feat(pi): package @earendil-works/pi-coding-agent as pi

Vendors the npm tarball + lockfile and wraps the `pi` binary with `fd` and
`ripgrep` on PATH. Also installs it on the m4 darwin host.

`buildNpmPackage` is pulled from `inputs.unstable` because nixos-25.11's
`prefetch-npm-deps-0.1.0` panics on cacache index entries that contain
either multiple lines or JSON values with embedded spaces (npm's
`accept: application/...; q=1.0, ...` headers). For this lockfile,
`@esbuild/netbsd-arm64` and `@rollup/rollup-linux-x64-musl` trigger
both conditions and `--map-cache` fails with `EOF while parsing a
string at line 1 column 369`. Fixed upstream in nixos-unstable, which
now uses `lines()` + `split_once('\t')`.

packages/pi/default.nix

@@ -0,0 +1,75 @@
+{
+  lib,
+  pkgs,
+  inputs,
+  fetchurl,
+  fd,
+  ripgrep,
+  runCommand,
+}:
+
+let
+  # Use unstable's buildNpmPackage: nixos-25.11's prefetch-npm-deps-0.1.0
+  # crashes on cacache index files that contain multiple entries or JSON
+  # values with spaces (e.g. `accept: application/...; q=1.0, ...`). Fixed
+  # upstream in nixos-unstable (lines() + split_once('\t')).
+  unstablePkgs = import inputs.unstable { inherit (pkgs.stdenv.hostPlatform) system; };
+  inherit (unstablePkgs) buildNpmPackage;
+
+  versionData = lib.importJSON ./hashes.json;
+  version = versionData.version;
+
+  # Create a source with package-lock.json included
+  srcWithLock = runCommand "pi-src-with-lock" { } ''
+    mkdir -p $out
+    tar -xzf ${
+      fetchurl {
+        url = "https://registry.npmjs.org/@earendil-works/pi-coding-agent/-/pi-coding-agent-${version}.tgz";
+        hash = versionData.sourceHash;
+      }
+    } -C $out --strip-components=1
+    cp ${./package-lock.json} $out/package-lock.json
+  '';
+in
+buildNpmPackage {
+  npmDepsFetcherVersion = 2;
+  inherit version;
+  pname = "pi";
+
+  src = srcWithLock;
+
+  npmDepsHash = versionData.npmDepsHash;
+  makeCacheWritable = true;
+
+  # The package from npm is already built
+  dontNpmBuild = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/pi \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          fd
+          ripgrep
+        ]
+      } \
+      --set PI_SKIP_VERSION_CHECK 1 \
+      --set PI_TELEMETRY 0 \
+      --run 'export NPM_CONFIG_PREFIX="''${NPM_CONFIG_PREFIX:-$HOME/.pi/npm-global}"' \
+      --run 'export PATH="$NPM_CONFIG_PREFIX/bin:$PATH"'
+  '';
+
+  doInstallCheck = true;
+
+  passthru.category = "AI Coding Agents";
+
+  meta = {
+    description = "A terminal-based coding agent with multi-model support";
+    homepage = "https://github.com/badlogic/pi-mono";
+    changelog = "https://github.com/badlogic/pi-mono/releases";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    maintainers = with lib.maintainers; [ aos ];
+    platforms = lib.platforms.all;
+    mainProgram = "pi";
+  };
+}

packages/pi/hashes.json

@@ -0,0 +1,5 @@
+{
+  "version": "0.74.0",
+  "sourceHash": "sha256-l0pzuWGVvX1jDhFYaey14N16XDo47kkm3JlEhmPUo0Q=",
+  "npmDepsHash": "sha256-KQsuZzH8bdnvyD/ZcSIZyDPO4th6+osbXFZmaK21eOc="
+}

packages/pi/update.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env nix
+#! nix shell --inputs-from .# nixpkgs#python3 --command python3
+
+"""Update script for pi package."""
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent.parent / "scripts"))
+
+from updater import (
+    calculate_dependency_hash,
+    calculate_url_hash,
+    extract_or_generate_lockfile,
+    fetch_npm_version,
+    load_hashes,
+    save_hashes,
+    should_update,
+)
+from updater.hash import DUMMY_SHA256_HASH
+from updater.nix import NixCommandError
+
+SCRIPT_DIR = Path(__file__).parent
+HASHES_FILE = SCRIPT_DIR / "hashes.json"
+NPM_PACKAGE = "@earendil-works/pi-coding-agent"
+
+
+def main() -> None:
+    """Update the pi package."""
+    data = load_hashes(HASHES_FILE)
+    current = data["version"]
+    latest = fetch_npm_version(NPM_PACKAGE)
+
+    print(f"Current: {current}, Latest: {latest}")
+
+    if not should_update(current, latest):
+        print("Already up to date")
+        return
+
+    tarball_url = (
+        f"https://registry.npmjs.org/{NPM_PACKAGE}/-/pi-coding-agent-{latest}.tgz"
+    )
+
+    print("Calculating source hash...")
+    source_hash = calculate_url_hash(tarball_url)
+
+    if not extract_or_generate_lockfile(tarball_url, SCRIPT_DIR / "package-lock.json"):
+        return
+
+    # Update hashes.json
+    data = {
+        "version": latest,
+        "sourceHash": source_hash,
+        "npmDepsHash": DUMMY_SHA256_HASH,
+    }
+    save_hashes(HASHES_FILE, data)
+
+    # Calculate npmDepsHash
+    try:
+        npm_deps_hash = calculate_dependency_hash(
+            ".#pi", "npmDepsHash", HASHES_FILE, data
+        )
+        data["npmDepsHash"] = npm_deps_hash
+        save_hashes(HASHES_FILE, data)
+    except (ValueError, NixCommandError) as e:
+        print(f"Error: {e}")
+        return
+
+    print(f"Updated to {latest}")
+
+
+if __name__ == "__main__":
+    main()

systems/aarch64-darwin/m4/default.nix

@@ -40,6 +40,7 @@ with lib.metacfg;
     attic-client
     claude-code
     opencode
+    metacfg.pi
     dnsmasq
     gh
     imagemagick