Your env follows the project

.env, .env.local, and .env.* travel with the project, encrypted end-to-end. Open the project on a second machine or hand it to an agent on a remote host, and pnpm dev just runs. There is no bowline shell to enter, no re-pasting API keys, and no scp-ing a .env file around before you can start.

Dotfile managers and secret managers each cover a slice: config here, secrets there. bowline carries env as part of the whole working state, alongside source, opaque Git state, and uncommitted work, so the project arrives ready to run instead of ready to configure.

Env files and secrets are encrypted end-to-end and rematerialize as normal files only on devices and agent hosts you have explicitly trusted. The hosted service carries ciphertext and cannot read secret values. Device trust is revocable, and you hold your own recovery keys.

This is what makes an agent host productive immediately. The moment a Linux box or ephemeral agent host is trusted, it has the same source and the same env you do, and its edits sync back to every machine, with no per-host secret setup and no manual copy step.