hermes - 💡(How to fix) Fix Tirith security wrapper warns on legitimate .app domains [2 pull requests]

Problem

Hermes' Tirith command-security wrapper currently treats legitimate .app domains as suspicious because Tirith reports a lookalike_tld finding like:

Domain uses '.app' TLD which can be confused with file extensions

This creates noisy warnings for normal commands against real .app services.

Reproduction

Run a command that references a legitimate .app domain, for example:

curl https://example.app

Observed locally through check_command_security(...): Tirith can return a warn verdict with a lookalike_tld finding for .app.

Expected behavior

Legitimate .app domains should not trigger a noisy warning by themselves. Other findings on the same command must still warn/block normally.

Notes

A previous implementation attempt was closed in favor of tracking this as an issue first: https://github.com/NousResearch/hermes-agent/pull/23809

Possible approaches:

• handle this via local/configurable security policy instead of hardcoding behavior;
• or apply a narrow allowlist for Tirith lookalike_tld findings where the only finding is .app.

Acceptance criteria

• .app-only lookalike_tld findings no longer interrupt normal command flow.
• Mixed findings still preserve the non-.app warning/block behavior.
• Regression tests cover both .app-only and mixed-finding cases.