# Bring your environment

> prized setup scans your machine, asks a few yes or no questions, and reproduces the parts you pick on the box: shell, toolchains, CLIs, Docker images, databases, and env vars.

URL: https://prized.dev/docs/environment

## What it does [#what-it-does]

```bash
prized setup
# ✓ fig ready
# ✓ project  ~/src/app ⇄ fig:~/code/app
# bring     Bring your dev environment to the box?
#           shell     aliases + exports · zsh as the login shell · ~/.tmux.conf
#           python    Python 3.12 · ruff · pre-commit · project deps (uv)
#           node      Node 22.4.0 · pnpm · typescript
#           docker    postgres:16 · redis:7 · compose up: app
#           services  postgres 16 on :5432 · redis on :6379
#           [Y/n] n = choose group by group
```

The step runs inside `prized setup`, between the project and agents steps, and its scan is read-only. Whatever did not carry is named with its reason (`✓ env  41 moved · 2 not carried (~/.vimrc: contains a key-shaped value)`); re-running is safe, as items already there report `already on the box`.

`prized env scan` shows the scan, `prized env plan` the questions without applying anything, and `prized env migrate` runs the step outside setup; `prized setup --dry-run` prints the whole run and changes nothing.

## The questions [#the-questions]

The install groups are one question: `y` or Enter takes them all, `n` asks group by group. Secrets are one question listing exactly what would move; data is its own question.

| Group    | Default | What it brings                                                                                                                                                                                                                                                                   |
| -------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| shell    | yes     | Aliases, functions, and non-secret exports into `~/.config/prized/shell.sh`; zsh with oh-my-zsh, powerlevel10k, or starship if you use them; `.tmux.conf`, `.vimrc`, nvim config.                                                                                                |
| python   | yes     | Your Python versions via `uv` (or only the one the project pins), pipx and `uv tool` packages, and the project's dependencies from its lockfile.                                                                                                                                 |
| node     | yes     | Your Node versions via `fnm` (or only the one the project pins), global npm packages, and pnpm or yarn through corepack.                                                                                                                                                         |
| tools    | yes     | Go and Rust at the same versions, `cargo install` binaries, Homebrew formulae as apt packages or Linux bottles (no bottle: `not carried`), and executables in `~/bin`, `~/.local/bin`, and `~/go/bin`, reinstalled from their origin.                                            |
| clis     | yes     | Developer CLIs on your PATH (aws, gcloud, az, kubectl, helm, terraform, flyctl, vercel, wrangler, supabase, stripe, ngrok, and more); one signed in through the macOS Keychain is `not carried`, with the login command for the box.                                             |
| docker   | yes     | Registry images pulled, project Dockerfiles rebuilt, and a running compose project started after the secrets step (so its `env_file` exists). Another compose project's images and volumes are `not carried`; set it up from its own folder.                                     |
| services | yes     | Local Postgres, MySQL, Redis, MongoDB, and similar, as containers at the same major version and port, with data in a named volume and the client installed. A port already taken on the box fails the item, with the reason.                                                     |
| data     | no      | Database contents, named Docker volumes, and local-only images, streamed over the tunnel; sizes are shown first. The copy uses the Docker engine and the `docker`, `pg_dump`, and `gzip` binaries the scan found, never a changed `DOCKER_*` or one on `PATH`.                   |
| secrets  | yes     | The project's `.env` files (below), secret-looking env vars from your shell files, and CLI sign-in files (`~/.aws`, `~/.config/gcloud`, `~/.kube/config`, ...), written 0600, values never shown. With [AWS access](https://prized.dev/docs/aws) connected, the box needs no `~/.aws` credentials. |

The box is amd64, so an arm64-only image is rebuilt or re-pulled, never streamed. Conda, Ruby and Java toolchains, casks, and devcontainers have no recipe and are listed as `not carried`, to set up by hand.

### `.env` files [#env-files]

A sync session `prized setup` creates ignores `.env` and `.env.*` at every depth (`.env.example` and `.env.sample` still sync), so syncing alone never moves a credential file. The secrets question lists each one found, a monorepo's `apps/web/.env.local` included, and a yes (the default) copies it to the same relative path on the box, 0600; under `--non-interactive`, `-y` or `--env-secrets` grants it.

A symlink to another `.env` inside the project is recreated as a symlink; a hard link, a symlink leaving the project, or a file you cannot read is refused as not carried.

> A project added by hand with `prized sync add`, or synced before setup ignored `.env` files, still mirrors them; add `.env` to its `extra_ignores` to stop that. On a [restricted box](https://prized.dev/docs/environments#safe-for-third-parties), `prized setup` adds the ignores to every sync project itself. Once a session ignores `.env` files, `--unignore` brings back only `.env.example` and `.env.sample`.

## Flags [#flags]

| Flag                      | Effect                                                                                                              |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `--env shell,python,...`  | Bring these install groups without asking (the grant for `--non-interactive`; `-y` covers them too).                |
| `--env-secrets`           | Copy your secrets without asking: `.env` files, env-var values, CLI sign-ins (`-y` covers this too).                |
| `--env-data`              | Copy database contents, volumes, and local-only images. Never covered by `-y`.                                      |
| `--no-env`                | Skip the step.                                                                                                      |
| `--no-advisor`            | Never contact the advisor; the built-in rules ask the questions.                                                    |
| `--env-workers N`         | How many items install at once (default: up to 8); `1` installs them one at a time, in order.                       |
| `--attach`, `--no-attach` | Open the box session in this terminal when setup finishes; the default (`--no-attach`) prints the reattach command. |

## The advisor [#the-advisor]

The scan is deterministic. Before asking, setup sends the inventory and your project's manifests (README, Makefile, package.json, compose file, version pins) to Prized's advisor, a bounded Claude pass that fits the questions to the project. It sees names, versions, and sizes only: secret values are redacted before anything leaves your machine, credential files are never read, and paths are relative (`.` for the project, `~` for your home).

It cannot run anything, picks only from the rules' recipe catalog, and cannot add a secrets or data item the scan did not find. When it is unreachable, the rules ask the questions; `--no-advisor` or `PRIZED_ADVISOR=off` skips it.

## What never moves [#what-never-moves]

| Never moves                                                  | Detail                                                                                                                                                                                                                            |
| ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Private keys and vaults                                      | SSH private keys, GPG keys, the macOS Keychain, browser profiles, 1Password data; the report says when commit signing needs a box key.                                                                                            |
| Secret values, into any output                               | The JSON envelope, the terminal, telemetry, and the advisor carry names only.                                                                                                                                                     |
| An export that is not one literal assignment on its own line | A computed value (`$(...)`, backticks), a second command, pipe, redirect, or open quote on the line, a `PATH` edit, or a secret-looking name sharing a line stays home as `not carried`; give the value its own line to carry it. |
| Anything through the control plane                           | Every transfer goes over your SSH tunnel straight to the box ([Credentials](https://prized.dev/docs/credentials)).                                                                                                                                  |

## On the box afterwards [#on-the-box-afterwards]

| Path                                   | What it is                                                                                                                |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `~/.config/prized/shell.sh`            | Your aliases, functions, exports, and the toolchains' PATH hooks; sourced from `~/.profile`, `~/.bashrc`, and `~/.zshrc`. |
| `~/.config/prized/env.secret`          | The env-var values you chose to move, 0600, sourced by `shell.sh`.                                                        |
| `~/.config/prized/welcome.txt`         | The welcome block setup printed: what moved, what was left.                                                               |
| `prized-postgres`, `prized-redis`, ... | Service containers, `--restart unless-stopped`, data in `prized-<name>-data` volumes.                                     |

Services listen on `127.0.0.1` on the box; `prized ports` mirrors them to your machine like any other box port.