fix(cli): address review feedback on omz generate plugin

- Turn %placeholders% into private markers when a template is read and
  strip the marker from every value, so text inserted from user input
  (e.g. -d '%name%') is never rescanned as a placeholder.
- When --enable is used for a name already in $plugins (a custom
  override of an enabled built-in), report it and reload instead of
  failing in _omz::plugin::enable.
- Make the completion note accurate whether or not a _<cmd> file was
  generated.
- Test the write-phase cleanup with a template set missing a later
  template, and test that placeholder-looking values come out literally.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/dependencies.yml

@@ -16,7 +16,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/dependencies/requirements.txt

@@ -1,6 +1,6 @@
 certifi==2026.7.22
-charset-normalizer==3.5.0
-idna==3.18
+charset-normalizer==3.5.1
+idna==3.19
 PyYAML==6.0.3
 requests==2.34.2
 semver==3.0.4

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -38,6 +38,7 @@ jobs:
                       ./lib/*.zsh \
                       ./plugins/*/*.plugin.zsh \
                       ./plugins/*/_* \
+                      ./templates/generators/*/*.zsh-template \
                       ./themes/*.zsh-theme; do
             zsh -n "$file" || return 1
           done

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

README.md

@@ -346,6 +346,10 @@ directory.
 If you have many functions that go well together, you can put them as a `XYZ.plugin.zsh` file in the
 `custom/plugins/` directory and then enable this plugin.
 
+The quickest way to start one is `omz generate plugin <name>`. It creates the plugin directory with a
+commented `<name>.plugin.zsh`, a `README.md`, and (for plugins that wrap a command-line tool) a completion
+skeleton, then tells you how to try it out.
+
 If you would like to override the functionality of a plugin distributed with Oh My Zsh, create a plugin of the
 same name in the `custom/plugins/` directory and it will be loaded instead of the one in `plugins/`.
 

lib/cli.zsh

@@ -24,6 +24,7 @@ function _omz {
   local -a cmds subcmds
   cmds=(
     'changelog:Print the changelog'
+    'generate:Run a generator, e.g. to create a custom plugin'
     'help:Usage information'
     'plugin:Manage plugins'
     'pr:Manage Oh My Zsh Pull Requests'
@@ -41,6 +42,8 @@ function _omz {
       changelog) local -a refs
         refs=("${(@f)$(builtin cd -q "$ZSH"; command git for-each-ref --format="%(refname:short):%(subject)" refs/heads refs/tags)}")
         _describe 'command' refs ;;
+      generate) subcmds=('plugin:Create a custom plugin')
+        _describe 'generator' subcmds ;;
       plugin) subcmds=(
         'disable:Disable plugin(s)'
         'enable:Enable plugin(s)'
@@ -56,6 +59,8 @@ function _omz {
     esac
   elif (( CURRENT == 4 )); then
     case "${words[2]}::${words[3]}" in
+      generate::plugin)
+        _omz::generate::plugin::complete_options ;;
       plugin::(disable|enable|load))
         local -aU valid_plugins
 
@@ -84,6 +89,8 @@ function _omz {
     esac
   elif (( CURRENT > 4 )); then
     case "${words[2]}::${words[3]}" in
+      generate::plugin)
+        _omz::generate::plugin::complete_options ;;
       plugin::(enable|disable|load))
         local -aU valid_plugins
 
@@ -169,15 +176,16 @@ Usage: omz <command> [options]
 
 Available commands:
 
-  help                Print this help message
-  changelog           Print the changelog
-  plugin <command>    Manage plugins
-  pr     <command>    Manage Oh My Zsh Pull Requests
-  reload              Reload the current zsh session
-  shop                Open the Oh My Zsh shop
-  theme  <command>    Manage themes
-  update              Update Oh My Zsh
-  version             Show the version
+  help                  Print this help message
+  changelog             Print the changelog
+  generate <generator>  Run a generator, e.g. to create a custom plugin
+  plugin <command>      Manage plugins
+  pr     <command>      Manage Oh My Zsh Pull Requests
+  reload                Reload the current zsh session
+  shop                  Open the Oh My Zsh shop
+  theme  <command>      Manage themes
+  update                Update Oh My Zsh
+  version               Show the version
 
 EOF
 }
@@ -202,6 +210,371 @@ EOF
   ZSH="$ZSH" command zsh -f "$ZSH/tools/changelog.sh" "$version" "${2:-}" "$format"
 }
 
+function _omz::generate {
+  (( $# > 0 && $+functions[$0::$1] )) || {
+    cat >&2 <<EOF
+Usage: ${(j: :)${(s.::.)0#_}} <generator> [options]
+
+Available generators:
+
+  plugin [<name>]  Create a custom plugin in \$ZSH_CUSTOM/plugins
+
+EOF
+    return 1
+  }
+
+  local command="$1"
+  shift
+
+  $0::$command "$@"
+}
+
+function _omz::generate::plugin {
+  setopt localoptions extendedglob
+
+  local -A opts
+  zparseopts -D -E -A opts -- d: -description: c: -command: -no-completion -enable y -yes h -help || return 1
+
+  if (( ${+opts[-h]} || ${+opts[--help]} )); then
+    _omz::generate::plugin::usage
+    return 0
+  fi
+
+  # zparseopts -E leaves anything it doesn't recognise in $@
+  local arg
+  for arg in "$@"; do
+    if [[ "$arg" == -* ]]; then
+      _omz::log error "unknown option '$arg'."
+      _omz::generate::plugin::usage
+      return 1
+    fi
+  done
+  if (( $# > 1 )); then
+    _omz::generate::plugin::usage
+    return 1
+  fi
+
+  # Only ask questions when there is someone there to answer them
+  local interactive=0
+  if [[ -o interactive && -t 0 ]] && (( ! ${+opts[-y]} && ! ${+opts[--yes]} )); then
+    interactive=1
+  fi
+
+  local custom="${ZSH_CUSTOM:-${ZSH:+$ZSH/custom}}"
+  if [[ -z "$custom" ]]; then
+    _omz::log error "\$ZSH is not set. Is Oh My Zsh loaded?"
+    return 1
+  fi
+
+  local templates="$ZSH/templates/generators/plugin"
+  if [[ ! -d "$templates" ]]; then
+    _omz::log error "templates not found at '${templates/#$HOME/\~}'. Try running 'omz update'."
+    return 1
+  fi
+
+  # Check we can write to $ZSH_CUSTOM/plugins, or the closest directory that exists
+  local probe="$custom/plugins"
+  while [[ ! -e "$probe" && "$probe" != "${probe:h}" ]]; do
+    probe="${probe:h}"
+  done
+  if [[ ! -w "$probe" ]]; then
+    _omz::log error "cannot write to '${probe/#$HOME/\~}'. Set \$ZSH_CUSTOM to a directory you own."
+    return 1
+  fi
+
+  ## Gather answers. Nothing is written until all of them are in.
+
+  local name="$1" attempts=0
+  if [[ -n "$name" ]]; then
+    _omz::generate::plugin::validate_name "$name" || return 1
+  elif (( interactive )); then
+    while true; do
+      _omz::generate::plugin::ask "Plugin name" || return 1
+      name="$REPLY"
+      _omz::generate::plugin::validate_name "$name" && break
+      if (( ++attempts >= 3 )); then
+        _omz::log error "giving up."
+        return 1
+      fi
+    done
+  else
+    _omz::generate::plugin::usage
+    return 1
+  fi
+
+  local dir="$custom/plugins/$name"
+  if [[ -e "$dir" ]]; then
+    _omz::log error "'$name' already exists at '${dir/#$HOME/\~}'. Remove it or pick another name."
+    return 1
+  fi
+  if [[ -d "$ZSH/plugins/$name" ]]; then
+    _omz::log warn "'$name' is also a built-in plugin. Your custom plugin will override it."
+    if (( interactive )); then
+      _omz::confirm "Continue? [y/N] "
+      if [[ "$REPLY" != [yY] ]]; then
+        _omz::log info "aborted."
+        return 1
+      fi
+    fi
+  fi
+
+  local description="${opts[-d]:-${opts[--description]:-}}"
+  if [[ -z "$description" ]]; then
+    description="$name plugin for Oh My Zsh"
+    if (( interactive )); then
+      _omz::generate::plugin::ask "Short description" "$description" || return 1
+      description="$REPLY"
+    fi
+  fi
+  # The description goes into a comment and a README line: keep it on one line
+  description="${description//[[:cntrl:]]/ }"
+
+  local cmd="${opts[-c]:-${opts[--command]:-}}"
+  if [[ -n "$cmd" ]]; then
+    _omz::generate::plugin::validate_command "$cmd" || return 1
+  elif (( interactive )); then
+    local default_cmd=""
+    (( $+commands[$name] )) && default_cmd="$name"
+    attempts=0
+    while true; do
+      if [[ -n "$default_cmd" ]]; then
+        _omz::generate::plugin::ask "Command-line tool this plugin wraps (or 'none')" "$default_cmd" || return 1
+      else
+        _omz::generate::plugin::ask "Command-line tool this plugin wraps (blank for none)" || return 1
+      fi
+      cmd="$REPLY"
+      [[ "$cmd" != (none|-) ]] || cmd=""
+      [[ -n "$cmd" ]] || break
+      _omz::generate::plugin::validate_command "$cmd" && break
+      if (( ++attempts >= 3 )); then
+        _omz::log error "giving up."
+        return 1
+      fi
+    done
+  fi
+
+  # completion: "" (none), "file" (a _<cmd> skeleton) or "cached" (the tool generates it)
+  local completion="" compgen=""
+  if [[ -n "$cmd" ]] && (( ! ${+opts[--no-completion]} )); then
+    completion=file
+    if (( interactive )); then
+      _omz::confirm "Add a completion function for $cmd? [Y/n] "
+      if [[ "$REPLY" == [nN] ]]; then
+        completion=""
+      else
+        _omz::confirm "Does $cmd generate its own zsh completion (e.g. '$cmd completion zsh')? [y/N] "
+        if [[ "$REPLY" == [yY] ]]; then
+          completion=cached
+          _omz::generate::plugin::ask "Command that prints the completion script" "$cmd completion zsh" || return 1
+          compgen="$REPLY"
+        fi
+      fi
+    fi
+  fi
+
+  local enable=${+opts[--enable]}
+  if (( interactive && ! enable )); then
+    _omz::confirm "Add $name to plugins=() in your .zshrc now? [y/N] "
+    [[ "$REPLY" != [yY] ]] || enable=1
+  fi
+
+  ## Write the files. If anything fails, remove only what we created.
+
+  local -a created
+  local block="" cache="" ok=0
+  {
+    if [[ ! -d "$custom/plugins" ]]; then
+      command mkdir -p "$custom/plugins" || return 1
+      _omz::generate::plugin::created "$custom/plugins"
+    fi
+    command mkdir "$dir" || return 1
+    _omz::generate::plugin::created "$dir"
+
+    local plugin_tpl=plugin.zsh-template readme_tpl=README.md-template
+    if [[ -z "$cmd" ]]; then
+      plugin_tpl=plugin-generic.zsh-template
+      readme_tpl=README-generic.md-template
+    elif [[ "$completion" == cached ]]; then
+      block="$(_omz::generate::plugin::template completion-cached.zsh-template)" || return 1
+      cache="$(_omz::generate::plugin::template README-cache.md-template)" || return 1
+    else
+      block="$(_omz::generate::plugin::template completion-note.zsh-template)" || return 1
+    fi
+
+    _omz::generate::plugin::render "$plugin_tpl" "$dir/$name.plugin.zsh" || return 1
+    _omz::generate::plugin::render "$readme_tpl" "$dir/README.md" || return 1
+    if [[ "$completion" == file ]]; then
+      _omz::generate::plugin::render completion.zsh-template "$dir/_$cmd" || return 1
+    fi
+    ok=1
+  } always {
+    if (( ! ok )); then
+      _omz::log error "could not generate the plugin. Cleaning up..."
+      (( ${#created} )) && command rm -f -- "${created[@]}"
+      [[ ! -d "$dir" ]] || command rmdir -- "$dir" 2>/dev/null
+    fi
+  }
+
+  print
+  _omz::log info "plugin '$name' generated."
+  print
+  print -r -- "Next steps:"
+  print
+  print -r -- "  1. Edit it:     ${EDITOR:-vim} ${dir/#$HOME/\~}/$name.plugin.zsh"
+  print -r -- "  2. Try it now:  omz plugin load $name"
+  (( enable )) || print -r -- "  3. Keep it:     omz plugin enable $name"
+  print
+  print -r -- "Docs: https://github.com/ohmyzsh/ohmyzsh/wiki/Customization#overriding-and-adding-plugins"
+
+  # Last thing we do: in an interactive shell this restarts zsh
+  if (( enable )); then
+    print
+    if (( ${plugins[(Ie)$name]} )); then
+      # Already enabled (e.g. a custom override of a built-in): just reload
+      _omz::log info "'$name' is already in your plugins list."
+      [[ ! -o interactive ]] || _omz::reload
+    else
+      _omz::plugin::enable "$name"
+    fi
+  fi
+}
+
+function _omz::generate::plugin::usage {
+  cat >&2 <<EOF
+Usage: omz generate plugin [<name>] [options]
+
+Creates a custom plugin in \$ZSH_CUSTOM/plugins/<name>. Anything not given as an
+option is asked for interactively. In a non-interactive shell (or with --yes)
+defaults are used instead.
+
+Options:
+  -d, --description <text>  One-line description for the README and file header
+  -c, --command <cmd>       Command-line tool this plugin wraps. Adds a check
+                            that it is installed and scaffolds its completion
+      --no-completion       Don't scaffold a completion function
+      --enable              Add the plugin to plugins=() in .zshrc when done
+                            (restarts your shell)
+  -y, --yes                 Never prompt; use defaults for anything not given
+  -h, --help                Show this help
+
+EOF
+}
+
+function _omz::generate::plugin::complete_options {
+  local -a opts
+  opts=(
+    '--description:One-line description for the README'
+    '--command:Command-line tool this plugin wraps'
+    '--no-completion:Skip the completion scaffold'
+    '--enable:Enable the plugin when done'
+    '--yes:Never prompt'
+  )
+  _describe -o 'options' opts
+}
+
+# The name ends up in a mkdir path and, via --enable, inside the awk script that
+# rewrites .zshrc. This is the one place it gets checked.
+function _omz::generate::plugin::validate_name {
+  setopt localoptions extendedglob
+  local name="$1"
+
+  if [[ -z "$name" ]]; then
+    _omz::log error "plugin name cannot be empty."
+  elif (( ${#name} > 64 )); then
+    _omz::log error "plugin name is too long (64 characters max)."
+  elif [[ "$name" != "${name:l}" ]]; then
+    _omz::log error "plugin names must be lowercase. Did you mean '${name:l}'?"
+  elif [[ "$name" != [a-z0-9][a-z0-9_-]# ]]; then
+    _omz::log error "invalid plugin name: use only lowercase letters, digits, '-' and '_', starting with a letter or digit."
+  else
+    return 0
+  fi
+  return 1
+}
+
+# The command name ends up in $+commands[...], _comps[...] and a filename
+function _omz::generate::plugin::validate_command {
+  setopt localoptions extendedglob
+
+  if (( ${#1} > 64 )) || [[ "$1" != [[:alnum:]_][[:alnum:]_.+-]# ]]; then
+    _omz::log error "invalid command name: use only letters, digits, '.', '_', '+' and '-'."
+    return 1
+  fi
+}
+
+# Ask a question and leave the answer in $REPLY. An empty answer takes the
+# default. Returns 1 when there is no more input (Ctrl-D).
+function _omz::generate::plugin::ask {
+  setopt localoptions extendedglob
+  local question="$1" default="$2"
+  [[ -z "$default" ]] || question+=" [$default]"
+
+  _omz::log prompt "$question: " "omz::generate::plugin"
+  if ! builtin read -r; then
+    print >&2
+    _omz::log info "aborted." "omz::generate::plugin"
+    return 1
+  fi
+
+  [[ -n "$REPLY" ]] || REPLY="$default"
+  # Answers are single-line values: flatten control characters and trim
+  REPLY="${REPLY//[[:cntrl:]]/ }"
+  REPLY="${${REPLY##[[:space:]]#}%%[[:space:]]#}"
+}
+
+# Print a template file with its %placeholders% turned into private markers,
+# or explain which one is missing
+function _omz::generate::plugin::template {
+  if [[ ! -f "$templates/$1" ]]; then
+    _omz::log error "missing template '${templates/#$HOME/\~}/$1'." "omz::generate::plugin"
+    return 1
+  fi
+
+  local content="$(<"$templates/$1")" token m=$'\x1f'
+  for token in completion cache name command description compgen; do
+    content="${content//\%${token}\%/${m}${token}${m}}"
+  done
+  print -r -- "$content"
+}
+
+# Fill in the placeholders of a template and write it to a file. Values come
+# from the caller: $name, $cmd, $description, $compgen, $block and $cache.
+#
+# Placeholders are matched as the markers that ::template produced, and the
+# marker character is stripped from every value, so a value that happens to
+# look like a placeholder (e.g. -d '%name%') is written out literally.
+function _omz::generate::plugin::render {
+  setopt localoptions extendedglob
+  local content m=$'\x1f'
+  content="$(_omz::generate::plugin::template "$1")" || return 1
+
+  # Blocks go first: they are templates too and carry markers of their own
+  content="${content//${m}completion${m}/$block}"
+  content="${content//${m}cache${m}/$cache}"
+  content="${content//${m}name${m}/${name//$m/}}"
+  content="${content//${m}command${m}/${cmd//$m/}}"
+  content="${content//${m}description${m}/${description//$m/}}"
+  content="${content//${m}compgen${m}/${compgen//$m/}}"
+  # Drop blank lines left behind by an empty placeholder at the end
+  content="${content%%$'\n'##}"
+
+  created+=("$2")
+  print -r -- "$content" > "$2" || return 1
+  _omz::generate::plugin::created "$2"
+}
+
+function _omz::generate::plugin::created {
+  # Colour the verb with print -P, but print the path with print -r so that a
+  # '%' somewhere in the path isn't treated as a prompt escape.
+  # Keep the output plain when it is being piped.
+  if [[ -t 1 ]]; then
+    print -Pn "      %F{green}create%f  "
+  else
+    print -n "      create  "
+  fi
+  print -r -- "${1/#$HOME/\~}"
+}
+
 function _omz::plugin {
   (( $# > 0 && $+functions[$0::$1] )) || {
     cat >&2 <<EOF
@@ -519,7 +892,7 @@ function _omz::plugin::load {
     # Check if it has completion to reload compinit
     local -a comp_files
     comp_files=($base/_*(N))
-    has_completion=$(( $#comp_files > 0 ))
+    (( has_completion )) || has_completion=$(( $#comp_files > 0 ))
 
     # Load the plugin
     if [[ -f "$base/$plugin.plugin.zsh" ]]; then

lib/diagnostics.zsh

@@ -271,7 +271,7 @@ function _omz_diag_dump_check_core_commands() {
     unfunction unhash unlimit unset unsetopt vared wait whence where which zcompile
     zle zmodload zparseopts zregexparse zstyle )
   if is-at-least 5.1; then
-    reserved_word+=( declare export integer float local readonly typeset )
+    reserved_words+=( declare export integer float local readonly typeset )
   else
     builtins+=( declare export integer float local readonly typeset )
   fi

lib/git.zsh

@@ -39,16 +39,27 @@ function _omz_git_prompt_info() {
   echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref//\%/%%}${upstream//\%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
 }
 
-function _omz_git_prompt_status() {
-  # OHMYZSH-13330: avoid "regex matching error: illegal byte sequence".
-  # zsh's "=~" operator delegates to the C library regex, which aborts with
-  # REG_ILLSEQ when the subject contains an invalid byte sequence under a
-  # multibyte locale (e.g. a filename with non-UTF-8 bytes in `git status`
-  # output). Forcing the C locale makes every byte a valid character, so the
-  # regex matching below never fails that way. `git status --porcelain` is
-  # locale-independent, so this does not change the parsed output.
+# Match an extended regular expression against a subject, forcing the C locale
+# only for the duration of the call.
+#
+# OHMYZSH-13330: zsh's "=~" operator delegates to the C library regex, which
+# aborts with REG_ILLSEQ when the subject contains an invalid byte sequence
+# under a multibyte locale (e.g. a filename with non-UTF-8 bytes in `git
+# status` output). Forcing the C locale makes every byte a valid character,
+# so the regex matching never fails that way. `git status --porcelain` is
+# locale-independent, so this does not change the parsed output.
+#
+# OHMYZSH-13985: the locale must be scoped to this function and not set for
+# the whole caller. Assigning LC_ALL makes zsh re-run setlocale() right away,
+# so leaving it set while the rest of the caller runs breaks multibyte
+# handling there — most visibly, `echo` refuses to expand Unicode escapes in
+# theme prompt symbols ("character not in range").
+function _omz_git_prompt_status_match() {
   local -x LC_ALL=C
+  [[ "$1" =~ "$2" ]]
+}
 
+function _omz_git_prompt_status() {
   [[ "$(__git_prompt_git config --get oh-my-zsh.hide-status 2>/dev/null)" = 1 ]] && return
 
   # Maps a git status prefix to an internal constant
@@ -113,11 +124,11 @@ function _omz_git_prompt_status() {
   status_lines=("${(@f)${status_text}}")
 
   # If the tracking line exists, get and parse it
-  if [[ "$status_lines[1]" =~ "^## [^ ]+ \[(.*)\]" ]]; then
+  if _omz_git_prompt_status_match "$status_lines[1]" "^## [^ ]+ \[(.*)\]"; then
     local branch_statuses
     branch_statuses=("${(@s/,/)match}")
     for branch_status in $branch_statuses; do
-      if [[ ! $branch_status =~ "(behind|diverged|ahead) ([0-9]+)?" ]]; then
+      if ! _omz_git_prompt_status_match "$branch_status" "(behind|diverged|ahead) ([0-9]+)?"; then
         continue
       fi
       local last_parsed_status=$prefix_constant_map[$match[1]]
@@ -130,7 +141,7 @@ function _omz_git_prompt_status() {
     local status_constant="${prefix_constant_map[$status_prefix]}"
     local status_regex=$'(^|\n)'"$status_prefix"
 
-    if [[ "$status_text" =~ $status_regex ]]; then
+    if _omz_git_prompt_status_match "$status_text" "$status_regex"; then
       statuses_seen[$status_constant]=1
     fi
   done

lib/tests/generate-plugin.test.zsh

@@ -0,0 +1,198 @@
+#!/usr/bin/zsh -df
+
+# Tests for `omz generate plugin`. Run with: zsh lib/tests/generate-plugin.test.zsh
+
+ZSH="${0:A:h:h:h}"
+ZSH_CUSTOM="$(mktemp -d)"
+trap 'command rm -rf "$ZSH_CUSTOM"' EXIT
+
+source "$ZSH/lib/cli.zsh"
+
+failures=0
+pass() { print -u2 "\e[32mSuccess\e[0m: $1" }
+fail() { print -u2 "\e[31mError\e[0m: $1"; (( failures++ )) }
+
+# assert_files <plugin> <expected files, space separated>
+assert_files() {
+  local actual="$(print -l "$ZSH_CUSTOM"/plugins/$1/*(N:t) "$ZSH_CUSTOM"/plugins/$1/_*(N:t) | sort -u | tr '\n' ' ')"
+  local expected="$(print -l ${=2} | sort -u | tr '\n' ' ')"
+  if [[ "$actual" == "$expected" ]]; then
+    pass "$1 has files: $expected"
+  else
+    fail "$1 has files '$actual', expected '$expected'"
+  fi
+}
+
+# assert_syntax <plugin>: every generated file must pass zsh -n, like CI does
+assert_syntax() {
+  local file
+  for file in "$ZSH_CUSTOM"/plugins/$1/*.plugin.zsh(N) "$ZSH_CUSTOM"/plugins/$1/_*(N); do
+    if zsh -n "$file"; then
+      pass "${file:t} passes zsh -n"
+    else
+      fail "${file:t} fails zsh -n"
+    fi
+  done
+}
+
+# assert_contains <file> <literal string>
+assert_contains() {
+  if grep -qF -- "$2" "$1"; then
+    pass "${1:t} contains '$2'"
+  else
+    fail "${1:t} does not contain '$2'"
+  fi
+}
+
+## Templates must be valid zsh even before substitution (CI checks this too)
+
+for file in "$ZSH"/templates/generators/plugin/*.zsh-template; do
+  if zsh -n "$file"; then
+    pass "template ${file:t} passes zsh -n"
+  else
+    fail "template ${file:t} fails zsh -n"
+  fi
+done
+
+## A plugin that wraps a command
+
+description='Shortcuts & stuff $(id) `id` 100%'
+if omz generate plugin foo -d "$description" -c foo --yes >/dev/null 2>&1; then
+  pass "generates a command-wrapping plugin"
+else
+  fail "generating a command-wrapping plugin failed"
+fi
+assert_files foo "README.md _foo foo.plugin.zsh"
+assert_syntax foo
+assert_contains "$ZSH_CUSTOM/plugins/foo/README.md" 'plugins=(... foo)'
+assert_contains "$ZSH_CUSTOM/plugins/foo/README.md" "$description"
+assert_contains "$ZSH_CUSTOM/plugins/foo/foo.plugin.zsh" "$description"
+assert_contains "$ZSH_CUSTOM/plugins/foo/foo.plugin.zsh" '$+commands[foo]'
+assert_contains "$ZSH_CUSTOM/plugins/foo/_foo" '#compdef foo'
+if grep -q '%[a-z]*%' "$ZSH_CUSTOM"/plugins/foo/*; then
+  fail "foo still has unfilled placeholders"
+else
+  pass "foo has no unfilled placeholders"
+fi
+
+## Values that look like placeholders are written literally
+
+omz generate plugin lit -d '%compgen% and %name% stay' -c lit --yes >/dev/null 2>&1
+assert_contains "$ZSH_CUSTOM/plugins/lit/README.md" '%compgen% and %name% stay'
+assert_contains "$ZSH_CUSTOM/plugins/lit/lit.plugin.zsh" '%compgen% and %name% stay'
+
+## A plugin with no command
+
+if omz generate plugin bar --yes >/dev/null 2>&1; then
+  pass "generates a generic plugin"
+else
+  fail "generating a generic plugin failed"
+fi
+assert_files bar "README.md bar.plugin.zsh"
+assert_syntax bar
+assert_contains "$ZSH_CUSTOM/plugins/bar/README.md" 'This plugin does not add any aliases.'
+assert_contains "$ZSH_CUSTOM/plugins/bar/bar.plugin.zsh" 'bar plugin for Oh My Zsh'
+
+## --no-completion, and the rails-style output
+
+output="$(omz generate plugin baz -c baz --no-completion --yes 2>/dev/null)"
+assert_files baz "README.md baz.plugin.zsh"
+create_lines=$(print -r -- "$output" | grep -c '^      create  ')
+if (( create_lines == 3 )); then
+  pass "prints one create line per path"
+else
+  fail "expected 3 create lines, got $create_lines"
+fi
+if [[ "$output" == *"omz plugin load baz"* ]]; then
+  pass "prints next steps"
+else
+  fail "next steps missing from output"
+fi
+
+## Bad names are rejected without touching the filesystem
+
+before="$(print -l "$ZSH_CUSTOM"/plugins/*(N:t))"
+for bad in '' 'Foo' 'a b' '../evil' 'a/b' '.hidden' '.' '..' '-x' 'foo`id`' 'foo"$(id)"' $'a\nb' "$(printf 'x%.0s' {1..65})"; do
+  if omz generate plugin "$bad" --yes >/dev/null 2>&1; then
+    fail "accepted bad name ${(qq)bad}"
+  else
+    pass "rejected bad name ${(qq)bad}"
+  fi
+done
+after="$(print -l "$ZSH_CUSTOM"/plugins/*(N:t))"
+if [[ "$before" == "$after" ]]; then
+  pass "bad names created nothing"
+else
+  fail "bad names changed \$ZSH_CUSTOM/plugins"
+fi
+
+## Bad command names are rejected
+
+for bad in 'a b' '../x' 'foo;id' 'foo$(id)'; do
+  if omz generate plugin qux -c "$bad" --yes >/dev/null 2>&1; then
+    fail "accepted bad command ${(qq)bad}"
+  else
+    pass "rejected bad command ${(qq)bad}"
+  fi
+done
+
+## Existing plugin, unknown option, missing templates
+
+if omz generate plugin foo --yes >/dev/null 2>&1; then
+  fail "overwrote an existing plugin"
+else
+  pass "refuses to overwrite an existing plugin"
+fi
+
+if omz generate plugin quux --bogus --yes >/dev/null 2>&1; then
+  fail "accepted an unknown option"
+else
+  pass "rejects an unknown option"
+fi
+
+if ( ZSH=/nonexistent; omz generate plugin quux --yes >/dev/null 2>&1 ); then
+  fail "ran without templates"
+else
+  pass "fails cleanly when templates are missing"
+fi
+[[ -e "$ZSH_CUSTOM/plugins/quux" ]] && fail "quux was created by a failed run"
+
+## A failure after the first file is written removes everything it created
+
+broken="$(mktemp -d)"
+mkdir -p "$broken/templates/generators/plugin" "$broken/plugins"
+cp "$ZSH/templates/generators/plugin/plugin.zsh-template" \
+   "$ZSH/templates/generators/plugin/completion-note.zsh-template" "$broken/templates/generators/plugin/"
+# README.md-template is missing, so the plugin file is written and then the README fails
+if ( ZSH="$broken"; omz generate plugin partial -c partial --yes >/dev/null 2>&1 ); then
+  fail "succeeded with a missing README template"
+else
+  pass "fails when a later template is missing"
+fi
+if [[ -e "$ZSH_CUSTOM/plugins/partial" ]]; then
+  fail "partial plugin directory was left behind: $(ls "$ZSH_CUSTOM/plugins/partial")"
+else
+  pass "cleans up the partial plugin directory"
+fi
+command rm -rf "$broken"
+
+## The prompt helper
+
+_omz::generate::plugin::ask "Q" "dflt" 2>/dev/null < <(print '')
+[[ "$REPLY" == "dflt" ]] && pass "ask: empty answer takes the default" || fail "ask: got '$REPLY', expected 'dflt'"
+
+_omz::generate::plugin::ask "Q" "dflt" 2>/dev/null < <(print '  hi there  ')
+[[ "$REPLY" == "hi there" ]] && pass "ask: trims whitespace" || fail "ask: got '$REPLY', expected 'hi there'"
+
+if _omz::generate::plugin::ask "Q" 2>/dev/null < /dev/null; then
+  fail "ask: did not fail on EOF"
+else
+  pass "ask: fails on EOF"
+fi
+
+print -u2
+if (( failures )); then
+  print -u2 "\e[31m$failures test(s) failed\e[0m"
+  exit 1
+fi
+print -u2 "\e[32mAll tests passed\e[0m"

plugins/1password/1password.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_op" ]]; then
   _comps[op]=_op
 fi
 
-op completion zsh >| "$ZSH_CACHE_DIR/completions/_op" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_op"
+  zf_mv -f -- =( op completion zsh ) "$TMPPREFIX"
+} &|
 
 # Load opswd function
 autoload -Uz opswd

plugins/arduino-cli/arduino-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_arduino-cli" ]]; then
 fi
 
 # Generate and load arduino-cli completion
-arduino-cli completion zsh >! "$ZSH_CACHE_DIR/completions/_arduino-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_arduino-cli"
+  zf_mv -f -- =( arduino-cli completion zsh ) "$TMPPREFIX"
+} &|

plugins/argocd/argocd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_argocd" ]]; then
   _comps[argocd]=_argocd
 fi
 
-argocd completion zsh >| "$ZSH_CACHE_DIR/completions/_argocd" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_argocd"
+  zf_mv -f -- =( argocd completion zsh ) "$TMPPREFIX"
+} &|

plugins/asdf/asdf.plugin.zsh

@@ -12,4 +12,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_asdf" ]]; then
   autoload -Uz _asdf
   _comps[asdf]=_asdf
 fi
-asdf completion zsh >| "$ZSH_CACHE_DIR/completions/_asdf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_asdf"
+  zf_mv -f -- =( asdf completion zsh ) "$TMPPREFIX"
+} &|

plugins/aws/aws.plugin.zsh

@@ -69,7 +69,7 @@ function asr() {
   local -a available_regions
   available_regions=($(aws_regions))
   if [[ -z "${available_regions[(r)$1]}" ]]; then
-    echo "${fg[red]}Available regions: \n$(aws_regions)"
+    echo "${fg[red]}Available regions: \n$(aws_regions)${reset_color}" >&2
     return 1
   fi
 

plugins/buf/buf.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_buf" ]]; then
 fi
 
 # Generate and load buf completion
-buf completion zsh >! "$ZSH_CACHE_DIR/completions/_buf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_buf"
+  zf_mv -f -- =( buf completion zsh ) "$TMPPREFIX"
+} &|

plugins/bun/bun.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_bun" ]]; then
   _comps[bun]=_bun
 fi
 
-SHELL=zsh bun completions >| "$ZSH_CACHE_DIR/completions/_bun" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_bun"
+  zf_mv -f -- =( SHELL=zsh bun completions ) "$TMPPREFIX"
+} &|

plugins/charm/charm.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_charm" ]]; then
   _comps[charm]=_charm
 fi
 
-charm completion zsh >| "$ZSH_CACHE_DIR/completions/_charm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_charm"
+  zf_mv -f -- =( charm completion zsh ) "$TMPPREFIX"
+} &|

plugins/chezmoi/chezmoi.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_chezmoi" ]]; then
   _comps[chezmoi]=_chezmoi
 fi
 
-chezmoi completion zsh >| "$ZSH_CACHE_DIR/completions/_chezmoi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_chezmoi"
+  zf_mv -f -- =( chezmoi completion zsh ) "$TMPPREFIX"
+} &|

plugins/codex/codex.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_codex" ]]; then
   _comps[codex]=_codex
 fi
 
-codex completion zsh < /dev/null 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_codex" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_codex"
+  zf_mv -f -- =( codex completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|

plugins/deno/deno.plugin.zsh

@@ -25,4 +25,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_deno" ]]; then
   _comps[deno]=_deno
 fi
 
-deno completions zsh >| "$ZSH_CACHE_DIR/completions/_deno" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_deno"
+  zf_mv -f -- =( deno completions zsh ) "$TMPPREFIX"
+} &|

plugins/docker-compose/README.md

@@ -2,7 +2,7 @@
 
 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
-This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+This plugin chooses automatically between the legacy `docker-compose` command and the modern
 `docker compose` subcommand, preferring `docker-compose` when both are available.
 
 To use it, add docker-compose to the plugins array of your zshrc file:
@@ -17,6 +17,7 @@ plugins=(... docker-compose)
 |-----------|----------------------------------|----------------------------------------------------------------------------------|
 | dco       | `docker-compose`                 | Docker-compose main command                                                      |
 | dcb       | `docker-compose build`           | Build containers                                                                 |
+| dcc       | `docker-compose config`                 | Parse, resolve and render compose file in canonical format |
 | dce       | `docker-compose exec`            | Execute command inside a container                                               |
 | dcps      | `docker-compose ps`              | List containers                                                                  |
 | dcrestart | `docker-compose restart`         | Restart container                                                                |

plugins/docker-compose/docker-compose.plugin.zsh

@@ -6,6 +6,7 @@
 
 alias dco="$dccmd"
 alias dcb="$dccmd build"
+alias dcc="$dccmd config"
 alias dce="$dccmd exec"
 alias dcps="$dccmd ps"
 alias dcrestart="$dccmd restart"

plugins/docker/docker.plugin.zsh

@@ -56,14 +56,19 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_docker" ]]; then
   _comps[docker]=_docker
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+
+  local plugin_dir="$1"
+
   # `docker completion` is only available from 23.0.0 on
   # docker version returns `Docker version 24.0.2, build cb74dfcd85`
   # with `s:,:` remove the comma after the version, and select third word of it
   if zstyle -t ':omz:plugins:docker' legacy-completion || \
     ! is-at-least 23.0.0 ${${(s:,:z)"$(command docker --version)"}[3]}; then
-        command cp "${0:h}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
+        command cp "${plugin_dir}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
       else
-        command docker completion zsh | tee "$ZSH_CACHE_DIR/completions/_docker" > /dev/null
+        local TMPPREFIX="$ZSH_CACHE_DIR/completions/_docker"
+        zf_mv -f -- =( command docker completion zsh ) "$TMPPREFIX"
   fi
-} &|
+} "${0:A:h}" &|

plugins/doctl/doctl.plugin.zsh

@@ -14,4 +14,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_doctl" ]]; then
   _comps[doctl]=_doctl
 fi
 
-doctl completion zsh >| "$ZSH_CACHE_DIR/completions/_doctl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_doctl"
+  zf_mv -f -- =( doctl completion zsh ) "$TMPPREFIX"
+} &|

plugins/eza/eza.plugin.zsh

@@ -52,8 +52,13 @@ function _configure_eza() {
   if [[ $_val ]]; then
     _EZA_TAIL+=("--time-style='$_val'")
   fi
-  if zstyle -t ":omz:plugins:eza" "hyperlink"; then
-    _EZA_TAIL+=("--hyperlink")
+  if zstyle -t ':omz:plugins:eza' 'hyperlink'; then
+    # eza >= 0.23 needs an explicit WHEN value
+    if command eza --hyperlink=auto --version &>/dev/null; then
+      _EZA_TAIL+=("--hyperlink=auto")
+    else
+      _EZA_TAIL+=("--hyperlink")
+    fi
   fi
 }
 

plugins/flutter/flutter.plugin.zsh

@@ -30,4 +30,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
   _comps[flutter]=_flutter
 fi
 
-flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flutter"
+  zf_mv -f -- =( flutter zsh-completion < /dev/null ) "$TMPPREFIX"
+} &|

plugins/fluxcd/fluxcd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flux" ]]; then
   _comps[flux]=_flux
 fi
 
-flux completion zsh >| "$ZSH_CACHE_DIR/completions/_flux" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flux"
+  zf_mv -f -- =( flux completion zsh ) "$TMPPREFIX"
+} &|

plugins/fnm/fnm.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_fnm" ]]; then
   _comps[fnm]=_fnm
 fi
 
-fnm completions --shell=zsh >| "$ZSH_CACHE_DIR/completions/_fnm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_fnm"
+  zf_mv -f -- =( fnm completions --shell=zsh ) "$TMPPREFIX"
+} &|
 
 if zstyle -t ':omz:plugins:fnm' autostart; then
   local -a fnm_env_cmd

plugins/gcx/README.md

@@ -0,0 +1,18 @@
+# Grafana CLI plugin
+
+This plugin adds completion for the [Grafana CLI (gcx)](https://github.com/grafana/gcx).
+
+To use it, add `gcx` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... gcx)
+```
+
+This plugin does not add any aliases.
+
+## Cache
+
+This plugin caches the completion script and automatically updates it when the
+plugin is loaded, which is usually when you start a new terminal emulator.
+
+The cache is stored at `$ZSH_CACHE_DIR/completions/_gcx`.

plugins/gcx/gcx.plugin.zsh

@@ -0,0 +1,18 @@
+# Autocompletion for the Grafana CLI (gcx).
+if (( ! $+commands[gcx] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `gcx`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_gcx" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _gcx
+  _comps[gcx]=_gcx
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gcx"
+  zf_mv -f -- =( gcx completion zsh ) "$TMPPREFIX"
+} &|

plugins/gh/gh.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_gh" ]]; then
   _comps[gh]=_gh
 fi
 
-gh completion --shell zsh >| "$ZSH_CACHE_DIR/completions/_gh" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gh"
+  zf_mv -f -- =( gh completion --shell zsh ) "$TMPPREFIX"
+} &|

plugins/git/git.plugin.zsh

@@ -137,8 +137,9 @@ function gbda() {
 # Copied and modified from James Roeder (jmaroeder) under MIT License
 # https://github.com/jmaroeder/plugin-git/blob/216723ef4f9e8dde399661c39c80bdf73f4076c4/functions/gbda.fish
 function gbds() {
-  local default_branch=$(git_main_branch)
-  (( ! $? )) || default_branch=$(git_develop_branch)
+  local default_branch
+  default_branch=$(git_main_branch) \
+    || default_branch=$(git_develop_branch)
 
   git for-each-ref refs/heads/ "--format=%(refname:short)" | \
     while read branch; do

plugins/hasura/hasura.plugin.zsh

@@ -9,5 +9,9 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hasura" ]]; then
   source "$ZSH_CACHE_DIR/completions/_hasura"
 else
   source "$ZSH_CACHE_DIR/completions/_hasura"
-  hasura completion zsh --file "$ZSH_CACHE_DIR/completions/_hasura" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hasura"
+    zf_mv -f -- =( hasura completion zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/hcloud/hcloud.plugin.zsh

@@ -13,7 +13,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hcloud" ]]; then
   _comps[hcloud]=_hcloud
 fi
 
-hcloud completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_hcloud" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hcloud"
+  zf_mv -f -- =( hcloud completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # Main alias
 alias hc='hcloud'

plugins/helm/helm.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_helm" ]]; then
   source "$ZSH_CACHE_DIR/completions/_helm"
 else
   source "$ZSH_CACHE_DIR/completions/_helm"
-  helm completion zsh | tee "$ZSH_CACHE_DIR/completions/_helm" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_helm"
+    zf_mv -f -- =( helm completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 alias h='helm'

plugins/jj/jj.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_jj" ]]; then
   _comps[jj]=_jj
 fi
 
-COMPLETE=zsh jj >| "$ZSH_CACHE_DIR/completions/_jj" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_jj"
+  zf_mv -f -- =( COMPLETE=zsh jj ) "$TMPPREFIX"
+} &|
 
 function __jj_prompt_jj() {
   local -a flags
@@ -72,4 +76,3 @@ alias jjsq='jj squash'
 alias jjst='jj status'
 alias jjwa='jj workspace add'
 alias jjwf='jj workspace forget'
-

plugins/k9s/k9s.plugin.zsh

@@ -11,4 +11,8 @@ fi
 
 # and then generate it in the background. On first completion,
 # the actual completion file will be loaded.
-k9s completion zsh >| "$ZSH_CACHE_DIR/completions/_k9s" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_k9s"
+  zf_mv -f -- =( k9s completion zsh ) "$TMPPREFIX"
+} &|

plugins/kind/kind.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kind" ]]; then
 fi
 
 # Generate and load kind completion
-kind completion zsh >! "$ZSH_CACHE_DIR/completions/_kind" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kind"
+  zf_mv -f -- =( kind completion zsh ) "$TMPPREFIX"
+} &|
 
 # Register aliases
 alias kicc="kind create cluster"

plugins/kubectl/kubectl.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kubectl" ]]; then
   _comps[kubectl]=_kubectl
 fi
 
-kubectl completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_kubectl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kubectl"
+  zf_mv -f -- =( kubectl completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # This command is used a LOT both below and in daily life
 alias k=kubectl

plugins/laravel/README.md

@@ -42,6 +42,7 @@ plugins=(... laravel)
 | `pamen` | `php artisan make:enum` |
 | `pami`  | `php artisan make:interface` |
 | `pamtr` | `php artisan make:trait` |
+| `pamv` | `php artisan make:view` |
 
 ## Clears
 

plugins/laravel/laravel.plugin.zsh

@@ -31,6 +31,7 @@ alias pamcl='php artisan make:class'
 alias pamen='php artisan make:enum'
 alias pami='php artisan make:interface'
 alias pamtr='php artisan make:trait'
+alias pamv='php artisan make:view'
 
 
 # Clears

plugins/minikube/minikube.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_minikube" ]]; then
   _comps[minikube]=_minikube
 fi
 
-minikube completion zsh >| "$ZSH_CACHE_DIR/completions/_minikube" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_minikube"
+  zf_mv -f -- =( minikube completion zsh ) "$TMPPREFIX"
+} &|

plugins/mise/mise.plugin.zsh

@@ -1,9 +1,14 @@
-if (( ! $+commands[mise] )); then
+if (( $+commands[mise] )); then
+  _mise_bin=mise
+elif [[ -x ~/.local/bin/mise ]]; then
+  _mise_bin=~/.local/bin/mise
+else
   return
 fi
 
 # Load mise hooks
-eval "$(mise activate zsh)"
+eval "$($_mise_bin activate zsh)"
+unset _mise_bin
 
 # If the completion file doesn't exist yet, we need to autoload it and
 # bind it to `mise`. Otherwise, compinit will have already done that.
@@ -14,4 +19,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_mise" ]]; then
 fi
 
 # Generate and load mise completion
-mise completion zsh >| "$ZSH_CACHE_DIR/completions/_mise" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_mise"
+  zf_mv -f -- =( mise completion zsh ) "$TMPPREFIX"
+} &|

plugins/molecule/molecule.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_molecule" ]]; then
   _comps[molecule]=_molecule
 fi
 
-_MOLECULE_COMPLETE=zsh_source molecule >| "$ZSH_CACHE_DIR/completions/_molecule" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_molecule"
+  zf_mv -f -- =( _MOLECULE_COMPLETE=zsh_source molecule ) "$TMPPREFIX"
+} &|
 
 # Alias
 # molecule: https://docs.ansible.com/projects/molecule/

plugins/mongo-atlas/mongo-atlas.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_atlas" ]]; then
   _comps[atlas]=_atlas
 fi
 
-atlas completion zsh >| "$ZSH_CACHE_DIR/completions/atlas" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_atlas"
+  zf_mv -f -- =( atlas completion zsh ) "$TMPPREFIX"
+} &|

plugins/nats/nats.plugin.zsh

@@ -7,7 +7,11 @@ if (( $+commands[nsc] )); then
     _comps[nsc]=_nsc
   fi
 
-  nsc completion zsh >| "$ZSH_CACHE_DIR/completions/_nsc" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nsc"
+    zf_mv -f -- =( nsc completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 if (( $+commands[nats] )); then
@@ -19,5 +23,9 @@ if (( $+commands[nats] )); then
     _comps[nats]=_nats
   fi
 
-  nats --completion-script-zsh >| "$ZSH_CACHE_DIR/completions/_nats" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nats"
+    zf_mv -f -- =( nats --completion-script-zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/ngrok/ngrok.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_ngrok" ]]; then
   _comps[ngrok]=_ngrok
 fi
 
-ngrok completion zsh >| "$ZSH_CACHE_DIR/completions/_ngrok" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_ngrok"
+  zf_mv -f -- =( ngrok completion zsh ) "$TMPPREFIX"
+} &|

plugins/pass-cli/pass-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pass-cli" ]]; then
   _comps[pass-cli]=_pass-cli
 fi
 
-pass-cli completions zsh >| "$ZSH_CACHE_DIR/completions/_pass-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pass-cli"
+  zf_mv -f -- =( pass-cli completions zsh ) "$TMPPREFIX"
+} &|

plugins/pipenv/pipenv.plugin.zsh

@@ -43,7 +43,11 @@ else
     _comps[pipenv]=_pipenv
   fi
 
-  _PIPENV_COMPLETE=zsh_source pipenv >| "$ZSH_CACHE_DIR/completions/_pipenv" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pipenv"
+    zf_mv -f -- =( _PIPENV_COMPLETE=zsh_source pipenv ) "$TMPPREFIX"
+  } &|
 fi
 
 if zstyle -T ':omz:plugins:pipenv' auto-shell; then
@@ -52,19 +56,26 @@ if zstyle -T ':omz:plugins:pipenv' auto-shell; then
     # deactivate shell if Pipfile doesn't exist and not in a subdir
     if [[ ! -f "$PWD/Pipfile" ]]; then
       if [[ "$PIPENV_ACTIVE" == 1 ]]; then
-        if [[ "$PWD" != "$pipfile_dir"* ]]; then
+        # Compare whole path components: `$pipfile_dir"*` also matches unrelated
+        # siblings that merely start with the same text (…/proj -> …/proj-docs),
+        # which would keep the virtualenv active outside the project.
+        local project_dir="${pipfile_dir%/}"
+        if [[ "$PWD" != "$project_dir" && "$PWD" != "$project_dir"/* ]]; then
           unset PIPENV_ACTIVE pipfile_dir
           deactivate
         fi
       fi
     fi
 
-    # activate the shell if Pipfile exists
+    # activate the shell if Pipfile exists and its virtualenv is usable
     if [[ "$PIPENV_ACTIVE" != 1 ]]; then
       if [[ -f "$PWD/Pipfile" ]]; then
-        export pipfile_dir="$PWD"
-        source "$(pipenv --venv)/bin/activate"
-        export PIPENV_ACTIVE=1
+        local venv_path
+        if venv_path="$(pipenv --venv 2>/dev/null)" && [[ -n "$venv_path" && -f "$venv_path/bin/activate" ]]; then
+          export pipfile_dir="$PWD"
+          source "$venv_path/bin/activate"
+          export PIPENV_ACTIVE=1
+        fi
       fi
     fi
   }

plugins/podman/podman.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_podman" ]]; then
   _comps[podman]=_podman
 fi
 
-podman completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_podman" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_podman"
+  zf_mv -f -- =( podman completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 alias pbl='podman build'
 alias pcin='podman container inspect'

plugins/poetry-env/README.md

@@ -1,7 +1,9 @@
 # Poetry Environment Plugin
 
-This plugin automatically changes poetry environment when you cd into or out of the project directory.
-Note: Script looks for pyproject.toml file to determine poetry if its a poetry environment
+This plugin automatically activates a Poetry environment when you enter a
+directory containing both `pyproject.toml` and `poetry.lock`. It keeps the
+environment active in project subdirectories, switches to nested Poetry
+projects, and deactivates it when you leave the project tree.
 
 To use it, add `poetry-env` to the plugins array in your zshrc file:
 

plugins/poetry-env/poetry-env.plugin.zsh

@@ -1,15 +1,24 @@
 _togglePoetryShell() {
   # Determine if currently in a Poetry-managed directory
   local in_poetry_dir=0
+  local in_active_poetry_dir=0
   if [[ -f "$PWD/pyproject.toml" && -f "$PWD/poetry.lock" ]]; then
     in_poetry_dir=1
   fi
 
-  # Deactivate the current environment if moving out of a Poetry directory or into a different Poetry directory
-  if [[ $poetry_active -eq 1 ]] && { [[ $in_poetry_dir -eq 0 ]] || [[ "$PWD" != "$poetry_dir"* ]]; }; then
-    export poetry_active=0
-    unset poetry_dir
-    (( $+functions[deactivate] )) && deactivate
+  # Deactivate when leaving the active project or entering a nested project
+  if [[ $poetry_active -eq 1 ]]; then
+    local project_dir="${poetry_dir%/}"
+    if [[ "$PWD" == "$project_dir" || "$PWD" == "$project_dir"/* ]]; then
+      in_active_poetry_dir=1
+    fi
+
+    if [[ $in_active_poetry_dir -eq 0 ]] ||
+      { [[ $in_poetry_dir -eq 1 ]] && [[ "$PWD" != "$poetry_dir" ]]; }; then
+      export poetry_active=0
+      unset poetry_dir
+      (( $+functions[deactivate] )) && deactivate
+    fi
   fi
 
   # Activate the environment if in a Poetry directory and no environment is currently active

plugins/poetry/poetry.plugin.zsh

@@ -39,4 +39,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_poetry" ]]; then
   _comps[poetry]=_poetry
 fi
 
-poetry completions zsh >| "$ZSH_CACHE_DIR/completions/_poetry" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_poetry"
+  zf_mv -f -- =( poetry completions zsh ) "$TMPPREFIX"
+} &|

plugins/procs/procs.plugin.zsh

@@ -10,12 +10,16 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_procs" ]]; then
   _comps[procs]=_procs
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_procs"
   autoload -Uz is-at-least
   local _version=$(procs --version)
-  if is-at-least "0.14" "${_version#procs }"; then
-    procs --gen-completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  else
-    procs --completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  fi
+  zf_mv -f -- =(
+    if is-at-least "0.14" "${_version#procs }"; then
+      procs --gen-completion-out zsh
+    else
+      procs --completion-out zsh
+    fi
+  ) "$TMPPREFIX"
 } &|

plugins/pulumi/pulumi.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pulumi" ]]; then
   _comps[pulumi]=_pulumi
 fi
 
-pulumi gen-completion zsh >| "$ZSH_CACHE_DIR/completions/_pulumi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pulumi"
+  zf_mv -f -- =( pulumi gen-completion zsh ) "$TMPPREFIX"
+} &|
 
 # Aliases
 alias pul='pulumi'

plugins/qodana/qodana.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_qodana" ]]; then
   _comps[qodana]=_qodana
 fi
 
-qodana completion zsh >| "$ZSH_CACHE_DIR/completions/_qodana" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_qodana"
+  zf_mv -f -- =( qodana completion zsh ) "$TMPPREFIX"
+} &|

plugins/rails/README.md

@@ -54,6 +54,33 @@ plugins=(... rails)
 | `rta`   | `rails test:all`                 | Runs all Rails tests, including system tests           |
 | `ru`    | `rails runner`                   | Run Ruby code in the context of Rails                  |
 
+### Multiple databases
+
+Rails applications can define more than one database (`primary`, `cache`, `cable`,
+`queue`, ...), and each one gets its own namespaced task. These commands accept an
+optional database name as the first argument:
+
+`rdc`, `rdd`, `rdm`, `rdmd`, `rdmr`, `rdms`, `rdmu`, `rdr`, `rdrs`, `rdsl`
+
+```zsh
+rdm                    # rails db:migrate
+rdm cache              # rails db:migrate:cache
+rdm VERSION=20231225   # rails db:migrate VERSION=20231225
+rdm cache STEP=2       # rails db:migrate:cache STEP=2
+rdm --trace            # rails db:migrate --trace
+```
+
+The first argument is read as a database name only when it is a bare word. Flags
+(`--trace`), variables (`STEP=2`) and other tasks (`db:seed`) are passed through to
+`rails` unchanged, so previous usage keeps working. When a database name is given,
+the resolved command is printed so it is clear which database is being used.
+
+`rdmrs` is not in the list above because Rails does not define a per-database
+`db:migrate:reset` task.
+
+Note that these are implemented as shell functions rather than aliases, so they will
+not appear in the output of `alias`.
+
 ### Foreman
 
 | Alias  | Command         | Description                               |

plugins/rails/rails.plugin.zsh

@@ -47,19 +47,9 @@ alias rc='rails console'
 alias rcs='rails console --sandbox'
 alias rd='rails destroy'
 alias rdb='rails dbconsole'
-alias rdc='rails db:create'
-alias rdd='rails db:drop'
-alias rdm='rails db:migrate'
-alias rdmd='rails db:migrate:down'
-alias rdmr='rails db:migrate:redo'
 alias rdmrs='rails db:migrate:reset'
-alias rdms='rails db:migrate:status'
 alias rdmtc='rails db:migrate db:test:clone'
-alias rdmu='rails db:migrate:up'
-alias rdr='rails db:rollback'
-alias rdrs='rails db:reset'
 alias rds='rails db:seed'
-alias rdsl='rails db:schema:load'
 alias rdtc='rails db:test:clone'
 alias rdtp='rails db:test:prepare'
 alias rgen='rails generate'
@@ -106,6 +96,47 @@ alias rkn='rake notes'
 alias rksts='rake stats'
 alias rkt='rake test'
 
+# Database tasks
+#
+# Rails applications can define more than one database (primary, cache, cable,
+# queue, ...). Each one gets its own namespaced task, e.g. `db:migrate:cache`.
+# The functions below take an optional database name as the first argument:
+#
+#   rdm                    ->  rails db:migrate
+#   rdm cache              ->  rails db:migrate:cache
+#   rdm VERSION=20231225   ->  rails db:migrate VERSION=20231225
+#   rdm cache STEP=2       ->  rails db:migrate:cache STEP=2
+#   rdm --trace            ->  rails db:migrate --trace
+#
+# The first argument is read as a database name only when it is a bare word.
+# Flags (--trace), variables (STEP=2) and other tasks (db:seed) are passed
+# through to rails untouched, so the previous alias behavior still works.
+function _rails_db_command() {
+  local task="$1"
+  shift
+
+  if [[ $# -gt 0 && "$1" != -* && "$1" != *=* && "$1" != *:* ]]; then
+    task="$task:$1"
+    shift
+    # Echo the resolved task so it is clear which database is being used
+    local -a cmd=(rails "$task" "$@")
+    print -u2 -r -- "Running: ${cmd[*]}"
+  fi
+
+  rails "$task" "$@"
+}
+
+function rdc()  { _rails_db_command db:create "$@" }
+function rdd()  { _rails_db_command db:drop "$@" }
+function rdm()  { _rails_db_command db:migrate "$@" }
+function rdmd() { _rails_db_command db:migrate:down "$@" }
+function rdmr() { _rails_db_command db:migrate:redo "$@" }
+function rdms() { _rails_db_command db:migrate:status "$@" }
+function rdmu() { _rails_db_command db:migrate:up "$@" }
+function rdr()  { _rails_db_command db:rollback "$@" }
+function rdrs() { _rails_db_command db:reset "$@" }
+function rdsl() { _rails_db_command db:schema:load "$@" }
+
 # legacy stuff
 alias sc='ruby script/console'
 alias sd='ruby script/destroy'

plugins/rbw/rbw.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rbw" ]]; then
   _comps[rbw]=_rbw
 fi
 
-rbw gen-completions zsh >| "$ZSH_CACHE_DIR/completions/_rbw" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rbw"
+  zf_mv -f -- =( rbw gen-completions zsh ) "$TMPPREFIX"
+} &|
 
 # rbwpw function copies the password of a service to the clipboard
 # and clears it after 20 seconds

plugins/rclone/rclone.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rclone" ]]; then
   _comps[rclone]=_rclone
 fi
 
-rclone completion zsh - >| "$ZSH_CACHE_DIR/completions/_rclone" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rclone"
+  zf_mv -f -- =( rclone completion zsh - ) "$TMPPREFIX"
+} &|

plugins/ruff/README.md

@@ -0,0 +1,22 @@
+# ruff plugin
+
+This plugin automatically installs [ruff](https://github.com/astral-sh/ruff)'s completions for you,
+and keeps them up to date. It also adds convenient aliases for common usage.
+
+To use it, add `ruff` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... ruff)
+```
+
+## Aliases
+
+| Alias | Command              | Description                                                  |
+| :---- | -------------------- | :----------------------------------------------------------- |
+| ruc   | `ruff check`         | Run Ruff linter on the given files or directories            |
+| rucf  | `ruff check --fix`   | Run Ruff linter and fix auto-fixable issues                  |
+| ruf   | `ruff format`        | Run the Ruff formatter on the given files or directories     |
+| rufc  | `ruff format --check`| Check if files are already formatted without making changes  |
+| rur   | `ruff rule`          | Explain a rule (or all rules)                                |
+| rul   | `ruff linter`        | List all supported upstream linters                          |
+| rucl  | `ruff clean`         | Clear any caches in the current directory and subdirectories |

plugins/ruff/ruff.plugin.zsh

@@ -0,0 +1,27 @@
+# Return immediately if ruff is not found
+if (( ! ${+commands[ruff]} )); then
+  return
+fi
+
+alias ruc='ruff check'
+alias rucf='ruff check --fix'
+alias ruf='ruff format'
+alias rufc='ruff format --check'
+alias rur='ruff rule'
+alias rul='ruff linter'
+alias rucl='ruff clean'
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_ruff" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _ruff
+  _comps[ruff]=_ruff
+fi
+
+# Overwrites the file each time as completions might change with ruff versions.
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_ruff"
+  zf_mv -f -- =( ruff generate-shell-completion zsh ) "$TMPPREFIX"
+} &|

plugins/rust/rust.plugin.zsh

@@ -19,7 +19,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rustup" ]]; then
 fi
 
 # Generate completion files in the background
-rustup completions zsh >| "$ZSH_CACHE_DIR/completions/_rustup" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rustup"
+  zf_mv -f -- =( rustup completions zsh ) "$TMPPREFIX"
+} &|
 cat >| "$ZSH_CACHE_DIR/completions/_cargo" <<'EOF'
 #compdef cargo
 source "$(rustup run ${${(z)$(rustup default)}[1]} rustc --print sysroot)"/share/zsh/site-functions/_cargo

plugins/sigstore/sigstore.plugin.zsh

@@ -12,7 +12,11 @@ function install_autocompletion {
     _comps[$1]=_$1
   fi
 
-  $1 completion zsh >| "$ZSH_CACHE_DIR/completions/_$1" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_$1"
+    zf_mv -f -- =( $1 completion zsh ) "$TMPPREFIX"
+  } "$1" &|
 }
 
 install_autocompletion cosign

plugins/skaffold/skaffold.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_skaffold" ]]; then
   _comps[skaffold]=_skaffold
 fi
 
-skaffold completion zsh >| "$ZSH_CACHE_DIR/completions/_skaffold" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_skaffold"
+  zf_mv -f -- =( skaffold completion zsh ) "$TMPPREFIX"
+} &|

plugins/ssh-agent/ssh-agent.plugin.zsh

@@ -101,10 +101,18 @@ if zstyle -t :omz:plugins:ssh-agent agent-forwarding \
    && [[ -n "$SSH_AUTH_SOCK" ]]; then
   if [[ ! -L "$SSH_AUTH_SOCK" ]]; then
     if [[ -n "$TERMUX_VERSION" ]]; then
-      ln -sf "$SSH_AUTH_SOCK" "$PREFIX"/tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link="$PREFIX"/tmp/ssh-agent-$USERNAME-screen
     else
-      ln -sf "$SSH_AUTH_SOCK" /tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link=/tmp/ssh-agent-$USERNAME-screen
     fi
+    # `ln -sf` unlinks the old symlink and then creates the new one: two
+    # syscalls, no atomic swap. Shells starting concurrently (a tmux window
+    # opening several panes at once) interleave those steps and all but one
+    # fail with "ln: ...: File exists". Stage the link under a PID-unique
+    # name and move it into place, since rename(2) is atomic.
+    command ln -sf "$SSH_AUTH_SOCK" "$_omz_ssh_agent_link.$$" \
+      && command mv -f "$_omz_ssh_agent_link.$$" "$_omz_ssh_agent_link"
+    unset _omz_ssh_agent_link
   fi
 else
   _start_agent

plugins/stripe/stripe.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_stripe" ]]; then
   _comps[stripe]=_stripe
 fi
 
-stripe completion --shell zsh --write-to-stdout >| "$ZSH_CACHE_DIR/completions/_stripe" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_stripe"
+  zf_mv -f -- =( stripe completion --shell zsh --write-to-stdout ) "$TMPPREFIX"
+} &|

plugins/sublime-merge/sublime-merge.plugin.zsh

@@ -19,6 +19,7 @@
 				ssm_run_sudo() {sudo $_sublime_merge_path "$@" >/dev/null 2>&1}
 				alias ssm=ssm_run_sudo
 				alias sm=sm_run
+				alias smerge="'$_sublime_merge_path'"
 				break
 			fi
 		done
@@ -33,6 +34,7 @@
 			if [[ -a $_sublime_merge_path ]]; then
 				subm () { "$_sublime_merge_path" "$@" }
 				alias sm=subm
+				alias smerge="'$_sublime_merge_path'"
 				break
 			fi
 		done
@@ -45,6 +47,7 @@
 			if [[ -a $_sublime_merge_path ]]; then
 				subm () { "$_sublime_merge_path" "$@" }
 				alias sm=subm
+				alias smerge="'$_sublime_merge_path'"
 				break
 			fi
 		done

plugins/systemadmin/systemadmin.plugin.zsh

@@ -138,7 +138,7 @@ function consume100() {
 
 # Website traffic statistics (G)
 function webtraffic() {
-  awk "{sum+=$10} END {print sum/1024/1024/1024}" "$(retlog)"
+  awk '{sum+=$10} END {print sum/1024/1024/1024}' "$(retlog)"
 }
 
 # Statistical connections 404

plugins/tailscale/tailscale.plugin.zsh

@@ -22,4 +22,8 @@ if (( $+aliases[tailscale] )); then
   _comps[${aliases[tailscale]:t}]=_tailscale
 fi
 
-tailscale completion zsh >| "$ZSH_CACHE_DIR/completions/_tailscale" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_tailscale"
+  zf_mv -f -- =( tailscale completion zsh ) "$TMPPREFIX"
+} &|

plugins/task/task.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_task" ]]; then
 fi
 
 # Generate and load task completion
-task --completion zsh >! "$ZSH_CACHE_DIR/completions/_task" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_task"
+  zf_mv -f -- =( task --completion zsh ) "$TMPPREFIX"
+} &|

plugins/timoni/timoni.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_timoni" ]]; then
   _comps[timoni]=_timoni
 fi
 
-timoni completion zsh >| "$ZSH_CACHE_DIR/completions/_timoni" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_timoni"
+  zf_mv -f -- =( timoni completion zsh ) "$TMPPREFIX"
+} &|

plugins/uv-env/README.md

@@ -0,0 +1,10 @@
+# uv Environment Plugin
+
+This plugin automatically activates the uv virtual environment when you cd into a project directory, and deactivates it when you cd out.
+Note: Script looks for pyproject.toml and uv.lock files to determine if it's a uv project
+
+To use it, add `uv-env` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... uv-env)
+```

plugins/uv-env/uv-env.plugin.zsh

@@ -0,0 +1,26 @@
+_toggleUvShell() {
+  local in_uv_dir=0
+  if [[ -f "$PWD/pyproject.toml" && -f "$PWD/uv.lock" ]]; then
+    in_uv_dir=1
+  fi
+
+  if [[ $uv_active -eq 1 ]] && { [[ $in_uv_dir -eq 0 ]] || [[ "$PWD" != "$uv_dir" && "$PWD" != "$uv_dir"/* ]]; }; then
+    typeset -g uv_active=0
+    unset uv_dir
+    (( $+functions[deactivate] )) && deactivate
+  fi
+
+  if [[ $in_uv_dir -eq 1 ]] && [[ $uv_active -ne 1 ]]; then
+    local venv_dir="${UV_PROJECT_ENVIRONMENT:-$PWD/.venv}"
+    [[ "$venv_dir" != /* ]] && venv_dir="$PWD/$venv_dir"
+
+    if [[ -f "${venv_dir}/bin/activate" ]]; then
+      typeset -g uv_active=1
+      typeset -g uv_dir="$PWD"
+      source "${venv_dir}/bin/activate"
+    fi
+  fi
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook chpwd _toggleUvShell
+_toggleUvShell

plugins/uv/uv.plugin.zsh

@@ -43,5 +43,12 @@ fi
 
 # uv and uvx are installed together (uvx is an alias to `uv tool run`)  
 # Overwrites the file each time as completions might change with uv versions.
-uv generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uv" &|
-uvx --generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uvx" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uv"
+  zf_mv -f -- =( uv generate-shell-completion zsh ) "$TMPPREFIX"
+} &|
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uvx"
+  zf_mv -f -- =( uvx --generate-shell-completion zsh ) "$TMPPREFIX"
+} &|

plugins/vagrant/_vagrant

@@ -47,6 +47,7 @@ _box_arguments=(
     'help:COMMAND List subcommands'
     'list:Lists all installed boxes'
     'outdated:Checks if a box has newer version'
+    'prune:Removes old versions of installed boxes'
     'remove:NAME Removes a box from the system'
     'repackage:NAME PROVIDER VERSION Repackages an installed box into a `.box` file'
     'update:Updates box to a newer version, if available'

plugins/volta/volta.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_volta" ]]; then
   _comps[volta]=_volta
 fi
 
-volta completions zsh >| "$ZSH_CACHE_DIR/completions/_volta" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_volta"
+  zf_mv -f -- =( volta completions zsh ) "$TMPPREFIX"
+} &|

templates/generators/plugin/README-cache.md-template

@@ -0,0 +1,7 @@
+
+## Cache
+
+This plugin caches the completion script and automatically updates it when the
+plugin is loaded, which is usually when you start a new terminal emulator.
+
+The cache is stored at `$ZSH_CACHE_DIR/completions/_%command%`.

templates/generators/plugin/README-generic.md-template

@@ -0,0 +1,11 @@
+# %name% plugin
+
+%description%
+
+To use it, add `%name%` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... %name%)
+```
+
+This plugin does not add any aliases.

templates/generators/plugin/README.md-template

@@ -0,0 +1,20 @@
+# %name% plugin
+
+%description%
+
+To use it, add `%name%` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... %name%)
+```
+
+## Aliases
+
+| Alias        | Command            | Description           |
+| :----------- | ------------------ | :-------------------- |
+| `%command%s` | `%command% status` | Show %command% status |
+
+## Requirements
+
+This plugin requires [%command%](https://example.com) to be installed.
+%cache%

templates/generators/plugin/completion-cached.zsh-template

@@ -0,0 +1,22 @@
+#
+# Completion
+#
+# %command% generates its own zsh completion, so we cache it instead of
+# maintaining a `_%command%` file by hand.
+#
+# On the first shell after installing this plugin the cache file doesn't exist
+# yet, so compinit hasn't bound it. Do that manually here.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_%command%" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _%command%
+  _comps[%command%]=_%command%
+fi
+
+# Regenerate the cache in the background so it never blocks shell startup.
+# TMPPREFIX puts the temp file next to the destination, which keeps the move
+# atomic.
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_%command%"
+  zf_mv -f -- =( %compgen% ) "$TMPPREFIX"
+} &|

templates/generators/plugin/completion-note.zsh-template

@@ -0,0 +1,6 @@
+#
+# Completion
+#
+# Oh My Zsh adds this directory to $fpath, so a file named `_%command%` next to
+# this one is picked up automatically as the completion for %command%.
+#

templates/generators/plugin/completion.zsh-template

@@ -0,0 +1,32 @@
+#compdef %command%
+#
+# Completion for %command%.
+#
+# This is a starting point. Delete what you don't need. Two references:
+#   https://zsh.sourceforge.io/Doc/Release/Completion-System.html
+#   https://github.com/zsh-users/zsh/blob/master/Etc/completion-style-guide
+
+local -a subcommands
+subcommands=(
+  'status:Show the current status'
+  'run:Run something'
+  'help:Show help for a command'
+)
+
+_arguments -C \
+  '(-h --help)'{-h,--help}'[show help]' \
+  '(-v --version)'{-v,--version}'[show the version]' \
+  '1: :->subcommand' \
+  '*:: :->args'
+
+case $state in
+  subcommand)
+    _describe -t commands '%command% subcommand' subcommands
+    ;;
+  args)
+    case $words[1] in
+      status) _arguments '--short[one-line output]' ;;
+      run)    _files ;;
+    esac
+    ;;
+esac

templates/generators/plugin/plugin-generic.zsh-template

@@ -0,0 +1,48 @@
+# %name% plugin
+#
+# %description%
+#
+# This file is sourced by Oh My Zsh in every new shell, so keep it fast.
+# Avoid running external commands at the top level unless you really need to.
+#
+# Wrapping a command-line tool? Guard everything so people who don't have it
+# installed don't end up with broken aliases:
+#
+# if (( ! $+commands[sometool] )); then
+#   return
+# fi
+
+#
+# Aliases
+#
+# Document every alias in README.md. Short, obvious, and few beats many.
+#
+
+# alias %name%='echo "hello from %name%"'
+
+#
+# Functions
+#
+# Anything that needs arguments in the middle, or more than one command,
+# belongs here rather than in an alias.
+#
+
+# function %name%_hello() {
+#   echo "hello, ${1:-world}"
+# }
+
+#
+# Completion
+#
+# Oh My Zsh adds this directory to $fpath, so a file named `_sometool` next to
+# this one is picked up automatically as the completion for `sometool`.
+#
+
+#
+# Need the path to this plugin's own directory (for data files, a lib/ dir...)?
+# This is the standard way to get it, since $0 is not reliable on its own:
+# https://zdharma-continuum.github.io/Zsh-100-Commits-Club/Zsh-Plugin-Standard.html
+#
+# 0="${ZERO:-${${0:#$ZSH_ARGZERO}:-${(%):-%N}}}"
+# 0="${${(M)0:#/*}:-$PWD/$0}"
+# source "${0:A:h}/lib/helpers.zsh"

templates/generators/plugin/plugin.zsh-template

@@ -0,0 +1,43 @@
+# %name% plugin
+#
+# %description%
+#
+# This file is sourced by Oh My Zsh in every new shell, so keep it fast.
+# Avoid running external commands at the top level unless you really need to.
+
+# Only define anything if the tool is actually installed. Without this guard,
+# people who don't have %command% get aliases that fail with "command not found".
+if (( ! $+commands[%command%] )); then
+  return
+fi
+
+#
+# Aliases
+#
+# Document every alias in README.md. Short, obvious, and few beats many.
+# The one below is just an example: replace it with something %command% can do.
+#
+
+alias %command%s='%command% status'
+
+#
+# Functions
+#
+# Anything that needs arguments in the middle, or more than one command,
+# belongs here rather than in an alias.
+#
+
+# function %name%_current() {
+#   %command% status --short "$@"
+# }
+
+%completion%
+
+#
+# Need the path to this plugin's own directory (for data files, a lib/ dir...)?
+# This is the standard way to get it, since $0 is not reliable on its own:
+# https://zdharma-continuum.github.io/Zsh-100-Commits-Club/Zsh-Plugin-Standard.html
+#
+# 0="${ZERO:-${${0:#$ZSH_ARGZERO}:-${(%):-%N}}}"
+# 0="${${(M)0:#/*}:-$PWD/$0}"
+# source "${0:A:h}/lib/helpers.zsh"

tools/changelog.sh

@@ -221,12 +221,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks

tools/check_for_upgrade.sh

@@ -28,7 +28,7 @@ zstyle -s ':omz:update' mode update_mode || {
 if [[ "$update_mode" = disabled ]] \
    || [[ ! -w "$ZSH" || ! -O "$ZSH" ]] \
    || [[ ! -t 1 && ${POWERLEVEL9K_INSTANT_PROMPT:-off} == off ]] \
-   || ! command git --version 2>&1 >/dev/null \
+   || ! command git --version >/dev/null 2>&1 \
    || (builtin cd -q "$ZSH"; ! command git rev-parse --is-inside-work-tree &>/dev/null); then
   unset update_mode
   return

tools/install.sh

@@ -49,9 +49,31 @@ USER=${USER:-$(id -u -n)}
 # $HOME is defined at the time of login, but it could be unset. If it is unset,
 # a tilde by itself (~) will not be expanded to the current user's home directory.
 # POSIX: https://pubs.opengroup.org/onlinepubs/009696899/basedefs/xbd_chap08.html#tag_08_03
-HOME="${HOME:-$(getent passwd $USER 2>/dev/null | cut -d: -f6)}"
-# macOS does not have getent, but this works even if $HOME is unset
-HOME="${HOME:-$(eval echo ~"$USER")}"
+if [ -z "$HOME" ]; then
+  HOME=$(getent passwd "$USER" 2>/dev/null | cut -d: -f6)
+
+  # macOS does not have getent; fall back to tilde expansion, but only if
+  # $USER is a safe username. The eval below would otherwise expand any shell
+  # metacharacters in $USER and allow command injection (CWE-78).
+  case "$USER" in
+    *[![:alnum:]_.-]*|'')
+      ;;
+    *)
+      resolved_home=$(eval echo ~"$USER")
+      # Unknown users are not expanded and produce a literal "~username".
+      [ "$resolved_home" = "~$USER" ] || HOME=$resolved_home
+      ;;
+  esac
+
+  case "$HOME" in
+    /*) ;;
+    *)
+      echo "Error: unable to determine the current user's home directory." >&2
+      echo "Set HOME explicitly and rerun the installer." >&2
+      exit 1
+      ;;
+  esac
+fi
 
 
 # Track if $ZSH was provided
@@ -168,12 +190,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks

tools/upgrade.sh

@@ -95,12 +95,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks