straylight: add tirith (Hermes pre-exec command scanner)

Hermes resolves tirith from PATH before its self-downloaded ~/.hermes/bin/tirith. Taken from nixpkgs-unstable (0.4.1); nixos-26.05 only has 0.3.3. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-20 21:07:37 -07:00
parent b3f66466bc
commit 0a4bec8935
1 changed files with 4 additions and 0 deletions
@@ -333,6 +333,10 @@ in
      llamaUnloadCmd
      whisperTranscribe
      whisperCpp
+      # tirith: pre-exec command security scanner used by Hermes (resolved from
+      # PATH before its self-downloaded ~/.hermes/bin/tirith). From unstable:
+      # 26.05 only has 0.3.3, Hermes ships 0.4.x.
+      pkgsUnstable.tirith
    ];

    services.open-webui = {