fix(config pi): embed extension sources so installed binary is self-contained

- add scripts/generate-pi-extension.ts to embed src/pi-ext sources as
  string constants (mirrors prime-agent's embedded switcher pattern).
- config pi now writes the embedded sources by default, so it works from
  an /usr/bin install with no source tree (--extension-dir overrides for
  dev). Verified installed binary writes files byte-identical to source.
- add installEmbeddedExtension test.

scripts/generate-pi-extension.ts

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * Generates `src/cli/src/config/pi-extension.ts` which embeds the pi extension
+ * sources (`mcpctl-pi.ts` + `mcp-http.ts`) as string constants, mirroring how
+ * prime-agent's `/mcpctl` switcher is embedded (`prime-agent-extension.ts`).
+ *
+ * Embedding matters: `mcpctl config pi` must work from an installed binary
+ * that has no access to the source tree. The installed extension files are this
+ * exact embedded source, so what the CLI ships is always what pi runs.
+ *
+ * Regenerate after editing the extension sources:
+ *   npx tsx scripts/generate-pi-extension.ts
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+const scriptsDir = import.meta.dirname;
+const root = join(scriptsDir, '..');
+const piExtDir = join(root, 'src', 'pi-ext');
+
+const MAIN = readFileSync(join(piExtDir, 'mcpctl-pi.ts'), 'utf-8');
+const HTTP = readFileSync(join(piExtDir, 'mcp-http.ts'), 'utf-8');
+
+function embed(src) {
+  // JSON.stringify yields a quoted string literal we can inline directly.
+  return JSON.stringify(src);
+}
+
+const out = `/**
+ * Embedded source of the mcpctl pi extension — DO NOT EDIT BY HAND.
+ * Generated by \`npx tsx scripts/generate-pi-extension.ts\` from
+ * \`src/pi-ext/mcpctl-pi.ts\` and \`src/pi-ext/mcp-http.ts\`.
+ *
+ * \`mcpctl config pi\` writes these verbatim into ~/.pi/agent/extensions/mcpctl/
+ * (and registers them), so an installed binary with no source tree can still
+ * provision a working pi integration.
+ */
+export const PI_EXTENSION_FILENAMES = ['mcpctl-pi.ts', 'mcp-http.ts'] as const;
+
+export const PI_EXTENSION_FILES: Record<string, string> = {
+  'mcpctl-pi.ts': ${embed(MAIN)},
+  'mcp-http.ts': ${embed(HTTP)},
+};
+`;
+
+mkdirSync(dirname(join(root, 'src', 'cli', 'src', 'config')), { recursive: true });
+writeFileSync(join(root, 'src', 'cli', 'src', 'config', 'pi-extension.ts'), out);
+console.log('wrote src/cli/src/config/pi-extension.ts');

src/cli/src/commands/config.ts

@@ -13,6 +13,7 @@ import { findProjectMarker, writeProjectMarker } from '../utils/project-marker.j
 import { installManagedSessionHook } from '../utils/sessionhook.js';
 import {
   installExtensionFiles,
+  installEmbeddedExtension,
   registerWithPi,
   piSkillsDir,
   piSettingsPath,
@@ -506,7 +507,7 @@ export function createConfigCommand(deps?: Partial<ConfigCommandDeps>, apiDeps?:
     .command('pi')
     .description('Install the pi extension + sync skills (native, no MCP client, no Claude)')
     .option('-p, --project <name>', 'Project name to make active')
-    .option('--extension-dir <path>', 'Path to the src/pi-ext sources to install (default: this checkout)')
+    .option('--extension-dir <path>', 'Source-tree src/pi-ext dir (dev only; default: embedded sources)')
     .option('--skip-skills', 'Skip the initial skills sync')
     .option('--settings <path>', 'pi settings.json path (default: ~/.pi/agent/settings.json)')
     .option('--pi-dir <path>', 'Override the pi agent home (default: ~/.pi/agent)')
@@ -526,25 +527,18 @@ export function createConfigCommand(deps?: Partial<ConfigCommandDeps>, apiDeps?:
       // custom --pi-dir is used (also keeps tests off the real ~/.mcpctl).
       const statePath = piHome ? join(opts.piDir!, 'pi-state.json') : piStatePath();
 
-      // 1. Install the extension files into ~/.pi/agent/extensions/mcpctl/
-      let srcDir: string = opts.extensionDir!;
-      if (!srcDir) {
-        // best-effort: locate this checkout's src/pi-ext from the running
-        // script (dist compile) or from cwd (tsx/dev).
-        const candidates = [
-          resolve(import.meta.dirname ?? process.cwd(), '..', '..', '..', '..', 'src', 'pi-ext'),
-          resolve(import.meta.dirname ?? process.cwd(), '..', '..', '..', '..', '..', 'src', 'pi-ext'),
-          resolve(process.cwd(), 'src', 'pi-ext'),
-        ];
-        const { existsSync } = await import('node:fs');
-        srcDir = candidates.find((c) => existsSync(join(c, 'mcpctl-pi.ts'))) ?? candidates[0]!;
-      }
+      // 1. Install the extension files into ~/.pi/agent/extensions/mcpctl/.
+      //    Default: write the embedded sources (works from an installed binary
+      //    with no source tree). --extension-dir overrides with a source-tree
+      //    checkout for dev iteration.
       try {
-        const written = await installExtensionFiles(srcDir, extDest);
+        const written = opts.extensionDir
+          ? await installExtensionFiles(opts.extensionDir, extDest)
+          : await installEmbeddedExtension(extDest);
         log(`Installed extension files:`);
         for (const w of written) log(`  ${w}`);
       } catch (err: unknown) {
-        log(`Error: could not install extension from '${srcDir}': ${err instanceof Error ? err.message : String(err)}`);
+        log(`Error: could not install extension: ${err instanceof Error ? err.message : String(err)}`);
         process.exitCode = 1;
         return;
       }

src/cli/src/utils/pi-settings.ts

@@ -2,18 +2,23 @@
  * Wiring helpers for the pi extension.
  *
  * `mcpctl config pi --project X`:
- *   1. copies `src/pi-ext/` (extension + http client) into
- *      `~/.pi/agent/extensions/mcpctl/`,
+ *   1. writes the embedded extension sources (`mcpctl-pi.ts` + `mcp-http.ts`)
+ *      into `~/.pi/agent/extensions/mcpctl/`,
  *   2. adds the extension path and the pi skills dir to
  *      `~/.pi/agent/settings.json` (`extensions`, `skills` arrays),
  *   3. writes `~/.mcpctl/pi-state.json` so the active project survives across
  *      sessions regardless of the shell's cwd.
  *
+ * The extension sources are embedded in the CLI (see
+ * `config/pi-extension.ts`) so an installed binary with no source tree can
+ * still provision a working pi integration.
+ *
  * Standalone: never touches `~/.claude/`, `~/.prime/`, or `.mcp.json`.
  */
 import { readFile, writeFile, mkdir, copyFile, rename } from 'node:fs/promises';
 import { dirname, join, basename, resolve } from 'node:path';
 import { homedir } from 'node:os';
+import { PI_EXTENSION_FILES } from '../config/pi-extension.js';
 
 export function piAgentDir(): string {
   return join(homedir(), '.pi', 'agent');
@@ -54,10 +59,27 @@ export function piStatePath(): string {
   return join(homedir(), '.mcpctl', 'pi-state.json');
 }
 
+/**
+ * Write the embedded extension sources into the pi extensions dir. This is the
+ * production path used by `mcpctl config pi` — it needs no source tree, so it
+ * works from an installed binary. The extension imports its http client via a
+ * sibling `./mcp-http.js`, so both files must land together.
+ */
+export async function installEmbeddedExtension(dest: string = piExtensionDir()): Promise<string[]> {
+  await mkdir(dest, { recursive: true });
+  const written: string[] = [];
+  for (const [name, src] of Object.entries(PI_EXTENSION_FILES)) {
+    const dst = join(dest, name);
+    await writeFile(dst, src, 'utf-8');
+    written.push(dst);
+  }
+  return written;
+}
+
 /**
  * Copy the bundled extension sources (relative to this source tree's
- * `src/pi-ext/`) into the pi extensions dir. The extension imports its http
- * client via a sibling `./mcp-http.js`, so both files must land together.
+ * `src/pi-ext/`) into the pi extensions dir. Kept for tests / dev; production
+ * uses `installEmbeddedExtension` so installed binaries are self-contained.
  */
 export async function installExtensionFiles(
   srcPiExtDir: string,

src/cli/tests/utils/pi-settings.test.ts

@@ -6,6 +6,7 @@ import { agentInstallRoot } from '../../src/commands/skills.js';
 import {
   registerWithPi,
   installExtensionFiles,
+  installEmbeddedExtension,
 } from '../../src/utils/pi-settings.js';
 
 describe('skills agentInstallRoot', () => {
@@ -89,4 +90,20 @@ describe('pi-settings util', () => {
     expect(readFileSync(join(destDir, 'mcpctl-pi.ts'), 'utf-8')).toBe('// extension\n');
     expect(readFileSync(join(destDir, 'mcp-http.ts'), 'utf-8')).toBe('// client\n');
   });
+
+  it('writes the embedded extension sources (self-contained, no source tree)', async () => {
+    const destDir = join(tmp, 'embedded-ext');
+
+    const written = await installEmbeddedExtension(destDir);
+
+    expect(written).toHaveLength(2);
+    // Both filenames must be written.
+    expect(written.map((w) => w.replace(destDir + '/', ''))).toEqual(['mcpctl-pi.ts', 'mcp-http.ts']);
+    // The main file must be non-empty and import the sibling client.
+    const main = readFileSync(join(destDir, 'mcpctl-pi.ts'), 'utf-8');
+    expect(main.length).toBeGreaterThan(1000);
+    expect(main).toContain('./mcp-http.js');
+    const http = readFileSync(join(destDir, 'mcp-http.ts'), 'utf-8');
+    expect(http).toContain('McpHttpSession');
+  });
 });