Bring your environment
prized setup scans your machine, asks a few yes or no questions, and reproduces the parts you pick on the box: shell, toolchains, CLIs, Docker images, databases, and env vars.
On this page7
What it does
prized setup
# ✓ fig ready
# ✓ project ~/src/app ⇄ fig:~/code/app
# bring Bring your dev environment to the box?
# shell aliases + exports · zsh as the login shell · ~/.tmux.conf
# python Python 3.12 · ruff · pre-commit · project deps (uv)
# node Node 22.4.0 · pnpm · typescript
# docker postgres:16 · redis:7 · compose up: app
# services postgres 16 on :5432 · redis on :6379
# [Y/n] n = choose group by groupThe step runs inside prized setup, between the project and agents steps, and its scan is read-only. Whatever did not carry is named with its reason (✓ env 41 moved · 2 not carried (~/.vimrc: contains a key-shaped value)); re-running is safe, as items already there report already on the box.
prized env scan shows the scan, prized env plan the questions without applying anything, and prized env migrate runs the step outside setup; prized setup --dry-run prints the whole run and changes nothing.
The questions
The install groups are one question: y or Enter takes them all, n asks group by group. Secrets are one question listing exactly what would move; data is its own question.
| Group | Default | What it brings |
|---|---|---|
| shell | yes | Aliases, functions, and non-secret exports into ~/; zsh with oh-my-zsh, powerlevel10k, or starship if you use them; .tmux.conf, .vimrc, nvim config. |
| python | yes | Your Python versions via uv (or only the one the project pins), pipx and uv tool packages, and the project's dependencies from its lockfile. |
| node | yes | Your Node versions via fnm (or only the one the project pins), global npm packages, and pnpm or yarn through corepack. |
| tools | yes | Go and Rust at the same versions, cargo install binaries, Homebrew formulae as apt packages or Linux bottles (no bottle: not carried), and executables in ~/bin, ~/.local/bin, and ~/go/bin, reinstalled from their origin. |
| clis | yes | Developer CLIs on your PATH (aws, gcloud, az, kubectl, helm, terraform, flyctl, vercel, wrangler, supabase, stripe, ngrok, and more); one signed in through the macOS Keychain is not carried, with the login command for the box. |
| docker | yes | Registry images pulled, project Dockerfiles rebuilt, and a running compose project started after the secrets step (so its env_file exists). Another compose project's images and volumes are not carried; set it up from its own folder. |
| services | yes | Local Postgres, MySQL, Redis, MongoDB, and similar, as containers at the same major version and port, with data in a named volume and the client installed. A port already taken on the box fails the item, with the reason. |
| data | no | Database contents, named Docker volumes, and local-only images, streamed over the tunnel; sizes are shown first. The copy uses the Docker engine and the docker, pg_dump, and gzip binaries the scan found, never a changed DOCKER_* or one on PATH. |
| secrets | yes | The project's .env files (below), secret-looking env vars from your shell files, and CLI sign-in files (~/.aws, ~/.config/gcloud, ~/.kube/config, ...), written 0600, values never shown. With AWS access connected, the box needs no ~/.aws credentials. |
The box is amd64, so an arm64-only image is rebuilt or re-pulled, never streamed. Conda, Ruby and Java toolchains, casks, and devcontainers have no recipe and are listed as not carried, to set up by hand.
.env files
A sync session prized setup creates ignores .env and .env.* at every depth (.env.example and .env.sample still sync), so syncing alone never moves a credential file. The secrets question lists each one found, a monorepo's apps/web/.env.local included, and a yes (the default) copies it to the same relative path on the box, 0600; under --non-interactive, -y or --env-secrets grants it.
A symlink to another .env inside the project is recreated as a symlink; a hard link, a symlink leaving the project, or a file you cannot read is refused as not carried.
Flags
| Flag | Effect |
|---|---|
--env shell,python,... | Bring these install groups without asking (the grant for --non-interactive; -y covers them too). |
--env-secrets | Copy your secrets without asking: .env files, env-var values, CLI sign-ins (-y covers this too). |
--env-data | Copy database contents, volumes, and local-only images. Never covered by -y. |
--no-env | Skip the step. |
--no-advisor | Never contact the advisor; the built-in rules ask the questions. |
--env-workers N | How many items install at once (default: up to 8); 1 installs them one at a time, in order. |
--attach, --no-attach | Open the box session in this terminal when setup finishes; the default (--no-attach) prints the reattach command. |
The advisor
The scan is deterministic. Before asking, setup sends the inventory and your project's manifests (README, Makefile, package.json, compose file, version pins) to Prized's advisor, a bounded Claude pass that fits the questions to the project. It sees names, versions, and sizes only: secret values are redacted before anything leaves your machine, credential files are never read, and paths are relative (. for the project, ~ for your home).
It cannot run anything, picks only from the rules' recipe catalog, and cannot add a secrets or data item the scan did not find. When it is unreachable, the rules ask the questions; --no-advisor or PRIZED_ADVISOR=off skips it.
What never moves
| Never moves | Detail |
|---|---|
| Private keys and vaults | SSH private keys, GPG keys, the macOS Keychain, browser profiles, 1Password data; the report says when commit signing needs a box key. |
| Secret values, into any output | The JSON envelope, the terminal, telemetry, and the advisor carry names only. |
| An export that is not one literal assignment on its own line | A computed value ($(...), backticks), a second command, pipe, redirect, or open quote on the line, a PATH edit, or a secret-looking name sharing a line stays home as not carried; give the value its own line to carry it. |
| Anything through the control plane | Every transfer goes over your SSH tunnel straight to the box (Credentials). |
On the box afterwards
| Path | What it is |
|---|---|
~/ | Your aliases, functions, exports, and the toolchains' PATH hooks; sourced from ~/.profile, ~/.bashrc, and ~/.zshrc. |
~/ | The env-var values you chose to move, 0600, sourced by shell.sh. |
~/ | The welcome block setup printed: what moved, what was left. |
prized-postgres, prized-redis, ... | Service containers, --restart unless-stopped, data in prized-<name>-data volumes. |
Services listen on 127.0.0.1 on the box; prized ports mirrors them to your machine like any other box port.