residoo 0.7.1 → 0.7.2

package/README.md

@@ -10,6 +10,7 @@
 
 [![npm version](https://img.shields.io/npm/v/residoo)](https://www.npmjs.com/package/residoo)
 [![CI](https://github.com/dandovdub/residoo/actions/workflows/ci.yml/badge.svg)](https://github.com/dandovdub/residoo/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/dandovdub/residoo/badge)](https://scorecard.dev/viewer/?uri=github.com/dandovdub/residoo)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![node >=18](https://img.shields.io/badge/node-%3E%3D18-339933)](package.json)
 [![runtime dependencies: 0](https://img.shields.io/badge/runtime_dependencies-0-brightgreen)](package.json)
@@ -60,13 +61,33 @@ watching 43 sources, 118 files · polling every 5s
 > trufflehog/betterleaks' verification postures, in
 > [docs/comparison.md](docs/comparison.md).
 
+Scan and watch tell you what already leaked. The most common way a NEW
+leak happens is pasting a key into the chat so Claude can use it, which
+then sits in that conversation's transcript forever, the exact thing scan
+exists to catch in the first place. `residoo cred` closes that loop: store
+a credential once in your OS keychain, then let Claude run a command with
+it injected as an environment variable, never pasted into the chat, never
+written into a script (see
+[Cred: run commands with injected credentials](#cred-run-commands-with-injected-credentials)):
+
+```
+$ residoo cred set aws-prod --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY
+Value for AWS_ACCESS_KEY_ID (input hidden):
+Value for AWS_SECRET_ACCESS_KEY (input hidden):
+Stored credential "aws-prod" (2 env vars: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY).
+
+$ residoo cred run aws-prod -- aws s3 ls
+exit 0 (succeeded). stdout: 3 line(s), stderr: 0 line(s).
+Command output is never shown by design, only exit status and line counts.
+```
+
 ## Benchmark: measured, not claimed
 
 A reproducible benchmark against 8 real competing tools, on a synthetic-but-
 pattern-true corpus (72 Claude Code sessions, 45 planted credentials, zero
 real secrets), with live egress monitoring so "no network calls" is
 observed, not just documented. Re-run against every meaningful release,
-most recently v0.4.14:
+most recently v0.7.2:
 
 | | residoo | best of the rest |
 |---|---|---|
@@ -310,7 +331,7 @@ As a GitHub Action (this repo doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.7.1
+  - uses: dandovdub/residoo@v0.7.2
 ```
 
 As a pre-commit hook:
@@ -318,7 +339,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.7.1
+    rev: v0.7.2
     hooks:
       - id: residoo
 ```
@@ -475,9 +496,13 @@ injected-credential execution, covered below.
 
 ## Cred: run commands with injected credentials
 
-`residoo cred` stores a live, reusable credential in the OS keychain and
-runs one allow-listed command with it injected as environment variables:
-Claude never sees the raw value, before, during, or after:
+The usual way an AI coding agent ends up able to use a real credential is
+you pasting it into the chat, which puts it in that conversation's
+transcript forever, indistinguishable from any other leak `residoo scan`
+finds. `residoo cred` is the alternative: store the credential once in
+your OS keychain, then let Claude run one allow-listed command with it
+injected as environment variables. Claude never sees the raw value,
+before, during, or after, and it's never written into a script either.
 
 ```bash
 residoo cred set aws-prod --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY

package/SECURITY.md

@@ -83,7 +83,16 @@ the kind of thing worth impersonating.
   built it; check the provenance badge on the npm page. One honest
   exception, stated rather than hidden: the very first release (v0.1.0)
   was a manual upload to claim the name, so provenance starts at the first
-  CI-published version after it.
+  CI-published version after it. Concretely, this is npm's own [Trusted
+  Publishing](https://docs.npmjs.com/trusted-publishers): no stored token
+  anywhere, GitHub mints a short-lived, workflow-scoped OIDC credential per
+  release, and the resulting provenance statement is signed and published
+  to the public [Sigstore transparency log](https://search.sigstore.dev/),
+  independently checkable by anyone, not just trusted on residoo's word.
+  In [SLSA](https://slsa.dev/) terms that's Build Level 2 (a hosted,
+  authenticated build platform generates non-forgeable provenance); Level
+  3 (fully hermetic, isolated builds) isn't implemented yet, stated
+  plainly rather than implied.
 - The only PyPI package is **`residoo`**: a thin official launcher whose
   entire job is running the npm CLI via `npx`. Its source lives in this
   repository under `pypi/`. It exists partly so nobody else can hold the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/decode.js

@@ -306,6 +306,25 @@ function findDecodedMatches(line, rules) {
 const BOUNDARY_WINDOW = 300;   // chars taken from each side of the seam
 const BOUNDARY_MIN_CONTENT = 24; // shorter "longest string" is treated as non-content
 
+// Minimum characters EACH side of the seam must contribute to a straddling
+// match for it to be trusted as a genuine split, not coincidence. Found via
+// this project's own benchmark stress-testing (2026-09-03), not hypothetical:
+// a variable-length rule (bearer_header, {16,1000}) can sit ONE character
+// short of its own minimum at the end of a line (a near-miss, not a complete
+// match — the existing greedy-extension guard above only recognizes COMPLETE
+// tail-alone matches, so it never sees this case), and if the very next
+// line's content happens to start with even one or two more characters the
+// pattern's class allows, the straddle pass stitches two entirely unrelated,
+// benign lines into a fabricated value that exists in neither. Existing
+// legitimate-split tests (tests/smoke.js) cut real secrets 9-11 characters
+// from each end, comfortably clear of this floor; a genuine chunked-
+// streaming boundary landing with less than this on one side, while
+// possible, is far rarer than the coincidental-concatenation failure mode
+// this exists to close, and the fragment still gets caught by the raw,
+// single-line pass once enough of it lands on either side to satisfy the
+// rule outright.
+const BOUNDARY_MIN_CONTRIBUTION = 4;
+
 /**
  * Escape-aware list of JSON string-literal CONTENTS on a line. Field names
  * are included (this walker does not distinguish keys from values); the
@@ -395,8 +414,15 @@ function findBoundaryMatches(contentA, contentB, rules) {
       const start = m.index;
       const end = m.index + m[0].length;
       // Straddle-only: the match must cross the seam, else it lay wholly in
-      // one line and the single-line pass already reported it.
-      if (start < seam && end > seam) straddles.push({ start, end, value: m[0] });
+      // one line and the single-line pass already reported it. Each side
+      // must also contribute a real fragment (BOUNDARY_MIN_CONTRIBUTION,
+      // see its own doc comment) -- otherwise this is a near-miss single-
+      // line match that unrelated adjacent content happened to push over a
+      // length-quantifier's minimum, not a genuine split.
+      if (start < seam && end > seam &&
+          (seam - start) >= BOUNDARY_MIN_CONTRIBUTION && (end - seam) >= BOUNDARY_MIN_CONTRIBUTION) {
+        straddles.push({ start, end, value: m[0] });
+      }
       if (m.index === rule.re.lastIndex) rule.re.lastIndex++;
     }
     let flush = null;