Change package.json check from executable to readable

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

.github/workflows/dependencies.yml

@@ -16,7 +16,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/dependencies/requirements.txt

@@ -1,6 +1,6 @@
 certifi==2026.7.22
-charset-normalizer==3.5.0
-idna==3.18
+charset-normalizer==3.5.1
+idna==3.19
 PyYAML==6.0.3
 requests==2.34.2
 semver==3.0.4

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -41,49 +41,3 @@ jobs:
                       ./themes/*.zsh-theme; do
             zsh -n "$file" || return 1
           done
-
-      - name: Focused syntax check for bootstrap-adjacent touched files
-        if: github.event_name == 'pull_request'
-        run: |
-          mapfile -t touched < <(
-            git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" \
-            | grep -E '^(lib/bootstrap\.zsh|lib/tests/bootstrap.*\.zsh|oh-my-zsh\.sh|lib/(completion|compfix|functions|theme-and-appearance)\.zsh|plugins/.+/.+\.plugin\.zsh|themes/.+\.zsh-theme)$' \
-            || true
-          )
-
-          if [ "${#touched[@]}" -eq 0 ]; then
-            echo "No bootstrap-adjacent files touched"
-            exit 0
-          fi
-
-          for file in "${touched[@]}"; do
-            echo "Syntax checking $file"
-            zsh -n "$file"
-          done
-
-      - name: Run bootstrap unit test
-        if: github.event_name == 'pull_request'
-        run: zsh ./lib/tests/bootstrap.test.zsh
-
-      - name: Run inline bootstrap invariants smoke test
-        if: github.event_name == 'pull_request'
-        run: zsh ./lib/tests/bootstrap-inline-ci.test.zsh
-
-  plugin-manager-smoke:
-    name: Plugin manager smoke (${{ matrix.manager }}:${{ matrix.scenario }})
-    runs-on: ubuntu-latest
-    if: github.repository == 'ohmyzsh/ohmyzsh' && github.event_name == 'pull_request'
-    strategy:
-      fail-fast: false
-      matrix:
-        manager: [antigen, zinit]
-        scenario: [positive, negative]
-    steps:
-      - name: Set up git repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install zsh
-        run: sudo apt-get update; sudo apt-get install zsh
-
-      - name: Run plugin-manager bootstrap integration
-        run: zsh ./lib/tests/plugin-manager-bootstrap-integration.test.zsh "${{ matrix.manager }}" "${{ matrix.scenario }}"

.github/workflows/plugin-manager-nightly.yml

@@ -1,37 +0,0 @@
-name: Plugin manager integration (advisory)
-
-on:
-  schedule:
-    - cron: '0 6 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  plugin-manager-matrix:
-    name: ${{ matrix.manager }}:${{ matrix.scenario }}
-    runs-on: ubuntu-latest
-    if: github.repository == 'ohmyzsh/ohmyzsh'
-    continue-on-error: true
-    strategy:
-      fail-fast: false
-      matrix:
-        manager: [antigen, zinit, zgen, zplug, antibody, zulu]
-        scenario: [positive, negative]
-
-    steps:
-      - name: Set up git repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install zsh and go
-        run: sudo apt-get update; sudo apt-get install zsh golang
-
-      - name: Run plugin-manager bootstrap integration
-        run: zsh ./lib/tests/plugin-manager-bootstrap-integration.test.zsh "${{ matrix.manager }}" "${{ matrix.scenario }}"
-
-      - name: Rollout note
-        if: always()
-        run: |
-          echo "Phase 2 active: full manager matrix is advisory/nightly."
-          echo "Phase 3 target: promote full matrix to required after stability window."

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

CONTRIBUTING.md

@@ -23,7 +23,6 @@ you would make is not already covered.
 - [A note on AI-assisted contributions](#a-note-on-ai-assisted-contributions)
 - [Use the Search, Luke](#use-the-search-luke)
 - [Commit Guidelines](#commit-guidelines)
-  - [Plugin And Theme Bootstrap Compatibility](#plugin-and-theme-bootstrap-compatibility)
   - [Format](#format)
   - [Style](#style)
 - [Volunteer](#volunteer)
@@ -177,24 +176,6 @@ specification. The automatic changelog tool uses these to automatically generate
 a changelog based on the commit messages. Here's a guide to writing a commit message
 to allow this:
 
-### Plugin And Theme Bootstrap Compatibility
-
-Oh My Zsh now provides a shared bootstrap entrypoint at `lib/bootstrap.zsh` for plugin-manager setups that don't
-source `oh-my-zsh.sh`.
-
-When working on plugins/themes:
-
-- assume bootstrap has already run in manager-driven setups
-- rely on bootstrap guarantees (`ZSH*` defaults, cache/completions setup, required `fpath` entries)
-- avoid adding per-plugin/per-theme copies of common setup unless truly plugin-specific
-
-Common patterns we should migrate away from over time:
-
-- repeated cache setup logic (`mkdir -p "$ZSH_CACHE_DIR/completions"`)
-- repeated base `fpath` bootstrapping for OMZ core/custom directories
-
-If your plugin/theme still needs custom initialization, keep it scoped to that plugin/theme behavior only.
-
 ### Format
 
 ```

README.md

@@ -46,7 +46,6 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
     - [Manual Installation](#manual-installation)
   - [Installation Problems](#installation-problems)
   - [Custom Plugins And Themes](#custom-plugins-and-themes)
-  - [Using Plugin Managers Without `oh-my-zsh.sh`](#using-plugin-managers-without-oh-my-zshsh)
   - [Enable GNU ls In macOS And FreeBSD Systems](#enable-gnu-ls-in-macos-and-freebsd-systems)
   - [Skip Aliases](#skip-aliases)
   - [Async git prompt](#async-git-prompt)
@@ -350,120 +349,6 @@ If you have many functions that go well together, you can put them as a `XYZ.plu
 If you would like to override the functionality of a plugin distributed with Oh My Zsh, create a plugin of the
 same name in the `custom/plugins/` directory and it will be loaded instead of the one in `plugins/`.
 
-### Using Plugin Managers Without `oh-my-zsh.sh`
-
-Some plugin managers load individual OMZ plugins/themes directly and do not source `oh-my-zsh.sh`.
-For those setups, source this bootstrap entrypoint before loading any OMZ plugin or theme:
-
-```zsh
-source "$ZSH/lib/bootstrap.zsh"
-```
-
-#### Bootstrap compatibility contract
-
-`lib/bootstrap.zsh` is idempotent and is the only required pre-load step for plugin-manager setups.
-It guarantees:
-
-- `ZSH`, `ZSH_CUSTOM`, and `ZSH_CACHE_DIR` defaults
-- writable cache fallback to `${XDG_CACHE_HOME:-$HOME/.cache}/oh-my-zsh`
-- `$ZSH_CACHE_DIR/completions` directory creation
-- required OMZ `fpath` entries for plugins/themes:
-  - `$ZSH/functions`
-  - `$ZSH/completions`
-  - `$ZSH_CUSTOM/functions`
-  - `$ZSH_CUSTOM/completions`
-  - `$ZSH_CACHE_DIR/completions`
-- public signal: `OMZ_IS_BOOTSTRAPPED=true` (for one-time hook guards)
-
-What still requires `oh-my-zsh.sh`:
-
-- update checks
-- plugin auto-discovery from the `plugins=(...)` list
-- `compinit`/`compfix` orchestration and zcompdump metadata refresh
-- alias filtering via `:omz:*` zstyles during file sourcing
-- final full-init signal: `OMZ_IS_LOADED=true`
-
-#### Plugin manager hook guidance
-
-Run bootstrap once, before any OMZ plugin/theme load:
-
-```zsh
-[[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"
-```
-
-- **Antigen** (pre-bundle hook pattern):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  antigen bundle OMZ::plugins/git
-  antigen apply
-  ```
-
-- **Zinit** (`atinit` pre-load hook):
-
-  ```zsh
-  zinit ice atinit'[[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"'
-  zinit snippet OMZ::plugins/git/git.plugin.zsh
-  ```
-
-- **zgen** (pre-load hook function called before OMZ loads):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  zgen load ohmyzsh/ohmyzsh plugins/git
-  ```
-
-- **zplug** (run pre-load hook immediately before OMZ entries):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  zplug "plugins/git", from:oh-my-zsh
-  zplug load
-  ```
-
-- **antibody** (run pre-load hook before `antibody bundle`/`source` output):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  source <(antibody bundle <<'EOF'
-  ohmyzsh/ohmyzsh path:plugins/git
-  EOF
-  )
-  ```
-
-- **zulu** (run pre-load hook before OMZ module loads):
-
-  ```zsh
-  omz_preload() { [[ -n "${OMZ_IS_BOOTSTRAPPED:-}" ]] || source "$ZSH/lib/bootstrap.zsh"; }
-  omz_preload
-  zulu install oh-my-zsh
-  ```
-
-Compatibility matrix:
-
-| Load mode | `OMZ_IS_BOOTSTRAPPED` | `OMZ_IS_LOADED` | Suitable for |
-| :-- | :--: | :--: | :-- |
-| `source $ZSH/oh-my-zsh.sh` | ✅ | ✅ | Full OMZ framework features |
-| `source $ZSH/lib/bootstrap.zsh` + manager-loaded OMZ plugins/themes | ✅ | ❌ | Plugin/theme prerequisites only |
-
-#### Manager entrypoints and OMZ-side auto-injection limits
-
-Most plugin managers load OMZ by directly sourcing selected plugin/theme/lib entrypoints, not by sourcing
-`oh-my-zsh.sh`, so OMZ cannot universally inject bootstrap on its own.
-
-| Manager | Typical OMZ entrypoint(s) it loads | Can OMZ auto-inject bootstrap without user hook? |
-| :-- | :-- | :--: |
-| Antigen | `antigen bundle ...` targets after `antigen use oh-my-zsh` | ❌ |
-| Zinit | `OMZ::`, `OMZL::`, `OMZP::`, `OMZT::` snippets | ❌ |
-| zgen | `zgen oh-my-zsh ...` selected OMZ paths | ❌ |
-| zplug | `from:oh-my-zsh` selected OMZ entries | ❌ |
-| antibody | `ohmyzsh/ohmyzsh path:...` selected OMZ paths | ❌ |
-| zulu | OMZ package/module entries selected by zulu | ❌ |
-
 ### Enable GNU ls In macOS And FreeBSD Systems
 
 <a name="enable-gnu-ls"></a>

lib/bootstrap.zsh

@@ -1,44 +0,0 @@
-#
-# Shared Oh My Zsh bootstrap entrypoint.
-#
-# This file can be sourced by plugin managers that don't source `oh-my-zsh.sh`.
-# It is safe to source multiple times.
-#
-
-# Keep source path for callers that invoke omz_bootstrap again later.
-typeset -g _OMZ_BOOTSTRAP_SOURCE="${${(%):-%x}:a}"
-
-omz_bootstrap() {
-  # If ZSH is not defined, infer from this file location.
-  [[ -n "${ZSH:-}" ]] || export ZSH="${_OMZ_BOOTSTRAP_SOURCE:h:h}"
-
-  # Set ZSH_CUSTOM to the path where custom config files and plugins exist.
-  [[ -n "${ZSH_CUSTOM:-}" ]] || ZSH_CUSTOM="$ZSH/custom"
-
-  # Set cache directory.
-  [[ -n "${ZSH_CACHE_DIR:-}" ]] || ZSH_CACHE_DIR="$ZSH/cache"
-
-  # Ensure cache dir is writable, otherwise fallback to a HOME-based cache.
-  if [[ ! -w "$ZSH_CACHE_DIR" ]]; then
-    ZSH_CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/oh-my-zsh"
-  fi
-
-  # Create cache and completions dir.
-  command mkdir -p "$ZSH_CACHE_DIR/completions"
-
-  # Add required OMZ search paths.
-  local dir
-  for dir in \
-    "$ZSH/functions" \
-    "$ZSH/completions" \
-    "$ZSH_CUSTOM/functions" \
-    "$ZSH_CUSTOM/completions" \
-    "$ZSH_CACHE_DIR/completions"; do
-    (( ${fpath[(Ie)$dir]} )) || fpath=("$dir" $fpath)
-  done
-
-  # Public signal: OMZ bootstrap has completed.
-  typeset -g OMZ_IS_BOOTSTRAPPED=true
-}
-
-omz_bootstrap "$@"

lib/cli.zsh

@@ -519,7 +519,7 @@ function _omz::plugin::load {
     # Check if it has completion to reload compinit
     local -a comp_files
     comp_files=($base/_*(N))
-    has_completion=$(( $#comp_files > 0 ))
+    (( has_completion )) || has_completion=$(( $#comp_files > 0 ))
 
     # Load the plugin
     if [[ -f "$base/$plugin.plugin.zsh" ]]; then

lib/diagnostics.zsh

@@ -271,7 +271,7 @@ function _omz_diag_dump_check_core_commands() {
     unfunction unhash unlimit unset unsetopt vared wait whence where which zcompile
     zle zmodload zparseopts zregexparse zstyle )
   if is-at-least 5.1; then
-    reserved_word+=( declare export integer float local readonly typeset )
+    reserved_words+=( declare export integer float local readonly typeset )
   else
     builtins+=( declare export integer float local readonly typeset )
   fi

lib/git.zsh

@@ -39,16 +39,27 @@ function _omz_git_prompt_info() {
   echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref//\%/%%}${upstream//\%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
 }
 
-function _omz_git_prompt_status() {
-  # OHMYZSH-13330: avoid "regex matching error: illegal byte sequence".
-  # zsh's "=~" operator delegates to the C library regex, which aborts with
-  # REG_ILLSEQ when the subject contains an invalid byte sequence under a
-  # multibyte locale (e.g. a filename with non-UTF-8 bytes in `git status`
-  # output). Forcing the C locale makes every byte a valid character, so the
-  # regex matching below never fails that way. `git status --porcelain` is
-  # locale-independent, so this does not change the parsed output.
+# Match an extended regular expression against a subject, forcing the C locale
+# only for the duration of the call.
+#
+# OHMYZSH-13330: zsh's "=~" operator delegates to the C library regex, which
+# aborts with REG_ILLSEQ when the subject contains an invalid byte sequence
+# under a multibyte locale (e.g. a filename with non-UTF-8 bytes in `git
+# status` output). Forcing the C locale makes every byte a valid character,
+# so the regex matching never fails that way. `git status --porcelain` is
+# locale-independent, so this does not change the parsed output.
+#
+# OHMYZSH-13985: the locale must be scoped to this function and not set for
+# the whole caller. Assigning LC_ALL makes zsh re-run setlocale() right away,
+# so leaving it set while the rest of the caller runs breaks multibyte
+# handling there — most visibly, `echo` refuses to expand Unicode escapes in
+# theme prompt symbols ("character not in range").
+function _omz_git_prompt_status_match() {
   local -x LC_ALL=C
+  [[ "$1" =~ "$2" ]]
+}
 
+function _omz_git_prompt_status() {
   [[ "$(__git_prompt_git config --get oh-my-zsh.hide-status 2>/dev/null)" = 1 ]] && return
 
   # Maps a git status prefix to an internal constant
@@ -113,11 +124,11 @@ function _omz_git_prompt_status() {
   status_lines=("${(@f)${status_text}}")
 
   # If the tracking line exists, get and parse it
-  if [[ "$status_lines[1]" =~ "^## [^ ]+ \[(.*)\]" ]]; then
+  if _omz_git_prompt_status_match "$status_lines[1]" "^## [^ ]+ \[(.*)\]"; then
     local branch_statuses
     branch_statuses=("${(@s/,/)match}")
     for branch_status in $branch_statuses; do
-      if [[ ! $branch_status =~ "(behind|diverged|ahead) ([0-9]+)?" ]]; then
+      if ! _omz_git_prompt_status_match "$branch_status" "(behind|diverged|ahead) ([0-9]+)?"; then
         continue
       fi
       local last_parsed_status=$prefix_constant_map[$match[1]]
@@ -130,7 +141,7 @@ function _omz_git_prompt_status() {
     local status_constant="${prefix_constant_map[$status_prefix]}"
     local status_regex=$'(^|\n)'"$status_prefix"
 
-    if [[ "$status_text" =~ $status_regex ]]; then
+    if _omz_git_prompt_status_match "$status_text" "$status_regex"; then
       statuses_seen[$status_constant]=1
     fi
   done

lib/tests/bootstrap-inline-ci.test.zsh

@@ -1,35 +0,0 @@
-#!/usr/bin/zsh -df
-
-set -eu
-
-bootstrap_file="${0:A:h:h}/bootstrap.zsh"
-
-assert() {
-  local condition="$1" message="$2"
-  if ! eval "$condition"; then
-    print -u2 "\e[31mError\e[0m: $message"
-    exit 1
-  fi
-}
-
-tmp==(:)
-mkdir -p "$tmp/ohmyzsh"/{functions,completions,cache} "$tmp/ohmyzsh/custom"/{functions,completions}
-
-export ZSH="$tmp/ohmyzsh"
-unset ZSH_CUSTOM ZSH_CACHE_DIR OMZ_IS_BOOTSTRAPPED
-fpath=()
-
-source "$bootstrap_file"
-
-assert '[[ "$OMZ_IS_BOOTSTRAPPED" == true ]]' "OMZ bootstrap signal should be true"
-assert '[[ -d "$ZSH_CACHE_DIR/completions" ]]' "cache completions directory should exist"
-assert '[[ "${fpath[(Ie)$ZSH/functions]}" -gt 0 ]]' "fpath should include OMZ functions"
-assert '[[ "${fpath[(Ie)$ZSH/completions]}" -gt 0 ]]' "fpath should include OMZ completions"
-assert '[[ "${fpath[(Ie)$ZSH_CUSTOM/functions]}" -gt 0 ]]' "fpath should include custom functions"
-assert '[[ "${fpath[(Ie)$ZSH_CUSTOM/completions]}" -gt 0 ]]' "fpath should include custom completions"
-assert '[[ "${fpath[(Ie)$ZSH_CACHE_DIR/completions]}" -gt 0 ]]' "fpath should include cache completions"
-
-touch "$ZSH_CACHE_DIR/completions/_bootstrap_ci_smoke"
-assert '[[ -f "$ZSH_CACHE_DIR/completions/_bootstrap_ci_smoke" ]]' "completion cache write should succeed"
-
-print -u2 "\e[32mSuccess\e[0m bootstrap inline invariants"

lib/tests/bootstrap.test.zsh

@@ -1,88 +0,0 @@
-#!/usr/bin/zsh -df
-
-set -u
-
-bootstrap_file="${0:A:h:h}/bootstrap.zsh"
-
-_assert() {
-  local condition="$1" message="$2"
-  if ! eval "$condition"; then
-    print -u2 "\e[31mError\e[0m: $message"
-    return 1
-  fi
-}
-
-test_bootstrap_sets_defaults_and_paths() {
-  local tmp==(:)
-  mkdir -p "$tmp/ohmyzsh"/{functions,completions,cache} "$tmp/ohmyzsh/custom"/{functions,completions}
-
-  (
-    set -e
-    export ZSH="$tmp/ohmyzsh"
-    unset ZSH_CUSTOM ZSH_CACHE_DIR OMZ_IS_BOOTSTRAPPED
-    fpath=()
-    source "$bootstrap_file"
-
-    _assert '[[ "$ZSH_CUSTOM" == "'"$tmp/ohmyzsh/custom"'" ]]' "ZSH_CUSTOM default should be set"
-    _assert '[[ "$ZSH_CACHE_DIR" == "'"$tmp/ohmyzsh/cache"'" ]]' "ZSH_CACHE_DIR default should be set"
-    _assert '[[ -d "'"$tmp/ohmyzsh/cache/completions"'" ]]' "completions dir should be created"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/functions"']}" -gt 0 ]]' "fpath should include OMZ functions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/completions"']}" -gt 0 ]]' "fpath should include OMZ completions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/custom/functions"']}" -gt 0 ]]' "fpath should include custom functions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/custom/completions"']}" -gt 0 ]]' "fpath should include custom completions dir"
-    _assert '[[ "${fpath[(Ie)'"$tmp/ohmyzsh/cache/completions"']}" -gt 0 ]]' "fpath should include cache completions dir"
-    _assert '[[ "$OMZ_IS_BOOTSTRAPPED" == true ]]' "bootstrap signal should be set"
-  )
-}
-
-test_bootstrap_is_idempotent() {
-  local tmp==(:)
-  mkdir -p "$tmp/ohmyzsh"/{functions,completions,cache} "$tmp/ohmyzsh/custom"/{functions,completions}
-
-  (
-    set -e
-    export ZSH="$tmp/ohmyzsh"
-    unset ZSH_CUSTOM ZSH_CACHE_DIR OMZ_IS_BOOTSTRAPPED
-    fpath=()
-    source "$bootstrap_file"
-    source "$bootstrap_file"
-    omz_bootstrap
-
-    _assert '[[ ${#fpath} -eq ${#${(u)fpath}} ]]' "fpath entries should not duplicate after repeated bootstrap"
-    _assert '[[ "$OMZ_IS_BOOTSTRAPPED" == true ]]' "bootstrap signal should remain true"
-  )
-}
-
-test_bootstrap_uses_writable_cache_fallback() {
-  local tmp==(:)
-  mkdir -p "$tmp/ohmyzsh"/{functions,completions} "$tmp/ohmyzsh/custom"/{functions,completions}
-  mkdir -p "$tmp/no-write" "$tmp/xdg-cache"
-  chmod 0555 "$tmp/no-write"
-
-  (
-    set -e
-    export ZSH="$tmp/ohmyzsh"
-    export XDG_CACHE_HOME="$tmp/xdg-cache"
-    export ZSH_CACHE_DIR="$tmp/no-write"
-    unset ZSH_CUSTOM OMZ_IS_BOOTSTRAPPED
-    fpath=()
-    source "$bootstrap_file"
-
-    _assert '[[ "$ZSH_CACHE_DIR" == "'"$tmp/xdg-cache/oh-my-zsh"'" ]]' "cache dir should fallback when not writable"
-    _assert '[[ -d "'"$tmp/xdg-cache/oh-my-zsh/completions"'" ]]' "fallback completions dir should be created"
-    _assert '[[ "${fpath[(Ie)'"$tmp/xdg-cache/oh-my-zsh/completions"']}" -gt 0 ]]' "fpath should include fallback completions dir"
-  )
-}
-
-tests=(
-  test_bootstrap_sets_defaults_and_paths
-  test_bootstrap_is_idempotent
-  test_bootstrap_uses_writable_cache_fallback
-)
-
-for test_name in $tests; do
-  print -u2 "Test: $test_name"
-  "$test_name" || exit 1
-  print -u2 "\e[32mSuccess\e[0m"
-  print -u2 ""
-done

lib/tests/plugin-manager-bootstrap-integration.test.zsh

@@ -1,104 +0,0 @@
-#!/usr/bin/zsh -df
-
-set -euo pipefail
-
-if (( $# != 2 )); then
-  print -u2 "Usage: $0 <manager> <positive|negative>"
-  exit 1
-fi
-
-manager="$1"
-scenario="$2"
-
-if [[ "$scenario" != "positive" && "$scenario" != "negative" ]]; then
-  print -u2 "scenario must be 'positive' or 'negative'"
-  exit 1
-fi
-
-repo_root="${0:A:h:h:h}"
-tmp==(:)
-workspace="$tmp/workspace"
-home_dir="$tmp/home"
-cache_dir="$tmp/cache"
-zshrc="$tmp/.zshrc"
-
-mkdir -p "$workspace" "$home_dir" "$cache_dir"
-
-manager_install=''
-manager_source=''
-
-case "$manager" in
-  antigen)
-    manager_install='git clone https://github.com/zsh-users/antigen.git "$MANAGER_HOME/antigen" >/dev/null 2>&1'
-    manager_source='source "$MANAGER_HOME/antigen/antigen.zsh"'
-    ;;
-  zinit)
-    manager_install='git clone https://github.com/zdharma-continuum/zinit.git "$MANAGER_HOME/zinit" >/dev/null 2>&1'
-    manager_source='source "$MANAGER_HOME/zinit/zinit.zsh"'
-    ;;
-  zgen)
-    manager_install='git clone https://github.com/tarjoilija/zgen.git "$MANAGER_HOME/zgen" >/dev/null 2>&1'
-    manager_source='source "$MANAGER_HOME/zgen/zgen.zsh"'
-    ;;
-  zplug)
-    manager_install='git clone https://github.com/zplug/zplug "$MANAGER_HOME/zplug" >/dev/null 2>&1'
-    manager_source='export ZPLUG_HOME="$MANAGER_HOME/zplug"; source "$ZPLUG_HOME/init.zsh"'
-    ;;
-  antibody)
-    manager_install='command -v go >/dev/null 2>&1; export GOBIN="$MANAGER_HOME/bin"; mkdir -p "$GOBIN"; go install github.com/getantibody/antibody@latest >/dev/null 2>&1'
-    manager_source='"$MANAGER_HOME/bin/antibody" --version >/dev/null 2>&1'
-    ;;
-  zulu)
-    manager_install='git clone https://github.com/zulu-zsh/zulu.git "$MANAGER_HOME/zulu" >/dev/null 2>&1'
-    manager_source='source "$MANAGER_HOME/zulu/zulu.zsh"'
-    ;;
-  *)
-    print -u2 "Unsupported manager: $manager"
-    exit 1
-    ;;
-esac
-
-cat > "$zshrc" <<RC
-set -eo pipefail
-
-export HOME="$home_dir"
-export XDG_CACHE_HOME="$cache_dir"
-export OMZ_ROOT="$repo_root"
-export ZSH="\$OMZ_ROOT"
-export MANAGER_HOME="$workspace/$manager"
-mkdir -p "\$MANAGER_HOME"
-
-$manager_install
-$manager_source
-RC
-
-if [[ "$scenario" == "positive" ]]; then
-  cat >> "$zshrc" <<'RC'
-source "$OMZ_ROOT/lib/bootstrap.zsh"
-[[ "${OMZ_IS_BOOTSTRAPPED:-}" == true ]] || { print -u2 "bootstrap signal missing before OMZ load"; return 1; }
-RC
-else
-  cat >> "$zshrc" <<'RC'
-[[ -z "${OMZ_IS_BOOTSTRAPPED:-}" ]] || { print -u2 "bootstrap signal unexpectedly set without hook"; return 1; }
-source "$OMZ_ROOT/lib/bootstrap.zsh"
-RC
-fi
-
-cat >> "$zshrc" <<RC
-[[ "\${OMZ_IS_BOOTSTRAPPED:-}" == true ]] || { print -u2 "bootstrap signal not set before OMZ entrypoint sourcing"; return 1; }
-
-source "\$OMZ_ROOT/lib/functions.zsh"
-source "\$OMZ_ROOT/plugins/git/git.plugin.zsh"
-autoload -Uz compinit
-compinit -i -d "\$ZSH_CACHE_DIR/.zcompdump"
-
-source "\$OMZ_ROOT/themes/robbyrussell.zsh-theme"
-
-[[ -d "\$ZSH_CACHE_DIR/completions" ]] || { print -u2 "completions cache directory missing"; return 1; }
-
-touch "\$ZSH_CACHE_DIR/completions/_ci_${manager}_${scenario}" || { print -u2 "completion cache write failed"; return 1; }
-[[ -f "\$ZSH_CACHE_DIR/completions/_ci_${manager}_${scenario}" ]] || { print -u2 "completion cache file missing"; return 1; }
-RC
-
-zsh -df "$zshrc"
-print -u2 "\e[32mSuccess\e[0m $manager $scenario"

oh-my-zsh.sh

@@ -50,14 +50,31 @@ unset -f omz_f
 # If ZSH is not defined, use the current script's directory.
 [[ -n "$ZSH" ]] || export ZSH="${${(%):-%x}:a:h}"
 
-# Shared, manager-agnostic bootstrap.
-source "$ZSH/lib/bootstrap.zsh"
+# Set ZSH_CUSTOM to the path where your custom config files
+# and plugins exists, or else we will use the default custom/
+[[ -n "$ZSH_CUSTOM" ]] || ZSH_CUSTOM="$ZSH/custom"
+
+# Set ZSH_CACHE_DIR to the path where cache files should be created
+# or else we will use the default cache/
+[[ -n "$ZSH_CACHE_DIR" ]] || ZSH_CACHE_DIR="$ZSH/cache"
+
+# Make sure $ZSH_CACHE_DIR is writable, otherwise use a directory in $HOME
+if [[ ! -w "$ZSH_CACHE_DIR" ]]; then
+  ZSH_CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/oh-my-zsh"
+fi
+
+# Create cache and completions dir and add to $fpath
+mkdir -p "$ZSH_CACHE_DIR/completions"
+(( ${fpath[(Ie)$ZSH_CACHE_DIR/completions]} )) || fpath=("$ZSH_CACHE_DIR/completions" $fpath)
 
 # Check for updates on initial load...
 source "$ZSH/tools/check_for_upgrade.sh"
 
 # Initializes Oh My Zsh
 
+# add a function path
+fpath=($ZSH/{functions,completions} $ZSH_CUSTOM/{functions,completions} $fpath)
+
 # Load all stock functions (from $fpath files) called below.
 autoload -U compaudit compinit zrecompile
 
@@ -217,6 +234,3 @@ fi
 
 # set completion colors to be the same as `ls`, after theme has been loaded
 [[ -z "$LS_COLORS" ]] || zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"
-
-# Public signal: full Oh My Zsh init script has completed.
-typeset -g OMZ_IS_LOADED=true

plugins/1password/1password.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_op" ]]; then
   _comps[op]=_op
 fi
 
-op completion zsh >| "$ZSH_CACHE_DIR/completions/_op" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_op"
+  zf_mv -f -- =( op completion zsh ) "$TMPPREFIX"
+} &|
 
 # Load opswd function
 autoload -Uz opswd

plugins/arduino-cli/arduino-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_arduino-cli" ]]; then
 fi
 
 # Generate and load arduino-cli completion
-arduino-cli completion zsh >! "$ZSH_CACHE_DIR/completions/_arduino-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_arduino-cli"
+  zf_mv -f -- =( arduino-cli completion zsh ) "$TMPPREFIX"
+} &|

plugins/argocd/argocd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_argocd" ]]; then
   _comps[argocd]=_argocd
 fi
 
-argocd completion zsh >| "$ZSH_CACHE_DIR/completions/_argocd" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_argocd"
+  zf_mv -f -- =( argocd completion zsh ) "$TMPPREFIX"
+} &|

plugins/asdf/asdf.plugin.zsh

@@ -12,4 +12,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_asdf" ]]; then
   autoload -Uz _asdf
   _comps[asdf]=_asdf
 fi
-asdf completion zsh >| "$ZSH_CACHE_DIR/completions/_asdf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_asdf"
+  zf_mv -f -- =( asdf completion zsh ) "$TMPPREFIX"
+} &|

plugins/buf/buf.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_buf" ]]; then
 fi
 
 # Generate and load buf completion
-buf completion zsh >! "$ZSH_CACHE_DIR/completions/_buf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_buf"
+  zf_mv -f -- =( buf completion zsh ) "$TMPPREFIX"
+} &|

plugins/bun/bun.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_bun" ]]; then
   _comps[bun]=_bun
 fi
 
-SHELL=zsh bun completions >| "$ZSH_CACHE_DIR/completions/_bun" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_bun"
+  zf_mv -f -- =( SHELL=zsh bun completions ) "$TMPPREFIX"
+} &|

plugins/charm/charm.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_charm" ]]; then
   _comps[charm]=_charm
 fi
 
-charm completion zsh >| "$ZSH_CACHE_DIR/completions/_charm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_charm"
+  zf_mv -f -- =( charm completion zsh ) "$TMPPREFIX"
+} &|

plugins/chezmoi/chezmoi.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_chezmoi" ]]; then
   _comps[chezmoi]=_chezmoi
 fi
 
-chezmoi completion zsh >| "$ZSH_CACHE_DIR/completions/_chezmoi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_chezmoi"
+  zf_mv -f -- =( chezmoi completion zsh ) "$TMPPREFIX"
+} &|

plugins/codex/codex.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_codex" ]]; then
   _comps[codex]=_codex
 fi
 
-codex completion zsh < /dev/null 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_codex" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_codex"
+  zf_mv -f -- =( codex completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|

plugins/deno/deno.plugin.zsh

@@ -25,4 +25,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_deno" ]]; then
   _comps[deno]=_deno
 fi
 
-deno completions zsh >| "$ZSH_CACHE_DIR/completions/_deno" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_deno"
+  zf_mv -f -- =( deno completions zsh ) "$TMPPREFIX"
+} &|

plugins/docker-compose/README.md

@@ -2,7 +2,7 @@
 
 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
-This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+This plugin chooses automatically between the legacy `docker-compose` command and the modern
 `docker compose` subcommand, preferring `docker-compose` when both are available.
 
 To use it, add docker-compose to the plugins array of your zshrc file:
@@ -17,6 +17,7 @@ plugins=(... docker-compose)
 |-----------|----------------------------------|----------------------------------------------------------------------------------|
 | dco       | `docker-compose`                 | Docker-compose main command                                                      |
 | dcb       | `docker-compose build`           | Build containers                                                                 |
+| dcc       | `docker-compose config`                 | Parse, resolve and render compose file in canonical format |
 | dce       | `docker-compose exec`            | Execute command inside a container                                               |
 | dcps      | `docker-compose ps`              | List containers                                                                  |
 | dcrestart | `docker-compose restart`         | Restart container                                                                |

plugins/docker-compose/docker-compose.plugin.zsh

@@ -6,6 +6,7 @@
 
 alias dco="$dccmd"
 alias dcb="$dccmd build"
+alias dcc="$dccmd config"
 alias dce="$dccmd exec"
 alias dcps="$dccmd ps"
 alias dcrestart="$dccmd restart"

plugins/docker/docker.plugin.zsh

@@ -56,14 +56,19 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_docker" ]]; then
   _comps[docker]=_docker
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+
+  local plugin_dir="$1"
+
   # `docker completion` is only available from 23.0.0 on
   # docker version returns `Docker version 24.0.2, build cb74dfcd85`
   # with `s:,:` remove the comma after the version, and select third word of it
   if zstyle -t ':omz:plugins:docker' legacy-completion || \
     ! is-at-least 23.0.0 ${${(s:,:z)"$(command docker --version)"}[3]}; then
-        command cp "${0:h}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
+        command cp "${plugin_dir}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
       else
-        command docker completion zsh | tee "$ZSH_CACHE_DIR/completions/_docker" > /dev/null
+        local TMPPREFIX="$ZSH_CACHE_DIR/completions/_docker"
+        zf_mv -f -- =( command docker completion zsh ) "$TMPPREFIX"
   fi
-} &|
+} "${0:A:h}" &|

plugins/doctl/doctl.plugin.zsh

@@ -14,4 +14,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_doctl" ]]; then
   _comps[doctl]=_doctl
 fi
 
-doctl completion zsh >| "$ZSH_CACHE_DIR/completions/_doctl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_doctl"
+  zf_mv -f -- =( doctl completion zsh ) "$TMPPREFIX"
+} &|

plugins/eza/eza.plugin.zsh

@@ -52,8 +52,13 @@ function _configure_eza() {
   if [[ $_val ]]; then
     _EZA_TAIL+=("--time-style='$_val'")
   fi
-  if zstyle -t ":omz:plugins:eza" "hyperlink"; then
-    _EZA_TAIL+=("--hyperlink")
+  if zstyle -t ':omz:plugins:eza' 'hyperlink'; then
+    # eza >= 0.23 needs an explicit WHEN value
+    if command eza --hyperlink=auto --version &>/dev/null; then
+      _EZA_TAIL+=("--hyperlink=auto")
+    else
+      _EZA_TAIL+=("--hyperlink")
+    fi
   fi
 }
 

plugins/flutter/flutter.plugin.zsh

@@ -30,4 +30,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
   _comps[flutter]=_flutter
 fi
 
-flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flutter"
+  zf_mv -f -- =( flutter zsh-completion < /dev/null ) "$TMPPREFIX"
+} &|

plugins/fluxcd/fluxcd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flux" ]]; then
   _comps[flux]=_flux
 fi
 
-flux completion zsh >| "$ZSH_CACHE_DIR/completions/_flux" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flux"
+  zf_mv -f -- =( flux completion zsh ) "$TMPPREFIX"
+} &|

plugins/fnm/fnm.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_fnm" ]]; then
   _comps[fnm]=_fnm
 fi
 
-fnm completions --shell=zsh >| "$ZSH_CACHE_DIR/completions/_fnm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_fnm"
+  zf_mv -f -- =( fnm completions --shell=zsh ) "$TMPPREFIX"
+} &|
 
 if zstyle -t ':omz:plugins:fnm' autostart; then
   local -a fnm_env_cmd

plugins/gh/gh.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_gh" ]]; then
   _comps[gh]=_gh
 fi
 
-gh completion --shell zsh >| "$ZSH_CACHE_DIR/completions/_gh" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gh"
+  zf_mv -f -- =( gh completion --shell zsh ) "$TMPPREFIX"
+} &|

plugins/git/git.plugin.zsh

@@ -137,8 +137,9 @@ function gbda() {
 # Copied and modified from James Roeder (jmaroeder) under MIT License
 # https://github.com/jmaroeder/plugin-git/blob/216723ef4f9e8dde399661c39c80bdf73f4076c4/functions/gbda.fish
 function gbds() {
-  local default_branch=$(git_main_branch)
-  (( ! $? )) || default_branch=$(git_develop_branch)
+  local default_branch
+  default_branch=$(git_main_branch) \
+    || default_branch=$(git_develop_branch)
 
   git for-each-ref refs/heads/ "--format=%(refname:short)" | \
     while read branch; do

plugins/hasura/hasura.plugin.zsh

@@ -9,5 +9,9 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hasura" ]]; then
   source "$ZSH_CACHE_DIR/completions/_hasura"
 else
   source "$ZSH_CACHE_DIR/completions/_hasura"
-  hasura completion zsh --file "$ZSH_CACHE_DIR/completions/_hasura" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hasura"
+    zf_mv -f -- =( hasura completion zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/hcloud/hcloud.plugin.zsh

@@ -13,7 +13,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hcloud" ]]; then
   _comps[hcloud]=_hcloud
 fi
 
-hcloud completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_hcloud" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hcloud"
+  zf_mv -f -- =( hcloud completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # Main alias
 alias hc='hcloud'

plugins/helm/helm.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_helm" ]]; then
   source "$ZSH_CACHE_DIR/completions/_helm"
 else
   source "$ZSH_CACHE_DIR/completions/_helm"
-  helm completion zsh | tee "$ZSH_CACHE_DIR/completions/_helm" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_helm"
+    zf_mv -f -- =( helm completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 alias h='helm'

plugins/jj/jj.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_jj" ]]; then
   _comps[jj]=_jj
 fi
 
-COMPLETE=zsh jj >| "$ZSH_CACHE_DIR/completions/_jj" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_jj"
+  zf_mv -f -- =( COMPLETE=zsh jj ) "$TMPPREFIX"
+} &|
 
 function __jj_prompt_jj() {
   local -a flags
@@ -72,4 +76,3 @@ alias jjsq='jj squash'
 alias jjst='jj status'
 alias jjwa='jj workspace add'
 alias jjwf='jj workspace forget'
-

plugins/k9s/k9s.plugin.zsh

@@ -11,4 +11,8 @@ fi
 
 # and then generate it in the background. On first completion,
 # the actual completion file will be loaded.
-k9s completion zsh >| "$ZSH_CACHE_DIR/completions/_k9s" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_k9s"
+  zf_mv -f -- =( k9s completion zsh ) "$TMPPREFIX"
+} &|

plugins/kind/kind.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kind" ]]; then
 fi
 
 # Generate and load kind completion
-kind completion zsh >! "$ZSH_CACHE_DIR/completions/_kind" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kind"
+  zf_mv -f -- =( kind completion zsh ) "$TMPPREFIX"
+} &|
 
 # Register aliases
 alias kicc="kind create cluster"

plugins/kubectl/kubectl.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kubectl" ]]; then
   _comps[kubectl]=_kubectl
 fi
 
-kubectl completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_kubectl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kubectl"
+  zf_mv -f -- =( kubectl completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # This command is used a LOT both below and in daily life
 alias k=kubectl

plugins/minikube/minikube.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_minikube" ]]; then
   _comps[minikube]=_minikube
 fi
 
-minikube completion zsh >| "$ZSH_CACHE_DIR/completions/_minikube" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_minikube"
+  zf_mv -f -- =( minikube completion zsh ) "$TMPPREFIX"
+} &|

plugins/mise/mise.plugin.zsh

@@ -1,9 +1,14 @@
-if (( ! $+commands[mise] )); then
+if (( $+commands[mise] )); then
+  _mise_bin=mise
+elif [[ -x ~/.local/bin/mise ]]; then
+  _mise_bin=~/.local/bin/mise
+else
   return
 fi
 
 # Load mise hooks
-eval "$(mise activate zsh)"
+eval "$($_mise_bin activate zsh)"
+unset _mise_bin
 
 # If the completion file doesn't exist yet, we need to autoload it and
 # bind it to `mise`. Otherwise, compinit will have already done that.
@@ -14,4 +19,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_mise" ]]; then
 fi
 
 # Generate and load mise completion
-mise completion zsh >| "$ZSH_CACHE_DIR/completions/_mise" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_mise"
+  zf_mv -f -- =( mise completion zsh ) "$TMPPREFIX"
+} &|

plugins/molecule/molecule.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_molecule" ]]; then
   _comps[molecule]=_molecule
 fi
 
-_MOLECULE_COMPLETE=zsh_source molecule >| "$ZSH_CACHE_DIR/completions/_molecule" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_molecule"
+  zf_mv -f -- =( _MOLECULE_COMPLETE=zsh_source molecule ) "$TMPPREFIX"
+} &|
 
 # Alias
 # molecule: https://docs.ansible.com/projects/molecule/

plugins/mongo-atlas/mongo-atlas.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_atlas" ]]; then
   _comps[atlas]=_atlas
 fi
 
-atlas completion zsh >| "$ZSH_CACHE_DIR/completions/atlas" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_atlas"
+  zf_mv -f -- =( atlas completion zsh ) "$TMPPREFIX"
+} &|

plugins/nats/nats.plugin.zsh

@@ -7,7 +7,11 @@ if (( $+commands[nsc] )); then
     _comps[nsc]=_nsc
   fi
 
-  nsc completion zsh >| "$ZSH_CACHE_DIR/completions/_nsc" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nsc"
+    zf_mv -f -- =( nsc completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 if (( $+commands[nats] )); then
@@ -19,5 +23,9 @@ if (( $+commands[nats] )); then
     _comps[nats]=_nats
   fi
 
-  nats --completion-script-zsh >| "$ZSH_CACHE_DIR/completions/_nats" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nats"
+    zf_mv -f -- =( nats --completion-script-zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/ngrok/ngrok.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_ngrok" ]]; then
   _comps[ngrok]=_ngrok
 fi
 
-ngrok completion zsh >| "$ZSH_CACHE_DIR/completions/_ngrok" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_ngrok"
+  zf_mv -f -- =( ngrok completion zsh ) "$TMPPREFIX"
+} &|

plugins/pass-cli/pass-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pass-cli" ]]; then
   _comps[pass-cli]=_pass-cli
 fi
 
-pass-cli completions zsh >| "$ZSH_CACHE_DIR/completions/_pass-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pass-cli"
+  zf_mv -f -- =( pass-cli completions zsh ) "$TMPPREFIX"
+} &|

plugins/pipenv/pipenv.plugin.zsh

@@ -43,7 +43,11 @@ else
     _comps[pipenv]=_pipenv
   fi
 
-  _PIPENV_COMPLETE=zsh_source pipenv >| "$ZSH_CACHE_DIR/completions/_pipenv" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pipenv"
+    zf_mv -f -- =( _PIPENV_COMPLETE=zsh_source pipenv ) "$TMPPREFIX"
+  } &|
 fi
 
 if zstyle -T ':omz:plugins:pipenv' auto-shell; then

plugins/podman/podman.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_podman" ]]; then
   _comps[podman]=_podman
 fi
 
-podman completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_podman" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_podman"
+  zf_mv -f -- =( podman completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 alias pbl='podman build'
 alias pcin='podman container inspect'

plugins/poetry/poetry.plugin.zsh

@@ -39,4 +39,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_poetry" ]]; then
   _comps[poetry]=_poetry
 fi
 
-poetry completions zsh >| "$ZSH_CACHE_DIR/completions/_poetry" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_poetry"
+  zf_mv -f -- =( poetry completions zsh ) "$TMPPREFIX"
+} &|

plugins/procs/procs.plugin.zsh

@@ -10,12 +10,16 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_procs" ]]; then
   _comps[procs]=_procs
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_procs"
   autoload -Uz is-at-least
   local _version=$(procs --version)
-  if is-at-least "0.14" "${_version#procs }"; then
-    procs --gen-completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  else
-    procs --completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  fi
+  zf_mv -f -- =(
+    if is-at-least "0.14" "${_version#procs }"; then
+      procs --gen-completion-out zsh
+    else
+      procs --completion-out zsh
+    fi
+  ) "$TMPPREFIX"
 } &|

plugins/pulumi/pulumi.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pulumi" ]]; then
   _comps[pulumi]=_pulumi
 fi
 
-pulumi gen-completion zsh >| "$ZSH_CACHE_DIR/completions/_pulumi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pulumi"
+  zf_mv -f -- =( pulumi gen-completion zsh ) "$TMPPREFIX"
+} &|
 
 # Aliases
 alias pul='pulumi'

plugins/qodana/qodana.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_qodana" ]]; then
   _comps[qodana]=_qodana
 fi
 
-qodana completion zsh >| "$ZSH_CACHE_DIR/completions/_qodana" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_qodana"
+  zf_mv -f -- =( qodana completion zsh ) "$TMPPREFIX"
+} &|

plugins/rails/README.md

@@ -54,6 +54,33 @@ plugins=(... rails)
 | `rta`   | `rails test:all`                 | Runs all Rails tests, including system tests           |
 | `ru`    | `rails runner`                   | Run Ruby code in the context of Rails                  |
 
+### Multiple databases
+
+Rails applications can define more than one database (`primary`, `cache`, `cable`,
+`queue`, ...), and each one gets its own namespaced task. These commands accept an
+optional database name as the first argument:
+
+`rdc`, `rdd`, `rdm`, `rdmd`, `rdmr`, `rdms`, `rdmu`, `rdr`, `rdrs`, `rdsl`
+
+```zsh
+rdm                    # rails db:migrate
+rdm cache              # rails db:migrate:cache
+rdm VERSION=20231225   # rails db:migrate VERSION=20231225
+rdm cache STEP=2       # rails db:migrate:cache STEP=2
+rdm --trace            # rails db:migrate --trace
+```
+
+The first argument is read as a database name only when it is a bare word. Flags
+(`--trace`), variables (`STEP=2`) and other tasks (`db:seed`) are passed through to
+`rails` unchanged, so previous usage keeps working. When a database name is given,
+the resolved command is printed so it is clear which database is being used.
+
+`rdmrs` is not in the list above because Rails does not define a per-database
+`db:migrate:reset` task.
+
+Note that these are implemented as shell functions rather than aliases, so they will
+not appear in the output of `alias`.
+
 ### Foreman
 
 | Alias  | Command         | Description                               |

plugins/rails/rails.plugin.zsh

@@ -47,19 +47,9 @@ alias rc='rails console'
 alias rcs='rails console --sandbox'
 alias rd='rails destroy'
 alias rdb='rails dbconsole'
-alias rdc='rails db:create'
-alias rdd='rails db:drop'
-alias rdm='rails db:migrate'
-alias rdmd='rails db:migrate:down'
-alias rdmr='rails db:migrate:redo'
 alias rdmrs='rails db:migrate:reset'
-alias rdms='rails db:migrate:status'
 alias rdmtc='rails db:migrate db:test:clone'
-alias rdmu='rails db:migrate:up'
-alias rdr='rails db:rollback'
-alias rdrs='rails db:reset'
 alias rds='rails db:seed'
-alias rdsl='rails db:schema:load'
 alias rdtc='rails db:test:clone'
 alias rdtp='rails db:test:prepare'
 alias rgen='rails generate'
@@ -106,6 +96,47 @@ alias rkn='rake notes'
 alias rksts='rake stats'
 alias rkt='rake test'
 
+# Database tasks
+#
+# Rails applications can define more than one database (primary, cache, cable,
+# queue, ...). Each one gets its own namespaced task, e.g. `db:migrate:cache`.
+# The functions below take an optional database name as the first argument:
+#
+#   rdm                    ->  rails db:migrate
+#   rdm cache              ->  rails db:migrate:cache
+#   rdm VERSION=20231225   ->  rails db:migrate VERSION=20231225
+#   rdm cache STEP=2       ->  rails db:migrate:cache STEP=2
+#   rdm --trace            ->  rails db:migrate --trace
+#
+# The first argument is read as a database name only when it is a bare word.
+# Flags (--trace), variables (STEP=2) and other tasks (db:seed) are passed
+# through to rails untouched, so the previous alias behavior still works.
+function _rails_db_command() {
+  local task="$1"
+  shift
+
+  if [[ $# -gt 0 && "$1" != -* && "$1" != *=* && "$1" != *:* ]]; then
+    task="$task:$1"
+    shift
+    # Echo the resolved task so it is clear which database is being used
+    local -a cmd=(rails "$task" "$@")
+    print -u2 -r -- "Running: ${cmd[*]}"
+  fi
+
+  rails "$task" "$@"
+}
+
+function rdc()  { _rails_db_command db:create "$@" }
+function rdd()  { _rails_db_command db:drop "$@" }
+function rdm()  { _rails_db_command db:migrate "$@" }
+function rdmd() { _rails_db_command db:migrate:down "$@" }
+function rdmr() { _rails_db_command db:migrate:redo "$@" }
+function rdms() { _rails_db_command db:migrate:status "$@" }
+function rdmu() { _rails_db_command db:migrate:up "$@" }
+function rdr()  { _rails_db_command db:rollback "$@" }
+function rdrs() { _rails_db_command db:reset "$@" }
+function rdsl() { _rails_db_command db:schema:load "$@" }
+
 # legacy stuff
 alias sc='ruby script/console'
 alias sd='ruby script/destroy'

plugins/rbw/rbw.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rbw" ]]; then
   _comps[rbw]=_rbw
 fi
 
-rbw gen-completions zsh >| "$ZSH_CACHE_DIR/completions/_rbw" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rbw"
+  zf_mv -f -- =( rbw gen-completions zsh ) "$TMPPREFIX"
+} &|
 
 # rbwpw function copies the password of a service to the clipboard
 # and clears it after 20 seconds

plugins/rclone/rclone.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rclone" ]]; then
   _comps[rclone]=_rclone
 fi
 
-rclone completion zsh - >| "$ZSH_CACHE_DIR/completions/_rclone" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rclone"
+  zf_mv -f -- =( rclone completion zsh - ) "$TMPPREFIX"
+} &|

plugins/rust/rust.plugin.zsh

@@ -19,7 +19,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rustup" ]]; then
 fi
 
 # Generate completion files in the background
-rustup completions zsh >| "$ZSH_CACHE_DIR/completions/_rustup" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rustup"
+  zf_mv -f -- =( rustup completions zsh ) "$TMPPREFIX"
+} &|
 cat >| "$ZSH_CACHE_DIR/completions/_cargo" <<'EOF'
 #compdef cargo
 source "$(rustup run ${${(z)$(rustup default)}[1]} rustc --print sysroot)"/share/zsh/site-functions/_cargo

plugins/shopify/README.md

@@ -0,0 +1,112 @@
+# Shopify CLI plugin
+
+This plugin adds aliases, helper functions and completion for the
+[Shopify CLI](https://shopify.dev/docs/api/shopify-cli).
+
+To use it, add `shopify` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... shopify)
+```
+
+## Requirements
+
+[Shopify CLI](https://shopify.dev/docs/api/shopify-cli) 4.0 or newer, installed
+and on your `PATH`. The plugin does nothing if it is not:
+
+```zsh
+npm install -g @shopify/cli
+# or
+brew tap shopify/shopify && brew install shopify-cli
+```
+
+## Aliases
+
+| Alias  | Command   | Description            |
+| :----- | :-------- | :--------------------- |
+| `shop` | `shopify` | The Shopify CLI itself |
+
+## Functions
+
+| Function       | Description                                                                        |
+| :------------- | :--------------------------------------------------------------------------------- |
+| `shopd`        | Runs `theme dev`, `app dev` or `hydrogen dev`, whichever fits the current project   |
+| `shopi`        | Shows what the current project is connected to                                      |
+| `shopify_here` | Prints the kind of Shopify project you are in and the commands worth running in it  |
+| `shopify`      | Wraps the CLI to confirm before irreversible commands. See Settings                 |
+
+`shopd` and `shopi` work out which topic applies by looking at the project you
+are standing in, so you do not have to remember whether this directory is a
+theme, an app or a Hydrogen storefront. They complete like the command they
+stand in for, so in a theme `shopd --<TAB>` offers the flags of
+`shopify theme dev`.
+
+## Completion
+
+Every command completes with a description of what it does, at every level, and
+so do their flags, short forms and allowed values. `--environment` completes
+from the `[environments.*]` sections of your local `shopify.theme.toml` or
+`shopify.app.toml`.
+
+The Shopify CLI ships no completion generator of its own, so `_shopify` is
+generated from `shopify commands --json` and kept in this repository. It targets
+Shopify CLI 4.x.
+
+## Settings
+
+Set these with `zstyle` in your zshrc, before Oh My Zsh is sourced.
+
+### Confirming destructive commands
+
+```zsh
+zstyle ':omz:plugins:shopify' confirm-destructive no
+```
+
+By default the plugin asks for confirmation before three irreversible
+operations:
+
+- `shopify theme push` with `--live`/`-l` or `--publish`/`-p`, which overwrites
+  or publishes the live storefront
+- `shopify theme delete`, which the CLI's own help describes as impossible to
+  undo
+- `shopify app deploy --allow-deletes`, which can permanently remove extensions
+
+Nothing else is intercepted, and the prompt is skipped when the command already
+carries `--force`/`-f` or when stdin is not a terminal, so scripts, pipelines
+and CI are unaffected. Set the style to `no` to turn the prompt off entirely.
+
+### Completing theme IDs
+
+```zsh
+zstyle ':omz:plugins:shopify' dynamic-theme-completion yes
+```
+
+Off by default. When enabled, `--theme` is completed from
+`shopify theme list --json`, showing each theme's name and role next to its ID
+instead of making you copy IDs by hand. It is opt-in because it runs the CLI and
+makes a network call when you press <kbd>Tab</kbd>, and because it needs you to
+be authenticated. Results are cached for five minutes.
+
+### Disabling the aliases
+
+This works for every Oh My Zsh plugin:
+
+```zsh
+zstyle ':omz:plugins:shopify' aliases no
+```
+
+## Caveats
+
+- `shopify` is a shell function here. Run `command shopify` to reach the binary
+  directly.
+- When a project has its own copy of the CLI in `node_modules/.bin/shopify`,
+  that one is used in preference to the global install. App and Hydrogen
+  projects normally pin the CLI in `package.json`, and running a different
+  global version against them is a common source of confusing errors.
+- `--password` and `--store-password` are unrelated, and you often need both.
+  `--password` is the CLI's own authentication token, from the Theme Access app
+  or the Admin API. `--store-password` is the password for a
+  password-protected storefront.
+- `shopify theme push` deletes remote files that are missing locally, and
+  `shopify theme pull` deletes local files that are missing remotely, unless you
+  pass `--nodelete`/`-n`. The plugin does not prompt for these.

plugins/shopify/shopify.plugin.zsh

@@ -0,0 +1,203 @@
+# Shopify CLI: completion, aliases and guard rails.
+# https://shopify.dev/docs/api/shopify-cli
+
+if (( ! $+commands[shopify] )); then
+  return
+fi
+
+# Prefer a project-local CLI: app and Hydrogen projects pin their own version.
+# The walk stops at $HOME so a stray ~/node_modules cannot hijack every project.
+# $commands avoids resolving back to the wrapper function below.
+function _shopify_bin() {
+  local dir="$PWD"
+  while [[ -n "$dir" && "$dir" != "/" && "$dir" != "$HOME" ]]; do
+    if [[ -x "$dir/node_modules/.bin/shopify" ]]; then
+      print -r -- "$dir/node_modules/.bin/shopify"
+      return 0
+    fi
+    dir="${dir:h}"
+  done
+  print -r -- "$commands[shopify]"
+}
+
+# Print the project type in $PWD: hydrogen, app or theme.
+# Hydrogen is tested first because those projects usually carry a
+# shopify.app.toml too. shopify.theme.toml is not a theme marker: it only
+# exists once environments are configured.
+function _shopify_project_type() {
+  local dir="$PWD"
+  local -a app_config
+
+  while [[ -n "$dir" && "$dir" != "/" && "$dir" != "$HOME" ]]; do
+    if [[ -x "$dir/node_modules/.bin/h2" ]] ||
+      [[ -r "$dir/package.json" && "$(<"$dir/package.json")" == *'"@shopify/hydrogen"'* ]]; then
+      return 0
+    fi
+
+    app_config=("$dir"/shopify.app*.toml(N))
+    if (( $#app_config )); then
+      print -r -- app
+      return 0
+    fi
+
+    if [[ -f "$dir/config/settings_schema.json" && -f "$dir/layout/theme.liquid" ]]; then
+      print -r -- theme
+      return 0
+    fi
+
+    dir="${dir:h}"
+  done
+
+  return 1
+}
+
+# Does this invocation need confirming? Sets REPLY to the reason.
+function _shopify_is_destructive() {
+  zstyle -T ':omz:plugins:shopify' confirm-destructive || return 1
+
+  # Nobody to answer: CI and pipelines are unaffected.
+  [[ -t 0 ]] || return 1
+
+  local topic="$1" subcommand="$2" arg
+  local -a long
+  local short=""
+
+  # Short flags can be bundled, so collect them as characters: -al counts as l.
+  for arg in "${@[3,-1]}"; do
+    [[ "$arg" == "--" ]] && break
+    case "$arg" in
+      --*) long+=("${arg%%=*}") ;;
+      -?*) short+="${${arg%%=*}#-}" ;;
+    esac
+  done
+
+  # An explicit force flag states the intent already.
+  if (( long[(I)--force] )) || [[ "$short" == *f* ]]; then
+    return 1
+  fi
+
+  case "$topic $subcommand" in
+    "theme push")
+      if (( long[(I)--live] || long[(I)--publish] )) || [[ "$short" == *[lp]* ]]; then
+        REPLY="this overwrites or publishes the live theme on the storefront."
+        return 0
+      fi
+      ;;
+    "theme delete")
+      REPLY="deleting a theme cannot be undone."
+      return 0
+      ;;
+    "app deploy")
+      if (( long[(I)--allow-deletes] )); then
+        REPLY="this can permanently remove app extensions."
+        return 0
+      fi
+      ;;
+  esac
+
+  return 1
+}
+
+# Adds a confirmation prompt before irreversible operations. Everything else
+# passes straight through, so `theme dev` stays interactive and pipes stay clean.
+function shopify() {
+  local REPLY
+  if _shopify_is_destructive "$@"; then
+    print -u2 -- "shopify: $REPLY"
+    if ! read -q "?Continue? [y/N] "; then
+      print -u2 -- ""
+      return 130
+    fi
+    print -u2 -- ""
+  fi
+
+  "$(_shopify_bin)" "$@"
+}
+
+# Print the commands worth running in the current directory.
+function shopify_here() {
+  local project_type
+  project_type="$(_shopify_project_type)"
+
+  case "$project_type" in
+    theme)
+      print -- "Shopify theme project."
+      print -- "  shopify theme dev     Preview locally with live reload"
+      print -- "  shopify theme check   Lint the theme"
+      print -- "  shopify theme list    List the themes on the store"
+      print -- "  shopify theme pull    Download a remote theme into this folder"
+      print -- "  shopify theme push    Upload this folder to a remote theme"
+      ;;
+    app)
+      print -- "Shopify app project."
+      print -- "  shopify app dev       Run the app against a development store"
+      print -- "  shopify app info      Show how the app is configured"
+      print -- "  shopify app deploy    Deploy the app and its extensions"
+      print -- "  shopify app logs      Stream app logs"
+      ;;
+    hydrogen)
+      print -- "Hydrogen storefront."
+      print -- "  shopify hydrogen dev      Run the storefront locally"
+      print -- "  shopify hydrogen build    Build for production"
+      print -- "  shopify hydrogen deploy   Deploy to Oxygen"
+      print -- "  shopify hydrogen link     Link this project to a storefront"
+      ;;
+    *)
+      print -- "No Shopify project found here."
+      print -- "  shopify theme init      Start a new theme"
+      print -- "  shopify app init        Start a new app"
+      print -- "  shopify hydrogen init   Start a new Hydrogen storefront"
+      ;;
+  esac
+}
+
+# Run the dev server for whichever kind of project this is.
+function shopd() {
+  local project_type
+  if ! project_type="$(_shopify_project_type)"; then
+    print -u2 -- "shopd: not inside a Shopify theme, app or Hydrogen project."
+    return 1
+  fi
+  shopify "$project_type" dev "$@"
+}
+
+# Show what the current project is connected to.
+function shopi() {
+  local project_type
+  if ! project_type="$(_shopify_project_type)"; then
+    print -u2 -- "shopi: not inside a Shopify theme, app or Hydrogen project."
+    return 1
+  fi
+  case "$project_type" in
+    hydrogen) shopify hydrogen list "$@" ;;
+    *) shopify "$project_type" info "$@" ;;
+  esac
+}
+
+# Complete the helpers like the commands they stand in for.
+if (( $+functions[compdef] )); then
+  _shopd() {
+    local project_type
+    project_type="$(_shopify_project_type)" || return 1
+    words=(shopify "$project_type" dev ${words[2,-1]})
+    (( CURRENT += 2 ))
+    _shopify
+  }
+
+  _shopi() {
+    local project_type
+    project_type="$(_shopify_project_type)" || return 1
+    if [[ "$project_type" == hydrogen ]]; then
+      words=(shopify hydrogen list ${words[2,-1]})
+    else
+      words=(shopify "$project_type" info ${words[2,-1]})
+    fi
+    (( CURRENT += 2 ))
+    _shopify
+  }
+
+  compdef _shopd shopd
+  compdef _shopi shopi
+fi
+
+alias shop='shopify'

plugins/sigstore/sigstore.plugin.zsh

@@ -12,7 +12,11 @@ function install_autocompletion {
     _comps[$1]=_$1
   fi
 
-  $1 completion zsh >| "$ZSH_CACHE_DIR/completions/_$1" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_$1"
+    zf_mv -f -- =( $1 completion zsh ) "$TMPPREFIX"
+  } "$1" &|
 }
 
 install_autocompletion cosign

plugins/skaffold/skaffold.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_skaffold" ]]; then
   _comps[skaffold]=_skaffold
 fi
 
-skaffold completion zsh >| "$ZSH_CACHE_DIR/completions/_skaffold" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_skaffold"
+  zf_mv -f -- =( skaffold completion zsh ) "$TMPPREFIX"
+} &|

plugins/ssh-agent/ssh-agent.plugin.zsh

@@ -101,10 +101,18 @@ if zstyle -t :omz:plugins:ssh-agent agent-forwarding \
    && [[ -n "$SSH_AUTH_SOCK" ]]; then
   if [[ ! -L "$SSH_AUTH_SOCK" ]]; then
     if [[ -n "$TERMUX_VERSION" ]]; then
-      ln -sf "$SSH_AUTH_SOCK" "$PREFIX"/tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link="$PREFIX"/tmp/ssh-agent-$USERNAME-screen
     else
-      ln -sf "$SSH_AUTH_SOCK" /tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link=/tmp/ssh-agent-$USERNAME-screen
     fi
+    # `ln -sf` unlinks the old symlink and then creates the new one: two
+    # syscalls, no atomic swap. Shells starting concurrently (a tmux window
+    # opening several panes at once) interleave those steps and all but one
+    # fail with "ln: ...: File exists". Stage the link under a PID-unique
+    # name and move it into place, since rename(2) is atomic.
+    command ln -sf "$SSH_AUTH_SOCK" "$_omz_ssh_agent_link.$$" \
+      && command mv -f "$_omz_ssh_agent_link.$$" "$_omz_ssh_agent_link"
+    unset _omz_ssh_agent_link
   fi
 else
   _start_agent

plugins/stripe/stripe.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_stripe" ]]; then
   _comps[stripe]=_stripe
 fi
 
-stripe completion --shell zsh --write-to-stdout >| "$ZSH_CACHE_DIR/completions/_stripe" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_stripe"
+  zf_mv -f -- =( stripe completion --shell zsh --write-to-stdout ) "$TMPPREFIX"
+} &|

plugins/systemadmin/systemadmin.plugin.zsh

@@ -138,7 +138,7 @@ function consume100() {
 
 # Website traffic statistics (G)
 function webtraffic() {
-  awk "{sum+=$10} END {print sum/1024/1024/1024}" "$(retlog)"
+  awk '{sum+=$10} END {print sum/1024/1024/1024}' "$(retlog)"
 }
 
 # Statistical connections 404

plugins/tailscale/tailscale.plugin.zsh

@@ -22,4 +22,8 @@ if (( $+aliases[tailscale] )); then
   _comps[${aliases[tailscale]:t}]=_tailscale
 fi
 
-tailscale completion zsh >| "$ZSH_CACHE_DIR/completions/_tailscale" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_tailscale"
+  zf_mv -f -- =( tailscale completion zsh ) "$TMPPREFIX"
+} &|

plugins/task/task.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_task" ]]; then
 fi
 
 # Generate and load task completion
-task --completion zsh >! "$ZSH_CACHE_DIR/completions/_task" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_task"
+  zf_mv -f -- =( task --completion zsh ) "$TMPPREFIX"
+} &|

plugins/timoni/timoni.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_timoni" ]]; then
   _comps[timoni]=_timoni
 fi
 
-timoni completion zsh >| "$ZSH_CACHE_DIR/completions/_timoni" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_timoni"
+  zf_mv -f -- =( timoni completion zsh ) "$TMPPREFIX"
+} &|

plugins/uv/uv.plugin.zsh

@@ -43,5 +43,12 @@ fi
 
 # uv and uvx are installed together (uvx is an alias to `uv tool run`)  
 # Overwrites the file each time as completions might change with uv versions.
-uv generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uv" &|
-uvx --generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uvx" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uv"
+  zf_mv -f -- =( uv generate-shell-completion zsh ) "$TMPPREFIX"
+} &|
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uvx"
+  zf_mv -f -- =( uvx --generate-shell-completion zsh ) "$TMPPREFIX"
+} &|

plugins/volta/volta.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_volta" ]]; then
   _comps[volta]=_volta
 fi
 
-volta completions zsh >| "$ZSH_CACHE_DIR/completions/_volta" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_volta"
+  zf_mv -f -- =( volta completions zsh ) "$TMPPREFIX"
+} &|

tools/changelog.sh

@@ -221,12 +221,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks

tools/check_for_upgrade.sh

@@ -28,7 +28,7 @@ zstyle -s ':omz:update' mode update_mode || {
 if [[ "$update_mode" = disabled ]] \
    || [[ ! -w "$ZSH" || ! -O "$ZSH" ]] \
    || [[ ! -t 1 && ${POWERLEVEL9K_INSTANT_PROMPT:-off} == off ]] \
-   || ! command git --version 2>&1 >/dev/null \
+   || ! command git --version >/dev/null 2>&1 \
    || (builtin cd -q "$ZSH"; ! command git rev-parse --is-inside-work-tree &>/dev/null); then
   unset update_mode
   return

tools/install.sh

@@ -49,9 +49,31 @@ USER=${USER:-$(id -u -n)}
 # $HOME is defined at the time of login, but it could be unset. If it is unset,
 # a tilde by itself (~) will not be expanded to the current user's home directory.
 # POSIX: https://pubs.opengroup.org/onlinepubs/009696899/basedefs/xbd_chap08.html#tag_08_03
-HOME="${HOME:-$(getent passwd $USER 2>/dev/null | cut -d: -f6)}"
-# macOS does not have getent, but this works even if $HOME is unset
-HOME="${HOME:-$(eval echo ~"$USER")}"
+if [ -z "$HOME" ]; then
+  HOME=$(getent passwd "$USER" 2>/dev/null | cut -d: -f6)
+
+  # macOS does not have getent; fall back to tilde expansion, but only if
+  # $USER is a safe username. The eval below would otherwise expand any shell
+  # metacharacters in $USER and allow command injection (CWE-78).
+  case "$USER" in
+    *[![:alnum:]_.-]*|'')
+      ;;
+    *)
+      resolved_home=$(eval echo ~"$USER")
+      # Unknown users are not expanded and produce a literal "~username".
+      [ "$resolved_home" = "~$USER" ] || HOME=$resolved_home
+      ;;
+  esac
+
+  case "$HOME" in
+    /*) ;;
+    *)
+      echo "Error: unable to determine the current user's home directory." >&2
+      echo "Set HOME explicitly and rerun the installer." >&2
+      exit 1
+      ;;
+  esac
+fi
 
 
 # Track if $ZSH was provided
@@ -168,12 +190,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks

tools/upgrade.sh

@@ -95,12 +95,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks