securenow 8.23.0 → 8.25.0

package/cli/utils.js

@@ -89,24 +89,36 @@ function cidrParse(args, flags) {
   }
 
   const parsed = cidrLib.parseCidr(cidr);
-  if (!parsed) {
+  const parsed6 = parsed ? null : cidrLib.parseCidr6(cidr);
+  if (!parsed && !parsed6) {
     ui.error(`Invalid CIDR: ${cidr}`);
     process.exit(1);
   }
 
-  const intToIp = (n) => [
-    (n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff,
-  ].join('.');
-  const broadcast = (parsed.network | (~parsed.mask >>> 0)) >>> 0;
-  const size = (~parsed.mask >>> 0) + 1;
-
-  const out = {
-    cidr,
-    network: intToIp(parsed.network),
-    broadcast: intToIp(broadcast),
-    mask: intToIp(parsed.mask),
-    size,
-  };
+  let out;
+  if (parsed) {
+    const { intToIp } = cidrLib;
+    const broadcast = (parsed.network | (~parsed.mask >>> 0)) >>> 0;
+    const size = (~parsed.mask >>> 0) + 1;
+    out = {
+      cidr,
+      network: intToIp(parsed.network),
+      broadcast: intToIp(broadcast),
+      mask: intToIp(parsed.mask),
+      size,
+    };
+  } else {
+    // IPv6 has no broadcast address: "broadcast" is the last address of the range.
+    const hostBits = 128n - BigInt(parsed6.bits);
+    const last = parsed6.network | ((1n << hostBits) - 1n);
+    out = {
+      cidr,
+      network: cidrLib.bigIntToIpv6(parsed6.network),
+      broadcast: cidrLib.bigIntToIpv6(last),
+      mask: `/${parsed6.bits}`,
+      size: (1n << hostBits).toString(),
+    };
+  }
 
   if (flags.json) {
     ui.json(out);

package/cli.js

@@ -48,11 +48,13 @@ const COMMANDS = {
       environment: 'Alias for --env',
       key: 'Firewall API key to write to .securenow/runtime.json',
       'api-key': 'Alias for --key',
-      typescript: 'Force TypeScript',
-      javascript: 'Force JavaScript',
-      src: 'Create in src/',
-      root: 'Create in root',
-      force: 'Overwrite existing',
+      ts: 'Next.js: write instrumentation.ts (default: TypeScript when tsconfig.json exists)',
+      typescript: 'Alias for --ts',
+      js: 'Next.js: write instrumentation.js',
+      javascript: 'Alias for --js',
+      src: 'Next.js: write the instrumentation file in src/ (default when app/ or pages/ is in src/)',
+      root: 'Next.js: write the instrumentation file at the project root',
+      force: 'Next.js: replace an existing instrumentation file (the old one is kept as .bak)',
     },
     run: (a, f) => require('./cli/init').init(a, f),
   },
@@ -152,13 +154,14 @@ const COMMANDS = {
     sub: {
       runtime: {
         desc: 'Write tokenless runtime credentials for production file-based deploys',
-        usage: 'securenow credentials runtime [--env production] [--out .securenow/credentials.production.json] [--stdout]',
+        usage: 'securenow credentials runtime [--env production] [--out .securenow/credentials.production.json] [--stdout] [--format env]',
         flags: {
           env: 'Deployment environment for this runtime file (default: production)',
           environment: 'Alias for --env',
           out: 'Output path (default: .securenow/credentials.<env>.json)',
           output: 'Alias for --out',
           stdout: 'Print JSON to stdout instead of writing a file',
+          format: 'env: print SECURENOW_CREDENTIALS=<base64> for hosts without file mounts (Vercel, Railway, Render, Heroku, Fly)',
         },
         run: (a, f) => require('./cli/credentials').runtime(a, f),
       },

package/console-instrumentation.js

@@ -21,6 +21,12 @@
  *   console.error('An error occurred');
  */
 
+// SECURENOW_DISABLED=1: nothing to forward to, and no warnings about it.
+if (require('./sdk-disabled').sdkDisabled('console instrumentation')) {
+  module.exports = {};
+  return;
+}
+
 const tracing = require('./tracing');
 
 if (!tracing.isLoggingEnabled()) {

package/crash-capture.js

@@ -122,4 +122,16 @@ function installCrashCapture({ getLogger, flush, isSdkError, onSdkError, write }
   });
 }
 
-module.exports = { installCrashCapture, describeError, unhandledRejectionMode };
+// Force-flush the global tracer provider. A crash used to ship the FATAL log but drop every
+// span still waiting in the batch processor, which are usually the requests that led to it.
+function flushTracerProvider() {
+  try {
+    const { trace } = require('@opentelemetry/api');
+    const provider = trace.getTracerProvider();
+    const target = provider && typeof provider.getDelegate === 'function' ? provider.getDelegate() : provider;
+    if (target && typeof target.forceFlush === 'function') return Promise.resolve(target.forceFlush()).catch(() => {});
+  } catch (_) {}
+  return Promise.resolve();
+}
+
+module.exports = { installCrashCapture, describeError, unhandledRejectionMode, flushTracerProvider };

package/esm-detect.js

@@ -38,7 +38,11 @@ function nearestPackageJson(startDir) {
 
 /** @returns {{ esm: boolean, reason: string|null }} */
 function detectEsmApp({ argv = process.argv, cwd = process.cwd(), env = process.env } = {}) {
-  const entries = [argv && argv[1], env && env.pm_exec_path]
+  // A pm2 cluster worker only has pm2_env (JSON) at preload time, and its working directory is
+  // still the pm2 daemon's: take the app's folder and script from pm2 (see pm2-env.js).
+  const pm2 = require('./pm2-env').readPm2Env(env);
+  if (pm2 && pm2.cwd) cwd = pm2.cwd;
+  const entries = [argv && argv[1], pm2 && pm2.execPath]
     .filter((p) => typeof p === 'string' && p && !p.startsWith('-'))
     .map((p) => path.resolve(cwd, p));
 

package/fastify-hooks.js

@@ -0,0 +1,67 @@
+'use strict';
+
+/**
+ * Fastify route and error capture.
+ *
+ * The OpenTelemetry bundle dropped its Fastify instrumentation (moved to @fastify/otel), so a
+ * Fastify request span had no http.route and a failing handler left no exception event. Every
+ * Fastify instance (4.x and 5.x) is announced on the 'fastify.initialization' diagnostics
+ * channel; these hooks give it what the Express, Koa and Hapi instrumentations give theirs:
+ *  - http.route on the request's server span, and the "GET /users/:id" span name, through the
+ *    request's RPC metadata (the HTTP instrumentation reads it when the response finishes);
+ *  - the handler's error recorded as an exception event on that span.
+ */
+
+let installed = false;
+
+function routeOf(request) {
+  try {
+    return (request.routeOptions && request.routeOptions.url) || request.routerPath || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function onInstance(message) {
+  const fastify = message && message.fastify;
+  if (!fastify || typeof fastify.addHook !== 'function') return;
+  let api;
+  let core;
+  try {
+    api = require('@opentelemetry/api');
+    core = require('@opentelemetry/core');
+  } catch (_) {
+    return;
+  }
+
+  fastify.addHook('onRequest', function securenowRoute(request, reply, done) {
+    try {
+      const route = routeOf(request);
+      if (route) {
+        const meta = core.getRPCMetadata(api.context.active());
+        if (meta && meta.type === core.RPCType.HTTP) meta.route = route;
+        const span = api.trace.getActiveSpan();
+        if (span) span.setAttribute('http.route', route);
+      }
+    } catch (_) {}
+    done();
+  });
+
+  fastify.addHook('onError', function securenowError(request, reply, error, done) {
+    try {
+      const span = api.trace.getActiveSpan();
+      if (span && error) span.recordException(error);
+    } catch (_) {}
+    done();
+  });
+}
+
+function installFastifyHooks() {
+  if (installed) return;
+  installed = true;
+  try {
+    require('node:diagnostics_channel').subscribe('fastify.initialization', onInstance);
+  } catch (_) {}
+}
+
+module.exports = { installFastifyHooks, routeOf };

package/firewall-cloud.js

@@ -11,14 +11,44 @@
  */
 
 const https = require('https');
+const net = require('net');
 
 let _options = null;
 let _active = false;
 let _provider = null;
 let _lastPushTime = 0;
+let _gcpRuleCount = 0;
+const GCP_BASE_PRIORITY = 2000;
+const GCP_RANGES_PER_RULE = 10;
+const GCP_MAX_RULES = 100;
 
 const MIN_PUSH_INTERVAL_MS = 30000;
 
+// Blocklist entries as CIDRs, per address family: an exact address becomes /32 (IPv4) or /128 (IPv6).
+// (Appending "/32" to everything turned one IPv6 address into a /32 covering billions of addresses.)
+function toCidrs(ips) {
+  const v4 = [];
+  const v6 = [];
+  for (const raw of ips || []) {
+    const entry = String(raw || '').trim();
+    if (!entry) continue;
+    const slash = entry.indexOf('/');
+    const addr = slash === -1 ? entry : entry.slice(0, slash);
+    const family = net.isIP(addr);
+    if (family === 4) v4.push(slash === -1 ? `${addr}/32` : entry);
+    else if (family === 6) v6.push(slash === -1 ? `${addr}/128` : entry);
+  }
+  return { v4, v6 };
+}
+
+function prefixLength(cidr) {
+  return Number(String(cidr).split('/')[1]);
+}
+
+function logCloud(...args) {
+  if (_options && _options.log) console.log(...args);
+}
+
 // ────── Cloudflare ──────
 
 async function cloudflareSync(ips) {
@@ -40,7 +70,14 @@ async function cloudflareSync(ips) {
     list = created.result;
   }
 
-  const items = ips.map(ip => ({ ip: ip.includes('/') ? ip : ip + '/32' }));
+  // Cloudflare lists take IPv6 ranges of /64 or wider, not single IPv6 addresses: those stay blocked by
+  // layer 1 in the app.
+  const { v4, v6 } = toCidrs(ips);
+  const v6Ranges = v6.filter((c) => prefixLength(c) <= 64);
+  if (v6Ranges.length < v6.length) {
+    logCloud('[securenow] Firewall cloud: %d IPv6 entries narrower than /64 not pushed to Cloudflare (blocked in the app)', v6.length - v6Ranges.length);
+  }
+  const items = [...v4, ...v6Ranges].map((ip) => ({ ip }));
 
   await cfApi('PUT', `/accounts/${accountId}/rules/lists/${list.id}/items`, token, items);
 }
@@ -95,7 +132,12 @@ async function awsSync(ips) {
     Id: ipSetId,
   }));
 
-  const addresses = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
+  // An IP set holds one address family: push the entries of the set's family.
+  const { v4, v6 } = toCidrs(ips);
+  const ipv6Set = IPSet && IPSet.IPAddressVersion === 'IPV6';
+  const addresses = ipv6Set ? v6 : v4;
+  const other = ipv6Set ? v4.length : v6.length;
+  if (other) logCloud('[securenow] Firewall cloud: %d %s entries not pushed to this %s IP set (blocked in the app)', other, ipv6Set ? 'IPv4' : 'IPv6', ipv6Set ? 'IPv6' : 'IPv4');
 
   await client.send(new WAFV2.UpdateIPSetCommand({
     Name: ipSetName,
@@ -122,38 +164,45 @@ async function gcpSync(ips) {
   if (!project || !policyName) throw new Error('Missing GCP_PROJECT_ID or GCP_SECURITY_POLICY');
 
   const client = new compute.SecurityPoliciesClient();
-  const rulePriority = 2000;
-
-  const srcRanges = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
+  // A Cloud Armor rule matches at most 10 IP ranges, so the blocklist is spread over consecutive
+  // rules from priority 2000, and rules left over from a longer blocklist are removed. (One rule with
+  // every address was refused as soon as the blocklist passed 10 entries.)
+  const { v4, v6 } = toCidrs(ips);
+  const ranges = [...v4, ...v6].slice(0, GCP_MAX_RULES * GCP_RANGES_PER_RULE);
+  if (ranges.length < v4.length + v6.length) {
+    logCloud('[securenow] Firewall cloud: Cloud Armor gets the first %d blocklist entries (%d rules of %d); the rest are blocked in the app', ranges.length, GCP_MAX_RULES, GCP_RANGES_PER_RULE);
+  }
+  const chunks = [];
+  for (let i = 0; i < ranges.length; i += GCP_RANGES_PER_RULE) chunks.push(ranges.slice(i, i + GCP_RANGES_PER_RULE));
+
+  for (let i = 0; i < chunks.length; i++) {
+    const priority = GCP_BASE_PRIORITY + i;
+    const securityPolicyRuleResource = {
+      priority,
+      action: 'deny(403)',
+      match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: chunks[i] } },
+      description: 'Managed by SecureNow firewall SDK',
+    };
+    try {
+      await client.patchRule({ project, securityPolicy: policyName, priority: String(priority), securityPolicyRuleResource });
+    } catch (e) {
+      if (e.code === 404 || e.code === 5 || /not found|does not exist/i.test(e.message || '')) {
+        await client.addRule({ project, securityPolicy: policyName, securityPolicyRuleResource });
+      } else {
+        throw e;
+      }
+    }
+  }
 
-  try {
-    await client.patchRule({
-      project,
-      securityPolicy: policyName,
-      priority: String(rulePriority),
-      securityPolicyRuleResource: {
-        priority: rulePriority,
-        action: 'deny(403)',
-        match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
-        description: 'Managed by SecureNow firewall SDK',
-      },
-    });
-  } catch (e) {
-    if (e.code === 404 || e.message?.includes('not found')) {
-      await client.addRule({
-        project,
-        securityPolicy: policyName,
-        securityPolicyRuleResource: {
-          priority: rulePriority,
-          action: 'deny(403)',
-          match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
-          description: 'Managed by SecureNow firewall SDK',
-        },
-      });
-    } else {
-      throw e;
+  const previous = Math.max(_gcpRuleCount, 1);
+  for (let i = chunks.length; i < previous; i++) {
+    try {
+      await client.removeRule({ project, securityPolicy: policyName, priority: String(GCP_BASE_PRIORITY + i) });
+    } catch (e) {
+      if (!(e.code === 404 || e.code === 5 || /not found|does not exist/i.test(e.message || ''))) throw e;
     }
   }
+  _gcpRuleCount = chunks.length;
 }
 
 // ────── Provider dispatch ──────
@@ -209,4 +258,4 @@ function shutdown() {
   _active = false;
 }
 
-module.exports = { init, sync, shutdown };
+module.exports = { init, sync, shutdown, _test: { toCidrs, pushNow: (ips) => PROVIDERS[_provider](ips) } };

package/firewall-iptables.js

@@ -1,104 +1,162 @@
 'use strict';
 
 /**
- * Layer 3: OS-level firewall via iptables/nftables.
- * Manages a dedicated SECURENOW_BLOCK chain — never touches customer rules.
+ * Layer 3: OS-level firewall via iptables (IPv4), ip6tables (IPv6) or, where neither exists, nftables.
+ * Manages its own chain (SECURENOW_BLOCK), or with nft its own table: never touches customer rules.
  * Linux only, requires root or CAP_NET_ADMIN. Falls back gracefully otherwise.
+ *
+ * Blocklist entries arrive over the network, so each one must be a literal IP or CIDR before it reaches
+ * a firewall command, and the binaries run without a shell. (Entries used to be pasted into a shell
+ * command run as root, and one IPv6 entry stopped the rest of the sync.) A sync is one batch
+ * (iptables-restore / nft -f), not one process per address.
  */
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
+const net = require('net');
 const os = require('os');
 
 const CHAIN_NAME = 'SECURENOW_BLOCK';
+const NFT_TABLE = 'securenow';
 
 let _options = null;
 let _active = false;
-let _useNft = false;
+let _backend = null; // 'iptables' | 'nft'
+let _ip6 = false; // ip6tables available alongside iptables
 
-function exec(cmd) {
-  return execSync(cmd, { stdio: 'pipe', timeout: 10000 }).toString().trim();
+function run(cmd, args, input) {
+  return execFileSync(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 15000, input }).toString().trim();
 }
 
-function canRun(cmd) {
-  try { exec(cmd); return true; } catch { return false; }
+function canRun(cmd, args) {
+  try { run(cmd, args); return true; } catch { return false; }
+}
+
+function log(method, ...args) {
+  if (_options && _options.log) console[method](...args);
+}
+
+// A literal IPv4/IPv6 address or CIDR, or null.
+function parseEntry(raw) {
+  const entry = String(raw == null ? '' : raw).trim();
+  const slash = entry.indexOf('/');
+  const addr = slash === -1 ? entry : entry.slice(0, slash);
+  const family = net.isIP(addr);
+  if (!family) return null;
+  if (slash !== -1) {
+    const bits = entry.slice(slash + 1);
+    if (!/^\d{1,3}$/.test(bits) || Number(bits) > (family === 4 ? 32 : 128)) return null;
+  }
+  return { family, value: entry };
+}
+
+function splitFamilies(ips) {
+  const v4 = [];
+  const v6 = [];
+  let rejected = 0;
+  for (const raw of ips || []) {
+    const parsed = parseEntry(raw);
+    if (!parsed) { rejected++; continue; }
+    (parsed.family === 4 ? v4 : v6).push(parsed.value);
+  }
+  return { v4, v6, rejected };
 }
 
 function detectBackend() {
-  if (canRun('nft --version')) return 'nft';
-  if (canRun('iptables --version')) return 'iptables';
+  // iptables first: iptables-legacy and iptables-nft both accept it, while bare nft rules depend on
+  // tables the host may not have.
+  if (canRun('iptables', ['--version'])) return 'iptables';
+  if (canRun('nft', ['--version'])) return 'nft';
   return null;
 }
 
-// ────── iptables backend ──────
+// ────── iptables / ip6tables backend ──────
 
-function iptablesSetup() {
-  try { exec(`iptables -N ${CHAIN_NAME}`); } catch (_) {} // chain may already exist
-  try { exec(`iptables -C INPUT -j ${CHAIN_NAME}`); } catch (_) {
-    exec(`iptables -I INPUT 1 -j ${CHAIN_NAME}`);
+function iptablesSetup(bin) {
+  try { run(bin, ['-N', CHAIN_NAME]); } catch (_) {} // chain may already exist
+  try { run(bin, ['-C', 'INPUT', '-j', CHAIN_NAME]); } catch (_) {
+    run(bin, ['-I', 'INPUT', '1', '-j', CHAIN_NAME]);
   }
 }
 
-function iptablesSync(ips) {
-  exec(`iptables -F ${CHAIN_NAME}`);
-  for (const ip of ips) {
-    exec(`iptables -A ${CHAIN_NAME} -s ${ip} -j DROP`);
-  }
+// Input for iptables-restore --noflush: replaces the chain's rules in one step, leaves everything else.
+function restoreScript(entries) {
+  return [
+    '*filter',
+    `:${CHAIN_NAME} - [0:0]`,
+    `-F ${CHAIN_NAME}`,
+    ...entries.map((entry) => `-A ${CHAIN_NAME} -s ${entry} -j DROP`),
+    'COMMIT',
+    '',
+  ].join('\n');
 }
 
-function iptablesCleanup() {
-  try { exec(`iptables -D INPUT -j ${CHAIN_NAME}`); } catch (_) {}
-  try { exec(`iptables -F ${CHAIN_NAME}`); } catch (_) {}
-  try { exec(`iptables -X ${CHAIN_NAME}`); } catch (_) {}
+function iptablesSync(v4, v6) {
+  run('iptables-restore', ['--noflush'], restoreScript(v4));
+  if (_ip6) run('ip6tables-restore', ['--noflush'], restoreScript(v6));
 }
 
-// ────── nftables backend ──────
+function iptablesCleanup(bin) {
+  try { run(bin, ['-D', 'INPUT', '-j', CHAIN_NAME]); } catch (_) {}
+  try { run(bin, ['-F', CHAIN_NAME]); } catch (_) {}
+  try { run(bin, ['-X', CHAIN_NAME]); } catch (_) {}
+}
 
-function nftSetup() {
-  try { exec(`nft list chain ip filter ${CHAIN_NAME}`); } catch (_) {
-    exec(`nft add chain ip filter ${CHAIN_NAME}`);
-  }
-  try { exec(`nft insert rule ip filter INPUT jump ${CHAIN_NAME}`); } catch (_) {}
+// ────── nftables backend (own table, own input hook) ──────
+
+// One nft -f transaction: make sure the table exists, drop it, add it back with the current rules.
+function nftScript(v4, v6) {
+  return [
+    `table inet ${NFT_TABLE}`,
+    `delete table inet ${NFT_TABLE}`,
+    `table inet ${NFT_TABLE} {`,
+    '  chain input {',
+    '    type filter hook input priority -10; policy accept;',
+    ...v4.map((entry) => `    ip saddr ${entry} drop`),
+    ...v6.map((entry) => `    ip6 saddr ${entry} drop`),
+    '  }',
+    '}',
+    '',
+  ].join('\n');
 }
 
-function nftSync(ips) {
-  exec(`nft flush chain ip filter ${CHAIN_NAME}`);
-  for (const ip of ips) {
-    exec(`nft add rule ip filter ${CHAIN_NAME} ip saddr ${ip} drop`);
-  }
+function nftSync(v4, v6) {
+  run('nft', ['-f', '-'], nftScript(v4, v6));
 }
 
 function nftCleanup() {
-  try { exec(`nft flush chain ip filter ${CHAIN_NAME}`); } catch (_) {}
-  try { exec(`nft delete chain ip filter ${CHAIN_NAME}`); } catch (_) {}
+  try { run('nft', ['delete', 'table', 'inet', NFT_TABLE]); } catch (_) {}
 }
 
 // ────── Public API ──────
 
-let _syncCallback = null;
-
 function init(options) {
   _options = options;
 
   if (os.platform() !== 'linux') {
-    if (_options.log) console.warn('[securenow] Firewall iptables: only supported on Linux, skipping');
+    log('warn', '[securenow] Firewall iptables: only supported on Linux, skipping');
     return;
   }
 
-  const backend = detectBackend();
-  if (!backend) {
-    if (_options.log) console.warn('[securenow] Firewall iptables: neither iptables nor nft found, skipping');
+  _backend = detectBackend();
+  if (!_backend) {
+    log('warn', '[securenow] Firewall iptables: neither iptables nor nft found, skipping');
     return;
   }
 
-  _useNft = backend === 'nft';
-  const label = _useNft ? 'nftables' : 'iptables';
-
   try {
-    if (_useNft) nftSetup(); else iptablesSetup();
+    if (_backend === 'nft') {
+      nftSync([], []);
+    } else {
+      iptablesSetup('iptables');
+      if (canRun('ip6tables', ['--version'])) {
+        try { iptablesSetup('ip6tables'); _ip6 = true; } catch (_) { _ip6 = false; }
+      }
+    }
     _active = true;
-    if (_options.log) console.log('[securenow] Firewall iptables: %s chain %s ready', label, CHAIN_NAME);
+    log('log', '[securenow] Firewall iptables: %s %s ready%s', _backend === 'nft' ? 'nftables table' : 'iptables chain',
+      _backend === 'nft' ? NFT_TABLE : CHAIN_NAME, _backend === 'iptables' && !_ip6 ? ' (IPv4 only: no ip6tables)' : '');
   } catch (e) {
-    if (_options.log) console.warn('[securenow] Firewall iptables: setup failed (need root or CAP_NET_ADMIN):', e.message);
+    log('warn', '[securenow] Firewall iptables: setup failed (need root or CAP_NET_ADMIN):', e.message);
   }
 }
 
@@ -110,30 +168,33 @@ function sync(ips) {
   if (!_active) return;
 
   const maxRules = (_options && _options.iptablesMax) || 10000;
-  const limited = ips.length > maxRules ? ips.slice(0, maxRules) : ips;
-
-  if (ips.length > maxRules && _options.log) {
-    console.warn('[securenow] Firewall iptables: truncated to %d rules (max %d)', maxRules, maxRules);
-  }
+  const list = Array.isArray(ips) ? ips : [];
+  if (list.length > maxRules) log('warn', '[securenow] Firewall iptables: truncated to %d rules (max %d)', maxRules, maxRules);
+  const { v4, v6, rejected } = splitFamilies(list.slice(0, maxRules));
+  if (rejected) log('warn', '[securenow] Firewall iptables: ignored %d blocklist entries that are not IPs or CIDRs', rejected);
 
   try {
-    if (_useNft) nftSync(limited); else iptablesSync(limited);
+    if (_backend === 'nft') nftSync(v4, v6);
+    else iptablesSync(v4, v6);
   } catch (e) {
-    if (_options && _options.log) {
-      console.warn('[securenow] Firewall iptables: sync failed:', e.message);
-    }
+    log('warn', '[securenow] Firewall iptables: sync failed:', e.message);
   }
 }
 
 function shutdown() {
   if (!_active) return;
   try {
-    if (_useNft) nftCleanup(); else iptablesCleanup();
-    if (_options && _options.log) console.log('[securenow] Firewall iptables: chain %s cleaned up', CHAIN_NAME);
+    if (_backend === 'nft') {
+      nftCleanup();
+    } else {
+      iptablesCleanup('iptables');
+      if (_ip6) iptablesCleanup('ip6tables');
+    }
+    log('log', '[securenow] Firewall iptables: %s cleaned up', _backend === 'nft' ? `table ${NFT_TABLE}` : `chain ${CHAIN_NAME}`);
   } catch (e) {
-    if (_options && _options.log) console.warn('[securenow] Firewall iptables: cleanup failed:', e.message);
+    log('warn', '[securenow] Firewall iptables: cleanup failed:', e.message);
   }
   _active = false;
 }
 
-module.exports = { init, sync, shutdown };
+module.exports = { init, sync, shutdown, _test: { parseEntry, splitFamilies, restoreScript, nftScript } };

package/firewall-only.js

@@ -41,6 +41,8 @@ if (firewallOptions.apiKey) {
     aws: firewallOptions.aws,
     gcp: firewallOptions.gcp,
   });
+  // Zero-code session revocation / session-theft capture (config.sessions.guard / .capture).
+  require('./sessions').installHttpGuard(appConfig.resolveSessionsOptions());
 
   const shutdown = () => { try { require('./firewall').shutdown(); } catch (_) {} };
   process.on('SIGINT', shutdown);