securenow 8.14.0 → 8.15.0

package/README.md

@@ -163,6 +163,8 @@ Everything the MCP server can do is also a command. Run `npx securenow help` for
 | `securenow ip <address>` | IP intelligence (geo, abuse, verdict) |
 | `securenow ip traces <address>` | Traces from an IP |
 | `securenow forensics "<query>"` | Natural-language forensic query |
+| `securenow forensics chat --app <key> ["<question>"]` | Forensics chat with memory; `--conversation <id>` continues one |
+| `securenow forensics conversations [<id>]` | List forensics conversations, or show one |
 | `securenow traces` / `traces show <traceId>` | Recent traces / trace spans |
 | `securenow traces analyze <traceId>` | AI security analysis of a trace |
 | `securenow logs [--since 6h] [--level error]` | View logs |

package/SKILL-CLI.md

@@ -334,10 +334,20 @@ securenow ip traces <ip-address> --env production # traces originating from this
 ```bash
 securenow forensics "show me all SQL injection attempts in the last 24h" --env production
 securenow forensics query "top 10 IPs by blocked requests" --app my-app --env production
-securenow forensics chat --app my-app --env production # interactive forensics chat session
+securenow forensics chat --app my-app --env production # interactive forensics chat session (with memory)
+securenow forensics chat --app my-app "which accounts had failed logins then a success?"   # one question, prints the conversation id
+securenow forensics chat --conversation <id> "what else did those IPs do?"                # follow up: the chat remembers the earlier answers
+securenow forensics conversations             # list conversations (dashboard, CLI and agent ones)
+securenow forensics conversations <id>        # show one: questions, SQL, findings, rows
 securenow forensics library                  # view saved/template queries
 ```
 
+The chat runs discovery queries before answering, shows its SQL, and ends each answer with findings: what the result rows
+show. A follow-up sees the earlier questions, their findings, and the IPs and trace IDs in their results. MCP:
+`securenow_forensics_chat` (pass `conversationId` to continue), `securenow_forensics_conversations_list`,
+`securenow_forensics_conversation_get`. `securenow forensics "<q>"` and `securenow_forensics_query` answer one question
+with no memory.
+
 ---
 
 ### Firewall

package/cli/automation.js

@@ -82,7 +82,7 @@ async function list(args, flags) {
 
     console.log('');
     const rows = rules.map((rule) => [
-      ui.c.dim(ui.truncate(rule._id || rule.id, 12)),
+      ui.c.dim(rule.id || rule._id || ''),
       rule.name || '-',
       ui.statusBadge(rule.status || 'active'),
       formatApplications(rule),

package/cli/challenges.js

@@ -64,7 +64,7 @@ async function list(args, flags) {
 
     console.log('');
     const rows = rules.map((r) => [
-      ui.c.dim(ui.truncate(r.id || r._id, 12)),
+      ui.c.dim(r.id || r._id || ''),
       r.status === 'active' ? ui.statusBadge('active') : ui.statusBadge(r.status || 'unknown'),
       describeTarget(r),
       `pow:${r.difficulty}`,

package/cli/fp.js

@@ -76,7 +76,7 @@ async function list(args, flags) {
     const rows = exclusions.map(e => {
       const scope = e.type === 'global' ? ui.c.cyan('All Rules') : `Rule: ${ui.truncate(e.ruleName || '?', 18)}`;
       return [
-        ui.c.dim(ui.truncate(e._id, 12)),
+        ui.c.dim(e.id || e._id || ''),
         scope,
         ui.truncate(conditionsSummary(e.conditions, e.matchMode), 40),
         (e.matchMode || 'all').toUpperCase(),

package/cli/monitor.js

@@ -351,7 +351,7 @@ async function notificationsList(args, flags) {
 
     console.log('');
     const rows = notifications.map(n => [
-      ui.c.dim(ui.truncate(n._id, 12)),
+      ui.c.dim(n.id || n._id || ''),
       ui.statusBadge(n.read ? 'read' : 'unread'),
       ui.truncate(n.title || n.message || n.type || '', 50),
       n.ip || '—',

package/cli/rateLimits.js

@@ -47,6 +47,16 @@ function describeTarget(rule) {
   return parts.join(' ') || 'all traffic';
 }
 
+// The bucket each request counts against: "ip", "global", "header x-api-key", "cookie session".
+function describeKey(rule) {
+  const keyBy = rule.keyBy || 'ip';
+  return rule.keyName && (keyBy === 'header' || keyBy === 'cookie') ? `${keyBy} ${rule.keyName}` : keyBy;
+}
+
+function isExpired(rule) {
+  return Boolean(rule.expiresAt) && new Date(rule.expiresAt).getTime() <= Date.now();
+}
+
 function naturalText(args, flags) {
   return String(flags.text || flags.prompt || flags.query || args.join(' ') || '').trim();
 }
@@ -62,6 +72,11 @@ function draftFromFlags(flags) {
   if (flags.mode || flags['path-mode']) draft.pathMatchMode = flags.mode || flags['path-mode'];
   if (flags.method) draft.method = flags.method;
   if (flags['key-by'] || flags.keyBy) draft.keyBy = flags['key-by'] || flags.keyBy;
+  else if (flags.header) draft.keyBy = 'header';
+  else if (flags.cookie) draft.keyBy = 'cookie';
+  if (flags['key-name'] || flags.keyName || flags.header || flags.cookie) {
+    draft.keyName = flags['key-name'] || flags.keyName || flags.header || flags.cookie;
+  }
   if (flags.limit) draft.limit = Number(flags.limit);
   if (flags.window || flags['window-seconds']) draft.windowSeconds = parseWindow(flags.window || flags['window-seconds']);
   if (flags.duration) draft.duration = flags.duration;
@@ -76,7 +91,7 @@ function printParsedDraft(data) {
     ['Name', draft.name || '-'],
     ['Target', describeTarget(draft)],
     ['Limit', `${draft.limit || '-'} / ${draft.windowSeconds || '-'}s`],
-    ['Key by', draft.keyBy || 'ip'],
+    ['Key by', describeKey(draft)],
     ['App', draft.appKey || 'all'],
     ['Environment', draft.environment || 'all'],
     ['Duration', draft.duration || 'none'],
@@ -107,16 +122,17 @@ async function list(args, flags) {
 
     console.log('');
     const rows = rules.map((r) => [
-      ui.c.dim(ui.truncate(r.id || r._id, 12)),
-      r.status === 'active' ? ui.statusBadge('active') : ui.statusBadge(r.status || 'unknown'),
+      ui.c.dim(r.id || r._id || ''),
+      ui.statusBadge(r.status === 'active' && isExpired(r) ? 'expired' : (r.status || 'unknown')),
       describeTarget(r),
       `${r.limit}/${r.windowSeconds}s`,
+      describeKey(r),
       r.applicationKey || ui.c.dim('all apps'),
       r.environment || ui.c.dim('all envs'),
       r.expiresAt ? new Date(r.expiresAt).toLocaleString() : ui.c.dim('permanent'),
       ui.timeAgo(r.createdAt),
     ]);
-    ui.table(['ID', 'Status', 'Target', 'Limit', 'App', 'Env', 'Expires', 'Created'], rows);
+    ui.table(['ID', 'Status', 'Target', 'Limit', 'Per', 'App', 'Env', 'Expires', 'Created'], rows);
     console.log('');
   } catch (err) {
     s.fail('Failed to fetch rate limits');
@@ -167,7 +183,7 @@ async function fromText(args, flags) {
     if (flags.json) { ui.json(data); return; }
     const r = data.rateLimit;
     console.log('');
-    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s`);
+    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s per ${describeKey(r)}`);
     console.log(`  ${ui.c.dim('ID:')} ${r.id || r._id}`);
     console.log('');
   } catch (err) {
@@ -197,7 +213,7 @@ async function show(args, flags) {
       ['Status', r.status || '-'],
       ['Target', describeTarget(r)],
       ['Limit', `${r.limit}/${r.windowSeconds}s`],
-      ['Key by', r.keyName ? `${r.keyBy} ${r.keyName}` : (r.keyBy || 'ip')],
+      ['Key by', describeKey(r)],
       ['App', r.applicationKey || 'all apps'],
       ['Environment', r.environment || 'all envs'],
       ['Reason', r.reason || '-'],
@@ -251,7 +267,7 @@ async function add(args, flags) {
     if (flags.json) { ui.json(data); return; }
     const r = data.rateLimit;
     console.log('');
-    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s`);
+    console.log(`  ${ui.c.green('ACTIVE')} ${describeTarget(r)} at ${r.limit}/${r.windowSeconds}s per ${describeKey(r)}`);
     console.log(`  ${ui.c.dim('ID:')} ${r.id || r._id}`);
     console.log('');
   } catch (err) {
@@ -330,7 +346,7 @@ async function test(args, flags) {
     if (data.limited) {
       console.log(`  ${ui.c.bold(ui.c.yellow('RATE LIMITED'))} - ${data.matches.length} matching rule${data.matches.length !== 1 ? 's' : ''}`);
       for (const r of data.matches.slice(0, 5)) {
-        console.log(`  ${ui.c.dim(r.id || r._id)}  ${describeTarget(r)}  ${r.limit}/${r.windowSeconds}s`);
+        console.log(`  ${ui.c.dim(r.id || r._id)}  ${describeTarget(r)}  ${r.limit}/${r.windowSeconds}s per ${describeKey(r)}`);
       }
     } else {
       console.log(`  ${ui.c.bold(ui.c.green('NOT LIMITED'))} - no matching rate-limit rules`);

package/cli/security.js

@@ -190,7 +190,7 @@ async function alertRulesList(args, flags) {
 
     console.log('');
     const rows = rules.map((r) => [
-      ui.c.dim(ui.truncate(r._id || r.id, 12)),
+      ui.c.dim(r.id || r._id || ''),
       r.name || '—',
       ruleStatusBadge(r),
       r.mode === 'test' ? ui.c.yellow('test') : ui.c.dim('prod'),
@@ -836,7 +836,7 @@ async function alertRuleExclusions(args, flags) {
     if (flags.json) { ui.json(data); return; }
     console.log('');
     const rows = exclusions.map((e) => [
-      ui.c.dim(ui.truncate(e._id, 12)),
+      ui.c.dim(e.id || e._id || ''),
       e.isActive === false ? ui.statusBadge('disabled') : ui.statusBadge('active'),
       e.matchMode || 'all',
       ui.truncate(e.reason || e.pathPattern || JSON.stringify(e.conditions || []), 72),
@@ -862,7 +862,7 @@ async function alertChannelsList(args, flags) {
 
     console.log('');
     const rows = channels.map(ch => [
-      ui.c.dim(ui.truncate(ch._id, 12)),
+      ui.c.dim(ch.id || ch._id || ''),
       ch.name || '—',
       ch.type || '—',
       ui.statusBadge(ch.enabled !== false ? 'enabled' : 'disabled'),
@@ -891,7 +891,7 @@ async function alertHistoryList(args, flags) {
 
     console.log('');
     const rows = history.map(h => [
-      ui.c.dim(ui.truncate(h._id, 12)),
+      ui.c.dim(h.id || h._id || ''),
       h.ruleName || h.type || '—',
       h.severity ? ui.statusBadge(h.severity) : '—',
       ui.truncate(h.message || h.description || '', 40),
@@ -938,7 +938,7 @@ async function blocklistList(args, flags) {
 
     console.log('');
     const rows = items.map(b => [
-      ui.c.dim(ui.truncate(b._id, 12)),
+      ui.c.dim(b.id || b._id || ''),
       ui.c.red(describeBlockTarget(b)),
       ui.truncate(b.reason || '', 40),
       b.source || '—',
@@ -1011,7 +1011,7 @@ async function revokeList(args, flags) {
     if (flags.json) { ui.json(entries); return; }
     console.log('');
     ui.table(['ID', 'Type', 'Value', 'Scope', 'Expires'], entries.map((r) => [
-      ui.c.dim(ui.truncate(r._id || r.id, 12)),
+      ui.c.dim(r.id || r._id || ''),
       r.type,
       ui.truncate(r.value, 28),
       r.applicationKey || ui.c.dim('all'),
@@ -1191,7 +1191,7 @@ async function allowlistList(args, flags) {
 
     console.log('');
     const rows = items.map(a => [
-      ui.c.dim(ui.truncate(a._id, 12)),
+      ui.c.dim(a.id || a._id || ''),
       ui.c.green(a.ip || '—'),
       a.label || ui.c.dim('—'),
       ui.truncate(a.reason || '', 40),
@@ -1307,7 +1307,7 @@ async function trustedList(args, flags) {
 
     console.log('');
     const rows = items.map(t => [
-      ui.c.dim(ui.truncate(t._id, 12)),
+      ui.c.dim(t.id || t._id || ''),
       ui.c.green(t.ip || t.cidr || '—'),
       t.label || t.description || ui.c.dim('—'),
       t.applicationKey || ui.c.dim('all apps'),
@@ -1494,7 +1494,7 @@ async function forensicsLibrary(args, flags) {
 
     console.log('');
     const rows = queries.map(q => [
-      ui.c.dim(ui.truncate(q._id, 12)),
+      ui.c.dim(q.id || q._id || ''),
       q.name || q.title || '—',
       ui.truncate(q.description || q.query || '', 50),
       ui.timeAgo(q.createdAt),
@@ -1509,24 +1509,124 @@ async function forensicsLibrary(args, flags) {
 
 // ── Forensics Chat ──
 
-async function forensicsChat(args, flags) {
-  requireAuth();
+const CHAT_PRINT_ROWS = 25;
+
+// Log timestamps come back as nanosecond (or microsecond) epochs when a query returns
+// min(timestamp) and the like from the logs table; print them as times.
+function chatCell(value) {
+  const s = String(value ?? '');
+  if (/^\d{16,19}$/.test(s)) {
+    const n = Number(s);
+    const ms = n >= 1e18 && n < 4e18 ? n / 1e6 : n >= 1e15 && n < 4e15 ? n / 1e3 : null;
+    if (ms != null) return new Date(ms).toISOString().replace('T', ' ').replace('Z', '');
+  }
+  return typeof value === 'object' && value !== null ? JSON.stringify(value) : s;
+}
+
+// The API answers a chat message with 202 and works in the background; poll until
+// the reply settles (complete or awaiting_confirmation) or about five minutes pass.
+async function waitForChatReply(conversationId, environment, s) {
+  for (let i = 0; i < 150; i++) {
+    await new Promise(r => setTimeout(r, 2000));
+    const result = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
+    if (result.status !== 'processing') return { ...result, conversationId };
+    if (result._progress?.action && s) s.update(result._progress.action);
+  }
+  return { conversationId, status: 'processing' };
+}
+
+async function sendChatMessage(body, environment, s) {
+  const chatRes = await api.post('/forensics/chat', body);
+  if (chatRes.status !== 'processing') {
+    return { conversationId: chatRes.conversationId, status: 'complete', message: chatRes.message };
+  }
+  return waitForChatReply(chatRes.conversationId, environment, s);
+}
+
+async function confirmChatQuery(conversationId, environment, s) {
+  await api.post(`/forensics/chat/confirm/${conversationId}`, { environment });
+  return waitForChatReply(conversationId, environment, s);
+}
+
+// Resolve what a chat talks to: an existing conversation (--conversation <id>,
+// which carries its own app and environment) or a new one scoped to --app.
+async function resolveChatTarget(flags) {
+  if (typeof flags.conversation === 'string' && flags.conversation) {
+    const data = await api.get(`/forensics/conversations/${flags.conversation}`);
+    const conv = data.conversation;
+    return {
+      conversationId: conv.id,
+      title: conv.title,
+      label: conv.applicationName || conv.applicationKey || conv.applicationId,
+      appKey: conv.applicationKey,
+      environment: conv.environment || 'production',
+      messageCount: (conv.messages || []).length,
+    };
+  }
   const resolved = await resolveAppId(flags);
   if (!resolved) {
-    ui.error('App required. Usage: securenow forensics chat --app <key>');
+    ui.error('App required. Usage: securenow forensics chat --app <key>, or --conversation <id> to continue one.');
     ui.info('Set a default with: securenow apps default <key>');
     process.exit(1);
   }
+  return {
+    conversationId: null,
+    label: resolved.name || resolved.key,
+    appKey: resolved.key,
+    environment: resolveEnvironment(flags, 'production'),
+  };
+}
 
-  console.log('');
-  ui.heading(`Forensics Chat — ${resolved.name || resolved.key}`);
-  console.log(ui.c.dim(`  App: ${resolved.key} (${resolved.id})`));
-  console.log(ui.c.dim('  Type your question, or "exit" to quit.\n'));
+async function forensicsChat(args, flags) {
+  requireAuth();
+  // `--json "<question>"` parses the question as the flag's value; give it back.
+  const words = [...args];
+  for (const key of ['json', 'yes', 'force']) {
+    if (typeof flags[key] === 'string') { words.push(flags[key]); flags[key] = true; }
+  }
+  const target = await resolveChatTarget(flags);
+  const { environment } = target;
+  let conversationId = target.conversationId;
+  const question = words.join(' ').trim();
+
+  // One question, one reply, then exit: scriptable, and what an agent without MCP uses.
+  if (question) {
+    const s = flags.json ? null : ui.spinner('Thinking');
+    const body = { message: question, environment };
+    if (conversationId) body.conversationId = conversationId;
+    else body.applicationKey = target.appKey;
+    let reply = await sendChatMessage(body, environment, s);
+    if (reply.status === 'awaiting_confirmation' && (flags.yes || flags.force)) {
+      if (s) s.update('Running the large query');
+      reply = await confirmChatQuery(reply.conversationId, environment, s);
+    }
+    if (flags.json) { ui.json(reply); return; }
+    if (reply.status === 'processing') {
+      s.fail('Still working');
+      ui.info(`See the reply later: securenow forensics conversations ${reply.conversationId}`);
+      return;
+    }
+    s.stop('Done');
+    printChatMessage(reply.message);
+    console.log('');
+    if (reply.status === 'awaiting_confirmation') {
+      ui.info('Large query held back. Add --yes to run it, or ask a narrower question.');
+    }
+    ui.info(`Conversation ${reply.conversationId}`);
+    console.log(ui.c.dim(`  Follow up: securenow forensics chat --conversation ${reply.conversationId} "<question>"`));
+    console.log('');
+    return;
+  }
 
-  const environment = resolveEnvironment(flags, 'production');
+  console.log('');
+  ui.heading(`Forensics Chat — ${target.label}`);
+  if (conversationId) {
+    console.log(ui.c.dim(`  Continuing: ${target.title} (${target.messageCount} messages)`));
+  } else {
+    console.log(ui.c.dim(`  App: ${target.appKey}`));
+  }
   console.log(ui.c.dim(`  Env: ${environment}`));
-
-  let conversationId = null;
+  console.log(ui.c.dim('  Type your question, or "exit" to quit.\n'));
 
   const readline = require('readline');
   const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
@@ -1541,57 +1641,37 @@ async function forensicsChat(args, flags) {
       if (!message || message.toLowerCase() === 'exit' || message.toLowerCase() === 'quit') {
         console.log('');
         ui.info('Chat ended.');
+        if (conversationId) console.log(ui.c.dim(`  Continue later: securenow forensics chat --conversation ${conversationId}`));
         break;
       }
 
       const s = ui.spinner('Thinking');
       try {
-        const body = { message, applicationKey: resolved.key, environment };
+        const body = { message, environment };
         if (conversationId) body.conversationId = conversationId;
+        else body.applicationKey = target.appKey;
 
-        const chatRes = await api.post('/forensics/chat', body);
-        conversationId = chatRes.conversationId;
-
-        if (chatRes.status === 'processing') {
-          let result;
-          for (let i = 0; i < 150; i++) {
-            await new Promise(r => setTimeout(r, 2000));
-            result = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
-            if (result.status === 'complete' || result.status === 'failed' || result.status === 'awaiting_confirmation') break;
-            const progress = result._progress;
-            if (progress?.action) s.update(progress.action);
-          }
+        const reply = await sendChatMessage(body, environment, s);
+        conversationId = reply.conversationId;
 
-          if (!result || result.status === 'processing') {
-            s.fail('Response timed out');
-            continue;
-          }
+        if (reply.status === 'processing') {
+          s.fail('Response timed out');
+          continue;
+        }
 
-          s.stop('Done');
-          printChatMessage(result.message);
-
-          if (result.status === 'awaiting_confirmation') {
-            const proceed = await ui.confirm('Proceed with this query?');
-            if (proceed) {
-              const cs = ui.spinner('Executing query');
-              await api.post(`/forensics/chat/confirm/${conversationId}`, { environment });
-              let confirmResult;
-              for (let i = 0; i < 90; i++) {
-                await new Promise(r => setTimeout(r, 2000));
-                confirmResult = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
-                if (confirmResult.status !== 'processing') break;
-              }
-              cs.stop('Done');
-              if (confirmResult?.message) printChatMessage(confirmResult.message);
-            } else {
-              ui.info('Query skipped. Ask a different question or refine.');
-            }
+        s.stop('Done');
+        printChatMessage(reply.message);
+
+        if (reply.status === 'awaiting_confirmation') {
+          const proceed = await ui.confirm('Proceed with this query?');
+          if (proceed) {
+            const cs = ui.spinner('Executing query');
+            const confirmed = await confirmChatQuery(conversationId, environment, cs);
+            cs.stop('Done');
+            if (confirmed?.message) printChatMessage(confirmed.message);
+          } else {
+            ui.info('Query skipped. Ask a different question or refine.');
           }
-        } else if (chatRes.message) {
-          s.stop('Done');
-          printChatMessage(chatRes.message);
-        } else {
-          s.stop('Done');
         }
       } catch (err) {
         s.fail('Error');
@@ -1604,9 +1684,61 @@ async function forensicsChat(args, flags) {
   }
 }
 
-function printChatMessage(msg) {
+async function forensicsConversations(args, flags) {
+  requireAuth();
+  const id = args[0];
+
+  if (id) {
+    const s = flags.json ? null : ui.spinner('Fetching conversation');
+    const data = await api.get(`/forensics/conversations/${id}`);
+    const conv = data.conversation;
+    if (flags.json) { ui.json(conv); return; }
+    s.stop(conv.title);
+    console.log(ui.c.dim(`  ${conv.applicationName || conv.applicationKey} · ${conv.environment} · ${(conv.messages || []).length} messages · ${conv.id}`));
+    for (const msg of conv.messages || []) {
+      if (msg.role === 'user') {
+        console.log(`\n  ${ui.c.cyan('you >')} ${msg.content}`);
+      } else {
+        printChatMessage(msg, { maxRows: 10 });
+      }
+    }
+    console.log('');
+    console.log(ui.c.dim(`  Continue: securenow forensics chat --conversation ${conv.id} "<question>"`));
+    console.log('');
+    return;
+  }
+
+  const s = flags.json ? null : ui.spinner('Fetching conversations');
+  const query = {};
+  if (flags.app) {
+    const resolved = await resolveAppId(flags);
+    if (resolved) query.applicationId = resolved.id;
+  }
+  const data = await api.get('/forensics/conversations', { query });
+  const list = data.conversations || [];
+  if (flags.json) { ui.json(list); return; }
+  s.stop(`Found ${list.length} conversation${list.length !== 1 ? 's' : ''}`);
+  console.log('');
+  ui.table(['ID', 'Title', 'App', 'Env', 'Msgs', 'Updated'], list.map(c => [
+    ui.c.dim(c.id),
+    ui.truncate(c.title || '', 48),
+    c.applicationName || '—',
+    c.environment || '—',
+    String(c.messageCount ?? 0),
+    ui.timeAgo(c.updatedAt),
+  ]));
+  console.log('');
+}
+
+function printChatMessage(msg, { maxRows = CHAT_PRINT_ROWS } = {}) {
   if (!msg) return;
   console.log('');
+  if (msg.reasoning) {
+    console.log(ui.c.dim(`  plan: ${msg.reasoning}`));
+  }
+  if (Array.isArray(msg.discoverySteps) && msg.discoverySteps.length > 0) {
+    console.log(ui.c.dim(`  ${msg.discoverySteps.length} discovery quer${msg.discoverySteps.length !== 1 ? 'ies' : 'y'} run first`));
+  }
   if (msg.content) {
     console.log(`  ${ui.c.green('ai >')} ${msg.content}`);
   }
@@ -1616,11 +1748,18 @@ function printChatMessage(msg) {
     console.log(`\n  ${ui.c.dim(msg.sqlQuery)}\n`);
   }
   if (msg.results && Array.isArray(msg.results) && msg.results.length > 0) {
-    ui.subheading(`Results (${msg.resultCount ?? msg.results.length} rows)`);
+    const total = msg.resultCount ?? msg.results.length;
+    ui.subheading(`Results (${total} rows)`);
     console.log('');
     const headers = Object.keys(msg.results[0]);
-    const rows = msg.results.map(row => headers.map(h => String(row[h] ?? '')));
+    const rows = msg.results.slice(0, maxRows).map(row => headers.map(h => chatCell(row[h])));
     ui.table(headers, rows);
+    if (msg.results.length > maxRows) {
+      console.log(ui.c.dim(`  … ${msg.results.length - maxRows} more rows (--json for all)`));
+    }
+  }
+  if (msg.findings) {
+    console.log(`\n  ${ui.c.cyan('findings >')} ${msg.findings}`);
   }
   if (msg.estimation) {
     const est = msg.estimation;
@@ -1756,7 +1895,7 @@ async function instancesList(args, flags) {
 
     console.log('');
     const rows = instances.map(inst => [
-      ui.c.dim(ui.truncate(inst._id, 12)),
+      ui.c.dim(inst.id || inst._id || ''),
       inst.name || inst.host || '—',
       inst.host || '—',
       inst.port != null ? String(inst.port) : '—',
@@ -1857,6 +1996,7 @@ module.exports = {
   trustedRemove,
   forensicsQuery,
   forensicsChat,
+  forensicsConversations,
   forensicsLibrary,
   ipLookup,
   ipTraces,

package/cli/ui.js

@@ -354,6 +354,7 @@ function statusBadge(status) {
     trusted: c.green('■ trusted'),
     enabled: c.green('● enabled'),
     disabled: c.dim('○ disabled'),
+    expired: c.dim('○ expired'),
     paused: c.yellow('◆ paused'),
     critical: c.red('▲ critical'),
     high: c.red('▲ high'),

package/cli.js

@@ -585,7 +585,8 @@ const COMMANDS = {
     usage: 'securenow forensics <query> [--app <key>]',
     sub: {
       query: { desc: 'Run a forensic query', flags: { app: 'App key to scope query', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/security').forensicsQuery(a, f) },
-      chat: { desc: 'Interactive forensics chat (scoped to an app)', usage: 'securenow forensics chat --app <key> [--env production]', flags: { app: 'App key to chat with', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/security').forensicsChat(a, f) },
+      chat: { desc: 'Forensics chat with memory: interactive, or one question with "<question>"', usage: 'securenow forensics chat [--app <key> | --conversation <id>] ["<question>"] [--json]', flags: { app: 'App key for a new conversation', conversation: 'Continue this conversation (from the dashboard, the CLI or an agent)', env: 'Environment of a new conversation (default: production)', environment: 'Alias for --env', yes: 'Run a query the chat held back as large', json: 'Print the raw reply (one-question mode)' }, run: (a, f) => require('./cli/security').forensicsChat(a, f) },
+      conversations: { desc: 'List forensics chat conversations, or show one', usage: 'securenow forensics conversations [<id>] [--app <key>] [--json]', flags: { app: 'Only conversations about this app', json: 'Output as JSON' }, run: (a, f) => require('./cli/security').forensicsConversations(a, f) },
       library: { desc: 'View saved queries', run: (a, f) => require('./cli/security').forensicsLibrary(a, f) },
     },
     defaultAction: (a, f) => require('./cli/security').forensicsQuery(a, f),

package/firewall.js

@@ -1478,7 +1478,7 @@ function init(options) {
       _rateLimitStore = require('./rate-limit-store').createRateLimitStore(storeSpec, {
         log: (...args) => { if (_options.log) fwLog(...args); },
       });
-      if (_options.log && _rateLimitStore) fwLog('[securenow] Firewall: shared rate-limit counters → %s', _rateLimitStore.describe());
+      if (_options.log && _rateLimitStore) fwLog('[securenow] Firewall: shared rate-limit counters: connecting to %s', _rateLimitStore.describe());
     } catch (e) {
       _rateLimitStore = null;
       if (_options.log) fwWarn('[securenow] Firewall: rate-limit store disabled (%s); counting in-process', e.message);

package/mcp/catalog.js

@@ -845,7 +845,7 @@ const TOOLS = [
   {
     name: 'securenow_forensics_query',
     title: 'Run Forensics Query',
-    description: 'Run a natural-language forensic query over your traffic and return the result rows. Waits up to 30 seconds; a query still running after that returns its jobId with status processing. Write scope because it creates an async query job.',
+    description: 'Run one natural-language forensic query over your traffic and return the result rows. One question, no memory of earlier questions; for an investigation with follow-ups use securenow_forensics_chat. Waits up to 30 seconds; a query still running after that returns its jobId with status processing. Write scope because it creates an async query job.',
     scope: 'forensics:write',
     readOnly: false,
     confirm: true,
@@ -890,6 +890,93 @@ const TOOLS = [
     endpoint: '/forensics/query-library',
     inputSchema: objectSchema({}),
   },
+  {
+    name: 'securenow_forensics_chat',
+    title: 'Ask the Forensics Chat',
+    description: 'Ask the SecureNow forensics chat a question about one app\'s traces, logs, errors and custom events, in plain English. Without conversationId it starts a new conversation (applicationKey or applicationId required); with conversationId it continues that conversation, including ones started in the dashboard or the CLI, and the chat sees the earlier questions, their SQL, findings, and the IPs and trace IDs in their results. The reply has the chat\'s reasoning, any discovery queries, the SQL, up to 100 result rows and findings: what the rows show. Read-only over telemetry. Waits up to 90 seconds; a reply still running after that comes back with status processing (use securenow_forensics_chat_status). Status awaiting_confirmation means the query is large: run it with securenow_forensics_chat_confirm or ask a narrower question.',
+    scope: 'forensics:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/forensics/chat',
+    bodyFields: ['message', 'conversationId', 'applicationKey', 'applicationId', 'environment'],
+    poll: {
+      tool: 'securenow_forensics_chat_status',
+      idField: 'conversationId',
+      pending: ['processing'],
+      timeoutMs: 90000,
+      intervalMs: 2000,
+    },
+    inputSchema: objectSchema({
+      message: string('The question, in plain English. Follow-ups can refer to earlier answers ("those IPs", "that session").'),
+      conversationId: string('Continue this conversation. Omit to start a new one.'),
+      applicationKey: string('App key the new conversation is scoped to. Not needed with conversationId.'),
+      applicationId: string('App database id, instead of applicationKey.'),
+      environment: string('Environment of a new conversation: production (default), staging, preview, local or test. Omit it when continuing: a conversation keeps its environment.'),
+      ...confirmSchema,
+    }, ['message', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_forensics_chat_status',
+    title: 'Forensics Chat Reply',
+    description: 'Get the latest reply of a forensics chat conversation: status (processing, complete or awaiting_confirmation), progress while processing, then the reasoning, SQL, result rows and findings.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/chat/status/:conversationId',
+    pathParams: ['conversationId'],
+    inputSchema: objectSchema({
+      conversationId: string('Forensics chat conversation id.'),
+    }, ['conversationId']),
+  },
+  {
+    name: 'securenow_forensics_chat_confirm',
+    title: 'Run a Large Forensics Query',
+    description: 'Run the query a forensics chat held back as large (status awaiting_confirmation), after the user agrees. Returns the rows and findings like securenow_forensics_chat.',
+    scope: 'forensics:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/forensics/chat/confirm/:conversationId',
+    pathParams: ['conversationId'],
+    poll: {
+      tool: 'securenow_forensics_chat_status',
+      idField: 'conversationId',
+      pending: ['processing'],
+      timeoutMs: 90000,
+      intervalMs: 2000,
+    },
+    inputSchema: objectSchema({
+      conversationId: string('Forensics chat conversation id.'),
+      ...confirmSchema,
+    }, ['conversationId', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_forensics_conversations_list',
+    title: 'List Forensics Conversations',
+    description: 'List your forensics chat conversations, newest first (up to 100): id, title, app, environment, message count and last update. Includes conversations started in the dashboard and the CLI.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/conversations',
+    queryFields: ['applicationId'],
+    inputSchema: objectSchema({
+      applicationId: string('Only conversations about this app database id.'),
+    }),
+  },
+  {
+    name: 'securenow_forensics_conversation_get',
+    title: 'Get Forensics Conversation',
+    description: 'Get a whole forensics chat conversation: every question and reply with its reasoning, SQL, findings and up to 100 result rows. Use it to read an investigation someone started in the dashboard before continuing it with securenow_forensics_chat.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/conversations/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Forensics chat conversation id.'),
+    }, ['id']),
+  },
   {
     name: 'securenow_analytics_summary',
     title: 'Analytics Summary',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.14.0",
+  "version": "8.15.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",