Guards

Records downloads, installs and started containers; /cleanup-list shows them.

Back office for the /company skill: every /company run is its own company (state file per company, several open at once), hires project specialists as agent types, enforces each company's optional budget cap on every spawn, shows the org and spend in a pane.

After a deploy command, runs 5 post-deploy checks from the project's .claude/deploy-verify.json and tells Claude the result.

Hides tokens, keys and passwords in tool output as ‹secret:N›, restores them in later tool calls, blocks reading key files.

Refuses ssh/scp/rsync to hosts listed in memory decommissioned_hosts.md; "# decommissioned-ok" overrides.