pi-t3-bridge 0.8.2 → 0.8.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Change log
 
+## 0.8.3, 6 November 2026
+
+Version 0.8.3 hardens the child sandbox from a large orchestration run. A bullet under "Files you may write" may now list several paths; every token with a slash or a glob counts. The disk limit no longer counts `node_modules`, which pnpm fills from the store, so a 500 MB limit no longer fails on a pnpm monorepo install. On Linux the child runs in its own PID namespace and cannot see or signal host processes, and anything a command starts in the background ends with that command. The child env now sets `TMPDIR`. Chrome, Electron and headless shells need `--no-sandbox` inside the sandbox, because their own namespace sandbox cannot nest under bwrap, and the sandbox already confines them; this is now documented, along with `PI_CODING_AGENT_DIR` for running `pi` inside a child.
+
 ## 0.8.2, 6 November 2026
 
 Version 0.8.2 closes a hole in the child sandbox. A delegated child whose brief missed a section or a header field ran with no sandbox and no limits, because the bridge treated it as the user's own session. Such a child could rewrite the parent's git hooks. Now every tool in that child is blocked, and the block lists what the brief is missing, so the parent can resend a complete one. A top-level session is never blocked, even when its first message starts with `# Task:`.

package/README.md

@@ -31,6 +31,8 @@ A delegated child runs its shell commands in a sandbox, which is `sandbox-exec`
 
 Inside the sandbox a child can write only to its workdir, its git directory, the tool caches, the pnpm store, and the system temp folder. The git hooks and git config stay read-only, because the parent runs them later outside the sandbox. Each child gets its own `XDG_RUNTIME_DIR` in the temp folder, where pnpm takes its store lock. The child also gets `pnpm_config_store_dir` set to the store that `pnpm store path` names for the workdir outside the sandbox, so it shares the parent's store. Under `bwrap`, pnpm copies packages from the store, because Linux refuses hardlinks across the sandbox's mounts. Children skip install scripts (`npm_config_ignore_scripts` and `pnpm_config_ignore_scripts` are `true`), so a root `prepare` such as `lefthook install` does not run. With this setting npm also skips the pre and post scripts of `npm run` and `npm test`, while pnpm still runs them. Steps that only a postinstall runs must run through the build or typecheck the brief names.
 
+The child also gets `TMPDIR` set. On Linux the child cannot see or signal processes outside its own commands, so a stray `pkill` cannot reach a daemon on the host, and anything a command starts in the background dies when that command ends. Chrome, Electron and headless shells need `--no-sandbox` inside the sandbox, because their own namespace sandbox cannot nest under bwrap; the sandbox already confines them. A `pi` run inside the sandbox needs `PI_CODING_AGENT_DIR` pointing at a writable temp copy of `~/.pi/agent`, because the real one is read-only. The disk limit in a brief ignores `node_modules`, which pnpm fills from the store.
+
 Native Windows and WSL1 have no sandbox. Where no sandbox can run, the bridge blocks a child's shell commands, unless you set `childSandbox` to `"off"` in the settings file.
 
 ## Install
@@ -150,7 +152,9 @@ on(run about to stop)
   ask the classifier how the run ended
   if the classifier is down or takes more than 5 seconds
     let the run stop
-  if the agent gave up partway and fewer than 2 notes were sent for the current prompt
+  if the agent gave up partway
+    if a stop note was already sent for the current prompt
+      log the check as capped in steer.jsonl and let the run stop
     add a note
     continue for one more turn
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-t3-bridge",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Pi extension adapter for t3-pstack inside T3 Code.",
   "keywords": [
     "pi-extension",

package/pstack/skills/poteto-mode/brief.md

@@ -61,6 +61,9 @@ ISSUES or BLOCKED: one line each with file:line and the command that shows it
 The child's own pstack extension reads this brief from its first message and enforces it, whatever the model does:
 
 - Every shell command runs in a sandbox (`sandbox-exec` on macOS, `bwrap` on Linux) that can write only to the workdir, its git directory, the tool caches, the pnpm store and the system temp folder. Git hooks and git config stay read-only.
+- All seven sections of this template are required. A delegated child whose brief misses one gets every tool blocked, so the parent must resend a complete brief.
+- In "Files you may write", a bullet may list several paths. Every token with a slash or a glob counts, as in `- packages/a/** and packages/b/c.ts`.
+- The disk limit ignores `node_modules`, which pnpm fills from the store, but build output still counts.
 - Install scripts are skipped, so `pnpm install` or `npm install` runs no `prepare` or `postinstall`. Don't ask for `prepare` to pass. If a postinstall generates something, such as `next typegen`, name the build or typecheck that runs it in the acceptance command. npm also skips `pre` and `post` scripts of `npm run` and `npm test`, so name those too, as in `npm run prebuild && npm test`.
 - `write` and `edit` only touch the listed files and `.scratch/`.
 - Shell timeouts stop at the time limit. After it, or past the disk limit, every tool is refused and the child can only report.

package/src/bridge/state.ts

@@ -121,6 +121,7 @@ export const appendLedger = (
 // One line per steer check, beside the ledger. It holds the verdict and never
 // transcript text. A log that cannot be written must not break a session.
 export const appendSteerLog = (line: {
+  readonly capped?: boolean;
   readonly error?: string;
   readonly fired?: readonly string[];
   readonly kind: string;

package/src/bridge/steer.ts

@@ -37,8 +37,13 @@ import { isDelegatedChild } from "./thread.ts";
 // github.com/dbreunig/pi-mast-steer), which only adds notes and never
 // continues a stopped run.
 
-// Per user prompt, so a model that keeps quitting cannot loop.
-const MAX_NUDGES = 2;
+// Per user prompt, so a model that keeps quitting cannot loop. A model that
+// stops again after a stop nudge has already reconsidered, and every second
+// stop nudge in the user's sessions was wrong. A reply cut off at the output
+// limit can need more than one continuation.
+const NUDGE_LIMITS = { length: 2, stop: 1 } as const;
+
+type NudgeGroup = keyof typeof NUDGE_LIMITS;
 
 const UNAWARE_OF_TERMINATION = "1.5";
 
@@ -79,17 +84,28 @@ const nudge = (
   ],
 });
 
-// Counted from the branch, so the cap holds across a reload. A nudge is a
+const noteDetails = compile(obj({ kind: opt(str()) }, { open: true }));
+
+const groupOf = (entry: SessionEntry): NudgeGroup | undefined => {
+  if (entry.type !== "custom_message" || entry.customType !== STEER_NOTE) {
+    return undefined;
+  }
+
+  return noteDetails.check(entry.details) && entry.details.kind === "length"
+    ? "length"
+    : "stop";
+};
+
+// Counted from the branch, so the limit holds across a reload. A nudge is a
 // custom message, not a user message, so it does not reset the count.
-const nudgesThisPrompt = (ctx: ExtensionContext): number => {
+const atLimit = (ctx: ExtensionContext, group: NudgeGroup): boolean => {
   const branch = ctx.sessionManager.getBranch();
 
-  return branch
-    .slice(branch.findLastIndex(isUser) + 1)
-    .filter(
-      (entry) =>
-        entry.type === "custom_message" && entry.customType === STEER_NOTE
-    ).length;
+  return (
+    branch
+      .slice(branch.findLastIndex(isUser) + 1)
+      .filter((entry) => groupOf(entry) === group).length >= NUDGE_LIMITS[group]
+  );
 };
 
 // The newest note this feature added in the prompt, of either kind. MAST 1.5
@@ -441,23 +457,21 @@ export const registerSteer = (pi: ExtensionAPI): void => {
       return;
     }
 
-    if (nudgesThisPrompt(ctx) >= MAX_NUDGES) {
-      tell(ctx, "steer: limit reached", "info");
-
-      return;
-    }
-
     const base = {
       mode,
       model: last.model,
       session: ctx.sessionManager.getSessionId(),
     };
 
-    // Shadow mode only judges and logs, so it never continues a run.
+    // Shadow mode only judges and logs, so it never continues a run. A nudge
+    // the limit holds back is logged as capped and not shown.
     if (last.stopReason === "length") {
-      appendSteerLog({ ...base, kind: "length", nudged: mode === "on" });
+      const capped = mode === "on" && atLimit(ctx, "length");
+      const nudged = mode === "on" && !capped;
+
+      appendSteerLog({ ...base, capped, kind: "length", nudged });
 
-      return mode === "on" ? nudge(event, "length") : undefined;
+      return nudged ? nudge(event, "length") : undefined;
     }
 
     const input =
@@ -488,9 +502,13 @@ export const registerSteer = (pi: ExtensionAPI): void => {
     }
 
     const chosen = chooseNudge(ctx, verdict);
-    const nudged = mode === "on" && chosen !== undefined;
 
-    appendSteerLog({ ...base, kind: "stop", nudged, verdict });
+    const capped =
+      mode === "on" && chosen !== undefined && atLimit(ctx, "stop");
+
+    const nudged = mode === "on" && chosen !== undefined && !capped;
+
+    appendSteerLog({ ...base, capped, kind: "stop", nudged, verdict });
 
     return nudged ? nudge(event, chosen.kind, chosen.probability) : undefined;
   });

package/src/pstack/brief.ts

@@ -64,9 +64,26 @@ const listItems = (section: string | undefined): string[] =>
         return [];
       }
 
-      const [first = ""] = item.replaceAll("`", "").trim().split(/\s+/u);
-
-      return [first.replace(/[:,]$/u, "")];
+      // A bullet may list several paths. Every token with a slash or a glob
+      // counts, so "a/** and b/c.ts" writes both. A bullet with no such
+      // token keeps only its first word, which stays the old behavior for
+      // plain file names.
+      const tokens = item
+        .replaceAll("`", "")
+        .trim()
+        .split(/[\s,]+/u)
+        .map((token) =>
+          token
+            .replace(/^[([{\u201C']+/u, "")
+            .replace(/[.,;)\]}\u201D']+$/u, "")
+        )
+        .filter((token) => token !== "");
+
+      const paths = tokens.filter(
+        (token) => token.includes("/") || token.includes("*")
+      );
+
+      return paths.length > 0 ? paths : [tokens[0] ?? ""];
     })
     .filter((item) => item !== "");
 

package/src/pstack/child.ts

@@ -93,13 +93,33 @@ export const allowedFile = (brief: Brief, relative: string): boolean =>
   relative.startsWith(SCRATCH) ||
   brief.files.some((file) => globToRegExp(file).test(relative));
 
+const quote = (text: string): string => `'${text.replaceAll("'", `'\\''`)}'`;
+
 const duKb = async (target: string): Promise<number | undefined> => {
   try {
-    const { stdout } = await run("du", ["-sk", target], {
-      timeout: DU_TIMEOUT_MS,
-    });
+    // node_modules is left out: pnpm fills it from the store, so its size is
+    // bounded by the lockfile and says nothing about runaway usage.
+    const { stdout } = await run(
+      "/bin/bash",
+      [
+        "-c",
+        `du -sk ${quote(target)} && find ${quote(target)} -name node_modules -prune -type d -exec du -sk {} +`,
+      ],
+      { timeout: DU_TIMEOUT_MS }
+    );
+
+    const lines = stdout.trim().split("\n");
+    const total = Number(lines[0]?.split(/\s/u)[0]);
+
+    if (!Number.isFinite(total)) {
+      return undefined;
+    }
+
+    const modules = lines
+      .slice(1)
+      .reduce((sum, line) => sum + Number(line.split(/\s/u)[0]), 0);
 
-    return Number(stdout.split(/\s/u)[0]);
+    return total >= modules ? total - modules : total;
   } catch {
     return undefined;
   }

package/src/pstack/sandbox.ts

@@ -158,6 +158,11 @@ const bwrapArgs = (
   "--dev-bind",
   "/dev",
   "/dev",
+  // A child cannot see or signal processes outside its own commands, so a
+  // stray pkill from a child cannot reach a daemon on the host. What a
+  // command starts in the background dies when that command ends.
+  "--die-with-parent",
+  "--unshare-pid",
   "--proc",
   "/proc",
   ...existing(writableRoots(workdir, gitDir, store)).flatMap((root) =>
@@ -269,7 +274,7 @@ export const chooseSandbox = async (
 // and later read pnpm_config_*. npm also skips pre and post scripts of
 // `npm run` then.
 const exportEnv = (env: ChildEnv, command: string): string =>
-  `export XDG_RUNTIME_DIR=${quote(env.runtimeDir)}${env.pnpmStore === undefined ? "" : ` pnpm_config_store_dir=${quote(env.pnpmStore)}`} npm_config_ignore_scripts=true pnpm_config_ignore_scripts=true; ${command}`;
+  `export XDG_RUNTIME_DIR=${quote(env.runtimeDir)} TMPDIR=${quote(tmpdir())}${env.pnpmStore === undefined ? "" : ` pnpm_config_store_dir=${quote(env.pnpmStore)}`} npm_config_ignore_scripts=true pnpm_config_ignore_scripts=true; ${command}`;
 
 // Undefined when no sandbox runs: the caller must not run the command.
 export const wrap = (