Hello world 👋

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/config.md

@@ -0,0 +1,119 @@
+# Config
+
+Optional, at `~/.config/lazysecrets/config.yaml` (or
+`$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags override
+it. Unknown keys are an error, so typos don't go unnoticed.
+
+```yaml
+icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
+clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
+revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
+hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
+expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
+timeout: 30s           # per backend request
+loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
+sourcesView: grouped   # or flat; ` toggles it
+collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
+updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
+history: true          # count uses of items for Recent (R)
+providers:
+  azure:                                 # applies to every az account
+    enabled: true                        # default
+    hideSubscriptions: [platform-mgmt]   # by name or ID
+    vaults:                              # listed under "Pinned vaults", for vaults
+      - https://kv-foo.vault.azure.net/  # you can read but not discover
+  databricks:
+    enabled: true
+    hideProfiles: [test]
+  repos:
+    enabled: true
+    roots: [~/git]
+    paths: [~/work/infra]
+    include: ["secrets/**"]
+    exclude: ["**/testdata/**"]
+```
+
+More, each on its own page: [repos](repos.md) (`providers.repos`), the
+[link handler](links.md#from-the-browser-and-chat) (`linkHandler`),
+[keybindings](keys.md#rebinding-keys) (`keybinding`) and
+[custom commands](custom-commands.md) (`customCommands`).
+
+## Clipboard
+
+The clipboard is the system clipboard locally and OSC52 over SSH (your
+terminal must allow OSC52 writes; in tmux, `set -g set-clipboard on`).
+
+## Theme
+
+Colours follow your terminal's 16-colour palette by default. A `theme:`
+section overrides roles with hex colours, palette numbers (0-255) or names,
+plus attributes (`bold`, `italic`, `underline`, `reverse`, `faint`). Role
+names follow lazygit's `gui.theme` where they mean the same thing:
+
+```yaml
+theme:
+  activeBorderColor: ["#ff966c", bold]   # focused pane
+  inactiveBorderColor: ["#589ed7"]
+  selectedLineBgColor: ["#2d3f76"]       # cursor row background (default: palette 8)
+  inactiveViewSelectedLineBgColor: ["#2f334d"]
+  defaultFgColor: ["#c8d3f5"]
+  optionsTextColor: ["#82aaff"]          # keys and labels
+  searchMatchColor: ["#ffc777", bold]
+  errorColor: ["#c53b53"]                # ✗ failures
+  noticeColor: ["#c3e88d"]
+  successColor: ["#c3e88d", bold]        # the ✓ before confirmations
+  warningColor: ["#ffc777"]              # ⚠ what can't be done here
+  mutedColor: ["#636da6"]
+  favouriteColor: ["#ffc777"]
+  valueColor: ["#ffc777"]
+  azureColor: ["#82aaff"]
+  databricksColor: ["#ff757f"]
+  repoColor: ["#c099ff"]
+```
+
+Icons need a [Nerd Font](https://www.nerdfonts.com) (v3+). If they render
+as boxes, turn them off with `icons: false`.
+
+## Layering
+
+Several config files can be layered, later ones winning (theme roles and
+keybindings merge one by one), with a comma-separated `--config` or
+`LAZYSECRETS_CONFIG_FILE`, like lazygit's `LG_CONFIG_FILE`. An editor
+plugin can so add a generated theme file to your own config, the way
+snacks.nvim themes lazygit from Neovim's highlight groups:
+
+```sh
+LAZYSECRETS_CONFIG_FILE=~/.config/lazysecrets/config.yaml,~/.cache/nvim/lazysecrets-theme.yml lazysecrets
+```
+
+## State
+
+Stars, notes, usage and the layout are kept in
+`~/.local/state/lazysecrets/state.json` (`$XDG_STATE_HOME`), readable only
+by you: one record per source, vault or secret, keyed by its
+`lazysecrets://` link, never with values. A star belongs to the account you
+starred the item under (a vault two of your accounts can see can be starred
+for one); a note describes the item, so it shows under every account. It's
+JSON so an editor plugin can read it with a built-in parser; several
+lazysecrets windows can save to it without losing each other's changes.
+
+Revealing, copying, opening in the browser, sharing and jumping to an item
+count as using it: its record keeps when it was last used and how often,
+for Recent (`R`). Records kept only for usage are dropped after 90 days
+unused, and beyond the 100 most recent. `history: false` stops counting.
+
+## Updates
+
+Once a day (`updateCheck`), in the background, lazysecrets asks the
+release server for the latest release; within the day it reuses the
+answer from the state file. Offline, or with the server down, it says
+nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
+`lazysecrets update --check`) shows its changelog.
+
+Updating (`u` there, or `lazysecrets update`) downloads the release for
+your OS and CPU, checks it against the release's `checksums.txt`, makes
+sure it runs, and only then replaces the binary, atomically: a
+lazysecrets that's running keeps working, and the next start is the new
+version. A binary a package manager owns (Homebrew, Nix, a distro
+package) is left to it. Development builds (`dev-…`) aren't offered
+releases.