode': 'HTTP status returned by application-layer firewall blocks.',
   'config.firewall.log': 'Log firewall decisions locally.',
@@ -680,7 +680,7 @@ function resolveFirewallOptions() {
     enabled: resolveFirewallEnabled(),
     apiUrl: env('SECURENOW_API_URL') || DEFAULT_API_URL,
     versionCheckInterval: numberEnv('SECURENOW_FIREWALL_VERSION_INTERVAL', 10, 1),
-    syncInterval: numberEnv('SECURENOW_FIREWALL_SYNC_INTERVAL', 300, 1),
+    syncInterval: numberEnv('SECURENOW_FIREWALL_SYNC_INTERVAL', 3600, 1),
     failMode: env('SECURENOW_FIREWALL_FAIL_MODE') || 'open',
     statusCode: numberEnv('SECURENOW_FIREWALL_STATUS_CODE', 403, 100),
     log: boolEnv('SECURENOW_FIREWALL_LOG', true),

package/cli/diagnostics.js

@@ -1,6 +1,8 @@
 'use strict';
 
 const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
 const url = require('url');
 const ui = require('./ui');
 const config = require('./config');
@@ -37,6 +39,7 @@ function resolvedConfig(options = {}) {
     loggingEnabled: appConfig.boolEnv('SECURENOW_LOGGING_ENABLED', true),
     captureBody: appConfig.boolEnv('SECURENOW_CAPTURE_BODY', true),
     captureMultipart: appConfig.boolEnv('SECURENOW_CAPTURE_MULTIPART', true),
+    otelLogLevel: (process.env.OTEL_LOG_LEVEL != null ? process.env.OTEL_LOG_LEVEL : appConfig.env('OTEL_LOG_LEVEL')) || 'error',
     firewallEnabled,
     firewallLayers: {
       http: firewallEnabled,
@@ -47,6 +50,68 @@ function resolvedConfig(options = {}) {
   };
 }
 
+function readPackageVersion(packageJsonPath, label) {
+  try {
+    if (!packageJsonPath || !fs.existsSync(packageJsonPath)) return null;
+    const realPath = fs.realpathSync(packageJsonPath);
+    const pkg = JSON.parse(fs.readFileSync(realPath, 'utf8').replace(/^\uFEFF/, ''));
+    return { label, path: realPath, version: pkg.version || null };
+  } catch {
+    return null;
+  }
+}
+
+function resolvePackageJson(pkgName, paths, label) {
+  try {
+    let current = path.dirname(require.resolve(pkgName, { paths }));
+    while (current && current !== path.dirname(current)) {
+      const candidate = path.join(current, 'package.json');
+      const pkg = readPackageVersion(candidate, label);
+      if (pkg) return pkg;
+      current = path.dirname(current);
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function collectOtelApiPackages() {
+  const cwd = process.cwd();
+  const packageName = '@opentelemetry/api';
+  const candidates = [
+    readPackageVersion(path.join(cwd, 'node_modules', '@opentelemetry', 'api', 'package.json'), 'project node_modules'),
+    readPackageVersion(path.join(cwd, 'node_modules', 'securenow', 'node_modules', '@opentelemetry', 'api', 'package.json'), 'nested under securenow'),
+    resolvePackageJson(packageName, [cwd], 'resolved from project'),
+    resolvePackageJson(packageName, [path.resolve(__dirname, '..')], 'resolved from securenow CLI'),
+  ].filter(Boolean);
+
+  const byPath = new Map();
+  for (const item of candidates) {
+    if (!byPath.has(item.path)) byPath.set(item.path, { ...item, labels: [item.label] });
+    else byPath.get(item.path).labels.push(item.label);
+  }
+
+  return [...byPath.values()].map(({ label, labels, ...rest }) => ({
+    ...rest,
+    label: labels.join(', '),
+  }));
+}
+
+function otelApiSingletonCheck() {
+  const packages = collectOtelApiPackages();
+  const versions = [...new Set(packages.map((p) => p.version).filter(Boolean))];
+  return {
+    name: 'otel-api-singleton',
+    ok: versions.length <= 1,
+    versions,
+    packages,
+    ...(versions.length > 1 ? {
+      error: `Multiple @opentelemetry/api versions detected (${versions.join(', ')}). This can leave tracing on the NoopTracerProvider.`,
+    } : {}),
+  };
+}
+
 function maskSecret(value) {
   if (!value) return '';
   const text = String(value);
@@ -308,6 +373,7 @@ function env(_args, flags) {
     firewallApiKey: cfg.apiKey ? `${cfg.apiKey.slice(0, 12)}...` : null,
     apiUrl: cfg.apiUrl,
     loggingEnabled: cfg.loggingEnabled,
+    otelLogLevel: cfg.otelLogLevel,
     captureBody: cfg.captureBody,
     captureMultipart: cfg.captureMultipart,
     noUuid: appConfig.resolveNoUuid(),
@@ -326,6 +392,7 @@ function env(_args, flags) {
     ['Environment', cfg.deploymentEnvironment],
     ['Traces endpoint', cfg.tracesEndpoint],
     ['Logs endpoint', cfg.logsEndpoint],
+    ['OTel diagnostics', cfg.otelLogLevel],
     ['Logging', cfg.loggingEnabled ? ui.c.green('enabled') : ui.c.dim('disabled')],
     ['Body capture', cfg.captureBody ? ui.c.green('enabled') : ui.c.dim('disabled')],
     ['Multipart capture', cfg.captureMultipart ? ui.c.green('enabled') : ui.c.dim('disabled')],
@@ -342,6 +409,8 @@ function env(_args, flags) {
 async function doctor(_args, flags) {
   const cfg = resolvedConfig();
   const checks = [];
+  const otelApiCheck = otelApiSingletonCheck();
+  checks.push(otelApiCheck);
 
   const jsonHeaders = { 'Content-Type': 'application/json', ...cfg.headers };
 
@@ -386,6 +455,15 @@ async function doctor(_args, flags) {
   }
 
   const warnings = [];
+  const singletonOkMessage = otelApiCheck.ok && otelApiCheck.packages.length
+    ? `OpenTelemetry API singleton OK (${otelApiCheck.versions[0] || 'unknown'})`
+    : null;
+  if (!otelApiCheck.ok) {
+    warnings.push(`${otelApiCheck.error} Align the app and SecureNow to one 1.9.x copy, then reinstall.`);
+  }
+  if (String(cfg.otelLogLevel || '').toLowerCase() === 'none') {
+    warnings.push('OpenTelemetry diagnostic log level is `none`; provider registration/export errors are hidden. Set config.otel.logLevel to `error`/`warn`, or temporarily run with OTEL_LOG_LEVEL=debug.');
+  }
   if (!cfg.appKey) {
     warnings.push('No app key resolved. Run `npx securenow login` or set app.key in .securenow/credentials.json.');
   }
@@ -410,6 +488,8 @@ async function doctor(_args, flags) {
     for (const w of warnings) ui.warn(w);
   }
 
+  if (singletonOkMessage) ui.success(singletonOkMessage);
+
   console.log('');
   if (ok) ui.success('All checks passed.');
   else ui.error('One or more checks failed. Run with --json for details.');

package/console-instrumentation.js

@@ -43,13 +43,14 @@ if (console.__securenow_patched) {
 }
 
 // Store original console methods
-const originalConsole = {
+const originalConsole = console.__securenow_original || {
   log: console.log,
   info: console.info,
   warn: console.warn,
   error: console.error,
   debug: console.debug,
 };
+if (!console.__securenow_original) console.__securenow_original = originalConsole;
 
 // Map severity levels (OpenTelemetry standard)
 const SeverityNumber = {

package/firewall.js

@@ -10,9 +10,10 @@ let _matcher = null;
 let _syncTimer = null;
 let _pollTimer = null;
 let _lastModified = null;
-let _lastVersion = null;
-let _lastSyncEtag = null;
-let _initialized = false;
+let _lastVersion = null;
+let _lastSyncEtag = null;
+let _lastUnifiedEtag = null;
+let _initialized = false;
 let _consecutiveErrors = 0;
 let _layers = [];
 let _rawIps = [];
@@ -21,7 +22,7 @@ let _localhostFallbackTried = false;
 let _eventQueue = [];
 let _eventTimer = null;
 
-// Remote toggle — set by /firewall/sync when an appKey is in scope. Default
+// Remote toggle - set by /firewall/sync when an appKey is in scope. Default
 // true so a missing/unreachable backend fails open (matches pre-7.3 behavior).
 // When the dashboard / CLI flips this off, the next poll suppresses
 // enforcement without restarting the host process.
@@ -56,9 +57,29 @@ const EVENT_QUEUE_MAX = 1_000;
 const TRANSIENT_NETWORK_CODES = new Set(['ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'EAI_AGAIN']);
 
 // Unified sync uses /firewall/sync (v2). Falls back to legacy on 404.
-let _useUnifiedSync = true;
+let _useUnifiedSync = true;
+
+function originalConsoleMethod(method) {
+  const originals = console.__securenow_original || console.__securenowOriginalConsole;
+  return (originals && originals[method]) || console[method] || console.log;
+}
+
+function firewallConsole(method, ...args) {
+  if (!_options || !_options.log) return;
+  try {
+    originalConsoleMethod(method).apply(console, args);
+  } catch (_) {}
+}
+
+function fwLog(...args) {
+  firewallConsole('log', ...args);
+}
+
+function fwWarn(...args) {
+  firewallConsole('warn', ...args);
+}
 
-// ────── Circuit Breaker ──────
+// Circuit Breaker
 
 function maybeOpenCircuit() {
   if (_circuitState === 'open') return;
@@ -66,7 +87,7 @@ function maybeOpenCircuit() {
     _circuitState = 'open';
     _circuitOpenedAt = Date.now();
     if (_options && _options.log) {
-      console.warn('[securenow] Firewall: circuit breaker OPEN — pausing polling for %ds', CIRCUIT_OPEN_COOLDOWN_MS / 1000);
+      fwWarn('[securenow] Firewall: circuit breaker OPEN - pausing polling for %ds', CIRCUIT_OPEN_COOLDOWN_MS / 1000);
     }
   }
 }
@@ -74,7 +95,7 @@ function maybeOpenCircuit() {
 function resetCircuit() {
   if (_circuitState !== 'closed') {
     _circuitState = 'closed';
-    if (_options && _options.log) console.log('[securenow] Firewall: circuit breaker CLOSED — API healthy');
+    if (_options && _options.log) fwLog('[securenow] Firewall: circuit breaker CLOSED - API healthy');
   }
   _consecutiveErrors = 0;
 }
@@ -99,12 +120,12 @@ function handleRetryAfter(res) {
   if (secs > 0 && secs <= 300) {
     _retryAfterUntil = Date.now() + secs * 1000;
     if (_options && _options.log) {
-      console.warn('[securenow] Firewall: API returned 429, backing off for %ds', secs);
+      fwWarn('[securenow] Firewall: API returned 429, backing off for %ds', secs);
     }
   }
 }
 
-// ────── HTTP helpers ──────
+// HTTP helpers
 
 function buildUrl(apiUrl, path) {
   return apiUrl.replace(/\/+$/, '') + '/api/v1' + path;
@@ -193,7 +214,7 @@ function requestWithRetry(method, url, body, extraHeaders, timeout, callback) {
     if (!err || !isTransientNetworkError(err)) return callback(err, res, data);
 
     if (_options && _options.log) {
-      console.warn('[securenow] Firewall: transient API socket error, retrying once:', formatRequestError(err));
+      fwWarn('[securenow] Firewall: transient API socket error, retrying once:', formatRequestError(err));
     }
 
     const retryTimer = setTimeout(() => {
@@ -234,7 +255,7 @@ function flushFirewallEvents() {
     if (err || !res || res.statusCode >= 400) {
       if (_options.log) {
         const msg = err ? formatRequestError(err) : `API returned ${res.statusCode}`;
-        console.warn('[securenow] Firewall: failed to report blocked-request ledger:', msg);
+        fwWarn('[securenow] Firewall: failed to report blocked-request ledger:', msg);
       }
     }
     if (_eventQueue.length) scheduleEventFlush();
@@ -262,7 +283,7 @@ function reportFirewallEvent(event) {
   else scheduleEventFlush();
 }
 
-// ────── Unified Sync (v2 — single request for everything) ──────
+// Unified Sync (v2 - single request for everything)
 
 function doUnifiedSync(callback) {
   const query = new URLSearchParams();
@@ -272,21 +293,23 @@ function doUnifiedSync(callback) {
   const url = buildUrl(_options.apiUrl, '/firewall/sync') + suffix;
   const headers = {};
   if (_options.environment) headers['X-SecureNow-Environment'] = _options.environment;
-  if (_lastVersion) headers['X-Blocklist-Version'] = _lastVersion;
-  if (_lastAllowlistVersion) headers['X-Allowlist-Version'] = _lastAllowlistVersion;
-
-  httpGet(url, headers, 8000, (err, res, data) => {
-    if (err) return callback(err);
-
-    _stats.versionChecks++;
-
-    if (res.statusCode === 304) {
-      return callback(null, { blChanged: false, alChanged: false });
+  if (_lastVersion) headers['X-Blocklist-Version'] = _lastVersion;
+  if (_lastAllowlistVersion) headers['X-Allowlist-Version'] = _lastAllowlistVersion;
+  if (_lastUnifiedEtag) headers['If-None-Match'] = _lastUnifiedEtag;
+
+  httpGet(url, headers, 8000, (err, res, data) => {
+    if (err) return callback(err);
+
+    _stats.versionChecks++;
+    if (res.headers && res.headers.etag) _lastUnifiedEtag = res.headers.etag;
+
+    if (res.statusCode === 304) {
+      return callback(null, { blChanged: false, alChanged: false });
     }
 
     if (res.statusCode === 404) {
       _useUnifiedSync = false;
-      if (_options.log) console.log('[securenow] Firewall: /sync not available, using legacy endpoints');
+      if (_options.log) fwLog('[securenow] Firewall: /sync not available, using legacy endpoints');
       return callback(null, { blChanged: false, alChanged: false, useLegacy: true });
     }
 
@@ -304,30 +327,29 @@ function doUnifiedSync(callback) {
 
       // Apply remote per-app toggle. Absent body.app means the backend either
       // doesn't know about appKey-scoped sync (older API) or no appKey was
-      // sent — leave the previous value untouched (default true on first run).
+      // sent - leave the previous value untouched (default true on first run).
       if (body.app && typeof body.app.firewallEnabled === 'boolean') {
         const next = body.app.firewallEnabled;
         if (next !== _lastRemoteEnabled) {
           _remoteEnabled = next;
           if (_options.log) {
-            console.log('[securenow] Firewall: remote toggle → %s (app=%s)',
+            fwLog('[securenow] Firewall: remote toggle -> %s (app=%s)',
               next ? 'ENABLED' : 'DISABLED', body.app.key || _options.appKey);
           }
           _lastRemoteEnabled = next;
         }
       }
 
-      // Update blocklist version + data
-      if (body.blocklist) {
-        const newVer = body.blocklist.version;
-        if (newVer !== _lastVersion) {
-          _lastVersion = newVer;
-          blChanged = true;
-        }
-      }
-
-      if (body.blocklistIps) {
-        _rawIps = body.blocklistIps;
+      // Update blocklist version + data
+      if (body.blocklist) {
+        const newVer = body.blocklist.version;
+        if (newVer !== _lastVersion) {
+          _lastVersion = newVer;
+        }
+      }
+
+      if (body.blocklistIps) {
+        _rawIps = body.blocklistIps;
         _matcher = createMatcher(body.blocklistIps);
         _stats.syncs++;
         notifyLayers(body.blocklistIps);
@@ -335,13 +357,12 @@ function doUnifiedSync(callback) {
       }
 
       // Update allowlist version + data
-      if (body.allowlist) {
-        const newVer = body.allowlist.version;
-        if (newVer !== _lastAllowlistVersion) {
-          _lastAllowlistVersion = newVer;
-          alChanged = true;
-        }
-      }
+      if (body.allowlist) {
+        const newVer = body.allowlist.version;
+        if (newVer !== _lastAllowlistVersion) {
+          _lastAllowlistVersion = newVer;
+        }
+      }
 
       if (body.allowlistIps) {
         _allowlistRawIps = body.allowlistIps;
@@ -356,7 +377,7 @@ function doUnifiedSync(callback) {
   });
 }
 
-// ────── Legacy Sync (v1 — separate endpoints, kept for backward compat) ──────
+// Legacy Sync (v1 - separate endpoints, kept for backward compat)
 
 function legacyBlocklistSync(callback) {
   const url = buildFirewallUrl('/firewall/blocklist');
@@ -481,15 +502,15 @@ function doLegacyPoll(callback) {
 
     if (blChanged) {
       legacyBlocklistSync((err, changed, stats) => {
-        if (err && _options.log) console.warn('[securenow] Firewall: sync failed (using stale list):', formatRequestError(err));
-        else if (changed && stats && _options.log) console.log('[securenow] Firewall: re-synced %d blocked IPs', stats.total);
+        if (err && _options.log) fwWarn('[securenow] Firewall: sync failed (using stale list):', formatRequestError(err));
+        else if (changed && stats && _options.log) fwLog('[securenow] Firewall: re-synced %d blocked IPs', stats.total);
         syncDone();
       });
     }
     if (alChanged) {
       legacyAllowlistSync((err, changed, stats) => {
-        if (err && _options.log) console.warn('[securenow] Firewall: allowlist sync failed:', formatRequestError(err));
-        else if (changed && stats && _options.log) console.log('[securenow] Firewall: re-synced %d allowed IPs', stats.total);
+        if (err && _options.log) fwWarn('[securenow] Firewall: allowlist sync failed:', formatRequestError(err));
+        else if (changed && stats && _options.log) fwLog('[securenow] Firewall: re-synced %d allowed IPs', stats.total);
         syncDone();
       });
     }
@@ -508,7 +529,7 @@ function doLegacyPoll(callback) {
   });
 }
 
-// ────── Unified poll loop ──────
+// Unified poll loop
 
 function notifyLayers(ips) {
   for (const layer of _layers) {
@@ -526,7 +547,7 @@ function pollOnce(callback) {
       _consecutiveErrors++;
       _stats.errors++;
       maybeOpenCircuit();
-      if (_options.log) console.warn('[securenow] Firewall: poll failed:', formatRequestError(err));
+      if (_options.log) fwWarn('[securenow] Firewall: poll failed:', formatRequestError(err));
       return callback(err);
     }
     _consecutiveErrors = 0;
@@ -534,11 +555,11 @@ function pollOnce(callback) {
     if (result) {
       if (result.blChanged && _options.log && _matcher) {
         const s = _matcher.stats();
-        console.log('[securenow] Firewall: re-synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        fwLog('[securenow] Firewall: re-synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
       if (result.alChanged && _options.log && _allowlistMatcher) {
         const s = _allowlistMatcher.stats();
-        console.log('[securenow] Firewall: re-synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        fwLog('[securenow] Firewall: re-synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
     }
     callback(null);
@@ -586,7 +607,7 @@ function startSyncLoop() {
           _localhostFallbackTried = true;
           const origUrl = _options.apiUrl;
           _options.apiUrl = 'http://localhost:4000';
-          if (_options.log) console.log('[securenow] Firewall: %s unreachable, trying http://localhost:4000', origUrl);
+          if (_options.log) fwLog('[securenow] Firewall: %s unreachable, trying http://localhost:4000', origUrl);
           const retryTimer = setTimeout(initialSync, 1000);
           if (retryTimer.unref) retryTimer.unref();
           return;
@@ -596,7 +617,7 @@ function startSyncLoop() {
           if (retryTimer.unref) retryTimer.unref();
           return;
         }
-        if (_options.log) console.warn('[securenow] Firewall: initial sync failed:', formatRequestError(err));
+        if (_options.log) fwWarn('[securenow] Firewall: initial sync failed:', formatRequestError(err));
         if (_options.failMode === 'closed') {
           _matcher = { isBlocked: () => true, stats: () => ({ exact: 0, cidr: 0, total: 0 }) };
         }
@@ -616,11 +637,11 @@ function startSyncLoop() {
       _initialized = true;
       if (_options.log && _matcher) {
         const s = _matcher.stats();
-        console.log('[securenow] Firewall: synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        fwLog('[securenow] Firewall: synced %d blocked IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
       if (_options.log && _allowlistMatcher) {
         const s = _allowlistMatcher.stats();
-        if (s.total > 0) console.log('[securenow] Firewall: synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
+        if (s.total > 0) fwLog('[securenow] Firewall: synced %d allowed IPs (%d exact + %d CIDR ranges)', s.total, s.exact, s.cidr);
       }
     });
   }
@@ -631,22 +652,25 @@ function startSyncLoop() {
   // Safety-net full sync timer (less frequent, uses same path)
   _syncTimer = setInterval(() => {
     if (shouldSkipRequest()) return;
-    // Force a full re-fetch by clearing versions so unified endpoint returns full data
-    const savedBlVer = _lastVersion;
-    const savedAlVer = _lastAllowlistVersion;
-    _lastVersion = null;
-    _lastAllowlistVersion = null;
-    pollOnce((err) => {
-      if (err) {
-        _lastVersion = savedBlVer;
-        _lastAllowlistVersion = savedAlVer;
-      }
-    });
-  }, fullSyncIntervalMs);
+    // Force a full re-fetch by clearing versions so unified endpoint returns full data
+    const savedBlVer = _lastVersion;
+    const savedAlVer = _lastAllowlistVersion;
+    const savedUnifiedEtag = _lastUnifiedEtag;
+    _lastVersion = null;
+    _lastAllowlistVersion = null;
+    _lastUnifiedEtag = null;
+    pollOnce((err) => {
+      if (err) {
+        _lastVersion = savedBlVer;
+        _lastAllowlistVersion = savedAlVer;
+        _lastUnifiedEtag = savedUnifiedEtag;
+      }
+    });
+  }, fullSyncIntervalMs);
   if (_syncTimer.unref) _syncTimer.unref();
 }
 
-// ────── Layer 1: HTTP Handler ──────
+// Layer 1: HTTP Handler
 
 const _origHttpCreate = http.createServer;
 const _origHttpsCreate = https.createServer;
@@ -658,7 +682,7 @@ function blockedHtml(ip) {
 <html lang="en">
 <head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Access Blocked — Security Alert</title>
+<title>Access Blocked - Security Alert</title>
 <style>
 *{margin:0;padding:0;box-sizing:border-box}
 body{min-height:100vh;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#0a0a0a;color:#e5e5e5}
@@ -729,7 +753,7 @@ function firewallRequestHandler(req, res) {
   if (_allowlistMatcher && _allowlistMatcher.stats().total > 0) {
     if (!_allowlistMatcher.isBlocked(ip)) {
       _stats.blocked++;
-      if (_options && _options.log) console.log('[securenow] Firewall: blocked %s via HTTP (not in allowlist)', ip);
+      if (_options && _options.log) fwLog('[securenow] Firewall: blocked %s via HTTP (not in allowlist)', ip);
       reportFirewallEvent({
         source: 'allowlist',
         ip,
@@ -747,7 +771,7 @@ function firewallRequestHandler(req, res) {
   // Blocklist check
   if (_matcher && _matcher.isBlocked(ip)) {
     _stats.blocked++;
-    if (_options && _options.log) console.log('[securenow] Firewall: blocked %s via HTTP', ip);
+    if (_options && _options.log) fwLog('[securenow] Firewall: blocked %s via HTTP', ip);
     reportFirewallEvent({
       source: 'blocklist',
       ip,
@@ -801,28 +825,28 @@ function patchHttpLayer() {
   Object.assign(https.createServer, _origHttpsCreate);
 }
 
-// ────── Init ──────
+// Init
 
 function init(options) {
   _options = options;
 
-  if (_options.log) console.log('[securenow] Firewall: ENABLED');
-  if (_options.log && _options.environment) console.log('[securenow] Firewall: environment=%s', _options.environment);
+  if (_options.log) fwLog('[securenow] Firewall: ENABLED');
+  if (_options.log && _options.environment) fwLog('[securenow] Firewall: environment=%s', _options.environment);
 
   patchHttpLayer();
-  if (_options.log) console.log('[securenow] Firewall: Layer 1 (HTTP 403)      active');
+  if (_options.log) fwLog('[securenow] Firewall: Layer 1 (HTTP 403)      active');
 
   if (_options.tcp) {
     try {
       const tcpLayer = require('./firewall-tcp');
       tcpLayer.init(() => _matcher, _options, () => _allowlistMatcher);
       _layers.push(tcpLayer);
-      if (_options.log) console.log('[securenow] Firewall: Layer 2 (TCP drop)       active');
+      if (_options.log) fwLog('[securenow] Firewall: Layer 2 (TCP drop)       active');
     } catch (e) {
-      if (_options.log) console.warn('[securenow] Firewall: Layer 2 (TCP drop)       failed:', e.message);
+      if (_options.log) fwWarn('[securenow] Firewall: Layer 2 (TCP drop)       failed:', e.message);
     }
   } else {
-    if (_options.log) console.log('[securenow] Firewall: Layer 2 (TCP drop)       disabled (set config.firewall.tcp=true)');
+    if (_options.log) fwLog('[securenow] Firewall: Layer 2 (TCP drop)       disabled (set config.firewall.tcp=true)');
   }
 
   if (_options.iptables) {
@@ -830,12 +854,12 @@ function init(options) {
       const iptablesLayer = require('./firewall-iptables');
       iptablesLayer.init(_options);
       _layers.push(iptablesLayer);
-      if (_options.log) console.log('[securenow] Firewall: Layer 3 (iptables)       active');
+      if (_options.log) fwLog('[securenow] Firewall: Layer 3 (iptables)       active');
     } catch (e) {
-      if (_options.log) console.warn('[securenow] Firewall: Layer 3 (iptables)       failed:', e.message);
+      if (_options.log) fwWarn('[securenow] Firewall: Layer 3 (iptables)       failed:', e.message);
     }
   } else {
-    if (_options.log) console.log('[securenow] Firewall: Layer 3 (iptables)       disabled (set config.firewall.iptables=true)');
+    if (_options.log) fwLog('[securenow] Firewall: Layer 3 (iptables)       disabled (set config.firewall.iptables=true)');
   }
 
   if (_options.cloud) {
@@ -843,12 +867,12 @@ function init(options) {
       const cloudLayer = require('./firewall-cloud');
       cloudLayer.init(_options);
       _layers.push(cloudLayer);
-      if (_options.log) console.log('[securenow] Firewall: Layer 4 (Cloud WAF)      active (%s)', _options.cloud);
+      if (_options.log) fwLog('[securenow] Firewall: Layer 4 (Cloud WAF)      active (%s)', _options.cloud);
     } catch (e) {
-      if (_options.log) console.warn('[securenow] Firewall: Layer 4 (Cloud WAF)      failed:', e.message);
+      if (_options.log) fwWarn('[securenow] Firewall: Layer 4 (Cloud WAF)      failed:', e.message);
     }
   } else {
-    if (_options.log) console.log('[securenow] Firewall: Layer 4 (Cloud WAF)      disabled (set config.firewall.cloud=cloudflare|aws|gcp)');
+    if (_options.log) fwLog('[securenow] Firewall: Layer 4 (Cloud WAF)      disabled (set config.firewall.cloud=cloudflare|aws|gcp)');
   }
 
   startSyncLoop();
@@ -907,4 +931,4 @@ function getMatcher() { return _remoteEnabled === false ? null : _matcher; }
 function getAllowlistMatcher() { return _remoteEnabled === false ? null : _allowlistMatcher; }
 function isRemoteEnabled() { return _remoteEnabled !== false; }
 
-module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, isRemoteEnabled };
+module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, isRemoteEnabled };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "7.7.3",
+  "version": "7.7.5",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -141,7 +141,7 @@
     "SKILL-API.md"
   ],
   "dependencies": {
-    "@opentelemetry/api": "1.9.1",
+    "@opentelemetry/api": ">=1.9.0 <1.10.0",
     "@opentelemetry/api-logs": "0.218.0",
     "@opentelemetry/auto-instrumentations-node": "0.76.0",
     "@opentelemetry/core": "2.7.1",

package/tracing.js

@@ -21,7 +21,7 @@
  *   OTEL_EXPORTER_OTLP_HEADERS="k=v,k2=v2"
  *   SECURENOW_DISABLE_INSTRUMENTATIONS="pkg1,pkg2"
  *   SECURENOW_CAPTURE_MULTIPART=1                # capture multipart/form-data fields & file metadata (streaming, no file content buffered)
- *   OTEL_LOG_LEVEL=info|debug
+ *   OTEL_LOG_LEVEL=error|warn|info|debug|none
  *   SECURENOW_TEST_SPAN=1
  *
  * Safety:
@@ -264,7 +264,7 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
 })();
 
 // -------- diagnostics --------
-const diagLevel = (env('OTEL_LOG_LEVEL') || '').toLowerCase();
+const diagLevel = ((process.env.OTEL_LOG_LEVEL != null ? process.env.OTEL_LOG_LEVEL : env('OTEL_LOG_LEVEL')) || '').toLowerCase();
 (() => {
   const level = diagLevel === 'debug' ? DiagLogLevel.DEBUG :
                 diagLevel === 'info'  ? DiagLogLevel.INFO  :
@@ -521,7 +521,8 @@ if (loggingEnabled) {
 
   // Auto-patch console.* so every log/warn/error becomes an OTel log record
   const _logger = loggerProvider.getLogger('console', '1.0.0');
-  const _orig = { log: console.log, info: console.info, warn: console.warn, error: console.error, debug: console.debug };
+  const _orig = console.__securenow_original || { log: console.log, info: console.info, warn: console.warn, error: console.error, debug: console.debug };
+  if (!console.__securenow_original) console.__securenow_original = _orig;
   const SEV = { DEBUG: 5, INFO: 9, WARN: 13, ERROR: 17 };
   function _emit(sn, st, args) {
     try {