Usage

spillscan paths          # list transcript roots
spillscan scan           # exit 2 if findings
spillscan scan --json
spillscan redact         # dry-run
spillscan redact --write # .bak then [REDACTED:<rule>]
spillscan undo           # dry-run: which .bak originals can go back
spillscan undo --write   # restore them (lines written after the scrub are kept)
spillscan scan --allow team-fakes.txt   # skip known false positives (see Configuration)
spillscan scan --no-allow               # ignore every allowlist, show everything
spillscan guard          # PreToolUse stdin JSON → decision
spillscan mcp            # read-only MCP: scan_report, list_paths

Undo. spillscan undo only restores a file that still begins with exactly what the scrub wrote. If the agent kept appending to the session, those new lines are kept after the restored originals (appended). Anything else is diverged and left alone with its .bak, and the exit code is 1. Running redact --write a second time extends the existing .bak rather than overwriting it, so the first originals are never lost.

False positives. Every finding has a 12-character FP (fingerprint) column. Put fp:<FP> on a line in ~/.config/spillscan/allow.txt and scan, redact and the MCP scan_report skip that value from then on; scan's header says how many it hid (allowlisted=N). The full format is on Configuration. On main; ships in the next release.

Pass explicit paths to limit scope: spillscan scan ~/.claude/projects/foo