opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: add tirith repo link in code comment, revert README change

Browse source
This commit is contained in:
sheeki003 2026-03-23 22:07:50 +05:30
parent 0d19b9eefb
commit 0dd05b3968
2 changed files with 9 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
README.md
View file

@ -452,24 +452,6 @@ PicoClaw can search the web to provide up-to-date information. Configure in `too
| [SearXNG](https://github.com/searxng/searxng) | Not needed | Self-hosted | Free metasearch engine | | [SearXNG](https://github.com/searxng/searxng) | Not needed | Self-hosted | Free metasearch engine |
| [GLM Search](https://open.bigmodel.cn/) | Required | Varies | Zhipu web search | | [GLM Search](https://open.bigmodel.cn/) | Required | Varies | Zhipu web search |
### 🛡️ Tirith Security Scanning
Shell commands are pre-screened by [Tirith](https://github.com/sheeki03/tirith) before execution. Tirith detects homograph/punycode URLs, pipe-to-shell patterns, terminal injection, typosquatted packages, and insecure transport. Auto-installed on first use with SHA-256 checksum verification. Also integrated in [Hermes Agent](https://github.com/NousResearch/hermes-agent/pull/1256).
Configure via `config.json`:
```json
{
"tools": {
"exec": {
"tirith_enabled": true,
"tirith_bin": "tirith",
"tirith_timeout": 5,
"tirith_fail_open": true
}
}
}
```
### ⚙️ Other Tools ### ⚙️ Other Tools
PicoClaw includes built-in tools for file operations, code execution, scheduling, and more. See [Tools Configuration](docs/tools_configuration.md) for details. PicoClaw includes built-in tools for file operations, code execution, scheduling, and more. See [Tools Configuration](docs/tools_configuration.md) for details.

9
pkg/tools/tirith.go
View file

@ -1,3 +1,12 @@
// Tirith pre-exec security scanning.
//
// Tirith (https://github.com/sheeki03/tirith) is a terminal security tool
// that scans commands for content-level threats: homograph/punycode URLs,
// pipe-to-interpreter patterns, terminal injection (ANSI escapes, bidi
// Unicode, zero-width chars), typosquatted packages, and insecure transport.
//
// Exit code is the verdict source of truth: 0=allow, 1=block, 2=warn.
// Auto-installed from GitHub releases with SHA-256 checksum verification.
package tools package tools
import ( import (