update nixpkgs and add pi

Flake lock file updates:

• Updated input 'darwin':
    'github:lnl7/nix-darwin/da529ac9e46f25ed5616fd634079a5f3c579135f' (2026-03-08)
  → 'github:lnl7/nix-darwin/06648f4902343228ce2de79f291dd5a58ee12146' (2026-04-01)
• Updated input 'home-manager':
    'github:nix-community/home-manager/02371c05a04a2876cf92e2d67a259e8f87399068' (2026-03-27)
  → 'github:nix-community/home-manager/9dc93220c1c9a410ef6277d6dc55c571d9e592d0' (2026-04-04)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9' (2026-03-24)
  → 'github:nixos/nixpkgs/6201e203d09599479a3b3450ed24fa81537ebc4e' (2026-04-01)
• Updated input 'nur':
    'github:nix-community/nur/6298c3410e4000a9e91c344ac5f163b043534e03' (2026-03-28)
  → 'github:nix-community/nur/274b289253048dec21259c12a16508fb1e30e0f6' (2026-04-04)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/98caaa8cd1fbcc45913d1bb2b7fbabcf3e8d967a' (2026-03-28)
  → 'github:oxalica/rust-overlay/740fb0203b2852917b909a72b948d34d0b171ec0' (2026-04-04)
• Updated input 'wsl':
    'github:nix-community/NixOS-WSL/fd0eae98d1ecee31024271f8d64676250a386ee7' (2026-03-19)
  → 'github:nix-community/NixOS-WSL/d97e078f4788cddb8d11c3c99f72a4bb9ddec221' (2026-03-31)

.claude/settings.local.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)"
+    ]
+  }
+}

flake.lock

@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771520882,
+        "lastModified": 1775037210,
-        "narHash": "sha256-9SeTZ4Pwr730YfT7V8Azb8GFbwk1ZwiQDAwft3qAD+o=",
+        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "6a7fdcd5839ec8b135821179eea3b58092171bcf",
+        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
         "type": "github"
       },
       "original": {
@@ -49,11 +49,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771469470,
+        "lastModified": 1773889306,
-        "narHash": "sha256-GnqdqhrguKNN3HtVfl6z+zbV9R9jhHFm3Z8nu7R6ml0=",
+        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4707eec8d1d2db5182ea06ed48c820a86a42dc13",
+        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
         "type": "github"
       },
       "original": {
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771647911,
+        "lastModified": 1775622785,
-        "narHash": "sha256-18liNHHwOmcaKCpOptE3wLW97fm5v7RTLiZBecX7km0=",
+        "narHash": "sha256-/yFxO+7oS1SymDfJ2iVO7K5vJKcYfe9XGIJ+quLqz0Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "436b27742c996b75e2baf8e835e3b3eae0c9fbd4",
+        "rev": "527e47b78fe67213072f706bf933a9705a8c4974",
         "type": "github"
       },
       "original": {
@@ -263,11 +263,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755344765,
+        "lastModified": 1772905551,
-        "narHash": "sha256-k/Cvh/mzb5lSvilKdgwNBCyAyYmD8YPr1nc0sTSgwxI=",
+        "narHash": "sha256-TZaHyWUJRhmVY9sRe4p2/wlC+p+O02LLeutjTwlZdLU=",
         "owner": "gytis-ivaskevicius",
         "repo": "nix2vim",
-        "rev": "78467c8de07719f92397179844bf75cdf2e58b83",
+        "rev": "71acbf5f97545b01778df03a8f2194e918103eba",
         "type": "github"
       },
       "original": {
@@ -409,11 +409,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1771369470,
+        "lastModified": 1775423009,
-        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
+        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0182a361324364ae3f436a63005877674cf45efb",
+        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
         "type": "github"
       },
       "original": {
@@ -447,11 +447,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771648529,
+        "lastModified": 1775654726,
-        "narHash": "sha256-hXZsRqfiO2Q/xVpjb/ETUhiPssYdPpC/ZIT2PWMbSn0=",
+        "narHash": "sha256-4R6Bc5EIQ+HxVte1Mo1B3OkyYFVmehywOPiH3Z9CAIU=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "1bedc7cb7cfbb0c29970ce26f61718c9b2dac4c3",
+        "rev": "c73a8885bd1bb5d329e16a4512e2c2708c5981a7",
         "type": "github"
       },
       "original": {
@@ -483,11 +483,11 @@
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1771642886,
+        "lastModified": 1775617983,
-        "narHash": "sha256-4zOvSi0WkS2WAaoJtM28wECtS9S+L38CPYbhF+wINDA=",
+        "narHash": "sha256-2NWGA/I4j/qlx6qbg86QvJiK1/GyH9gnf0hFiARWVwE=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "85078369717bdbe1f266c9eaad5e66956fb6feea",
+        "rev": "d98b91b1feae7ef07fa2ccb3aa3f83f11abfae54",
         "type": "github"
       },
       "original": {
@@ -615,11 +615,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771563879,
+        "lastModified": 1774972752,
-        "narHash": "sha256-vA5hocvdGhr+jfBN7A7ogeZqIz2qx01EixXwdVsQcnE=",
+        "narHash": "sha256-DnLIpFxznohpLkIFs390uZ0gxwkVyhtknhKNu+lQJK8=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "379d20c55f552e91fb9f3f0382e4a97d3f452943",
+        "rev": "d97e078f4788cddb8d11c3c99f72a4bb9ddec221",
         "type": "github"
       },
       "original": {

platforms/home-manager/modules/nmasur/presets/fonts.nix

@@ -17,23 +17,27 @@ in
     home.packages = [
       pkgs.nerd-fonts.victor-mono # Used for Vim and Terminal
       pkgs.nerd-fonts.hack # For Polybar, Rofi
+
+      # Maple Mono NF (Ligature unhinted)
+      pkgs.maple-mono.NF-unhinted
     ];
     fonts.fontconfig = {
       enable = true;
-      defaultFonts.monospace = [ "Victor Mono" ];
+      defaultFonts.monospace = [ "Maple Mono NF" ];
     };
 
     xsession.windowManager.i3.config.fonts = {
-      names = [ "pango:Victor Mono" ];
+      # names = [ "pango:Victor Mono" ];
+      names = [ "pango:Maple Mono" ];
       # style = "Regular";
       # size = 11.0;
     };
     services.polybar.config."bar/main".font-0 = "Hack Nerd Font:size=10;2";
     programs.rofi.font = "Hack Nerd Font 14";
-    programs.alacritty.settings.font.normal.family = "VictorMono";
+    programs.alacritty.settings.font.normal.family = "Maple Mono NF";
-    programs.kitty.font.name = "VictorMono Nerd Font Mono";
+    programs.kitty.font.name = "Maple Mono NF";
-    nmasur.presets.programs.wezterm.font = "VictorMono Nerd Font Mono";
+    nmasur.presets.programs.wezterm.font = "Maple Mono NF";
-    programs.ghostty.settings.font-family = "VictorMono Nerd Font Mono";
+    programs.ghostty.settings.font-family = "Maple Mono NF";
     services.dunst.settings.global.font = "Hack Nerd Font 14";
   };
 }

platforms/home-manager/modules/nmasur/presets/programs/ripgrep.nix

@@ -24,6 +24,7 @@ in
         .terraform/
         .target/
         /Library/
+        .jj/
       '';
     };
   };

platforms/home-manager/modules/nmasur/presets/programs/zellij.nix

@@ -15,7 +15,7 @@ let
       return 1
     fi
     echo "$ZELLIJ_SESSION_NAME" > ~/.local/state/zellij-last-session
-    zellij pipe --plugin file:$(which zellij-switch.wasm) -- "--session $TARGET_SESSION"
+    ${lib.getExe pkgs.zellij} action switch-session $TARGET_SESSION
   '';
 in
 
@@ -42,13 +42,13 @@ in
                 return 1
               end
               echo "$ZELLIJ_SESSION_NAME" > ~/.local/state/zellij-last-session
-              zellij pipe --plugin file:$(which zellij-switch.wasm) -- "--cwd $TARGET_DIR --layout default --session $(basename $TARGET_DIR)"
+              ${lib.getExe pkgs.zellij} action switch-session $(basename $TARGET_DIR) --cwd $TARGET_DIR --layout default
             '';
         };
         gh-run = {
           body = # fish
             ''
-              zellij action new-pane --start-suspended -- gh run watch
+              ${lib.getExe pkgs.zellij} action new-pane --start-suspended -- gh run watch
             '';
         };
       };
@@ -143,8 +143,8 @@ in
                 _args =
                   if pkgs.stdenv.isDarwin then
                     [
-                      "env"
+                      # "env"
-                      "PATH=/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin"
+                      # "PATH=/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin"
                       (lib.getExe zellij-switch-to-last)
                     ]
                   else

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/Spoons/HideZoomWindow.spoon/init.lua

@@ -0,0 +1,45 @@
+--- === Hide Zoom Window ===
+-- Credit: https://news.ycombinator.com/item?id=47369091
+
+local obj = {}
+obj.__index = obj
+
+-- Metadata
+obj.name = "HideZoomWindow"
+obj.version = "0.1"
+
+function obj:init()
+    -- Hide Zoom's "share" windows so it doesn't come back on ESC keypress
+    local zoomWindow = nil
+    local originalFrame = nil
+
+    hs.hotkey.bind({"cmd", "ctrl", "alt"}, "H", function()
+      print("> trying to hide zoom")
+      if not zoomWindow then
+        print(">  looking for window")
+        zoomWindow = hs.window.find("zoom share statusbar window")
+      end
+
+      if zoomWindow then
+        print(">  found window")
+        if originalFrame then
+          print(">    restoring")
+          zoomWindow:setFrame(originalFrame)
+          originalFrame = nil
+          zoomWindow = nil
+        else
+          print(">    hiding")
+          originalFrame = zoomWindow:frame()
+          local screen = zoomWindow:screen()
+          local frame = zoomWindow:frame()
+          frame.x = screen:frame().w + 99000
+          frame.y = screen:frame().h + 99000
+          zoomWindow:setFrame(frame)
+        end
+      else
+        print(">  window not found")
+      end
+    end)
+end
+
+return obj

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/default.nix

@@ -29,6 +29,7 @@ in
           zed = "${config.programs.zed-editor.package}/Applications/Zed.app";
         };
     xdg.configFile."hammerspoon/Spoons/MoveWindow.spoon".source = ./Spoons/MoveWindow.spoon;
+    xdg.configFile."hammerspoon/Spoons/HideZoomWindow.spoon".source = ./Spoons/HideZoomWindow.spoon;
 
     home.activation.reloadHammerspoon = config.lib.dag.entryAfter [ "writeBoundary" ] ''
       $DRY_RUN_CMD /Applications/Hammerspoon.app/Contents/Frameworks/hs/hs -c "hs.reload()"

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/init.lua

@@ -3,3 +3,4 @@ hs.loadSpoon("ControlEscape"):start() -- Load Hammerspoon bits from https://gith
 hs.loadSpoon("Launcher"):init()
 hs.loadSpoon("DismissAlerts"):init()
 hs.loadSpoon("MoveWindow"):init()
+hs.loadSpoon("HideZoomWindow"):init()

platforms/home-manager/modules/nmasur/profiles/experimental.nix

@@ -31,8 +31,9 @@ in
       pkgs.comma # Nix-index auto-launch
       pkgs.nix-inspect # TUI for browsing Nix configs
 
-      pkgs.crush # AI LLM Agent
+      # pkgs.crush # AI LLM Agent
       pkgs.gemini-cli # AI LLM Agent
+      pkgs.pi-coding-agent # AI LLM Agent
 
     ];
 

platforms/home-manager/modules/nmasur/profiles/work.nix

@@ -21,6 +21,8 @@ in
     ];
 
     home.packages = [
+      pkgs.actionlint # Lint for GitHub Actions Workflows
+      pkgs.claude-code # AI LLM Agent
       pkgs.stable.visidata # CSV inspector
       pkgs.dos2unix # Convert Windows text files
       pkgs.inetutils # Includes telnet

platforms/nixos/modules/nmasur/presets/services/grafana/grafana-secret-key.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBxUDhh
+SkpvdDNNS04yNk0yNGtqRlRXT2V2QVVScUpVd3RrMWUvYnVyRlJFCktoZUw1VnJI
+SnJ4dDBZK1ROUDRhWm1EaExKZUJmM1NrcUZ0elRtZXZFSTQKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RICtHZGEyUm1lelBEWVFIaCsxSmx0S2V3Yk5qREVRaDdtSkp6ckcz
+UDB5aWcKUFNoeU1YQjhaTG1zTEZBZElkUUpUcXVXdzgrUENUajNqRytMMFZVTzNm
+NAotPiBzc2gtZWQyNTUxOSBuanZYNUEgNjNoM0U0ZnE5dzNCenRWZmVkRVdXOGFa
+cmFjSWtFOUVXSUdzTFNlWGhUSQpvNnk3NXdGZkhtaGRJRmd3czFNUHh3OUlTSGpG
+YUJjT1Baa3dRdzF4V2EwCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBXcnNQcnY5MnJ3
+b3hLM01PYXNwa2tPTFVRMC96QmZZTkdDNktWZFRHOVE4Ck1PZUlLcXN6Rnh3UnlS
+dVkwODJ2QjBXWUZOUTdBU01DYjFSemJxY1haVVUKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IEQwZTA3WFkwMWJjbXhMRDlFaEJjMVhuZFpTVTFsaktqWHFXN0J1ajJHMmMK
+bXRTdTI2N1o4ZXhYcG9kWCtMNjJCMG0zeUpqMS95SC9VdTRNdUY3ZFVVSQotLS0g
+OXJFMUkvOXkvdStrU1dBSEhhNnE0NU56SHE0UkUvbXhwcWRCdkdxdXN3SQpXUnGQ
+XJT+KXvM80eW2z/je+0kq9Yh+DkgcWtUpq2k2WyzIue9AifKco9CQ4AsBtKKoxO9
+SxjY/7b0HRwoXS578gwTxJD0j9sBRsz4s64IeiepKn01KcMTgo1TxYzB7JgM
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix

@@ -28,9 +28,22 @@ in
       before = [ "grafana.service" ];
     };
 
+    secrets.grafana-secret-key = {
+             source = ./grafana-secret-key.age;
+      dest = "${config.secretsDirectory}/grafana-secret-key";
+      owner = "grafana";
+      group = "grafana";
+      permissions = "0440";
+    };
+    systemd.services.grafana-secret-key  = {
+      requiredBy = [ "grafana.service" ];
+      before = [ "grafana.service" ];
+    };
+
     services.grafana = {
       enable = true;
       settings = {
+        security.secret_key = "$__file{${config.secrets.grafana-secret-key.dest}}";
         server = {
           domain = hostnames.metrics;
           http_addr = "127.0.0.1";