feat: add 'envapor keys' to list stored keys

- config.ListKeys returns key names from the keys directory
- Marks the current repository's mapped key when run inside a repo
- Prints a keygen hint when no keys exist yet

🤖 Generated with Claude Code

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ranaroussi

README.md

@@ -89,6 +89,7 @@ Parsing **fails closed**: a value is left in plaintext *only* on an unambiguous
 | Command | Purpose |
 |---|---|
 | `envapor keygen NAME` | Generate a new key at `~/.config/envapor/keys/NAME` |
+| `envapor keys` | List stored keys, marking the current repository's key |
 | `envapor init NAME` or `--pem PATH` | Configure filters, hook, `.gitattributes`, and map the repo to a key (by stored name or key file) |
 | `envapor doctor` | Diagnose the setup (filters, hook, mapping, coverage, crypto round-trip) |
 | `envapor status` | Show the mapping and per-file encryption state |

docs/user-guide.md

@@ -234,6 +234,13 @@ If a managed `.env` file is git-ignored, it would silently never be committed. B
 
 Generates a new key with safe defaults and writes it to `~/.config/envapor/keys/NAME`. Refuses to overwrite an existing key unless you pass `--force`.
 
+### `envapor keys`
+
+Lists the keys stored in the keys directory (`~/.config/envapor/keys/` by
+default), one per line. When run inside an initialized repository, the key
+mapped to that repository is marked. Prints a hint instead when no keys exist
+yet.
+
 ### `envapor init [KEY_NAME]` / `envapor init --pem PATH`
 
 Sets up Envapor in the current repository. The key is given either as the name

src/internal/cmd/keys.go

@@ -0,0 +1,47 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/automazeio/envapor/internal/config"
+	"github.com/automazeio/envapor/internal/gitutil"
+	"github.com/spf13/cobra"
+)
+
+var keysCmd = &cobra.Command{
+	Use:   "keys",
+	Short: "List stored encryption keys",
+	Args:  cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		names, err := config.ListKeys()
+		if err != nil {
+			return err
+		}
+		if len(names) == 0 {
+			dir, err := config.KeysDir()
+			if err != nil {
+				return err
+			}
+			fmt.Printf("No keys found in %s (create one with 'envapor keygen NAME').\n", dir)
+			return nil
+		}
+		active := ""
+		if gitutil.InsideRepo() {
+			if name, err := resolveKeyName(); err == nil {
+				active = name
+			}
+		}
+		for _, name := range names {
+			if name == active {
+				fmt.Printf("%s  (this repository)\n", name)
+			} else {
+				fmt.Println(name)
+			}
+		}
+		return nil
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(keysCmd)
+}

src/internal/config/config.go

@@ -211,6 +211,30 @@ func SecureKey(name string) error {
 	return nil
 }
 
+// ListKeys returns the names of the keys stored in the keys directory, in
+// lexical order. A missing keys directory yields an empty list, not an error.
+func ListKeys() ([]string, error) {
+	dir, err := KeysDir()
+	if err != nil {
+		return nil, err
+	}
+	entries, err := os.ReadDir(dir)
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("envapor: reading keys dir: %w", err)
+	}
+	var names []string
+	for _, e := range entries {
+		if e.IsDir() || strings.HasPrefix(e.Name(), ".") {
+			continue
+		}
+		names = append(names, e.Name())
+	}
+	return names, nil
+}
+
 // KeyExists reports whether a named key file is present.
 func KeyExists(name string) bool {
 	path, err := KeyPath(name)

src/internal/config/config_test.go

@@ -19,6 +19,25 @@ func TestKeyPathRejectsUnsafeNames(t *testing.T) {
 	}
 }
 
+func TestListKeys(t *testing.T) {
+	t.Setenv("ENVAPOR_HOME", t.TempDir())
+	if names, err := ListKeys(); err != nil || len(names) != 0 {
+		t.Fatalf("ListKeys on missing dir = %v, %v; want empty, nil", names, err)
+	}
+	for _, name := range []string{"team", "ci"} {
+		if _, err := WriteKey(name, []byte("pem")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	names, err := ListKeys()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(names) != 2 || names[0] != "ci" || names[1] != "team" {
+		t.Fatalf("ListKeys = %v, want [ci team]", names)
+	}
+}
+
 func TestWriteKeyCorrectsPermissions(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("Unix permission bits are not enforced on Windows")