residoo 0.4.7 → 0.4.9

package/README.md

@@ -195,10 +195,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.7 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.9 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.7 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.9 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -429,7 +429,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.7
+  - uses: dandovdub/residoo@v0.4.9
 ```
 
 As a pre-commit hook:
@@ -437,7 +437,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.7
+    rev: v0.4.9
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/scan.js

@@ -641,26 +641,68 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
       ref.verifiedDetail = result.detail;
     }
   };
+  const awsAvailable = pendingAwsVerifications.size === 0 || isAwsCliAvailable();
+  if (verify && anyPending) {
+    // One disclosure, not one per vendor: this used to print a full
+    // "this is a real network request..." paragraph for EACH vendor in
+    // turn, so a scan touching nine vendors put nine near-identical
+    // paragraphs on screen before any results — a wall of repeated
+    // boilerplate, caught live as bad UX. The safety-relevant fact (real
+    // outbound calls, using the exact matched value, one at a time) only
+    // needs saying once; per-vendor detail becomes a compact count table.
+    // Deliberately not gated on isTTY like the scan spinner: a script
+    // piping through a pager or into a log still needs this disclosure.
+    //
+    // Three columns, not two: an earlier version of this table showed only
+    // the vendor name ("AWS  2"), which answers "how many" but drops the
+    // one thing a security-conscious user actually wants to check before
+    // agreeing to real outbound calls, namely WHICH endpoint each vendor's
+    // credential gets sent to. Every vendor's own SIMPLE_VERIFY_VENDOR_LABEL
+    // is already written "<Vendor>'s <endpoint>", so split it into the two
+    // columns rather than maintaining a second, parallel description.
+    const rows = [];
+    if (pendingAwsVerifications.size > 0 && awsAvailable) {
+      rows.push(["AWS", "sts:get-caller-identity", pendingAwsVerifications.size]);
+    }
+    if (pendingPlanetScaleVerifications.size > 0) {
+      rows.push(["PlanetScale", "organizations endpoint", pendingPlanetScaleVerifications.size]);
+    }
+    for (const [ruleId, byValue] of pendingSimpleVerifications) {
+      if (byValue.size === 0) continue;
+      const [vendor, endpoint] = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ");
+      rows.push([vendor, endpoint, byValue.size]);
+    }
+    if (rows.length > 0) {
+      const vendorWidth = Math.max(...rows.map(([vendor]) => vendor.length));
+      const endpointWidth = Math.max(...rows.map(([, endpoint]) => endpoint.length));
+      const table = rows
+        .map(([vendor, endpoint, count]) => `    ${vendor.padEnd(vendorWidth)}  ${endpoint.padEnd(endpointWidth)}  ${count}`)
+        .join("\n");
+      process.stderr.write(
+        "residoo --verify: checking whether these credentials are still active. Real network " +
+        "calls, using the exact value found in your transcript, one at a time. Nothing is cached " +
+        "or sent anywhere but the endpoint listed below.\n\n" +
+        table + "\n\n"
+      );
+    }
+    if (pendingAwsVerifications.size > 0 && !awsAvailable) {
+      process.stderr.write(
+        "residoo --verify: the aws CLI was not found on PATH, so the " +
+        `${pendingAwsVerifications.size} AWS credential(s) found in this scan could not be checked. ` +
+        "Install it (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to use --verify.\n"
+      );
+    }
+  }
   if (verify && pendingAwsVerifications.size > 0) {
     const applyPair = (refs, result) => {
       for (const ref of refs) {
         applyVerifyResult([ref.akiaFinding, ref.secretFinding], result);
       }
     };
-    if (!isAwsCliAvailable()) {
-      process.stderr.write(
-        "residoo --verify: the aws CLI was not found on PATH, so the " +
-        `${pendingAwsVerifications.size} AWS credential(s) found in this scan could not be checked. ` +
-        "Install it (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to use --verify.\n"
-      );
+    if (!awsAvailable) {
       const result = { status: "error", detail: "aws CLI not found on PATH" };
       for (const { refs } of pendingAwsVerifications.values()) applyPair(refs, result);
     } else {
-      process.stderr.write(
-        `residoo --verify: calling AWS sts:get-caller-identity for ${pendingAwsVerifications.size} ` +
-        "credential(s) found in this scan. This is a real network request to AWS, using the exact " +
-        "credential found in your transcript, one at a time.\n"
-      );
       for (const [accessKeyValue, { secretValue, refs }] of pendingAwsVerifications) {
         const result = verifyAwsCredential(accessKeyValue, secretValue);
         applyPair(refs, result);
@@ -668,11 +710,6 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     }
   }
   if (verify && pendingPlanetScaleVerifications.size > 0) {
-    process.stderr.write(
-      `residoo --verify: calling PlanetScale's organizations endpoint for ${pendingPlanetScaleVerifications.size} ` +
-      "credential(s) found in this scan. This is a real network request to PlanetScale, using the exact " +
-      "credential found in your transcript, one at a time.\n"
-    );
     for (const [secretValue, { idValue, refs }] of pendingPlanetScaleVerifications) {
       const result = await verifyPlanetScaleToken(idValue, secretValue);
       for (const ref of refs) applyVerifyResult([ref.secretFinding, ref.idFinding], result);
@@ -682,11 +719,6 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;
       const verifyFn = SIMPLE_VERIFY_FNS[ruleId];
-      process.stderr.write(
-        `residoo --verify: calling ${SIMPLE_VERIFY_VENDOR_LABEL[ruleId]} for ${byValue.size} ` +
-        "token(s) found in this scan. This is a real network request, using the exact " +
-        "token found in your transcript, one at a time.\n"
-      );
       for (const [value, { refs }] of byValue) {
         const result = await verifyFn(value);
         applyVerifyResult(refs, result);