residoo 0.4.7 → 0.4.8

package/README.md

@@ -195,10 +195,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.7 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.8 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.7 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.8 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -429,7 +429,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.7
+  - uses: dandovdub/residoo@v0.4.8
 ```
 
 As a pre-commit hook:
@@ -437,7 +437,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.7
+    rev: v0.4.8
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/scan.js

@@ -641,26 +641,61 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
       ref.verifiedDetail = result.detail;
     }
   };
+  const awsAvailable = pendingAwsVerifications.size === 0 || isAwsCliAvailable();
+  if (verify && anyPending) {
+    // One disclosure, not one per vendor: this used to print a full
+    // "this is a real network request..." paragraph for EACH vendor in
+    // turn, so a scan touching nine vendors put nine near-identical
+    // paragraphs on screen before any results — a wall of repeated
+    // boilerplate, caught live as bad UX. The safety-relevant fact (real
+    // outbound calls, using the exact matched value, one at a time) only
+    // needs saying once; per-vendor detail becomes a compact count table.
+    // Deliberately not gated on isTTY like the scan spinner: a script
+    // piping through a pager or into a log still needs this disclosure.
+    const rows = [];
+    if (pendingAwsVerifications.size > 0 && awsAvailable) {
+      rows.push(["AWS", pendingAwsVerifications.size]);
+    }
+    if (pendingPlanetScaleVerifications.size > 0) {
+      rows.push(["PlanetScale", pendingPlanetScaleVerifications.size]);
+    }
+    for (const [ruleId, byValue] of pendingSimpleVerifications) {
+      if (byValue.size === 0) continue;
+      // Vendor labels are consistently written "<Vendor>'s <endpoint
+      // description>" (see SIMPLE_VERIFY_VENDOR_LABEL above); take the
+      // part before "'s" rather than maintaining a second, parallel map
+      // of the same names.
+      const vendor = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ")[0];
+      rows.push([vendor, byValue.size]);
+    }
+    if (rows.length > 0) {
+      const width = Math.max(...rows.map(([label]) => label.length));
+      const table = rows.map(([label, count]) => `    ${label.padEnd(width)}  ${count}`).join("\n");
+      process.stderr.write(
+        "residoo --verify: checking whether these credentials are still active. Real network " +
+        "calls, one per vendor's own API, using the exact value found in your transcript, one at " +
+        "a time. Nothing is cached or sent anywhere but the vendor that issued it.\n\n" +
+        table + "\n\n"
+      );
+    }
+    if (pendingAwsVerifications.size > 0 && !awsAvailable) {
+      process.stderr.write(
+        "residoo --verify: the aws CLI was not found on PATH, so the " +
+        `${pendingAwsVerifications.size} AWS credential(s) found in this scan could not be checked. ` +
+        "Install it (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to use --verify.\n"
+      );
+    }
+  }
   if (verify && pendingAwsVerifications.size > 0) {
     const applyPair = (refs, result) => {
       for (const ref of refs) {
         applyVerifyResult([ref.akiaFinding, ref.secretFinding], result);
       }
     };
-    if (!isAwsCliAvailable()) {
-      process.stderr.write(
-        "residoo --verify: the aws CLI was not found on PATH, so the " +
-        `${pendingAwsVerifications.size} AWS credential(s) found in this scan could not be checked. ` +
-        "Install it (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to use --verify.\n"
-      );
+    if (!awsAvailable) {
       const result = { status: "error", detail: "aws CLI not found on PATH" };
       for (const { refs } of pendingAwsVerifications.values()) applyPair(refs, result);
     } else {
-      process.stderr.write(
-        `residoo --verify: calling AWS sts:get-caller-identity for ${pendingAwsVerifications.size} ` +
-        "credential(s) found in this scan. This is a real network request to AWS, using the exact " +
-        "credential found in your transcript, one at a time.\n"
-      );
       for (const [accessKeyValue, { secretValue, refs }] of pendingAwsVerifications) {
         const result = verifyAwsCredential(accessKeyValue, secretValue);
         applyPair(refs, result);
@@ -668,11 +703,6 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     }
   }
   if (verify && pendingPlanetScaleVerifications.size > 0) {
-    process.stderr.write(
-      `residoo --verify: calling PlanetScale's organizations endpoint for ${pendingPlanetScaleVerifications.size} ` +
-      "credential(s) found in this scan. This is a real network request to PlanetScale, using the exact " +
-      "credential found in your transcript, one at a time.\n"
-    );
     for (const [secretValue, { idValue, refs }] of pendingPlanetScaleVerifications) {
       const result = await verifyPlanetScaleToken(idValue, secretValue);
       for (const ref of refs) applyVerifyResult([ref.secretFinding, ref.idFinding], result);
@@ -682,11 +712,6 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;
       const verifyFn = SIMPLE_VERIFY_FNS[ruleId];
-      process.stderr.write(
-        `residoo --verify: calling ${SIMPLE_VERIFY_VENDOR_LABEL[ruleId]} for ${byValue.size} ` +
-        "token(s) found in this scan. This is a real network request, using the exact " +
-        "token found in your transcript, one at a time.\n"
-      );
       for (const [value, { refs }] of byValue) {
         const result = await verifyFn(value);
         applyVerifyResult(refs, result);