fix(pi): point pi at config dir via PI_CODING_AGENT_DIR instead of redirecting HOME

[dgokeeffe]

Issue

Closes #291.

This PR's current head (45db26a) and the current-origin/main validation candidate (88d759c) have the same stable patch ID (eaa6fe487b9f968de6ff0da5fb1abc83b962bdcf). The focused/full evidence below was rerun from the rebased candidate without rewriting this existing PR branch.

---

Unit 01 — Pi config-dir/keychain fix

Objective and user-visible behavior

Keep Pi models, settings, sessions, MCP, and skills under ucode's private Pi directory without changing the process HOME. On macOS, subprocesses therefore keep login-keychain and credential-helper resolution.

Candidate: review/pi-config-keychain (88d759c), existing PR #243, compared with current origin/main.

Exact scope

Production: src/ucode/agents/pi.py.
Tests: tests/test_agent_pi.py, tests/test_e2e.py, tests/test_e2e_user_agent.py.
Non-goals: model routing, context metadata, MLflow proxying, cache retention, managed config, MCP/skills behavior changes.

Before / after reproduction

git show origin/main:src/ucode/agents/pi.py | rg 'env\["(HOME|PI_CODING_AGENT_DIR)"\]'
# env["HOME"] = str(PI_UCODE_HOME)

git show review/pi-config-keychain:src/ucode/agents/pi.py | rg 'env\["(HOME|PI_CODING_AGENT_DIR)"\]'
# env["PI_CODING_AGENT_DIR"] = str(PI_CONFIG_DIR)

Focused validation:

uv run --frozen pytest tests/test_agent_pi.py tests/test_e2e_user_agent.py::TestPiUserAgent tests/test_e2e.py -q
# 50 passed, 29 skipped
uv run --frozen ruff check .
# All checks passed

Full suite:

uv run --frozen pytest -q
# 1 failed, 1658 passed, 36 skipped

Only TestClaudeUserAgent::test_user_agent_arrives_at_gateway failed; integrated dev reproduces that installed-Claude capture failure. Pi's capture test passes here, providing direct regression evidence for home isolation.

Live evidence

No Databricks serving behavior changes. The focused Pi installed-agent capture test validates the launched environment locally without logging credentials.

Impact map

• Agent: Pi only.
• Provider: all Pi providers inherit the corrected process environment; endpoint payloads are unchanged.
• Config: PI_CODING_AGENT_DIR points at the existing private config root; real HOME is preserved.
• Compatibility risks: requires Pi's supported config-dir variable; tests cover models/settings/session path patching and installed Pi launch.
• MCP/skills/managed config: paths remain under the same private Pi root; no registration or state schema changes.

Rollback and residual risk

Rollback by reverting 88d759c; this restores HOME redirection and its macOS keychain breakage. Residual risk is limited to older Pi releases that might ignore PI_CODING_AGENT_DIR; current installed Pi behavior is covered by the focused launch test.

Hygiene

git diff --check origin/main..88d759c passes. Four-file range; no uv.lock, generated files, credentials, .pi-subagents/, or goal.md; no merge markers or unresolved index entries.

[dgokeeffe]

Rebased onto current main and tightened after review: the test now explicitly proves HOME is preserved, stale HOME-based comments/docstrings were updated, and focused validation is 42 passed / 29 workspace-gated skips with Ruff clean. A maintainer CI approval/review is now the remaining gate.

[dgokeeffe]

Rebased on current main. All four PRs in this stack are now 0 commits behind main and report MERGEABLE.

The remaining blocker is outside my control. Because these are fork PRs, every CI run has ended in action_required — 21 runs since 2026-07-16, not one has ever executed. The active main protection ruleset requires the test and e2e checks to pass, so all four PRs stay BLOCKED until someone with write access clicks Approve and run workflows. I also can't add reviewers myself (the request-reviewers API 404s without push access), which is why none of these has a reviewer assigned.

@asujithan @rohita5l — could one of you approve the workflow runs?

I'd suggest starting with this PR: it's the smallest of the four (+17 / −7, 4 files). It stops ucode from redirecting HOME when launching Pi and points Pi at its config dir via PI_CODING_AGENT_DIR instead. Local validation on this branch: ruff clean, 1046 passed / 6 skipped.

One heads-up on the e2e gate: fork PRs receive empty secrets, so UCODE_TEST_WORKSPACE is blank and the workspace-gated tests skip via tests/conftest.py:46. The job will go green without exercising a live workspace — worth knowing when you read the check result.

Happy to take the other three (#223, #239, #217) one at a time after this one lands.