From 687fac019f9a030d78bbca7939cfdd0bc6d6c537 Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Wed, 23 Sep 2026 13:11:17 -0700
Subject: [PATCH] straylight: sift CLI 8ca3ade on PATH at next switch

Pin follows approved CLI fail-closed for non-default HERMES_HOME.
Does not switch straylight or orion. ~/.local/bin/sift (e36da19)
still shadows until that binary is removed after the switch.
---
 flake.lock                | 10 +++++-----
 flake.nix                 |  2 +-
 hw/straylight/default.nix |  3 +++
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index d3d2dd3..d156373 100644
--- a/flake.lock
+++ b/flake.lock
@@ -446,16 +446,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1790191351,
-        "narHash": "sha256-XJhq+BEccNUP8FLnpkuZhrxDqhW+Yq9uXmN9Pf0MESQ=",
+        "lastModified": 1790192357,
+        "narHash": "sha256-tG3THukZh1woEbmSEWoaDFjQaGE1rdZBTPF3/6OTC4w=",
         "ref": "refs/heads/master",
-        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
-        "revCount": 34,
+        "rev": "8ca3adec9e53326db063c3e768e81a91037b3765",
+        "revCount": 35,
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       },
       "original": {
-        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
+        "rev": "8ca3adec9e53326db063c3e768e81a91037b3765",
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       }
diff --git a/flake.nix b/flake.nix
index 48987a5..02f84ac 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,7 +23,7 @@
     tracker.url = "git+https://git.wntrmute.dev/kyle/tracker";
     tracker.inputs.nixpkgs.follows = "nixpkgs";
 
-    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=429f6b207eab4bb480f21ca5dd9caafb6b55e9d5";
+    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=8ca3adec9e53326db063c3e768e81a91037b3765";
     sift.inputs.nixpkgs.follows = "nixpkgs";
 
     tether.url = "git+ssh://git@git.wntrmute.dev/kyle/tether?rev=c89894b8dcac89aaea9ad72529524c1204884bc0";
diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index 4e9273e..e556858 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -323,6 +323,9 @@ in
       # PATH before its self-downloaded ~/.hermes/bin/tirith). From unstable:
       # 26.05 only has 0.3.3, Hermes ships 0.4.x.
       pkgsUnstable.tirith
+      # CLI fail-closed for non-default HERMES_HOME. ~/.local/bin/sift currently
+      # shadows this until the next straylight switch + that binary is gone.
+      inputs.sift.packages.x86_64-linux.sift
     ];
 
     services.open-webui = {