The product

The secret-leak guard refuses Bash, Read and Grep calls that would put secret values in the transcript, such as env, printenv or cat .env.local, and names the safe form instead: compgen -v | grep NAME, or extracting one field into a variable.

The worktree path guard refuses git worktree add under /tmp, /private/tmp or $TMPDIR, refuses merges whose tracked symlinks would delete ignored paths, and warns on git add -A inside a linked worktree.

Fork and cron hygiene puts a scope guard on forks spawned while a cron or /loop prompt is in context, and shows scheduled and background jobs on the status line.

They are guardrails against a model’s accidents, not a security boundary. Each README lists its known bypasses.

The beads pane shows bd ready, claimed beads and beads touched this session, and pins the active bead on the status line.

The rollout dashboard pane draws one row per repo from a local rollout.json (schema cw-rollout/1): PR state, CI, deploy wiring and verification.

The session-bus band shows unread bus messages above the prompt for a registered session. /wrap checks that a session is wrapped up and never pushes.

/kb, the ?kb prompt prefix and the model-callable kb_search tool run a scoped ripgrep over session dossiers, ADRs and plans, and attach at most 4,000 characters of untrusted-wrapped excerpts as hidden context.

Pull mode is the default. Automatic push mode failed its gate on the measured spike and stays off.

Claude Code refuses to load a hooks module that imports a file outside its own plugin folder, and a git install copies only the plugin’s subfolder. So a file in shared/ is copied byte for byte into each plugin, and CI fails on drift (ADR-0001).