fix(cli): preserve literal theme browser output

Keep backslash sequences literal and enable prompt-percent rendering independently of the parent shell options. Add PTY coverage for both fixes and verify EXIT-hook preservation through the public CLI.

.github/dependencies.yml

@@ -12,7 +12,7 @@ dependencies:
   plugins/gradle:
     repo: gradle/gradle-completion
     branch: master
-    version: 63578c9bc56134b80766e88957ba0239e6be2343
+    version: e7c881dbef7462bc35ad05328397e1582fe25cb8
     precopy: |
       set -e
       find . ! -name _gradle ! -name LICENSE -delete

.github/workflows/dependencies.yml

@@ -16,7 +16,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/dependencies/requirements.txt

@@ -1,6 +1,6 @@
 certifi==2026.7.22
-charset-normalizer==3.5.0
-idna==3.18
+charset-normalizer==3.5.1
+idna==3.19
 PyYAML==6.0.3
 requests==2.34.2
 semver==3.0.4

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

README.md

@@ -23,6 +23,14 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/111169632522566717?label=%40ohmyzsh&domain=https%3A%2F%2Fmstdn.social&logo=mastodon&style=flat)](https://mstdn.social/@ohmyzsh)
 [![Discord server](https://img.shields.io/discord/642496866407284746)](https://discord.gg/ohmyzsh)
 
+<a href="https://commitgoods.com/collections/oh-my-zsh?utm_source=github">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://cdn.shopify.com/s/files/1/0101/8752/files/commitgoods-badge-stacked-navy-dark.svg">
+    <img src="https://cdn.shopify.com/s/files/1/0101/8752/files/commitgoods-badge-stacked-navy.svg" height="28" alt="Official merch on commitgoods.com">
+  </picture>
+</a>
+
+
 <details>
 <summary>Table of Contents</summary>
 
@@ -163,6 +171,19 @@ adds any) and extra goodies that are included in that particular plugin.
 
 ### Themes
 
+Preview installed themes in your current directory without changing your prompt or `.zshrc`:
+
+```zsh
+omz theme browse              # Interactive browser
+omz theme browse agn          # Start with a theme-name filter
+omz theme preview agnoster    # Print one isolated static preview
+```
+
+In the browser, type to filter, use Up/Down or Ctrl-P/Ctrl-N to navigate, and press Enter
+for explicit use/save actions. Esc or Ctrl-C cancels without applying a theme.
+See the [theme browser guide](tools/theme-browser/README.md) for shortcuts, preview limitations,
+and local testing instructions.
+
 We'll admit it. Early in the Oh My Zsh world, we may have gotten a bit too theme-happy. We have over one
 hundred and fifty themes now bundled. Most of them have
 [screenshots](https://github.com/ohmyzsh/ohmyzsh/wiki/Themes) on the wiki (We are working on updating this!).

lib/cli.zsh

@@ -51,7 +51,7 @@ function _omz {
         _describe 'command' subcmds ;;
       pr) subcmds=('clean:Delete all Pull Request branches' 'test:Test a Pull Request')
         _describe 'command' subcmds ;;
-      theme) subcmds=('list:List themes' 'set:Set a theme in your .zshrc file' 'use:Load a theme')
+      theme) subcmds=('browse:Browse theme previews' 'preview:Preview a theme without applying it' 'list:List themes' 'set:Set a theme in your .zshrc file' 'use:Load a theme')
         _describe 'command' subcmds ;;
     esac
   elif (( CURRENT == 4 )); then
@@ -77,6 +77,10 @@ function _omz {
         local -a opts
         opts=('--enabled:List enabled plugins only')
         _describe -o 'options' opts ;;
+      theme::(browse|preview))
+        local -a themes
+        themes=("${(@f)$(source "$ZSH/tools/theme-browser/preview.zsh"; _omz_theme_names)}")
+        _describe 'theme' themes ;;
       theme::(set|use))
         local -aU themes
         themes=("$ZSH"/themes/*.zsh-theme(-.N:t:r) "$ZSH_CUSTOM"/**/*.zsh-theme(-.N:r:gs:"$ZSH_CUSTOM"/themes/:::gs:"$ZSH_CUSTOM"/:::))
@@ -519,7 +523,7 @@ function _omz::plugin::load {
     # Check if it has completion to reload compinit
     local -a comp_files
     comp_files=($base/_*(N))
-    has_completion=$(( $#comp_files > 0 ))
+    (( has_completion )) || has_completion=$(( $#comp_files > 0 ))
 
     # Load the plugin
     if [[ -f "$base/$plugin.plugin.zsh" ]]; then
@@ -749,6 +753,8 @@ Usage: ${(j: :)${(s.::.)0#_}} <command> [options]
 
 Available commands:
 
+  browse [filter] Browse installed themes without applying them
+  preview <theme> Preview a theme in the current directory
   list            List all available Oh My Zsh themes
   set <theme>     Set a theme in your .zshrc file
   use <theme>     Load a theme
@@ -763,6 +769,45 @@ EOF
   $0::$command "$@"
 }
 
+function _omz::theme::preview {
+  if (( $# != 1 )); then
+    print -u2 -r -- 'Usage: omz theme preview <theme>'
+    return 1
+  fi
+  source "$ZSH/tools/theme-browser/preview.zsh"
+  _omz_theme_preview "$1"
+}
+
+function _omz::theme::browse {
+  if (( $# > 1 )); then
+    print -u2 -r -- 'Usage: omz theme browse [filter]'
+    return 1
+  fi
+  if [[ ! -o interactive || ! -t 0 || ! -t 1 ]]; then
+    print -u2 -r -- 'omz theme browse requires an interactive terminal; use omz theme preview <theme> instead.'
+    return 1
+  fi
+  source "$ZSH/tools/theme-browser/preview.zsh"
+  source "$ZSH/tools/theme-browser/browser.zsh"
+  local selection action name
+  selection=$(_omz_theme_browser "$1") || return $?
+  [[ -n $selection ]] || return 0
+  action=${selection%%$'\n'*}
+  name=${selection#*$'\n'}
+  _omz_theme_resolve "$name" >/dev/null || return 1
+  case $action in
+    use) _omz::theme::use "$name" ;;
+    set)
+      # The existing set command interpolates the name into shell and awk text.
+      [[ $name != *[^a-zA-Z0-9_./-]* ]] || {
+        print -u2 -r -- 'Cannot save this theme name safely; set ZSH_THEME manually.'
+        return 1
+      }
+      _omz::theme::set "$name" ;;
+    *) return 1 ;;
+  esac
+}
+
 function _omz::theme::list {
   local -a custom_themes builtin_themes
   custom_themes=("$ZSH_CUSTOM"/**/*.zsh-theme(-.N:r:gs:"$ZSH_CUSTOM"/themes/:::gs:"$ZSH_CUSTOM"/:::))

lib/diagnostics.zsh

@@ -271,7 +271,7 @@ function _omz_diag_dump_check_core_commands() {
     unfunction unhash unlimit unset unsetopt vared wait whence where which zcompile
     zle zmodload zparseopts zregexparse zstyle )
   if is-at-least 5.1; then
-    reserved_word+=( declare export integer float local readonly typeset )
+    reserved_words+=( declare export integer float local readonly typeset )
   else
     builtins+=( declare export integer float local readonly typeset )
   fi

lib/git.zsh

@@ -39,16 +39,27 @@ function _omz_git_prompt_info() {
   echo "${ZSH_THEME_GIT_PROMPT_PREFIX}${ref//\%/%%}${upstream//\%/%%}$(parse_git_dirty)${ZSH_THEME_GIT_PROMPT_SUFFIX}"
 }
 
-function _omz_git_prompt_status() {
-  # OHMYZSH-13330: avoid "regex matching error: illegal byte sequence".
-  # zsh's "=~" operator delegates to the C library regex, which aborts with
-  # REG_ILLSEQ when the subject contains an invalid byte sequence under a
-  # multibyte locale (e.g. a filename with non-UTF-8 bytes in `git status`
-  # output). Forcing the C locale makes every byte a valid character, so the
-  # regex matching below never fails that way. `git status --porcelain` is
-  # locale-independent, so this does not change the parsed output.
+# Match an extended regular expression against a subject, forcing the C locale
+# only for the duration of the call.
+#
+# OHMYZSH-13330: zsh's "=~" operator delegates to the C library regex, which
+# aborts with REG_ILLSEQ when the subject contains an invalid byte sequence
+# under a multibyte locale (e.g. a filename with non-UTF-8 bytes in `git
+# status` output). Forcing the C locale makes every byte a valid character,
+# so the regex matching never fails that way. `git status --porcelain` is
+# locale-independent, so this does not change the parsed output.
+#
+# OHMYZSH-13985: the locale must be scoped to this function and not set for
+# the whole caller. Assigning LC_ALL makes zsh re-run setlocale() right away,
+# so leaving it set while the rest of the caller runs breaks multibyte
+# handling there — most visibly, `echo` refuses to expand Unicode escapes in
+# theme prompt symbols ("character not in range").
+function _omz_git_prompt_status_match() {
   local -x LC_ALL=C
+  [[ "$1" =~ "$2" ]]
+}
 
+function _omz_git_prompt_status() {
   [[ "$(__git_prompt_git config --get oh-my-zsh.hide-status 2>/dev/null)" = 1 ]] && return
 
   # Maps a git status prefix to an internal constant
@@ -113,11 +124,11 @@ function _omz_git_prompt_status() {
   status_lines=("${(@f)${status_text}}")
 
   # If the tracking line exists, get and parse it
-  if [[ "$status_lines[1]" =~ "^## [^ ]+ \[(.*)\]" ]]; then
+  if _omz_git_prompt_status_match "$status_lines[1]" "^## [^ ]+ \[(.*)\]"; then
     local branch_statuses
     branch_statuses=("${(@s/,/)match}")
     for branch_status in $branch_statuses; do
-      if [[ ! $branch_status =~ "(behind|diverged|ahead) ([0-9]+)?" ]]; then
+      if ! _omz_git_prompt_status_match "$branch_status" "(behind|diverged|ahead) ([0-9]+)?"; then
         continue
       fi
       local last_parsed_status=$prefix_constant_map[$match[1]]
@@ -130,7 +141,7 @@ function _omz_git_prompt_status() {
     local status_constant="${prefix_constant_map[$status_prefix]}"
     local status_regex=$'(^|\n)'"$status_prefix"
 
-    if [[ "$status_text" =~ $status_regex ]]; then
+    if _omz_git_prompt_status_match "$status_text" "$status_regex"; then
       statuses_seen[$status_constant]=1
     fi
   done

lib/prompt_info_functions.zsh

@@ -21,6 +21,7 @@ function chruby_prompt_info \
   azure_prompt_info \
   tf_prompt_info \
   conda_prompt_info \
+  go_prompt_info \
 {
   return 1
 }

oh-my-zsh.sh

@@ -64,7 +64,7 @@ if [[ ! -w "$ZSH_CACHE_DIR" ]]; then
 fi
 
 # Create cache and completions dir and add to $fpath
-mkdir -p "$ZSH_CACHE_DIR/completions"
+[[ -d "$ZSH_CACHE_DIR/completions" ]] || mkdir -p "$ZSH_CACHE_DIR/completions"
 (( ${fpath[(Ie)$ZSH_CACHE_DIR/completions]} )) || fpath=("$ZSH_CACHE_DIR/completions" $fpath)
 
 # Check for updates on initial load...
@@ -114,9 +114,17 @@ fi
 zcompdump_revision="#omz revision: $(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
 zcompdump_fpath="#omz fpath: $fpath"
 
+# Check whether the zcompdump file carries the current OMZ metadata lines
+_omz_compdump_has_metadata() {
+  local -a lines
+  [[ -r "$ZSH_COMPDUMP" ]] || return 1
+  lines=("${(@f)$(<"$ZSH_COMPDUMP")}")
+  (( ${lines[(Ie)$zcompdump_revision]} && ${lines[(Ie)$zcompdump_fpath]} ))
+}
+
 # Delete the zcompdump file if OMZ zcompdump metadata changed
-if ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null \
-   || ! command grep -q -Fx "$zcompdump_fpath" "$ZSH_COMPDUMP" 2>/dev/null; then
+zcompdump_refresh=0
+if ! _omz_compdump_has_metadata; then
   command rm -f "$ZSH_COMPDUMP"
   zcompdump_refresh=1
 fi
@@ -134,9 +142,8 @@ else
   compinit -u -d "$ZSH_COMPDUMP"
 fi
 
-# Append zcompdump metadata if missing
-if (( $zcompdump_refresh )) \
-  || ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null; then
+# Append zcompdump metadata if missing (compinit may have regenerated the file)
+if (( zcompdump_refresh )) || ! _omz_compdump_has_metadata; then
   # Use `tee` in case the $ZSH_COMPDUMP filename is invalid, to silence the error
   # See https://github.com/ohmyzsh/ohmyzsh/commit/dd1a7269#commitcomment-39003489
   tee -a "$ZSH_COMPDUMP" &>/dev/null <<EOF
@@ -146,9 +153,12 @@ $zcompdump_fpath
 EOF
 fi
 unset zcompdump_revision zcompdump_fpath zcompdump_refresh
+unset -f _omz_compdump_has_metadata
 
 # zcompile the completion dump file if the .zwc is older or missing.
-if command mkdir "${ZSH_COMPDUMP}.lock" 2>/dev/null; then
+# Test that first so the lock directory and zrecompile are skipped when it's fresh.
+if [[ ! "${ZSH_COMPDUMP}.zwc" -nt "$ZSH_COMPDUMP" ]] \
+   && command mkdir "${ZSH_COMPDUMP}.lock" 2>/dev/null; then
   zrecompile -q -p "$ZSH_COMPDUMP"
   command rm -rf "$ZSH_COMPDUMP.zwc.old" "${ZSH_COMPDUMP}.lock"
 fi

plugins/1password/1password.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_op" ]]; then
   _comps[op]=_op
 fi
 
-op completion zsh >| "$ZSH_CACHE_DIR/completions/_op" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_op"
+  zf_mv -f -- =( op completion zsh ) "$TMPPREFIX"
+} &|
 
 # Load opswd function
 autoload -Uz opswd

plugins/arduino-cli/arduino-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_arduino-cli" ]]; then
 fi
 
 # Generate and load arduino-cli completion
-arduino-cli completion zsh >! "$ZSH_CACHE_DIR/completions/_arduino-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_arduino-cli"
+  zf_mv -f -- =( arduino-cli completion zsh ) "$TMPPREFIX"
+} &|

plugins/argocd/argocd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_argocd" ]]; then
   _comps[argocd]=_argocd
 fi
 
-argocd completion zsh >| "$ZSH_CACHE_DIR/completions/_argocd" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_argocd"
+  zf_mv -f -- =( argocd completion zsh ) "$TMPPREFIX"
+} &|

plugins/asdf/asdf.plugin.zsh

@@ -12,4 +12,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_asdf" ]]; then
   autoload -Uz _asdf
   _comps[asdf]=_asdf
 fi
-asdf completion zsh >| "$ZSH_CACHE_DIR/completions/_asdf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_asdf"
+  zf_mv -f -- =( asdf completion zsh ) "$TMPPREFIX"
+} &|

plugins/aws/aws.plugin.zsh

@@ -69,7 +69,7 @@ function asr() {
   local -a available_regions
   available_regions=($(aws_regions))
   if [[ -z "${available_regions[(r)$1]}" ]]; then
-    echo "${fg[red]}Available regions: \n$(aws_regions)"
+    echo "${fg[red]}Available regions: \n$(aws_regions)${reset_color}" >&2
     return 1
   fi
 

plugins/buf/buf.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_buf" ]]; then
 fi
 
 # Generate and load buf completion
-buf completion zsh >! "$ZSH_CACHE_DIR/completions/_buf" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_buf"
+  zf_mv -f -- =( buf completion zsh ) "$TMPPREFIX"
+} &|

plugins/bun/bun.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_bun" ]]; then
   _comps[bun]=_bun
 fi
 
-SHELL=zsh bun completions >| "$ZSH_CACHE_DIR/completions/_bun" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_bun"
+  zf_mv -f -- =( SHELL=zsh bun completions ) "$TMPPREFIX"
+} &|

plugins/charm/charm.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_charm" ]]; then
   _comps[charm]=_charm
 fi
 
-charm completion zsh >| "$ZSH_CACHE_DIR/completions/_charm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_charm"
+  zf_mv -f -- =( charm completion zsh ) "$TMPPREFIX"
+} &|

plugins/chezmoi/chezmoi.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_chezmoi" ]]; then
   _comps[chezmoi]=_chezmoi
 fi
 
-chezmoi completion zsh >| "$ZSH_CACHE_DIR/completions/_chezmoi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_chezmoi"
+  zf_mv -f -- =( chezmoi completion zsh ) "$TMPPREFIX"
+} &|

plugins/codex/codex.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_codex" ]]; then
   _comps[codex]=_codex
 fi
 
-codex completion zsh < /dev/null 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_codex" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_codex"
+  zf_mv -f -- =( codex completion zsh < /dev/null 2> /dev/null ) "$TMPPREFIX"
+} &|

plugins/deno/deno.plugin.zsh

@@ -25,4 +25,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_deno" ]]; then
   _comps[deno]=_deno
 fi
 
-deno completions zsh >| "$ZSH_CACHE_DIR/completions/_deno" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_deno"
+  zf_mv -f -- =( deno completions zsh ) "$TMPPREFIX"
+} &|

plugins/docker-compose/README.md

@@ -2,7 +2,7 @@
 
 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
-This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+This plugin chooses automatically between the legacy `docker-compose` command and the modern
 `docker compose` subcommand, preferring `docker-compose` when both are available.
 
 To use it, add docker-compose to the plugins array of your zshrc file:
@@ -17,6 +17,7 @@ plugins=(... docker-compose)
 |-----------|----------------------------------|----------------------------------------------------------------------------------|
 | dco       | `docker-compose`                 | Docker-compose main command                                                      |
 | dcb       | `docker-compose build`           | Build containers                                                                 |
+| dcc       | `docker-compose config`                 | Parse, resolve and render compose file in canonical format |
 | dce       | `docker-compose exec`            | Execute command inside a container                                               |
 | dcps      | `docker-compose ps`              | List containers                                                                  |
 | dcrestart | `docker-compose restart`         | Restart container                                                                |

plugins/docker-compose/docker-compose.plugin.zsh

@@ -6,6 +6,7 @@
 
 alias dco="$dccmd"
 alias dcb="$dccmd build"
+alias dcc="$dccmd config"
 alias dce="$dccmd exec"
 alias dcps="$dccmd ps"
 alias dcrestart="$dccmd restart"

plugins/docker/docker.plugin.zsh

@@ -56,14 +56,19 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_docker" ]]; then
   _comps[docker]=_docker
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+
+  local plugin_dir="$1"
+
   # `docker completion` is only available from 23.0.0 on
   # docker version returns `Docker version 24.0.2, build cb74dfcd85`
   # with `s:,:` remove the comma after the version, and select third word of it
   if zstyle -t ':omz:plugins:docker' legacy-completion || \
     ! is-at-least 23.0.0 ${${(s:,:z)"$(command docker --version)"}[3]}; then
-        command cp "${0:h}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
+        command cp "${plugin_dir}/completions/_docker" "$ZSH_CACHE_DIR/completions/_docker"
       else
-        command docker completion zsh | tee "$ZSH_CACHE_DIR/completions/_docker" > /dev/null
+        local TMPPREFIX="$ZSH_CACHE_DIR/completions/_docker"
+        zf_mv -f -- =( command docker completion zsh ) "$TMPPREFIX"
   fi
-} &|
+} "${0:A:h}" &|

plugins/doctl/doctl.plugin.zsh

@@ -14,4 +14,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_doctl" ]]; then
   _comps[doctl]=_doctl
 fi
 
-doctl completion zsh >| "$ZSH_CACHE_DIR/completions/_doctl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_doctl"
+  zf_mv -f -- =( doctl completion zsh ) "$TMPPREFIX"
+} &|

plugins/eza/eza.plugin.zsh

@@ -52,8 +52,13 @@ function _configure_eza() {
   if [[ $_val ]]; then
     _EZA_TAIL+=("--time-style='$_val'")
   fi
-  if zstyle -t ":omz:plugins:eza" "hyperlink"; then
-    _EZA_TAIL+=("--hyperlink")
+  if zstyle -t ':omz:plugins:eza' 'hyperlink'; then
+    # eza >= 0.23 needs an explicit WHEN value
+    if command eza --hyperlink=auto --version &>/dev/null; then
+      _EZA_TAIL+=("--hyperlink=auto")
+    else
+      _EZA_TAIL+=("--hyperlink")
+    fi
   fi
 }
 

plugins/flutter/flutter.plugin.zsh

@@ -30,4 +30,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
   _comps[flutter]=_flutter
 fi
 
-flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flutter"
+  zf_mv -f -- =( flutter zsh-completion < /dev/null ) "$TMPPREFIX"
+} &|

plugins/fluxcd/fluxcd.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flux" ]]; then
   _comps[flux]=_flux
 fi
 
-flux completion zsh >| "$ZSH_CACHE_DIR/completions/_flux" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_flux"
+  zf_mv -f -- =( flux completion zsh ) "$TMPPREFIX"
+} &|

plugins/fnm/fnm.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_fnm" ]]; then
   _comps[fnm]=_fnm
 fi
 
-fnm completions --shell=zsh >| "$ZSH_CACHE_DIR/completions/_fnm" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_fnm"
+  zf_mv -f -- =( fnm completions --shell=zsh ) "$TMPPREFIX"
+} &|
 
 if zstyle -t ':omz:plugins:fnm' autostart; then
   local -a fnm_env_cmd

plugins/gcx/README.md

@@ -0,0 +1,18 @@
+# Grafana CLI plugin
+
+This plugin adds completion for the [Grafana CLI (gcx)](https://github.com/grafana/gcx).
+
+To use it, add `gcx` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... gcx)
+```
+
+This plugin does not add any aliases.
+
+## Cache
+
+This plugin caches the completion script and automatically updates it when the
+plugin is loaded, which is usually when you start a new terminal emulator.
+
+The cache is stored at `$ZSH_CACHE_DIR/completions/_gcx`.

plugins/gcx/gcx.plugin.zsh

@@ -0,0 +1,18 @@
+# Autocompletion for the Grafana CLI (gcx).
+if (( ! $+commands[gcx] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `gcx`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_gcx" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _gcx
+  _comps[gcx]=_gcx
+fi
+
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gcx"
+  zf_mv -f -- =( gcx completion zsh ) "$TMPPREFIX"
+} &|

plugins/gh/gh.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_gh" ]]; then
   _comps[gh]=_gh
 fi
 
-gh completion --shell zsh >| "$ZSH_CACHE_DIR/completions/_gh" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gh"
+  zf_mv -f -- =( gh completion --shell zsh ) "$TMPPREFIX"
+} &|

plugins/git/git.plugin.zsh

@@ -137,8 +137,9 @@ function gbda() {
 # Copied and modified from James Roeder (jmaroeder) under MIT License
 # https://github.com/jmaroeder/plugin-git/blob/216723ef4f9e8dde399661c39c80bdf73f4076c4/functions/gbda.fish
 function gbds() {
-  local default_branch=$(git_main_branch)
-  (( ! $? )) || default_branch=$(git_develop_branch)
+  local default_branch
+  default_branch=$(git_main_branch) \
+    || default_branch=$(git_develop_branch)
 
   git for-each-ref refs/heads/ "--format=%(refname:short)" | \
     while read branch; do

plugins/golang/README.md

@@ -39,3 +39,18 @@ plugins=(... golang)
 | gov    | `go vet`          | Vet examines Go source code and reports suspicious constructs |
 | gove   | `go version`      | Prints Go version                                             |
 | gow    | `go work`         | Work provides access to operations on workspaces              |
+
+## Prompt
+
+This plugin provides the `go_prompt_info` function to add the installed Go
+version to your prompt.
+
+For example:
+```
+PROMPT="%~$ "
+RPROMPT='$(go_prompt_info)'
+```
+changes your prompt to:
+```
+~/go/project$ ▋                                                     1.22.3
+```

plugins/golang/golang.plugin.zsh

@@ -36,3 +36,12 @@ alias gotofx='go tool fix'
 alias gov='go vet'
 alias gove='go version'
 alias gow='go work'
+
+## prompt
+function go_prompt_info() {
+  (( $+commands[go] )) || return
+  local go_prompt
+  go_prompt=$(go version | awk '{ print substr($3, 3) }')
+  [[ -z "${go_prompt}" ]] && return
+  echo "${ZSH_THEME_GO_PROMPT_PREFIX}${go_prompt:gs/%/%%}${ZSH_THEME_GO_PROMPT_SUFFIX}"
+}

plugins/gradle/_gradle

@@ -284,6 +284,9 @@ __gradle_subcommand() {
                 '-Dorg.gradle.debug.suspend=[]' \
                 '-Dorg.gradle.debug=[]:org.gradle.debug:(true false)' \
                 '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
+                '-Dorg.gradle.isolated-projects.dangerously-ignore-problems=[]' \
+                '-Dorg.gradle.isolated-projects.diagnostics=[]' \
+                '-Dorg.gradle.isolated-projects=[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`.]' \
                 '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories' \
                 '-Dorg.gradle.java.installations.auto-detect=[]' \
                 '-Dorg.gradle.java.installations.auto-download=[]' \
@@ -299,8 +302,6 @@ __gradle_subcommand() {
                 '-Dorg.gradle.problems.report=[Enables the HTML problems report.]' \
                 '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
                 '-Dorg.gradle.tooling.parallel=[]' \
-                '-Dorg.gradle.unsafe.isolated-projects.diagnostics=[]' \
-                '-Dorg.gradle.unsafe.isolated-projects=[]' \
                 '-Dorg.gradle.vfs.verbose=[]' \
                 '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false)' \
                 '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]' \
@@ -328,12 +329,14 @@ __gradle_subcommand() {
                 \*'--include-build[Includes the specified build in the composite.]:include build:_directories' \
                 (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
                 \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
+                (--no-isolated-projects)'--isolated-projects[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`. (incubating)]' \
                 '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]' \
                 (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
                 (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
                 (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
                 (--continue)'--no-continue[Stops task execution after a task failure.]' \
                 (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+                (--isolated-projects)'--no-isolated-projects[Disables Isolated Projects. (incubating)]' \
                 (--parallel)'--no-parallel[Disables parallel project execution.]' \
                 (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
                 {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \
@@ -421,6 +424,9 @@ _gradle() {
         '-Dorg.gradle.debug.suspend=[]:->argument-expected' \
         '-Dorg.gradle.debug=[]:org.gradle.debug:(true false):->argument-expected' \
         '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Supported values are 'strict', 'lenient', or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
+        '-Dorg.gradle.isolated-projects.dangerously-ignore-problems=[]:->argument-expected' \
+        '-Dorg.gradle.isolated-projects.diagnostics=[]:->argument-expected' \
+        '-Dorg.gradle.isolated-projects=[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`.]:->argument-expected' \
         '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories:->argument-expected' \
         '-Dorg.gradle.java.installations.auto-detect=[]:->argument-expected' \
         '-Dorg.gradle.java.installations.auto-download=[]:->argument-expected' \
@@ -436,8 +442,6 @@ _gradle() {
         '-Dorg.gradle.problems.report=[Enables the HTML problems report.]:->argument-expected' \
         '-Dorg.gradle.projectcachedir=[Specifies the project-specific cache directory. Default is .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
         '-Dorg.gradle.tooling.parallel=[]:->argument-expected' \
-        '-Dorg.gradle.unsafe.isolated-projects.diagnostics=[]:->argument-expected' \
-        '-Dorg.gradle.unsafe.isolated-projects=[]:->argument-expected' \
         '-Dorg.gradle.vfs.verbose=[]:->argument-expected' \
         '-Dorg.gradle.vfs.watch=[Enables file system watching. Reuses file system data for subsequent builds.]:org.gradle.vfs.watch:(true false):->argument-expected' \
         '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Supported values are 'all', 'fail', 'summary' (default), or 'none'.]:->argument-expected' \
@@ -466,12 +470,14 @@ _gradle() {
         \*'--include-build[Includes the specified build in the composite.]:include build:_directories:->argument-expected' \
         (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Sets the log level to info.]' \
         \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
+        (--no-isolated-projects)'--isolated-projects[Enables Isolated Projects. Projects are configured in parallel. Implies `--configuration-cache`. (incubating)]' \
         '--max-workers[Configures the maximum number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
         (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
         (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
         (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
         (--continue)'--no-continue[Stops task execution after a task failure.]' \
         (--daemon)'--no-daemon[Runs the build without the Gradle daemon. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+        (--isolated-projects)'--no-isolated-projects[Disables Isolated Projects. (incubating)]' \
         (--parallel)'--no-parallel[Disables parallel project execution.]' \
         (--problems-report)'--no-problems-report[Disables the HTML problems report. (incubating)]' \
         {-a,--no-rebuild}'[Disables rebuilding of project dependencies.]' \

plugins/hasura/hasura.plugin.zsh

@@ -9,5 +9,9 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hasura" ]]; then
   source "$ZSH_CACHE_DIR/completions/_hasura"
 else
   source "$ZSH_CACHE_DIR/completions/_hasura"
-  hasura completion zsh --file "$ZSH_CACHE_DIR/completions/_hasura" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hasura"
+    zf_mv -f -- =( hasura completion zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/hcloud/hcloud.plugin.zsh

@@ -13,7 +13,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_hcloud" ]]; then
   _comps[hcloud]=_hcloud
 fi
 
-hcloud completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_hcloud" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_hcloud"
+  zf_mv -f -- =( hcloud completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # Main alias
 alias hc='hcloud'

plugins/helm/helm.plugin.zsh

@@ -9,7 +9,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_helm" ]]; then
   source "$ZSH_CACHE_DIR/completions/_helm"
 else
   source "$ZSH_CACHE_DIR/completions/_helm"
-  helm completion zsh | tee "$ZSH_CACHE_DIR/completions/_helm" >/dev/null &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_helm"
+    zf_mv -f -- =( helm completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 alias h='helm'

plugins/jj/README.md

@@ -19,35 +19,54 @@ plugins=(... jj)
 | jjbd   | `jj bookmark delete`          |
 | jjbf   | `jj bookmark forget`          |
 | jjbl   | `jj bookmark list`            |
+| jjblt  | `jj bookmark list --tracked`  |
 | jjbm   | `jj bookmark move`            |
 | jjbr   | `jj bookmark rename`          |
 | jjbs   | `jj bookmark set`             |
 | jjbt   | `jj bookmark track`           |
 | jjbu   | `jj bookmark untrack`         |
 | jjc    | `jj commit`                   |
+| jjcfg  | `jj config`                   |
+| jjcfgl | `jj config list`              |
 | jjcmsg | `jj commit --message`         |
 | jjd    | `jj diff`                     |
 | jjdmsg | `jj desc --message`           |
 | jjds   | `jj desc`                     |
+| jjdst  | `jj diff --stat`              |
 | jje    | `jj edit`                     |
+| jjev   | `jj evolog`                   |
+| jjf    | `jj file`                     |
+| jjfl   | `jj file list`                |
+| jjg    | `jj git`                      |
 | jjgcl  | `jj git clone`                |
 | jjgf   | `jj git fetch`                |
 | jjgfa  | `jj git fetch --all-remotes`  |
+| jjgi   | `jj git init`                 |
 | jjgp   | `jj git push`                 |
 | jjgpa  | `jj git push --all`           |
 | jjgpd  | `jj git push --deleted`       |
 | jjgpt  | `jj git push --tracked`       |
+| jjgrl  | `jj git remote list`          |
 | jjl    | `jj log`                      |
 | jjla   | `jj log -r "all()"`           |
 | jjn    | `jj new`                      |
 | jjnt   | `jj new "trunk()"`            |
+| jjop   | `jj op`                       |
+| jjopl  | `jj op log`                   |
+| jjor   | `jj op restore`               |
 | jjrb   | `jj rebase`                   |
 | jjrbm  | `jj rebase -d "trunk()"`      |
 | jjrs   | `jj restore`                  |
 | jjrt   | `cd "$(jj root \|\| echo .)"` |
+| jjs    | `jj show`                     |
 | jjsp   | `jj split`                    |
 | jjsq   | `jj squash`                   |
 | jjst   | `jj status`                   |
+| jju    | `jj undo`                     |
+| jjw    | `jj workspace`                |
+| jjwa   | `jj workspace add`            |
+| jjwf   | `jj workspace forget`         |
+| jjwl   | `jj workspace list`           |
 
 ## Prompt usage
 

plugins/jj/jj.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_jj" ]]; then
   _comps[jj]=_jj
 fi
 
-COMPLETE=zsh jj >| "$ZSH_CACHE_DIR/completions/_jj" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_jj"
+  zf_mv -f -- =( COMPLETE=zsh jj ) "$TMPPREFIX"
+} &|
 
 function __jj_prompt_jj() {
   local -a flags
@@ -41,35 +45,51 @@ alias jjbc='jj bookmark create'
 alias jjbd='jj bookmark delete'
 alias jjbf='jj bookmark forget'
 alias jjbl='jj bookmark list'
+alias jjblt='jj bookmark list --tracked'
 alias jjbm='jj bookmark move'
 alias jjbr='jj bookmark rename'
 alias jjbs='jj bookmark set'
 alias jjbt='jj bookmark track'
 alias jjbu='jj bookmark untrack'
 alias jjc='jj commit'
+alias jjcfg='jj config'
+alias jjcfgl='jj config list'
 alias jjcmsg='jj commit --message'
 alias jjd='jj diff'
 alias jjdmsg='jj desc --message'
 alias jjds='jj desc'
+alias jjdst='jj diff --stat'
 alias jje='jj edit'
+alias jjev='jj evolog'
+alias jjf='jj file'
+alias jjfl='jj file list'
+alias jjg='jj git'
 alias jjgcl='jj git clone'
 alias jjgf='jj git fetch'
 alias jjgfa='jj git fetch --all-remotes'
+alias jjgi='jj git init'
 alias jjgp='jj git push'
 alias jjgpa='jj git push --all'
 alias jjgpd='jj git push --deleted'
 alias jjgpt='jj git push --tracked'
+alias jjgrl='jj git remote list'
 alias jjl='jj log'
 alias jjla='jj log -r "all()"'
 alias jjn='jj new'
 alias jjnt='jj new "trunk()"'
+alias jjop='jj op'
+alias jjopl='jj op log'
+alias jjor='jj op restore'
 alias jjrb='jj rebase'
 alias jjrbm='jj rebase -d "trunk()"'
 alias jjrs='jj restore'
 alias jjrt='cd "$(jj root || echo .)"'
+alias jjs='jj show'
 alias jjsp='jj split'
 alias jjsq='jj squash'
 alias jjst='jj status'
+alias jju='jj undo'
+alias jjw='jj workspace'
 alias jjwa='jj workspace add'
 alias jjwf='jj workspace forget'
-
+alias jjwl='jj workspace list'

plugins/juju/juju.plugin.zsh

@@ -35,6 +35,7 @@ alias jdlr='juju debug-log --ms --replay'
 alias jcon='juju consume'
 alias jeb='juju export-bundle'
 alias jex='juju expose'
+alias junex='juju unexpose'
 alias jh='juju help'
 alias jkc='juju kill-controller -y -t 0'
 alias jm='juju models'

plugins/k9s/k9s.plugin.zsh

@@ -11,4 +11,8 @@ fi
 
 # and then generate it in the background. On first completion,
 # the actual completion file will be loaded.
-k9s completion zsh >| "$ZSH_CACHE_DIR/completions/_k9s" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_k9s"
+  zf_mv -f -- =( k9s completion zsh ) "$TMPPREFIX"
+} &|

plugins/kind/kind.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kind" ]]; then
 fi
 
 # Generate and load kind completion
-kind completion zsh >! "$ZSH_CACHE_DIR/completions/_kind" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kind"
+  zf_mv -f -- =( kind completion zsh ) "$TMPPREFIX"
+} &|
 
 # Register aliases
 alias kicc="kind create cluster"

plugins/kubectl/README.md

@@ -71,6 +71,7 @@ plugins=(... kubectl)
 |          |                                                         | **Secret management**                                                                            |
 | kgsec    | `kubectl get secret`                                    | Get secret for decoding                                                                          |
 | kgseca   | `kubectl get secret --all-namespaces`                   | List secrets across all namespaces                                                               |
+| kesec    | `kubectl edit secret`                                   | Edit secret resource                                                                             |
 | kdsec    | `kubectl describe secret`                               | Describe secret resource in detail                                                               |
 | kdelsec  | `kubectl delete secret`                                 | Delete the secret                                                                                |
 |          |                                                         | **Deployment management**                                                                        |

plugins/kubectl/kubectl.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_kubectl" ]]; then
   _comps[kubectl]=_kubectl
 fi
 
-kubectl completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_kubectl" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_kubectl"
+  zf_mv -f -- =( kubectl completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 # This command is used a LOT both below and in daily life
 alias k=kubectl
@@ -89,6 +93,7 @@ alias kdelcm='kubectl delete configmap'
 # Secret management
 alias kgsec='kubectl get secret'
 alias kgseca='kubectl get secret --all-namespaces'
+alias kesec='kubectl edit secret'
 alias kdsec='kubectl describe secret'
 alias kdelsec='kubectl delete secret'
 

plugins/laravel/README.md

@@ -42,6 +42,8 @@ plugins=(... laravel)
 | `pamen` | `php artisan make:enum` |
 | `pami`  | `php artisan make:interface` |
 | `pamtr` | `php artisan make:trait` |
+| `pamv` | `php artisan make:view` |
+| `pammig` | `php artisan make:migration` |
 
 ## Clears
 

plugins/laravel/laravel.plugin.zsh

@@ -31,6 +31,8 @@ alias pamcl='php artisan make:class'
 alias pamen='php artisan make:enum'
 alias pami='php artisan make:interface'
 alias pamtr='php artisan make:trait'
+alias pamv='php artisan make:view'
+alias pammig='php artisan make:migration'
 
 
 # Clears

plugins/minikube/minikube.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_minikube" ]]; then
   _comps[minikube]=_minikube
 fi
 
-minikube completion zsh >| "$ZSH_CACHE_DIR/completions/_minikube" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_minikube"
+  zf_mv -f -- =( minikube completion zsh ) "$TMPPREFIX"
+} &|

plugins/mise/mise.plugin.zsh

@@ -1,9 +1,14 @@
-if (( ! $+commands[mise] )); then
+if (( $+commands[mise] )); then
+  _mise_bin=mise
+elif [[ -x ~/.local/bin/mise ]]; then
+  _mise_bin=~/.local/bin/mise
+else
   return
 fi
 
 # Load mise hooks
-eval "$(mise activate zsh)"
+eval "$($_mise_bin activate zsh)"
+unset _mise_bin
 
 # If the completion file doesn't exist yet, we need to autoload it and
 # bind it to `mise`. Otherwise, compinit will have already done that.
@@ -14,4 +19,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_mise" ]]; then
 fi
 
 # Generate and load mise completion
-mise completion zsh >| "$ZSH_CACHE_DIR/completions/_mise" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_mise"
+  zf_mv -f -- =( mise completion zsh ) "$TMPPREFIX"
+} &|

plugins/molecule/molecule.plugin.zsh

@@ -11,7 +11,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_molecule" ]]; then
   _comps[molecule]=_molecule
 fi
 
-_MOLECULE_COMPLETE=zsh_source molecule >| "$ZSH_CACHE_DIR/completions/_molecule" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_molecule"
+  zf_mv -f -- =( _MOLECULE_COMPLETE=zsh_source molecule ) "$TMPPREFIX"
+} &|
 
 # Alias
 # molecule: https://docs.ansible.com/projects/molecule/

plugins/mongo-atlas/mongo-atlas.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_atlas" ]]; then
   _comps[atlas]=_atlas
 fi
 
-atlas completion zsh >| "$ZSH_CACHE_DIR/completions/atlas" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_atlas"
+  zf_mv -f -- =( atlas completion zsh ) "$TMPPREFIX"
+} &|

plugins/nats/nats.plugin.zsh

@@ -7,7 +7,11 @@ if (( $+commands[nsc] )); then
     _comps[nsc]=_nsc
   fi
 
-  nsc completion zsh >| "$ZSH_CACHE_DIR/completions/_nsc" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nsc"
+    zf_mv -f -- =( nsc completion zsh ) "$TMPPREFIX"
+  } &|
 fi
 
 if (( $+commands[nats] )); then
@@ -19,5 +23,9 @@ if (( $+commands[nats] )); then
     _comps[nats]=_nats
   fi
 
-  nats --completion-script-zsh >| "$ZSH_CACHE_DIR/completions/_nats" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_nats"
+    zf_mv -f -- =( nats --completion-script-zsh ) "$TMPPREFIX"
+  } &|
 fi

plugins/ngrok/ngrok.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_ngrok" ]]; then
   _comps[ngrok]=_ngrok
 fi
 
-ngrok completion zsh >| "$ZSH_CACHE_DIR/completions/_ngrok" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_ngrok"
+  zf_mv -f -- =( ngrok completion zsh ) "$TMPPREFIX"
+} &|

plugins/pass-cli/pass-cli.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pass-cli" ]]; then
   _comps[pass-cli]=_pass-cli
 fi
 
-pass-cli completions zsh >| "$ZSH_CACHE_DIR/completions/_pass-cli" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pass-cli"
+  zf_mv -f -- =( pass-cli completions zsh ) "$TMPPREFIX"
+} &|

plugins/pipenv/pipenv.plugin.zsh

@@ -43,7 +43,11 @@ else
     _comps[pipenv]=_pipenv
   fi
 
-  _PIPENV_COMPLETE=zsh_source pipenv >| "$ZSH_CACHE_DIR/completions/_pipenv" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pipenv"
+    zf_mv -f -- =( _PIPENV_COMPLETE=zsh_source pipenv ) "$TMPPREFIX"
+  } &|
 fi
 
 if zstyle -T ':omz:plugins:pipenv' auto-shell; then
@@ -52,19 +56,26 @@ if zstyle -T ':omz:plugins:pipenv' auto-shell; then
     # deactivate shell if Pipfile doesn't exist and not in a subdir
     if [[ ! -f "$PWD/Pipfile" ]]; then
       if [[ "$PIPENV_ACTIVE" == 1 ]]; then
-        if [[ "$PWD" != "$pipfile_dir"* ]]; then
+        # Compare whole path components: `$pipfile_dir"*` also matches unrelated
+        # siblings that merely start with the same text (…/proj -> …/proj-docs),
+        # which would keep the virtualenv active outside the project.
+        local project_dir="${pipfile_dir%/}"
+        if [[ "$PWD" != "$project_dir" && "$PWD" != "$project_dir"/* ]]; then
           unset PIPENV_ACTIVE pipfile_dir
           deactivate
         fi
       fi
     fi
 
-    # activate the shell if Pipfile exists
+    # activate the shell if Pipfile exists and its virtualenv is usable
     if [[ "$PIPENV_ACTIVE" != 1 ]]; then
       if [[ -f "$PWD/Pipfile" ]]; then
-        export pipfile_dir="$PWD"
-        source "$(pipenv --venv)/bin/activate"
-        export PIPENV_ACTIVE=1
+        local venv_path
+        if venv_path="$(pipenv --venv 2>/dev/null)" && [[ -n "$venv_path" && -f "$venv_path/bin/activate" ]]; then
+          export pipfile_dir="$PWD"
+          source "$venv_path/bin/activate"
+          export PIPENV_ACTIVE=1
+        fi
       fi
     fi
   }

plugins/podman/podman.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_podman" ]]; then
   _comps[podman]=_podman
 fi
 
-podman completion zsh 2> /dev/null >| "$ZSH_CACHE_DIR/completions/_podman" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_podman"
+  zf_mv -f -- =( podman completion zsh 2> /dev/null ) "$TMPPREFIX"
+} &|
 
 alias pbl='podman build'
 alias pcin='podman container inspect'

plugins/poetry-env/README.md

@@ -1,7 +1,9 @@
 # Poetry Environment Plugin
 
-This plugin automatically changes poetry environment when you cd into or out of the project directory.
-Note: Script looks for pyproject.toml file to determine poetry if its a poetry environment
+This plugin automatically activates a Poetry environment when you enter a
+directory containing both `pyproject.toml` and `poetry.lock`. It keeps the
+environment active in project subdirectories, switches to nested Poetry
+projects, and deactivates it when you leave the project tree.
 
 To use it, add `poetry-env` to the plugins array in your zshrc file:
 

plugins/poetry-env/poetry-env.plugin.zsh

@@ -1,20 +1,29 @@
 _togglePoetryShell() {
   # Determine if currently in a Poetry-managed directory
   local in_poetry_dir=0
+  local in_active_poetry_dir=0
   if [[ -f "$PWD/pyproject.toml" && -f "$PWD/poetry.lock" ]]; then
     in_poetry_dir=1
   fi
 
-  # Deactivate the current environment if moving out of a Poetry directory or into a different Poetry directory
-  if [[ $poetry_active -eq 1 ]] && { [[ $in_poetry_dir -eq 0 ]] || [[ "$PWD" != "$poetry_dir"* ]]; }; then
-    export poetry_active=0
-    unset poetry_dir
-    (( $+functions[deactivate] )) && deactivate
+  # Deactivate when leaving the active project or entering a nested project
+  if [[ $poetry_active -eq 1 ]]; then
+    local project_dir="${poetry_dir%/}"
+    if [[ "$PWD" == "$project_dir" || "$PWD" == "$project_dir"/* ]]; then
+      in_active_poetry_dir=1
+    fi
+
+    if [[ $in_active_poetry_dir -eq 0 ]] ||
+      { [[ $in_poetry_dir -eq 1 ]] && [[ "$PWD" != "$poetry_dir" ]]; }; then
+      export poetry_active=0
+      unset poetry_dir
+      (( $+functions[deactivate] )) && deactivate
+    fi
   fi
 
   # Activate the environment if in a Poetry directory and no environment is currently active
   if [[ $in_poetry_dir -eq 1 ]] && [[ $poetry_active -ne 1 ]]; then
-    venv_dir=$(poetry env info --path 2>/dev/null)
+    local venv_dir=$(poetry env info --path 2>/dev/null)
     # Handle case where poetry returns "." for in-project virtual environments
     if [[ "$venv_dir" == "." ]]; then
       venv_dir="$PWD/.venv"

plugins/poetry/poetry.plugin.zsh

@@ -39,4 +39,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_poetry" ]]; then
   _comps[poetry]=_poetry
 fi
 
-poetry completions zsh >| "$ZSH_CACHE_DIR/completions/_poetry" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_poetry"
+  zf_mv -f -- =( poetry completions zsh ) "$TMPPREFIX"
+} &|

plugins/procs/procs.plugin.zsh

@@ -10,12 +10,16 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_procs" ]]; then
   _comps[procs]=_procs
 fi
 
-{
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_procs"
   autoload -Uz is-at-least
   local _version=$(procs --version)
-  if is-at-least "0.14" "${_version#procs }"; then
-    procs --gen-completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  else
-    procs --completion-out zsh >| "$ZSH_CACHE_DIR/completions/_procs"
-  fi
+  zf_mv -f -- =(
+    if is-at-least "0.14" "${_version#procs }"; then
+      procs --gen-completion-out zsh
+    else
+      procs --completion-out zsh
+    fi
+  ) "$TMPPREFIX"
 } &|

plugins/pulumi/pulumi.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_pulumi" ]]; then
   _comps[pulumi]=_pulumi
 fi
 
-pulumi gen-completion zsh >| "$ZSH_CACHE_DIR/completions/_pulumi" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_pulumi"
+  zf_mv -f -- =( pulumi gen-completion zsh ) "$TMPPREFIX"
+} &|
 
 # Aliases
 alias pul='pulumi'

plugins/qodana/qodana.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_qodana" ]]; then
   _comps[qodana]=_qodana
 fi
 
-qodana completion zsh >| "$ZSH_CACHE_DIR/completions/_qodana" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_qodana"
+  zf_mv -f -- =( qodana completion zsh ) "$TMPPREFIX"
+} &|

plugins/rails/README.md

@@ -54,6 +54,33 @@ plugins=(... rails)
 | `rta`   | `rails test:all`                 | Runs all Rails tests, including system tests           |
 | `ru`    | `rails runner`                   | Run Ruby code in the context of Rails                  |
 
+### Multiple databases
+
+Rails applications can define more than one database (`primary`, `cache`, `cable`,
+`queue`, ...), and each one gets its own namespaced task. These commands accept an
+optional database name as the first argument:
+
+`rdc`, `rdd`, `rdm`, `rdmd`, `rdmr`, `rdms`, `rdmu`, `rdr`, `rdrs`, `rdsl`
+
+```zsh
+rdm                    # rails db:migrate
+rdm cache              # rails db:migrate:cache
+rdm VERSION=20231225   # rails db:migrate VERSION=20231225
+rdm cache STEP=2       # rails db:migrate:cache STEP=2
+rdm --trace            # rails db:migrate --trace
+```
+
+The first argument is read as a database name only when it is a bare word. Flags
+(`--trace`), variables (`STEP=2`) and other tasks (`db:seed`) are passed through to
+`rails` unchanged, so previous usage keeps working. When a database name is given,
+the resolved command is printed so it is clear which database is being used.
+
+`rdmrs` is not in the list above because Rails does not define a per-database
+`db:migrate:reset` task.
+
+Note that these are implemented as shell functions rather than aliases, so they will
+not appear in the output of `alias`.
+
 ### Foreman
 
 | Alias  | Command         | Description                               |

plugins/rails/rails.plugin.zsh

@@ -47,19 +47,9 @@ alias rc='rails console'
 alias rcs='rails console --sandbox'
 alias rd='rails destroy'
 alias rdb='rails dbconsole'
-alias rdc='rails db:create'
-alias rdd='rails db:drop'
-alias rdm='rails db:migrate'
-alias rdmd='rails db:migrate:down'
-alias rdmr='rails db:migrate:redo'
 alias rdmrs='rails db:migrate:reset'
-alias rdms='rails db:migrate:status'
 alias rdmtc='rails db:migrate db:test:clone'
-alias rdmu='rails db:migrate:up'
-alias rdr='rails db:rollback'
-alias rdrs='rails db:reset'
 alias rds='rails db:seed'
-alias rdsl='rails db:schema:load'
 alias rdtc='rails db:test:clone'
 alias rdtp='rails db:test:prepare'
 alias rgen='rails generate'
@@ -106,6 +96,47 @@ alias rkn='rake notes'
 alias rksts='rake stats'
 alias rkt='rake test'
 
+# Database tasks
+#
+# Rails applications can define more than one database (primary, cache, cable,
+# queue, ...). Each one gets its own namespaced task, e.g. `db:migrate:cache`.
+# The functions below take an optional database name as the first argument:
+#
+#   rdm                    ->  rails db:migrate
+#   rdm cache              ->  rails db:migrate:cache
+#   rdm VERSION=20231225   ->  rails db:migrate VERSION=20231225
+#   rdm cache STEP=2       ->  rails db:migrate:cache STEP=2
+#   rdm --trace            ->  rails db:migrate --trace
+#
+# The first argument is read as a database name only when it is a bare word.
+# Flags (--trace), variables (STEP=2) and other tasks (db:seed) are passed
+# through to rails untouched, so the previous alias behavior still works.
+function _rails_db_command() {
+  local task="$1"
+  shift
+
+  if [[ $# -gt 0 && "$1" != -* && "$1" != *=* && "$1" != *:* ]]; then
+    task="$task:$1"
+    shift
+    # Echo the resolved task so it is clear which database is being used
+    local -a cmd=(rails "$task" "$@")
+    print -u2 -r -- "Running: ${cmd[*]}"
+  fi
+
+  rails "$task" "$@"
+}
+
+function rdc()  { _rails_db_command db:create "$@" }
+function rdd()  { _rails_db_command db:drop "$@" }
+function rdm()  { _rails_db_command db:migrate "$@" }
+function rdmd() { _rails_db_command db:migrate:down "$@" }
+function rdmr() { _rails_db_command db:migrate:redo "$@" }
+function rdms() { _rails_db_command db:migrate:status "$@" }
+function rdmu() { _rails_db_command db:migrate:up "$@" }
+function rdr()  { _rails_db_command db:rollback "$@" }
+function rdrs() { _rails_db_command db:reset "$@" }
+function rdsl() { _rails_db_command db:schema:load "$@" }
+
 # legacy stuff
 alias sc='ruby script/console'
 alias sd='ruby script/destroy'

plugins/rbw/rbw.plugin.zsh

@@ -10,7 +10,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rbw" ]]; then
   _comps[rbw]=_rbw
 fi
 
-rbw gen-completions zsh >| "$ZSH_CACHE_DIR/completions/_rbw" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rbw"
+  zf_mv -f -- =( rbw gen-completions zsh ) "$TMPPREFIX"
+} &|
 
 # rbwpw function copies the password of a service to the clipboard
 # and clears it after 20 seconds

plugins/rclone/rclone.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rclone" ]]; then
   _comps[rclone]=_rclone
 fi
 
-rclone completion zsh - >| "$ZSH_CACHE_DIR/completions/_rclone" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rclone"
+  zf_mv -f -- =( rclone completion zsh - ) "$TMPPREFIX"
+} &|

plugins/ruff/README.md

@@ -0,0 +1,22 @@
+# ruff plugin
+
+This plugin automatically installs [ruff](https://github.com/astral-sh/ruff)'s completions for you,
+and keeps them up to date. It also adds convenient aliases for common usage.
+
+To use it, add `ruff` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... ruff)
+```
+
+## Aliases
+
+| Alias | Command              | Description                                                  |
+| :---- | -------------------- | :----------------------------------------------------------- |
+| ruc   | `ruff check`         | Run Ruff linter on the given files or directories            |
+| rucf  | `ruff check --fix`   | Run Ruff linter and fix auto-fixable issues                  |
+| ruf   | `ruff format`        | Run the Ruff formatter on the given files or directories     |
+| rufc  | `ruff format --check`| Check if files are already formatted without making changes  |
+| rur   | `ruff rule`          | Explain a rule (or all rules)                                |
+| rul   | `ruff linter`        | List all supported upstream linters                          |
+| rucl  | `ruff clean`         | Clear any caches in the current directory and subdirectories |

plugins/ruff/ruff.plugin.zsh

@@ -0,0 +1,27 @@
+# Return immediately if ruff is not found
+if (( ! ${+commands[ruff]} )); then
+  return
+fi
+
+alias ruc='ruff check'
+alias rucf='ruff check --fix'
+alias ruf='ruff format'
+alias rufc='ruff format --check'
+alias rur='ruff rule'
+alias rul='ruff linter'
+alias rucl='ruff clean'
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_ruff" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _ruff
+  _comps[ruff]=_ruff
+fi
+
+# Overwrites the file each time as completions might change with ruff versions.
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_ruff"
+  zf_mv -f -- =( ruff generate-shell-completion zsh ) "$TMPPREFIX"
+} &|

plugins/rust/rust.plugin.zsh

@@ -19,7 +19,11 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_rustup" ]]; then
 fi
 
 # Generate completion files in the background
-rustup completions zsh >| "$ZSH_CACHE_DIR/completions/_rustup" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_rustup"
+  zf_mv -f -- =( rustup completions zsh ) "$TMPPREFIX"
+} &|
 cat >| "$ZSH_CACHE_DIR/completions/_cargo" <<'EOF'
 #compdef cargo
 source "$(rustup run ${${(z)$(rustup default)}[1]} rustc --print sysroot)"/share/zsh/site-functions/_cargo

plugins/sigstore/sigstore.plugin.zsh

@@ -12,7 +12,11 @@ function install_autocompletion {
     _comps[$1]=_$1
   fi
 
-  $1 completion zsh >| "$ZSH_CACHE_DIR/completions/_$1" &|
+  zmodload -F zsh/files b:zf_mv
+  () {
+    local TMPPREFIX="$ZSH_CACHE_DIR/completions/_$1"
+    zf_mv -f -- =( $1 completion zsh ) "$TMPPREFIX"
+  } "$1" &|
 }
 
 install_autocompletion cosign

plugins/skaffold/skaffold.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_skaffold" ]]; then
   _comps[skaffold]=_skaffold
 fi
 
-skaffold completion zsh >| "$ZSH_CACHE_DIR/completions/_skaffold" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_skaffold"
+  zf_mv -f -- =( skaffold completion zsh ) "$TMPPREFIX"
+} &|

plugins/ssh-agent/ssh-agent.plugin.zsh

@@ -101,10 +101,18 @@ if zstyle -t :omz:plugins:ssh-agent agent-forwarding \
    && [[ -n "$SSH_AUTH_SOCK" ]]; then
   if [[ ! -L "$SSH_AUTH_SOCK" ]]; then
     if [[ -n "$TERMUX_VERSION" ]]; then
-      ln -sf "$SSH_AUTH_SOCK" "$PREFIX"/tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link="$PREFIX"/tmp/ssh-agent-$USERNAME-screen
     else
-      ln -sf "$SSH_AUTH_SOCK" /tmp/ssh-agent-$USERNAME-screen
+      _omz_ssh_agent_link=/tmp/ssh-agent-$USERNAME-screen
     fi
+    # `ln -sf` unlinks the old symlink and then creates the new one: two
+    # syscalls, no atomic swap. Shells starting concurrently (a tmux window
+    # opening several panes at once) interleave those steps and all but one
+    # fail with "ln: ...: File exists". Stage the link under a PID-unique
+    # name and move it into place, since rename(2) is atomic.
+    command ln -sf "$SSH_AUTH_SOCK" "$_omz_ssh_agent_link.$$" \
+      && command mv -f "$_omz_ssh_agent_link.$$" "$_omz_ssh_agent_link"
+    unset _omz_ssh_agent_link
   fi
 else
   _start_agent

plugins/stripe/stripe.plugin.zsh

@@ -10,4 +10,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_stripe" ]]; then
   _comps[stripe]=_stripe
 fi
 
-stripe completion --shell zsh --write-to-stdout >| "$ZSH_CACHE_DIR/completions/_stripe" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_stripe"
+  zf_mv -f -- =( stripe completion --shell zsh --write-to-stdout ) "$TMPPREFIX"
+} &|

plugins/sublime-merge/sublime-merge.plugin.zsh

@@ -19,6 +19,7 @@
 				ssm_run_sudo() {sudo $_sublime_merge_path "$@" >/dev/null 2>&1}
 				alias ssm=ssm_run_sudo
 				alias sm=sm_run
+				alias smerge="'$_sublime_merge_path'"
 				break
 			fi
 		done
@@ -33,6 +34,7 @@
 			if [[ -a $_sublime_merge_path ]]; then
 				subm () { "$_sublime_merge_path" "$@" }
 				alias sm=subm
+				alias smerge="'$_sublime_merge_path'"
 				break
 			fi
 		done
@@ -45,6 +47,7 @@
 			if [[ -a $_sublime_merge_path ]]; then
 				subm () { "$_sublime_merge_path" "$@" }
 				alias sm=subm
+				alias smerge="'$_sublime_merge_path'"
 				break
 			fi
 		done

plugins/symfony6/symfony6.plugin.zsh

@@ -15,8 +15,8 @@
 #   - https://github.com/symfony/symfony/blob/5.4/src/Symfony/Component/Console/Resources/completion.bash
 #
 _sf_console() {
-    local lastParam flagPrefix requestComp out comp
-    local -a completions
+    local lastParam out comp sf_cmd
+    local -a completions flagPrefix requestComp inputs
 
     # The user could have moved the cursor backwards on the command-line.
     # We need to trigger completion from the $CURRENT location, so we need
@@ -29,11 +29,20 @@ _sf_console() {
     setopt local_options BASH_REMATCH
     if [[ "${lastParam}" =~ '-.*=' ]]; then
         # We are dealing with a flag with an =
-        flagPrefix="-P ${BASH_REMATCH}"
+        flagPrefix=(-P "${BASH_REMATCH}")
     fi
 
-    # Prepare the command to obtain completions
-    requestComp="${words[0]} ${words[1]} _complete --no-interaction -szsh -a1 -c$((CURRENT-1))" i=""
+    # Prepare the command to obtain completions. An alias is resolved here,
+    # because the request is no longer read again by the shell.
+    sf_cmd="${words[1]}"
+    if [[ -n "${aliases[$sf_cmd]}" ]]; then
+        requestComp=(${(z)aliases[$sf_cmd]})
+    else
+        requestComp=(${~sf_cmd})
+    fi
+
+    requestComp+=(_complete --no-interaction -szsh -a1 "-c$((CURRENT-1))")
+
     for w in ${words[@]}; do
         w=$(printf -- '%b' "$w")
         # remove quotes from typed values
@@ -47,19 +56,18 @@ _sf_console() {
         fi
         # empty values are ignored
         if [ ! -z "$w" ]; then
-            i="${i}-i${w} "
+            inputs+=("-i$w")
         fi
     done
 
     # Ensure at least 1 input
-    if [ "${i}" = "" ]; then
-        requestComp="${requestComp} -i\" \""
-    else
-        requestComp="${requestComp} ${i}"
+    if (( ! $#inputs )); then
+        inputs=(-i' ')
     fi
 
-    # Use eval to handle any environment variables and such
-    out=$(eval ${requestComp} 2>/dev/null)
+    # The request is run without being read again by the shell, so that a
+    # "$(...)" or a backtick typed on the command line is not executed
+    out=$(SHELL_VERBOSITY=0 "${requestComp[@]}" "${inputs[@]}" 2>/dev/null)
 
     while IFS='\n' read -r comp; do
         if [ -n "$comp" ]; then
@@ -75,7 +83,7 @@ _sf_console() {
     done < <(printf "%s\n" "${out[@]}")
 
     # Let inbuilt _describe handle completions
-    eval _describe "completions" completions $flagPrefix
+    _describe "completions" completions "${flagPrefix[@]}"
     return $?
 }
 

plugins/systemadmin/systemadmin.plugin.zsh

@@ -138,7 +138,7 @@ function consume100() {
 
 # Website traffic statistics (G)
 function webtraffic() {
-  awk "{sum+=$10} END {print sum/1024/1024/1024}" "$(retlog)"
+  awk '{sum+=$10} END {print sum/1024/1024/1024}' "$(retlog)"
 }
 
 # Statistical connections 404

plugins/tailscale/tailscale.plugin.zsh

@@ -22,4 +22,8 @@ if (( $+aliases[tailscale] )); then
   _comps[${aliases[tailscale]:t}]=_tailscale
 fi
 
-tailscale completion zsh >| "$ZSH_CACHE_DIR/completions/_tailscale" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_tailscale"
+  zf_mv -f -- =( tailscale completion zsh ) "$TMPPREFIX"
+} &|

plugins/task/task.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_task" ]]; then
 fi
 
 # Generate and load task completion
-task --completion zsh >! "$ZSH_CACHE_DIR/completions/_task" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_task"
+  zf_mv -f -- =( task --completion zsh ) "$TMPPREFIX"
+} &|

plugins/timoni/timoni.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_timoni" ]]; then
   _comps[timoni]=_timoni
 fi
 
-timoni completion zsh >| "$ZSH_CACHE_DIR/completions/_timoni" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_timoni"
+  zf_mv -f -- =( timoni completion zsh ) "$TMPPREFIX"
+} &|

plugins/uv-env/README.md

@@ -0,0 +1,10 @@
+# uv Environment Plugin
+
+This plugin automatically activates the uv virtual environment when you cd into a project directory, and deactivates it when you cd out.
+Note: Script looks for pyproject.toml and uv.lock files to determine if it's a uv project
+
+To use it, add `uv-env` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... uv-env)
+```

plugins/uv-env/uv-env.plugin.zsh

@@ -0,0 +1,26 @@
+_toggleUvShell() {
+  local in_uv_dir=0
+  if [[ -f "$PWD/pyproject.toml" && -f "$PWD/uv.lock" ]]; then
+    in_uv_dir=1
+  fi
+
+  if [[ $uv_active -eq 1 ]] && { [[ $in_uv_dir -eq 0 ]] || [[ "$PWD" != "$uv_dir" && "$PWD" != "$uv_dir"/* ]]; }; then
+    typeset -g uv_active=0
+    unset uv_dir
+    (( $+functions[deactivate] )) && deactivate
+  fi
+
+  if [[ $in_uv_dir -eq 1 ]] && [[ $uv_active -ne 1 ]]; then
+    local venv_dir="${UV_PROJECT_ENVIRONMENT:-$PWD/.venv}"
+    [[ "$venv_dir" != /* ]] && venv_dir="$PWD/$venv_dir"
+
+    if [[ -f "${venv_dir}/bin/activate" ]]; then
+      typeset -g uv_active=1
+      typeset -g uv_dir="$PWD"
+      source "${venv_dir}/bin/activate"
+    fi
+  fi
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook chpwd _toggleUvShell
+_toggleUvShell

plugins/uv/uv.plugin.zsh

@@ -43,5 +43,12 @@ fi
 
 # uv and uvx are installed together (uvx is an alias to `uv tool run`)  
 # Overwrites the file each time as completions might change with uv versions.
-uv generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uv" &|
-uvx --generate-shell-completion zsh >| "$ZSH_CACHE_DIR/completions/_uvx" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uv"
+  zf_mv -f -- =( uv generate-shell-completion zsh ) "$TMPPREFIX"
+} &|
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_uvx"
+  zf_mv -f -- =( uvx --generate-shell-completion zsh ) "$TMPPREFIX"
+} &|

plugins/vagrant/_vagrant

@@ -47,6 +47,7 @@ _box_arguments=(
     'help:COMMAND List subcommands'
     'list:Lists all installed boxes'
     'outdated:Checks if a box has newer version'
+    'prune:Removes old versions of installed boxes'
     'remove:NAME Removes a box from the system'
     'repackage:NAME PROVIDER VERSION Repackages an installed box into a `.box` file'
     'update:Updates box to a newer version, if available'
@@ -126,7 +127,7 @@ case $state in
       (box)
           __vagrant-box
       ;;
-      (up|provision|port|package|destroy|reload|ssh|ssh-config|halt|resume|status)
+      (up|provision|port|package|destroy|reload|ssh|ssh-config|halt|resume|status|suspend|rdp)
       _arguments ':feature:__vm_list'
     esac
   ;;

plugins/virtualenvwrapper/virtualenvwrapper.plugin.zsh

@@ -39,7 +39,7 @@ if [[ ! $DISABLE_VENV_CD -eq 1 ]]; then
       # Get absolute path, resolving symlinks
       local PROJECT_ROOT="${PWD:A}"
       while [[ "$PROJECT_ROOT" != "/" && ! -e "$PROJECT_ROOT/.venv" \
-          && ! -d "$PROJECT_ROOT/.git" ]]; do
+          && ! -e "$PROJECT_ROOT/.git" ]]; do
         PROJECT_ROOT="${PROJECT_ROOT:h}"
       done
 

plugins/volta/volta.plugin.zsh

@@ -11,4 +11,8 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_volta" ]]; then
   _comps[volta]=_volta
 fi
 
-volta completions zsh >| "$ZSH_CACHE_DIR/completions/_volta" &|
+zmodload -F zsh/files b:zf_mv
+() {
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_volta"
+  zf_mv -f -- =( volta completions zsh ) "$TMPPREFIX"
+} &|

plugins/web-search/README.md

@@ -51,6 +51,11 @@ Available search contexts are:
 | `npmpkg`              | `https://www.npmjs.com/search?q=`               |
 | `packagist`           | `https://packagist.org/?query=`                 |
 | `gopkg`               | `https://pkg.go.dev/search?m=package&q=`        |
+| `maven`               | `https://central.sonatype.com/search?q=`        |
+| `pypi`                | `https://pypi.org/search/?q=`                   |
+| `aur`                 | `https://aur.archlinux.org/packages?O=0&K=`     |
+| `archwiki`            | `https://wiki.archlinux.org/index.php?search=`  |
+| `wikipedia`           | `https://en.wikipedia.org/w/index.php?search=`  |
 | `chatgpt`             | `https://chatgpt.com/?q=`                       |
 | `claudeai`            | `https://claude.ai/new?q=`                      |
 | `grokcom`             | `https://grok.com/?q=`                          |

plugins/web-search/web-search.plugin.zsh

@@ -32,6 +32,11 @@ function web_search() {
     npmpkg          "https://www.npmjs.com/search?q="
     packagist       "https://packagist.org/?query="
     gopkg           "https://pkg.go.dev/search?m=package&q="
+    maven           "https://central.sonatype.com/search?q="
+    pypi            "https://pypi.org/search/?q="
+    aur             "https://aur.archlinux.org/packages?O=0&K="
+    archwiki        "https://wiki.archlinux.org/index.php?search="
+    wikipedia       "https://en.wikipedia.org/w/index.php?search="
     chatgpt         "https://chatgpt.com/?q="
     grok            "https://grok.com/?q="
     claudeai        "https://claude.ai/new?q="
@@ -92,6 +97,11 @@ alias gems='web_search gems'
 alias npmpkg='web_search npmpkg'
 alias packagist='web_search packagist'
 alias gopkg='web_search gopkg'
+alias maven='web_search maven'
+alias pypi='web_search pypi'
+alias aur='web_search aur'
+alias archwiki='web_search archwiki'
+alias wikipedia='web_search wikipedia'
 alias chatgpt='web_search chatgpt'
 alias grokcom='web_search grok'
 alias claudeai='web_search claudeai'
@@ -116,4 +126,3 @@ if [[ ${#ZSH_WEB_SEARCH_ENGINES} -gt 0 ]]; then
   done
   unset engines key
 fi
-

themes/strug.zsh-theme

@@ -4,8 +4,8 @@ export LSCOLORS=dxFxCxDxBxegedabagacad
 
 local git_branch='$(git_prompt_info)%{$reset_color%}$(git_remote_status)'
 
-PROMPT="%{$fg[green]%}╭─%n@%m %{$reset_color%}%{$fg[yellow]%}in %~ %{$reset_color%}${git_branch}
-%{$fg[green]%}╰\$ %{$reset_color%}"
+PROMPT="%{%(#~$fg[red]~$fg[green])%}╭─%n@%m %{$reset_color%}%{$fg[yellow]%}in %~ %{$reset_color%}${git_branch}
+%{%(#~$fg[red]~$fg[green])%}╰%(#~#~\$) %{$reset_color%}"
 
 ZSH_THEME_GIT_PROMPT_PREFIX="%{$fg_bold[yellow]%}on "
 ZSH_THEME_GIT_PROMPT_SUFFIX="%{$reset_color%}"

tools/changelog.sh

@@ -221,12 +221,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks

tools/check_for_upgrade.sh

@@ -23,12 +23,32 @@ zstyle -s ':omz:update' mode update_mode || {
 # - the automatic update is disabled
 # - the current user doesn't have write permissions nor owns the $ZSH directory
 # - is not run from a tty
-# - git is unavailable on the system
-# - $ZSH is not a git repository
 if [[ "$update_mode" = disabled ]] \
    || [[ ! -w "$ZSH" || ! -O "$ZSH" ]] \
-   || [[ ! -t 1 && ${POWERLEVEL9K_INSTANT_PROMPT:-off} == off ]] \
-   || ! command git --version 2>&1 >/dev/null \
+   || [[ ! -t 1 && ${POWERLEVEL9K_INSTANT_PROMPT:-off} == off ]]; then
+  unset update_mode
+  return
+fi
+
+# Cancel update if it's not time to check yet. This runs before the git checks
+# below because those fork on every startup. Skipped when a background update
+# left a result that still needs to be reported (EXIT_STATUS is set).
+() {
+  local LAST_EPOCH EXIT_STATUS ERROR epoch_target
+  zmodload zsh/datetime
+  source "${ZSH_CACHE_DIR}/.zsh-update" 2>/dev/null || return 1
+  [[ -n "$LAST_EPOCH" && -z "$EXIT_STATUS" ]] || return 1
+  zstyle -s ':omz:update' frequency epoch_target || epoch_target=${UPDATE_ZSH_DAYS:-13}
+  (( ( EPOCHSECONDS / 60 / 60 / 24 - LAST_EPOCH ) < epoch_target ))
+} && {
+  unset update_mode
+  return
+}
+
+# Cancel update if:
+# - git is unavailable on the system
+# - $ZSH is not a git repository
+if ! command git --version >/dev/null 2>&1 \
    || (builtin cd -q "$ZSH"; ! command git rev-parse --is-inside-work-tree &>/dev/null); then
   unset update_mode
   return

tools/install.sh

@@ -49,9 +49,31 @@ USER=${USER:-$(id -u -n)}
 # $HOME is defined at the time of login, but it could be unset. If it is unset,
 # a tilde by itself (~) will not be expanded to the current user's home directory.
 # POSIX: https://pubs.opengroup.org/onlinepubs/009696899/basedefs/xbd_chap08.html#tag_08_03
-HOME="${HOME:-$(getent passwd $USER 2>/dev/null | cut -d: -f6)}"
-# macOS does not have getent, but this works even if $HOME is unset
-HOME="${HOME:-$(eval echo ~"$USER")}"
+if [ -z "$HOME" ]; then
+  HOME=$(getent passwd "$USER" 2>/dev/null | cut -d: -f6)
+
+  # macOS does not have getent; fall back to tilde expansion, but only if
+  # $USER is a safe username. The eval below would otherwise expand any shell
+  # metacharacters in $USER and allow command injection (CWE-78).
+  case "$USER" in
+    *[![:alnum:]_.-]*|'')
+      ;;
+    *)
+      resolved_home=$(eval echo ~"$USER")
+      # Unknown users are not expanded and produce a literal "~username".
+      [ "$resolved_home" = "~$USER" ] || HOME=$resolved_home
+      ;;
+  esac
+
+  case "$HOME" in
+    /*) ;;
+    *)
+      echo "Error: unable to determine the current user's home directory." >&2
+      echo "Set HOME explicitly and rerun the installer." >&2
+      exit 1
+      ;;
+  esac
+fi
 
 
 # Track if $ZSH was provided
@@ -168,12 +190,12 @@ supports_hyperlinks() {
 
   # If $TERM_PROGRAM is set, these terminals support hyperlinks
   case "$TERM_PROGRAM" in
-  Hyper|iTerm.app|terminology|WezTerm|vscode) return 0 ;;
+  ghostty|Hyper|iTerm.app|terminology|vscode|WezTerm) return 0 ;;
   esac
 
   # These termcap entries support hyperlinks
   case "$TERM" in
-  xterm-kitty|alacritty|alacritty-direct) return 0 ;;
+  alacritty|alacritty-direct|xterm-ghostty|xterm-kitty) return 0 ;;
   esac
 
   # xfce4-terminal supports hyperlinks
@@ -506,9 +528,10 @@ print_success() {
     "$(fmt_code "$(fmt_link ".zshrc" "file://$zdot/.zshrc" --text)")" \
     "file to select plugins, themes, and options."
   printf '\n'
-  printf '%s\n' "• Follow us on X: $(fmt_link @ohmyzsh https://x.com/ohmyzsh)"
-  printf '%s\n' "• Join our Discord community: $(fmt_link "Discord server" https://discord.gg/ohmyzsh)"
-  printf '%s\n' "• Get stickers, t-shirts, coffee mugs and more: $(fmt_link "CommitGoods Shop" https://commitgoods.com/collections/oh-my-zsh)"
+  printf '%s\n' "• Follow along on X ($(fmt_link @ohmyzsh https://x.com/ohmyzsh)) or Bluesky ($(fmt_link @ohmyz.sh https://bsky.app/profile/ohmyz.sh))"
+  printf '%s\n' "• Questions or ideas? Join the community on $(fmt_link Discord https://discord.gg/ohmyzsh)"
+  printf '%s\n' "• Help support the project: sponsor us on $(fmt_link "Open Collective" https://opencollective.com/ohmyzsh),"
+  printf '%s\n' "  or grab stickers, shirts, and swag from $(fmt_link CommitGoods https://commitgoods.com/ohmyzsh)"
   printf '%s\n' $FMT_RESET
 }
 

tools/theme-browser/README.md

@@ -0,0 +1,55 @@
+# Theme Browser
+
+Preview installed themes without changing your current prompt:
+
+```zsh
+omz theme browse
+omz theme browse agn
+omz theme preview agnoster
+```
+
+The browser filters theme names as you type and renders the highlighted theme using
+the current directory, including synchronous Git information.
+
+## Controls
+
+| Key | Action |
+| --- | --- |
+| Up / Down, Ctrl-P / Ctrl-N | Previous / next theme |
+| Page Up / Page Down | Move one page |
+| Printable text | Filter names |
+| Backspace | Delete the last filter character |
+| Ctrl-U | Clear the filter |
+| Enter | Open selection actions |
+| Esc / Ctrl-C | Cancel without applying or saving |
+| `u` in selection actions | Use the theme for this session |
+| `s` in selection actions | Save as default and reload the shell |
+| `b` or Enter in selection actions | Return to browsing |
+
+Using a theme changes the current session. It does not remove hooks or widgets installed
+by the previous theme. Saving updates `ZSH_THEME` in `.zshrc` and reloads the shell.
+
+## Limitations
+
+- Previews run in a fresh shell, so plugin-dependent and interactive themes may be incomplete.
+- Right prompts are labeled and shown separately rather than positioned by ZLE.
+- The browser requires an interactive terminal with alternate-screen support.
+- Theme code is isolated from your active shell, but it is not sandboxed. Preview only trusted themes.
+
+## Local Testing
+
+From this checkout, launch a disposable interactive shell:
+
+```zsh
+env ZSH="$PWD" zsh -dfi
+source "$ZSH/lib/cli.zsh"
+omz theme preview robbyrussell
+omz theme browse
+```
+
+Run the regression suites with:
+
+```zsh
+zsh -df tools/theme-browser/tests/preview_test.zsh
+zsh -df tools/theme-browser/tests/browser_test.zsh
+```

tools/theme-browser/browser.zsh

@@ -0,0 +1,170 @@
+# Loaded only by `omz theme browse`. The UI runs in a subshell; stdout is a
+# two-line data handoff, while all terminal I/O goes through a private tty fd.
+function _omz_theme_browser() (
+  emulate -L zsh
+  setopt extendedglob promptpercent
+  # Displayed names, filter text, and worker output are data, not prompt code.
+  unsetopt promptsubst
+  zmodload zsh/terminfo && zmodload zsh/zpty && zmodload zsh/system && zmodload zsh/datetime || return 1
+  local tty saved filter=$1 key suffix name previous='' preview='' chunk
+  local mode=browse action='' pty=omz-browser-$sysparams[pid] record pgid
+  local -a names matches lines size
+  local -i selected=1 page=1 height=0 width=0 rows=0 cols=0 active=0 dirty=1 i row cancelled=0
+  local -F render_after=0
+  [[ -n $terminfo[smcup] && -n $terminfo[rmcup] && -n $terminfo[cup] ]] || {
+    print -u2 -r -- 'Theme browser requires a terminal with alternate-screen support.'
+    return 1
+  }
+  exec {tty}<>/dev/tty || return 1
+  saved=$(command stty -g <&$tty) || return 1
+  names=("${(@f)$(_omz_theme_names)}")
+  names=("${(@)names:#}")
+  trap 'cancelled=1' INT TERM HUP
+  trap 'dirty=1' WINCH
+
+  function _omz_browser_stop {
+    if (( active )); then
+      [[ $pgid == <2-> ]] && kill -HUP -- -$pgid 2>/dev/null
+      # Let the preview supervisor clean up its nested worker group first.
+      local -i wait_count=0
+      while zpty -t "$pty" && (( wait_count++ < 100 )); do
+        zselect -t 1
+      done
+      zpty -d "$pty" 2>/dev/null
+      active=0
+    fi
+  }
+
+  function _omz_browser_line {
+    local text=${1//$'\t'/    } formatted='' MATCH MBEGIN MEND
+    text=${text//\%/%%}
+    # Tell prompt truncation that SGR has zero display width. All other terminal
+    # controls have already been removed by the preview backend.
+    while [[ $text =~ $'\e\\[[0-9;:]*m' ]]; do
+      formatted+=${text[1,$(( MBEGIN - 1 ))]}"%{"$MATCH"%}"
+      text=${text[$(( MEND + 1 )),-1]}
+    done
+    formatted+=$text
+    echoti cup $row 0 >&$tty
+    print -Prn -u $tty -- "%${width}<..<${formatted}%<<%f%k%b"
+    (( row++ ))
+  }
+
+  {
+    zmodload zsh/zselect || return 1
+    command stty -echo -icanon min 0 time 0 <&$tty || return 1
+    print -rn -u $tty -- "$terminfo[smcup]$terminfo[civis]"
+    while (( ! cancelled )); do
+      size=(${=$(command stty size <&$tty)})
+      rows=${size[1]:-24} cols=${size[2]:-80}
+      if (( height != rows || width != cols - 1 )); then
+        height=$rows width=$(( cols - 1 )) dirty=1
+      fi
+      matches=()
+      for name in "${names[@]}"; do
+        [[ ${(L)name} == *${(L)filter}* ]] && matches+=("$name")
+      done
+      (( selected > $#matches )) && selected=$#matches
+      (( selected < 1 )) && selected=1
+      name=${matches[$selected]}
+      if [[ $name != "$previous" ]]; then
+        _omz_browser_stop
+        previous=$name preview='' dirty=1
+        render_after=$(( EPOCHREALTIME + 0.12 ))
+      fi
+      # Coalesce typing and key repeats rather than starting a worker per key.
+      if (( ! active && EPOCHREALTIME >= render_after )); then
+        if [[ -n $name ]]; then
+          # zpty joins arguments as shell text; quote the literal theme name.
+          zpty -b "$pty" _omz_theme_preview "${(q)name}" || return 1
+          active=1
+          pgid=''
+          for record in "${(@f)$(zpty)}"; do
+            [[ $record == \(<->\)\ "$pty":* ]] && pgid=${${record#\(}%%\)*}
+          done
+        fi
+      fi
+      if (( active )); then
+        while zpty -r -t "$pty" chunk; do
+          preview+=${chunk//$'\r'/}
+          dirty=1
+        done
+      fi
+      page=$(( height > 24 ? 8 : 4 ))
+      if (( dirty )); then
+        print -rn -u $tty -- "$terminfo[clear]"
+        row=0
+        if (( width < 39 || height < 16 )); then
+          _omz_browser_line 'Resize to at least 40 columns x 16 rows.'
+          _omz_browser_line 'Esc / Ctrl-C: cancel'
+        else
+          _omz_browser_line 'Oh My Zsh theme browser | Esc / Ctrl-C: cancel'
+          _omz_browser_line "Filter: ${(V)filter}  ($#matches themes)"
+          if [[ $mode == actions ]]; then
+            _omz_browser_line '[u] Use in session  [s] Save + reload  [b] Back'
+            _omz_browser_line 'Use keeps old theme hooks. Save edits .zshrc + reloads.'
+          else
+            _omz_browser_line 'Arrows / Ctrl-P,N: move | PgUp,Dn | Enter: actions'
+            _omz_browser_line 'Type to filter | Backspace: delete | Ctrl-U: clear'
+          fi
+          for (( i = ((selected - 1) / page) * page + 1; i <= $#matches && row < page + 4; i++ )); do
+            if (( i == selected )); then
+              _omz_browser_line "> ${(V)matches[$i]}"
+            else
+              _omz_browser_line "  ${(V)matches[$i]}"
+            fi
+          done
+          _omz_browser_line '--- Static preview (right prompt shown separately) ---'
+          lines=("${(@f)preview}")
+          if [[ -z $preview ]]; then
+            [[ -n $name ]] && lines=('Rendering...') || lines=('No matching themes.')
+          fi
+          for chunk in "${lines[@]}"; do
+            (( row < height - 1 )) || break
+            _omz_browser_line "$chunk"
+          done
+        fi
+        dirty=0
+      fi
+      key=''
+      read -r -k 1 -t 0.1 -u $tty key || continue
+      if [[ $key == $'\e' ]]; then
+        suffix=''
+        while read -r -k 1 -t 0.03 -u $tty chunk; do
+          suffix+=$chunk
+          [[ $chunk == [A-Za-z~] || ${#suffix} -ge 8 ]] && break
+        done
+        [[ -n $suffix ]] || break
+        key=$'\e'$suffix
+      fi
+      [[ $key == $'\x03' ]] && break
+      if [[ $mode == actions ]]; then
+        case $key in
+          u) action=use; break ;;
+          s) action=set; break ;;
+          b|$'\r'|$'\n') mode=browse ;;
+        esac
+      else
+        case $key in
+          $'\e[A'|$'\eOA'|$'\x10') (( selected-- )) ;;
+          $'\e[B'|$'\eOB'|$'\x0e') (( selected++ )) ;;
+          $'\e[5~') (( selected -= page )) ;;
+          $'\e[6~') (( selected += page )) ;;
+          $'\x7f'|$'\b') filter=${filter[1,-2]}; selected=1 ;;
+          $'\x15') filter=''; selected=1 ;;
+          $'\r'|$'\n') [[ -n $name ]] && mode=actions ;;
+          [[:print:]]) filter+=$key; selected=1 ;;
+        esac
+      fi
+      dirty=1
+    done
+  } always {
+    _omz_browser_stop
+    print -rn -u $tty -- $'\e[0m'"$terminfo[cnorm]$terminfo[rmcup]"
+    command stty "$saved" <&$tty
+    exec {tty}>&-
+  }
+  (( cancelled )) && return 130
+  [[ -n $action ]] && print -rl -- "$action" "$name"
+  return 0
+)

tools/theme-browser/preview-worker.zsh

@@ -0,0 +1,88 @@
+# Invoked only by preview.zsh in a fresh zsh -df process. Themes and hooks
+# are intentionally sourced/run at top level (not inside a setup function).
+emulate -R zsh
+if [[ $1 == --supervise ]]; then
+  # This process is the private PTY's session leader. Keep the actual worker's
+  # standard descriptors non-TTY, and report its status outside theme state.
+  typeset -r _omz_preview_tmp=$2
+  shift 2
+  unsetopt monitor
+  command "$commands[zsh]" -df "${0:A}" "$@" \
+    < /dev/null > "$_omz_preview_tmp/output" 2>&1
+  print -r -- $? > "$_omz_preview_tmp/result"
+  exit
+fi
+typeset -r _omz_preview_root=$1 _omz_preview_theme=$2 _omz_preview_status=$3
+export ZSH=${ZSH:-$_omz_preview_root}
+ZSH_THEME=$4
+ZSH_CUSTOM=$5
+fpath=("$_omz_preview_root/functions" $fpath)
+autoload -Uz colors add-zsh-hook vcs_info
+colors
+setopt prompt_subst prompt_percent
+zstyle ':omz:alpha:lib:git' async-prompt no
+ZSH_THEME_GIT_PROMPT_PREFIX='git:('
+ZSH_THEME_GIT_PROMPT_SUFFIX=')'
+ZSH_THEME_GIT_PROMPT_DIRTY='*'
+ZSH_THEME_GIT_PROMPT_CLEAN=''
+ZSH_THEME_RUBY_PROMPT_PREFIX='('
+ZSH_THEME_RUBY_PROMPT_SUFFIX=')'
+source "$_omz_preview_root/lib/git.zsh"
+source "$_omz_preview_root/lib/vcs_info.zsh"
+source "$_omz_preview_root/lib/bzr.zsh"
+source "$_omz_preview_root/lib/nvm.zsh"
+source "$_omz_preview_root/lib/prompt_info_functions.zsh"
+source "$_omz_preview_root/lib/spectrum.zsh"
+# Check syntax before accepting a final false conditional as a successful load.
+# This subprocess shares the worker's execution deadline and process group.
+command "$commands[zsh]" -dfn "$_omz_preview_theme" || {
+  print -u2 -r -- 'theme preview: theme syntax check failed'
+  exit 1
+}
+# Keep zsh's PROMPT/PS1 and RPROMPT/RPS1 aliases intact (dieter sets RPS1).
+PROMPT=''
+RPROMPT=''
+source "$_omz_preview_theme"
+typeset -i _omz_preview_load_status=$?
+# Status 1 may just be a final conditional; require an initialized prompt below.
+# Higher statuses include syntax/runtime errors and missing commands.
+if (( _omz_preview_load_status > 1 )); then
+  print -u2 -r -- "theme preview: theme could not be loaded (exit $_omz_preview_load_status)"
+  exit 1
+fi
+
+function _omz_preview_set_status { return "$_omz_preview_status" }
+typeset -i _omz_preview_hook_status=0
+if (( $+functions[precmd] )); then
+  _omz_preview_set_status
+  precmd
+  _omz_preview_hook_status=$?
+  if (( _omz_preview_hook_status )); then
+    print -u2 -r -- "theme preview: precmd failed (exit $_omz_preview_hook_status); remaining hooks skipped"
+  fi
+fi
+for _omz_preview_hook in "${precmd_functions[@]}"; do
+  (( _omz_preview_hook_status )) && break
+  if (( $+functions[$_omz_preview_hook] )); then
+    _omz_preview_set_status
+    "$_omz_preview_hook"
+    _omz_preview_hook_status=$?
+    if (( _omz_preview_hook_status )); then
+      print -u2 -r -- "theme preview: precmd hook $_omz_preview_hook failed (exit $_omz_preview_hook_status); remaining hooks skipped"
+    fi
+  fi
+done
+if (( _omz_preview_load_status )) && [[ -z $PROMPT && -z $RPROMPT ]]; then
+  print -u2 -r -- "theme preview: theme did not initialize a prompt (load exit $_omz_preview_load_status)"
+  exit 1
+fi
+# Native prompt expansion handles PROMPT_SUBST once, followed by percent escapes.
+# An explicit (e) pass here would re-execute literal substitutions from helpers.
+print -r -- "Left prompt (status $_omz_preview_status):"
+_omz_preview_set_status
+print -Pr -- "${PROMPT-}"
+print -r -- 'Right prompt (shown separately):'
+_omz_preview_set_status
+print -Pr -- "${RPROMPT-}"
+(( _omz_preview_hook_status )) && exit 1
+exit 42

tools/theme-browser/preview.zsh

@@ -0,0 +1,217 @@
+# Static previews execute theme code as the current user, not in a sandbox.
+# A private PTY supplies a process group without requiring shell job control.
+typeset -g _OMZ_THEME_PREVIEW_DIR=${${(%):-%x}:A:h}
+
+function _omz_theme_names() (
+  emulate -L zsh
+  setopt extendedglob
+  local root=${ZSH:-${_OMZ_THEME_PREVIEW_DIR:h:h}}
+  local custom=${ZSH_CUSTOM:-$root/custom} dir file name
+  local -a names files
+  for dir in "$custom" "$root/themes"; do
+    if [[ $dir == "$custom" ]]; then
+      files=("$dir"/**/*.zsh-theme(N-.))
+    else
+      files=("$dir"/*.zsh-theme(N-.))
+    fi
+    for file in "${files[@]}"; do
+      name=${${file#"$dir/"}%.zsh-theme}
+      [[ $dir == "$custom" ]] && name=${name#themes/}
+      [[ -n $name && $name != random && /$name/ != */(.|..)/* && $name != /* && $name != *[[:cntrl:]\\]* ]] || continue
+      names+=("$name")
+    done
+  done
+  (( $#names )) && print -rl -- ${(ou)names}
+  return 0
+)
+
+function _omz_theme_resolve() (
+  emulate -L zsh
+  setopt extendedglob
+  local name=$1 root=${ZSH:-${_OMZ_THEME_PREVIEW_DIR:h:h}}
+  local custom=${ZSH_CUSTOM:-$root/custom} dir
+  if (( $# != 1 )) || [[ -z $name || $name == random || /$name/ == */(.|..)/* || $name == /* || $name == *//* || $name == *[[:cntrl:]\\]* ]]; then
+    print -u2 -r -- 'theme preview: invalid or non-selectable theme name'
+    return 2
+  fi
+  for dir in "$custom" "$custom/themes" "$root/themes"; do
+    if [[ -f "$dir/$name.zsh-theme" ]]; then
+      print -r -- "${dir:A}/$name.zsh-theme"
+      return 0
+    fi
+  done
+  print -u2 -r -- 'theme preview: theme not found'
+  return 1
+)
+
+# One sample, with the requested exit status (0 by default). All execution and
+# state changes are confined to this subshell and the fresh -df worker.
+# For asynchronous callers, cancel the job group, not just zsh's waiting wrapper.
+function _omz_theme_preview() (
+  emulate -L zsh
+  local theme sample=${2:-0} backend=$_OMZ_THEME_PREVIEW_DIR
+  if (( $# < 1 || $# > 2 )) || [[ $sample != <0-255> ]]; then
+    print -u2 -r -- 'theme preview: usage: _omz_theme_preview name [status 0..255]'
+    return 2
+  fi
+  theme=$(_omz_theme_resolve "$1") || return $?
+  if ! zmodload zsh/zpty || ! zmodload zsh/system || ! zmodload zsh/datetime || ! zmodload zsh/zselect; then
+    print -u2 -r -- 'theme preview: required zsh modules unavailable (zpty, system, datetime, zselect)'
+    return 1
+  fi
+  local tmp fifo_fd pty=omz-preview-$sysparams[pid] record pgid raw='' chunk error=''
+  local selected=$1 custom=${ZSH_CUSTOM:-${ZSH:-${backend:h:h}}/custom}
+  local -i active=0 cancelled=0 bytes=0 count remaining result=1
+  local -F deadline
+  trap 'cancelled=130' INT
+  trap 'cancelled=143' TERM
+  trap 'cancelled=129' HUP
+  {
+    tmp=$(command mktemp -d "${TMPDIR:-/tmp}/omz-preview.XXXXXXXX") || return 1
+    command mkfifo "$tmp/output" || return 1
+    sysopen -r -o nonblock,cloexec -u fifo_fd "$tmp/output" || return 1
+
+    # Exec immediately: a forked shell function could run inherited EXIT traps
+    # after returning. Both the launcher and theme worker must start fresh.
+    local -a launch=("$commands[zsh]" -df "$backend/preview-worker.zsh" --supervise
+      "$tmp" "${backend:h:h}" "$theme" "$sample" "$selected" "$custom")
+    deadline=$(( EPOCHREALTIME + 3 ))
+    if ! zpty -b "$pty" exec "${(@q)launch}"; then
+      print -u2 -r -- 'theme preview: could not allocate a private PTY'
+      return 1
+    fi
+    active=1
+    # The builtin listing supplies the session leader even before the child
+    # starts; this avoids a PID-handshake race during immediate cancellation.
+    for record in "${(@f)$(zpty)}"; do
+      if [[ $record == \(<->\)\ "$pty":* ]]; then
+        pgid=${${record#\(}%%\)*}
+        break
+      fi
+    done
+    if [[ $pgid != <2-> ]]; then
+      print -u2 -r -- 'theme preview: could not identify worker process group'
+      return 1
+    fi
+    while true; do
+      if (( cancelled )); then
+        error='cancelled'
+        break
+      fi
+      if (( EPOCHREALTIME >= deadline )); then
+        error='timed out after 3 seconds'
+        break
+      fi
+      remaining=$(( 32001 - bytes ))
+      if sysread -i "$fifo_fd" -s $(( remaining < 4096 ? remaining : 4096 )) -t 0.02 -c count chunk; then
+        raw+=$chunk
+        (( bytes += count ))
+        if (( bytes > 32000 )); then
+          error='output exceeded 32 KiB'
+          break
+        fi
+      elif [[ -s "$tmp/result" ]]; then
+        result=$(<"$tmp/result")
+        # The worker's dedicated completion status distinguishes a theme's
+        # early exit (including exit 0) from rendering both prompts.
+        [[ $result == 42 ]] || error="worker did not complete preview (exit $result)"
+        break
+      elif ! zpty -t "$pty"; then
+        error='worker supervisor exited before completing preview'
+        break
+      else
+        zselect -t 1
+      fi
+    done
+  } always {
+    # Clean up the whole group even on success. Deliberately detached processes
+    # are outside this boundary. Delete only our PTY, not any inherited ones.
+    if [[ $pgid == <2-> ]]; then
+      kill -TERM -- -$pgid 2>/dev/null
+      zselect -t 5
+      kill -KILL -- -$pgid 2>/dev/null
+    fi
+    (( active )) && zpty -d "$pty" 2>/dev/null
+    [[ -n $fifo_fd ]] && exec {fifo_fd}<&-
+    [[ -n $tmp ]] && command rm -rf -- "$tmp"
+  }
+
+  # Bound by bytes before splitting into locale-aware characters. No escape is
+  # emitted until it is a complete numeric SGR; all string controls are dropped,
+  # including their payloads and incomplete sequences at the output boundary.
+  unsetopt multibyte
+  raw=${raw[1,32000]}
+  setopt multibyte
+  local char safe='' state=text sgr=''
+  local -i code valid=1
+  for char in "${(@s::)raw}"; do
+    if (( cancelled )); then
+      error='cancelled'
+      break
+    fi
+    printf -v code '%d' "'$char" 2>/dev/null
+    case $state in
+      string|string-escape)
+        if [[ $char == $'\a' || $char == $'\xc2\x9c' || $char == $'\x9c' || ( $state == string-escape && $char == \\ ) ]]; then
+          state=text
+        elif [[ $char == $'\e' ]]; then
+          state=string-escape
+        else
+          state=string
+        fi
+        ;;
+      escape)
+        case $char in
+          '[') state=csi; sgr=''; valid=1 ;;
+          ']'|P|X|'^'|_) state=string ;;
+          $'\e') ;;
+          *)
+            if (( code >= 32 && code <= 47 )); then
+              state=intermediate
+            else
+              state=text
+            fi
+            ;;
+        esac
+        ;;
+      intermediate)
+        (( code >= 32 && code <= 47 )) || state=text
+        ;;
+      csi)
+        if [[ $char == [0-9\;:] ]]; then
+          sgr+=$char
+        elif (( code >= 64 && code <= 126 )); then
+          [[ $char == m && $valid == 1 ]] && safe+=$'\e['${sgr}m
+          state=text
+        elif [[ $char == $'\e' ]]; then
+          state=escape
+        else
+          valid=0
+        fi
+        ;;
+      text)
+        case $char in
+          $'\e') state=escape ;;
+          $'\xc2\x9b') state=csi; sgr=''; valid=1 ;;
+          # Drop raw 8-bit CSI instead of expanding it to two bytes. Filtering
+          # can then never enlarge the byte-bounded input buffer.
+          $'\x9b') state=csi; sgr=''; valid=0 ;;
+          $'\xc2\x90'|$'\xc2\x98'|$'\xc2\x9d'|$'\xc2\x9e'|$'\xc2\x9f'|$'\x90'|$'\x98'|$'\x9d'|$'\x9e'|$'\x9f') state=string ;;
+          $'\n'|$'\t') safe+=$char ;;
+          *)
+            # Reject format/directional controls even on libc implementations
+            # that classify them as printable. Keep private-use font glyphs.
+            if [[ $char == [[:print:]] ]] && ! (( code >= 0x200b && code <= 0x200f || code >= 0x2028 && code <= 0x202e || code >= 0x2060 && code <= 0x206f || code == 0xfeff )); then
+              safe+=$char
+            fi
+            ;;
+        esac
+        ;;
+    esac
+  done
+  (( cancelled )) && error='cancelled'
+  print -rn -- "$safe"$'\e[0m\n'
+  [[ -n $error ]] && print -u2 -r -- "theme preview: $error"
+  (( cancelled )) && return $cancelled
+  [[ -z $error ]]
+)

tools/theme-browser/tests/browser_test.zsh

@@ -0,0 +1,406 @@
+#!/usr/bin/env zsh
+# Run with: zsh -df tools/theme-browser/tests/browser_test.zsh
+# Optionally pass one group, e.g. `slow-interrupt`, to run it alone.
+# Each browser runs under a real controlling PTY, with no user startup files.
+emulate -R zsh
+
+if [[ $1 == --child ]]; then
+  if [[ $2 == completion ]]; then
+    function compdef { print -r -- "REGISTERED:${(j.:.)@}"; }
+  fi
+  source "$ZSH/lib/cli.zsh"
+  # Match normal OMZ sessions without sourcing any user startup/configuration.
+  setopt promptsubst
+  [[ -z $BROWSER_TEST_NO_PROMPT_PERCENT ]] || unsetopt promptpercent
+  print -r -- "LAZY:$+functions[_omz_theme_browser]:$+functions[_omz_theme_preview]"
+  if [[ $2 == completion ]]; then
+    # Capture the real completion function's candidates without loading the
+    # user's completion setup or replacing any CLI/backend functions.
+    function _describe { print -rl -- "DESCRIBE:$1" "${(@P)2}"; }
+    CURRENT=3 words=(omz theme '')
+    print -r -- SUBCOMMANDS
+    _omz
+    print -r -- END_SUBCOMMANDS
+    for action in browse preview set use; do
+      CURRENT=4 words=(omz theme "$action" '')
+      print -r -- "CANDIDATES:$action"
+      _omz
+      print -r -- "END:$action"
+    done
+    print -r -- "STILL_LAZY:$+functions[_omz_theme_browser]:$+functions[_omz_theme_preview]"
+    print -r -- COMPLETIONS_FINISHED
+    exit
+  fi
+  if [[ $2 == reject* ]]; then
+    case $2 in
+      reject-stdin) omz theme browse </dev/null ;;
+      reject-stdout) omz theme browse >/dev/null ;;
+      *) omz theme browse ;;
+    esac
+    result=$?
+    print -r -- "REJECT:$result:$+functions[_omz_theme_browser]:$+functions[_omz_theme_preview]"
+    exit
+  fi
+  function _omz::theme::use { calls+=("use:$1"); ZSH_THEME=$1; }
+  function _omz::theme::set { calls+=("set:$1"); ZSH_THEME=$1; }
+  function browser_test_hook { : parent-hook; }
+  function precmd { : parent-precmd; }
+  typeset -a calls=() precmd_functions=(browser_test_hook) chpwd_functions=(browser_test_hook)
+  ZSH_THEME=parent-theme PROMPT=parent-prompt RPROMPT=parent-rprompt
+  typeset original_hook=$functions[browser_test_hook] original_precmd=$functions[precmd]
+  typeset original_options=$(setopt) original_pwd=$PWD
+  stty rows 24 cols 100
+  # PENDIN is a transient kernel input-reprocessing flag, not a user mode.
+  typeset original_tty=$(stty -a)
+  original_tty=${${original_tty//-pendin/}//pendin/}
+  tty > "$TEST_SCRATCH/tty"
+  print -r -- READY
+  # An interactive script otherwise aborts on SIGINT instead of returning to
+  # the next prompt as an interactive command loop would.
+  trap ':' INT
+  case $BROWSER_TEST_EXIT_TRAP in
+    function) function TRAPEXIT { print -r -- EXIT_HOOK; } ;;
+    string) trap 'print -r -- EXIT_HOOK' EXIT ;;
+  esac
+  typeset original_exit_trap=${functions[TRAPEXIT]-}
+  omz theme browse "$2"
+  result=$?
+  if [[ -n $BROWSER_TEST_EXIT_TRAP ]]; then
+    [[ ${functions[TRAPEXIT]-} == "$original_exit_trap" ]] && print -r -- EXIT_FUNCTION_UNCHANGED
+    trap
+    trap - EXIT
+  fi
+  typeset restored_tty=$(stty -a)
+  restored_tty=${${restored_tty//-pendin/}//pendin/}
+  if [[ $restored_tty == "$original_tty" ]]; then
+    print -r -- TTY_RESTORED
+  else
+    print -r -- "TTY_MISMATCH:before=$original_tty after=$restored_tty"
+  fi
+  if [[ $PROMPT == parent-prompt && $RPROMPT == parent-rprompt &&
+        $functions[browser_test_hook] == "$original_hook" &&
+        $functions[precmd] == "$original_precmd" &&
+        ${(j:,:)precmd_functions} == browser_test_hook &&
+        ${(j:,:)chpwd_functions} == browser_test_hook &&
+        -o promptsubst && $(setopt) == "$original_options" && $PWD == "$original_pwd" &&
+        ${BROWSER_TEST_LEAK-unset} == unset ]]; then
+    print -r -- PARENT_UNCHANGED
+  fi
+  print -r -- "RESULT:$result:${(j:,:)calls}:$ZSH_THEME"
+  print -r -- FINISHED
+  exit 0
+fi
+
+setopt err_exit pipe_fail
+[[ -n $BROWSER_TEST_TRACE ]] && setopt xtrace
+zmodload zsh/zpty
+zmodload zsh/datetime
+zmodload zsh/zselect
+typeset -r repo=${0:A:h:h:h:h} self=${0:A}
+typeset scratch=$(mktemp -d "${TMPDIR:-/tmp}/omz-browser-test.XXXXXXXX")
+scratch=${scratch:A}
+trap 'zpty -d 2>/dev/null; command rm -rf -- "$scratch"' EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+mkdir -p "$scratch/home" "$scratch/custom/themes/nested" "$scratch/tmp"
+export ZSH=$repo ZSH_CUSTOM=$scratch/custom HOME=$scratch/home ZDOTDIR=$scratch/home
+export TMPDIR=$scratch/tmp TEST_SCRATCH=$scratch TERM=xterm-256color
+unset ZSH_THEME
+# Even a mistakenly enabled startup-file load must never reach real dotfiles.
+print -r -- 'print STARTUP_RAN; exit 99' > "$HOME/.zshenv"
+print -r -- 'PROMPT="nested fixture"' > "$ZSH_CUSTOM/themes/nested/browser-fixture.zsh-theme"
+for number in {01..10}; do
+  print -r -- 'typeset -g BROWSER_TEST_LEAK=bad
+ZSH_THEME=fixture-theme
+precmd_functions=() chpwd_functions=()
+function precmd { PROMPT="%F{red}FIXTURE_PREVIEW%f" }
+RPROMPT="fixture-right"' > "$ZSH_CUSTOM/zz-omz-test-$number.zsh-theme"
+done
+print -r -- 'sleep 30 &
+print -r -- $! > "$TEST_SCRATCH/slow-pid"
+wait
+PROMPT="SLOW_FINISHED"' > "$ZSH_CUSTOM/zz-omz-test-slow.zsh-theme"
+typeset filter_probe='$(print HIT > $TEST_SCRATCH/filter-executed)'
+typeset preview_probe='$(print HIT > $TEST_SCRATCH/preview-executed)'
+# Emit literal preview output, rather than asking the worker to evaluate a
+# prompt expression. Only a second evaluation by the browser can execute it.
+print -rl -- "print -r -- ${(q)preview_probe}" 'PROMPT="literal-preview-ready"' > "$ZSH_CUSTOM/literal-browser.zsh-theme"
+typeset backslash_probe='literal:\e[2J\n\c:end'
+print -rl -- "print -r -- ${(q)backslash_probe}" 'PROMPT="backslash-preview-ready"' > "$ZSH_CUSTOM/backslash-browser.zsh-theme"
+
+typeset buffer='' transcript='' chunk='' label=''
+typeset -F browser_finished_at=0
+function cleanup_pty {
+  local record group
+  for record in "${(@f)$(zpty)}"; do
+    [[ $record == \(<->\)\ browser:* ]] || continue
+    group=${${record#\(}%%\)*}
+    kill -HUP -- -$group 2>/dev/null || true
+    zselect -t 20 || true
+    # A renderer regression can loop without checking its cancellation flag.
+    kill -KILL -- -$group 2>/dev/null || true
+  done
+  zpty -d 2>/dev/null || true
+  return 0
+}
+function fail {
+  print -u2 -r -- "FAIL: $label: $1"
+  print -u2 -r -- "PTY transcript, last 4000 characters (escaped): ${(V)transcript[-4000,-1]}"
+  exit 1
+}
+function check {
+  "$@" || fail "$1 assertion failed"
+}
+function await {
+  local wanted=$1
+  local -F deadline=$(( EPOCHREALTIME + ${2:-6} ))
+  [[ $buffer == *"$wanted"* ]] && return 0
+  while (( EPOCHREALTIME < deadline )); do
+    if zpty -r browser chunk; then
+      buffer+=$chunk transcript+=$chunk
+      [[ $buffer == *"$wanted"* ]] && return 0
+    else
+      zselect -t 1 || true
+    fi
+  done
+  fail "timed out waiting for ${(V)wanted}"
+}
+function send {
+  buffer=''
+  zpty -w -n browser "$1"
+}
+function start {
+  label=$1 buffer='' transcript=''
+  local -a launch=("$commands[zsh]" -dfi "$self" --child "$2")
+  zpty -b browser exec "${(@q)launch}"
+  await 'LAZY:0:0'
+  await "$3"
+}
+function finish {
+  await FINISHED
+  # zpty -d can spend a second reaping an already-completed child. It is
+  # harness teardown, not browser cancellation/terminal-restoration latency.
+  browser_finished_at=$EPOCHREALTIME
+  check test "${transcript#*TTY_RESTORED}" != "$transcript"
+  check test "${transcript#*PARENT_UNCHANGED}" != "$transcript"
+  check test "${transcript#*RESULT:$1}" != "$transcript"
+  check test "${transcript#*$'\e[?1049l'}" != "$transcript"
+  check test "${transcript#*$'\e[?25h'}" != "$transcript"
+  check test "${transcript#*STARTUP_RAN}" = "$transcript"
+  zpty -d browser
+  [[ -z $BROWSER_TEST_TIMING ]] || print -r -- "TIMING: PTY deletion $(( EPOCHREALTIME - browser_finished_at ))s"
+}
+
+function test_completion {
+  start 'completion registration, commands, theme candidates, lazy loading' completion COMPLETIONS_FINISHED
+  check test "${transcript#*REGISTERED:_omz:omz}" != "$transcript"
+  local section=${${transcript#*SUBCOMMANDS}%END_SUBCOMMANDS*} action
+  check test "${section#*browse:Browse theme previews}" != "$section"
+  check test "${section#*preview:Preview a theme without applying it}" != "$section"
+  for action in browse preview set use; do
+    section=${${transcript#*CANDIDATES:$action}%END:$action*}
+    check test "${section#*DESCRIBE:theme}" != "$section"
+    for name in robbyrussell zz-omz-test-01 nested/browser-fixture; do
+      check test "${section#*$name}" != "$section"
+    done
+  done
+  check test "${transcript#*STILL_LAZY:0:0}" != "$transcript"
+  check test "${transcript#*STARTUP_RAN}" = "$transcript"
+  zpty -d browser
+}
+
+function test_rejection {
+  # Noninteractive rejection even with both descriptors attached to a PTY.
+  label=noninteractive
+  typeset -a launch=("$commands[zsh]" -df "$self" --child reject)
+  zpty -b browser exec "${(@q)launch}"
+  await 'REJECT:1:0:0'
+  check test "${transcript#*requires an interactive terminal}" != "$transcript"
+  zpty -d browser
+  for mode in stdin stdout; do
+    start "redirected $mode" "reject-$mode" 'REJECT:1:0:0'
+    check test "${transcript#*requires an interactive terminal}" != "$transcript"
+    zpty -d browser
+  done
+  label='noninteractive and redirected-I/O rejection'
+}
+
+function test_navigation {
+  start 'filter, navigation, actions/back, Esc isolation' zz-omz-test- '> zz-omz-test-01'
+  await FIXTURE_PREVIEW
+  send $'\e[B'; await '> zz-omz-test-02'
+  send $'\e[A'; await '> zz-omz-test-01'
+  send $'\x0e'; await '> zz-omz-test-02'
+  send $'\x10'; await '> zz-omz-test-01'
+  send $'\e[6~'; await '> zz-omz-test-05'
+  send $'\e[5~'; await '> zz-omz-test-01'
+  send '09'; await '> zz-omz-test-09'
+  send $'\x7f'; await '(9 themes)'
+  send $'\x15'; await 'Filter:   ('
+  send 'ZZ-OMZ-TEST-03'; await '> zz-omz-test-03'
+  send $'\r'; await '[u] Use in session'
+  send b; await 'Enter: actions'
+  send $'\x15no-such-omz-fixture'; await 'No matching themes.'
+  send $'\r'; await 'No matching themes.'
+  send $'\e'
+  finish '0::parent-theme'
+}
+
+function test_use {
+  start 'explicit use dispatch' zz-omz-test-01 '> zz-omz-test-01'
+  send $'\r'; await '[u] Use in session'
+  send u
+  finish '0:use:zz-omz-test-01:zz-omz-test-01'
+}
+
+function test_promptsubst {
+  start 'literal filter/preview substitutions with parent promptsubst enabled' literal-browser '> literal-browser'
+  await "$preview_probe"
+  await literal-preview-ready
+  check test ! -e "$scratch/preview-executed"
+  send $'\x15'"$filter_probe"
+  await "Filter: $filter_probe"
+  await 'No matching themes.'
+  check test ! -e "$scratch/filter-executed"
+  send $'\x15literal-browser'
+  await "$preview_probe"
+  await literal-preview-ready
+  send $'\e'
+  finish '0::parent-theme'
+  check test ! -e "$scratch/filter-executed"
+  check test ! -e "$scratch/preview-executed"
+}
+
+function test_save {
+  start 'explicit save dispatch (stubbed)' zz-omz-test-02 '> zz-omz-test-02'
+  send $'\r'; await '[u] Use in session'
+  send s
+  finish '0:set:zz-omz-test-02:zz-omz-test-02'
+}
+
+function test_backslashes {
+  start 'literal backslashes in preview and filter' backslash-browser '> backslash-browser'
+  await "$backslash_probe"
+  await backslash-preview-ready
+  send $'\x15'"$backslash_probe"
+  await "Filter: $backslash_probe"
+  await 'No matching themes.'
+  send $'\e'
+  finish '0::parent-theme'
+}
+
+function test_promptpercent {
+  local -x BROWSER_TEST_NO_PROMPT_PERCENT=1
+  start 'renderer enables promptpercent without changing parent options' zz-omz-test-01 '> zz-omz-test-01'
+  await FIXTURE_PREVIEW
+  check test "${transcript#*'%<<'}" = "$transcript"
+  send $'\e'
+  finish '0::parent-theme'
+}
+
+function test_exittrap {
+  local -x BROWSER_TEST_EXIT_TRAP
+  local action
+  for BROWSER_TEST_EXIT_TRAP in function string; do
+    for action in use set cancel; do
+      start "inherited $BROWSER_TEST_EXIT_TRAP EXIT trap: $action" zz-omz-test-01 '> zz-omz-test-01'
+      await FIXTURE_PREVIEW
+      if [[ $action == cancel ]]; then
+        send $'\e'
+        finish '0::parent-theme'
+      else
+        send $'\r'; await '[u] Use in session'
+        send "${action[1]}"
+        finish "0:$action:zz-omz-test-01:zz-omz-test-01"
+      fi
+      check test "${transcript#*EXIT_FUNCTION_UNCHANGED}" != "$transcript"
+      if [[ $BROWSER_TEST_EXIT_TRAP == string ]]; then
+        check test "${transcript#*"trap -- 'print -r -- EXIT_HOOK' EXIT"}" != "$transcript"
+      fi
+    done
+  done
+}
+
+function test_interrupt {
+  start 'Ctrl-C restores terminal' zz-omz-test-01 '> zz-omz-test-01'
+  send $'\x03'
+  finish '130::parent-theme'
+}
+
+function test_resize {
+  start 'resize small and back' zz-omz-test-01 '> zz-omz-test-01'
+  typeset terminal=$(<"$scratch/tty")
+  terminal=${terminal//$'\r'/}
+  buffer=''
+  stty rows 10 cols 30 < "$terminal"
+  await '40 columns x 16 rows.'
+  buffer=''
+  stty rows 24 cols 100 < "$terminal"
+  await '> zz-omz-test-01'
+  send $'\e'
+  finish '0::parent-theme'
+}
+
+function test_slow {
+  local cancellation=$1
+  command rm -f "$scratch/slow-pid"
+  start "slow preview cancellation: $cancellation" zz-omz-test-slow '> zz-omz-test-slow'
+  for attempt in {1..150}; do
+    [[ -s "$scratch/slow-pid" ]] && break
+    zselect -t 1 || true
+  done
+  check test -s "$scratch/slow-pid"
+  typeset -F started=$EPOCHREALTIME
+  case $cancellation in
+    navigation)
+      send $'\x15zz-omz-test-01'
+      await FIXTURE_PREVIEW 2
+      [[ -z $BROWSER_TEST_TIMING ]] || print -r -- "TIMING: navigation preview $(( EPOCHREALTIME - started ))s"
+      (( EPOCHREALTIME - started < 2 )) || fail 'replacement preview exceeded 2 seconds'
+      send $'\e'
+      finish '0::parent-theme'
+      ;;
+    escape) send $'\e'; finish '0::parent-theme' ;;
+    interrupt) send $'\x03'; finish '130::parent-theme' ;;
+  esac
+  [[ -z $BROWSER_TEST_TIMING ]] || print -r -- "TIMING: browser completed $(( browser_finished_at - started ))s; including teardown $(( EPOCHREALTIME - started ))s"
+  (( browser_finished_at - started < 2 )) || fail "browser completion exceeded 2 seconds: $(( browser_finished_at - started ))s"
+  typeset child=$(<"$scratch/slow-pid") child_state
+  for attempt in {1..100}; do
+    child_state=$(command ps -o stat= -p "$child" 2>/dev/null || true)
+    [[ -z "${child_state//[ ZN+]/}" ]] && break
+    zselect -t 1 || true
+  done
+  [[ -z $BROWSER_TEST_TIMING ]] || print -r -- "TIMING: descendant $child state=${child_state:-absent}, cleanup polls=$attempt"
+  [[ -z "${child_state//[ ZN+]/}" ]] || fail "preview descendant $child still running: $child_state"
+}
+
+# Keep independent regressions running after a failed UI session.
+unsetopt err_exit
+typeset -i failures=0
+for scenario in rejection completion navigation promptsubst backslashes promptpercent exittrap use save interrupt resize slow-navigation slow-escape slow-interrupt; do
+  [[ -z $1 || $scenario == "$1" ]] || continue
+  (
+    setopt err_exit
+    trap 'cleanup_pty' EXIT
+    if [[ $scenario == slow-* ]]; then
+      test_slow "${scenario#slow-}"
+    else
+      test_$scenario
+    fi
+    print -r -- "PASS: $label"
+  )
+  (( $? == 0 )) || (( failures++ ))
+done
+typeset -a leftovers
+for attempt in {1..100}; do
+  leftovers=("$TMPDIR"/omz-preview.*(N))
+  (( $#leftovers == 0 )) && break
+  zselect -t 1 || true
+done
+if (( $#leftovers )); then
+  print -u2 -r -- "FAIL: $#leftovers preview temporary directories remain"
+  (( failures++ ))
+fi
+print -r -- "Theme browser regression groups failed: $failures"
+(( failures == 0 ))