One Mac.
Every AI Agent.
Fully Loaded.

Enable FileVaultFileVault · Full-Disk EncryptionmacOS full-disk encryption. On Apple Silicon the data volume is encrypted by default; FileVault binds the decryption key to your login password — without logging in, nobody can read the disk. Your SSH private keys and API keys all depend on it as the last line of defense. Performance cost ≈ 0. Always turn it on, and keep the recovery key safe. disk encryption in the setup wizard; skip iCloud Desktop sync for now. Then use defaults writedefaults writeThe command-line interface to macOS preferences — reads and writes app settings directly. Scriptable and dotfiles-friendly: run it once on a new machine and every setting takes effect, no clicking through System Settings. to shape the system into developer form — all of it lives in your dotfilesdotfilesHidden config files starting with a dot (.zshrc, .gitconfig, .config/…). Managing them in a git repo = configuration as code; one command restores every setting on a new machine. See Chapter 13. and applies automatically on the next machine. Finally install the Xcode Command Line ToolsXcode CLTApple's standalone command-line developer tools package (git, clang, make, etc.) — no need to install the full Xcode. Homebrew and nearly every build toolchain depend on it., the prerequisite for every build toolchain.

# Keyboard: fastest key repeat, shortest delay
defaults write NSGlobalDomain KeyRepeat -int 1
defaults write NSGlobalDomain InitialKeyRepeat -int 10

# Trackpad: tap to click
defaults write com.apple.AppleMultitouchTrackpad Clicking -bool true

# Finder: show extensions + status bar + path bar
defaults write NSGlobalDomain AppleShowAllExtensions -bool true
defaults write com.apple.finder ShowStatusBar -bool true
defaults write com.apple.finder ShowPathbar -bool true

# Dock: auto-hide, disable recent apps
defaults write com.apple.dock autohide -bool true
defaults write com.apple.dock show-recents -bool false

# Save screenshots to ~/Screenshots
mkdir -p ~/Screenshots
defaults write com.apple.screencapture location ~/Screenshots

killall Finder Dock

# Xcode Command Line Tools: prerequisite for git, clang and every build toolchain
xcode-select --install

From this moment on, never install any dev software with a mouse again. Everything goes through brew install / brew install --cask and gets recorded in a Brewfile (see Chapter 13) — the core of "reproducible".

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Apple Silicon installs to /opt/homebrew by default; add it to PATH
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"

brew update && brew doctor

In the AI agent era, the terminal is the primary interface. Recommended stack: GhosttyGhostty · Terminal EmulatorProvides the window, rendering and interaction layer. GPU-accelerated rendering, a native macOS feel, and every setting in a single config file. (GPU rendering, natively fast) + zshzsh · Shell Command InterpreterEvery command you type (including the ones AI agents run) is parsed by the shell and handed to the system. The default macOS shell; all config lives in ~/.zshrc. Division of labor: Ghostty is the window, zsh is the "language" inside it, Starship is the prompt's appearance, Nerd Font draws the icons. + StarshipStarship · PromptA cross-shell prompt tool: renders the directory, git branch, Node/Python versions and command duration right in the prompt, configured with a single starship.toml. prompt + Nerd FontNerd Font · Icon FontA patched font family that adds thousands of icons on top of programming fonts. Starship, eza and friends rely on it to render icons — otherwise you get question-mark squares. icon font.

brew install --cask ghostty   # recommended; alternatives: wezterm / iterm2
brew install --cask font-jetbrains-mono-nerd-font
brew install starship zsh-autosuggestions zsh-syntax-highlighting

echo 'eval "$(starship init zsh)"' >> ~/.zshrc

font-family = JetBrainsMono Nerd Font
font-size = 14
theme = catppuccin-mocha
background-opacity = 0.96
window-padding-x = 12
window-padding-y = 10
copy-on-select = clipboard

Ditch nvm / pyenv / rbenv. misemise · One Manager for All Language VersionsDifferent projects need different Node / Python / Go versions; mise manages them all in one tool: declare versions in .mise.toml per project, auto-switch on cd, commit to git so the whole team stays on the same versions. Replaces nvm / pyenv / rbenv and the rest of the single-language managers. Phone analogy: mise manages the "OS version", uv manages "which apps to install". manages every runtime in one tool — auto-switches per project directory, versions live in .mise.toml shared with the team; uvuv · Python Package ManagerInstalls third-party libraries (openai, anthropic…). Written in Rust, 10–100× faster than pip. Automatically creates an isolated virtualenv per project so dependencies never clash; uv run executes scripts with the project environment. handles Python packages and virtualenvs, 10–100× faster than pip — the standard for AI projects.

brew install mise uv pnpm
echo 'eval "$(mise activate zsh)"' >> ~/.zshrc

mise use -g node@lts          # global default
mise use -g python@3.12
mise use -g go@latest

# In a project: mise use node@22 → generates .mise.toml, commit it to git

uv init my-agent && cd my-agent
uv add openai anthropic           # add dependencies
uv run main.py                    # run a script (auto-uses the project venv)
uv run --with ruff ruff check .   # ephemeral tool, keeps the environment clean

AI agents change code fast and in bulk — Git is your only safety net. Habits: commit before letting an agent touch anything; use git worktreegit worktree · Multiple Working TreesChecks out multiple branches of the same repo into different directories — independent working trees sharing one .git. The foundation of multi-agent parallelism: one worktree per agent, no stepping on each other. to run multiple agents in parallel without interference. Companion trio: ghgh · Official GitHub CLIManage issues / PRs / repos from the terminal; gh auth login signs in once and covers git push/pull authentication too. (official GitHub CLI), lazygitlazygit · Terminal UI for GitNo command memorization — stage, commit, branch, rebase and resolve conflicts entirely from the keyboard. After an agent rewrites a pile of code, it's the perfect review tool for walking diffs file by file and committing in batches. (terminal UI for Git), git-deltagit-delta · Diff RendererAdds syntax highlighting, line numbers and side-by-side view to git diffs. Enable it with pager = delta and it applies to git diff / git log / lazygit views. lazygit handles the "doing", delta handles the "display". (pretty diff renderer).

brew install git gh lazygit git-delta
gh auth login   # browser authorization; covers git push auth in one go

[core]
    editor = code --wait
    pager = delta               # syntax-highlighted diffs
[merge]
    conflictstyle = zdiff3
[pull]
    rebase = true
[alias]
    lg = log --graph --oneline --decorate --all
    st = status -sb

A set of modern replacements rewritten in Rust/Go. ripgrep is the underlying search engine agents use to search code; the rest speed up everything you do daily. All cross-platformCross-platform noteEvery tool in this chapter is written in Rust/Go — install the same set on Windows with winget / scoop, identical commands. The macOS-only items in this guide are: Homebrew, Ghostty, zsh, Raycast-style productivity apps, OrbStack — their Windows counterparts are winget, Windows Terminal, PowerShell 7, PowerToys, and Docker Desktop + WSL2., so you can practice on Windows in advance.

brew install ripgrep fd bat eza fzf zoxide jq yq sd httpie \
  hyperfine dust duf bottom tlrc

# ~/.zshrc additions
eval "$(zoxide init zsh)"
source <(fzf --zsh)
alias ls='eza --icons' cat='bat --style=plain'

Terminal agents do the heavy lifting; the editor is only for reviewing diffs and fine adjustments. Strategy: VS Code as the mainstay (keeps your existing habits, richest ecosystem) + ZedZed · Zed IndustriesBuilt by the original team behind GitHub's Atom editor (they also created the Tree-sitter parsing engine). After Atom was sunset they rewrote it from scratch in Rust: GPU-accelerated, millisecond startup, native multiplayer collaboration, open-sourced in 2024, with a built-in AI panel. as the lightweight alternative (opens huge files in a blink). No Cursor: your AI horsepower already lives in terminal agents; stacking another AI subscription on the editor duplicates value.

brew install --cask visual-studio-code    # mainstay: richest ecosystem
brew install --cask zed                   # alternative: instant startup, built-in AI panel

The 2026 consensus: don't bet on a single agent. The core lineup is a set of seven — Claude Code for long tasks, Codex for PR delivery, DSH for plugin orchestration, PI for self-extension, WorkBuddy and ZCode for full-scenario desktop work.

# Use git worktree for isolated workspaces — parallel agents without conflicts
git worktree add ../proj-feat-a feat-a
git worktree add ../proj-feat-b feat-b

# Window 1:  cd ../proj-feat-a && claude
# Window 2:  cd ../proj-feat-b && kimi

brew install herdr                            # preferred: updates ride along with brew upgrade
mise use -g herdr                             # alternative (old mise: mise use -g github:herdrdev/herdr)
curl -fsSL https://herdr.dev/install.sh | sh  # direct installer; only these use herdr update

MCPMCP · Model Context ProtocolThe "standardized socket" between agents and external tools — think USB-C: an agent implements the client once, a tool implements the server once, and they plug together. Servers expose tools (callable functions, 99% of use cases) / resources (data) / prompts (templates); local servers run as the agent's subprocess, remote ones over HTTP. lets agents plug into external tools. Each agent configures it differently (Claude Code uses claude mcp add, Kimi Code uses /mcp-config). Only install what the current project actually uses — more MCPs mean a more bloated context.

OrbStackOrbStack · Danny Lin (kdrag0n)The work of an indie developer's one-person company, released in 2023. The author was previously a well-known Android custom-kernel developer (creator of Proton Kernel) and rewrote the entire Docker + Linux virtualization stack natively in Swift / Rust — "one person beat Docker's official product". Free for personal use, paid for commercial use. replaces Docker Desktop: the fastest, most power-efficient Docker / Linux runtime on macOS. All databases run containerized — nothing pollutes the system.

brew install --cask orbstack
brew install lazydocker   # container TUI: lazygit for Docker

docker run -d --name pg -p 5432:5432 \
  -e POSTGRES_PASSWORD=dev postgres:17
docker run -d --name redis -p 6379:6379 redis:7

In the AI era you hold more API keys than credit cards. Iron rules: keys never enter git, never enter dotfiles in plaintext, never enter ~/.zshrc in plaintext. Take the free path first; 1Password1Password · Paid SubscriptionAbout $3/month (billed annually) for the personal plan; no free tier, just a 14-day trial. Unique value: op run injects API keys at runtime, plus a cross-device experience. Free alternatives are good enough — macOS Keychain for SSH keys, Bitwarden (free tier, with CLI and SSH agent) for passwords. is an optional paid extra (subscription ≈ $3/month).

brew install direnv age sops     # auto-load .env + encrypt sensitive configs

# SSH private keys managed by the native macOS Keychain (free, built-in)
ssh-keygen -t ed25519
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

# Optional paid: brew install --cask 1password 1password-cli
# Inject keys across projects: op run --env-file=.env.tpl -- claude

brew install --cask raycast rectangle alt-tab stats karabiner-elements

Second tier (daily enhancements — a macOS mapping of the OmarchyOmarchy · DHH's Fully-Loaded LinuxAn Arch distribution led by DHH (creator of Ruby on Rails), preloaded with a curated set of dev/productivity tools; very popular in 2025. This tier maps its list to macOS; items like fzf / ripgrep / lazygit / Neovim are already covered by this guide. list):

brew install --cask google-chrome obsidian shottr localsend iina tailscale

This is the soul of the whole setup: software list, configs and runtimes — all as code, stored in a private git repo. For the first setup, follow chapters 1–12 in order, then do this chapter once at the end; the payoff comes with your next machine — run a single bootstrap and you're restored in 30 minutes. Manage dotfiles with chezmoichezmoi · Dotfiles ManagerFree and open source (written in Go, released by Tom Payne in 2019), the most mainstream tool in its category. Collects scattered dotfiles into a git repo and restores them on a new machine with one command; its strengths are templating (per-machine differences) and encryption (sensitive configs age-encrypted into the repo)..

# After installing everything, export the list
brew bundle dump --file=~/dotfiles/Brewfile --force

# Manage dotfiles with chezmoi (supports templates & encryption)
brew install chezmoi
chezmoi init --apply <your-dotfiles-repo>

#!/bin/bash
# The only script a new Mac needs to run
xcode-select --install 2>/dev/null
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
eval "$(/opt/homebrew/bin/brew shellenv)"
brew bundle --file=<your-Brewfile>
chezmoi init --apply <your-dotfiles-repo>
mise install
gh auth login

The one-line principle: code travels via git, configs are rebuilt, dependency directories are never migrated.

# Run in Git Bash on Windows to push projects to the Mac
scp -r /c/Users/TUF/Workspace/<project> user@<mac-ip>:~/Workspace/

# Big-file fallback: an exFAT external drive (native read/write on both sides)
# Or enable SMB "File Sharing" on the Mac → drag & drop from Windows via \\<mac-ip>

Core mental model: two layers of assets, each with one discipline — the software layer answers to the Brewfile, the config layer answers to chezmoi. You don't run chezmoi for every step: a single dotsync alias bundles all the wrap-up actions.

dotsync() {
  brew bundle dump --file=~/dotfiles/Brewfile --force  # software list
  chezmoi re-add                                       # collect config changes
  git -C ~/dotfiles add -A
  git -C ~/dotfiles commit -m "chore: sync $(date +%F)"
  git -C ~/dotfiles push
}