env-secrets
Use this skill whenever you need to read or change an encrypted environment file (`.env.<env>.encrypted`) in a project using `phattarachai/laravel-env-secrets` — production, uat, or any non-local env. It is the ONLY correct way to touch these files: NEVER run `php artisan env:encrypt` by hand, because that command reads the key only from `--key` (it ignores `LARAVEL_ENV_ENCRYPTION_KEY`) and, run non-interactively, silently mints a throwaway random key — producing ciphertext the deploy box can no longer decrypt. This package's `secrets:*` commands fetch the real key from the deploy box over ssh and always pass it through, so the key can never drift and never lands in argv, shell history, or a CI log. Covers editing an env (`secrets:edit` → `secrets:reencrypt`), first-time setup (`secrets:provision`), health-checking (`secrets:status`), and peeking at values without decrypting to disk (`secrets:show`), plus the `--remote` mode that reads the live deployed `.env`, and the per-env `environments` map for projects whose envs live on different boxes. Triggers on: "edit the production env", "add a key to .env.production", "re-encrypt the env", ".env.production.encrypted", "env:encrypt", "MAC is invalid", "decryption failed after deploy", "what is DB_PASSWORD on production", "rotate an env value", "staging is on a different box", "--host", "sudo: a terminal is required to read the password", "secrets:provision failed to install key", or any request to change committed encrypted env files.