Clean Env Runner

Vol. 01 / Free & local

Security brief № 01Linux · macOS · Windows

Your shell knows too much.

Run commands with an explicit environment. Review every variable in; prove every other variable stayed out.

Install from source

cargo install --git https://github.com/B-Divyesh/sf-clean-env-runner

Rust 1.85+ · single binary · no telemetry

A cream manifest isolated within a red proof mark on a black letterpress bed.
Plate A. The manifest is the boundary; the receipt is the proof.

01 / The boundary

Start from nothing.

Most local runs inherit dozens of invisible choices: cloud keys, proxy settings, feature flags, language paths. Clean Env Runner clears the slate before the command starts.

  1. DeclareAllow only named variables.
  2. PreviewSee added, changed, and missing inputs.
  3. RunExecute inside the scrubbed process.
  4. ProveKeep a receipt with values removed.

02 / Desk proof

Audit a manifest before it runs.

This browser-only proofreader never uploads, stores, or executes your text. The CLI remains the authoritative validator.

Load edition:

Edit the text. The audit ledger updates immediately.

Audit ledger

Reviewing

03 / Field reference

A small contract on purpose.

Four commands cover the lifecycle. Every reporting command can emit JSON, and every failure has a stable exit code.

clean-env init
Write a commented starter manifest without overwriting an existing one.
clean-env preview [--json]
Show declared values, redactions, missing inputs, and the ambient removal count.
clean-env check [--json]
Validate the manifest and fail when a required source is unavailable.
clean-env run -- command
Clear the environment, run the child, preserve its exit code, and write a scrubbed receipt.

04 / Manifest anatomy

Values have provenance.

inherit = true

Copy the same-named parent variable.

from_env = "NAME"

Map an injected variable to a child name.

value = "test"

Declare a reviewable, non-secret literal.

secret = true

Redact its value everywhere Clean Env Runner reports.