Add unlock and lock commands for decrypt-only operations

unlock: decrypts a LUKS volume without mounting. Idempotent — reports
existing cleartext device if already unlocked.

lock: locks a LUKS volume. If mounted, unmounts first (udisks2 with
privileged fallback) then locks. Idempotent — reports if already locked.

Both commands support alias completion and config resolution.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/lock.go

@@ -0,0 +1,68 @@
+package cmd
+
+import (
+	"fmt"
+
+	"git.wntrmute.dev/kyle/arca/internal/config"
+	"git.wntrmute.dev/kyle/arca/internal/cryptsetup"
+	"git.wntrmute.dev/kyle/arca/internal/udisks"
+	"github.com/spf13/cobra"
+)
+
+var lockCmd = &cobra.Command{
+	Use:               "lock <device|alias>",
+	Short:             "Lock a LUKS volume without unmounting",
+	Long:              "Locks (closes) a LUKS volume. If the volume is mounted, it will be unmounted first.",
+	Args:              cobra.ExactArgs(1),
+	RunE:              runLock,
+	ValidArgsFunction: completeDeviceOrAlias,
+}
+
+func init() {
+	rootCmd.AddCommand(lockCmd)
+}
+
+func runLock(cmd *cobra.Command, args []string) error {
+	cfg := config.Load()
+	target := args[0]
+
+	client, err := udisks.NewClient()
+	if err != nil {
+		return fmt.Errorf("connecting to udisks2: %w", err)
+	}
+	defer client.Close()
+
+	devCfg := cfg.ResolveDevice(target)
+
+	dev, err := client.FindDevice(devCfg.UUID, target)
+	if err != nil {
+		return err
+	}
+
+	// Check if already locked.
+	cleartext, err := client.CleartextDevice(dev)
+	if err != nil {
+		fmt.Fprintf(cmd.ErrOrStderr(), "%s is already locked\n", target)
+		return nil
+	}
+
+	// If mounted, unmount first — can't lock a mounted device.
+	if mp, mounted := client.IsMounted(cleartext); mounted {
+		if err := client.Unmount(cleartext); err != nil {
+			if err := cryptsetup.Unmount(mp); err != nil {
+				return fmt.Errorf("unmounting before lock: %w", err)
+			}
+		}
+	}
+
+	// Lock: try udisks2 first, fall back to cryptsetup close.
+	if err := client.Lock(dev); err != nil {
+		mapperName := cryptsetup.MapperName(dev.DevicePath)
+		if err := cryptsetup.Close(mapperName); err != nil {
+			return fmt.Errorf("locking: %w", err)
+		}
+	}
+
+	fmt.Printf("Locked %s\n", target)
+	return nil
+}

cmd/mount.go

@@ -3,11 +3,13 @@ package cmd
 import (
 	"fmt"
 	"os"
+	"strings"
 
 	"git.wntrmute.dev/kyle/arca/internal/config"
 	"git.wntrmute.dev/kyle/arca/internal/cryptsetup"
 	"git.wntrmute.dev/kyle/arca/internal/udisks"
 	"git.wntrmute.dev/kyle/arca/internal/unlock"
+	"git.wntrmute.dev/kyle/arca/internal/verbose"
 	"github.com/spf13/cobra"
 	"golang.org/x/term"
 )
@@ -57,7 +59,18 @@ func runMount(cmd *cobra.Command, args []string) error {
 			fmt.Println(existing)
 			return nil
 		}
-		// Unlocked but not mounted — just mount it.
+		// Unlocked but not mounted — mount it. If the mapper name
+		// indicates arca opened it via cryptsetup (privileged path),
+		// use privileged mount since udisks2 won't authorize it.
+		if isPrivilegedMapping(dev) {
+			verbose.Printf("detected arca-managed mapping, using privileged mount")
+			mnt, err := cryptsetup.Mount(cleartext.DevicePath, mp)
+			if err != nil {
+				return fmt.Errorf("mounting: %w", err)
+			}
+			fmt.Println(mnt)
+			return nil
+		}
 		return doMount(client, cleartext, mp)
 	}
 
@@ -105,6 +118,14 @@ func doMount(client *udisks.Client, cleartext *udisks.BlockDevice, mp string) er
 	return nil
 }
 
+// isPrivilegedMapping checks if a LUKS device was opened via arca's
+// cryptsetup path by checking if the expected mapper name exists.
+func isPrivilegedMapping(dev *udisks.BlockDevice) bool {
+	expected := cryptsetup.MapperName(dev.DevicePath)
+	_, err := os.Stat("/dev/mapper/" + expected)
+	return err == nil && strings.HasPrefix(expected, "arca-")
+}
+
 func readPassphrase() (string, error) {
 	fmt.Fprint(os.Stderr, "Passphrase: ")
 	pass, err := term.ReadPassword(int(os.Stdin.Fd()))

cmd/unlock.go

@@ -0,0 +1,59 @@
+package cmd
+
+import (
+	"fmt"
+
+	"git.wntrmute.dev/kyle/arca/internal/config"
+	"git.wntrmute.dev/kyle/arca/internal/udisks"
+	"git.wntrmute.dev/kyle/arca/internal/unlock"
+	"github.com/spf13/cobra"
+)
+
+var unlockCmd = &cobra.Command{
+	Use:               "unlock <device|alias>",
+	Short:             "Unlock a LUKS volume without mounting",
+	Args:              cobra.ExactArgs(1),
+	RunE:              runUnlock,
+	ValidArgsFunction: completeDeviceOrAlias,
+}
+
+func init() {
+	rootCmd.AddCommand(unlockCmd)
+}
+
+func runUnlock(cmd *cobra.Command, args []string) error {
+	cfg := config.Load()
+	target := args[0]
+
+	client, err := udisks.NewClient()
+	if err != nil {
+		return fmt.Errorf("connecting to udisks2: %w", err)
+	}
+	defer client.Close()
+
+	devCfg := cfg.ResolveDevice(target)
+
+	dev, err := client.FindDevice(devCfg.UUID, target)
+	if err != nil {
+		return err
+	}
+
+	// Check if already unlocked.
+	if cleartext, err := client.CleartextDevice(dev); err == nil {
+		fmt.Printf("%s is already unlocked (%s)\n", target, cleartext.DevicePath)
+		return nil
+	}
+
+	u := unlock.New(client, unlock.Options{
+		ReadPassphrase: readPassphrase,
+		KeyfilePath:    devCfg.Keyfile,
+	})
+
+	result, err := u.Unlock(dev, devCfg.Methods)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Unlocked %s -> %s\n", target, result.Device.DevicePath)
+	return nil
+}