model sidecar: the owner's claude CLI behind a small API, the hl tool and its guard hook

runClaude runs the unmodified CLI in print mode with a JSON-schema answer, in a fresh empty directory
with only PATH, HOME, CLAUDE_CONFIG_DIR (the owner's login) and the session's HL_URL/HL_TOKEN; the tools
profile allows Bash(hl *) and Read/Edit/Write under dontAsk, with a PreToolUse hook (model-guard.ts)
that refuses anything else. Usage limits and expired logins come back as rate_limited / auth_failed.
POST /run on the sidecar, one run at a time; the driver's client throws ModelError. hl (bin/hl) maps
each command to one executor agent route; compose saves ./compose.yaml and write sends it back.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bin/hl

@@ -0,0 +1,3 @@
+#!/bin/sh
+# The repairing model's only command (src/main/hl.ts).
+exec node /app/src/main/hl.ts "$@"