[ZSH] Hook improvements

zsh/.zshrc

@@ -12,6 +12,9 @@
 # Per-branch, so `server` on each device fast-forwards to origin/server.
 update_dotfiles() {
     local repo="$HOME/dotfiles"
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file="$cache_dir/dotfiles-update-notice"
+    local notice_tmp="$notice_file.$$.tmp"
     # Bound the network call so a stalled fetch can't wedge this backgrounded
     # (&!) job into a days-long orphan holding unreaped children. `timeout` is
     # absent on macOS, so only use it when present. Disable ssh multiplexing so
@@ -21,22 +24,30 @@ update_dotfiles() {
         $TO git -C "$repo" fetch --quiet </dev/null 2>/dev/null || return
     git -C "$repo" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1 || return    # no upstream
     git -C "$repo" merge-base --is-ancestor '@{u}' HEAD 2>/dev/null && return # already current
-    git -C "$repo" merge --ff-only --quiet '@{u}' 2>/dev/null \
-        || print -u2 "⚠ dotfiles: $(git -C "$repo" symbolic-ref --short HEAD) can't fast-forward to @{u} — run: git -C ~/dotfiles pull"
+    git -C "$repo" merge --ff-only --quiet '@{u}' 2>/dev/null && return
+    local notice="⚠ dotfiles: $(git -C "$repo" symbolic-ref --short HEAD) can't fast-forward to @{u} — run: git -C ~/dotfiles pull"
+    mkdir -p "$cache_dir" || return
+    print -r -- "$notice" >| "$notice_tmp" || return
+    mv -f "$notice_tmp" "$notice_file"
 }
 
 update_dotfiles &!
 
-# On shell start, check the security tools repo for upstream updates and print a
-# one-line notice if the checkout is behind. Notify only (never auto-pull). This
-# stays read-only so it works even when the repo lives in root-owned /opt/tools:
+# On shell start, check the security tools repo for upstream updates and queue a
+# one-line notice if the checkout is behind. A precmd hook prints it between
+# commands, rather than letting this background job write across other startup
+# output or a prompt that is already being edited. Notify only (never auto-pull).
+# The check stays read-only so it works even in root-owned /opt/tools:
 #   - `safe.directory=*` sidesteps git's "dubious ownership" refusal on a repo
 #     owned by root, which would otherwise fail every git command.
 #   - `ls-remote` queries the remote without writing into .git (a normal user
 #     can't write a root-owned .git, so `fetch` would fail there).
 # Uses the first candidate that is a git checkout; covers global and per-user layouts.
 check_tools_repo() {
-    local repo branch remote mergeref remote_sha local_sha cmd
+    local repo branch remote mergeref remote_sha local_sha cmd notice
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file="$cache_dir/tools-update-notice"
+    local notice_tmp="$notice_file.$$.tmp"
     # See update_dotfiles: bound the network probe (timeout, absent on macOS) and
     # disable ssh multiplexing so a stalled ls-remote can't orphan this &! job.
     local -a TO; (( $+commands[timeout] )) && TO=(timeout -k 5 10)
@@ -53,11 +64,29 @@ check_tools_repo() {
         [[ "$remote_sha" == "$local_sha" ]] && return                             # already current
         $g merge-base --is-ancestor "$remote_sha" HEAD 2>/dev/null && return       # remote is an ancestor: ahead/equal (also true if we lack the object -> falls through to "behind")
         [[ -w "$repo/.git" ]] && cmd="git -C $repo pull" || cmd="sudo git -C $repo pull"
-        print -u2 "⬆ tools: updates available in $repo — run: $cmd"
+        notice="⬆ tools: updates available in $repo — run: $cmd"
+        mkdir -p "$cache_dir" || return
+        print -r -- "$notice" >| "$notice_tmp" || return
+        mv -f "$notice_tmp" "$notice_file"
         return
     done
 }
 check_tools_repo &!
+
+show_update_notices() {
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file claimed_notice
+    for notice_file in "$cache_dir"/{dotfiles,tools}-update-notice; do
+        [[ -s "$notice_file" ]] || continue
+        claimed_notice="$notice_file.$$.show"
+        mv "$notice_file" "$claimed_notice" 2>/dev/null || continue
+        command cat "$claimed_notice"
+        command rm -f "$claimed_notice"
+    done
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook precmd show_update_notices
+
 export LC_OSC52=1
 
 # Load Antidote
@@ -177,7 +206,19 @@ zstyle :bracketed-paste-magic paste-finish pastefinish
 # https://github.com/zsh-users/zsh-autosuggestions/issues/351
 ZSH_AUTOSUGGEST_CLEAR_WIDGETS+=(bracketed-paste)
 export PATH=$PATH:/Users/ising/.runai/bin
-source <(/Users/ising/.runai/bin/runai --quiet completion zsh)
+runai_bin=/Users/ising/.runai/bin/runai
+runai_completion=${ZDOTDIR:-$HOME}/.cache/zsh/runai-completion.zsh
+if [[ -x "$runai_bin" ]]; then
+    if [[ ! -s "$runai_completion" || "$runai_bin" -nt "$runai_completion" ]]; then
+        runai_completion_tmp="$runai_completion.$$.tmp"
+        if "$runai_bin" --quiet completion zsh >| "$runai_completion_tmp"; then
+            command mv -f "$runai_completion_tmp" "$runai_completion"
+        else
+            command rm -f "$runai_completion_tmp"
+        fi
+    fi
+    [[ -s "$runai_completion" ]] && source "$runai_completion"
+fi
 
 # Re-activate an inherited virtualenv — MUST be the last PATH-affecting line.
 #