securenow 8.25.1 → 8.26.0

package/NPM_README.md

@@ -1472,7 +1472,7 @@ The firewall supports four layers -- Layer 1 is always on, the rest are opt-in:
 | **Layer 1: HTTP** | *(always on)* | Returns 403 (`config.firewall.statusCode`): JSON `{"error":"Forbidden","ip":"..."}` for API clients, a security alert page for browsers. Works with proxy headers. |
 | **Layer 2: TCP** | `config.firewall.tcp=true` | `socket.destroy()` before HTTP parsing -- zero bytes sent back. Sees only the connection's source IP; connections from trusted proxies are left to Layer 1. Checked on each server `connection` **(8.25.0+)**; before, it hooked `listen()` and missed the servers most apps start before the SDK has finished starting |
 | **Layer 3: iptables** | `config.firewall.iptables=true` | Kernel-level DROP in a dedicated `SECURENOW_BLOCK` chain (ip6tables for IPv6), or a `securenow` nft table where iptables is missing **(8.25.0+)**. Linux, root or `CAP_NET_ADMIN`; direct client connections only. 8.25.0 validates every entry, runs without a shell and applies each sync as one batch |
-| **Layer 4: Cloud WAF** | `config.firewall.cloud="cloudflare"` / `"aws"` / `"gcp"` | Pushes the global blocklist to Cloudflare (an account IP list named `securenow-blocklist` that your own WAF rule must reference), AWS WAFv2 (IP set; `npm i @aws-sdk/client-wafv2`) or GCP Cloud Armor (`deny(403)` rules at priority 2000; `npm i @google-cloud/compute`), at most every 30 seconds. `config.firewall.cloudDryRun=true` only logs. 8.25.0 fixes IPv6 ranges, Cloud Armor's 10-range limit and stale rules. Request format tested, not run against real accounts |
+| **Layer 4: Cloud WAF** | `config.firewall.cloud="cloudflare"` / `"aws"` / `"gcp"` | Pushes the global blocklist to Cloudflare (an account IP list named `securenow-blocklist` that your own WAF rule must reference), AWS WAFv2 (IP set; `npm i @aws-sdk/client-wafv2`) or GCP Cloud Armor (`deny(403)` rules at priority 2000; `npm i @google-cloud/compute`), at most every 30 seconds. `config.firewall.cloudDryRun=true` only logs. 8.25.0 fixes IPv6 ranges, Cloud Armor's 10-range limit and stale rules. AWS tested against real IP sets (8.25.2+); Cloudflare and GCP request format tested only |
 
 Layers 2 to 4 carry the global blocklist; scoped blocks, rate limits and challenges are Layer 1 only. Turn Layers 2 to 4 on with 8.25.0+. In a container, Layer 3 needs `--cap-add NET_ADMIN` and the `iptables` package.
 
@@ -1784,6 +1784,24 @@ app.post('/api/login', async (req, res) => {
 
 `track(type, { userId, sessionId, ip, userAgent, severity, ts, attributes })` is fire-and-forget: it buffers up to 1000 events, sends batches of up to 100 every 2 seconds, and never throws. `flush()` returns a promise for scripts that exit right away. It works in any Node process that can resolve the runtime credentials, with or without the preload.
 
+Inside a request SecureNow is handling, `ip` and `userAgent` fill themselves when you leave them out (8.26.0+): the address is resolved with the firewall's trusted-proxy rules, so a client can't choose it with `X-Forwarded-For`. That's how a Next.js route handler, which only gets a Web `Request`, reports who connected:
+
+```ts
+// app/api/login/route.ts (Node.js runtime)
+import { track } from 'securenow/events';
+
+export async function POST(request: Request) {
+  const { email, password } = await request.json();
+  const user = await findUserByEmail(email);
+  if (!user || !(await verifyPassword(user, password))) {
+    track('auth.login.failure', { userId: user?.id, severity: 'warn', attributes: { reason: 'bad_password' } });
+    return Response.json({ error: 'Invalid email or password' }, { status: 401 });
+  }
+  track('auth.login.success', { userId: user.id });
+  // ...create the session
+}
+```
+
 Recommended auth events: `auth.login.failure`, `auth.login.success`, `auth.otp.send.requested`, `auth.otp.send.result`, `auth.otp.verify.failure`, `auth.otp.verify.success`, `auth.password_reset.requested`, `auth.password_reset.completed`, `auth.mfa.challenge.failure`, `auth.mfa.challenge.success`, `auth.session.revoked`.
 
 Check what arrives with `npx securenow telemetry fields --since 1h --json` (it lists custom event types). From a shell or a non-JS service: `npx securenow event send <type> --user <id> --ip <ip> --attrs k=v`.

package/SKILL-API.md

@@ -2,7 +2,7 @@
 
 > **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
 
-The integration playbook for the `securenow` npm package. A coding agent that reads only this file can plug SecureNow into a Node.js app, turn on every feature, deploy it and prove it works. It describes 8.25.1; items marked **(8.25.0+)** are new in 8.25.0, so an older install needs `npm install securenow@latest` for them (check with `npx securenow version`). The terminal reference is [SKILL-CLI.md](./SKILL-CLI.md). Both files ship in `node_modules/securenow/`.
+The integration playbook for the `securenow` npm package. A coding agent that reads only this file can plug SecureNow into a Node.js app, turn on every feature, deploy it and prove it works. It describes 8.26.0; items marked **(8.25.0+)** or **(8.26.0+)** are new in that version, so an older install needs `npm install securenow@latest` for them (check with `npx securenow version`). The terminal reference is [SKILL-CLI.md](./SKILL-CLI.md). Both files ship in `node_modules/securenow/`.
 
 ## Rules for the agent
 
@@ -332,7 +332,7 @@ So a `runtime.json` left on a server beats the `credentials.production.json` nex
 
 - **What:** one server span per request with method, route (`http.route` where section 3 says so), status code, client IP (`http.client_ip`, `http.client_ip.source`, `http.socket_ip`, `http.proxy.trusted`), redacted headers and body, plus child spans for outgoing HTTP and databases (Postgres, MySQL, MongoDB, Redis...). `service.name` is the app key; `deployment.environment` comes from the config.
 - **On:** automatic once wired. To skip one instrumentation, list its package name in `config.otel.disableInstrumentations`.
-- **Verify:** `npx securenow test-span` prints `Span accepted (HTTP 200)`. Send one request to the app, then `npx securenow traces --env <env> --limit 5` and `npx securenow traces show <traceId> --env <env>`.
+- **Verify:** `npx securenow test-span` prints `Span accepted (HTTP 200)`. Send one request to the app, then `npx securenow traces --env <env> --limit 5` and `npx securenow traces show <traceId> --env <env>` (it starts with the request: route, status, client IP, user agent and the redacted body **(8.26.0+)**). In a project signed in with `securenow login`, these commands use the project's app without `--app` **(8.26.0+)**.
 
 ### 5.2 Logs
 
@@ -384,7 +384,7 @@ So a `runtime.json` left on a server beats the `credentials.production.json` nex
   | 1 HTTP | always, once the runtime API key is present | 403 JSON `{"error":"Forbidden","ip":"..."}`, or an HTML page with the masked IP for browsers; status from `firewall.statusCode` | Works behind proxies (forwarding headers) |
   | 2 TCP | `"tcp": true` | Destroys the socket before HTTP parsing, zero bytes sent | Sees only the connection's source IP; connections from trusted proxies are left to layer 1. Use 8.25.0+: before, it hooked `listen()` and missed the servers most apps start before the SDK has finished starting |
   | 3 OS | `"iptables": true` | Kernel DROP: a `SECURENOW_BLOCK` chain in iptables (ip6tables for IPv6), or a `securenow` nft table where iptables is missing **(8.25.0+)** | Linux, root or `CAP_NET_ADMIN`, `iptables`/`nft` installed; direct client connections only. Use 8.25.0+: it validates every entry, runs without a shell and applies each sync as one batch, and an IPv6 entry no longer stops the sync |
-  | 4 Cloud WAF | `"cloud": "cloudflare"`, `"aws"` or `"gcp"` | Pushes the global blocklist to the edge, at most every 30 s | Cloudflare: fills an account IP list `securenow-blocklist` that your own WAF rule must reference. AWS: WAFv2 IP set. GCP: Cloud Armor rules at priority 2000, `deny(403)`. Use 8.25.0+ (IPv6 ranges, Cloud Armor's 10-range limit, stale rules fixed). Request format tested, not run against real accounts |
+  | 4 Cloud WAF | `"cloud": "cloudflare"`, `"aws"` or `"gcp"` | Pushes the global blocklist to the edge, at most every 30 s | Cloudflare: fills an account IP list `securenow-blocklist` that your own WAF rule must reference. AWS: WAFv2 IP set. GCP: Cloud Armor rules at priority 2000, `deny(403)`. Use 8.25.2+ (IPv6 ranges, Cloud Armor's 10-range limit, stale rules, IPv4-mapped entries fixed). AWS tested against real IP sets; Cloudflare and GCP request format tested only |
 
   Layers 2 to 4 carry the global blocklist. Scoped blocks, rate limits and challenges are layer 1 only.
 - **On:** automatic with the runtime API key. Each app and environment also has a remote switch, `npx securenow firewall enable|disable --app <key> --env production`, applied without a deploy. `config.firewall.enabled` is ignored.
@@ -483,6 +483,24 @@ So a `runtime.json` left on a server beats the `credentials.production.json` nex
   ```
 
   If you also send `sessionId` and want it to match revocations made through the session guard, send what the guard computes, `require('securenow/sessions').sha256(<session cookie value exactly as sent>)`, or give the guard your own `getSessionId` (section 5.10).
+
+- **Inside a request, `ip` and `userAgent` fill themselves (8.26.0+).** When `track()` runs while SecureNow is handling a request and you leave `ip` or `userAgent` out, they come from that request: the address resolved with the firewall's trusted-proxy rules (a client can't choose it with `X-Forwarded-For`) and its `User-Agent`. This is how to report events from a Next.js route handler, which only gets a Web `Request` and can't tell who connected. Values you pass win. Outside a request (a script, a queue worker) nothing is added. `require('securenow/resolve-ip').currentClientIp()` returns the same address for your own code (`''` outside a request). It needs the runtime API key (the firewall's request hook carries the request).
+
+  ```ts
+  // Next.js route handler (Node.js runtime), app/api/login/route.ts
+  import { track } from 'securenow/events';
+
+  export async function POST(request: Request) {
+    const { email, password } = await request.json();
+    const user = await findUserByEmail(email);
+    if (!user || !(await verifyPassword(user, password))) {
+      track('auth.login.failure', { userId: user?.id, severity: 'warn', attributes: { reason: user ? 'bad_password' : 'unknown_user' } });
+      return Response.json({ error: 'Invalid email or password' }, { status: 401 });
+    }
+    track('auth.login.success', { userId: user.id, attributes: { method: 'password' } });
+    // ...create the session
+  }
+  ```
 - **Verify:** `npx securenow telemetry fields --since 1h --json` lists the custom event types observed for the app. From a shell or a non-JS service: `npx securenow event send auth.login.failure --user u_test --ip 203.0.113.10 --attrs reason=test` (add `--env local` to tag it local).
 
 ### 5.10 Session revocation
@@ -519,7 +537,7 @@ Pick one way to enforce:
 
    A revoked request gets 401 with the session cookies cleared: JSON `{"error":"Session revoked. Please sign in again.","code":"session_revoked"}` where `res.json` exists (Express), plain `Session revoked` otherwise. Options: `getSessionId(req)`, `getUserId(req)`, `onRevoked(req, res, next, { sessionId, userId })`, `capture` (default `true`: also sends `session.seen`), `captureWindowMs` (default 300000), `syncIntervalMs` (default 30000). In NestJS, call `app.use(sessions.guard())` in `main.ts`.
 
-3. **Anything else: `check()` (8.25.0+).** `sessions.check(req, options?)` takes a Node request or a Web `Request` and returns `{ revoked, sessionId, userId }`; you answer 401 yourself. Options: `getSessionId`, `getUserId`, `capture` (default `true`), `ip` (for `session.seen` when `req` is a Web `Request`, which has no socket).
+3. **Anything else: `check()` (8.25.0+).** `sessions.check(req, options?)` takes a Node request or a Web `Request` and returns `{ revoked, sessionId, userId }`; you answer 401 yourself. Options: `getSessionId`, `getUserId`, `capture` (default `true`), `ip` (for `session.seen`; with a Web `Request`, which has no socket, it defaults to the address of the request SecureNow is handling **(8.26.0+)**).
 
    ```js
    const sessions = require('securenow/sessions');
@@ -771,7 +789,7 @@ Next.js on Vercel goes through `@vercel/otel` (an optional dependency); set `SEC
 | Config | `npx securenow env` | `Service name` = the app key UUID, the expected `Environment`, `Firewall enabled` (not `missing firewall API key`) |
 | Connectivity | `npx securenow doctor` | `All checks passed.` (traces, logs, API, firewall sync) |
 | Ingest | `npx securenow test-span` | `Span accepted (HTTP 200)` |
-| App start | start the app | `[securenow] pid=... appId="<app-uuid>" instance=... apiKey=set credentials=<path or env:SECURENOW_CREDENTIALS> → service.name=<app-uuid> ...` (`apiKey=missing`: no runtime API key, so the gateway rejects telemetry and firewall sync; before 8.25.0 the field showed whether the app key was set), `OTel SDK started → https://ingest.securenow.ai/v1/traces`, `Logging: ENABLED`, `Request body capture: ENABLED (max: 10240 bytes, redacting 68 sensitive fields)`, `Firewall: ENABLED`, `Firewall: environment=<env>`, `Firewall: synced <n> global blocked IPs (...) and <n> scoped block rules`. ESM apps first print `ESM loader hook auto-registered (module.register)`. Next.js prints `Next.js App -> service.name=<app-uuid> apiKey=set credentials=<...>` (the `apiKey` and `credentials` fields 8.25.0+), `Environment: <env>`, `OpenTelemetry started for Next.js -> ...` and the same Firewall lines |
+| App start | start the app | `[securenow] pid=... appId="<app-uuid>" instance=... apiKey=set credentials=<path or env:SECURENOW_CREDENTIALS> → service.name=<app-uuid> ...` (`apiKey=missing`: no runtime API key, so the gateway rejects telemetry and firewall sync; before 8.25.0 the field showed whether the app key was set), `OTel SDK started → https://ingest.securenow.ai/v1/traces`, `Logging: ENABLED`, `Request body capture: ENABLED (max: 10240 bytes, redacting 68 sensitive fields)`, `Firewall: ENABLED`, `Firewall: environment=<env>`, `Firewall: synced <n> global blocked IPs (...) and <n> scoped block rules`. ESM apps first print `ESM loader hook auto-registered (module.register)`. Next.js prints `Next.js App -> service.name=<app-uuid> apiKey=set credentials=<...>` (the `apiKey` and `credentials` fields 8.25.0+), `Environment: <env>`, `OpenTelemetry started for Next.js -> ...`, `Request body capture: ENABLED (...)` **(8.26.0+)** and the same Firewall lines |
 | Traffic | one real request, then `npx securenow traces --env <env> --limit 5` | The request, with `http.client_ip` and (where supported) `http.route` |
 | Overview | `npx securenow status --env <env>` and `npx securenow today` | The app covered: data flowing, firewall on, detection monitoring |
 | Firewall | `npx securenow firewall status --env <env>`, `npx securenow firewall test-ip 203.0.113.7 --env <env>` | Firewall on for the app and environment; the verdict for the IP |
@@ -806,7 +824,7 @@ Bad signs: no `[securenow]` line at all (the preload is not on the command that
 
 **Not supported:** Edge runtimes (Cloudflare Workers, Vercel Edge, Next.js Edge middleware and routes), Deno, `Bun.serve`, browser telemetry.
 **Not tested:** Vercel (firewall unverified on its serverless functions), AWS Lambda and other serverless platforms.
-**Layers 2 to 4:** turn them on with 8.25.0+ only (in 8.24.0 layer 2 dropped nothing for most apps and layers 3 and 4 mishandled IPv6). **Cloud WAF (layer 4):** request format tested, not run against real Cloudflare, AWS or GCP accounts; on Cloudflare your own WAF rule must reference the `securenow-blocklist` list.
+**Layers 2 to 4:** turn them on with 8.25.0+ only (in 8.24.0 layer 2 dropped nothing for most apps and layers 3 and 4 mishandled IPv6). **Cloud WAF (layer 4):** AWS WAF is tested against real IP sets (IPv4 and IPv6, emptied list) from 8.25.2; Cloudflare and GCP are tested on the request format only, not against real accounts. On Cloudflare your own WAF rule must reference the `securenow-blocklist` list.
 **IPv6:** the blocklist, allowlist, trusted IPs, rate limits, challenges and API-key IP limits take IPv6 addresses and CIDR ranges, stored in canonical form (`2001:DB8::1` = `2001:db8::1`); layer 1 and trusted proxies match them **(8.25.0+; older SDKs match exact IPv6 addresses but ignore IPv6 ranges)**. A trusted-IP range can be no wider than /8 (IPv4) or /32 (IPv6).
 **`nuxt dev`:** before 8.25.0 the client IP was unknown, so IP blocking only applied to the built server.
 **Log redaction (8.25.0+)** goes by field names and value shapes: a secret in free text with no recognizable shape is exported as written.
@@ -824,7 +842,7 @@ Bad signs: no `[securenow]` line at all (the preload is not on the command that
 | `securenow/events` | `track(type, props)`, `flush()` |
 | `securenow/sessions` | `guard()`, `capture()`, `isRevoked()`, `start()`, `sha256()`; `check()` **(8.25.0+)** |
 | `securenow/tracing` | `getLogger(name, version)`, `isLoggingEnabled()` |
-| `securenow/resolve-ip` | `resolveClientIp(req)`, `resolveClientIpWithDetails(req)`, `resolveSocketIp(socket)`, `isFromTrustedProxy(ip)` |
+| `securenow/resolve-ip` | `resolveClientIp(req)`, `resolveClientIpWithDetails(req)`, `resolveSocketIp(socket)`, `isFromTrustedProxy(ip)`, `currentClientIp()` **(8.26.0+)** |
 | `securenow/cidr` | `createMatcher(list)` returns `{ isBlocked(ip), stats() }` for IPv4 and IPv6 addresses and ranges (IPv6 ranges 8.25.0+); `parseCidr`, `parseCidr6`, `parseIp`, `ipToInt`, `matchesCidr` |
 | `securenow/firewall` | `getStats()`, `getMatcher()`, `getAllowlistMatcher()`, `init()`/`shutdown()` for custom setups |
 | `securenow/rate-limits` | API helpers: `parseRateLimitText()`, `createRateLimitFromText()`, `createRateLimit()`, `listRateLimits()` (use the CLI or MCP for one-off rules) |

package/cli/challenges.js

@@ -5,7 +5,7 @@ const config = require('./config');
 const ui = require('./ui');
 
 function resolveApp(flags) {
-  return flags.app || config.getDefaultApp();
+  return flags.app || config.getDefaultAppKey();
 }
 
 function resolveEnvironment(flags, fallback = null) {

package/cli/config.js

@@ -419,6 +419,23 @@ function getDefaultApp() {
   return loadConfig().defaultApp;
 }
 
+// The app a command acts on when no --app is given: the CLI default (`securenow apps default`), else the app this
+// project's SDK reports to (.securenow/runtime.json after `securenow login`), so `traces`, `logs` and the rest work
+// in a freshly signed-in project the way `firewall` and `protect` already did.
+function getDefaultAppKey() {
+  const fromConfig = loadConfig().defaultApp;
+  if (fromConfig) return fromConfig;
+  try {
+    const app = getApp();
+    if (app && app.key) return String(app.key);
+  } catch (_) {}
+  try {
+    return require('../app-config').resolveAppKey() || null;
+  } catch (_) {
+    return null;
+  }
+}
+
 module.exports = {
   CONFIG_DIR,
   CONFIG_FILE,
@@ -459,4 +476,5 @@ module.exports = {
   getApiUrl,
   getAppUrl,
   getDefaultApp,
+  getDefaultAppKey,
 };

package/cli/diagnostics.js

@@ -492,8 +492,10 @@ async function doctor(_args, flags) {
   if (!cfg.appKey) {
     warnings.push('No app key resolved. Run `npx securenow app connect` or set app.key in .securenow/runtime.json.');
   }
+  // The default and recommended path: an info line, not a warning (it read like a problem on every healthy setup).
+  const notes = [];
   if (cfg.instance === 'https://ingest.securenow.ai') {
-    warnings.push('Using the SecureNow ingest gateway. Dedicated instances are routed server-side after policy checks.');
+    notes.push('Telemetry goes through the SecureNow ingest gateway (the default; dedicated instances are routed server-side).');
   } else if (cfg.instance === 'https://api.securenow.ai/api/otlp') {
     warnings.push('Using the legacy SecureNow telemetry gateway path. Regenerate credentials so telemetry uses https://ingest.securenow.ai.');
   } else if (cfg.instance === 'https://freetrial.securenow.ai:4318') {
@@ -508,7 +510,7 @@ async function doctor(_args, flags) {
   const ok = checks.every((c) => c.ok);
 
   if (flags.json) {
-    ui.json({ ok, resolved: redactConfig(cfg), checks, warnings });
+    ui.json({ ok, resolved: redactConfig(cfg), checks, warnings, notes });
     process.exit(ok ? 0 : 1);
   }
 
@@ -517,6 +519,7 @@ async function doctor(_args, flags) {
     for (const w of warnings) ui.warn(w);
   }
 
+  for (const n of notes) ui.info(n);
   if (singletonOkMessage) ui.success(singletonOkMessage);
 
   console.log('');

package/cli/init.js

@@ -121,8 +121,14 @@ async function init(_args, flags) {
 
   console.log('');
   ui.success('Setup complete.');
-  ui.info('Run `npx securenow app connect` if this project is not linked to an app yet.');
-  ui.info('Then verify with `npx securenow test-span` and `npx securenow status`.');
+  let linked = null;
+  try { linked = config.getApp(); } catch (_) {}
+  if (linked && linked.key) {
+    ui.info(`Linked to app ${ui.bold(linked.name || linked.key)}. Verify with \`npx securenow doctor\` and \`npx securenow test-span\`.`);
+  } else {
+    ui.info('This project is not linked to an app yet: run `npx securenow login` (or `npx securenow app connect`).');
+    ui.info('Then verify with `npx securenow test-span` and `npx securenow status`.');
+  }
 }
 
 function initCredentials(flags) {
@@ -237,6 +243,15 @@ const nextConfig = {
 export default nextConfig;
 `;
 
+// Where the config object opens. The TypeScript template create-next-app writes for Next.js 15 and 16 annotates it,
+// `const nextConfig: NextConfig = {`: before 8.26.0 only the untyped form matched, so init asked for a manual edit
+// on nearly every new TypeScript app.
+const CONFIG_OBJECT_PATTERNS = [
+  /(const\s+nextConfig\s*(?::\s*[\w$.<>[\]| ]+?)?\s*=\s*{\s*\r?\n)/,
+  /(export\s+default\s+{\s*\r?\n)/,
+  /(module\.exports\s*=\s*{\s*\r?\n)/,
+];
+
 function patchNextConfig(configPath, major) {
   const content = fs.readFileSync(configPath, 'utf8');
   const serverExternalWithSecureNow = /serverExternalPackages\s*:\s*\[[\s\S]*?['"]securenow['"][\s\S]*?\]/m.test(content);
@@ -248,15 +263,15 @@ function patchNextConfig(configPath, major) {
 
   if (major < 15) return 'manual';
 
+  // Write in the file's own quote style (create-next-app's TypeScript template uses double quotes).
+  const doubles = (content.match(/"/g) || []).length;
+  const singles = (content.match(/'/g) || []).length;
+  const Q = doubles > singles ? '"' : "'";
+
   function addTraceInclude(nextContent) {
     if (traceIncludeWithSecureNow || /outputFileTracingIncludes\s*:/.test(nextContent)) return nextContent;
-    const insert = `  outputFileTracingIncludes: {\n    '/*': ['./node_modules/securenow/**/*'],\n  },\n`;
-    const patterns = [
-      /(const\s+nextConfig\s*=\s*{\s*\r?\n)/,
-      /(export\s+default\s+{\s*\r?\n)/,
-      /(module\.exports\s*=\s*{\s*\r?\n)/,
-    ];
-    for (const pattern of patterns) {
+    const insert = `  outputFileTracingIncludes: {\n    ${Q}/*${Q}: [${Q}./node_modules/securenow/**/*${Q}],\n  },\n`;
+    for (const pattern of CONFIG_OBJECT_PATTERNS) {
       if (pattern.test(nextContent)) return nextContent.replace(pattern, `$1${insert}`);
     }
     return null;
@@ -274,21 +289,15 @@ function patchNextConfig(configPath, major) {
   const existingServerExternal = content.match(/serverExternalPackages\s*:\s*\[([\s\S]*?)\]/m);
   if (existingServerExternal) {
     const current = existingServerExternal[1].trim().replace(/,\s*$/, '');
-    const replacement = `serverExternalPackages: [${current ? `${current}, ` : ''}'securenow']`;
+    const replacement = `serverExternalPackages: [${current ? `${current}, ` : ''}${Q}securenow${Q}]`;
     let nextContent = content.replace(existingServerExternal[0], replacement);
     nextContent = addTraceInclude(nextContent) || nextContent;
     fs.writeFileSync(configPath, nextContent, 'utf8');
     return 'patched';
   }
 
-  const insert = `  serverExternalPackages: ['securenow'],\n  outputFileTracingIncludes: {\n    '/*': ['./node_modules/securenow/**/*'],\n  },\n`;
-  const patterns = [
-    /(const\s+nextConfig\s*=\s*{\s*\r?\n)/,
-    /(export\s+default\s+{\s*\r?\n)/,
-    /(module\.exports\s*=\s*{\s*\r?\n)/,
-  ];
-
-  for (const pattern of patterns) {
+  const insert = `  serverExternalPackages: [${Q}securenow${Q}],\n  outputFileTracingIncludes: {\n    ${Q}/*${Q}: [${Q}./node_modules/securenow/**/*${Q}],\n  },\n`;
+  for (const pattern of CONFIG_OBJECT_PATTERNS) {
     if (pattern.test(content)) {
       fs.writeFileSync(configPath, content.replace(pattern, `$1${insert}`), 'utf8');
       return 'patched';

package/cli/monitor.js

@@ -6,7 +6,7 @@ const ui = require('./ui');
 const appConfig = require('../app-config');
 
 function resolveApp(flags) {
-  return flags.app || config.getDefaultApp();
+  return flags.app || config.getDefaultAppKey();
 }
 
 function resolveEnvironment(flags) {
@@ -21,6 +21,57 @@ function addEnvironment(query, flags) {
 
 // ── Traces ──
 
+// Spans come back as stored (snake_case columns with attribute maps) or, from older APIs, camelCase.
+function spanField(span, ...names) {
+  for (const n of names) if (span && span[n] != null && span[n] !== '') return span[n];
+  return null;
+}
+function spanAttrs(span) {
+  return Object.assign({}, span.attributes_number || {}, span.attributes_bool || {}, span.attributes_string || {}, span.attributes || {});
+}
+function spanStatus(span) {
+  const a = spanAttrs(span);
+  const code = spanField(span, 'response_status_code', 'responseStatusCode', 'statusCode', 'httpStatusCode') || a['http.status_code'] || a['http.response.status_code'];
+  const n = parseInt(code, 10);
+  return n >= 100 ? n : null;
+}
+function spanDurationMs(span) {
+  const nano = spanField(span, 'duration_nano', 'durationNano');
+  if (nano != null) return Number(nano) / 1e6;
+  return spanField(span, 'duration');
+}
+function spanKind(span) {
+  const s = spanField(span, 'kind_string');
+  if (s) return String(s).replace(/^SPAN_KIND_/, '').toLowerCase();
+  return { 1: 'internal', 2: 'server', 3: 'client', 4: 'producer', 5: 'consumer' }[spanField(span, 'kind')] || '—';
+}
+function requestSpan(spans) {
+  const withBody = spans.find((s) => spanAttrs(s)['http.request.body'] != null);
+  if (withBody) return withBody;
+  const withIp = spans.find((s) => spanAttrs(s)['http.client_ip']);
+  if (withIp) return withIp;
+  return spans.find((s) => !spanField(s, 'parent_span_id', 'parentSpanID', 'parentSpanId')) || null;
+}
+function headerValue(headersJson, name) {
+  try { return JSON.parse(headersJson)[name] || null; } catch (_) { return null; }
+}
+
+// One row per trace: when a trace has several server spans (Next.js wraps the HTTP span in its own), keep the
+// longest one, which is the whole request as the client saw it. Order is kept.
+function onePerTrace(spans) {
+  const best = new Map();
+  const order = [];
+  for (const t of spans) {
+    const id = t.traceID || t.traceId || t._id;
+    if (!id) { order.push(t); continue; }
+    const dur = (x) => Number(x.durationNano || 0) || Number(x.duration || 0) * 1e6;
+    const prev = best.get(id);
+    if (!prev) { best.set(id, t); order.push(id); }
+    else if (dur(t) > dur(prev)) best.set(id, t);
+  }
+  return order.map((k) => (typeof k === 'string' ? best.get(k) : k));
+}
+
 async function tracesList(args, flags) {
   requireAuth();
   const appKey = resolveApp(flags);
@@ -31,33 +82,37 @@ async function tracesList(args, flags) {
 
   const s = ui.spinner('Fetching traces');
   try {
+    const limit = Math.max(1, parseInt(flags.limit, 10) || 20);
     const query = {
       appKeys: appKey,
-      limit: flags.limit || 20,
+      // Ask for more server spans than rows: one request can have two (Next.js records its own span next to
+      // the HTTP one), and they collapse into one row below.
+      limit: Math.min(limit * 3, 1000),
     };
     addEnvironment(query, flags);
     if (flags.start) query.from = flags.start;
     if (flags.end) query.to = flags.end;
 
     const data = await api.get('/traces', { query });
-    const traces = data.traces || [];
+    const traces = onePerTrace(data.traces || []).slice(0, limit);
     s.stop(`Found ${traces.length} trace${traces.length !== 1 ? 's' : ''}`);
 
     if (flags.json) { ui.json(traces); return; }
 
     console.log('');
+    // Full trace ids: `securenow traces show <id>` needs the whole id.
     const rows = traces.map(t => [
-      ui.c.dim(ui.truncate(t.traceID || t.traceId || t._id, 16)),
+      ui.c.dim(String(t.traceID || t.traceId || t._id || '')),
       t.environment || 'production',
-      t.operationName || t.name || t.serviceName || '—',
+      t.httpMethod || t.method || '—',
+      ui.truncate(t.operationName || t.name || t.httpRoute || t.httpUrl || t.url || '—', 40),
       ui.httpStatusColor(t.statusCode || t.httpStatusCode || t.responseStatusCode || '—'),
       ui.durationColor(t.durationNano ? t.durationNano / 1e6 : t.duration),
-      t.httpMethod || t.method || '—',
-      ui.truncate(t.httpUrl || t.url || t.httpRoute || '', 40),
+      t.clientIp || '—',
       ui.timeAgo(t.timestamp),
     ]);
 
-    ui.table(['Trace ID', 'Env', 'Operation', 'Status', 'Duration', 'Method', 'URL', 'Time'], rows);
+    ui.table(['Trace ID', 'Env', 'Method', 'Path', 'Status', 'Duration', 'Client IP', 'Time'], rows);
     console.log('');
   } catch (err) {
     s.fail('Failed to fetch traces');
@@ -88,14 +143,36 @@ async function tracesShow(args, flags) {
     ui.heading(`Trace ${data.traceId || traceId}`);
 
     if (spans.length) {
+      // The request as SecureNow stored it: the server span that carries the HTTP attributes.
+      const request = requestSpan(spans);
+      if (request) {
+        const a = spanAttrs(request);
+        const ip = a['http.client_ip'];
+        const pairs = [
+          ['Request', `${a['http.method'] || spanField(request, 'http_method', 'httpMethod') || ''} ${a['http.route'] || a['http.target'] || ''}`.trim() || '—'],
+          ['Status', spanStatus(request) ? ui.httpStatusColor(spanStatus(request)) : '—'],
+          ['Duration', ui.durationColor(spanDurationMs(request))],
+          ['Client IP', ip ? `${ip}${a['http.client_ip.source'] ? ui.c.dim(` (${a['http.client_ip.source']})`) : ''}` : '—'],
+        ];
+        const ua = a['http.user_agent'] || a['user_agent.original'] || headerValue(a['http.request.headers'], 'user-agent');
+        if (ua) pairs.push(['User agent', ua]);
+        if (a['http.request.body']) {
+          const kind = [a['http.request.body.type'], a['http.request.body.size'] != null ? `${a['http.request.body.size']} bytes` : ''].filter(Boolean).join(', ');
+          pairs.push(['Body', `${a['http.request.body']}${kind ? ui.c.dim(`  (${kind})`) : ''}`]);
+        }
+        if (a['http.request.headers']) pairs.push(['Headers', ui.c.dim(a['http.request.headers'])]);
+        console.log('');
+        ui.keyValue(pairs);
+      }
+
       ui.subheading(`Spans (${spans.length})`);
       console.log('');
       const rows = spans.map(span => [
-        ui.c.dim(ui.truncate(span.spanID || span.spanId, 16)),
-        span.operationName || span.name || '—',
-        ui.httpStatusColor(span.statusCode || span.responseStatusCode || '—'),
-        ui.durationColor(span.durationNano ? span.durationNano / 1e6 : span.duration),
-        span.kind || '—',
+        ui.c.dim(ui.truncate(spanField(span, 'span_id', 'spanID', 'spanId') || '', 16)),
+        spanField(span, 'operationName', 'name') || '—',
+        spanStatus(span) ? ui.httpStatusColor(spanStatus(span)) : ui.c.dim('—'),
+        ui.durationColor(spanDurationMs(span)),
+        spanKind(span),
       ]);
       ui.table(['Span ID', 'Operation', 'Status', 'Duration', 'Kind'], rows);
     } else {

package/cli/rateLimits.js

@@ -5,7 +5,7 @@ const config = require('./config');
 const ui = require('./ui');
 
 function resolveApp(flags) {
-  return flags.app || config.getDefaultApp();
+  return flags.app || config.getDefaultAppKey();
 }
 
 function resolveEnvironment(flags, fallback = null) {

package/cli/security.js

@@ -6,7 +6,7 @@ const config = require('./config');
 const ui = require('./ui');
 
 function resolveApp(flags) {
-  return flags.app || config.getDefaultApp();
+  return flags.app || config.getDefaultAppKey();
 }
 
 function resolveEnvironment(flags, fallback = null) {
@@ -1962,7 +1962,7 @@ async function trustedRemove(args, flags) {
 // ── Helpers ──
 
 async function resolveAppId(flags) {
-  const appKey = flags.app || config.getDefaultApp();
+  const appKey = flags.app || config.getDefaultAppKey();
   if (!appKey) return null;
   const data = await api.get('/applications');
   const apps = data.applications || [];

package/cli/telemetry.js

@@ -108,7 +108,7 @@ async function schema(args, flags) {
 
 async function fields(args, flags) {
   requireAuth();
-  const appKey = flags.app || config.getDefaultApp() || appConfig.resolveAppKey();
+  const appKey = flags.app || config.getDefaultAppKey();
   if (!appKey) {
     ui.error('No app specified. Use --app <key>, run `securenow app connect`, or set a default app.');
     process.exitCode = 1;

package/events.d.ts

@@ -3,9 +3,12 @@ export interface TrackProps {
   userId?: string | number;
   /** Session identifier (finer-grained than userId). */
   sessionId?: string | number;
-  /** End-user client IP as seen by your app (enriched to geo/ASN server-side). */
+  /**
+   * End-user client IP (enriched to geo/ASN server-side). Inside a request SecureNow is handling, defaults to
+   * that request's address, resolved with the firewall's trusted-proxy rules (8.26.0+).
+   */
   ip?: string;
-  /** End-user agent string. */
+  /** End-user agent string. Inside a request, defaults to its User-Agent header (8.26.0+). */
   userAgent?: string;
   /** Severity hint. Defaults to "info". */
   severity?: "trace" | "debug" | "info" | "warn" | "error" | "fatal";

package/events.js

@@ -129,6 +129,24 @@ function normalizeEvent(type, props) {
       ev.attributes = props.attributes;
     }
   }
+  // Inside a request SecureNow is handling, the visitor's address and user agent come from that request
+  // when the caller leaves them out (8.26.0+): a Next.js route handler only has a Web Request, which can't
+  // tell who connected. The address is resolved like the firewall's, so X-Forwarded-For can't choose it.
+  if (ev.ip == null || ev.user_agent == null) {
+    try {
+      const requestContext = require('./request-context');
+      if (ev.ip == null) {
+        const ip = requestContext.currentClientIp();
+        if (ip) ev.ip = ip;
+      }
+      if (ev.user_agent == null) {
+        const ua = requestContext.currentUserAgent();
+        if (ua) ev.user_agent = ua;
+      }
+    } catch {
+      /* never throw into the app */
+    }
+  }
   return ev;
 }
 
@@ -136,6 +154,7 @@ function normalizeEvent(type, props) {
  * Emit a custom event. Fire-and-forget — returns immediately, never throws.
  * @param {string} type        Event type, e.g. "auth.login.success".
  * @param {object} [props]      { userId, sessionId, ip, userAgent, severity, ts, attributes }
+ *                              Inside a request, ip and userAgent default to the request's (8.26.0+).
  */
 function track(type, props = {}) {
   try {

package/firewall-cloud.js

@@ -11,7 +11,7 @@
  */
 
 const https = require('https');
-const net = require('net');
+const { parseIp, parseCidr, parseCidr6, intToIp, bigIntToIpv6 } = require('./cidr');
 
 let _options = null;
 let _active = false;
@@ -24,21 +24,38 @@ const GCP_MAX_RULES = 100;
 
 const MIN_PUSH_INTERVAL_MS = 30000;
 
-// Blocklist entries as CIDRs, per address family: an exact address becomes /32 (IPv4) or /128 (IPv6).
-// (Appending "/32" to everything turned one IPv6 address into a /32 covering billions of addresses.)
+// Blocklist entries as canonical CIDRs, per address family: an exact address becomes /32 (IPv4) or /128
+// (IPv6), an IPv4-mapped address (::ffff:1.2.3.4) is IPv4, a range is written from its network address,
+// and anything a provider would refuse (not an IP, a /0) is left out. One bad entry used to make the
+// provider refuse the whole push; the app still blocks what is left out here.
 function toCidrs(ips) {
-  const v4 = [];
-  const v6 = [];
+  const v4 = new Set();
+  const v6 = new Set();
   for (const raw of ips || []) {
     const entry = String(raw || '').trim();
     if (!entry) continue;
-    const slash = entry.indexOf('/');
-    const addr = slash === -1 ? entry : entry.slice(0, slash);
-    const family = net.isIP(addr);
-    if (family === 4) v4.push(slash === -1 ? `${addr}/32` : entry);
-    else if (family === 6) v6.push(slash === -1 ? `${addr}/128` : entry);
+    if (!entry.includes('/')) {
+      const ip = parseIp(entry);
+      if (ip) (ip.family === 4 ? v4 : v6).add(`${ip.key}/${ip.family === 4 ? 32 : 128}`);
+      continue;
+    }
+    const bits = Number(entry.slice(entry.indexOf('/') + 1));
+    const c4 = parseCidr(entry);
+    if (c4) {
+      if (bits > 0) v4.add(`${intToIp(c4.network)}/${bits}`);
+      continue;
+    }
+    const c6 = parseCidr6(entry);
+    if (!c6 || c6.bits === 0) continue;
+    if (c6.bits >= 96 && (c6.network >> 32n) === 0xffffn) {
+      // ::ffff:0:0/96 and narrower are IPv4 ranges written in IPv6 form.
+      const b4 = c6.bits - 96;
+      if (b4 > 0) v4.add(`${intToIp(Number(c6.network & 0xffffffffn) >>> 0)}/${b4}`);
+    } else {
+      v6.add(`${bigIntToIpv6(c6.network)}/${c6.bits}`);
+    }
   }
-  return { v4, v6 };
+  return { v4: [...v4], v6: [...v6] };
 }
 
 function prefixLength(cidr) {

package/firewall.js

@@ -5,6 +5,7 @@ const https = require('https');
 const crypto = require('crypto');
 const { createMatcher } = require('./cidr');
 const { resolveClientIp } = require('./resolve-ip');
+const requestContext = require('./request-context');
 const challenge = require('./challenge');
 
 // Sent with every firewall API call, so SecureNow can tell which SDK versions and how many processes run.
@@ -480,9 +481,12 @@ function doUnifiedSync(callback) {
       }
 
       if (body.allowlistIps) {
+        // The API can resend an unchanged (often empty) allowlist on every sync: only a real change counts, or
+        // "re-synced 0 allowed IPs" was logged, and exported as a log record, every 10 seconds.
+        const before = _allowlistRawIps ? JSON.stringify(_allowlistRawIps) : null;
         _allowlistRawIps = body.allowlistIps;
         _allowlistMatcher = createMatcher(body.allowlistIps);
-        alChanged = true;
+        alChanged = before !== JSON.stringify(body.allowlistIps);
       }
 
       if (body.rateLimits) {
@@ -1463,13 +1467,20 @@ function runRequestHooks(req, res) {
 }
 
 // One 'request' guard for every server kind: the firewall runs once per request, then the server's own emit.
+// The app's handler runs inside the request context (request-context.js), so track() and sessions.check()
+// can find the visitor's address from code that only gets a Web Request (Next.js route handlers).
 function guardedEmit(originalEmit) {
   return function securenowGuardedEmit(event, req, res, ...rest) {
     if (event === 'connection' && _tcpLayer && req && _tcpLayer.checkConnection(req)) return true;
-    if (event === 'request' && req && res && !res.headersSent && !req[FIREWALL_CHECKED]) {
-      req[FIREWALL_CHECKED] = true;
-      if (firewallRequestHandler(req, res)) return true;
-      if (_requestHooks.length && runRequestHooks(req, res)) return true;
+    if (event === 'request' && req && res) {
+      return requestContext.runWithRequest(req, () => {
+        if (!res.headersSent && !req[FIREWALL_CHECKED]) {
+          req[FIREWALL_CHECKED] = true;
+          if (firewallRequestHandler(req, res)) return true;
+          if (_requestHooks.length && runRequestHooks(req, res)) return true;
+        }
+        return originalEmit.call(this, event, req, res, ...rest);
+      });
     }
     return originalEmit.call(this, event, req, res, ...rest);
   };

package/nextjs.js

@@ -156,7 +156,7 @@ function registerSecureNow(options = {}) {
 
     // -------- Log environment detection --------
     if (!isVercel) {
-      console.log('[securenow] Self-hosted environment detected (EC2/PM2) - using vanilla SDK');
+      console.log('[securenow] Node.js server (next start or standalone) - using the OpenTelemetry Node SDK');
     }
 
     // -------- Use different initialization based on environment --------
@@ -458,7 +458,7 @@ function registerSecureNow(options = {}) {
       });
       
       sdk.start();
-      console.log('[securenow] Vanilla SDK initialized for self-hosted environment');
+      console.log('[securenow] OpenTelemetry Node SDK initialized');
 
       // -------- Logging (self-hosted only) --------
       // Opt-out default: set config.logging.enabled=false to disable.
@@ -595,14 +595,16 @@ function registerSecureNow(options = {}) {
     isRegistered = true;
 
     console.log('[securenow] OpenTelemetry started for Next.js -> %s', tracesUrl);
-    console.log('[securenow] Auto-capturing comprehensive request metadata:');
-    console.log('[securenow]    - IP addresses (x-forwarded-for, x-real-ip, socket)');
-    console.log('[securenow]    - User-Agent, Referer, Origin, Accept headers');
-    console.log('[securenow]    - Protocol, Host, Port (proxy-aware)');
-    console.log('[securenow]    - Geographic data (Vercel/Cloudflare)');
-    console.log('[securenow]    - Request IDs, CSRF tokens, Auth presence');
-    console.log('[securenow]    - Response status, content-type, content-length');
-    console.log('[securenow]    - Request headers (redacted)%s', captureBody ? ' and JSON/form/GraphQL bodies (redacted)' : '');
+    console.log('[securenow] Capturing: client IP (trusted proxies only), method, route, status, user agent, headers (redacted)');
+    // Same line as -r securenow/register prints, so one checklist works for every framework.
+    if (captureBody) {
+      console.log('[securenow] Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', requestCapture.maxBodySize, requestCapture.allSensitiveFields.length);
+    } else {
+      console.log('[securenow] Request body capture: DISABLED (config.capture.body=false)');
+    }
+    if (requestCapture.captureMultipart) {
+      console.log('[securenow] Multipart capture: ENABLED (field names and file metadata, never file content)');
+    }
 
     // Optional test span
     if (appConfig.boolConfig('runtime.testSpan', false)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.25.1",
+  "version": "8.26.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
@@ -11,7 +11,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-cidr.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-firewall-guards.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-log-redaction.js && node test-crash-capture.js && node test-crash-flush.js && node test-request-capture.js && node test-fastify-hooks.js && node test-pm2-credentials.js && node test-env-credentials.js && node test-framework-wiring.js && node test-framework-routes.js && node test-sessions-everywhere.js && node test-local-socket.js && node test-firewall-cloud.js && node test-firewall-layers.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-esm-detect.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-cidr.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-firewall-guards.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-log-redaction.js && node test-crash-capture.js && node test-crash-flush.js && node test-request-capture.js && node test-fastify-hooks.js && node test-pm2-credentials.js && node test-env-credentials.js && node test-framework-wiring.js && node test-framework-routes.js && node test-sessions-everywhere.js && node test-request-context.js && node test-local-socket.js && node test-firewall-cloud.js && node test-firewall-layers.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-esm-detect.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -155,6 +155,7 @@
     "cli/",
     "mcp/",
     "resolve-ip.js",
+    "request-context.js",
     "cidr.js",
     "firewall.js",
     "challenge.js",

package/request-context.js

@@ -0,0 +1,73 @@
+'use strict';
+
+// The incoming request SecureNow is handling right now, for code that runs inside it.
+//
+// The firewall's request guard enters this context once per incoming request, and AsyncLocalStorage
+// carries it through every await of the app's handler. So code that never sees the Node request can
+// still reach it: a Next.js route handler gets a Web Request with no socket, which is not enough to
+// know who connected. track() and sessions.check() use it to fill the visitor's address (resolved with
+// the same trusted-proxy rules as the firewall, so a client can't choose it with X-Forwarded-For) and
+// the user agent when the caller doesn't pass them.
+//
+//   const { currentClientIp } = require('securenow/resolve-ip');
+//   currentClientIp(); // '203.0.113.7' inside a request, '' outside one
+//
+// The store lives on globalThis so a second copy of the package (CommonJS and ESM loads, a bundled
+// copy) still sees the request the first copy entered.
+
+const KEY = Symbol.for('securenow.requestContext');
+
+function store() {
+  let als = globalThis[KEY];
+  if (!als) {
+    try {
+      const { AsyncLocalStorage } = require('async_hooks');
+      als = new AsyncLocalStorage();
+    } catch (_) {
+      als = null;
+    }
+    globalThis[KEY] = als;
+  }
+  return als;
+}
+
+/** Run fn with req as the current request. Returns what fn returns. */
+function runWithRequest(req, fn) {
+  const als = store();
+  if (!als || !req) return fn();
+  return als.run(req, fn);
+}
+
+/** The Node request being handled in this async context, or null outside a request. */
+function currentRequest() {
+  try {
+    const als = store();
+    return (als && als.getStore()) || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+/** The visitor's address for the current request ('' outside a request). */
+function currentClientIp() {
+  const req = currentRequest();
+  if (!req) return '';
+  try {
+    return require('./resolve-ip').resolveClientIp(req) || '';
+  } catch (_) {
+    return '';
+  }
+}
+
+/** The User-Agent header of the current request ('' outside a request). */
+function currentUserAgent() {
+  const req = currentRequest();
+  try {
+    const ua = req && req.headers && req.headers['user-agent'];
+    return ua ? String(ua) : '';
+  } catch (_) {
+    return '';
+  }
+}
+
+module.exports = { runWithRequest, currentRequest, currentClientIp, currentUserAgent };

package/resolve-ip.js

@@ -182,9 +182,18 @@ function resolveSocketIp(socket) {
   return normalizeIp(raw);
 }
 
+/**
+ * The visitor's address for the request SecureNow is handling right now ('' outside a request), for code
+ * that only gets a Web Request, like a Next.js route handler (8.26.0+). Same trusted-proxy rules as above.
+ */
+function currentClientIp() {
+  return require('./request-context').currentClientIp();
+}
+
 module.exports = {
   resolveClientIp,
   resolveClientIpWithDetails,
+  currentClientIp,
   resolveSocketIp,
   isFromTrustedProxy,
   normalizeIp,

package/sessions.js

@@ -17,6 +17,7 @@ const crypto = require('crypto');
 const appConfig = require('./app-config');
 const events = require('./events');
 const { resolveClientIp: resolveTrustedClientIp } = require('./resolve-ip');
+const requestContext = require('./request-context');
 
 let _entries = new Map(); // "type:value" -> expiryMs (0 = never)
 let _etag = null;
@@ -217,9 +218,10 @@ let _captureWindowMs = 5 * 60 * 1000;
 
 // The client IP the way the firewall and traces resolve it (resolve-ip.js): forwarding headers count only
 // when the connection comes from a trusted proxy. Trusting X-Forwarded-For from anyone let a client choose the
-// IP that session-theft detection compares.
+// IP that session-theft detection compares. A Web Request (Next.js route handler, Hono) has no socket: the
+// address then comes from the Node request SecureNow is handling (request-context.js, 8.26.0+).
 function resolveClientIp(req) {
-  return resolveTrustedClientIp(req) || null;
+  return resolveTrustedClientIp(req) || requestContext.currentClientIp() || null;
 }
 
 function emitSessionSeen(sessionId, userId, ip) {