Move safe-chain package to packages/safe-chain

packages/safe-chain/src/shell-integration/helpers.js

@@ -0,0 +1,68 @@
+import { spawnSync } from "child_process";
+import * as os from "os";
+import fs from "fs";
+
+export const knownAikidoTools = [
+  { tool: "npm", aikidoCommand: "aikido-npm" },
+  { tool: "npx", aikidoCommand: "aikido-npx" },
+  { tool: "yarn", aikidoCommand: "aikido-yarn" },
+  { tool: "pnpm", aikidoCommand: "aikido-pnpm" },
+  { tool: "pnpx", aikidoCommand: "aikido-pnpx" },
+  // When adding a new tool here, also update the expected alias in the tests (setup.spec.js, teardown.spec.js)
+  // and add the documentation for the new tool in the README.md
+];
+
+export function doesExecutableExistOnSystem(executableName) {
+  if (os.platform() === "win32") {
+    const result = spawnSync("where", [executableName], { stdio: "ignore" });
+    return result.status === 0;
+  } else {
+    const result = spawnSync("which", [executableName], { stdio: "ignore" });
+    return result.status === 0;
+  }
+}
+
+export function removeLinesMatchingPattern(filePath, pattern) {
+  if (!fs.existsSync(filePath)) {
+    return;
+  }
+
+  const fileContent = fs.readFileSync(filePath, "utf-8");
+  const lines = fileContent.split(/[\r\n\u2028\u2029]+/);
+  const updatedLines = lines.filter((line) => !shouldRemoveLine(line, pattern));
+  fs.writeFileSync(filePath, updatedLines.join(os.EOL), "utf-8");
+}
+
+const maxLineLength = 100;
+function shouldRemoveLine(line, pattern) {
+  const isPatternMatch = pattern.test(line);
+
+  if (!isPatternMatch) {
+    return false;
+  }
+
+  if (line.length > maxLineLength) {
+    // safe-chain only adds lines shorter than maxLineLength
+    // so if the line is longer, it must be from a different 
+    // source and could be dangerous to remove
+    return false;
+  }
+
+  if (line.includes("\n") || line.includes("\r") || line.includes("\u2028") || line.includes("\u2029")) {
+    // If the line contains newlines, something has gone wrong in splitting
+    // \u2028 and \u2029 are Unicode line separator characters (line and paragraph separators)
+    return false;
+  }
+
+  return true;
+}
+
+export function addLineToFile(filePath, line) {
+  if (!fs.existsSync(filePath)) {
+    fs.writeFileSync(filePath, "", "utf-8");
+  }
+
+  const fileContent = fs.readFileSync(filePath, "utf-8");
+  const updatedContent = fileContent + os.EOL + line;
+  fs.writeFileSync(filePath, updatedContent, "utf-8");
+}

packages/safe-chain/src/shell-integration/helpers.spec.js

@@ -0,0 +1,113 @@
+import { describe, it, beforeEach, afterEach, mock } from "node:test";
+import assert from "node:assert";
+import { tmpdir } from "node:os";
+import fs from "node:fs";
+import path from "path";
+
+describe("removeLinesMatchingPatternTests", () => {
+  let testFile;
+
+  beforeEach(() => {
+    // Create temporary test file
+    testFile = path.join(tmpdir(), `test-helpers-${Date.now()}.txt`);
+
+    // Mock the os module to override EOL
+    mock.module("node:os", {
+      namedExports: {
+        EOL: "\r\n", // Simulate Windows line endings
+        tmpdir: tmpdir,
+        platform: () => "linux"
+      }
+    });
+  });
+
+  afterEach(() => {
+    // Clean up test files
+    if (fs.existsSync(testFile)) {
+      fs.unlinkSync(testFile);
+    }
+
+    // Reset mocks
+    mock.reset();
+  });
+
+
+  it("should handle mixed line endings without wiping entire file", async () => {
+    // Import helpers after setting up the mock
+    const { removeLinesMatchingPattern } = await import("./helpers.js");
+    
+    // Create a file with Unix line endings but os.EOL expects Windows
+    const fileContent = [
+      "# keep this line",
+      "alias npm='remove-this'", 
+      "# keep this line too",
+      "alias yarn='remove-this-too'",
+      "# final line to keep"
+    ].join("\n"); // File has Unix line endings
+    
+    fs.writeFileSync(testFile, fileContent, "utf-8");
+    
+    // Try to remove lines containing 'alias'
+    const pattern = /alias.*=/;
+    removeLinesMatchingPattern(testFile, pattern);
+    
+    const result = fs.readFileSync(testFile, "utf-8");
+    
+    // This test will fail because the function splits on '\r\n' but file uses '\n'
+    // So it treats the entire content as one line and if any part matches, removes everything
+    assert.ok(result.includes("keep this line"), "Should preserve non-matching lines");
+    assert.ok(result.includes("final line to keep"), "Should preserve final line");
+  });
+
+  it("should handle mixed line endings with short matching content", async () => {
+    // Import helpers after setting up the mock
+    const { removeLinesMatchingPattern } = await import("./helpers.js");
+    
+    // Create a file with Unix line endings, but make the entire content short 
+    // to bypass the maxLineLength protection
+    const fileContent = [
+      "# keep1",
+      "alias x=y", // Short alias line that should be removed
+      "# keep2"
+    ].join("\n"); // File has Unix line endings, total length < 100 chars
+    
+    fs.writeFileSync(testFile, fileContent, "utf-8");
+    
+    // Try to remove lines containing 'alias'
+    const pattern = /alias/;
+    removeLinesMatchingPattern(testFile, pattern);
+    
+    const result = fs.readFileSync(testFile, "utf-8");
+    
+    // This should now be protected by the newline detection
+    assert.ok(result.includes("keep1"), "Should preserve first line");
+    assert.ok(result.includes("keep2"), "Should preserve third line");
+  });
+
+  it("should handle Unicode line separators that bypass newline detection", async () => {
+    // Import helpers after setting up the mock
+    const { removeLinesMatchingPattern } = await import("./helpers.js");
+    
+    // Use Unicode line separator (U+2028) and paragraph separator (U+2029)
+    // These are considered line breaks but aren't \n or \r
+    const fileContent = [
+      "keep this",
+      "alias test=value",
+      "keep that"
+    ].join("\u2028"); // Unicode line separator
+    
+    fs.writeFileSync(testFile, fileContent, "utf-8");
+    
+    // Try to remove lines containing 'alias'
+    const pattern = /alias/;
+    removeLinesMatchingPattern(testFile, pattern);
+    
+    const result = fs.readFileSync(testFile, "utf-8");
+    
+    // This could still wipe everything if split() treats it as one line
+    // but the content doesn't contain \n or \r so passes the newline check
+    assert.ok(result.includes("keep this"), "Should preserve first part");
+    assert.ok(result.includes("keep that"), "Should preserve last part");
+  });
+
+});

packages/safe-chain/src/shell-integration/setup.js

@@ -0,0 +1,100 @@
+import chalk from "chalk";
+import { ui } from "../environment/userInteraction.js";
+import { detectShells } from "./shellDetection.js";
+import { knownAikidoTools } from "./helpers.js";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+
+/**
+ * Loops over the detected shells and calls the setup function for each.
+ */
+export async function setup() {
+  ui.writeInformation(
+    chalk.bold("Setting up shell aliases.") +
+      " This will wrap safe-chain around npm, npx, and yarn commands."
+  );
+  ui.emptyLine();
+
+  copyStartupFiles();
+
+  try {
+    const shells = detectShells();
+    if (shells.length === 0) {
+      ui.writeError("No supported shells detected. Cannot set up aliases.");
+      return;
+    }
+
+    ui.writeInformation(
+      `Detected ${shells.length} supported shell(s): ${shells
+        .map((shell) => chalk.bold(shell.name))
+        .join(", ")}.`
+    );
+
+    let updatedCount = 0;
+    for (const shell of shells) {
+      if (setupShell(shell)) {
+        updatedCount++;
+      }
+    }
+
+    if (updatedCount > 0) {
+      ui.emptyLine();
+      ui.writeInformation(`Please restart your terminal to apply the changes.`);
+    }
+  } catch (error) {
+    ui.writeError(
+      `Failed to set up shell aliases: ${error.message}. Please check your shell configuration.`
+    );
+    return;
+  }
+}
+
+/**
+ * Calls the setup function for the given shell and reports the result.
+ */
+function setupShell(shell) {
+  let success = false;
+  try {
+    shell.teardown(knownAikidoTools); // First, tear down to prevent duplicate aliases
+    success = shell.setup(knownAikidoTools);
+  } catch {
+    success = false;
+  }
+
+  if (success) {
+    ui.writeInformation(
+      `${chalk.bold("- " + shell.name + ":")} ${chalk.green(
+        "Setup successful"
+      )}`
+    );
+  } else {
+    ui.writeError(
+      `${chalk.bold("- " + shell.name + ":")} ${chalk.red(
+        "Setup failed"
+      )}. Please check your ${shell.name} configuration.`
+    );
+  }
+
+  return success;
+}
+
+function copyStartupFiles() {
+  const startupFiles = ["init-posix.sh", "init-pwsh.ps1", "init-fish.fish"];
+
+  for (const file of startupFiles) {
+    const targetDir = path.join(os.homedir(), ".safe-chain", "scripts");
+    const targetPath = path.join(os.homedir(), ".safe-chain", "scripts", file);
+
+    if (!fs.existsSync(targetDir)) {
+      fs.mkdirSync(targetDir, { recursive: true });
+    }
+
+    // Use absolute path for source
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = path.dirname(__filename);
+    const sourcePath = path.resolve(__dirname, "startup-scripts", file);
+    fs.copyFileSync(sourcePath, targetPath);
+  }
+}

packages/safe-chain/src/shell-integration/shellDetection.js

@@ -0,0 +1,26 @@
+import zsh from "./supported-shells/zsh.js";
+import bash from "./supported-shells/bash.js";
+import powershell from "./supported-shells/powershell.js";
+import windowsPowershell from "./supported-shells/windowsPowershell.js";
+import fish from "./supported-shells/fish.js";
+import { ui } from "../environment/userInteraction.js";
+
+export function detectShells() {
+  let possibleShells = [zsh, bash, powershell, windowsPowershell, fish];
+  let availableShells = [];
+
+  try {
+    for (const shell of possibleShells) {
+      if (shell.isInstalled()) {
+        availableShells.push(shell);
+      }
+    }
+  } catch (error) {
+    ui.writeError(
+      `We were not able to detect which shells are installed on your system. Please check your shell configuration. Error: ${error.message}`
+    );
+    return [];
+  }
+
+  return availableShells;
+}

packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish

@@ -0,0 +1,58 @@
+function printSafeChainWarning
+    set original_cmd $argv[1]
+    
+    # Fish equivalent of ANSI color codes: yellow background, black text for "Warning:"
+    set_color -b yellow black
+    printf "Warning:"
+    set_color normal
+    printf " safe-chain is not available to protect you from installing malware. %s will run without it.\n" $original_cmd
+    
+    # Cyan text for the install command
+    printf "Install safe-chain by using "
+    set_color cyan
+    printf "npm install -g @aikidosec/safe-chain"
+    set_color normal
+    printf ".\n"
+end
+
+function wrapSafeChainCommand
+    set original_cmd $argv[1]
+    set aikido_cmd $argv[2]
+    set cmd_args $argv[3..-1]
+    
+    if type -q $aikido_cmd
+        # If the aikido command is available, just run it with the provided arguments
+        $aikido_cmd $cmd_args
+    else
+        # If the aikido command is not available, print a warning and run the original command
+        printSafeChainWarning $original_cmd
+        command $original_cmd $cmd_args
+    end
+end
+
+function npx
+    wrapSafeChainCommand "npx" "aikido-npx" $argv
+end
+
+function yarn
+    wrapSafeChainCommand "yarn" "aikido-yarn" $argv
+end
+
+function pnpm
+    wrapSafeChainCommand "pnpm" "aikido-pnpm" $argv
+end
+
+function pnpx
+    wrapSafeChainCommand "pnpx" "aikido-pnpx" $argv
+end
+
+function npm
+    if test (count $argv) -eq 1 -a \( "$argv[1]" = "-v" -o "$argv[1]" = "--version" \)
+        # If args is just -v or --version and nothing else, just run the npm version command
+        # This is because nvm uses this to check the version of npm
+        command npm $argv
+        return
+    end
+
+    wrapSafeChainCommand "npm" "aikido-npm" $argv
+end

packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh

@@ -0,0 +1,54 @@
+
+function printSafeChainWarning() {
+  # \033[43;30m is used to set the background color to yellow and text color to black
+  # \033[0m is used to reset the text formatting
+  printf "\033[43;30mWarning:\033[0m safe-chain is not available to protect you from installing malware. %s will run without it.\n" "$1"
+  # \033[36m is used to set the text color to cyan
+  printf "Install safe-chain by using \033[36mnpm install -g @aikidosec/safe-chain\033[0m.\n"
+}
+
+function wrapSafeChainCommand() {
+  local original_cmd="$1"
+  local aikido_cmd="$2"
+
+  # Remove the first 2 arguments (original_cmd and aikido_cmd) from $@
+  # so that "$@" now contains only the arguments passed to the original command
+  shift 2
+
+  if command -v "$aikido_cmd" > /dev/null 2>&1; then
+    # If the aikido command is available, just run it with the provided arguments
+    "$aikido_cmd" "$@"
+  else
+    # If the aikido command is not available, print a warning and run the original command
+    printSafeChainWarning "$original_cmd"
+
+    command "$original_cmd" "$@"
+  fi
+}
+
+function npx() {
+  wrapSafeChainCommand "npx" "aikido-npx" "$@"
+}
+
+function yarn() {
+  wrapSafeChainCommand "yarn" "aikido-yarn" "$@"
+}
+
+function pnpm() {
+  wrapSafeChainCommand "pnpm" "aikido-pnpm" "$@"
+}
+
+function pnpx() {
+  wrapSafeChainCommand "pnpx" "aikido-pnpx" "$@"
+}
+
+function npm() {
+  if [[ "$1" == "-v" || "$1" == "--version" ]] && [[ $# -eq 1 ]]; then
+    # If args is just -v or --version and nothing else, just run the npm version command
+    # This is because nvm uses this to check the version of npm
+    command npm "$@"
+    return
+  fi
+
+  wrapSafeChainCommand "npm" "aikido-npm" "$@"
+}

packages/safe-chain/src/shell-integration/startup-scripts/init-pwsh.ps1

@@ -0,0 +1,80 @@
+function Write-SafeChainWarning {
+    param([string]$Command)
+    
+    # PowerShell equivalent of ANSI color codes: yellow background, black text for "Warning:"
+    Write-Host "Warning:" -BackgroundColor Yellow -ForegroundColor Black -NoNewline
+    Write-Host " safe-chain is not available to protect you from installing malware. $Command will run without it."
+    
+    # Cyan text for the install command
+    Write-Host "Install safe-chain by using " -NoNewline
+    Write-Host "npm install -g @aikidosec/safe-chain" -ForegroundColor Cyan -NoNewline
+    Write-Host "."
+}
+
+function Test-CommandAvailable {
+    param([string]$Command)
+    
+    try {
+        Get-Command $Command -ErrorAction Stop | Out-Null
+        return $true
+    }
+    catch {
+        return $false
+    }
+}
+
+function Invoke-RealCommand {
+    param(
+        [string]$Command,
+        [string[]]$Arguments
+    )
+    
+    # Find the real executable to avoid calling our wrapped functions
+    $realCommand = Get-Command -Name $Command -CommandType Application | Select-Object -First 1
+    if ($realCommand) {
+        & $realCommand.Source @Arguments
+    }
+}
+
+function Invoke-WrappedCommand {
+    param(
+        [string]$OriginalCmd,
+        [string]$AikidoCmd,
+        [string[]]$Arguments
+    )
+
+    if (Test-CommandAvailable $AikidoCmd) {
+        & $AikidoCmd @Arguments
+    }
+    else {
+        Write-SafeChainWarning $OriginalCmd
+        Invoke-RealCommand $OriginalCmd $Arguments
+    }
+}
+
+function npx {
+    Invoke-WrappedCommand "npx" "aikido-npx" $args
+}
+
+function yarn {
+    Invoke-WrappedCommand "yarn" "aikido-yarn" $args
+}
+
+function pnpm {
+    Invoke-WrappedCommand "pnpm" "aikido-pnpm" $args
+}
+
+function pnpx {
+    Invoke-WrappedCommand "pnpx" "aikido-pnpx" $args
+}
+
+function npm {
+    # If args is just -v or --version and nothing else, just run the npm version command
+    # This is because nvm uses this to check the version of npm
+    if (($args.Length -eq 1) -and (($args[0] -eq "-v") -or ($args[0] -eq "--version"))) {
+        Invoke-RealCommand "npm" $args
+        return
+    }
+    
+    Invoke-WrappedCommand "npm" "aikido-npm" $args
+}

packages/safe-chain/src/shell-integration/supported-shells/bash.js

@@ -0,0 +1,62 @@
+import {
+  addLineToFile,
+  doesExecutableExistOnSystem,
+  removeLinesMatchingPattern,
+} from "../helpers.js";
+import { execSync } from "child_process";
+
+const shellName = "Bash";
+const executableName = "bash";
+const startupFileCommand = "echo ~/.bashrc";
+
+function isInstalled() {
+  return doesExecutableExistOnSystem(executableName);
+}
+
+function teardown(tools) {
+  const startupFile = getStartupFile();
+
+  for (const { tool } of tools) {
+    // Remove any existing alias for the tool
+    removeLinesMatchingPattern(startupFile, new RegExp(`^alias\\s+${tool}=`));
+  }
+
+  // Removes the line that sources the safe-chain bash initialization script (~/.aikido/scripts/init-posix.sh)
+  removeLinesMatchingPattern(
+    startupFile,
+    /^source\s+~\/\.safe-chain\/scripts\/init-posix\.sh/
+  );
+
+  return true;
+}
+
+function setup() {
+  const startupFile = getStartupFile();
+
+  addLineToFile(
+    startupFile,
+    `source ~/.safe-chain/scripts/init-posix.sh # Safe-chain bash initialization script`
+  );
+
+  return true;
+}
+
+function getStartupFile() {
+  try {
+    return execSync(startupFileCommand, {
+      encoding: "utf8",
+      shell: executableName,
+    }).trim();
+  } catch (error) {
+    throw new Error(
+      `Command failed: ${startupFileCommand}. Error: ${error.message}`
+    );
+  }
+}
+
+export default {
+  name: shellName,
+  isInstalled,
+  setup,
+  teardown,
+};

packages/safe-chain/src/shell-integration/supported-shells/bash.spec.js

@@ -0,0 +1,199 @@
+import { describe, it, beforeEach, afterEach, mock } from "node:test";
+import assert from "node:assert";
+import { tmpdir } from "node:os";
+import fs from "node:fs";
+import path from "path";
+import { knownAikidoTools } from "../helpers.js";
+
+describe("Bash shell integration", () => {
+  let mockStartupFile;
+  let bash;
+
+  beforeEach(async () => {
+    // Create temporary startup file for testing
+    mockStartupFile = path.join(tmpdir(), `test-bashrc-${Date.now()}`);
+
+    // Mock the helpers module
+    mock.module("../helpers.js", {
+      namedExports: {
+        doesExecutableExistOnSystem: () => true,
+        addLineToFile: (filePath, line) => {
+          if (!fs.existsSync(filePath)) {
+            fs.writeFileSync(filePath, "", "utf-8");
+          }
+          fs.appendFileSync(filePath, line + "\n", "utf-8");
+        },
+        removeLinesMatchingPattern: (filePath, pattern) => {
+          if (!fs.existsSync(filePath)) return;
+          const content = fs.readFileSync(filePath, "utf-8");
+          const lines = content.split("\n");
+          const filteredLines = lines.filter((line) => !pattern.test(line));
+          fs.writeFileSync(filePath, filteredLines.join("\n"), "utf-8");
+        },
+      },
+    });
+
+    // Mock child_process execSync
+    mock.module("child_process", {
+      namedExports: {
+        execSync: () => mockStartupFile,
+      },
+    });
+
+    // Import bash module after mocking
+    bash = (await import("./bash.js")).default;
+  });
+
+  afterEach(() => {
+    // Clean up test files
+    if (fs.existsSync(mockStartupFile)) {
+      fs.unlinkSync(mockStartupFile);
+    }
+
+    // Reset mocks
+    mock.reset();
+  });
+
+  describe("isInstalled", () => {
+    it("should return true when bash is installed", () => {
+      assert.strictEqual(bash.isInstalled(), true);
+    });
+
+    it("should call doesExecutableExistOnSystem with correct parameter", () => {
+      // Test that the method calls the helper with the right executable name
+      assert.strictEqual(bash.isInstalled(), true);
+    });
+  });
+
+  describe("setup", () => {
+    it("should add source line for bash initialization script", () => {
+      const result = bash.setup();
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        content.includes(
+          "source ~/.safe-chain/scripts/init-posix.sh # Safe-chain bash initialization script"
+        )
+      );
+    });
+  });
+
+  describe("teardown", () => {
+    it("should remove npm, npx, and yarn aliases", () => {
+      const initialContent = [
+        "#!/bin/bash",
+        "alias npm='aikido-npm'",
+        "alias npx='aikido-npx'",
+        "alias yarn='aikido-yarn'",
+        "alias ls='ls --color=auto'",
+        "alias grep='grep --color=auto'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = bash.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("alias npm="));
+      assert.ok(!content.includes("alias npx="));
+      assert.ok(!content.includes("alias yarn="));
+      assert.ok(content.includes("alias ls="));
+      assert.ok(content.includes("alias grep="));
+    });
+
+    it("should handle file that doesn't exist", () => {
+      if (fs.existsSync(mockStartupFile)) {
+        fs.unlinkSync(mockStartupFile);
+      }
+
+      const result = bash.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+    });
+
+    it("should handle file with no relevant aliases", () => {
+      const initialContent = [
+        "#!/bin/bash",
+        "alias ls='ls --color=auto'",
+        "export PATH=$PATH:~/bin",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = bash.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("alias ls="));
+      assert.ok(content.includes("export PATH="));
+    });
+  });
+
+  describe("shell properties", () => {
+    it("should have correct name", () => {
+      assert.strictEqual(bash.name, "Bash");
+    });
+
+    it("should expose all required methods", () => {
+      assert.ok(typeof bash.isInstalled === "function");
+      assert.ok(typeof bash.setup === "function");
+      assert.ok(typeof bash.teardown === "function");
+      assert.ok(typeof bash.name === "string");
+    });
+  });
+
+  describe("integration tests", () => {
+    it("should handle complete setup and teardown cycle", () => {
+      const tools = [
+        { tool: "npm", aikidoCommand: "aikido-npm" },
+        { tool: "yarn", aikidoCommand: "aikido-yarn" },
+      ];
+
+      // Setup
+      bash.setup(tools);
+      let content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("source ~/.safe-chain/scripts/init-posix.sh"));
+
+      // Teardown
+      bash.teardown(tools);
+      content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        !content.includes("source ~/.safe-chain/scripts/init-posix.sh")
+      );
+    });
+
+    it("should handle multiple setup calls", () => {
+      const tools = [{ tool: "npm", aikidoCommand: "aikido-npm" }];
+
+      bash.setup(tools);
+      bash.teardown(tools);
+      bash.setup(tools);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      const sourceMatches = (content.match(/source.*init-posix\.sh/g) || [])
+        .length;
+      assert.strictEqual(sourceMatches, 1, "Should not duplicate source lines");
+    });
+
+    it("should handle mixed content with aliases and source lines", () => {
+      const initialContent = [
+        "#!/bin/bash",
+        "alias npm='old-npm'",
+        "source ~/.safe-chain/scripts/init-posix.sh",
+        "alias ls='ls --color=auto'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      // Teardown should remove both aliases and source line
+      bash.teardown(knownAikidoTools);
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("alias npm="));
+      assert.ok(
+        !content.includes("source ~/.safe-chain/scripts/init-posix.sh")
+      );
+      assert.ok(content.includes("alias ls="));
+    });
+  });
+});

packages/safe-chain/src/shell-integration/supported-shells/fish.js

@@ -0,0 +1,65 @@
+import {
+  addLineToFile,
+  doesExecutableExistOnSystem,
+  removeLinesMatchingPattern,
+} from "../helpers.js";
+import { execSync } from "child_process";
+
+const shellName = "Fish";
+const executableName = "fish";
+const startupFileCommand = "echo ~/.config/fish/config.fish";
+
+function isInstalled() {
+  return doesExecutableExistOnSystem(executableName);
+}
+
+function teardown(tools) {
+  const startupFile = getStartupFile();
+
+  for (const { tool } of tools) {
+    // Remove any existing alias for the tool
+    removeLinesMatchingPattern(
+      startupFile,
+      new RegExp(`^alias\\s+${tool}\\s+`)
+    );
+  }
+
+  // Removes the line that sources the safe-chain fish initialization script (~/.safe-chain/scripts/init-fish.fish)
+  removeLinesMatchingPattern(
+    startupFile,
+    /^source\s+~\/\.safe-chain\/scripts\/init-fish\.fish/
+  );
+
+  return true;
+}
+
+function setup() {
+  const startupFile = getStartupFile();
+
+  addLineToFile(
+    startupFile,
+    `source ~/.safe-chain/scripts/init-fish.fish # Safe-chain Fish initialization script`
+  );
+
+  return true;
+}
+
+function getStartupFile() {
+  try {
+    return execSync(startupFileCommand, {
+      encoding: "utf8",
+      shell: executableName,
+    }).trim();
+  } catch (error) {
+    throw new Error(
+      `Command failed: ${startupFileCommand}. Error: ${error.message}`
+    );
+  }
+}
+
+export default {
+  name: shellName,
+  isInstalled,
+  setup,
+  teardown,
+};

packages/safe-chain/src/shell-integration/supported-shells/fish.spec.js

@@ -0,0 +1,183 @@
+import { describe, it, beforeEach, afterEach, mock } from "node:test";
+import assert from "node:assert";
+import { tmpdir } from "node:os";
+import fs from "node:fs";
+import path from "path";
+import { knownAikidoTools } from "../helpers.js";
+
+describe("Fish shell integration", () => {
+  let mockStartupFile;
+  let fish;
+
+  beforeEach(async () => {
+    // Create temporary startup file for testing
+    mockStartupFile = path.join(tmpdir(), `test-fish-config-${Date.now()}`);
+
+    // Mock the helpers module
+    mock.module("../helpers.js", {
+      namedExports: {
+        doesExecutableExistOnSystem: () => true,
+        addLineToFile: (filePath, line) => {
+          if (!fs.existsSync(filePath)) {
+            fs.writeFileSync(filePath, "", "utf-8");
+          }
+          fs.appendFileSync(filePath, line + "\n", "utf-8");
+        },
+        removeLinesMatchingPattern: (filePath, pattern) => {
+          if (!fs.existsSync(filePath)) return;
+          const content = fs.readFileSync(filePath, "utf-8");
+          const lines = content.split("\n");
+          const filteredLines = lines.filter((line) => !pattern.test(line));
+          fs.writeFileSync(filePath, filteredLines.join("\n"), "utf-8");
+        },
+      },
+    });
+
+    // Mock child_process execSync
+    mock.module("child_process", {
+      namedExports: {
+        execSync: () => mockStartupFile,
+      },
+    });
+
+    // Import fish module after mocking
+    fish = (await import("./fish.js")).default;
+  });
+
+  afterEach(() => {
+    // Clean up test files
+    if (fs.existsSync(mockStartupFile)) {
+      fs.unlinkSync(mockStartupFile);
+    }
+
+    // Reset mocks
+    mock.reset();
+  });
+
+  describe("isInstalled", () => {
+    it("should return true when fish is installed", () => {
+      assert.strictEqual(fish.isInstalled(), true);
+    });
+
+    it("should call doesExecutableExistOnSystem with correct parameter", () => {
+      // Test that the method calls the helper with the right executable name
+      assert.strictEqual(fish.isInstalled(), true);
+    });
+  });
+
+  describe("setup", () => {
+    it("should add source line for safe-chain fish initialization script", () => {
+      const result = fish.setup();
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        content.includes('source ~/.safe-chain/scripts/init-fish.fish # Safe-chain Fish initialization script')
+      );
+    });
+
+    it("should not duplicate source lines on multiple calls", () => {
+      fish.setup();
+      fish.setup();
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      const sourceMatches = (content.match(/source ~\/\.safe-chain\/scripts\/init-fish\.fish/g) || []).length;
+      assert.strictEqual(sourceMatches, 2, "Should allow multiple source lines (helper doesn't dedupe)");
+    });
+  });
+
+  describe("teardown", () => {
+    it("should remove npm, npx, yarn aliases and source line", () => {
+      const initialContent = [
+        "#!/usr/bin/env fish",
+        "alias npm 'aikido-npm'",
+        "alias npx 'aikido-npx'",
+        "alias yarn 'aikido-yarn'",
+        "source ~/.safe-chain/scripts/init-fish.fish # Safe-chain Fish initialization script",
+        "alias ls 'ls --color=auto'",
+        "alias grep 'grep --color=auto'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = fish.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("alias npm "));
+      assert.ok(!content.includes("alias npx "));
+      assert.ok(!content.includes("alias yarn "));
+      assert.ok(!content.includes("source ~/.safe-chain/scripts/init-fish.fish"));
+      assert.ok(content.includes("alias ls "));
+      assert.ok(content.includes("alias grep "));
+    });
+
+    it("should handle file that doesn't exist", () => {
+      if (fs.existsSync(mockStartupFile)) {
+        fs.unlinkSync(mockStartupFile);
+      }
+
+      const result = fish.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+    });
+
+    it("should handle file with no relevant aliases or source lines", () => {
+      const initialContent = [
+        "#!/usr/bin/env fish",
+        "alias ls 'ls --color=auto'",
+        "set PATH $PATH ~/bin",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = fish.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("alias ls "));
+      assert.ok(content.includes("set PATH "));
+    });
+  });
+
+  describe("shell properties", () => {
+    it("should have correct name", () => {
+      assert.strictEqual(fish.name, "Fish");
+    });
+
+    it("should expose all required methods", () => {
+      assert.ok(typeof fish.isInstalled === "function");
+      assert.ok(typeof fish.setup === "function");
+      assert.ok(typeof fish.teardown === "function");
+      assert.ok(typeof fish.name === "string");
+    });
+  });
+
+  describe("integration tests", () => {
+    it("should handle complete setup and teardown cycle", () => {
+      const tools = [
+        { tool: "npm", aikidoCommand: "aikido-npm" },
+        { tool: "yarn", aikidoCommand: "aikido-yarn" },
+      ];
+
+      // Setup
+      fish.setup();
+      let content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes('source ~/.safe-chain/scripts/init-fish.fish'));
+
+      // Teardown
+      fish.teardown(tools);
+      content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("source ~/.safe-chain/scripts/init-fish.fish"));
+    });
+
+    it("should handle multiple setup calls", () => {
+      fish.setup();
+      fish.teardown(knownAikidoTools);
+      fish.setup();
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      const sourceMatches = (content.match(/source ~\/\.safe-chain\/scripts\/init-fish\.fish/g) || []).length;
+      assert.strictEqual(sourceMatches, 1, "Should have exactly one source line after setup-teardown-setup cycle");
+    });
+  });
+});

packages/safe-chain/src/shell-integration/supported-shells/powershell.js

@@ -0,0 +1,65 @@
+import {
+  addLineToFile,
+  doesExecutableExistOnSystem,
+  removeLinesMatchingPattern,
+} from "../helpers.js";
+import { execSync } from "child_process";
+
+const shellName = "PowerShell Core";
+const executableName = "pwsh";
+const startupFileCommand = "echo $PROFILE";
+
+function isInstalled() {
+  return doesExecutableExistOnSystem(executableName);
+}
+
+function teardown(tools) {
+  const startupFile = getStartupFile();
+
+  for (const { tool } of tools) {
+    // Remove any existing alias for the tool
+    removeLinesMatchingPattern(
+      startupFile,
+      new RegExp(`^Set-Alias\\s+${tool}\\s+`)
+    );
+  }
+
+  // Remove the line that sources the safe-chain PowerShell initialization script
+  removeLinesMatchingPattern(
+    startupFile,
+    /^\.\s+["']?\$HOME[/\\].safe-chain[/\\]scripts[/\\]init-pwsh\.ps1["']?/
+  );
+
+  return true;
+}
+
+function setup() {
+  const startupFile = getStartupFile();
+
+  addLineToFile(
+    startupFile,
+    `. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1" # Safe-chain PowerShell initialization script`
+  );
+
+  return true;
+}
+
+function getStartupFile() {
+  try {
+    return execSync(startupFileCommand, {
+      encoding: "utf8",
+      shell: executableName,
+    }).trim();
+  } catch (error) {
+    throw new Error(
+      `Command failed: ${startupFileCommand}. Error: ${error.message}`
+    );
+  }
+}
+
+export default {
+  name: shellName,
+  isInstalled,
+  setup,
+  teardown,
+};

packages/safe-chain/src/shell-integration/supported-shells/powershell.spec.js

@@ -0,0 +1,200 @@
+import { describe, it, beforeEach, afterEach, mock } from "node:test";
+import assert from "node:assert";
+import { tmpdir } from "node:os";
+import fs from "node:fs";
+import path from "path";
+import { knownAikidoTools } from "../helpers.js";
+
+describe("PowerShell Core shell integration", () => {
+  let mockStartupFile;
+  let powershell;
+
+  beforeEach(async () => {
+    // Create temporary startup file for testing
+    mockStartupFile = path.join(
+      tmpdir(),
+      `test-powershell-profile-${Date.now()}.ps1`
+    );
+
+    // Mock the helpers module
+    mock.module("../helpers.js", {
+      namedExports: {
+        doesExecutableExistOnSystem: () => true,
+        addLineToFile: (filePath, line) => {
+          if (!fs.existsSync(filePath)) {
+            fs.writeFileSync(filePath, "", "utf-8");
+          }
+          fs.appendFileSync(filePath, line + "\n", "utf-8");
+        },
+        removeLinesMatchingPattern: (filePath, pattern) => {
+          if (!fs.existsSync(filePath)) return;
+          const content = fs.readFileSync(filePath, "utf-8");
+          const lines = content.split("\n");
+          const filteredLines = lines.filter((line) => !pattern.test(line));
+          fs.writeFileSync(filePath, filteredLines.join("\n"), "utf-8");
+        },
+      },
+    });
+
+    // Mock child_process execSync
+    mock.module("child_process", {
+      namedExports: {
+        execSync: () => mockStartupFile,
+      },
+    });
+
+    // Import powershell module after mocking
+    powershell = (await import("./powershell.js")).default;
+  });
+
+  afterEach(() => {
+    // Clean up test files
+    if (fs.existsSync(mockStartupFile)) {
+      fs.unlinkSync(mockStartupFile);
+    }
+
+    // Reset mocks
+    mock.reset();
+  });
+
+  describe("isInstalled", () => {
+    it("should return true when powershell is installed", () => {
+      assert.strictEqual(powershell.isInstalled(), true);
+    });
+
+    it("should call doesExecutableExistOnSystem with correct parameter", () => {
+      // Test that the method calls the helper with the right executable name
+      assert.strictEqual(powershell.isInstalled(), true);
+    });
+  });
+
+  describe("setup", () => {
+    it("should add init-pwsh.ps1 source line", () => {
+      const result = powershell.setup();
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        content.includes(
+          '. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1" # Safe-chain PowerShell initialization script'
+        )
+      );
+    });
+  });
+
+  describe("teardown", () => {
+    it("should remove init-pwsh.ps1 source line", () => {
+      const initialContent = [
+        "# PowerShell profile",
+        '. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1" # Safe-chain PowerShell initialization script',
+        "Set-Alias ls Get-ChildItem",
+        "Set-Alias grep Select-String",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = powershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        !content.includes('. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1"')
+      );
+      assert.ok(content.includes("Set-Alias ls "));
+      assert.ok(content.includes("Set-Alias grep "));
+    });
+
+    it("should remove old-style aliases from earlier versions", () => {
+      const initialContent = [
+        "# PowerShell profile",
+        "Set-Alias npm aikido-npm # Safe-chain alias for npm",
+        "Set-Alias npx aikido-npx # Safe-chain alias for npx",
+        "Set-Alias yarn aikido-yarn # Safe-chain alias for yarn",
+        "Set-Alias ls Get-ChildItem",
+        "Set-Alias grep Select-String",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = powershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("Set-Alias npm "));
+      assert.ok(!content.includes("Set-Alias npx "));
+      assert.ok(!content.includes("Set-Alias yarn "));
+      assert.ok(content.includes("Set-Alias ls "));
+      assert.ok(content.includes("Set-Alias grep "));
+    });
+
+    it("should handle file that doesn't exist", () => {
+      if (fs.existsSync(mockStartupFile)) {
+        fs.unlinkSync(mockStartupFile);
+      }
+
+      const result = powershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+    });
+
+    it("should handle file with no relevant content", () => {
+      const initialContent = [
+        "# PowerShell profile",
+        "Set-Alias ls Get-ChildItem",
+        "$env:PATH += ';C:\\Tools'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = powershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("Set-Alias ls "));
+      assert.ok(content.includes("$env:PATH "));
+    });
+  });
+
+  describe("shell properties", () => {
+    it("should have correct name", () => {
+      assert.strictEqual(powershell.name, "PowerShell Core");
+    });
+
+    it("should expose all required methods", () => {
+      assert.ok(typeof powershell.isInstalled === "function");
+      assert.ok(typeof powershell.setup === "function");
+      assert.ok(typeof powershell.teardown === "function");
+      assert.ok(typeof powershell.name === "string");
+    });
+  });
+
+  describe("integration tests", () => {
+    it("should handle complete setup and teardown cycle", () => {
+      // Setup
+      powershell.setup();
+      let content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        content.includes('. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1"')
+      );
+
+      // Teardown
+      powershell.teardown(knownAikidoTools);
+      content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        !content.includes('. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1"')
+      );
+    });
+
+    it("should handle multiple setup calls", () => {
+      powershell.setup();
+      powershell.teardown(knownAikidoTools);
+      powershell.setup();
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      const sourceMatches = (
+        content.match(/\. "\$HOME\\.safe-chain\\scripts\\init-pwsh\.ps1"/g) ||
+        []
+      ).length;
+      assert.strictEqual(sourceMatches, 1, "Should not duplicate source lines");
+    });
+  });
+});

packages/safe-chain/src/shell-integration/supported-shells/windowsPowershell.js

@@ -0,0 +1,65 @@
+import {
+  addLineToFile,
+  doesExecutableExistOnSystem,
+  removeLinesMatchingPattern,
+} from "../helpers.js";
+import { execSync } from "child_process";
+
+const shellName = "Windows PowerShell";
+const executableName = "powershell";
+const startupFileCommand = "echo $PROFILE";
+
+function isInstalled() {
+  return doesExecutableExistOnSystem(executableName);
+}
+
+function teardown(tools) {
+  const startupFile = getStartupFile();
+
+  for (const { tool } of tools) {
+    // Remove any existing alias for the tool
+    removeLinesMatchingPattern(
+      startupFile,
+      new RegExp(`^Set-Alias\\s+${tool}\\s+`)
+    );
+  }
+
+  // Remove the line that sources the safe-chain PowerShell initialization script
+  removeLinesMatchingPattern(
+    startupFile,
+    /^\.\s+["']?\$HOME[/\\].safe-chain[/\\]scripts[/\\]init-pwsh\.ps1["']?/
+  );
+
+  return true;
+}
+
+function setup() {
+  const startupFile = getStartupFile();
+
+  addLineToFile(
+    startupFile,
+    `. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1" # Safe-chain PowerShell initialization script`
+  );
+
+  return true;
+}
+
+function getStartupFile() {
+  try {
+    return execSync(startupFileCommand, {
+      encoding: "utf8",
+      shell: executableName,
+    }).trim();
+  } catch (error) {
+    throw new Error(
+      `Command failed: ${startupFileCommand}. Error: ${error.message}`
+    );
+  }
+}
+
+export default {
+  name: shellName,
+  isInstalled,
+  setup,
+  teardown,
+};

packages/safe-chain/src/shell-integration/supported-shells/windowsPowershell.spec.js

@@ -0,0 +1,200 @@
+import { describe, it, beforeEach, afterEach, mock } from "node:test";
+import assert from "node:assert";
+import { tmpdir } from "node:os";
+import fs from "node:fs";
+import path from "path";
+import { knownAikidoTools } from "../helpers.js";
+
+describe("Windows PowerShell shell integration", () => {
+  let mockStartupFile;
+  let windowsPowershell;
+
+  beforeEach(async () => {
+    // Create temporary startup file for testing
+    mockStartupFile = path.join(
+      tmpdir(),
+      `test-windows-powershell-profile-${Date.now()}.ps1`
+    );
+
+    // Mock the helpers module
+    mock.module("../helpers.js", {
+      namedExports: {
+        doesExecutableExistOnSystem: () => true,
+        addLineToFile: (filePath, line) => {
+          if (!fs.existsSync(filePath)) {
+            fs.writeFileSync(filePath, "", "utf-8");
+          }
+          fs.appendFileSync(filePath, line + "\n", "utf-8");
+        },
+        removeLinesMatchingPattern: (filePath, pattern) => {
+          if (!fs.existsSync(filePath)) return;
+          const content = fs.readFileSync(filePath, "utf-8");
+          const lines = content.split("\n");
+          const filteredLines = lines.filter((line) => !pattern.test(line));
+          fs.writeFileSync(filePath, filteredLines.join("\n"), "utf-8");
+        },
+      },
+    });
+
+    // Mock child_process execSync
+    mock.module("child_process", {
+      namedExports: {
+        execSync: () => mockStartupFile,
+      },
+    });
+
+    // Import windowsPowershell module after mocking
+    windowsPowershell = (await import("./windowsPowershell.js")).default;
+  });
+
+  afterEach(() => {
+    // Clean up test files
+    if (fs.existsSync(mockStartupFile)) {
+      fs.unlinkSync(mockStartupFile);
+    }
+
+    // Reset mocks
+    mock.reset();
+  });
+
+  describe("isInstalled", () => {
+    it("should return true when windows powershell is installed", () => {
+      assert.strictEqual(windowsPowershell.isInstalled(), true);
+    });
+
+    it("should call doesExecutableExistOnSystem with correct parameter", () => {
+      // Test that the method calls the helper with the right executable name
+      assert.strictEqual(windowsPowershell.isInstalled(), true);
+    });
+  });
+
+  describe("setup", () => {
+    it("should add init-pwsh.ps1 source line", () => {
+      const result = windowsPowershell.setup();
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        content.includes(
+          '. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1" # Safe-chain PowerShell initialization script'
+        )
+      );
+    });
+  });
+
+  describe("teardown", () => {
+    it("should remove init-pwsh.ps1 source line", () => {
+      const initialContent = [
+        "# Windows PowerShell profile",
+        '. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1" # Safe-chain PowerShell initialization script',
+        "Set-Alias ls Get-ChildItem",
+        "Set-Alias grep Select-String",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = windowsPowershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        !content.includes('. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1"')
+      );
+      assert.ok(content.includes("Set-Alias ls "));
+      assert.ok(content.includes("Set-Alias grep "));
+    });
+
+    it("should remove old-style aliases from earlier versions", () => {
+      const initialContent = [
+        "# Windows PowerShell profile",
+        "Set-Alias npm aikido-npm # Safe-chain alias for npm",
+        "Set-Alias npx aikido-npx # Safe-chain alias for npx",
+        "Set-Alias yarn aikido-yarn # Safe-chain alias for yarn",
+        "Set-Alias ls Get-ChildItem",
+        "Set-Alias grep Select-String",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = windowsPowershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("Set-Alias npm "));
+      assert.ok(!content.includes("Set-Alias npx "));
+      assert.ok(!content.includes("Set-Alias yarn "));
+      assert.ok(content.includes("Set-Alias ls "));
+      assert.ok(content.includes("Set-Alias grep "));
+    });
+
+    it("should handle file that doesn't exist", () => {
+      if (fs.existsSync(mockStartupFile)) {
+        fs.unlinkSync(mockStartupFile);
+      }
+
+      const result = windowsPowershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+    });
+
+    it("should handle file with no relevant content", () => {
+      const initialContent = [
+        "# Windows PowerShell profile",
+        "Set-Alias ls Get-ChildItem",
+        "$env:PATH += ';C:\\Tools'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = windowsPowershell.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("Set-Alias ls "));
+      assert.ok(content.includes("$env:PATH "));
+    });
+  });
+
+  describe("shell properties", () => {
+    it("should have correct name", () => {
+      assert.strictEqual(windowsPowershell.name, "Windows PowerShell");
+    });
+
+    it("should expose all required methods", () => {
+      assert.ok(typeof windowsPowershell.isInstalled === "function");
+      assert.ok(typeof windowsPowershell.setup === "function");
+      assert.ok(typeof windowsPowershell.teardown === "function");
+      assert.ok(typeof windowsPowershell.name === "string");
+    });
+  });
+
+  describe("integration tests", () => {
+    it("should handle complete setup and teardown cycle", () => {
+      // Setup
+      windowsPowershell.setup();
+      let content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        content.includes('. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1"')
+      );
+
+      // Teardown
+      windowsPowershell.teardown(knownAikidoTools);
+      content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        !content.includes('. "$HOME\\.safe-chain\\scripts\\init-pwsh.ps1"')
+      );
+    });
+
+    it("should handle multiple setup calls", () => {
+      windowsPowershell.setup();
+      windowsPowershell.teardown(knownAikidoTools);
+      windowsPowershell.setup();
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      const sourceMatches = (
+        content.match(/\. "\$HOME\\.safe-chain\\scripts\\init-pwsh\.ps1"/g) ||
+        []
+      ).length;
+      assert.strictEqual(sourceMatches, 1, "Should not duplicate source lines");
+    });
+  });
+});

packages/safe-chain/src/shell-integration/supported-shells/zsh.js

@@ -0,0 +1,62 @@
+import {
+  addLineToFile,
+  doesExecutableExistOnSystem,
+  removeLinesMatchingPattern,
+} from "../helpers.js";
+import { execSync } from "child_process";
+
+const shellName = "Zsh";
+const executableName = "zsh";
+const startupFileCommand = "echo ${ZDOTDIR:-$HOME}/.zshrc";
+
+function isInstalled() {
+  return doesExecutableExistOnSystem(executableName);
+}
+
+function teardown(tools) {
+  const startupFile = getStartupFile();
+
+  for (const { tool } of tools) {
+    // Remove any existing alias for the tool
+    removeLinesMatchingPattern(startupFile, new RegExp(`^alias\\s+${tool}=`));
+  }
+
+  // Removes the line that sources the safe-chain zsh initialization script (~/.aikido/scripts/init-posix.sh)
+  removeLinesMatchingPattern(
+    startupFile,
+    /^source\s+~\/\.safe-chain\/scripts\/init-posix\.sh/
+  );
+
+  return true;
+}
+
+function setup() {
+  const startupFile = getStartupFile();
+
+  addLineToFile(
+    startupFile,
+    `source ~/.safe-chain/scripts/init-posix.sh # Safe-chain Zsh initialization script`
+  );
+
+  return true;
+}
+
+function getStartupFile() {
+  try {
+    return execSync(startupFileCommand, {
+      encoding: "utf8",
+      shell: executableName,
+    }).trim();
+  } catch (error) {
+    throw new Error(
+      `Command failed: ${startupFileCommand}. Error: ${error.message}`
+    );
+  }
+}
+
+export default {
+  name: shellName,
+  isInstalled,
+  setup,
+  teardown,
+};

packages/safe-chain/src/shell-integration/supported-shells/zsh.spec.js

@@ -0,0 +1,226 @@
+import { describe, it, beforeEach, afterEach, mock } from "node:test";
+import assert from "node:assert";
+import { tmpdir } from "node:os";
+import fs from "node:fs";
+import path from "path";
+import { knownAikidoTools } from "../helpers.js";
+
+describe("Zsh shell integration", () => {
+  let mockStartupFile;
+  let zsh;
+
+  beforeEach(async () => {
+    // Create temporary startup file for testing
+    mockStartupFile = path.join(tmpdir(), `test-zshrc-${Date.now()}`);
+
+    // Mock the helpers module
+    mock.module("../helpers.js", {
+      namedExports: {
+        doesExecutableExistOnSystem: () => true,
+        addLineToFile: (filePath, line) => {
+          if (!fs.existsSync(filePath)) {
+            fs.writeFileSync(filePath, "", "utf-8");
+          }
+          fs.appendFileSync(filePath, line + "\n", "utf-8");
+        },
+        removeLinesMatchingPattern: (filePath, pattern) => {
+          if (!fs.existsSync(filePath)) return;
+          const content = fs.readFileSync(filePath, "utf-8");
+          const lines = content.split("\n");
+          const filteredLines = lines.filter((line) => !pattern.test(line));
+          fs.writeFileSync(filePath, filteredLines.join("\n"), "utf-8");
+        },
+      },
+    });
+
+    // Mock child_process execSync
+    mock.module("child_process", {
+      namedExports: {
+        execSync: () => mockStartupFile,
+      },
+    });
+
+    // Import zsh module after mocking
+    zsh = (await import("./zsh.js")).default;
+  });
+
+  afterEach(() => {
+    // Clean up test files
+    if (fs.existsSync(mockStartupFile)) {
+      fs.unlinkSync(mockStartupFile);
+    }
+
+    // Reset mocks
+    mock.reset();
+  });
+
+  describe("isInstalled", () => {
+    it("should return true when zsh is installed", () => {
+      assert.strictEqual(zsh.isInstalled(), true);
+    });
+
+    it("should call doesExecutableExistOnSystem with correct parameter", () => {
+      // Test that the method calls the helper with the right executable name
+      assert.strictEqual(zsh.isInstalled(), true);
+    });
+  });
+
+  describe("setup", () => {
+    it("should add source line for zsh initialization script", () => {
+      const result = zsh.setup();
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        content.includes(
+          "source ~/.safe-chain/scripts/init-posix.sh # Safe-chain Zsh initialization script"
+        )
+      );
+    });
+
+    it("should handle empty startup file", () => {
+      const result = zsh.setup();
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("source ~/.safe-chain/scripts/init-posix.sh"));
+    });
+  });
+
+  describe("teardown", () => {
+    it("should remove npm, npx, and yarn aliases", () => {
+      const initialContent = [
+        "#!/bin/zsh",
+        "alias npm='aikido-npm'",
+        "alias npx='aikido-npx'",
+        "alias yarn='aikido-yarn'",
+        "alias ls='ls --color=auto'",
+        "alias grep='grep --color=auto'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = zsh.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("alias npm="));
+      assert.ok(!content.includes("alias npx="));
+      assert.ok(!content.includes("alias yarn="));
+      assert.ok(content.includes("alias ls="));
+      assert.ok(content.includes("alias grep="));
+    });
+
+    it("should remove zsh initialization script source line", () => {
+      const initialContent = [
+        "#!/bin/zsh",
+        "source ~/.safe-chain/scripts/init-posix.sh",
+        "alias ls='ls --color=auto'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = zsh.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        !content.includes("source ~/.safe-chain/scripts/init-posix.sh")
+      );
+      assert.ok(content.includes("alias ls="));
+    });
+
+    it("should handle file that doesn't exist", () => {
+      if (fs.existsSync(mockStartupFile)) {
+        fs.unlinkSync(mockStartupFile);
+      }
+
+      const result = zsh.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+    });
+
+    it("should handle file with no relevant aliases or source lines", () => {
+      const initialContent = [
+        "#!/bin/zsh",
+        "alias ls='ls --color=auto'",
+        "export PATH=$PATH:~/bin",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      const result = zsh.teardown(knownAikidoTools);
+      assert.strictEqual(result, true);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("alias ls="));
+      assert.ok(content.includes("export PATH="));
+    });
+  });
+
+  describe("shell properties", () => {
+    it("should have correct name", () => {
+      assert.strictEqual(zsh.name, "Zsh");
+    });
+
+    it("should expose all required methods", () => {
+      assert.ok(typeof zsh.isInstalled === "function");
+      assert.ok(typeof zsh.setup === "function");
+      assert.ok(typeof zsh.teardown === "function");
+      assert.ok(typeof zsh.name === "string");
+    });
+  });
+
+  describe("integration tests", () => {
+    it("should handle complete setup and teardown cycle", () => {
+      const tools = [
+        { tool: "npm", aikidoCommand: "aikido-npm" },
+        { tool: "yarn", aikidoCommand: "aikido-yarn" },
+      ];
+
+      // Setup
+      zsh.setup();
+      let content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(content.includes("source ~/.safe-chain/scripts/init-posix.sh"));
+
+      // Teardown
+      zsh.teardown(tools);
+      content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(
+        !content.includes("source ~/.safe-chain/scripts/init-posix.sh")
+      );
+    });
+
+    it("should handle multiple setup calls", () => {
+      const tools = [{ tool: "npm", aikidoCommand: "aikido-npm" }];
+
+      zsh.setup(tools);
+      zsh.teardown(tools);
+      zsh.setup(tools);
+
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      const sourceMatches = (content.match(/source.*init-posix\.sh/g) || [])
+        .length;
+      assert.strictEqual(sourceMatches, 1, "Should not duplicate source lines");
+    });
+
+    it("should handle mixed content with aliases and source lines", () => {
+      const initialContent = [
+        "#!/bin/zsh",
+        "alias npm='old-npm'",
+        "source ~/.safe-chain/scripts/init-posix.sh",
+        "alias ls='ls --color=auto'",
+      ].join("\n");
+
+      fs.writeFileSync(mockStartupFile, initialContent, "utf-8");
+
+      // Teardown should remove both aliases and source line
+      zsh.teardown(knownAikidoTools);
+      const content = fs.readFileSync(mockStartupFile, "utf-8");
+      assert.ok(!content.includes("alias npm="));
+      assert.ok(
+        !content.includes("source ~/.safe-chain/scripts/init-posix.sh")
+      );
+      assert.ok(content.includes("alias ls="));
+    });
+  });
+});

packages/safe-chain/src/shell-integration/teardown.js

@@ -0,0 +1,61 @@
+import chalk from "chalk";
+import { ui } from "../environment/userInteraction.js";
+import { detectShells } from "./shellDetection.js";
+import { knownAikidoTools } from "./helpers.js";
+
+export async function teardown() {
+  ui.writeInformation(
+    chalk.bold("Removing shell aliases.") +
+      " This will remove safe-chain aliases for npm, npx, and yarn commands."
+  );
+  ui.emptyLine();
+
+  try {
+    const shells = detectShells();
+    if (shells.length === 0) {
+      ui.writeError("No supported shells detected. Cannot remove aliases.");
+      return;
+    }
+
+    ui.writeInformation(
+      `Detected ${shells.length} supported shell(s): ${shells
+        .map((shell) => chalk.bold(shell.name))
+        .join(", ")}.`
+    );
+
+    let updatedCount = 0;
+    for (const shell of shells) {
+      let success = false;
+      try {
+        success = shell.teardown(knownAikidoTools);
+      } catch {
+        success = false;
+      }
+
+      if (success) {
+        ui.writeInformation(
+          `${chalk.bold("- " + shell.name + ":")} ${chalk.green(
+            "Teardown successful"
+          )}`
+        );
+        updatedCount++;
+      } else {
+        ui.writeError(
+          `${chalk.bold("- " + shell.name + ":")} ${chalk.red(
+            "Teardown failed"
+          )}. Please check your ${shell.name} configuration.`
+        );
+      }
+    }
+
+    if (updatedCount > 0) {
+      ui.emptyLine();
+      ui.writeInformation(`Please restart your terminal to apply the changes.`);
+    }
+  } catch (error) {
+    ui.writeError(
+      `Failed to remove shell aliases: ${error.message}. Please check your shell configuration.`
+    );
+    return;
+  }
+}