From 0a4bec8935b2ee640235a5833c52bebbe592a040 Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Sun, 20 Sep 2026 21:07:37 -0700
Subject: [PATCH] straylight: add tirith (Hermes pre-exec command scanner)

Hermes resolves tirith from PATH before its self-downloaded
~/.hermes/bin/tirith. Taken from nixpkgs-unstable (0.4.1); nixos-26.05
only has 0.3.3.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 hw/straylight/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index aef7cb7..f8b7245 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -333,6 +333,10 @@ in
       llamaUnloadCmd
       whisperTranscribe
       whisperCpp
+      # tirith: pre-exec command security scanner used by Hermes (resolved from
+      # PATH before its self-downloaded ~/.hermes/bin/tirith). From unstable:
+      # 26.05 only has 0.3.3, Hermes ships 0.4.x.
+      pkgsUnstable.tirith
     ];
 
     services.open-webui = {