workflow

macOS has a kernel-level sandboxing tool you can use from the terminal. You can leverage it with the audit pattern: use a deny-list profile that lets you run a script once, watch the kernel deny its first write, and decide what to do next.

The Modern CLI Stack book presents zoxide, mise, starship, and fzf one chapter at a time. This issue wires them into a single session.