v0.1.5

Fixes the false positives found by an independent audit of v0.1.4: 100 realistic agent tool calls across Claude Code, Codex, Gemini CLI and Cursor. Bypasses stay closed.

Now allowed (15 cases that v0.1.4 denied):

• Writes to your own files built with Join-Path/+ from $HOME, ~, $env:APPDATA, USERPROFILE or LOCALAPPDATA, such as .npmrc, .gitconfig, .bashrc, VS Code settings and Documents\todo.txt. The path is literal and is not ExactGround's.
• Loops whose body runs a literal tool: ForEach-Object { npx eslint $_ }, foreach (...) { npm test $f }, for %f in (*.js) do npx prettier --write %f, and ForEach-Object { pip install -r requirements.txt }. The body is parsed and checked like any other command.
• & $python -m pip install requests, which is parsed from the literal pip.

Still denied:

• ExactGround's own config, approvals and cache, in any split form.
• A per-user write whose path after the user directory is a variable. The deny message now says so.
• & ('np'+'m') install, & $pm install, and for %I in (npm) do %I install.

Newly denied: a package name held in a variable (npm install $p, npx $_, pip install $PKG), because it cannot be checked.

Tests: test/falsepositive.test.mjs holds all 100 audit cases plus bypass guards; the suite has 155 tests. Generated site files now always use LF line endings.

Unchanged: a same-user agent that deliberately obfuscates its commands remains out of scope; see SECURITY.md.

v0.1.4

Final hardening pass on an independent re-review of v0.1.3.

Fixed

• NTFS alternate data streams: writes to .exactground.json::$DATA, .exactground.json:x or a trailing-dot name are writes to the policy file, and are denied.
• cmd caret escapes (np^m install x) are removed and the install is checked normally.
• Program names built at run time are denied as unverifiable when an install verb or a package manager appears. Covered forms: call-operator expressions (& ('np'+'m') install x, & ('npm') ..., & $(...)) and loops (for %I in (npm) do %I install x, foreach, ForEach-Object, for ... do).
• cmd /c and pwsh -Command followed by an unquoted command now parse the whole rest of the line.
• Writes whose target is built with Join-Path, string concatenation or environment variables ($env:APPDATA, %APPDATA%, $HOME, ~, XDG_CONFIG_HOME, EXACTGROUND_CONFIG_DIR) into ExactGround's config, approval or cache directories are denied. The same applies when the command names those files in split form ('ex'+'actground').
• background no longer matches the policy-path hint (false positive).

The false-positive table stays allowed: git add, apt/brew/winget/choco installs, code --install-extension, npm run/npm test, pip list, reads, and ordinary Join-Path writes inside the project.

Out of scope, stated plainly (new SECURITY.md)
A same-user agent that deliberately obfuscates its commands can defeat any hook-based guard, including this one. ExactGround will not chase that class further. For adversarial agents, use an OS sandbox or container, or a separate OS user.

ExactGround v0.1.3 — re-review security fixes

Security release. It closes the bypasses an independent re-review found in v0.1.2. Upgrade recommended.

Threat model: ExactGround stops an agent that hallucinates or mistypes a package name in a normal install command. It is a cooperative guardrail, not a sandbox against an agent deliberately evading it; use OS or container sandboxing for that.

• Policy files:
  • Your user-level config.json now needs approval, like project files: exactground trust --user.
  • Shell commands that write ExactGround's policy, approvals or cache are denied whatever the verb (copy, xcopy, robocopy, move, [IO.File]::WriteAllText, Out-File, redirection), as are inline write one-liners that build those paths.
• Every tool is inspected:
  • The hooks now match all tools.
  • Any tool that carries a command (for example Claude Code's PowerShell tool) is treated as a shell.
  • Every non-read-only tool, such as NotebookEdit or MCP filesystem tools, has its paths checked.
• Package managers are found however they are invoked: variables (n=npm; $n install x, $pm="npm"; & $pm install x, %PM%), 8.3 short names (NPM~1.EXE), .cmd/.ps1 suffixes and full paths are resolved and checked. iex, Invoke-Expression, Start-Process and -EncodedCommand combined with a package manager are denied.
• No false positives: git add, apt/brew/winget/choco install and code --install-extension stay allowed (tested).
• pip install -r: files with extra hard links, or whose real path leaves the project through a junction or linked directory, are refused.
• Tests: 46 offline tests (10 new); CI green on Windows and Linux with Node 20 and 24.

Install: claude plugin marketplace add alidaram99/exactground · codex plugin marketplace add alidaram99/exactground --ref v0.1.3 · gemini extensions install https://github.com/alidaram99/exactground --ref v0.1.3 · npx -y github:alidaram99/exactground#v0.1.3 check <pkg>

ExactGround v0.1.2 — security fixes

Security release. It fixes the findings of an independent review. Upgrade from v0.1.0/v0.1.1.

• The agent can no longer approve its own install (high).
  • Hooks re-check the registry for every install and never allow from the local cache.
  • Strict mode is the hook default, so an unreachable registry means deny.
  • A project .exactground.json counts only after you run exactground trust, which records its SHA-256 outside the project. Any edit needs approval again.
  • Tool calls that write .exactground.json, the approvals or the cache are denied.
• Fails closed. If the hook itself errors, the action is denied (EXACTGROUND_FAIL_OPEN=1 to opt out). Installs hidden in node -e, python -c, $(...) or eval are denied, because they cannot be checked.
• pip install -r files must be regular files inside the project (no symlinks, at most 256 KB). Anything else denies the install.
• Fix: scoped npm names are encoded for the downloads API.
• Docs:
  • The limits are on the first screen.
  • The quickstart is pinned: npx -y github:alidaram99/exactground#v0.1.2.
  • The hosted API is marked as awaiting Apify Store publication.
• Tests: 36 offline tests (8 new security regression tests); CI green on Windows and Linux with Node 20 and 24.

Install: claude plugin marketplace add alidaram99/exactground · codex plugin marketplace add alidaram99/exactground --ref v0.1.2 · gemini extensions install https://github.com/alidaram99/exactground --ref v0.1.2

ExactGround v0.1.1

Gemini CLI extension and discovery release.

• Gemini CLI extension: gemini extensions install https://github.com/alidaram99/exactground --ref v0.1.1. Root gemini-extension.json and GEMINI.md. The BeforeTool hook on run_shell_command|write_file|replace lives in hooks/hooks.json next to Claude Code's PreToolUse (Claude ignores the Gemini event). Validated with gemini extensions validate.
• MCP Registry:
  • The publishing workflow now publishes only when the Apify Actor behind the remote endpoint is public and the version is new.
  • It re-checks daily, and can be run by hand.
  • io.github.alidaram99/exactground 0.1.0 is already listed.
• Docs: README and site lead with the direct answer, the FAQ covers Gemini, and there are links to the team's other tools (DoneLatch, CanaryIndex, Waraq).
• 28 offline tests; CI green on Windows and Linux with Node 20 and 24.

ExactGround v0.1.0

First release of ExactGround: stop AI coding agents from installing npm and PyPI packages that do not exist.

Free local guard (this repo, MIT, zero dependencies, Node ≥ 20)

• Hooks for Claude Code (plugin: claude plugin marketplace add alidaram99/exactground), Codex (PreToolUse on Bash + apply_patch), Gemini CLI (BeforeTool) and Cursor (beforeShellExecution).
• Blocks:
  • names missing from the registry (hallucinated packages, slopsquatting);
  • pinned versions that were never published;
  • npm security placeholders;
  • young or rarely downloaded look-alikes of the top 3,000 npm/PyPI packages.
• Warns: new, low-download, deprecated or yanked packages.
• Covers:
  • npm/pnpm/yarn/bun/npx and pip/uv/poetry/pdm/pipx/uvx;
  • pip install -r;
  • bare installs, checked against the lockfile;
  • manifest edits and Codex patches.
• npx -y github:alidaram99/exactground check …, plus scan, manifest, init <agent> --write.

Hosted API (pay per check, MCP + REST): https://apify.com/dropin-apis/exactground-api

• check_symbols (does a function, class or method exist in this exact npm/PyPI version?): $0.002 per symbol.
• check_packages: $0.0005 per package.
• check_diff: $0.01 per diff.

Tested: 27 offline tests on Windows and Linux (Node 20 and 24), and live registry smoke tests.