Merge 040365a0ed into 7c10d9839f

Bumps [charset-normalizer](https://github.com/jawah/charset_normalizer) from 3.4.6 to 3.4.7.
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jawah/charset_normalizer/compare/3.4.6...3.4.7)

---
updated-dependencies:
- dependency-name: charset-normalizer
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/dependencies.yml

@@ -13,7 +13,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

.github/workflows/dependencies/requirements.txt

@@ -1,7 +1,7 @@
 certifi==2026.2.25
-charset-normalizer==3.4.6
+charset-normalizer==3.4.7
 idna==3.11
 PyYAML==6.0.3
-requests==2.33.0
+requests==2.33.1
 semver==3.0.4
 urllib3==2.6.3

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

plugins/claude-code/README.md

@@ -0,0 +1,94 @@
+# Claude Code Plugin
+
+The `claude-code` plugin adds several aliases and helper functions for [Claude Code](https://github.com/anthropics/claude-code), the CLI for Claude.
+
+To use it, add `claude-code` to the plugins array of your zshrc file:
+
+```zsh
+plugins=(... claude-code)
+```
+
+## Configuration Variables
+
+Set these in your `~/.zshrc` **before** the plugins line:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ZSH_CLAUDE_DEFAULT_MODEL` | _(unset)_ | Default model applied to all session aliases (e.g., `opus`, `sonnet`, `haiku`, or a full model ID) |
+| `ZSH_CLAUDE_DEFAULT_EFFORT` | _(unset)_ | Default reasoning effort level (`low`, `medium`, `high`, `max`) |
+| `ZSH_CLAUDE_DEFAULT_PERMISSION_MODE` | _(unset)_ | Default permission mode (`acceptEdits`, `bypassPermissions`, `default`, `dontAsk`, `plan`, `auto`) |
+| `ZSH_CLAUDE_AUTO_CONTINUE` | `false` | Auto-resume last conversation on new shell start |
+
+> **How defaults work:** All session-starting aliases (`cl`, `clc`, `clr`, `cln`, `clw`, etc.) automatically
+> inject your configured defaults. If you also pass a flag explicitly (e.g., `cl --model opus`), the explicit
+> flag takes precedence since it appears after the defaults on the command line.
+
+### Example
+
+```zsh
+# ~/.zshrc
+ZSH_CLAUDE_DEFAULT_MODEL="sonnet"
+ZSH_CLAUDE_DEFAULT_EFFORT="high"
+ZSH_CLAUDE_DEFAULT_PERMISSION_MODE="plan"
+ZSH_CLAUDE_AUTO_CONTINUE=false
+
+plugins=(... claude-code)
+```
+
+## Aliases
+
+### Core
+
+| Alias | Command | Description |
+|-------|---------|-------------|
+| `cl` | `claude` | Start interactive session |
+| `clc` | `claude --continue` | Continue last conversation |
+| `clr` | `claude --resume` | Open session picker |
+| `clp` | `claude -p` | Headless/print mode |
+| `clv` | `claude --version` | Show version |
+| `clu` | `claude update` | Update Claude Code |
+
+### Sessions
+
+| Alias | Command | Description |
+|-------|---------|-------------|
+| `cln` | `claude -n` | Start a named session |
+| `clw` | `claude -w` | Start in a git worktree |
+| `clfork` | `claude --fork-session` | Fork current session |
+
+### Auth
+
+| Alias | Command | Description |
+|-------|---------|-------------|
+| `clas` | `claude auth status` | Check auth status |
+| `clal` | `claude auth login` | Sign in |
+| `clao` | `claude auth logout` | Sign out |
+
+### Config
+
+| Alias | Command | Description |
+|-------|---------|-------------|
+| `clmcp` | `claude mcp` | Manage MCP servers |
+| `clag` | `claude agents` | List configured agents |
+
+### Channels
+
+| Alias | Command | Description | Plugin Install |
+|-------|---------|-------------|----------------|
+| `clch-tg` | `claude --channels plugin:telegram@...` | Start with Telegram channel | `/plugin install telegram@claude-plugins-official` |
+| `clch-dc` | `claude --channels plugin:discord@...` | Start with Discord channel | `/plugin install discord@claude-plugins-official` |
+| `clch <spec>` | `claude --channels <spec>` | Start with custom channel | — |
+
+## Functions
+
+| Function | Description | Example |
+|----------|-------------|---------|
+| `clm <model>` | Start with a specific model (also applies effort and permission-mode defaults) | `clm opus` |
+| `cle <effort>` | Start with a specific effort level (also applies model and permission-mode defaults) | `cle high` |
+| `clds` | Directory session — create or resume a session named after `$PWD` | `clds` |
+| `clfp <pr>` | Resume sessions linked to a GitHub PR | `clfp 123` |
+
+## Tab Completion
+
+- `clm [TAB]` — completes model names (`opus`, `sonnet`, `haiku`)
+- `cle [TAB]` — completes effort levels (`low`, `medium`, `high`, `max`)

plugins/claude-code/claude-code.plugin.zsh

@@ -0,0 +1,173 @@
+# Claude Code - Oh My Zsh Plugin
+# Aliases and helpers for the Claude Code CLI
+# https://github.com/anthropics/claude-code
+
+# Prerequisite check
+
+if ! (( $+commands[claude] )); then
+  print "zsh claude-code plugin: claude not found. Please install Claude Code before using this plugin." >&2
+  return 1
+fi
+
+# Configuration variables
+
+# Default model for clm function (e.g., opus, sonnet, haiku, or full model ID)
+: ${ZSH_CLAUDE_DEFAULT_MODEL:=}
+# Default reasoning effort level (low, medium, high, max)
+: ${ZSH_CLAUDE_DEFAULT_EFFORT:=}
+# Default permission mode for claude sessions (choices: "acceptEdits", "bypassPermissions", "default", "dontAsk", "plan", "auto")
+: ${ZSH_CLAUDE_DEFAULT_PERMISSION_MODE:=}
+# Auto-resume last conversation on new shell start (true/false)
+: ${ZSH_CLAUDE_AUTO_CONTINUE:=false}
+
+# Core aliases
+
+alias cl='_claude_with_defaults'
+alias clc='_claude_with_defaults --continue'
+alias clr='_claude_with_defaults --resume'
+alias clp='_claude_with_defaults -p'
+alias clv='claude --version'
+alias clu='claude update'
+
+# Session aliases
+
+alias cln='_claude_with_defaults -n'
+alias clw='_claude_with_defaults -w'
+alias clfork='_claude_with_defaults --fork-session'
+
+# Auth aliases
+
+alias clas='claude auth status'
+alias clal='claude auth login'
+alias clao='claude auth logout'
+
+# Config aliases
+
+alias clmcp='claude mcp'
+alias clag='claude agents'
+
+# Model & effort aliases
+
+function clm() {
+  local model="${1:-${ZSH_CLAUDE_DEFAULT_MODEL}}"
+  if [[ -z "$model" ]]; then
+    print "Usage: clm <model>  (opus, sonnet, haiku, or full model ID)" >&2
+    return 1
+  fi
+  shift 2>/dev/null
+  local -a args=()
+  [[ -n "$ZSH_CLAUDE_DEFAULT_EFFORT" ]] && args+=(--effort "$ZSH_CLAUDE_DEFAULT_EFFORT")
+  [[ -n "$ZSH_CLAUDE_DEFAULT_PERMISSION_MODE" ]] && args+=(--permission-mode "$ZSH_CLAUDE_DEFAULT_PERMISSION_MODE")
+  claude --model "$model" "${args[@]}" "$@"
+}
+
+function cle() {
+  local effort="${1:-${ZSH_CLAUDE_DEFAULT_EFFORT}}"
+  if [[ -z "$effort" ]]; then
+    print "Usage: cle <effort>  (low, medium, high, max)" >&2
+    return 1
+  fi
+  shift 2>/dev/null
+  local -a args=()
+  [[ -n "$ZSH_CLAUDE_DEFAULT_MODEL" ]] && args+=(--model "$ZSH_CLAUDE_DEFAULT_MODEL")
+  [[ -n "$ZSH_CLAUDE_DEFAULT_PERMISSION_MODE" ]] && args+=(--permission-mode "$ZSH_CLAUDE_DEFAULT_PERMISSION_MODE")
+  claude --effort "$effort" "${args[@]}" "$@"
+}
+
+# Channel aliases
+
+alias clch-tg='_claude_with_defaults --channels plugin:telegram@claude-plugins-official'
+alias clch-dc='_claude_with_defaults --channels plugin:discord@claude-plugins-official'
+
+function clch() {
+  if [[ -z "$1" ]]; then
+    print "Usage: clch <channel-spec> [claude-args...]" >&2
+    print "  e.g. clch plugin:telegram@claude-plugins-official" >&2
+    return 1
+  fi
+  local channel="$1"
+  shift
+  _claude_with_defaults --channels "$channel" "$@"
+}
+
+# Helper functions
+
+# Directory session: create or resume a session named after the current directory
+# Similar to tmux's tds alias
+function clds() {
+  local dir="${PWD##*/}"
+  [[ "$PWD" == "$HOME" ]] && dir="HOME"
+  [[ "$PWD" == "/" ]] && dir="ROOT"
+  _claude_with_defaults --resume "$dir" "$@" 2>/dev/null || _claude_with_defaults -n "$dir" "$@"
+}
+
+# Resume from a PR number
+function clfp() {
+  if [[ -z "$1" ]]; then
+    print "Usage: clfp <pr-number>" >&2
+    return 1
+  fi
+  claude --from-pr "$1"
+}
+
+# Start claude with default config variables applied
+function _claude_with_defaults() {
+  local -a args
+  args=()
+
+  [[ -n "$ZSH_CLAUDE_DEFAULT_MODEL" ]] && args+=(--model "$ZSH_CLAUDE_DEFAULT_MODEL")
+  [[ -n "$ZSH_CLAUDE_DEFAULT_EFFORT" ]] && args+=(--effort "$ZSH_CLAUDE_DEFAULT_EFFORT")
+  [[ -n "$ZSH_CLAUDE_DEFAULT_PERMISSION_MODE" ]] && args+=(--permission-mode "$ZSH_CLAUDE_DEFAULT_PERMISSION_MODE")
+
+  claude "${args[@]}" "$@"
+}
+
+# Tab completion
+
+function _claude_code_models() {
+  local -a models
+  models=(
+    'opus:Claude Opus (most capable)'
+    'sonnet:Claude Sonnet (balanced)'
+    'haiku:Claude Haiku (fastest)'
+  )
+  _describe 'model' models
+}
+
+function _claude_code_efforts() {
+  local -a efforts
+  efforts=(
+    'low:Minimal reasoning'
+    'medium:Balanced reasoning'
+    'high:Deep reasoning'
+    'max:Maximum reasoning depth'
+  )
+  _describe 'effort' efforts
+}
+
+function _claude_code_permission_modes() {
+  local -a modes
+  modes=(
+    'plan:Plan mode - confirm before actions'
+    'auto:Auto mode - approve safe actions'
+    'manual:Manual mode - approve everything'
+  )
+  _describe 'permission-mode' modes
+}
+
+function _clm() {
+  _arguments '1:model:_claude_code_models' '*::args:'
+}
+
+function _cle() {
+  _arguments '1:effort:_claude_code_efforts' '*::args:'
+}
+
+compdef _clm clm
+compdef _cle cle
+
+# Auto-continue on shell start
+
+if [[ "$ZSH_CLAUDE_AUTO_CONTINUE" == "true" && -z "$CLAUDECODE" ]]; then
+  claude --continue 2>/dev/null
+fi

plugins/opentofu/opentofu.plugin.zsh

@@ -30,14 +30,20 @@ function tofu_version_prompt_info() {
 alias tt='tofu'
 alias tta='tofu apply'
 alias tta!='tofu apply -auto-approve'
+alias ttap='tofu apply -parallelism=1'
+alias ttapp='tofu apply tfplan'
 alias ttc='tofu console'
 alias ttd='tofu destroy'
 alias ttd!='tofu destroy -auto-approve'
 alias ttf='tofu fmt'
 alias ttfr='tofu fmt -recursive'
 alias tti='tofu init'
+alias ttir='tofu init -reconfigure'
+alias ttiu='tofu init -upgrade'
+alias ttiur='tofu init -upgrade -reconfigure'
 alias tto='tofu output'
 alias ttp='tofu plan'
+alias ttpo='tofu plan -out tfplan'
 alias ttv='tofu validate'
 alias tts='tofu state'
 alias ttsh='tofu show'

plugins/terraform/terraform.plugin.zsh

@@ -4,21 +4,21 @@ function tf_prompt_info() {
   # check if in terraform dir and file exists
   [[ -d "${TF_DATA_DIR:-.terraform}" && -r "${TF_DATA_DIR:-.terraform}/environment" ]] || return
 
-  local workspace="$(< "${TF_DATA_DIR:-.terraform}/environment")"
+  local workspace="$(<"${TF_DATA_DIR:-.terraform}/environment")"
   echo "${ZSH_THEME_TF_PROMPT_PREFIX-[}${workspace:gs/%/%%}${ZSH_THEME_TF_PROMPT_SUFFIX-]}"
 }
 
 function tf_version_prompt_info() {
-    local terraform_version
-    terraform_version=$(terraform --version | head -n 1 | cut -d ' ' -f 2)
-    echo "${ZSH_THEME_TF_VERSION_PROMPT_PREFIX-[}${terraform_version:gs/%/%%}${ZSH_THEME_TF_VERSION_PROMPT_SUFFIX-]}"
+  local terraform_version
+  terraform_version=$(terraform --version | head -n 1 | cut -d ' ' -f 2)
+  echo "${ZSH_THEME_TF_VERSION_PROMPT_PREFIX-[}${terraform_version:gs/%/%%}${ZSH_THEME_TF_VERSION_PROMPT_SUFFIX-]}"
 }
 
-
 alias tf='terraform'
 alias tfa='terraform apply'
 alias tfa!='terraform apply -auto-approve'
 alias tfap='terraform apply -parallelism=1'
+alias tfapp='terraform apply tfplan'
 alias tfc='terraform console'
 alias tfd='terraform destroy'
 alias tfd!='terraform destroy -auto-approve'
@@ -31,6 +31,7 @@ alias tfiu='terraform init -upgrade'
 alias tfiur='terraform init -upgrade -reconfigure'
 alias tfo='terraform output'
 alias tfp='terraform plan'
+alias tfpo='terraform plan -out tfplan'
 alias tfv='terraform validate'
 alias tfs='terraform state'
 alias tft='terraform test'