deps: update nixos, nixos-small and nixos-unstable

Security update due to CA compromise.

For all:

  nss: 3.112.5, 3.128 -> 3.112.5, 3.131
  nix: 2.34.8 -> 2.34.9

For hamac:

  chromium: 153.0.8010.52 -> 155.0.8059.84
  firefox: 156.0 -> 158.0
  jujutsu: 0.45.1 -> 0.46.0
  pi-coding-agent: 0.87.1 -> 1.3.0
  thunderbird: 156.0 -> 157.0.1
  wireshark-qt: 4.6.8 -> 4.6.9
  zed-editor: 1.20.2 -> 1.24.2

For ev:

  grafana-loki: 3.7.7 -> 3.7.8
  zigbee2mqtt: 2.14.0 -> 2.14.2

For tente:

  grafana: 13.0.9 -> 13.0.11
  grafana-loki: 3.7.7 -> 3.7.8
  headscale: 0.28.0 -> 0.29.3
  nginx: 1.30.5 -> 1.30.6

3 files changed, 31 insertions, 9 deletions

diff --git a/nixos/npins/sources.json b/nixos/npins/sources.json
index 070f08f..8fc6e74 100644
--- a/nixos/npins/sources.json
+++ b/nixos/npins/sources.json
@@ -80,9 +80,9 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "bac7da2cfa0cd67a764a4f1199119eaa3164add2",
+      "revision": "0d373b36fed5c24e34ebd9747390a4347bcb1ab2",
       "url": null,
-      "hash": "sha256-PCc3AuDWSViyfA4cHXF2m6dYAw6pkm+mtJ0mUWZBjcs="
+      "hash": "sha256-MngbFxDoY5BxF04MaABuKMkMErWsf+rpNvpmD6n73Sw="
     },
     "my-rust-features": {
       "type": "Git",
@@ -135,20 +135,20 @@
     "nixos": {
       "type": "Channel",
       "name": "nixos-26.05",
-      "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10478.1bc55b9def81/nixexprs.tar.xz",
-      "hash": "sha256-DfkF+sEdKXCrvkg7olt82Q9cfP3p7Ro2R851fcTcSxI="
+      "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.12297.cd4ea8d57de1/nixexprs.tar.xz",
+      "hash": "sha256-OtQ9jaQ9aXZDm61TqykPLZdXJa2NMykYG3d0tbT683U="
     },
     "nixos-small": {
       "type": "Channel",
       "name": "nixos-26.05-small",
-      "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.10525.ccec4b6c6bf3/nixexprs.tar.xz",
-      "hash": "sha256-fiFr3bohK9pcxHhhyxGuPK0U/W1/0VQl/lUXP9Spcsg="
+      "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.12338.2544984418e6/nixexprs.tar.xz",
+      "hash": "sha256-+83IgDzywfGz36Lha94c6VioF93u5+FUSsIpuSLGaeM="
     },
     "nixos-unstable": {
       "type": "Channel",
       "name": "nixos-unstable",
-      "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1078696.4975466d3247/nixexprs.tar.xz",
-      "hash": "sha256-EZwz6sR6RLzbKiJJ9QQgXPZ/zA6P8ecfFr/6fwBRfes="
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1097682.02c087f3fe67/nixexprs.tar.xz",
+      "hash": "sha256-ij8QUxzTOHovLrNOxVRx+RAhGQFOMsJbji0veiatH5k="
     },
     "prometheus-sql-exporter": {
       "type": "GitRelease",
diff --git a/nixos/profiles/workstation/firefox.nix b/nixos/profiles/workstation/firefox.nix
index ead7b45..7e4e39b 100644
--- a/nixos/profiles/workstation/firefox.nix
+++ b/nixos/profiles/workstation/firefox.nix
@@ -17,6 +17,7 @@
 
           "browser.aboutConfig.showWarning" = false;
           "browser.ml.chat.menu" = false;
+          "browser.nova.enabled" = false;
           "browser.tabs.insertAfterCurrent" = true;
           "browser.tabs.groups.enabled" = false;
           "browser.tabs.splitView.enabled" = false;
diff --git a/nixos/profiles/workstation/pkgs/pi.nix b/nixos/profiles/workstation/pkgs/pi.nix
index e5d1da6..d617089 100644
--- a/nixos/profiles/workstation/pkgs/pi.nix
+++ b/nixos/profiles/workstation/pkgs/pi.nix
@@ -4,11 +4,32 @@
   lib,
   pi-coding-agent,
   python3,
+  runCommand,
   symlinkJoin,
   writeShellScriptBin,
 }:
 
 let
+  # Patch away the new distracting block-art logo. We're patching dist/
+  # rather than src to avoid downloading >600MB of npm-deps.
+  pi-coding-agent-patched = runCommand "${pi-coding-agent.name}-no-logo" { } ''
+    cp -a ${pi-coding-agent} "$out"
+    chmod -R u+w "$out"
+
+    substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/modes/interactive/components/pi-logo.js" \
+      --replace-fail 'return !isAppleTerminalSession();' 'return false;' \
+      --replace-fail 'return `''${foregroundAnsi(CORAL, mode)}P''${RESET}''${foregroundAnsi(YELLOW, mode)}i''${RESET}`;' \
+                     'return theme.bold(theme.fg("accent", "pi"));'
+    substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/bundle/chunks/chunk-66G7ITPS.js" \
+      --replace-fail 'function supportsPiLogo(){return!isAppleTerminalSession()}' \
+                     'function supportsPiLogo(){return false}' \
+      --replace-fail 'function piWordmark(){let mode=theme.getColorMode();return`''${foregroundAnsi(CORAL,mode)}P''${RESET}''${foregroundAnsi(YELLOW,mode)}i''${RESET}`}' \
+                     'function piWordmark(){return theme.bold(theme.fg("accent","pi"))}'
+
+    substituteInPlace "$out/bin/pi" "$out/bin/.pi-wrapped" \
+      --replace-fail '${pi-coding-agent}' "$out"
+  '';
+
   sbox = writeShellScriptBin "sbox" ''
     set -euo pipefail
 
@@ -54,7 +75,7 @@ let
       --bind "$HOME/.config/pi" "$HOME/.config/pi" \
       --bind "$physical_pwd" "$physical_pwd" \
       --chdir "$physical_pwd" \
-      ${pi-coding-agent}/bin/pi \
+      ${pi-coding-agent-patched}/bin/pi \
         --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \
         --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \
         "$@"