SOPS Decrypt

Decrypt .enc.yaml files back to their plaintext .env originals.

Workflow

1. Detect current state:

   python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>
   

2. Verify prerequisites:

   • tools.sops.installed must be true — if not, tell user to install: brew install sops (macOS) or download binary (Linux)
   • age_key.exists must be true — if not, guide user to place their age private key at the expected path, or set SOPS_AGE_KEY_FILE env var

3. Show encrypted files from project.encrypted_files. If empty, report "No encrypted files found" and exit.

4. Use AskUserQuestion (multiSelect: true) — which files to decrypt. For each, show the target output name (e.g., .env.local.enc.yaml → .env.local). If the target file already exists, note it will be overwritten.