securenow 8.5.0 → 8.7.0

package/cli.js

@@ -255,8 +255,8 @@ const COMMANDS = {
     usage: 'securenow alerts <subcommand> [options]',
     sub: {
       rules: {
-        desc: 'Create, list, show, update, set-sql, validate, delete, test, or tune alert rules',
-        usage: 'securenow alerts rules <list|create|show|update|set-sql|validate|delete|test|dry-run-query|tune-query|exclusions> [options]',
+        desc: 'Create, list, show, update, promote/demote, set-sql, validate, delete, test, or tune alert rules',
+        usage: 'securenow alerts rules <list|create|show|update|promote|demote|set-sql|validate|delete|test|dry-run-query|tune-query|exclusions> [options]',
         flags: {
           json: 'Output as JSON',
           name: 'With create: rule name',
@@ -275,7 +275,14 @@ const COMMANDS = {
           'no-applications-all': 'With update: scope to explicit --apps list',
           apps: 'Comma-separated app keys (with create/update)',
           app: 'Application key for rule tests',
-          mode: 'Rule test mode: dry_run or live',
+          mode: 'With test: dry_run | live.  With list/update: lifecycle test | prod (test = detect-only, no mitigation)',
+          status: 'With update: Active | Disabled | Paused.  With list: filter by status',
+          enable: 'With update: shortcut for --status Active',
+          disable: 'With update: shortcut for --status Disabled',
+          pause: 'With update: shortcut for --status Paused',
+          active: 'With list: filter active (true) or non-active (false)',
+          system: 'With list: only system rules',
+          user: 'With list: only user (non-system) rules',
           wait: 'Wait for rule test completion',
           sql: 'Detection/candidate/replacement SQL, @file, or - for stdin (create, set-sql, update, validate, dry-run-query, tune-query)',
           query: 'Alias for --sql',
@@ -389,6 +396,37 @@ const COMMANDS = {
     },
     defaultSub: 'list',
   },
+  challenge: {
+    desc: 'Manage CAPTCHA / proof-of-work challenge remediation rules',
+    usage: 'securenow challenge <list|add|show|test|enable|disable|remove> [options]',
+    flags: {
+      app: 'Scope to app key (defaults to logged-in app)',
+      env: 'Scope to environment (default for create/test: production)',
+      environment: 'Alias for --env',
+      json: 'Output as JSON',
+      difficulty: 'Proof-of-work strength in leading zero bits (4-28, default 14)',
+      clearance: 'How long a solve clears, e.g. 30m, 1h (default 30m)',
+      route: 'Path pattern such as /login',
+      path: 'Alias for --route',
+      mode: 'Path mode: exact, prefix, or regex',
+      method: 'HTTP method, or ALL',
+      duration: 'Rule expiry, e.g. 24h or 7d',
+      reason: 'Reason note',
+      'escalate-to-block': 'Promote to a hard block after repeated failures',
+      'fail-threshold': 'Failures before escalation (default 10)',
+      'block-ttl-hours': 'Block duration when escalating (default 24)',
+    },
+    sub: {
+      list: { desc: 'List challenge remediation rules', run: (a, f) => require('./cli/challenges').list(a, f) },
+      add: { desc: 'Create a challenge rule', usage: 'securenow challenge add [ip] --route /login --difficulty 16 --clearance 30m', run: (a, f) => require('./cli/challenges').add(a, f) },
+      show: { desc: 'Show one challenge rule', usage: 'securenow challenge show <id>', run: (a, f) => require('./cli/challenges').show(a, f) },
+      test: { desc: 'Check whether a request would be challenged', usage: 'securenow challenge test <ip> --path /login --method GET', run: (a, f) => require('./cli/challenges').test(a, f) },
+      enable: { desc: 'Enable a challenge rule', usage: 'securenow challenge enable <id>', run: (a, f) => require('./cli/challenges').enable(a, f) },
+      disable: { desc: 'Disable a challenge rule', usage: 'securenow challenge disable <id>', run: (a, f) => require('./cli/challenges').disable(a, f) },
+      remove: { desc: 'Remove a challenge rule', usage: 'securenow challenge remove <id> [--reason "..."]', run: (a, f) => require('./cli/challenges').remove(a, f) },
+    },
+    defaultSub: 'list',
+  },
   automation: {
     desc: 'Manage automation rules for blocklist actions',
     usage: 'securenow automation <list|defaults|show|create|update|dry-run|execute|delete> [rule-id] [options]',
@@ -724,7 +762,7 @@ function showHelp(commandName) {
     'Detect & Respond': ['human', 'notifications', 'alerts', 'fp'],
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
-    'Remediation': ['automation', 'ratelimit', 'blocklist', 'revoke', 'allowlist', 'trusted'],
+    'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],
     'Telemetry': ['log', 'event', 'test-span'],
     'Utilities': ['redact', 'cidr', 'doctor', 'env', 'mcp'],
     'Settings': ['instances', 'config', 'version'],