feat: harden into a type-safe, tested, CI-gated extension

[mio-g]

Hi — thanks for building this. It is the only pi multi-session tool that runs in-process, which makes it the only one that works in a plain terminal without tmux/Zellij/Ghostty. I have been using it daily and wanted to make it something I could depend on, so this PR adds the engineering scaffolding around the existing design.

No feature changes and no rewrite. The architecture and LockManager design are kept as-is; file names and the public surface are unchanged.

Blast radius: 🟡 Medium

• Behavior change visible to users: inferToolPaths now recognizes mutating git, npm/pnpm/yarn/bun, make, cargo, terraform, and dbt commands, so more tool calls take path locks than before
• peerDependencies narrows from * to >=0.84.4, and engines.node is declared as >=22.19.0 (mirroring pi's own) — installs on older hosts now warn instead of failing at runtime
• Scope: whole package, but no cross-repo contract; runtime dependencies remain zero (all new tooling is devDependencies)

What this fixes

Silent drift against pi 0.84.4

The extension monkey-patched InteractiveMode.prototype.setWorkingIndicator. That method no longer exists in pi 0.84.4, and the patch was guarded, so it silently no-oped — the working/idle indicator in the switcher was already dead. It is now driven from the agent_start/agent_end events the extension already subscribes to.

It also dynamically imported pi's compiled internals (getPackageDir()/dist/core/model-resolver.js). That is replaced with the public resolveModelScopeWithDiagnostics export. A startup preflight now checks every symbol the package consumes and, on mismatch, warns via ctx.ui.notify naming the missing symbol instead of registering half-working behavior.

Lock coverage gap

The mutator whitelist did not include git, so two sessions running git checkout / reset --hard in the same repo were completely unguarded. Same for package installs, make, cargo, terraform, and dbt. Two related fixes: same-session acquisitions are reference-counted (one tool call finishing no longer releases a path another still holds), and commands are tokenized so sed -i 's|/usr/bin|/opt|' no longer locks the delimiter contents as paths.

Three bugs found while smoke-testing

• Child runtimes get a fresh resource loader, which dropped this extension entirely in sessions opened outside the parent cwd — Ctrl-R stopped working after switching folders
• The parent row was labelled with its cwd basename, making the protected row indistinguishable from a child
• Killing the active child deadlocked, because the command awaited disposal of the runtime executing it

Type safety and validation

• @ts-nocheck removed from both files; tsc --noEmit passes
• All 69 any occurrences replaced with pi's exported types
• Unit tests for LockManager, inferToolPaths, the compatibility preflight, and the widget
• CI runs typecheck + tests on push and PR (publishing stays in its own workflow)
• The 12 empty catch {} blocks now either report through a debug channel or carry a rationale

Notes

• The kill key is configurable via ~/.pi/agent/pi-sessions.json ({"killKey": "ctrl+x"}), since some terminals — kitty, for one — consume Ctrl-K. Default is unchanged.
• The README now states the real safety model: locks are a per-tool-call race guard, not isolation, and are process-local. That felt worth being explicit about.

Happy to split this into smaller PRs, drop any part, or adjust the conventions to match your preferences — just say the word.