residoo 0.4.8 → 0.4.9

package/README.md

@@ -195,10 +195,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.8 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.9 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.8 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.9 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -429,7 +429,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.8
+  - uses: dandovdub/residoo@v0.4.9
 ```
 
 As a pre-commit hook:
@@ -437,7 +437,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.8
+    rev: v0.4.9
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/scan.js

@@ -652,29 +652,36 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     // needs saying once; per-vendor detail becomes a compact count table.
     // Deliberately not gated on isTTY like the scan spinner: a script
     // piping through a pager or into a log still needs this disclosure.
+    //
+    // Three columns, not two: an earlier version of this table showed only
+    // the vendor name ("AWS  2"), which answers "how many" but drops the
+    // one thing a security-conscious user actually wants to check before
+    // agreeing to real outbound calls, namely WHICH endpoint each vendor's
+    // credential gets sent to. Every vendor's own SIMPLE_VERIFY_VENDOR_LABEL
+    // is already written "<Vendor>'s <endpoint>", so split it into the two
+    // columns rather than maintaining a second, parallel description.
     const rows = [];
     if (pendingAwsVerifications.size > 0 && awsAvailable) {
-      rows.push(["AWS", pendingAwsVerifications.size]);
+      rows.push(["AWS", "sts:get-caller-identity", pendingAwsVerifications.size]);
     }
     if (pendingPlanetScaleVerifications.size > 0) {
-      rows.push(["PlanetScale", pendingPlanetScaleVerifications.size]);
+      rows.push(["PlanetScale", "organizations endpoint", pendingPlanetScaleVerifications.size]);
     }
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;
-      // Vendor labels are consistently written "<Vendor>'s <endpoint
-      // description>" (see SIMPLE_VERIFY_VENDOR_LABEL above); take the
-      // part before "'s" rather than maintaining a second, parallel map
-      // of the same names.
-      const vendor = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ")[0];
-      rows.push([vendor, byValue.size]);
+      const [vendor, endpoint] = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ");
+      rows.push([vendor, endpoint, byValue.size]);
     }
     if (rows.length > 0) {
-      const width = Math.max(...rows.map(([label]) => label.length));
-      const table = rows.map(([label, count]) => `    ${label.padEnd(width)}  ${count}`).join("\n");
+      const vendorWidth = Math.max(...rows.map(([vendor]) => vendor.length));
+      const endpointWidth = Math.max(...rows.map(([, endpoint]) => endpoint.length));
+      const table = rows
+        .map(([vendor, endpoint, count]) => `    ${vendor.padEnd(vendorWidth)}  ${endpoint.padEnd(endpointWidth)}  ${count}`)
+        .join("\n");
       process.stderr.write(
         "residoo --verify: checking whether these credentials are still active. Real network " +
-        "calls, one per vendor's own API, using the exact value found in your transcript, one at " +
-        "a time. Nothing is cached or sent anywhere but the vendor that issued it.\n\n" +
+        "calls, using the exact value found in your transcript, one at a time. Nothing is cached " +
+        "or sent anywhere but the endpoint listed below.\n\n" +
         table + "\n\n"
       );
     }