@dotenvx/dotenvx 2.1.0 → 2.1.2

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.1.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.1.2...main)
+
+## [2.1.2](https://github.com/dotenvx/dotenvx/compare/v2.1.1...v2.1.2) (2026-07-02)
+
+### Changed
+
+* Support restricted read permissions to `.env.keys` ([#676](https://github.com/dotenvx/dotenvx/issues/676), [#867](https://github.com/dotenvx/dotenvx/pull/867))
+
+## [2.1.1](https://github.com/dotenvx/dotenvx/compare/v2.1.0...v2.1.1) (2026-07-02)
+
+### Changed
+
+* Support `DOTENV_CONFIG_QUIET=true` as synonym for `--quiet` flag ([#866](https://github.com/dotenvx/dotenvx/pull/866))
 
 ## [2.1.0](https://github.com/dotenvx/dotenvx/compare/v2.0.0...v2.1.0) (2026-07-02)
 

package/README.md

@@ -672,6 +672,13 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
+You can also set `DOTENV_CONFIG_QUIET=true`.
+
+```sh
+$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+Hello production
+```
+
 </details>
 <details><summary>`--log-level` flag</summary><br>
 
@@ -723,6 +730,22 @@ $ dotenvx encrypt
 
 > A `DOTENV_PUBLIC_KEY` (encryption key) and a `DOTENV_PRIVATE_KEY` (decryption key) are generated using the same public-key cryptography as [Bitcoin](https://en.bitcoin.it/wiki/Secp256k1).
 
+### Protect `.env.keys` from agents
+
+After encryption, `DOTENV_PUBLIC_KEY` lives in your encrypted `.env` file. This means agents and automation can keep running `dotenvx set` and `dotenvx encrypt` without reading `.env.keys`.
+
+```sh
+$ chmod a-r .env.keys
+
+$ dotenvx set HELLO World
+◈ encrypted HELLO (.env)
+
+$ dotenvx encrypt
+◈ encrypted (.env)
+```
+
+Keep `.env.keys` unreadable by agents, while still letting them safely update encrypted values.
+
 More examples
 
 <details><summary>`.env`</summary><br>
@@ -1231,6 +1254,13 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
+You can also set `DOTENV_CONFIG_QUIET=true`.
+
+```sh
+$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+Hello production
+```
+
 </details>
 <details><summary>`run --log-level`</summary><br>
 
@@ -1572,6 +1602,8 @@ $ dotenvx set HELLO Dotenvx
 set HELLO with encryption (.env)
 ```
 
+Works with unreadable `.env.keys` when `.env` already contains `DOTENV_PUBLIC_KEY`.
+
 </details>
 <details><summary>`set KEY value -f`</summary><br>
 
@@ -1646,6 +1678,20 @@ $ dotenvx set HELLO Dotenvx --plain
 set HELLO (.env)
 ```
 
+</details>
+<details><summary>`set KEY_PLAIN value`</summary><br>
+
+Set a plaintext key/value inside an encrypted `.env` file by ending the key with `_PLAIN`.
+
+```sh
+$ touch .env
+
+$ dotenvx set HELLO_PLAIN Dotenvx
+set HELLO_PLAIN (.env)
+```
+
+Keys ending in `_PLAIN` are not encrypted by `dotenvx set` or `dotenvx encrypt`.
+
 </details>
 <details><summary>`encrypt`</summary><br>
 
@@ -1660,6 +1706,8 @@ $ dotenvx encrypt
 ⮕  next run [DOTENV_PRIVATE_KEY='122...0b8' dotenvx run -- yourcommand] to test decryption locally
 ```
 
+Works with unreadable `.env.keys` when `.env` already contains `DOTENV_PUBLIC_KEY`.
+
 </details>
 <details><summary>`encrypt -f`</summary><br>
 
@@ -1755,6 +1803,20 @@ $ dotenvx encrypt -ek "HO*"
 ◈ encrypted (.env)
 ```
 
+</details>
+<details><summary>`encrypt KEY_PLAIN`</summary><br>
+
+Skip encryption for keys ending in `_PLAIN`.
+
+```sh
+$ echo "HELLO=Dotenvx\nHELLO_PLAIN=visible" > .env
+
+$ dotenvx encrypt
+◈ encrypted (.env)
+```
+
+`HELLO` is encrypted. `HELLO_PLAIN` stays plaintext.
+
 </details>
 <details><summary>`encrypt --stdout`</summary><br>
 
@@ -2398,6 +2460,14 @@ Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
 Hello Dotenvx
 ```
 
+You can also set `DOTENV_CONFIG_QUIET=true`.
+
+```sh
+$ DOTENV_CONFIG_QUIET=true node index.js
+Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
+Hello Dotenvx
+```
+
 </details>
 <details><summary>`config(strict: true)` - strict</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.1.0",
+  "version": "2.1.2",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/run.js

@@ -7,6 +7,7 @@ const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 const normalizeArmorAliases = require('./normalizeArmorAliases')
+const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
 
 const conventions = require('./../../lib/helpers/conventions')
 const { determine } = require('./../../lib/helpers/envResolution')
@@ -45,7 +46,7 @@ function uniqueInjectedKeys (processedEnvs) {
 }
 
 async function run () {
-  const options = normalizeArmorAliases(this.opts())
+  const options = normalizeDotenvConfigQuiet(normalizeArmorAliases(this.opts()))
 
   let commandArgs = this.args
   if (commandArgs.length < 1) {

package/src/cli/dotenvx.js

@@ -12,6 +12,7 @@ const getCommanderVersion = require('./../lib/helpers/getCommanderVersion')
 const executeDynamic = require('./../lib/helpers/executeDynamic')
 const removeDynamicHelpSection = require('./../lib/helpers/removeDynamicHelpSection')
 const removeOptionsHelpParts = require('./../lib/helpers/removeOptionsHelpParts')
+const normalizeDotenvConfigQuiet = require('./../lib/helpers/normalizeDotenvConfigQuiet')
 
 // for use with run
 const envs = []
@@ -38,7 +39,7 @@ program
   .option('-v, --verbose', 'sets log level to verbose')
   .option('-d, --debug', 'sets log level to debug')
   .hook('preAction', (thisCommand, actionCommand) => {
-    const options = thisCommand.opts()
+    const options = normalizeDotenvConfigQuiet(thisCommand.opts())
 
     setLogLevel(options)
   })

package/src/lib/helpers/normalizeDotenvConfigQuiet.js

@@ -0,0 +1,9 @@
+function normalizeDotenvConfigQuiet (options) {
+  if (process.env.DOTENV_CONFIG_QUIET === 'true') {
+    options.quiet = true
+  }
+
+  return options
+}
+
+module.exports = normalizeDotenvConfigQuiet

package/src/lib/main.js

@@ -22,6 +22,7 @@ const { determine } = require('./helpers/envResolution')
 const fsx = require('./helpers/fsx')
 const decryptKeyValue = require('./helpers/cryptography/decryptKeyValue')
 const Errors = require('./helpers/errors')
+const normalizeDotenvConfigQuiet = require('./helpers/normalizeDotenvConfigQuiet')
 
 function uniqueInjectedKeys (processedEnvs) {
   const result = new Set()
@@ -35,6 +36,8 @@ function uniqueInjectedKeys (processedEnvs) {
 
 /** @type {import('./main').config} */
 const config = function (options = {}) {
+  options = normalizeDotenvConfigQuiet(options)
+
   // allow user to set processEnv to write to
   let processEnv = process.env
   if (options && options.processEnv != null) {
@@ -202,6 +205,8 @@ const parse = function (src, options = {}) {
 
 /* @type {import('./main').set} */
 const set = async function (key, value, options = {}) {
+  options = normalizeDotenvConfigQuiet(options)
+
   // encrypt
   let encrypt = true
   if (options.plain) {

package/src/lib/transforms/encrypt.js

@@ -45,8 +45,16 @@ async function encryptTransform (options = {}) {
   // set up keysSrc
   let keysSrc
   if (await fsx.exists(fk)) {
-    const encoding = await detectEncoding(fk)
-    keysSrc = await fsx.readFileX(fk, { encoding })
+    try {
+      const encoding = await detectEncoding(fk)
+      keysSrc = await fsx.readFileX(fk, { encoding })
+    } catch (err) {
+      if (err.code === 'EACCES' || err.code === 'EPERM') {
+        // do nothing (scenario: chmod a-r .env.keys)
+      } else {
+        throw err
+      }
+    }
   }
 
   for (const env of determine(envs, process.env)) {

package/src/lib/transforms/set.js

@@ -46,8 +46,16 @@ async function setTransform (options = {}) {
   // set up keysSrc
   let keysSrc
   if (await fsx.exists(fk)) {
-    const encoding = await detectEncoding(fk)
-    keysSrc = await fsx.readFileX(fk, { encoding })
+    try {
+      const encoding = await detectEncoding(fk)
+      keysSrc = await fsx.readFileX(fk, { encoding })
+    } catch (err) {
+      if (err.code === 'EACCES' || err.code === 'EPERM') {
+        // do nothing (scenario: chmod a-r .env.keys)
+      } else {
+        throw err
+      }
+    }
   }
 
   for (const env of determine(envs, process.env)) {