residoo 0.4.9 → 0.4.10

package/README.md

@@ -195,10 +195,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.9 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.10 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.9 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.10 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -429,7 +429,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.9
+  - uses: dandovdub/residoo@v0.4.10
 ```
 
 As a pre-commit hook:
@@ -437,7 +437,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.9
+    rev: v0.4.10
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/scan.js

@@ -653,30 +653,30 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     // Deliberately not gated on isTTY like the scan spinner: a script
     // piping through a pager or into a log still needs this disclosure.
     //
-    // Three columns, not two: an earlier version of this table showed only
-    // the vendor name ("AWS  2"), which answers "how many" but drops the
-    // one thing a security-conscious user actually wants to check before
-    // agreeing to real outbound calls, namely WHICH endpoint each vendor's
-    // credential gets sent to. Every vendor's own SIMPLE_VERIFY_VENDOR_LABEL
-    // is already written "<Vendor>'s <endpoint>", so split it into the two
-    // columns rather than maintaining a second, parallel description.
+    // Went through two earlier shapes, each missing what mattered: first a
+    // bare vendor+count ("AWS  2", which credential?), then vendor+endpoint
+    // +count ("AWS  sts:get-caller-identity  2", still no way to tell WHICH
+    // two). What answers "which needs to be handled" is the same redacted
+    // preview (first/last 4 characters) already shown for that finding
+    // everywhere else in the report — reusing redact() on the same raw
+    // value record() was called with, not a second display convention.
+    // One line per vendor+endpoint header, one indented line per credential.
     const rows = [];
     if (pendingAwsVerifications.size > 0 && awsAvailable) {
-      rows.push(["AWS", "sts:get-caller-identity", pendingAwsVerifications.size]);
+      rows.push(["AWS", "sts:get-caller-identity", [...pendingAwsVerifications.keys()].map(redact)]);
     }
     if (pendingPlanetScaleVerifications.size > 0) {
-      rows.push(["PlanetScale", "organizations endpoint", pendingPlanetScaleVerifications.size]);
+      rows.push(["PlanetScale", "organizations endpoint", [...pendingPlanetScaleVerifications.keys()].map(redact)]);
     }
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;
       const [vendor, endpoint] = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ");
-      rows.push([vendor, endpoint, byValue.size]);
+      rows.push([vendor, endpoint, [...byValue.keys()].map(redact)]);
     }
     if (rows.length > 0) {
-      const vendorWidth = Math.max(...rows.map(([vendor]) => vendor.length));
-      const endpointWidth = Math.max(...rows.map(([, endpoint]) => endpoint.length));
       const table = rows
-        .map(([vendor, endpoint, count]) => `    ${vendor.padEnd(vendorWidth)}  ${endpoint.padEnd(endpointWidth)}  ${count}`)
+        .map(([vendor, endpoint, previews]) =>
+          `    ${vendor} · ${endpoint}\n` + previews.map((p) => `        ${p}`).join("\n"))
         .join("\n");
       process.stderr.write(
         "residoo --verify: checking whether these credentials are still active. Real network " +