securenow 8.13.0 → 8.14.1

package/README.md

@@ -6,7 +6,7 @@
 
 Your coding agent knows your code. SecureNow shows it what's happening in production. One Node.js package, CLI, and MCP server connect Claude Code, Codex, and Cursor to your live application security — attacks, routes, users, traces, IP intelligence, and response controls.
 
-Your agent already sees the repository, the dependencies, the auth implementation, the API handlers, the database queries. SecureNow adds the half it can't see: live requests, routes, users and sessions, attack patterns, IP intelligence, traces and logs, security history, and block / rate-limit controls — with human approval on every mutation.
+Your agent already sees the repository, the dependencies, the auth implementation, the API handlers, the database queries. SecureNow adds the half it can't see: live requests, routes, users and sessions, attack patterns, IP intelligence, traces and logs, security history, and block / rate-limit controls — every write confirmed by you and recorded.
 
 **Find it in code. Watch it in production.**
 
@@ -33,7 +33,7 @@ Agent: Apply the recommended blocks?
 You:   Yes.
 ```
 
-Detection and investigation are automatic. Actions are proposed, a human approves, then they execute — and every action is reversible (unblock keeps the history, revocations can be restored, rate limits expire).
+Detection and investigation are automatic. Your agent proposes actions and asks before it acts: every write needs an explicit `confirm: true` and a reason, applies to your running apps in about 10 seconds, and is reversible (unblock keeps the history, revocations can be restored, rate limits expire). Some automated AI blocks wait in an approval queue (`securenow human`).
 
 ---
 
@@ -176,11 +176,25 @@ Everything the MCP server can do is also a command. Run `npx securenow help` for
 | `securenow human block <row> --yes --reason "..."` | Approve a proposed block |
 | `securenow blocklist add <ip> [--route /admin*] [--mode prefix] [--duration 24h] [--reason "..."]` | Block an IP globally or per-route |
 | `securenow blocklist unblock <id> --reason "..."` | Stop enforcement, keep the history |
-| `securenow ratelimit from-text "rate limit /api/login to 5 per minute" --yes` | Rate-limit rule from natural language |
+| `securenow ratelimit from-text "5 per minute per IP on POST /api/login for 2h" --yes` | Rate-limit rule from natural language |
+| `securenow ratelimit add --route /api/ --limit 100 --window 1m --header x-api-key` | Per-API-key (or `--cookie session` per-session) limit |
+| `securenow firewall hits --since 1h` | Who your blocks, rate limits and challenges actually stopped |
 | `securenow challenge add <ip> --route /login` | Proof-of-work challenge instead of a hard block |
 | `securenow revoke session <id>` / `revoke user <id>` | Kill stolen sessions (enforced via `securenow/sessions`) |
 | `securenow trusted add <ip>` | Mark an IP as trusted |
 
+### Rate limits, outside your code
+
+Rate-limit rules live in SecureNow, not in your code: create them from the dashboard, the CLI or your agent (MCP), and every running instance picks them up in about 10 seconds, with no deploy. A rule matches a route (exact, prefix or regex), a method, optionally an IP/CIDR, an app and an environment, and counts per IP, globally, per request header value (`--header x-api-key`) or per cookie value (`--cookie session`). Header and cookie values are hashed; requests without them are counted per IP. Rules can stack (a burst limit and an hourly cap). Over the limit, the app answers `429` with `Retry-After`.
+
+Counters live in each process by default. To share one counter across workers and servers, point the firewall at your Redis:
+
+```json
+{ "config": { "firewall": { "rateLimitStore": "redis://your-redis:6379" } } }
+```
+
+The firewall never waits on Redis: it decides from what it already knows and reports each hit in the background (at most about one extra request per process can get through while a reply is in flight). If Redis is unreachable, counting falls back to in-process.
+
 ### Rules & detections
 
 | Command | Description |
@@ -235,7 +249,7 @@ It syncs your app's blocklist plus SecureNow's known-bad IP feed, refreshed hour
 
   SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
 - **Fails open.** If SecureNow is unreachable, your app serves traffic normally (`config.firewall.failMode: "open"` is the default).
-- **Read/write split.** MCP read tools are read-only; write tools require explicit `confirm: true` plus a reason, and human approval is the designed path for mutations — blocks, rate limits, and revocations are proposed, approved, executed, and reversible.
+- **Read/write split.** MCP read tools are read-only; write tools require explicit `confirm: true` plus a reason, so your agent asks you before it blocks, rate-limits or revokes anything; every write is recorded and reversible.
 
 More at [securenow.ai/security](https://securenow.ai/security).
 

package/app-config.js

@@ -75,6 +75,7 @@ const DEFAULT_CONFIG = Object.freeze({
     iptables: false,
     cloud: null,
     cloudDryRun: false,
+    rateLimitStore: null,
     cloudflare: {
       apiToken: null,
       accountId: null,
@@ -126,6 +127,7 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.firewall.iptables': 'Layer 3 OS firewall. Default false because it requires Linux root/CAP_NET_ADMIN.',
   'config.firewall.cloud': 'Layer 4 WAF provider: cloudflare, aws, gcp, or null.',
   'config.firewall.cloudDryRun': 'Log intended cloud WAF pushes without applying them.',
+  'config.firewall.rateLimitStore': 'Optional shared rate-limit counters: a redis:// or rediss:// URL. Unset = each process counts on its own. If the store is unreachable, counting falls back to in-process.',
   'config.firewall.cloudflare': 'Cloudflare API token/account id for Layer 4 WAF. Secrets: do not commit.',
   'config.firewall.aws': 'AWS WAF IP set configuration for Layer 4 WAF.',
   'config.firewall.gcp': 'GCP Cloud Armor policy configuration for Layer 4 WAF.',
@@ -710,6 +712,8 @@ function resolveFirewallOptions() {
     iptables: boolConfig('firewall.iptables', false),
     cloud: configValue('firewall.cloud', null) || null,
     cloudDryRun: boolConfig('firewall.cloudDryRun', false),
+    // Optional shared rate-limit counters: "redis://host:6379" (or rediss://). Unset = per process.
+    rateLimitStore: configValue('firewall.rateLimitStore', null) || null,
     cloudflare: {
       apiToken: resolveConfigPath('firewall.cloudflare.apiToken', [], null) || null,
       accountId: resolveConfigPath('firewall.cloudflare.accountId', [], null) || null,

package/cli/automation.js

@@ -82,7 +82,7 @@ async function list(args, flags) {
 
     console.log('');
     const rows = rules.map((rule) => [
-      ui.c.dim(ui.truncate(rule._id || rule.id, 12)),
+      ui.c.dim(rule.id || rule._id || ''),
       rule.name || '-',
       ui.statusBadge(rule.status || 'active'),
       formatApplications(rule),

package/cli/challenges.js

@@ -64,7 +64,7 @@ async function list(args, flags) {
 
     console.log('');
     const rows = rules.map((r) => [
-      ui.c.dim(ui.truncate(r.id || r._id, 12)),
+      ui.c.dim(r.id || r._id || ''),
       r.status === 'active' ? ui.statusBadge('active') : ui.statusBadge(r.status || 'unknown'),
       describeTarget(r),
       `pow:${r.difficulty}`,

package/cli/firewall.js

@@ -216,4 +216,50 @@ async function appsList(args, flags) {
   }
 }
 
-module.exports = { status, testIp, enable, disable, appsList };
+// securenow firewall hits — who the firewall actually stopped (blocks, 429s, challenges),
+// per rule and per IP, plus the latest hits. The quickest "is my rule working?" check.
+async function hits(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Loading firewall hits');
+  try {
+    const query = { since: flags.since || '24h' };
+    const appKey = await resolveAppKey(flags);
+    if (appKey) query.appKey = appKey;
+    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
+    if (flags.action) query.action = flags.action === 'rate-limited' ? 'rate_limited' : flags.action;
+    if (flags.source) query.source = flags.source === 'rate-limit' ? 'rate_limit' : flags.source;
+    if (flags.rule) query.ruleId = flags.rule;
+    if (flags.ip) query.ip = flags.ip;
+    if (flags.limit) query.limit = flags.limit;
+    const data = await api.get('/firewall/hits', { query });
+    s.stop('Firewall hits loaded');
+    if (flags.json) { ui.json(data); return; }
+
+    const label = { blocked: 'blocked', rate_limited: '429', captcha_challenged: 'challenged', captcha_passed: 'passed', captcha_failed: 'failed', allowed: 'allowed' };
+    const totals = Object.entries(data.totals || {}).map(([k, v]) => `${label[k] || k} ${v}`).join(' · ') || 'none';
+    console.log('');
+    console.log(`  ${ui.c.bold('Hits')} ${ui.c.dim(`${new Date(data.from).toLocaleString()} → ${new Date(data.to).toLocaleString()}`)}   ${totals}`);
+    console.log('');
+    if (!(data.byRule || []).length) {
+      console.log(`  ${ui.c.dim('No blocks, rate limits or challenges in this window.')}`);
+      console.log('');
+      return;
+    }
+    console.log(`  ${ui.c.bold('By rule')}`);
+    for (const r of data.byRule.slice(0, 15)) {
+      const what = r.rule || (r.ruleId ? `rule ${r.ruleId}` : r.matchedEntry ? `block ${r.matchedEntry}` : r.source);
+      console.log(`  ${String(r.hits).padStart(6)}  ${(label[r.action] || r.action).padEnd(10)} ${what}  ${ui.c.dim(`${r.distinctIps} IP${r.distinctIps === 1 ? '' : 's'}${r.ruleId ? ` · ${r.ruleId}` : ''}`)}`);
+    }
+    console.log('');
+    console.log(`  ${ui.c.bold('Top IPs')}`);
+    for (const r of (data.byIp || []).slice(0, 10)) {
+      console.log(`  ${String(r.hits).padStart(6)}  ${(label[r.action] || r.action).padEnd(10)} ${r.ip}`);
+    }
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to load firewall hits');
+    throw err;
+  }
+}
+
+module.exports = { status, testIp, enable, disable, appsList, hits };

package/cli/fp.js

@@ -76,7 +76,7 @@ async function list(args, flags) {
     const rows = exclusions.map(e => {
       const scope = e.type === 'global' ? ui.c.cyan('All Rules') : `Rule: ${ui.truncate(e.ruleName || '?', 18)}`;
       return [
-        ui.c.dim(ui.truncate(e._id, 12)),
+        ui.c.dim(e.id || e._id || ''),
         scope,
         ui.truncate(conditionsSummary(e.conditions, e.matchMode), 40),
         (e.matchMode || 'all').toUpperCase(),

package/cli/monitor.js

@@ -269,7 +269,7 @@ async function logsList(args, flags) {
 
     console.log('');
     for (const log of logs) {
-      const level = (log.severityText || log.level || 'INFO').toUpperCase();
+      const level = (log.severity_text || log.severityText || log.level || 'INFO').toUpperCase();
       const levelColor = {
         ERROR: ui.c.red, FATAL: ui.c.red, WARN: ui.c.yellow, WARNING: ui.c.yellow,
         INFO: ui.c.cyan, DEBUG: ui.c.dim, TRACE: ui.c.dim,
@@ -277,13 +277,14 @@ async function logsList(args, flags) {
 
       const parsedTime = ui.parseTimestamp(log.timestamp);
       const time = ui.c.dim(parsedTime ? parsedTime.toLocaleTimeString() : '');
-      const body = log.body || log.message || log.severityText || '';
+      const body = log.body || log.message || '';
 
       const env = log.environment ? ` ${ui.c.dim(`[${log.environment}]`)}` : '';
       console.log(`  ${time} ${levelColor(level.padEnd(7))}${env} ${body}`);
 
-      if (log.traceId && flags.verbose) {
-        console.log(`  ${ui.c.dim(`  trace=${log.traceId} span=${log.spanId || ''}`)}`);
+      const traceId = log.trace_id || log.traceId;
+      if (traceId && flags.verbose) {
+        console.log(`  ${ui.c.dim(`  trace=${traceId} span=${log.span_id || log.spanId || ''}`)}`);
       }
     }
     console.log('');
@@ -315,7 +316,7 @@ async function logsTrace(args, flags) {
 
     console.log('');
     for (const log of logs) {
-      const level = (log.severityText || log.level || 'INFO').toUpperCase();
+      const level = (log.severity_text || log.severityText || log.level || 'INFO').toUpperCase();
       const levelColor = {
         ERROR: ui.c.red, FATAL: ui.c.red, WARN: ui.c.yellow, WARNING: ui.c.yellow,
         INFO: ui.c.cyan, DEBUG: ui.c.dim, TRACE: ui.c.dim,
@@ -350,7 +351,7 @@ async function notificationsList(args, flags) {
 
     console.log('');
     const rows = notifications.map(n => [
-      ui.c.dim(ui.truncate(n._id, 12)),
+      ui.c.dim(n.id || n._id || ''),
       ui.statusBadge(n.read ? 'read' : 'unread'),
       ui.truncate(n.title || n.message || n.type || '', 50),
       n.ip || '—',

package/cli/rateLimits.js

@@ -47,6 +47,16 @@ function describeTarget(rule) {
   return parts.join(' ') || 'all traffic';
 }
 
+// The bucket each request counts against: "ip", "global", "header x-api-key", "cookie session".
+function describeKey(rule) {
+  const keyBy = rule.keyBy || 'ip';
+  return rule.keyName && (keyBy === 'header' || keyBy === 'cookie') ? `${keyBy} ${rule.keyName}` : keyBy;
+}
+
+function isExpired(rule) {
+  return Boolean(rule.expiresAt) && new Date(rule.expiresAt).getTime() <= Date.now();
+}
+
 function naturalText(args, flags) {
   return String(flags.text || flags.prompt || flags.query || args.join(' ') || '').trim();
 }
@@ -62,6 +72,11 @@ function draftFromFlags(flags) {
   if (flags.mode || flags['path-mode']) draft.pathMatchMode = flags.mode || flags['path-mode'];
   if (flags.method) draft.method = flags.method;
   if (flags['key-by'] || flags.keyBy) draft.keyBy = flags['key-by'] || flags.keyBy;
+  else if (flags.header) draft.keyBy = 'header';
+  else if (flags.cookie) draft.keyBy = 'cookie';
+  if (flags['key-name'] || flags.keyName || flags.header || flags.cookie) {
+    draft.keyName = flags['key-name'] || flags.keyName || flags.header || flags.cookie;
+  }
   if (flags.limit) draft.limit = Number(flags.limit);
   if (flags.window || flags['window-seconds']) draft.windowSeconds = parseWindow(flags.window || flags['window-seconds']);
   if (flags.duration) draft.duration = flags.duration;
@@ -76,7 +91,7 @@ function printParsedDraft(data) {
     ['Name', draft.name || '-'],
     ['Target', describeTarget(draft)],
     ['Limit', `${draft.limit || '-'} / ${draft.windowSeconds || '-'}s`],
-    ['Key by', draft.keyBy || 'ip'],
+    ['Key by', describeKey(draft)],
     ['App', draft.appKey || 'all'],
     ['Environment', draft.environment || 'all'],
     ['Duration', draft.duration || 'none'],
@@ -107,16 +122,17 @@ async function list(args, flags) {
 
     console.log('');
     const rows = rules.map((r) => [
-      ui.c.dim(ui.truncate(r.id || r._id, 12)),
-      r.status === 'active' ? ui.statusBadge('active') : ui.statusBadge(r.status || 'unknown'),
+      ui.c.dim(r.id || r._id || ''),
+      ui.statusBadge(r.status === 'active' && isExpired(r) ? 'expired' : (r.status || 'unknown')),
       describeTarget(r),
       `${r.limit}/${r.windowSeconds}s`,
+      describeKey(r),
       r.applicationKey || ui.c.dim('all apps'),
       r.environment || ui.c.dim('all envs'),
       r.expiresAt ? new Date(r.expiresAt).toLocaleString() : ui.c.dim('permanent'),
       ui.timeAgo(r.createdAt),
     ]);
-    ui.table(['ID', 'Status', 'Target', 'Limit', 'App', 'Env', 'Expires', 'Created'], rows);
+    ui.table(['ID', 'Status', 'Target', 'Limit', 'Per', 'App', 'Env', 'Expires', 'Created'], rows);
     console.log('');
   } catch (err) {
     s.fail('Failed to fetch rate limits');
@@ -167,7 +183,7 @@ async function fromText(args, flags) {
     if (flags.json) { ui.json(data); return; }
     const r = data.rateLimit;
     console.log('');
-    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s`);
+    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s per ${describeKey(r)}`);
     console.log(`  ${ui.c.dim('ID:')} ${r.id || r._id}`);
     console.log('');
   } catch (err) {
@@ -197,7 +213,7 @@ async function show(args, flags) {
       ['Status', r.status || '-'],
       ['Target', describeTarget(r)],
       ['Limit', `${r.limit}/${r.windowSeconds}s`],
-      ['Key by', r.keyBy || 'ip'],
+      ['Key by', describeKey(r)],
       ['App', r.applicationKey || 'all apps'],
       ['Environment', r.environment || 'all envs'],
       ['Reason', r.reason || '-'],
@@ -232,7 +248,8 @@ async function add(args, flags) {
     pathPattern,
     pathMatchMode: flags.mode || flags['path-mode'] || (pathPattern ? 'prefix' : 'prefix'),
     method: flags.method || 'ALL',
-    keyBy: flags['key-by'] || flags.keyBy || 'ip',
+    keyBy: flags['key-by'] || flags.keyBy || (flags.header ? 'header' : flags.cookie ? 'cookie' : 'ip'),
+    keyName: flags['key-name'] || flags.keyName || flags.header || flags.cookie || '',
     limit: Number(flags.limit),
     windowSeconds: parseWindow(flags.window || flags['window-seconds']),
     reason: flags.reason || '',
@@ -250,7 +267,7 @@ async function add(args, flags) {
     if (flags.json) { ui.json(data); return; }
     const r = data.rateLimit;
     console.log('');
-    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s`);
+    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s per ${describeKey(r)}`);
     console.log(`  ${ui.c.dim('ID:')} ${r.id || r._id}`);
     console.log('');
   } catch (err) {
@@ -329,7 +346,7 @@ async function test(args, flags) {
     if (data.limited) {
       console.log(`  ${ui.c.bold(ui.c.yellow('RATE LIMITED'))} - ${data.matches.length} matching rule${data.matches.length !== 1 ? 's' : ''}`);
       for (const r of data.matches.slice(0, 5)) {
-        console.log(`  ${ui.c.dim(r.id || r._id)}  ${describeTarget(r)}  ${r.limit}/${r.windowSeconds}s`);
+        console.log(`  ${ui.c.dim(r.id || r._id)}  ${describeTarget(r)}  ${r.limit}/${r.windowSeconds}s per ${describeKey(r)}`);
       }
     } else {
       console.log(`  ${ui.c.bold(ui.c.green('NOT LIMITED'))} - no matching rate-limit rules`);

package/cli/security.js

@@ -190,7 +190,7 @@ async function alertRulesList(args, flags) {
 
     console.log('');
     const rows = rules.map((r) => [
-      ui.c.dim(ui.truncate(r._id || r.id, 12)),
+      ui.c.dim(r.id || r._id || ''),
       r.name || '—',
       ruleStatusBadge(r),
       r.mode === 'test' ? ui.c.yellow('test') : ui.c.dim('prod'),
@@ -836,7 +836,7 @@ async function alertRuleExclusions(args, flags) {
     if (flags.json) { ui.json(data); return; }
     console.log('');
     const rows = exclusions.map((e) => [
-      ui.c.dim(ui.truncate(e._id, 12)),
+      ui.c.dim(e.id || e._id || ''),
       e.isActive === false ? ui.statusBadge('disabled') : ui.statusBadge('active'),
       e.matchMode || 'all',
       ui.truncate(e.reason || e.pathPattern || JSON.stringify(e.conditions || []), 72),
@@ -862,7 +862,7 @@ async function alertChannelsList(args, flags) {
 
     console.log('');
     const rows = channels.map(ch => [
-      ui.c.dim(ui.truncate(ch._id, 12)),
+      ui.c.dim(ch.id || ch._id || ''),
       ch.name || '—',
       ch.type || '—',
       ui.statusBadge(ch.enabled !== false ? 'enabled' : 'disabled'),
@@ -891,7 +891,7 @@ async function alertHistoryList(args, flags) {
 
     console.log('');
     const rows = history.map(h => [
-      ui.c.dim(ui.truncate(h._id, 12)),
+      ui.c.dim(h.id || h._id || ''),
       h.ruleName || h.type || '—',
       h.severity ? ui.statusBadge(h.severity) : '—',
       ui.truncate(h.message || h.description || '', 40),
@@ -938,7 +938,7 @@ async function blocklistList(args, flags) {
 
     console.log('');
     const rows = items.map(b => [
-      ui.c.dim(ui.truncate(b._id, 12)),
+      ui.c.dim(b.id || b._id || ''),
       ui.c.red(describeBlockTarget(b)),
       ui.truncate(b.reason || '', 40),
       b.source || '—',
@@ -1011,7 +1011,7 @@ async function revokeList(args, flags) {
     if (flags.json) { ui.json(entries); return; }
     console.log('');
     ui.table(['ID', 'Type', 'Value', 'Scope', 'Expires'], entries.map((r) => [
-      ui.c.dim(ui.truncate(r._id || r.id, 12)),
+      ui.c.dim(r.id || r._id || ''),
       r.type,
       ui.truncate(r.value, 28),
       r.applicationKey || ui.c.dim('all'),
@@ -1191,7 +1191,7 @@ async function allowlistList(args, flags) {
 
     console.log('');
     const rows = items.map(a => [
-      ui.c.dim(ui.truncate(a._id, 12)),
+      ui.c.dim(a.id || a._id || ''),
       ui.c.green(a.ip || '—'),
       a.label || ui.c.dim('—'),
       ui.truncate(a.reason || '', 40),
@@ -1307,7 +1307,7 @@ async function trustedList(args, flags) {
 
     console.log('');
     const rows = items.map(t => [
-      ui.c.dim(ui.truncate(t._id, 12)),
+      ui.c.dim(t.id || t._id || ''),
       ui.c.green(t.ip || t.cidr || '—'),
       t.label || t.description || ui.c.dim('—'),
       t.applicationKey || ui.c.dim('all apps'),
@@ -1494,7 +1494,7 @@ async function forensicsLibrary(args, flags) {
 
     console.log('');
     const rows = queries.map(q => [
-      ui.c.dim(ui.truncate(q._id, 12)),
+      ui.c.dim(q.id || q._id || ''),
       q.name || q.title || '—',
       ui.truncate(q.description || q.query || '', 50),
       ui.timeAgo(q.createdAt),
@@ -1756,7 +1756,7 @@ async function instancesList(args, flags) {
 
     console.log('');
     const rows = instances.map(inst => [
-      ui.c.dim(ui.truncate(inst._id, 12)),
+      ui.c.dim(inst.id || inst._id || ''),
       inst.name || inst.host || '—',
       inst.host || '—',
       inst.port != null ? String(inst.port) : '—',

package/cli/ui.js

@@ -354,6 +354,7 @@ function statusBadge(status) {
     trusted: c.green('■ trusted'),
     enabled: c.green('● enabled'),
     disabled: c.dim('○ disabled'),
+    expired: c.dim('○ expired'),
     paused: c.yellow('◆ paused'),
     critical: c.red('▲ critical'),
     high: c.red('▲ high'),

package/cli.js

@@ -387,6 +387,7 @@ const COMMANDS = {
       enable: { desc: 'Turn the firewall ON for an app environment', usage: 'securenow firewall enable [--app <key>] [--env production]', flags: { app: 'App key (defaults to logged-in app)', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/firewall').enable(a, f) },
       disable: { desc: 'Turn the firewall OFF for an app environment', usage: 'securenow firewall disable [--app <key>] [--env local]', flags: { app: 'App key (defaults to logged-in app)', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/firewall').disable(a, f) },
       'test-ip': { desc: 'Check if an IP would be blocked', usage: 'securenow firewall test-ip <ip> [--path /admin/users] [--method GET] [--env production]', flags: { env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/firewall').testIp(a, f) },
+      hits: { desc: 'Who the firewall stopped: blocks, 429s and challenges per rule and per IP', usage: 'securenow firewall hits [--since 24h] [--action blocked|rate_limited|captcha_challenged] [--rule <id>] [--ip <ip>] [--env production] [--json]', flags: { since: 'Look-back window, e.g. 30m, 6h, 7d (default 24h)', action: 'blocked | rate_limited | captcha_challenged', source: 'blocklist | allowlist | rate_limit | challenge', rule: 'Rule id', ip: 'Client IP', env: 'Environment', limit: 'Recent hits to fetch' }, run: (a, f) => require('./cli/firewall').hits(a, f) },
     },
     defaultSub: 'status',
   },
@@ -410,7 +411,7 @@ const COMMANDS = {
     },
     sub: {
       list: { desc: 'List rate-limit remediation rules', run: (a, f) => require('./cli/rateLimits').list(a, f) },
-      add: { desc: 'Create a rate-limit rule', usage: 'securenow ratelimit add [ip] --route /api/login --limit 5 --window 1m --duration 24h', run: (a, f) => require('./cli/rateLimits').add(a, f) },
+      add: { desc: 'Create a rate-limit rule', usage: 'securenow ratelimit add [ip] --route /api/login --limit 5 --window 1m --duration 24h [--key-by ip|global|header|cookie] [--key-name x-api-key | --header x-api-key | --cookie session]', run: (a, f) => require('./cli/rateLimits').add(a, f) },
       parse: { desc: 'Parse natural language into a rate-limit draft', usage: 'securenow ratelimit parse "rate limit /api/login to 2 attempts per minute"', run: (a, f) => require('./cli/rateLimits').parseText(a, f) },
       'from-text': { desc: 'Create a rate-limit rule from natural language', usage: 'securenow ratelimit from-text "rate limit /api/login to 2 attempts per minute" --yes', run: (a, f) => require('./cli/rateLimits').fromText(a, f) },
       show: { desc: 'Show one rate-limit rule', usage: 'securenow ratelimit show <id>', run: (a, f) => require('./cli/rateLimits').show(a, f) },

package/firewall.js

@@ -44,6 +44,10 @@ let _lastAllowlistSyncEtag = null;
 let _rateLimitRules = [];
 let _lastRateLimitVersion = null;
 let _rateLimitBuckets = new Map();
+// Optional shared counters (config.firewall.rateLimitStore = "redis://…"). When it is ready,
+// rate limits count across every worker and server; otherwise each process counts on its own.
+let _rateLimitStore = null;
+let _sharedBuckets = new Map();
 
 // CAPTCHA / proof-of-work challenge state. _challengeConfig.secret signs the
 // challenge tokens + clearance cookies (delivered per-app over sync). When a
@@ -914,10 +918,43 @@ function ruleIpMatches(rule, ip) {
 // Matches the raw path and its canonical aliases (case, trailing/duplicate slashes, percent-encoding).
 const { rulePathMatches } = require('./firewall-paths');
 
-function rateLimitKey(rule, ip) {
-  const id = rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`;
-  const subject = rule.keyBy === 'global' ? 'global' : ip;
-  return `${id}|${subject}`;
+function readCookie(req, name) {
+  const header = req && req.headers && req.headers.cookie;
+  if (!header || !name) return '';
+  for (const part of String(header).split(';')) {
+    const idx = part.indexOf('=');
+    if (idx === -1) continue;
+    if (part.slice(0, idx).trim() === name) return part.slice(idx + 1).trim();
+  }
+  return '';
+}
+
+function hashSubject(value) {
+  return require('crypto').createHash('sha256').update(String(value)).digest('hex').slice(0, 24);
+}
+
+// What one bucket counts. keyBy "header"/"cookie" counts per value of that header (an API key,
+// a user or tenant id) or cookie (a session), hashed so no raw credential is ever kept or sent
+// to a shared store. A request without the header/cookie is counted per IP instead.
+function rateLimitSubject(rule, ip, req) {
+  if (rule.keyBy === 'global') return 'global';
+  if (rule.keyBy === 'header' || rule.keyBy === 'cookie') {
+    const name = String(rule.keyName || '').trim();
+    const raw = rule.keyBy === 'header'
+      ? (req && req.headers ? req.headers[name.toLowerCase()] : '')
+      : readCookie(req, name);
+    const value = Array.isArray(raw) ? raw.join(',') : String(raw || '').trim();
+    if (value) return `${rule.keyBy}:${hashSubject(value)}`;
+  }
+  return ip;
+}
+
+function rateLimitRuleId(rule) {
+  return rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`;
+}
+
+function rateLimitKey(rule, ip, req) {
+  return `${rateLimitRuleId(rule)}|${rateLimitSubject(rule, ip, req)}`;
 }
 
 function checkBlocklistRules(req, ip) {
@@ -958,7 +995,39 @@ function checkRateLimitRules(req, ip) {
     const limit = Math.max(1, Number(rule.limit || 1) || 1);
     const windowSeconds = Math.max(1, Number(rule.windowSeconds || 60) || 60);
     const windowMs = windowSeconds * 1000;
-    const key = rateLimitKey(rule, ip);
+    const key = rateLimitKey(rule, ip, req);
+
+    if (_rateLimitStore && _rateLimitStore.ready) {
+      // Shared counters: windows aligned to the clock so every process agrees on the bucket.
+      // Decide from what is already known (this process's count, or the latest shared total
+      // plus requests still in flight) and report the hit to the store in the background.
+      const windowIndex = Math.floor(now / windowMs);
+      let shared = _sharedBuckets.get(key);
+      if (!shared || shared.windowIndex !== windowIndex) {
+        shared = { windowIndex, local: 0, shared: 0, inflight: 0 };
+        _sharedBuckets.set(key, shared);
+      }
+      if (Math.max(shared.local, shared.shared + shared.inflight) >= limit) {
+        return {
+          rule,
+          ruleId: rule.id || rule._id || '',
+          limit,
+          windowSeconds,
+          retryAfter: Math.max(1, Math.ceil(((windowIndex + 1) * windowMs - now) / 1000)),
+          path,
+          shared: true,
+        };
+      }
+      shared.local++;
+      shared.inflight++;
+      const entry = shared;
+      _rateLimitStore.incr(`securenow:rl:${key}:${windowIndex}`, windowMs + 1000)
+        .then((total) => { if (Number.isFinite(total)) entry.shared = Math.max(entry.shared, total); })
+        .catch(() => {})
+        .finally(() => { entry.inflight = Math.max(0, entry.inflight - 1); });
+      continue;
+    }
+
     let bucket = _rateLimitBuckets.get(key);
     if (!bucket || now - bucket.windowStart >= windowMs) {
       bucket = { windowStart: now, count: 0 };
@@ -983,11 +1052,21 @@ function checkRateLimitRules(req, ip) {
 }
 
 function pruneRateLimitBuckets(rules) {
-  const ids = new Set((rules || []).map((rule) => String(rule.id || rule._id || `${rule.ip || '*'}:${rule.method || 'ALL'}:${rule.pathPattern || '*'}`)));
-  for (const key of _rateLimitBuckets.keys()) {
+  const ids = new Set((rules || []).map((rule) => String(rateLimitRuleId(rule))));
+  for (const buckets of [_rateLimitBuckets, _sharedBuckets]) {
+    for (const key of buckets.keys()) {
+      const idx = key.indexOf('|');
+      const ruleKey = idx === -1 ? key : key.slice(0, idx);
+      if (!ids.has(ruleKey)) buckets.delete(key);
+    }
+  }
+  // Drop shared entries from past windows so the map cannot grow without bound.
+  const now = Date.now();
+  const windowMsById = new Map((rules || []).map((r) => [String(rateLimitRuleId(r)), Math.max(1, Number(r.windowSeconds) || 60) * 1000]));
+  for (const [key, entry] of _sharedBuckets) {
     const idx = key.indexOf('|');
-    const ruleKey = idx === -1 ? key : key.slice(0, idx);
-    if (!ids.has(ruleKey)) _rateLimitBuckets.delete(key);
+    const windowMs = windowMsById.get(idx === -1 ? key : key.slice(0, idx)) || 60000;
+    if (entry.windowIndex < Math.floor(now / windowMs)) _sharedBuckets.delete(key);
   }
 }
 
@@ -1100,6 +1179,7 @@ function sendChallengeResponse(req, res, ip, decision) {
     source: 'challenge',
     statusCode: 403,
     ip,
+    ruleId: String(decision.ruleId || ''),
     matchedEntry: rid,
     method: req.method || '',
     path: decision.path || req.url || '',
@@ -1249,6 +1329,7 @@ function firewallRequestHandler(req, res) {
     reportFirewallEvent({
       source: 'blocklist',
       ip,
+      ruleId: String(blockRuleDecision.ruleId || ''),
       matchedEntry: blockRuleDecision.matchedEntry || ip,
       method: req.method || '',
       path: blockRuleDecision.path || req.url || '',
@@ -1282,6 +1363,8 @@ function firewallRequestHandler(req, res) {
       source: 'rate_limit',
       statusCode: 429,
       ip,
+      ruleId: String(rateLimitDecision.ruleId || ''),
+      keyBy: (rateLimitDecision.rule && rateLimitDecision.rule.keyBy) || 'ip',
       matchedEntry: rateLimitDecision.ruleId || '',
       method: req.method || '',
       path: rateLimitDecision.path || req.url || '',
@@ -1387,10 +1470,27 @@ function init(options) {
     if (_options.log) fwLog('[securenow] Firewall: Layer 4 (Cloud WAF)      disabled (set config.firewall.cloud=cloudflare|aws|gcp)');
   }
 
+  const storeSpec = _options.rateLimitStore !== undefined
+    ? _options.rateLimitStore
+    : require('./app-config').resolveFirewallOptions().rateLimitStore;
+  if (storeSpec) {
+    try {
+      _rateLimitStore = require('./rate-limit-store').createRateLimitStore(storeSpec, {
+        log: (...args) => { if (_options.log) fwLog(...args); },
+      });
+      if (_options.log && _rateLimitStore) fwLog('[securenow] Firewall: shared rate-limit counters: connecting to %s', _rateLimitStore.describe());
+    } catch (e) {
+      _rateLimitStore = null;
+      if (_options.log) fwWarn('[securenow] Firewall: rate-limit store disabled (%s); counting in-process', e.message);
+    }
+  }
+
   startSyncLoop();
 }
 
 function shutdown() {
+  if (_rateLimitStore) { try { _rateLimitStore.close(); } catch (_) {} _rateLimitStore = null; }
+  _sharedBuckets = new Map();
   if (_pollTimer) { clearTimeout(_pollTimer); _pollTimer = null; }
   if (_syncTimer) { clearInterval(_syncTimer); _syncTimer = null; }
   if (_eventTimer) { clearTimeout(_eventTimer); _eventTimer = null; }
@@ -1459,4 +1559,15 @@ function isRemoteEnabled() { return _remoteEnabled !== false; }
 
 function getChallengeRules() { return _challengeRules; }
 
-module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, getBlocklistRules, getRateLimitRules, getChallengeRules, isRemoteEnabled };
+// Test hooks (not part of the public API): drive rate-limit decisions without a server or sync.
+const _test = {
+  setRateLimitRules(rules) { _rateLimitRules = Array.isArray(rules) ? rules : []; _rateLimitBuckets = new Map(); _sharedBuckets = new Map(); },
+  setRateLimitStore(store) { _rateLimitStore = store || null; _sharedBuckets = new Map(); },
+  checkRateLimitRules,
+  rateLimitSubject,
+  rateLimitKey,
+  pruneRateLimitBuckets,
+  sharedBucketCount: () => _sharedBuckets.size,
+};
+
+module.exports = { init, shutdown, getStats, getMatcher, getAllowlistMatcher, getBlocklistRules, getRateLimitRules, getChallengeRules, isRemoteEnabled, _test };

package/mcp/catalog.js

@@ -318,16 +318,18 @@ const TOOLS = [
   {
     name: 'securenow_firewall_test_ip',
     title: 'Test Firewall IP Decision',
-    description: 'Check whether an IP would be blocked by the firewall.',
+    description: 'Check whether an IP would be blocked by the firewall. Pass path (and method) to evaluate route-scoped block rules the way the running app does, including case and trailing-slash aliases.',
     scope: 'firewall:read',
     readOnly: true,
     method: 'GET',
     endpoint: '/firewall/check/:ip',
     pathParams: ['ip'],
-    queryFields: ['environment', 'appKey'],
+    queryFields: ['environment', 'appKey', 'path', 'method'],
     inputSchema: objectSchema({
       ip: string('IPv4 address to test.'),
       appKey: string('Optional application key UUID to test the app/environment toggle and scoped lists.'),
+      path: string('Optional request path, for example /api/auth/login. Without it, route-scoped rules are not evaluated.'),
+      method: string('Optional HTTP method for the path, default GET.'),
       ...environmentInput,
     }, ['ip']),
   },
@@ -1100,6 +1102,165 @@ const TOOLS = [
       ...confirmSchema,
     }, ['id', 'confirm', 'reason']),
   },
+  {
+    name: 'securenow_rate_limit_create',
+    title: 'Create Rate Limit',
+    description: 'Create a rate-limit rule from structured fields. The running app enforces it within about 10 seconds and answers 429 with Retry-After once the limit is reached. keyBy picks what each bucket counts: ip (default), global (one shared bucket), header (one bucket per value of keyName, e.g. x-api-key) or cookie (one bucket per value of keyName, e.g. session). Several rules can stack on one route (for example a burst limit and an hourly cap). Write action; requires confirmation.',
+    scope: 'rate_limits:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/rate-limits',
+    bodyFields: ['name', 'appKey', 'environment', 'ip', 'pathPattern', 'pathMatchMode', 'method', 'keyBy', 'keyName', 'limit', 'windowSeconds', 'duration', 'expiresAt', 'status', 'reason'],
+    inputSchema: objectSchema({
+      name: string('Optional rule name.'),
+      appKey: string('Optional application key. Omit for all apps.'),
+      ip: string('Optional IPv4 address or CIDR the rule applies to. Omit for any IP.'),
+      pathPattern: string('Route pattern, for example /api/auth/login or /api/. A rule needs a route, an IP, or both.'),
+      pathMatchMode: { type: 'string', enum: ['exact', 'prefix', 'regex'], description: 'Path matching mode. Defaults to prefix.' },
+      method: { type: 'string', enum: ['ALL', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'], description: 'HTTP method scope. Defaults to ALL.' },
+      keyBy: { type: 'string', enum: ['ip', 'global', 'header', 'cookie'], description: 'What each bucket counts. Defaults to ip.' },
+      keyName: string('Header or cookie name when keyBy is header or cookie, for example x-api-key or session.'),
+      limit: number('Requests allowed per window.', { minimum: 1, maximum: 1000000 }),
+      windowSeconds: number('Window length in seconds (1 to 86400).', { minimum: 1, maximum: 86400 }),
+      duration: string('Optional rule lifetime, for example 2h or 7d. Omit for no expiry.'),
+      expiresAt: string('Optional expiry time as ISO 8601 instead of duration.'),
+      status: { type: 'string', enum: ['active', 'disabled'], description: 'Create it disabled to stage it. Defaults to active.' },
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['limit', 'windowSeconds', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_rate_limit_update',
+    title: 'Update Rate Limit',
+    description: 'Change a rate-limit rule: enable or disable it (status), or change its limit, window, route, method, key or expiry. Only the fields you pass change. Write action; requires confirmation.',
+    scope: 'rate_limits:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/rate-limits/:id',
+    pathParams: ['id'],
+    bodyFields: ['name', 'status', 'limit', 'windowSeconds', 'pathPattern', 'pathMatchMode', 'method', 'keyBy', 'keyName', 'ip', 'duration', 'expiresAt', 'reason'],
+    inputSchema: objectSchema({
+      id: string('Rate-limit rule id.'),
+      name: string('Optional new name.'),
+      status: { type: 'string', enum: ['active', 'disabled'], description: 'active enables the rule, disabled stops enforcing it.' },
+      limit: number('New requests-per-window limit.', { minimum: 1, maximum: 1000000 }),
+      windowSeconds: number('New window length in seconds.', { minimum: 1, maximum: 86400 }),
+      pathPattern: string('New route pattern.'),
+      pathMatchMode: { type: 'string', enum: ['exact', 'prefix', 'regex'] },
+      method: { type: 'string', enum: ['ALL', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'] },
+      keyBy: { type: 'string', enum: ['ip', 'global', 'header', 'cookie'] },
+      keyName: string('Header or cookie name for keyBy header/cookie.'),
+      ip: string('New IPv4 address or CIDR filter ("" for any IP).'),
+      duration: string('New lifetime from now, for example 2h.'),
+      expiresAt: string('New expiry as ISO 8601.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_firewall_hits',
+    title: 'Firewall Hits',
+    description: 'Who the firewall actually stopped: blocks (403), rate limits (429) and challenges, totalled per rule and per IP, plus the most recent hits. Use it to check that a new block or rate limit is working.',
+    scope: 'firewall:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/firewall/hits',
+    queryFields: ['appKey', 'environment', 'action', 'source', 'ruleId', 'ip', 'since', 'from', 'to', 'limit'],
+    inputSchema: objectSchema({
+      appKey: string('Optional application key.'),
+      action: { type: 'string', enum: ['blocked', 'rate_limited', 'captcha_challenged', 'captcha_passed', 'captcha_failed', 'allowed'], description: 'Optional action filter.' },
+      source: { type: 'string', enum: ['blocklist', 'allowlist', 'rate_limit', 'challenge'], description: 'Optional source filter.' },
+      ruleId: string('Optional rule id (rate limit, scoped block or challenge).'),
+      ip: string('Optional client IP.'),
+      since: string('Look-back window, for example 30m, 6h or 7d (default 24h, max 30d).'),
+      from: string('Optional start time as ISO 8601 (instead of since).'),
+      to: string('Optional end time as ISO 8601.'),
+      limit: number('Recent hits to return.', { minimum: 1, maximum: 200 }),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_challenge_list',
+    title: 'List Challenges',
+    description: 'List proof-of-work challenge rules (an invisible check browsers pass and simple bots do not).',
+    scope: 'challenges:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/challenges',
+    queryFields: ['status', 'appKey', 'environment'],
+    inputSchema: objectSchema({
+      status: string('Optional status filter: active or disabled.'),
+      appKey: string('Optional application key.'),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_challenge_create',
+    title: 'Create Challenge',
+    description: 'Serve a proof-of-work challenge on a route (optionally for one IP/CIDR and method). Browsers solve it invisibly and keep a clearance cookie; clients that cannot solve it never reach the route. Write action; requires confirmation.',
+    scope: 'challenges:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/challenges',
+    bodyFields: ['name', 'appKey', 'environment', 'ip', 'pathPattern', 'pathMatchMode', 'method', 'difficulty', 'clearanceTtlSeconds', 'duration', 'status', 'reason'],
+    inputSchema: objectSchema({
+      name: string('Optional rule name.'),
+      appKey: string('Optional application key. Omit for all apps.'),
+      ip: string('Optional IPv4 address or CIDR. Omit for any IP.'),
+      pathPattern: string('Route pattern to protect, for example /api/signup.'),
+      pathMatchMode: { type: 'string', enum: ['exact', 'prefix', 'regex'] },
+      method: { type: 'string', enum: ['ALL', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'] },
+      difficulty: number('Proof-of-work difficulty bits (4 to 28, default 14).', { minimum: 4, maximum: 28 }),
+      clearanceTtlSeconds: number('How long a solved challenge stays valid, in seconds (default 1800).', { minimum: 60 }),
+      duration: string('Optional rule lifetime, for example 24h.'),
+      status: { type: 'string', enum: ['active', 'disabled'] },
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['confirm', 'reason']),
+  },
+  {
+    name: 'securenow_challenge_update',
+    title: 'Update Challenge',
+    description: 'Enable/disable a challenge rule or change its route, difficulty or expiry. Write action; requires confirmation.',
+    scope: 'challenges:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/challenges/:id',
+    pathParams: ['id'],
+    bodyFields: ['name', 'status', 'pathPattern', 'pathMatchMode', 'method', 'ip', 'difficulty', 'clearanceTtlSeconds', 'duration', 'reason'],
+    inputSchema: objectSchema({
+      id: string('Challenge rule id.'),
+      name: string('Optional new name.'),
+      status: { type: 'string', enum: ['active', 'disabled'] },
+      pathPattern: string('New route pattern.'),
+      pathMatchMode: { type: 'string', enum: ['exact', 'prefix', 'regex'] },
+      method: { type: 'string', enum: ['ALL', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'] },
+      ip: string('New IPv4 address or CIDR filter.'),
+      difficulty: number('New difficulty bits.', { minimum: 4, maximum: 28 }),
+      clearanceTtlSeconds: number('New clearance lifetime in seconds.', { minimum: 60 }),
+      duration: string('New lifetime from now, for example 24h.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_challenge_remove',
+    title: 'Remove Challenge',
+    description: 'Remove a proof-of-work challenge rule. Write action; requires confirmation.',
+    scope: 'challenges:write',
+    readOnly: false,
+    confirm: true,
+    method: 'DELETE',
+    endpoint: '/challenges/:id',
+    pathParams: ['id'],
+    bodyFields: ['reason'],
+    inputSchema: objectSchema({
+      id: string('Challenge rule id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
   {
     name: 'securenow_rate_limit_parse',
     title: 'Parse Rate Limit Text',
@@ -1726,11 +1887,12 @@ const TOOLS = [
     confirm: true,
     method: 'POST',
     endpoint: '/blocklist',
-    bodyFields: ['ip', 'reason', 'expiresAt', 'metadata', 'appKey', 'environment', 'pathPattern', 'pathMatchMode', 'method'],
+    bodyFields: ['ip', 'reason', 'expiresAt', 'duration', 'metadata', 'appKey', 'environment', 'pathPattern', 'pathMatchMode', 'method'],
     inputSchema: objectSchema({
       ip: string('IPv4 address or CIDR.'),
       reason: string('Reason for blocking.'),
       expiresAt: string('Optional expiry time as ISO 8601.'),
+      duration: string('Optional block lifetime instead of expiresAt, for example 15m, 2h or 7d.'),
       metadata: { type: 'object', additionalProperties: true, description: 'Optional metadata.' },
       appKey: string('Optional application key to scope this block. Omit for all apps.'),
       pathPattern: string('Optional route/path pattern, for example /admin*. Omit to block all routes.'),
@@ -1905,6 +2067,11 @@ const DESTRUCTIVE_TOOLS = new Set([
   'securenow_automation_rule_delete',
   'securenow_rate_limit_remove',
   'securenow_rate_limit_create_from_text',
+  'securenow_rate_limit_create',
+  'securenow_rate_limit_update',
+  'securenow_challenge_create',
+  'securenow_challenge_update',
+  'securenow_challenge_remove',
   'securenow_alert_rule_rollback',
   'securenow_alert_rule_update',
   'securenow_alert_rule_query_update',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.13.0",
+  "version": "8.14.1",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
@@ -11,7 +11,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-log-format.js && node test-crash-capture.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-crash-capture.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -164,6 +164,7 @@
     "otp-redaction.js",
     "header-redaction.js",
     "firewall-paths.js",
+    "rate-limit-store.js",
     "log-format.js",
     "crash-capture.js",
     "sdk-disabled.js",

package/rate-limit-store.js

@@ -0,0 +1,175 @@
+'use strict';
+
+// Optional shared counters for rate limits, so every worker and every server counts against
+// one bucket instead of each process counting on its own.
+//
+//   .securenow/runtime.json → "config": { "firewall": { "rateLimitStore": "redis://host:6379" } }
+//   (rediss:// for TLS; user:password@ and /db are supported)
+//
+// The firewall never waits on Redis: it decides from what it already knows (its own count plus
+// the latest shared count Redis returned) and reports each counted request in the background.
+// At most a request or two per process can slip past the limit while a reply is in flight.
+// If Redis is unreachable the firewall keeps counting in-process (fail-open) and reconnects.
+//
+// No dependency: a minimal RESP client that only sends AUTH / SELECT / INCR / PEXPIRE.
+
+const net = require('net');
+const tls = require('tls');
+
+const COMMAND_TIMEOUT_MS = 1000;
+const MAX_BACKOFF_MS = 30000;
+
+function encodeCommand(args) {
+  let out = `*${args.length}\r\n`;
+  for (const arg of args) {
+    const s = String(arg);
+    out += `$${Buffer.byteLength(s)}\r\n${s}\r\n`;
+  }
+  return out;
+}
+
+// Parses as many complete RESP replies as the buffer holds. Returns { replies, rest }.
+function parseReplies(buffer) {
+  const replies = [];
+  let offset = 0;
+  while (offset < buffer.length) {
+    const end = buffer.indexOf('\r\n', offset);
+    if (end === -1) break;
+    const type = buffer[offset];
+    const line = buffer.toString('utf8', offset + 1, end);
+    if (type === 0x2b /* + */) { replies.push({ ok: true, value: line }); offset = end + 2; continue; }
+    if (type === 0x2d /* - */) { replies.push({ ok: false, error: line }); offset = end + 2; continue; }
+    if (type === 0x3a /* : */) { replies.push({ ok: true, value: Number(line) }); offset = end + 2; continue; }
+    if (type === 0x24 /* $ */) {
+      const len = Number(line);
+      if (len === -1) { replies.push({ ok: true, value: null }); offset = end + 2; continue; }
+      if (buffer.length < end + 2 + len + 2) break;
+      replies.push({ ok: true, value: buffer.toString('utf8', end + 2, end + 2 + len) });
+      offset = end + 2 + len + 2;
+      continue;
+    }
+    // Arrays and other types are never requested; treat as a protocol error.
+    replies.push({ ok: false, error: `unexpected reply type ${String.fromCharCode(type)}` });
+    offset = end + 2;
+  }
+  return { replies, rest: buffer.subarray(offset) };
+}
+
+class RedisCounterStore {
+  constructor(url, { log } = {}) {
+    const parsed = new URL(url);
+    if (!['redis:', 'rediss:'].includes(parsed.protocol)) throw new Error('rateLimitStore must be a redis:// or rediss:// URL');
+    this.host = parsed.hostname || '127.0.0.1';
+    this.port = Number(parsed.port || 6379);
+    this.tls = parsed.protocol === 'rediss:';
+    this.username = decodeURIComponent(parsed.username || '');
+    this.password = decodeURIComponent(parsed.password || '');
+    this.db = Number((parsed.pathname || '/').slice(1) || 0) || 0;
+    this.log = typeof log === 'function' ? log : () => {};
+    this.socket = null;
+    this.ready = false;
+    this.pending = [];
+    this.buffer = Buffer.alloc(0);
+    this.backoff = 1000;
+    this.closed = false;
+    this.connect();
+  }
+
+  describe() {
+    return `${this.tls ? 'rediss' : 'redis'}://${this.host}:${this.port}/${this.db}`;
+  }
+
+  connect() {
+    if (this.closed) return;
+    const onConnect = () => {
+      const setup = [];
+      if (this.password) setup.push(this.username ? ['AUTH', this.username, this.password] : ['AUTH', this.password]);
+      if (this.db) setup.push(['SELECT', this.db]);
+      Promise.all(setup.map((cmd) => this.send(cmd, true)))
+        .then(() => {
+          this.ready = true;
+          this.backoff = 1000;
+          this.log('[securenow] Firewall: shared rate-limit counters ON (%s)', this.describe());
+        })
+        .catch((err) => {
+          this.log('[securenow] Firewall: rate-limit store setup failed (%s); counting in-process', err.message);
+          this.socket.destroy();
+        });
+    };
+    const socket = this.tls
+      ? tls.connect({ host: this.host, port: this.port, servername: this.host }, onConnect)
+      : net.connect({ host: this.host, port: this.port }, onConnect);
+    socket.setNoDelay(true);
+    socket.unref();
+    socket.on('data', (chunk) => this.onData(chunk));
+    socket.on('error', () => { /* handled by close */ });
+    socket.on('close', () => this.onClose());
+    this.socket = socket;
+  }
+
+  onData(chunk) {
+    this.buffer = this.buffer.length ? Buffer.concat([this.buffer, chunk]) : chunk;
+    const { replies, rest } = parseReplies(this.buffer);
+    this.buffer = rest;
+    for (const reply of replies) {
+      const waiter = this.pending.shift();
+      if (!waiter) continue;
+      clearTimeout(waiter.timer);
+      if (reply.ok) waiter.resolve(reply.value);
+      else waiter.reject(new Error(reply.error));
+    }
+  }
+
+  onClose() {
+    const wasReady = this.ready;
+    this.ready = false;
+    this.buffer = Buffer.alloc(0);
+    const pending = this.pending;
+    this.pending = [];
+    for (const waiter of pending) { clearTimeout(waiter.timer); waiter.reject(new Error('connection closed')); }
+    if (this.closed) return;
+    if (wasReady) this.log('[securenow] Firewall: rate-limit store unreachable; counting in-process until it is back');
+    const delay = this.backoff;
+    this.backoff = Math.min(MAX_BACKOFF_MS, this.backoff * 2);
+    const timer = setTimeout(() => this.connect(), delay);
+    if (timer.unref) timer.unref();
+  }
+
+  send(args, allowBeforeReady = false) {
+    if (!this.socket || (!this.ready && !allowBeforeReady)) return Promise.reject(new Error('store not ready'));
+    return new Promise((resolve, reject) => {
+      const waiter = { resolve, reject, timer: null };
+      waiter.timer = setTimeout(() => {
+        reject(new Error('store timeout'));
+        // A lost reply desynchronizes the pipeline: drop the connection and start clean.
+        if (this.socket) this.socket.destroy();
+      }, COMMAND_TIMEOUT_MS);
+      if (waiter.timer.unref) waiter.timer.unref();
+      this.pending.push(waiter);
+      this.socket.write(encodeCommand(args));
+    });
+  }
+
+  // Count one request in a fixed window key; resolves with the shared total for that window.
+  incr(key, ttlMs) {
+    if (!this.ready) return Promise.reject(new Error('store not ready'));
+    const counted = this.send(['INCR', key]);
+    this.send(['PEXPIRE', key, Math.max(1000, Math.round(ttlMs))]).catch(() => {});
+    return counted;
+  }
+
+  close() {
+    this.closed = true;
+    this.ready = false;
+    if (this.socket) this.socket.destroy();
+  }
+}
+
+function createRateLimitStore(spec, options = {}) {
+  if (!spec) return null;
+  const url = typeof spec === 'string' ? spec : spec.url;
+  if (!url) return null;
+  return new RedisCounterStore(url, options);
+}
+
+module.exports = { createRateLimitStore, RedisCounterStore, encodeCommand, parseReplies };