securenow 8.12.4 → 8.14.0

package/mcp/server.js

@@ -14,6 +14,9 @@ const {
   promptMessages,
   assertConfirmed,
   buildApiRequest,
+  pollToolResult,
+  fitToolResult,
+  summarizeToolResult,
   resourceContent,
   jsonText,
   maskSecret,
@@ -160,27 +163,32 @@ async function callApiTool(tool, args) {
     throw new Error('Admin auth is missing. Run `npx securenow admin login` from the project root, then retry. Runtime app credentials cannot grant admin/control-plane permissions.');
   }
 
-  const request = buildApiRequest(tool, finalArgs);
-  const options = {
-    token,
-    ...(Object.keys(request.query || {}).length > 0 ? { query: request.query } : {}),
-  };
+  const send = (request) => {
+    const options = {
+      token,
+      ...(Object.keys(request.query || {}).length > 0 ? { query: request.query } : {}),
+    };
+
+    if (request.method === 'GET') return api.get(request.endpoint, options);
+    if (request.method === 'POST') return api.post(request.endpoint, request.body || {}, options);
+    if (request.method === 'PUT') return api.put(request.endpoint, request.body || {}, options);
+    if (request.method === 'PATCH') return api.patch(request.endpoint, request.body || {}, options);
+    if (request.method === 'DELETE') return api.delete(request.endpoint, options);
 
-  if (request.method === 'GET') return api.get(request.endpoint, options);
-  if (request.method === 'POST') return api.post(request.endpoint, request.body || {}, options);
-  if (request.method === 'PUT') return api.put(request.endpoint, request.body || {}, options);
-  if (request.method === 'PATCH') return api.patch(request.endpoint, request.body || {}, options);
-  if (request.method === 'DELETE') return api.delete(request.endpoint, options);
+    throw new Error(`Unsupported method for ${tool.name}: ${request.method}`);
+  };
 
-  throw new Error(`Unsupported method for ${tool.name}: ${request.method}`);
+  const result = await send(buildApiRequest(tool, finalArgs));
+  return summarizeToolResult(tool, await pollToolResult(tool, result, send));
 }
 
-function asToolResult(result) {
+function asToolResult(rawResult) {
+  const result = fitToolResult(rawResult);
   return {
     content: [
       {
         type: 'text',
-        text: typeof result === 'string' ? result : jsonText(result),
+        text: typeof result === 'string' ? result : JSON.stringify(result),
       },
     ],
     structuredContent: typeof result === 'object' && result !== null ? result : { value: result },

package/nextjs.js

@@ -514,19 +514,14 @@ function registerSecureNow(options = {}) {
         _formatOtlpError(err)
       );
     }
-    process.on('uncaughtException', (err, origin) => {
-      if (_isOtlpTransientError(err) && (_looksLikeOtlpStack(err) || _looksLikeConfiguredOtlpEndpoint(err))) {
-        _reportSuppressedOtlpError('error', err, origin);
-        return;
-      }
-      throw err;
-    });
-    process.on('unhandledRejection', (reason) => {
-      if (_isOtlpTransientError(reason) && (_looksLikeOtlpStack(reason) || _looksLikeConfiguredOtlpEndpoint(reason))) {
-        _reportSuppressedOtlpError('rejection', reason, 'unhandledRejection');
-        return;
-      }
-      throw reason;
+    // Crash capture (see crash-capture.js). The logger provider only exists on
+    // self-hosted deployments; on Vercel crashes keep Node's default behaviour.
+    let _crashLoggerProvider = null;
+    require('./crash-capture').installCrashCapture({
+      getLogger: () => (_crashLoggerProvider ? _crashLoggerProvider.getLogger('securenow.crash', '1.0.0') : null),
+      flush: () => (_crashLoggerProvider ? _crashLoggerProvider.forceFlush() : undefined),
+      isSdkError: (e) => _isOtlpTransientError(e) && (_looksLikeOtlpStack(e) || _looksLikeConfiguredOtlpEndpoint(e)),
+      onSdkError: _reportSuppressedOtlpError,
     });
 
     if (isVercel) {
@@ -606,6 +601,7 @@ function registerSecureNow(options = {}) {
             // sdk-logs >= 0.220 takes a single options object ({ exporter }).
             processors: [new BatchLogRecordProcessor({ exporter: logExporter })],
           });
+          _crashLoggerProvider = loggerProvider;
 
           // Patch console to forward logs as OTLP log records
           const logger = loggerProvider.getLogger('console', '1.0.0');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.12.4",
+  "version": "8.14.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
@@ -11,7 +11,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-log-format.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-crash-capture.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -164,7 +164,9 @@
     "otp-redaction.js",
     "header-redaction.js",
     "firewall-paths.js",
+    "rate-limit-store.js",
     "log-format.js",
+    "crash-capture.js",
     "sdk-disabled.js",
     "rate-limits.js",
     "rate-limits.d.ts",

package/rate-limit-store.js

@@ -0,0 +1,175 @@
+'use strict';
+
+// Optional shared counters for rate limits, so every worker and every server counts against
+// one bucket instead of each process counting on its own.
+//
+//   .securenow/runtime.json → "config": { "firewall": { "rateLimitStore": "redis://host:6379" } }
+//   (rediss:// for TLS; user:password@ and /db are supported)
+//
+// The firewall never waits on Redis: it decides from what it already knows (its own count plus
+// the latest shared count Redis returned) and reports each counted request in the background.
+// At most a request or two per process can slip past the limit while a reply is in flight.
+// If Redis is unreachable the firewall keeps counting in-process (fail-open) and reconnects.
+//
+// No dependency: a minimal RESP client that only sends AUTH / SELECT / INCR / PEXPIRE.
+
+const net = require('net');
+const tls = require('tls');
+
+const COMMAND_TIMEOUT_MS = 1000;
+const MAX_BACKOFF_MS = 30000;
+
+function encodeCommand(args) {
+  let out = `*${args.length}\r\n`;
+  for (const arg of args) {
+    const s = String(arg);
+    out += `$${Buffer.byteLength(s)}\r\n${s}\r\n`;
+  }
+  return out;
+}
+
+// Parses as many complete RESP replies as the buffer holds. Returns { replies, rest }.
+function parseReplies(buffer) {
+  const replies = [];
+  let offset = 0;
+  while (offset < buffer.length) {
+    const end = buffer.indexOf('\r\n', offset);
+    if (end === -1) break;
+    const type = buffer[offset];
+    const line = buffer.toString('utf8', offset + 1, end);
+    if (type === 0x2b /* + */) { replies.push({ ok: true, value: line }); offset = end + 2; continue; }
+    if (type === 0x2d /* - */) { replies.push({ ok: false, error: line }); offset = end + 2; continue; }
+    if (type === 0x3a /* : */) { replies.push({ ok: true, value: Number(line) }); offset = end + 2; continue; }
+    if (type === 0x24 /* $ */) {
+      const len = Number(line);
+      if (len === -1) { replies.push({ ok: true, value: null }); offset = end + 2; continue; }
+      if (buffer.length < end + 2 + len + 2) break;
+      replies.push({ ok: true, value: buffer.toString('utf8', end + 2, end + 2 + len) });
+      offset = end + 2 + len + 2;
+      continue;
+    }
+    // Arrays and other types are never requested; treat as a protocol error.
+    replies.push({ ok: false, error: `unexpected reply type ${String.fromCharCode(type)}` });
+    offset = end + 2;
+  }
+  return { replies, rest: buffer.subarray(offset) };
+}
+
+class RedisCounterStore {
+  constructor(url, { log } = {}) {
+    const parsed = new URL(url);
+    if (!['redis:', 'rediss:'].includes(parsed.protocol)) throw new Error('rateLimitStore must be a redis:// or rediss:// URL');
+    this.host = parsed.hostname || '127.0.0.1';
+    this.port = Number(parsed.port || 6379);
+    this.tls = parsed.protocol === 'rediss:';
+    this.username = decodeURIComponent(parsed.username || '');
+    this.password = decodeURIComponent(parsed.password || '');
+    this.db = Number((parsed.pathname || '/').slice(1) || 0) || 0;
+    this.log = typeof log === 'function' ? log : () => {};
+    this.socket = null;
+    this.ready = false;
+    this.pending = [];
+    this.buffer = Buffer.alloc(0);
+    this.backoff = 1000;
+    this.closed = false;
+    this.connect();
+  }
+
+  describe() {
+    return `${this.tls ? 'rediss' : 'redis'}://${this.host}:${this.port}/${this.db}`;
+  }
+
+  connect() {
+    if (this.closed) return;
+    const onConnect = () => {
+      const setup = [];
+      if (this.password) setup.push(this.username ? ['AUTH', this.username, this.password] : ['AUTH', this.password]);
+      if (this.db) setup.push(['SELECT', this.db]);
+      Promise.all(setup.map((cmd) => this.send(cmd, true)))
+        .then(() => {
+          this.ready = true;
+          this.backoff = 1000;
+          this.log('[securenow] Firewall: shared rate-limit counters ON (%s)', this.describe());
+        })
+        .catch((err) => {
+          this.log('[securenow] Firewall: rate-limit store setup failed (%s); counting in-process', err.message);
+          this.socket.destroy();
+        });
+    };
+    const socket = this.tls
+      ? tls.connect({ host: this.host, port: this.port, servername: this.host }, onConnect)
+      : net.connect({ host: this.host, port: this.port }, onConnect);
+    socket.setNoDelay(true);
+    socket.unref();
+    socket.on('data', (chunk) => this.onData(chunk));
+    socket.on('error', () => { /* handled by close */ });
+    socket.on('close', () => this.onClose());
+    this.socket = socket;
+  }
+
+  onData(chunk) {
+    this.buffer = this.buffer.length ? Buffer.concat([this.buffer, chunk]) : chunk;
+    const { replies, rest } = parseReplies(this.buffer);
+    this.buffer = rest;
+    for (const reply of replies) {
+      const waiter = this.pending.shift();
+      if (!waiter) continue;
+      clearTimeout(waiter.timer);
+      if (reply.ok) waiter.resolve(reply.value);
+      else waiter.reject(new Error(reply.error));
+    }
+  }
+
+  onClose() {
+    const wasReady = this.ready;
+    this.ready = false;
+    this.buffer = Buffer.alloc(0);
+    const pending = this.pending;
+    this.pending = [];
+    for (const waiter of pending) { clearTimeout(waiter.timer); waiter.reject(new Error('connection closed')); }
+    if (this.closed) return;
+    if (wasReady) this.log('[securenow] Firewall: rate-limit store unreachable; counting in-process until it is back');
+    const delay = this.backoff;
+    this.backoff = Math.min(MAX_BACKOFF_MS, this.backoff * 2);
+    const timer = setTimeout(() => this.connect(), delay);
+    if (timer.unref) timer.unref();
+  }
+
+  send(args, allowBeforeReady = false) {
+    if (!this.socket || (!this.ready && !allowBeforeReady)) return Promise.reject(new Error('store not ready'));
+    return new Promise((resolve, reject) => {
+      const waiter = { resolve, reject, timer: null };
+      waiter.timer = setTimeout(() => {
+        reject(new Error('store timeout'));
+        // A lost reply desynchronizes the pipeline: drop the connection and start clean.
+        if (this.socket) this.socket.destroy();
+      }, COMMAND_TIMEOUT_MS);
+      if (waiter.timer.unref) waiter.timer.unref();
+      this.pending.push(waiter);
+      this.socket.write(encodeCommand(args));
+    });
+  }
+
+  // Count one request in a fixed window key; resolves with the shared total for that window.
+  incr(key, ttlMs) {
+    if (!this.ready) return Promise.reject(new Error('store not ready'));
+    const counted = this.send(['INCR', key]);
+    this.send(['PEXPIRE', key, Math.max(1000, Math.round(ttlMs))]).catch(() => {});
+    return counted;
+  }
+
+  close() {
+    this.closed = true;
+    this.ready = false;
+    if (this.socket) this.socket.destroy();
+  }
+}
+
+function createRateLimitStore(spec, options = {}) {
+  if (!spec) return null;
+  const url = typeof spec === 'string' ? spec : spec.url;
+  if (!url) return null;
+  return new RedisCounterStore(url, options);
+}
+
+module.exports = { createRateLimitStore, RedisCounterStore, encodeCommand, parseReplies };

package/tracing.js

@@ -9,7 +9,7 @@ if (require('./sdk-disabled').sdkDisabled('tracing')) return;
  * Preload with: node --require securenow/register app.js
  *
  * Works for both CJS and ESM apps. On Node >=20.6 the ESM loader hook is
- * auto-registered via module.register() — no --import flag needed.
+ * auto-registered via module.register() — no --import flag needed.
  * On Node 18 with "type": "module", add the hook manually:
  *   node --import @opentelemetry/instrumentation/hook.mjs --require securenow/register app.js
  *
@@ -348,7 +348,7 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
         const hasCliHook = execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle');
         const hasModuleRegister = typeof require('node:module').register === 'function';
         if (!hasCliHook && !hasModuleRegister) {
-          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
+          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
           console.warn('[securenow]    Upgrade to Node >=20.6 (recommended) or add: --import @opentelemetry/instrumentation/hook.mjs');
         }
       }
@@ -384,7 +384,7 @@ const headers = resolvedEndpoints.headers;
 const rawBase = (resolvedApp.appId || '').trim().replace(/^['"]|['"]$/g, '');
 const baseName = rawBase || null;
 // Auto-disables the per-worker suffix when we resolved a routing UUID from
-// credentials — the dashboard does exact-match IN on service.name, so any
+// credentials — the dashboard does exact-match IN on service.name, so any
 // suffix breaks routing. config.runtime.noUuid can override.
 const noUuid   = appConfig.resolveNoUuid();
 const strict   = appConfig.boolConfig('runtime.strict', false);
@@ -411,7 +411,7 @@ const instancePrefix   = baseName || 'securenow';
 const serviceInstanceId = `${instancePrefix}-${randomUUID()}`;
 
 // Loud line per worker to prove what was used
-console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=%s instance.id=%s',
+console.log('[securenow] pid=%d appId=%s instance=%s apiKey=%s → service.name=%s instance.id=%s',
   process.pid,
   JSON.stringify(baseName),
   JSON.stringify(endpointBase),
@@ -739,21 +739,15 @@ function _reportSuppressedOtlpError(kind, err, origin) {
   );
 }
 
-process.on('uncaughtException', (err, origin) => {
-  if (_isOtlpTransientError(err) && (_looksLikeOtlpStack(err) || _looksLikeConfiguredOtlpEndpoint(err))) {
-    _reportSuppressedOtlpError('error', err, origin);
-    return; // swallow - do not crash
-  }
-  // Not ours — re-throw so the default handler (or the app's own handler) fires
-  throw err;
-});
-process.on('unhandledRejection', (reason) => {
-  if (_isOtlpTransientError(reason) && (_looksLikeOtlpStack(reason) || _looksLikeConfiguredOtlpEndpoint(reason))) {
-    _reportSuppressedOtlpError('rejection', reason, 'unhandledRejection');
-    return; // swallow
-  }
-  // Not ours — re-throw as unhandled so Node's default behaviour applies
-  throw reason;
+// Crashes: OTLP exporter blips are swallowed (never crash the host app); every
+// other uncaught exception / unhandled rejection is recorded as a FATAL log
+// record, flushed, and the process exits like Node's default (code 1). If the
+// app has its own handler, the error is recorded and that handler decides.
+require('./crash-capture').installCrashCapture({
+  getLogger: () => (loggerProvider ? loggerProvider.getLogger('securenow.crash', '1.0.0') : null),
+  flush: () => (loggerProvider ? loggerProvider.forceFlush() : undefined),
+  isSdkError: (e) => _isOtlpTransientError(e) && (_looksLikeOtlpStack(e) || _looksLikeConfiguredOtlpEndpoint(e)),
+  onSdkError: _reportSuppressedOtlpError,
 });
 
 // -------- SDK --------
@@ -779,17 +773,17 @@ const sdk = new NodeSDK({
 (async () => {
   try {
     await Promise.resolve(sdk.start?.());
-    console.log('[securenow] OTel SDK started → %s', tracesUrl);
+    console.log('[securenow] OTel SDK started → %s', tracesUrl);
     if (loggingEnabled) {
-      console.log('[securenow] 📋 Logging: ENABLED → %s', logsUrl);
+      console.log('[securenow] 📋 Logging: ENABLED → %s', logsUrl);
     } else {
       console.log('[securenow] Logging: DISABLED (config.logging.enabled=false)');
     }
     if (captureBody) {
-      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
+      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
     }
     if (captureMultipart) {
-      console.log('[securenow] 📎 Multipart body capture: ENABLED (streaming — file content not buffered)');
+      console.log('[securenow] 📎 Multipart body capture: ENABLED (streaming — file content not buffered)');
     }
     if (appConfig.boolConfig('runtime.testSpan', false)) {
       const api = require('@opentelemetry/api');
@@ -797,9 +791,9 @@ const sdk = new NodeSDK({
       const span = tracer.startSpan('securenow.startup.smoke'); span.end();
     }
 
-    // Firewall — auto-activates only when a real snk_live_ key is resolvable.
+    // Firewall — auto-activates only when a real snk_live_ key is resolvable.
     // resolveApiKey() enforces the prefix, so we skip cleanly when the app has
-    // only an app-routing UUID (or nothing at all) — no 401 polling loops.
+    // only an app-routing UUID (or nothing at all) — no 401 polling loops.
     const firewallOptions = appConfig.resolveFirewallOptions();
     if (firewallOptions.apiKey) {
       require('./firewall').init({