residoo 0.8.1 → 0.8.2

package/README.md

@@ -65,17 +65,35 @@ covered in [docs/features.md](docs/features.md).
 
 Scored #1 of 8 real competing tools on a reproducible, synthetic-but-
 pattern-true corpus, with live egress monitoring so "no network calls" is
-observed, not just documented:
-
-| | residoo | best of the rest |
-|---|---|---|
-| Distinct credentials found (all claimed classes) | **45/45 (100%)** | agentsweep 33/42 (79%) |
-| Precision (false positives) | **100%** (0 of 55 flags wrong) | gitleaks, whatileaked, trufflehog also 100% |
-| Network egress during the scan | **none-observed** | 3 of 8 tools attempt real outbound calls in their *default* mode |
-
-Published while losing rows, then fixed in public against the classes it
-was losing — full methodology, every dated rerun, and how to reproduce it
-yourself: [docs/benchmark.md](docs/benchmark.md).
+observed, not just documented. All 8, not just the closest one:
+
+| tool | distinct credentials found | precision | egress during the scan |
+|---|---|---|---|
+| **residoo** | **45/45 (100%)** | **100%** | **none-observed** |
+| agentsweep | 33/42 (79%) | 100% | none-observed |
+| gitleaks | 32/45 (71%) | 100% | none-observed |
+| betterleaks | 32/45 (71%) | 100% | none-observed |
+| whatileaked | 28/42 (67%) | 100% | none-observed |
+| kingfisher | 29/45 (64%) | 100% | attempts calls in default mode |
+| trufflehog | 29/45 (64%) | 97% | attempts calls in default mode |
+| detect-secrets | 25/45 (56%) | 2% | attempts calls in default mode |
+
+"none-observed" is a measured result, not a default assumption: every run
+sits under a live proxy trap and process-tree polling, and a deliberate
+canary connection is fired and confirmed caught *before* each real
+benchmark run, specifically so a clean result is falsifiable evidence, not
+silence. The 3 rows with real outbound calls prove the monitor was
+watching them too — kingfisher, trufflehog, and detect-secrets each ship
+an *optional* live-verification feature (checking a found secret against
+the vendor's own API), scored here in their documented offline mode for a
+fair recall comparison, with their default mode's real connection
+attempts reported factually rather than hidden.
+
+GitGuardian's `ggshield` is documented, not scored: it refuses to run
+without a server account, so there's no local result to measure. Published
+while losing rows, then fixed in public against the classes it was losing
+— full methodology, every dated rerun, and how to reproduce it yourself:
+[docs/benchmark.md](docs/benchmark.md).
 
 ## What it does
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",
@@ -20,7 +20,8 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node tests/smoke.js"
+    "test": "node tests/smoke.js",
+    "fuzz": "node tests/fuzz.js"
   },
   "files": [
     "bin",
@@ -41,5 +42,8 @@
     "privacy",
     "cli",
     "encryption"
-  ]
+  ],
+  "devDependencies": {
+    "fast-check": "4.9.0"
+  }
 }

package/src/patterns.js

@@ -145,11 +145,16 @@ const PATTERNS = [
   // Confirmed via airtable.com/developers/web/api: pat + 14 alnum + "." + 64 hex.
   { id: "airtable_token", label: "Airtable personal access token", confidence: "high",
     re: /\bpat[A-Za-z0-9]{14}\.[a-f0-9]{64}\b/g },
-  // Current Cloudflare API Token format only (cfat_/cfut_, confirmed via
-  // developers.cloudflare.com). The legacy format is a bare 40-char string
-  // with no prefix, left out for the same reason as CircleCI's legacy form.
+  // Current Cloudflare credential formats only (cfat_/cfut_/cfk_, all three
+  // confirmed via developers.cloudflare.com/fundamentals/api/get-started/token-formats,
+  // which describes all three with the identical "<prefix>_[40 characters]
+  // [checksum]" shape). cfk_ (Global API Key, full account access) found
+  // missing by cross-checking agentsweep's own open issue tracker -- it had
+  // cfat_/cfut_ before this project did, cfk_ after. The legacy formats are
+  // bare unprefixed strings, left out for the same reason as CircleCI's
+  // legacy form.
   { id: "cloudflare_api_token", label: "Cloudflare API token", confidence: "high",
-    re: /\bcf[au]t_[a-zA-Z0-9]{40}[a-f0-9]{8}\b/g },
+    re: /\bcf(?:[au]t|k)_[a-zA-Z0-9]{40}[a-f0-9]{8}\b/g },
   // Current Heroku API key format only (HRKU-AA + 58 chars, confirmed via
   // Heroku's own help docs). The legacy format is a bare UUID, left out:
   // "any UUID-shaped string" is exactly the noisy, unspecific shape this