Module lock 

git-xcrypt lock — close an unlocked repository, and delete its key.

This is the most expensive command in the product to get wrong. .git/ is neither versioned nor pushed, so the key file it removes is the only copy anywhere; unlock will not undo that, whatever its name suggests. Worse, the loss is deferred: nothing breaks at the moment it runs, and the truth surfaces months later at the first attempt to read anything. Most of this module is therefore refusals, not work.

The order of operations is the whole design. Prove the working tree holds nothing that would be lost → warn and ask → encrypt every selected file → then remove the key. Reversed, an interruption would leave a working tree in the clear with no key left to encrypt it with, which is the one state this command must never produce.

Selection is by pattern, not by header — the mirror image of unlock, and necessarily so: a plaintext file carries no header saying it is a secret, so .git-xcrypt is the only thing that can say. The encryption itself goes through decide::clean, the very function git calls on the check-in path, so the bytes this command writes are the bytes that are already committed. That is what makes git status clean afterwards, and it is why line-ending handling cannot drift between the two.

Two refusals, for two different losses. The key is one; uncommitted work is the other, and --yes waives only the first. Content that is not stored in the repository exists nowhere but in the file lock is about to encrypt, and after the key is gone that is the same as gone. The founding document is explicit that this deserves a decision of its own.

Everything this command cannot verify, it refuses over. A directory it cannot list might hold a secret; an index it cannot parse cannot vouch for anything. unlock skips such things and says so, because there the cost of skipping is a file left encrypted. Here it would be a plaintext secret left behind by the command that promised to remove it, so the two commands lean opposite ways on purpose.

Structs

Ask

The default: shows the warning and waits for the word yes.

Assumed

--yes: shows the warning, asks nothing.

Report

What lock did.

Warning

Everything lock says before it does anything irreversible.

Enums

Outcome

How a run ended.

Traits

Confirm

Decides whether the irreversible half of lock may go ahead.

Functions

run

Locks repo: encrypts every selected file, then removes the key.