diff --git a/internal/dl/file.go b/internal/dl/file.go
index 0d9eb51..52723ce 100644
--- a/internal/dl/file.go
+++ b/internal/dl/file.go
@@ -33,7 +33,7 @@ import (
 
 	"github.com/mholt/archiver/v4"
 	"github.com/schollz/progressbar/v3"
-	"lure.sh/lure/internal/shutils"
+	"lure.sh/lure/internal/shutils/handlers"
 )
 
 // FileDownloader downloads files using HTTP
@@ -125,7 +125,7 @@ func (FileDownloader) Download(opts Options) (Type, string, error) {
 		)
 		defer bar.Close()
 	} else {
-		bar = shutils.NopRWC{}
+		bar = handlers.NopRWC{}
 	}
 
 	h, err := opts.NewHash()
diff --git a/internal/shutils/exec.go b/internal/shutils/handlers/exec.go
similarity index 99%
rename from internal/shutils/exec.go
rename to internal/shutils/handlers/exec.go
index 7b84ace..797a64b 100644
--- a/internal/shutils/exec.go
+++ b/internal/shutils/handlers/exec.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package shutils
+package handlers
 
 import (
 	"context"
diff --git a/internal/shutils/exec_test.go b/internal/shutils/handlers/exec_test.go
similarity index 99%
rename from internal/shutils/exec_test.go
rename to internal/shutils/handlers/exec_test.go
index e225f20..f8e8480 100644
--- a/internal/shutils/exec_test.go
+++ b/internal/shutils/handlers/exec_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package shutils_test
+package handlers_test
 
 import (
 	"context"
diff --git a/internal/shutils/nop.go b/internal/shutils/handlers/nop.go
similarity index 98%
rename from internal/shutils/nop.go
rename to internal/shutils/handlers/nop.go
index 08d95e0..5a32e74 100644
--- a/internal/shutils/nop.go
+++ b/internal/shutils/handlers/nop.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package shutils
+package handlers
 
 import (
 	"context"
diff --git a/internal/shutils/nop_test.go b/internal/shutils/handlers/nop_test.go
similarity index 98%
rename from internal/shutils/nop_test.go
rename to internal/shutils/handlers/nop_test.go
index 6f8529b..bb32a8b 100644
--- a/internal/shutils/nop_test.go
+++ b/internal/shutils/handlers/nop_test.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package shutils_test
+package handlers_test
 
 import (
 	"bytes"
diff --git a/internal/shutils/restricted.go b/internal/shutils/handlers/restricted.go
similarity index 99%
rename from internal/shutils/restricted.go
rename to internal/shutils/handlers/restricted.go
index d202f64..3855abf 100644
--- a/internal/shutils/restricted.go
+++ b/internal/shutils/handlers/restricted.go
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package shutils
+package handlers
 
 import (
 	"context"
diff --git a/internal/shutils/helpers/helpers.go b/internal/shutils/helpers/helpers.go
index f9897d7..e101312 100644
--- a/internal/shutils/helpers/helpers.go
+++ b/internal/shutils/helpers/helpers.go
@@ -30,8 +30,8 @@ import (
 
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing/object"
-	"lure.sh/lure/internal/shutils"
 	"golang.org/x/exp/slices"
+	"lure.sh/lure/internal/shutils/handlers"
 	"mvdan.cc/sh/v3/interp"
 )
 
@@ -41,7 +41,7 @@ var (
 )
 
 // Helpers contains all the helper commands
-var Helpers = shutils.ExecFuncs{
+var Helpers = handlers.ExecFuncs{
 	"install-binary":       installHelperCmd("/usr/bin", 0o755),
 	"install-systemd-user": installHelperCmd("/usr/lib/systemd/user", 0o644),
 	"install-systemd":      installHelperCmd("/usr/lib/systemd/system", 0o644),
@@ -57,14 +57,14 @@ var Helpers = shutils.ExecFuncs{
 
 // Restricted contains restricted read-only helper commands
 // that don't modify any state
-var Restricted = shutils.ExecFuncs{
+var Restricted = handlers.ExecFuncs{
 	"git-version": gitVersionCmd,
 }
 
-func installHelperCmd(prefix string, perms os.FileMode) shutils.ExecFunc {
+func installHelperCmd(prefix string, perms os.FileMode) handlers.ExecFunc {
 	return func(hc interp.HandlerContext, cmd string, args []string) error {
 		if len(args) < 1 {
-			return shutils.InsufficientArgsError(cmd, 1, len(args))
+			return handlers.InsufficientArgsError(cmd, 1, len(args))
 		}
 
 		from := resolvePath(hc, args[0])
@@ -85,7 +85,7 @@ func installHelperCmd(prefix string, perms os.FileMode) shutils.ExecFunc {
 
 func installManualCmd(hc interp.HandlerContext, cmd string, args []string) error {
 	if len(args) < 1 {
-		return shutils.InsufficientArgsError(cmd, 1, len(args))
+		return handlers.InsufficientArgsError(cmd, 1, len(args))
 	}
 
 	from := resolvePath(hc, args[0])
@@ -115,7 +115,7 @@ func installCompletionCmd(hc interp.HandlerContext, cmd string, args []string) e
 	}
 
 	if len(args) < 2 {
-		return shutils.InsufficientArgsError(cmd, 2, len(args))
+		return handlers.InsufficientArgsError(cmd, 2, len(args))
 	}
 
 	shell := args[0]
diff --git a/pkg/build/build.go b/pkg/build/build.go
index 058c206..0fee410 100644
--- a/pkg/build/build.go
+++ b/pkg/build/build.go
@@ -43,8 +43,8 @@ import (
 	"lure.sh/lure/internal/cpu"
 	"lure.sh/lure/internal/db"
 	"lure.sh/lure/internal/dl"
-	"lure.sh/lure/internal/shutils"
 	"lure.sh/lure/internal/shutils/decoder"
+	"lure.sh/lure/internal/shutils/handlers"
 	"lure.sh/lure/internal/shutils/helpers"
 	"lure.sh/lure/internal/types"
 	"lure.sh/lure/pkg/distro"
@@ -229,10 +229,10 @@ func executeFirstPass(ctx context.Context, info *distro.OSRelease, fl *syntax.Fi
 	runner, err := interp.New(
 		interp.Env(expand.ListEnviron(env...)),
 		interp.StdIO(os.Stdin, os.Stdout, os.Stderr),
-		interp.ExecHandler(helpers.Restricted.ExecHandler(shutils.NopExec)),
-		interp.ReadDirHandler(shutils.RestrictedReadDir(scriptDir)),
-		interp.StatHandler(shutils.RestrictedStat(scriptDir)),
-		interp.OpenHandler(shutils.RestrictedOpen(scriptDir)),
+		interp.ExecHandler(helpers.Restricted.ExecHandler(handlers.NopExec)),
+		interp.ReadDirHandler(handlers.RestrictedReadDir(scriptDir)),
+		interp.StatHandler(handlers.RestrictedStat(scriptDir)),
+		interp.OpenHandler(handlers.RestrictedOpen(scriptDir)),
 	)
 	if err != nil {
 		return nil, err
diff --git a/pkg/distro/osrelease.go b/pkg/distro/osrelease.go
index 6db3bd8..3a5f6a7 100644
--- a/pkg/distro/osrelease.go
+++ b/pkg/distro/osrelease.go
@@ -23,7 +23,7 @@ import (
 	"os"
 	"strings"
 
-	"lure.sh/lure/internal/shutils"
+	"lure.sh/lure/internal/shutils/handlers"
 	"mvdan.cc/sh/v3/expand"
 	"mvdan.cc/sh/v3/interp"
 	"mvdan.cc/sh/v3/syntax"
@@ -74,10 +74,10 @@ func ParseOSRelease(ctx context.Context) (*OSRelease, error) {
 	// as well as no environment variables in order to prevent vulnerabilities
 	// caused by changing the os-release file.
 	runner, err := interp.New(
-		interp.OpenHandler(shutils.NopOpen),
-		interp.ExecHandler(shutils.NopExec),
-		interp.ReadDirHandler(shutils.NopReadDir),
-		interp.StatHandler(shutils.NopStat),
+		interp.OpenHandler(handlers.NopOpen),
+		interp.ExecHandler(handlers.NopExec),
+		interp.ReadDirHandler(handlers.NopReadDir),
+		interp.StatHandler(handlers.NopStat),
 		interp.Env(expand.ListEnviron()),
 	)
 	if err != nil {
diff --git a/pkg/repos/pull.go b/pkg/repos/pull.go
index 8916378..84df688 100644
--- a/pkg/repos/pull.go
+++ b/pkg/repos/pull.go
@@ -37,8 +37,8 @@ import (
 	"go.elara.ws/vercmp"
 	"lure.sh/lure/internal/config"
 	"lure.sh/lure/internal/db"
-	"lure.sh/lure/internal/shutils"
 	"lure.sh/lure/internal/shutils/decoder"
+	"lure.sh/lure/internal/shutils/handlers"
 	"lure.sh/lure/internal/types"
 	"lure.sh/lure/pkg/distro"
 	"lure.sh/lure/pkg/loggerctx"
@@ -243,11 +243,11 @@ func processRepoChanges(ctx context.Context, repo types.Repo, r *git.Repository,
 		env := append(os.Environ(), "scriptdir="+filepath.Dir(filepath.Join(repoDir, action.File)))
 		runner, err := interp.New(
 			interp.Env(expand.ListEnviron(env...)),
-			interp.ExecHandler(shutils.NopExec),
-			interp.ReadDirHandler(shutils.RestrictedReadDir(repoDir)),
-			interp.StatHandler(shutils.RestrictedStat(repoDir)),
-			interp.OpenHandler(shutils.RestrictedOpen(repoDir)),
-			interp.StdIO(shutils.NopRWC{}, shutils.NopRWC{}, shutils.NopRWC{}),
+			interp.ExecHandler(handlers.NopExec),
+			interp.ReadDirHandler(handlers.RestrictedReadDir(repoDir)),
+			interp.StatHandler(handlers.RestrictedStat(repoDir)),
+			interp.OpenHandler(handlers.RestrictedOpen(repoDir)),
+			interp.StdIO(handlers.NopRWC{}, handlers.NopRWC{}, handlers.NopRWC{}),
 		)
 		if err != nil {
 			return err
@@ -349,11 +349,11 @@ func processRepoFull(ctx context.Context, repo types.Repo, repoDir string) error
 		env := append(os.Environ(), "scriptdir="+filepath.Dir(match))
 		runner, err := interp.New(
 			interp.Env(expand.ListEnviron(env...)),
-			interp.ExecHandler(shutils.NopExec),
-			interp.ReadDirHandler(shutils.RestrictedReadDir(repoDir)),
-			interp.StatHandler(shutils.RestrictedStat(repoDir)),
-			interp.OpenHandler(shutils.RestrictedOpen(repoDir)),
-			interp.StdIO(shutils.NopRWC{}, shutils.NopRWC{}, shutils.NopRWC{}),
+			interp.ExecHandler(handlers.NopExec),
+			interp.ReadDirHandler(handlers.RestrictedReadDir(repoDir)),
+			interp.StatHandler(handlers.RestrictedStat(repoDir)),
+			interp.OpenHandler(handlers.RestrictedOpen(repoDir)),
+			interp.StdIO(handlers.NopRWC{}, handlers.NopRWC{}, handlers.NopRWC{}),
 		)
 		if err != nil {
 			return err