feat(cli): add Zsh shell integration

[CoderSufiyan]

Description 📣

Fixes #292.

Add an opt-in infisical shell-init zsh command that generates an interactive Zsh hook. Once sourced with eval "$(infisical shell-init zsh)", commands beginning with npm, pnpm, bun, or node run through infisical run --. Other commands remain unchanged.

The README documents setup and the supported prefixes. No new dependencies.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

go test -vet=off ./packages/cmd
go build ./...
go run . shell-init zsh | zsh -n

The unit test verifies the generated hook is interactive-only, uses the requested command prefixes, wraps the command with infisical run --, and delegates execution back to Zsh.

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[greptile-apps]

Greptile Summary

Adds an opt-in Zsh integration that automatically routes npm, pnpm, bun, and node commands through Infisical’s secret-injecting runner.

• Introduces the shell-init zsh Cobra command and generated ZLE hook.
• Documents .zshrc setup and supported command prefixes.
• Adds a unit test for key generated-script fragments.

Confidence Score: 4/5

This PR should not merge until it prevents secrets from being automatically exposed to untrusted project scripts and preserves existing Zsh command and widget behavior.

The hook currently wraps sensitive package-install and Node execution paths with a secret-bearing environment, replaces any existing accept-line widget, and changes resolution of aliased or function-backed commands.

Files Needing Attention: packages/cmd/shell_init.go

Security Review

The broad command hook makes injected secrets available to project-controlled Node programs and package-manager lifecycle scripts, including scripts run during dependency installation. How this was verified: The hook unconditionally rewrites matching commands through infisical run, whose execution path overlays fetched secrets onto the launched process environment.

Important Files Changed

Filename	Overview
packages/cmd/shell_init.go	Adds the command and ZLE hook, but broad secret injection, replacement of existing accept-line behavior, and bypass of Zsh aliases/functions require attention.
packages/cmd/shell_init_test.go	Verifies generated-script fragments but does not exercise runtime command resolution, widget coexistence, or sensitive command categories.
README.md	Documents setup and prefixes accurately, but does not warn that installation and other project-controlled scripts receive injected secrets.

_{Reviews (1): Last reviewed commit: "feat(cli): add Zsh shell integration" | Re-trigger Greptile}

[greptile-apps]

Secrets reach dependency lifecycle scripts

When a user runs npm install, pnpm install, bun install, or a Node script in an untrusted project, this unconditional rewrite launches it through infisical run, and project-controlled code inherits the injected secrets and can exfiltrate them. How this was verified: The hook routes every matching command through the run path, which overlays fetched secrets onto the launched process environment.

Context Used: Flag SSRF risks (source)

Knowledge Base Used: infisical run Secret Injection Flow

[greptile-apps]

Existing accept-line widget is discarded

When a user already has a custom or plugin-provided accept-line widget, this registration replaces it and the wrapper delegates directly to the built-in .accept-line, causing the existing Enter-key behavior to stop running.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Zsh command resolution is bypassed

When npm, pnpm, bun, or node is defined as a Zsh alias or function, forwarding the raw token through infisical run -- launches the PATH executable directly, causing the user's wrapper, flags, and environment setup to be silently ignored.

Knowledge Base Used: infisical run Secret Injection Flow