@dotenvx/dotenvx 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.5.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.6.0...main)
+
+## [2.6.0](https://github.com/dotenvx/dotenvx/compare/v2.5.0...v2.6.0) (2026-07-11)
+
+### Added
+
+* Support `native up|down|pull|push` for windows ([#834](https://github.com/dotenvx/dotenvx/pull/884))
 
 ## [2.5.0](https://github.com/dotenvx/dotenvx/compare/v2.4.2...v2.5.0) (2026-07-11)
 

package/README.md

@@ -2484,7 +2484,9 @@ $ dotenvx lock down
 
 Move private keys into your OS secret store.
 
-Native commands support macOS Keychain and Windows Credential Manager.
+Native commands support macOS Keychain, Linux Secret Service, and Windows Credential Manager.
+
+On Linux, `secret-tool` and an available Secret Service are required.
 
 </details>
 <details><summary>`native up`</summary><br>
@@ -2646,7 +2648,7 @@ Commands:
  
 Professional Security: 
   lock                     ⊡ lock private keys with a local passphrase
-  native                   ⌥ move private keys into your OS secret store (macOS and Windows supported)
+  native                   ⌥ move private keys into your OS secret store
   armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.5.0",
+  "version": "2.6.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/commands/native.js

@@ -1,6 +1,6 @@
 function configureNativeCommand (native) {
   native
-    .description('move private keys into your OS secret store (macOS and Windows supported)')
+    .description('move private keys into your OS secret store')
     .action(function () {
       this.help()
     })

package/src/cli/dotenvx.js

@@ -260,7 +260,7 @@ program.command('help [command]')
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
-program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store (macOS and Windows supported)')
+program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
 
 // dotenvx native

package/src/lib/helpers/linuxSecretService.js

@@ -0,0 +1,43 @@
+const { execFileSync } = require('child_process')
+
+const SECRET_TOOL_BIN = 'secret-tool'
+const SERVICE = 'dotenvx'
+
+function attributes (publicKey) {
+  return ['service', SERVICE, 'public-key', publicKey]
+}
+
+function findGenericPassword (publicKey) {
+  try {
+    return execFileSync(SECRET_TOOL_BIN, ['lookup', ...attributes(publicKey)], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe']
+    }).trim() || null
+  } catch {
+    throw new Error('failed to read private key from Linux Secret Service')
+  }
+}
+
+function addGenericPassword (publicKey, label, privateKey) {
+  try {
+    execFileSync(SECRET_TOOL_BIN, ['store', `--label=${label}`, ...attributes(publicKey)], {
+      input: privateKey,
+      encoding: 'utf8',
+      stdio: ['pipe', 'ignore', 'pipe']
+    })
+  } catch {
+    throw new Error('failed to save private key to Linux Secret Service')
+  }
+}
+
+function deleteGenericPassword (publicKey) {
+  try {
+    execFileSync(SECRET_TOOL_BIN, ['clear', ...attributes(publicKey)], {
+      stdio: ['ignore', 'ignore', 'pipe']
+    })
+  } catch {
+    throw new Error('failed to delete private key from Linux Secret Service')
+  }
+}
+
+module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/providers/index.js

@@ -44,7 +44,7 @@ function armorProviderForOptions (options) {
 }
 
 function useNative (options) {
-  if (process.platform !== 'darwin' && process.platform !== 'win32') return false
+  if (!['darwin', 'linux', 'win32'].includes(process.platform)) return false
   if (process.env.CI) return false
   return options.noNative !== true && options.native !== false && options.noKeychain !== true
 }

package/src/lib/providers/native/index.js

@@ -1,6 +1,7 @@
 const { execFileSync } = require('child_process')
 
 const windowsCredentialManager = require('../../helpers/windowsCredentialManager')
+const linuxSecretService = require('../../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
@@ -10,12 +11,17 @@ function findMacosPrivateKey (publicKeyHex) {
 }
 
 function index (publicKeyHex) {
-  if (process.platform !== 'darwin' && process.platform !== 'win32') return {}
+  if (!['darwin', 'linux', 'win32'].includes(process.platform)) return {}
 
   try {
-    const privateKeyHex = process.platform === 'win32'
-      ? windowsCredentialManager.findGenericPassword(publicKeyHex)
-      : findMacosPrivateKey(publicKeyHex)
+    let privateKeyHex
+    if (process.platform === 'win32') {
+      privateKeyHex = windowsCredentialManager.findGenericPassword(publicKeyHex)
+    } else if (process.platform === 'linux') {
+      privateKeyHex = linuxSecretService.findGenericPassword(publicKeyHex)
+    } else {
+      privateKeyHex = findMacosPrivateKey(publicKeyHex)
+    }
 
     if (!privateKeyHex) return {}
 

package/src/lib/services/keychainDown.js

@@ -5,6 +5,7 @@ const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
 const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
@@ -14,6 +15,10 @@ function findGenericPassword (publicKey) {
     return windowsCredentialManager.findGenericPassword(publicKey)
   }
 
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
   return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
 }
 
@@ -23,6 +28,11 @@ function deleteGenericPassword (publicKey) {
     return
   }
 
+  if (process.platform === 'linux') {
+    linuxSecretService.deleteGenericPassword(publicKey)
+    return
+  }
+
   execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', publicKey], { stdio: 'ignore' })
 }
 
@@ -47,7 +57,9 @@ class KeychainDown {
     try {
       privateKey = findGenericPassword(publicKey)
       if (!privateKey) {
-        const secretStore = process.platform === 'win32' ? 'Windows Credential Manager' : 'macOS Keychain'
+        const secretStore = process.platform === 'win32'
+          ? 'Windows Credential Manager'
+          : process.platform === 'linux' ? 'Linux Secret Service' : 'macOS Keychain'
         throw new Error(`[NOT_FOUND] private key not found in ${secretStore} (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
       }
     } catch (error) {

package/src/lib/services/keychainPull.js

@@ -5,6 +5,7 @@ const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
 const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
@@ -14,6 +15,10 @@ function findGenericPassword (publicKey) {
     return windowsCredentialManager.findGenericPassword(publicKey)
   }
 
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
   return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
 }
 
@@ -39,7 +44,9 @@ class KeychainPull {
       privateKey = findGenericPassword(publicKey)
       if (!privateKey) throw new Error('not found')
     } catch {
-      const secretStore = process.platform === 'win32' ? 'Windows Credential Manager' : 'macOS Keychain'
+      const secretStore = process.platform === 'win32'
+        ? 'Windows Credential Manager'
+        : process.platform === 'linux' ? 'Linux Secret Service' : 'macOS Keychain'
       throw new Error(`[NOT_FOUND] private key not found in ${secretStore} (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
     }
 

package/src/lib/services/keychainPush.js

@@ -4,6 +4,7 @@ const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
 const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
@@ -14,6 +15,11 @@ function addGenericPassword (publicKey, label, privateKey) {
     return
   }
 
+  if (process.platform === 'linux') {
+    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
+    return
+  }
+
   try {
     execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
   } catch {
@@ -26,6 +32,10 @@ function findGenericPassword (publicKey) {
     return windowsCredentialManager.findGenericPassword(publicKey)
   }
 
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
   return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
 }
 

package/src/lib/services/keychainUp.js

@@ -5,6 +5,7 @@ const readEnvKey = require('../helpers/readEnvKey')
 const removeEnvKey = require('../helpers/removeEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
 const windowsCredentialManager = require('../helpers/windowsCredentialManager')
+const linuxSecretService = require('../helpers/linuxSecretService')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
@@ -15,6 +16,11 @@ function addGenericPassword (publicKey, label, privateKey) {
     return
   }
 
+  if (process.platform === 'linux') {
+    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
+    return
+  }
+
   try {
     execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
   } catch {
@@ -27,6 +33,10 @@ function findGenericPassword (publicKey) {
     return windowsCredentialManager.findGenericPassword(publicKey)
   }
 
+  if (process.platform === 'linux') {
+    return linuxSecretService.findGenericPassword(publicKey)
+  }
+
   return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
 }