Skip to content

ClonePeek v0.4.1 — Correct changed-script diff scans

Choose a tag to compare

View all tags
@harshitethic harshitethic released this 15 Oct 08:24
· 36 commits to main since this release
v0.4.1
dfb6467
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ClonePeek v0.4.1 — Correct changed-script PR reviews

Patch release addressing a changed-file scan blind spot. The v0.4.0 scanner added bounded, read-only inspection of local shell scripts explicitly referenced by npm/editor/agent execution hooks. --changed-since could previously miss a change made only to a script when its referencing configuration file remained unchanged.

Fix

  • A tracked changed .sh file now triggers limited reinspection of unchanged recognized configurations for literal references to that script.
  • If the configuration itself is unchanged, the diff-only report surfaces just the relevant changed script finding rather than reopening every previously known lifecycle finding.
  • Tests cover an actual temporary Git repository in which only scripts/setup.sh changes from harmless text to a synthetic fetch-and-execute command using a reserved .invalid domain. Nothing is executed during the scan.
  • 55 unit tests, a cross-platform Windows/macOS/Linux CI matrix, and the same bounded read-only implementation with symlink and path-escape defenses.

Run

uvx --from git+https://github.com/harshitethic/clonepeek@v0.4.1 clonepeek /path/to/repo
clonepeek /path/to/repo --changed-since HEAD --fail-on high

The second example expects a Git repository and uses tracked changes. Untracked files, shell-variable references, additional script hops, non-.sh script types and dynamic commands are outside its guarantee. The tool does not execute repository scripts or make security verdicts. These heuristics are not malware detection or proof that a repository is safe.

Read the full threat model · Contribute

Assets 4
Loading