pi-agent stack (#46)

* pi-agent stack

* fix: hardcode pi binary path, set XDG env for npm

npm prefix discovery fails in systemd and activation contexts
because NPM_CONFIG_USERCONFIG and XDG_DATA_HOME are not set.
Hardcode the known path ~/.local/share/npm/bin/pi instead.

hosts/netty/configuration.nix

@@ -18,6 +18,7 @@ in
     ./vaultwarden.nix
     ./forgejo.nix
     ./betternas.nix
+    ./pi-agent.nix
     ../../modules/base.nix
     (modulesPath + "/profiles/minimal.nix")
     (modulesPath + "/profiles/headless.nix")

hosts/netty/pi-agent.nix

@@ -0,0 +1,74 @@
+{
+  pkgs,
+  username,
+  ...
+}:
+let
+  piAgentEnvFile = "/var/lib/pi-agent/pi-agent.env";
+  piAgentEnvCheck = pkgs.writeShellScript "pi-agent-env-check" ''
+    [ -f "${piAgentEnvFile}" ]
+  '';
+
+  piBin = "/home/${username}/.local/share/npm/bin/pi";
+
+  # Wrapper that exec's pi inside tmux's foreground process so systemd
+  # tracks the actual PID. When pi dies, tmux exits, systemd sees it
+  # and triggers Restart=on-failure.
+  piAgentStart = pkgs.writeShellScript "start-pi-agent" ''
+    if [ ! -x "${piBin}" ]; then
+      echo "pi binary not found at ${piBin}" >&2
+      exit 1
+    fi
+
+    # tmux runs in the foreground (-D) so systemd tracks this process.
+    # The inner shell exec's pi so the tmux pane PID *is* the pi PID.
+    exec ${pkgs.tmux}/bin/tmux new-session -D -s pi-agent \
+      "exec ${piBin} --chat-bridge"
+  '';
+in
+{
+  # Ensure state directory and env file have correct permissions.
+  systemd.tmpfiles.rules = [
+    "d /var/lib/pi-agent 0750 ${username} users -"
+    "z ${piAgentEnvFile} 0600 ${username} users -"
+  ];
+
+  # Pi agent running 24/7 in a foreground tmux session.
+  # Extensions (pi-channels, pi-schedule-prompt, pi-subagents) load
+  # inside Pi's process and handle Telegram bridging, scheduled tasks,
+  # and background subagent delegation.
+  #
+  # The --chat-bridge flag auto-enables the Telegram bridge on startup.
+  # Telegram bot token lives in ~/.pi/agent/settings.json (see pi-channels docs).
+  # ANTHROPIC_API_KEY comes from the env file.
+  #
+  # tmux session name: pi-agent
+  # Attach for debugging: tmux attach -t pi-agent
+  systemd.services.pi-agent = {
+    description = "Pi Coding Agent (24/7)";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [
+      pkgs.nodejs_22
+      pkgs.git
+      pkgs.tmux
+      pkgs.coreutils
+    ];
+    environment = {
+      HOME = "/home/${username}";
+      NODE_NO_WARNINGS = "1";
+    };
+    serviceConfig = {
+      Type = "simple";
+      User = username;
+      Group = "users";
+      WorkingDirectory = "/home/${username}";
+      ExecCondition = piAgentEnvCheck;
+      EnvironmentFile = piAgentEnvFile;
+      ExecStart = piAgentStart;
+      Restart = "on-failure";
+      RestartSec = 10;
+    };
+  };
+}