From 97dfe1ae54766f7cbf3ebb963158f4f78a84160e Mon Sep 17 00:00:00 2001
From: Robby Russell <robby@planetargon.com>
Date: Mon, 7 Sep 2026 08:25:57 -0700
Subject: [PATCH] fix(init): only accept an object ID as the resolved revision

A malformed HEAD or loose ref was copied into the zcompdump metadata as
though it had resolved, so a corrupt file could make #omz revision:
differ from git rev-parse HEAD instead of taking the fallback.

Fold the three resolution paths into one exit and check the result is a
40 or 64 character hex object ID, so symbolic refs, malformed files and
missed packed entries all fall through to git.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 oh-my-zsh.sh | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/oh-my-zsh.sh b/oh-my-zsh.sh
index 3dbeee01a..c8a185824 100644
--- a/oh-my-zsh.sh
+++ b/oh-my-zsh.sh
@@ -136,20 +136,25 @@ _omz_git_head() {
   [[ -r "$gitdir/HEAD" ]] || return 1
   read -r head 2>/dev/null < "$gitdir/HEAD" || return 1
 
-  # detached HEAD: the file holds the commit itself
-  [[ "$head" = ref:\ * ]] || { REPLY="$head"; return 0 }
-
-  ref="${head#ref: }"
-  if [[ -r "$common/$ref" ]]; then
-    read -r REPLY 2>/dev/null < "$common/$ref" || return 1
-    [[ "$REPLY" != ref:\ * ]] || return 1
-    return 0
+  if [[ "$head" = ref:\ * ]]; then
+    ref="${head#ref: }"
+    if [[ -r "$common/$ref" ]]; then
+      read -r REPLY 2>/dev/null < "$common/$ref" || return 1
+    elif [[ -r "$common/packed-refs" ]]; then
+      lines=("${(@f)$(<"$common/packed-refs")}")
+      REPLY="${lines[(r)* ${(b)ref}]%% *}"
+    else
+      return 1
+    fi
+  else
+    # detached HEAD: the file holds the commit itself
+    REPLY="$head"
   fi
 
-  [[ -r "$common/packed-refs" ]] || return 1
-  lines=("${(@f)$(<"$common/packed-refs")}")
-  REPLY="${lines[(r)* ${(b)ref}]%% *}"
-  [[ -n "$REPLY" ]]
+  # only an object ID is a usable answer: a symbolic ref, a malformed file or
+  # a missed packed entry all fall through to the git fallback instead
+  [[ -n "$REPLY" && -z "${REPLY//[0-9a-f]/}" ]] \
+    && (( ${#REPLY} == 40 || ${#REPLY} == 64 ))
 }
 
 # Construct zcompdump OMZ metadata. The helper reports through $REPLY, so