Description

On Windows, the tirith security binary is not installed by default. However, security.tirith_enabled defaults to true, so every terminal command triggers a spawn attempt → OSError → WARNING log. With tirith_fail_open: true (the default), commands are still allowed, but the log is flooded:

WARNING tools.tirith_security: tirith spawn failed: [WinError 2] The system cannot find the file specified.

This repeats for every single terminal command, making it difficult to spot real warnings/errors in the log.

Environment

• Windows 11
• Hermes via pip install (no Rust toolchain for tirith)
• No tirith binary in PATH or installed separately

Expected Behavior

Either:

1. Auto-detect the absence of tirith on startup and set tirith_enabled = false (or log once, not per-command), OR
2. Suppress the per-command warning when tirith is persistently unavailable (cache the failure result), OR
3. Default tirith_enabled to false on Windows (or add Windows-specific skip logic in _initialize_dev)

Actual Behavior

Every terminal command logs a WARNING. On a session with 20+ terminal calls, the log has 20+ identical tirith warnings.

Root Cause

In tools/tirith_security.py:648-653:

except OSError as exc:
    logger.warning("tirith spawn failed: %s", exc)
    if fail_open:
        return {"action": "allow", ...}
    return {"action": "block", ...}

The spawn attempt happens unconditionally regardless of platform. Once the binary is found to be missing, the result should be cached so subsequent calls don't retry and re-log.

Workaround

Set tirith_enabled: false in config.yaml to disable tirith entirely on Windows.