From 305a0e61f839de12f5aebaee6e1469e138c86fd7 Mon Sep 17 00:00:00 2001
From: "Simen A. W. Olsen" <hello@simenandre.no>
Date: Tue, 27 Oct 2026 11:50:21 +0100
Subject: feat: gate updates behind vet supply-chain checks

update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.
---
 pkgs/vet/default.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 pkgs/vet/default.nix

(limited to 'pkgs/vet/default.nix')

diff --git a/pkgs/vet/default.nix b/pkgs/vet/default.nix
new file mode 100644
index 0000000..e9c1b09
--- /dev/null
+++ b/pkgs/vet/default.nix
@@ -0,0 +1,30 @@
+# Supply-chain gate for `update` in modules/home/zsh.nix. nix, claude, skills
+# and gh come from the user's PATH: they are configured elsewhere, and nix
+# must match the installed daemon.
+{
+  writeShellApplication,
+  coreutils,
+  curl,
+  gawk,
+  git,
+  gnugrep,
+  gnused,
+  jq,
+  vulnix,
+}:
+
+writeShellApplication {
+  name = "vet";
+  runtimeInputs = [
+    coreutils
+    curl
+    gawk
+    git
+    gnugrep
+    gnused
+    jq
+    vulnix
+  ];
+  runtimeEnv.VET_PROMPT = ./prompt.md;
+  text = builtins.readFile ./vet.sh;
+}
-- 
cgit v1.3.1