pi-t3-bridge 0.8.1 → 0.8.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Change log
 
+## 0.8.2, 6 November 2026
+
+Version 0.8.2 closes a hole in the child sandbox. A delegated child whose brief missed a section or a header field ran with no sandbox and no limits, because the bridge treated it as the user's own session. Such a child could rewrite the parent's git hooks. Now every tool in that child is blocked, and the block lists what the brief is missing, so the parent can resend a complete one. A top-level session is never blocked, even when its first message starts with `# Task:`.
+
 ## 0.8.1, 6 November 2026
 
 Version 0.8.1 lets a delegated child run `pnpm install` and `git commit` in a pnpm and lefthook repo, under `bwrap` on Linux and `sandbox-exec` on macOS. Each child gets its own `XDG_RUNTIME_DIR` in the temp folder, where pnpm 12 takes its store lock. The sandbox can now write to the store that `pnpm store path` names for the workdir, and the child uses that store, so it shares the parent's store and does not build a second one in the workdir.

package/README.md

@@ -230,7 +230,7 @@ To choose your own models, run the `setup-pstack` skill, which writes a model sh
 
 ### Limits for delegated children
 
-When the first message of a session is a complete pstack brief, the extension treats the session as a delegated child and holds it to the limits in the brief. The child can't lift the limits through anything it writes.
+When the first message of a session is a complete pstack brief, the extension treats the session as a delegated child and holds it to the limits in the brief. The child can't lift the limits through anything it writes. A T3-delegated child whose brief has a `# Task:` heading but misses a section or a header field gets every tool blocked, with a list of what is missing, so it never runs without the sandbox.
 
 ```mermaid
 sequenceDiagram

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-t3-bridge",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Pi extension adapter for t3-pstack inside T3 Code.",
   "keywords": [
     "pi-extension",

package/src/pstack/brief.ts

@@ -253,10 +253,9 @@ const dispatchable = (brief: Brief): boolean =>
   brief.diskMb !== undefined &&
   SECTIONS.every((section) => brief.sections.has(section));
 
-// The brief that started this session, when it is a delegated child.
-export const sessionBrief = (
+const firstMessage = (
   ctx: ExtensionContext
-): { readonly brief: Brief; readonly startedAt: number } | undefined => {
+): { readonly at: number; readonly text: string } | undefined => {
   const first = ctx.sessionManager
     .getBranch()
     .find((entry) => entry.type === "message" && entry.message.role === "user");
@@ -267,13 +266,38 @@ export const sessionBrief = (
 
   const { content } = first.message;
 
-  const text = isString(content)
-    ? content
-    : content.map((part) => (part.type === "text" ? part.text : "")).join("\n");
+  return {
+    at: Date.parse(first.timestamp),
+    text: isString(content)
+      ? content
+      : content
+          .map((part) => (part.type === "text" ? part.text : ""))
+          .join("\n"),
+  };
+};
 
-  const brief = parseBrief(text);
+// The brief that started this session, when it is a delegated child.
+export const sessionBrief = (
+  ctx: ExtensionContext
+): { readonly brief: Brief; readonly startedAt: number } | undefined => {
+  const first = firstMessage(ctx);
+  const brief = first === undefined ? undefined : parseBrief(first.text);
+
+  return first === undefined || brief === undefined || !dispatchable(brief)
+    ? undefined
+    : { brief, startedAt: first.at };
+};
+
+// What is wrong with a brief that has a `# Task:` heading but is not complete
+// enough to hold a child to. Undefined when there is no such brief.
+export const incompleteBrief = (
+  ctx: ExtensionContext,
+  rules: BriefRules
+): string[] | undefined => {
+  const first = firstMessage(ctx);
+  const brief = first === undefined ? undefined : parseBrief(first.text);
 
-  return brief === undefined || !dispatchable(brief)
+  return first === undefined || brief === undefined || dispatchable(brief)
     ? undefined
-    : { brief, startedAt: Date.parse(first.timestamp) };
+    : briefProblems(first.text, rules);
 };

package/src/pstack/child.ts

@@ -22,9 +22,9 @@ import {
 
 import { bashTimeoutSeconds } from "../bridge/bash-timeout.ts";
 import { appendLedger } from "../bridge/state.ts";
-import { ownThreadId } from "../bridge/thread.ts";
-import { sessionBrief } from "./brief.ts";
-import type { Brief } from "./brief.ts";
+import { isDelegatedChild, ownThreadId } from "../bridge/thread.ts";
+import { incompleteBrief, sessionBrief } from "./brief.ts";
+import type { Brief, BriefRules } from "./brief.ts";
 import { policyPath } from "./resources.ts";
 import {
   chooseSandbox,
@@ -122,10 +122,22 @@ const isExecFailure = compile(
   )
 ).check;
 
+const isLimits = compile(obj({ files: num(), minutes: num() })).check;
+
 const isPolicy = compile(
   obj(
     {
-      briefs: opt(obj({ redBeforeGreen: opt(arr(str())) }, { open: true })),
+      briefs: opt(
+        obj(
+          {
+            noWrites: opt(arr(str())),
+            redBeforeGreen: opt(arr(str())),
+            sizes: opt(obj({}, { open: true })),
+          },
+          { open: true }
+        )
+      ),
+      jobs: opt(obj({}, { open: true })),
     },
     { open: true }
   )
@@ -139,10 +151,27 @@ const isPathInput = compile(obj({ path: str() }, { open: true })).check;
 
 const isNumber = compile(num()).check;
 
-const readRedBeforeGreen = (): readonly string[] => {
+const readPolicy = () => {
   const policy: unknown = JSON.parse(readFileSync(policyPath(), "utf-8"));
 
-  return isPolicy(policy) ? (policy.briefs?.redBeforeGreen ?? []) : [];
+  return isPolicy(policy) ? policy : {};
+};
+
+const readRedBeforeGreen = (): readonly string[] =>
+  readPolicy().briefs?.redBeforeGreen ?? [];
+
+const readBriefRules = (): BriefRules => {
+  const { briefs, jobs } = readPolicy();
+
+  return {
+    jobs: Object.keys(jobs ?? {}),
+    noWrites: briefs?.noWrites ?? [],
+    sizes: Object.fromEntries(
+      Object.entries(briefs?.sizes ?? {}).flatMap(([size, limits]) =>
+        isLimits(limits) ? [[size, limits] as const] : []
+      )
+    ),
+  };
 };
 
 const changedFiles = async (cwd: string): Promise<string[]> => {
@@ -227,6 +256,7 @@ interface ChildState {
   diskCheck: Promise<void>;
   diskOver: boolean;
   diskQueued: boolean;
+  delegated: boolean | undefined;
   gitDir: string | undefined;
   greenAtStart: boolean;
   ready: boolean;
@@ -237,6 +267,7 @@ export const registerChild = (pi: ExtensionAPI): void => {
   const state: ChildState = {
     baselineKb: undefined,
     before: undefined,
+    delegated: undefined,
     diskCheck: Promise.resolve(),
     diskOver: false,
     diskQueued: false,
@@ -331,7 +362,22 @@ export const registerChild = (pi: ExtensionAPI): void => {
     const started = sessionBrief(ctx);
 
     if (started === undefined) {
-      return;
+      // A delegated child whose brief is incomplete would otherwise run with
+      // no sandbox and no limits, as if it were the user's own session.
+      const problems = incompleteBrief(ctx, readBriefRules());
+
+      if (problems === undefined) {
+        return;
+      }
+
+      state.delegated ??= await isDelegatedChild();
+
+      return state.delegated
+        ? {
+            block: true,
+            reason: `This delegated task's brief is incomplete, so it can't run in the sandbox and every tool is blocked. Use no more tools. Report STATUS: BLOCKED (incomplete brief) with these problems, so the parent can resend a complete brief:\n- ${problems.join("\n- ")}`,
+          }
+        : undefined;
     }
 
     const { brief, startedAt } = started;