Graphical apps
The apps around the terminal — browsers, a launcher, notes.
Not everything happens in a terminal. On a Mac, Groundwork installs a small desktop layer around the agent workflow: the browser you inspect with, a launcher that keeps context one keystroke away, a durable link library, display controls, and notes. Linux/headless profiles skip this layer; the point is to support the work, not make every app mandatory.
#What Groundwork can configure
Groundwork should only automate settings that live in stable files, templates, or documented macOS defaults. Many Mac apps keep their real state in app databases, account sync, Keychain, iCloud, or per-device stores; those should stay in the app that owns them.
| Managed by Groundwork | Shell, Git, tmux, Neovim, Ghostty, Karabiner merge config, selected macOS defaults, Zen user.js, Chrome password-manager policy, browser/Raycast extension checklists, and Obsidian vault/plugin seed files. |
| Use app sync/export | Raycast aliases, hotkeys, snippets, Quicklinks, and extensions belong in Raycast Cloud Sync if available on your plan, or Raycast export/import. Anybox links, profiles, Quick Links, and snippets sync through iCloud. Browser bookmarks/history use Firefox Sync or each browser's own profile sync. |
| Manual by design | App Store purchases, sign-in, password-manager unlock, API keys, SSH-agent approval, default-browser confirmation, macOS privacy prompts, display presets, and app-level hotkeys that depend on your hands, monitors, and existing shortcuts. |
It would look automated for a moment and then drift. Raycast, Anybox, BetterDisplay, and password managers are allowed to change their private storage, encrypt it, sync it, or rewrite it on launch. Groundwork keeps those steps short and repeatable instead of reverse-engineering state that the app owns.
#Browsers
| Zen | The daily driver. Built on Firefox's engine, with a sidebar, vertical tabs, and workspaces. Private by default and pleasant to live in. |
| Chrome | The baseline everyone tests against. Keep it for the occasional site that only behaves in Chrome — not as your everyday browser. |
| Dia | An AI-first browser (from the makers of Arc), installed on personal machines. Experimental — worth a look, not yet a daily driver. |
Living in a private browser and keeping a mainstream one for testing is normal for developers. Zen for everything; Chrome when a site demands it.
Zen rides on Firefox Sync: Settings → Sync, sign in with a free Mozilla account, and your bookmarks, history, saved logins, and open tabs follow you to every Mac (end-to-end encrypted). The catch — Spaces (workspaces) don't sync. They're a Zen-only idea Firefox Sync doesn't understand, and a bookmark's Space assignment is lost in transit, so synced bookmarks land in every Space rather than the one you filed them in. So turn Sync on for the links and passwords, but expect to recreate your Space layout by hand on each machine (or use "Send to Device" for one-off tab handoffs). Cross-device Spaces are on Zen's roadmap, not shipped.
chezmoi writes zen.workspaces.wrap-around-navigation=false into each Zen profile's user.js. That makes Space navigation stop at the leftmost and rightmost Space instead of cycling around. Swipe navigation is left alone; restart Zen after applying Groundwork if the change does not show up immediately.
Browser extensions
Groundwork keeps the extension source of truth in ~/.local/share/groundwork/browser-extensions.tsv. Run browser-extensions to list the vetted links. On macOS, add --open to open them in Zen, Chrome, or Dia. Chrome and Dia use Chrome Web Store links; Zen uses Firefox Add-ons.
| Core | Password manager, uBlock Origin Lite / uBlock Origin, Anybox Browser Extension, and Obsidian Web Clipper. |
| Privacy | Privacy.com is included as the official virtual-card service link. I could not verify a current official browser extension, so it is not treated as an extension install. |
| Optional privacy | Privacy Badger is available, but keep the extension set small unless you need it; every extension is another trusted code path. |
| Frontend dev | React Developer Tools, Redux DevTools, Vue.js devtools, Angular DevTools for Chromium, and axe DevTools for accessibility. |
$ browser-extensions
$ browser-extensions --browser zen --tier core --open
$ browser-extensions --browser chrome --tier dev --openPassword manager and autofill
Groundwork installs Bitwarden or 1Password based on the setup choice, but sign-in, autofill provider selection, and SSH-agent approval are intentionally manual. Password managers protect the keys and credentials agents should never see in prompts or dotfiles.
| SSH agent | Sign in to the desktop app, then enable its SSH agent. Bitwarden: Settings → enable SSH agent. 1Password: Settings → Developer → Use the SSH agent. If commits stop signing, unlock the app and retry. See Git for the signing flow. |
| macOS + Safari | System Settings → General → AutoFill & Passwords: turn on Bitwarden and turn off Passwords/iCloud Keychain if Bitwarden is the source of truth. |
| Chrome / Dia | Install the Bitwarden extension, sign in, and pin it. Groundwork disables Chrome's built-in password manager by policy; turn Dia's built-in manager off in its own settings. |
| Zen | Install the Firefox-family Bitwarden add-on, sign in, then Settings → Privacy & Security → uncheck Ask to save logins and passwords. |
| iOS / iPadOS | Install Bitwarden, sign in, then Settings → General → AutoFill & Passwords: enable Bitwarden and disable Passwords if you want the same source of truth on mobile. |
#Raycast — the launcher
Raycast is the single biggest quality-of-life app here. One keystroke opens a search box that launches apps, does math, manages windows, remembers your clipboard, and runs little commands — so your hands stay off the mouse. It's meant to take over ⌘Space from Spotlight.
| Launch & search | Hit the hotkey, type an app or file name, Enter |
| Clipboard history | Everything you've copied, searchable — no more losing what you copied two things ago |
| Window management | Snap windows left/right/full from the keyboard — the default window manager for this setup |
| Quicklinks | Save a keyword that jumps straight to a site or search you use daily |
| Extensions | A store of add-ons — GitHub, Homebrew, and more |
Aliases, Quicklinks, and hotkeys
There are two kinds of shortcuts, and mixing them up is where people create conflicts. Typed aliases are words you type after Raycast or Anybox is already open. Global hotkeys are key chords that work everywhere. Use lots of aliases, but keep global hotkeys rare and consistent.
| Typed aliases | Use short, memorable lowercase triggers such as gh for GitHub, cal for calendar, docs for your docs site, ab for Anybox Search Links, and as for Anybox Save Current Tab. They only run after you open Raycast or Anybox, so they do not collide with macOS shortcuts like ⌘Tab. |
| Good keywords | Prefer two to five characters, tied to the thing you want, and easy to type with one hand. Avoid single letters, full app names, and words you already search for often; those create noisy search results instead of speed. |
| Global hotkeys | Use key chords only for actions you need many times a day: Raycast itself, clipboard history, and window snapping. Keep one mostly-free modifier family, usually ⌃⌥, so your custom shortcuts are easy to remember and easy to audit. |
| Reserved habits | Do not override core macOS/browser muscle memory unless you mean to: ⌘Space for Raycast, ⌘Tab, ⌘Q, ⌘W, ⌘H, browser tab keys, and Mission Control keys. |
Raycast, not Anybox, should replace Spotlight. In System Settings → Keyboard → Keyboard Shortcuts → Spotlight, change or uncheck "Show Spotlight search," then set Raycast's hotkey to ⌘Space (its onboarding offers to do this for you). chezmoi installs Raycast, but this hotkey lives in Raycast/macOS settings, so use Raycast Cloud Sync if it is available on your plan, or export/import a Raycast config to reproduce it.
Browser add-ons live in Zen, Chrome, and Dia. Raycast extensions live inside the Raycast app and come from the Raycast Store. Groundwork cannot silently install or configure Raycast's internal extension database, but it does install a helper on Mac profiles: run raycast-extensions to list the recommended Store entries, or raycast-extensions --open to open them.
$ raycast-extensions
$ raycast-extensions --open
$ raycast-extensions --tier tabs --open
$ raycast-extensions --tier ai --openUsing it day to day
The loop is always the same: tap the hotkey, start typing, press Enter. What you type can be an app name, a math expression (128*1.2), a unit or currency conversion, or part of a filename — Raycast surfaces the best match. A few habits make it sing:
| Clipboard history | Give it one global hotkey in Settings → Extensions, preferably inside the same ⌃⌥ family, then recall anything you copied earlier instead of losing it |
| Window management | Set hotkeys to snap the focused window left / right / full / to another display — no mouse |
| Quicklinks | Create one for a site or search you open daily, such as gh for GitHub or cal for calendar; type its keyword after opening Raycast |
| Aliases & hotkeys | For any command you use a lot, start with a typed alias. Promote it to a global hotkey only when you use it constantly and know it will not shadow macOS or browser defaults. |
| Extensions | Add from the Store — Browser Bookmarks, Browser Tabs, GitHub, Homebrew, Anybox, the VS Code project opener — and search them right from the bar |
Reproducing your Raycast setup on another Mac isn't something chezmoi can do because Raycast keeps aliases, hotkeys, extensions, and Quicklinks internally. Use Raycast Cloud Sync if it is available on your plan; otherwise use Settings → Advanced → Export to a .rayconfig file and Import it on the other machine. Keep full exports out of Git: they are private, not reviewable like text config, and may include settings you did not mean to publish. The important hotkeys to set first are Raycast itself on ⌘Space, window left half, right half, maximize, restore, clipboard history, Browser Bookmarks, Browser Tabs if you use supported browsers, and Anybox link search.
Bookmarks, tabs, and links in Raycast
| Browser Bookmarks | Best baseline. It searches bookmarks from the browsers you enable inside the extension, including Firefox-family browsers such as Zen and Chromium-family browsers such as Chrome and Dia. No browser add-on is needed for bookmarks. |
| Browser Tabs | Use for live open tabs in browsers Raycast can read through macOS automation, especially Safari and Chromium-family browsers. Zen is Firefox-based, so do not rely on Browser Tabs as the universal live-tab layer. |
| Anybox | The durable cross-browser layer. Save important tabs into Anybox, then search them from Raycast through the Anybox extension. This is more reliable for project/client/teaching links than hoping every browser exposes live tabs the same way. |
| Browser add-ons | Install the Anybox and Obsidian Web Clipper add-ons in Zen, Chrome, and Dia with browser-extensions --tier core --open. They are for capturing pages, not for making Raycast itself work. |
Asking Claude, GPT, or Grok from Raycast
There are two good paths. Raycast Pro is the cleanest: use Quick AI from the root Raycast search, AI Chat for longer conversations, AI Commands on selected text, and the model picker when you want Claude, OpenAI, or Grok. No per-model extension setup; Raycast owns the subscription and routing.
The no-subscription path is bring your own keys: install separate ChatGPT, Claude, and Grok extensions from the Store and configure each with its provider API key. It is more fiddly, but it lets you pay providers directly. Run raycast-extensions --tier ai --open to open the relevant Store searches and Raycast AI docs.
If Raycast Settings only shows Anybox under Applications, the Raycast extension is not installed yet. Install the Anybox Raycast extension from the Raycast Store, or run open 'raycast://extensions/anybox/anybox?source=webstore'. Its Save Current Tab commands work through Anybox, and its Search Links command has its own required API Key preference. Copy the key from the Anybox app → Preferences → General, then select the Search Links command row in Raycast Settings and paste it there. Use typed aliases first: ab for Search Links and as for Save Current Tab are short, memorable, and do not compete with global macOS shortcuts.
| Search Tags | On — tags should be searchable from Raycast. |
| Search Folders | On — folders matter once Anybox becomes the shared project/client/teaching link library. |
| Show Tags | On — useful context while scanning results. |
| Show Folders | On — useful context while scanning results. |
| As Icons | Off — list view is faster to scan from Raycast. |
| Prefer Link Icons in Icons view | Off — only matters if icon view is enabled. |
#Anybox — bookmarks
Anybox keeps your links organized and a keystroke away. It can live in the menu bar, group links into profiles (one set for work, another for personal), and jump to any of them with a keyword. It syncs across your devices through iCloud.
Using it day to day
Three motions cover it: save, organize, recall.
| Save a link | Use Anybox's global hotkey, or the macOS share sheet from any browser/app, to drop the current page in |
| Organize | Tag links or sort them into profiles — one set for work, one for home — so each context shows only its own |
| Recall | Open Anybox Quick Find, search from Raycast, or trigger a Quick Link keyword to jump straight to a saved link |
For Anybox Quick Links, use the same typed-keyword convention as Raycast: short lowercase triggers for places you open constantly, such as gh, cal, docs, or a project nickname. Quick Link keywords are typed after opening Anybox, so they are safer than global hotkeys; reserve actual key chords for capture and search actions you use all day.
Run it as a menu-bar app so it's always a keystroke away, and it syncs everything through iCloud to your other devices. Pro removes the small free-library cap, which makes Anybox a real shared bookmark layer for work, home, teaching, and client links.
Anybox links, profiles, Quick Links, snippets, and menu-bar behavior are app-owned state. Set them once in Anybox and let iCloud carry them to your other Apple devices. The Anybox API key also stays out of the repo: paste it into the Raycast Anybox command preference by hand so it remains a local secret.
Anybox is bought once from the App Store — the setup can't purchase it for you. Buy and sign in there first; after that it updates and syncs on its own. There is no AI switch you need for this workflow; Anybox is the link library, not the AI layer.
#BetterDisplay — resolutions and monitors
BetterDisplay owns the display layer: menu-bar resolution changes, favorite display modes, refresh rates, brightness/DDC controls for supported monitors, and protection against layouts drifting when displays reconnect. Raycast moves windows; BetterDisplay changes the screens those windows live on.
| Resolution menu | Switch between favorite scaled resolutions without digging through System Settings |
| External monitor controls | Adjust brightness, volume, inputs, and color modes on many supported displays |
| Layout protection | Keep laptop and external monitor arrangements stable after sleep, docks, and reconnects |
| Automation | Use CLI, URL schemes, Shortcuts, or Raycast commands for repeatable display setups |
Groundwork does not seed BetterDisplay presets or hotkeys. Those depend on the exact laptop, dock, monitor IDs, refresh rates, and licensing state in front of you. Pick favorites in the app first, then automate with BetterDisplay's supported CLI, Shortcuts, URL schemes, or Raycast only after you know the display setup is stable.
BetterDisplay has a free tier and a paid Pro license. For work or contract teams, check the license before relying on Pro features.
#Obsidian — notes
Obsidian is a notes app where every note is a plain markdown file you own. Notes link to each other with [[double brackets]], building a web of ideas you can navigate visually. The setup points it at an iCloud vault so your notes follow you to every Mac and the mobile app.
Groundwork enables Obsidian's Vim mode in managed vault defaults. That keeps notes consistent with Neovim muscle memory: Esc returns to Normal mode, j/k move by line, and editing uses familiar Vim motions.
The wiki from the Knowledge base page is just a folder of markdown — open it as an Obsidian vault and you get the same notes with a visual graph and link-following on top.
Obsidian AI helpers
Obsidian is useful before adding AI. If you do use AI over notes, keep the data flow explicit: local files stay in the vault, plugins get only the keys or local endpoints they need, and agents work from a project folder you can inspect.
| Keep files local | Your vault lives at iCloud Drive/Obsidian/<name>. Right-click the folder and choose Keep Downloaded, or turn off Optimize Mac Storage, so notes are available to editors and agents. |
| Plugin first run | After first launch, restart Obsidian once so Groundwork's auto-installed plugins load before you configure them. |
| Smart Connections | Add your Claude API key or local Ollama URL, then choose the embedding model you want. For a local path, start Ollama so it serves http://localhost:11434, then run ollama pull nomic-embed-text. |
| Whisper | Use it for speech-to-text notes. Point it at a local endpoint if you want speech fully offline. |
| Claude Code over notes | For AI chat over a vault, point Claude Code at the vault or the generated knowledge-wiki folder so changes happen through files you can review. |
#The terminal window: Ghostty
Everything in the rest of this guide — the shell, tmux, Neovim — runs inside Ghostty, a fast, modern terminal app themed to match the rest of the setup. It's the window; tmux does the splitting inside it. Worth knowing: ⌘K clears the screen.
Groundwork installs font-jetbrains-mono-nerd-font and sets Ghostty to JetBrainsMono Nerd Font at size 14. The goal is practical readability: code should make 1, l, I, 0, O, and similar shapes easy to tell apart, and the Nerd Font symbols keep prompt and tmux icons from turning into boxes.
$ ghostty +show-config | grep -i font-family
font-family = JetBrainsMono Nerd Font
A fresh Ghostty launch opens in your home folder (~). New tabs, windows, and splits inherit the folder you are already working in, so quick side shells stay near the task. tmux owns project persistence and restoration; Ghostty stays a clean window around it.
#Communication
Rounding out the set, installed and ready to sign into:
| Slack · Zoom | Team chat and calls |
| Discord | Communities and dev servers |
| Personal messaging |
#Uninstalling apps without leaving a mess
Groundwork installs AppCleaner on personal Macs, but it is the fallback, not the universal first step. The installer that owns an app usually knows more about its login items, extensions, privileged helpers, and shared data than a generic cleaner can infer.
- Vendor uninstaller first. If the app includes an uninstall command or removal app, use it.
- Homebrew next. For an app managed by the Brewfile, run
brew uninstall --cask NAME. Add--zaponly after inspecting the cask because zap can remove preferences, caches, and shared resources. - AppCleaner for a plain app. Drag an app that was installed from a DMG or ZIP into AppCleaner, review every related path it proposes, then remove the checked items.
- Personal files stay a separate decision. Projects, documents, media libraries, cloud files, and exported data are not app leftovers. Archive or delete those deliberately.
Use largest ~ before and after cleanup when you want evidence that the space changed. Apple’s Storage settings remain the safest overview for user files and system recommendations.
#First-time setup
Hand ⌘Space to Raycast
Free up Spotlight's shortcut (settings above), then set Raycast to ⌘Space. Open it, launch an app, then press it again and try the clipboard history. This is the habit that changes your day.
Make Zen your default
Open Zen and set it as the default browser when it asks, or run defaultbrowser zen and approve the macOS confirmation. Leave Chrome installed but unused except for testing.
Turn on Anybox
Buy and sign into Anybox from the App Store, enable its menu-bar mode, and add one or two Quick Links with typed keywords such as gh, cal, or a project nickname.
Choose your display presets
Open BetterDisplay, mark the resolutions you actually use as favorites, and make sure the menu bar icon is visible. If you use an external display, test brightness and input control.
Open your notes
Launch Obsidian, open the iCloud vault, and make a note. Type [[ and watch it offer to link to other notes — that's the whole idea.