feat: added Config parsing.

.envrc

@@ -1 +1,3 @@
 use flake
+
+export PATH=".:./deps/zig:./deps/zls:$PATH"

.gitignore

@@ -1,10 +1,16 @@
 # dev env
 .direnv
 
+# dependencies
+deps
+vendor
+
 # docs
 man 
 
 # build artifacts
+.zig-cache
 builds
 envr
+envr-go
 result

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.2.1](https://github.com/sbrow/envr/compare/v0.2.0...v0.2.1) (2026-01-12)
+
+
+### Bug Fixes
+
+* Added `add` as an alias for backup. ([cf363ab](https://github.com/sbrow/envr/commit/cf363abc4d8cec208d23c6acedbb7e0dd6900332))
+
 ## [0.2.0](https://github.com/sbrow/envr/compare/v0.1.1...v0.2.0) (2025-11-10)
 
 

README.md

@@ -3,6 +3,10 @@
 Have you ever wanted to back up all your .env files in case your hard drive gets
 nuked? `envr` makes it easier.
 
+> [!CAUTION]
+> The Zig community is quite anti-AI. Please read the [AI Disclaimer](#ai-disclaimer)
+> before wasting your time.
+
 `envr` is a binary application that tracks your `.env` files
 in an encyrpted sqlite database. Changes can be effortlessly synced with
 `envr sync`, and restored with `envr restore`.
@@ -132,3 +136,13 @@ This project is licensed under the [MIT License](./LICENSE).
 
 For issues, feature requests, or questions, please
 [open an issue](https://github.com/sbrow/envr/issues).
+
+## AI Disclaimer
+
+Unless noted here, you can be assured that I have personally written and reviewed
+every line of code in this software.
+
+- Many compiler errors that couldn't be solved with a quick google search were
+solved by passing errors to AI and transcribing the suggestions.
+- The "Pre-Zig" version of this readme was written by AI and then edited by me.
+- The Go code was mostly written using opencode, and manually tested by me.

WINDOWS.md

@@ -0,0 +1,92 @@
+# Windows Compatibility Guide
+
+This document outlines Windows compatibility issues and solutions for the envr project.
+
+## Critical Issues
+
+### 1. Path Handling Bug (MUST FIX)
+
+**File:** `app/env_file.go:209`
+
+**Issue:** Uses `path.Join` instead of `filepath.Join`, which won't work correctly on Windows due to different path separators.
+
+**Current code:**
+```go
+f.Path = path.Join(newDir, path.Base(f.Path))
+```
+
+**Fixed code:**
+```go
+f.Path = filepath.Join(newDir, filepath.Base(f.Path))
+```
+
+## External Dependencies
+
+The application relies on external tools that need to be installed separately on Windows:
+
+### Required Tools
+
+1. **fd** - Fast file finder
+   - Install via: `winget install sharkdp.fd` or `choco install fd`
+   - Alternative: `scoop install fd`
+
+2. **git** - Version control system
+   - Install via: `winget install Git.Git` or download from git-scm.com
+   - Usually already available on most development machines
+
+## Minor Compatibility Notes
+
+### File Permissions
+- Unix file permissions (`0755`, `0644`) are used throughout the codebase
+- These are safely ignored on Windows - no changes needed
+
+### Editor Configuration
+**File:** `cmd/edit_config.go:20-24`
+
+**Issue:** Relies on `$EDITOR` environment variable which is less common on Windows.
+
+**Current behavior:** Fails if `$EDITOR` is not set
+
+**Recommended improvement:** Add fallback detection for Windows editors:
+```go
+editor := os.Getenv("EDITOR")
+if editor == "" {
+    if runtime.GOOS == "windows" {
+        editor = "notepad.exe"  // or "code.exe" for VS Code
+    } else {
+        fmt.Println("Error: $EDITOR environment variable is not set")
+        return
+    }
+}
+```
+
+## Installation Instructions for Windows
+
+1. Install required dependencies:
+   ```powershell
+   winget install sharkdp.fd
+   winget install Git.Git
+   ```
+
+2. Fix the path handling bug in `app/env_file.go:209`
+
+3. Build and run as normal:
+   ```powershell
+   go build
+   .\envr.exe init
+   ```
+
+## Testing on Windows
+
+After applying the critical path fix, the core functionality should work correctly on Windows. The application has been designed with cross-platform compatibility in mind, using:
+
+- `filepath` package for path operations (mostly)
+- `os.UserHomeDir()` for home directory detection
+- Standard Go file operations
+
+## Summary
+
+- **1 critical bug** must be fixed for Windows compatibility
+- **2 external tools** need to be installed
+- **1 minor enhancement** recommended for better Windows UX
+- Overall architecture is Windows-compatible

build.zig

@@ -0,0 +1,172 @@
+const std = @import("std");
+
+// Although this function looks imperative, it does not perform the build
+// directly and instead it mutates the build graph (`b`) that will be then
+// executed by an external runner. The functions in `std.Build` implement a DSL
+// for defining build steps and express dependencies between them, allowing the
+// build runner to parallelize the build automatically (and the cache system to
+// know when a step doesn't need to be re-run).
+pub fn build(b: *std.Build) void {
+    // Standard target options allow the person running `zig build` to choose
+    // what target to build for. Here we do not override the defaults, which
+    // means any target is allowed, and the default is native. Other options
+    // for restricting supported target set are available.
+    const target = b.standardTargetOptions(.{});
+    // Standard optimization options allow the person running `zig build` to select
+    // between Debug, ReleaseSafe, ReleaseFast, and ReleaseSmall. Here we do not
+    // set a preferred release mode, allowing the user to decide how to optimize.
+    const optimize = b.standardOptimizeOption(.{});
+    // It's also possible to define more custom flags to toggle optional features
+    // of this build script using `b.option()`. All defined flags (including
+    // target and optimize options) will be listed when running `zig build --help`
+    // in this directory.
+
+    const comma = b.addModule("comma", .{
+        .root_source_file = b.path("src/comma.zig"),
+        .target = target,
+    });
+
+    // This creates a module, which represents a collection of source files alongside
+    // some compilation options, such as optimization mode and linked system libraries.
+    // Zig modules are the preferred way of making Zig code available to consumers.
+    // addModule defines a module that we intend to make available for importing
+    // to our consumers. We must give it a name because a Zig package can expose
+    // multiple modules and consumers will need to be able to specify which
+    // module they want to access.
+    const mod = b.addModule("envr", .{
+        // The root source file is the "entry point" of this module. Users of
+        // this module will only be able to access public declarations contained
+        // in this file, which means that if you have declarations that you
+        // intend to expose to consumers that were defined in other files part
+        // of this module, you will have to make sure to re-export them from
+        // the root file.
+        .root_source_file = b.path("src/root.zig"),
+        // Later on we'll use this module as the root module of a test executable
+        // which requires us to specify a target.
+        .target = target,
+        .imports = &.{
+            .{ .name = "comma", .module = comma },
+        },
+    });
+
+    // Here we define an executable. An executable needs to have a root module
+    // which needs to expose a `main` function. While we could add a main function
+    // to the module defined above, it's sometimes preferable to split business
+    // logic and the CLI into two separate modules.
+    //
+    // If your goal is to create a Zig library for others to use, consider if
+    // it might benefit from also exposing a CLI tool. A parser library for a
+    // data serialization format could also bundle a CLI syntax checker, for example.
+    //
+    // If instead your goal is to create an executable, consider if users might
+    // be interested in also being able to embed the core functionality of your
+    // program in their own executable in order to avoid the overhead involved in
+    // subprocessing your CLI tool.
+    //
+    // If neither case applies to you, feel free to delete the declaration you
+    // don't need and to put everything under a single module.
+    const exe = b.addExecutable(.{
+        .name = "envr",
+        .root_module = b.createModule(.{
+            // b.createModule defines a new module just like b.addModule but,
+            // unlike b.addModule, it does not expose the module to consumers of
+            // this package, which is why in this case we don't have to give it a name.
+            .root_source_file = b.path("src/main.zig"),
+            // Target and optimization levels must be explicitly wired in when
+            // defining an executable or library (in the root module), and you
+            // can also hardcode a specific target for an executable or library
+            // definition if desireable (e.g. firmware for embedded devices).
+            .target = target,
+            .optimize = optimize,
+            // List of modules available for import in source files part of the
+            // root module.
+            .imports = &.{
+                // Here "envr" is the name you will use in your source code to
+                // import this module (e.g. `@import("envr")`). The name is
+                // repeated because you are allowed to rename your imports, which
+                // can be extremely useful in case of collisions (which can happen
+                // importing modules from different packages).
+                .{ .name = "comma", .module = comma },
+                .{ .name = "envr", .module = mod },
+            },
+        }),
+    });
+
+    const version = b.option([]const u8, "version", "application version string") orelse "dev";
+
+    const options = b.addOptions();
+    options.addOption([]const u8, "version", version);
+
+    exe.root_module.addOptions("config", options);
+
+    // This declares intent for the executable to be installed into the
+    // install prefix when running `zig build` (i.e. when executing the default
+    // step). By default the install prefix is `zig-out/` but can be overridden
+    // by passing `--prefix` or `-p`.
+    b.installArtifact(exe);
+
+    // This creates a top level step. Top level steps have a name and can be
+    // invoked by name when running `zig build` (e.g. `zig build run`).
+    // This will evaluate the `run` step rather than the default step.
+    // For a top level step to actually do something, it must depend on other
+    // steps (e.g. a Run step, as we will see in a moment).
+    const run_step = b.step("run", "Run the app");
+
+    // This creates a RunArtifact step in the build graph. A RunArtifact step
+    // invokes an executable compiled by Zig. Steps will only be executed by the
+    // runner if invoked directly by the user (in the case of top level steps)
+    // or if another step depends on it, so it's up to you to define when and
+    // how this Run step will be executed. In our case we want to run it when
+    // the user runs `zig build run`, so we create a dependency link.
+    const run_cmd = b.addRunArtifact(exe);
+    run_step.dependOn(&run_cmd.step);
+
+    // By making the run step depend on the default step, it will be run from the
+    // installation directory rather than directly from within the cache directory.
+    run_cmd.step.dependOn(b.getInstallStep());
+
+    // This allows the user to pass arguments to the application in the build
+    // command itself, like this: `zig build run -- arg1 arg2 etc`
+    if (b.args) |args| {
+        run_cmd.addArgs(args);
+    }
+
+    // Creates an executable that will run `test` blocks from the provided module.
+    // Here `mod` needs to define a target, which is why earlier we made sure to
+    // set the releative field.
+    const mod_tests = b.addTest(.{
+        .root_module = mod,
+    });
+
+    // A run step that will run the test executable.
+    const run_mod_tests = b.addRunArtifact(mod_tests);
+
+    // Creates an executable that will run `test` blocks from the executable's
+    // root module. Note that test executables only test one module at a time,
+    // hence why we have to create two separate ones.
+    const exe_tests = b.addTest(.{
+        .root_module = exe.root_module,
+    });
+
+    // A run step that will run the second test executable.
+    const run_exe_tests = b.addRunArtifact(exe_tests);
+
+    // A top level step for running all tests. dependOn can be called multiple
+    // times and since the two run steps do not depend on one another, this will
+    // make the two of them run in parallel.
+    const test_step = b.step("test", "Run tests");
+    test_step.dependOn(&run_mod_tests.step);
+    test_step.dependOn(&run_exe_tests.step);
+
+    // Just like flags, top level steps are also listed in the `--help` menu.
+    //
+    // The Zig build system is entirely implemented in userland, which means
+    // that it cannot hook into private compiler APIs. All compilation work
+    // orchestrated by the build system will result in other Zig compiler
+    // subcommands being invoked with the right flags defined. You can observe
+    // these invocations when one fails (or you pass a flag to increase
+    // verbosity) to validate assumptions and diagnose problems.
+    //
+    // Lastly, the Zig build system is relatively simple and self-contained,
+    // and reading its source code will allow you to master it.
+}

build.zig.zon

@@ -0,0 +1,81 @@
+.{
+    // This is the default name used by packages depending on this one. For
+    // example, when a user runs `zig fetch --save <url>`, this field is used
+    // as the key in the `dependencies` table. Although the user can choose a
+    // different name, most users will stick with this provided value.
+    //
+    // It is redundant to include "zig" in this name because it is already
+    // within the Zig package namespace.
+    .name = .envr,
+    // This is a [Semantic Version](https://semver.org/).
+    // In a future version of Zig it will be used for package deduplication.
+    .version = "0.3.0",
+    // Together with name, this represents a globally unique package
+    // identifier. This field is generated by the Zig toolchain when the
+    // package is first created, and then *never changes*. This allows
+    // unambiguous detection of one package being an updated version of
+    // another.
+    //
+    // When forking a Zig project, this id should be regenerated (delete the
+    // field and run `zig build`) if the upstream project is still maintained.
+    // Otherwise, the fork is *hostile*, attempting to take control over the
+    // original project's identity. Thus it is recommended to leave the comment
+    // on the following line intact, so that it shows up in code reviews that
+    // modify the field.
+    .fingerprint = 0xa89bf067266a3e10, // Changing this has security and trust implications.
+    // Tracks the earliest Zig version that the package considers to be a
+    // supported use case.
+    .minimum_zig_version = "0.16.0",
+    // This field is optional.
+    // Each dependency must either provide a `url` and `hash`, or a `path`.
+    // `zig build --fetch` can be used to fetch all dependencies of a package, recursively.
+    // Once all dependencies are fetched, `zig build` no longer requires
+    // internet connectivity.
+    .dependencies = .{
+        // See `zig fetch --save <url>` for a command-line interface for adding dependencies.
+        //.example = .{
+        //    // When updating this field to a new URL, be sure to delete the corresponding
+        //    // `hash`, otherwise you are communicating that you expect to find the old hash at
+        //    // the new URL. If the contents of a URL change this will result in a hash mismatch
+        //    // which will prevent zig from using it.
+        //    .url = "https://example.com/foo.tar.gz",
+        //
+        //    // This is computed from the file contents of the directory of files that is
+        //    // obtained after fetching `url` and applying the inclusion rules given by
+        //    // `paths`.
+        //    //
+        //    // This field is the source of truth; packages do not come from a `url`; they
+        //    // come from a `hash`. `url` is just one of many possible mirrors for how to
+        //    // obtain a package matching this `hash`.
+        //    //
+        //    // Uses the [multihash](https://multiformats.io/multihash/) format.
+        //    .hash = "...",
+        //
+        //    // When this is provided, the package is found in a directory relative to the
+        //    // build root. In this case the package's hash is irrelevant and therefore not
+        //    // computed. This field and `url` are mutually exclusive.
+        //    .path = "foo",
+        //
+        //    // When this is set to `true`, a package is declared to be lazily
+        //    // fetched. This makes the dependency only get fetched if it is
+        //    // actually used.
+        //    .lazy = false,
+        //},
+    },
+    // Specifies the set of files and directories that are included in this package.
+    // Only files and directories listed here are included in the `hash` that
+    // is computed for this package. Only files listed here will remain on disk
+    // when using the zig package manager. As a rule of thumb, one should list
+    // files required for compilation plus any license(s).
+    // Paths are relative to the build root. Use the empty string (`""`) to refer to
+    // the build root itself.
+    // A directory listed here means that all files within, recursively, are included.
+    .paths = .{
+        "build.zig",
+        "build.zig.zon",
+        "src",
+        // For example...
+        //"LICENSE",
+        //"README.md",
+    },
+}

cmd/backup.go

@@ -13,9 +13,10 @@ import (
 
 // backupCmd represents the backup command
 var backupCmd = &cobra.Command{
-	Use:   "backup <path>",
-	Short: "Import a .env file into envr",
-	Args:  cobra.ExactArgs(1),
+	Use:     "backup <path>",
+	Short:   "Import a .env file into envr",
+	Aliases: []string{"add"},
+	Args:    cobra.ExactArgs(1),
 	// Long: `Long desc`
 	RunE: func(cmd *cobra.Command, args []string) error {
 		path := args[0]

cmd/version.go

@@ -15,6 +15,7 @@ var (
 var long bool
 
 // versionCmd represents the version command
+// Deprecated: Remove when Zig has the chance to emit help
 var versionCmd = &cobra.Command{
 	Use:   "version",
 	Short: "Show envr's version",

fixtures/default_config.json

@@ -0,0 +1,20 @@
+{
+  "keys": [
+    {
+      "private": "/home/spencer/.ssh/id_ed25519",
+      "public": "/home/spencer/.ssh/id_ed25519.pub"
+    }
+  ],
+  "scan": {
+    "matcher": "\\.env",
+    "exclude": [
+      "*\\.envrc",
+      "\\.local",
+      "node_modules",
+      "vendor"
+    ],
+    "include": [
+      "~"
+    ]
+  }
+}

flake.lock

@@ -5,11 +5,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1751413152,
-        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "lastModified": 1768135262,
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
         "type": "github"
       },
       "original": {
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761597516,
-        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
         "type": "github"
       },
       "original": {
@@ -36,11 +36,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1751159883,
-        "narHash": "sha256-urW/Ylk9FIfvXfliA1ywh75yszAbiTEVgpPeinFyVZo=",
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "14a40a1d7fb9afa4739275ac642ed7301a9ba1ab",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -51,11 +51,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1751949589,
-        "narHash": "sha256-mgFxAPLWw0Kq+C8P3dRrZrOYEQXOtKuYVlo9xvPntt8=",
+        "lastModified": 1768178648,
+        "narHash": "sha256-kz/F6mhESPvU1diB7tOM3nLcBfQe7GU7GQCymRlTi/s=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9b008d60392981ad674e04016d25619281550a9d",
+        "rev": "3fbab70c6e69c87ea2b6e48aa6629da2aa6a23b0",
         "type": "github"
       },
       "original": {
@@ -80,11 +80,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "lastModified": 1768158989,
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
         "type": "github"
       },
       "original": {

flake.nix

@@ -100,6 +100,8 @@
                 # Build tools
                 zip
 
+                opencode
+
                 # IDE
                 unstable.helix
                 typescript-language-server

src/comma.zig

@@ -0,0 +1,146 @@
+//! By convention, root.zig is the root source file when making a package.
+const std = @import("std");
+const Io = std.Io;
+
+pub const Command = struct {
+    name: []const u8,
+    short: ?[]const u8 = null,
+    long: ?[]const u8 = null,
+    subcommands: []const Command = &.{},
+    examples: [][]const u8 = &.{},
+    /// The enum type of the command
+    Type: type,
+    /// The type of struct that holds the Commands's flags and arguments
+    // Params: type,
+
+    pub fn new(cmd: CommandOptions) Command {
+        const subcommands: [cmd.subcommands.len]Command = blk: {
+            var result: [cmd.subcommands.len]Command = undefined;
+            inline for (cmd.subcommands, 0..) |sub, idx| {
+                result[idx] = new(sub);
+            }
+            break :blk result;
+        };
+
+        return .{
+            .name = cmd.name,
+            .short = cmd.short,
+            .long = cmd.long,
+            .subcommands = &subcommands,
+            .Type = cmd.as_enum(),
+        };
+    }
+
+    pub fn parse(comptime self: @This(), args: []const []const u8) self.Type {
+        if (args.len == 0) {
+            return @enumFromInt(0);
+        }
+
+        const target = args[0];
+
+        inline for (self.subcommands, 1..) |cmd, idx| {
+            if (std.mem.eql(u8, target, cmd.name)) {
+                return @enumFromInt(idx);
+            }
+        }
+
+        return @enumFromInt(self.subcommands.len + 1);
+    }
+
+    /// Used for indentation when printing command help
+    const tab = "  ";
+
+    /// Print usage information to the console.
+    pub fn help(self: @This(), w: *Io.Writer) !void {
+        defer w.flush() catch {};
+
+        if (self.long) |long| {
+            try w.print("{s}\n\n", .{long});
+        }
+
+        try w.print("Usage:\n{s}{s}\n", .{ tab, self.name });
+
+        if (self.subcommands.len > 0) {
+            try w.print("\nAvailable Commands:\n", .{});
+
+            var max_width: u8 = 0;
+
+            inline for (self.subcommands) |cmd| {
+                max_width = @max(max_width, cmd.name.len);
+            }
+
+            // Print short command description
+            inline for (self.subcommands) |cmd| {
+                try w.print(
+                    "{s}{s}",
+                    .{
+                        tab,
+                        cmd.name,
+                    },
+                );
+
+                for (0..(max_width - cmd.name.len)) |_| {
+                    try w.print(" ", .{});
+                }
+
+                try w.print(
+                    " {s}\n",
+                    .{
+                        cmd.short orelse "",
+                    },
+                );
+            }
+
+            try w.print("\n", .{});
+        }
+
+        // TODO: Print flags
+
+        // TODO: Print arguments
+
+        if (self.subcommands.len > 0) {
+            try w.print(
+                "Use \"{s} [command] --help\" for more information about a command.",
+                .{self.name},
+            );
+        }
+    }
+};
+
+pub const ParseError = error{
+    InvalidType,
+};
+
+const CommandOptions = struct {
+    name: []const u8,
+    short: ?[]const u8 = null,
+    long: ?[]const u8 = null,
+    subcommands: []const CommandOptions = &[0]CommandOptions{},
+
+    fn as_enum(self: @This()) type {
+        var field_names: [self.subcommands.len + 2][]const u8 = undefined;
+        var field_values: [self.subcommands.len + 2]u32 = undefined;
+
+        field_names[0] = self.name;
+        field_values[0] = 0;
+
+        inline for (self.subcommands, 1..) |cmd, idx| {
+            field_names[idx] = cmd.name;
+            field_values[idx] = idx;
+        }
+
+        field_names[self.subcommands.len + 1] = "unknown";
+        field_values[self.subcommands.len + 1] = self.subcommands.len + 1;
+
+        return @Enum(
+            u32,
+            .exhaustive,
+            &field_names,
+            &field_values,
+        );
+    }
+};
+
+// /// parses the args into params
+// pub fn params(cmd: Command, args: [][]const u8) cmd.Params {
+// }

src/config.zig

@@ -0,0 +1,223 @@
+const std = @import("std");
+
+/// Keys that are available for encryption
+keys: []const SSHKeyPair,
+
+/// Rules for how to match the scan command
+scan: ScanConfig = .default,
+
+pub const SSHKeyPair = struct {
+    private: []const u8,
+    public: []const u8,
+
+    /// Caller owns the returned memory
+    pub fn from_path(gpa: std.mem.Allocator, path: []const u8) !SSHKeyPair {
+        if (std.mem.eql(u8, std.fs.path.extension(path), ".pub")){
+            return from_pub_path(path);
+        } else {
+            return .{
+                .public = try std.mem.concat(gpa, u8, &.{path, ".pub"}),
+                .private = path,
+            };
+        }
+    }
+
+    pub fn from_pub_path(path: []const u8) SSHKeyPair {
+        std.debug.assert(std.mem.eql(u8, std.fs.path.extension(path), ".pub"));
+
+        return .{
+            .public = path,
+            .private = path[0..path.len - 4],
+        };
+    }
+};
+
+/// Configuration for the scan command
+pub const ScanConfig = struct {
+    /// the file extension to look for
+    matcher: []const u8,
+
+    /// Glob patterns to ignore
+    exclude: []const []const u8,
+
+    /// paths to search in
+    include: []const []const u8,
+
+    const default: @This() = .{
+        .matcher = "\\.env",
+        .exclude = &.{
+            "*\\.envrc",
+            "\\.local",
+            "node_modules",
+            "vendor",
+        },
+        .include = &.{"~"},
+    };
+};
+
+/// Load the Config from the file at path
+pub fn load(
+    io: std.Io,
+    gpa: std.mem.Allocator,
+    path: []const u8,
+) !std.json.Parsed(@This()) {
+    var file = try std.Io.Dir.cwd().openFile(
+        io,
+        path,
+        .{ .mode = .read_only },
+    );
+    defer file.close(io);
+
+    var buffer: [4096]u8 = undefined;
+    var reader = file.reader(io, &buffer);
+
+    var json_reader: std.json.Reader = .init(gpa, &reader.interface);
+    defer json_reader.deinit();
+
+    return try std.json.parseFromTokenSource(
+        @This(),
+        gpa,
+        &json_reader,
+        .{},
+    );
+}
+
+/// Save the config to the given file
+pub fn save(
+    self: *@This(),
+    io: std.Io,
+    dir: std.Io.Dir,
+    path: []const u8,
+) !void {
+    // TODO: Remove dependence on string?
+    var string: std.Io.Writer.Allocating = .init(std.testing.allocator);
+    defer string.deinit();
+
+    try string.writer.print(
+        "{f}",
+        .{std.json.fmt(self, .{ .whitespace = .indent_2 })},
+    );
+
+    var file = try dir.createFile(io, path, .{ .truncate = true });
+    defer file.close(io);
+
+    try file.writeStreamingAll(io, string.written());
+}
+
+test "loading the default config from disk matches expected values" {
+    const gpa = std.testing.allocator;
+
+    const parsed = try load(std.testing.io, gpa, "./fixtures/default_config.json");
+    defer parsed.deinit();
+
+    const got = parsed.value;
+    try std.testing.expectEqualDeep(got.scan, ScanConfig.default);
+}
+
+test "saving to a new file upserts the file" {
+    const io = std.testing.io;
+
+    var cfg: @This() = .{
+        .keys = &.{
+          .from_pub_path("~/.ssh/id_ed25519.pub"),
+        },
+    };
+
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+
+    var dir = tmp.dir;
+
+    try std.testing.expectError(
+        error.FileNotFound,
+        dir.statFile(io, "config.json", .{}),
+    );
+
+    try cfg.save(io, dir, "config.json");
+
+    const contents = try dir.readFileAlloc(
+        io,
+        "config.json",
+        std.testing.allocator,
+        .unlimited,
+    );
+    defer std.testing.allocator.free(contents);
+
+    const want =
+        \\{
+        \\  "keys": [
+        \\    {
+        \\      "private": "~/.ssh/id_ed25519",
+        \\      "public": "~/.ssh/id_ed25519.pub"
+        \\    }
+        \\  ],
+        \\  "scan": {
+        \\    "matcher": "\\.env",
+        \\    "exclude": [
+        \\      "*\\.envrc",
+        \\      "\\.local",
+        \\      "node_modules",
+        \\      "vendor"
+        \\    ],
+        \\    "include": [
+        \\      "~"
+        \\    ]
+        \\  }
+        \\}
+    ;
+
+    try std.testing.expectEqualSlices(u8, want, contents);
+}
+
+test "saving to an existing file updates the file" {
+    const io = std.testing.io;
+
+    var cfg: @This() = .{
+        .keys = &.{
+            .from_pub_path("~/.ssh/id_ed25519.pub"),
+        },
+    };
+
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+
+    var dir = tmp.dir;
+
+    try dir.writeFile(io, .{ .sub_path = "config.json", .data = "{}" });
+    _ = try dir.statFile(io, "config.json", .{});
+
+    try cfg.save(io, dir, "config.json");
+
+    const contents = try dir.readFileAlloc(
+        io,
+        "config.json",
+        std.testing.allocator,
+        .unlimited,
+    );
+    defer std.testing.allocator.free(contents);
+
+    const want =
+        \\{
+        \\  "keys": [
+        \\    {
+        \\      "private": "~/.ssh/id_ed25519",
+        \\      "public": "~/.ssh/id_ed25519.pub"
+        \\    }
+        \\  ],
+        \\  "scan": {
+        \\    "matcher": "\\.env",
+        \\    "exclude": [
+        \\      "*\\.envrc",
+        \\      "\\.local",
+        \\      "node_modules",
+        \\      "vendor"
+        \\    ],
+        \\    "include": [
+        \\      "~"
+        \\    ]
+        \\  }
+        \\}
+    ;
+
+    try std.testing.expectEqualSlices(u8, want, contents);
+}

src/main.zig

@@ -0,0 +1,175 @@
+const std = @import("std");
+const Io = std.Io;
+
+const config = @import("config");
+
+const comma = @import("comma");
+const envr = @import("envr");
+
+const goBinary = "envr-go";
+
+pub fn main(init: std.process.Init) !void {
+    // This is appropriate for anything that lives as long as the process.
+    const arena: std.mem.Allocator = init.arena.allocator();
+
+    const args = try init.minimal.args.toSlice(arena);
+
+    try run(init.environ_map, init.io, arena, args);
+}
+
+/// Attempt to run the requested command.
+fn run(
+    environ_map: *std.process.Environ.Map,
+    io: Io,
+    arena: std.mem.Allocator,
+    args: []const [:0]const u8,
+) !void {
+    const cmd = envr.root.parse(args[1..]);
+    switch (cmd) {
+        .envr => {
+            var stdout_buffer: [4096]u8 = undefined;
+            var stdout_file_writer: Io.File.Writer = .init(.stdout(), io, &stdout_buffer);
+            const stdout_writer = &stdout_file_writer.interface;
+
+            return envr.root.help(stdout_writer);
+        },
+        .version => {
+            var stdout_buffer: [1024]u8 = undefined;
+            var stdout_file_writer: Io.File.Writer = .init(.stdout(), io, &stdout_buffer);
+            const stdout_writer = &stdout_file_writer.interface;
+
+            return version(stdout_writer);
+        },
+        .deps => {
+            var stdout_buffer: [1024]u8 = undefined;
+            var stdout_file_writer: Io.File.Writer = .init(.stdout(), io, &stdout_buffer);
+            const stdout_writer = &stdout_file_writer.interface;
+
+            return deps(
+                io,
+                stdout_writer,
+                environ_map.get("PATH").?,
+            );
+        },
+        .unknown => {
+            return fallback_to_go(io, arena, args);
+        },
+    }
+}
+
+fn version(writer: *Io.Writer) !void {
+    try writer.print("{s}\n", .{config.version});
+    try writer.flush();
+}
+
+// Display dependency statuses
+fn deps(
+    io: Io,
+    writer: *Io.Writer,
+    path: []const u8,
+) !void {
+    const feats: Features = try .scan(io, path);
+
+    // FIXME: Draw as a table
+    try writer.print("features: {}", .{feats});
+    try writer.flush();
+}
+
+const Features = packed struct {
+    git: bool = false,
+    fd: bool = false,
+    const all_features: Features = .{
+        .git = true,
+        .fd = true,
+    };
+
+    /// Scans your PATH variable for programs.
+    pub fn scan(io: Io, path: []const u8) !@This() {
+        var feats: Features = .{};
+
+        var dirs = std.mem.splitScalar(u8, path, std.fs.path.delimiter);
+
+        loop: while (dirs.next()) |dir| {
+            const dirt = Io.Dir.openDir(Io.Dir.cwd(), io, dir, .{ .follow_symlinks = true, .iterate = true }) catch continue;
+            defer dirt.close(io);
+
+            var dir_paths = dirt.iterate();
+
+            while (try dir_paths.next(io)) |file| {
+                // FIXME: Check if executable
+                if (std.mem.eql(u8, std.fs.path.basename(file.name), "git")) {
+                    feats.git = true;
+
+                    if (feats == Features.all_features) {
+                        break :loop;
+                    }
+                }
+
+                if (std.mem.eql(u8, std.fs.path.basename(file.name), "fd")) {
+                    feats.fd = true;
+
+                    if (feats == Features.all_features) {
+                        break :loop;
+                    }
+                }
+            }
+        }
+
+        return feats;
+    }
+};
+
+fn fallback_to_go(
+    io: Io,
+    arena: std.mem.Allocator,
+    args: []const [:0]const u8,
+) std.process.ReplaceError {
+    // Remap args
+    var childArgs = try std.ArrayList([]const u8).initCapacity(arena, args.len);
+    childArgs.appendAssumeCapacity(goBinary);
+
+    for (args[1..]) |arg| {
+        childArgs.appendAssumeCapacity(arg);
+    }
+
+    return std.process.replace(io, .{ .argv = childArgs.items });
+}
+
+test "simple test" {
+    const gpa = std.testing.allocator;
+    var list: std.ArrayList(i32) = .empty;
+    defer list.deinit(gpa); // Try commenting this out and see if zig detects the memory leak!
+    try list.append(gpa, 42);
+    try std.testing.expectEqual(@as(i32, 42), list.pop());
+}
+
+test "fuzz example" {
+    try std.testing.fuzz({}, testOne, .{});
+}
+
+fn testOne(context: void, smith: *std.testing.Smith) !void {
+    _ = context;
+    // Try passing `--fuzz` to `zig build test` and see if it manages to fail this test case!
+
+    const gpa = std.testing.allocator;
+    var list: std.ArrayList(u8) = .empty;
+    defer list.deinit(gpa);
+    while (!smith.eos()) switch (smith.value(enum { add_data, dup_data })) {
+        .add_data => {
+            const slice = try list.addManyAsSlice(gpa, smith.value(u4));
+            smith.bytes(slice);
+        },
+        .dup_data => {
+            if (list.items.len == 0) continue;
+            if (list.items.len > std.math.maxInt(u32)) return error.SkipZigTest;
+            const len = smith.valueRangeAtMost(u32, 1, @min(32, list.items.len));
+            const off = smith.valueRangeAtMost(u32, 0, @intCast(list.items.len - len));
+            try list.appendSlice(gpa, list.items[off..][0..len]);
+            try std.testing.expectEqualSlices(
+                u8,
+                list.items[off..][0..len],
+                list.items[list.items.len - len ..],
+            );
+        },
+    };
+}

src/root.zig

@@ -0,0 +1,77 @@
+//! By convention, root.zig is the root source file when making a package.
+const std = @import("std");
+const Io = std.Io;
+
+const comma = @import("comma");
+const Command = comma.Command;
+
+pub const root: Command = .new(.{
+    .name = "envr",
+    .short = "Manage your .env files.",
+    .long =
+    \\envr keeps your .env synced to a local, age encrypted database.
+    \\It is a safe and eay way to gather all your .env files in one place where they can
+    \\easily be backed by another tool such as restic or git.
+    \\All your data is stored in ~/data.age
+    \\
+    \\Getting started is easy:
+    \\
+    \\1. Create your configuration file and set up encrypted storage:
+    \\
+    \\> envr init
+    \\
+    \\2. Scan for existing .env files:
+    \\
+    \\> envr scan
+    \\
+    \\Select the files you want to back up from the interactive list.
+    \\
+    \\3. Verify that it worked:
+    \\
+    \\> envr list
+    \\
+    \\4. After changing any of your .env files, update the backup with:
+    \\
+    \\> envr sync
+    \\
+    \\5. If you lose a repository, after re-cloning the repo into the same path it was
+    \\at before, restore your backup with:
+    \\
+    \\> envr restore <path to repository> .env
+    ,
+    .subcommands = &.{
+        .{
+            .name = "deps",
+            .short = "Check for missing binaries",
+            .long =
+            \\envr relies on external binaries for certain functionality.
+            \\
+            \\ The deps command reports which binaries are available and which are not."
+            ,
+        },
+        .{
+            .name = "version",
+            .short = "Show envr's version",
+        },
+    },
+});
+
+test "enum type" {
+    const got: root.Type = @enumFromInt(2);
+
+    try std.testing.expectEqual(.version, got);
+}
+
+test "parse version" {
+    const args = &[_][]const u8{"version"};
+    const cmd = root.parse(args);
+
+    try std.testing.expectEqual(.version, cmd);
+}
+
+test "parse unknown" {
+    const args = &[_][]const u8{ "bad", "value" };
+    const cmd = root.parse(args);
+
+    try std.testing.expectEqual(.unknown, cmd);
+}