> ## Documentation Index
> Fetch the complete documentation index at: https://capy.sc/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# capy status: Show Drift Between Local & Remote

> Read-only three-way diff of your secrets: pinned, local, and remote. Shows + - ~ ? symbols for every variable that differs. Safe to run anytime.

## Synopsis

```bash theme={null}
capy status
```

## Description

Reports the state of your secrets without modifying anything. `status` compares three sources for every variable - **pinned** (the hashes stored in `keep.lock`), **local** (what's in your `.env` right now, decrypted), and **remote** (what's on the service for this branch) - and prints every variable whose three versions don't all agree.

Purely read-only. Safe to run on a PR branch, in CI, or anywhere else you just want to know what `capy` would do.

See [Syncing → Conflicts](/using/syncing-secrets#conflicts-and-resolution) for the full list of states.

## Output

```bash theme={null}
$ capy status

capy: my-app (development)
x Local has changes (2 differences)
x Remote has changes (1 difference)

  ~ DATABASE_URL         (changed locally)
  + STRIPE_WEBHOOK_KEY   (new locally)
  - LEGACY_TOKEN         (missing from remote)

  Run capy to sync these changes.
```

### Symbols

| Symbol | Meaning                                                          |
| ------ | ---------------------------------------------------------------- |
| `+`    | Variable is new (present on one side, not pinned)                |
| `-`    | Variable is missing on one side                                  |
| `~`    | Value differs between sides                                      |
| `?`    | Couldn't reach remote (access denied, network error, or no data) |

### Headers

| Line                               | When                                                        |
| ---------------------------------- | ----------------------------------------------------------- |
| `> N secrets match pinned branch.` | All local values match `keep.lock`                          |
| `x Local has changes (…)`          | Your `.env` has diverged from pinned                        |
| `x Remote has changes (…)`         | The service's copy has diverged from pinned                 |
| `x Out of sync (…)`                | Both sides differ and remote couldn't be reached for detail |
| `> Remote is up to date.`          | Remote matches pinned                                       |
| `! Remote is empty.`               | First push hasn't happened yet - run `capy push`            |
| `! Could not reach remote: …`      | Access denied, network error, etc.                          |

## When remote is unreachable

If `status` can't reach the service (auth failure, network error, or no access to this branch), it falls back to a two-way comparison between pinned and local, and marks every variable with `?`:

```
capy: my-app (development)
x Out of sync (3 differences)
! Could not reach remote: you do not have access

  ? DATABASE_URL         (access denied)
  ? REDIS_URL            (access denied)
  ? STRIPE_KEY           (access denied)

  If you have already been invited, run capy redeem [invite-code] to access these secrets.
```

EOF