zsh: restrict local calls