securenow 8.12.1 → 8.12.3

package/README.md

@@ -111,6 +111,8 @@ npx securenow doctor         # diagnose config + connectivity
 npx securenow status         # dashboard summary
 ```
 
+**Tests** — test runs otherwise report to your real app with the project's `.securenow` credentials. `SECURENOW_DISABLED=1 npm test` turns the SDK off for that process: no traces, logs, events, firewall or session sync, and `guard()` just calls `next()`. This is the only setting read from the environment.
+
 ---
 
 ## Connect your coding agent (MCP)

package/cli/automation.js

@@ -198,18 +198,20 @@ async function dryRun(args, flags) {
     ui.keyValue([
       ['Scanned IPs', String(results.scanned ?? 0)],
       ['Matched IPs', String(results.matched ?? 0)],
+      ...(results.testModeMatched != null ? [['Test-mode matches', `${results.testModeMatched} (preview only: never acted on until the rule is promoted)`]] : []),
       ['Sample count', String((results.samples || []).length)],
     ]);
     if ((results.samples || []).length) {
       console.log('');
       const rows = results.samples.map((sample) => [
         sample.ip,
+        ui.truncate([].concat(sample.alertName || []).slice(-1).join(''), 40),
         ui.truncate((sample.path || []).join(', '), 32),
-        ui.truncate((sample.attackType || []).join(', '), 28),
         (sample.environment || []).join(', ') || '-',
         String(sample.riskScore ?? '-'),
+        sample.testMode ? 'test' : 'prod',
       ]);
-      ui.table(['IP', 'Paths', 'Attack', 'Env', 'Risk'], rows);
+      ui.table(['IP', 'Alert', 'Paths', 'Env', 'Risk', 'Mode'], rows);
     }
     console.log('');
   } catch (err) {

package/cli/threatModel.js

@@ -0,0 +1,80 @@
+'use strict';
+
+// `securenow threat-model <category>` — print the copy-paste threat-modeling prompt for a category,
+// fetched from the published set at securenow.ai (the same prompt shown on securenow.ai/threat-modeling).
+// Pipe it straight into your coding agent:
+//   claude -p "$(npx securenow threat-model authentication)"
+// or save it:  npx securenow threat-model authentication --out prompt.md
+const fs = require('fs');
+const ui = require('./ui');
+
+const BASE = process.env.SECURENOW_THREAT_PROMPTS_URL || 'https://securenow.ai/threat-prompts';
+
+// Published categories (slugs). Aliases map common shorthands to the slug.
+const CATEGORIES = [
+  'authentication', 'authorization', 'xss-csrf-cors', 'client-side-supply-chain', 'injection',
+  'oauth-sso-integrations', 'admin-support-tools', 'payment-business-logic', 'file-upload-download',
+  'messaging-notifications', 'rate-limits-and-abuse', 'legacy-endpoints', 'api-security', 'graphql-security',
+  'webhooks', 'realtime-websocket-sse', 'serverless-and-edge', 'cloud-infrastructure', 'secrets-and-cloud-iam',
+  'dns-tls-certificates', 'supply-chain-cicd', 'storage-and-logs', 'data-privacy-pii', 'ai-llm-features',
+  'secrets-and-api-key-hygiene',
+];
+const ALIASES = { auth: 'authentication', authz: 'authorization', oauth: 'oauth-sso-integrations', sso: 'oauth-sso-integrations', api: 'api-security', graphql: 'graphql-security', uploads: 'file-upload-download', upload: 'file-upload-download', xss: 'xss-csrf-cors', csrf: 'xss-csrf-cors', cors: 'xss-csrf-cors', rate: 'rate-limits-and-abuse', 'rate-limits': 'rate-limits-and-abuse', secrets: 'secrets-and-api-key-hygiene', privacy: 'data-privacy-pii', pii: 'data-privacy-pii', ai: 'ai-llm-features', llm: 'ai-llm-features' };
+
+function resolveSlug(input) {
+  const raw = String(input || '').trim().toLowerCase().replace(/\.md$/, '').replace(/^\d+[-_]/, '');
+  if (!raw) return null;
+  if (CATEGORIES.includes(raw)) return raw;
+  if (ALIASES[raw]) return ALIASES[raw];
+  return null;
+}
+
+function listCategories() {
+  ui.heading('SecureNow threat-modeling prompts');
+  console.log('  Copy-paste a prompt into your coding agent, or run it with the SecureNow CLI.\n');
+  for (const slug of CATEGORIES) console.log('    ' + slug);
+  console.log('\n  Print one:  securenow threat-model authentication');
+  console.log('  Pipe it:    claude -p "$(securenow threat-model authentication)"');
+  console.log('  Save it:    securenow threat-model authentication --out prompt.md');
+  console.log('  On the web: securenow.ai/threat-modeling');
+}
+
+async function run(args, flags = {}) {
+  const category = args[0];
+  if (flags.list || (!category && !flags.all)) {
+    if (!category && !flags.list) ui.info('Pick a category (or --list to see them all):\n');
+    listCategories();
+    return;
+  }
+
+  const slug = resolveSlug(category);
+  if (!slug) {
+    ui.error(`Unknown category "${category}". Run "securenow threat-model --list" to see the ${CATEGORIES.length} categories.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const url = `${BASE}/${slug}.md`;
+  let text;
+  try {
+    const res = await fetch(url, { headers: { accept: 'text/markdown, text/plain' } });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    text = await res.text();
+  } catch (err) {
+    ui.error(`Could not fetch the ${slug} prompt (${err.message}). Open securenow.ai/threat-modeling/${slug} in a browser instead.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (flags.out) {
+    fs.writeFileSync(flags.out, text);
+    ui.success(`Saved the ${slug} threat-model prompt to ${flags.out} (${text.length.toLocaleString()} chars).`);
+    ui.info('Open it with your coding agent at the root of a project that has the securenow SDK installed.');
+    return;
+  }
+
+  // Default: raw prompt to stdout so it pipes cleanly into an agent.
+  process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+}
+
+module.exports = { run, resolveSlug, CATEGORIES, ALIASES };

package/cli/ui.js

@@ -182,10 +182,19 @@ function prompt(question, opts = {}) {
 
   return new Promise((resolve) => {
     const q = opts.secret ? question : `  ${c.cyan('?')} ${question} `;
+    let answered = false;
     rl.question(q, (answer) => {
+      answered = true;
       rl.close();
       resolve(answer.trim());
     });
+    // stdin closed without an answer (EOF, /dev/null, a coding agent's shell): resolve empty instead of
+    // leaving the promise pending until the process silently exits.
+    rl.once('close', () => {
+      if (answered) return;
+      process.stderr.write('\n');
+      resolve('');
+    });
 
     if (opts.secret) {
       const onData = (char) => {
@@ -202,7 +211,15 @@ function prompt(question, opts = {}) {
 async function confirm(question, defaultYes = false) {
   const hint = defaultYes ? 'Y/n' : 'y/N';
   const answer = await prompt(`${question} ${c.dim(`(${hint})`)}`);
-  if (!answer) return defaultYes;
+  if (!answer) {
+    // A script or coding agent has no terminal to answer from: say so and exit non-zero instead of
+    // silently cancelling the write with exit code 0.
+    if (!defaultYes && !process.stdin.isTTY) {
+      error('No confirmation received (non-interactive shell). Re-run with --yes to confirm.');
+      process.exitCode = 1;
+    }
+    return defaultYes;
+  }
   return answer.toLowerCase().startsWith('y');
 }
 

package/cli.js

@@ -671,6 +671,12 @@ const COMMANDS = {
     rawArgv: true,
     run: (rawArgs) => require('./cli/run').run(rawArgs),
   },
+  'threat-model': {
+    desc: 'Print a copy-paste threat-modeling prompt for a category (pipe it into your coding agent)',
+    usage: 'securenow threat-model <authentication|authorization|…|--list> [--out prompt.md]',
+    flags: { list: 'List all threat-modeling categories', out: 'Write the prompt to a file instead of stdout' },
+    run: (a, f) => require('./cli/threatModel').run(a, f),
+  },
   redact: {
     desc: 'Redact sensitive fields and OTP codes from a JSON payload',
     usage: "securenow redact '<json>' [--fields f1,f2] [--json]",
@@ -822,7 +828,7 @@ function showHelp(commandName) {
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],
     'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
-    'Utilities': ['redact', 'cidr', 'doctor', 'env', 'mcp'],
+    'Utilities': ['threat-model', 'redact', 'cidr', 'doctor', 'env', 'mcp'],
     'Settings': ['instances', 'config', 'version'],
   };
 

package/console-instrumentation.js

@@ -64,18 +64,7 @@ const SeverityNumber = {
  * Format arguments into a log message
  */
 function formatMessage(args) {
-  return args
-    .map((arg) => {
-      if (typeof arg === 'object' && arg !== null) {
-        try {
-          return JSON.stringify(arg);
-        } catch (e) {
-          return String(arg);
-        }
-      }
-      return String(arg);
-    })
-    .join(' ');
+  return require('./log-format').formatLogArgs(args);
 }
 
 const { context, trace } = require('@opentelemetry/api');

package/events.js

@@ -139,6 +139,7 @@ function normalizeEvent(type, props) {
  */
 function track(type, props = {}) {
   try {
+    if (require('./sdk-disabled').sdkDisabled()) return;
     const ev = normalizeEvent(type, props);
     if (!ev) return;
     buffer.push(ev);

package/firewall-only.js

@@ -2,6 +2,8 @@
 
 // Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
 if (require('./internal-thread').inInternalThread()) return;
+// SECURENOW_DISABLED=1 turns the SDK off for this process (test runs).
+if (require('./sdk-disabled').sdkDisabled('firewall')) return;
 
 /**
  * Standalone firewall preload — no OpenTelemetry, no tracing.

package/firewall-paths.js

@@ -0,0 +1,46 @@
+'use strict';
+
+// Route matching for firewall block, rate-limit and challenge rules.
+//
+// Many servers answer more than one spelling of a path: Express 5 routes case-insensitively and ignores
+// a trailing slash, so POST /API/AUTH/LOGIN/ reaches the /api/auth/login handler. A rule matched only
+// against the raw path let those aliases walk past a route-scoped block. Rules now also match the
+// canonical form (percent-decoded, lower-case, duplicate slashes collapsed; exact rules also ignore a
+// trailing slash). Every caller enforces (block / rate-limit / challenge), so matching more spellings
+// is the safe direction.
+
+function normalizePrefixPattern(pattern) {
+  const value = String(pattern || '').trim();
+  if (!value) return '';
+  return value.endsWith('*') ? value.slice(0, -1) : value;
+}
+
+function canonicalPath(path, { stripTrailingSlash = false } = {}) {
+  let value = String(path || '/');
+  try { value = decodeURIComponent(value); } catch (_) { /* keep the raw spelling */ }
+  value = value.toLowerCase().replace(/\/{2,}/g, '/');
+  if (stripTrailingSlash && value.length > 1) value = value.replace(/\/+$/, '') || '/';
+  return value || '/';
+}
+
+function rulePathMatches(rule, path) {
+  const pattern = String((rule && rule.pathPattern) || '').trim();
+  if (!pattern) return true;
+  const mode = (rule && rule.pathMatchMode) || 'prefix';
+  if (mode === 'regex') {
+    try {
+      const re = new RegExp(pattern);
+      return re.test(path) || re.test(canonicalPath(path, { stripTrailingSlash: true }));
+    } catch (_) {
+      return false;
+    }
+  }
+  if (mode === 'exact') {
+    return path === pattern
+      || canonicalPath(path, { stripTrailingSlash: true }) === canonicalPath(pattern, { stripTrailingSlash: true });
+  }
+  const prefix = normalizePrefixPattern(pattern);
+  return path.startsWith(prefix) || canonicalPath(path).startsWith(canonicalPath(prefix));
+}
+
+module.exports = { canonicalPath, normalizePrefixPattern, rulePathMatches };

package/firewall.js

@@ -911,16 +911,8 @@ function ruleIpMatches(rule, ip) {
   }
 }
 
-function rulePathMatches(rule, path) {
-  const pattern = String(rule.pathPattern || '').trim();
-  if (!pattern) return true;
-  const mode = rule.pathMatchMode || 'prefix';
-  if (mode === 'exact') return path === pattern;
-  if (mode === 'regex') {
-    try { return new RegExp(pattern).test(path); } catch (_) { return false; }
-  }
-  return path.startsWith(normalizePrefixPattern(pattern));
-}
+// Matches the raw path and its canonical aliases (case, trailing/duplicate slashes, percent-encoding).
+const { rulePathMatches } = require('./firewall-paths');
 
 function rateLimitKey(rule, ip) {
   const id = rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`;

package/log-format.js

@@ -0,0 +1,28 @@
+'use strict';
+
+// Body of an exported console log record, matching what the terminal shows.
+// - A first string argument with printf-style placeholders (%s %d %i %f %j %o %O %c %%) is formatted
+//   like console.log does (util.format), so "%d users" becomes "3 users" instead of "%d users 3".
+// - Errors keep their stack (JSON.stringify(new Error('x')) is "{}").
+// - Other objects stay JSON, as before, so structured logs remain parseable.
+const util = require('util');
+
+const PLACEHOLDER = /%[sdifjoOc%]/;
+
+function renderArg(arg) {
+  if (arg instanceof Error) return arg.stack || `${arg.name}: ${arg.message}`;
+  if (typeof arg === 'object' && arg !== null) {
+    try { return JSON.stringify(arg); } catch (_) { return util.inspect(arg, { depth: 4, breakLength: Infinity }); }
+  }
+  return String(arg);
+}
+
+function formatLogArgs(args) {
+  if (!Array.isArray(args) || args.length === 0) return '';
+  if (typeof args[0] === 'string' && PLACEHOLDER.test(args[0])) {
+    try { return util.format(...args); } catch (_) { /* fall through */ }
+  }
+  return args.map(renderArg).join(' ');
+}
+
+module.exports = { formatLogArgs };

package/nextjs.js

@@ -221,6 +221,7 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
  * @param {boolean} options.noUuid - Don't append UUID to service name
  */
 function registerSecureNow(options = {}) {
+  if (require('./sdk-disabled').sdkDisabled('nextjs')) return;
   // Only register once
   if (isRegistered) {
     console.log('[securenow] Already registered, skipping...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.12.1",
+  "version": "8.12.3",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -10,7 +10,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-log-format.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -162,6 +162,9 @@
     "legacy-semconv.js",
     "otp-redaction.js",
     "header-redaction.js",
+    "firewall-paths.js",
+    "log-format.js",
+    "sdk-disabled.js",
     "rate-limits.js",
     "rate-limits.d.ts",
     "firewall-only.js",

package/register.js

@@ -8,6 +8,8 @@
 
 // Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
 if (require('./internal-thread').inInternalThread()) return;
+// SECURENOW_DISABLED=1 turns the SDK off for this process (test runs).
+if (require('./sdk-disabled').sdkDisabled('register')) return;
 
 // 1. Auto-register the ESM loader hook so customers never need --import
 (() => {

package/sdk-disabled.js

@@ -0,0 +1,18 @@
+'use strict';
+
+// Kill switch: SECURENOW_DISABLED=1 (or true / yes / on) turns the SDK off for one process. Tracing, log
+// export, the firewall, track() events and the sessions guard's sync and session.seen all stay idle, and
+// the guard just calls next(). Meant for unit and integration test runs, which otherwise report to the
+// real app with the project's .securenow credentials.
+let _announced = false;
+
+function sdkDisabled(component) {
+  const on = /^(1|true|yes|on)$/i.test(String(process.env.SECURENOW_DISABLED || '').trim());
+  if (on && component && !_announced) {
+    _announced = true;
+    try { console.log(`[securenow] disabled by SECURENOW_DISABLED (${component} not started)`); } catch (_) { /* ignore */ }
+  }
+  return on;
+}
+
+module.exports = { sdkDisabled };

package/sessions.js

@@ -130,6 +130,7 @@ function isRevoked(input) {
 }
 
 function start(options = {}) {
+  if (require('./sdk-disabled').sdkDisabled()) return;
   if (options.syncIntervalMs) _syncIntervalMs = options.syncIntervalMs;
   if (_started) return;
   _started = true;
@@ -277,6 +278,7 @@ function defaultOnRevoked(req, res) {
  * @param {number} [options.syncIntervalMs]
  */
 function guard(options = {}) {
+  if (require('./sdk-disabled').sdkDisabled('sessions guard')) return function securenowSessionGuardDisabled(req, res, next) { return next(); };
   start(options);
   if (options.captureWindowMs) _captureWindowMs = options.captureWindowMs;
   const { getSessionId, getUserId } = options;

package/tracing.js

@@ -2,6 +2,8 @@
 
 // Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
 if (require('./internal-thread').inInternalThread()) return;
+// SECURENOW_DISABLED=1 turns the SDK off for this process (test runs).
+if (require('./sdk-disabled').sdkDisabled('tracing')) return;
 
 /**
  * Preload with: node --require securenow/register app.js
@@ -665,7 +667,7 @@ if (loggingEnabled) {
       _logger.emit({
         severityNumber: sn,
         severityText: st,
-        body: args.map(a => (typeof a === 'object' && a !== null) ? JSON.stringify(a) : String(a)).join(' '),
+        body: require('./log-format').formatLogArgs(args),
         attributes: { 'log.source': 'console', 'log.method': st.toLowerCase() },
         ...(spanCtx && { context: activeCtx }),
       });