@dotenvx/dotenvx 2.4.1 → 2.6.0

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.4.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.6.0...main)
+
+## [2.6.0](https://github.com/dotenvx/dotenvx/compare/v2.5.0...v2.6.0) (2026-07-11)
+
+### Added
+
+* Support `native up|down|pull|push` for windows ([#834](https://github.com/dotenvx/dotenvx/pull/884))
+
+## [2.5.0](https://github.com/dotenvx/dotenvx/compare/v2.4.2...v2.5.0) (2026-07-11)
+
+### Added
+
+* Support `native up|down|pull|push` for windows ([#833](https://github.com/dotenvx/dotenvx/pull/883))
 
 ## [2.4.1](https://github.com/dotenvx/dotenvx/compare/v2.4.0...v2.4.1) (2026-07-10)
 

package/README.md

@@ -2482,9 +2482,11 @@ $ dotenvx lock down
 </details>
 <details><summary>`native`</summary><br>
 
-Move private keys into your OS secret store (macOS Keychain supported).
+Move private keys into your OS secret store.
 
-Currently supported on macOS.
+Native commands support macOS Keychain, Linux Secret Service, and Windows Credential Manager.
+
+On Linux, `secret-tool` and an available Secret Service are required.
 
 </details>
 <details><summary>`native up`</summary><br>
@@ -2646,7 +2648,7 @@ Commands:
  
 Professional Security: 
   lock                     ⊡ lock private keys with a local passphrase
-  native                   ⌥ move private keys into your OS secret store (macOS Keychain supported)
+  native                   ⌥ move private keys into your OS secret store
   armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.4.1",
+  "version": "2.6.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/commands/native.js

@@ -1,6 +1,6 @@
 function configureNativeCommand (native) {
   native
-    .description('move private keys into your OS secret store (macOS Keychain supported)')
+    .description('move private keys into your OS secret store')
     .action(function () {
       this.help()
     })

package/src/cli/dotenvx.js

@@ -260,7 +260,7 @@ program.command('help [command]')
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
-program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store (macOS Keychain supported)')
+program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
 
 // dotenvx native

package/src/lib/helpers/linuxSecretService.js

@@ -0,0 +1,43 @@
+const { execFileSync } = require('child_process')
+
+const SECRET_TOOL_BIN = 'secret-tool'
+const SERVICE = 'dotenvx'
+
+function attributes (publicKey) {
+  return ['service', SERVICE, 'public-key', publicKey]
+}
+
+function findGenericPassword (publicKey) {
+  try {
+    return execFileSync(SECRET_TOOL_BIN, ['lookup', ...attributes(publicKey)], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe']
+    }).trim() || null
+  } catch {
+    throw new Error('failed to read private key from Linux Secret Service')
+  }
+}
+
+function addGenericPassword (publicKey, label, privateKey) {
+  try {
+    execFileSync(SECRET_TOOL_BIN, ['store', `--label=${label}`, ...attributes(publicKey)], {
+      input: privateKey,
+      encoding: 'utf8',
+      stdio: ['pipe', 'ignore', 'pipe']
+    })
+  } catch {
+    throw new Error('failed to save private key to Linux Secret Service')
+  }
+}
+
+function deleteGenericPassword (publicKey) {
+  try {
+    execFileSync(SECRET_TOOL_BIN, ['clear', ...attributes(publicKey)], {
+      stdio: ['ignore', 'ignore', 'pipe']
+    })
+  } catch {
+    throw new Error('failed to delete private key from Linux Secret Service')
+  }
+}
+
+module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/helpers/windowsCredentialManager.js

@@ -0,0 +1,161 @@
+const { execFileSync } = require('child_process')
+
+const POWERSHELL_BIN = 'powershell.exe'
+const SERVICE = 'dotenvx'
+
+const script = `
+$ErrorActionPreference = 'Stop'
+
+Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class DotenvxCredentialManager
+{
+    private const uint CRED_TYPE_GENERIC = 1;
+    private const uint CRED_PERSIST_LOCAL_MACHINE = 2;
+    private const int ERROR_NOT_FOUND = 1168;
+
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    private struct Credential
+    {
+        public uint Flags;
+        public uint Type;
+        public string TargetName;
+        public string Comment;
+        public long LastWritten;
+        public uint CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public uint Persist;
+        public uint AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias;
+        public string UserName;
+    }
+
+    [DllImport("Advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool CredWrite(ref Credential credential, uint flags);
+
+    [DllImport("Advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool CredRead(string target, uint type, uint flags, out IntPtr credentialPtr);
+
+    [DllImport("Advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool CredDelete(string target, uint type, uint flags);
+
+    [DllImport("Advapi32.dll", SetLastError = true)]
+    private static extern void CredFree(IntPtr credentialPtr);
+
+    public static string Read(string target)
+    {
+        IntPtr credentialPtr;
+        if (!CredRead(target, CRED_TYPE_GENERIC, 0, out credentialPtr))
+        {
+            int error = Marshal.GetLastWin32Error();
+            if (error == ERROR_NOT_FOUND) return null;
+            throw new Win32Exception(error);
+        }
+
+        try
+        {
+            Credential credential = (Credential)Marshal.PtrToStructure(credentialPtr, typeof(Credential));
+            if (credential.CredentialBlob == IntPtr.Zero || credential.CredentialBlobSize == 0) return null;
+            return Marshal.PtrToStringUni(credential.CredentialBlob, (int)credential.CredentialBlobSize / 2);
+        }
+        finally
+        {
+            CredFree(credentialPtr);
+        }
+    }
+
+    public static void Write(string target, string username, string secret)
+    {
+        IntPtr secretPtr = Marshal.StringToCoTaskMemUni(secret);
+        try
+        {
+            Credential credential = new Credential();
+            credential.Type = CRED_TYPE_GENERIC;
+            credential.TargetName = target;
+            credential.CredentialBlobSize = (uint)Encoding.Unicode.GetByteCount(secret);
+            credential.CredentialBlob = secretPtr;
+            credential.Persist = CRED_PERSIST_LOCAL_MACHINE;
+            credential.UserName = username;
+
+            if (!CredWrite(ref credential, 0))
+            {
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            }
+        }
+        finally
+        {
+            Marshal.ZeroFreeCoTaskMemUnicode(secretPtr);
+        }
+    }
+
+    public static void Delete(string target)
+    {
+        if (!CredDelete(target, CRED_TYPE_GENERIC, 0))
+        {
+            throw new Win32Exception(Marshal.GetLastWin32Error());
+        }
+    }
+}
+'@
+
+$payload = [Console]::In.ReadToEnd() | ConvertFrom-Json
+
+if ($payload.action -eq 'read') {
+    $secret = [DotenvxCredentialManager]::Read([string]$payload.target)
+    if ($null -ne $secret) {
+        [Console]::Out.Write($secret)
+    }
+} elseif ($payload.action -eq 'write') {
+    [DotenvxCredentialManager]::Write([string]$payload.target, [string]$payload.username, [string]$payload.secret)
+} elseif ($payload.action -eq 'delete') {
+    [DotenvxCredentialManager]::Delete([string]$payload.target)
+} else {
+    throw "unsupported credential action"
+}
+`
+
+const encodedScript = Buffer.from(script, 'utf16le').toString('base64')
+
+function target (publicKey) {
+  return `${SERVICE}:${publicKey}`
+}
+
+function run (payload) {
+  return execFileSync(POWERSHELL_BIN, ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodedScript], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    stdio: ['pipe', 'pipe', 'pipe'],
+    windowsHide: true
+  })
+}
+
+function findGenericPassword (publicKey) {
+  try {
+    return run({ action: 'read', target: target(publicKey) }).trim() || null
+  } catch {
+    throw new Error('failed to read private key from Windows Credential Manager')
+  }
+}
+
+function addGenericPassword (publicKey, privateKey) {
+  try {
+    run({ action: 'write', target: target(publicKey), username: publicKey, secret: privateKey })
+  } catch {
+    throw new Error('failed to save private key to Windows Credential Manager')
+  }
+}
+
+function deleteGenericPassword (publicKey) {
+  try {
+    run({ action: 'delete', target: target(publicKey) })
+  } catch {
+    throw new Error('failed to delete private key from Windows Credential Manager')
+  }
+}
+
+module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/providers/index.js

@@ -1,7 +1,7 @@
 const Session = require('./../../db/session')
 
 const armorProvider = require('./armor/index')
-const keychainProvider = require('./keychain/index')
+const nativeProvider = require('./native/index')
 
 function syncArmorProvider (publicKeyHex) {
   const { createSyncFn } = require('@dotenvx/tooling')
@@ -43,8 +43,8 @@ function armorProviderForOptions (options) {
   })
 }
 
-function useKeychain (options) {
-  if (process.platform !== 'darwin') return false
+function useNative (options) {
+  if (!['darwin', 'linux', 'win32'].includes(process.platform)) return false
   if (process.env.CI) return false
   return options.noNative !== true && options.native !== false && options.noKeychain !== true
 }
@@ -67,8 +67,8 @@ async function providers (options = {}) {
 
   const providerFns = []
 
-  if (useKeychain(options)) {
-    providerFns.push(keychainProvider)
+  if (useNative(options)) {
+    providerFns.push(nativeProvider)
   }
 
   if (options.noArmor !== true && options.armor !== false) {
@@ -89,8 +89,8 @@ providers.sync = function providersSync (options = {}) {
 
   const providerFns = []
 
-  if (useKeychain(options)) {
-    providerFns.push(keychainProvider)
+  if (useNative(options)) {
+    providerFns.push(nativeProvider)
   }
 
   if (options.noArmor !== true && options.armor !== false) {

package/src/lib/providers/native/index.js

@@ -0,0 +1,34 @@
+const { execFileSync } = require('child_process')
+
+const windowsCredentialManager = require('../../helpers/windowsCredentialManager')
+const linuxSecretService = require('../../helpers/linuxSecretService')
+
+const SECURITY_BIN = '/usr/bin/security'
+const SERVICE = 'dotenvx'
+
+function findMacosPrivateKey (publicKeyHex) {
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKeyHex, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
+function index (publicKeyHex) {
+  if (!['darwin', 'linux', 'win32'].includes(process.platform)) return {}
+
+  try {
+    let privateKeyHex
+    if (process.platform === 'win32') {
+      privateKeyHex = windowsCredentialManager.findGenericPassword(publicKeyHex)
+    } else if (process.platform === 'linux') {
+      privateKeyHex = linuxSecretService.findGenericPassword(publicKeyHex)
+    } else {
+      privateKeyHex = findMacosPrivateKey(publicKeyHex)
+    }
+
+    if (!privateKeyHex) return {}
+
+    return { [publicKeyHex]: privateKeyHex }
+  } catch {
+    return {}
+  }
+}
+
+module.exports = index

package/src/lib/services/keychainDown.js

@@ -3,10 +3,39 @@ const { execFileSync } = require('child_process')
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
+const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
+function deleteGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.deleteGenericPassword(publicKey)
+    return
+  }
+
+  if (process.platform === 'linux') {
+    linuxSecretService.deleteGenericPassword(publicKey)
+    return
+  }
+
+  execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', publicKey], { stdio: 'ignore' })
+}
+
 class KeychainDown {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -26,7 +55,13 @@ class KeychainDown {
     let privateKey
 
     try {
-      privateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      privateKey = findGenericPassword(publicKey)
+      if (!privateKey) {
+        const secretStore = process.platform === 'win32'
+          ? 'Windows Credential Manager'
+          : process.platform === 'linux' ? 'Linux Secret Service' : 'macOS Keychain'
+        throw new Error(`[NOT_FOUND] private key not found in ${secretStore} (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
+      }
     } catch (error) {
       privateKey = readEnvKey(privateKeyName, envKeysFile, { strict: false })
 
@@ -43,7 +78,7 @@ class KeychainDown {
     }
 
     upsertEnvKey(privateKeyName, privateKey, envKeysFile)
-    execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', publicKey], { stdio: 'ignore' })
+    deleteGenericPassword(publicKey)
 
     return {
       changed: true,

package/src/lib/services/keychainPull.js

@@ -4,10 +4,24 @@ const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
 class KeychainPull {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -27,9 +41,13 @@ class KeychainPull {
     let privateKey
 
     try {
-      privateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      privateKey = findGenericPassword(publicKey)
+      if (!privateKey) throw new Error('not found')
     } catch {
-      throw new Error(`[NOT_FOUND] private key not found in macOS Keychain (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
+      const secretStore = process.platform === 'win32'
+        ? 'Windows Credential Manager'
+        : process.platform === 'linux' ? 'Linux Secret Service' : 'macOS Keychain'
+      throw new Error(`[NOT_FOUND] private key not found in ${secretStore} (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
     }
 
     const result = upsertEnvKey(privateKeyName, privateKey, envKeysFile)

package/src/lib/services/keychainPush.js

@@ -3,11 +3,23 @@ const { execFileSync } = require('child_process')
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
 function addGenericPassword (publicKey, label, privateKey) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
+    return
+  }
+
+  if (process.platform === 'linux') {
+    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
+    return
+  }
+
   try {
     execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
   } catch {
@@ -15,6 +27,18 @@ function addGenericPassword (publicKey, label, privateKey) {
   }
 }
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
 class KeychainPush {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -35,7 +59,7 @@ class KeychainPush {
     const label = `dotenvx (${armoredKeyDisplay(publicKey)})`
 
     try {
-      const existingPrivateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      const existingPrivateKey = findGenericPassword(publicKey)
 
       if (existingPrivateKey === privateKey) {
         return {

package/src/lib/services/keychainUp.js

@@ -4,11 +4,23 @@ const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const removeEnvKey = require('../helpers/removeEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
 function addGenericPassword (publicKey, label, privateKey) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
+    return
+  }
+
+  if (process.platform === 'linux') {
+    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
+    return
+  }
+
   try {
     execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
   } catch {
@@ -16,6 +28,18 @@ function addGenericPassword (publicKey, label, privateKey) {
   }
 }
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
 class KeychainUp {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -36,7 +60,7 @@ class KeychainUp {
     let existingPrivateKey
 
     try {
-      existingPrivateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      existingPrivateKey = findGenericPassword(publicKey)
     } catch {}
 
     const privateKey = readEnvKey(privateKeyName, envKeysFile, { strict: !existingPrivateKey })

package/src/lib/providers/keychain/index.js

@@ -1,20 +0,0 @@
-const { execFileSync } = require('child_process')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function index (publicKeyHex) {
-  if (process.platform !== 'darwin') return {}
-
-  try {
-    const stdout = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKeyHex, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
-    const privateKeyHex = stdout.trim()
-    if (!privateKeyHex) return {}
-
-    return { [publicKeyHex]: privateKeyHex }
-  } catch {
-    return {}
-  }
-}
-
-module.exports = index