@dotenvx/dotenvx 2.19.1 → 2.20.0

package/CHANGELOG.md

@@ -2,7 +2,17 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.19.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.20.0...main)
+
+## [2.20.0](https://github.com/dotenvx/dotenvx/compare/v2.19.1...v2.20.0) (2026-08-07)
+
+### Added
+
+* Add `dotenvx del` command for deleting a key from a .env file ([#939](https://github.com/dotenvx/dotenvx/pull/939))
+
+### Changed
+
+* Exempt `.env.vault` from `precommit`/`prebuild` sealed checks (vault-format ciphertext is already safe to commit)
 
 ## [2.19.1](https://github.com/dotenvx/dotenvx/compare/v2.19.0...v2.19.1) (2026-07-29)
 

package/README.md

@@ -130,6 +130,13 @@ More examples
 
 Run Claude with your real secrets while redacting them from its output.
 
+Prerequisite: install [Claude Code](https://code.claude.com/docs/en/setup) to get the `claude` command.
+
+```sh
+$ curl -fsSL https://claude.ai/install.sh | bash
+$ claude --version
+```
+
 ```sh
 $ echo "HELLO=World" > .env
 
@@ -144,6 +151,13 @@ see [Claude redaction guide](https://dotenvx.com/docs/cli/run-redact-claude-prin
 
 Run Codex with your real secrets while redacting them from its output.
 
+Prerequisite: install the [Codex CLI](https://developers.openai.com/codex/cli/) to get the `codex` command.
+
+```sh
+$ npm install -g @openai/codex
+$ codex --version
+```
+
 ```sh
 $ echo "HELLO=World" > .env
 
@@ -153,6 +167,27 @@ Hello [REDACTED]
 
 see [Codex redaction guide](https://dotenvx.com/docs/cli/run-redact-codex-exec)
 
+</details>
+<details><summary>Cursor 🖱️</summary><br>
+
+Run Cursor with your real secrets while redacting them from its output.
+
+Prerequisite: install the separate [Cursor CLI](https://cursor.com/cli). Installing the Cursor desktop app does not necessarily install the `agent` command.
+
+```sh
+$ curl https://cursor.com/install -fsS | bash
+$ agent --version
+```
+
+```sh
+$ echo "HELLO=World" > .env
+
+$ dotenvx run --redact -- agent -p --force 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --output-format text
+Hello [REDACTED]
+```
+
+see [Cursor redaction guide](https://dotenvx.com/docs/secrets-in-cursor)
+
 </details>
 <details><summary>1Password 🔐</summary><br>
 
@@ -2176,6 +2211,30 @@ Do not create a missing `.env` file.
 $ dotenvx set HELLO World -f .env.production --no-create
 ```
 
+</details>
+<details><summary>`del KEY`</summary><br>
+
+Delete a key from your `.env` file.
+
+```sh
+$ echo "HELLO=World" > .env
+
+$ dotenvx del HELLO
+◇ removed HELLO (.env)
+```
+
+</details>
+<details><summary>`del KEY -f`</summary><br>
+
+Delete a key from another `.env` file.
+
+```sh
+$ echo "HELLO=production" > .env.production
+
+$ dotenvx del HELLO -f .env.production
+◇ removed HELLO (.env.production)
+```
+
 </details>
 <details><summary>`encrypt`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.19.1",
+  "version": "2.20.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -52,7 +52,7 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^2.1.1",
+    "@dotenvx/primitives": "^2.2.0",
     "@dotenvx/tooling": "^1.0.3",
     "yocto-spinner": "^1.2.1"
   },
@@ -67,7 +67,7 @@
     "tap": "^21.7.4"
   },
   "overrides": {
-    "brace-expansion": "^5.0.8",
+    "brace-expansion": "^5.0.9",
     "minimatch": "^10.2.5"
   },
   "publishConfig": {

package/src/cli/actions/del.js

@@ -0,0 +1,56 @@
+const fsx = require('./../../lib/helpers/fsx')
+const { logger } = require('./../../shared/logger')
+
+const delTransform = require('./../../lib/transforms/del')
+
+const catchAndLog = require('../../lib/helpers/catchAndLog')
+const createSpinner = require('../../lib/helpers/createSpinner')
+
+async function del (key) {
+  const options = this.opts()
+  const spinnerOptions = typeof this.optsWithGlobals === 'function' ? this.optsWithGlobals() : options
+  const spinner = await createSpinner({ ...spinnerOptions, ...options, text: 'deleting' })
+
+  logger.debug(`key: ${key}`)
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const envs = this.envs || []
+
+  let errorCount = 0
+
+  try {
+    const { processedEnvs, changedFilepaths, unchangedFilepaths } = await delTransform({ envs, key })
+
+    if (spinner) spinner.stop()
+    for (const processedEnv of processedEnvs) {
+      logger.verbose(`deleting for ${processedEnv.envFilepath}`)
+      if (processedEnv.error) {
+        errorCount += 1
+        logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
+      } else if (processedEnv.changed) {
+        await fsx.writeFileX(processedEnv.filepath, processedEnv.envSrc)
+        logger.verbose(`${processedEnv.key} deleted (${processedEnv.envFilepath})`)
+      } else {
+        logger.verbose(`no change ${processedEnv.envFilepath} (${processedEnv.filepath})`)
+      }
+    }
+
+    if (changedFilepaths.length > 0) {
+      logger.success(`◇ removed ${key} (${changedFilepaths.join(',')})`)
+    } else if (unchangedFilepaths.length > 0) {
+      logger.info(`○ no change (${unchangedFilepaths})`)
+    } else {
+      // do nothing - scenario when no .env files found
+    }
+
+    if (errorCount > 0) {
+      process.exit(1)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    catchAndLog(error)
+    process.exit(1)
+  }
+}
+
+module.exports = del

package/src/cli/dotenvx.js

@@ -129,6 +129,18 @@ program.command('set')
     return require('./actions/set').apply(this, args)
   })
 
+// dotenvx del
+program.command('del')
+  .usage('<KEY> [options]')
+  .description('delete a single environment variable')
+  .addHelpText('after', help.del)
+  .argument('KEY', 'KEY')
+  .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
+  .action(function (...args) {
+    this.envs = envs
+    return require('./actions/del').apply(this, args)
+  })
+
 // dotenvx encrypt
 program.command('encrypt')
   .description('encrypt .env file(s)')
@@ -317,7 +329,7 @@ program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
 program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
-program.addHelpText('after', '  curl                     ⛨ call authenticated api to Dotenvx Armor [www.dotenvx.com/armor]')
+program.addHelpText('after', '  curl                     ⛨ call authenticated api Dotenvx Armor [www.dotenvx.com/armor]')
 
 // dotenvx native
 require('./commands/native')(program.command('native', { hidden: true }))

package/src/cli/help.js

@@ -90,6 +90,17 @@ Examples:
   `
 }
 
+const del = function () {
+  return `
+Examples:
+
+  \`\`\`
+  $ dotenvx del KEY
+  $ dotenvx del KEY -f .env.production
+  \`\`\`
+  `
+}
+
 const curl = function () {
   return `
 Endpoints:
@@ -130,5 +141,6 @@ module.exports = {
   prebuild,
   gitignore,
   set,
+  del,
   curl
 }

package/src/lib/services/prebuild.js

@@ -43,7 +43,7 @@ class Prebuild {
 
       // check if that file is being ignored
       if (ig.ignores(file)) {
-        if (file === '.env.example' || file === '.env.x') {
+        if (file === '.env.example' || file === '.env.vault' || file === '.env.x') {
           const warning = new Errors({
             message: `${file} ignored (should not be)`,
             help: `fix: [dotenvx gitignore --pattern !${file}]`
@@ -51,7 +51,7 @@ class Prebuild {
           warnings.push(warning)
         }
       } else {
-        if (file !== '.env.example' && file !== '.env.x') {
+        if (file !== '.env.example' && file !== '.env.vault' && file !== '.env.x') {
           const src = fsx.readFileXSync(file)
           const encrypted = sealed(src)
 

package/src/lib/services/precommit.js

@@ -60,7 +60,7 @@ class Precommit {
         if (this._isFileToBeCommitted(file)) {
           // check if that file is being ignored
           if (ig.ignores(file)) {
-            if (filename === '.env.example' || filename === '.env.x') {
+            if (filename === '.env.example' || filename === '.env.vault' || filename === '.env.x') {
               const warning = new Errors({
                 message: `${file} ignored (should not be)`,
                 help: `fix: [dotenvx gitignore --pattern !${file}]`
@@ -68,7 +68,7 @@ class Precommit {
               warnings.push(warning)
             }
           } else {
-            if (filename !== '.env.example' && filename !== '.env.x') {
+            if (filename !== '.env.example' && filename !== '.env.vault' && filename !== '.env.x') {
               const src = fsx.readFileXSync(file)
               const encrypted = sealed(src)
 

package/src/lib/transforms/del.js

@@ -0,0 +1,58 @@
+const fsx = require('./../helpers/fsx')
+const path = require('path')
+const { remove } = require('@dotenvx/primitives')
+
+const TYPE_ENV_FILE = 'envFile'
+
+const Errors = require('./../helpers/errors')
+const { determine } = require('./../helpers/envResolution')
+const detectEncoding = require('./../helpers/detectEncoding')
+
+async function delTransform (options = {}) {
+  const envs = options.envs || []
+  const key = options.key
+
+  const processedEnvs = []
+  const changedFilepaths = []
+  const unchangedFilepaths = []
+
+  for (const env of determine(envs, process.env)) {
+    if (env.type !== TYPE_ENV_FILE) {
+      continue
+    }
+
+    const envFilepath = env.envFilepath || env.value
+    const filepath = env.filepath || path.resolve(envFilepath)
+    const row = { key, type: TYPE_ENV_FILE, filepath, envFilepath, changed: false }
+
+    try {
+      const encoding = await detectEncoding(filepath)
+      const before = await fsx.readFileX(filepath, { encoding })
+      const after = remove(before, key)
+
+      row.envSrc = after
+      if (after !== before) {
+        row.changed = true
+        changedFilepaths.push(envFilepath)
+      } else {
+        unchangedFilepaths.push(envFilepath)
+      }
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        row.error = new Errors({ envFilepath, filepath }).missingEnvFile()
+      } else {
+        row.error = error
+      }
+    }
+
+    processedEnvs.push(row)
+  }
+
+  return {
+    processedEnvs,
+    changedFilepaths,
+    unchangedFilepaths
+  }
+}
+
+module.exports = delTransform