build a clean terminal with zsh and starship

why your prompt is a security tool and not just a vibe

everyone treats the terminal like it's just a black box you type into and forget. that's a mistake. your shell is the control panel for everything you do on your machine, and if you don't know what's configured in it, you don't fully know what your machine is doing when you open it. building a clean zsh and starship setup isn't just about looking cool for a screen recording, it's about giving yourself visibility. a good prompt tells you what user you are, what directory you're in, whether your last command failed, and whether you're inside a git repo with uncommitted changes. that's the kind of context that stops "oops i just force pushed to main" or "wait was that sudo command run as root."

step one, switch to zsh

before installing anything, check what shell you're actually running. a lot of people don't know.

echo $SHELL

if that says bash and you want zsh, install it and set it as your default.

sudo apt install zsh
chsh -s $(which zsh)

on mac, zsh is already the default in modern macos, so you can skip straight to config. the defensive habit here: know your default shell and know where its config file lives (~/.zshrc or ~/.bashrc). that file runs every time you open a terminal, so it's worth actually reading what's in yours, especially if you inherited a dotfiles setup from an old job or copied one from a tutorial without looking.

installing starship without blindly trusting a script

starship is a fast, themeable prompt that works across shells. the install page gives you this:

curl -sS https://starship.rs/install.sh | sh

piping curl straight into sh is convenient, but it's also the exact pattern security folks warn about, because you're running a remote script without seeing it first. good habit for any tool, not just starship: download the script, open it in a text editor, skim it for anything that touches your ssh keys, shell history, or sudo, then run it.

curl -sS https://starship.rs/install.sh -o install.sh
less install.sh
sh install.sh

or skip the script entirely and install it through your package manager, which is generally the safer path since it's maintained and signed by a distro you already trust.

brew install starship

then add this line to the bottom of your ~/.zshrc:

eval "$(starship init zsh)"

nerd fonts and syntax highlighting

starship's icons need a nerd font to render correctly, otherwise you get boxes instead of symbols. grab one from nerdfonts.com directly rather than a random mirror site, since font files are executable-adjacent in some contexts and you want them coming from the source.

next, syntax highlighting. this one actually has real defensive value, not just aesthetics. the zsh-syntax-highlighting plugin colors your command as you type it, so a typo in a destructive command stands out before you hit enter. that's the difference between catching a bad rm -rf flag and not catching it.

git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ~/.zsh/zsh-syntax-highlighting
echo "source ~/.zsh/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh" >> ~/.zshrc

aliases you'll actually audit

aliases save time, but they're also a spot where people quietly build in bad habits, like aliasing sudo to skip a password prompt or aliasing rm to always force delete. keep yours simple and readable.

alias ll='ls -la'
alias gs='git status'
alias update='sudo apt update && sudo apt upgrade'

reload your config to see everything take effect:

source ~/.zshrc

the takeaway

a clean terminal setup is a small win that pays off in a big way: you get faster feedback, fewer silent mistakes, and a shell that actually shows you what's happening instead of hiding it. the real defensive habit isn't the theme, it's the discipline underneath it. read your dotfiles before you copy someone else's. read a script before you pipe it into sh. know your default shell and what runs when you open it. your terminal should work for you, and you should know exactly what it's doing on your behalf.