@dotenvx/dotenvx 2.16.0 → 2.17.0

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.16.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.17.0...main)
+
+## [2.17.0](https://github.com/dotenvx/dotenvx/compare/v2.16.1...v2.17.0) (2026-07-21)
+
+### Added
+
+* Add support for Bitwarden `bw://` secrets in your .env files. ([#915](https://github.com/dotenvx/dotenvx/pull/915))
+
+## [2.16.1](https://github.com/dotenvx/dotenvx/compare/v2.16.0...v2.16.1) (2026-07-21)
+
+### Changed
+
+* Fix: Do not report child error - let child do so. ([#914](https://github.com/dotenvx/dotenvx/pull/914))
 
 ## [2.16.0](https://github.com/dotenvx/dotenvx/compare/v2.15.1...v2.16.0) (2026-07-21)
 

package/README.md

@@ -166,6 +166,19 @@ Hello World
 
 see [1Password guide](https://dotenvx.com/docs/secrets-in-1password)
 
+</details>
+<details><summary>Bitwarden 🔑</summary><br>
+
+Run with secrets resolved directly from Bitwarden Password Manager.
+
+```sh
+$ echo 'HELLO="bw://My Hello Login/password"' > .env
+$ dotenvx run -- sh -c 'echo Hello $HELLO'
+Hello World
+```
+
+Install the [Bitwarden Password Manager CLI](https://bitwarden.com/help/cli/) before running dotenvx.
+
 </details>
 <details><summary>TypeScript 📘</summary><br>
 
@@ -1193,6 +1206,38 @@ $ dotenvx run --no-1password -- node index.js
 
 The same flag is available for `dotenvx get` and `dotenvx validate`.
 
+</details>
+<details><summary>`run` - Bitwarden</summary><br>
+
+Resolve `bw://` references directly from your `.env` file through the [Bitwarden Password Manager CLI](https://bitwarden.com/help/cli/).
+
+```ini
+# .env
+API_KEY="bw://My GitHub Account/password"
+```
+
+The reference format is `bw://<item>/<field>`. The item can be a human-readable Bitwarden search term or an exact item UUID. Quote the dotenv value when the item name contains spaces.
+
+Supported fields are:
+
+- `username`
+- `password`
+- `uri`
+
+When the vault is locked in an interactive terminal, dotenvx prompts for your Bitwarden master password.
+
+Human-readable names are convenient, but must identify a single item. If multiple items match, Bitwarden returns an error. Use the item UUID when you need an unambiguous reference.
+
+If Bitwarden cannot resolve a reference, dotenvx reports the error and leaves the original `bw://` value unresolved.
+
+Use `--no-bitwarden` to skip Bitwarden resolution intentionally.
+
+```sh
+$ dotenvx run --no-bitwarden -- node index.js
+```
+
+The same flag is available for `dotenvx get` and `dotenvx validate`.
+
 </details>
 <details><summary>`run -f <directory>`</summary><br>
 
@@ -3310,6 +3355,30 @@ Set `no1Password` to leave `op://` values unresolved and avoid calling `op`.
 require('@dotenvx/dotenvx').config({no1Password: true})
 ```
 
+</details>
+<details><summary>`config(noBitwarden:)` - noBitwarden</summary><br>
+
+By default, `config()` automatically resolves `bw://` values through the installed [Bitwarden Password Manager CLI](https://bitwarden.com/help/cli/).
+
+```ini
+# .env
+API_KEY="bw://My GitHub Account/password"
+```
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config()
+
+console.log(process.env.API_KEY)
+```
+
+Set `noBitwarden` to leave `bw://` values unresolved and avoid calling `bw`.
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config({noBitwarden: true})
+```
+
 </details>
 <details><summary>`parse(src)`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.16.0",
+  "version": "2.17.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/helpers/executeCommand.js

@@ -174,14 +174,18 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
 
     if (exitCode !== 0) {
       logger.debug(`received exitCode ${exitCode}`)
-      throw new Errors({ exitCode }).commandExitedWithCode()
+      const error = new Errors({ exitCode }).commandExitedWithCode()
+      error.exitCode = exitCode
+      throw error
     }
   } catch (error) {
+    const commandExited = Number.isInteger(error.exitCode) && (error.code === 'COMMAND_EXITED_WITH_CODE' || error.command)
+
     // no color on these errors as they can be standard errors for things like jest exiting with exitCode 1 for a single failed test.
     if (!['SIGINT', 'SIGTERM'].includes(signalSent || error.signal)) {
       if (error.code === 'ENOENT') {
         logger.error(`Unknown command: ${error.command}`)
-      } else {
+      } else if (!commandExited) {
         logger.error(redactOutput(error.message, sensitiveValues))
       }
     }

package/src/lib/helpers/resolveBitwardenPassword.js

@@ -5,7 +5,6 @@ const createSpinner = require('./createSpinner')
 const createElapsedStatus = require('./createElapsedStatus')
 
 const FIELDS = new Set(['username', 'password', 'uri'])
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
 function execFileAsync (command, args, options) {
   return new Promise((resolve, reject) => {
@@ -21,9 +20,12 @@ function isSecretReference (value) {
 }
 
 function parseSecretReference (value) {
-  const [itemId, field, ...extra] = value.slice('bw://'.length).split('/')
+  const reference = value.slice('bw://'.length)
+  const separatorIndex = reference.lastIndexOf('/')
+  const item = reference.slice(0, separatorIndex)
+  const field = reference.slice(separatorIndex + 1)
 
-  if (!UUID.test(itemId) || !field || extra.length > 0) {
+  if (separatorIndex < 1 || !field) {
     throw new Error('invalid Bitwarden Password Manager reference')
   }
 
@@ -31,7 +33,7 @@ function parseSecretReference (value) {
     throw new Error(`unsupported Bitwarden Password Manager field ${field}`)
   }
 
-  return { itemId, field }
+  return { item, field }
 }
 
 async function session (options) {
@@ -105,10 +107,10 @@ async function resolveBitwardenPassword (parsed, options = {}) {
       if (!isSecretReference(value)) continue
 
       try {
-        const { itemId, field } = parseSecretReference(value)
+        const { item, field } = parseSecretReference(value)
         if (options.session) startStatus()
         const bwSession = await session(options)
-        const stdout = await execFileAsync('bw', ['get', field, itemId], {
+        const stdout = await execFileAsync('bw', ['get', field, item], {
           encoding: 'utf8',
           windowsHide: true,
           env: { ...process.env, BW_SESSION: bwSession }
@@ -117,7 +119,6 @@ async function resolveBitwardenPassword (parsed, options = {}) {
       } catch (error) {
         errors.push(resolutionError(key, error))
         unresolved.push(key)
-        delete parsed[key]
       }
     }
   } finally {
@@ -138,13 +139,13 @@ function resolveBitwardenPasswordSync (parsed) {
     if (!isSecretReference(value)) continue
 
     try {
-      const { itemId, field } = parseSecretReference(value)
+      const { item, field } = parseSecretReference(value)
       if (!process.env.BW_SESSION) {
         const error = new Error('Bitwarden Password Manager requires an unlocked BW_SESSION')
         error.code = 'BW_SESSION_MISSING'
         throw error
       }
-      const stdout = execFileSync('bw', ['get', field, itemId], {
+      const stdout = execFileSync('bw', ['get', field, item], {
         encoding: 'utf8',
         windowsHide: true,
         stdio: ['ignore', 'pipe', 'pipe']
@@ -153,7 +154,6 @@ function resolveBitwardenPasswordSync (parsed) {
     } catch (error) {
       errors.push(resolutionError(key, error))
       unresolved.push(key)
-      delete parsed[key]
     }
   }
 

package/src/lib/helpers/resolveOnePassword.js

@@ -44,7 +44,6 @@ async function resolveOnePassword (parsed, options = {}) {
       } catch (error) {
         errors.push(resolutionError(key, error))
         unresolved.push(key)
-        delete parsed[key]
       }
     }
   } finally {
@@ -73,7 +72,6 @@ function resolveOnePasswordSync (parsed) {
     } catch (error) {
       errors.push(resolutionError(key, error))
       unresolved.push(key)
-      delete parsed[key]
     }
   }
 

package/src/lib/resolvers/envs.js

@@ -106,14 +106,12 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
     if (!no1Password) {
       const result = await resolveOnePassword(row.injected, { onStatus })
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = await resolveBitwardenPassword(row.injected, { onStatus })
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }
@@ -160,14 +158,12 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
     if (!no1Password) {
       const result = resolveOnePassword.sync(row.injected)
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = resolveBitwardenPassword.sync(row.injected)
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }
@@ -217,14 +213,12 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
     if (!no1Password) {
       const result = await resolveOnePassword(row.injected, { onStatus })
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = await resolveBitwardenPassword(row.injected, { onStatus })
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }
@@ -278,14 +272,12 @@ function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provid
     if (!no1Password) {
       const result = resolveOnePassword.sync(row.injected)
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = resolveBitwardenPassword.sync(row.injected)
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }