Bring your environment.
prized setup looks at your machine, asks a few yes or no questions, and reproduces the parts you pick on the box - shell, toolchains, CLIs, Docker images, databases, and env vars.
What it does
prized setup
# ✓ fig ready
# ✓ project ~/src/app ⇄ fig:~/code/app
# bring Bring your dev environment to the box?
# shell aliases + exports · zsh as the login shell · ~/.tmux.conf
# python Python 3.12 · ruff · pre-commit · project deps (uv)
# node Node 22.4.0 · pnpm · typescript
# docker postgres:16 · redis:7 · compose up: app
# services postgres 16 on :5432 · redis on :6379
# [Y/n] n = choose group by groupThe environment step runs inside prized setup, between the project and agents steps: it scans your machine read-only, asks a few yes or no questions, and applies what you accept. Anything that did not carry is named with its reason (✓ env 41 moved · 2 not carried (~/.vimrc: contains a key-shaped value)). Re-running is safe: every item checks the box first and reports already on the box.
prized env scan shows the scan, prized env plan the questions without applying anything, and prized env migrate runs the step outside setup; prized setup --dry-run prints the whole run and changes nothing.
The questions
The install groups are one question; y or Enter takes them all, n asks group by group. Secrets are one question listing exactly what would move; data copies are their own question and default to no.
| Group | Default | What it brings |
|---|---|---|
| shell | yes | Aliases, functions, and non-secret exports into ~/.config/prized/shell.sh on the box; zsh with oh-my-zsh, powerlevel10k, or starship when you use them; .tmux.conf, .vimrc, and nvim config. |
| python | yes | The same Python versions via uv (or just the one the project pins), your pipx and uv tool packages, and the project's dependencies from its lockfile. |
| node | yes | The same Node versions via fnm (or just the one the project pins), your global npm packages, and pnpm or yarn through corepack. |
| tools | yes | Go and Rust at the same versions, cargo install binaries, Homebrew formulae as apt packages or Linux bottles (no bottle means not carried), and executables in ~/bin, ~/.local/bin, and ~/go/bin reinstalled from their origin. |
| clis | yes | Developer CLIs on your PATH: aws, gcloud, az, kubectl, helm, terraform, flyctl, vercel, wrangler, supabase, stripe, ngrok, and more. One whose sign-in lives in the macOS Keychain is not carried with the login command to run on the box. |
| docker | yes | Registry images pulled on the box, project Dockerfiles rebuilt there, and a running compose project brought up after the secrets step so its env_file is in place. Another compose project's images and volumes are not carried; set it up from its own folder. |
| services | yes | Local Postgres, MySQL, Redis, MongoDB, and similar as containers at the same major version and port, data in a named volume, client installed alongside. A port already taken on the box fails the item with the reason. |
| data | no | Database contents, named Docker volumes, and local-only images streamed over the tunnel. Sizes are shown before you answer. Images and volumes are read from the engine the scan inspected, whatever DOCKER_* says by the time the copy runs, and the copy runs docker, pg_dump, and gzip from the same standard locations the scan found them in, never from PATH. |
| secrets | yes | The project's .env files (below), secret-looking env vars from your shell files, and CLI sign-in files (~/.aws, ~/.config/gcloud, ~/.kube/config, ...), all 0600; values are never shown. |
The box is amd64: an arm64-only image is rebuilt or re-pulled, never streamed. Things with no recipe yet (conda, Ruby and Java toolchains, casks, devcontainers) are listed as not carried so you know what to set up by hand.
.env files
A sync session prized setup creates ignores .env and .env.* at every depth (.env.example and .env.sample still sync), so a credential file never reaches the box as a side effect of syncing. Instead the secrets question lists each one it found, a monorepo's apps/web/.env.local included, and with the default yes copies it to the same relative path on the box, 0600. A symlink to another .env inside the project is recreated as a symlink; a hard link, a symlink that leaves the project, or a file you cannot read is refused and named as not carried. Under --non-interactive, -y or --env-secrets grants the copy.
A project synced before this rule, or added by hand with
prized sync add, still carries.envfiles in the mirror; add.envto that project'sextra_ignoresto gate it. On a restricted box,prized setupadds the ignores to every sync project itself. Once a session ignores.envfiles,--unignorebrings back only.env.exampleand.env.sample.
Flags
| Flag | Effect |
|---|---|
--env shell,python,... | Bring these install groups without asking (the grant for --non-interactive; -y covers them too). |
--env-secrets | Copy your secrets without asking: .env files, env-var values, and CLI sign-ins (-y covers this too). |
--env-data | Copy database contents, volumes, and local-only images. Never covered by -y. |
--no-env | Skip the step. |
--no-advisor | Never contact the advisor; questions come from the built-in rules. |
--env-workers N | How many items install at once (default: up to 8); 1 installs them one at a time, in order. |
--attach, --no-attach | Open the box session in this terminal when setup finishes. The default (--no-attach) prints the reattach command. |
The advisor
The scan is deterministic. Before asking, the inventory and your project's manifests (README, Makefile, package.json, compose file, version pins) go to Prized's advisor, a bounded Claude pass that rewrites the questions around what the project actually needs. It sees names, versions, and sizes only: secret values are redacted before anything leaves your machine, credential files are never read, and paths are relative (. for the project, ~ for your home). It cannot run anything, picks only from the recipe catalog the rules use, and cannot add a secrets or data item the scan did not find. If it is unreachable the questions come from the rules; --no-advisor or PRIZED_ADVISOR=off skips it.
What never moves
- Private keys and vaults. SSH private keys, GPG keys, the macOS Keychain, browser profiles, 1Password data; the report tells you when commit signing needs a box key.
- Secret values into any output. The JSON envelope, the terminal, telemetry, and the advisor carry names only.
- An export that is not one literal assignment on its own line. A computed value (
$(...), backticks), a second command, pipe, redirect, or open quote on the line, aPATHedit, or a secret-looking name sharing a line stays home and is listed asnot carried; put the value on a line of its own to carry it. - Anything through the control plane. Every transfer goes over your SSH tunnel straight to the box. See Credentials.
- Data unless you say so. Database contents, volumes, and local-only images move only on an explicit yes or
--env-data.
On the box afterwards
| Path | What it is |
|---|---|
~/.config/prized/shell.sh | Your aliases, functions, exports, and the PATH hooks for the installed toolchains; sourced from ~/.profile, ~/.bashrc, and ~/.zshrc. |
~/.config/prized/env.secret | The env-var values you chose to move, 0600, sourced by shell.sh. |
~/.config/prized/welcome.txt | The welcome block setup printed: what moved, what was left. |
prized-postgres, prized-redis, ... | Service containers, --restart unless-stopped, data in prized-<name>-data volumes. |
Services listen on 127.0.0.1 on the box; prized ports mirrors them to your machine like any other box port.
Something unclear or out of date?
Agent setup
Paste one prompt into Claude Code or Codex on your machine; the agent installs the CLI, runs prized setup, and asks before putting your project or your credentials on the box.
Sync
A synced project is one folder pair, ~/code/<name> on the box mirrored into a folder on your machine. Edits land on the other side in under a second, both directions, .git included.