Bring your environment.

What it does

prized setup
# ✓ fig ready
# ✓ project  ~/src/app ⇄ fig:~/code/app
# bring     Bring your dev environment to the box?
#           shell     aliases + exports · zsh as the login shell · ~/.tmux.conf
#           python    Python 3.12 · ruff · pre-commit · project deps (uv)
#           node      Node 22.4.0 · pnpm · typescript
#           docker    postgres:16 · redis:7 · compose up: app
#           services  postgres 16 on :5432 · redis on :6379
#           [Y/n] n = choose group by group

The environment step runs inside prized setup, after the project step and before the agents step. It scans your Mac read-only (a spinner; the counts and the probes that could not look print under --verbose), turns what it finds into a few questions, and applies what you accept. One question shows at a time: what would move and a [Y/n] or [y/N]; a single key answers, and the answered question collapses to a one-line result so the screen stays short. The apply prints a row only when something did not carry (✓ env 41 moved · 2 not carried (mole, cursor-agent)); a clean run leaves the result lines as the record. Installs run four at a time within a group (a Python version, a go install, and a Docker pull do not wait for each other); apt, Homebrew, and npm -g take turns, since they hold a lock. Re-running is safe: every item checks the box first and reports already on the box instead of redoing work.

prized env scan shows the scan on its own, prized env plan shows the questions without applying anything, and prized env migrate runs the step outside setup. To preview the whole onboarding, this step's exact on-box commands included, run prized setup --dry-run: everything prints, nothing changes.

The questions

The install groups are one question (bring: Bring your dev environment to the box? [Y/n], each group on its own line with what would move); y or Enter takes them all, n asks group by group. Secrets are one question (secrets: Copy your secrets to the box? [Y/n]) listing exactly what would move: the project's .env files, the secret-looking env vars from your shell files, and CLI sign-in files. Data copies are their own question and default to no. On a terminal one key answers (y, n, Enter for the default), and each answered question collapses to a one-line result.

The box is amd64. An arm64-only image is rebuilt from its Dockerfile or pulled from its registry, never streamed. Things with no recipe yet (conda environments, Ruby and Java toolchains, casks, devcontainers, MLX packages that only ship Apple Silicon wheels) are listed as not carried so you know what to set up by hand.

.env files

A sync session prized setup creates ignores .env and .env.* at every depth (.env.example and .env.sample still sync), so a credential file never reaches the box as a side effect of "sync this folder". Instead the secrets question lists each one it found (a monorepo's apps/web/.env.local included; node_modules, build folders, and hidden folders are not searched) and, with the default yes, copies it to the same relative path under the project folder on the box, 0600; a re-run refreshes it. A symlink to another .env file inside the project (apps/web/.env.local → ../../.env.local) is recreated as a symlink. Under --non-interactive, -y or --env-secrets grants it. A project synced before this (or added by hand with prized sync add) still carries them in the mirror: the project row says so (.env synced with the folder) and the question leaves them out. Add .env to that project's extra_ignores to gate it.

Flags

The advisor

The scan is deterministic. Before asking, the inventory goes to Prized's advisor, a bounded Claude pass that reads your project's manifests (README, Makefile, package.json, compose file) and rewrites the questions around what the project actually needs: the Python your .python-version pins, the Postgres your compose file names, the CLI your README says to install. It runs by default; --no-advisor (or PRIZED_ADVISOR=off) skips it.

What it can and cannot do:

• It sees names, versions, and sizes. Secret values are redacted before anything leaves your Mac, and it never reads your credential files.
• It cannot run anything. It picks from the same recipe catalog the rules use; anything outside the catalog is dropped and noted.
• It cannot add a secrets or data item that the scan did not find.
• If it is unreachable, the questions come from the rules; the JSON envelope's env step says questions: rules (the terminal shows nothing either way, the tailored summary prints under --verbose).

Set PRIZED_ADVISOR=off to never offer it.

What never moves

• SSH private keys, GPG keys, the macOS Keychain, browser profiles, 1Password data. The report tells you when commit signing needs a box key.
• Secret values into any output: the JSON envelope, the terminal, telemetry, and the advisor all carry names only.
• Anything through the control plane: every transfer goes over your SSH tunnel straight to the box, the same path the agent handoff uses. See Credentials.

On the box afterwards

Services listen on 127.0.0.1 on the box; prized ports mirrors them to your Mac like any other box port.