feat: gate updates behind vet supply-chain checksHEADmain

update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.

1 files changed, 30 insertions, 0 deletions

diff --git a/pkgs/vet/default.nix b/pkgs/vet/default.nix
new file mode 100644
index 0000000..e9c1b09
--- /dev/null
+++ b/pkgs/vet/default.nix
@@ -0,0 +1,30 @@
+# Supply-chain gate for `update` in modules/home/zsh.nix. nix, claude, skills
+# and gh come from the user's PATH: they are configured elsewhere, and nix
+# must match the installed daemon.
+{
+  writeShellApplication,
+  coreutils,
+  curl,
+  gawk,
+  git,
+  gnugrep,
+  gnused,
+  jq,
+  vulnix,
+}:
+
+writeShellApplication {
+  name = "vet";
+  runtimeInputs = [
+    coreutils
+    curl
+    gawk
+    git
+    gnugrep
+    gnused
+    jq
+    vulnix
+  ];
+  runtimeEnv.VET_PROMPT = ./prompt.md;
+  text = builtins.readFile ./vet.sh;
+}