securenow 8.20.0 → 8.20.1

package/app-config.js

@@ -56,6 +56,7 @@ const DEFAULT_CONFIG = Object.freeze({
     headers: {},
     logLevel: 'error',
     disableInstrumentations: [],
+    middlewareSpans: false,
   },
   runtime: {
     deploymentEnvironment: 'production',
@@ -112,6 +113,7 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.otel.headers': 'Optional OTLP headers. The SDK auto-adds x-securenow-app-key from app.key and Authorization from apiKey when missing.',
   'config.otel.logLevel': 'OpenTelemetry diagnostic log level: error, warn, info, debug, or none.',
   'config.otel.disableInstrumentations': 'Optional OTel instrumentation package names to disable.',
+  'config.otel.middlewareSpans': 'If true, Express and Koa emit one span per middleware per request (off by default: high volume, not used by detections; route handlers and http.route are kept).',
   'config.runtime.deploymentEnvironment': 'deployment.environment resource attribute. Set this in the credentials file for production.',
   'config.runtime.noUuid': 'null means auto: true when app.key is present. Set true/false only for advanced routing needs.',
   'config.runtime.strict': 'If true, PM2/cluster workers exit when no app identity is resolvable.',

package/mcp/catalog.js

@@ -780,7 +780,20 @@ const TOOLS = [
       notificationId: string('Notification id from the human action row.'),
       ip: string('IP address to mark as false positive.'),
       verificationId: string('The autonomous agent must pass the verificationId from securenow_agent_verify_ip for this IP (verdict benign or never_block).'),
-      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Restrictive false-positive conditions, scoped by app, rule, path, method, status, user agent or body.' },
+      conditions: {
+        type: 'array',
+        description: 'Restrictive exclusion conditions on the request (all must match unless matchMode is "any"). The app and rule scope come from the alert and ruleScope, not from a condition.',
+        items: {
+          type: 'object',
+          additionalProperties: false,
+          required: ['field', 'operator', 'value'],
+          properties: {
+            field: { type: 'string', enum: ['path', 'method', 'user_agent', 'status_code', 'request_body', 'request_headers'] },
+            operator: { type: 'string', enum: ['equals', 'not_equals', 'contains', 'not_contains', 'starts_with', 'ends_with', 'regex', 'in', 'not_in'], description: 'Text operators; in / not_in take comma-separated values.' },
+            value: { type: 'string', description: 'A string; comma-separated for in / not_in.' },
+          },
+        },
+      },
       matchMode: string('Condition match mode: all or any.'),
       createExclusion: boolean('Whether to create a restrictive exclusion rule.'),
       applyToExisting: boolean('Whether to apply to existing matching IP investigations.'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.20.0",
+  "version": "8.20.1",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",

package/tracing.js

@@ -420,6 +420,16 @@ for (const n of appConfig.listConfig('otel.disableInstrumentations')) {
   disabledMap[n] = { enabled: false };
 }
 
+// Express and Koa make one span per middleware per request (body parsers, compression, cors...). On a busy app
+// that is most of the telemetry (one store sent 16 of its 21 million spans an hour this way) and no detection
+// reads it. Route handlers and http.route on the server span stay. config.otel.middlewareSpans=true keeps them.
+const frameworkInstrumentationConfig = appConfig.boolConfig('otel.middlewareSpans', false)
+  ? {}
+  : {
+      '@opentelemetry/instrumentation-express': { ignoreLayersType: ['middleware'] },
+      '@opentelemetry/instrumentation-koa': { ignoreLayersType: ['middleware'] },
+    };
+
 // -------- Body Capture Configuration --------
 // Opt-out defaults: set config.capture.body=false to disable.
 const captureBody = appConfig.boolConfig('capture.body', true);
@@ -754,7 +764,8 @@ const sdk = new NodeSDK({
   instrumentations: [
     httpInstrumentation,
     ...(disabledMap['@opentelemetry/instrumentation-mongodb'] ? [] : [new MongoDBInstrumentation()]),
-    ...getNodeAutoInstrumentations({ 
+    ...getNodeAutoInstrumentations({
+      ...frameworkInstrumentationConfig,
       ...disabledMap,
       '@opentelemetry/instrumentation-http': { enabled: false },
       '@opentelemetry/instrumentation-mongodb': { enabled: false },