After clean macOS install, in Terminal.app:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/donbox/migration-bootstrap/main/step1-homebrew.sh)"
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/donbox/migration-bootstrap/main/step2-claude-code.sh)"

Why this form, not curl ... | bash? Piping through bash disconnects the script from your terminal — the Homebrew installer can't read your sudo password and fails. The bash -c "$(curl ...)" form keeps stdin attached to the terminal so sudo and other interactive prompts work. Same pattern Homebrew uses for its own install instructions.

Step 2 ends with Claude Code launched and the provision prompt on your clipboard. Sign in to Claude Code, open a new conversation, and Cmd+V.

Everything below is reference material. The two commands above are what you actually type.

• step1-homebrew.sh — installs Homebrew and wires brew shellenv into ~/.zprofile. ~10 min. Asks for your password and offers to install Xcode Command Line Tools.
• step2-claude-code.sh — installs Claude Code via brew install --cask claude-code, installs gh, runs gh auth login --web (you sign in to GitHub via browser), clones the private donbox/how-I-work repo to ~/repos/wp/how-I-work, pipes machine-setup/provision-machine.md to pbcopy, and launches Claude Code.

Both scripts support --help for a full description.

The migration workflow itself (provision prompt, decommission prompt, bundle script, runbook) lives in the private donbox/how-I-work repo. But curl | bash doesn't work against a private repo until you've authenticated with gh, which is itself referenced from inside the private repo. This public repo solves the chicken-and-egg: two public scripts that the fresh Mac can reach, and step 2 handles gh auth login before any private content is needed.

Both scripts are idempotent. Each step checks before acting:

• step1 detects existing Homebrew and existing shellenv line, skips both.
• step2 detects existing Claude Code install, existing gh auth, existing how-I-work clone — skips each that's already done.

Safe to re-run anytime to recover from a partial install.