securenow 8.12.4 → 8.14.0

package/NPM_README.md

@@ -1,5 +1,7 @@
 # SecureNow - Complete OpenTelemetry Observability for Node.js
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 OpenTelemetry instrumentation library for Node.js, Next.js, and Nuxt applications. Send distributed traces and logs to any OTLP-compatible observability backend.
 
 **Features:**

package/README.md

@@ -1,10 +1,12 @@
 # SecureNow
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 **Production security for AI-native development teams.**
 
 Your coding agent knows your code. SecureNow shows it what's happening in production. One Node.js package, CLI, and MCP server connect Claude Code, Codex, and Cursor to your live application security — attacks, routes, users, traces, IP intelligence, and response controls.
 
-Your agent already sees the repository, the dependencies, the auth implementation, the API handlers, the database queries. SecureNow adds the half it can't see: live requests, routes, users and sessions, attack patterns, IP intelligence, traces and logs, security history, and block / rate-limit controls — with human approval on every mutation.
+Your agent already sees the repository, the dependencies, the auth implementation, the API handlers, the database queries. SecureNow adds the half it can't see: live requests, routes, users and sessions, attack patterns, IP intelligence, traces and logs, security history, and block / rate-limit controls — every write confirmed by you and recorded.
 
 **Find it in code. Watch it in production.**
 
@@ -31,7 +33,7 @@ Agent: Apply the recommended blocks?
 You:   Yes.
 ```
 
-Detection and investigation are automatic. Actions are proposed, a human approves, then they execute — and every action is reversible (unblock keeps the history, revocations can be restored, rate limits expire).
+Detection and investigation are automatic. Your agent proposes actions and asks before it acts: every write needs an explicit `confirm: true` and a reason, applies to your running apps in about 10 seconds, and is reversible (unblock keeps the history, revocations can be restored, rate limits expire). Some automated AI blocks wait in an approval queue (`securenow human`).
 
 ---
 
@@ -94,7 +96,7 @@ export default defineNuxtConfig({
 });
 ```
 
-**What's captured automatically:** HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw `http`), database spans (Postgres, MySQL, MongoDB, Redis), `console.*` as logs with trace correlation, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in `.securenow/runtime.json` under `config`.
+**What's captured automatically:** HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw `http`), database spans (Postgres, MySQL, MongoDB, Redis), `console.*` as logs with trace correlation, crashes (uncaught exceptions and unhandled rejections) as `FATAL` logs with their stack, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in `.securenow/runtime.json` under `config`.
 
 **Production** — same file structure, no env vars. Generate a tokenless runtime credentials file and mount it as a deployment secret:
 
@@ -174,11 +176,25 @@ Everything the MCP server can do is also a command. Run `npx securenow help` for
 | `securenow human block <row> --yes --reason "..."` | Approve a proposed block |
 | `securenow blocklist add <ip> [--route /admin*] [--mode prefix] [--duration 24h] [--reason "..."]` | Block an IP globally or per-route |
 | `securenow blocklist unblock <id> --reason "..."` | Stop enforcement, keep the history |
-| `securenow ratelimit from-text "rate limit /api/login to 5 per minute" --yes` | Rate-limit rule from natural language |
+| `securenow ratelimit from-text "5 per minute per IP on POST /api/login for 2h" --yes` | Rate-limit rule from natural language |
+| `securenow ratelimit add --route /api/ --limit 100 --window 1m --header x-api-key` | Per-API-key (or `--cookie session` per-session) limit |
+| `securenow firewall hits --since 1h` | Who your blocks, rate limits and challenges actually stopped |
 | `securenow challenge add <ip> --route /login` | Proof-of-work challenge instead of a hard block |
 | `securenow revoke session <id>` / `revoke user <id>` | Kill stolen sessions (enforced via `securenow/sessions`) |
 | `securenow trusted add <ip>` | Mark an IP as trusted |
 
+### Rate limits, outside your code
+
+Rate-limit rules live in SecureNow, not in your code: create them from the dashboard, the CLI or your agent (MCP), and every running instance picks them up in about 10 seconds, with no deploy. A rule matches a route (exact, prefix or regex), a method, optionally an IP/CIDR, an app and an environment, and counts per IP, globally, per request header value (`--header x-api-key`) or per cookie value (`--cookie session`). Header and cookie values are hashed; requests without them are counted per IP. Rules can stack (a burst limit and an hourly cap). Over the limit, the app answers `429` with `Retry-After`.
+
+Counters live in each process by default. To share one counter across workers and servers, point the firewall at your Redis:
+
+```json
+{ "config": { "firewall": { "rateLimitStore": "redis://your-redis:6379" } } }
+```
+
+The firewall never waits on Redis: it decides from what it already knows and reports each hit in the background (at most about one extra request per process can get through while a reply is in flight). If Redis is unreachable, counting falls back to in-process.
+
 ### Rules & detections
 
 | Command | Description |
@@ -233,7 +249,7 @@ It syncs your app's blocklist plus SecureNow's known-bad IP feed, refreshed hour
 
   SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
 - **Fails open.** If SecureNow is unreachable, your app serves traffic normally (`config.firewall.failMode: "open"` is the default).
-- **Read/write split.** MCP read tools are read-only; write tools require explicit `confirm: true` plus a reason, and human approval is the designed path for mutations — blocks, rate limits, and revocations are proposed, approved, executed, and reversible.
+- **Read/write split.** MCP read tools are read-only; write tools require explicit `confirm: true` plus a reason, so your agent asks you before it blocks, rate-limits or revokes anything; every write is recorded and reversible.
 
 More at [securenow.ai/security](https://securenow.ai/security).
 

package/SKILL-API.md

@@ -1,5 +1,7 @@
 # SecureNow SDK — Agent Skill
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 Instrument any Node.js application with OpenTelemetry tracing, structured logging, request body capture, and a multi-layer IP firewall. Supports Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt 3, Vite (browser), and raw `http.createServer` — with zero code changes for most setups.
 
 **CLI parity:** every capability exposed below (redaction, CIDR matching, log/span emission, firewall preload, config inspection) has an equivalent `securenow` CLI command. See [SKILL-CLI.md](./SKILL-CLI.md) for the terminal surface.
@@ -670,7 +672,7 @@ Make sure an API key is resolvable by running `npx securenow app connect` first.
 ### Instrument a Docker Container
 
 ```dockerfile
-FROM node:20-slim
+FROM node:24.22.1-slim
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --omit=dev

package/SKILL-CLI.md

@@ -1,5 +1,7 @@
 # SecureNow CLI — Agent Skill
 
+> **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
+
 Use the `securenow` CLI to perform security DevOps from the terminal: manage apps, investigate threats, control the firewall, analyze traces, handle false positives, and run instrumented Node.js processes. Every command supports `--json` for machine-readable output.
 
 ## Installation

package/app-config.js

@@ -75,6 +75,7 @@ const DEFAULT_CONFIG = Object.freeze({
     iptables: false,
     cloud: null,
     cloudDryRun: false,
+    rateLimitStore: null,
     cloudflare: {
       apiToken: null,
       accountId: null,
@@ -126,6 +127,7 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.firewall.iptables': 'Layer 3 OS firewall. Default false because it requires Linux root/CAP_NET_ADMIN.',
   'config.firewall.cloud': 'Layer 4 WAF provider: cloudflare, aws, gcp, or null.',
   'config.firewall.cloudDryRun': 'Log intended cloud WAF pushes without applying them.',
+  'config.firewall.rateLimitStore': 'Optional shared rate-limit counters: a redis:// or rediss:// URL. Unset = each process counts on its own. If the store is unreachable, counting falls back to in-process.',
   'config.firewall.cloudflare': 'Cloudflare API token/account id for Layer 4 WAF. Secrets: do not commit.',
   'config.firewall.aws': 'AWS WAF IP set configuration for Layer 4 WAF.',
   'config.firewall.gcp': 'GCP Cloud Armor policy configuration for Layer 4 WAF.',
@@ -710,6 +712,8 @@ function resolveFirewallOptions() {
     iptables: boolConfig('firewall.iptables', false),
     cloud: configValue('firewall.cloud', null) || null,
     cloudDryRun: boolConfig('firewall.cloudDryRun', false),
+    // Optional shared rate-limit counters: "redis://host:6379" (or rediss://). Unset = per process.
+    rateLimitStore: configValue('firewall.rateLimitStore', null) || null,
     cloudflare: {
       apiToken: resolveConfigPath('firewall.cloudflare.apiToken', [], null) || null,
       accountId: resolveConfigPath('firewall.cloudflare.accountId', [], null) || null,

package/cli/firewall.js

@@ -216,4 +216,50 @@ async function appsList(args, flags) {
   }
 }
 
-module.exports = { status, testIp, enable, disable, appsList };
+// securenow firewall hits — who the firewall actually stopped (blocks, 429s, challenges),
+// per rule and per IP, plus the latest hits. The quickest "is my rule working?" check.
+async function hits(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Loading firewall hits');
+  try {
+    const query = { since: flags.since || '24h' };
+    const appKey = await resolveAppKey(flags);
+    if (appKey) query.appKey = appKey;
+    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
+    if (flags.action) query.action = flags.action === 'rate-limited' ? 'rate_limited' : flags.action;
+    if (flags.source) query.source = flags.source === 'rate-limit' ? 'rate_limit' : flags.source;
+    if (flags.rule) query.ruleId = flags.rule;
+    if (flags.ip) query.ip = flags.ip;
+    if (flags.limit) query.limit = flags.limit;
+    const data = await api.get('/firewall/hits', { query });
+    s.stop('Firewall hits loaded');
+    if (flags.json) { ui.json(data); return; }
+
+    const label = { blocked: 'blocked', rate_limited: '429', captcha_challenged: 'challenged', captcha_passed: 'passed', captcha_failed: 'failed', allowed: 'allowed' };
+    const totals = Object.entries(data.totals || {}).map(([k, v]) => `${label[k] || k} ${v}`).join(' · ') || 'none';
+    console.log('');
+    console.log(`  ${ui.c.bold('Hits')} ${ui.c.dim(`${new Date(data.from).toLocaleString()} → ${new Date(data.to).toLocaleString()}`)}   ${totals}`);
+    console.log('');
+    if (!(data.byRule || []).length) {
+      console.log(`  ${ui.c.dim('No blocks, rate limits or challenges in this window.')}`);
+      console.log('');
+      return;
+    }
+    console.log(`  ${ui.c.bold('By rule')}`);
+    for (const r of data.byRule.slice(0, 15)) {
+      const what = r.rule || (r.ruleId ? `rule ${r.ruleId}` : r.matchedEntry ? `block ${r.matchedEntry}` : r.source);
+      console.log(`  ${String(r.hits).padStart(6)}  ${(label[r.action] || r.action).padEnd(10)} ${what}  ${ui.c.dim(`${r.distinctIps} IP${r.distinctIps === 1 ? '' : 's'}${r.ruleId ? ` · ${r.ruleId}` : ''}`)}`);
+    }
+    console.log('');
+    console.log(`  ${ui.c.bold('Top IPs')}`);
+    for (const r of (data.byIp || []).slice(0, 10)) {
+      console.log(`  ${String(r.hits).padStart(6)}  ${(label[r.action] || r.action).padEnd(10)} ${r.ip}`);
+    }
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to load firewall hits');
+    throw err;
+  }
+}
+
+module.exports = { status, testIp, enable, disable, appsList, hits };

package/cli/monitor.js

@@ -269,7 +269,7 @@ async function logsList(args, flags) {
 
     console.log('');
     for (const log of logs) {
-      const level = (log.severityText || log.level || 'INFO').toUpperCase();
+      const level = (log.severity_text || log.severityText || log.level || 'INFO').toUpperCase();
       const levelColor = {
         ERROR: ui.c.red, FATAL: ui.c.red, WARN: ui.c.yellow, WARNING: ui.c.yellow,
         INFO: ui.c.cyan, DEBUG: ui.c.dim, TRACE: ui.c.dim,
@@ -277,13 +277,14 @@ async function logsList(args, flags) {
 
       const parsedTime = ui.parseTimestamp(log.timestamp);
       const time = ui.c.dim(parsedTime ? parsedTime.toLocaleTimeString() : '');
-      const body = log.body || log.message || log.severityText || '';
+      const body = log.body || log.message || '';
 
       const env = log.environment ? ` ${ui.c.dim(`[${log.environment}]`)}` : '';
       console.log(`  ${time} ${levelColor(level.padEnd(7))}${env} ${body}`);
 
-      if (log.traceId && flags.verbose) {
-        console.log(`  ${ui.c.dim(`  trace=${log.traceId} span=${log.spanId || ''}`)}`);
+      const traceId = log.trace_id || log.traceId;
+      if (traceId && flags.verbose) {
+        console.log(`  ${ui.c.dim(`  trace=${traceId} span=${log.span_id || log.spanId || ''}`)}`);
       }
     }
     console.log('');
@@ -315,7 +316,7 @@ async function logsTrace(args, flags) {
 
     console.log('');
     for (const log of logs) {
-      const level = (log.severityText || log.level || 'INFO').toUpperCase();
+      const level = (log.severity_text || log.severityText || log.level || 'INFO').toUpperCase();
       const levelColor = {
         ERROR: ui.c.red, FATAL: ui.c.red, WARN: ui.c.yellow, WARNING: ui.c.yellow,
         INFO: ui.c.cyan, DEBUG: ui.c.dim, TRACE: ui.c.dim,

package/cli/rateLimits.js

@@ -197,7 +197,7 @@ async function show(args, flags) {
       ['Status', r.status || '-'],
       ['Target', describeTarget(r)],
       ['Limit', `${r.limit}/${r.windowSeconds}s`],
-      ['Key by', r.keyBy || 'ip'],
+      ['Key by', r.keyName ? `${r.keyBy} ${r.keyName}` : (r.keyBy || 'ip')],
       ['App', r.applicationKey || 'all apps'],
       ['Environment', r.environment || 'all envs'],
       ['Reason', r.reason || '-'],
@@ -232,7 +232,8 @@ async function add(args, flags) {
     pathPattern,
     pathMatchMode: flags.mode || flags['path-mode'] || (pathPattern ? 'prefix' : 'prefix'),
     method: flags.method || 'ALL',
-    keyBy: flags['key-by'] || flags.keyBy || 'ip',
+    keyBy: flags['key-by'] || flags.keyBy || (flags.header ? 'header' : flags.cookie ? 'cookie' : 'ip'),
+    keyName: flags['key-name'] || flags.keyName || flags.header || flags.cookie || '',
     limit: Number(flags.limit),
     windowSeconds: parseWindow(flags.window || flags['window-seconds']),
     reason: flags.reason || '',

package/cli.js

@@ -387,6 +387,7 @@ const COMMANDS = {
       enable: { desc: 'Turn the firewall ON for an app environment', usage: 'securenow firewall enable [--app <key>] [--env production]', flags: { app: 'App key (defaults to logged-in app)', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/firewall').enable(a, f) },
       disable: { desc: 'Turn the firewall OFF for an app environment', usage: 'securenow firewall disable [--app <key>] [--env local]', flags: { app: 'App key (defaults to logged-in app)', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/firewall').disable(a, f) },
       'test-ip': { desc: 'Check if an IP would be blocked', usage: 'securenow firewall test-ip <ip> [--path /admin/users] [--method GET] [--env production]', flags: { env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/firewall').testIp(a, f) },
+      hits: { desc: 'Who the firewall stopped: blocks, 429s and challenges per rule and per IP', usage: 'securenow firewall hits [--since 24h] [--action blocked|rate_limited|captcha_challenged] [--rule <id>] [--ip <ip>] [--env production] [--json]', flags: { since: 'Look-back window, e.g. 30m, 6h, 7d (default 24h)', action: 'blocked | rate_limited | captcha_challenged', source: 'blocklist | allowlist | rate_limit | challenge', rule: 'Rule id', ip: 'Client IP', env: 'Environment', limit: 'Recent hits to fetch' }, run: (a, f) => require('./cli/firewall').hits(a, f) },
     },
     defaultSub: 'status',
   },
@@ -410,7 +411,7 @@ const COMMANDS = {
     },
     sub: {
       list: { desc: 'List rate-limit remediation rules', run: (a, f) => require('./cli/rateLimits').list(a, f) },
-      add: { desc: 'Create a rate-limit rule', usage: 'securenow ratelimit add [ip] --route /api/login --limit 5 --window 1m --duration 24h', run: (a, f) => require('./cli/rateLimits').add(a, f) },
+      add: { desc: 'Create a rate-limit rule', usage: 'securenow ratelimit add [ip] --route /api/login --limit 5 --window 1m --duration 24h [--key-by ip|global|header|cookie] [--key-name x-api-key | --header x-api-key | --cookie session]', run: (a, f) => require('./cli/rateLimits').add(a, f) },
       parse: { desc: 'Parse natural language into a rate-limit draft', usage: 'securenow ratelimit parse "rate limit /api/login to 2 attempts per minute"', run: (a, f) => require('./cli/rateLimits').parseText(a, f) },
       'from-text': { desc: 'Create a rate-limit rule from natural language', usage: 'securenow ratelimit from-text "rate limit /api/login to 2 attempts per minute" --yes', run: (a, f) => require('./cli/rateLimits').fromText(a, f) },
       show: { desc: 'Show one rate-limit rule', usage: 'securenow ratelimit show <id>', run: (a, f) => require('./cli/rateLimits').show(a, f) },

package/crash-capture.js

@@ -0,0 +1,125 @@
+'use strict';
+
+// Crash capture: an uncaught exception or an unhandled promise rejection is
+// recorded as a FATAL log record (with exception.type/message/stacktrace), the
+// log pipeline is flushed, and the process then exits the way Node would have
+// (stack on stderr, exit code 1). When the app registered its own handler, the
+// error is recorded as ERROR and the app's handler decides what happens next.
+// Transient OTLP exporter errors are still swallowed so telemetry outages never
+// crash the host app.
+
+const util = require('util');
+
+const FLUSH_TIMEOUT_MS = 2000;
+
+function unhandledRejectionMode() {
+  const args = [...process.execArgv, ...String(process.env.NODE_OPTIONS || '').split(/\s+/)];
+  for (const a of args) {
+    const m = /^--unhandled-rejections=(\S+)$/.exec(a);
+    if (m) return m[1];
+  }
+  return 'throw';
+}
+
+function describeError(err) {
+  if (err instanceof Error) {
+    const type = err.name || (err.constructor && err.constructor.name) || 'Error';
+    const message = err.message || '';
+    return { type, message, stack: err.stack || `${type}: ${message}` };
+  }
+  const text = util.inspect(err, { depth: 3, breakLength: Infinity });
+  const type = err && typeof err === 'object' ? (err.constructor && err.constructor.name) || 'Object' : typeof err;
+  return { type, message: text, stack: text };
+}
+
+function installCrashCapture({ getLogger, flush, isSdkError, onSdkError, write } = {}) {
+  const writeErr = write || ((s) => { try { process.stderr.write(s); } catch (_) {} });
+  let crashing = false;
+
+  function record(err, origin, fatal) {
+    let logger = null;
+    try { logger = getLogger ? getLogger() : null; } catch (_) {}
+    if (!logger) return;
+    const d = describeError(err);
+    const what = origin === 'unhandledRejection' ? 'Unhandled promise rejection' : 'Uncaught exception';
+    try {
+      logger.emit({
+        severityNumber: fatal ? 21 : 17,
+        severityText: fatal ? 'FATAL' : 'ERROR',
+        body: `${what}${fatal ? ', process crashed' : ' (handled by the app)'}: ${d.stack}`,
+        attributes: {
+          'log.source': 'crash',
+          'exception.type': d.type,
+          'exception.message': d.message.slice(0, 4000),
+          'exception.stacktrace': d.stack.slice(0, 16000),
+          'exception.origin': origin || 'uncaughtException',
+          'exception.escaped': Boolean(fatal),
+          'process.pid': process.pid,
+          'process.uptime_s': Math.round(process.uptime()),
+        },
+      });
+    } catch (_) {}
+  }
+
+  function flushQuietly() {
+    try {
+      return Promise.resolve(flush ? flush() : undefined).catch(() => {});
+    } catch (_) {
+      return Promise.resolve();
+    }
+  }
+
+  // Print like Node's default handler, give the exporter a bounded window to
+  // ship the crash record, then exit with code 1.
+  function crash(err, origin) {
+    if (crashing) process.exit(1);
+    crashing = true;
+    const d = describeError(err);
+    if (origin === 'unhandledRejection' && !(err instanceof Error)) {
+      writeErr(`[UnhandledPromiseRejection: This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). The promise rejected with the reason "${d.message}".]\n`);
+    } else {
+      writeErr(`${d.stack}\n`);
+    }
+    writeErr(`\nNode.js ${process.version}\n`);
+    const hardStop = setTimeout(() => process.exit(1), FLUSH_TIMEOUT_MS + 250);
+    Promise.race([flushQuietly(), new Promise((r) => setTimeout(r, FLUSH_TIMEOUT_MS))])
+      .then(() => { clearTimeout(hardStop); process.exit(1); });
+  }
+
+  process.on('uncaughtException', function securenowUncaughtException(err, origin) {
+    if (isSdkError && isSdkError(err)) {
+      if (onSdkError) onSdkError('error', err, origin);
+      return;
+    }
+    const appHandles = process.listenerCount('uncaughtException') > 1;
+    record(err, origin, !appHandles);
+    if (appHandles) {
+      flushQuietly();
+      return;
+    }
+    crash(err, origin);
+  });
+
+  process.on('unhandledRejection', function securenowUnhandledRejection(reason) {
+    if (isSdkError && isSdkError(reason)) {
+      if (onSdkError) onSdkError('rejection', reason, 'unhandledRejection');
+      return;
+    }
+    const appHandles = process.listenerCount('unhandledRejection') > 1;
+    const mode = unhandledRejectionMode();
+    if (appHandles || mode === 'warn' || mode === 'none' || mode === 'warn-with-error-code') {
+      record(reason, 'unhandledRejection', false);
+      if (!appHandles && mode === 'warn-with-error-code') {
+        writeErr(`(node:${process.pid}) UnhandledPromiseRejectionWarning: ${describeError(reason).stack}\n`);
+        process.exitCode = 1;
+      }
+      flushQuietly();
+      return;
+    }
+    // Default (--unhandled-rejections=throw): an unhandled rejection crashes.
+    record(reason, 'unhandledRejection', true);
+    crash(reason, 'unhandledRejection');
+  });
+}
+
+module.exports = { installCrashCapture, describeError, unhandledRejectionMode };

package/firewall.js

@@ -44,6 +44,10 @@ let _lastAllowlistSyncEtag = null;
 let _rateLimitRules = [];
 let _lastRateLimitVersion = null;
 let _rateLimitBuckets = new Map();
+// Optional shared counters (config.firewall.rateLimitStore = "redis://…"). When it is ready,
+// rate limits count across every worker and server; otherwise each process counts on its own.
+let _rateLimitStore = null;
+let _sharedBuckets = new Map();
 
 // CAPTCHA / proof-of-work challenge state. _challengeConfig.secret signs the
 // challenge tokens + clearance cookies (delivered per-app over sync). When a
@@ -914,10 +918,43 @@ function ruleIpMatches(rule, ip) {
 // Matches the raw path and its canonical aliases (case, trailing/duplicate slashes, percent-encoding).
 const { rulePathMatches } = require('./firewall-paths');
 
-function rateLimitKey(rule, ip) {
-  const id = rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`;
-  const subject = rule.keyBy === 'global' ? 'global' : ip;
-  return `${id}|${subject}`;
+function readCookie(req, name) {
+  const header = req && req.headers && req.headers.cookie;
+  if (!header || !name) return '';
+  for (const part of String(header).split(';')) {
+    const idx = part.indexOf('=');
+    if (idx === -1) continue;
+    if (part.slice(0, idx).trim() === name) return part.slice(idx + 1).trim();
+  }
+  return '';
+}
+
+function hashSubject(value) {
+  return require('crypto').createHash('sha256').update(String(value)).digest('hex').slice(0, 24);
+}
+
+// What one bucket counts. keyBy "header"/"cookie" counts per value of that header (an API key,
+// a user or tenant id) or cookie (a session), hashed so no raw credential is ever kept or sent
+// to a shared store. A request without the header/cookie is counted per IP instead.
+function rateLimitSubject(rule, ip, req) {
+  if (rule.keyBy === 'global') return 'global';
+  if (rule.keyBy === 'header' || rule.keyBy === 'cookie') {
+    const name = String(rule.keyName || '').trim();
+    const raw = rule.keyBy === 'header'
+      ? (req && req.headers ? req.headers[name.toLowerCase()] : '')
+      : readCookie(req, name);
+    const value = Array.isArray(raw) ? raw.join(',') : String(raw || '').trim();
+    if (value) return `${rule.keyBy}:${hashSubject(value)}`;
+  }
+  return ip;
+}
+
+function rateLimitRuleId(rule) {
+  return rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`;
+}
+
+function rateLimitKey(rule, ip, req) {
+  return `${rateLimitRuleId(rule)}|${rateLimitSubject(rule, ip, req)}`;
 }
 
 function checkBlocklistRules(req, ip) {
@@ -958,7 +995,39 @@ function checkRateLimitRules(req, ip) {
     const limit = Math.max(1, Number(rule.limit || 1) || 1);
     const windowSeconds = Math.max(1, Number(rule.windowSeconds || 60) || 60);
     const windowMs = windowSeconds * 1000;
-    const key = rateLimitKey(rule, ip);
+    const key = rateLimitKey(rule, ip, req);
+
+    if (_rateLimitStore && _rateLimitStore.ready) {
+      // Shared counters: windows aligned to the clock so every process agrees on the bucket.
+      // Decide from what is already known (this process's count, or the latest shared total
+      // plus requests still in flight) and report the hit to the store in the background.
+      const windowIndex = Math.floor(now / windowMs);
+      let shared = _sharedBuckets.get(key);
+      if (!shared || shared.windowIndex !== windowIndex) {
+        shared = { windowIndex, local: 0, shared: 0, inflight: 0 };
+        _sharedBuckets.set(key, shared);
+      }
+      if (Math.max(shared.local, shared.shared + shared.inflight) >= limit) {
+        return {
+          rule,
+          ruleId: rule.id || rule._id || '',
+          limit,
+          windowSeconds,
+          retryAfter: Math.max(1, Math.ceil(((windowIndex + 1) * windowMs - now) / 1000)),
+          path,
+          shared: true,
+        };
+      }
+      shared.local++;
+      shared.inflight++;
+      const entry = shared;
+      _rateLimitStore.incr(`securenow:rl:${key}:${windowIndex}`, windowMs + 1000)
+        .then((total) => { if (Number.isFinite(total)) entry.shared = Math.max(entry.shared, total); })
+        .catch(() => {})
+        .finally(() => { entry.inflight = Math.max(0, entry.inflight - 1); });
+      continue;
+    }
+
     let bucket = _rateLimitBuckets.get(key);
     if (!bucket || now - bucket.windowStart >= windowMs) {
       bucket = { windowStart: now, count: 0 };
@@ -983,11 +1052,21 @@ function checkRateLimitRules(req, ip) {
 }
 
 function pruneRateLimitBuckets(rules) {
-  const ids = new Set((rules || []).map((rule) => String(rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`)));
-  for (const key of _rateLimitBuckets.keys()) {
+  const ids = new Set((rules || []).map((rule) => String(rateLimitRuleId(rule))));
+  for (const buckets of [_rateLimitBuckets, _sharedBuckets]) {
+    for (const key of buckets.keys()) {
+      const idx = key.indexOf('|');
+      const ruleKey = idx === -1 ? key : key.slice(0, idx);
+      if (!ids.has(ruleKey)) buckets.delete(key);
+    }
+  }
+  // Drop shared entries from past windows so the map cannot grow without bound.
+  const now = Date.now();
+  const windowMsById = new Map((rules || []).map((r) => [String(rateLimitRuleId(r)), Math.max(1, Number(r.windowSeconds) || 60) * 1000]));
+  for (const [key, entry] of _sharedBuckets) {
     const idx = key.indexOf('|');
-    const ruleKey = idx === -1 ? key : key.slice(0, idx);
-    if (!ids.has(ruleKey)) _rateLimitBuckets.delete(key);
+    const windowMs = windowMsById.get(idx === -1 ? key : key.slice(0, idx)) || 60000;
+    if (entry.windowIndex < Math.floor(now / windowMs)) _sharedBuckets.delete(key);
   }
 }
 
@@ -1100,6 +1179,7 @@ function sendChallengeResponse(req, res, ip, decision) {
     source: 'challenge',
     statusCode: 403,
     ip,
+    ruleId: String(decision.ruleId || ''),
     matchedEntry: rid,
     method: req.method || '',
     path: decision.path || req.url || '',
@@ -1249,6 +1329,7 @@ function firewallRequestHandler(req, res) {
     reportFirewallEvent({
       source: 'blocklist',
       ip,
+      ruleId: String(blockRuleDecision.ruleId || ''),
       matchedEntry: blockRuleDecision.matchedEntry || ip,
       method: req.method || '',
       path: blockRuleDecision.path || req.url || '',
@@ -1282,6 +1363,8 @@ function firewallRequestHandler(req, res) {
       source: 'rate_limit',
       statusCode: 429,
       ip,
+      ruleId: String(rateLimitDecision.ruleId || ''),
+      keyBy: (rateLimitDecision.rule && rateLimitDecision.rule.keyBy) || 'ip',
       matchedEntry: rateLimitDecision.ruleId || '',
       method: req.method || '',
       path: rateLimitDecision.path || req.url || '',
@@ -1387,10 +1470,27 @@ function init(options) {
     if (_options.log) fwLog('[securenow] Firewall: Layer 4 (Cloud WAF)      disabled (set config.firewall.cloud=cloudflare|aws|gcp)');
   }
 
+  const storeSpec = _options.rateLimitStore !== undefined
+    ? _options.rateLimitStore
+    : require('./app-config').resolveFirewallOptions().rateLimitStore;
+  if (storeSpec) {
+    try {
+      _rateLimitStore = require('./rate-limit-store').createRateLimitStore(storeSpec, {
+        log: (...args) => { if (_options.log) fwLog(...args); },
+      });
+      if (_options.log && _rateLimitStore) fwLog('[securenow] Firewall: shared rate-limit counters → %s', _rateLimitStore.describe());
+    } catch (e) {
+      _rateLimitStore = null;
+      if (_options.log) fwWarn('[securenow] Firewall: rate-limit store disabled (%s); counting in-process', e.message);
+    }
+  }
+
   startSyncLoop();
 }
 
 function shutdown() {
+  if (_rateLimitStore) { try { _rateLimitStore.close(); } catch (_) {} _rateLimitStore = null; }
+  _sharedBuckets = new Map();
   if (_pollTimer) { clearTimeout(_pollTimer); _pollTimer = null; }
   if (_syncTimer) { clearInterval(_syncTimer); _syncTimer = null; }
   if (_eventTimer) { clearTimeout(_eventTimer); _eventTimer = null; }
@@ -1459,4 +1559,15 @@ function isRemoteEnabled() { return _remoteEnabled !== false; }
 
 function getChallengeRules() { return _challengeRules; }
 
-module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, getBlocklistRules, getRateLimitRules, getChallengeRules, isRemoteEnabled };
+// Test hooks (not part of the public API): drive rate-limit decisions without a server or sync.
+const _test = {
+  setRateLimitRules(rules) { _rateLimitRules = Array.isArray(rules) ? rules : []; _rateLimitBuckets = new Map(); _sharedBuckets = new Map(); },
+  setRateLimitStore(store) { _rateLimitStore = store || null; _sharedBuckets = new Map(); },
+  checkRateLimitRules,
+  rateLimitSubject,
+  rateLimitKey,
+  pruneRateLimitBuckets,
+  sharedBucketCount: () => _sharedBuckets.size,
+};
+
+module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, getBlocklistRules, getRateLimitRules, getChallengeRules, isRemoteEnabled, _test };