securenow 8.22.0 → 8.24.0

package/NPM_README.md

@@ -584,6 +584,10 @@ npx securenow credentials runtime --env production
 # also works when the canonical credentials.json file is absent.
 # The SDK checks named files in a fixed order and does not use env vars
 # to pick the credentials filename.
+# Hosts without file mounts (Vercel, Railway, Render, Heroku, Fly):
+npx securenow credentials runtime --env production --format env
+# -> SECURENOW_CREDENTIALS=<base64>; store it as a secret environment variable.
+#    It takes precedence over credential files.
 
 # Use --json for machine-readable output
 npx securenow logs --json --level error | jq '.logs'
@@ -719,12 +723,16 @@ module.exports = {
   apps: [{
     name: 'my-app',
     script: './app.js',
-    node_args: '-r securenow/register',
+    instances: 'max', // or leave out for fork mode
+    // An absolute path, resolved when PM2 loads this file: in cluster mode Node resolves a bare
+    // '-r securenow/register' from the PM2 daemon's folder, so workers started by `pm2 resurrect`
+    // at boot crash-loop with "Cannot find module 'securenow/register'".
+    node_args: ['-r', require.resolve('securenow/register')],
   }]
 };
 ```
 
-> **Important:** Put `.securenow/runtime.json` in the PM2 app root for local/dev deployments, or mount the production runtime export as `.securenow/credentials.json`. Keep `node_args: '-r securenow/register'`. PM2 restarts will then load the SDK, traces/logs, body capture, and firewall without any SecureNow env vars.
+> **Important:** Put `.securenow/runtime.json` in the PM2 app root for local/dev deployments, or mount the production runtime export as `.securenow/credentials.json`. PM2 restarts will then load the SDK, traces/logs, body capture, and firewall without any SecureNow env vars. Fork and cluster mode both read the app folder PM2 started (`pm_cwd`), whichever folder the PM2 daemon itself was started from (before 8.24.0 a cluster worker searched the daemon's folder and could start without credentials).
 
 ---
 
@@ -840,7 +848,7 @@ PM2 config:
   name: 'my-nestjs-app',
   script: 'app.ts',
   interpreter: 'node',
-  node_args: '-r securenow/register -r ts-node/register',
+  node_args: ['-r', require.resolve('securenow/register'), '-r', require.resolve('ts-node/register')],
 }
 ```
 
@@ -1082,12 +1090,16 @@ npx securenow init
 
 ```typescript
 export async function register() {
-  if (process.env.NEXT_RUNTIME !== 'nodejs') return;
-
-  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
-  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
-  registerSecureNow({ captureBody: true });
-  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    try {
+      const securenowNext = await import('securenow/nextjs');
+      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+      registerSecureNow({ captureBody: true });
+      await import('securenow/nextjs-auto-capture');
+    } catch (error) {
+      console.error('[securenow] SecureNow did not start; the app is running without it:', error);
+    }
+  }
 }
 ```
 
@@ -1104,7 +1116,9 @@ const nextConfig = {
 export default nextConfig;
 ```
 
-No `.env.local` is needed locally or in production. Local setup reads `.securenow/runtime.json`; production should use `npx securenow credentials runtime --env production` and mount/copy the resulting JSON as `.securenow/credentials.json`.
+No `.env.local` is needed locally or in production. Local setup reads `.securenow/runtime.json`; production should use `npx securenow credentials runtime --env production` and mount/copy the resulting JSON as `.securenow/credentials.json` (in a standalone Docker image, next to `server.js`). On Vercel or another host without file mounts, run `npx securenow credentials runtime --env production --format env` and store the printed `SECURENOW_CREDENTIALS` value as a secret environment variable.
+
+Keep the imports inside the `nodejs` block and without `webpackIgnore`: Next.js then drops them from the Edge build and traces `securenow` and its dependencies into `output: 'standalone'`. An instrumentation file written by `init` before 8.24.0 used `webpackIgnore`, so standalone images shipped without OpenTelemetry and every request returned 500; run `npx securenow init` again to replace it.
 
 #### Option B: Manual configuration
 
@@ -1133,11 +1147,11 @@ module.exports = {
 };
 ```
 
-**Why is this needed?** Next.js bundles server code with webpack, which can break OpenTelemetry's dynamic `require()` calls and monkey-patching. Externalizing `securenow` keeps the SDK as normal Node.js runtime code. `outputFileTracingIncludes` keeps SecureNow's runtime modules available in standalone/self-hosted output, including the firewall.
+**Why is this needed?** Next.js bundles server code with webpack or Turbopack, which can break OpenTelemetry's dynamic `require()` calls and monkey-patching. Externalizing `securenow` keeps the SDK as normal Node.js runtime code, and Next.js traces its dependencies into standalone output. `outputFileTracingIncludes` adds SecureNow's own files that are loaded at runtime, including the firewall.
 
 ---
 
-### Nuxt 3
+### Nuxt 3 and 4
 
 ```bash
 npm install securenow
@@ -1151,22 +1165,11 @@ export default defineNuxtConfig({
 });
 ```
 
-Local app identity, runtime API key, and secure defaults come from `.securenow/runtime.json`; production can mount the generated tokenless runtime file as `.securenow/credentials.json` or `.securenow/credentials.<env>.json`.
+Local app identity, runtime API key, and secure defaults come from `.securenow/runtime.json`; production can mount the generated tokenless runtime file as `.securenow/credentials.json` or `.securenow/credentials.<env>.json` next to the `.output` server, or set `SECURENOW_CREDENTIALS` (see `credentials runtime --format env`).
 
-That's it -- the Nuxt module handles OTel SDK initialization, Nitro externalization, firewall activation, and request tracing automatically. Optional config:
-
-```typescript
-export default defineNuxtConfig({
-  modules: ['securenow/nuxt'],
-  securenow: {
-    captureBody: true,
-    logging: true,
-    noUuid: true,
-  },
-});
-```
+That's it: the module's Nitro plugin loads the same runtime as `node -r securenow/register` (tracing with header and body capture, logs, crash capture, firewall, rate limits, challenges) and keeps `securenow` external, so Nitro copies it with its dependencies into `.output/server/node_modules`. It also records the matched route as `http.route` and handler errors as exceptions. Settings go in `.securenow/runtime.json` (`config.capture.body`, `config.logging.enabled`, ...); `securenow: { ... }` options in `nuxt.config` are no longer used, and the build prints a warning if you set them.
 
-The Nuxt server plugin (v5.13.0+) initializes the firewall independently from OpenTelemetry, so IP blocking works even if tracing encounters an error.
+Before 8.24.0 the module's plugin crashed the `nuxt build` server at startup. Starting `.output/server/index.mjs` with `node -r securenow/register` and no module also works.
 
 ---
 
@@ -1174,18 +1177,19 @@ The Nuxt server plugin (v5.13.0+) initializes the firewall independently from Op
 
 | Framework | Traces | Logs | Body Capture | Firewall | Notes |
 |-----------|--------|------|--------------|----------|-------|
-| Express | Yes | Yes | Yes | Yes | Fully compatible |
-| Fastify | Yes | Yes | Yes | Yes | Default on; use `config.capture.body=false` only for local stream conflicts |
-| Koa | Yes | Yes | Yes | Yes | Needs `koa-bodyparser` |
-| NestJS | Yes | Yes | Yes | Yes | Use `-r ts-node/register` |
-| Hapi | Yes | Yes | Yes | Yes | Default on; use `config.capture.body=false` only for local stream conflicts |
-| h3 | Yes | Yes | Yes | Yes | Uses `toNodeListener()` |
-| Polka | Yes | Yes | Yes | Yes | Needs manual body parser |
-| Micro/HTTP | Yes | Yes | Yes | Yes | Full control |
-| Hono | Yes | Yes | Yes | Yes | Use ESM `-r` preload |
-| Feathers | Yes | Yes | Yes | Yes | Uses Express transport |
-| Next.js | Yes | Yes | Yes | Yes | Use `instrumentation.ts` + `serverExternalPackages` + `outputFileTracingIncludes` |
-| Nuxt 3 | Yes | Yes | Yes | Yes | Use `securenow/nuxt` module |
+| Express 4 and 5 | Yes | Yes | Yes | Yes | Fully compatible (CommonJS, ESM, TypeScript via tsx) |
+| Fastify 5 | Yes | Yes | Yes | Yes | `http.route` and handler exceptions recorded through Fastify's `fastify.initialization` channel (8.24.0+) |
+| Koa 3 | Yes | Yes | Yes | Yes | Body needs a body parser; `http.route` needs `@koa/router` |
+| NestJS 11 | Yes | Yes | Yes | Yes | `-r securenow/register` before `-r ts-node/register` for TypeScript |
+| Hapi 21 | Yes | Yes | Yes | Yes | Fully compatible |
+| h3 1 | Yes | Yes | Yes | Yes | Uses `toNodeListener()`; no `http.route` (raw path) |
+| Polka | Yes | Yes | Yes | Yes | Needs a body parser; no `http.route`; pass errors to `next(err)` (a thrown error crashes Polka) |
+| Micro/HTTP | Yes | Yes | Yes | Yes | Full control; no route templates |
+| Hono 4 (`@hono/node-server`) | Yes | Yes | Yes | Yes | No `http.route` (raw path); errors reach the logs through Hono's default handler |
+| Feathers 5 | Yes | Yes | Yes | Yes | Koa or Express transport; no `http.route` |
+| Next.js 15 and 16 | Yes | Yes | Yes | Yes | `instrumentation.ts` + `serverExternalPackages` + `outputFileTracingIncludes`; `next start` and `output: 'standalone'` |
+| Nuxt 3 and 4 | Yes | Yes | Yes | Yes | `securenow/nuxt` module; `nuxt build` output |
+| Bun 1.3 (`node:http` apps) | Yes | Yes | Yes | Yes | `bun --preload securenow/register`; `Bun.serve` is not supported |
 
 ---
 
@@ -1339,8 +1343,9 @@ SecureNow provides multiple entry points depending on your needs:
 |-------------|-------|-------------------|-------------------|-------|
 | `securenow/register` | `node -r securenow/register app.js` | Yes | Yes | Default -- full tracing + firewall |
 | `securenow/firewall-only` | `node -r securenow/firewall-only app.js` | No | Yes | Firewall only, no OTel overhead |
-| `securenow/nextjs` | `await import(/* webpackIgnore: true */ 'securenow/nextjs')` | Yes | Yes | Next.js instrumentation hook |
-| `securenow/nuxt` | `modules: ['securenow/nuxt']` | Yes | Yes | Nuxt 3 module |
+| `securenow/nextjs` | `await import('securenow/nextjs')` inside the `nodejs` block of `instrumentation.ts` | Yes | Yes | Next.js instrumentation hook |
+| `securenow/nuxt` | `modules: ['securenow/nuxt']` | Yes | Yes | Nuxt 3 and 4 module |
+| `securenow/register-vite` | `node -r securenow/register-vite node_modules/vite/bin/vite.js preview` | Yes | Yes | Same as `securenow/register`, for the Node process serving a Vite app |
 | `securenow/nextjs-webpack-config` | `withSecureNow(config)` | - | - | Next.js config wrapper |
 | `securenow/firewall` | `require('securenow/firewall').init({...})` | No | Yes | Programmatic firewall API |
 | `securenow/rate-limits` | `require('securenow/rate-limits').parseRateLimitText(...)` | No | Yes | Rate-limit remediation API helper |
@@ -1619,12 +1624,16 @@ const enabled: boolean = isLoggingEnabled();
 ```typescript
 // instrumentation.ts
 export async function register() {
-  if (process.env.NEXT_RUNTIME !== 'nodejs') return;
-
-  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
-  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
-  registerSecureNow({ captureBody: true });
-  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    try {
+      const securenowNext = await import('securenow/nextjs');
+      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+      registerSecureNow({ captureBody: true });
+      await import('securenow/nextjs-auto-capture');
+    } catch (error) {
+      console.error('[securenow] SecureNow did not start; the app is running without it:', error);
+    }
+  }
 }
 ```
 
@@ -1759,7 +1768,7 @@ SecureNow trusts private, loopback, and same-host proxy peers automatically. For
 
 **Check 6: Using PM2?**
 
-Make sure `node_args: '-r securenow/register'` is in your `ecosystem.config.cjs`. Without it, PM2 restarts skip the SDK entirely.
+Make sure `node_args: ['-r', require.resolve('securenow/register')]` is in your `ecosystem.config.cjs`. Without it, PM2 restarts skip the SDK entirely; with a bare `'-r securenow/register'`, cluster workers started from another folder (`pm2 resurrect` at boot) crash with `Cannot find module 'securenow/register'`.
 
 ### Logs Not Appearing
 
@@ -1913,12 +1922,12 @@ module.exports = {
     name: 'my-app',
     script: './app.js',
     instances: 4,
-    node_args: '-r securenow/register',
+    node_args: ['-r', require.resolve('securenow/register')],
   }]
 };
 ```
 
-Without `node_args`, PM2 starts your script directly without the securenow preload, so neither tracing nor the firewall will be active.
+Without `node_args`, PM2 starts your script directly without the securenow preload, so neither tracing nor the firewall will be active. Use the absolute path: in cluster mode Node resolves a bare `-r securenow/register` from the PM2 daemon's folder, and the workers crash-loop when the daemon was started elsewhere (as `pm2 resurrect` does at boot).
 
 ---
 

package/README.md

@@ -75,7 +75,7 @@ npx securenow login
 node -r securenow/register src/index.js
 ```
 
-No `.env` edits, no API keys to paste. Runtime config lives in `.securenow/runtime.json`; it is never read from environment variables.
+No `.env` edits, no API keys to paste. Runtime config lives in `.securenow/runtime.json`. The only environment variables the SDK reads are `SECURENOW_CREDENTIALS`, for hosts that cannot mount a file (see Production), and the `SECURENOW_DISABLED` test switch.
 
 ```json
 "scripts": {
@@ -86,9 +86,9 @@ No `.env` edits, no API keys to paste. Runtime config lives in `.securenow/runti
 
 Can't change the script? Use `NODE_OPTIONS="-r securenow/register" npm start`, or the wrapper: `npx securenow run src/index.js`.
 
-**Next.js** — `npx securenow init` creates `instrumentation.ts` and patches `next.config.*` when it can do so safely (adds `securenow` to `serverExternalPackages` on Next.js 15+). If your config needs human judgment, `init` prints an agent-ready prompt with the exact edits to merge.
+**Next.js** — `npx securenow init` creates `instrumentation.ts` and patches `next.config.*` when it can do so safely (adds `securenow` to `serverExternalPackages` on Next.js 15+). If your config needs human judgment, `init` prints an agent-ready prompt with the exact edits to merge. `next start` and `output: 'standalone'` (Docker) both work. If `init` wrote your instrumentation file before 8.24.0, run it again: it replaces that file, whose `webpackIgnore` imports left SecureNow's dependencies out of standalone builds.
 
-**Nuxt 3** — add the module, then run `npx securenow init`:
+**Nuxt 3 and 4** — add the module, then run `npx securenow init`. The `nuxt build` output is fully covered (tested on Nuxt 3.21 and 4.6, with `.output` running on its own like a Docker image). In `nuxt dev`, requests reach Nitro through Nuxt's dev proxy, so the client IP is unknown there and IP blocking only applies to the built server:
 
 ```ts
 export default defineNuxtConfig({
@@ -96,15 +96,30 @@ export default defineNuxtConfig({
 });
 ```
 
-**What's captured automatically:** HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw `http`), database spans (Postgres, MySQL, MongoDB, Redis), `console.*` as logs with trace correlation, crashes (uncaught exceptions and unhandled rejections) as `FATAL` logs with their stack, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in `.securenow/runtime.json` under `config`.
+Settings come from `.securenow/runtime.json` like every other integration; `securenow: { ... }` options in `nuxt.config` are ignored.
 
-**Production** — same file structure, no env vars. Generate a tokenless runtime credentials file and mount it as a deployment secret:
+**PM2** — in `ecosystem.config.cjs`, pass the preload as an absolute path: `node_args: ['-r', require.resolve('securenow/register')]`. That works in fork and cluster mode (`instances: 'max'`) wherever the PM2 daemon was started. (In cluster mode Node resolves a bare `-r securenow/register` from the daemon's folder, so after `pm2 resurrect` at boot the workers crash-loop with `Cannot find module 'securenow/register'`.) Each process reads the `.securenow/` folder of the app PM2 started.
+
+**Bun** — `bun --preload securenow/register app.js` works for apps served through `node:http` (tested with Express 5 on Bun 1.3). `Bun.serve` is not traced or protected. Deno is not supported.
+
+**What's captured automatically:** HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Hono, Polka, Feathers, h3, Next.js, Nuxt, raw `http`), database spans (Postgres, MySQL, MongoDB, Redis), `console.*` as logs with trace correlation, crashes (uncaught exceptions and unhandled rejections) as `FATAL` logs with their stack, plus the spans that ended just before the crash, request headers and bodies with auto-redaction, multipart metadata (never file content), plus the firewall. `http.route` is recorded for Express, Fastify, NestJS, Koa with `@koa/router`, Hapi, Nuxt, and Next.js 16 (on Next.js's own span; Next.js 15 records `next.route`); Hono, Polka, Feathers and plain h3 show the raw path. Tune everything in `.securenow/runtime.json` under `config`.
+
+**Production** — same file structure. Generate a tokenless runtime credentials file and mount it as a deployment secret (Docker, Kubernetes, VMs):
 
 ```bash
 npx securenow credentials runtime --env production
 # store the output, mount it at <app-root>/.securenow/credentials.json
 ```
 
+**Hosts without file mounts** (Vercel, Railway, Render, Heroku, Fly) — print the same credentials as one environment variable and store it as a secret there:
+
+```bash
+npx securenow credentials runtime --env production --format env
+# SECURENOW_CREDENTIALS=eyJ... -> add as a secret environment variable
+```
+
+`SECURENOW_CREDENTIALS` (raw JSON or base64) takes precedence over credential files.
+
 **Verify** any environment with:
 
 ```bash
@@ -113,7 +128,7 @@ npx securenow doctor         # diagnose config + connectivity
 npx securenow status         # dashboard summary
 ```
 
-**Tests** — test runs otherwise report to your real app with the project's `.securenow` credentials. `SECURENOW_DISABLED=1 npm test` turns the SDK off for that process: no traces, logs, events, firewall or session sync, and `guard()` just calls `next()`. This is the only setting read from the environment.
+**Tests** — test runs otherwise report to your real app with the project's `.securenow` credentials. `SECURENOW_DISABLED=1 npm test` turns the SDK off for that process: no traces, logs, events, firewall or session sync, and `guard()` just calls `next()`. Apart from `SECURENOW_CREDENTIALS`, this is the only setting read from the environment.
 
 ---
 

package/SKILL-API.md

@@ -119,8 +119,8 @@ operator needs to ensure those defaults immediately.
 | `securenow/cidr` | CIDR utilities; exports `createMatcher()`, `ipToInt()`, `parseCidr()`, `matchesCidr()` | CJS |
 | `securenow/resolve-ip` | IP resolution; exports `resolveClientIp()`, `resolveSocketIp()`, `isFromTrustedProxy()` | CJS |
 | `securenow/console-instrumentation` | Console→OTLP bridge; exports `originalConsole`, `restoreConsole()` | CJS |
-| `securenow/web-vite` | Browser OTel (document load, fetch, XHR, user interaction); default export `startSecurenowWeb()` | ESM |
-| `securenow/register-vite` | CJS bridge for Vite preload | CJS |
+| `securenow/web-vite` | Browser OTel (document load, fetch, XHR, user interaction); default export `startSecurenowWeb()`. Sending browser telemetry to SecureNow is disabled since 8.0 (no browser-safe auth yet) | ESM |
+| `securenow/register-vite` | Preload: the same runtime as `securenow/register`, for the Node process serving a Vite app (`vite preview`, Vite SSR) | Preload (`-r`) |
 
 ---
 
@@ -149,8 +149,10 @@ module.exports = {
     name: 'my-app',
     script: './app.js',
     instances: 4,
-    node_args: '-r securenow/register',
-    // Reads .securenow/runtime.json from the project root.
+    // Absolute path: in cluster mode Node resolves a bare '-r securenow/register' from the PM2
+    // daemon's folder, and workers started by `pm2 resurrect` crash with "Cannot find module".
+    node_args: ['-r', require.resolve('securenow/register')],
+    // Reads .securenow/runtime.json from the project root (pm_cwd), wherever the daemon runs.
   }],
 };
 ```
@@ -187,12 +189,16 @@ For Next.js < 15, add `securenow` to `experimental.serverComponentsExternalPacka
 
 ```typescript
 export async function register() {
-  if (process.env.NEXT_RUNTIME !== 'nodejs') return;
-
-  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
-  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
-  registerSecureNow({ captureBody: true });
-  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    try {
+      const securenowNext = await import('securenow/nextjs');
+      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+      registerSecureNow({ captureBody: true });
+      await import('securenow/nextjs-auto-capture');
+    } catch (error) {
+      console.error('[securenow] SecureNow did not start; the app is running without it:', error);
+    }
+  }
 }
 ```
 
@@ -236,12 +242,16 @@ Add to your `instrumentation.ts`:
 
 ```typescript
 export async function register() {
-  if (process.env.NEXT_RUNTIME !== 'nodejs') return;
-
-  const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
-  const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
-  registerSecureNow({ captureBody: true });
-  await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    try {
+      const securenowNext = await import('securenow/nextjs');
+      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+      registerSecureNow({ captureBody: true });
+      await import('securenow/nextjs-auto-capture');
+    } catch (error) {
+      console.error('[securenow] SecureNow did not start; the app is running without it:', error);
+    }
+  }
 }
 ```
 
@@ -270,39 +280,33 @@ npx securenow app connect
 npx securenow init
 ```
 
-Auto-detects Next.js, creates `instrumentation.ts`, adds `serverExternalPackages: ['securenow']` plus `outputFileTracingIncludes` when safe, and reuses the app, instance, runtime API key, and secure defaults in `.securenow/runtime.json`. If files already exist, it prints an agent-ready prompt with the exact edits to propose.
+Auto-detects Next.js, creates `instrumentation.ts`, adds `serverExternalPackages: ['securenow']` plus `outputFileTracingIncludes` when safe, and reuses the app, instance, runtime API key, and secure defaults in `.securenow/runtime.json`. An instrumentation file it generated before 8.24.0 is replaced automatically (its `webpackIgnore` imports left SecureNow's dependencies out of standalone builds); for any other existing file it prints an agent-ready prompt with the exact edits to propose.
 
 ---
 
-### Nuxt 3
+### Nuxt 3 and 4
 
 **`nuxt.config.ts`:**
 
 ```typescript
 export default defineNuxtConfig({
   modules: ['securenow/nuxt'],
-  securenow: {
-    // optional overrides (defaults come from .securenow/runtime.json)
-  },
 });
 ```
 
-The Nuxt module auto-configures Nitro externals, runtime config, and a server plugin that sets up OTel tracing + logging + firewall. Local app identity, runtime API key, and secure defaults come from `.securenow/runtime.json`; production can use tokenless `.securenow/credentials.<env>.json`.
+The Nuxt module keeps `securenow` external (Nitro copies it with its dependencies into `.output/server/node_modules`) and adds a server plugin that loads the same runtime as `node -r securenow/register`: tracing with header/body capture, logging, crash capture, firewall, rate limits and challenges, plus `http.route` from the matched route and handler exceptions. Settings come from `.securenow/runtime.json` (production: tokenless `.securenow/credentials.<env>.json` or `SECURENOW_CREDENTIALS`); `securenow: { ... }` options in `nuxt.config` are no longer used. Before 8.24.0 this plugin crashed the `nuxt build` server at startup.
 
 ---
 
-### Vite / Browser
+### Vite
 
-```javascript
-import startSecurenowWeb from 'securenow/web-vite';
+Instrument the Node process that serves the app (`vite preview`, a Vite SSR server):
 
-startSecurenowWeb({
-  serviceName: 'my-frontend',
-  endpoint: 'https://ingest.securenow.ai',
-});
+```bash
+node -r securenow/register-vite node_modules/vite/bin/vite.js preview
 ```
 
-Instruments document load, fetch, XMLHttpRequest, and user interactions with browser-side OpenTelemetry.
+`securenow/register-vite` is the same runtime as `securenow/register`. Browser-side telemetry (`securenow/web-vite`) is not sent to SecureNow: browser ingestion is disabled since 8.0 until browser-safe auth exists.
 
 ---
 

package/SKILL-CLI.md

@@ -208,10 +208,28 @@ Auto-detects framework (Next.js, Nuxt, Express, Fastify, Koa, Hapi, Node) from `
 ### Dashboard & Status
 
 ```bash
+securenow today [--since 24h|7d] [--attackers 20] [--json]  # the Overview: what happened, what SecureNow did, what needs you
+securenow attacker <ip> [--json]             # why an address was flagged: verdict, signals, traffic vs normal, detections, timeline
 securenow status [--app <key>] [--env local|production|all] # dashboard overview
 securenow analytics [--app <key>]            # response analytics
 ```
 
+`today` is the dashboard's home in the terminal:
+- whether each app is covered (data flowing, firewall on, detection monitoring or blocking);
+- attack requests, attackers, what the firewall stopped and what got through;
+- the decisions waiting for you, the top attackers, and what SecureNow did (the agent's actions, automatic blocks,
+  closed probes).
+
+`attacker <ip>` explains one address:
+- the verdict and score with the signals behind them, and its reputation;
+- where it is blocked;
+- its last 3 days of traffic against your apps' normal (error rate, share of traffic, scanner probes, attack
+  payloads answered 2xx);
+- the detections it triggered and what happened to each, a timeline, and questions to paste into
+  `securenow forensics chat`.
+
+MCP: `securenow_overview` and `securenow_attacker` (read).
+
 ---
 
 ### Traces

package/app-config.js

@@ -8,14 +8,16 @@
  * Named runtime files such as ./.securenow/credentials.staging.json and
  * ./.securenow/credentials.production.json are also accepted when the
  * canonical file is not present. Filename selection is deterministic and does
- * not read environment variables.
+ * not depend on NODE_ENV.
  * Every SDK setting has a file-backed equivalent so customers do not need
- * .env files.
+ * .env files. Hosts that cannot mount a file (Vercel, Railway, Render, Heroku,
+ * Fly) pass the same JSON in one variable, SECURENOW_CREDENTIALS.
  */
 
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { readPm2Env } = require('./pm2-env');
 
 // Shared SecureNow Cloud ingestion gateway (production collector for every
 // paying account and for the 14-day trial).
@@ -240,7 +242,20 @@ function credentialRelativePaths() {
   return runtimeCredentialRelativePaths();
 }
 
-function resolveLocalFileFromRelativePaths(relativePaths) {
+// Where to look for .securenow/ files and package.json. A PM2 process is searched from the app
+// folder PM2 recorded and nowhere else: in cluster mode the worker's working directory is still
+// the PM2 daemon's when the preload runs, so searching from it found nothing, or another
+// project's credentials if the daemon was started inside that project.
+function searchStartDirs() {
+  const pm2 = readPm2Env();
+  if (pm2 && (pm2.cwd || pm2.execPath)) {
+    const appDir = pm2.cwd ? path.resolve(pm2.cwd) : null;
+    return uniq([
+      appDir,
+      pm2.execPath ? path.dirname(path.resolve(appDir || '.', pm2.execPath)) : null,
+    ]);
+  }
+
   const starts = [];
   try {
     if (typeof process !== 'undefined' && process.cwd) starts.push(process.cwd());
@@ -250,8 +265,12 @@ function resolveLocalFileFromRelativePaths(relativePaths) {
   if (process.argv && process.argv[1]) starts.push(path.dirname(process.argv[1]));
   if (require.main && require.main.filename) starts.push(path.dirname(require.main.filename));
 
+  return uniq(starts);
+}
+
+function resolveLocalFileFromRelativePaths(relativePaths) {
   const candidates = relativePaths;
-  for (const start of uniq(starts)) {
+  for (const start of searchStartDirs()) {
     const found = findUpFirstFile(start, candidates);
     if (found) return found;
   }
@@ -314,16 +333,7 @@ function runtimeCredentialsFromDocument(credentials) {
 }
 
 function resolvePackageJsonFile() {
-  const starts = [];
-  try {
-    if (typeof process !== 'undefined' && process.cwd) starts.push(process.cwd());
-  } catch {}
-
-  if (process.env.INIT_CWD) starts.push(process.env.INIT_CWD);
-  if (process.argv && process.argv[1]) starts.push(path.dirname(process.argv[1]));
-  if (require.main && require.main.filename) starts.push(path.dirname(require.main.filename));
-
-  for (const start of uniq(starts)) {
+  for (const start of searchStartDirs()) {
     const found = findUpFile(start, 'package.json');
     if (found) return found;
   }
@@ -347,7 +357,50 @@ function loadGlobalCredentials() {
   }
 }
 
+const ENV_CREDENTIALS_VAR = 'SECURENOW_CREDENTIALS';
+let _envCredentials = { raw: undefined, value: null };
+let _warnedBadEnvCredentials = false;
+
+// Runtime credentials passed in the environment, for hosts that cannot mount a file. The value is
+// the JSON written by `npx securenow credentials runtime`, raw or base64-encoded (`--format env`
+// prints it ready to paste). When set it takes precedence over credential files.
+function loadEnvCredentials() {
+  const raw = typeof process !== 'undefined' && process.env ? process.env[ENV_CREDENTIALS_VAR] : undefined;
+  if (raw !== _envCredentials.raw) {
+    let value = null;
+    const text = raw == null ? '' : String(raw).trim();
+    if (text) {
+      try {
+        const json = text.startsWith('{') ? text : Buffer.from(text, 'base64').toString('utf8');
+        value = withCredentialDefaults(runtimeCredentialsFromDocument(JSON.parse(json.replace(/^\uFEFF/, ''))));
+      } catch {
+        value = null;
+      }
+      if (!value && !_warnedBadEnvCredentials) {
+        _warnedBadEnvCredentials = true;
+        try {
+          console.warn('[securenow] %s is set but is not runtime credentials JSON (raw or base64); ignoring it.', ENV_CREDENTIALS_VAR);
+        } catch {}
+      }
+    }
+    _envCredentials = { raw, value };
+  }
+  return _envCredentials.value ? clone(_envCredentials.value) : null;
+}
+
+// Where the runtime credentials came from, for the startup log: never their content.
+function describeCredentialsSource() {
+  try {
+    if (loadEnvCredentials()) return `env:${ENV_CREDENTIALS_VAR}`;
+    return resolveLocalCredentialsFile() || resolveGlobalCredentialsFile() || 'none';
+  } catch {
+    return 'none';
+  }
+}
+
 function loadCredentials() {
+  const fromEnv = loadEnvCredentials();
+  if (fromEnv) return fromEnv;
   try {
     const localFile = resolveLocalCredentialsFile();
     if (localFile) {
@@ -781,6 +834,10 @@ module.exports = {
   resolveLocalAdminCredentialsFile,
   resolveGlobalAdminCredentialsFile,
   loadCredentials,
+  loadEnvCredentials,
+  describeCredentialsSource,
+  searchStartDirs,
+  ENV_CREDENTIALS_VAR,
   loadLocalCredentials,
   loadGlobalCredentials,
   loadPackageJsonName,

package/cli/credentials.js

@@ -73,6 +73,17 @@ async function runtime(_args, flags) {
     warn('Runtime API key is missing. Run `npx securenow app connect` or `npx securenow api-key create` before generating production runtime credentials.');
   }
 
+  // For hosts that inject environment variables but cannot mount a file (Vercel, Railway,
+  // Render, Heroku, Fly): one line to paste as a secret. The SDK reads SECURENOW_CREDENTIALS
+  // (raw JSON or base64) before any credentials file.
+  if (flags.format === 'env' || flags['env-var']) {
+    const { ENV_CREDENTIALS_VAR } = appConfig;
+    const encoded = Buffer.from(JSON.stringify(creds), 'utf8').toString('base64');
+    console.log(`${ENV_CREDENTIALS_VAR}=${encoded}`);
+    console.error(`! This line contains the runtime API key. Store it as a secret variable named ${ENV_CREDENTIALS_VAR}; do not commit it.`);
+    return;
+  }
+
   if (flags.stdout) {
     console.log(JSON.stringify(creds, null, 2));
     return;