residoo 0.15.0 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/bip39wordlist.js

@@ -0,0 +1,270 @@
+"use strict";
+
+/**
+ * The canonical BIP-39 English wordlist (2048 words), verbatim from the
+ * spec's own reference file: github.com/bitcoin/bips, bip-0039/english.txt
+ * (fetched directly, not retyped from memory -- transcription errors here
+ * would silently break every checksum computation in src/pii.js). Order
+ * matters: word N's position in this array IS its 11-bit index per the
+ * spec, so this list must never be re-sorted or edited.
+ */
+const BIP39_ENGLISH_WORDLIST = [
+  "abandon", "ability", "able", "about", "above", "absent", "absorb", "abstract",
+  "absurd", "abuse", "access", "accident", "account", "accuse", "achieve", "acid",
+  "acoustic", "acquire", "across", "act", "action", "actor", "actress", "actual",
+  "adapt", "add", "addict", "address", "adjust", "admit", "adult", "advance",
+  "advice", "aerobic", "affair", "afford", "afraid", "again", "age", "agent",
+  "agree", "ahead", "aim", "air", "airport", "aisle", "alarm", "album",
+  "alcohol", "alert", "alien", "all", "alley", "allow", "almost", "alone",
+  "alpha", "already", "also", "alter", "always", "amateur", "amazing", "among",
+  "amount", "amused", "analyst", "anchor", "ancient", "anger", "angle", "angry",
+  "animal", "ankle", "announce", "annual", "another", "answer", "antenna", "antique",
+  "anxiety", "any", "apart", "apology", "appear", "apple", "approve", "april",
+  "arch", "arctic", "area", "arena", "argue", "arm", "armed", "armor",
+  "army", "around", "arrange", "arrest", "arrive", "arrow", "art", "artefact",
+  "artist", "artwork", "ask", "aspect", "assault", "asset", "assist", "assume",
+  "asthma", "athlete", "atom", "attack", "attend", "attitude", "attract", "auction",
+  "audit", "august", "aunt", "author", "auto", "autumn", "average", "avocado",
+  "avoid", "awake", "aware", "away", "awesome", "awful", "awkward", "axis",
+  "baby", "bachelor", "bacon", "badge", "bag", "balance", "balcony", "ball",
+  "bamboo", "banana", "banner", "bar", "barely", "bargain", "barrel", "base",
+  "basic", "basket", "battle", "beach", "bean", "beauty", "because", "become",
+  "beef", "before", "begin", "behave", "behind", "believe", "below", "belt",
+  "bench", "benefit", "best", "betray", "better", "between", "beyond", "bicycle",
+  "bid", "bike", "bind", "biology", "bird", "birth", "bitter", "black",
+  "blade", "blame", "blanket", "blast", "bleak", "bless", "blind", "blood",
+  "blossom", "blouse", "blue", "blur", "blush", "board", "boat", "body",
+  "boil", "bomb", "bone", "bonus", "book", "boost", "border", "boring",
+  "borrow", "boss", "bottom", "bounce", "box", "boy", "bracket", "brain",
+  "brand", "brass", "brave", "bread", "breeze", "brick", "bridge", "brief",
+  "bright", "bring", "brisk", "broccoli", "broken", "bronze", "broom", "brother",
+  "brown", "brush", "bubble", "buddy", "budget", "buffalo", "build", "bulb",
+  "bulk", "bullet", "bundle", "bunker", "burden", "burger", "burst", "bus",
+  "business", "busy", "butter", "buyer", "buzz", "cabbage", "cabin", "cable",
+  "cactus", "cage", "cake", "call", "calm", "camera", "camp", "can",
+  "canal", "cancel", "candy", "cannon", "canoe", "canvas", "canyon", "capable",
+  "capital", "captain", "car", "carbon", "card", "cargo", "carpet", "carry",
+  "cart", "case", "cash", "casino", "castle", "casual", "cat", "catalog",
+  "catch", "category", "cattle", "caught", "cause", "caution", "cave", "ceiling",
+  "celery", "cement", "census", "century", "cereal", "certain", "chair", "chalk",
+  "champion", "change", "chaos", "chapter", "charge", "chase", "chat", "cheap",
+  "check", "cheese", "chef", "cherry", "chest", "chicken", "chief", "child",
+  "chimney", "choice", "choose", "chronic", "chuckle", "chunk", "churn", "cigar",
+  "cinnamon", "circle", "citizen", "city", "civil", "claim", "clap", "clarify",
+  "claw", "clay", "clean", "clerk", "clever", "click", "client", "cliff",
+  "climb", "clinic", "clip", "clock", "clog", "close", "cloth", "cloud",
+  "clown", "club", "clump", "cluster", "clutch", "coach", "coast", "coconut",
+  "code", "coffee", "coil", "coin", "collect", "color", "column", "combine",
+  "come", "comfort", "comic", "common", "company", "concert", "conduct", "confirm",
+  "congress", "connect", "consider", "control", "convince", "cook", "cool", "copper",
+  "copy", "coral", "core", "corn", "correct", "cost", "cotton", "couch",
+  "country", "couple", "course", "cousin", "cover", "coyote", "crack", "cradle",
+  "craft", "cram", "crane", "crash", "crater", "crawl", "crazy", "cream",
+  "credit", "creek", "crew", "cricket", "crime", "crisp", "critic", "crop",
+  "cross", "crouch", "crowd", "crucial", "cruel", "cruise", "crumble", "crunch",
+  "crush", "cry", "crystal", "cube", "culture", "cup", "cupboard", "curious",
+  "current", "curtain", "curve", "cushion", "custom", "cute", "cycle", "dad",
+  "damage", "damp", "dance", "danger", "daring", "dash", "daughter", "dawn",
+  "day", "deal", "debate", "debris", "decade", "december", "decide", "decline",
+  "decorate", "decrease", "deer", "defense", "define", "defy", "degree", "delay",
+  "deliver", "demand", "demise", "denial", "dentist", "deny", "depart", "depend",
+  "deposit", "depth", "deputy", "derive", "describe", "desert", "design", "desk",
+  "despair", "destroy", "detail", "detect", "develop", "device", "devote", "diagram",
+  "dial", "diamond", "diary", "dice", "diesel", "diet", "differ", "digital",
+  "dignity", "dilemma", "dinner", "dinosaur", "direct", "dirt", "disagree", "discover",
+  "disease", "dish", "dismiss", "disorder", "display", "distance", "divert", "divide",
+  "divorce", "dizzy", "doctor", "document", "dog", "doll", "dolphin", "domain",
+  "donate", "donkey", "donor", "door", "dose", "double", "dove", "draft",
+  "dragon", "drama", "drastic", "draw", "dream", "dress", "drift", "drill",
+  "drink", "drip", "drive", "drop", "drum", "dry", "duck", "dumb",
+  "dune", "during", "dust", "dutch", "duty", "dwarf", "dynamic", "eager",
+  "eagle", "early", "earn", "earth", "easily", "east", "easy", "echo",
+  "ecology", "economy", "edge", "edit", "educate", "effort", "egg", "eight",
+  "either", "elbow", "elder", "electric", "elegant", "element", "elephant", "elevator",
+  "elite", "else", "embark", "embody", "embrace", "emerge", "emotion", "employ",
+  "empower", "empty", "enable", "enact", "end", "endless", "endorse", "enemy",
+  "energy", "enforce", "engage", "engine", "enhance", "enjoy", "enlist", "enough",
+  "enrich", "enroll", "ensure", "enter", "entire", "entry", "envelope", "episode",
+  "equal", "equip", "era", "erase", "erode", "erosion", "error", "erupt",
+  "escape", "essay", "essence", "estate", "eternal", "ethics", "evidence", "evil",
+  "evoke", "evolve", "exact", "example", "excess", "exchange", "excite", "exclude",
+  "excuse", "execute", "exercise", "exhaust", "exhibit", "exile", "exist", "exit",
+  "exotic", "expand", "expect", "expire", "explain", "expose", "express", "extend",
+  "extra", "eye", "eyebrow", "fabric", "face", "faculty", "fade", "faint",
+  "faith", "fall", "false", "fame", "family", "famous", "fan", "fancy",
+  "fantasy", "farm", "fashion", "fat", "fatal", "father", "fatigue", "fault",
+  "favorite", "feature", "february", "federal", "fee", "feed", "feel", "female",
+  "fence", "festival", "fetch", "fever", "few", "fiber", "fiction", "field",
+  "figure", "file", "film", "filter", "final", "find", "fine", "finger",
+  "finish", "fire", "firm", "first", "fiscal", "fish", "fit", "fitness",
+  "fix", "flag", "flame", "flash", "flat", "flavor", "flee", "flight",
+  "flip", "float", "flock", "floor", "flower", "fluid", "flush", "fly",
+  "foam", "focus", "fog", "foil", "fold", "follow", "food", "foot",
+  "force", "forest", "forget", "fork", "fortune", "forum", "forward", "fossil",
+  "foster", "found", "fox", "fragile", "frame", "frequent", "fresh", "friend",
+  "fringe", "frog", "front", "frost", "frown", "frozen", "fruit", "fuel",
+  "fun", "funny", "furnace", "fury", "future", "gadget", "gain", "galaxy",
+  "gallery", "game", "gap", "garage", "garbage", "garden", "garlic", "garment",
+  "gas", "gasp", "gate", "gather", "gauge", "gaze", "general", "genius",
+  "genre", "gentle", "genuine", "gesture", "ghost", "giant", "gift", "giggle",
+  "ginger", "giraffe", "girl", "give", "glad", "glance", "glare", "glass",
+  "glide", "glimpse", "globe", "gloom", "glory", "glove", "glow", "glue",
+  "goat", "goddess", "gold", "good", "goose", "gorilla", "gospel", "gossip",
+  "govern", "gown", "grab", "grace", "grain", "grant", "grape", "grass",
+  "gravity", "great", "green", "grid", "grief", "grit", "grocery", "group",
+  "grow", "grunt", "guard", "guess", "guide", "guilt", "guitar", "gun",
+  "gym", "habit", "hair", "half", "hammer", "hamster", "hand", "happy",
+  "harbor", "hard", "harsh", "harvest", "hat", "have", "hawk", "hazard",
+  "head", "health", "heart", "heavy", "hedgehog", "height", "hello", "helmet",
+  "help", "hen", "hero", "hidden", "high", "hill", "hint", "hip",
+  "hire", "history", "hobby", "hockey", "hold", "hole", "holiday", "hollow",
+  "home", "honey", "hood", "hope", "horn", "horror", "horse", "hospital",
+  "host", "hotel", "hour", "hover", "hub", "huge", "human", "humble",
+  "humor", "hundred", "hungry", "hunt", "hurdle", "hurry", "hurt", "husband",
+  "hybrid", "ice", "icon", "idea", "identify", "idle", "ignore", "ill",
+  "illegal", "illness", "image", "imitate", "immense", "immune", "impact", "impose",
+  "improve", "impulse", "inch", "include", "income", "increase", "index", "indicate",
+  "indoor", "industry", "infant", "inflict", "inform", "inhale", "inherit", "initial",
+  "inject", "injury", "inmate", "inner", "innocent", "input", "inquiry", "insane",
+  "insect", "inside", "inspire", "install", "intact", "interest", "into", "invest",
+  "invite", "involve", "iron", "island", "isolate", "issue", "item", "ivory",
+  "jacket", "jaguar", "jar", "jazz", "jealous", "jeans", "jelly", "jewel",
+  "job", "join", "joke", "journey", "joy", "judge", "juice", "jump",
+  "jungle", "junior", "junk", "just", "kangaroo", "keen", "keep", "ketchup",
+  "key", "kick", "kid", "kidney", "kind", "kingdom", "kiss", "kit",
+  "kitchen", "kite", "kitten", "kiwi", "knee", "knife", "knock", "know",
+  "lab", "label", "labor", "ladder", "lady", "lake", "lamp", "language",
+  "laptop", "large", "later", "latin", "laugh", "laundry", "lava", "law",
+  "lawn", "lawsuit", "layer", "lazy", "leader", "leaf", "learn", "leave",
+  "lecture", "left", "leg", "legal", "legend", "leisure", "lemon", "lend",
+  "length", "lens", "leopard", "lesson", "letter", "level", "liar", "liberty",
+  "library", "license", "life", "lift", "light", "like", "limb", "limit",
+  "link", "lion", "liquid", "list", "little", "live", "lizard", "load",
+  "loan", "lobster", "local", "lock", "logic", "lonely", "long", "loop",
+  "lottery", "loud", "lounge", "love", "loyal", "lucky", "luggage", "lumber",
+  "lunar", "lunch", "luxury", "lyrics", "machine", "mad", "magic", "magnet",
+  "maid", "mail", "main", "major", "make", "mammal", "man", "manage",
+  "mandate", "mango", "mansion", "manual", "maple", "marble", "march", "margin",
+  "marine", "market", "marriage", "mask", "mass", "master", "match", "material",
+  "math", "matrix", "matter", "maximum", "maze", "meadow", "mean", "measure",
+  "meat", "mechanic", "medal", "media", "melody", "melt", "member", "memory",
+  "mention", "menu", "mercy", "merge", "merit", "merry", "mesh", "message",
+  "metal", "method", "middle", "midnight", "milk", "million", "mimic", "mind",
+  "minimum", "minor", "minute", "miracle", "mirror", "misery", "miss", "mistake",
+  "mix", "mixed", "mixture", "mobile", "model", "modify", "mom", "moment",
+  "monitor", "monkey", "monster", "month", "moon", "moral", "more", "morning",
+  "mosquito", "mother", "motion", "motor", "mountain", "mouse", "move", "movie",
+  "much", "muffin", "mule", "multiply", "muscle", "museum", "mushroom", "music",
+  "must", "mutual", "myself", "mystery", "myth", "naive", "name", "napkin",
+  "narrow", "nasty", "nation", "nature", "near", "neck", "need", "negative",
+  "neglect", "neither", "nephew", "nerve", "nest", "net", "network", "neutral",
+  "never", "news", "next", "nice", "night", "noble", "noise", "nominee",
+  "noodle", "normal", "north", "nose", "notable", "note", "nothing", "notice",
+  "novel", "now", "nuclear", "number", "nurse", "nut", "oak", "obey",
+  "object", "oblige", "obscure", "observe", "obtain", "obvious", "occur", "ocean",
+  "october", "odor", "off", "offer", "office", "often", "oil", "okay",
+  "old", "olive", "olympic", "omit", "once", "one", "onion", "online",
+  "only", "open", "opera", "opinion", "oppose", "option", "orange", "orbit",
+  "orchard", "order", "ordinary", "organ", "orient", "original", "orphan", "ostrich",
+  "other", "outdoor", "outer", "output", "outside", "oval", "oven", "over",
+  "own", "owner", "oxygen", "oyster", "ozone", "pact", "paddle", "page",
+  "pair", "palace", "palm", "panda", "panel", "panic", "panther", "paper",
+  "parade", "parent", "park", "parrot", "party", "pass", "patch", "path",
+  "patient", "patrol", "pattern", "pause", "pave", "payment", "peace", "peanut",
+  "pear", "peasant", "pelican", "pen", "penalty", "pencil", "people", "pepper",
+  "perfect", "permit", "person", "pet", "phone", "photo", "phrase", "physical",
+  "piano", "picnic", "picture", "piece", "pig", "pigeon", "pill", "pilot",
+  "pink", "pioneer", "pipe", "pistol", "pitch", "pizza", "place", "planet",
+  "plastic", "plate", "play", "please", "pledge", "pluck", "plug", "plunge",
+  "poem", "poet", "point", "polar", "pole", "police", "pond", "pony",
+  "pool", "popular", "portion", "position", "possible", "post", "potato", "pottery",
+  "poverty", "powder", "power", "practice", "praise", "predict", "prefer", "prepare",
+  "present", "pretty", "prevent", "price", "pride", "primary", "print", "priority",
+  "prison", "private", "prize", "problem", "process", "produce", "profit", "program",
+  "project", "promote", "proof", "property", "prosper", "protect", "proud", "provide",
+  "public", "pudding", "pull", "pulp", "pulse", "pumpkin", "punch", "pupil",
+  "puppy", "purchase", "purity", "purpose", "purse", "push", "put", "puzzle",
+  "pyramid", "quality", "quantum", "quarter", "question", "quick", "quit", "quiz",
+  "quote", "rabbit", "raccoon", "race", "rack", "radar", "radio", "rail",
+  "rain", "raise", "rally", "ramp", "ranch", "random", "range", "rapid",
+  "rare", "rate", "rather", "raven", "raw", "razor", "ready", "real",
+  "reason", "rebel", "rebuild", "recall", "receive", "recipe", "record", "recycle",
+  "reduce", "reflect", "reform", "refuse", "region", "regret", "regular", "reject",
+  "relax", "release", "relief", "rely", "remain", "remember", "remind", "remove",
+  "render", "renew", "rent", "reopen", "repair", "repeat", "replace", "report",
+  "require", "rescue", "resemble", "resist", "resource", "response", "result", "retire",
+  "retreat", "return", "reunion", "reveal", "review", "reward", "rhythm", "rib",
+  "ribbon", "rice", "rich", "ride", "ridge", "rifle", "right", "rigid",
+  "ring", "riot", "ripple", "risk", "ritual", "rival", "river", "road",
+  "roast", "robot", "robust", "rocket", "romance", "roof", "rookie", "room",
+  "rose", "rotate", "rough", "round", "route", "royal", "rubber", "rude",
+  "rug", "rule", "run", "runway", "rural", "sad", "saddle", "sadness",
+  "safe", "sail", "salad", "salmon", "salon", "salt", "salute", "same",
+  "sample", "sand", "satisfy", "satoshi", "sauce", "sausage", "save", "say",
+  "scale", "scan", "scare", "scatter", "scene", "scheme", "school", "science",
+  "scissors", "scorpion", "scout", "scrap", "screen", "script", "scrub", "sea",
+  "search", "season", "seat", "second", "secret", "section", "security", "seed",
+  "seek", "segment", "select", "sell", "seminar", "senior", "sense", "sentence",
+  "series", "service", "session", "settle", "setup", "seven", "shadow", "shaft",
+  "shallow", "share", "shed", "shell", "sheriff", "shield", "shift", "shine",
+  "ship", "shiver", "shock", "shoe", "shoot", "shop", "short", "shoulder",
+  "shove", "shrimp", "shrug", "shuffle", "shy", "sibling", "sick", "side",
+  "siege", "sight", "sign", "silent", "silk", "silly", "silver", "similar",
+  "simple", "since", "sing", "siren", "sister", "situate", "six", "size",
+  "skate", "sketch", "ski", "skill", "skin", "skirt", "skull", "slab",
+  "slam", "sleep", "slender", "slice", "slide", "slight", "slim", "slogan",
+  "slot", "slow", "slush", "small", "smart", "smile", "smoke", "smooth",
+  "snack", "snake", "snap", "sniff", "snow", "soap", "soccer", "social",
+  "sock", "soda", "soft", "solar", "soldier", "solid", "solution", "solve",
+  "someone", "song", "soon", "sorry", "sort", "soul", "sound", "soup",
+  "source", "south", "space", "spare", "spatial", "spawn", "speak", "special",
+  "speed", "spell", "spend", "sphere", "spice", "spider", "spike", "spin",
+  "spirit", "split", "spoil", "sponsor", "spoon", "sport", "spot", "spray",
+  "spread", "spring", "spy", "square", "squeeze", "squirrel", "stable", "stadium",
+  "staff", "stage", "stairs", "stamp", "stand", "start", "state", "stay",
+  "steak", "steel", "stem", "step", "stereo", "stick", "still", "sting",
+  "stock", "stomach", "stone", "stool", "story", "stove", "strategy", "street",
+  "strike", "strong", "struggle", "student", "stuff", "stumble", "style", "subject",
+  "submit", "subway", "success", "such", "sudden", "suffer", "sugar", "suggest",
+  "suit", "summer", "sun", "sunny", "sunset", "super", "supply", "supreme",
+  "sure", "surface", "surge", "surprise", "surround", "survey", "suspect", "sustain",
+  "swallow", "swamp", "swap", "swarm", "swear", "sweet", "swift", "swim",
+  "swing", "switch", "sword", "symbol", "symptom", "syrup", "system", "table",
+  "tackle", "tag", "tail", "talent", "talk", "tank", "tape", "target",
+  "task", "taste", "tattoo", "taxi", "teach", "team", "tell", "ten",
+  "tenant", "tennis", "tent", "term", "test", "text", "thank", "that",
+  "theme", "then", "theory", "there", "they", "thing", "this", "thought",
+  "three", "thrive", "throw", "thumb", "thunder", "ticket", "tide", "tiger",
+  "tilt", "timber", "time", "tiny", "tip", "tired", "tissue", "title",
+  "toast", "tobacco", "today", "toddler", "toe", "together", "toilet", "token",
+  "tomato", "tomorrow", "tone", "tongue", "tonight", "tool", "tooth", "top",
+  "topic", "topple", "torch", "tornado", "tortoise", "toss", "total", "tourist",
+  "toward", "tower", "town", "toy", "track", "trade", "traffic", "tragic",
+  "train", "transfer", "trap", "trash", "travel", "tray", "treat", "tree",
+  "trend", "trial", "tribe", "trick", "trigger", "trim", "trip", "trophy",
+  "trouble", "truck", "true", "truly", "trumpet", "trust", "truth", "try",
+  "tube", "tuition", "tumble", "tuna", "tunnel", "turkey", "turn", "turtle",
+  "twelve", "twenty", "twice", "twin", "twist", "two", "type", "typical",
+  "ugly", "umbrella", "unable", "unaware", "uncle", "uncover", "under", "undo",
+  "unfair", "unfold", "unhappy", "uniform", "unique", "unit", "universe", "unknown",
+  "unlock", "until", "unusual", "unveil", "update", "upgrade", "uphold", "upon",
+  "upper", "upset", "urban", "urge", "usage", "use", "used", "useful",
+  "useless", "usual", "utility", "vacant", "vacuum", "vague", "valid", "valley",
+  "valve", "van", "vanish", "vapor", "various", "vast", "vault", "vehicle",
+  "velvet", "vendor", "venture", "venue", "verb", "verify", "version", "very",
+  "vessel", "veteran", "viable", "vibrant", "vicious", "victory", "video", "view",
+  "village", "vintage", "violin", "virtual", "virus", "visa", "visit", "visual",
+  "vital", "vivid", "vocal", "voice", "void", "volcano", "volume", "vote",
+  "voyage", "wage", "wagon", "wait", "walk", "wall", "walnut", "want",
+  "warfare", "warm", "warrior", "wash", "wasp", "waste", "water", "wave",
+  "way", "wealth", "weapon", "wear", "weasel", "weather", "web", "wedding",
+  "weekend", "weird", "welcome", "west", "wet", "whale", "what", "wheat",
+  "wheel", "when", "where", "whip", "whisper", "wide", "width", "wife",
+  "wild", "will", "win", "window", "wine", "wing", "wink", "winner",
+  "winter", "wire", "wisdom", "wise", "wish", "witness", "wolf", "woman",
+  "wonder", "wood", "wool", "word", "work", "world", "worry", "worth",
+  "wrap", "wreck", "wrestle", "wrist", "write", "wrong", "yard", "year",
+  "yellow", "you", "young", "youth", "zebra", "zero", "zone", "zoo",
+];
+
+module.exports = { BIP39_ENGLISH_WORDLIST };

package/src/cli.js

@@ -150,13 +150,19 @@ Scan options:
                           similar characters (0/O, Y/*) can be misread,
                           which breaks an exact-format match, so this is
                           best-effort additional coverage, not a guarantee.
-  --include-pii           also scan for PII: US Social Security Numbers
-                          (dashed format only), credit card numbers
-                          (Luhn-validated), and IBANs (checksum-validated).
-                          A different RISK CATEGORY, not a lower confidence
-                          bar -- residoo is deliberately credentials-only
-                          by default. Deliberately excludes bare email/
-                          phone (too common in ordinary text to meet this
+  --include-pii           also scan for PII and adjacent secrets: US Social
+                          Security Numbers (dashed format only), credit
+                          card numbers (Luhn-validated), IBANs (checksum-
+                          validated), and crypto wallet seed phrases
+                          (BIP-39, SHA-256-checksum-validated -- a
+                          CREDENTIAL, not personal data, kept in this flag
+                          rather than a new one to avoid flag proliferation
+                          for the same "opt in, then checksum-validate"
+                          shape). A different RISK CATEGORY, not a lower
+                          confidence bar -- residoo is deliberately
+                          credentials-only by default. Deliberately
+                          excludes bare email/phone (too common in
+                          ordinary text to meet this
                           project's own high-confidence bar even opt-in).
 
 Watch:
@@ -227,22 +233,20 @@ Cred:
   tool, present only when RESIDOO_CRED_ALLOWED_COMMANDS is configured.
 
 Guard:
-  residoo guard             one binary, two Claude Code hooks, dispatched on
-                          the payload's own hook_event_name:
+  residoo guard             one binary, three Claude Code hooks, dispatched
+                          on the payload's own hook_event_name:
 
                           PreToolUse blocks an obviously-sensitive file read
                           (.env, id_rsa, .aws/credentials, and similar)
                           before it can be written to the session
-                          transcript at all. Narrower than it sounds:
-                          Claude Code's hooks API can see a proposed Bash
-                          command or Read path before it runs, but never
-                          the command's OUTPUT, so this alone cannot catch
-                          a secret typed into a prompt or one arriving
-                          through an unrelated command's output.
-
-                          UserPromptSubmit closes exactly that gap: it
-                          checks the user's own typed prompt against
-                          residoo's 79 high-confidence rules (never
+                          transcript at all. Narrower than it sounds on its
+                          own: this only sees a proposed Bash command or
+                          Read path before it runs, based on WHAT you're
+                          about to touch, not what actually comes back.
+
+                          UserPromptSubmit closes the "typed into a prompt"
+                          gap: it checks the user's own typed prompt against
+                          residoo's 84 high-confidence rules (never
                           --verify, never --ocr -- this hook has no matcher
                           and fires on every single prompt, so it must stay
                           fast) and can block it before Claude processes it
@@ -258,15 +262,34 @@ Guard:
                           consistent with this hook never blocking on
                           anything it doesn't recognize.
 
+                          PostToolUse closes the "arriving through a
+                          command's output" gap for Bash specifically: it
+                          scans the command's actual stdout/stderr against
+                          the same 84 rules and, if one matches, replaces
+                          the output with a redacted version before Claude
+                          ever sees it (Claude Code's own updatedToolOutput
+                          decision field). Bash only, disclosed rather than
+                          silently partial: every other built-in tool's
+                          exact output shape isn't documented precisely
+                          enough to reconstruct a replacement safely, and a
+                          wrong shape is silently ignored by Claude Code,
+                          not reported as a failure. The command has
+                          already run by this point -- this cannot undo a
+                          file write or network call, only keep the raw
+                          value out of the model's context.
+
                           scan/watch/mcp remain the real safety net either
                           way -- this is prevention on top of detection,
-                          not a replacement for it. Add both to
+                          not a replacement for it. Add all three to
                           .claude/settings.json:
                             {"hooks":{
                               "PreToolUse":[{"matcher":"Bash|Read",
                                 "hooks":[{"type":"command",
                                 "command":"residoo guard"}]}],
                               "UserPromptSubmit":[{"hooks":[{"type":"command",
+                                "command":"residoo guard"}]}],
+                              "PostToolUse":[{"matcher":"Bash",
+                                "hooks":[{"type":"command",
                                 "command":"residoo guard"}]}]}}
 
 Rotation:

package/src/guard.js

@@ -1,7 +1,7 @@
 "use strict";
 
 /**
- * `residoo guard`: two Claude Code hooks in one binary, dispatched on the
+ * `residoo guard`: three Claude Code hooks in one binary, dispatched on the
  * payload's own `hook_event_name` field.
  *
  * PreToolUse blocks an obviously-sensitive file read before it happens,
@@ -11,14 +11,18 @@
  * from leaking": Claude Code's hooks API gives a PreToolUse hook the
  * PROPOSED tool input (a Bash command string, a Read file_path) before the
  * tool runs, and lets it deny the call outright -- but it never sees the
- * tool's OUTPUT, and by the time a PostToolUse hook fires, that output is
- * already committed to the transcript and can no longer be redacted. There
- * is no documented hook mechanism for "let the read happen, but strip the
- * secret out of what the model sees." So this can only block INPUT that
- * matches a known-sensitive file path pattern (.env, id_rsa, .aws/credentials,
- * and similar) -- it cannot catch a secret typed directly into a prompt, a
- * secret arriving in the output of an otherwise-unremarkable command
- * (curl, a build log), or any file path this pattern list does not name.
+ * tool's OUTPUT. So on its own, this can only block INPUT that matches a
+ * known-sensitive file path pattern (.env, id_rsa, .aws/credentials, and
+ * similar) -- it cannot catch a secret typed directly into a prompt, or one
+ * arriving in the output of an otherwise-unremarkable command (curl, `git
+ * log`, a build log), or any file path this pattern list does not name.
+ * UserPromptSubmit (below) closes the first gap; PostToolUse (below) closes
+ * the second, corrected from an earlier version of this comment that
+ * called it uncatchable -- Claude Code's own `updatedToolOutput` decision
+ * field (confirmed directly against code.claude.com/docs/en/hooks, not
+ * assumed) can in fact replace what the model sees, discovered during a
+ * later competitive-research pass after GitGuardian's ggshield was found to
+ * already scan tool output at this exact stage.
  *
  * UserPromptSubmit closes exactly the "typed directly into a prompt" gap
  * named above: Claude Code's own docs (code.claude.com/docs/en/hooks,
@@ -204,8 +208,86 @@ function evaluatePromptText(promptText) {
 }
 
 /**
- * Writes one structured audit line to stderr for a block decision --
- * CONTRIBUTING.md's own hard rule (rule 3) names `~/.residoo/rotations.json`
+ * Redacts every high-confidence match in `text`, tracking the first REAL
+ * (non-suppressed) hit for the audit trail/preview. Same suppression rule
+ * as evaluatePromptText (a documented vendor-example key or an obvious
+ * zero-entropy placeholder is never redacted) and the same rule set
+ * (PROMPT_GUARD_RULES) -- one bar for everything this module scans text
+ * content with, whether that content is a typed prompt or a command's
+ * output. `String.prototype.replace` with each rule's own global regex
+ * redacts every occurrence in one pass per rule; a value already inside a
+ * PREVIOUS rule's redaction (unlikely given how distinct these vendor
+ * prefixes are, but not impossible) is walked past unchanged rather than
+ * double-redacted, since only literal ORIGINAL text can still match a
+ * pattern from patterns.js.
+ */
+function redactSecretsInText(text) {
+  if (typeof text !== "string" || !text) return { text: typeof text === "string" ? text : "", hit: null };
+  let result = text;
+  let hit = null;
+  for (const rule of PROMPT_GUARD_RULES) {
+    rule.re.lastIndex = 0;
+    result = result.replace(rule.re, (match) => {
+      if (VENDOR_EXAMPLE_VALUES.has(match) || zeroEntropyTail(match)) return match;
+      if (!hit) hit = { label: rule.label, preview: redact(match) };
+      return redact(match);
+    });
+  }
+  return { text: result, hit };
+}
+
+/**
+ * Pure decision function: given a PostToolUse hook payload's tool_name and
+ * tool_response, decide whether to redact. No I/O, fully unit-testable.
+ *
+ * Bash only, and stated why rather than left implicit: Claude Code's own
+ * docs (code.claude.com/docs/en/hooks, "PostToolUse decision control",
+ * fetched directly) state `updatedToolOutput` "must match the tool's
+ * output shape" and "a value that doesn't match the tool's output schema
+ * is ignored and the original output is used" -- a SILENT no-op, not an
+ * error residoo could detect and report. Bash's shape ({stdout, stderr,
+ * interrupted, isImage}) is the one built-in tool output shape those same
+ * docs actually publish; every other built-in tool's tool_response shape
+ * is not documented at this level of precision, so reconstructing one
+ * would risk exactly the silent-no-op failure this project's own
+ * discipline exists to avoid. A stated, narrow scope limit, not full
+ * "every tool's output" coverage -- and still a real, new defense layer:
+ * PreToolUse's matchSensitivePath blocks based on WHAT you're about to
+ * read (a path), this blocks based on WHAT ACTUALLY CAME BACK (content),
+ * catching a secret in `git log`, `env`, a build log, or any other Bash
+ * output PreToolUse's path-based check was never going to see coming.
+ *
+ * The tool has ALREADY run by the time this fires (Claude Code's own docs,
+ * same section) -- this cannot undo the read/write/network call the
+ * command made, and does not try to. It only keeps the raw value out of
+ * the model's context (and so out of the transcript this project's own
+ * `scan` exists to check), a narrower guarantee than PreToolUse's denial,
+ * disclosed as such rather than oversold.
+ */
+function evaluatePostToolUse(toolName, toolResponse) {
+  if (toolName !== "Bash" || !toolResponse || typeof toolResponse !== "object") {
+    return { act: false, label: null, preview: null, updatedToolOutput: null };
+  }
+  const stdout = redactSecretsInText(toolResponse.stdout);
+  const stderr = redactSecretsInText(toolResponse.stderr);
+  const hit = stdout.hit || stderr.hit;
+  if (!hit) return { act: false, label: null, preview: null, updatedToolOutput: null };
+  return {
+    act: true,
+    label: hit.label,
+    preview: hit.preview,
+    updatedToolOutput: {
+      stdout: stdout.text,
+      stderr: stderr.text,
+      interrupted: !!toolResponse.interrupted,
+      isImage: !!toolResponse.isImage,
+    },
+  };
+}
+
+/**
+ * Writes one structured audit line to stderr for a block OR redact decision
+ * -- CONTRIBUTING.md's own hard rule (rule 3) names `~/.residoo/rotations.json`
  * as "the only file residoo ever writes outside an explicit --seal...
  * nothing else may claim this carve-out," so this is NOT a new file, the
  * same choice `cred`'s own audit trail already made for the same reason
@@ -213,28 +295,45 @@ function evaluatePromptText(promptText) {
  * hook's own stderr at launch if you want it kept, same as `cred`.
  * Never the raw matched value -- `preview` is already redact()'d by the
  * caller (rule 4: no raw value in any log line, ever), and PreToolUse
- * decisions carry no value at all, only a path-pattern label.
+ * decisions carry no value at all, only a path-pattern label. `decision`
+ * defaults to "block" (every call site before PostToolUse existed) --
+ * PostToolUse passes "redact" since nothing is actually blocked there, the
+ * tool already ran; the log should say what really happened.
  */
-function logAuditLine(errOutput, { event, label, preview, sessionId, cwd }) {
+function logAuditLine(errOutput, { event, label, preview, sessionId, cwd, decision = "block" }) {
   try {
     errOutput.write(JSON.stringify({
-      ts: new Date().toISOString(), tool: "residoo guard", event, decision: "block",
+      ts: new Date().toISOString(), tool: "residoo guard", event, decision,
       label, ...(preview ? { preview } : {}), sessionId: sessionId || null, cwd: cwd || null,
     }) + "\n");
   } catch { /* stderr write failing is never a reason to fail the hook decision itself */ }
 }
 
 /**
- * Reads one PreToolUse OR UserPromptSubmit hook payload from `input`
- * (default stdin) -- distinguished by the payload's own `hook_event_name`
- * common field, a single binary handling both the way Claude Code's own
- * hook registration allows -- decides, and writes the hook's own JSON
- * response protocol to `output` (default stdout) -- exit code is the
- * caller's job (bin/residoo.js), this returns the intended process exit
- * code instead of calling process.exit itself, matching every other run*
- * function in cli.js. Every BLOCK decision also gets one structured line
- * on `errOutput` (default stderr) -- see logAuditLine's own docstring for
- * why stderr, never a file.
+ * Reads one PreToolUse, UserPromptSubmit, OR PostToolUse hook payload from
+ * `input` (default stdin) -- distinguished by the payload's own
+ * `hook_event_name` common field, a single binary handling all three the
+ * way Claude Code's own hook registration allows -- decides, and writes
+ * the hook's own JSON response protocol to `output` (default stdout) --
+ * exit code is the caller's job (bin/residoo.js), this returns the
+ * intended process exit code instead of calling process.exit itself,
+ * matching every other run* function in cli.js. Every BLOCK or REDACT
+ * decision also gets one structured line on `errOutput` (default stderr)
+ * -- see logAuditLine's own docstring for why stderr, never a file.
+ *
+ * The final `hook_event_name !== "PreToolUse"` guard fixes a real latent
+ * bug, not a hypothetical one: before PostToolUse existed here, anything
+ * OTHER than UserPromptSubmit fell through unconditionally to
+ * evaluateToolInput -- harmless while only PreToolUse and UserPromptSubmit
+ * were ever registered, but a PostToolUse payload also carries a
+ * `tool_input` field (Claude Code's own docs confirm both `tool_input` and
+ * `tool_response` are present), so without this guard a PostToolUse event
+ * would have been silently re-evaluated as a PreToolUse decision and could
+ * have emitted a `permissionDecision: "deny"` response for a tool call
+ * that had already finished executing -- a response Claude Code has no
+ * defined behavior for. Explicit is safer than "everything else falls
+ * through," the same fail-safe posture this whole module already commits
+ * to elsewhere.
  */
 async function runGuard({ input = process.stdin, output = process.stdout, errOutput = process.stderr } = {}) {
   const chunks = [];
@@ -266,6 +365,24 @@ async function runGuard({ input = process.stdin, output = process.stdout, errOut
     return 0;
   }
 
+  if (payload.hook_event_name === "PostToolUse") {
+    const decision = evaluatePostToolUse(payload.tool_name, payload.tool_response);
+    if (!decision.act) return 0;
+    logAuditLine(errOutput, {
+      event: "PostToolUse", label: decision.label, preview: decision.preview,
+      sessionId: payload.session_id, cwd: payload.cwd, decision: "redact",
+    });
+    output.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PostToolUse",
+        updatedToolOutput: decision.updatedToolOutput,
+      },
+    }) + "\n");
+    return 0;
+  }
+
+  if (payload.hook_event_name !== "PreToolUse") return 0;
+
   const decision = evaluateToolInput(payload.tool_name, payload.tool_input);
   if (!decision.block) return 0;
 
@@ -283,4 +400,7 @@ async function runGuard({ input = process.stdin, output = process.stdout, errOut
   return 0;
 }
 
-module.exports = { evaluateToolInput, matchSensitivePath, evaluatePromptText, runGuard, SENSITIVE_PATH_PATTERNS };
+module.exports = {
+  evaluateToolInput, matchSensitivePath, evaluatePromptText, evaluatePostToolUse,
+  runGuard, SENSITIVE_PATH_PATTERNS,
+};

package/src/integrity.js

@@ -677,6 +677,79 @@ function checkIntegrity({ home = os.homedir(), cwd = process.cwd(), projectMode
     }
   }
 
+  // ---- 5. credential-vault file permissions (HOME only, POSIX only) ------
+  // GitGuardian's "State of Secrets Sprawl 2026" (blog.gitguardian.com,
+  // published 2026-03-17) found 24,008 unique secrets in MCP-related config
+  // files on public GitHub, 8.8% of them still live -- these files
+  // routinely hold real, working credentials. This does not scan their
+  // CONTENT: the files below are the exact "credential VAULTS ... deliberately
+  // NOT read" set from agent-configs.js's own header comment, files whose
+  // whole documented job is holding the user's own keys/tokens -- reporting
+  // their content re-reports what the user put there on purpose. What's
+  // checked instead is narrower and complementary: whether the file's own OS
+  // permission bits leak that live credential to every other account on the
+  // machine. Anthropic's own docs (code.claude.com/docs/en/authentication,
+  // "Credential management", fetched 2026-09-04) state Claude Code writes
+  // .credentials.json with file mode 0600 on Linux and as the macOS
+  // Keychain-write-failure fallback, and that Windows inherits its user
+  // profile directory's own access controls. Kiro's own security guidance
+  // separately recommends "chmod 600" on its global mcp.json -- the
+  // vendor's own admission it holds secrets (already cited in
+  // agent-configs.js). Nothing here disputes that these tools do the right
+  // thing by default; the point is drift AFTER that -- a WSL DrvFs mount, a
+  // naive backup restore, or a shared-volume container mount can each
+  // silently widen a file's mode without the tool that wrote it ever
+  // knowing, the same way SSH itself checks id_rsa's permissions rather
+  // than trusting whoever created it. Windows is skipped entirely, not
+  // approximated: Node's fs.Stats.mode on Windows does not reflect NTFS
+  // ACLs, so a POSIX-style bit check there would be meaningless rather than
+  // merely imprecise. Project mode is skipped too -- none of these are ever
+  // project-scoped files by any vendor's own design, so there is no
+  // project-relative equivalent to check.
+  if (!projectMode && process.platform !== "win32") {
+    const geminiDir = process.env.GEMINI_CLI_HOME
+      ? path.join(process.env.GEMINI_CLI_HOME, ".gemini")
+      : path.join(home, ".gemini");
+    const credentialVaultFiles = [
+      {
+        file: path.join(process.env.CLAUDE_CONFIG_DIR || path.join(home, ".claude"), ".credentials.json"),
+        note: "Claude Code's OAuth login (code.claude.com/docs/en/authentication documents file mode 0600)",
+      },
+      {
+        file: path.join(process.env.CODEX_HOME || path.join(home, ".codex"), "auth.json"),
+        note: "Codex CLI's own auth store",
+      },
+      { file: path.join(geminiDir, "oauth_creds.json"), note: "Gemini CLI's own OAuth store" },
+      { file: path.join(geminiDir, ".env"), note: "Gemini CLI's own credential env file" },
+      {
+        file: path.join(home, ".kiro", "settings", "mcp.json"),
+        note: "Kiro's own security guidance recommends chmod 600 on this file",
+      },
+    ];
+    for (const { file, note } of credentialVaultFiles) {
+      const r = path.resolve(file);
+      if (seen.has(r)) continue;
+      seen.add(r);
+      let stat;
+      try { stat = fs.statSync(file); }
+      catch (err) {
+        mark(file, err && err.code === "ENOENT" ? "absent" : "unreadable");
+        if (!(err && err.code === "ENOENT")) {
+          add("warn", "unreadable-config", file, "credential file exists but its permissions could not be checked (stat failed): unverified, not clean");
+        }
+        continue;
+      }
+      mark(file, "checked");
+      const openBits = stat.mode & 0o077;
+      if (openBits !== 0) {
+        const octal = (stat.mode & 0o777).toString(8).padStart(3, "0");
+        const shown = display(file);
+        add("warn", "insecure-credential-permissions", file,
+          `${note}; current mode ${octal} grants group and/or other accounts on this machine access to a live credential. Fix: chmod 600 "${shown}"`);
+      }
+    }
+  }
+
   return {
     findings,
     filesChecked,

package/src/mcpTools.js

@@ -365,7 +365,7 @@ function buildTools({ sources }) {
         projectDir: { type: "string", description: "Absolute path to a project/repo directory to scan instead of the machine-wide transcript stores (same as `residoo scan --project <dir>`). Omit for the default machine-wide scan." },
         includeNoisy: { type: "boolean", default: false, description: "Also run residoo's two low-confidence heuristic rules (generic password/secret assignments) -- catches more, false-positives more. Off by default." },
         includeSuppressed: { type: "boolean", default: false, description: "Include matches normally hidden because they look like vendor-documented example values or placeholder text. Off by default." },
-        includePii: { type: "boolean", default: false, description: "Also scan for PII (US Social Security Numbers, Luhn-validated credit card numbers, checksum-validated IBANs) -- a different risk category from a credential, not a lower confidence bar. Off by default; residoo is deliberately credentials-only otherwise." },
+        includePii: { type: "boolean", default: false, description: "Also scan for PII and adjacent secrets (US Social Security Numbers, Luhn-validated credit card numbers, checksum-validated IBANs, BIP-39 checksum-validated crypto wallet seed phrases) -- a different risk category from a vendor credential, not a lower confidence bar. Off by default; residoo is deliberately credentials-only otherwise." },
         maxEntries: { type: "integer", minimum: 1, maximum: 200, default: 25, description: "Cap on distinct findings returned in full detail, pending-first. Counts in the response are always exact even when the entry list is truncated." },
       },
       required: [],

package/src/pii.js

@@ -1,12 +1,16 @@
 "use strict";
 
+const crypto = require("crypto");
+const { BIP39_ENGLISH_WORDLIST } = require("./bip39wordlist");
+
 /**
- * Opt-in PII detection (--include-pii). Named directly by this session's
- * own competitive research into funded AI-DLP vendors (Strac, Cyberhaven,
- * Nightfall) as one of the few concrete, buildable things residoo could
- * adopt without becoming a hosted service -- and independently
- * corroborated by two direct competitors' own shipped detector lists
- * (DidILeak, Medusa), both of which cover PII alongside credentials.
+ * Opt-in PII-and-adjacent detection (--include-pii). Named directly by this
+ * session's own competitive research into funded AI-DLP vendors (Strac,
+ * Cyberhaven, Nightfall) as one of the few concrete, buildable things
+ * residoo could adopt without becoming a hosted service -- and
+ * independently corroborated by two direct competitors' own shipped
+ * detector lists (DidILeak, Medusa), both of which cover PII alongside
+ * credentials.
  *
  * Kept entirely separate from PATTERNS/NOISY_PATTERNS in patterns.js on
  * purpose: residoo's stated identity elsewhere in this project is
@@ -17,19 +21,34 @@
  * for a different reason (a different RISK CATEGORY, not a lower
  * confidence bar).
  *
- * Only three detectors, deliberately: DidILeak's own shipped list also
+ * "PII" is the name of the flag, not a perfectly accurate label for
+ * everything in it: a BIP-39 crypto wallet seed phrase (added after a
+ * competitive-feature-parity pass found AgentSweep ships seed-phrase
+ * detection and residoo didn't) is a CREDENTIAL, not personal data --
+ * arguably it belongs in the default, always-on set the way a vendor API
+ * key does. It lives here instead for the same architectural reason as
+ * the other three: no single-vendor prefix to anchor on (a seed phrase is
+ * 12-24 plain English words, structurally unlike every PATTERNS.js rule),
+ * and a real, own risk-category case for asking first, the same
+ * "different shape, not a lower bar" framing already applied to SSN/card/
+ * IBAN. Kept in the same flag rather than a new one to avoid flag
+ * proliferation for what is, mechanically, the same "opt in, then
+ * checksum-validate before ever reporting" pattern.
+ *
+ * Four detectors, deliberately not more: DidILeak's own shipped list also
  * includes bare email addresses and phone numbers, but both are far too
  * common in ordinary, non-sensitive text (a support email in a comment, a
  * phone number in an error message) to meet this project's own
  * "high-confidence only, a security tool that cries wolf gets
  * uninstalled" bar, opt-in or not -- DidILeak itself rates them "low"/
- * "info" severity for the same reason. The three included here all have a
+ * "info" severity for the same reason. Every detector here instead has a
  * REAL mathematical validator, not just a shape match, which is what
  * keeps false-positive risk low enough to ship even as an additive
- * category: Luhn for card numbers, ISO 7064 MOD 97-10 for IBAN, and the
- * Social Security Administration's own published invalid-range rules for
- * SSNs (no checksum exists for SSNs, hence "medium" confidence there, not
- * "high" -- disclosed, not smoothed over).
+ * category: Luhn for card numbers, ISO 7064 MOD 97-10 for IBAN, the BIP-39
+ * spec's own SHA-256 checksum for seed phrases, and the Social Security
+ * Administration's own published invalid-range rules for SSNs (no
+ * checksum exists for SSNs, hence "medium" confidence there, not "high"
+ * -- disclosed, not smoothed over).
  */
 
 /** Luhn checksum (ISO/IEC 7812-1): the standard validator for payment card numbers. `digits` must already be digits-only. */
@@ -72,6 +91,75 @@ function ibanValid(iban) {
   return mod === 1;
 }
 
+const BIP39_INDEX = new Map(BIP39_ENGLISH_WORDLIST.map((w, i) => [w, i]));
+const BIP39_VALID_LENGTHS = new Set([12, 15, 18, 21, 24]);
+
+/**
+ * BIP-39 mnemonic checksum (github.com/bitcoin/bips/blob/master/bip-0039.mediawiki,
+ * fetched directly, cross-checked against the spec's own canonical all-zero
+ * test vector -- "abandon" x11 + "about" -- rather than trusted from memory):
+ * a mnemonic of MS words (12/15/18/21/24) encodes ENT bits of entropy plus a
+ * CS = ENT/32-bit checksum, each word an 11-bit index into the wordlist. The
+ * checksum is the first CS bits of SHA-256(entropy); this recomputes it and
+ * compares. English wordlist only -- BIP-39 also defines Japanese, Korean,
+ * Spanish, Chinese, French, Italian, Czech, and Portuguese wordlists this
+ * does not check, a disclosed scope limit rather than a silent one, the same
+ * shape as ibanValid's own per-country-length gap above.
+ *
+ * BigInt throughout: a 24-word phrase packs 264 bits, far past a safe JS
+ * integer, and a mis-sized intermediate here would silently corrupt every
+ * checksum it touches rather than throw.
+ */
+function bip39ChecksumValid(words) {
+  if (!Array.isArray(words) || !BIP39_VALID_LENGTHS.has(words.length)) return false;
+  const indices = [];
+  for (const w of words) {
+    const idx = BIP39_INDEX.get(w);
+    if (idx === undefined) return false;
+    indices.push(idx);
+  }
+  const csBits = words.length / 3; // MS/3, derived from CS=ENT/32 and MS=(ENT+CS)/11
+  const entBits = words.length * 11 - csBits;
+
+  let combined = 0n;
+  for (const idx of indices) combined = (combined << 11n) | BigInt(idx);
+
+  const checksumMask = (1n << BigInt(csBits)) - 1n;
+  const checksumBits = combined & checksumMask;
+  const entropyBits = combined >> BigInt(csBits);
+
+  const entHex = entropyBits.toString(16).padStart(entBits / 8 * 2, "0");
+  const hash = crypto.createHash("sha256").update(Buffer.from(entHex, "hex")).digest();
+  const hashBits = BigInt("0x" + hash.toString("hex"));
+  const expectedChecksum = (hashBits >> BigInt(256 - csBits)) & checksumMask;
+
+  return checksumBits === expectedChecksum;
+}
+
+/**
+ * A real seed phrase is rarely the WHOLE candidate span: "here's my wallet
+ * seed: <12 words> keep it safe" is a plausible, ordinary way to paste one,
+ * and the candidate regex below (deliberately wide, to not miss a phrase
+ * that isn't sentence-initial) captures the surrounding words too. Slides
+ * every valid length (24 down to 12, longest first so a real 15+-word
+ * phrase is reported whole rather than as a coincidentally-checksum-valid
+ * 12-word prefix of it) across every starting offset in the captured run,
+ * returning the first exact substring whose checksum validates, or null.
+ * O(words x 5) checksum computations worst case -- cheap, since the regex
+ * itself already bounds "words" to at most 100.
+ */
+function findBip39Phrase(candidateRun) {
+  const words = candidateRun.split(" ");
+  for (let start = 0; start < words.length; start++) {
+    for (const len of [24, 21, 18, 15, 12]) {
+      if (start + len > words.length) continue;
+      const slice = words.slice(start, start + len);
+      if (bip39ChecksumValid(slice)) return slice.join(" ");
+    }
+  }
+  return null;
+}
+
 const PII_PATTERNS = [
   // Dashed format only -- a bare 9-digit run is indistinguishable from
   // countless other numbers in a coding-agent transcript (ports, PIDs,
@@ -91,6 +179,21 @@ const PII_PATTERNS = [
   { id: "iban", label: "IBAN (checksum-validated)", confidence: "high",
     re: /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/g,
     validate: (m) => ibanValid(m) },
+  // Candidate: a run of 12-100 lowercase words, single-space-separated (how
+  // a seed phrase actually appears -- pasted as plain text, no punctuation
+  // breaking it up). Deliberately wider than the 12-24 a phrase itself can
+  // be: a real phrase is rarely the WHOLE sentence ("here's my seed: <12
+  // words> keep it safe"), so the candidate must be free to capture
+  // leading/trailing prose too -- findBip39Phrase (below) narrows it back
+  // down. validate() returns the narrowed substring, not a boolean: common
+  // English function words like "the"/"and"/"of"/"is" are NOT in the
+  // 2048-word list (confirmed by direct check against the fetched
+  // wordlist), so ordinary prose almost never survives even the membership
+  // test, let alone the checksum, but the narrowing still matters whenever
+  // it does.
+  { id: "crypto_seed_phrase", label: "Crypto wallet seed phrase (BIP-39, checksum-validated)", confidence: "high",
+    re: /\b[a-z]+(?: [a-z]+){11,99}\b/g,
+    validate: (m) => findBip39Phrase(m) },
 ];
 
-module.exports = { PII_PATTERNS, luhnValid, ibanValid };
+module.exports = { PII_PATTERNS, luhnValid, ibanValid, bip39ChecksumValid, findBip39Phrase };

package/src/rotation.js

@@ -1181,6 +1181,23 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "This passed the real ISO 7064 MOD 97-10 checksum every valid IBAN must satisfy, so it is very unlikely to be a random-looking placeholder.",
   },
+  // Framed like every credential rule above, not like the two PII entries
+  // just above it: unlike an SSN or an IBAN, a seed phrase is a bearer
+  // credential with an actual "rotation" action available -- move the
+  // funds to a new wallet -- so it belongs with "revoke and replace," not
+  // "there is no console for this."
+  crypto_seed_phrase: {
+    label: "Crypto wallet seed phrase (BIP-39, checksum-validated)",
+    consolePath: "No vendor console -- this is a self-custodied wallet's own master key, not an account credential a company can revoke for you.",
+    steps: [
+      "Treat the wallet as fully compromised the moment this leaves your control, even if you don't see funds move immediately -- anyone with the phrase can derive every key and address it controls",
+      "Create a brand-new wallet from a freshly-generated seed phrase, on a device you trust, never by reusing or deriving from the exposed one",
+      "Move all funds and any NFTs/tokens to the new wallet as soon as possible, paying attention to network fees so a move doesn't get front-run",
+      "Update every dApp, exchange, or service that had the old wallet's address on file",
+      "Remove the phrase from the transcript file if it doesn't need to be there -- residoo scan --seal quarantines the whole file without deleting anything, if you want a reversible first step",
+    ],
+    revokeNote: "This passed the real BIP-39 SHA-256 checksum every valid seed phrase must satisfy, so it is very unlikely to be a random-looking placeholder -- treat it as a real, live wallet key until shown otherwise.",
+  },
 
   // ── NOISY_PATTERNS (only reachable via --include-noisy) ───────────────
   generic_password_assignment: {

package/src/scan.js

@@ -609,21 +609,31 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // at all, so this mirrors decodeLine/ocrLine's simpler shape, not
   // matchLine's. `validate` (Luhn, IBAN's MOD 97-10) runs before a
   // candidate is even considered for suppression -- an invalid checksum
-  // is not a "placeholder," it's simply not a match.
+  // is not a "placeholder," it's simply not a match. `validate` may return
+  // `true` (record the regex's own match verbatim -- Luhn/IBAN) or a
+  // narrower STRING (record that instead -- crypto_seed_phrase's
+  // findBip39Phrase, since the regex candidate deliberately over-captures
+  // surrounding prose and the checksum-valid phrase is usually a
+  // sub-string of it, not the whole match).
   const piiLine = (line, file, relFile, lineNo, mtimeMs) => {
     if (!includePii) return;
     for (const rule of PII_PATTERNS) {
       rule.re.lastIndex = 0;
       let m;
       while ((m = rule.re.exec(line)) !== null) {
-        if (rule.validate && !rule.validate(m[0])) continue;
+        let value = m[0];
+        if (rule.validate) {
+          const v = rule.validate(m[0]);
+          if (!v) continue;
+          if (typeof v === "string") value = v;
+        }
         const before = line.slice(Math.max(0, m.index - CONTEXT_WINDOW), m.index);
-        const suppressedReason = suppressionReason(m[0], before, rule.id);
+        const suppressedReason = suppressionReason(value, before, rule.id);
         if (suppressedReason && !includeSuppressed) {
           suppressedCount++;
           continue;
         }
-        record(rule, m[0], relFile, file, lineNo, mtimeMs,
+        record(rule, value, relFile, file, lineNo, mtimeMs,
           suppressedReason ? "low" : rule.confidence, suppressedReason, { pii: true });
       }
     }

package/src/sources/agent-configs.js

@@ -107,6 +107,18 @@ const { createInterface } = require("readline/promises");
  *    (global config; their own security page recommends `chmod 600` on
  *    it, a vendor admission it holds secrets) + named verbatim in JFrog's
  *    Bitwarden-CLI target list.
+ *  - `~/.mcp.json` (bare, directly under HOME, distinct from every
+ *    subdirectory-nested path above) — Visual Studio (the full Windows
+ *    IDE, not VS Code; VS Code's own MCP config is `.vscode/mcp.json`,
+ *    already project-scoped below) documents this exact path as its
+ *    global, all-solutions MCP config: Microsoft's own docs repo
+ *    (github.com/MicrosoftDocs/visualstudio-docs, docs/ide/mcp-servers.md,
+ *    fetched directly), "Serves as a global MCP server configuration for
+ *    a specific user. Adding an MCP server here makes it load for all
+ *    Visual Studio solutions." Visual Studio's remote-MCP OAuth tokens go
+ *    through "the Visual Studio keychain" per the same doc -- an OS-backed
+ *    store, not a plaintext file, so there is no separate credential
+ *    vault to name here the way `.codex/auth.json` needed one.
  *
  * DELIBERATELY NOT READ, and why:
  *  - `~/.claude/projects/**` AS SCAN CONTENT — claude-code.js's territory;
@@ -194,6 +206,7 @@ const CANDIDATES = [
   path.join(GEMINI_DIR, "settings.json"),
   path.join(CODEX_HOME, "config.toml"),
   path.join(KIRO_DIR, "settings", "mcp.json"),
+  path.join(HOME, ".mcp.json"),
 ];
 
 // Configs are KB-scale in every real observation this source's research
@@ -229,7 +242,12 @@ function available() {
     dirExists(CURSOR_DIR) ||
     dirExists(GEMINI_DIR) ||
     dirExists(CODEX_HOME) ||
-    dirExists(KIRO_DIR)
+    dirExists(KIRO_DIR) ||
+    // Visual Studio (the full IDE) has no dedicated root directory the way
+    // every other tool above does -- its one machine-level artifact is this
+    // bare file, so it needs its own direct existence check rather than a
+    // dirExists() on some ~/.visualstudio root that doesn't exist.
+    fileExists(path.join(HOME, ".mcp.json"))
   );
 }
 
@@ -319,6 +337,13 @@ const PROJECT_CONFIG_RELPATHS = [
   ".mcp.json",
   path.join(".claude", "settings.json"),
   path.join(".claude", "settings.local.json"),
+  // Visual Studio's per-solution, VS-only MCP config: Microsoft's own docs
+  // (same source cited for ~/.mcp.json above) list this as a distinct
+  // location from <SOLUTIONDIR>/.mcp.json (source-controlled) --
+  // "Specific to Visual Studio and loads the specified MCP servers only
+  // for a specific user, for the specified solution," living inside the
+  // hidden, not-source-controlled .vs/ folder Visual Studio already owns.
+  path.join(".vs", "mcp.json"),
 ];
 
 // Probe bounds: transcript first-records are KB-scale; 256KB and 20 lines is