ClonePeek v0.2.1 — Git helper execution hardening

Security fix

The previous --changed-since path used git diff --name-only with untrusted repository-local Git configuration. A malicious core.fsmonitor setting was reproduced executing a helper that wrote an unwanted marker.

This release disables filesystem monitor helpers, external diffs, repository hook dispatch, unsafe protocol configuration and inherited Git/SSH/environment overrides for changed-file filtering. Structured argv, ref validation and a 15-second timeout remain in place.

Verification

29 regression tests pass locally, including a real exploit reproduction; six GitHub Actions jobs passed on Linux, Windows and macOS across Python 3.10 and 3.13. See docs/GIT-CONFIG-ISOLATION.md for a grounded reproduction and remaining trust limits.

Limitations

ClonePeek is a heuristic offline scanner, not a Git sandbox or malware verdict. The installed Git binary still executes; no comprehensive Git security audit is claimed.