# Bring your environment > prized setup looks at your machine, asks a few yes or no questions, and reproduces the parts you pick on the box - shell, toolchains, CLIs, Docker images, databases, and env vars. URL: https://prized.dev/docs/environment ## What it does [#what-it-does] ```bash prized setup # ✓ fig ready # ✓ project ~/src/app ⇄ fig:~/code/app # bring Bring your dev environment to the box? # shell aliases + exports · zsh as the login shell · ~/.tmux.conf # python Python 3.12 · ruff · pre-commit · project deps (uv) # node Node 22.4.0 · pnpm · typescript # docker postgres:16 · redis:7 · compose up: app # services postgres 16 on :5432 · redis on :6379 # [Y/n] n = choose group by group ``` The environment step runs inside `prized setup`, between the project and agents steps: it scans your machine read-only, asks a few yes or no questions, and applies what you accept. Anything that did not carry is named with its reason (`✓ env 41 moved · 2 not carried (~/.vimrc: contains a key-shaped value)`). Re-running is safe: every item checks the box first and reports `already on the box`. `prized env scan` shows the scan, `prized env plan` the questions without applying anything, and `prized env migrate` runs the step outside setup; `prized setup --dry-run` prints the whole run and changes nothing. ## The questions [#the-questions] The install groups are one question; `y` or Enter takes them all, `n` asks group by group. Secrets are one question listing exactly what would move; data copies are their own question and default to no. | Group | Default | What it brings | | -------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | shell | yes | Aliases, functions, and non-secret exports into `~/.config/prized/shell.sh` on the box; zsh with oh-my-zsh, powerlevel10k, or starship when you use them; `.tmux.conf`, `.vimrc`, and nvim config. | | python | yes | The same Python versions via `uv` (or just the one the project pins), your pipx and `uv tool` packages, and the project's dependencies from its lockfile. | | node | yes | The same Node versions via `fnm` (or just the one the project pins), your global npm packages, and pnpm or yarn through corepack. | | tools | yes | Go and Rust at the same versions, `cargo install` binaries, Homebrew formulae as apt packages or Linux bottles (no bottle means `not carried`), and executables in `~/bin`, `~/.local/bin`, and `~/go/bin` reinstalled from their origin. | | clis | yes | Developer CLIs on your PATH: aws, gcloud, az, kubectl, helm, terraform, flyctl, vercel, wrangler, supabase, stripe, ngrok, and more. One whose sign-in lives in the macOS Keychain is `not carried` with the login command to run on the box. | | docker | yes | Registry images pulled on the box, project Dockerfiles rebuilt there, and a running compose project brought up after the secrets step so its `env_file` is in place. Another compose project's images and volumes are `not carried`; set it up from its own folder. | | services | yes | Local Postgres, MySQL, Redis, MongoDB, and similar as containers at the same major version and port, data in a named volume, client installed alongside. A port already taken on the box fails the item with the reason. | | data | no | Database contents, named Docker volumes, and local-only images streamed over the tunnel. Sizes are shown before you answer. Images and volumes are read from the engine the scan inspected, whatever `DOCKER_*` says by the time the copy runs, and the copy runs `docker`, `pg_dump`, and `gzip` from the same standard locations the scan found them in, never from `PATH`. | | secrets | yes | The project's `.env` files (below), secret-looking env vars from your shell files, and CLI sign-in files (`~/.aws`, `~/.config/gcloud`, `~/.kube/config`, ...), all 0600; values are never shown. With [AWS access](https://prized.dev/docs/aws) connected, the box needs no `~/.aws` credentials at all. | The box is amd64: an arm64-only image is rebuilt or re-pulled, never streamed. Things with no recipe yet (conda, Ruby and Java toolchains, casks, devcontainers) are listed as `not carried` so you know what to set up by hand. ### `.env` files [#env-files] A sync session `prized setup` creates ignores `.env` and `.env.*` at every depth (`.env.example` and `.env.sample` still sync), so a credential file never reaches the box as a side effect of syncing. Instead the secrets question lists each one it found, a monorepo's `apps/web/.env.local` included, and with the default yes copies it to the same relative path on the box, 0600. A symlink to another `.env` inside the project is recreated as a symlink; a hard link, a symlink that leaves the project, or a file you cannot read is refused and named as not carried. Under `--non-interactive`, `-y` or `--env-secrets` grants the copy. > A project synced before this rule, or added by hand with `prized sync add`, still carries `.env` files in the mirror; add `.env` to that project's `extra_ignores` to gate it. On a [restricted box](https://prized.dev/docs/environments#safe-for-third-parties), `prized setup` adds the ignores to every sync project itself. Once a session ignores `.env` files, `--unignore` brings back only `.env.example` and `.env.sample`. ## Flags [#flags] | Flag | Effect | | ------------------------- | ------------------------------------------------------------------------------------------------------------------- | | `--env shell,python,...` | Bring these install groups without asking (the grant for `--non-interactive`; `-y` covers them too). | | `--env-secrets` | Copy your secrets without asking: `.env` files, env-var values, and CLI sign-ins (`-y` covers this too). | | `--env-data` | Copy database contents, volumes, and local-only images. Never covered by `-y`. | | `--no-env` | Skip the step. | | `--no-advisor` | Never contact the advisor; questions come from the built-in rules. | | `--env-workers N` | How many items install at once (default: up to 8); `1` installs them one at a time, in order. | | `--attach`, `--no-attach` | Open the box session in this terminal when setup finishes. The default (`--no-attach`) prints the reattach command. | ## The advisor [#the-advisor] The scan is deterministic. Before asking, the inventory and your project's manifests (README, Makefile, package.json, compose file, version pins) go to Prized's advisor, a bounded Claude pass that rewrites the questions around what the project actually needs. It sees names, versions, and sizes only: secret values are redacted before anything leaves your machine, credential files are never read, and paths are relative (`.` for the project, `~` for your home). It cannot run anything, picks only from the recipe catalog the rules use, and cannot add a secrets or data item the scan did not find. If it is unreachable the questions come from the rules; `--no-advisor` or `PRIZED_ADVISOR=off` skips it. ## What never moves [#what-never-moves] * **Private keys and vaults.** SSH private keys, GPG keys, the macOS Keychain, browser profiles, 1Password data; the report tells you when commit signing needs a box key. * **Secret values into any output.** The JSON envelope, the terminal, telemetry, and the advisor carry names only. * **An export that is not one literal assignment on its own line.** A computed value (`$(...)`, backticks), a second command, pipe, redirect, or open quote on the line, a `PATH` edit, or a secret-looking name sharing a line stays home and is listed as `not carried`; put the value on a line of its own to carry it. * **Anything through the control plane.** Every transfer goes over your SSH tunnel straight to the box. See [Credentials](https://prized.dev/docs/credentials). * **Data unless you say so.** Database contents, volumes, and local-only images move only on an explicit yes or `--env-data`. ## On the box afterwards [#on-the-box-afterwards] | Path | What it is | | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | `~/.config/prized/shell.sh` | Your aliases, functions, exports, and the PATH hooks for the installed toolchains; sourced from `~/.profile`, `~/.bashrc`, and `~/.zshrc`. | | `~/.config/prized/env.secret` | The env-var values you chose to move, 0600, sourced by `shell.sh`. | | `~/.config/prized/welcome.txt` | The welcome block setup printed: what moved, what was left. | | `prized-postgres`, `prized-redis`, ... | Service containers, `--restart unless-stopped`, data in `prized--data` volumes. | Services listen on `127.0.0.1` on the box; `prized ports` mirrors them to your machine like any other box port.