deps: update nixos, nixos-small and nixos-unstable

Security update due to CA compromise.

For all:

  nss: 3.112.5, 3.128 -> 3.112.5, 3.131
  nix: 2.34.8 -> 2.34.9

For hamac:

  chromium: 153.0.8010.52 -> 155.0.8059.84
  firefox: 156.0 -> 158.0
  jujutsu: 0.45.1 -> 0.46.0
  pi-coding-agent: 0.87.1 -> 1.3.0
  thunderbird: 156.0 -> 157.0.1
  wireshark-qt: 4.6.8 -> 4.6.9
  zed-editor: 1.20.2 -> 1.24.2

For ev:

  grafana-loki: 3.7.7 -> 3.7.8
  zigbee2mqtt: 2.14.0 -> 2.14.2

For tente:

  grafana: 13.0.9 -> 13.0.11
  grafana-loki: 3.7.7 -> 3.7.8
  headscale: 0.28.0 -> 0.29.3
  nginx: 1.30.5 -> 1.30.6

1 files changed, 22 insertions, 1 deletions

diff --git a/nixos/profiles/workstation/pkgs/pi.nix b/nixos/profiles/workstation/pkgs/pi.nix
index e5d1da6..d617089 100644
--- a/nixos/profiles/workstation/pkgs/pi.nix
+++ b/nixos/profiles/workstation/pkgs/pi.nix
@@ -4,11 +4,32 @@
   lib,
   pi-coding-agent,
   python3,
+  runCommand,
   symlinkJoin,
   writeShellScriptBin,
 }:
 
 let
+  # Patch away the new distracting block-art logo. We're patching dist/
+  # rather than src to avoid downloading >600MB of npm-deps.
+  pi-coding-agent-patched = runCommand "${pi-coding-agent.name}-no-logo" { } ''
+    cp -a ${pi-coding-agent} "$out"
+    chmod -R u+w "$out"
+
+    substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/modes/interactive/components/pi-logo.js" \
+      --replace-fail 'return !isAppleTerminalSession();' 'return false;' \
+      --replace-fail 'return `''${foregroundAnsi(CORAL, mode)}P''${RESET}''${foregroundAnsi(YELLOW, mode)}i''${RESET}`;' \
+                     'return theme.bold(theme.fg("accent", "pi"));'
+    substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/bundle/chunks/chunk-66G7ITPS.js" \
+      --replace-fail 'function supportsPiLogo(){return!isAppleTerminalSession()}' \
+                     'function supportsPiLogo(){return false}' \
+      --replace-fail 'function piWordmark(){let mode=theme.getColorMode();return`''${foregroundAnsi(CORAL,mode)}P''${RESET}''${foregroundAnsi(YELLOW,mode)}i''${RESET}`}' \
+                     'function piWordmark(){return theme.bold(theme.fg("accent","pi"))}'
+
+    substituteInPlace "$out/bin/pi" "$out/bin/.pi-wrapped" \
+      --replace-fail '${pi-coding-agent}' "$out"
+  '';
+
   sbox = writeShellScriptBin "sbox" ''
     set -euo pipefail
 
@@ -54,7 +75,7 @@ let
       --bind "$HOME/.config/pi" "$HOME/.config/pi" \
       --bind "$physical_pwd" "$physical_pwd" \
       --chdir "$physical_pwd" \
-      ${pi-coding-agent}/bin/pi \
+      ${pi-coding-agent-patched}/bin/pi \
         --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \
         --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \
         "$@"