feat(server): add Pi coding agent adapter with Azure OpenAI support

Add Pi (@mariozechner/pi-coding-agent) as a third AI agent backend
alongside Claude Code and OpenCode. Pi is a provider-agnostic TypeScript
coding agent that supports Azure OpenAI, OpenAI, and Anthropic.

Key changes:
- PiAgentAdapter: builds sandbox spec, runner script with write-tool
  output, Swift escape sanitization, self-correction retries via -c
- PI-AGENTS.md: 42-line orchestrator prompt (vs 268 for Claude Code)
- AZURE_OPENAI provider: new LlmProvider enum, proxy route, config
- Shared loadClasspathResource() extracted to AgentAdapter interface
- sanitizeBodyForAzure now keys off provider enum (not URL heuristic)
- Docker image: node:22-slim + Pi 0.65.0 + Bun + precompute infra
- CI: agent-pi-build job in docker build workflow

Tested end-to-end: 80% accuracy on 3 MRs, 0.848 NEG F1. Delivery
verified posting MR summaries + inline diff notes to GitLab.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/ci-docker-build.yml

@@ -162,3 +162,24 @@ jobs:
         org.opencontainers.image.vendor=AET TUM
         org.opencontainers.image.licenses=MIT
         hephaestus.component=agent-opencode
+
+  agent-pi-build:
+    name: "Agent: Pi"
+    if: inputs.should_skip != 'true' && inputs.agent_images_changed == 'true'
+    uses: ./.github/workflows/reusable-docker-build.yml
+    with:
+      image-name: "ls1intum/hephaestus/agent-pi"
+      docker-file: "./docker/agents/pi/Dockerfile"
+      docker-context: "./docker/agents"
+      registry: "ghcr.io"
+      tags: |
+        ${{ github.ref_name }}
+        ${{ github.sha }}
+        ci-${{ github.run_number }}
+        ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'latest' }}
+      labels: |
+        org.opencontainers.image.title=Hephaestus Agent - Pi
+        org.opencontainers.image.description=Sandboxed Pi coding agent for AI-powered code review
+        org.opencontainers.image.vendor=AET TUM
+        org.opencontainers.image.licenses=MIT
+        hephaestus.component=agent-pi

.gitignore

@@ -1,4 +1,5 @@
 .DS_Store
+.context
 
 # IDE files
 .project

docker/agents/pi/.dockerignore

@@ -0,0 +1,3 @@
+.git
+node_modules
+*.md

docker/agents/pi/Dockerfile

@@ -0,0 +1,40 @@
+# syntax=docker/dockerfile:1.4
+# Pi coding agent container image
+# Used by PiAgentAdapter — command set by SandboxSpec, no entrypoint.
+ARG NODE_TAG=22-slim
+FROM node:${NODE_TAG}
+
+RUN apt-get update -qq && apt-get install -y --no-install-recommends git findutils tree jq curl ca-certificates unzip && \
+    rm -rf /var/lib/apt/lists/*
+
+ARG PI_VERSION=0.65.0
+RUN npm install -g @mariozechner/pi-coding-agent@${PI_VERSION} && \
+    npm cache clean --force && \
+    mkdir -p /home/agent/.pi /workspace && \
+    chown -R 1000:1000 /home/agent /workspace
+
+# Bun runtime for precomputation scripts (static analysis before agent runs)
+ARG BUN_VERSION=1.3.11
+RUN curl -fsSL "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" -o /tmp/bun.zip && \
+    unzip -o /tmp/bun.zip -d /tmp && \
+    mv /tmp/bun-linux-x64/bun /usr/local/bin/bun && \
+    chmod +x /usr/local/bin/bun && \
+    rm -rf /tmp/bun*
+
+# Precompute runner + shared libraries (practice scripts injected at runtime from DB)
+COPY --chown=1000:1000 precompute/runner.ts /opt/precompute/runner.ts
+COPY --chown=1000:1000 precompute/lib/ /opt/precompute/lib/
+
+# Git security: neutralize hooks and external commands from mounted repos.
+# System-level config cannot be overridden by repo-local .git/config.
+RUN git config --system core.hooksPath /nonexistent && \
+    git config --system core.fsmonitor false && \
+    git config --system safe.directory /workspace/repo
+
+ENV HOME=/home/agent
+ENV GIT_PAGER=cat
+ENV GIT_TERMINAL_PROMPT=0
+ENV LANG=C.UTF-8
+
+USER 1000:1000
+WORKDIR /workspace

server/application-server/src/main/java/de/tum/in/www1/hephaestus/agent/AgentType.java

@@ -7,9 +7,11 @@
  * <ul>
  *   <li>{@link #CLAUDE_CODE} — requires {@link LlmProvider#ANTHROPIC}</li>
  *   <li>{@link #OPENCODE} — any provider</li>
+ *   <li>{@link #PI} — any provider (multi-provider via Pi coding agent)</li>
  * </ul>
  */
 public enum AgentType {
     CLAUDE_CODE,
     OPENCODE,
+    PI,
 }

server/application-server/src/main/java/de/tum/in/www1/hephaestus/agent/LlmProvider.java

@@ -6,4 +6,5 @@
 public enum LlmProvider {
     ANTHROPIC,
     OPENAI,
+    AZURE_OPENAI,
 }

server/application-server/src/main/java/de/tum/in/www1/hephaestus/agent/adapter/AgentAdapterConfiguration.java

@@ -26,6 +26,11 @@ public AgentAdapter openCodeAgentAdapter(ObjectMapper objectMapper) {
         return new OpenCodeAgentAdapter(objectMapper);
     }
 
+    @Bean
+    public AgentAdapter piAgentAdapter(ObjectMapper objectMapper) {
+        return new PiAgentAdapter(objectMapper);
+    }
+
     @Bean
     public AgentAdapterRegistry agentAdapterRegistry(List<AgentAdapter> adapters) {
         return new AgentAdapterRegistry(adapters);

server/application-server/src/main/java/de/tum/in/www1/hephaestus/agent/adapter/ClaudeCodeAgentAdapter.java

@@ -7,8 +7,6 @@
 import de.tum.in.www1.hephaestus.agent.adapter.spi.AgentAdapterRequest;
 import de.tum.in.www1.hephaestus.agent.adapter.spi.AgentSandboxSpec;
 import de.tum.in.www1.hephaestus.agent.sandbox.spi.SandboxResult;
-import java.io.IOException;
-import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
@@ -72,7 +70,7 @@ public AgentSandboxSpec buildSandboxSpec(AgentAdapterRequest request) {
         inputFiles.put(".json-schema", buildJsonSchema());
 
         // Claude Code-specific orchestrator file (auto-discovered by Claude Code CLI)
-        inputFiles.put("CLAUDE.md", loadClasspathResource("CLAUDE.md"));
+        inputFiles.put("CLAUDE.md", AgentAdapter.loadClasspathResource("CLAUDE.md"));
 
         // Node.js runner script handles: run claude → validate output → retry via --continue
         long agentTimeoutMs = Math.max(60_000L, (long) (request.timeoutSeconds() - TIMEOUT_BUFFER_SECONDS) * 1000);
@@ -502,22 +500,6 @@ private boolean isValidJsonWithFindings(String text) {
         }
     }
 
-    /** Classpath prefix for agent resource files. */
-    private static final String AGENT_RESOURCE_PREFIX = "agent/";
-
-    /** Load a classpath resource from the {@code agent/} directory. */
-    private static byte[] loadClasspathResource(String relativePath) {
-        String fullPath = AGENT_RESOURCE_PREFIX + relativePath;
-        try (InputStream is = ClaudeCodeAgentAdapter.class.getClassLoader().getResourceAsStream(fullPath)) {
-            if (is == null) {
-                throw new IllegalStateException("Missing classpath resource: " + fullPath);
-            }
-            return is.readAllBytes();
-        } catch (IOException e) {
-            throw new IllegalStateException("Failed to read classpath resource: " + fullPath, e);
-        }
-    }
-
     /**
      * Build the shell auth setup prefix and populate env vars based on credential mode.
      */

server/application-server/src/main/java/de/tum/in/www1/hephaestus/agent/adapter/OpenCodeAgentAdapter.java

@@ -9,8 +9,6 @@
 import de.tum.in.www1.hephaestus.agent.adapter.spi.AgentAdapterRequest;
 import de.tum.in.www1.hephaestus.agent.adapter.spi.AgentSandboxSpec;
 import de.tum.in.www1.hephaestus.agent.sandbox.spi.SandboxResult;
-import java.io.IOException;
-import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
@@ -66,8 +64,14 @@ public AgentSandboxSpec buildSandboxSpec(AgentAdapterRequest request) {
 
         // OpenCode agent definitions loaded from classpath resources.
         // The orchestrator (practice-review) spawns per-practice subagents via the task tool.
-        inputFiles.put(".opencode/agents/practice-review.md", loadClasspathResource("opencode-orchestrator.md"));
-        inputFiles.put(".opencode/agents/practice-analyzer.md", loadClasspathResource("opencode-practice-analyzer.md"));
+        inputFiles.put(
+            ".opencode/agents/practice-review.md",
+            AgentAdapter.loadClasspathResource("opencode-orchestrator.md")
+        );
+        inputFiles.put(
+            ".opencode/agents/practice-analyzer.md",
+            AgentAdapter.loadClasspathResource("opencode-practice-analyzer.md")
+        );
 
         // Use a Node.js wrapper to invoke opencode with spawnSync.
         // This bypasses shell variable handling entirely — the prompt file is read
@@ -375,6 +379,7 @@ private String buildProxyEnvAliases(AgentAdapterRequest request) {
         return switch (request.llmProvider()) {
             case OPENAI -> " && export OPENAI_BASE_URL=$LLM_PROXY_URL && export OPENAI_API_KEY=$LLM_PROXY_TOKEN";
             case ANTHROPIC -> " && export ANTHROPIC_BASE_URL=$LLM_PROXY_URL && export ANTHROPIC_API_KEY=$LLM_PROXY_TOKEN";
+            case AZURE_OPENAI -> " && export OPENAI_BASE_URL=$LLM_PROXY_URL && export OPENAI_API_KEY=$LLM_PROXY_TOKEN";
         };
     }
 
@@ -489,22 +494,6 @@ NdjsonParseResult parseNdjson(String ndjsonContent) {
         return new NdjsonParseResult(text, usage);
     }
 
-    /** Classpath prefix for agent resource files. */
-    private static final String AGENT_RESOURCE_PREFIX = "agent/";
-
-    /** Load a classpath resource from the {@code agent/} directory. */
-    private static byte[] loadClasspathResource(String relativePath) {
-        String fullPath = AGENT_RESOURCE_PREFIX + relativePath;
-        try (InputStream is = OpenCodeAgentAdapter.class.getClassLoader().getResourceAsStream(fullPath)) {
-            if (is == null) {
-                throw new IllegalStateException("Missing classpath resource: " + fullPath);
-            }
-            return is.readAllBytes();
-        } catch (IOException e) {
-            throw new IllegalStateException("Failed to read classpath resource: " + fullPath, e);
-        }
-    }
-
     void configureAuth(AgentAdapterRequest request, Map<String, String> env) {
         switch (request.credentialMode()) {
             case PROXY -> {
@@ -518,6 +507,7 @@ void configureAuth(AgentAdapterRequest request, Map<String, String> env) {
                 switch (request.llmProvider()) {
                     case ANTHROPIC -> env.put("ANTHROPIC_API_KEY", request.credential());
                     case OPENAI -> env.put("OPENAI_API_KEY", request.credential());
+                    case AZURE_OPENAI -> env.put("OPENAI_API_KEY", request.credential());
                 }
             }
         }
@@ -543,7 +533,7 @@ byte[] buildConfigJson(AgentAdapterRequest request) {
         // In proxy mode, OPENAI_BASE_URL/ANTHROPIC_BASE_URL env vars redirect to the proxy.
         String providerPrefix = switch (request.llmProvider()) {
             case ANTHROPIC -> "anthropic";
-            case OPENAI -> "openai";
+            case OPENAI, AZURE_OPENAI -> "openai";
         };
         config.put("model", providerPrefix + "/" + model);