feat(pi): package @earendil-works/pi-coding-agent as pi

Vendors the npm tarball + lockfile and wraps the `pi` binary with `fd` and
`ripgrep` on PATH. Also installs it on the m4 darwin host.

`buildNpmPackage` is pulled from `inputs.unstable` because nixos-25.11's
`prefetch-npm-deps-0.1.0` panics on cacache index entries that contain
either multiple lines or JSON values with embedded spaces (npm's
`accept: application/...; q=1.0, ...` headers). For this lockfile,
`@esbuild/netbsd-arm64` and `@rollup/rollup-linux-x64-musl` trigger
both conditions and `--map-cache` fails with `EOF while parsing a
string at line 1 column 369`. Fixed upstream in nixos-unstable, which
now uses `lines()` + `split_once('\t')`.

packages/pi/default.nix

@@ -0,0 +1,75 @@
+{
+  lib,
+  pkgs,
+  inputs,
+  fetchurl,
+  fd,
+  ripgrep,
+  runCommand,
+}:
+
+let
+  # Use unstable's buildNpmPackage: nixos-25.11's prefetch-npm-deps-0.1.0
+  # crashes on cacache index files that contain multiple entries or JSON
+  # values with spaces (e.g. `accept: application/...; q=1.0, ...`). Fixed
+  # upstream in nixos-unstable (lines() + split_once('\t')).
+  unstablePkgs = import inputs.unstable { inherit (pkgs.stdenv.hostPlatform) system; };
+  inherit (unstablePkgs) buildNpmPackage;
+
+  versionData = lib.importJSON ./hashes.json;
+  version = versionData.version;
+
+  # Create a source with package-lock.json included
+  srcWithLock = runCommand "pi-src-with-lock" { } ''
+    mkdir -p $out
+    tar -xzf ${
+      fetchurl {
+        url = "https://registry.npmjs.org/@earendil-works/pi-coding-agent/-/pi-coding-agent-${version}.tgz";
+        hash = versionData.sourceHash;
+      }
+    } -C $out --strip-components=1
+    cp ${./package-lock.json} $out/package-lock.json
+  '';
+in
+buildNpmPackage {
+  npmDepsFetcherVersion = 2;
+  inherit version;
+  pname = "pi";
+
+  src = srcWithLock;
+
+  npmDepsHash = versionData.npmDepsHash;
+  makeCacheWritable = true;
+
+  # The package from npm is already built
+  dontNpmBuild = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/pi \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          fd
+          ripgrep
+        ]
+      } \
+      --set PI_SKIP_VERSION_CHECK 1 \
+      --set PI_TELEMETRY 0 \
+      --run 'export NPM_CONFIG_PREFIX="''${NPM_CONFIG_PREFIX:-$HOME/.pi/npm-global}"' \
+      --run 'export PATH="$NPM_CONFIG_PREFIX/bin:$PATH"'
+  '';
+
+  doInstallCheck = true;
+
+  passthru.category = "AI Coding Agents";
+
+  meta = {
+    description = "A terminal-based coding agent with multi-model support";
+    homepage = "https://github.com/badlogic/pi-mono";
+    changelog = "https://github.com/badlogic/pi-mono/releases";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    maintainers = with lib.maintainers; [ aos ];
+    platforms = lib.platforms.all;
+    mainProgram = "pi";
+  };
+}