Run envkit <command> --help for the full flag list; this is the map.
| Command | What it does |
|---|
envkit init --store <path> | Write ~/.config/envkit/config.toml pointing at your store |
envkit setup | Prepare the secret backend (GPG + pass) on Linux |
envkit migrate | One-time: turn existing ~ symlinks into real files and seed the store |
| Command | What it does |
|---|
envkit add <path> | Track a file, relative to ~. --from reads a list |
envkit rm <path> | Stop tracking. The local file is left alone |
envkit list | List tracked files |
| Command | Direction |
|---|
envkit backup | ~ → store. Secrets go to the keychain |
envkit load | store → ~. Won't clobber local changes without --force |
envkit status | Per-file state: in-sync, differs, missing-local, missing-store, other-os |
envkit diff <path> | Diff one tracked file between ~ and the store |
| Command | What it does |
|---|
envkit secret list | List managed key names. Never prints values |
envkit secret get <KEY> | Print a value. Missing key: empty + warning, exit 0 |
envkit secret set <KEY> [VALUE] | Store a value. Prompts if omitted; reads a pipe if not a terminal |
envkit secret rm <KEY> | Delete a value |
envkit exec KEY[:ENVNAME]... -- <cmd> | Run a command with secrets in its environment |
| Command | What it does |
|---|
envkit doctor | Check config, store, manifest, keychain, and leftover coupling |
0 success. Non-zero on a real failure — a keychain error, an unreadable store, a
backup blocked by the undeclared-secret scan.
The exception worth remembering: secret get on a missing key is exit 0 with
an empty value, so a typo cannot break shell startup. See Secrets.