securenow 8.12.3 → 8.13.0

package/NPM_README.md

@@ -1,5 +1,7 @@
 # SecureNow - Complete OpenTelemetry Observability for Node.js
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 OpenTelemetry instrumentation library for Node.js, Next.js, and Nuxt applications. Send distributed traces and logs to any OTLP-compatible observability backend.
 
 **Features:**

package/README.md

@@ -1,5 +1,7 @@
 # SecureNow
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 **Production security for AI-native development teams.**
 
 Your coding agent knows your code. SecureNow shows it what's happening in production. One Node.js package, CLI, and MCP server connect Claude Code, Codex, and Cursor to your live application security — attacks, routes, users, traces, IP intelligence, and response controls.
@@ -94,7 +96,7 @@ export default defineNuxtConfig({
 });
 ```
 
-**What's captured automatically:** HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw `http`), database spans (Postgres, MySQL, MongoDB, Redis), `console.*` as logs with trace correlation, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in `.securenow/runtime.json` under `config`.
+**What's captured automatically:** HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw `http`), database spans (Postgres, MySQL, MongoDB, Redis), `console.*` as logs with trace correlation, crashes (uncaught exceptions and unhandled rejections) as `FATAL` logs with their stack, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in `.securenow/runtime.json` under `config`.
 
 **Production** — same file structure, no env vars. Generate a tokenless runtime credentials file and mount it as a deployment secret:
 

package/SKILL-API.md

@@ -1,5 +1,7 @@
 # SecureNow SDK — Agent Skill
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 Instrument any Node.js application with OpenTelemetry tracing, structured logging, request body capture, and a multi-layer IP firewall. Supports Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt 3, Vite (browser), and raw `http.createServer` — with zero code changes for most setups.
 
 **CLI parity:** every capability exposed below (redaction, CIDR matching, log/span emission, firewall preload, config inspection) has an equivalent `securenow` CLI command. See [SKILL-CLI.md](./SKILL-CLI.md) for the terminal surface.
@@ -670,7 +672,7 @@ Make sure an API key is resolvable by running `npx securenow app connect` first.
 ### Instrument a Docker Container
 
 ```dockerfile
-FROM node:20-slim
+FROM node:24.22.1-slim
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --omit=dev

package/SKILL-CLI.md

@@ -1,5 +1,7 @@
 # SecureNow CLI — Agent Skill
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 Use the `securenow` CLI to perform security DevOps from the terminal: manage apps, investigate threats, control the firewall, analyze traces, handle false positives, and run instrumented Node.js processes. Every command supports `--json` for machine-readable output.
 
 ## Installation

package/cli/threatModel.js

@@ -2,9 +2,10 @@
 
 // `securenow threat-model <category>` — print the copy-paste threat-modeling prompt for a category,
 // fetched from the published set at securenow.ai (the same prompt shown on securenow.ai/threat-modeling).
-// Pipe it straight into your coding agent:
-//   claude -p "$(npx securenow threat-model authentication)"
-// or save it:  npx securenow threat-model authentication --out prompt.md
+// Save it and have your coding agent follow the file (prompts run to ~136 KB, over
+// Linux's 128 KB single-argument limit, so `claude -p "$(...)"` fails):
+//   npx securenow threat-model authentication --out threat-prompt.md
+// or pipe it on stdin:  npx securenow threat-model authentication | claude -p
 const fs = require('fs');
 const ui = require('./ui');
 
@@ -34,8 +35,9 @@ function listCategories() {
   console.log('  Copy-paste a prompt into your coding agent, or run it with the SecureNow CLI.\n');
   for (const slug of CATEGORIES) console.log('    ' + slug);
   console.log('\n  Print one:  securenow threat-model authentication');
-  console.log('  Pipe it:    claude -p "$(securenow threat-model authentication)"');
-  console.log('  Save it:    securenow threat-model authentication --out prompt.md');
+  console.log('  Save it:    securenow threat-model authentication --out threat-prompt.md');
+  console.log('              then tell your agent: "Follow threat-prompt.md"');
+  console.log('  Pipe it:    securenow threat-model authentication | claude -p');
   console.log('  On the web: securenow.ai/threat-modeling');
 }
 

package/crash-capture.js

@@ -0,0 +1,125 @@
+'use strict';
+
+// Crash capture: an uncaught exception or an unhandled promise rejection is
+// recorded as a FATAL log record (with exception.type/message/stacktrace), the
+// log pipeline is flushed, and the process then exits the way Node would have
+// (stack on stderr, exit code 1). When the app registered its own handler, the
+// error is recorded as ERROR and the app's handler decides what happens next.
+// Transient OTLP exporter errors are still swallowed so telemetry outages never
+// crash the host app.
+
+const util = require('util');
+
+const FLUSH_TIMEOUT_MS = 2000;
+
+function unhandledRejectionMode() {
+  const args = [...process.execArgv, ...String(process.env.NODE_OPTIONS || '').split(/\s+/)];
+  for (const a of args) {
+    const m = /^--unhandled-rejections=(\S+)$/.exec(a);
+    if (m) return m[1];
+  }
+  return 'throw';
+}
+
+function describeError(err) {
+  if (err instanceof Error) {
+    const type = err.name || (err.constructor && err.constructor.name) || 'Error';
+    const message = err.message || '';
+    return { type, message, stack: err.stack || `${type}: ${message}` };
+  }
+  const text = util.inspect(err, { depth: 3, breakLength: Infinity });
+  const type = err && typeof err === 'object' ? (err.constructor && err.constructor.name) || 'Object' : typeof err;
+  return { type, message: text, stack: text };
+}
+
+function installCrashCapture({ getLogger, flush, isSdkError, onSdkError, write } = {}) {
+  const writeErr = write || ((s) => { try { process.stderr.write(s); } catch (_) {} });
+  let crashing = false;
+
+  function record(err, origin, fatal) {
+    let logger = null;
+    try { logger = getLogger ? getLogger() : null; } catch (_) {}
+    if (!logger) return;
+    const d = describeError(err);
+    const what = origin === 'unhandledRejection' ? 'Unhandled promise rejection' : 'Uncaught exception';
+    try {
+      logger.emit({
+        severityNumber: fatal ? 21 : 17,
+        severityText: fatal ? 'FATAL' : 'ERROR',
+        body: `${what}${fatal ? ', process crashed' : ' (handled by the app)'}: ${d.stack}`,
+        attributes: {
+          'log.source': 'crash',
+          'exception.type': d.type,
+          'exception.message': d.message.slice(0, 4000),
+          'exception.stacktrace': d.stack.slice(0, 16000),
+          'exception.origin': origin || 'uncaughtException',
+          'exception.escaped': Boolean(fatal),
+          'process.pid': process.pid,
+          'process.uptime_s': Math.round(process.uptime()),
+        },
+      });
+    } catch (_) {}
+  }
+
+  function flushQuietly() {
+    try {
+      return Promise.resolve(flush ? flush() : undefined).catch(() => {});
+    } catch (_) {
+      return Promise.resolve();
+    }
+  }
+
+  // Print like Node's default handler, give the exporter a bounded window to
+  // ship the crash record, then exit with code 1.
+  function crash(err, origin) {
+    if (crashing) process.exit(1);
+    crashing = true;
+    const d = describeError(err);
+    if (origin === 'unhandledRejection' && !(err instanceof Error)) {
+      writeErr(`[UnhandledPromiseRejection: This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). The promise rejected with the reason "${d.message}".]\n`);
+    } else {
+      writeErr(`${d.stack}\n`);
+    }
+    writeErr(`\nNode.js ${process.version}\n`);
+    const hardStop = setTimeout(() => process.exit(1), FLUSH_TIMEOUT_MS + 250);
+    Promise.race([flushQuietly(), new Promise((r) => setTimeout(r, FLUSH_TIMEOUT_MS))])
+      .then(() => { clearTimeout(hardStop); process.exit(1); });
+  }
+
+  process.on('uncaughtException', function securenowUncaughtException(err, origin) {
+    if (isSdkError && isSdkError(err)) {
+      if (onSdkError) onSdkError('error', err, origin);
+      return;
+    }
+    const appHandles = process.listenerCount('uncaughtException') > 1;
+    record(err, origin, !appHandles);
+    if (appHandles) {
+      flushQuietly();
+      return;
+    }
+    crash(err, origin);
+  });
+
+  process.on('unhandledRejection', function securenowUnhandledRejection(reason) {
+    if (isSdkError && isSdkError(reason)) {
+      if (onSdkError) onSdkError('rejection', reason, 'unhandledRejection');
+      return;
+    }
+    const appHandles = process.listenerCount('unhandledRejection') > 1;
+    const mode = unhandledRejectionMode();
+    if (appHandles || mode === 'warn' || mode === 'none' || mode === 'warn-with-error-code') {
+      record(reason, 'unhandledRejection', false);
+      if (!appHandles && mode === 'warn-with-error-code') {
+        writeErr(`(node:${process.pid}) UnhandledPromiseRejectionWarning: ${describeError(reason).stack}\n`);
+        process.exitCode = 1;
+      }
+      flushQuietly();
+      return;
+    }
+    // Default (--unhandled-rejections=throw): an unhandled rejection crashes.
+    record(reason, 'unhandledRejection', true);
+    crash(reason, 'unhandledRejection');
+  });
+}
+
+module.exports = { installCrashCapture, describeError, unhandledRejectionMode };

package/mcp/catalog.js

@@ -190,7 +190,7 @@ const TOOLS = [
   {
     name: 'securenow_auth_status',
     title: 'SecureNow Auth Status',
-    description: 'Show local SecureNow credential source, selected app, and masked runtime API key.',
+    description: 'Show who is signed in and how: over the hosted connector, the OAuth client, access level (investigate or investigate_and_respond) and the organization with the role of the person signed in; locally, the credential source, selected app and masked runtime API key.',
     scope: null,
     localOnly: true,
     readOnly: true,
@@ -209,7 +209,7 @@ const TOOLS = [
   {
     name: 'securenow_apps_create',
     title: 'Create Application',
-    description: 'Create a SecureNow application. Write action; requires confirmation. Each app is billed $99/month on subscribed accounts (free during the 14-day trial). Confirm with the user before creating apps.',
+    description: 'Create a SecureNow application. Write action; requires confirmation. Each app is billed $99/month on subscribed accounts (free during the 14-day trial). Creating one changes the bill.',
     scope: 'applications:write',
     readOnly: false,
     confirm: true,
@@ -379,7 +379,7 @@ const TOOLS = [
       ...appKeysInput,
       ...environmentInput,
       ...timeRangeInput,
-      severity: string('Optional severity filter.'),
+      severity: string('Optional severity filter: debug, info, warn, error or fatal (case-insensitive). error also returns fatal crash records.'),
       limit: number('Maximum logs to return.', { minimum: 1, maximum: 500 }),
     }, ['appKeys']),
   },
@@ -403,13 +403,19 @@ const TOOLS = [
   {
     name: 'securenow_notifications_list',
     title: 'List Notifications',
-    description: 'List security notifications.',
+    description: 'List security alerts (notifications), newest first, as compact summaries: rule, severity, status, test mode, IPs with AI verdicts, agent status and proposed actions. Open alerts by default; securenow_notifications_get returns one alert in full.',
     scope: 'notifications:read',
     readOnly: true,
     method: 'GET',
     endpoint: '/notifications',
-    queryFields: ['limit', 'page'],
-    inputSchema: objectSchema({ ...pagingInput }),
+    queryFields: ['limit', 'page', 'status', 'severity', 'search', 'archived'],
+    inputSchema: objectSchema({
+      ...pagingInput,
+      status: string('Optional status filter, for example open, pending_review or resolved.'),
+      severity: string('Optional severity filter: critical, high, medium or low.'),
+      search: string('Optional text search over the alert title, IPs and rule.'),
+      archived: boolean('true lists archived alerts instead of open ones.'),
+    }),
   },
   {
     name: 'securenow_notifications_unread',
@@ -465,7 +471,7 @@ const TOOLS = [
   {
     name: 'securenow_human_actions_list',
     title: 'List Human Action Queue',
-    description: 'List approval-gated human decisions prepared by SecureNow AI, ordered by urgency.',
+    description: 'List approval-gated decisions prepared by SecureNow AI, most urgent first, as compact summaries: IP rows (kind ip) with the AI recommendation, risk score, confidence and proofs, and rule-level case actions (kind case_action, no IP) such as tune_rule.',
     scope: 'notifications:read',
     readOnly: true,
     method: 'GET',
@@ -609,7 +615,7 @@ const TOOLS = [
       prototypeRunId: string('Optional notification id whose root-cause key should be used.'),
       notificationIds: arrayOfStrings('Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.'),
       status: string('Resolution status: resolved or dismissed. Defaults to resolved.'),
-      allowMixed: boolean('Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.'),
+      allowMixed: boolean('Allows a mixed decision/attribution group, meant for groups whose rows were all reviewed manually. Defaults to false.'),
       previewOnly: boolean('When true, returns the eligible rows without writing.'),
       maxRows: number('Maximum rows to close in this batch. Defaults to 100, capped at 250.', { minimum: 1, maximum: 250 }),
       maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
@@ -635,7 +641,7 @@ const TOOLS = [
       prototypeRunId: string('Optional notification id whose root-cause key should be used.'),
       notificationIds: arrayOfStrings('Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.'),
       status: string('Resolution status: resolved or dismissed. Defaults to resolved.'),
-      allowMixed: boolean('Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.'),
+      allowMixed: boolean('Allows a mixed decision/attribution group, meant for groups whose rows were all reviewed manually. Defaults to false.'),
       previewOnly: boolean('When true, returns the eligible rows without writing.'),
       maxRows: number('Maximum rows to close in this batch. Defaults to 100, capped at 250.', { minimum: 1, maximum: 250 }),
       maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
@@ -751,7 +757,7 @@ const TOOLS = [
     inputSchema: objectSchema({
       notificationId: string('Notification id from the human action row.'),
       ip: string('IP address to mark as false positive.'),
-      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Restrictive false-positive conditions. Prefer app/rule/path/method/status/user-agent/body scope.' },
+      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Restrictive false-positive conditions, scoped by app, rule, path, method, status, user agent or body.' },
       matchMode: string('Condition match mode: all or any.'),
       createExclusion: boolean('Whether to create a restrictive exclusion rule.'),
       applyToExisting: boolean('Whether to apply to existing matching IP investigations.'),
@@ -818,30 +824,39 @@ const TOOLS = [
   {
     name: 'securenow_ip_traces',
     title: 'IP Traces',
-    description: 'Fetch traces associated with an IP address.',
+    description: 'Fetch the requests an IP made: time, app key, route, method, status code, duration and user agent, newest first. Covers the last 24 hours unless from/to are given, up to 500 requests per telemetry store, across every app unless appKeys are given; the response states the window.',
     scope: 'ip_intel:read',
     readOnly: true,
     method: 'GET',
     endpoint: '/ip/:ip/traces',
     pathParams: ['ip'],
-    queryFields: ['appKeys', 'environment'],
+    queryFields: ['appKeys', 'environment', 'from', 'to'],
     normalize: { appKeys: normalizeAppKeys },
     inputSchema: objectSchema({
       ip: string('IPv4 address.'),
       ...appKeysInput,
       ...environmentInput,
+      from: string('Start time as ISO 8601. Defaults to 24 hours before to.'),
+      to: string('End time as ISO 8601. Defaults to now.'),
     }, ['ip']),
   },
   {
     name: 'securenow_forensics_query',
     title: 'Run Forensics Query',
-    description: 'Run a natural-language forensic query. Write scope because it creates an async query job.',
+    description: 'Run a natural-language forensic query over your traffic and return the result rows. Waits up to 30 seconds; a query still running after that returns its jobId with status processing. Write scope because it creates an async query job.',
     scope: 'forensics:write',
     readOnly: false,
     confirm: true,
     method: 'POST',
     endpoint: '/forensics/query',
     bodyFields: ['query', 'applicationId', 'instanceId', 'environment'],
+    poll: {
+      tool: 'securenow_forensics_query_status',
+      idField: 'jobId',
+      pending: ['processing'],
+      timeoutMs: 30000,
+      intervalMs: 2000,
+    },
     inputSchema: objectSchema({
       query: string('Natural-language forensic query.'),
       applicationId: string('Optional application database id.'),
@@ -850,6 +865,19 @@ const TOOLS = [
       ...confirmSchema,
     }, ['query', 'confirm', 'reason']),
   },
+  {
+    name: 'securenow_forensics_query_status',
+    title: 'Forensics Query Result',
+    description: 'Get the status (processing, completed or failed), generated SQL and result rows of a forensics query job.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/query/status/:jobId',
+    pathParams: ['jobId'],
+    inputSchema: objectSchema({
+      jobId: string('Forensics query job id.'),
+    }, ['jobId']),
+  },
   {
     name: 'securenow_forensics_library',
     title: 'Forensics Query Library',
@@ -1105,12 +1133,18 @@ const TOOLS = [
   {
     name: 'securenow_alert_rules_list',
     title: 'List Alert Rules',
-    description: 'List alert rules, including system rules and app scope.',
+    description: 'List detection rules as compact summaries: name, mode (test or prod), status, severity, schedule, throttle, app scope and trigger stats. The detection SQL is left out; securenow_alert_rule_get returns one rule in full.',
     scope: 'alerts:read',
     readOnly: true,
     method: 'GET',
     endpoint: '/alert-rules',
-    inputSchema: objectSchema({}),
+    queryFields: ['status', 'mode', 'isSystem', 'active'],
+    inputSchema: objectSchema({
+      status: string('Optional status filter: Active, Disabled or Paused.'),
+      mode: string('Optional mode filter: test or prod.'),
+      isSystem: boolean('true lists only template rules, false only your own.'),
+      active: boolean('true lists only rules with status Active.'),
+    }),
   },
   {
     name: 'securenow_alert_rule_get',
@@ -1167,7 +1201,7 @@ const TOOLS = [
     bodyFields: ['version', 'reason'],
     inputSchema: objectSchema({
       id: string('Alert rule id (must be a custom, non-system rule).'),
-      version: number('Version number to restore. List options with securenow_alert_rule_versions.', { minimum: 1 }),
+      version: number('Version number to restore, as listed by securenow_alert_rule_versions.', { minimum: 1 }),
       ...confirmSchema,
     }, ['id', 'version', 'confirm', 'reason']),
   },
@@ -1257,7 +1291,7 @@ const TOOLS = [
     ],
     fixedBody: { auditSource: 'mcp' },
     inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_get first to get ruleVersion and instantHash.'),
+      id: string('Alert rule id.'),
       operations: {
         type: 'array',
         items: { type: 'object', additionalProperties: true },
@@ -1341,7 +1375,7 @@ const TOOLS = [
     ],
     fixedBody: { auditSource: 'mcp' },
     inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
+      id: string('Alert rule id.'),
       operations: {
         type: 'array',
         items: { type: 'object', additionalProperties: true },
@@ -1400,7 +1434,7 @@ const TOOLS = [
     ],
     fixedBody: { auditSource: 'mcp', dryRun: true },
     inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
+      id: string('Alert rule id.'),
       operations: {
         type: 'array',
         items: { type: 'object', additionalProperties: true },
@@ -1456,7 +1490,7 @@ const TOOLS = [
     ],
     fixedBody: { auditSource: 'mcp', dryRun: true },
     inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
+      id: string('Alert rule id.'),
       operations: {
         type: 'array',
         items: { type: 'object', additionalProperties: true },
@@ -1766,7 +1800,7 @@ const TOOLS = [
   {
     name: 'securenow_allowlist_add',
     title: 'Add Restrictive Allowlist IP',
-    description: 'Dangerous production action: add an IP/CIDR to the restrictive allowlist. Once active, allowlist mode blocks every IP except listed entries. Do not use this to mark an IP trusted or suppress false positives; use securenow_trusted_add instead. Requires explicit human approval confirming deny-all behavior.',
+    description: 'Dangerous production action: add an IP/CIDR to the restrictive allowlist. Once active, allowlist mode blocks every IP except listed entries, so it is not a way to mark an IP trusted or suppress false positives (trusted IPs are a separate list). The server rejects the call unless allowlistDenyAllApproved is true.',
     scope: 'allowlist:write',
     readOnly: false,
     confirm: true,
@@ -1781,7 +1815,7 @@ const TOOLS = [
       expiresAt: string('Optional expiry time as ISO 8601.'),
       applicationsAll: boolean('Apply to all applications.'),
       applicationKeys: arrayOfStrings('Application keys to scope this allowlist entry to.'),
-      allowlistDenyAllApproved: boolean('Must be true only after the user explicitly approves deny-by-default allowlist behavior. Do not set this for trusted IPs, monitors, false positives, or investigation cleanup.'),
+      allowlistDenyAllApproved: boolean('Confirms the deny-by-default behavior: once the allowlist has entries, every unlisted IP is blocked. Must be true.'),
       ...environmentInput,
       ...confirmSchema,
     }, ['ip', 'confirm', 'reason', 'allowlistDenyAllApproved']),
@@ -1852,6 +1886,54 @@ const TOOLS = [
   },
 ];
 
+// Annotation policy, matching how Claude's and ChatGPT's directory reviews read
+// the hints: a write is destructive when it removes or overwrites something,
+// or can stop production traffic or detection, even if it can be undone. Pure
+// record-keeping writes (reports, queue closures, read markers, dry runs) are
+// not. Only tools that reach arbitrary public entities are open-world.
+const DESTRUCTIVE_TOOLS = new Set([
+  'securenow_firewall_enable',
+  'securenow_firewall_disable',
+  'securenow_firewall_set_threshold',
+  'securenow_human_action_block',
+  'securenow_human_action_false_positive',
+  'securenow_human_case_action_update',
+  'securenow_automation_defaults_ensure',
+  'securenow_automation_rule_create',
+  'securenow_automation_rule_update',
+  'securenow_automation_rule_execute',
+  'securenow_automation_rule_delete',
+  'securenow_rate_limit_remove',
+  'securenow_rate_limit_create_from_text',
+  'securenow_alert_rule_rollback',
+  'securenow_alert_rule_update',
+  'securenow_alert_rule_query_update',
+  'securenow_alert_rule_instant_update',
+  'securenow_alert_rule_condition_update',
+  'securenow_alert_rule_exclusion_add',
+  'securenow_alert_rule_exclusion_remove',
+  'securenow_blocklist_pending_approve',
+  'securenow_blocklist_pending_reject',
+  'securenow_blocklist_pending_bulk_approve',
+  'securenow_blocklist_pending_bulk_reject',
+  'securenow_blocklist_add',
+  'securenow_blocklist_remove',
+  'securenow_blocklist_unblock',
+  'securenow_allowlist_add',
+  'securenow_allowlist_remove',
+  'securenow_trusted_add',
+  'securenow_trusted_remove',
+]);
+
+const OPEN_WORLD_TOOLS = new Set([
+  'securenow_ip_lookup', // reputation of any public IP address
+]);
+
+for (const tool of TOOLS) {
+  if (DESTRUCTIVE_TOOLS.has(tool.name)) tool.destructive = true;
+  tool.openWorld = OPEN_WORLD_TOOLS.has(tool.name);
+}
+
 const RESOURCES = [
   {
     uri: 'securenow://docs/skill-api',
@@ -2246,11 +2328,14 @@ function mcpToolDefinition(tool) {
     description: tool.description,
     inputSchema: tool.inputSchema || objectSchema({}),
     annotations: {
+      // Directory listings (Claude's connector review) read the title here too.
+      title: tool.title,
       readOnlyHint: !!tool.readOnly,
-      destructiveHint: !!tool.destructive,
+      destructiveHint: !tool.readOnly && !!tool.destructive,
       idempotentHint: !!tool.readOnly,
-  },
-};
+      openWorldHint: !!tool.openWorld,
+    },
+  };
 }
 
 function listTools() {
@@ -2323,6 +2408,209 @@ function buildApiRequest(tool, rawArgs = {}) {
   };
 }
 
+// Async tools (tool.poll) return a job id; follow it with the status tool until
+// the job settles or the wait runs out. fetchStatus(request) performs one API call.
+async function pollToolResult(tool, first, fetchStatus) {
+  const spec = tool.poll;
+  const id = spec && first && first[spec.idField];
+  if (!id || !spec.pending.includes(first.status)) return first;
+  const statusTool = getTool(spec.tool);
+  const deadline = Date.now() + spec.timeoutMs;
+  let last = first;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, spec.intervalMs));
+    last = await fetchStatus(buildApiRequest(statusTool, { [spec.idField]: id }));
+    if (!last || !spec.pending.includes(last.status)) return last;
+  }
+  if (last && last.error) {
+    return { ...last, message: `Not finished after ${Math.round(spec.timeoutMs / 1000)} seconds, and the last attempt failed: ${last.error}. It may be retrying; ${statusTool.name} with ${spec.idField} ${id} shows its state. A narrower question (one app, a shorter window) usually avoids this.` };
+  }
+  return { ...last, message: `Still running. Call ${statusTool.name} with ${spec.idField} ${id} to get the result.` };
+}
+
+// Tool results land in a chat context, so very large API responses (a 500-IP
+// investigation, every saved rule) are shrunk: long arrays keep their first
+// items and long strings are cut, with a note saying how to narrow the call.
+const MAX_RESULT_CHARS = 60000;
+const TRIM_STEPS = [[50, 4000], [20, 2000], [10, 1000], [5, 400], [3, 200], [1, 100]];
+const TRUNCATED_NOTE = 'This result was shortened to fit the conversation. Use filters, a smaller limit or a get tool for the full details.';
+
+function trimValue(value, maxItems, maxString) {
+  if (typeof value === 'string') {
+    return value.length > maxString ? `${value.slice(0, maxString)}… [${value.length - maxString} more characters]` : value;
+  }
+  if (Array.isArray(value)) {
+    const kept = value.slice(0, maxItems).map((item) => trimValue(item, maxItems, maxString));
+    if (value.length > maxItems) kept.push(`… ${value.length - maxItems} more items not shown`);
+    return kept;
+  }
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) out[key] = trimValue(item, maxItems, maxString);
+    return out;
+  }
+  return value;
+}
+
+// Tool results are sent as compact JSON, so sizes are measured that way.
+const compactJson = (value) => JSON.stringify(value);
+
+function fitToolResult(value, maxChars = MAX_RESULT_CHARS) {
+  if (value == null || typeof value !== 'object') return value;
+  if (compactJson(value).length <= maxChars) return value;
+  for (const [maxItems, maxString] of TRIM_STEPS) {
+    const trimmed = trimValue(value, maxItems, maxString);
+    const wrapped = Array.isArray(trimmed) ? { _truncated: TRUNCATED_NOTE, result: trimmed } : { _truncated: TRUNCATED_NOTE, ...trimmed };
+    if (compactJson(wrapped).length <= maxChars) return wrapped;
+  }
+  return { _truncated: TRUNCATED_NOTE, preview: compactJson(value).slice(0, maxChars) };
+}
+
+// List tools return compact rows so a page of results fits in a chat context;
+// the matching get tools return one record in full. Each summarizer keeps the
+// response envelope (pagination, summary) and only reshapes the rows.
+const clip = (value, max = 300) => (typeof value === 'string' && value.length > max ? `${value.slice(0, max)}…` : value);
+const firstN = (list, n) => (Array.isArray(list) ? list.slice(0, n) : []);
+
+function summarizeNotification(n) {
+  const investigations = Array.isArray(n.ipInvestigations) ? n.ipInvestigations : [];
+  return {
+    id: n._id || n.id,
+    title: n.title,
+    detectionName: n.alertContext?.detectionName || null,
+    alertRuleId: n.alertRuleId,
+    severity: n.severity,
+    status: n.status,
+    testMode: n.testMode === true,
+    applications: n.applications,
+    occurrences: n.occurrences,
+    firstOccurredAt: n.firstOccurredAt,
+    lastOccurredAt: n.lastOccurredAt,
+    createdAt: n.createdAt,
+    readAt: n.readAt || null,
+    primaryIp: n.primaryIp || null,
+    ipCount: Math.max(n.ipSummary?.totalCount || 0, investigations.length, (n.relatedIps || []).length + (n.primaryIp ? 1 : 0)),
+    stormSignal: n.ipSummary?.stormSignal === true,
+    resultCount: n.resultCount,
+    agent: n.agentState ? { status: n.agentState.status, summary: clip(n.agentState.summary, 200), confidence: n.agentState.confidence } : null,
+    proposedActions: firstN(n.proposedActions, 3).map((a) => ({
+      actionKey: a.actionKey, type: a.type, status: a.status, confidence: a.confidence, ips: firstN(a.scope?.ips, 5),
+    })),
+    ips: firstN(investigations, 5).map((i) => ({ ip: i.ip, status: i.status, riskScore: i.riskScore, hitCount: i.hitCount })),
+  };
+}
+
+function summarizeRule(r) {
+  return {
+    id: r.id || r._id,
+    name: r.name,
+    detection: clip(r.queryMappingId?.nlpQuery || r.description, 140) || null,
+    mode: r.mode,
+    status: r.status,
+    severity: r.severity,
+    isSystem: r.isSystem === true,
+    executionMode: r.executionMode,
+    applicationsAll: r.applicationsAll,
+    applications: r.applications,
+    schedule: r.schedule?.enabled === false ? null : r.schedule?.cronExpression || null,
+    throttleMinutes: r.throttle?.enabled === false ? 0 : r.throttle?.minutes ?? null,
+    instant: r.instant ? { enabled: r.instant.enabled === true, block: r.instant.block === true } : null,
+    exclusions: Array.isArray(r.exclusions) ? r.exclusions.length : 0,
+    stats: r.stats ? {
+      triggerCount: r.stats.triggerCount, executionCount: r.stats.executionCount,
+      lastTriggeredAt: r.stats.lastTriggeredAt || null, lastExecutedAt: r.stats.lastExecutedAt || null,
+    } : null,
+    currentVersion: r.currentVersion,
+  };
+}
+
+function summarizeTask(t) {
+  const proofs = t.proofs || {};
+  return {
+    id: t.id,
+    kind: t.kind || 'ip',
+    actionKey: t.actionKey,
+    actionType: t.actionType,
+    notificationId: t.notificationId,
+    ip: t.ip,
+    alertRuleId: t.alertRuleId,
+    title: t.title,
+    detectionName: t.detectionName,
+    severity: t.severity,
+    applications: t.applications,
+    hitCount: t.hitCount,
+    firstSeenAt: t.firstSeenAt,
+    lastSeenAt: t.lastSeenAt,
+    urgencyScore: t.urgencyScore,
+    cluster: t.cluster ? { clusterId: t.cluster.clusterId, label: t.cluster.label, ipCount: t.cluster.ipCount, riskScore: t.cluster.riskScore } : null,
+    aiDecision: t.aiDecision ? {
+      recommendation: t.aiDecision.recommendation, label: t.aiDecision.label, riskScore: t.aiDecision.riskScore,
+      confidence: t.aiDecision.confidence, completedAt: t.aiDecision.completedAt, reason: clip(t.aiDecision.reason || t.aiDecision.summary, 300),
+    } : null,
+    proofs: {
+      paths: firstN(proofs.paths, 5), methods: firstN(proofs.methods, 5), statusCodes: firstN(proofs.statusCodes, 5),
+      userAgents: firstN(proofs.userAgents, 3).map((ua) => clip(ua, 120)), traceIds: firstN(proofs.traceIds, 5),
+      rootCauseKey: proofs.rootCauseKey, evidenceShape: proofs.evidenceShape,
+    },
+  };
+}
+
+function summarizeApp(a) {
+  return {
+    id: a._id || a.id,
+    key: a.key,
+    name: a.name,
+    status: a.status,
+    hosts: a.hosts,
+    firewallEnabled: a.firewallEnabled,
+    tracingEnabled: a.tracingEnabled,
+    loggingEnabled: a.loggingEnabled,
+    lastTelemetryAt: a.lastTelemetryAt || null,
+    lastTelemetryEnvironment: a.lastTelemetryEnvironment || null,
+    lastTraceAt: a.lastTraceAt || null,
+    lastTraceEnvironment: a.lastTraceEnvironment || null,
+    lastLogAt: a.lastLogAt || null,
+    lastLogEnvironment: a.lastLogEnvironment || null,
+  };
+}
+
+function summarizeRateLimit(r) {
+  const expired = !!r.expiresAt && new Date(r.expiresAt).getTime() < Date.now();
+  return { ...r, metadata: undefined, effectiveStatus: r.status === 'active' && expired ? 'expired' : r.status };
+}
+
+const SUMMARIZERS = {
+  securenow_notifications_list: (res) => (Array.isArray(res?.notifications) ? { ...res, notifications: res.notifications.map(summarizeNotification) } : res),
+  securenow_alert_rules_list: (res) => {
+    if (!Array.isArray(res?.alertRules)) return res;
+    const rules = res.alertRules;
+    const count = (fn) => rules.filter(fn).length;
+    const counts = {
+      total: rules.length,
+      active: count((r) => r.status === 'Active'),
+      prodActive: count((r) => r.status === 'Active' && r.mode === 'prod'),
+      testActive: count((r) => r.status === 'Active' && r.mode === 'test'),
+      paused: count((r) => r.status === 'Paused'),
+      disabled: count((r) => r.status === 'Disabled'),
+      neverTriggered: count((r) => !r.stats?.triggerCount),
+    };
+    return { counts, ...res, alertRules: rules.map(summarizeRule) };
+  },
+  securenow_human_actions_list: (res) => (Array.isArray(res?.tasks) ? { ...res, tasks: res.tasks.map(summarizeTask) } : res),
+  securenow_apps_list: (res) => (Array.isArray(res?.applications) ? { ...res, applications: res.applications.map(summarizeApp) } : res),
+  securenow_rate_limit_list: (res) => (Array.isArray(res?.rateLimits) ? { ...res, rateLimits: res.rateLimits.map(summarizeRateLimit) } : res),
+};
+
+function summarizeToolResult(tool, result) {
+  const summarize = tool && SUMMARIZERS[tool.name];
+  if (!summarize || result == null || typeof result !== 'object') return result;
+  try {
+    return summarize(result);
+  } catch (_) {
+    return result;
+  }
+}
+
 function readStaticResource(resource) {
   const filepath = path.resolve(__dirname, resource.file);
   return fs.readFileSync(filepath, 'utf8');
@@ -2351,6 +2639,9 @@ module.exports = {
   promptMessages,
   assertConfirmed,
   buildApiRequest,
+  pollToolResult,
+  fitToolResult,
+  summarizeToolResult,
   resourceContent,
   jsonText,
   maskSecret,

package/mcp/server.js

@@ -14,6 +14,9 @@ const {
   promptMessages,
   assertConfirmed,
   buildApiRequest,
+  pollToolResult,
+  fitToolResult,
+  summarizeToolResult,
   resourceContent,
   jsonText,
   maskSecret,
@@ -160,27 +163,32 @@ async function callApiTool(tool, args) {
     throw new Error('Admin auth is missing. Run `npx securenow admin login` from the project root, then retry. Runtime app credentials cannot grant admin/control-plane permissions.');
   }
 
-  const request = buildApiRequest(tool, finalArgs);
-  const options = {
-    token,
-    ...(Object.keys(request.query || {}).length > 0 ? { query: request.query } : {}),
-  };
+  const send = (request) => {
+    const options = {
+      token,
+      ...(Object.keys(request.query || {}).length > 0 ? { query: request.query } : {}),
+    };
+
+    if (request.method === 'GET') return api.get(request.endpoint, options);
+    if (request.method === 'POST') return api.post(request.endpoint, request.body || {}, options);
+    if (request.method === 'PUT') return api.put(request.endpoint, request.body || {}, options);
+    if (request.method === 'PATCH') return api.patch(request.endpoint, request.body || {}, options);
+    if (request.method === 'DELETE') return api.delete(request.endpoint, options);
 
-  if (request.method === 'GET') return api.get(request.endpoint, options);
-  if (request.method === 'POST') return api.post(request.endpoint, request.body || {}, options);
-  if (request.method === 'PUT') return api.put(request.endpoint, request.body || {}, options);
-  if (request.method === 'PATCH') return api.patch(request.endpoint, request.body || {}, options);
-  if (request.method === 'DELETE') return api.delete(request.endpoint, options);
+    throw new Error(`Unsupported method for ${tool.name}: ${request.method}`);
+  };
 
-  throw new Error(`Unsupported method for ${tool.name}: ${request.method}`);
+  const result = await send(buildApiRequest(tool, finalArgs));
+  return summarizeToolResult(tool, await pollToolResult(tool, result, send));
 }
 
-function asToolResult(result) {
+function asToolResult(rawResult) {
+  const result = fitToolResult(rawResult);
   return {
     content: [
       {
         type: 'text',
-        text: typeof result === 'string' ? result : jsonText(result),
+        text: typeof result === 'string' ? result : JSON.stringify(result),
       },
     ],
     structuredContent: typeof result === 'object' && result !== null ? result : { value: result },

package/nextjs.js

@@ -514,19 +514,14 @@ function registerSecureNow(options = {}) {
         _formatOtlpError(err)
       );
     }
-    process.on('uncaughtException', (err, origin) => {
-      if (_isOtlpTransientError(err) && (_looksLikeOtlpStack(err) || _looksLikeConfiguredOtlpEndpoint(err))) {
-        _reportSuppressedOtlpError('error', err, origin);
-        return;
-      }
-      throw err;
-    });
-    process.on('unhandledRejection', (reason) => {
-      if (_isOtlpTransientError(reason) && (_looksLikeOtlpStack(reason) || _looksLikeConfiguredOtlpEndpoint(reason))) {
-        _reportSuppressedOtlpError('rejection', reason, 'unhandledRejection');
-        return;
-      }
-      throw reason;
+    // Crash capture (see crash-capture.js). The logger provider only exists on
+    // self-hosted deployments; on Vercel crashes keep Node's default behaviour.
+    let _crashLoggerProvider = null;
+    require('./crash-capture').installCrashCapture({
+      getLogger: () => (_crashLoggerProvider ? _crashLoggerProvider.getLogger('securenow.crash', '1.0.0') : null),
+      flush: () => (_crashLoggerProvider ? _crashLoggerProvider.forceFlush() : undefined),
+      isSdkError: (e) => _isOtlpTransientError(e) && (_looksLikeOtlpStack(e) || _looksLikeConfiguredOtlpEndpoint(e)),
+      onSdkError: _reportSuppressedOtlpError,
     });
 
     if (isVercel) {
@@ -606,6 +601,7 @@ function registerSecureNow(options = {}) {
             // sdk-logs >= 0.220 takes a single options object ({ exporter }).
             processors: [new BatchLogRecordProcessor({ exporter: logExporter })],
           });
+          _crashLoggerProvider = loggerProvider;
 
           // Patch console to forward logs as OTLP log records
           const logger = loggerProvider.getLogger('console', '1.0.0');

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "securenow",
-  "version": "8.12.3",
+  "version": "8.13.0",
+  "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -10,7 +11,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-log-format.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-log-format.js && node test-crash-capture.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -164,6 +165,7 @@
     "header-redaction.js",
     "firewall-paths.js",
     "log-format.js",
+    "crash-capture.js",
     "sdk-disabled.js",
     "rate-limits.js",
     "rate-limits.d.ts",

package/tracing.js

@@ -9,7 +9,7 @@ if (require('./sdk-disabled').sdkDisabled('tracing')) return;
  * Preload with: node --require securenow/register app.js
  *
  * Works for both CJS and ESM apps. On Node >=20.6 the ESM loader hook is
- * auto-registered via module.register() — no --import flag needed.
+ * auto-registered via module.register() — no --import flag needed.
  * On Node 18 with "type": "module", add the hook manually:
  *   node --import @opentelemetry/instrumentation/hook.mjs --require securenow/register app.js
  *
@@ -348,7 +348,7 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
         const hasCliHook = execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle');
         const hasModuleRegister = typeof require('node:module').register === 'function';
         if (!hasCliHook && !hasModuleRegister) {
-          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
+          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
           console.warn('[securenow]    Upgrade to Node >=20.6 (recommended) or add: --import @opentelemetry/instrumentation/hook.mjs');
         }
       }
@@ -384,7 +384,7 @@ const headers = resolvedEndpoints.headers;
 const rawBase = (resolvedApp.appId || '').trim().replace(/^['"]|['"]$/g, '');
 const baseName = rawBase || null;
 // Auto-disables the per-worker suffix when we resolved a routing UUID from
-// credentials — the dashboard does exact-match IN on service.name, so any
+// credentials — the dashboard does exact-match IN on service.name, so any
 // suffix breaks routing. config.runtime.noUuid can override.
 const noUuid   = appConfig.resolveNoUuid();
 const strict   = appConfig.boolConfig('runtime.strict', false);
@@ -411,7 +411,7 @@ const instancePrefix   = baseName || 'securenow';
 const serviceInstanceId = `${instancePrefix}-${randomUUID()}`;
 
 // Loud line per worker to prove what was used
-console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=%s instance.id=%s',
+console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=%s instance.id=%s',
   process.pid,
   JSON.stringify(baseName),
   JSON.stringify(endpointBase),
@@ -739,21 +739,15 @@ function _reportSuppressedOtlpError(kind, err, origin) {
   );
 }
 
-process.on('uncaughtException', (err, origin) => {
-  if (_isOtlpTransientError(err) && (_looksLikeOtlpStack(err) || _looksLikeConfiguredOtlpEndpoint(err))) {
-    _reportSuppressedOtlpError('error', err, origin);
-    return; // swallow - do not crash
-  }
-  // Not ours — re-throw so the default handler (or the app's own handler) fires
-  throw err;
-});
-process.on('unhandledRejection', (reason) => {
-  if (_isOtlpTransientError(reason) && (_looksLikeOtlpStack(reason) || _looksLikeConfiguredOtlpEndpoint(reason))) {
-    _reportSuppressedOtlpError('rejection', reason, 'unhandledRejection');
-    return; // swallow
-  }
-  // Not ours — re-throw as unhandled so Node's default behaviour applies
-  throw reason;
+// Crashes: OTLP exporter blips are swallowed (never crash the host app); every
+// other uncaught exception / unhandled rejection is recorded as a FATAL log
+// record, flushed, and the process exits like Node's default (code 1). If the
+// app has its own handler, the error is recorded and that handler decides.
+require('./crash-capture').installCrashCapture({
+  getLogger: () => (loggerProvider ? loggerProvider.getLogger('securenow.crash', '1.0.0') : null),
+  flush: () => (loggerProvider ? loggerProvider.forceFlush() : undefined),
+  isSdkError: (e) => _isOtlpTransientError(e) && (_looksLikeOtlpStack(e) || _looksLikeConfiguredOtlpEndpoint(e)),
+  onSdkError: _reportSuppressedOtlpError,
 });
 
 // -------- SDK --------
@@ -779,17 +773,17 @@ const sdk = new NodeSDK({
 (async () => {
   try {
     await Promise.resolve(sdk.start?.());
-    console.log('[securenow] OTel SDK started → %s', tracesUrl);
+    console.log('[securenow] OTel SDK started → %s', tracesUrl);
     if (loggingEnabled) {
-      console.log('[securenow] 📋 Logging: ENABLED → %s', logsUrl);
+      console.log('[securenow] 📋 Logging: ENABLED → %s', logsUrl);
     } else {
       console.log('[securenow] Logging: DISABLED (config.logging.enabled=false)');
     }
     if (captureBody) {
-      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
+      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
     }
     if (captureMultipart) {
-      console.log('[securenow] 📎 Multipart body capture: ENABLED (streaming — file content not buffered)');
+      console.log('[securenow] 📎 Multipart body capture: ENABLED (streaming — file content not buffered)');
     }
     if (appConfig.boolConfig('runtime.testSpan', false)) {
       const api = require('@opentelemetry/api');
@@ -797,9 +791,9 @@ const sdk = new NodeSDK({
       const span = tracer.startSpan('securenow.startup.smoke'); span.end();
     }
 
-    // Firewall — auto-activates only when a real snk_live_ key is resolvable.
+    // Firewall — auto-activates only when a real snk_live_ key is resolvable.
     // resolveApiKey() enforces the prefix, so we skip cleanly when the app has
-    // only an app-routing UUID (or nothing at all) — no 401 polling loops.
+    // only an app-routing UUID (or nothing at all) — no 401 polling loops.
     const firewallOptions = appConfig.resolveFirewallOptions();
     if (firewallOptions.apiKey) {
       require('./firewall').init({