pi-t3-bridge 0.8.1 → 0.8.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Change log
 
+## 0.8.3, 6 November 2026
+
+Version 0.8.3 hardens the child sandbox from a large orchestration run. A bullet under "Files you may write" may now list several paths; every token with a slash or a glob counts. The disk limit no longer counts `node_modules`, which pnpm fills from the store, so a 500 MB limit no longer fails on a pnpm monorepo install. On Linux the child runs in its own PID namespace and cannot see or signal host processes, and anything a command starts in the background ends with that command. The child env now sets `TMPDIR`. Chrome, Electron and headless shells need `--no-sandbox` inside the sandbox, because their own namespace sandbox cannot nest under bwrap, and the sandbox already confines them; this is now documented, along with `PI_CODING_AGENT_DIR` for running `pi` inside a child.
+
+## 0.8.2, 6 November 2026
+
+Version 0.8.2 closes a hole in the child sandbox. A delegated child whose brief missed a section or a header field ran with no sandbox and no limits, because the bridge treated it as the user's own session. Such a child could rewrite the parent's git hooks. Now every tool in that child is blocked, and the block lists what the brief is missing, so the parent can resend a complete one. A top-level session is never blocked, even when its first message starts with `# Task:`.
+
 ## 0.8.1, 6 November 2026
 
 Version 0.8.1 lets a delegated child run `pnpm install` and `git commit` in a pnpm and lefthook repo, under `bwrap` on Linux and `sandbox-exec` on macOS. Each child gets its own `XDG_RUNTIME_DIR` in the temp folder, where pnpm 12 takes its store lock. The sandbox can now write to the store that `pnpm store path` names for the workdir, and the child uses that store, so it shares the parent's store and does not build a second one in the workdir.

package/README.md

@@ -31,6 +31,8 @@ A delegated child runs its shell commands in a sandbox, which is `sandbox-exec`
 
 Inside the sandbox a child can write only to its workdir, its git directory, the tool caches, the pnpm store, and the system temp folder. The git hooks and git config stay read-only, because the parent runs them later outside the sandbox. Each child gets its own `XDG_RUNTIME_DIR` in the temp folder, where pnpm takes its store lock. The child also gets `pnpm_config_store_dir` set to the store that `pnpm store path` names for the workdir outside the sandbox, so it shares the parent's store. Under `bwrap`, pnpm copies packages from the store, because Linux refuses hardlinks across the sandbox's mounts. Children skip install scripts (`npm_config_ignore_scripts` and `pnpm_config_ignore_scripts` are `true`), so a root `prepare` such as `lefthook install` does not run. With this setting npm also skips the pre and post scripts of `npm run` and `npm test`, while pnpm still runs them. Steps that only a postinstall runs must run through the build or typecheck the brief names.
 
+The child also gets `TMPDIR` set. On Linux the child cannot see or signal processes outside its own commands, so a stray `pkill` cannot reach a daemon on the host, and anything a command starts in the background dies when that command ends. Chrome, Electron and headless shells need `--no-sandbox` inside the sandbox, because their own namespace sandbox cannot nest under bwrap; the sandbox already confines them. A `pi` run inside the sandbox needs `PI_CODING_AGENT_DIR` pointing at a writable temp copy of `~/.pi/agent`, because the real one is read-only. The disk limit in a brief ignores `node_modules`, which pnpm fills from the store.
+
 Native Windows and WSL1 have no sandbox. Where no sandbox can run, the bridge blocks a child's shell commands, unless you set `childSandbox` to `"off"` in the settings file.
 
 ## Install
@@ -150,7 +152,9 @@ on(run about to stop)
   ask the classifier how the run ended
   if the classifier is down or takes more than 5 seconds
     let the run stop
-  if the agent gave up partway and fewer than 2 notes were sent for the current prompt
+  if the agent gave up partway
+    if a stop note was already sent for the current prompt
+      log the check as capped in steer.jsonl and let the run stop
     add a note
     continue for one more turn
 
@@ -230,7 +234,7 @@ To choose your own models, run the `setup-pstack` skill, which writes a model sh
 
 ### Limits for delegated children
 
-When the first message of a session is a complete pstack brief, the extension treats the session as a delegated child and holds it to the limits in the brief. The child can't lift the limits through anything it writes.
+When the first message of a session is a complete pstack brief, the extension treats the session as a delegated child and holds it to the limits in the brief. The child can't lift the limits through anything it writes. A T3-delegated child whose brief has a `# Task:` heading but misses a section or a header field gets every tool blocked, with a list of what is missing, so it never runs without the sandbox.
 
 ```mermaid
 sequenceDiagram

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-t3-bridge",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Pi extension adapter for t3-pstack inside T3 Code.",
   "keywords": [
     "pi-extension",

package/pstack/skills/poteto-mode/brief.md

@@ -61,6 +61,9 @@ ISSUES or BLOCKED: one line each with file:line and the command that shows it
 The child's own pstack extension reads this brief from its first message and enforces it, whatever the model does:
 
 - Every shell command runs in a sandbox (`sandbox-exec` on macOS, `bwrap` on Linux) that can write only to the workdir, its git directory, the tool caches, the pnpm store and the system temp folder. Git hooks and git config stay read-only.
+- All seven sections of this template are required. A delegated child whose brief misses one gets every tool blocked, so the parent must resend a complete brief.
+- In "Files you may write", a bullet may list several paths. Every token with a slash or a glob counts, as in `- packages/a/** and packages/b/c.ts`.
+- The disk limit ignores `node_modules`, which pnpm fills from the store, but build output still counts.
 - Install scripts are skipped, so `pnpm install` or `npm install` runs no `prepare` or `postinstall`. Don't ask for `prepare` to pass. If a postinstall generates something, such as `next typegen`, name the build or typecheck that runs it in the acceptance command. npm also skips `pre` and `post` scripts of `npm run` and `npm test`, so name those too, as in `npm run prebuild && npm test`.
 - `write` and `edit` only touch the listed files and `.scratch/`.
 - Shell timeouts stop at the time limit. After it, or past the disk limit, every tool is refused and the child can only report.

package/src/bridge/state.ts

@@ -121,6 +121,7 @@ export const appendLedger = (
 // One line per steer check, beside the ledger. It holds the verdict and never
 // transcript text. A log that cannot be written must not break a session.
 export const appendSteerLog = (line: {
+  readonly capped?: boolean;
   readonly error?: string;
   readonly fired?: readonly string[];
   readonly kind: string;

package/src/bridge/steer.ts

@@ -37,8 +37,13 @@ import { isDelegatedChild } from "./thread.ts";
 // github.com/dbreunig/pi-mast-steer), which only adds notes and never
 // continues a stopped run.
 
-// Per user prompt, so a model that keeps quitting cannot loop.
-const MAX_NUDGES = 2;
+// Per user prompt, so a model that keeps quitting cannot loop. A model that
+// stops again after a stop nudge has already reconsidered, and every second
+// stop nudge in the user's sessions was wrong. A reply cut off at the output
+// limit can need more than one continuation.
+const NUDGE_LIMITS = { length: 2, stop: 1 } as const;
+
+type NudgeGroup = keyof typeof NUDGE_LIMITS;
 
 const UNAWARE_OF_TERMINATION = "1.5";
 
@@ -79,17 +84,28 @@ const nudge = (
   ],
 });
 
-// Counted from the branch, so the cap holds across a reload. A nudge is a
+const noteDetails = compile(obj({ kind: opt(str()) }, { open: true }));
+
+const groupOf = (entry: SessionEntry): NudgeGroup | undefined => {
+  if (entry.type !== "custom_message" || entry.customType !== STEER_NOTE) {
+    return undefined;
+  }
+
+  return noteDetails.check(entry.details) && entry.details.kind === "length"
+    ? "length"
+    : "stop";
+};
+
+// Counted from the branch, so the limit holds across a reload. A nudge is a
 // custom message, not a user message, so it does not reset the count.
-const nudgesThisPrompt = (ctx: ExtensionContext): number => {
+const atLimit = (ctx: ExtensionContext, group: NudgeGroup): boolean => {
   const branch = ctx.sessionManager.getBranch();
 
-  return branch
-    .slice(branch.findLastIndex(isUser) + 1)
-    .filter(
-      (entry) =>
-        entry.type === "custom_message" && entry.customType === STEER_NOTE
-    ).length;
+  return (
+    branch
+      .slice(branch.findLastIndex(isUser) + 1)
+      .filter((entry) => groupOf(entry) === group).length >= NUDGE_LIMITS[group]
+  );
 };
 
 // The newest note this feature added in the prompt, of either kind. MAST 1.5
@@ -441,23 +457,21 @@ export const registerSteer = (pi: ExtensionAPI): void => {
       return;
     }
 
-    if (nudgesThisPrompt(ctx) >= MAX_NUDGES) {
-      tell(ctx, "steer: limit reached", "info");
-
-      return;
-    }
-
     const base = {
       mode,
       model: last.model,
       session: ctx.sessionManager.getSessionId(),
     };
 
-    // Shadow mode only judges and logs, so it never continues a run.
+    // Shadow mode only judges and logs, so it never continues a run. A nudge
+    // the limit holds back is logged as capped and not shown.
     if (last.stopReason === "length") {
-      appendSteerLog({ ...base, kind: "length", nudged: mode === "on" });
+      const capped = mode === "on" && atLimit(ctx, "length");
+      const nudged = mode === "on" && !capped;
+
+      appendSteerLog({ ...base, capped, kind: "length", nudged });
 
-      return mode === "on" ? nudge(event, "length") : undefined;
+      return nudged ? nudge(event, "length") : undefined;
     }
 
     const input =
@@ -488,9 +502,13 @@ export const registerSteer = (pi: ExtensionAPI): void => {
     }
 
     const chosen = chooseNudge(ctx, verdict);
-    const nudged = mode === "on" && chosen !== undefined;
 
-    appendSteerLog({ ...base, kind: "stop", nudged, verdict });
+    const capped =
+      mode === "on" && chosen !== undefined && atLimit(ctx, "stop");
+
+    const nudged = mode === "on" && chosen !== undefined && !capped;
+
+    appendSteerLog({ ...base, capped, kind: "stop", nudged, verdict });
 
     return nudged ? nudge(event, chosen.kind, chosen.probability) : undefined;
   });

package/src/pstack/brief.ts

@@ -64,9 +64,26 @@ const listItems = (section: string | undefined): string[] =>
         return [];
       }
 
-      const [first = ""] = item.replaceAll("`", "").trim().split(/\s+/u);
-
-      return [first.replace(/[:,]$/u, "")];
+      // A bullet may list several paths. Every token with a slash or a glob
+      // counts, so "a/** and b/c.ts" writes both. A bullet with no such
+      // token keeps only its first word, which stays the old behavior for
+      // plain file names.
+      const tokens = item
+        .replaceAll("`", "")
+        .trim()
+        .split(/[\s,]+/u)
+        .map((token) =>
+          token
+            .replace(/^[([{\u201C']+/u, "")
+            .replace(/[.,;)\]}\u201D']+$/u, "")
+        )
+        .filter((token) => token !== "");
+
+      const paths = tokens.filter(
+        (token) => token.includes("/") || token.includes("*")
+      );
+
+      return paths.length > 0 ? paths : [tokens[0] ?? ""];
     })
     .filter((item) => item !== "");
 
@@ -253,10 +270,9 @@ const dispatchable = (brief: Brief): boolean =>
   brief.diskMb !== undefined &&
   SECTIONS.every((section) => brief.sections.has(section));
 
-// The brief that started this session, when it is a delegated child.
-export const sessionBrief = (
+const firstMessage = (
   ctx: ExtensionContext
-): { readonly brief: Brief; readonly startedAt: number } | undefined => {
+): { readonly at: number; readonly text: string } | undefined => {
   const first = ctx.sessionManager
     .getBranch()
     .find((entry) => entry.type === "message" && entry.message.role === "user");
@@ -267,13 +283,38 @@ export const sessionBrief = (
 
   const { content } = first.message;
 
-  const text = isString(content)
-    ? content
-    : content.map((part) => (part.type === "text" ? part.text : "")).join("\n");
+  return {
+    at: Date.parse(first.timestamp),
+    text: isString(content)
+      ? content
+      : content
+          .map((part) => (part.type === "text" ? part.text : ""))
+          .join("\n"),
+  };
+};
 
-  const brief = parseBrief(text);
+// The brief that started this session, when it is a delegated child.
+export const sessionBrief = (
+  ctx: ExtensionContext
+): { readonly brief: Brief; readonly startedAt: number } | undefined => {
+  const first = firstMessage(ctx);
+  const brief = first === undefined ? undefined : parseBrief(first.text);
+
+  return first === undefined || brief === undefined || !dispatchable(brief)
+    ? undefined
+    : { brief, startedAt: first.at };
+};
+
+// What is wrong with a brief that has a `# Task:` heading but is not complete
+// enough to hold a child to. Undefined when there is no such brief.
+export const incompleteBrief = (
+  ctx: ExtensionContext,
+  rules: BriefRules
+): string[] | undefined => {
+  const first = firstMessage(ctx);
+  const brief = first === undefined ? undefined : parseBrief(first.text);
 
-  return brief === undefined || !dispatchable(brief)
+  return first === undefined || brief === undefined || dispatchable(brief)
     ? undefined
-    : { brief, startedAt: Date.parse(first.timestamp) };
+    : briefProblems(first.text, rules);
 };

package/src/pstack/child.ts

@@ -22,9 +22,9 @@ import {
 
 import { bashTimeoutSeconds } from "../bridge/bash-timeout.ts";
 import { appendLedger } from "../bridge/state.ts";
-import { ownThreadId } from "../bridge/thread.ts";
-import { sessionBrief } from "./brief.ts";
-import type { Brief } from "./brief.ts";
+import { isDelegatedChild, ownThreadId } from "../bridge/thread.ts";
+import { incompleteBrief, sessionBrief } from "./brief.ts";
+import type { Brief, BriefRules } from "./brief.ts";
 import { policyPath } from "./resources.ts";
 import {
   chooseSandbox,
@@ -93,13 +93,33 @@ export const allowedFile = (brief: Brief, relative: string): boolean =>
   relative.startsWith(SCRATCH) ||
   brief.files.some((file) => globToRegExp(file).test(relative));
 
+const quote = (text: string): string => `'${text.replaceAll("'", `'\\''`)}'`;
+
 const duKb = async (target: string): Promise<number | undefined> => {
   try {
-    const { stdout } = await run("du", ["-sk", target], {
-      timeout: DU_TIMEOUT_MS,
-    });
+    // node_modules is left out: pnpm fills it from the store, so its size is
+    // bounded by the lockfile and says nothing about runaway usage.
+    const { stdout } = await run(
+      "/bin/bash",
+      [
+        "-c",
+        `du -sk ${quote(target)} && find ${quote(target)} -name node_modules -prune -type d -exec du -sk {} +`,
+      ],
+      { timeout: DU_TIMEOUT_MS }
+    );
+
+    const lines = stdout.trim().split("\n");
+    const total = Number(lines[0]?.split(/\s/u)[0]);
 
-    return Number(stdout.split(/\s/u)[0]);
+    if (!Number.isFinite(total)) {
+      return undefined;
+    }
+
+    const modules = lines
+      .slice(1)
+      .reduce((sum, line) => sum + Number(line.split(/\s/u)[0]), 0);
+
+    return total >= modules ? total - modules : total;
   } catch {
     return undefined;
   }
@@ -122,10 +142,22 @@ const isExecFailure = compile(
   )
 ).check;
 
+const isLimits = compile(obj({ files: num(), minutes: num() })).check;
+
 const isPolicy = compile(
   obj(
     {
-      briefs: opt(obj({ redBeforeGreen: opt(arr(str())) }, { open: true })),
+      briefs: opt(
+        obj(
+          {
+            noWrites: opt(arr(str())),
+            redBeforeGreen: opt(arr(str())),
+            sizes: opt(obj({}, { open: true })),
+          },
+          { open: true }
+        )
+      ),
+      jobs: opt(obj({}, { open: true })),
     },
     { open: true }
   )
@@ -139,10 +171,27 @@ const isPathInput = compile(obj({ path: str() }, { open: true })).check;
 
 const isNumber = compile(num()).check;
 
-const readRedBeforeGreen = (): readonly string[] => {
+const readPolicy = () => {
   const policy: unknown = JSON.parse(readFileSync(policyPath(), "utf-8"));
 
-  return isPolicy(policy) ? (policy.briefs?.redBeforeGreen ?? []) : [];
+  return isPolicy(policy) ? policy : {};
+};
+
+const readRedBeforeGreen = (): readonly string[] =>
+  readPolicy().briefs?.redBeforeGreen ?? [];
+
+const readBriefRules = (): BriefRules => {
+  const { briefs, jobs } = readPolicy();
+
+  return {
+    jobs: Object.keys(jobs ?? {}),
+    noWrites: briefs?.noWrites ?? [],
+    sizes: Object.fromEntries(
+      Object.entries(briefs?.sizes ?? {}).flatMap(([size, limits]) =>
+        isLimits(limits) ? [[size, limits] as const] : []
+      )
+    ),
+  };
 };
 
 const changedFiles = async (cwd: string): Promise<string[]> => {
@@ -227,6 +276,7 @@ interface ChildState {
   diskCheck: Promise<void>;
   diskOver: boolean;
   diskQueued: boolean;
+  delegated: boolean | undefined;
   gitDir: string | undefined;
   greenAtStart: boolean;
   ready: boolean;
@@ -237,6 +287,7 @@ export const registerChild = (pi: ExtensionAPI): void => {
   const state: ChildState = {
     baselineKb: undefined,
     before: undefined,
+    delegated: undefined,
     diskCheck: Promise.resolve(),
     diskOver: false,
     diskQueued: false,
@@ -331,7 +382,22 @@ export const registerChild = (pi: ExtensionAPI): void => {
     const started = sessionBrief(ctx);
 
     if (started === undefined) {
-      return;
+      // A delegated child whose brief is incomplete would otherwise run with
+      // no sandbox and no limits, as if it were the user's own session.
+      const problems = incompleteBrief(ctx, readBriefRules());
+
+      if (problems === undefined) {
+        return;
+      }
+
+      state.delegated ??= await isDelegatedChild();
+
+      return state.delegated
+        ? {
+            block: true,
+            reason: `This delegated task's brief is incomplete, so it can't run in the sandbox and every tool is blocked. Use no more tools. Report STATUS: BLOCKED (incomplete brief) with these problems, so the parent can resend a complete brief:\n- ${problems.join("\n- ")}`,
+          }
+        : undefined;
     }
 
     const { brief, startedAt } = started;

package/src/pstack/sandbox.ts

@@ -158,6 +158,11 @@ const bwrapArgs = (
   "--dev-bind",
   "/dev",
   "/dev",
+  // A child cannot see or signal processes outside its own commands, so a
+  // stray pkill from a child cannot reach a daemon on the host. What a
+  // command starts in the background dies when that command ends.
+  "--die-with-parent",
+  "--unshare-pid",
   "--proc",
   "/proc",
   ...existing(writableRoots(workdir, gitDir, store)).flatMap((root) =>
@@ -269,7 +274,7 @@ export const chooseSandbox = async (
 // and later read pnpm_config_*. npm also skips pre and post scripts of
 // `npm run` then.
 const exportEnv = (env: ChildEnv, command: string): string =>
-  `export XDG_RUNTIME_DIR=${quote(env.runtimeDir)}${env.pnpmStore === undefined ? "" : ` pnpm_config_store_dir=${quote(env.pnpmStore)}`} npm_config_ignore_scripts=true pnpm_config_ignore_scripts=true; ${command}`;
+  `export XDG_RUNTIME_DIR=${quote(env.runtimeDir)} TMPDIR=${quote(tmpdir())}${env.pnpmStore === undefined ? "" : ` pnpm_config_store_dir=${quote(env.pnpmStore)}`} npm_config_ignore_scripts=true pnpm_config_ignore_scripts=true; ${command}`;
 
 // Undefined when no sandbox runs: the caller must not run the command.
 export const wrap = (