Home workspaces for AI configuration
Dotfiles for your AI coding tools, with a package manager on top.
Install a package of instructions, skills, hooks and settings with one command. Workloom writes the files each AI tool reads, resolves secrets from your keychain, installs only the plugins you allowlisted, and can undo every change it made.
- file{{home}}/.claude/CLAUDE.mdowned file
- file{{home}}/.claude/skills/review/SKILL.mdowned file
- settings.claude/settings.jsonhook registered, reversible
- secret{{secret:REVIEW_API_TOKEN}}resolved from keychain
- pluginacme-lintheld · not on your allowlist: trust.plugin_unapproved
Sample data · 1 package · 2 files · 1 settings effect · 1 plugin held
What Workloom does
- 01
Home workspace package manager
Install, list, upgrade and remove AI config packages in your home directory.
- 02
Secrets that stay on your machine
{{secret:NAME}} references resolve locally at apply time, never in the registry.
- 03
Plugins and reversible settings
Settings edits you can undo, and plugins installed only from your allowlist.
- 04
Provider-aware rendering
One package renders into each provider’s native files, the same way every time.
- 05
Trust gates
Hooks, MCP servers, wildcards and inline secrets are blocked before any write.
- 06
Owned files, adopt and unbind
Workloom only touches files it wrote, and can hand everything back.
- 07
Drift checks in CI
A sync check fails the build when files on disk drift from the desired state.
- 08
Public catalog and forks
Share a workspace or package publicly, and fork someone else’s into your own.
- 09
Registry, approvals and audit
Packages, workspace revisions, package approvals and an audit log in one API.
- 10
Signed webhooks
HMAC-signed callbacks for publishes, approvals, CI tokens and drift.
- 11
Advisory AI review
An AI-written review of a package version or workspace, with a follow-up chat.
- 12
Private by default
Telemetry is off in new workspaces, and the registry rejects forbidden fields.
From a package to files on disk
- Step 1
Publish
Create a draft package version with `wl push --draft --package <path>`. A registry admin approves the version, and `wl visibility` can make it public in the catalog.
- Step 2
Install
`wl install <package>` pins a package ref in your home workspace. For a repository, `wl init` writes a workloom.workspace.json and `wl pull` fetches the current workspace revision.
- Step 3
Gate
Before any write, the trust gate blocks denied hooks, unapproved MCP servers, permission wildcards, sandbox weakening, inline secrets and plugins that are not on your allowlist.
- Step 4
Sync
`wl sync` (alias `wl apply`) writes the approved projections, fills in template tokens and {{secret:NAME}} references locally, applies settings effects and records every owned file.
Set up a new machine with one manifest
Keep your AI tool config in versioned packages, install it into every machine’s home directory, and let CI tell you when a repository drifts.