Provider sandbox & model routing

Before launching a CLI provider the daemon refuses an unsafe working directory, then confines the provider to the task worktree and picks a model sized to the run.

Unsafe-cwd refusal

• Rejects launching in a too-broad directory — /, /tmp, /var, /Users, /home or $HOME itself.
• Requires a .git boundary at or above the cwd, so a provider running git add -A cannot stage unrelated work from a stale parent repo.

Claude sandbox

• Adds --add-dir <worktree> — the only directory the provider may read/write outside its own state.
• Strips any --dangerously-skip-permissions, so an out-of-tree mutation surfaces as a prompt a non-interactive worker cannot answer (it is refused, not silently executed).
• Injects --output-format stream-json --verbose for non-interactive workers so long runs stream live instead of buffering to exit.

Model routing by run purpose

The run’s purpose maps to a difficulty tier, then to a model. An explicit caller hint always wins; otherwise the tier table applies; otherwise the provider default; otherwise a compiled fallback.