@dotenvx/dotenvx 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -2,7 +2,22 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.0.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.1.0...main)
+
+## [2.1.0](https://github.com/dotenvx/dotenvx/compare/v2.0.0...v2.1.0) (2026-07-02)
+
+### Added
+
+* Add interactive input mode for `set` ([#862](https://github.com/dotenvx/dotenvx/pull/862))
+* Support leaving `_PLAIN` suffixed keys unencrypted during `set` and `encrypt` ([#862](https://github.com/dotenvx/dotenvx/pull/862))
+
+### Changed
+
+* Return exit code 1 from `get` when decryption errors are reported ([#862](https://github.com/dotenvx/dotenvx/pull/862))
+
+### Fixed
+
+* Add Windows PowerShell coverage for npm shim encryption of `.env.local` files
 
 ## [2.0.0](https://github.com/dotenvx/dotenvx/compare/v1.76.0...v2.0.0) (2026-06-30)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.0",
+  "version": "2.1.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/get.js

@@ -19,6 +19,7 @@ async function get (key) {
 
   const prettyPrint = options.prettyPrint || options.pp
   const ignore = options.ignore || []
+  let errorCount = 0
 
   let envs = []
   // handle shorthand conventions - like --convention=nextjs
@@ -52,6 +53,7 @@ async function get (key) {
         continue // ignore error
       }
 
+      errorCount += 1
       logger.error(error.messageWithHelp)
     }
 
@@ -97,6 +99,10 @@ async function get (key) {
         console.log(JSON.stringify(parsed, null, space))
       }
     }
+
+    if (errorCount > 0) {
+      process.exit(1)
+    }
   } catch (error) {
     if (spinner) spinner.stop()
     catchAndLog(error)

package/src/cli/actions/set.js

@@ -5,6 +5,8 @@ const setTransform = require('./../../lib/transforms/set')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
+const Errors = require('../../lib/helpers/errors')
+const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
 const normalizeArmorAliases = require('./normalizeArmorAliases')
 
@@ -13,9 +15,43 @@ async function set (key, value) {
 
   let encrypt = true
   let settingMessage = 'encrypting'
+  let settingSymbol = '◈'
   if (options.plain) {
     encrypt = false
     settingMessage = 'setting'
+    settingSymbol = '◇'
+  }
+
+  if (typeof value === 'undefined') {
+    if (!process.stdin.isTTY) {
+      catchAndLog(new Errors({ key }).missingValue())
+      process.exit(1)
+      return
+    }
+
+    try {
+      value = await prompts.password({
+        message: key,
+        prefix: settingSymbol,
+        separator: '='
+      }, {
+        input: process.stdin,
+        output: process.stderr
+      })
+    } catch (error) {
+      if (error.code === 'PROMPT_CANCELLED') {
+        process.exit(130)
+        return
+      }
+
+      throw error
+    }
+  }
+
+  if (value === '') {
+    catchAndLog(new Errors({ key }).missingValue())
+    process.exit(1)
+    return
   }
 
   const spinner = await createSpinner({ ...options, text: settingMessage })

package/src/cli/dotenvx.js

@@ -103,12 +103,12 @@ program.command('get')
 
 // dotenvx set
 program.command('set')
-  .usage('<KEY> <value> [options]')
+  .usage('<KEY> [value] [options]')
   .description('encrypt a single environment variable')
   .addHelpText('after', examples.set)
   .allowUnknownOption()
   .argument('KEY', 'KEY')
-  .argument('value', 'value')
+  .argument('[value]', 'value')
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-c, --encrypt', 'encrypt value', true)

package/src/lib/helpers/cryptography/index.js

@@ -1,6 +1,7 @@
 module.exports = {
   decryptKeyValue: require('./decryptKeyValue'),
-  isPublicKey: require('./isPublicKey'),
+  isDotenvPublicKey: require('./isDotenvPublicKey'),
+  isPlainKey: require('./isPlainKey'),
   mutateKeysSrc: require('./mutateKeysSrc'),
   mutateSrc: require('./mutateSrc')
 }

package/src/lib/helpers/cryptography/{isPublicKey.js → isDotenvPublicKey.js}

@@ -1,7 +1,7 @@
 const PUBLIC_KEY_PATTERN = /^DOTENV_PUBLIC_KEY/
 
-function isPublicKey (key) {
+function isDotenvPublicKey (key) {
   return PUBLIC_KEY_PATTERN.test(key)
 }
 
-module.exports = isPublicKey
+module.exports = isDotenvPublicKey

package/src/lib/helpers/cryptography/isPlainKey.js

@@ -0,0 +1,7 @@
+const PLAIN_KEY_PATTERN = /_PLAIN$/
+
+function isPlainKey (key) {
+  return PLAIN_KEY_PATTERN.test(key)
+}
+
+module.exports = isPlainKey

package/src/lib/helpers/errors.js

@@ -18,7 +18,8 @@ const ISSUE_BY_CODE = {
   MISSING_KEY: 'https://github.com/dotenvx/dotenvx/issues/759',
   MISSING_LOG_LEVEL: 'must be valid log level',
   MISSING_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/464',
-  MISSING_PUBLIC_KEY: 'https://github.com/dotenvx/dotenvx/issues/new',
+  MISSING_PUBLIC_KEY: 'https://github.com/dotenvx/dotenvx/issues/865',
+  MISSING_VALUE: 'https://github.com/dotenvx/dotenvx/issues/864',
   PRECOMMIT_HOOK_MODIFY_FAILED: 'try again or report error',
   WRONG_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/466'
 }
@@ -278,6 +279,18 @@ class Errors {
     return e
   }
 
+  missingValue () {
+    const code = 'MISSING_VALUE'
+    const message = `[${code}] missing value (${this.key})`
+    const help = `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
   precommitHookModifyFailed () {
     const code = 'PRECOMMIT_HOOK_MODIFY_FAILED'
     const message = `[${code}] failed to modify pre-commit hook: ${this.error.message}`

package/src/lib/helpers/prompts.js

@@ -26,6 +26,18 @@ function enquirerOptions (context = {}) {
   return options
 }
 
+function clearLastLine (stream) {
+  if (stream && typeof stream.moveCursor === 'function' && typeof stream.clearLine === 'function') {
+    stream.moveCursor(0, -1)
+    stream.clearLine(0)
+    return
+  }
+
+  if (stream && typeof stream.write === 'function') {
+    stream.write('\x1B[1A\x1B[2K')
+  }
+}
+
 async function select ({ message, choices }, context) {
   const answer = await enquirer.prompt({
     type: 'select',
@@ -38,6 +50,40 @@ async function select ({ message, choices }, context) {
   return answer.value
 }
 
+async function password ({ message, prefix, separator }, context) {
+  const output = (context && context.output) || process.stderr
+
+  try {
+    const answer = await enquirer.prompt({
+      type: 'password',
+      name: 'value',
+      message,
+      symbols: {
+        prefix: {
+          pending: prefix,
+          submitted: prefix,
+          cancelled: prefix
+        },
+        separator: {
+          pending: separator,
+          submitted: separator,
+          cancelled: separator
+        }
+      },
+      ...enquirerOptions(context)
+    })
+
+    clearLastLine(output)
+    return answer.value
+  } catch (error) {
+    clearLastLine(output)
+    const e = new Error('prompt cancelled')
+    e.code = 'PROMPT_CANCELLED'
+    throw e
+  }
+}
+
 module.exports = {
+  password,
   select
 }

package/src/lib/main.js

@@ -130,7 +130,7 @@ const config = function (options = {}) {
     if (readableFilepaths.length > 0) {
       msg += ` from ${readableFilepaths.join(', ')}`
     }
-    logger.successv(msg)
+    logger.success(`⟐ ${msg}`)
 
     if (lastError) {
       return { parsed: parsedAll, error: lastError }

package/src/lib/transforms/encrypt.js

@@ -8,7 +8,7 @@ const SAMPLE_ENV_KIT = require('../helpers/kits/sample')
 const Errors = require('../helpers/errors')
 const { determine } = require('./../helpers/envResolution')
 const detectEncoding = require('./../helpers/detectEncoding')
-const { isPublicKey, mutateSrc, mutateKeysSrc } = require('../helpers/cryptography')
+const { isDotenvPublicKey, isPlainKey, mutateSrc, mutateKeysSrc } = require('../helpers/cryptography')
 const keynames = require('../conventions/keynames')
 const PostArmorUp = require('../api/postArmorUp')
 const prompts = require('../helpers/prompts')
@@ -129,8 +129,7 @@ async function encryptTransform (options = {}) {
       const { parsed } = scan(row.envSrc, { ik, ek })
 
       for (const [key, values] of Object.entries(parsed)) {
-        // skip if public key
-        if (isPublicKey(key)) {
+        if (isDotenvPublicKey(key) || isPlainKey(key)) {
           continue
         }
 

package/src/lib/transforms/set.js

@@ -7,7 +7,7 @@ const TYPE_ENV_FILE = 'envFile'
 const getResolver = require('./../resolvers/get')
 const { determine } = require('./../helpers/envResolution')
 const detectEncoding = require('./../helpers/detectEncoding')
-const { mutateSrc, mutateKeysSrc } = require('../helpers/cryptography')
+const { isPlainKey, mutateSrc, mutateKeysSrc } = require('../helpers/cryptography')
 const keynames = require('../conventions/keynames')
 const Errors = require('../helpers/errors')
 const PostArmorUp = require('../api/postArmorUp')
@@ -37,7 +37,7 @@ async function setTransform (options = {}) {
   const fk = options.fk || '.env.keys'
   let noArmor = options.noArmor // key storage selector below
   const noCreate = options.noCreate
-  const noEncrypt = !options.encrypt
+  const noEncrypt = !options.encrypt || isPlainKey(key)
 
   const processedEnvs = []
   const changedFilepaths = []