residoo 0.16.0 → 0.18.0

package/README.md

@@ -72,14 +72,24 @@ observed, not just documented. All 8, not just the closest one:
 | tool | distinct credentials found | precision | egress during the scan |
 |---|---|---|---|
 | **residoo** | **45/45 (100%)** | **100%** | **none-observed** |
-| agentsweep | 33/42 (79%) | 100% | none-observed |
+| agentsweep | 33/42 (79%) | 89% | none-observed |
 | gitleaks | 32/45 (71%) | 100% | none-observed |
-| betterleaks | 32/45 (71%) | 100% | none-observed |
+| betterleaks | 32/45 (71%) | 95% | none-observed |
 | whatileaked | 28/42 (67%) | 100% | none-observed |
-| kingfisher | 29/45 (64%) | 100% | attempts calls in default mode |
+| kingfisher | 29/45 (64%) | 97% | attempts calls in default mode |
 | trufflehog | 29/45 (64%) | 97% | attempts calls in default mode |
 | detect-secrets | 25/45 (56%) | 2% | attempts calls in default mode |
 
+Precision here counts a flagged vendor-documented example key (a real,
+deliberate suppress-placeholder in the corpus) as a false positive, the
+stricter of the two measures `bench/RESULTS.md` reports throughout —
+several tools above score better on the looser "excluding suppress flags"
+measure (e.g. agentsweep and betterleaks both reach 100% there), but this
+is the one that matches what a user actually experiences: a tool that
+flags AWS's own published example key on every run trains people to
+ignore its output. residoo and gitleaks are the only two tools that hit
+100% either way.
+
 "none-observed" is a measured result, not a default assumption: every run
 sits under a live proxy trap and process-tree polling, and a deliberate
 canary connection is fired and confirmed caught *before* each real

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/bip39wordlist.js

@@ -0,0 +1,270 @@
+"use strict";
+
+/**
+ * The canonical BIP-39 English wordlist (2048 words), verbatim from the
+ * spec's own reference file: github.com/bitcoin/bips, bip-0039/english.txt
+ * (fetched directly, not retyped from memory -- transcription errors here
+ * would silently break every checksum computation in src/pii.js). Order
+ * matters: word N's position in this array IS its 11-bit index per the
+ * spec, so this list must never be re-sorted or edited.
+ */
+const BIP39_ENGLISH_WORDLIST = [
+  "abandon", "ability", "able", "about", "above", "absent", "absorb", "abstract",
+  "absurd", "abuse", "access", "accident", "account", "accuse", "achieve", "acid",
+  "acoustic", "acquire", "across", "act", "action", "actor", "actress", "actual",
+  "adapt", "add", "addict", "address", "adjust", "admit", "adult", "advance",
+  "advice", "aerobic", "affair", "afford", "afraid", "again", "age", "agent",
+  "agree", "ahead", "aim", "air", "airport", "aisle", "alarm", "album",
+  "alcohol", "alert", "alien", "all", "alley", "allow", "almost", "alone",
+  "alpha", "already", "also", "alter", "always", "amateur", "amazing", "among",
+  "amount", "amused", "analyst", "anchor", "ancient", "anger", "angle", "angry",
+  "animal", "ankle", "announce", "annual", "another", "answer", "antenna", "antique",
+  "anxiety", "any", "apart", "apology", "appear", "apple", "approve", "april",
+  "arch", "arctic", "area", "arena", "argue", "arm", "armed", "armor",
+  "army", "around", "arrange", "arrest", "arrive", "arrow", "art", "artefact",
+  "artist", "artwork", "ask", "aspect", "assault", "asset", "assist", "assume",
+  "asthma", "athlete", "atom", "attack", "attend", "attitude", "attract", "auction",
+  "audit", "august", "aunt", "author", "auto", "autumn", "average", "avocado",
+  "avoid", "awake", "aware", "away", "awesome", "awful", "awkward", "axis",
+  "baby", "bachelor", "bacon", "badge", "bag", "balance", "balcony", "ball",
+  "bamboo", "banana", "banner", "bar", "barely", "bargain", "barrel", "base",
+  "basic", "basket", "battle", "beach", "bean", "beauty", "because", "become",
+  "beef", "before", "begin", "behave", "behind", "believe", "below", "belt",
+  "bench", "benefit", "best", "betray", "better", "between", "beyond", "bicycle",
+  "bid", "bike", "bind", "biology", "bird", "birth", "bitter", "black",
+  "blade", "blame", "blanket", "blast", "bleak", "bless", "blind", "blood",
+  "blossom", "blouse", "blue", "blur", "blush", "board", "boat", "body",
+  "boil", "bomb", "bone", "bonus", "book", "boost", "border", "boring",
+  "borrow", "boss", "bottom", "bounce", "box", "boy", "bracket", "brain",
+  "brand", "brass", "brave", "bread", "breeze", "brick", "bridge", "brief",
+  "bright", "bring", "brisk", "broccoli", "broken", "bronze", "broom", "brother",
+  "brown", "brush", "bubble", "buddy", "budget", "buffalo", "build", "bulb",
+  "bulk", "bullet", "bundle", "bunker", "burden", "burger", "burst", "bus",
+  "business", "busy", "butter", "buyer", "buzz", "cabbage", "cabin", "cable",
+  "cactus", "cage", "cake", "call", "calm", "camera", "camp", "can",
+  "canal", "cancel", "candy", "cannon", "canoe", "canvas", "canyon", "capable",
+  "capital", "captain", "car", "carbon", "card", "cargo", "carpet", "carry",
+  "cart", "case", "cash", "casino", "castle", "casual", "cat", "catalog",
+  "catch", "category", "cattle", "caught", "cause", "caution", "cave", "ceiling",
+  "celery", "cement", "census", "century", "cereal", "certain", "chair", "chalk",
+  "champion", "change", "chaos", "chapter", "charge", "chase", "chat", "cheap",
+  "check", "cheese", "chef", "cherry", "chest", "chicken", "chief", "child",
+  "chimney", "choice", "choose", "chronic", "chuckle", "chunk", "churn", "cigar",
+  "cinnamon", "circle", "citizen", "city", "civil", "claim", "clap", "clarify",
+  "claw", "clay", "clean", "clerk", "clever", "click", "client", "cliff",
+  "climb", "clinic", "clip", "clock", "clog", "close", "cloth", "cloud",
+  "clown", "club", "clump", "cluster", "clutch", "coach", "coast", "coconut",
+  "code", "coffee", "coil", "coin", "collect", "color", "column", "combine",
+  "come", "comfort", "comic", "common", "company", "concert", "conduct", "confirm",
+  "congress", "connect", "consider", "control", "convince", "cook", "cool", "copper",
+  "copy", "coral", "core", "corn", "correct", "cost", "cotton", "couch",
+  "country", "couple", "course", "cousin", "cover", "coyote", "crack", "cradle",
+  "craft", "cram", "crane", "crash", "crater", "crawl", "crazy", "cream",
+  "credit", "creek", "crew", "cricket", "crime", "crisp", "critic", "crop",
+  "cross", "crouch", "crowd", "crucial", "cruel", "cruise", "crumble", "crunch",
+  "crush", "cry", "crystal", "cube", "culture", "cup", "cupboard", "curious",
+  "current", "curtain", "curve", "cushion", "custom", "cute", "cycle", "dad",
+  "damage", "damp", "dance", "danger", "daring", "dash", "daughter", "dawn",
+  "day", "deal", "debate", "debris", "decade", "december", "decide", "decline",
+  "decorate", "decrease", "deer", "defense", "define", "defy", "degree", "delay",
+  "deliver", "demand", "demise", "denial", "dentist", "deny", "depart", "depend",
+  "deposit", "depth", "deputy", "derive", "describe", "desert", "design", "desk",
+  "despair", "destroy", "detail", "detect", "develop", "device", "devote", "diagram",
+  "dial", "diamond", "diary", "dice", "diesel", "diet", "differ", "digital",
+  "dignity", "dilemma", "dinner", "dinosaur", "direct", "dirt", "disagree", "discover",
+  "disease", "dish", "dismiss", "disorder", "display", "distance", "divert", "divide",
+  "divorce", "dizzy", "doctor", "document", "dog", "doll", "dolphin", "domain",
+  "donate", "donkey", "donor", "door", "dose", "double", "dove", "draft",
+  "dragon", "drama", "drastic", "draw", "dream", "dress", "drift", "drill",
+  "drink", "drip", "drive", "drop", "drum", "dry", "duck", "dumb",
+  "dune", "during", "dust", "dutch", "duty", "dwarf", "dynamic", "eager",
+  "eagle", "early", "earn", "earth", "easily", "east", "easy", "echo",
+  "ecology", "economy", "edge", "edit", "educate", "effort", "egg", "eight",
+  "either", "elbow", "elder", "electric", "elegant", "element", "elephant", "elevator",
+  "elite", "else", "embark", "embody", "embrace", "emerge", "emotion", "employ",
+  "empower", "empty", "enable", "enact", "end", "endless", "endorse", "enemy",
+  "energy", "enforce", "engage", "engine", "enhance", "enjoy", "enlist", "enough",
+  "enrich", "enroll", "ensure", "enter", "entire", "entry", "envelope", "episode",
+  "equal", "equip", "era", "erase", "erode", "erosion", "error", "erupt",
+  "escape", "essay", "essence", "estate", "eternal", "ethics", "evidence", "evil",
+  "evoke", "evolve", "exact", "example", "excess", "exchange", "excite", "exclude",
+  "excuse", "execute", "exercise", "exhaust", "exhibit", "exile", "exist", "exit",
+  "exotic", "expand", "expect", "expire", "explain", "expose", "express", "extend",
+  "extra", "eye", "eyebrow", "fabric", "face", "faculty", "fade", "faint",
+  "faith", "fall", "false", "fame", "family", "famous", "fan", "fancy",
+  "fantasy", "farm", "fashion", "fat", "fatal", "father", "fatigue", "fault",
+  "favorite", "feature", "february", "federal", "fee", "feed", "feel", "female",
+  "fence", "festival", "fetch", "fever", "few", "fiber", "fiction", "field",
+  "figure", "file", "film", "filter", "final", "find", "fine", "finger",
+  "finish", "fire", "firm", "first", "fiscal", "fish", "fit", "fitness",
+  "fix", "flag", "flame", "flash", "flat", "flavor", "flee", "flight",
+  "flip", "float", "flock", "floor", "flower", "fluid", "flush", "fly",
+  "foam", "focus", "fog", "foil", "fold", "follow", "food", "foot",
+  "force", "forest", "forget", "fork", "fortune", "forum", "forward", "fossil",
+  "foster", "found", "fox", "fragile", "frame", "frequent", "fresh", "friend",
+  "fringe", "frog", "front", "frost", "frown", "frozen", "fruit", "fuel",
+  "fun", "funny", "furnace", "fury", "future", "gadget", "gain", "galaxy",
+  "gallery", "game", "gap", "garage", "garbage", "garden", "garlic", "garment",
+  "gas", "gasp", "gate", "gather", "gauge", "gaze", "general", "genius",
+  "genre", "gentle", "genuine", "gesture", "ghost", "giant", "gift", "giggle",
+  "ginger", "giraffe", "girl", "give", "glad", "glance", "glare", "glass",
+  "glide", "glimpse", "globe", "gloom", "glory", "glove", "glow", "glue",
+  "goat", "goddess", "gold", "good", "goose", "gorilla", "gospel", "gossip",
+  "govern", "gown", "grab", "grace", "grain", "grant", "grape", "grass",
+  "gravity", "great", "green", "grid", "grief", "grit", "grocery", "group",
+  "grow", "grunt", "guard", "guess", "guide", "guilt", "guitar", "gun",
+  "gym", "habit", "hair", "half", "hammer", "hamster", "hand", "happy",
+  "harbor", "hard", "harsh", "harvest", "hat", "have", "hawk", "hazard",
+  "head", "health", "heart", "heavy", "hedgehog", "height", "hello", "helmet",
+  "help", "hen", "hero", "hidden", "high", "hill", "hint", "hip",
+  "hire", "history", "hobby", "hockey", "hold", "hole", "holiday", "hollow",
+  "home", "honey", "hood", "hope", "horn", "horror", "horse", "hospital",
+  "host", "hotel", "hour", "hover", "hub", "huge", "human", "humble",
+  "humor", "hundred", "hungry", "hunt", "hurdle", "hurry", "hurt", "husband",
+  "hybrid", "ice", "icon", "idea", "identify", "idle", "ignore", "ill",
+  "illegal", "illness", "image", "imitate", "immense", "immune", "impact", "impose",
+  "improve", "impulse", "inch", "include", "income", "increase", "index", "indicate",
+  "indoor", "industry", "infant", "inflict", "inform", "inhale", "inherit", "initial",
+  "inject", "injury", "inmate", "inner", "innocent", "input", "inquiry", "insane",
+  "insect", "inside", "inspire", "install", "intact", "interest", "into", "invest",
+  "invite", "involve", "iron", "island", "isolate", "issue", "item", "ivory",
+  "jacket", "jaguar", "jar", "jazz", "jealous", "jeans", "jelly", "jewel",
+  "job", "join", "joke", "journey", "joy", "judge", "juice", "jump",
+  "jungle", "junior", "junk", "just", "kangaroo", "keen", "keep", "ketchup",
+  "key", "kick", "kid", "kidney", "kind", "kingdom", "kiss", "kit",
+  "kitchen", "kite", "kitten", "kiwi", "knee", "knife", "knock", "know",
+  "lab", "label", "labor", "ladder", "lady", "lake", "lamp", "language",
+  "laptop", "large", "later", "latin", "laugh", "laundry", "lava", "law",
+  "lawn", "lawsuit", "layer", "lazy", "leader", "leaf", "learn", "leave",
+  "lecture", "left", "leg", "legal", "legend", "leisure", "lemon", "lend",
+  "length", "lens", "leopard", "lesson", "letter", "level", "liar", "liberty",
+  "library", "license", "life", "lift", "light", "like", "limb", "limit",
+  "link", "lion", "liquid", "list", "little", "live", "lizard", "load",
+  "loan", "lobster", "local", "lock", "logic", "lonely", "long", "loop",
+  "lottery", "loud", "lounge", "love", "loyal", "lucky", "luggage", "lumber",
+  "lunar", "lunch", "luxury", "lyrics", "machine", "mad", "magic", "magnet",
+  "maid", "mail", "main", "major", "make", "mammal", "man", "manage",
+  "mandate", "mango", "mansion", "manual", "maple", "marble", "march", "margin",
+  "marine", "market", "marriage", "mask", "mass", "master", "match", "material",
+  "math", "matrix", "matter", "maximum", "maze", "meadow", "mean", "measure",
+  "meat", "mechanic", "medal", "media", "melody", "melt", "member", "memory",
+  "mention", "menu", "mercy", "merge", "merit", "merry", "mesh", "message",
+  "metal", "method", "middle", "midnight", "milk", "million", "mimic", "mind",
+  "minimum", "minor", "minute", "miracle", "mirror", "misery", "miss", "mistake",
+  "mix", "mixed", "mixture", "mobile", "model", "modify", "mom", "moment",
+  "monitor", "monkey", "monster", "month", "moon", "moral", "more", "morning",
+  "mosquito", "mother", "motion", "motor", "mountain", "mouse", "move", "movie",
+  "much", "muffin", "mule", "multiply", "muscle", "museum", "mushroom", "music",
+  "must", "mutual", "myself", "mystery", "myth", "naive", "name", "napkin",
+  "narrow", "nasty", "nation", "nature", "near", "neck", "need", "negative",
+  "neglect", "neither", "nephew", "nerve", "nest", "net", "network", "neutral",
+  "never", "news", "next", "nice", "night", "noble", "noise", "nominee",
+  "noodle", "normal", "north", "nose", "notable", "note", "nothing", "notice",
+  "novel", "now", "nuclear", "number", "nurse", "nut", "oak", "obey",
+  "object", "oblige", "obscure", "observe", "obtain", "obvious", "occur", "ocean",
+  "october", "odor", "off", "offer", "office", "often", "oil", "okay",
+  "old", "olive", "olympic", "omit", "once", "one", "onion", "online",
+  "only", "open", "opera", "opinion", "oppose", "option", "orange", "orbit",
+  "orchard", "order", "ordinary", "organ", "orient", "original", "orphan", "ostrich",
+  "other", "outdoor", "outer", "output", "outside", "oval", "oven", "over",
+  "own", "owner", "oxygen", "oyster", "ozone", "pact", "paddle", "page",
+  "pair", "palace", "palm", "panda", "panel", "panic", "panther", "paper",
+  "parade", "parent", "park", "parrot", "party", "pass", "patch", "path",
+  "patient", "patrol", "pattern", "pause", "pave", "payment", "peace", "peanut",
+  "pear", "peasant", "pelican", "pen", "penalty", "pencil", "people", "pepper",
+  "perfect", "permit", "person", "pet", "phone", "photo", "phrase", "physical",
+  "piano", "picnic", "picture", "piece", "pig", "pigeon", "pill", "pilot",
+  "pink", "pioneer", "pipe", "pistol", "pitch", "pizza", "place", "planet",
+  "plastic", "plate", "play", "please", "pledge", "pluck", "plug", "plunge",
+  "poem", "poet", "point", "polar", "pole", "police", "pond", "pony",
+  "pool", "popular", "portion", "position", "possible", "post", "potato", "pottery",
+  "poverty", "powder", "power", "practice", "praise", "predict", "prefer", "prepare",
+  "present", "pretty", "prevent", "price", "pride", "primary", "print", "priority",
+  "prison", "private", "prize", "problem", "process", "produce", "profit", "program",
+  "project", "promote", "proof", "property", "prosper", "protect", "proud", "provide",
+  "public", "pudding", "pull", "pulp", "pulse", "pumpkin", "punch", "pupil",
+  "puppy", "purchase", "purity", "purpose", "purse", "push", "put", "puzzle",
+  "pyramid", "quality", "quantum", "quarter", "question", "quick", "quit", "quiz",
+  "quote", "rabbit", "raccoon", "race", "rack", "radar", "radio", "rail",
+  "rain", "raise", "rally", "ramp", "ranch", "random", "range", "rapid",
+  "rare", "rate", "rather", "raven", "raw", "razor", "ready", "real",
+  "reason", "rebel", "rebuild", "recall", "receive", "recipe", "record", "recycle",
+  "reduce", "reflect", "reform", "refuse", "region", "regret", "regular", "reject",
+  "relax", "release", "relief", "rely", "remain", "remember", "remind", "remove",
+  "render", "renew", "rent", "reopen", "repair", "repeat", "replace", "report",
+  "require", "rescue", "resemble", "resist", "resource", "response", "result", "retire",
+  "retreat", "return", "reunion", "reveal", "review", "reward", "rhythm", "rib",
+  "ribbon", "rice", "rich", "ride", "ridge", "rifle", "right", "rigid",
+  "ring", "riot", "ripple", "risk", "ritual", "rival", "river", "road",
+  "roast", "robot", "robust", "rocket", "romance", "roof", "rookie", "room",
+  "rose", "rotate", "rough", "round", "route", "royal", "rubber", "rude",
+  "rug", "rule", "run", "runway", "rural", "sad", "saddle", "sadness",
+  "safe", "sail", "salad", "salmon", "salon", "salt", "salute", "same",
+  "sample", "sand", "satisfy", "satoshi", "sauce", "sausage", "save", "say",
+  "scale", "scan", "scare", "scatter", "scene", "scheme", "school", "science",
+  "scissors", "scorpion", "scout", "scrap", "screen", "script", "scrub", "sea",
+  "search", "season", "seat", "second", "secret", "section", "security", "seed",
+  "seek", "segment", "select", "sell", "seminar", "senior", "sense", "sentence",
+  "series", "service", "session", "settle", "setup", "seven", "shadow", "shaft",
+  "shallow", "share", "shed", "shell", "sheriff", "shield", "shift", "shine",
+  "ship", "shiver", "shock", "shoe", "shoot", "shop", "short", "shoulder",
+  "shove", "shrimp", "shrug", "shuffle", "shy", "sibling", "sick", "side",
+  "siege", "sight", "sign", "silent", "silk", "silly", "silver", "similar",
+  "simple", "since", "sing", "siren", "sister", "situate", "six", "size",
+  "skate", "sketch", "ski", "skill", "skin", "skirt", "skull", "slab",
+  "slam", "sleep", "slender", "slice", "slide", "slight", "slim", "slogan",
+  "slot", "slow", "slush", "small", "smart", "smile", "smoke", "smooth",
+  "snack", "snake", "snap", "sniff", "snow", "soap", "soccer", "social",
+  "sock", "soda", "soft", "solar", "soldier", "solid", "solution", "solve",
+  "someone", "song", "soon", "sorry", "sort", "soul", "sound", "soup",
+  "source", "south", "space", "spare", "spatial", "spawn", "speak", "special",
+  "speed", "spell", "spend", "sphere", "spice", "spider", "spike", "spin",
+  "spirit", "split", "spoil", "sponsor", "spoon", "sport", "spot", "spray",
+  "spread", "spring", "spy", "square", "squeeze", "squirrel", "stable", "stadium",
+  "staff", "stage", "stairs", "stamp", "stand", "start", "state", "stay",
+  "steak", "steel", "stem", "step", "stereo", "stick", "still", "sting",
+  "stock", "stomach", "stone", "stool", "story", "stove", "strategy", "street",
+  "strike", "strong", "struggle", "student", "stuff", "stumble", "style", "subject",
+  "submit", "subway", "success", "such", "sudden", "suffer", "sugar", "suggest",
+  "suit", "summer", "sun", "sunny", "sunset", "super", "supply", "supreme",
+  "sure", "surface", "surge", "surprise", "surround", "survey", "suspect", "sustain",
+  "swallow", "swamp", "swap", "swarm", "swear", "sweet", "swift", "swim",
+  "swing", "switch", "sword", "symbol", "symptom", "syrup", "system", "table",
+  "tackle", "tag", "tail", "talent", "talk", "tank", "tape", "target",
+  "task", "taste", "tattoo", "taxi", "teach", "team", "tell", "ten",
+  "tenant", "tennis", "tent", "term", "test", "text", "thank", "that",
+  "theme", "then", "theory", "there", "they", "thing", "this", "thought",
+  "three", "thrive", "throw", "thumb", "thunder", "ticket", "tide", "tiger",
+  "tilt", "timber", "time", "tiny", "tip", "tired", "tissue", "title",
+  "toast", "tobacco", "today", "toddler", "toe", "together", "toilet", "token",
+  "tomato", "tomorrow", "tone", "tongue", "tonight", "tool", "tooth", "top",
+  "topic", "topple", "torch", "tornado", "tortoise", "toss", "total", "tourist",
+  "toward", "tower", "town", "toy", "track", "trade", "traffic", "tragic",
+  "train", "transfer", "trap", "trash", "travel", "tray", "treat", "tree",
+  "trend", "trial", "tribe", "trick", "trigger", "trim", "trip", "trophy",
+  "trouble", "truck", "true", "truly", "trumpet", "trust", "truth", "try",
+  "tube", "tuition", "tumble", "tuna", "tunnel", "turkey", "turn", "turtle",
+  "twelve", "twenty", "twice", "twin", "twist", "two", "type", "typical",
+  "ugly", "umbrella", "unable", "unaware", "uncle", "uncover", "under", "undo",
+  "unfair", "unfold", "unhappy", "uniform", "unique", "unit", "universe", "unknown",
+  "unlock", "until", "unusual", "unveil", "update", "upgrade", "uphold", "upon",
+  "upper", "upset", "urban", "urge", "usage", "use", "used", "useful",
+  "useless", "usual", "utility", "vacant", "vacuum", "vague", "valid", "valley",
+  "valve", "van", "vanish", "vapor", "various", "vast", "vault", "vehicle",
+  "velvet", "vendor", "venture", "venue", "verb", "verify", "version", "very",
+  "vessel", "veteran", "viable", "vibrant", "vicious", "victory", "video", "view",
+  "village", "vintage", "violin", "virtual", "virus", "visa", "visit", "visual",
+  "vital", "vivid", "vocal", "voice", "void", "volcano", "volume", "vote",
+  "voyage", "wage", "wagon", "wait", "walk", "wall", "walnut", "want",
+  "warfare", "warm", "warrior", "wash", "wasp", "waste", "water", "wave",
+  "way", "wealth", "weapon", "wear", "weasel", "weather", "web", "wedding",
+  "weekend", "weird", "welcome", "west", "wet", "whale", "what", "wheat",
+  "wheel", "when", "where", "whip", "whisper", "wide", "width", "wife",
+  "wild", "will", "win", "window", "wine", "wing", "wink", "winner",
+  "winter", "wire", "wisdom", "wise", "wish", "witness", "wolf", "woman",
+  "wonder", "wood", "wool", "word", "work", "world", "worry", "worth",
+  "wrap", "wreck", "wrestle", "wrist", "write", "wrong", "yard", "year",
+  "yellow", "you", "young", "youth", "zebra", "zero", "zone", "zoo",
+];
+
+module.exports = { BIP39_ENGLISH_WORDLIST };

package/src/cli.js

@@ -2,6 +2,7 @@
 
 const path = require("path");
 const fs = require("fs");
+const os = require("os");
 const crypto = require("crypto");
 const { availableSources, ALL_SOURCES } = require("./sources");
 const { scan, emptyResult } = require("./scan");
@@ -13,7 +14,7 @@ const {
 const { startWatch, isTailable } = require("./watch");
 const { startMcpServer } = require("./mcp");
 const { buildTools } = require("./mcpTools");
-const { runGuard: runGuardEngine } = require("./guard");
+const { runGuard: runGuardEngine, buildHookConfig } = require("./guard");
 
 /**
  * A source is unavailable for the ordinary reason (not installed — nothing
@@ -150,13 +151,19 @@ Scan options:
                           similar characters (0/O, Y/*) can be misread,
                           which breaks an exact-format match, so this is
                           best-effort additional coverage, not a guarantee.
-  --include-pii           also scan for PII: US Social Security Numbers
-                          (dashed format only), credit card numbers
-                          (Luhn-validated), and IBANs (checksum-validated).
-                          A different RISK CATEGORY, not a lower confidence
-                          bar -- residoo is deliberately credentials-only
-                          by default. Deliberately excludes bare email/
-                          phone (too common in ordinary text to meet this
+  --include-pii           also scan for PII and adjacent secrets: US Social
+                          Security Numbers (dashed format only), credit
+                          card numbers (Luhn-validated), IBANs (checksum-
+                          validated), and crypto wallet seed phrases
+                          (BIP-39, SHA-256-checksum-validated -- a
+                          CREDENTIAL, not personal data, kept in this flag
+                          rather than a new one to avoid flag proliferation
+                          for the same "opt in, then checksum-validate"
+                          shape). A different RISK CATEGORY, not a lower
+                          confidence bar -- residoo is deliberately
+                          credentials-only by default. Deliberately
+                          excludes bare email/phone (too common in
+                          ordinary text to meet this
                           project's own high-confidence bar even opt-in).
 
 Watch:
@@ -177,6 +184,15 @@ Watch:
                           never to one already seen
   --include-noisy, --include-suppressed, --include-pii, --no-color
                           same meaning as scan
+  --no-notify             skip the OS desktop notification watch fires for
+                          each genuinely new finding (macOS via osascript,
+                          Linux via notify-send if installed; no built-in
+                          mechanism on Windows -- disclosed, not attempted).
+                          On by default in human-readable mode: watch's own
+                          purpose is alerting you, and a background process
+                          nobody is watching a terminal for needs more than
+                          a printed line. Never fires for a re-exposure of
+                          something already seen, and never in --json mode.
   Ctrl+C stops cleanly and prints a session summary (skipped with --json,
   where the same information is one final NDJSON event).
 
@@ -227,22 +243,20 @@ Cred:
   tool, present only when RESIDOO_CRED_ALLOWED_COMMANDS is configured.
 
 Guard:
-  residoo guard             one binary, two Claude Code hooks, dispatched on
-                          the payload's own hook_event_name:
+  residoo guard             one binary, three Claude Code hooks, dispatched
+                          on the payload's own hook_event_name:
 
                           PreToolUse blocks an obviously-sensitive file read
                           (.env, id_rsa, .aws/credentials, and similar)
                           before it can be written to the session
-                          transcript at all. Narrower than it sounds:
-                          Claude Code's hooks API can see a proposed Bash
-                          command or Read path before it runs, but never
-                          the command's OUTPUT, so this alone cannot catch
-                          a secret typed into a prompt or one arriving
-                          through an unrelated command's output.
-
-                          UserPromptSubmit closes exactly that gap: it
-                          checks the user's own typed prompt against
-                          residoo's 79 high-confidence rules (never
+                          transcript at all. Narrower than it sounds on its
+                          own: this only sees a proposed Bash command or
+                          Read path before it runs, based on WHAT you're
+                          about to touch, not what actually comes back.
+
+                          UserPromptSubmit closes the "typed into a prompt"
+                          gap: it checks the user's own typed prompt against
+                          residoo's 84 high-confidence rules (never
                           --verify, never --ocr -- this hook has no matcher
                           and fires on every single prompt, so it must stay
                           fast) and can block it before Claude processes it
@@ -258,17 +272,49 @@ Guard:
                           consistent with this hook never blocking on
                           anything it doesn't recognize.
 
+                          PostToolUse closes the "arriving through a
+                          command's output" gap for Bash specifically: it
+                          scans the command's actual stdout/stderr against
+                          the same 84 rules and, if one matches, replaces
+                          the output with a redacted version before Claude
+                          ever sees it (Claude Code's own updatedToolOutput
+                          decision field). Bash only, disclosed rather than
+                          silently partial: every other built-in tool's
+                          exact output shape isn't documented precisely
+                          enough to reconstruct a replacement safely, and a
+                          wrong shape is silently ignored by Claude Code,
+                          not reported as a failure. The command has
+                          already run by this point -- this cannot undo a
+                          file write or network call, only keep the raw
+                          value out of the model's context.
+
                           scan/watch/mcp remain the real safety net either
                           way -- this is prevention on top of detection,
-                          not a replacement for it. Add both to
+                          not a replacement for it. Add all three to
                           .claude/settings.json:
                             {"hooks":{
                               "PreToolUse":[{"matcher":"Bash|Read",
                                 "hooks":[{"type":"command",
                                 "command":"residoo guard"}]}],
                               "UserPromptSubmit":[{"hooks":[{"type":"command",
+                                "command":"residoo guard"}]}],
+                              "PostToolUse":[{"matcher":"Bash",
+                                "hooks":[{"type":"command",
                                 "command":"residoo guard"}]}]}}
 
+  residoo guard --print-config
+                          print that same merged JSON to stdout instead of
+                          hand-writing it -- reads your existing
+                          ~/.claude/settings.json if present, adds
+                          whatever residoo guard hooks are missing (never
+                          duplicates one already there), and prints the
+                          result. Writes NOTHING to disk: residoo never
+                          writes any file but its own rotation ledger and
+                          an explicit --seal vault, so save it yourself:
+                            residoo guard --print-config > ~/.claude/settings.json
+                          --project targets ./.claude/settings.json (the
+                          repo-local config) instead of the home-level one.
+
 Rotation:
   residoo explain <rule-id>     full rotation runbook for one detection rule
                                 (where to revoke, steps, what revocation does)
@@ -665,6 +711,7 @@ async function runWatch(args) {
   const verify = args.includes("--verify");
   const noColor = args.includes("--no-color");
   const includePii = args.includes("--include-pii");
+  const noNotify = args.includes("--no-notify");
 
   let intervalSeconds = 5;
   const intervalArg = argValue(args, "--interval");
@@ -690,7 +737,7 @@ async function runWatch(args) {
 
   const { promise, stop } = startWatch({
     sources,
-    options: { includeNoisy, includeSuppressed, verify, noColor, includePii, json: wantsJson, pollMs: intervalSeconds * 1000 },
+    options: { includeNoisy, includeSuppressed, verify, noColor, includePii, noNotify, json: wantsJson, pollMs: intervalSeconds * 1000 },
   });
 
   const printFinalSummary = (stats) => {
@@ -720,6 +767,57 @@ async function runWatch(args) {
   return 0;
 }
 
+/**
+ * `residoo guard --print-config`: print the merged .claude/settings.json
+ * a user would need to register all three guard hooks, without ever
+ * writing it -- see guard.js's own buildHookConfig docstring for why this
+ * is print-only rather than an auto-installer. Reads the existing file
+ * (home-level by default, `--project` for the repo-local one) if present,
+ * merges in whatever hook groups are missing, and writes the result to
+ * STDOUT ONLY -- every instructional line goes to stderr, so
+ * `residoo guard --print-config > ~/.claude/settings.json` redirects
+ * exactly the JSON and nothing else.
+ */
+function runGuardPrintConfig(args) {
+  const wantsProject = args.includes("--project");
+  const targetPath = wantsProject
+    ? path.join(process.cwd(), ".claude", "settings.json")
+    : path.join(os.homedir(), ".claude", "settings.json");
+
+  let existing = {};
+  let existedAlready = false;
+  try {
+    const raw = fs.readFileSync(targetPath, "utf-8");
+    existedAlready = true;
+    try { existing = JSON.parse(raw); }
+    catch {
+      process.stderr.write(
+        `residoo guard --print-config: ${targetPath} exists but is not valid JSON. ` +
+        `Fix it first -- printing a merge against unparseable JSON would risk losing whatever is already there.\n`
+      );
+      return 1;
+    }
+  } catch (err) {
+    if (!(err && err.code === "ENOENT")) {
+      process.stderr.write(`residoo guard --print-config: could not read ${targetPath}: ${err.message}\n`);
+      return 1;
+    }
+  }
+
+  const merged = buildHookConfig(existing);
+  process.stderr.write(
+    (existedAlready
+      ? `residoo guard --print-config: merged residoo's three hooks into your existing ${targetPath} below.\n`
+      : `residoo guard --print-config: ${targetPath} doesn't exist yet -- here's a new one with residoo's three hooks.\n`) +
+    `Nothing was written to disk -- residoo never writes any file but its own rotation ledger and an explicit ` +
+    `--seal vault. Save this yourself, e.g.:\n` +
+    `  residoo guard --print-config${wantsProject ? " --project" : ""} > ${targetPath}\n` +
+    (wantsProject ? "" : "(add --project to target ./.claude/settings.json instead of the home-level one)\n")
+  );
+  process.stdout.write(JSON.stringify(merged, null, 2) + "\n");
+  return 0;
+}
+
 /**
  * `residoo mcp`: run residoo as an MCP server over stdio. See src/mcp.js
  * for the protocol engine and src/mcpTools.js for the tool catalog; this
@@ -902,7 +1000,10 @@ async function main(argv) {
   if (cmd === "watch") return runWatch(args);
   if (cmd === "mcp") return runMcp(args);
   if (cmd === "cred") return runCred(args);
-  if (cmd === "guard") return runGuardEngine();
+  if (cmd === "guard") {
+    if (args.includes("--print-config")) return runGuardPrintConfig(args.slice(1));
+    return runGuardEngine();
+  }
   if (cmd !== "scan") {
     process.stderr.write(`Unknown command "${cmd}". Try "residoo --help".\n`);
     return 2;

package/src/guard.js

@@ -1,7 +1,7 @@
 "use strict";
 
 /**
- * `residoo guard`: two Claude Code hooks in one binary, dispatched on the
+ * `residoo guard`: three Claude Code hooks in one binary, dispatched on the
  * payload's own `hook_event_name` field.
  *
  * PreToolUse blocks an obviously-sensitive file read before it happens,
@@ -11,14 +11,18 @@
  * from leaking": Claude Code's hooks API gives a PreToolUse hook the
  * PROPOSED tool input (a Bash command string, a Read file_path) before the
  * tool runs, and lets it deny the call outright -- but it never sees the
- * tool's OUTPUT, and by the time a PostToolUse hook fires, that output is
- * already committed to the transcript and can no longer be redacted. There
- * is no documented hook mechanism for "let the read happen, but strip the
- * secret out of what the model sees." So this can only block INPUT that
- * matches a known-sensitive file path pattern (.env, id_rsa, .aws/credentials,
- * and similar) -- it cannot catch a secret typed directly into a prompt, a
- * secret arriving in the output of an otherwise-unremarkable command
- * (curl, a build log), or any file path this pattern list does not name.
+ * tool's OUTPUT. So on its own, this can only block INPUT that matches a
+ * known-sensitive file path pattern (.env, id_rsa, .aws/credentials, and
+ * similar) -- it cannot catch a secret typed directly into a prompt, or one
+ * arriving in the output of an otherwise-unremarkable command (curl, `git
+ * log`, a build log), or any file path this pattern list does not name.
+ * UserPromptSubmit (below) closes the first gap; PostToolUse (below) closes
+ * the second, corrected from an earlier version of this comment that
+ * called it uncatchable -- Claude Code's own `updatedToolOutput` decision
+ * field (confirmed directly against code.claude.com/docs/en/hooks, not
+ * assumed) can in fact replace what the model sees, discovered during a
+ * later competitive-research pass after GitGuardian's ggshield was found to
+ * already scan tool output at this exact stage.
  *
  * UserPromptSubmit closes exactly the "typed directly into a prompt" gap
  * named above: Claude Code's own docs (code.claude.com/docs/en/hooks,
@@ -66,6 +70,56 @@
 const { PATTERNS, redact } = require("./patterns");
 const { VENDOR_EXAMPLE_VALUES, zeroEntropyTail } = require("./scan");
 
+const GUARD_COMMAND = "residoo guard";
+
+// matcher: null means Claude Code's own hook-config schema omits the field
+// entirely for an event with no matcher support (UserPromptSubmit) --
+// distinct from an empty string, which would mean "match everything" for
+// an event that DOES support matchers.
+const HOOK_EVENT_SPECS = [
+  { event: "PreToolUse", matcher: "Bash|Read" },
+  { event: "UserPromptSubmit", matcher: null },
+  { event: "PostToolUse", matcher: "Bash" },
+];
+
+/**
+ * Pure function: given a parsed Claude Code settings.json object (or `{}`
+ * for a fresh one), returns a NEW object with a "residoo guard" hook group
+ * appended to each of PreToolUse/UserPromptSubmit/PostToolUse's hook
+ * arrays -- unless a "residoo guard" command already exists ANYWHERE in
+ * that event's groups, in which case that event is left untouched
+ * (idempotent: running this against its own prior output changes
+ * nothing). Never mutates `existing`; every other key, every other tool's
+ * hook, every unrelated setting is carried through byte-for-byte.
+ *
+ * This function only COMPUTES a value -- it never touches a file, on
+ * purpose. CONTRIBUTING.md's own hard rule (rule 3) names
+ * `~/.residoo/rotations.json` as "the only file residoo ever writes
+ * outside an explicit --seal ... nothing else may claim this carve-out."
+ * An auto-installing `guard --install` that edited `.claude/settings.json`
+ * directly would violate that rule outright, so the CLI wraps this in
+ * `--print-config` instead (see cli.js's runGuardPrintConfig): print the
+ * merged JSON to stdout, let the human decide whether and where to save it.
+ */
+function buildHookConfig(existing) {
+  const settings = existing && typeof existing === "object" && !Array.isArray(existing)
+    ? JSON.parse(JSON.stringify(existing)) : {};
+  if (!settings.hooks || typeof settings.hooks !== "object" || Array.isArray(settings.hooks)) settings.hooks = {};
+
+  for (const { event, matcher } of HOOK_EVENT_SPECS) {
+    const groups = Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
+    const alreadyPresent = groups.some((g) =>
+      g && typeof g === "object" && Array.isArray(g.hooks) &&
+      g.hooks.some((h) => h && typeof h === "object" && h.type === "command" && h.command === GUARD_COMMAND));
+    if (alreadyPresent) { settings.hooks[event] = groups; continue; }
+    const newGroup = matcher
+      ? { matcher, hooks: [{ type: "command", command: GUARD_COMMAND }] }
+      : { hooks: [{ type: "command", command: GUARD_COMMAND }] };
+    settings.hooks[event] = [...groups, newGroup];
+  }
+  return settings;
+}
+
 // A matched path fragment must be preceded by a path separator or the start
 // of the string, and followed by either the end of the string (the common
 // case for Read's file_path) or a shell metacharacter/whitespace (the case
@@ -204,8 +258,86 @@ function evaluatePromptText(promptText) {
 }
 
 /**
- * Writes one structured audit line to stderr for a block decision --
- * CONTRIBUTING.md's own hard rule (rule 3) names `~/.residoo/rotations.json`
+ * Redacts every high-confidence match in `text`, tracking the first REAL
+ * (non-suppressed) hit for the audit trail/preview. Same suppression rule
+ * as evaluatePromptText (a documented vendor-example key or an obvious
+ * zero-entropy placeholder is never redacted) and the same rule set
+ * (PROMPT_GUARD_RULES) -- one bar for everything this module scans text
+ * content with, whether that content is a typed prompt or a command's
+ * output. `String.prototype.replace` with each rule's own global regex
+ * redacts every occurrence in one pass per rule; a value already inside a
+ * PREVIOUS rule's redaction (unlikely given how distinct these vendor
+ * prefixes are, but not impossible) is walked past unchanged rather than
+ * double-redacted, since only literal ORIGINAL text can still match a
+ * pattern from patterns.js.
+ */
+function redactSecretsInText(text) {
+  if (typeof text !== "string" || !text) return { text: typeof text === "string" ? text : "", hit: null };
+  let result = text;
+  let hit = null;
+  for (const rule of PROMPT_GUARD_RULES) {
+    rule.re.lastIndex = 0;
+    result = result.replace(rule.re, (match) => {
+      if (VENDOR_EXAMPLE_VALUES.has(match) || zeroEntropyTail(match)) return match;
+      if (!hit) hit = { label: rule.label, preview: redact(match) };
+      return redact(match);
+    });
+  }
+  return { text: result, hit };
+}
+
+/**
+ * Pure decision function: given a PostToolUse hook payload's tool_name and
+ * tool_response, decide whether to redact. No I/O, fully unit-testable.
+ *
+ * Bash only, and stated why rather than left implicit: Claude Code's own
+ * docs (code.claude.com/docs/en/hooks, "PostToolUse decision control",
+ * fetched directly) state `updatedToolOutput` "must match the tool's
+ * output shape" and "a value that doesn't match the tool's output schema
+ * is ignored and the original output is used" -- a SILENT no-op, not an
+ * error residoo could detect and report. Bash's shape ({stdout, stderr,
+ * interrupted, isImage}) is the one built-in tool output shape those same
+ * docs actually publish; every other built-in tool's tool_response shape
+ * is not documented at this level of precision, so reconstructing one
+ * would risk exactly the silent-no-op failure this project's own
+ * discipline exists to avoid. A stated, narrow scope limit, not full
+ * "every tool's output" coverage -- and still a real, new defense layer:
+ * PreToolUse's matchSensitivePath blocks based on WHAT you're about to
+ * read (a path), this blocks based on WHAT ACTUALLY CAME BACK (content),
+ * catching a secret in `git log`, `env`, a build log, or any other Bash
+ * output PreToolUse's path-based check was never going to see coming.
+ *
+ * The tool has ALREADY run by the time this fires (Claude Code's own docs,
+ * same section) -- this cannot undo the read/write/network call the
+ * command made, and does not try to. It only keeps the raw value out of
+ * the model's context (and so out of the transcript this project's own
+ * `scan` exists to check), a narrower guarantee than PreToolUse's denial,
+ * disclosed as such rather than oversold.
+ */
+function evaluatePostToolUse(toolName, toolResponse) {
+  if (toolName !== "Bash" || !toolResponse || typeof toolResponse !== "object") {
+    return { act: false, label: null, preview: null, updatedToolOutput: null };
+  }
+  const stdout = redactSecretsInText(toolResponse.stdout);
+  const stderr = redactSecretsInText(toolResponse.stderr);
+  const hit = stdout.hit || stderr.hit;
+  if (!hit) return { act: false, label: null, preview: null, updatedToolOutput: null };
+  return {
+    act: true,
+    label: hit.label,
+    preview: hit.preview,
+    updatedToolOutput: {
+      stdout: stdout.text,
+      stderr: stderr.text,
+      interrupted: !!toolResponse.interrupted,
+      isImage: !!toolResponse.isImage,
+    },
+  };
+}
+
+/**
+ * Writes one structured audit line to stderr for a block OR redact decision
+ * -- CONTRIBUTING.md's own hard rule (rule 3) names `~/.residoo/rotations.json`
  * as "the only file residoo ever writes outside an explicit --seal...
  * nothing else may claim this carve-out," so this is NOT a new file, the
  * same choice `cred`'s own audit trail already made for the same reason
@@ -213,28 +345,45 @@ function evaluatePromptText(promptText) {
  * hook's own stderr at launch if you want it kept, same as `cred`.
  * Never the raw matched value -- `preview` is already redact()'d by the
  * caller (rule 4: no raw value in any log line, ever), and PreToolUse
- * decisions carry no value at all, only a path-pattern label.
+ * decisions carry no value at all, only a path-pattern label. `decision`
+ * defaults to "block" (every call site before PostToolUse existed) --
+ * PostToolUse passes "redact" since nothing is actually blocked there, the
+ * tool already ran; the log should say what really happened.
  */
-function logAuditLine(errOutput, { event, label, preview, sessionId, cwd }) {
+function logAuditLine(errOutput, { event, label, preview, sessionId, cwd, decision = "block" }) {
   try {
     errOutput.write(JSON.stringify({
-      ts: new Date().toISOString(), tool: "residoo guard", event, decision: "block",
+      ts: new Date().toISOString(), tool: "residoo guard", event, decision,
       label, ...(preview ? { preview } : {}), sessionId: sessionId || null, cwd: cwd || null,
     }) + "\n");
   } catch { /* stderr write failing is never a reason to fail the hook decision itself */ }
 }
 
 /**
- * Reads one PreToolUse OR UserPromptSubmit hook payload from `input`
- * (default stdin) -- distinguished by the payload's own `hook_event_name`
- * common field, a single binary handling both the way Claude Code's own
- * hook registration allows -- decides, and writes the hook's own JSON
- * response protocol to `output` (default stdout) -- exit code is the
- * caller's job (bin/residoo.js), this returns the intended process exit
- * code instead of calling process.exit itself, matching every other run*
- * function in cli.js. Every BLOCK decision also gets one structured line
- * on `errOutput` (default stderr) -- see logAuditLine's own docstring for
- * why stderr, never a file.
+ * Reads one PreToolUse, UserPromptSubmit, OR PostToolUse hook payload from
+ * `input` (default stdin) -- distinguished by the payload's own
+ * `hook_event_name` common field, a single binary handling all three the
+ * way Claude Code's own hook registration allows -- decides, and writes
+ * the hook's own JSON response protocol to `output` (default stdout) --
+ * exit code is the caller's job (bin/residoo.js), this returns the
+ * intended process exit code instead of calling process.exit itself,
+ * matching every other run* function in cli.js. Every BLOCK or REDACT
+ * decision also gets one structured line on `errOutput` (default stderr)
+ * -- see logAuditLine's own docstring for why stderr, never a file.
+ *
+ * The final `hook_event_name !== "PreToolUse"` guard fixes a real latent
+ * bug, not a hypothetical one: before PostToolUse existed here, anything
+ * OTHER than UserPromptSubmit fell through unconditionally to
+ * evaluateToolInput -- harmless while only PreToolUse and UserPromptSubmit
+ * were ever registered, but a PostToolUse payload also carries a
+ * `tool_input` field (Claude Code's own docs confirm both `tool_input` and
+ * `tool_response` are present), so without this guard a PostToolUse event
+ * would have been silently re-evaluated as a PreToolUse decision and could
+ * have emitted a `permissionDecision: "deny"` response for a tool call
+ * that had already finished executing -- a response Claude Code has no
+ * defined behavior for. Explicit is safer than "everything else falls
+ * through," the same fail-safe posture this whole module already commits
+ * to elsewhere.
  */
 async function runGuard({ input = process.stdin, output = process.stdout, errOutput = process.stderr } = {}) {
   const chunks = [];
@@ -266,6 +415,24 @@ async function runGuard({ input = process.stdin, output = process.stdout, errOut
     return 0;
   }
 
+  if (payload.hook_event_name === "PostToolUse") {
+    const decision = evaluatePostToolUse(payload.tool_name, payload.tool_response);
+    if (!decision.act) return 0;
+    logAuditLine(errOutput, {
+      event: "PostToolUse", label: decision.label, preview: decision.preview,
+      sessionId: payload.session_id, cwd: payload.cwd, decision: "redact",
+    });
+    output.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PostToolUse",
+        updatedToolOutput: decision.updatedToolOutput,
+      },
+    }) + "\n");
+    return 0;
+  }
+
+  if (payload.hook_event_name !== "PreToolUse") return 0;
+
   const decision = evaluateToolInput(payload.tool_name, payload.tool_input);
   if (!decision.block) return 0;
 
@@ -283,4 +450,7 @@ async function runGuard({ input = process.stdin, output = process.stdout, errOut
   return 0;
 }
 
-module.exports = { evaluateToolInput, matchSensitivePath, evaluatePromptText, runGuard, SENSITIVE_PATH_PATTERNS };
+module.exports = {
+  evaluateToolInput, matchSensitivePath, evaluatePromptText, evaluatePostToolUse,
+  runGuard, buildHookConfig, SENSITIVE_PATH_PATTERNS,
+};

package/src/mcpTools.js

@@ -365,7 +365,7 @@ function buildTools({ sources }) {
         projectDir: { type: "string", description: "Absolute path to a project/repo directory to scan instead of the machine-wide transcript stores (same as `residoo scan --project <dir>`). Omit for the default machine-wide scan." },
         includeNoisy: { type: "boolean", default: false, description: "Also run residoo's two low-confidence heuristic rules (generic password/secret assignments) -- catches more, false-positives more. Off by default." },
         includeSuppressed: { type: "boolean", default: false, description: "Include matches normally hidden because they look like vendor-documented example values or placeholder text. Off by default." },
-        includePii: { type: "boolean", default: false, description: "Also scan for PII (US Social Security Numbers, Luhn-validated credit card numbers, checksum-validated IBANs) -- a different risk category from a credential, not a lower confidence bar. Off by default; residoo is deliberately credentials-only otherwise." },
+        includePii: { type: "boolean", default: false, description: "Also scan for PII and adjacent secrets (US Social Security Numbers, Luhn-validated credit card numbers, checksum-validated IBANs, BIP-39 checksum-validated crypto wallet seed phrases) -- a different risk category from a vendor credential, not a lower confidence bar. Off by default; residoo is deliberately credentials-only otherwise." },
         maxEntries: { type: "integer", minimum: 1, maximum: 200, default: 25, description: "Cap on distinct findings returned in full detail, pending-first. Counts in the response are always exact even when the entry list is truncated." },
       },
       required: [],

package/src/notify.js

@@ -0,0 +1,53 @@
+"use strict";
+
+const cp = require("child_process");
+
+/**
+ * Best-effort OS desktop notification for `residoo watch`. macOS via
+ * `osascript` (always present, no new dependency -- the same shell-out
+ * precedent `keychain.js`'s `security` and `ocr.js`'s `tesseract` already
+ * set), Linux via `notify-send` (commonly present on a desktop session,
+ * NOT guaranteed -- `watch` also runs on headless/server machines with no
+ * notification daemon at all).
+ *
+ * Windows: no built-in, dependency-free mechanism was found that doesn't
+ * either need an external module (BurntToast) or pop a blocking, modal
+ * MessageBox in front of a background process -- a disclosed scope limit,
+ * not silently assumed covered, the same posture `keychain.js` already
+ * takes for its own Windows refusal.
+ *
+ * Decoration, never the report itself: `watch`'s own `emit()` already
+ * writes every finding to stdout/stderr before this is ever called, so a
+ * missing binary, no display server, or a spawn error here must never
+ * throw, block, or affect the caller in any way -- it can only make an
+ * already-reported finding easier to notice sooner.
+ *
+ * `cp.spawn` (not destructured at module load) so a test can monkey-patch
+ * `require("child_process").spawn` directly and restore it after, without
+ * this module needing its own injectable-dependency parameter.
+ */
+function notifyDesktop(title, message) {
+  try {
+    if (process.platform === "darwin") {
+      // osascript's -e takes one AppleScript source string; spawn (no
+      // shell:true) passes it as a single argv entry, so there is no shell
+      // to inject into -- but the string still has to be valid AppleScript
+      // source, so its own quote/backslash characters need escaping or a
+      // stray one just breaks the script into a harmless no-op.
+      const esc = (s) => String(s).replace(/[\\"]/g, "\\$&");
+      const script = `display notification "${esc(message)}" with title "${esc(title)}"`;
+      const child = cp.spawn("osascript", ["-e", script], { stdio: "ignore" });
+      child.on("error", () => {}); // binary missing or spawn failed: never throw
+      child.unref();
+    } else if (process.platform === "linux") {
+      const child = cp.spawn("notify-send", [String(title), String(message)], { stdio: "ignore" });
+      child.on("error", () => {});
+      child.unref();
+    }
+    // Windows and anything else: no-op, disclosed above, not attempted.
+  } catch {
+    // Never let a notification failure affect the caller.
+  }
+}
+
+module.exports = { notifyDesktop };

package/src/pii.js

@@ -1,12 +1,16 @@
 "use strict";
 
+const crypto = require("crypto");
+const { BIP39_ENGLISH_WORDLIST } = require("./bip39wordlist");
+
 /**
- * Opt-in PII detection (--include-pii). Named directly by this session's
- * own competitive research into funded AI-DLP vendors (Strac, Cyberhaven,
- * Nightfall) as one of the few concrete, buildable things residoo could
- * adopt without becoming a hosted service -- and independently
- * corroborated by two direct competitors' own shipped detector lists
- * (DidILeak, Medusa), both of which cover PII alongside credentials.
+ * Opt-in PII-and-adjacent detection (--include-pii). Named directly by this
+ * session's own competitive research into funded AI-DLP vendors (Strac,
+ * Cyberhaven, Nightfall) as one of the few concrete, buildable things
+ * residoo could adopt without becoming a hosted service -- and
+ * independently corroborated by two direct competitors' own shipped
+ * detector lists (DidILeak, Medusa), both of which cover PII alongside
+ * credentials.
  *
  * Kept entirely separate from PATTERNS/NOISY_PATTERNS in patterns.js on
  * purpose: residoo's stated identity elsewhere in this project is
@@ -17,19 +21,34 @@
  * for a different reason (a different RISK CATEGORY, not a lower
  * confidence bar).
  *
- * Only three detectors, deliberately: DidILeak's own shipped list also
+ * "PII" is the name of the flag, not a perfectly accurate label for
+ * everything in it: a BIP-39 crypto wallet seed phrase (added after a
+ * competitive-feature-parity pass found AgentSweep ships seed-phrase
+ * detection and residoo didn't) is a CREDENTIAL, not personal data --
+ * arguably it belongs in the default, always-on set the way a vendor API
+ * key does. It lives here instead for the same architectural reason as
+ * the other three: no single-vendor prefix to anchor on (a seed phrase is
+ * 12-24 plain English words, structurally unlike every PATTERNS.js rule),
+ * and a real, own risk-category case for asking first, the same
+ * "different shape, not a lower bar" framing already applied to SSN/card/
+ * IBAN. Kept in the same flag rather than a new one to avoid flag
+ * proliferation for what is, mechanically, the same "opt in, then
+ * checksum-validate before ever reporting" pattern.
+ *
+ * Four detectors, deliberately not more: DidILeak's own shipped list also
  * includes bare email addresses and phone numbers, but both are far too
  * common in ordinary, non-sensitive text (a support email in a comment, a
  * phone number in an error message) to meet this project's own
  * "high-confidence only, a security tool that cries wolf gets
  * uninstalled" bar, opt-in or not -- DidILeak itself rates them "low"/
- * "info" severity for the same reason. The three included here all have a
+ * "info" severity for the same reason. Every detector here instead has a
  * REAL mathematical validator, not just a shape match, which is what
  * keeps false-positive risk low enough to ship even as an additive
- * category: Luhn for card numbers, ISO 7064 MOD 97-10 for IBAN, and the
- * Social Security Administration's own published invalid-range rules for
- * SSNs (no checksum exists for SSNs, hence "medium" confidence there, not
- * "high" -- disclosed, not smoothed over).
+ * category: Luhn for card numbers, ISO 7064 MOD 97-10 for IBAN, the BIP-39
+ * spec's own SHA-256 checksum for seed phrases, and the Social Security
+ * Administration's own published invalid-range rules for SSNs (no
+ * checksum exists for SSNs, hence "medium" confidence there, not "high"
+ * -- disclosed, not smoothed over).
  */
 
 /** Luhn checksum (ISO/IEC 7812-1): the standard validator for payment card numbers. `digits` must already be digits-only. */
@@ -72,6 +91,75 @@ function ibanValid(iban) {
   return mod === 1;
 }
 
+const BIP39_INDEX = new Map(BIP39_ENGLISH_WORDLIST.map((w, i) => [w, i]));
+const BIP39_VALID_LENGTHS = new Set([12, 15, 18, 21, 24]);
+
+/**
+ * BIP-39 mnemonic checksum (github.com/bitcoin/bips/blob/master/bip-0039.mediawiki,
+ * fetched directly, cross-checked against the spec's own canonical all-zero
+ * test vector -- "abandon" x11 + "about" -- rather than trusted from memory):
+ * a mnemonic of MS words (12/15/18/21/24) encodes ENT bits of entropy plus a
+ * CS = ENT/32-bit checksum, each word an 11-bit index into the wordlist. The
+ * checksum is the first CS bits of SHA-256(entropy); this recomputes it and
+ * compares. English wordlist only -- BIP-39 also defines Japanese, Korean,
+ * Spanish, Chinese, French, Italian, Czech, and Portuguese wordlists this
+ * does not check, a disclosed scope limit rather than a silent one, the same
+ * shape as ibanValid's own per-country-length gap above.
+ *
+ * BigInt throughout: a 24-word phrase packs 264 bits, far past a safe JS
+ * integer, and a mis-sized intermediate here would silently corrupt every
+ * checksum it touches rather than throw.
+ */
+function bip39ChecksumValid(words) {
+  if (!Array.isArray(words) || !BIP39_VALID_LENGTHS.has(words.length)) return false;
+  const indices = [];
+  for (const w of words) {
+    const idx = BIP39_INDEX.get(w);
+    if (idx === undefined) return false;
+    indices.push(idx);
+  }
+  const csBits = words.length / 3; // MS/3, derived from CS=ENT/32 and MS=(ENT+CS)/11
+  const entBits = words.length * 11 - csBits;
+
+  let combined = 0n;
+  for (const idx of indices) combined = (combined << 11n) | BigInt(idx);
+
+  const checksumMask = (1n << BigInt(csBits)) - 1n;
+  const checksumBits = combined & checksumMask;
+  const entropyBits = combined >> BigInt(csBits);
+
+  const entHex = entropyBits.toString(16).padStart(entBits / 8 * 2, "0");
+  const hash = crypto.createHash("sha256").update(Buffer.from(entHex, "hex")).digest();
+  const hashBits = BigInt("0x" + hash.toString("hex"));
+  const expectedChecksum = (hashBits >> BigInt(256 - csBits)) & checksumMask;
+
+  return checksumBits === expectedChecksum;
+}
+
+/**
+ * A real seed phrase is rarely the WHOLE candidate span: "here's my wallet
+ * seed: <12 words> keep it safe" is a plausible, ordinary way to paste one,
+ * and the candidate regex below (deliberately wide, to not miss a phrase
+ * that isn't sentence-initial) captures the surrounding words too. Slides
+ * every valid length (24 down to 12, longest first so a real 15+-word
+ * phrase is reported whole rather than as a coincidentally-checksum-valid
+ * 12-word prefix of it) across every starting offset in the captured run,
+ * returning the first exact substring whose checksum validates, or null.
+ * O(words x 5) checksum computations worst case -- cheap, since the regex
+ * itself already bounds "words" to at most 100.
+ */
+function findBip39Phrase(candidateRun) {
+  const words = candidateRun.split(" ");
+  for (let start = 0; start < words.length; start++) {
+    for (const len of [24, 21, 18, 15, 12]) {
+      if (start + len > words.length) continue;
+      const slice = words.slice(start, start + len);
+      if (bip39ChecksumValid(slice)) return slice.join(" ");
+    }
+  }
+  return null;
+}
+
 const PII_PATTERNS = [
   // Dashed format only -- a bare 9-digit run is indistinguishable from
   // countless other numbers in a coding-agent transcript (ports, PIDs,
@@ -91,6 +179,21 @@ const PII_PATTERNS = [
   { id: "iban", label: "IBAN (checksum-validated)", confidence: "high",
     re: /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/g,
     validate: (m) => ibanValid(m) },
+  // Candidate: a run of 12-100 lowercase words, single-space-separated (how
+  // a seed phrase actually appears -- pasted as plain text, no punctuation
+  // breaking it up). Deliberately wider than the 12-24 a phrase itself can
+  // be: a real phrase is rarely the WHOLE sentence ("here's my seed: <12
+  // words> keep it safe"), so the candidate must be free to capture
+  // leading/trailing prose too -- findBip39Phrase (below) narrows it back
+  // down. validate() returns the narrowed substring, not a boolean: common
+  // English function words like "the"/"and"/"of"/"is" are NOT in the
+  // 2048-word list (confirmed by direct check against the fetched
+  // wordlist), so ordinary prose almost never survives even the membership
+  // test, let alone the checksum, but the narrowing still matters whenever
+  // it does.
+  { id: "crypto_seed_phrase", label: "Crypto wallet seed phrase (BIP-39, checksum-validated)", confidence: "high",
+    re: /\b[a-z]+(?: [a-z]+){11,99}\b/g,
+    validate: (m) => findBip39Phrase(m) },
 ];
 
-module.exports = { PII_PATTERNS, luhnValid, ibanValid };
+module.exports = { PII_PATTERNS, luhnValid, ibanValid, bip39ChecksumValid, findBip39Phrase };

package/src/rotation.js

@@ -1181,6 +1181,23 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "This passed the real ISO 7064 MOD 97-10 checksum every valid IBAN must satisfy, so it is very unlikely to be a random-looking placeholder.",
   },
+  // Framed like every credential rule above, not like the two PII entries
+  // just above it: unlike an SSN or an IBAN, a seed phrase is a bearer
+  // credential with an actual "rotation" action available -- move the
+  // funds to a new wallet -- so it belongs with "revoke and replace," not
+  // "there is no console for this."
+  crypto_seed_phrase: {
+    label: "Crypto wallet seed phrase (BIP-39, checksum-validated)",
+    consolePath: "No vendor console -- this is a self-custodied wallet's own master key, not an account credential a company can revoke for you.",
+    steps: [
+      "Treat the wallet as fully compromised the moment this leaves your control, even if you don't see funds move immediately -- anyone with the phrase can derive every key and address it controls",
+      "Create a brand-new wallet from a freshly-generated seed phrase, on a device you trust, never by reusing or deriving from the exposed one",
+      "Move all funds and any NFTs/tokens to the new wallet as soon as possible, paying attention to network fees so a move doesn't get front-run",
+      "Update every dApp, exchange, or service that had the old wallet's address on file",
+      "Remove the phrase from the transcript file if it doesn't need to be there -- residoo scan --seal quarantines the whole file without deleting anything, if you want a reversible first step",
+    ],
+    revokeNote: "This passed the real BIP-39 SHA-256 checksum every valid seed phrase must satisfy, so it is very unlikely to be a random-looking placeholder -- treat it as a real, live wallet key until shown otherwise.",
+  },
 
   // ── NOISY_PATTERNS (only reachable via --include-noisy) ───────────────
   generic_password_assignment: {

package/src/scan.js

@@ -609,21 +609,31 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // at all, so this mirrors decodeLine/ocrLine's simpler shape, not
   // matchLine's. `validate` (Luhn, IBAN's MOD 97-10) runs before a
   // candidate is even considered for suppression -- an invalid checksum
-  // is not a "placeholder," it's simply not a match.
+  // is not a "placeholder," it's simply not a match. `validate` may return
+  // `true` (record the regex's own match verbatim -- Luhn/IBAN) or a
+  // narrower STRING (record that instead -- crypto_seed_phrase's
+  // findBip39Phrase, since the regex candidate deliberately over-captures
+  // surrounding prose and the checksum-valid phrase is usually a
+  // sub-string of it, not the whole match).
   const piiLine = (line, file, relFile, lineNo, mtimeMs) => {
     if (!includePii) return;
     for (const rule of PII_PATTERNS) {
       rule.re.lastIndex = 0;
       let m;
       while ((m = rule.re.exec(line)) !== null) {
-        if (rule.validate && !rule.validate(m[0])) continue;
+        let value = m[0];
+        if (rule.validate) {
+          const v = rule.validate(m[0]);
+          if (!v) continue;
+          if (typeof v === "string") value = v;
+        }
         const before = line.slice(Math.max(0, m.index - CONTEXT_WINDOW), m.index);
-        const suppressedReason = suppressionReason(m[0], before, rule.id);
+        const suppressedReason = suppressionReason(value, before, rule.id);
         if (suppressedReason && !includeSuppressed) {
           suppressedCount++;
           continue;
         }
-        record(rule, m[0], relFile, file, lineNo, mtimeMs,
+        record(rule, value, relFile, file, lineNo, mtimeMs,
           suppressedReason ? "low" : rule.confidence, suppressedReason, { pii: true });
       }
     }

package/src/sources/agent-configs.js

@@ -107,6 +107,18 @@ const { createInterface } = require("readline/promises");
  *    (global config; their own security page recommends `chmod 600` on
  *    it, a vendor admission it holds secrets) + named verbatim in JFrog's
  *    Bitwarden-CLI target list.
+ *  - `~/.mcp.json` (bare, directly under HOME, distinct from every
+ *    subdirectory-nested path above) — Visual Studio (the full Windows
+ *    IDE, not VS Code; VS Code's own MCP config is `.vscode/mcp.json`,
+ *    already project-scoped below) documents this exact path as its
+ *    global, all-solutions MCP config: Microsoft's own docs repo
+ *    (github.com/MicrosoftDocs/visualstudio-docs, docs/ide/mcp-servers.md,
+ *    fetched directly), "Serves as a global MCP server configuration for
+ *    a specific user. Adding an MCP server here makes it load for all
+ *    Visual Studio solutions." Visual Studio's remote-MCP OAuth tokens go
+ *    through "the Visual Studio keychain" per the same doc -- an OS-backed
+ *    store, not a plaintext file, so there is no separate credential
+ *    vault to name here the way `.codex/auth.json` needed one.
  *
  * DELIBERATELY NOT READ, and why:
  *  - `~/.claude/projects/**` AS SCAN CONTENT — claude-code.js's territory;
@@ -194,6 +206,7 @@ const CANDIDATES = [
   path.join(GEMINI_DIR, "settings.json"),
   path.join(CODEX_HOME, "config.toml"),
   path.join(KIRO_DIR, "settings", "mcp.json"),
+  path.join(HOME, ".mcp.json"),
 ];
 
 // Configs are KB-scale in every real observation this source's research
@@ -229,7 +242,12 @@ function available() {
     dirExists(CURSOR_DIR) ||
     dirExists(GEMINI_DIR) ||
     dirExists(CODEX_HOME) ||
-    dirExists(KIRO_DIR)
+    dirExists(KIRO_DIR) ||
+    // Visual Studio (the full IDE) has no dedicated root directory the way
+    // every other tool above does -- its one machine-level artifact is this
+    // bare file, so it needs its own direct existence check rather than a
+    // dirExists() on some ~/.visualstudio root that doesn't exist.
+    fileExists(path.join(HOME, ".mcp.json"))
   );
 }
 
@@ -319,6 +337,13 @@ const PROJECT_CONFIG_RELPATHS = [
   ".mcp.json",
   path.join(".claude", "settings.json"),
   path.join(".claude", "settings.local.json"),
+  // Visual Studio's per-solution, VS-only MCP config: Microsoft's own docs
+  // (same source cited for ~/.mcp.json above) list this as a distinct
+  // location from <SOLUTIONDIR>/.mcp.json (source-controlled) --
+  // "Specific to Visual Studio and loads the specified MCP servers only
+  // for a specific user, for the specified solution," living inside the
+  // hidden, not-source-controlled .vs/ folder Visual Studio already owns.
+  path.join(".vs", "mcp.json"),
 ];
 
 // Probe bounds: transcript first-records are KB-scale; 256KB and 20 lines is

package/src/watch.js

@@ -6,6 +6,7 @@ const crypto = require("crypto");
 const { scan } = require("./scan");
 const { guidanceFor, fingerprintFinding, loadAcks, loadDismissed, statePath } = require("./rotation");
 const { c, makePaint } = require("./color");
+const { notifyDesktop } = require("./notify");
 
 /**
  * `residoo watch`: continuous, near-real-time scanning of the same
@@ -563,7 +564,7 @@ function reloadLedgerIfChanged(prev) {
  * backstop and nothing riding on top of it. `options.fsWatch` is accepted
  * and ignored, reserved for when a future version adds real hints.
  */
-function startWatch({ sources, options = {}, out = process.stdout, errOut = process.stderr } = {}) {
+function startWatch({ sources, options = {}, out = process.stdout, errOut = process.stderr, notify = notifyDesktop } = {}) {
   const paint = makePaint(options.noColor, out);
   const tracked = new Map();
   const seen = new Map();
@@ -582,6 +583,17 @@ function startWatch({ sources, options = {}, out = process.stdout, errOut = proc
     }
     const line = renderHumanLine(event, paint);
     if (line !== null) out.write(line + "\n");
+    // Desktop notification is decoration on top of the line just written
+    // above, never a substitute for it -- JSON mode is for programmatic
+    // consumption (a pipe, a log shipper), not a human sitting in front of
+    // the terminal, so it's excluded the same way `options.noColor` only
+    // applies to the human-line path. Only a genuinely NEW finding notifies
+    // -- a `reexposure` (the same secret seen again) or a `watch-error`
+    // would otherwise turn a quiet, healthy watch into a notification
+    // spamming machine.
+    if (event.type === "finding" && !options.json && !options.noNotify) {
+      notify("residoo: new secret found", `${event.label} in ${event.relFile}:${event.line} (${event.preview})`);
+    }
   }
 
   async function tick() {