feat(pi): ctx setup pi - Pi coding-agent CLI integration

[bilersan]

feat(pi): ctx setup pi — Pi coding-agent CLI integration

New AI-tool integration: ctx setup pi [--write] for the Pi coding-agent CLI
(earendil-works/pi, pi.dev). Pi has no built-in MCP by design, so the
integration is a thin TypeScript extension + Agent-Skills-standard skills +
AGENTS.md; all logic stays in the ctx binary via ctx system subcommands.

Spec: specs/pi-cli-integration.md (committed on-branch).

What ships

• Embedded extension — internal/assets/integrations/pi/extension/ctx.ts:
  flat .pi/extensions/ctx.ts shim wiring Pi lifecycle events to ctx system:
  • session_start: warm-up ctx agent --budget 4000 off the prompt path
  • before_agent_start: injects the packet as a persistent
    customType: "ctx-context" message (display: true) only when no ctx
    message exists in the live context — compaction-aware scan of
    sessionManager.buildContextEntries() (summary + kept tail +
    post-compaction entries), so kept-tail packets suppress re-injection and
    folded-away packets trigger it; fail-safe across /new /resume /fork
/reload
  • tool_result (bash, git commit regex, !isError): ctx system post-commit
    with the hook-JSON envelope on piped+closed stdin (node:child_process
    is mandatory — Pi's exec helper hardcodes stdio: ["ignore","pipe","pipe"])
  • tool_result (edit/write, !isError): check-task-completion;
    agent_settled: check-persistence; session_compact: cache drop
• ctx setup pi — deploy core (internal/cli/setup/core/pi/) mirroring
  the OpenCode integration: extension fatal, AGENTS.md + 10 bundled skills
  warn; refresh-in-place, symlink/non-regular refusal; dry-run prints the
  hook.pi blueprint; case cfgHook.ToolPi in setup root (no new
  subcommand, no new Use* constant)
• CI gate — tools/typecheck/pi/ (strict tsc --noEmit against
  @earendil-works/pi-coding-agent@0.84.2 types, committed lockfile) +
  typecheck-pi-extension job in .github/workflows/ci.yml
• Docs — Pi entry in supported-tools reference, docs/home/pi.md
  quickstart, multi-tool recipe, zensical nav

Validation

• go build ./..., golangci-lint (0 issues), targeted go test green
• Full-suite delta vs clean main: zero new failures (all failing packages
  pre-exist on this Windows machine: CRLF render drift, .exe exec, audit
  path exemptions)
• Scratch project: init + dry-run + --write + idempotent re-run +
  tamper-refresh (byte-identical to embedded)
• Live pi: extension loads clean (A/B run with/without .pi identical);
  full LLM round-trip blocked by local pi provider config — left for a
  working-provider machine
• tsc --noEmit passes against pi-coding-agent 0.84.2 types

Reviews

• Independent sub-agent review: approve-with-nits — all nits addressed
  (32c55041: docstring, frontmatter coverage, spec naming)
• claude -p fable-5 effort-max branch audit: ship-ready after one
  decision — the one decision (kept-tail duplicate-injection gap, MAJOR 1)
  resolved by switching the predicate to a buildContextEntries() scan
  (694f6d37, with a one-line stdin stream hardening)

Notes / follow-ups

• site/ HTML rebuild deferred: this machine's zensical toolchain renders
  entity-escape drift vs the committed artifacts; rebuild on the canonical
  build machine (documented in PI.5 / commit 03a7e776)
• TASKS.md PI.8 tracks the remaining low-priority audit follow-ups
  (post-compaction re-warm location, embedded-asset EOL pinning, unused
  tool_result nudge channel, tsconfig paths hardening)