Leadcode Client Workspace Isolation Setup (Onboarding)

Leadcode Client Workspace Isolation Setup (Onboarding)

1. 01

   Install Leadcode on a dedicated macOS machine

   Download the app and grant it the necessary permissions. Ensure the machine is dedicated to client work to avoid cross-contamination with personal projects.

2. 02

   Create a workspace for the pilot client

   In the Leadcode main window, click 'New Workspace' and name it after the client. This workspace will hold all credentials and bindings for that client.

3. 03

   Add GitHub, Claude, and cloud credentials to the workspace

   Navigate to the workspace's 'Credentials' tab and input the client's GitHub token, Claude API key, and cloud service keys (e.g., AWS, GCP). Leadcode stores these in the macOS Keychain.

4. 04

   Define persona and binding templates

   In the 'Templates' section, create a persona that maps the client's identity to the workspace. Bind the credentials to the workspace so that any session started here uses only these accounts.

5. 05

   Activate the fail-closed router

   Toggle the router setting to 'Fail-closed' in the workspace's 'Security' tab. This ensures ambient credentials are scrubbed and only declared bindings are injected into sessions.

6. 06

   Run a test session to verify isolation

   Start a Claude Code session within the workspace and execute a simple command like 'git remote -v' to confirm it uses the client's GitHub identity. Also test a cloud CLI command to ensure it targets the correct account.

7. 07

   Document the workspace switching protocol

   Create a short internal guide for your team on how to switch between workspaces and verify the active client before running any command. Include a checklist for credential hygiene.