Commands
Status
See where you are at a glance: account, linked project and environment, agent state, and sync.
klef status
The "where am I" command. It reports everything about your current context in one view, and it runs without unlocking, so it never prompts for your encryption password.
klef statusIt reports four things:
- Account which email you are signed in as, or a prompt to run
klef login. - Project the project and environment the current directory is linked to
(from
.klef), plus the list of available environments. It says so plainly when the directory has no.klef. - Agent whether
klef-agentis running, and if so locked or unlocked with the idle and hard-cap expiry. - Sync a comparison of your local
.env.localagainst the current environment: how many keys are on each side, how many are only local (would push), and how many are only on the server (would pull).
Example
Account
✓ signed in as you@example.com
Project
· my-app (proj_a1b2c3)
· environment: development
· available: development, staging, production
Agent
· unlocked
· idle until: 2026-05-24T14:00:00Z
Sync
· 12 local, 11 on the server (development, key names only)
+ 2 keys only local
- 1 key only on the server
· run `klef diff` to compare values, `klef push`/`klef pull` to syncOptions
| Flag | Description |
|---|---|
-e, --env <name> | Compare against this environment instead of the .klef default. |
Keys, not values
The sync summary compares key names only, which are stored in plaintext.
That is why klef status needs no password. To compare the actual values, run
klef diff.
klef status always exits 0. It is a report, not a gate, so it is safe to run
anytime.