residoo 0.4.1 → 0.4.2

package/README.md

@@ -122,10 +122,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.1 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.2 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.1 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.2 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -349,7 +349,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.1
+  - uses: dandovdub/residoo@v0.4.2
 ```
 
 As a pre-commit hook:
@@ -357,7 +357,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.1
+    rev: v0.4.2
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/report.js

@@ -193,15 +193,23 @@ function renderRotationSection(rotation, { noColor = false, showAdvisory = false
   const MAX_SHOWN = 12;
   let shownCount = 0;
   let elided = 0;
+  // Tracked separately from `elided` so the closing line can say WHICH rule
+  // types got cut, not just how many entries. The cap is global across all
+  // groups (a report is a summary), so on a rule-heavy scan the elided
+  // remainder almost always spans multiple types, not more of whichever
+  // group happened to print right above the "N more" line; without this a
+  // reader sees that line directly under (say) an Anthropic group and
+  // reasonably reads it as "N more Anthropic keys," which it usually is not.
+  const elidedRuleLabels = new Set();
   for (const g of groupList) {
-    if (shownCount >= MAX_SHOWN) { elided += g.entries.length; continue; }
+    if (shownCount >= MAX_SHOWN) { elided += g.entries.length; elidedRuleLabels.add(g.label); continue; }
     push();
     const g0 = g.entries[0];
     const where = g0.guidance.rotateUrl ? `rotate: ${g0.guidance.rotateUrl}` : `where: ${g0.guidance.consolePath}`;
     push(`  ${paint(c.bold, g.label)}`);
     push(paint(c.dim, `    ${where}`));
     for (const e of g.entries) {
-      if (shownCount >= MAX_SHOWN) { elided++; continue; }
+      if (shownCount >= MAX_SHOWN) { elided++; elidedRuleLabels.add(g.label); continue; }
       shownCount++;
       // e.files always has exactly one entry: the fingerprint is derived
       // from this same basename (see fingerprintFinding in rotation.js), so
@@ -234,7 +242,8 @@ function renderRotationSection(rotation, { noColor = false, showAdvisory = false
   }
   if (elided > 0) {
     push();
-    push(paint(c.dim, `  … and ${elided} more; see --json for the full list`));
+    const typeNote = elidedRuleLabels.size > 1 ? ` across ${elidedRuleLabels.size} rule types` : "";
+    push(paint(c.dim, `  … and ${elided} more${typeNote}; see --json for the full list`));
   }
   push();
   push(paint(c.dim, `  Full runbook: residoo explain <rule-id> · rotated: residoo ack <fp> · not a secret: residoo dismiss <fp>`));