setup: pin and parameterize pi install version

CONFIGURATION.md

@@ -143,12 +143,13 @@ The control plane runs as the admin user, not `baudbot_agent`. These env vars ar
 
 Port 28800 is intentionally outside the agent's firewall allowlist — the agent cannot reach the control plane.
 
-### Git Identity
+### Setup Overrides
 
-Set during `setup.sh` via env vars (or edit `~/.gitconfig` after):
+Set during `setup.sh` / `baudbot install` via env vars:
 
 | Variable | Description | Default |
 |----------|-------------|---------|
+| `BAUDBOT_PI_VERSION` | pi package version installed for `baudbot_agent` | `0.52.12` |
 | `GIT_USER_NAME` | Git commit author name | `baudbot-agent` |
 | `GIT_USER_EMAIL` | Git commit author email | `baudbot-agent@users.noreply.github.com` |
 

README.md

@@ -77,6 +77,12 @@ Upgrade later:
 sudo baudbot update
 ```
 
+Install with a specific pi version (optional):
+
+```bash
+BAUDBOT_PI_VERSION=0.52.12 baudbot install
+```
+
 Slack broker registration (after OAuth callback). When `SLACK_BROKER_*` variables are present, the runtime starts broker pull mode (no inbound callback port required):
 
 ```bash

bin/baudbot

@@ -208,7 +208,16 @@ bootstrap_install() {
   fi
 
   echo "Escalating with $escalator for system setup..."
-  "$escalator" bash "$install_script" "$@"
+  if [ "$escalator" = "sudo" ]; then
+    sudo --preserve-env=BAUDBOT_PI_VERSION bash "$install_script" "$@"
+  else
+    # doas has no portable preserve-env flag; pass explicitly when set.
+    if [ -n "${BAUDBOT_PI_VERSION:-}" ]; then
+      doas env BAUDBOT_PI_VERSION="$BAUDBOT_PI_VERSION" bash "$install_script" "$@"
+    else
+      doas bash "$install_script" "$@"
+    fi
+  fi
 }
 
 # Detect systemd

docs/operations.md

@@ -32,6 +32,12 @@ sudo baudbot update
 sudo baudbot rollback previous
 ```
 
+Provision with a pinned pi version (optional):
+
+```bash
+BAUDBOT_PI_VERSION=0.52.12 baudbot install
+```
+
 ## Slack broker registration
 
 ```bash

install.sh

@@ -187,7 +187,7 @@ header "Setup"
 info "Running setup.sh (user, Node.js, firewall, permissions)..."
 info "This takes 1–2 minutes."
 echo ""
-bash "$REPO_DIR/setup.sh" "$ADMIN_USER"
+BAUDBOT_PI_VERSION="${BAUDBOT_PI_VERSION:-}" bash "$REPO_DIR/setup.sh" "$ADMIN_USER"
 echo ""
 info "Core setup complete"
 

setup.sh

@@ -34,6 +34,7 @@ BAUDBOT_HOME="/home/baudbot_agent"
 # Source repo auto-detected from this script's location (can live anywhere)
 REPO_DIR="$(cd "$(dirname "$0")" && pwd)"
 NODE_VERSION="22.14.0"
+PI_VERSION="${BAUDBOT_PI_VERSION:-0.52.12}"
 
 # Work from a neutral directory — sudo -u baudbot_agent inherits CWD, and
 # git/find fail if CWD is a directory the agent can't access (e.g. /root).
@@ -88,11 +89,10 @@ else
   echo "Node.js already installed, skipping"
 fi
 
-echo "=== Installing pi ==="
-sudo -u baudbot_agent bash -c "
-  export PATH=~/opt/node-v$NODE_VERSION-linux-x64/bin:\$PATH
-  npm install -g @mariozechner/pi-coding-agent
-"
+echo "=== Installing pi $PI_VERSION ==="
+NODE_BIN="$BAUDBOT_HOME/opt/node-v$NODE_VERSION-linux-x64/bin"
+sudo -u baudbot_agent env PATH="$NODE_BIN:$PATH" \
+  npm install -g "@mariozechner/pi-coding-agent@$PI_VERSION"
 
 echo "=== Configuring git identity ==="
 GIT_USER_NAME="${GIT_USER_NAME:-baudbot-agent}"