feat: lazysecrets list prints everything lazysecrets can find, for fzf and editor pickers (#70)

`lazysecrets list` prints every source, vault and secret lazysecrets can find, one per line, for fzf, editor pickers and scripts: what Go to searches, without the TUI. What's cached prints at once; what's missing or older than `--max-age` loads in the background and streams in. It stops when the reader goes (a pick in fzf), saving what it loaded.

- Text: kind, mark (✗/⚠, ★, ◷ and the provider icon), name, status (why it couldn't be read, or expired / expires in 12d), note, account and link, tab-separated; kind first and account and link last, so new fields go between. Coloured from the theme; `--color never`, `--icons=false`, `--stars=false`, `--recent`, `--notes=false`, `--expiry=false`.
- `--format json`: an object per line, with starred, recent, lastUsed and uses, expires, enabled, note, reference and url too.
- `--kind` lists only some kinds, and doesn't load lists only other kinds need; `--cached` loads nothing.
- `lazysecrets open --action go|copy|show` skips the "what to do" menu and ends in the list, like Go to; `open` and `get` take `--account`, the account list printed, rather than asking which.
- The cache file moved to `internal/cachefile`: saves merge with the file under a lock, so list and the TUI don't undo each other.
- `ui.recentIcon` marks items used lately with ◷ in the TUI's lists too; Recent now means the last 90 days.
- --demo has stars, notes, recent use, and expired, expiring and disabled secrets.
- docs/integration.md documents get, list and an fzf picker; docs/links.md is docs/sharing.md.

Reviewed-on: #70
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>

cmd/lazysecrets/get.go

@@ -37,10 +37,15 @@ func value(ctx context.Context, providers []provider.Provider, st *store.Store,
 	return v, err
 }
 
-// readKey is value, also returning the version read.
+// readKey is value, also returning the version read. The account asked
+// for (--account) goes first, else the one that last read it.
 func readKey(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, string, error) {
 	key := r
 	key.Version = ""
 	node := st.Node(key.String())
-	return ref.Read(ctx, providers, r, node.Account, node.Source)
+	account, source := node.Account, node.Source
+	if r.Account != "" && r.Account != account {
+		account, source = r.Account, ""
+	}
+	return ref.Read(ctx, providers, r, account, source)
 }

cmd/lazysecrets/list.go

@@ -0,0 +1,269 @@
+package main
+
+import (
+	"cmp"
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"slices"
+	"strings"
+	"syscall"
+	"time"
+
+	"charm.land/lipgloss/v2"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
+	"git.kebcloud.no/keb/lazysecrets/internal/listing"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
+)
+
+// listCmd prints every source, vault and secret lazysecrets can find, one
+// per line, for fzf, editor pickers and scripts:
+//
+//	lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1
+//
+// Each line is the kind, a mark (✗ or ⚠, ★, ◷ and the provider's icon),
+// the name, a status (why it couldn't be read, or that it has expired or
+// expires soon; else empty), its note (muted, or empty), the account and
+// the link, tab-separated. The mark has a field of its own so a search can
+// leave it out (fzf --nth), and ^prod finds names starting with prod. The
+// name is coloured from the theme,
+// with the provider's icon (as in the TUI: --icons, LAZYSECRETS_ICONS,
+// ui.icons); the link never is.
+//
+// What's cached prints at once; what's missing or older than --max-age
+// follows as it loads. A list that can't be read is a line too, as it
+// fails: the vault or source, then ✗ and why in the theme's error colour.
+// They're in the output rather than on stderr, which would draw over fzf.
+func listCmd(providers []provider.Provider, st *store.Store, cachePath string, timeout func(provider.Kind) time.Duration, theme styles.Styles, withIcons, withRecent bool, expiryWarn time.Duration, args []string, out io.Writer) error {
+	fs := flag.NewFlagSet("list", flag.ContinueOnError)
+	cached := fs.Bool("cached", false, "only what's cached, and repos: load nothing from Azure or Databricks")
+	maxAge := fs.Duration("max-age", 2*time.Minute, "load cached lists older than this again")
+	format := fs.String("format", "text", "text: kind, mark, name, status, note, account and link, tab-separated; json: an object per line")
+	color := fs.String("color", "always", "colour the names (text): always or never; fzf needs --ansi")
+	iconsOn := fs.Bool("icons", withIcons, "put the provider's Nerd Font icon before names (text)")
+	stars := fs.Bool("stars", true, "put ★ before starred names, in the theme's favouriteColor (text)")
+	recent := fs.Bool("recent", withRecent, "put ◷ before names used lately, in mutedColor (text; default ui.recentIcon)")
+	notes := fs.Bool("notes", true, "start a note with a note icon (✎ without --icons) (text; the note is printed either way)")
+	expiry := fs.Bool("expiry", true, "mark and say which have expired (✗ expired) or expire within ui.expiryWarningDays (⚠ expires in 12d) (text)")
+	kinds := fs.String("kind", "", "only these kinds, comma-separated: "+strings.Join(listing.Kinds, ", ")+" (vault: also scopes and repo files)")
+	showErrors := fs.Bool("errors", true, "list the lists that can't be read, with why (text: ✗ lines; json: \"error\")")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() > 0 {
+		return fmt.Errorf("usage: lazysecrets list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]")
+	}
+	var only []string
+	for k := range strings.SplitSeq(*kinds, ",") {
+		if k = strings.TrimSpace(k); k == "" {
+			continue
+		}
+		if !slices.Contains(listing.Kinds, k) {
+			return fmt.Errorf("--kind: %q is not one of %s", k, strings.Join(listing.Kinds, ", "))
+		}
+		only = append(only, k)
+	}
+	if *color != "always" && *color != "never" {
+		return fmt.Errorf("--color: %q is not always or never", *color)
+	}
+	now := time.Now()
+	m := marks{theme: theme, icons: icons.None, stars: *stars, recent: *recent, expiry: *expiry,
+		color: *color == "always", warn: expiryWarn, now: now}
+	if *iconsOn {
+		m.icons = icons.NerdFont
+	}
+	var write func(listing.Entry) error
+	switch *format {
+	case "text":
+		write = func(e listing.Entry) error {
+			colored := *color == "always"
+			mark := m.of(e)
+			name := nameOf(e, theme, colored)
+			// Why it couldn't be read (vaults, sources), or when it
+			// expires (secrets, keys, certificates): never both.
+			status := errorOf(e, theme, colored)
+			if status == "" && *expiry {
+				status = expiryOf(e, theme, expiryWarn, now, colored)
+			}
+			note := noteOf(e, theme, m.icons, *notes, colored)
+			// A tab or line break in a name would break the line up.
+			_, err := fmt.Fprintf(out, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", e.Kind, mark, oneLine.Replace(name), oneLine.Replace(status),
+				oneLine.Replace(note), e.Account, e.Link)
+			return err
+		}
+	case "json":
+		enc := json.NewEncoder(out)
+		enc.SetEscapeHTML(false)
+		write = func(e listing.Entry) error { return enc.Encode(e) }
+	default:
+		return fmt.Errorf("--format: %q is not text or json", *format)
+	}
+
+	// When the reader goes away (a pick in fzf), writing fails instead of
+	// killing the process, so what loaded is still saved.
+	signal.Notify(make(chan os.Signal, 1), syscall.SIGPIPE)
+	var gone error
+	emit := func(e listing.Entry) error {
+		if e.Error != "" && !*showErrors {
+			return nil
+		}
+		if err := write(e); err != nil {
+			gone = err
+			return err
+		}
+		return nil
+	}
+
+	f := cachefile.New()
+	if cachePath != "" {
+		f = cachefile.Read(cachePath)
+	}
+	f, loaded := listing.Run(context.Background(), listing.Options{
+		Providers: providers, Cache: f, MaxAge: *maxAge, Cached: *cached, Kinds: only, Timeout: timeout,
+		Mark: func(link, account string) listing.Marks {
+			n := st.Node(link)
+			return listing.Marks{Starred: n.StarredFor(account), Recent: n.UsedLately(now),
+				LastUsed: n.LastUsed, Uses: n.Uses, Note: n.Note}
+		},
+	}, emit)
+	// Only what was loaded: list never moves a cursor, so the TUI's stay.
+	if cachePath != "" && loaded {
+		f.Cursor = nil
+		if err := cachefile.Save(cachePath, f, cachefile.Keep(providers), time.Now()); err != nil {
+			return err
+		}
+	}
+	if gone != nil && !errors.Is(gone, syscall.EPIPE) {
+		return gone
+	}
+	return nil // or the reader has what it wanted
+}
+
+var oneLine = strings.NewReplacer("\t", " ", "\r\n", " ", "\n", " ", "\r", " ")
+
+// noteOf is the entry's note, muted, after a note icon (✎ without Nerd
+// Font icons) with icon; or "".
+func noteOf(e listing.Entry, theme styles.Styles, iconSet icons.Set, icon, color bool) string {
+	if e.Note == "" {
+		return ""
+	}
+	note := e.Note
+	if icon {
+		note = cmp.Or(iconSet.Note, "✎") + " " + note
+	}
+	return renderer(color)(theme.Muted, note)
+}
+
+// expiryOf says that a secret, key or certificate has expired, in red,
+// or when it will if that's within warn (expires in 12d), in yellow, or
+// is "". Its mark (✗, ⚠) is before the name.
+func expiryOf(e listing.Entry, theme styles.Styles, warn time.Duration, now time.Time, color bool) string {
+	render := renderer(color)
+	switch state, left := expiry.Of(e.Expires, now, warn); state {
+	case expiry.Expired:
+		return render(theme.Error, "expired")
+	case expiry.Soon:
+		return render(theme.Warning, "expires in "+expiry.Left(left))
+	}
+	return ""
+}
+
+// errorOf is why a list couldn't be read, in red, or "". Its mark (✗)
+// is before the name.
+func errorOf(e listing.Entry, theme styles.Styles, color bool) string {
+	return renderer(color)(theme.Error, e.Error)
+}
+
+// nameOf is an entry's name for the text format: the path with the
+// item's own name standing out, and the account.
+func nameOf(e listing.Entry, theme styles.Styles, color bool) string {
+	render := renderer(color)
+	var name string
+	if n := len(e.Path); n > 0 {
+		if n > 1 {
+			name = render(theme.Muted, strings.Join(e.Path[:n-1], " / ")+" / ")
+		}
+		name += e.Path[n-1]
+	}
+	if e.AccountLabel != "" {
+		name += render(theme.Muted, " · "+e.AccountLabel)
+	}
+	return name
+}
+
+// marks says what goes before the name, in a field of its own so a
+// search leaves it out: ✗ in red when something's wrong (it couldn't be
+// read, or has expired) or ⚠ when it expires within warn; ★ for a starred
+// entry and ◷ for one used lately, as the TUI marks them; then the
+// provider's icon. The marks are right-aligned in room for every kind
+// turned on, so they sit by the icon and names line up.
+type marks struct {
+	theme                        styles.Styles
+	icons                        icons.Set
+	stars, recent, expiry, color bool
+	warn                         time.Duration // ui.expiryWarningDays
+	now                          time.Time
+}
+
+func (m marks) of(e listing.Entry) string {
+	render := renderer(m.color)
+	var parts []string
+	room := 0 // marks turned on
+	mark := func(on bool, st lipgloss.Style, s string) {
+		room++
+		if on {
+			parts = append(parts, render(st, s))
+		}
+	}
+	// What's wrong, then what to watch: room for one of them.
+	state := expiry.None
+	if m.expiry {
+		state, _ = expiry.Of(e.Expires, m.now, m.warn)
+	}
+	switch {
+	case e.Error != "" || state == expiry.Expired:
+		mark(true, m.theme.Error, "✗")
+	case state == expiry.Soon:
+		mark(true, m.theme.Warning, "⚠")
+	default:
+		mark(false, m.theme.Error, "")
+	}
+	if m.stars {
+		mark(e.Starred, m.theme.Favourite, "★")
+	}
+	if m.recent {
+		mark(e.Recent, m.theme.Muted, "◷")
+	}
+	pad := strings.Repeat("  ", room-len(parts)) // each mark and its space
+	kind := provider.Kind("")
+	for _, k := range []provider.Kind{provider.KindAzure, provider.KindDatabricks, provider.KindRepo} {
+		if strings.EqualFold(string(k), e.Provider) {
+			kind = k
+		}
+	}
+	if icon := strings.TrimSpace(m.icons.Prefix(kind)); icon != "" {
+		parts = append(parts, render(m.theme.Kind(kind), icon))
+	} else if len(parts) == 0 {
+		pad = strings.TrimSuffix(pad, " ") // no mark after the room
+	}
+	return pad + strings.Join(parts, " ")
+}
+
+func renderer(color bool) func(lipgloss.Style, string) string {
+	return func(st lipgloss.Style, s string) string {
+		if !color || s == "" {
+			return s
+		}
+		return st.Render(s)
+	}
+}

cmd/lazysecrets/list_test.go

@@ -0,0 +1,152 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/listing"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
+)
+
+func TestListNames(t *testing.T) {
+	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-app-prod", "db-password"}, AccountLabel: "alice"}
+	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-app-prod / db-password · alice" {
+		t.Errorf("plain: %q", got)
+	}
+	// The item's own name isn't muted with its path.
+	if got := nameOf(e, styles.Default(), true); !strings.Contains(got, "\x1b[mdb-password") {
+		t.Errorf("name not set apart: %q", got)
+	}
+}
+
+func TestListMarks(t *testing.T) {
+	az := icons.NerdFont.Azure
+	plain := marks{theme: styles.Default(), icons: icons.NerdFont, stars: true}
+	noIcons := plain
+	noIcons.icons = icons.None
+	colored := noIcons
+	colored.color = true
+	for _, c := range []struct {
+		m    marks
+		e    listing.Entry
+		want string
+	}{
+		// Room for the status mark and the star, so names line up.
+		{plain, listing.Entry{Provider: "azure", Starred: true}, "  ★ " + az},
+		{plain, listing.Entry{Provider: "azure"}, "    " + az},
+		{marks{icons: icons.NerdFont}, listing.Entry{Provider: "azure", Starred: true}, "  " + az},
+		{noIcons, listing.Entry{Provider: "azure", Starred: true}, "  ★"},
+		{marks{}, listing.Entry{Provider: "azure", Starred: true}, " "},
+		{colored, listing.Entry{Provider: "azure", Starred: true}, "  " + styles.Default().Favourite.Render("★")},
+	} {
+		if got := c.m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+}
+
+func TestListRecentMarks(t *testing.T) {
+	az := icons.NerdFont.Azure
+	m := marks{icons: icons.NerdFont, stars: true, recent: true}
+	for _, c := range []struct {
+		e    listing.Entry
+		want string
+	}{
+		// Right-aligned in room for three: by the icon, names lined up.
+		{listing.Entry{Provider: "azure", Starred: true, Recent: true}, "  ★ ◷ " + az},
+		{listing.Entry{Provider: "azure", Recent: true}, "    ◷ " + az},
+		{listing.Entry{Provider: "azure"}, "      " + az},
+	} {
+		if got := m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+}
+
+func TestListExpiry(t *testing.T) {
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	warn := 30 * 24 * time.Hour
+	for _, c := range []struct {
+		expires time.Time
+		want    string
+	}{
+		{time.Time{}, ""},
+		{now.Add(-time.Hour), "expired"},
+		{now.Add(12*24*time.Hour + time.Hour), "expires in 12d"},
+		{now.Add(5 * time.Hour), "expires in 5h"},
+		{now.Add(60 * 24 * time.Hour), ""},
+	} {
+		if got := expiryOf(listing.Entry{Expires: c.expires}, styles.Default(), warn, now, false); got != c.want {
+			t.Errorf("expires %v: %q, want %q", c.expires, got, c.want)
+		}
+	}
+	if got := expiryOf(listing.Entry{Expires: now.Add(-time.Hour)}, styles.Default(), warn, now, true); got != styles.Default().Error.Render("expired") {
+		t.Errorf("expired isn't red: %q", got)
+	}
+}
+
+func TestListNotes(t *testing.T) {
+	e := listing.Entry{Note: "rotate in May"}
+	if got := noteOf(e, styles.Default(), icons.NerdFont, true, false); got != icons.NerdFont.Note+" rotate in May" {
+		t.Errorf("icons: %q", got)
+	}
+	if got := noteOf(e, styles.Default(), icons.None, true, false); got != "✎ rotate in May" {
+		t.Errorf("no icons: %q", got)
+	}
+	if got := noteOf(e, styles.Default(), icons.NerdFont, false, false); got != "rotate in May" {
+		t.Errorf("--notes=false: %q", got)
+	}
+	if got := noteOf(listing.Entry{}, styles.Default(), icons.NerdFont, true, true); got != "" {
+		t.Errorf("no note: %q", got)
+	}
+}
+
+func TestListStatusMark(t *testing.T) {
+	az := icons.NerdFont.Azure
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	m := marks{icons: icons.NerdFont, stars: true, expiry: true, warn: 30 * 24 * time.Hour, now: now}
+	for _, c := range []struct {
+		e    listing.Entry
+		want string
+	}{
+		// Right-aligned in room for two, as with ★ and ◷.
+		{listing.Entry{Provider: "azure", Error: "403 Forbidden"}, "  ✗ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}, "  ✗ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour), Starred: true}, "✗ ★ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(5 * 24 * time.Hour)}, "  ⚠ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(60 * 24 * time.Hour), Starred: true}, "  ★ " + az},
+	} {
+		if got := m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+	m.expiry = false // --expiry=false: no ⚠ or ✗ for expiry; errors still
+	if got := m.of(listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}); got != "    "+az {
+		t.Errorf("--expiry=false: %q", got)
+	}
+	m.expiry, m.color, m.theme = true, true, styles.Default()
+	if got := m.of(listing.Entry{Error: "403"}); !strings.Contains(got, styles.Default().Error.Render("✗")) {
+		t.Errorf("not a red ✗: %q", got)
+	}
+	if got := m.of(listing.Entry{Expires: now.Add(time.Hour)}); !strings.Contains(got, styles.Default().Warning.Render("⚠")) {
+		t.Errorf("not a yellow ⚠: %q", got)
+	}
+}
+
+func TestListErrors(t *testing.T) {
+	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-restricted"}, Error: "403 Forbidden"}
+	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-restricted" {
+		t.Errorf("the name has more: %q", got)
+	}
+	if got := errorOf(e, styles.Default(), false); got != "403 Forbidden" {
+		t.Errorf("plain: %q", got)
+	}
+	if got := errorOf(e, styles.Default(), true); got != styles.Default().Error.Render("403 Forbidden") {
+		t.Errorf("why isn't red: %q", got)
+	}
+	if got := errorOf(listing.Entry{}, styles.Default(), true); got != "" {
+		t.Errorf("no error: %q", got)
+	}
+}

cmd/lazysecrets/main.go

@@ -89,6 +89,32 @@ func cmpOr(a, b string) string {
 	return b
 }
 
+// refArg parses get's and open's arguments: a reference, and optionally
+// the account to use when several could (lazysecrets list's column) and,
+// for open, what to do with it rather than asking (--action).
+func refArg(cmd string, args []string) (r ref.Ref, action string, err error) {
+	fs := flag.NewFlagSet(cmd, flag.ContinueOnError)
+	account := fs.String("account", "", "the account to use when several could, as lazysecrets list prints it")
+	usage := "usage: lazysecrets get [--account <account>] <ref>"
+	act := new(string)
+	if cmd == "open" {
+		act = fs.String("action", "", "do this rather than ask: go (to it), copy (go, and copy its value) or show (go, and show it)")
+		usage = "usage: lazysecrets open [--account <account>] [--action go|copy|show] <ref>"
+	}
+	if err := fs.Parse(args); err != nil {
+		return r, "", err
+	}
+	if fs.NArg() != 1 {
+		return r, "", errors.New(usage)
+	}
+	if _, ok := app.OpenActions[*act]; *act != "" && !ok {
+		return r, "", fmt.Errorf("--action: %q is not go, copy or show", *act)
+	}
+	r, err = ref.Parse(fs.Arg(0))
+	r.Account = *account
+	return r, *act, err
+}
+
 // defaultConfigPath is $LAZYSECRETS_CONFIG_FILE, else config.yaml in the
 // config directory.
 func defaultConfigPath() string {
@@ -115,12 +141,18 @@ func run() error {
 	flag.Usage = func() {
 		fmt.Fprintf(flag.CommandLine.Output(), `Usage:
   lazysecrets [flags]             browse secrets
-  lazysecrets [flags] [open] <ref>
+  lazysecrets [flags] [open [--account <account>] [--action go|copy|show]] <ref>
                                   open a lazysecrets:// link (also a share link),
                                   Key Vault URL, @Microsoft.KeyVault(...) or
                                   {{secrets/scope/key}}
-  lazysecrets [flags] get <ref>   print the value a lazysecrets:// link points at,
+  lazysecrets [flags] get [--account <account>] <ref>
+                                  print the value a lazysecrets:// link points at,
                                   for scripts: VAR=$(lazysecrets get <ref>)
+  lazysecrets [flags] list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]
+                          [--color always|never] [--icons=false] [--errors=false]
+                                  print every source, vault and secret it can
+                                  find, one per line, for fzf and pickers:
+                                  what's cached at once, then what loads
   lazysecrets [flags] share [--key <secret>] <env file>...
                                   print a link to env files of a repo, encrypted
                                   with a secret's value (default: sharing.key)
@@ -146,7 +178,8 @@ Flags:
 	}
 
 	var open, getRef *ref.Ref
-	var shareArgs []string
+	var openAction string
+	var shareArgs, listArgs []string
 	printKeys := false
 	switch args := flag.Args(); {
 	case len(args) > 0 && args[0] == "share":
@@ -154,10 +187,12 @@ Flags:
 		if len(shareArgs) == 0 {
 			shareArgs = []string{} // still sharing: says how
 		}
+	case len(args) > 0 && args[0] == "list":
+		listArgs = append([]string{}, args[1:]...) // not nil: listing
 	case len(args) == 1 && args[0] == "keybindings":
 		printKeys = true
-	case len(args) == 2 && args[0] == "get":
-		r, err := ref.Parse(args[1])
+	case len(args) > 0 && args[0] == "get":
+		r, _, err := refArg("get", args[1:])
 		if err != nil {
 			return err
 		}
@@ -169,12 +204,12 @@ Flags:
 	case len(args) > 0 && args[0] == "update":
 		return updateCmd(*configPath, args[1:])
 	case len(args) == 0:
-	case args[0] == "open" && len(args) == 2:
-		r, err := ref.Parse(args[1])
+	case args[0] == "open" && len(args) >= 2:
+		r, act, err := refArg("open", args[1:])
 		if err != nil {
 			return err
 		}
-		open = &r
+		open, openAction = &r, act
 	case len(args) == 1 && looksLikeRef(args[0]):
 		// lazysecrets <link>, like lazysecrets open <link>
 		r, err := ref.Parse(args[0])
@@ -263,6 +298,8 @@ Flags:
 		}
 	}
 
+	recentIcon := cfg.UI.RecentIcon != nil && *cfg.UI.RecentIcon
+
 	// Stars, notes and the layout. Demo mode keeps them in memory, so
 	// sample vaults never end up in the real file.
 	stateDir, err := config.StateDir()
@@ -283,9 +320,14 @@ Flags:
 	var providers []provider.Provider
 	if *demo {
 		// Two Azure accounts, like a personal and an admin login in az.
+		alice, admin := "Azure:alice@example.com/demo", "Azure:admin.alice@example.com/demo"
+		fake.Seed(st, alice, admin)
+		az := fake.Azure(400*time.Millisecond).As(alice, "Azure · alice")
+		// Due soon whenever the demo runs (the tests' dates are fixed).
+		az.Expire("kv-app-prod", "api-key", time.Now().AddDate(0, 0, 9).Truncate(24*time.Hour))
 		providers = []provider.Provider{
-			fake.Azure(400*time.Millisecond).As("Azure:alice@example.com/demo", "Azure · alice"),
-			fake.AzureOps(700*time.Millisecond).As("Azure:admin.alice@example.com/demo", "Azure · admin.alice"),
+			az,
+			fake.AzureOps(700*time.Millisecond).As(admin, "Azure · admin.alice"),
 			fake.Databricks(600 * time.Millisecond),
 			fake.Repos(),
 		}
@@ -345,6 +387,13 @@ Flags:
 		defer cancel()
 		return get(ctx, providers, st, *getRef)
 	}
+	if listArgs != nil {
+		cachePath := ""
+		if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
+			cachePath = filepath.Join(d, "cache.json")
+		}
+		return listCmd(providers, st, cachePath, timeoutFor, theme, *icons, recentIcon, time.Duration(expiryDays)*24*time.Hour, listArgs, os.Stdout)
+	}
 	if shareArgs != nil {
 		// The files from a repo, the key from whichever provider it's
 		// in: the longest timeout.
@@ -433,6 +482,8 @@ Flags:
 		ShareKey:       cfg.Sharing.Key,
 		ShareRules:     shareRules(cfg),
 		Open:           open,
+		OpenAction:     openAction,
+		RecentIcon:     recentIcon,
 		Styles:         &theme,
 		DefaultFg:      defaultFg,
 	})