more fixes

A malformed HEAD or loose ref was copied into the zcompdump metadata as
though it had resolved, so a corrupt file could make #omz revision:
differ from git rev-parse HEAD instead of taking the fallback.

Fold the three resolution paths into one exit and check the result is a
40 or 64 character hex object ID, so symbolic refs, malformed files and
missed packed entries all fall through to git.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

oh-my-zsh.sh

@@ -110,9 +110,89 @@ if [[ -z "$ZSH_COMPDUMP" ]]; then
   ZSH_COMPDUMP="${ZDOTDIR:-$HOME}/.zcompdump-${SHORT_HOST}-${ZSH_VERSION}"
 fi
 
-# Construct zcompdump OMZ metadata
-zcompdump_revision="#omz revision: $(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
+# Resolve the commit $ZSH is checked out at into $REPLY by reading the git
+# directory, so that no git process is forked on every startup.
+# Handles .git files (worktrees, submodules), worktree common dirs, detached
+# HEADs and packed refs. Returns 1 if anything is unexpected.
+_omz_git_head() {
+  local gitdir="$ZSH/.git" common head ref
+  local -a lines
+  REPLY=
+
+  # .git may be a file pointing at the real git dir
+  if [[ -f "$gitdir" ]]; then
+    read -r head 2>/dev/null < "$gitdir" || return 1
+    [[ "$head" = "gitdir: "* ]] || return 1
+    gitdir="${head#gitdir: }"
+    [[ -n "$gitdir" ]] || return 1
+    [[ "$gitdir" = /* ]] || gitdir="$ZSH/$gitdir"
+  fi
+
+  # worktrees keep their refs in the common git dir
+  common="$gitdir"
+  if [[ -f "$gitdir/commondir" ]]; then
+    read -r common 2>/dev/null < "$gitdir/commondir" || return 1
+    [[ "$common" = /* ]] || common="$gitdir/$common"
+  fi
+
+  [[ -r "$gitdir/HEAD" ]] || return 1
+  read -r head 2>/dev/null < "$gitdir/HEAD" || return 1
+
+  if [[ "$head" = ref:\ * ]]; then
+    ref="${head#ref: }"
+
+    # Only use well-formed full ref names as paths. Besides matching Git's ref
+    # rules, this prevents a malformed HEAD from escaping the git directory.
+    [[ "$ref" = refs/?* \
+      && "$ref" != *..* \
+      && "$ref" != *//* \
+      && "$ref" != */ \
+      && "$ref" != */.* \
+      && "$ref" != *.lock \
+      && "$ref" != *.lock/* \
+      && "$ref" != *. \
+      && "$ref" != *'@{'* \
+      && "$ref" != *[[:cntrl:]\ \~\^\:\?\*\[\\]* \
+    ]] || return 1
+
+    case "$ref" in
+      # These namespaces are private to each worktree and are never resolved
+      # from the common directory or its packed-refs file.
+      refs/bisect/*|refs/worktree/*|refs/rewritten/*)
+        [[ -r "$gitdir/$ref" ]] || return 1
+        read -r REPLY 2>/dev/null < "$gitdir/$ref" || return 1
+        ;;
+      *)
+        if [[ -r "$common/$ref" ]]; then
+          read -r REPLY 2>/dev/null < "$common/$ref" || return 1
+        elif [[ -r "$common/packed-refs" ]]; then
+          lines=("${(@f)$(<"$common/packed-refs")}")
+          REPLY="${lines[(r)* ${(b)ref}]%% *}"
+        else
+          return 1
+        fi
+        ;;
+    esac
+  else
+    # detached HEAD: the file holds the commit itself
+    REPLY="$head"
+  fi
+
+  # only an object ID is a usable answer: a symbolic ref, a malformed file or
+  # a missed packed entry all fall through to the git fallback instead
+  [[ -n "$REPLY" && -z "${REPLY//[0-9a-f]/}" ]] \
+    && (( ${#REPLY} == 40 || ${#REPLY} == 64 ))
+}
+
+# Construct zcompdump OMZ metadata. The helper reports through $REPLY, so
+# call it in a scope that keeps that out of the global namespace.
+() {
+  local REPLY
+  _omz_git_head || REPLY="$(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
+  typeset -g zcompdump_revision="#omz revision: $REPLY"
+}
 zcompdump_fpath="#omz fpath: $fpath"
+unset -f _omz_git_head
 
 # Delete the zcompdump file if OMZ zcompdump metadata changed
 if ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null \

plugins/kubectl/README.md

@@ -71,6 +71,7 @@ plugins=(... kubectl)
 |          |                                                         | **Secret management**                                                                            |
 | kgsec    | `kubectl get secret`                                    | Get secret for decoding                                                                          |
 | kgseca   | `kubectl get secret --all-namespaces`                   | List secrets across all namespaces                                                               |
+| kesec    | `kubectl edit secret`                                   | Edit secret resource                                                                             |
 | kdsec    | `kubectl describe secret`                               | Describe secret resource in detail                                                               |
 | kdelsec  | `kubectl delete secret`                                 | Delete the secret                                                                                |
 |          |                                                         | **Deployment management**                                                                        |

plugins/kubectl/kubectl.plugin.zsh

@@ -93,6 +93,7 @@ alias kdelcm='kubectl delete configmap'
 # Secret management
 alias kgsec='kubectl get secret'
 alias kgseca='kubectl get secret --all-namespaces'
+alias kesec='kubectl edit secret'
 alias kdsec='kubectl describe secret'
 alias kdelsec='kubectl delete secret'
 

plugins/symfony6/symfony6.plugin.zsh

@@ -15,8 +15,8 @@
 #   - https://github.com/symfony/symfony/blob/5.4/src/Symfony/Component/Console/Resources/completion.bash
 #
 _sf_console() {
-    local lastParam flagPrefix requestComp out comp
-    local -a completions
+    local lastParam out comp sf_cmd
+    local -a completions flagPrefix requestComp inputs
 
     # The user could have moved the cursor backwards on the command-line.
     # We need to trigger completion from the $CURRENT location, so we need
@@ -29,11 +29,20 @@ _sf_console() {
     setopt local_options BASH_REMATCH
     if [[ "${lastParam}" =~ '-.*=' ]]; then
         # We are dealing with a flag with an =
-        flagPrefix="-P ${BASH_REMATCH}"
+        flagPrefix=(-P "${BASH_REMATCH}")
     fi
 
-    # Prepare the command to obtain completions
-    requestComp="${words[0]} ${words[1]} _complete --no-interaction -szsh -a1 -c$((CURRENT-1))" i=""
+    # Prepare the command to obtain completions. An alias is resolved here,
+    # because the request is no longer read again by the shell.
+    sf_cmd="${words[1]}"
+    if [[ -n "${aliases[$sf_cmd]}" ]]; then
+        requestComp=(${(z)aliases[$sf_cmd]})
+    else
+        requestComp=(${~sf_cmd})
+    fi
+
+    requestComp+=(_complete --no-interaction -szsh -a1 "-c$((CURRENT-1))")
+
     for w in ${words[@]}; do
         w=$(printf -- '%b' "$w")
         # remove quotes from typed values
@@ -47,19 +56,18 @@ _sf_console() {
         fi
         # empty values are ignored
         if [ ! -z "$w" ]; then
-            i="${i}-i${w} "
+            inputs+=("-i$w")
         fi
     done
 
     # Ensure at least 1 input
-    if [ "${i}" = "" ]; then
-        requestComp="${requestComp} -i\" \""
-    else
-        requestComp="${requestComp} ${i}"
+    if (( ! $#inputs )); then
+        inputs=(-i' ')
     fi
 
-    # Use eval to handle any environment variables and such
-    out=$(eval ${requestComp} 2>/dev/null)
+    # The request is run without being read again by the shell, so that a
+    # "$(...)" or a backtick typed on the command line is not executed
+    out=$(SHELL_VERBOSITY=0 "${requestComp[@]}" "${inputs[@]}" 2>/dev/null)
 
     while IFS='\n' read -r comp; do
         if [ -n "$comp" ]; then
@@ -75,7 +83,7 @@ _sf_console() {
     done < <(printf "%s\n" "${out[@]}")
 
     # Let inbuilt _describe handle completions
-    eval _describe "completions" completions $flagPrefix
+    _describe "completions" completions "${flagPrefix[@]}"
     return $?
 }