Scan on clone

A worm fires when you install dependencies, run a build, or open the folder in an editor — not when you clone. And a worm spreads when you push it on to a shared remote, where it reaches your collaborators and your CI. saw hook puts a scan in between on both sides: a fresh clone and its submodules, a pull, a branch switch, a rebase or a file checkout (git checkout <rev> -- <paths>, git restore) is scanned and you are warned before you run anything, and a git push is checked for every file version it would publish, and reported, before the code leaves your machine. Flags: CLI reference.

saw hook install                       # new clones and this repository are scanned automatically
saw hook install ~/dev                 # give the hooks to every repository under ~/dev
saw hook install -c ~/security.yml     # scan them against YOUR allowlist
saw hook status                        # active? where is its state?
saw hook uninstall                     # stop
SAW_HOOK_DISABLED=1 git clone <url>    # one-off bypass, no uninstall needed

The hook warns and points at saw fix. It modifies nothing and can never break a git command. It is scanned against your allowlist, never the cloned repository's own config — see trust model.

What you are installing. Hooks that git runs, unprompted, in your repositories. Each repository keeps them current on its own, and saw audit reports a hook saw did not install or one that has been changed. With git 2.54 or later, repositories you already have are scanned as well; with an older git, install says to update it.

Limits worth knowing. git reset --hard runs no hook, so scan that yourself. If git runs every repository's hooks from one folder that saw cannot use, install and status say so. saw never stops a push: a push it could not check in full reads as not verified, never clean.

CI has no clone hook; the equivalent there is gate CI.