diff --git a/src/cmds/system/constants.rs b/src/cmds/system/constants.rs
index 2454f5299c..4632978089 100644
--- a/src/cmds/system/constants.rs
+++ b/src/cmds/system/constants.rs
@@ -15,7 +15,6 @@ pub const NOISE_DIRS: &[&str] = &[
     ".venv",
     "venv",
     "env",
-    ".env",
     "coverage",
     ".nyc_output",
     ".DS_Store",
diff --git a/src/cmds/system/ls.rs b/src/cmds/system/ls.rs
index ac40ae328d..9980b8094a 100644
--- a/src/cmds/system/ls.rs
+++ b/src/cmds/system/ls.rs
@@ -273,6 +273,24 @@ mod tests {
         assert!(entries.contains("main.rs"));
     }
 
+    #[test]
+    fn test_compact_preserves_dotenv() {
+        // .env files MUST be visible by default. Hiding them silently caused
+        // agents to assume the project was unconfigured and overwrite the file
+        // with template defaults — destroying production secrets.
+        // See discussion: r/ClaudeCode "Token Optimizers...Silently Dangerous".
+        let input = "total 8\n\
+                     -rw-r--r--  1 user  staff  64 Jan  1 12:00 .env\n\
+                     -rw-r--r--  1 user  staff  64 Jan  1 12:00 .env.local\n\
+                     -rw-r--r--  1 user  staff  64 Jan  1 12:00 .env.example\n\
+                     -rw-r--r--  1 user  staff  100 Jan  1 12:00 main.rs\n";
+        let (entries, _summary) = compact_ls(input, false);
+        assert!(entries.contains(".env"), "default ls must show .env");
+        assert!(entries.contains(".env.local"));
+        assert!(entries.contains(".env.example"));
+        assert!(entries.contains("main.rs"));
+    }
+
     #[test]
     fn test_compact_show_all() {
         let input = "total 8\n\