shellfirm wrap

The wrap command creates a PTY proxy around an interactive command-line tool, checking every statement against shellfirm's pattern database before it executes.

Usage

shellfirm wrap <COMMAND> [ARGS...]

Arguments

Argument	Description
COMMAND	The command to wrap (e.g., psql, mysql, redis-cli)
ARGS	Arguments passed to the wrapped command

Description

shellfirm wrap spawns the target command inside a pseudo-terminal (PTY). Your input is intercepted, buffered until a statement delimiter is detected, and checked against the active check patterns. Safe statements pass through; risky statements trigger a challenge prompt.

The wrapped tool behaves normally -- you get the same prompt, tab completion, and output. The only difference is that dangerous statements are intercepted.

Examples

PostgreSQL

shellfirm wrap psql -h prod.db.com -U analyst -d myapp

MySQL

shellfirm wrap mysql -h prod.db.com -u root -p myapp

Redis

shellfirm wrap redis-cli -h prod.redis.com -p 6379

MongoDB

shellfirm wrap mongosh "mongodb://prod.mongo.com/myapp"

Any interactive tool

shellfirm wrap ./my-admin-cli --env production

Configuration

Per-tool settings are configured in ~/.shellfirm/settings.yaml:

wrappers:
  tools:
    psql:
      delimiter: ";"
      check_groups:
        - psql
        - database
    mysql:
      delimiter: ";"
      check_groups:
        - mysql
        - database
    redis-cli:
      delimiter: "\n"
      check_groups:
        - redis

Setting	Default	Description
delimiter	;	Character that marks the end of a statement
check_groups	(global)	Check groups active for this tool

Statement delimiters

Delimiter	Use for
;	SQL tools (psql, mysql, mongosh)
\n	Line-oriented tools (redis-cli, custom CLIs)

Context awareness

shellfirm wrap inherits all context-aware features. If you are on SSH, as root, or on a production branch, the context signals are detected and challenges are escalated accordingly.

See the Interactive Wrapper section for detailed walkthroughs with each tool.