Function run 

pub fn run(
    repo: &Repo,
    key_source: Option<KeySource<'_>>,
    key_only: bool,
) -> Result<Report>

Unlocks repo, optionally installing the key at key_source first.

With key_only the working tree is left exactly as it is: the key goes in, the filter and the managed section are repaired, and nothing is decrypted. That was a command of its own until 2026-08-06 — import-key — and it is a flag now because the two differed by this one step and by nothing else, while unlock <key-file> was already the path every message pointed at. The evidence check still runs, so a key the working tree’s own headers contradict is refused here exactly as it is on the full path.

Errors

Error::NoKey when no key is given and none is present. Error::Config when .git-xcrypt cannot be understood, or when the repository already holds a key other than the one offered — note that this second case is code 2 rather than the 4 a file-level mismatch reports, because the refusal comes from the repository’s own key file and not from anything a header said. Error::Format when a file in the working tree belongs to another key. Error::Io on a read or write failure.