securenow 8.17.0 → 8.19.0

package/cli/security.js

@@ -55,6 +55,9 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'from-text' || sub === 'draft') {
     return alertRuleFromText(args.slice(1), flags);
   }
+  if (sub === 'change') {
+    return alertRuleChange(args.slice(1), flags);
+  }
   if (sub === 'show') {
     return alertRuleShow(args.slice(1), flags);
   }
@@ -94,6 +97,9 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'runs') {
     return alertRuleRuns(args.slice(1), flags);
   }
+  if (sub === 'request-promotion') {
+    return alertRuleRequestPromotion(args.slice(1), flags);
+  }
   if (sub === 'run' || sub === 'run-now') {
     return alertRuleRunNow(args.slice(1), flags);
   }
@@ -472,9 +478,14 @@ async function alertRuleUpdate(args, flags) {
 
   // Lifecycle mode promote/demote (also available as: alerts rules promote|demote <id>).
   if (flags.mode === 'test' || flags.mode === 'prod') body.mode = flags.mode;
+  if (flags.severity) {
+    const severity = String(flags.severity).toLowerCase();
+    if (!['critical', 'high', 'medium', 'low'].includes(severity)) { ui.error('--severity must be critical, high, medium or low'); process.exit(1); }
+    body.severity = severity;
+  }
 
   if (Object.keys(body).length === 0) {
-    ui.error('Nothing to update. Use --applications-all/--apps, --status (or --enable/--disable/--pause), or --mode test|prod (or: alerts rules promote/demote <id>).');
+    ui.error('Nothing to update. Use --applications-all/--apps, --status (or --enable/--disable/--pause), --severity, or --mode test|prod (or: alerts rules promote/demote <id>).');
     process.exit(1);
   }
 
@@ -482,7 +493,7 @@ async function alertRuleUpdate(args, flags) {
   try {
     await api.put(`/alert-rules/${id}`, body);
     s.stop('Updated');
-    const extras = [body.status && `status → ${body.status}`, body.mode && `mode → ${body.mode}`].filter(Boolean);
+    const extras = [body.status && `status → ${body.status}`, body.mode && `mode → ${body.mode}`, body.severity && `severity → ${body.severity}`].filter(Boolean);
     ui.success('Alert rule updated' + (extras.length ? ` (${extras.join(', ')})` : ''));
   } catch (err) {
     s.fail('Failed to update alert rule');
@@ -873,6 +884,87 @@ async function alertRuleFromText(args, flags) {
   console.log(ui.c.dim(`  Runs: securenow alerts rules runs ${id}   Why no alert: securenow alerts rules why ${id} --ip <ip>`));
 }
 
+// Describe a change to an existing rule in English: the API rewrites the rule from its current
+// version and the app's data, checks the result, and the change is applied as a new rule version.
+async function alertRuleChange(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const text = args.slice(1).join(' ').trim() || (typeof flags.text === 'string' ? flags.text.trim() : '');
+  if (!id || !text) {
+    ui.error('Usage: securenow alerts rules change <rule-id> "<what should change>" [--app <key>] [--yes] [--draft-only] [--json]');
+    console.log(ui.c.dim('  Example: securenow alerts rules change <id> "raise the threshold to 20 failed sign-ins"'));
+    process.exit(1);
+  }
+  const body = { text, ruleId: id };
+  if (flags.app) body.applicationKey = flags.app;
+
+  const s = ui.spinner('Rewriting the rule from your app\'s data');
+  let result;
+  try {
+    const started = await api.post('/alert-rules/draft', body);
+    result = await waitForDraft(started.draftId, s);
+  } catch (err) {
+    s.fail('Failed to draft the change');
+    throw err;
+  }
+  if (result.status !== 'complete') {
+    s.fail(result.error || 'Could not draft the change');
+    process.exit(1);
+  }
+  s.stop('Change drafted');
+
+  const matches = Number(result.check?.matches || 0);
+  const refuse = Boolean(flags.yes) && !flags.force && !flags['draft-only'] && matches > 0;
+  if (flags.json && (flags['draft-only'] || !flags.yes)) { ui.json(result); return; }
+  if (flags.json && refuse) {
+    ui.json({ ...result, applied: false, refused: 'check_matches' });
+    process.exit(1);
+  }
+  if (result.current?.kind === 'instant') {
+    console.log('');
+    console.log(ui.c.dim(`  Before: ${result.current.matchMode === 'all' ? 'all of' : 'any of'} ${(result.current.conditions || []).map((c) => `${c.field} ${c.operator} ${c.value}`).join('; ')}`));
+  } else if (result.current?.sql) {
+    console.log('');
+    console.log(ui.c.dim('  Before'));
+    for (const line of String(result.current.sql).split('\n')) console.log(ui.c.dim(`    ${line}`));
+  }
+  printDraft(result);
+  console.log('');
+  if (flags['draft-only']) { ui.info('Draft only: nothing was changed.'); return; }
+  if (refuse) {
+    ui.warn(`Not applied: the changed rule matches ${matches} row${matches === 1 ? '' : 's'} in your data right now, so it would alert at once. Apply anyway with --yes --force.`);
+    process.exit(1);
+  }
+  if (!flags.yes) {
+    if (matches > 0) ui.warn(`The changed rule matches ${matches} row${matches === 1 ? '' : 's'} right now (above): it alerts as soon as it is applied.`);
+    const ok = await ui.confirm('Apply this change? It is saved as a new rule version (roll back with alerts rules rollback)');
+    if (!ok) { ui.info('Nothing changed'); return; }
+  }
+
+  const d = result.draft || {};
+  const update = {
+    name: d.name,
+    description: d.summary || undefined,
+    severity: d.severity,
+    reviewNote: `Changed in English: ${text}`.slice(0, 1000),
+    // Instant: only what the draft decides, so the rule keeps its own instant-block settings.
+    ...(d.executionMode === 'instant'
+      ? { instant: { matchMode: d.instant?.matchMode, conditions: d.instant?.conditions || [], environments: d.instant?.environments || [] } }
+      : { sqlQuery: d.sqlQuery, schedule: d.schedule }),
+  };
+  const c = ui.spinner('Applying the change');
+  try {
+    const data = await api.put(`/alert-rules/${id}`, update);
+    c.stop(`Changed: version ${data.configVersion || '?'}`);
+    printWarnings(data);
+    if (flags.json) ui.json(data);
+    else console.log(ui.c.dim(`  History: securenow alerts rules versions ${id}   Runs: securenow alerts rules runs ${id}`));
+  } catch (err) {
+    c.fail('Failed to apply the change');
+    throw err;
+  }
+}
+
 async function alertRuleTest(args, flags) {
   requireAuth();
   const id = args[0];
@@ -1230,6 +1322,33 @@ async function alertRuleWhy(args, flags) {
   console.log('');
 }
 
+// An agent hands the promotion of its test-mode rule to a person: the request waits on the rules
+// page and in `securenow human promotions` until someone approves or denies it.
+async function alertRuleRequestPromotion(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const reason = typeof flags.reason === 'string' ? flags.reason.trim() : '';
+  if (!id || !reason) {
+    ui.error('Usage: securenow alerts rules request-promotion <rule-id> --reason "why it is ready for prod" [--evidence "<text>|@file"]');
+    process.exit(1);
+  }
+  const body = { reason };
+  if (typeof flags.evidence === 'string') {
+    body.evidence = flags.evidence.startsWith('@') ? fs.readFileSync(flags.evidence.slice(1), 'utf8') : flags.evidence;
+  }
+  const s = ui.spinner('Asking for promotion');
+  try {
+    const data = await api.post(`/alert-rules/${id}/promotion-requests`, body);
+    s.stop(data.existing ? 'A request for this rule is already waiting' : 'Promotion requested');
+    if (flags.json) { ui.json(data); return; }
+    ui.info(data.message || 'Waiting for a person to approve it.');
+    if (data.request?.id) console.log(ui.c.dim(`  Request ${data.request.id}. A person decides with: securenow human promotions`));
+  } catch (err) {
+    s.fail('Failed to request promotion');
+    throw err;
+  }
+}
+
 // ── Alert Channels ──
 
 function channelDestination(ch) {

package/cli.js

@@ -195,6 +195,7 @@ const COMMANDS = {
     sub: {
       list: { desc: 'List recent logs', flags: { app: 'App key', env: 'Environment (production, staging, preview, local, or all)', environment: 'Alias for --env', limit: 'Max results (default 200)', since: 'Time window (e.g. 30m, 6h, 2d)', minutes: 'Time window in minutes (alias for --since Nm)', level: 'Filter by level (error, warn, info, debug)', start: 'Start time (ISO 8601)', end: 'End time (ISO 8601)' }, run: (a, f) => require('./cli/monitor').logsList(a, f) },
       trace: { desc: 'Show logs for a trace', usage: 'securenow logs trace <traceId>', flags: { app: 'App key', env: 'Environment', environment: 'Alias for --env' }, run: (a, f) => require('./cli/monitor').logsTrace(a, f) },
+      errors: { desc: 'Error lines grouped by message (ids and numbers normalized), most frequent first', usage: 'securenow logs errors [--app <key>] [--env <env>] [--since 1h] [--warn] [--limit 20]', flags: { app: 'App key', env: 'Environment', environment: 'Alias for --env', since: 'Window, e.g. 30m, 6h, 2d (default 1h)', warn: 'Include warnings', limit: 'Max groups (default 20)', json: 'Output as JSON' }, run: (a, f) => require('./cli/monitor').logsErrors(a, f) },
     },
     defaultSub: 'list',
   },
@@ -248,10 +249,11 @@ const COMMANDS = {
     defaultSub: 'list',
   },
   human: {
-    desc: 'Work the human action queue prepared by SecureNow AI',
-    usage: 'securenow human <list|show|block|fp|report|action|prompt|work> [row|notificationId:ip] [options]',
+    desc: 'Requires Human: decisions SecureNow prepared but won\'t make alone (block an IP, false positive, close, approve a plan)',
+    usage: 'securenow human <list|show|block|fp|close|report|action|prompt|work|promotions|approve-promotion|deny-promotion> [row|notificationId:ip|request-id] [options]',
     flags: {
       json: 'Output as JSON',
+      note: 'With approve-promotion / deny-promotion: a note recorded with the decision',
       page: 'Queue page number',
       limit: 'Queue page size',
       search: 'Search IP, rule, path, or verdict',
@@ -282,10 +284,40 @@ const COMMANDS = {
       show: { desc: 'Show one row with AI report, proofs, investigation steps, and trace links', usage: 'securenow human show <row|notificationId:ip>', run: (a, f) => require('./cli/human').show(a, f) },
       block: { desc: 'Approve the AI block recommendation for a row', usage: 'securenow human block <row|notificationId:ip> --yes --reason "..."', run: (a, f) => require('./cli/human').block(a, f) },
       fp: { desc: 'Mark a row as a scoped false positive', usage: 'securenow human fp <row|notificationId:ip> --yes --reason "..."', run: (a, f) => require('./cli/human').fp(a, f) },
-      report: { desc: 'Record a structured decision report on a row without changing status', usage: 'securenow human report <row|notificationId:ip> --yes --outcome ambiguous --summary "..."', run: (a, f) => require('./cli/human').report(a, f) },
-      action: { desc: 'Approve/reject/execute a case-level proposed action', usage: 'securenow human action <row|notificationId> [actionKey] --status approved --yes --reason "..."', run: (a, f) => require('./cli/human').action(a, f) },
+      close: { desc: 'Close an IP row without blocking it (not now, rule needs tuning, rate-limited...): it leaves the queue, the reason stays on the case', usage: 'securenow human close <row|notificationId:ip> --outcome deferred|rule_tuning|new_alert_rule|ambiguous|skipped|rate_limited|other --reason "..." [--missing-proof "..."] --yes', run: (a, f) => require('./cli/human').close(a, f) },
+      report: { desc: 'Add a decision note to a row; the row stays in the queue (use close to remove it)', usage: 'securenow human report <row|notificationId:ip> --yes --outcome ambiguous --summary "..."', run: (a, f) => require('./cli/human').report(a, f) },
+      action: { desc: 'Approve/reject a case-level plan. approve_block blocks; approving tune_rule/create_exclusion only records it (change the rule first)', usage: 'securenow human action <row|notificationId> [actionKey] --status approved --yes --reason "..."', run: (a, f) => require('./cli/human').action(a, f) },
       prompt: { desc: 'Print a Codex/Claude MCP prompt for row or queue work', usage: 'securenow human prompt [row|notificationId:ip] [--limit 10]', run: (a, f) => require('./cli/human').prompt(a, f) },
       work: { desc: 'List the queue and print the MCP runbook to work it deeply', usage: 'securenow human work [--limit 10]', run: (a, f) => require('./cli/human').work(a, f) },
+      promotions: { desc: 'List requests to promote a test-mode rule to prod (agents ask, a person decides)', usage: 'securenow human promotions [--status pending|approved|denied|all]', run: (a, f) => require('./cli/human').promotions(a, f) },
+      'approve-promotion': { desc: 'Approve a promotion request: the rule goes to prod', usage: 'securenow human approve-promotion <request-id> --yes [--note "..."]', run: (a, f) => require('./cli/human').approvePromotion(a, f) },
+      'deny-promotion': { desc: 'Deny a promotion request: the rule stays in test mode', usage: 'securenow human deny-promotion <request-id> --reason "..."', run: (a, f) => require('./cli/human').denyPromotion(a, f) },
+    },
+    defaultSub: 'list',
+  },
+  review: {
+    desc: 'Alert Review: "is this rule right?" Rules that fired too wide or on your own infrastructure, paused until someone decides',
+    usage: 'securenow review <list|show|keep|close|dismiss|group> [row|rootCauseKey|notificationId] [options]',
+    flags: {
+      json: 'Output as JSON',
+      page: 'Groups page number',
+      limit: 'Groups page size',
+      search: 'Search rule, route, IP, or app name',
+      outcome: 'Why it closes: rule_tuning, false_positive, clean, deferred, new_alert_rule, rate_limited, ambiguous, skipped, other',
+      reason: 'Why, in one sentence: kept on the alert as its decision report',
+      summary: 'Longer decision summary (defaults to --reason)',
+      preview: 'With group: show what would close, change nothing',
+      'allow-mixed': 'With group: close a group whose rows disagree, after reviewing every row',
+      yes: 'Confirm without prompting',
+      force: 'Alias for --yes',
+    },
+    sub: {
+      list: { desc: 'List open alert runs grouped by root cause (one decision can close a group)', usage: 'securenow review list [--search lab-auth]', run: (a, f) => require('./cli/review').list(a, f) },
+      show: { desc: 'Show a group (row or arc_ key) or one alert run (notification id)', usage: 'securenow review show <row|rootCauseKey|notificationId>', run: (a, f) => require('./cli/review').show(a, f) },
+      keep: { desc: 'The rule is right: turn it back on, stop it pausing itself, close the run', usage: 'securenow review keep <notificationId> --reason "..." --yes', run: (a, f) => require('./cli/review').keep(a, f) },
+      close: { desc: 'Close one run with an outcome; nothing is blocked or unblocked', usage: 'securenow review close <notificationId> --outcome rule_tuning --reason "..." --yes', run: (a, f) => require('./cli/review').close(a, f) },
+      dismiss: { desc: 'Dismiss one run (not worth acting on); nothing is blocked or unblocked', usage: 'securenow review dismiss <notificationId> --reason "..." --yes', run: (a, f) => require('./cli/review').dismiss(a, f) },
+      group: { desc: 'Close every run in a group with one decision; --preview first', usage: 'securenow review group <row|rootCauseKey> --outcome rule_tuning --reason "..." [--preview] [--allow-mixed] --yes', run: (a, f) => require('./cli/review').group(a, f) },
     },
     defaultSub: 'list',
   },
@@ -314,9 +346,11 @@ const COMMANDS = {
         desc: 'Create (from English or SQL), list, show, update, duplicate, promote/demote, set-sql, validate, delete, test, run, explain, or tune alert rules',
         usage: 'securenow alerts rules <list|from-text|create|show|update|duplicate|promote|demote|set-sql|validate|delete|test|run|runs|why|dry-run-query|tune-query|exclusions|versions|version|rollback> [options]\n'
           + '  securenow alerts rules from-text "<what to catch, in English>" --app <key> [--env <environment>] [--instant|--periodic] [--yes|--draft-only]\n'
+          + '  securenow alerts rules change <id> "<what should change>" [--yes|--draft-only]   rewrite a rule from English, checked, applied as a new version\n'
           + '  securenow alerts rules runs <id> [--limit 20] [--since 1h]     what each run saw and why it did or didn\'t notify\n'
           + '  securenow alerts rules run <id> [--no-wait]                     run a periodic rule now\n'
-          + '  securenow alerts rules why <id> --ip <ip> [--since 1h]          why the rule did or didn\'t alert on one address',
+          + '  securenow alerts rules why <id> --ip <ip> [--since 1h]          why the rule did or didn\'t alert on one address\n'
+          + '  securenow alerts rules request-promotion <id> --reason "..."    ask a person to promote a test-mode rule (for agents)',
         flags: {
           json: 'Output as JSON',
           env: 'With from-text or create --conditions: only watch this environment (default: every environment)',
@@ -330,7 +364,7 @@ const COMMANDS = {
           nlp: 'With create: plain-English intent stored on the query',
           text: 'Alias for --nlp',
           category: 'With create: query category (default: custom)',
-          severity: 'With create: critical | high | medium | low',
+          severity: 'With create/update: critical | high | medium | low',
           schedule: 'With create: cron expression (default */15 * * * *)',
           'throttle-minutes': 'With create: one alert per address every N minutes (default 15)',
           'no-throttle': 'With create: disable throttling',
@@ -359,7 +393,8 @@ const COMMANDS = {
           query: 'Alias for --sql',
           file: 'Read SQL from a file',
           'no-validate': 'With create/set-sql: skip the post-write dry-run + rollback',
-          reason: 'Audit reason for a write',
+          reason: 'Audit reason for a write. With request-promotion: why the rule is ready for prod',
+          evidence: 'With request-promotion: evidence text or @file (runs, notifications, false-positive checks)',
           'apply-globally': 'Required for system query tuning',
           'reactivate-paused': 'Reactivate paused system copies after tuning',
           'expected-hash': 'Expected current SQL SHA-256 hash',
@@ -775,8 +810,14 @@ const COMMANDS = {
   },
   mcp: {
     desc: 'Start the SecureNow MCP server over stdio',
-    usage: 'securenow mcp',
-    run: () => require('./mcp/server'),
+    usage: 'securenow mcp [--profile all|investigator|detection|responder]',
+    flags: {
+      profile: 'Serve a subset of the tools: investigator (read-only investigation), detection (alert rules), responder (alerts, blocks, limits). Default: all',
+    },
+    run: (a, f) => {
+      if (typeof f.profile === 'string') process.env.SECURENOW_MCP_PROFILE = f.profile;
+      require('./mcp/server');
+    },
   },
   version: {
     desc: 'Show CLI version',
@@ -840,7 +881,7 @@ function showHelp(commandName) {
     'Authentication': ['login', 'logout', 'whoami', 'credentials'],
     'Applications': ['apps', 'init', 'status'],
     'Observe': ['traces', 'logs', 'analytics'],
-    'Detect & Respond': ['human', 'notifications', 'alerts', 'fp'],
+    'Detect & Respond': ['human', 'review', 'notifications', 'alerts', 'fp'],
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],

package/esm-detect.js

@@ -0,0 +1,57 @@
+'use strict';
+
+/**
+ * Is this an ESM app, so the preload must register the ESM loader hook?
+ *
+ * Node decides a file's module type from the nearest package.json above THE FILE, not from
+ * the working directory. Process managers often start apps from another directory (pm2 `cwd`,
+ * systemd WorkingDirectory, a Docker WORKDIR, a supervisor that runs each environment from its
+ * own folder). Checking only process.cwd() then missed the hook, and every library the app
+ * imports (Express, pg, ...) went uninstrumented: no http.route on any request span.
+ *
+ * ESM when any of these says so: the entry script is .mjs; the nearest package.json above the
+ * entry script (process.argv[1], or pm2's pm_exec_path) has "type": "module"; or the working
+ * directory's package.json does (the original check, kept for launchers whose argv[1] is a wrapper).
+ */
+const fs = require('fs');
+const path = require('path');
+
+function readType(pkgPath) {
+  try {
+    return JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^/, '')).type || 'commonjs';
+  } catch (_) {
+    return null;
+  }
+}
+
+function nearestPackageJson(startDir) {
+  let dir = startDir;
+  for (let i = 0; i < 64; i++) {
+    const candidate = path.join(dir, 'package.json');
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
+/** @returns {{ esm: boolean, reason: string|null }} */
+function detectEsmApp({ argv = process.argv, cwd = process.cwd(), env = process.env } = {}) {
+  const entries = [argv && argv[1], env && env.pm_exec_path]
+    .filter((p) => typeof p === 'string' && p && !p.startsWith('-'))
+    .map((p) => path.resolve(cwd, p));
+
+  for (const entry of entries) {
+    if (/\.mjs$/i.test(entry)) return { esm: true, reason: `${path.basename(entry)} is an .mjs file` };
+    if (/\.cjs$/i.test(entry)) continue;
+    const pkgPath = nearestPackageJson(path.dirname(entry));
+    if (pkgPath && readType(pkgPath) === 'module') return { esm: true, reason: `${pkgPath} has "type": "module"` };
+  }
+
+  const cwdPkg = path.resolve(cwd, 'package.json');
+  if (fs.existsSync(cwdPkg) && readType(cwdPkg) === 'module') return { esm: true, reason: `${cwdPkg} has "type": "module"` };
+  return { esm: false, reason: null };
+}
+
+module.exports = { detectEsmApp, nearestPackageJson };