Skip to content

ClonePeek v0.3.0 — Cursor hooks and real terminal demo

Choose a tag to compare

View all tags
@harshitethic harshitethic released this 15 Oct 06:38
· 34 commits to main since this release
v0.3.0
5ae0558
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ClonePeek v0.3.0 — see what agent and editor hooks can run

Know what runs before you open an unfamiliar repository. ClonePeek is a local, read-only Python CLI with no runtime dependencies, no telemetry, and evidence-based findings—not a malware verdict.

New in v0.3.0

  • Cursor project hooks: inspect .cursor/hooks.json for executable project-defined commands, including workspaceOpen, sessionStart, file-edit and agent events. Show trigger, file, source line and review guidance.
  • Claude local hooks: inventory .claude/settings.local.json in addition to project settings.
  • Honest demo: actual CLI output and a terminal preview from a combined Cursor/Claude example; only safe .invalid URLs are included. No sample commands are executed.
  • Public smoke test: correctly reports seven medium command hooks from the public Cursor cookbook configuration. See reproduction and SHA-256. This is not a representative accuracy study.
  • Correct SARIF version metadata: reflects the installed version.
  • Tests and evaluation: 43 unit tests; a 51-case synthetic review-urgency evaluation with documented false positives/negatives. Those figures do not estimate performance on real repositories.

One-command start

uvx --from git+https://github.com/harshitethic/clonepeek@v0.3.0 clonepeek /path/to/repo

Or download the wheel/source archive attached to this release. Demo: clonepeek examples/agent-hooks from the source checkout.

Limits and safety

The scanner intentionally does not execute repository code or follow references into all nested scripts. It cannot prove a repository safe, and it may miss dangerous configurations or flag benign hooks as high urgency. Treat source excerpts and generated reports as potentially sensitive. Read the threat model before using this for security decisions.

Feedback and contributors

Open a reproducible issue for missed or overly severe hook classifications. Use redacted, inert examples only. Contributions should expand independent fixture coverage rather than claiming perfect detection. Discuss ideas.

Assets 4
Loading