fix(shopify): parse every theme and keep match variables local

The dynamic theme completion split the `theme list --json` payload on
"${json//\{/$'\n'}", which substitutes a literal $'\n' rather than a newline.
Only the first theme was ever offered. Split on a newline held in a variable
instead.

Both completion helpers used =~ and (#b) backreferences without declaring
$match, leaving match, MATCH, mbegin and mend set in the user's shell.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LNDR8NjvPSgHbjcQurMHW9

.github/dependencies.yml

@@ -46,9 +46,10 @@ dependencies:
   plugins/z:
     branch: master
     repo: agkozak/zsh-z
-    version: acd0e1984df350c189f8f9c4956ec586b6c73fca
+    version: 102fb78036ed76feedf623907483691777a1d510
     precopy: |
       set -e
+      rm -r tests
       test -e README.md && mv -f README.md MANUAL.md
     postcopy: |
       set -e

.github/workflows/dependencies.yml

@@ -16,7 +16,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/dependencies/requirements.txt

@@ -1,6 +1,6 @@
 certifi==2026.7.22
-charset-normalizer==3.4.9
-idna==3.18
+charset-normalizer==3.5.1
+idna==3.19
 PyYAML==6.0.3
 requests==2.34.2
 semver==3.0.4

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

lib/cli.zsh

@@ -519,7 +519,7 @@ function _omz::plugin::load {
     # Check if it has completion to reload compinit
     local -a comp_files
     comp_files=($base/_*(N))
-    has_completion=$(( $#comp_files > 0 ))
+    (( has_completion )) || has_completion=$(( $#comp_files > 0 ))
 
     # Load the plugin
     if [[ -f "$base/$plugin.plugin.zsh" ]]; then

lib/diagnostics.zsh

@@ -271,7 +271,7 @@ function _omz_diag_dump_check_core_commands() {
     unfunction unhash unlimit unset unsetopt vared wait whence where which zcompile
     zle zmodload zparseopts zregexparse zstyle )
   if is-at-least 5.1; then
-    reserved_word+=( declare export integer float local readonly typeset )
+    reserved_words+=( declare export integer float local readonly typeset )
   else
     builtins+=( declare export integer float local readonly typeset )
   fi

lib/git.zsh

@@ -39,16 +39,27 @@ function _omz_git_prompt_info() {
   echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref//\%/%%}${upstream//\%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
 }
 
-function _omz_git_prompt_status() {
-  # OHMYZSH-13330: avoid "regex matching error: illegal byte sequence".
-  # zsh's "=~" operator delegates to the C library regex, which aborts with
-  # REG_ILLSEQ when the subject contains an invalid byte sequence under a
-  # multibyte locale (e.g. a filename with non-UTF-8 bytes in `git status`
-  # output). Forcing the C locale makes every byte a valid character, so the
-  # regex matching below never fails that way. `git status --porcelain` is
-  # locale-independent, so this does not change the parsed output.
+# Match an extended regular expression against a subject, forcing the C locale
+# only for the duration of the call.
+#
+# OHMYZSH-13330: zsh's "=~" operator delegates to the C library regex, which
+# aborts with REG_ILLSEQ when the subject contains an invalid byte sequence
+# under a multibyte locale (e.g. a filename with non-UTF-8 bytes in `git
+# status` output). Forcing the C locale makes every byte a valid character,
+# so the regex matching never fails that way. `git status --porcelain` is
+# locale-independent, so this does not change the parsed output.
+#
+# OHMYZSH-13985: the locale must be scoped to this function and not set for
+# the whole caller. Assigning LC_ALL makes zsh re-run setlocale() right away,
+# so leaving it set while the rest of the caller runs breaks multibyte
+# handling there — most visibly, `echo` refuses to expand Unicode escapes in
+# theme prompt symbols ("character not in range").
+function _omz_git_prompt_status_match() {
   local -x LC_ALL=C
+  [[ "$1" =~ "$2" ]]
+}
 
+function _omz_git_prompt_status() {
   [[ "$(__git_prompt_git config --get oh-my-zsh.hide-status 2>/dev/null)" = 1 ]] && return
 
   # Maps a git status prefix to an internal constant
@@ -113,11 +124,11 @@ function _omz_git_prompt_status() {
   status_lines=("${(@f)${status_text}}")
 
   # If the tracking line exists, get and parse it
-  if [[ "$status_lines[1]" =~ "^## [^ ]+ \[(.*)\]" ]]; then
+  if _omz_git_prompt_status_match "$status_lines[1]" "^## [^ ]+ \[(.*)\]"; then
     local branch_statuses
     branch_statuses=("${(@s/,/)match}")
     for branch_status in $branch_statuses; do
-      if [[ ! $branch_status =~ "(behind|diverged|ahead) ([0-9]+)?" ]]; then
+      if ! _omz_git_prompt_status_match "$branch_status" "(behind|diverged|ahead) ([0-9]+)?"; then
         continue
       fi
       local last_parsed_status=$prefix_constant_map[$match[1]]
@@ -130,7 +141,7 @@ function _omz_git_prompt_status() {
     local status_constant="${prefix_constant_map[$status_prefix]}"
     local status_regex=$'(^|\n)'"$status_prefix"
 
-    if [[ "$status_text" =~ $status_regex ]]; then
+    if _omz_git_prompt_status_match "$status_text" "$status_regex"; then
       statuses_seen[$status_constant]=1
     fi
   done

plugins/1password/1password.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_op" ]]; then
   _comps[op]=_op
 fi
 
-op completion zsh >| "$ZSH_CACHE_DIR/completions/_op" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_op"
+  zf_mv -f -- =( op completion zsh ) "$TMPPREFIX"
+} &|
 
 # Load opswd function
 autoload -Uz opswd

plugins/arduino-cli/arduino-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_arduino-cli" ]]; then
 fi
 
 # Generate and load arduino-cli completion
-arduino-cli completion zsh >! "$ZSH_CACHE_DIR/completions/_arduino-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_arduino-cli"
+  zf_mv -f -- =( arduino-cli completion zsh ) "$TMPPREFIX"
+} &|

plugins/argocd/argocd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_argocd" ]]; then
   _comps[argocd]=_argocd
 fi
 
-argocd completion zsh >| "$ZSH_CACHE_DIR/completions/_argocd" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_argocd"
+  zf_mv -f -- =( argocd completion zsh ) "$TMPPREFIX"
+} &|

plugins/asdf/asdf.plugin.zsh

@@ -12,4 +12,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_asdf" ]]; then
   autoload -Uz _asdf
   _comps[asdf]=_asdf
 fi
-asdf completion zsh >| "$ZSH_CACHE_DIR/completions/_asdf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_asdf"
+  zf_mv -f -- =( asdf completion zsh ) "$TMPPREFIX"
+} &|

plugins/buf/buf.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_buf" ]]; then
 fi
 
 # Generate and load buf completion
-buf completion zsh >! "$ZSH_CACHE_DIR/completions/_buf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_buf"
+  zf_mv -f -- =( buf completion zsh ) "$TMPPREFIX"
+} &|

plugins/bun/bun.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_bun" ]]; then
   _comps[bun]=_bun
 fi
 
-SHELL=zsh bun completions >| "$ZSH_CACHE_DIR/completions/_bun" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_bun"
+  zf_mv -f -- =( SHELL=zsh bun completions ) "$TMPPREFIX"
+} &|

plugins/charm/charm.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_charm" ]]; then
   _comps[charm]=_charm
 fi
 
-charm completion zsh >| "$ZSH_CACHE_DIR/completions/_charm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_charm"
+  zf_mv -f -- =( charm completion zsh ) "$TMPPREFIX"
+} &|

plugins/chezmoi/chezmoi.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_chezmoi" ]]; then
   _comps[chezmoi]=_chezmoi
 fi
 
-chezmoi completion zsh >| "$ZSH_CACHE_DIR/completions/_chezmoi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_chezmoi"
+  zf_mv -f -- =( chezmoi completion zsh ) "$TMPPREFIX"
+} &|

plugins/codex/codex.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_codex" ]]; then
   _comps[codex]=_codex
 fi
 
-codex completion zsh < /dev/null 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_codex" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_codex"
+  zf_mv -f -- =( codex completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|

plugins/deno/deno.plugin.zsh

@@ -25,4 +25,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_deno" ]]; then
   _comps[deno]=_deno
 fi
 
-deno completions zsh >| "$ZSH_CACHE_DIR/completions/_deno" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_deno"
+  zf_mv -f -- =( deno completions zsh ) "$TMPPREFIX"
+} &|

plugins/docker-compose/README.md

@@ -2,7 +2,7 @@
 
 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
-This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+This plugin chooses automatically between the legacy `docker-compose` command and the modern
 `docker compose` subcommand, preferring `docker-compose` when both are available.
 
 To use it, add docker-compose to the plugins array of your zshrc file:
@@ -17,6 +17,7 @@ plugins=(... docker-compose)
 |-----------|----------------------------------|----------------------------------------------------------------------------------|
 | dco       | `docker-compose`                 | Docker-compose main command                                                      |
 | dcb       | `docker-compose build`           | Build containers                                                                 |
+| dcc       | `docker-compose config`                 | Parse, resolve and render compose file in canonical format |
 | dce       | `docker-compose exec`            | Execute command inside a container                                               |
 | dcps      | `docker-compose ps`              | List containers                                                                  |
 | dcrestart | `docker-compose restart`         | Restart container                                                                |

plugins/docker-compose/docker-compose.plugin.zsh

@@ -6,6 +6,7 @@
 
 alias dco="$dccmd"
 alias dcb="$dccmd build"
+alias dcc="$dccmd config"
 alias dce="$dccmd exec"
 alias dcps="$dccmd ps"
 alias dcrestart="$dccmd restart"

plugins/docker/docker.plugin.zsh

@@ -56,14 +56,19 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_docker" ]]; then
   _comps[docker]=_docker
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+
+  local plugin_dir="$1"
+
   # `docker completion` is only available from 23.0.0 on
   # docker version returns `Docker version 24.0.2, build cb74dfcd85`
   # with `s:,:` remove the comma after the version, and select third word of it
   if zstyle -t ':omz:plugins:docker' legacy-completion || \
     ! is-at-least 23.0.0 ${${(s:,:z)"$(command docker --version)"}[3]}; then
-        command cp "${0:h}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
+        command cp "${plugin_dir}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
       else
-        command docker completion zsh | tee "$ZSH_CACHE_DIR/completions/_docker" > /dev/null
+        local TMPPREFIX="$ZSH_CACHE_DIR/completions/_docker"
+        zf_mv -f -- =( command docker completion zsh ) "$TMPPREFIX"
   fi
-} &|
+} "${0:A:h}" &|

plugins/doctl/doctl.plugin.zsh

@@ -14,4 +14,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_doctl" ]]; then
   _comps[doctl]=_doctl
 fi
 
-doctl completion zsh >| "$ZSH_CACHE_DIR/completions/_doctl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_doctl"
+  zf_mv -f -- =( doctl completion zsh ) "$TMPPREFIX"
+} &|

plugins/eza/eza.plugin.zsh

@@ -52,8 +52,13 @@ function _configure_eza() {
   if [[ $_val ]]; then
     _EZA_TAIL+=("--time-style='$_val'")
   fi
-  if zstyle -t ":omz:plugins:eza" "hyperlink"; then
-    _EZA_TAIL+=("--hyperlink")
+  if zstyle -t ':omz:plugins:eza' 'hyperlink'; then
+    # eza >= 0.23 needs an explicit WHEN value
+    if command eza --hyperlink=auto --version &>/dev/null; then
+      _EZA_TAIL+=("--hyperlink=auto")
+    else
+      _EZA_TAIL+=("--hyperlink")
+    fi
   fi
 }
 

plugins/flutter/flutter.plugin.zsh

@@ -30,4 +30,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
   _comps[flutter]=_flutter
 fi
 
-flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flutter"
+  zf_mv -f -- =( flutter zsh-completion < /dev/null ) "$TMPPREFIX"
+} &|

plugins/fluxcd/fluxcd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flux" ]]; then
   _comps[flux]=_flux
 fi
 
-flux completion zsh >| "$ZSH_CACHE_DIR/completions/_flux" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flux"
+  zf_mv -f -- =( flux completion zsh ) "$TMPPREFIX"
+} &|

plugins/fnm/fnm.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_fnm" ]]; then
   _comps[fnm]=_fnm
 fi
 
-fnm completions --shell=zsh >| "$ZSH_CACHE_DIR/completions/_fnm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_fnm"
+  zf_mv -f -- =( fnm completions --shell=zsh ) "$TMPPREFIX"
+} &|
 
 if zstyle -t ':omz:plugins:fnm' autostart; then
   local -a fnm_env_cmd

plugins/gh/gh.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_gh" ]]; then
   _comps[gh]=_gh
 fi
 
-gh completion --shell zsh >| "$ZSH_CACHE_DIR/completions/_gh" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gh"
+  zf_mv -f -- =( gh completion --shell zsh ) "$TMPPREFIX"
+} &|

plugins/git/git.plugin.zsh

@@ -137,8 +137,9 @@ function gbda() {
 # Copied and modified from James Roeder (jmaroeder) under MIT License
 # https://github.com/jmaroeder/plugin-git/blob/216723ef4f9e8dde399661c39c80bdf73f4076c4/functions/gbda.fish
 function gbds() {
-  local default_branch=$(git_main_branch)
-  (( ! $? )) || default_branch=$(git_develop_branch)
+  local default_branch
+  default_branch=$(git_main_branch) \
+    || default_branch=$(git_develop_branch)
 
   git for-each-ref refs/heads/ "--format=%(refname:short)" | \
     while read branch; do

plugins/hasura/hasura.plugin.zsh

@@ -9,5 +9,9 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hasura" ]]; then
   source "$ZSH_CACHE_DIR/completions/_hasura"
 else
   source "$ZSH_CACHE_DIR/completions/_hasura"
-  hasura completion zsh --file "$ZSH_CACHE_DIR/completions/_hasura" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hasura"
+    zf_mv -f -- =( hasura completion zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/hcloud/hcloud.plugin.zsh

@@ -13,7 +13,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hcloud" ]]; then
   _comps[hcloud]=_hcloud
 fi
 
-hcloud completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_hcloud" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hcloud"
+  zf_mv -f -- =( hcloud completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # Main alias
 alias hc='hcloud'

plugins/helm/helm.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_helm" ]]; then
   source "$ZSH_CACHE_DIR/completions/_helm"
 else
   source "$ZSH_CACHE_DIR/completions/_helm"
-  helm completion zsh | tee "$ZSH_CACHE_DIR/completions/_helm" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_helm"
+    zf_mv -f -- =( helm completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 alias h='helm'

plugins/jj/jj.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_jj" ]]; then
   _comps[jj]=_jj
 fi
 
-COMPLETE=zsh jj >| "$ZSH_CACHE_DIR/completions/_jj" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_jj"
+  zf_mv -f -- =( COMPLETE=zsh jj ) "$TMPPREFIX"
+} &|
 
 function __jj_prompt_jj() {
   local -a flags
@@ -72,4 +76,3 @@ alias jjsq='jj squash'
 alias jjst='jj status'
 alias jjwa='jj workspace add'
 alias jjwf='jj workspace forget'
-

plugins/k9s/k9s.plugin.zsh

@@ -11,4 +11,8 @@ fi
 
 # and then generate it in the background. On first completion,
 # the actual completion file will be loaded.
-k9s completion zsh >| "$ZSH_CACHE_DIR/completions/_k9s" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_k9s"
+  zf_mv -f -- =( k9s completion zsh ) "$TMPPREFIX"
+} &|

plugins/kind/kind.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kind" ]]; then
 fi
 
 # Generate and load kind completion
-kind completion zsh >! "$ZSH_CACHE_DIR/completions/_kind" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kind"
+  zf_mv -f -- =( kind completion zsh ) "$TMPPREFIX"
+} &|
 
 # Register aliases
 alias kicc="kind create cluster"

plugins/kubectl/kubectl.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kubectl" ]]; then
   _comps[kubectl]=_kubectl
 fi
 
-kubectl completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_kubectl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kubectl"
+  zf_mv -f -- =( kubectl completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # This command is used a LOT both below and in daily life
 alias k=kubectl

plugins/kubectx/README.md

@@ -22,6 +22,21 @@ RPS1='$(kubectx_prompt_info)'
 PROMPT="$PROMPT"'$(kubectx_prompt_info)'
 ```
 
+The context is loaded asynchronously on supported versions of zsh so that
+`kubectl` does not block the prompt. To restore synchronous behavior, add this
+before Oh My Zsh is sourced:
+
+```zsh
+zstyle ':omz:alpha:plugins:kubectx' async-prompt no
+```
+
+If your theme calls `kubectx_prompt_info` indirectly through another function,
+force registration of the async handler instead:
+
+```zsh
+zstyle ':omz:alpha:plugins:kubectx' async-prompt force
+```
+
 ### Custom context names
 
 You can rename the default context name for better readability or additional formatting.

plugins/kubectx/kubectx.plugin.zsh

@@ -1,6 +1,6 @@
 typeset -g -A kubectx_mapping
 
-function kubectx_prompt_info() {
+function _omz_kubectx_prompt_info() {
   (( $+commands[kubectl] )) || return
 
   local current_ctx=$(kubectl config current-context 2> /dev/null)
@@ -13,3 +13,34 @@ function kubectx_prompt_info() {
   # the context name, as it could contain a % character.
   echo "${kubectx_mapping[$current_ctx]:-${current_ctx:gs/%/%%}}"
 }
+
+function kubectx_prompt_info() {
+  if (( ${+_OMZ_ASYNC_OUTPUT} )) \
+    && [[ -n "${_OMZ_ASYNC_OUTPUT[_omz_kubectx_prompt_info]-}" ]]; then
+    echo -n "${_OMZ_ASYNC_OUTPUT[_omz_kubectx_prompt_info]}"
+  fi
+}
+
+local _style
+if zstyle -t ':omz:alpha:plugins:kubectx' async-prompt \
+  || { is-at-least 5.0.6 && zstyle -T ':omz:alpha:plugins:kubectx' async-prompt }; then
+  function _defer_async_kubectx_register() {
+    case "${PS1}:${PS2}:${PS3}:${PS4}:${RPROMPT-}:${RPS1-}:${RPS2-}:${RPS3-}:${RPS4-}" in
+    *(\$\(kubectx_prompt_info\)|\`kubectx_prompt_info\`)*)
+      _omz_register_handler _omz_kubectx_prompt_info
+      ;;
+    esac
+
+    add-zsh-hook -d precmd _defer_async_kubectx_register
+    unset -f _defer_async_kubectx_register
+  }
+
+  autoload -Uz add-zsh-hook
+  precmd_functions=(_defer_async_kubectx_register $precmd_functions)
+elif zstyle -s ':omz:alpha:plugins:kubectx' async-prompt _style && [[ $_style == "force" ]]; then
+  _omz_register_handler _omz_kubectx_prompt_info
+else
+  function kubectx_prompt_info() {
+    _omz_kubectx_prompt_info
+  }
+fi

plugins/laravel/README.md

@@ -10,6 +10,7 @@ plugins=(... laravel)
 |:-:|:-:|
 | `artisan`  | `php artisan`  |
 | `pas`  | `php artisan serve` |
+| `pad`  | `php artisan dev` |
 | `pats`  | `php artisan test` |
 
 ## Database

plugins/laravel/laravel.plugin.zsh

@@ -4,6 +4,7 @@ alias bob='php artisan bob::build'
 
 # Development
 alias pas='php artisan serve'
+alias pad='php artisan dev'
 alias pats='php artisan test'
 
 # Database

plugins/minikube/minikube.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_minikube" ]]; then
   _comps[minikube]=_minikube
 fi
 
-minikube completion zsh >| "$ZSH_CACHE_DIR/completions/_minikube" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_minikube"
+  zf_mv -f -- =( minikube completion zsh ) "$TMPPREFIX"
+} &|

plugins/mise/mise.plugin.zsh

@@ -1,9 +1,14 @@
-if (( ! $+commands[mise] )); then
+if (( $+commands[mise] )); then
+  _mise_bin=mise
+elif [[ -x ~/.local/bin/mise ]]; then
+  _mise_bin=~/.local/bin/mise
+else
   return
 fi
 
 # Load mise hooks
-eval "$(mise activate zsh)"
+eval "$($_mise_bin activate zsh)"
+unset _mise_bin
 
 # If the completion file doesn't exist yet, we need to autoload it and
 # bind it to `mise`. Otherwise, compinit will have already done that.
@@ -14,4 +19,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_mise" ]]; then
 fi
 
 # Generate and load mise completion
-mise completion zsh >| "$ZSH_CACHE_DIR/completions/_mise" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_mise"
+  zf_mv -f -- =( mise completion zsh ) "$TMPPREFIX"
+} &|

plugins/molecule/molecule.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_molecule" ]]; then
   _comps[molecule]=_molecule
 fi
 
-_MOLECULE_COMPLETE=zsh_source molecule >| "$ZSH_CACHE_DIR/completions/_molecule" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_molecule"
+  zf_mv -f -- =( _MOLECULE_COMPLETE=zsh_source molecule ) "$TMPPREFIX"
+} &|
 
 # Alias
 # molecule: https://docs.ansible.com/projects/molecule/

plugins/mongo-atlas/mongo-atlas.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_atlas" ]]; then
   _comps[atlas]=_atlas
 fi
 
-atlas completion zsh >| "$ZSH_CACHE_DIR/completions/atlas" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_atlas"
+  zf_mv -f -- =( atlas completion zsh ) "$TMPPREFIX"
+} &|

plugins/nats/nats.plugin.zsh

@@ -7,7 +7,11 @@ if (( $+commands[nsc] )); then
     _comps[nsc]=_nsc
   fi
 
-  nsc completion zsh >| "$ZSH_CACHE_DIR/completions/_nsc" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nsc"
+    zf_mv -f -- =( nsc completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 if (( $+commands[nats] )); then
@@ -19,5 +23,9 @@ if (( $+commands[nats] )); then
     _comps[nats]=_nats
   fi
 
-  nats --completion-script-zsh >| "$ZSH_CACHE_DIR/completions/_nats" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nats"
+    zf_mv -f -- =( nats --completion-script-zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/ngrok/ngrok.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_ngrok" ]]; then
   _comps[ngrok]=_ngrok
 fi
 
-ngrok completion zsh >| "$ZSH_CACHE_DIR/completions/_ngrok" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_ngrok"
+  zf_mv -f -- =( ngrok completion zsh ) "$TMPPREFIX"
+} &|

plugins/pass-cli/pass-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pass-cli" ]]; then
   _comps[pass-cli]=_pass-cli
 fi
 
-pass-cli completions zsh >| "$ZSH_CACHE_DIR/completions/_pass-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pass-cli"
+  zf_mv -f -- =( pass-cli completions zsh ) "$TMPPREFIX"
+} &|

plugins/pipenv/pipenv.plugin.zsh

@@ -43,7 +43,11 @@ else
     _comps[pipenv]=_pipenv
   fi
 
-  _PIPENV_COMPLETE=zsh_source pipenv >| "$ZSH_CACHE_DIR/completions/_pipenv" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pipenv"
+    zf_mv -f -- =( _PIPENV_COMPLETE=zsh_source pipenv ) "$TMPPREFIX"
+  } &|
 fi
 
 if zstyle -T ':omz:plugins:pipenv' auto-shell; then

plugins/podman/podman.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_podman" ]]; then
   _comps[podman]=_podman
 fi
 
-podman completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_podman" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_podman"
+  zf_mv -f -- =( podman completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 alias pbl='podman build'
 alias pcin='podman container inspect'

plugins/poetry/poetry.plugin.zsh

@@ -39,4 +39,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_poetry" ]]; then
   _comps[poetry]=_poetry
 fi
 
-poetry completions zsh >| "$ZSH_CACHE_DIR/completions/_poetry" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_poetry"
+  zf_mv -f -- =( poetry completions zsh ) "$TMPPREFIX"
+} &|

plugins/procs/procs.plugin.zsh

@@ -10,12 +10,16 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_procs" ]]; then
   _comps[procs]=_procs
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_procs"
   autoload -Uz is-at-least
   local _version=$(procs --version)
-  if is-at-least "0.14" "${_version#procs }"; then
-    procs --gen-completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  else
-    procs --completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  fi
+  zf_mv -f -- =(
+    if is-at-least "0.14" "${_version#procs }"; then
+      procs --gen-completion-out zsh
+    else
+      procs --completion-out zsh
+    fi
+  ) "$TMPPREFIX"
 } &|

plugins/pulumi/pulumi.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pulumi" ]]; then
   _comps[pulumi]=_pulumi
 fi
 
-pulumi gen-completion zsh >| "$ZSH_CACHE_DIR/completions/_pulumi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pulumi"
+  zf_mv -f -- =( pulumi gen-completion zsh ) "$TMPPREFIX"
+} &|
 
 # Aliases
 alias pul='pulumi'

plugins/qodana/qodana.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_qodana" ]]; then
   _comps[qodana]=_qodana
 fi
 
-qodana completion zsh >| "$ZSH_CACHE_DIR/completions/_qodana" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_qodana"
+  zf_mv -f -- =( qodana completion zsh ) "$TMPPREFIX"
+} &|

plugins/rails/README.md

@@ -54,6 +54,33 @@ plugins=(... rails)
 | `rta`   | `rails test:all`                 | Runs all Rails tests, including system tests           |
 | `ru`    | `rails runner`                   | Run Ruby code in the context of Rails                  |
 
+### Multiple databases
+
+Rails applications can define more than one database (`primary`, `cache`, `cable`,
+`queue`, ...), and each one gets its own namespaced task. These commands accept an
+optional database name as the first argument:
+
+`rdc`, `rdd`, `rdm`, `rdmd`, `rdmr`, `rdms`, `rdmu`, `rdr`, `rdrs`, `rdsl`
+
+```zsh
+rdm                    # rails db:migrate
+rdm cache              # rails db:migrate:cache
+rdm VERSION=20231225   # rails db:migrate VERSION=20231225
+rdm cache STEP=2       # rails db:migrate:cache STEP=2
+rdm --trace            # rails db:migrate --trace
+```
+
+The first argument is read as a database name only when it is a bare word. Flags
+(`--trace`), variables (`STEP=2`) and other tasks (`db:seed`) are passed through to
+`rails` unchanged, so previous usage keeps working. When a database name is given,
+the resolved command is printed so it is clear which database is being used.
+
+`rdmrs` is not in the list above because Rails does not define a per-database
+`db:migrate:reset` task.
+
+Note that these are implemented as shell functions rather than aliases, so they will
+not appear in the output of `alias`.
+
 ### Foreman
 
 | Alias  | Command         | Description                               |

plugins/rails/rails.plugin.zsh

@@ -47,19 +47,9 @@ alias rc='rails console'
 alias rcs='rails console --sandbox'
 alias rd='rails destroy'
 alias rdb='rails dbconsole'
-alias rdc='rails db:create'
-alias rdd='rails db:drop'
-alias rdm='rails db:migrate'
-alias rdmd='rails db:migrate:down'
-alias rdmr='rails db:migrate:redo'
 alias rdmrs='rails db:migrate:reset'
-alias rdms='rails db:migrate:status'
 alias rdmtc='rails db:migrate db:test:clone'
-alias rdmu='rails db:migrate:up'
-alias rdr='rails db:rollback'
-alias rdrs='rails db:reset'
 alias rds='rails db:seed'
-alias rdsl='rails db:schema:load'
 alias rdtc='rails db:test:clone'
 alias rdtp='rails db:test:prepare'
 alias rgen='rails generate'
@@ -106,6 +96,47 @@ alias rkn='rake notes'
 alias rksts='rake stats'
 alias rkt='rake test'
 
+# Database tasks
+#
+# Rails applications can define more than one database (primary, cache, cable,
+# queue, ...). Each one gets its own namespaced task, e.g. `db:migrate:cache`.
+# The functions below take an optional database name as the first argument:
+#
+#   rdm                    ->  rails db:migrate
+#   rdm cache              ->  rails db:migrate:cache
+#   rdm VERSION=20231225   ->  rails db:migrate VERSION=20231225
+#   rdm cache STEP=2       ->  rails db:migrate:cache STEP=2
+#   rdm --trace            ->  rails db:migrate --trace
+#
+# The first argument is read as a database name only when it is a bare word.
+# Flags (--trace), variables (STEP=2) and other tasks (db:seed) are passed
+# through to rails untouched, so the previous alias behavior still works.
+function _rails_db_command() {
+  local task="$1"
+  shift
+
+  if [[ $# -gt 0 && "$1" != -* && "$1" != *=* && "$1" != *:* ]]; then
+    task="$task:$1"
+    shift
+    # Echo the resolved task so it is clear which database is being used
+    local -a cmd=(rails "$task" "$@")
+    print -u2 -r -- "Running: ${cmd[*]}"
+  fi
+
+  rails "$task" "$@"
+}
+
+function rdc()  { _rails_db_command db:create "$@" }
+function rdd()  { _rails_db_command db:drop "$@" }
+function rdm()  { _rails_db_command db:migrate "$@" }
+function rdmd() { _rails_db_command db:migrate:down "$@" }
+function rdmr() { _rails_db_command db:migrate:redo "$@" }
+function rdms() { _rails_db_command db:migrate:status "$@" }
+function rdmu() { _rails_db_command db:migrate:up "$@" }
+function rdr()  { _rails_db_command db:rollback "$@" }
+function rdrs() { _rails_db_command db:reset "$@" }
+function rdsl() { _rails_db_command db:schema:load "$@" }
+
 # legacy stuff
 alias sc='ruby script/console'
 alias sd='ruby script/destroy'

plugins/rbw/rbw.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rbw" ]]; then
   _comps[rbw]=_rbw
 fi
 
-rbw gen-completions zsh >| "$ZSH_CACHE_DIR/completions/_rbw" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rbw"
+  zf_mv -f -- =( rbw gen-completions zsh ) "$TMPPREFIX"
+} &|
 
 # rbwpw function copies the password of a service to the clipboard
 # and clears it after 20 seconds

plugins/rclone/rclone.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rclone" ]]; then
   _comps[rclone]=_rclone
 fi
 
-rclone completion zsh - >| "$ZSH_CACHE_DIR/completions/_rclone" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rclone"
+  zf_mv -f -- =( rclone completion zsh - ) "$TMPPREFIX"
+} &|

plugins/rust/rust.plugin.zsh

@@ -19,7 +19,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rustup" ]]; then
 fi
 
 # Generate completion files in the background
-rustup completions zsh >| "$ZSH_CACHE_DIR/completions/_rustup" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rustup"
+  zf_mv -f -- =( rustup completions zsh ) "$TMPPREFIX"
+} &|
 cat >| "$ZSH_CACHE_DIR/completions/_cargo" <<'EOF'
 #compdef cargo
 source "$(rustup run ${${(z)$(rustup default)}[1]} rustc --print sysroot)"/share/zsh/site-functions/_cargo

plugins/shopify/README.md

@@ -0,0 +1,112 @@
+# Shopify CLI plugin
+
+This plugin adds aliases, helper functions and completion for the
+[Shopify CLI](https://shopify.dev/docs/api/shopify-cli).
+
+To use it, add `shopify` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... shopify)
+```
+
+## Requirements
+
+[Shopify CLI](https://shopify.dev/docs/api/shopify-cli) 4.0 or newer, installed
+and on your `PATH`. The plugin does nothing if it is not:
+
+```zsh
+npm install -g @shopify/cli
+# or
+brew tap shopify/shopify && brew install shopify-cli
+```
+
+## Aliases
+
+| Alias  | Command   | Description            |
+| :----- | :-------- | :--------------------- |
+| `shop` | `shopify` | The Shopify CLI itself |
+
+## Functions
+
+| Function       | Description                                                                        |
+| :------------- | :--------------------------------------------------------------------------------- |
+| `shopd`        | Runs `theme dev`, `app dev` or `hydrogen dev`, whichever fits the current project   |
+| `shopi`        | Shows what the current project is connected to                                      |
+| `shopify_here` | Prints the kind of Shopify project you are in and the commands worth running in it  |
+| `shopify`      | Wraps the CLI to confirm before irreversible commands. See Settings                 |
+
+`shopd` and `shopi` work out which topic applies by looking at the project you
+are standing in, so you do not have to remember whether this directory is a
+theme, an app or a Hydrogen storefront. They complete like the command they
+stand in for, so in a theme `shopd --<TAB>` offers the flags of
+`shopify theme dev`.
+
+## Completion
+
+Every command completes with a description of what it does, at every level, and
+so do their flags, short forms and allowed values. `--environment` completes
+from the `[environments.*]` sections of your local `shopify.theme.toml` or
+`shopify.app.toml`.
+
+The Shopify CLI ships no completion generator of its own, so `_shopify` is
+generated from `shopify commands --json` and kept in this repository. It targets
+Shopify CLI 4.x.
+
+## Settings
+
+Set these with `zstyle` in your zshrc, before Oh My Zsh is sourced.
+
+### Confirming destructive commands
+
+```zsh
+zstyle ':omz:plugins:shopify' confirm-destructive no
+```
+
+By default the plugin asks for confirmation before three irreversible
+operations:
+
+- `shopify theme push` with `--live`/`-l` or `--publish`/`-p`, which overwrites
+  or publishes the live storefront
+- `shopify theme delete`, which the CLI's own help describes as impossible to
+  undo
+- `shopify app deploy --allow-deletes`, which can permanently remove extensions
+
+Nothing else is intercepted, and the prompt is skipped when the command already
+carries `--force`/`-f` or when stdin is not a terminal, so scripts, pipelines
+and CI are unaffected. Set the style to `no` to turn the prompt off entirely.
+
+### Completing theme IDs
+
+```zsh
+zstyle ':omz:plugins:shopify' dynamic-theme-completion yes
+```
+
+Off by default. When enabled, `--theme` is completed from
+`shopify theme list --json`, showing each theme's name and role next to its ID
+instead of making you copy IDs by hand. It is opt-in because it runs the CLI and
+makes a network call when you press <kbd>Tab</kbd>, and because it needs you to
+be authenticated. Results are cached for five minutes.
+
+### Disabling the aliases
+
+This works for every Oh My Zsh plugin:
+
+```zsh
+zstyle ':omz:plugins:shopify' aliases no
+```
+
+## Caveats
+
+- `shopify` is a shell function here. Run `command shopify` to reach the binary
+  directly.
+- When a project has its own copy of the CLI in `node_modules/.bin/shopify`,
+  that one is used in preference to the global install. App and Hydrogen
+  projects normally pin the CLI in `package.json`, and running a different
+  global version against them is a common source of confusing errors.
+- `--password` and `--store-password` are unrelated, and you often need both.
+  `--password` is the CLI's own authentication token, from the Theme Access app
+  or the Admin API. `--store-password` is the password for a
+  password-protected storefront.
+- `shopify theme push` deletes remote files that are missing locally, and
+  `shopify theme pull` deletes local files that are missing remotely, unless you
+  pass `--nodelete`/`-n`. The plugin does not prompt for these.

plugins/shopify/shopify.plugin.zsh

@@ -0,0 +1,204 @@
+# Shopify CLI: completion, aliases and guard rails.
+# https://shopify.dev/docs/api/shopify-cli
+
+if (( ! $+commands[shopify] )); then
+  return
+fi
+
+# Prefer a project-local CLI: app and Hydrogen projects pin their own version.
+# The walk stops at $HOME so a stray ~/node_modules cannot hijack every project.
+# $commands avoids resolving back to the wrapper function below.
+function _shopify_bin() {
+  local dir="$PWD"
+  while [[ -n "$dir" && "$dir" != "/" && "$dir" != "$HOME" ]]; do
+    if [[ -x "$dir/node_modules/.bin/shopify" ]]; then
+      print -r -- "$dir/node_modules/.bin/shopify"
+      return 0
+    fi
+    dir="${dir:h}"
+  done
+  print -r -- "$commands[shopify]"
+}
+
+# Print the project type in $PWD: hydrogen, app or theme.
+# Hydrogen is tested first because those projects usually carry a
+# shopify.app.toml too. shopify.theme.toml is not a theme marker: it only
+# exists once environments are configured.
+function _shopify_project_type() {
+  local dir="$PWD"
+  local -a app_config
+
+  while [[ -n "$dir" && "$dir" != "/" && "$dir" != "$HOME" ]]; do
+    if [[ -x "$dir/node_modules/.bin/h2" ]] ||
+      [[ -f "$dir/package.json" && "$(<"$dir/package.json")" == *'"@shopify/hydrogen"'* ]]; then
+      print -r -- hydrogen
+      return 0
+    fi
+
+    app_config=("$dir"/shopify.app*.toml(N))
+    if (( $#app_config )); then
+      print -r -- app
+      return 0
+    fi
+
+    if [[ -f "$dir/config/settings_schema.json" && -f "$dir/layout/theme.liquid" ]]; then
+      print -r -- theme
+      return 0
+    fi
+
+    dir="${dir:h}"
+  done
+
+  return 1
+}
+
+# Does this invocation need confirming? Sets REPLY to the reason.
+function _shopify_is_destructive() {
+  zstyle -T ':omz:plugins:shopify' confirm-destructive || return 1
+
+  # Nobody to answer: CI and pipelines are unaffected.
+  [[ -t 0 ]] || return 1
+
+  local topic="$1" subcommand="$2" arg
+  local -a long
+  local short=""
+
+  # Short flags can be bundled, so collect them as characters: -al counts as l.
+  for arg in "${@[3,-1]}"; do
+    [[ "$arg" == "--" ]] && break
+    case "$arg" in
+      --*) long+=("${arg%%=*}") ;;
+      -?*) short+="${${arg%%=*}#-}" ;;
+    esac
+  done
+
+  # An explicit force flag states the intent already.
+  if (( long[(I)--force] )) || [[ "$short" == *f* ]]; then
+    return 1
+  fi
+
+  case "$topic $subcommand" in
+    "theme push")
+      if (( long[(I)--live] || long[(I)--publish] )) || [[ "$short" == *[lp]* ]]; then
+        REPLY="this overwrites or publishes the live theme on the storefront."
+        return 0
+      fi
+      ;;
+    "theme delete")
+      REPLY="deleting a theme cannot be undone."
+      return 0
+      ;;
+    "app deploy")
+      if (( long[(I)--allow-deletes] )); then
+        REPLY="this can permanently remove app extensions."
+        return 0
+      fi
+      ;;
+  esac
+
+  return 1
+}
+
+# Adds a confirmation prompt before irreversible operations. Everything else
+# passes straight through, so `theme dev` stays interactive and pipes stay clean.
+function shopify() {
+  local REPLY
+  if _shopify_is_destructive "$@"; then
+    print -u2 -- "shopify: $REPLY"
+    if ! read -q "?Continue? [y/N] "; then
+      print -u2 -- ""
+      return 130
+    fi
+    print -u2 -- ""
+  fi
+
+  "$(_shopify_bin)" "$@"
+}
+
+# Print the commands worth running in the current directory.
+function shopify_here() {
+  local project_type
+  project_type="$(_shopify_project_type)"
+
+  case "$project_type" in
+    theme)
+      print -- "Shopify theme project."
+      print -- "  shopify theme dev     Preview locally with live reload"
+      print -- "  shopify theme check   Lint the theme"
+      print -- "  shopify theme list    List the themes on the store"
+      print -- "  shopify theme pull    Download a remote theme into this folder"
+      print -- "  shopify theme push    Upload this folder to a remote theme"
+      ;;
+    app)
+      print -- "Shopify app project."
+      print -- "  shopify app dev       Run the app against a development store"
+      print -- "  shopify app info      Show how the app is configured"
+      print -- "  shopify app deploy    Deploy the app and its extensions"
+      print -- "  shopify app logs      Stream app logs"
+      ;;
+    hydrogen)
+      print -- "Hydrogen storefront."
+      print -- "  shopify hydrogen dev      Run the storefront locally"
+      print -- "  shopify hydrogen build    Build for production"
+      print -- "  shopify hydrogen deploy   Deploy to Oxygen"
+      print -- "  shopify hydrogen link     Link this project to a storefront"
+      ;;
+    *)
+      print -- "No Shopify project found here."
+      print -- "  shopify theme init      Start a new theme"
+      print -- "  shopify app init        Start a new app"
+      print -- "  shopify hydrogen init   Start a new Hydrogen storefront"
+      ;;
+  esac
+}
+
+# Run the dev server for whichever kind of project this is.
+function shopd() {
+  local project_type
+  if ! project_type="$(_shopify_project_type)"; then
+    print -u2 -- "shopd: not inside a Shopify theme, app or Hydrogen project."
+    return 1
+  fi
+  shopify "$project_type" dev "$@"
+}
+
+# Show what the current project is connected to.
+function shopi() {
+  local project_type
+  if ! project_type="$(_shopify_project_type)"; then
+    print -u2 -- "shopi: not inside a Shopify theme, app or Hydrogen project."
+    return 1
+  fi
+  case "$project_type" in
+    hydrogen) shopify hydrogen list "$@" ;;
+    *) shopify "$project_type" info "$@" ;;
+  esac
+}
+
+# Complete the helpers like the commands they stand in for.
+if (( $+functions[compdef] )); then
+  _shopd() {
+    local project_type
+    project_type="$(_shopify_project_type)" || return 1
+    words=(shopify "$project_type" dev ${words[2,-1]})
+    (( CURRENT += 2 ))
+    _shopify
+  }
+
+  _shopi() {
+    local project_type
+    project_type="$(_shopify_project_type)" || return 1
+    if [[ "$project_type" == hydrogen ]]; then
+      words=(shopify hydrogen list ${words[2,-1]})
+    else
+      words=(shopify "$project_type" info ${words[2,-1]})
+    fi
+    (( CURRENT += 2 ))
+    _shopify
+  }
+
+  compdef _shopd shopd
+  compdef _shopi shopi
+fi
+
+alias shop='shopify'

plugins/sigstore/sigstore.plugin.zsh

@@ -12,7 +12,11 @@ function install_autocompletion {
     _comps[$1]=_$1
   fi
 
-  $1 completion zsh >| "$ZSH_CACHE_DIR/completions/_$1" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_$1"
+    zf_mv -f -- =( $1 completion zsh ) "$TMPPREFIX"
+  } "$1" &|
 }
 
 install_autocompletion cosign

plugins/skaffold/skaffold.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_skaffold" ]]; then
   _comps[skaffold]=_skaffold
 fi
 
-skaffold completion zsh >| "$ZSH_CACHE_DIR/completions/_skaffold" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_skaffold"
+  zf_mv -f -- =( skaffold completion zsh ) "$TMPPREFIX"
+} &|

plugins/ssh-agent/ssh-agent.plugin.zsh

@@ -101,10 +101,18 @@ if zstyle -t :omz:plugins:ssh-agent agent-forwarding \
    && [[ -n "$SSH_AUTH_SOCK" ]]; then
   if [[ ! -L "$SSH_AUTH_SOCK" ]]; then
     if [[ -n "$TERMUX_VERSION" ]]; then
-      ln -sf "$SSH_AUTH_SOCK" "$PREFIX"/tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link="$PREFIX"/tmp/ssh-agent-$USERNAME-screen
     else
-      ln -sf "$SSH_AUTH_SOCK" /tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link=/tmp/ssh-agent-$USERNAME-screen
     fi
+    # `ln -sf` unlinks the old symlink and then creates the new one: two
+    # syscalls, no atomic swap. Shells starting concurrently (a tmux window
+    # opening several panes at once) interleave those steps and all but one
+    # fail with "ln: ...: File exists". Stage the link under a PID-unique
+    # name and move it into place, since rename(2) is atomic.
+    command ln -sf "$SSH_AUTH_SOCK" "$_omz_ssh_agent_link.$$" \
+      && command mv -f "$_omz_ssh_agent_link.$$" "$_omz_ssh_agent_link"
+    unset _omz_ssh_agent_link
   fi
 else
   _start_agent

plugins/stripe/stripe.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_stripe" ]]; then
   _comps[stripe]=_stripe
 fi
 
-stripe completion --shell zsh --write-to-stdout >| "$ZSH_CACHE_DIR/completions/_stripe" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_stripe"
+  zf_mv -f -- =( stripe completion --shell zsh --write-to-stdout ) "$TMPPREFIX"
+} &|

plugins/systemadmin/systemadmin.plugin.zsh

@@ -138,7 +138,7 @@ function consume100() {
 
 # Website traffic statistics (G)
 function webtraffic() {
-  awk "{sum+=$10} END {print sum/1024/1024/1024}" "$(retlog)"
+  awk '{sum+=$10} END {print sum/1024/1024/1024}' "$(retlog)"
 }
 
 # Statistical connections 404

plugins/tailscale/tailscale.plugin.zsh

@@ -22,4 +22,8 @@ if (( $+aliases[tailscale] )); then
   _comps[${aliases[tailscale]:t}]=_tailscale
 fi
 
-tailscale completion zsh >| "$ZSH_CACHE_DIR/completions/_tailscale" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_tailscale"
+  zf_mv -f -- =( tailscale completion zsh ) "$TMPPREFIX"
+} &|

plugins/task/task.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_task" ]]; then
 fi
 
 # Generate and load task completion
-task --completion zsh >! "$ZSH_CACHE_DIR/completions/_task" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_task"
+  zf_mv -f -- =( task --completion zsh ) "$TMPPREFIX"
+} &|

plugins/timoni/timoni.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_timoni" ]]; then
   _comps[timoni]=_timoni
 fi
 
-timoni completion zsh >| "$ZSH_CACHE_DIR/completions/_timoni" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_timoni"
+  zf_mv -f -- =( timoni completion zsh ) "$TMPPREFIX"
+} &|

plugins/uv/uv.plugin.zsh

@@ -43,5 +43,12 @@ fi
 
 # uv and uvx are installed together (uvx is an alias to `uv tool run`)  
 # Overwrites the file each time as completions might change with uv versions.
-uv generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uv" &|
-uvx --generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uvx" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uv"
+  zf_mv -f -- =( uv generate-shell-completion zsh ) "$TMPPREFIX"
+} &|
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uvx"
+  zf_mv -f -- =( uvx --generate-shell-completion zsh ) "$TMPPREFIX"
+} &|

plugins/volta/volta.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_volta" ]]; then
   _comps[volta]=_volta
 fi
 
-volta completions zsh >| "$ZSH_CACHE_DIR/completions/_volta" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_volta"
+  zf_mv -f -- =( volta completions zsh ) "$TMPPREFIX"
+} &|

plugins/z/MANUAL.md

@@ -2,20 +2,26 @@
 
 [![MIT License](img/mit_license.svg)](https://opensource.org/licenses/MIT)
 ![Zsh version 4.3.11 and higher](img/zsh_4.3.11_plus.svg)
+![Version](https://img.shields.io/github/v/release/agkozak/zsh-z)
+![Workflow Status](https://github.com/agkozak/zsh-z/actions/workflows/test.yml/badge.svg)
 [![GitHub stars](https://img.shields.io/github/stars/agkozak/zsh-z.svg)](https://github.com/agkozak/zsh-z/stargazers)
 
 ![Zsh-z demo](img/demo.gif)
 
 Zsh-z is a command-line tool that allows you to jump quickly to directories that you have visited frequently or recently -- but most often a combination of the two (a concept known as ["frecency"](https://en.wikipedia.org/wiki/Frecency)). It works by keeping track of when you go to directories and how much time you spend in them. Based on this data, it predicts where you want to go when you type a partial string. For example, `z src` might take you to `~/src/zsh`. `z zsh` might also get you there, and `z c/z` might prove to be even more specific -- it all depends on your habits and how long you have been using Zsh-z to build up a database. After using Zsh-z for a little while, you will get to where you want to be by typing considerably less than you would need to if you were using `cd`.
 
-Zsh-z is a native Zsh port of [`rupa/z`](https://github.com/rupa/z), a tool written for `bash` and Zsh that uses embedded `awk` scripts to do the heavy lifting. `rupa/z` was my most used command-line tool for a couple of years. I decided to translate it, `awk` parts and all, into pure Zsh script, to see if by eliminating calls to external tools (`awk`, `sort`, `date`, `sed`, `mv`, `rm`, and `chown`) and reducing forking through subshells I could make it faster. The performance increase is impressive, particularly on systems where forking is slow, such as Cygwin, MSYS2, and WSL. I have found that in those environments, switching directories using Zsh-z can be over 100% faster than it is using `rupa/z`.
+Zsh-z is a native Zsh port of [`rupa/z`](https://github.com/rupa/z), a tool written for `bash` and Zsh that uses embedded `awk` scripts to do the heavy lifting. `rupa/z` was my most used command-line tool for a couple of years. I decided to translate it, `awk` parts and all, into pure Zsh script, to see if by eliminating calls to external tools (`awk`, `sort`, `date`, `sed`, `mv`, `rm`, and `chown`) and reducing forking through subshells I could make it faster. The performance increase is impressive, particularly on systems where forking is slow, such as Cygwin, MSYS2, and WSL.
 
-There is also a significant stability improvement. Race conditions have always been a problem with `rupa/z`, and users of that utility occasionally lose their `~/.z` databases. By having Zsh-z only use Zsh (`rupa/z` uses a hybrid shell code standard that works on `bash` as well), I have been able to implement a `zsh/system`-based file-locking mechanism similar to [the one @mafredri once proposed for `rupa/z`](https://github.com/rupa/z/pull/199). It is now nearly impossible to crash the database.
+There is also a significant stability improvement. Race conditions have always been a problem with `rupa/z`, and users of that utility occasionally lose their `~/.z` databases. By having Zsh-z only use Zsh (`rupa/z` uses a hybrid shell code standard that works on `bash` as well), I have been able to implement a `zsh/system`-based file-locking mechanism. It is now nearly impossible to crash the database.
 
-There are other, smaller improvements which I document below in [Improvements and Fixes](#improvements-and-fixes). For instance, tab completions are now sorted by frecency by default rather than alphabetically (the latter behavior can be restored if you like it -- [see below](#settings)).
+There are other, smaller improvements which I document below in [Other Improvements to the Original Functionality of `rupa/z`](#other-improvements-to-the-original-functionality-of-rupaz). For instance, tab completions are now sorted by frecency by default rather than alphabetically (the latter behavior can be restored if you like it -- [see below](#settings)).
 
 Zsh-z is a drop-in replacement for `rupa/z` and will, by default, use the same database (`~/.z`, or whatever database file you specify), so you can go on using `rupa/z` when you launch `bash`.
 
+> ### Zsh-z v2.0
+>
+> **v2.0 is the most significant release in the project's history.** It is faster than ever at adding, searching, and listing on modern Zsh; it never makes your prompt wait on database writes -- on any platform; it hardens those writes against corruption and against prying eyes; and it makes tab completion "just work" even under `setopt COMPLETE_ALIASES`. See [**v2.0**](#v20) in the News below for the full rundown, and [Performance](#performance) for the benchmarks.
+
 ## Table of Contents
 - [News](#news)
 - [Installation](#installation)
@@ -23,16 +29,45 @@ Zsh-z is a drop-in replacement for `rupa/z` and will, by default, use the same d
 - [Settings](#settings)
 - [Case Sensitivity](#case-sensitivity)
 - [`ZSHZ_UNCOMMON`](#zshz_uncommon)
+- [`ZSHZ_OWNER`](#zshz_owner)
 - [Making `--add` work for you](#making---add-work-for-you)
-- [Other Improvements to the Original Functionality of `rupa/z`](#other-improvements-to-the-original-functionality-of-rupa-z)
+- [Performance](#performance)
+- [Other Improvements to the Original Functionality of `rupa/z`](#other-improvements-to-the-original-functionality-of-rupaz)
 - [Migrating from Other Tools](#migrating-from-other-tools)
 - [`COMPLETE_ALIASES`](#complete_aliases)
 
 ## News
 
-<details>
-    <summary>Here are the latest features and updates.</summary>
+### v2.0 (August 14, 2026)
 
+Version **2.0** is a major step forward, and these are the changes most worth knowing about:
+
+- **Zsh-z is even faster than before.** Version 2.0 builds on Zsh-z's past successes in optimizing adding to the datafile -- something it does at virtually every prompt -- by streamlining searching and listing, as well. See [Performance](#performance) for the numbers.
+- **Database writes never block your prompt** -- on any platform. The per-prompt `--add` has long run in the background on most systems, but Cygwin and MSYS2 did the write in the foreground, because backgrounding there cost a wrapper subshell plus a job. `--add` now runs as a single disowned job (`&!`) everywhere: one fork, no wrapper subshell, no job-control noise. On Cygwin and MSYS2 that turns a foreground write whose cost grows with your datafile (~30 ms at 300 entries, ~300 ms at 1,000) into a flat ~10-12 ms fork. Elsewhere it halves the forks per prompt.
+- **Safer, crash-resistant concurrent writes.** Writes are now guarded by a dedicated, stable lockfile using `zsh/system` file locking, with a bounded wait for lock acquisition (the new [`ZSHZ_LOCK_TIMEOUT`](#settings), default `1` second). Write errors are handled gracefully, and locks are always released even if a write is interrupted. On Cygwin and MSYS2 a write is also retried briefly if Windows refuses it: a virus scanner or the search indexer that opens the database in the instant between its being written and its being moved into place makes the move fail, which used to lose that one directory silently. Zsh-z now retries the move briefly.
+- **Your database file now has `600` permissions** -- readable and writable only by you -- so that other users on a shared system cannot read your directory history ([#92](https://github.com/agkozak/zsh-z/issues/92)). On Zsh 5+ this uses the in-process `zf_chmod` builtin; on Zsh 4.3.11 it uses a `umask`-in-a-subshell technique that avoids the fork-and-exec of an external `chmod`.
+- **`COMPLETE_ALIASES` works automatically in normal setups.** Tab completion no longer breaks when you have `setopt COMPLETE_ALIASES` enabled. Zsh-z registers the alias automatically on the first Tab press, so the manual `compdef` line that earlier versions required is no longer necessary. [See below](#complete_aliases).
+- **Fixed a `can't clobber parameter tmpfd` error on some Zsh builds.** On certain Zsh builds, every database write could fail with `can't clobber parameter tmpfd containing file descriptor 0`, leaving an error at each new prompt. The file descriptor used for the temporary database file is now held in an unset scalar rather than one seeded with `0`, so the write never trips Zsh's file-descriptor-clobber guard ([#81](https://github.com/agkozak/zsh-z/issues/81)).
+- **A misconfigured database file no longer closes your shell -- or nags you at every prompt.** When `ZSHZ_DATA` points at a directory, or names a file without a directory, Zsh-z now reports the problem and returns instead of calling `exit`. The per-prompt `--add` stays quiet about it, so you are told once, when you actually run `z`, rather than at every prompt ([#103](https://github.com/agkozak/zsh-z/issues/103); props @ahjota).
+- **`z -x` can now remove the entry for a directory that no longer exists -- and can no longer crash Zsh 4.3.11.** The removal target used to have to exist on disk, so a database entry whose directory had been deleted -- exactly the entry you most want gone -- could not be removed. `z -x /deleted/dir` (and `z -xR`) now canonicalizes the argument without requiring it to exist, resolving symlinks in as much of the path as is still present. The same change fixes a crash on Zsh 4.3.11, where an upstream bug makes `${x:A}` segfault when the top-level component of the path is missing: `z -x /gone/sub` -- or a `ZSHZ_DATA` pointing into a missing top-level directory -- could kill the shell there.
+- **More robust startup and operation.** A version check on an unsupported Zsh no longer risks exiting your interactive shell.
+
+#### Smaller changes you may notice
+
+None of these should need any action from you, but they are the things a v1 user is most likely to spot:
+
+- **`-r` and `-t` can no longer be combined.** They name mutually exclusive sort orders -- rank versus recency -- so `z -rt foo` was always contradictory, and `-t` silently took precedence. It is now rejected with an error message instead of silently picking one.
+- **A lockfile appears next to your database.** Writes are serialized through `~/.z.lock` (or `$ZSHZ_DATA` plus `.lock`). It is created `600`, it stays empty, and it is deliberately never deleted -- removing a lockfile that another shell has already opened would reintroduce the very race it exists to prevent. Where `zsh/system` is missing and `zsystem flock` is therefore unavailable -- MobaXterm's cut-down Cygwin is the case in practice -- you will see a short-lived `~/.z.lock.d` **directory** instead, which is created and removed for each write. See [`ZSHZ_LOCK_TIMEOUT`](#settings) for how that fallback behaves.
+- **An existing database gets tightened to `600` on the next write.** If your `~/.z` predates this release and is `644`, the first write will re-mode it. This is the [#92](https://github.com/agkozak/zsh-z/issues/92) fix applied to databases you already have, not just newly created ones. Setting the mode is treated as part of the write rather than a courtesy afterwards: if it cannot be done, the write is abandoned and reports failure instead of publishing a database that anyone on the machine could read.
+
+The dated entries below remain the historical record of changes leading up to v2.0.
+
+<details>
+    <summary>Here are the older features and updates.</summary>
+
+- May 6, 2026
+    + Zsh-z will now handle paths with dollar signs (`$`) in them.
+    + Workaround for Zsh emulating `sh`/`bash`/`ksh`.
 - May 1, 2026
     + Various tab completion bugs resolved.
 - April 27, 2026
@@ -90,7 +125,7 @@ Zsh-z is a drop-in replacement for `rupa/z` and will, by default, use the same d
 - February 15, 2021
     + Ranks are displayed the way `rupa/z` now displays them, i.e. as large integers. This should help Zsh-z to integrate with other tools.
 - January 31, 2021
-    + Zsh-z is now efficient enough that, on MSYS2 and Cygwin, it is faster to run it in the foreground than it is to fork a subshell for it.
+    + Zsh-z is now efficient enough that, on MSYS2 and Cygwin, it is faster to run it in the foreground than it is to fork a subshell for it. (Behavior superseded in v2.0.)
     + `_zshz_precmd` simply returns if `PWD` is `HOME` or in `ZSHZ_EXCLUDE_DIRS`, rather than waiting for `zshz` to do that.
 - January 17, 2021
     + Made sure that the `PUSHD_IGNORE_DUPS` option is respected.
@@ -121,11 +156,11 @@ This plugin can be installed simply by putting the various files in a directory
 
     source /path/to/zsh-z.plugin.zsh
 
-For tab completion to work, `_zshz` *must* be in the same directory as `zsh-z.plugin.zsh`, and you will want to have loaded `compinit`. The frameworks handle this themselves. If you are not using a framework, put
+Tab completion requires `compinit`. `_zshz` *must* also be in the same directory as `zsh-z.plugin.zsh`. The frameworks handle both of these requirements, but if you are not using a framework, put
 
     autoload -U compinit; compinit
 
-in your `.zshrc` somewhere below where you source `zsh-z.plugin.zsh`.
+in your `.zshrc` somewhere below where you source `zsh-z.plugin.zsh` -- the plugin adds its directory to `fpath` at source time, and `compinit` needs to see it there in order to find `_zshz`.
 
 If you add
 
@@ -195,7 +230,7 @@ Add a backslash to the end of the last line and add `'zsh-z'` to the list, e.g.,
 Then relaunch `zsh`.
 
 ### For [zcomet](https://github.com/agkozak/zcomet) users
-        
+
 Simply add
 
     zcomet load agkozak/zsh-z
@@ -235,7 +270,7 @@ Add the line
 
 to your `.zshrc`.
 
-Zsh-z supports `zinit`'s `unload` feature; just run `zinit unload agkozak/zsh-z` to restore the shell to its state before Zsh-z was loaded.
+Zsh-z supports `zinit`'s `unload` feature; just run `zinit unload agkozak/zsh-z` to restore the shell to its state before Zsh-z was loaded. It gives back only what it took: the `fpath` entry is removed only if Zsh-z was the one that added it, so a directory your plugin manager put there is left alone, and the Tab-completion mapping is dropped only while it still points at Zsh-z's own completer.
 
 ### For [Znap](https://github.com/marlonrichert/zsh-snap) users
 
@@ -274,6 +309,7 @@ to install Zsh-z.
 
 Zsh-z has environment variables (they all begin with `ZSHZ_`) that change its behavior if you set them. You can also keep your old ones if you have been using `rupa/z` (whose environment variables begin with `_Z_`).
 
+* `ZSHZ_CASE` can be `ignore`, for case-insensitive matching, or `smart`, for Vim-like `smartcase` matching; [see below](#case-sensitivity) (default: empty, i.e., a case-sensitive match is tried first, then a case-insensitive one)
 * `ZSHZ_CMD` changes the command name (default: `z`)
 * `ZSHZ_CD` specifies the default directory-changing command (default: `builtin cd`)
 * `ZSHZ_COMPLETION` can be `'frecent'` (default) or `'legacy'`, depending on whether you want your completion results sorted according to frecency or simply sorted alphabetically
@@ -281,9 +317,10 @@ Zsh-z has environment variables (they all begin with `ZSHZ_`) that change its be
 * `ZSHZ_ECHO` displays the new path name when changing directories (default: `0`)
 * `ZSHZ_EXCLUDE_DIRS` is an array of directories to keep out of the database (default: empty)
 * `ZSHZ_KEEP_DIRS` is an array of directories that should not be removed from the database, even if they are not currently available (useful when a drive is not always mounted) (default: empty)
+* `ZSHZ_LOCK_TIMEOUT` is the number of seconds to wait for the database lock before giving up on a write (default: `1`). Where `zsh/system` is unavailable and `zsystem flock` cannot be used -- MobaXterm's cut-down Cygwin, for instance -- Zsh-z serializes writes with an atomic `mkdir` on `~/.z.lock.d` instead, and this setting bounds the wait the same way. That fallback has no equivalent of the kernel releasing a lock when its holder dies, so a lock directory older than 30 seconds is treated as abandoned and cleared; a write takes milliseconds, so nothing legitimate is ever that old. A write that times out is dropped silently -- the automatic `precmd` add is best-effort -- so if the database seems to stop updating, the lock is probably contended: run `z --add .` by hand and check `$?`. A `2` is a lock-acquisition timeout, which confirms contention -- look for a stale process holding `~/.z.lock` (or a leftover `~/.z.lock.d` directory on the fallback path), or raise this setting. A `1` is something else entirely, usually a permissions or ownership problem, such as a root-owned `~/.z` or `~/.z.lock` left behind by an earlier `sudo -s` session.
 * `ZSHZ_MAX_SCORE` is the maximum combined score the database entries can have before they begin to age and potentially drop out of the database (default: 9000)
 * `ZSHZ_NO_RESOLVE_SYMLINKS` prevents symlink resolution (default: `0`)
-* `ZSHZ_OWNER` allows usage when in `sudo -s` mode (default: empty)
+* `ZSHZ_OWNER` is the username the database belongs to; set it to your own login name to keep `z` working in a root shell, such as under `sudo -E -s`; [see below](#zshz_owner) (default: empty)
 * `ZSHZ_TILDE` displays the name of the `HOME` directory as a `~` (default: `0`)
 * `ZSHZ_TRAILING_SLASH` makes it so that a search pattern ending in `/` can match the final element in a path; e.g., `z foo/` can match `/path/to/foo` (default: `0`)
 * `ZSHZ_UNCOMMON` changes the logic used to calculate the directory jumped to; [see below](#zshz_uncommon) (default: `0`)
@@ -319,6 +356,12 @@ then there is no common prefix. In this case, `z code` will simply send you to t
 
 You may enable an alternate, experimental behavior by setting `ZSHZ_UNCOMMON=1`. If you do that, Zsh-z will not jump to a common prefix, even if one exists. Instead, it chooses the highest-ranking match -- but it drops any subdirectories that do not include the search term. So if you type `z bat` and `/home/me/code/bat` is the best match, that is exactly where you will end up. If, however, you had typed `z code` and the best match was also `/home/me/code/bat`, you would have ended up in `/home/me/code` (because `code` was what you had searched for). This feature is still in development, and feedback is welcome.
 
+## `ZSHZ_OWNER`
+
+If you are using `root` privileges while keeping your personal home directory as `HOME` (as is the case with `sudo -E -s`), conflicts with file ownership arise. You can resolve them by using `ZSHZ_OWNER`. If you set this variable to your username, Zsh-z will be able to use your personal datafile, restoring its proper ownership with every write.
+
+Setting `ZSHZ_OWNER` makes one thing stricter, because a privileged shell is then writing to a path that an unprivileged user controls: Zsh-z follows a symlink on the way to the datafile -- the file itself, or any parent directory -- only if `root` owns the link, and reports an error instead of writing otherwise. Symlinked system directories, such as `/home` → `/usr/home` on the BSDs or `/var` → `/private/var` on macOS, belong to root and still resolve. With `ZSHZ_OWNER` unset none of this applies: a symlinked `~/.z` is followed exactly as before, so pointing it at synced storage keeps working.
+
 ## Making `--add` Work for You
 
 Zsh-z internally uses the `--add` option to add paths to its database. @zachriggle pointed out to me that users might want to use `--add` themselves, so I have altered it a little to make it more user-friendly.
@@ -331,9 +374,33 @@ A good example might involve a directory tree that has Git repositories within i
 
 (As a Zsh user, I tend to use `**` instead of `find`, but it is good to see how deep your directory trees go before doing that.)
 
+## Performance
+
+One of the goals of the rewrite that culminated in v2.0 was to make Zsh-z simultaneously more stable and faster. On modern Zsh, Zsh-z outpaces `rupa/z`'s `z.sh` at adding, searching, and listing. Representative figures (N = 200 database entries, medians of seven interleaved runs on a Core i7-12700 desktop under WSL2):
+
+**Modern Zsh (5.9) -- Zsh-z vs. `rupa/z`:**
+
+| Operation | `rupa/z` (`z.sh`) | Zsh-z       | Winner            |
+| --------- | ----------------- | ----------- | ----------------- |
+| `add`     |  6.25 ms/op       |  1.99 ms/op | **Zsh-z** ~3.14x  |
+| `search`  |  6.51 ms/op       |  3.62 ms/op | **Zsh-z** ~1.80x  |
+| `list`    |  8.93 ms/op       |  4.36 ms/op | **Zsh-z** ~2.05x  |
+
+**Zsh 4.3.11 (the oldest supported release) -- Zsh-z vs. `rupa/z`:**
+
+| Operation | `rupa/z` (`z.sh`) | Zsh-z       | Winner            |
+| --------- | ----------------- | ----------- | ----------------- |
+| `add`     |  5.00 ms/op       |  2.92 ms/op | **Zsh-z** ~1.71x  |
+| `search`  |  4.93 ms/op       |  4.47 ms/op | **Zsh-z** ~1.10x  |
+| `list`    |  7.92 ms/op       |  6.08 ms/op | **Zsh-z** ~1.30x  |
+
+Removal is absent from these tables: in `rupa/z`, the per-prompt hook re-adds the current directory right after `z -x` removes it, so the two implementations' `-x` are not doing comparable work.
+
+Relative to the previous generation of Zsh-z, the v2.0 read path is dramatically faster -- on modern Zsh, listing the whole database is about 2.4x faster and searching about 1.6x faster.
+
 ## Other Improvements to the Original Functionality of `rupa/z`
 
-* `z -x` works, with the help of `chpwd_functions`.
+* `z -x` works: a directory you remove stays removed.
 * Zsh-z is compatible with Solaris.
 * Zsh-z uses the "new" `zshcompsys` completion system instead of the old `compctl` one.
 * No error message is displayed when the database file has not yet been created.
@@ -355,12 +422,10 @@ If you are coming to Zsh-z (or even to the original `rupa/z`, for that matter) f
 
 ## `COMPLETE_ALIASES`
 
-`z`, or any alternative you set up using `$ZSHZ_CMD` or `$_Z_CMD`, is an alias. `setopt COMPLETE_ALIASES` divorces the tab completion for aliases from the underlying commands they invoke, so if you enable `COMPLETE_ALIASES`, tab completion for Zsh-z will be broken. You can get it working again, however, by adding under
+`z`, or any alternative you set up using `$ZSHZ_CMD` or `$_Z_CMD`, is an alias. `setopt COMPLETE_ALIASES` divorces the tab completion for aliases from the underlying commands they invoke, which historically broke Zsh-z's tab completion. Zsh-z now handles this automatically: the first Tab press registers the alias name with `_zshz` so completion works under `COMPLETE_ALIASES` without any extra setup.
 
-    setopt COMPLETE_ALIASES
-
-the line
+That registration happens inside Zsh-z's own Tab widget. If a plugin loaded after Zsh-z replaces the Tab binding without invoking the previous widget, Zsh-z's widget never runs and the registration does not happen. Under `COMPLETE_ALIASES`, you would then have no completion for `z`. Once `compinit` has run, adding
 
     compdef _zshz ${ZSHZ_CMD:-${_Z_CMD:-z}}
 
-That will re-bind `z` or the command of your choice to the underlying Zsh-z function.
+below `setopt COMPLETE_ALIASES` in your `.zshrc` fixes that, and it is harmless if the automatic registration has already run.

plugins/z/_z

@@ -1,6 +1,6 @@
 #compdef zshz ${ZSHZ_CMD:-${_Z_CMD:-z}}
 #
-# Zsh-z - jump around with Zsh - A native Zsh version of z without awk, sort,
+# Zsh-z - jump around with Zsh - A native Zsh version of rupa/z without awk, sort,
 # date, or sed
 #
 # https://github.com/agkozak/zsh-z
@@ -24,11 +24,7 @@
 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
-#
-# z (https://github.com/rupa/z) is copyright (c) 2009 rupa deadwyler and
-# licensed under the WTFPL license, Version 2.a
-#
-# shellcheck shell=ksh
+################################################################################
 
 ############################################################
 # Zsh-z COMPLETIONS

tools/changelog.sh

@@ -221,12 +221,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks

tools/check_for_upgrade.sh

@@ -28,7 +28,7 @@ zstyle -s ':omz:update' mode update_mode || {
 if [[ "$update_mode" = disabled ]] \
    || [[ ! -w "$ZSH" || ! -O "$ZSH" ]] \
    || [[ ! -t 1 && ${POWERLEVEL9K_INSTANT_PROMPT:-off} == off ]] \
-   || ! command git --version 2>&1 >/dev/null \
+   || ! command git --version >/dev/null 2>&1 \
    || (builtin cd -q "$ZSH"; ! command git rev-parse --is-inside-work-tree &>/dev/null); then
   unset update_mode
   return

tools/install.sh

@@ -49,9 +49,31 @@ USER=${USER:-$(id -u -n)}
 # $HOME is defined at the time of login, but it could be unset. If it is unset,
 # a tilde by itself (~) will not be expanded to the current user's home directory.
 # POSIX: https://pubs.opengroup.org/onlinepubs/009696899/basedefs/xbd_chap08.html#tag_08_03
-HOME="${HOME:-$(getent passwd $USER 2>/dev/null | cut -d: -f6)}"
-# macOS does not have getent, but this works even if $HOME is unset
-HOME="${HOME:-$(eval echo ~"$USER")}"
+if [ -z "$HOME" ]; then
+  HOME=$(getent passwd "$USER" 2>/dev/null | cut -d: -f6)
+
+  # macOS does not have getent; fall back to tilde expansion, but only if
+  # $USER is a safe username. The eval below would otherwise expand any shell
+  # metacharacters in $USER and allow command injection (CWE-78).
+  case "$USER" in
+    *[![:alnum:]_.-]*|'')
+      ;;
+    *)
+      resolved_home=$(eval echo ~"$USER")
+      # Unknown users are not expanded and produce a literal "~username".
+      [ "$resolved_home" = "~$USER" ] || HOME=$resolved_home
+      ;;
+  esac
+
+  case "$HOME" in
+    /*) ;;
+    *)
+      echo "Error: unable to determine the current user's home directory." >&2
+      echo "Set HOME explicitly and rerun the installer." >&2
+      exit 1
+      ;;
+  esac
+fi
 
 
 # Track if $ZSH was provided
@@ -168,12 +190,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks

tools/upgrade.sh

@@ -95,12 +95,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks