residoo 0.4.12 → 0.4.14

package/README.md

@@ -47,6 +47,26 @@ scanned here left your machine; residoo makes no network calls.
 > trufflehog/betterleaks' verification postures, in
 > [docs/comparison.md](docs/comparison.md).
 
+## Benchmark: measured, not claimed
+
+A reproducible benchmark against 8 real competing tools, on a synthetic-but-
+pattern-true corpus (72 Claude Code sessions, 45 planted credentials, zero
+real secrets), with live egress monitoring so "no network calls" is
+observed, not just documented. Re-run against every meaningful release,
+most recently v0.4.14:
+
+| | residoo | best of the rest |
+|---|---|---|
+| Distinct credentials found (all claimed classes) | **45/45 (100%)** | agentsweep 33/42 (79%) |
+| Precision (false positives) | **100%** (0 of 55 flags wrong) | gitleaks, whatileaked, trufflehog also 100% |
+| Network egress during the scan | **none-observed** | 3 of 8 tools attempt real outbound calls in their *default* mode (trufflehog: 50 connection attempts to github.com, slack.com, api.anthropic.com, gitlab.com, npmjs.org) |
+
+No single blended score, on purpose: a blend would hide exactly the class-
+level differences (base64-wrapped, split-across-lines, JSON-nested) the
+benchmark exists to measure. Full per-class breakdown, fairness rules, and
+reproduction steps: [bench/](bench/). Self-run, pending independent
+reproduction; everything needed to rerun it ships in this repo.
+
 ## What it does
 
 - Scans your local AI-agent session transcripts for 50 high-confidence
@@ -265,7 +285,7 @@ As a GitHub Action (this repo doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.12
+  - uses: dandovdub/residoo@v0.4.14
 ```
 
 As a pre-commit hook:
@@ -273,7 +293,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.12
+    rev: v0.4.14
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.12",
+  "version": "0.4.14",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/patterns.js

@@ -67,8 +67,16 @@ const PATTERNS = [
     re: /\beyJ[A-Za-z0-9_-]{10,2000}\.eyJ[A-Za-z0-9_-]{10,20000}\.[A-Za-z0-9_-]{10,2000}\b/g },
   { id: "connection_string_with_password", label: "Database connection string with embedded password", confidence: "high",
     re: /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^\s:@\/]{1,255}:[^\s@\/]{3,255}@[^\s\/]{1,255}/g },
+  // \b alone missed a real shape: transcript text that embeds a literal
+  // newline as a JSON string escape ("\n", two characters: backslash then
+  // the letter n) leaves that trailing "n" glued directly to the "A" of
+  // "Authorization" with no actual whitespace between them on the scanned
+  // line, and \b never fires between two word characters. (?<=\\n) is the
+  // fix: it also accepts the position right after a literal "\n" escape as
+  // a valid left edge, alongside \b's normal boundary — found via this
+  // project's own benchmark (bench/RESULTS.md), not a hypothetical.
   { id: "bearer_header", label: "Authorization: Bearer header with a real-looking token", confidence: "medium",
-    re: /\bauthorization["']?\s*[:=]\s*["']?bearer\s+[A-Za-z0-9._-]{16,1000}/gi },
+    re: /(?:\b|(?<=\\n))authorization["']?\s*[:=]\s*["']?bearer\s+[A-Za-z0-9._-]{16,1000}/gi },
   { id: "refresh_token_field", label: "refresh_token field", confidence: "medium",
     re: /"refresh_token"\s*:\s*"[^"\s]{20,4000}"/gi },
   { id: "access_token_field", label: "access_token field", confidence: "medium",