Synopsis
Description
Reports the state of your secrets without modifying anything. status compares three sources for every variable - pinned (the hashes stored in keep.lock), local (what’s in your .env right now, decrypted), and remote (what’s on the service for this branch) - and prints every variable whose three versions don’t all agree.
Purely read-only: it never writes .env, never rewrites keep.lock, and never changes the remote. Safe to run on a PR branch, in CI, or anywhere else you just want to know what capy would do.
status always exits 0 - including when it finds drift and when it can’t reach the remote - so don’t gate a CI job on its exit code.
See Syncing → Conflicts for the full list of states.
Output
Symbols
When remote is unreachable
If status can’t reach the service (auth failure, network error, or no access to this branch), it drops the remote side and labels every row it prints with ? - it has no remote value to compare against. When the failure happens while resolving your project key, it can’t decrypt your local values either, so every pinned variable is listed:
Local-only mode
In local-only mode there’s no service to reach, so the “remote” side comes from the encrypted blob Capy stored on this machine. Capy unlocks your local key first, prompting for the passphrase when the session has expired. If nothing is stored for the current keep.lock, status prints ! Could not reach remote: no data at this keep_hash and labels each row (no data) - nothing went over the network.Last modified on August 11, 2026
