residoo 0.4.8 → 0.4.10

package/README.md

@@ -195,10 +195,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.8 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.10 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.8 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.10 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -429,7 +429,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.8
+  - uses: dandovdub/residoo@v0.4.10
 ```
 
 As a pre-commit hook:
@@ -437,7 +437,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.8
+    rev: v0.4.10
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/scan.js

@@ -652,29 +652,36 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     // needs saying once; per-vendor detail becomes a compact count table.
     // Deliberately not gated on isTTY like the scan spinner: a script
     // piping through a pager or into a log still needs this disclosure.
+    //
+    // Went through two earlier shapes, each missing what mattered: first a
+    // bare vendor+count ("AWS  2", which credential?), then vendor+endpoint
+    // +count ("AWS  sts:get-caller-identity  2", still no way to tell WHICH
+    // two). What answers "which needs to be handled" is the same redacted
+    // preview (first/last 4 characters) already shown for that finding
+    // everywhere else in the report — reusing redact() on the same raw
+    // value record() was called with, not a second display convention.
+    // One line per vendor+endpoint header, one indented line per credential.
     const rows = [];
     if (pendingAwsVerifications.size > 0 && awsAvailable) {
-      rows.push(["AWS", pendingAwsVerifications.size]);
+      rows.push(["AWS", "sts:get-caller-identity", [...pendingAwsVerifications.keys()].map(redact)]);
     }
     if (pendingPlanetScaleVerifications.size > 0) {
-      rows.push(["PlanetScale", pendingPlanetScaleVerifications.size]);
+      rows.push(["PlanetScale", "organizations endpoint", [...pendingPlanetScaleVerifications.keys()].map(redact)]);
     }
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;
-      // Vendor labels are consistently written "<Vendor>'s <endpoint
-      // description>" (see SIMPLE_VERIFY_VENDOR_LABEL above); take the
-      // part before "'s" rather than maintaining a second, parallel map
-      // of the same names.
-      const vendor = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ")[0];
-      rows.push([vendor, byValue.size]);
+      const [vendor, endpoint] = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ");
+      rows.push([vendor, endpoint, [...byValue.keys()].map(redact)]);
     }
     if (rows.length > 0) {
-      const width = Math.max(...rows.map(([label]) => label.length));
-      const table = rows.map(([label, count]) => `    ${label.padEnd(width)}  ${count}`).join("\n");
+      const table = rows
+        .map(([vendor, endpoint, previews]) =>
+          `    ${vendor} · ${endpoint}\n` + previews.map((p) => `        ${p}`).join("\n"))
+        .join("\n");
       process.stderr.write(
         "residoo --verify: checking whether these credentials are still active. Real network " +
-        "calls, one per vendor's own API, using the exact value found in your transcript, one at " +
-        "a time. Nothing is cached or sent anywhere but the vendor that issued it.\n\n" +
+        "calls, using the exact value found in your transcript, one at a time. Nothing is cached " +
+        "or sent anywhere but the endpoint listed below.\n\n" +
         table + "\n\n"
       );
     }