$ shellfirm
Getting Started

Shell Setup

Configure your shell to use shellfirm for command interception

shellfirm works by hooking into your shell's command execution pipeline. You need to add a small snippet to your shell configuration so every command passes through shellfirm before running.

One command detects all installed shells and configures them:

shellfirm init

Here's what you'll see:

shellfirm init
$ shellfirm init
shellfirm — installing hooks for all detected shells
✓ bash → ~/.bashrc
✓ zsh → ~/.zshrc
✓ fish → ~/.config/fish/config.fish
— nushell (not installed on system)
— powershell (not installed on system)
— elvish (not installed on system)
— xonsh (not installed on system)
— oils (not installed on system)
✔ Choose your challenge type: · Enter — just press Enter to confirm
✔ Choose your protection level: · Balanced — catches medium-risk and above (Recommended)
Settings saved to ~/.shellfirm/settings.yaml
3 shell(s) protected (3 new, 0 already set up).
Restart your shell to activate protection:
▸ exec zsh (current shell)
exec bash (bash)
exec fish (fish)

shellfirm scans for all 8 supported shells — Zsh, Bash, Fish, Nushell, PowerShell, Elvish, Xonsh, and Oils — and appends the appropriate hook to each shell's config file. Shells that aren't installed are skipped.

Restart your shell (or run exec zsh / exec bash) for the changes to take effect.

Installing for a specific shell

If you only want to set up a single shell, pass the shell name:

shellfirm init zsh
shellfirm init zsh
shellfirm — installing hook for zsh
✓ zsh → ~/.zshrc
1 shell(s) protected.
Restart your shell to activate protection:
▸ exec zsh

This is useful when you only use one shell, or when you want to add shellfirm to a new shell without touching the others.

Supported shell names: zsh, bash, fish, nushell, powershell, elvish, xonsh, oils.

Uninstall

To remove the shell hooks from all configured shells:

shellfirm init --uninstall

This removes the shellfirm lines from each shell's configuration file.

Manual removal

If the shellfirm init --uninstall command is not working (for example, if the hook is blocking all commands), you can remove the hook manually by editing your shell's config file.

Open the config file for your shell and remove the lines added by shellfirm:

ShellConfig fileLines to remove
Zsh~/.zshrceval "$(shellfirm init zsh)"
Bash~/.bashrceval "$(shellfirm init bash)"
Fish~/.config/fish/config.fishshellfirm init fish | source
Oils~/.config/oils/oshrceval "$(shellfirm init oils)"
Nushell~/.config/nushell/config.nuFull hook block (starts with $env.config.hooks.pre_execution)
PowerShell~/.config/powershell/Microsoft.PowerShell_profile.ps1Full hook block (starts with if (Get-Command shellfirm)
Elvish~/.config/elvish/rc.elvFull hook block (starts with if (not ?(which shellfirm)
Xonsh~/.xonshrcFull hook block (starts with import subprocess)

Look for the comment # Added by shellfirm init and remove everything from that line through the end of the hook.

After editing, open a new terminal window for the changes to take effect. See Troubleshooting for more recovery steps.

Verifying the setup

⚠ Restart your shell before continuing

Run exec zsh, exec bash, or open a new terminal window. shellfirm won't work until the shell is restarted.

Once restarted, run:

shellfirm status

Or try a command that shellfirm will intercept:

Terminal
$ mkdir /tmp/shellfirm-test-verify
$ rm -rf /tmp/shellfirm-test-verify
============ RISKY COMMAND DETECTED ============
Severity: MEDIUM
Blast radius: RESOURCE — Deletes directory with ~0 files (0B)
* Are you sure you want to continue with deletion?
? Type Enter to continue Esc to cancel ›

If you see a challenge prompt, shellfirm is working correctly. Press Esc to cancel.