@dotenvx/dotenvx 2.19.0 → 2.19.2

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.19.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.19.2...main)
+
+## [2.19.2](https://github.com/dotenvx/dotenvx/compare/v2.19.1...v2.19.2) (2026-08-03)
+
+### Changed
+
+* Example `.env.vault` from precommit ([#935](https://github.com/dotenvx/dotenvx/pull/935))
+
+## [2.19.1](https://github.com/dotenvx/dotenvx/compare/v2.19.0...v2.19.1) (2026-07-29)
+
+### Changed
+
+* User can click enter to open up approval url for convenience ([#934](https://github.com/dotenvx/dotenvx/pull/934))
 
 ## [2.19.0](https://github.com/dotenvx/dotenvx/compare/v2.18.1...v2.19.0) (2026-07-27)
 

package/README.md

@@ -130,6 +130,13 @@ More examples
 
 Run Claude with your real secrets while redacting them from its output.
 
+Prerequisite: install [Claude Code](https://code.claude.com/docs/en/setup) to get the `claude` command.
+
+```sh
+$ curl -fsSL https://claude.ai/install.sh | bash
+$ claude --version
+```
+
 ```sh
 $ echo "HELLO=World" > .env
 
@@ -144,6 +151,13 @@ see [Claude redaction guide](https://dotenvx.com/docs/cli/run-redact-claude-prin
 
 Run Codex with your real secrets while redacting them from its output.
 
+Prerequisite: install the [Codex CLI](https://developers.openai.com/codex/cli/) to get the `codex` command.
+
+```sh
+$ npm install -g @openai/codex
+$ codex --version
+```
+
 ```sh
 $ echo "HELLO=World" > .env
 
@@ -153,6 +167,27 @@ Hello [REDACTED]
 
 see [Codex redaction guide](https://dotenvx.com/docs/cli/run-redact-codex-exec)
 
+</details>
+<details><summary>Cursor 🖱️</summary><br>
+
+Run Cursor with your real secrets while redacting them from its output.
+
+Prerequisite: install the separate [Cursor CLI](https://cursor.com/cli). Installing the Cursor desktop app does not necessarily install the `agent` command.
+
+```sh
+$ curl https://cursor.com/install -fsS | bash
+$ agent --version
+```
+
+```sh
+$ echo "HELLO=World" > .env
+
+$ dotenvx run --redact -- agent -p --force 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --output-format text
+Hello [REDACTED]
+```
+
+see [Cursor redaction guide](https://dotenvx.com/docs/secrets-in-cursor)
+
 </details>
 <details><summary>1Password 🔐</summary><br>
 
@@ -1734,6 +1769,37 @@ Turn off OS secret store lookups for get.
 $ dotenvx get HELLO --no-native
 ```
 
+</details>
+<details><summary>`get KEY --no-armor`</summary><br>
+
+Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features for get.
+
+```sh
+$ dotenvx get HELLO --no-armor
+World
+```
+
+</details>
+<details><summary>`get KEY --ignore`</summary><br>
+
+Ignore specific error codes.
+
+```sh
+$ dotenvx get HELLO --ignore=MISSING_ENV_FILE
+```
+
+Ignore multiple error codes by separating them with spaces.
+
+```sh
+$ dotenvx get HELLO --ignore=MISSING_ENV_FILE MISSING_KEY
+```
+
+You can also set `DOTENV_CONFIG_IGNORE`. Its value is a comma-separated list.
+
+```sh
+$ DOTENV_CONFIG_IGNORE=MISSING_ENV_FILE,OTHER dotenvx get HELLO
+```
+
 </details>
 <details><summary>`get KEY -f`</summary><br>
 
@@ -1880,6 +1946,20 @@ $ dotenvx get
 {"HELLO":"World"}
 ```
 
+</details>
+<details><summary>`get --pretty-print`</summary><br>
+
+Make the JSON output more readable.
+
+```sh
+$ echo "HELLO=World" > .env
+
+$ dotenvx get --pretty-print
+{
+  "HELLO": "World"
+}
+```
+
 </details>
 <details><summary>`get -ik`</summary><br>
 
@@ -1904,6 +1984,18 @@ $ dotenvx get --format=eval-export -ek "DOTENV_PUBLIC_KEY*"
 export HELLO='World'
 ```
 
+</details>
+<details><summary>`get --format colon`</summary><br>
+
+Return a colon-formatted response of all key/value pairs in a `.env` file.
+
+```sh
+$ echo "HELLO=World" > .env
+
+$ dotenvx get --format colon
+HELLO: World
+```
+
 </details>
 <details><summary>`get --format shell`</summary><br>
 
@@ -2100,6 +2192,25 @@ Turn off OS secret store lookups for set.
 $ dotenvx set HELLO World --no-native
 ```
 
+</details>
+<details><summary>`set KEY value --no-armor`</summary><br>
+
+Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features for set.
+
+```sh
+$ dotenvx set HELLO World --no-armor
+◈ encrypted HELLO (.env)
+```
+
+</details>
+<details><summary>`set KEY value --no-create`</summary><br>
+
+Do not create a missing `.env` file.
+
+```sh
+$ dotenvx set HELLO World -f .env.production --no-create
+```
+
 </details>
 <details><summary>`encrypt`</summary><br>
 
@@ -2149,6 +2260,25 @@ $ dotenvx encrypt --no-armor
 ◈ encrypted (.env)
 ```
 
+</details>
+<details><summary>`encrypt --token`</summary><br>
+
+Set the Armor token.
+
+```sh
+$ dotenvx encrypt --token token
+◈ encrypted (.env) · armored ⛨
+```
+
+</details>
+<details><summary>`encrypt --no-create`</summary><br>
+
+Do not create a missing `.env` file.
+
+```sh
+$ dotenvx encrypt -f .env.production --no-create
+```
+
 </details>
 <details><summary>`encrypt -fk`</summary><br>
 
@@ -2278,6 +2408,16 @@ $ dotenvx decrypt --no-native
 ◇ decrypted (.env)
 ```
 
+</details>
+<details><summary>`decrypt --no-armor`</summary><br>
+
+Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features for decrypt.
+
+```sh
+$ dotenvx decrypt --no-armor
+◇ decrypted (.env)
+```
+
 </details>
 <details><summary>`decrypt -f`</summary><br>
 
@@ -2416,6 +2556,16 @@ $ dotenvx keypair --no-native
 {"DOTENV_PUBLIC_KEY":"<publicKey>","DOTENV_PRIVATE_KEY":"<privateKey>"}
 ```
 
+</details>
+<details><summary>`keypair --no-armor`</summary><br>
+
+Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features for keypair.
+
+```sh
+$ dotenvx keypair --no-armor
+{"DOTENV_PUBLIC_KEY":"<publicKey>","DOTENV_PRIVATE_KEY":"<privateKey>"}
+```
+
 </details>
 <details><summary>`keypair -f`</summary><br>
 
@@ -2469,6 +2619,39 @@ $ dotenvx keypair --format shell
 DOTENV_PUBLIC_KEY=<publicKey> DOTENV_PRIVATE_KEY=<privateKey>
 ```
 
+</details>
+<details><summary>`keypair --format colon`</summary><br>
+
+Return a colon-formatted keypair.
+
+```sh
+$ dotenvx keypair --format colon
+DOTENV_PUBLIC_KEY:<publicKey> DOTENV_PRIVATE_KEY:<privateKey>
+```
+
+</details>
+<details><summary>`keypair --format json`</summary><br>
+
+Return a JSON-formatted keypair.
+
+```sh
+$ dotenvx keypair --format json
+{"DOTENV_PUBLIC_KEY":"<publicKey>","DOTENV_PRIVATE_KEY":"<privateKey>"}
+```
+
+</details>
+<details><summary>`keypair --pretty-print`</summary><br>
+
+Make the JSON output more readable.
+
+```sh
+$ dotenvx keypair --pretty-print
+{
+  "DOTENV_PUBLIC_KEY": "<publicKey>",
+  "DOTENV_PRIVATE_KEY": "<privateKey>"
+}
+```
+
 </details>
 <details><summary>`ls`</summary><br>
 
@@ -2895,6 +3078,21 @@ Use a token when running non-interactively.
 $ dotenvx armor pull -f .env.production --token "$DOTENVX_ARMOR_TOKEN"
 ```
 
+</details>
+<details><summary>`armor open`</summary><br>
+
+Open an armored key in your browser.
+
+```sh
+$ dotenvx armor open
+```
+
+Open the armored key for a specific env file.
+
+```sh
+$ dotenvx armor open -f .env.production
+```
+
 </details>
 <details><summary>`armor move`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.19.0",
+  "version": "2.19.2",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/dotenvx.js

@@ -282,11 +282,16 @@ program.command('logout', { hidden: true })
 program.command('curl', { hidden: true })
   .description('Dotenvx Armor API')
   .addHelpText('after', help.curl)
-  .argument('<url>', '(run dotenvx run --help for list of urls)')
+  .argument('[url]', '(run dotenvx curl --help for list of urls)')
   .option('-X, --request <method>', 'HTTP request method')
   .option('--data <json>', 'JSON request body')
   .option('--token <token>', 'set token')
   .action(function (...args) {
+    if (!this.args[0]) {
+      this.outputHelp()
+      return
+    }
+
     return require('./actions/curl').apply(this, args)
   })
 

package/src/cli/help.js

@@ -105,20 +105,22 @@ Endpoints:
   GET    /api/teams/:team/invitations
   POST   /api/teams/:team/invitations
   DELETE /api/teams/:team/invitations/:id
+  GET    /api/logs?team=:team
 
 Examples:
 
-  dotenvx curl https://armor.dotenvx.com/api/account
-  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs
-  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY
-  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/guard --data '{"value":true}'
-  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/enclave --data '{"value":true}'
-  dotenvx curl https://armor.dotenvx.com/api/teams
-  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM
-  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/members
-  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/members
-  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/invitations --data '{"email":"person@example.com","role":"member"}'
-  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/invitations/123 --request DELETE
+  dotenvx curl "https://armor.dotenvx.com/api/account"
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs"
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY"
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/guard" --data '{"value":true}'
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/enclave" --data '{"value":true}'
+  dotenvx curl "https://armor.dotenvx.com/api/teams"
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM"
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/members"
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/members"
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/invitations" --data '{"email":"person@example.com","role":"member"}'
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/invitations/123" --request DELETE
+  dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM"
   `
 }
 

package/src/lib/providers/armor/index.js

@@ -2,6 +2,8 @@ const Session = require('../../../db/session')
 const ArmorKeyring = require('../../services/armorKeyring')
 const armoredKeyDisplay = require('../../helpers/armoredKeyDisplay')
 const isNetworkError = require('../../helpers/isNetworkError')
+const listenForOpenKey = require('../../helpers/listenForOpenKey')
+const openUrl = require('../../helpers/openUrl')
 
 async function index (publicKeyHex, options = {}) {
   const sesh = new Session()
@@ -16,11 +18,13 @@ async function index (publicKeyHex, options = {}) {
     devicePublicKey,
     publicKeyHex
   )
+  let cleanupOpenKeyListener = () => {}
   if (options.onStatus) {
     keyring.onApprovalRequired = ({ approvalUri, code }) => {
       const keyDisplay = armoredKeyDisplay(publicKeyHex)
       const keySuffix = keyDisplay ? ` (${keyDisplay})` : ''
-      options.onStatus(`[${code}] visit [${approvalUri}] and approve${keySuffix}`)
+      options.onStatus(`[${code}] press Enter to open [${approvalUri}] and approve${keySuffix}`)
+      cleanupOpenKeyListener = listenForOpenKey(() => openUrl(approvalUri))
     }
   }
 
@@ -32,6 +36,8 @@ async function index (publicKeyHex, options = {}) {
     }
 
     throw error
+  } finally {
+    cleanupOpenKeyListener()
   }
 }
 

package/src/lib/services/prebuild.js

@@ -43,7 +43,7 @@ class Prebuild {
 
       // check if that file is being ignored
       if (ig.ignores(file)) {
-        if (file === '.env.example' || file === '.env.x') {
+        if (file === '.env.example' || file === '.env.vault' || file === '.env.x') {
           const warning = new Errors({
             message: `${file} ignored (should not be)`,
             help: `fix: [dotenvx gitignore --pattern !${file}]`
@@ -51,7 +51,7 @@ class Prebuild {
           warnings.push(warning)
         }
       } else {
-        if (file !== '.env.example' && file !== '.env.x') {
+        if (file !== '.env.example' && file !== '.env.vault' && file !== '.env.x') {
           const src = fsx.readFileXSync(file)
           const encrypted = sealed(src)
 

package/src/lib/services/precommit.js

@@ -60,7 +60,7 @@ class Precommit {
         if (this._isFileToBeCommitted(file)) {
           // check if that file is being ignored
           if (ig.ignores(file)) {
-            if (filename === '.env.example' || filename === '.env.x') {
+            if (filename === '.env.example' || filename === '.env.vault' || filename === '.env.x') {
               const warning = new Errors({
                 message: `${file} ignored (should not be)`,
                 help: `fix: [dotenvx gitignore --pattern !${file}]`
@@ -68,7 +68,7 @@ class Precommit {
               warnings.push(warning)
             }
           } else {
-            if (filename !== '.env.example' && filename !== '.env.x') {
+            if (filename !== '.env.example' && filename !== '.env.vault' && filename !== '.env.x') {
               const src = fsx.readFileXSync(file)
               const encrypted = sealed(src)