@dotenvx/dotenvx 1.71.1 → 1.71.3

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.71.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.71.3...main)
+
+## [1.71.3](https://github.com/dotenvx/dotenvx/compare/v1.71.2...v1.71.3) (2026-06-11)
+
+### Changed
+
+* Forward command to Dotenvx Armor Key Guard approvals ([#835](https://github.com/dotenvx/dotenvx/pull/835))
+
+## [1.71.2](https://github.com/dotenvx/dotenvx/compare/v1.71.1...v1.71.2) (2026-06-08)
+
+### Changed
+
+* touch up `get`, `set`, and `decrypt` when armor installed ([#834](https://github.com/dotenvx/dotenvx/pull/834))
 
 ## [1.71.1](https://github.com/dotenvx/dotenvx/compare/v1.71.0...v1.71.1) (2026-06-08)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.71.1",
+  "version": "1.71.3",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/decrypt.js

@@ -21,9 +21,12 @@ async function decrypt () {
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
+    if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+      command: process.argv.slice(2)
+    }).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       if (processedEnv.error) {
@@ -41,11 +44,14 @@ async function decrypt () {
     }
   } else {
     try {
+      if (spinner) spinner.stop()
       const {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+        command: process.argv.slice(2)
+      }).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`decrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/encrypt.js

@@ -56,7 +56,10 @@ async function encrypt () {
     if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(noArmor)).run()
+    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, {
+      ...encryptOptions(noArmor),
+      command: process.argv.slice(2)
+    }).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -69,7 +72,10 @@ async function encrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(noArmor)).run()
+      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, {
+        ...encryptOptions(noArmor),
+        command: process.argv.slice(2)
+      }).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/get.js

@@ -31,7 +31,10 @@ async function get (key) {
   try {
     const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
-    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noArmor).run()
+    if (spinner) spinner.stop()
+    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noArmor, {
+      command: process.argv.slice(2)
+    }).run()
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict

package/src/cli/actions/keypair.js

@@ -19,7 +19,9 @@ async function keypair (key) {
   const sesh = new Session()
   const noArmor = options.armor === false || await sesh.noArmor()
   if (spinner) spinner.stop()
-  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noArmor).run()
+  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noArmor, {
+    command: process.argv.slice(2)
+  }).run()
   const results = key ? keypairs[key] : keypairs
 
   if (spinner) spinner.stop()

package/src/cli/actions/rotate.js

@@ -20,9 +20,12 @@ async function rotate () {
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
+    if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+      command: process.argv.slice(2)
+    }).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -34,11 +37,14 @@ async function rotate () {
     process.exit(0) // exit early
   } else {
     try {
+      if (spinner) spinner.stop()
       const {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+        command: process.argv.slice(2)
+      }).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`rotating ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/run.js

@@ -56,7 +56,8 @@ async function run () {
       readableFilepaths,
       uniqueInjectedKeys
     } = await new Run(envs, options.overload, process.env, options.envKeysFile, noArmor, {
-      token: options.token
+      token: options.token,
+      command: commandArgs
     }).run()
 
     for (const processedEnv of processedEnvs) {

package/src/cli/actions/set.js

@@ -30,11 +30,14 @@ async function set (key, value) {
     const noArmor = options.armor === false || (await sesh.noArmor())
     const noCreate = options.create === false
 
+    if (spinner) spinner.stop()
     const {
       processedEnvs,
       changedFilepaths,
       unchangedFilepaths
-    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noArmor, noCreate).run()
+    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noArmor, noCreate, {
+      command: process.argv.slice(2)
+    }).run()
 
     let withEncryption = ''
 

package/src/lib/extensions/armor.js

@@ -43,6 +43,7 @@ class Armor {
     if (options.noSpinner) args.push('--no-spinner')
     if (options.token) args.push('--token', options.token)
     if (options.envFilepath) args.push('-f', options.envFilepath)
+    if (options.command) args.push('--metadata', this._serializeMetadata(options))
     if (publicKey) args.push(publicKey)
 
     try {
@@ -62,6 +63,7 @@ class Armor {
     if (options.noSpinner) args.push('--no-spinner')
     if (options.token) args.push('--token', options.token)
     if (options.envFilepath) args.push('-f', options.envFilepath)
+    if (options.command) args.push('--metadata', this._serializeMetadata(options))
     if (publicKey) args.push(publicKey)
 
     try {
@@ -97,6 +99,17 @@ class Armor {
     }
   }
 
+  _serializeMetadata (options) {
+    return JSON.stringify({
+      command: this._serializeCommand(options.command)
+    })
+  }
+
+  _serializeCommand (command) {
+    if (Array.isArray(command)) return command.map((arg) => `${arg}`).join(' ')
+    return `${command}`
+  }
+
   async _exec (binary, args) {
     const { stdout, stderr } = await execFile(binary, args)
     if (stderr && stderr.length > 0) {

package/src/lib/helpers/cryptography/armorKeypair.js

@@ -3,7 +3,8 @@ const Armor = require('../../extensions/armor')
 async function armorKeypair (existingPublicKey, options = {}) {
   const keypairOptions = {
     token: options.token,
-    envFilepath: options.envFilepath
+    envFilepath: options.envFilepath,
+    command: options.command
   }
 
   const kp = await new Armor().keypair(existingPublicKey, keypairOptions)

package/src/lib/helpers/cryptography/provision.js

@@ -4,7 +4,7 @@ const armorKeypair = require('./armorKeypair')
 const localKeypair = require('./localKeypair')
 const { keyNames } = require('../keyResolution')
 
-async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage }) {
+async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage, command }) {
   noArmor = noArmor !== false
   if (!noArmor && selectKeyStorage) {
     noArmor = await selectKeyStorage() !== 'armored'
@@ -24,7 +24,7 @@ async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, s
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   } else {
-    const armorOptions = { token, envFilepath }
+    const armorOptions = { token, envFilepath, command }
     const kp = await armorKeypair(undefined, armorOptions)
     publicKey = kp.publicKey
     privateKey = kp.privateKey

package/src/lib/helpers/cryptography/provisionSync.js

@@ -4,7 +4,7 @@ const armorKeypairSync = require('./armorKeypairSync')
 const localKeypair = require('./localKeypair')
 const { keyNames } = require('../keyResolution')
 
-function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor }) {
+function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor, command }) {
   noArmor = noArmor !== false
   const { publicKeyName, privateKeyName } = keyNames(envFilepath)
 
@@ -20,7 +20,7 @@ function provisionSync ({ envSrc, envFilepath, keysFilepath, noArmor }) {
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   } else {
-    const kp = armorKeypairSync(undefined, { envFilepath })
+    const kp = armorKeypairSync(undefined, { envFilepath, command })
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   }

package/src/lib/helpers/keyResolution/keyValues.js

@@ -77,6 +77,9 @@ async function keyValues (filepath, opts = {}) {
     if (opts.token) {
       armorOptions.token = opts.token
     }
+    if (opts.command) {
+      armorOptions.command = opts.command
+    }
     const kp = await armorKeypair(publicKey, armorOptions)
     privateKey = kp.privateKey
     privateKeySource = 'armor'

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -57,6 +57,9 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
     if (opts.token) {
       armorOptions.token = opts.token
     }
+    if (opts.command) {
+      armorOptions.command = opts.command
+    }
     const kp = armorKeypairSync(publicKeyValue, armorOptions)
     privateKeyValue = kp.privateKey
     privateKeySource = 'armor'

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -77,6 +77,9 @@ function keyValuesSync (filepath, opts = {}) {
     if (opts.token) {
       armorOptions.token = opts.token
     }
+    if (opts.command) {
+      armorOptions.command = opts.command
+    }
     if (opts.noSpinner) {
       armorOptions.noSpinner = true
     }

package/src/lib/services/decrypt.js

@@ -25,12 +25,13 @@ const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Decrypt {
-  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noArmor = false) {
+  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noArmor = false, options = {}) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.excludeKey = excludeKey
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
+    this.command = options.command
 
     this.processedEnvs = []
     this.changedFilepaths = new Set()
@@ -77,7 +78,11 @@ class Decrypt {
       const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { privateKeyName } = keyNames(envFilepath)
-      const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+      const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, {
+        keysFilepath: this.envKeysFilepath,
+        noArmor: this.noArmor,
+        command: this.command
+      })
 
       row.privateKey = privateKeyValue
       row.privateKeySource = privateKeySource

package/src/lib/services/encrypt.js

@@ -38,6 +38,7 @@ class Encrypt {
     this.noCreate = noCreate
     this.token = token
     this.selectKeyStorage = options.selectKeyStorage
+    this.command = options.command
 
     this.processedEnvs = []
     this.changedFilepaths = new Set()
@@ -104,7 +105,8 @@ class Encrypt {
       const { publicKeyName, privateKeyName } = keyNames(envFilepath)
       const { publicKeyValue, privateKeyValue } = await keyValues(envFilepath, {
         keysFilepath: this.envKeysFilepath,
-        noArmor: this.noArmor
+        noArmor: this.noArmor,
+        command: this.command
       })
 
       // first pass - provision
@@ -115,7 +117,8 @@ class Encrypt {
           keysFilepath: this.envKeysFilepath,
           noArmor: this.noArmor,
           token: this.token,
-          selectKeyStorage: this.selectKeyStorage
+          selectKeyStorage: this.selectKeyStorage,
+          command: this.command
         })
         envSrc = prov.envSrc
         publicKey = prov.publicKey

package/src/lib/services/get.js

@@ -3,26 +3,31 @@ const Errors = require('./../helpers/errors')
 const { determine } = require('./../helpers/envResolution')
 
 class Get {
-  constructor (key, envs = [], overload = false, all = false, envKeysFilepath = null, noArmor = false) {
+  constructor (key, envs = [], overload = false, all = false, envKeysFilepath = null, noArmor = false, options = {}) {
     this.key = key
     this.envs = envs
     this.overload = overload
     this.all = all
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
+    this.command = options.command
   }
 
   runSync () {
     const processEnv = { ...process.env }
     const envs = determine(this.envs, processEnv)
-    const { processedEnvs } = new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noArmor).runSync()
+    const { processedEnvs } = new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noArmor, {
+      command: this.command
+    }).runSync()
     return this._result(processedEnvs, processEnv)
   }
 
   async run () {
     const processEnv = { ...process.env }
     const envs = determine(this.envs, processEnv)
-    const { processedEnvs } = await new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noArmor).run()
+    const { processedEnvs } = await new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noArmor, {
+      command: this.command
+    }).run()
     return this._result(processedEnvs, processEnv)
   }
 

package/src/lib/services/keypair.js

@@ -5,10 +5,11 @@ const {
 } = require('./../helpers/keyResolution')
 
 class Keypair {
-  constructor (envFile = '.env', envKeysFilepath = null, noArmor = false) {
+  constructor (envFile = '.env', envKeysFilepath = null, noArmor = false, options = {}) {
     this.envFile = envFile
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
+    this.command = options.command
   }
 
   runSync () {
@@ -17,7 +18,11 @@ class Keypair {
     const filepaths = this._filepaths()
     for (const filepath of filepaths) {
       const { publicKeyName, privateKeyName } = keyNames(filepath)
-      const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+      const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, {
+        keysFilepath: this.envKeysFilepath,
+        noArmor: this.noArmor,
+        command: this.command
+      })
 
       out[publicKeyName] = publicKeyValue
       out[privateKeyName] = privateKeyValue
@@ -32,7 +37,11 @@ class Keypair {
     const filepaths = this._filepaths()
     for (const filepath of filepaths) {
       const { publicKeyName, privateKeyName } = keyNames(filepath)
-      const { publicKeyValue, privateKeyValue } = await keyValues(filepath, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+      const { publicKeyValue, privateKeyValue } = await keyValues(filepath, {
+        keysFilepath: this.envKeysFilepath,
+        noArmor: this.noArmor,
+        command: this.command
+      })
 
       out[publicKeyName] = publicKeyValue
       out[privateKeyName] = privateKeyValue

package/src/lib/services/rotate.js

@@ -29,12 +29,13 @@ const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Rotate {
-  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noArmor = false) {
+  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noArmor = false, options = {}) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.excludeKey = excludeKey
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
+    this.command = options.command
 
     this.processedEnvs = []
     this.changedFilepaths = new Set()
@@ -83,7 +84,11 @@ class Rotate {
       const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { publicKeyName, privateKeyName } = keyNames(envFilepath)
-      const { privateKeyValue } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+      const { privateKeyValue } = await keyValues(envFilepath, {
+        keysFilepath: this.envKeysFilepath,
+        noArmor: this.noArmor,
+        command: this.command
+      })
 
       let newPublicKey
       let newPrivateKey
@@ -91,7 +96,9 @@ class Rotate {
       let envKeysSrc
 
       if (!this.noArmor) {
-        const kp = await armorKeypair()
+        const kp = await armorKeypair(undefined, {
+          command: this.command
+        })
         newPublicKey = kp.publicKey
         newPrivateKey = kp.privateKey
 

package/src/lib/services/run.js

@@ -25,6 +25,7 @@ class Run {
     this.noArmor = noArmor
     this.noSpinner = options.noSpinner
     this.token = options.token
+    this.command = options.command
 
     this.processedEnvs = []
     this.readableFilepaths = new Set()
@@ -95,7 +96,13 @@ class Run {
         privateKeyName: resolvedPrivateKeyName,
         privateKeyValue,
         privateKeySource
-      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor, processEnv: this.processEnv, token: this.token })
+      } = keyValuesFromEnvSrc(env, privateKeyName, {
+        keysFilepath: this.envKeysFilepath,
+        noArmor: this.noArmor,
+        processEnv: this.processEnv,
+        token: this.token,
+        command: this.command
+      })
 
       const {
         parsed,
@@ -145,7 +152,8 @@ class Run {
         keysFilepath: this.envKeysFilepath,
         noArmor: this.noArmor,
         noSpinner: this.noSpinner,
-        token: this.token
+        token: this.token,
+        command: this.command
       })
 
       const {
@@ -198,7 +206,8 @@ class Run {
       const { privateKeyValue, privateKeySource } = await keyValues(filepath, {
         keysFilepath: this.envKeysFilepath,
         noArmor: this.noArmor,
-        token: this.token
+        token: this.token,
+        command: this.command
       })
 
       const {

package/src/lib/services/sets.js

@@ -34,7 +34,7 @@ function allValuesForKey (envSrc, key) {
 }
 
 class Sets {
-  constructor (key, value, envs = [], encrypt = true, envKeysFilepath = null, noArmor = false, noCreate = false) {
+  constructor (key, value, envs = [], encrypt = true, envKeysFilepath = null, noArmor = false, noCreate = false, options = {}) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.value = value
@@ -42,6 +42,7 @@ class Sets {
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
     this.noCreate = noCreate
+    this.command = options.command
 
     this.processedEnvs = []
     this.changedFilepaths = new Set()
@@ -131,11 +132,21 @@ class Sets {
         let privateKey
 
         const { publicKeyName, privateKeyName } = keyNames(filepath)
-        const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+        const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, {
+          keysFilepath: this.envKeysFilepath,
+          noArmor: this.noArmor,
+          command: this.command
+        })
 
         // first pass - provisionSync
         if (!privateKeyValue && !publicKeyValue) {
-          const prov = provisionSync({ envSrc, envFilepath, keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+          const prov = provisionSync({
+            envSrc,
+            envFilepath,
+            keysFilepath: this.envKeysFilepath,
+            noArmor: this.noArmor,
+            command: this.command
+          })
           envSrc = prov.envSrc
           publicKey = prov.publicKey
           privateKey = prov.privateKey
@@ -238,11 +249,21 @@ class Sets {
         let privateKey
 
         const { publicKeyName, privateKeyName } = keyNames(filepath)
-        const { publicKeyValue, privateKeyValue } = await keyValues(filepath, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+        const { publicKeyValue, privateKeyValue } = await keyValues(filepath, {
+          keysFilepath: this.envKeysFilepath,
+          noArmor: this.noArmor,
+          command: this.command
+        })
 
         // first pass - provision
         if (!privateKeyValue && !publicKeyValue) {
-          const prov = await provision({ envSrc, envFilepath, keysFilepath: this.envKeysFilepath, noArmor: this.noArmor })
+          const prov = await provision({
+            envSrc,
+            envFilepath,
+            keysFilepath: this.envKeysFilepath,
+            noArmor: this.noArmor,
+            command: this.command
+          })
           envSrc = prov.envSrc
           publicKey = prov.publicKey
           privateKey = prov.privateKey