I didn't run the one-command setup.
I built it by hand.

After picking Ghostty as my main terminal (told in the previous post), it was time to actually configure it. Looking for how, I ran into a popular script that promised to do it all in a single command: Ghostty, Zsh, a fancy prompt, and thirty-odd modern CLI tools in one shot.

Tempting. One line to copy and paste. But that line was a curl pulling a script off the internet and piping it straight into bash. Before hitting Enter, I opened it up to see what it does, and what I saw made me decide not to run it.

Part 1What the one-command script does to your machine

To be fair first: these scripts are well written, well intentioned, and on a brand-new machine with nothing on it, they genuinely save time. The problem isn't the script. It's that you're about to run something you haven't read, with your full permissions, on a machine you've already set up.

When I read the one I found, several of the things it does reach deeper than expected.

• It overwrites your .zshrc. It installs oh-my-zsh, which on install renames your existing .zshrc to .zshrc.pre-oh-my-zsh and drops in its own template. So the PATH, aliases, and functions I'd set up across 108 lines wouldn't load until I moved them back in myself.
• It changes your default shell with chsh, and it removes the install directory with rm -rf at the end.
• It stacks three runtime managers (mise, fnm, pyenv) and two prompt layers (oh-my-zsh plus starship), which conflict and slow shell startup.
• It pulls more remote scripts to run, for example the Homebrew installer, itself another curl into bash.

Nothing here is "dangerous" in the sense of malicious. But taken together it re-plumbs my entire shell config, and without reading it first I'd have had no way to know what I was about to lose.

A script you curl into bash runs with your permissions and can change anything on your machine. Running it unread is signing a blank check to a stranger.

Part 2The guardrail: read before you run, curate before you pour

The lesson here is the same one from the post on the AI memory system that lost data silently: know what the tools you let touch your stuff actually do to it. Here, "your stuff" is the whole machine.

The rules I use are just two, nothing elaborate.

1. Always read before you run. Especially anything that curls into bash: rather than piping straight into bash, save the script to a file, read what it touches, then run that file. It costs a few extra minutes, and it turns "trust completely" into "seen it, it's fine".
2. Curate before you pour. On a configured machine, installing the specific pieces you want beats pouring in a whole prebuilt bundle, because bundles come with things you don't use and things that clash with your existing config.

This isn't paranoia. A brand-new machine can run the one-shot script fine, low risk. But on one with dotfiles and functions built up over a year, reading first and installing by hand is the difference between gaining new tools and breaking the ones you already rely on.

Part 3How I built it by hand

Once I chose to assemble it myself, it wasn't as fiddly as I feared. Just do it in steps, and keep every step visible.

1. Install tools one at a time with brew

Pick a set that's worthwhile without being bloat, and install through Homebrew, one command, so you know exactly what's on the machine.

brew install eza bat fd ripgrep zoxide starship fzf \
  zsh-autosuggestions zsh-syntax-highlighting

• eza for ls · bat for cat · fd for find · ripgrep for grep
• zoxide remembers directories you've visited so you jump with z · fzf for fuzzy finding
• starship is the prompt (light, cross-shell); the last two are autosuggestions and syntax-highlighting

Want searchable, syncable history? Add atuin later. It doesn't need to be there from the start.

2. Configure Ghostty as a single file

Ghostty reads one file at ~/.config/ghostty/config, plain key = value lines. Keep it in your dotfiles/git and copy it to a new machine instantly.

theme = catppuccin-mocha
font-family = "JetBrainsMono Nerd Font Mono"
font-size = 14
macos-option-as-alt = true

The macos-option-as-alt line matters if you want Alt-based shortcuts (like fzf's) to work on a Mac. And the font has to be a Nerd Font for the prompt's icons to render.

3. Append to .zshrc as a reversible block (back it up first)

This is the heart of building it yourself. Instead of letting something rewrite .zshrc, I back up the original first, then append the new setup as a labelled block you can delete to restore the old state.

cp ~/.zshrc ~/.zshrc.bak-$(date +%F)   # back up first

# --- curated modern-cli (delete this whole block to revert) ---
eval "$(starship init zsh)"
eval "$(zoxide init zsh)"
alias ls='eza --icons=auto --group-directories-first'
alias cat='bat'
source /opt/homebrew/share/zsh-autosuggestions/zsh-autosuggestions.zsh
# syntax-highlighting must be sourced on the very last line
source /opt/homebrew/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
# --- end ---

Two things to watch: one, syntax-highlighting must come last, after every other plugin; two, appending the block at the end of the file leaves everything above it (your PATH, your own functions) untouched.

The result is what the bundled script promised: a nice prompt and the full toolset. But gained in a way where I know what's there, and every step is reversible.

The one rule to keep

If you take one thing from this post: anything you'd curl into bash, read it first, and on a machine you've already configured, install the pieces yourself instead of pouring in a whole bundle. The convenience of one command isn't worth losing a config you built over a year.