Case study 01 · Developer tooling

Clean Room Launcher

CLROOM is an open-source Rust launch layer for Codex and Claude Code. It keeps project context available while excluding known unrelated global instructions and unselected global skills from that launch.

Inspect repository Read documentation CI

Problem

Installed context is not always task context.

Coding-agent setups accumulate global instructions, skills, plugins, hooks, and provider settings. A task may need only a small subset, but uninstalling or rewriting the normal setup is the wrong control surface.

The engineering problem was to make a launch selective without taking ownership of the provider installation, login, project files, or persistent configuration.

Constraints

Isolation had to stay narrow and reversible.

The installed Codex or Claude CLI remains the provider executable.
Project files, project instructions, and project-local skills stay available.
Selected global skills apply to one launch only; installed skill sources are not rewritten.
Provider authentication remains provider-owned.
If the required macOS filesystem restrictions cannot be created, the launcher fails instead of silently starting an inherited session.
The project explicitly does not claim to be a VM, container, network sandbox, or complete home-directory sandbox.

Decisions

Fail closed, keep the provider native.

Rust launcher + macOS SeatbeltThe launcher resolves the installed provider locally and applies focused filesystem restrictions around documented global instruction and skill roots.

Explicit skill admissionDirect skill names and saved @sets make selected global skills readable for that launch; project-local skills remain available automatically.

Clean defaults, not persistent rewritesCodex starts with global apps/hooks/plugins off by default and cleared developer instructions; Claude excludes global user instructions/settings and auto memory within the qualified path.

Provider-owned executionCLROOM launches the original CLI and does not become the orchestrator, login system, or coding-agent proxy.

Evidence

Public artifacts can be inspected independently.

Sourcegithub.com/y-sor/clean-room-launcher

Documentationy-sor.github.io/clean-room-launcher

CIPublic GitHub Actions workflow

Trust postureThe repository exposes its limitations, security policy, supported launch paths, and OpenSSF Best Practices badges instead of presenting the launcher as a broader sandbox than it is.

The repository can contain source work ahead of the latest published release. This page intentionally avoids claiming an unreleased source version as the currently published release.

Outcome

A reusable launch boundary, not another orchestrator.

The result is a repeatable way to start Codex or Claude Code with deliberate per-run inputs while keeping the normal provider setup intact. The value is the boundary itself: explicit context selection, visible restrictions, and failure instead of silent inheritance when the qualified isolation path cannot be established.