chore(deps): update dependency sheeki03/tirith to v0.4.1

[renovate-fullsend]

This PR contains the following updates:

Package	Update	Change
sheeki03/tirith	patch	0.4.0 → 0.4.1

---

Release Notes

sheeki03/tirith (sheeki03/tirith)

v0.4.1

Compare Source

Added

• One canonical ThreatDB source-pin manifest, and a daily watcher that proposes pin updates instead of applying them. .github/threatdb-source-pins.json is now the manifest every build resolves the reviewed OpenSSF, DataDog, and ecosyste-ms revisions from. fetch-threatdb-sources.sh reads them through threatdb_source_pins.py resolve and refuses to start when the manifest does not validate: exact source set, reviewed upstream repository per source, lowercase 40-hex commit, RFC3339 UTC timestamps, a commit that does not postdate its own selection, and a max_lag_hours inside 1 to 8760. A scheduled workflow (.github/workflows/threatdb-source-pins.yml, 02:37 UTC daily, main only) discovers each upstream's candidate, requires GitHub's comparison to report it strictly ahead of the current pin, rewrites the manifest, and then proves the candidate before asking anyone to look: it re-runs the pin unit tests and the fail-closed fetch fixture suite, performs a real source fetch, and compiles the exact snapshots with a public deterministic test key. OpenSSF only ever pins a completed Assign IDs commit, paginating up to 10 pages of 100, so a mid-ingestion tree is never selected. The output is a pull request on automation/threatdb-source-pins whose body carries the compare links, changed path prefixes, file-status counts, whether GitHub truncated the file list, and each source's lag against its max_lag_hours. The security boundary is deliberate: discovery runs on the read-only github.token under permissions: contents: read, the workflow holds no ThreatDB signing key and publishes no database, it pushes only to its own automation branch, and the report says not to auto-merge. Operator action after upgrading this repository: pushing that branch and opening the pull request need a separately scoped THREATDB_PIN_PR_TOKEN repository secret (contents plus pull requests, this repository only). Until it is set, the watcher fails at the token check the first time a pin actually changes.
• The README documents the allowlist pattern grammar. allowlist and allowlist_rules match only URLs extracted from the input that appear in a finding's evidence. They never match raw command text, and a finding with no URL evidence cannot be suppressed at all, so a command-shaped entry such as launchctl list is inert. The README now spells out the grammar, which is the same one tirith trust uses, and points at tirith policy effective and tirith policy test '<command>' for checking what a policy actually resolves to.

Changed

• Bash enter mode delivers and blocks, so an ordinary bash install blocks instead of only warning. A bare bind -x on Enter runs the bound function but does not then accept the line on stock bash, so enter mode stashed the typed command and dropped it. The capability self-test correctly reported that, which is why every 0.4.0 bash user fell back to warn-only preexec and got no blocking without setting TIRITH_BASH_PREEXEC_ENFORCE=1 (issues #​111, #​224). Enter is now bound to a readline macro that runs the checker through bind -x and then a guarded accept-line: the accept sub-sequence stays bound to a no-op until _tirith_enter arms it, and _tirith_prompt_hook re-disarms it at every prompt, so typing or injecting the accept bytes cannot accept a line the checker never approved. operate-and-get-next (Ctrl-O) accepts a line without running the checker, so it is unbound while enter mode owns delivery, and the exact prior Ctrl-O binding is captured per keymap and restored on degrade. Bindings and the startup health gate cover emacs-standard, vi-insert, and vi-command, so a later set -o vi cannot expose an unguarded Enter. Every failure to arm or disarm rolls back: the pending command and its receipt are dropped, the receipt is discarded, the command goes back into the readline buffer, and the shell degrades to preexec. Verified over a real PTY with the real binary on GNU bash 5.2 and 5.3. The 0.4.0 gate is unchanged: enter mode is selected only when the tirith setup or tirith doctor self-test has proven delivery for that exact bash version, path, and fingerprint, and an SSH session, a persisted safe-mode flag, or a forced TIRITH_BASH_MODE=preexec still selects preexec.
• Published ThreatDB source provenance records when each pinned commit was authored and when its pin was chosen. Every Git source in source-provenance.json gains commit_timestamp and pin_selected_at. The fetch reads the commit time out of the checkout itself and aborts when a manifest-pinned tree disagrees with the manifest, and tirith-threatdb-compile verifies the pair independently rather than trusting the document: both fields must be present together or both absent, both must be RFC3339 UTC, the commit must not postdate its own selection, and verify_git_checkout re-runs git show -s --format=%cI HEAD against the staged tree and refuses a mismatch. Provenance written before this release carries neither field and still validates, so older signed generations keep verifying. threatdb.yml no longer keeps a second copy of the pins: THREATDB_OSSF_MP_REF, THREATDB_DD_MP_REF, and THREATDB_TYPOSQUAT_REF are gone from its environment block. The overrides still exist for pre-review shadow builds, but an overridden ref now requires a matching THREATDB_*_PIN_SELECTED_AT or the fetch refuses to run.
• TIRITH_BASH_REQUIRE_ENTER is labelled reserved. tirith doctor displayed it alongside the knobs that do something, but no hook reads it: it appears only in doctor's own display and its captured-environment list. Doctor now prints on (reserved; not enforced by this version), and docs/troubleshooting.md says the same, so nobody plans around an enforcement that does not exist yet.

Fixed

• Tirith launched through a symlink lost execution receipts on macOS. std::env::current_exe returns the launch path unresolved there, so registering or validating the shell receipt capability through Homebrew's /opt/homebrew/bin/tirith or an npm wrapper hit the O_NOFOLLOW identity open on the symlink itself, failed with ELOOP, and the shell fell back to legacy mode with no execution receipts. The launch path is canonicalized first. The O_NOFOLLOW open, the owner and group/other-writable checks, and the symlink_metadata device/inode recheck all still run against the resolved path, so a symlink swapped in after canonicalization still fails closed. Reported in issue #​221.
• zsh silently dropped to legacy mode behind a forked subshell. The hook registered the protocol-v3 receipt instance through a command substitution. The Rust side binds the capability to its immediate parent pid, and whenever zsh's exec optimization is suppressed while the rc file is sourced (a prompt framework installing a WINCH trap earlier in the rc is the usual trigger) the substitution runs behind an intermediate fork, so registration was rejected, TIRITH_STATUS went to degraded, and the session ran with no execution receipts. zsh now registers with a plain foreground command redirected into temp files, the way the bash hook already did, so tirith is a direct child of the main shell in every condition. The fish hook gets the same shape for consistency, not because it had the zsh failure. All three hooks also stop discarding the register stderr: the first line of the rejection is kept in _TIRITH_RECEIPT_REGISTER_ERROR and printed under the legacy-mode warning, so a downgrade says why. Reported in issue #​221.
• noclobber broke the hooks' private capture files. A redirect into a file mktemp has already created fails under noclobber, and bash used a plain > everywhere. The bash redirects are now forced with >| across receipt registration, the preexec check, the DEBUG-trap bootstrap command, and the enter-mode check and paste paths; zsh gains the same on its registration redirect, its accept-line and paste widgets having already carried setopt localoptions clobber. A rejected zsh registration is also kept inside an explicit condition so ERR_EXIT cannot kill hook initialization before the rejection is recorded and the honest fallback runs, and both branches clean up their temp files.
• The "how to actually block this" advice pointed bash users back at bash. The warn-only block advisory recommended "an enter-capable shell (bash 5+/zsh/fish)", so a bash 5 user was told to switch to bash 5. It now names zsh or fish, plus the path that blocks on bash without enter mode: export TIRITH_BASH_PREEXEC_ENFORCE=1 before the tirith init line. tirith doctor prints the same remedy whenever it still applies, and adds that a forced TIRITH_BASH_MODE=enter has to go, because preexec enforcement only arms in a shell that starts in preexec mode. When enforcement is already armed and the shell is blocking, doctor prints neither line.
• tirith receipt claimed to manage execution receipts. It fronts the download receipts tirith run writes, and the wrong noun sent the reporter of issue #​221 hunting for shell execution receipts in a store this command has never touched. The command help now reads "Manage download receipts recorded by tirith run", the after-help says shell execution receipts are a separate store with no CLI viewer, the empty-store message names the directory tirith run actually writes to, and docs/compatibility.md matches.
• The repo-policy neutralization notice never reached anyone with a user or org policy. warn_repo_policy_neutralized keyed on policy.scope == Repo, but since the baseline plus overlay merge the merged policy carries the trusted baseline's scope, so a repo overlay whose weakening fields were dropped produced no warning at all for an operator with a user or org policy in place. It now keys on the recorded drop set, which only repo sanitization populates, so it still cannot fire for a purely trusted policy. tirith policy effective already listed the full drop set and is unchanged.
• _tirith_ensure_prompt_hook aborted instead of degrading when PROMPT_COMMAND was readonly. The reattach path assigned to PROMPT_COMMAND without checking its attributes first, and assigning to a readonly variable is a fatal error in bash: the function died before it could return non-zero, so the runtime self-heal never reported a failure and the session never degraded. It now refuses unsafe attributes up front, the same _tirith_prompt_command_attrs_safe check the preexec guard install already used, and confirms the reattachment actually took effect before returning success. Latent before this release; the enter-mode work exposed it.
• ThreatDB reviewed source pins advanced, and the fetch can materialize and hash the tree they point at. The OpenSSF revision moves from 1ea2762d to 54642f7e and the DataDog revision from ef4a781d to 2d098390; the ecosyste-ms typosquat pin is unchanged. That OpenSSF tree is roughly 200k sparse-materialized advisory files, so THREATDB_FETCH_TIMEOUT_SECONDS now defaults to 300 instead of 180; the 600s THREATDB_TRANSACTION_TIMEOUT_SECONDS end-to-end deadline and the separate 420s registry-snapshot budget are unchanged. Content hashing no longer forks sha256sum and cut once per file, close to half a million subprocesses on the current tree: .github/scripts/hash-threatdb-tree.py runs once under the same run_bounded deadline and folds the identical path-NUL/digest-NUL byte stream into one digest, so published content_sha256 values are byte-for-byte what the old loop produced, and a fixture test recomputes the digest with the old shell oracle and fails on any difference. The hasher uses lstat and os.walk(followlinks=False), keeping find -type f semantics: symlinks are neither followed nor hashed, and the OpenSSF fixture now plants one to prove it.
• tirith update on a Hermes-managed install no longer refuses with package-manager advice. A Tirith release cached at $HERMES_HOME/bin/tirith matched no branch of detect_install_method, so it classified as Unknown, and on a Debian or RPM host refine_system_pm turned that into apt or dnf. update then exited 0 having changed nothing, telling the user to dpkg -i or rpm -U a package they never installed, and --rollback refused outright. Such an install is now treated as self-replaceable and runs the existing path unchanged: signed download, mandatory cosign verification (checksum-only only with --allow-unsigned), atomic swap keeping the tirith.tirith-previous sidecar, and --rollback. Recognition is proof-based and Unix-only, and only a binary whose path resolved cleanly and classified as Unknown is even a candidate. The root (HERMES_HOME, else ~/.hermes when that variable is unset; an empty HERMES_HOME disables the path entirely) must be absolute and lexically normal, so a relative path, a .. component, or an alias spelling such as /safe/./root is refused, and it must not be a system or package-manager root (/usr, /usr/local, /opt/homebrew, /nix/store, a Cellar, and the rest of the deny list). The layout must be exactly <root>/bin/tirith or <root>/profiles/<profile>/bin/tirith. The root, every traversed directory, and the binary must be owned by the current effective uid, must not be symlinks, must carry no group or world write bit, and must carry no POSIX ACL entry granting write to another principal, checked by the new tirith_core::trusted_child::validate_unix_trusted_path_acl, which fails closed when ACLs cannot be read. The binary must canonicalize back to the running executable, and a tree carrying Cargo's install metadata (.crates.toml or .crates2.json) is never granted self-replacement, the same signal ~/.local/bin already uses. The proof is re-run immediately before the swap and again before a rollback; a boundary that changed since classification aborts with exit 1 and a message naming ownership, permissions, and path, rather than falling through to generic self-management. install_method reports hermes in tirith version --provenance and verify-self JSON, and a Hermes update never requests the privileged package-approval-helper effect or installs that helper. The public tirith_core::selfupdate::InstallMethod enum is deliberately untouched, so this patch release adds no variant to it: hermes is a CLI-private origin (CliInstallOrigin::Hermes) layered over SelfManaged and rendered only by install_method_token.
• Migrated the mutable ThreatDB publication channel to threatdb-current after
  GitHub sealed the former threatdb-latest rolling release. The signed legacy
  channel remains intact as a last-known-good fallback, while new manifests,
  assets, pruning, and v2 rollback operations use the replacement channel.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:26 PM UTC · Completed 3:36 PM UTC

Commit: add9fd4 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.64

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies a file under the protected path prefix images/. No linked issue provides authorization context for modifying infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Obtain human approval for this infrastructure change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies a file under the protected path prefix images/. No linked issue provides authorization context for modifying infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Obtain human approval for this infrastructure change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies a file under the protected path prefix images/. No linked issue provides authorization context for modifying infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Obtain human approval for this infrastructure change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies a file under the protected path prefix images/. No linked issue provides authorization context for modifying infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Obtain human approval for this infrastructure change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:28 AM UTC · Completed 3:41 AM UTC

Commit: fb0898c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.30

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored single-file Containerfile patch bump (sheeki03/tirith v0.4.0→v0.4.1) yields a near-minimal Tier 1 sub-score of 1.25, and while Tier 2 remains elevated (3.43) due to high 30d churn (36 commits), 7 authors in 90d, and 9 fix-pattern commits, the weighted composite (0.62×1.25 + 0.38×3.43 ≈ 2.08) rounds to 2; Tier 1 signals are unchanged from the prior assessment, anchoring confirms the prior score of 2 (moderate) is appropriate.

Previous run

Risk Assessment: moderate (2/5)

Details

Bot-authored single-file patch bump (sheeki03/tirith v0.4.0→v0.4.1) keeps Tier 1 nearly all minimal; Tier 2 signals have intensified since the prior review (churn 38/30d, fix/revert commits 22/90d, 7 authors) but the composite still rounds to moderate at 2, unchanged from the prior assessment.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Tiny bot-authored dependency bump (sheeki03/tirith v0.4.0 → v0.4.1) in a single Containerfile — metadata signals are almost all minimal. Elevated Tier 2 driven by the Containerfile being a high-churn hotspot (30 commits/30d, 6 authors/90d, 8 fix commits/90d). Composite lands at moderate: the change is trivial but the file's recent volatility warrants a careful look.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:28 AM UTC · Completed 3:40 AM UTC

Commit: 7a8c2d8 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.66

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:22 PM UTC · Completed 3:35 PM UTC

Commit: 2338d0b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.69

[fullsend-ai-review]

See the review comment for full details.