deps: update nixos, nixos-small and nixos-unstable

Security update due to CA compromise.

For all:

  nss: 3.112.5, 3.128 -> 3.112.5, 3.131
  nix: 2.34.8 -> 2.34.9

For hamac:

  chromium: 153.0.8010.52 -> 155.0.8059.84
  firefox: 156.0 -> 158.0
  jujutsu: 0.45.1 -> 0.46.0
  pi-coding-agent: 0.87.1 -> 1.3.0
  thunderbird: 156.0 -> 157.0.1
  wireshark-qt: 4.6.8 -> 4.6.9
  zed-editor: 1.20.2 -> 1.24.2

For ev:

  grafana-loki: 3.7.7 -> 3.7.8
  zigbee2mqtt: 2.14.0 -> 2.14.2

For tente:

  grafana: 13.0.9 -> 13.0.11
  grafana-loki: 3.7.7 -> 3.7.8
  headscale: 0.28.0 -> 0.29.3
  nginx: 1.30.5 -> 1.30.6

5 files changed, 120 insertions, 11 deletions

diff --git a/nixos/npins/sources.json b/nixos/npins/sources.json
index 070f08f..8fc6e74 100644
--- a/nixos/npins/sources.json
+++ b/nixos/npins/sources.json
@@ -80,9 +80,9 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "bac7da2cfa0cd67a764a4f1199119eaa3164add2",
+      "revision": "0d373b36fed5c24e34ebd9747390a4347bcb1ab2",
       "url": null,
-      "hash": "sha256-PCc3AuDWSViyfA4cHXF2m6dYAw6pkm+mtJ0mUWZBjcs="
+      "hash": "sha256-MngbFxDoY5BxF04MaABuKMkMErWsf+rpNvpmD6n73Sw="
     },
     "my-rust-features": {
       "type": "Git",
@@ -135,20 +135,20 @@
     "nixos": {
       "type": "Channel",
       "name": "nixos-26.05",
-      "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10478.1bc55b9def81/nixexprs.tar.xz",
-      "hash": "sha256-DfkF+sEdKXCrvkg7olt82Q9cfP3p7Ro2R851fcTcSxI="
+      "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.12297.cd4ea8d57de1/nixexprs.tar.xz",
+      "hash": "sha256-OtQ9jaQ9aXZDm61TqykPLZdXJa2NMykYG3d0tbT683U="
     },
     "nixos-small": {
       "type": "Channel",
       "name": "nixos-26.05-small",
-      "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.10525.ccec4b6c6bf3/nixexprs.tar.xz",
-      "hash": "sha256-fiFr3bohK9pcxHhhyxGuPK0U/W1/0VQl/lUXP9Spcsg="
+      "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.12338.2544984418e6/nixexprs.tar.xz",
+      "hash": "sha256-+83IgDzywfGz36Lha94c6VioF93u5+FUSsIpuSLGaeM="
     },
     "nixos-unstable": {
       "type": "Channel",
       "name": "nixos-unstable",
-      "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1078696.4975466d3247/nixexprs.tar.xz",
-      "hash": "sha256-EZwz6sR6RLzbKiJJ9QQgXPZ/zA6P8ecfFr/6fwBRfes="
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1097682.02c087f3fe67/nixexprs.tar.xz",
+      "hash": "sha256-ij8QUxzTOHovLrNOxVRx+RAhGQFOMsJbji0veiatH5k="
     },
     "prometheus-sql-exporter": {
       "type": "GitRelease",
diff --git a/nixos/profiles/workstation/firefox.nix b/nixos/profiles/workstation/firefox.nix
index ead7b45..7e4e39b 100644
--- a/nixos/profiles/workstation/firefox.nix
+++ b/nixos/profiles/workstation/firefox.nix
@@ -17,6 +17,7 @@
 
           "browser.aboutConfig.showWarning" = false;
           "browser.ml.chat.menu" = false;
+          "browser.nova.enabled" = false;
           "browser.tabs.insertAfterCurrent" = true;
           "browser.tabs.groups.enabled" = false;
           "browser.tabs.splitView.enabled" = false;
diff --git a/nixos/profiles/workstation/pkgs/pi.nix b/nixos/profiles/workstation/pkgs/pi.nix
index e5d1da6..d617089 100644
--- a/nixos/profiles/workstation/pkgs/pi.nix
+++ b/nixos/profiles/workstation/pkgs/pi.nix
@@ -4,11 +4,32 @@
   lib,
   pi-coding-agent,
   python3,
+  runCommand,
   symlinkJoin,
   writeShellScriptBin,
 }:
 
 let
+  # Patch away the new distracting block-art logo. We're patching dist/
+  # rather than src to avoid downloading >600MB of npm-deps.
+  pi-coding-agent-patched = runCommand "${pi-coding-agent.name}-no-logo" { } ''
+    cp -a ${pi-coding-agent} "$out"
+    chmod -R u+w "$out"
+
+    substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/modes/interactive/components/pi-logo.js" \
+      --replace-fail 'return !isAppleTerminalSession();' 'return false;' \
+      --replace-fail 'return `''${foregroundAnsi(CORAL, mode)}P''${RESET}''${foregroundAnsi(YELLOW, mode)}i''${RESET}`;' \
+                     'return theme.bold(theme.fg("accent", "pi"));'
+    substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/bundle/chunks/chunk-66G7ITPS.js" \
+      --replace-fail 'function supportsPiLogo(){return!isAppleTerminalSession()}' \
+                     'function supportsPiLogo(){return false}' \
+      --replace-fail 'function piWordmark(){let mode=theme.getColorMode();return`''${foregroundAnsi(CORAL,mode)}P''${RESET}''${foregroundAnsi(YELLOW,mode)}i''${RESET}`}' \
+                     'function piWordmark(){return theme.bold(theme.fg("accent","pi"))}'
+
+    substituteInPlace "$out/bin/pi" "$out/bin/.pi-wrapped" \
+      --replace-fail '${pi-coding-agent}' "$out"
+  '';
+
   sbox = writeShellScriptBin "sbox" ''
     set -euo pipefail
 
@@ -54,7 +75,7 @@ let
       --bind "$HOME/.config/pi" "$HOME/.config/pi" \
       --bind "$physical_pwd" "$physical_pwd" \
       --chdir "$physical_pwd" \
-      ${pi-coding-agent}/bin/pi \
+      ${pi-coding-agent-patched}/bin/pi \
         --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \
         --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \
         "$@"
diff --git a/user/pi/settings.json b/user/pi/settings.json
index 940ed46..cf47dc7 100644
--- a/user/pi/settings.json
+++ b/user/pi/settings.json
@@ -1,6 +1,7 @@
 {
-  "lastChangelogVersion": "0.87.1",
-  "theme": "dark",
+  "lastChangelogVersion": "1.3.0",
+  "theme": "classic-dark",
+  "tuiMode": "regular",
   "defaultProvider": "openai-codex",
   "defaultModel": "gpt-5.6-sol",
   "defaultThinkingLevel": "medium",
diff --git a/user/pi/themes/classic-dark.json b/user/pi/themes/classic-dark.json
new file mode 100644
index 0000000..f3b75da
--- /dev/null
+++ b/user/pi/themes/classic-dark.json
@@ -0,0 +1,86 @@
+{
+  "$schema": "https://pi.dev/schemas/theme.schema.json",
+  "name": "classic-dark",
+  "appearance": "dark",
+  "vars": {
+    "cyan": "#00d7ff",
+    "blue": "#5f87ff",
+    "green": "#b5bd68",
+    "red": "#cc6666",
+    "yellow": "#ffff00",
+    "text": "#d4d4d4",
+    "gray": "#808080",
+    "dimGray": "#666666",
+    "darkGray": "#505050",
+    "accent": "#8abeb7",
+    "selectedBg": "#3a3a4a",
+    "userMsgBg": "#343541",
+    "toolPendingBg": "#282832",
+    "toolSuccessBg": "#283228",
+    "toolErrorBg": "#3c2828",
+    "customMsgBg": "#2d2838"
+  },
+  "colors": {
+    "accent": "accent",
+    "border": "blue",
+    "borderAccent": "cyan",
+    "borderMuted": "darkGray",
+    "success": "green",
+    "error": "red",
+    "warning": "yellow",
+    "muted": "gray",
+    "dim": "dimGray",
+    "text": "text",
+    "thinkingText": "gray",
+    "selectedBg": "selectedBg",
+    "scrollbarTrack": "darkGray",
+    "scrollbarThumb": "text",
+    "searchMatchBg": "selectedBg",
+    "searchMatchText": "text",
+    "userMessageBg": "userMsgBg",
+    "userMessageText": "text",
+    "customMessageBg": "customMsgBg",
+    "customMessageText": "text",
+    "customMessageLabel": "#9575cd",
+    "toolPendingBg": "toolPendingBg",
+    "toolSuccessBg": "toolSuccessBg",
+    "toolErrorBg": "toolErrorBg",
+    "toolTitle": "text",
+    "toolOutput": "gray",
+    "mdHeading": "#f0c674",
+    "mdLink": "#81a2be",
+    "mdLinkUrl": "dimGray",
+    "mdCode": "accent",
+    "mdCodeBlock": "green",
+    "mdCodeBlockBorder": "gray",
+    "mdQuote": "gray",
+    "mdQuoteBorder": "gray",
+    "mdHr": "gray",
+    "mdListBullet": "accent",
+    "toolDiffAdded": "green",
+    "toolDiffRemoved": "red",
+    "toolDiffContext": "gray",
+    "syntaxComment": "#6A9955",
+    "syntaxKeyword": "#569CD6",
+    "syntaxFunction": "#DCDCAA",
+    "syntaxVariable": "#9CDCFE",
+    "syntaxString": "#CE9178",
+    "syntaxNumber": "#B5CEA8",
+    "syntaxType": "#4EC9B0",
+    "syntaxOperator": "#D4D4D4",
+    "syntaxPunctuation": "#D4D4D4",
+    "thinkingOff": "darkGray",
+    "thinkingMinimal": "#6e6e6e",
+    "thinkingLow": "#5f87af",
+    "thinkingMedium": "#81a2be",
+    "thinkingHigh": "#b294bb",
+    "thinkingXhigh": "#d183e8",
+    "thinkingMax": "#ff5fff",
+    "bashMode": "green"
+  },
+  "export": {
+    "pageBg": "#18181e",
+    "cardBg": "#1e1e24",
+    "infoBg": "#3c3728"
+  }
+}