config check: validates UUID format, recognized methods, keyfile
consistency and existence. Reports all issues with alias context.
remove: deletes a device from config by alias. Inverse of add.
status: --mounted, --unlocked, --locked flags filter the device table.
Flags combine as OR.
mount/unlock: display which method succeeded and key slot used, e.g.
"(fido2, key slot 1)". cryptsetup Open now runs with -v and parses
"Key slot N unlocked" from stderr via io.MultiWriter.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
unlock: decrypts a LUKS volume without mounting. Idempotent — reports
existing cleartext device if already unlocked.
lock: locks a LUKS volume. If mounted, unmounts first (udisks2 with
privileged fallback) then locks. Idempotent — reports if already locked.
Both commands support alias completion and config resolution.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
