Leave penv
penv pull writes a plain .env you can keep using with anything. Deleting the workspace ends the rest.
.env is the interchange format, so leaving is one command per environment and then some tidying.
Nothing you put in is held anywhere you cannot read it back from.
Get your values back
penv pull --env productionThat writes a plain .env for one environment, with permissions only you can read, and adds .env
to your .gitignore if it is not there. Run it once per environment, moving each file somewhere
before you pull the next, because the name is always .env.
The file penv writes is the subset every dotenv reader agrees on: UTF-8 with no byte order mark, LF
endings, KEY=value in upper snake case, no export, no comments. Quotes appear only where they
are needed, and inside double quotes \n is the one escape, which is how a multi-line key sits on
one line.
A value penv cannot write portably stops the pull rather than being mangled. The refusal names the key, and the value is never in it. It tells you to fix it in the console and pull again. Keys the cloud mints for itself are skipped, and penv says how many.
Under a coding agent session penv pull exits 2, because it writes every value to disk. A person
runs it with --i-am-human. If what you actually want is to run something, use penv run instead
and leave nothing behind.
Take penv out of the repository
Four things penv put in your repository, and what removing each one costs you:
| What | Where | If you remove it |
|---|---|---|
| The schema | .env.schema | Nothing validates your values before a process starts |
| Remembered targets | .penv/targets/ | The typed file stops being regenerated |
| The generated typed file | Wherever you told it to go | Your code loses the typed object, so keep it or replace it |
| Harness rules | .claude/, .codex/, .cursor/ and the rest | Your coding agent can read .env again |
penv merged its rules into files you already had rather than owning them, so removing them means
taking out the lines it added. The deny entries name .env and .env.*, and the hooks run
penv hook <harness>.
Then remove the credential and the binary:
penv logout
rm -rf ~/.penvlogout revokes the stored credential and takes it out of your operating system keychain. It drops
the encrypted cache too, which was sealed against that credential and would open for nothing else.
The second line removes the binary the installer placed, along with any target folders you kept
under your home directory. On Windows that directory is %USERPROFILE%\.penv.
Close the workspace
Deleting the workspace is a console action, under Settings then Danger Zone. It needs the
org:delete permission, confirming it is you, and typing the workspace name.
It is refused while a subscription is still live, so cancel that first. Cancellation takes effect at the end of the period you have paid for.
Deletion is soft. Access ends immediately for everyone, and the data stays restorable for 30 days before the purge job removes it for good. There is no restore button in the console: it is a support operation, so ask before the 30 days run out rather than after.
Pull every environment you still need before you delete the workspace. Access ends the moment you confirm, so a value you did not pull is a support ticket rather than a command.
Do it in order
penv pull --env development, then move the file out of the way.- Repeat for every other environment, one at a time.
- Open each file and check the keys you expected are all there.
- Cancel the subscription under Settings then Billing, if one is live.
- Delete
.env.schemaand.penv/, and take penv's lines out of your harness configs. penv logout, then remove~/.penv.- Delete the workspace under Settings then Danger Zone, typing the name when it asks.