From 0dd05b3968aeabc886b82b85ec4728fb9e9f7022 Mon Sep 17 00:00:00 2001
From: sheeki003 <36009418+sheeki03@users.noreply.github.com>
Date: Mon, 23 Mar 2026 22:07:50 +0530
Subject: [PATCH] docs: add tirith repo link in code comment, revert README
 change

---
 README.md           | 18 ------------------
 pkg/tools/tirith.go |  9 +++++++++
 2 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/README.md b/README.md
index 0bf4e898b..e25366ef8 100644
--- a/README.md
+++ b/README.md
@@ -452,24 +452,6 @@ PicoClaw can search the web to provide up-to-date information. Configure in `too
 | [SearXNG](https://github.com/searxng/searxng) | Not needed | Self-hosted | Free metasearch engine |
 | [GLM Search](https://open.bigmodel.cn/) | Required | Varies | Zhipu web search |
 
-### 🛡️ Tirith Security Scanning
-
-Shell commands are pre-screened by [Tirith](https://github.com/sheeki03/tirith) before execution. Tirith detects homograph/punycode URLs, pipe-to-shell patterns, terminal injection, typosquatted packages, and insecure transport. Auto-installed on first use with SHA-256 checksum verification. Also integrated in [Hermes Agent](https://github.com/NousResearch/hermes-agent/pull/1256).
-
-Configure via `config.json`:
-```json
-{
-  "tools": {
-    "exec": {
-      "tirith_enabled": true,
-      "tirith_bin": "tirith",
-      "tirith_timeout": 5,
-      "tirith_fail_open": true
-    }
-  }
-}
-```
-
 ### ⚙️ Other Tools
 
 PicoClaw includes built-in tools for file operations, code execution, scheduling, and more. See [Tools Configuration](docs/tools_configuration.md) for details.
diff --git a/pkg/tools/tirith.go b/pkg/tools/tirith.go
index 7f014d777..3e1c3349e 100644
--- a/pkg/tools/tirith.go
+++ b/pkg/tools/tirith.go
@@ -1,3 +1,12 @@
+// Tirith pre-exec security scanning.
+//
+// Tirith (https://github.com/sheeki03/tirith) is a terminal security tool
+// that scans commands for content-level threats: homograph/punycode URLs,
+// pipe-to-interpreter patterns, terminal injection (ANSI escapes, bidi
+// Unicode, zero-width chars), typosquatted packages, and insecure transport.
+//
+// Exit code is the verdict source of truth: 0=allow, 1=block, 2=warn.
+// Auto-installed from GitHub releases with SHA-256 checksum verification.
 package tools
 
 import (