hw/straylight/default.nix

@@ -333,6 +333,10 @@ in
       llamaUnloadCmd
       whisperTranscribe
       whisperCpp
+      # tirith: pre-exec command security scanner used by Hermes (resolved from
+      # PATH before its self-downloaded ~/.hermes/bin/tirith). From unstable:
+      # 26.05 only has 0.3.3, Hermes ships 0.4.x.
+      pkgsUnstable.tirith
     ];
 
     services.open-webui = {