[bdougie]

Adds the pi coding agent to the coder mixtape's agent PATH alongside claude-code, codex, gemini-cli and opencode. These original ai coding agents were added in March. I've been using pi for the pokemon and sweeper pcc-labs but I need to install each time.

Why

pcc-labs/lambda-microvm-agents tracks this as a known rough edge: paperctl start pi works, but the coder mixtape ships no pi binary. Sweeper has since made pi its default driver, so the gap shows up there too.

Approach

pi is not in nixpkgs, so lib/pi-bin.nix builds it from the published npm tarball, following the same local-derivation pattern as lib/paper-bin.nix.

No autoPatchelfHook is needed. pi-tui ships native prebuilds for darwin and win32 only, and the sole optionalDependency (@mariozechner/clipboard) is darwin-only — so on Linux pi is pure JS plus one WASM blob. Unlike paper-bin.nix there are no per-arch hashes either.

Because flake/images.nix derives the Lambda MicroVM bundle's agentPackages from stereos.agent.extraPackages, pi lands in the VM images and the Lambda MicroVM source bundle from the one mixtape edit. mkSandboxManifest picks it up for the gVisor closure manifest the same way.

Also: the mixtape table was stale

The README still listed a single opencode-mixtape row — a name the flake no longer builds. Replaced with the real base / coder pair, coder's five agents broken out with their packages and API keys, and a note that stereos.agent.extraPackages feeds the gVisor closure manifest and the Lambda MicroVM bundle as well as the agent PATH. Binary names verified against meta.mainProgram.

Two upstream lockfile defects

Both are patched in a source derivation rather than postPatch — buildNpmPackage runs postPatch inside the npm-deps fetcher too, and that stdenv has no node/jq on PATH.

1. Missing integrity. Upstream's custom shrinkwrap generator (scripts/generate-coding-agent-shrinkwrap.mjs in pi-mono) emits the six pi-mono sibling packages with a resolved registry URL but no integrity field. Both prefetch-npm-deps and npm ci reject that. The tarballs are on the public registry; only the SRI hashes are missing, so they're pinned in siblingIntegrity.

2. package.json ⟷ lockfile mismatch. package.json declares eight devDependencies that the lockfile's root entry omits (devDependencies: []). npm ci validates the pair before honouring --omit=dev, so the mismatch sends it to the registry and it dies on the sandbox's only-if-cached policy. Since dist/ is prebuilt and dontNpmBuild is set, the dev toolchain is unused — dropping it makes the pair consistent.

Verified

• Builds clean; pi --version reports 0.84.3
• nixosConfigurations.coder agent PATH resolves to claude-code-2.1.158, codex-0.135.0, gemini-cli-0.43.0, opencode-1.15.13, pi-coding-agent-0.84.3
• packages.aarch64-linux.coder-lambda-microvm-source evaluates with pi in its drv closure
• Derivation evaluates for aarch64-linux
• flake/checks.nix only builds the devshell — unaffected

Reviewer notes

• The compile ran on aarch64-darwin via NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1 (meta.platforms is linux-only, matching paper-bin's convention). The logic is platform-independent, and npmDepsHash should be stable since prefetch-npm-deps is lockfile-driven — but a real aarch64-linux build should confirm before merge.
• Closure cost: 129 MiB for pi itself, 318 MiB including nodejs. Marginal add is nearer 129 MiB since the mixtape already ships four Node CLIs sharing the runtime. Worth checking the assembled image against the size budget.
• Version bumps need three hash updates — tarball, npmDepsHash, and all six siblingIntegrity values (the pi-mono packages publish in lockstep). Noted in the file header. pi moved 0.80.10 → 0.84.3 in about a month, so a refresh script may earn its keep.

[greptile-apps]

Greptile Summary

The PR packages pi coding agent 0.84.3 from its published npm tarball and adds it to the coder mixtape’s restricted-agent and system-wide package sets.

• Repairs upstream shrinkwrap integrity metadata and removes unused development dependencies before the Nix npm build.
• Pins Node.js 22 and exposes the resulting pi executable on supported Linux architectures.
• Reuses one agent package list so pi propagates into coder systems, sandbox closures, and Lambda MicroVM bundles.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness or security defects identified in the changed paths.

The pi derivation’s runtime, launcher metadata, Linux platform declarations, and package propagation align with the coder mixtape’s existing access and image-closure contracts.

Important Files Changed

Filename	Overview
lib/pi-bin.nix	Adds a content-addressed npm derivation for pi, patches upstream lockfile defects, and limits the package to supported Linux targets.
mixtapes/coder/package.nix	Consolidates coding agents into one list and adds pi consistently to both restricted-agent and system-wide package surfaces.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  P[lib/pi-bin.nix] --> A[coder agents list]
  A --> E[stereos.agent.extraPackages]
  A --> S[environment.systemPackages]
  E --> R[Restricted agent PATH]
  E --> G[gVisor sandbox closure]
  E --> L[Lambda MicroVM bundle]
  S --> M[System-wide admin PATH]

Loading

_{Reviews (1): Last reviewed commit: "✨ feat: package pi in the coder mixtape" | Re-trigger Greptile}

[bdougie]

we should go with the simpler #39