refactor: drop dead code and use the standard library where it already does the job

No behaviour change.

- Deleted, unused or one-line wrappers: panes.RuneIndexes, Detail.Refresh (SetDescribed does it), SecretValue.Len, Query.Empty, Clipboard.Native, config.Load, get's value, Model.done, providerOf (cachefile.ProviderOf), contextWithTimeout, searchCoverage, startCrawl, showKeybindings, the expiry aliases and daysLeft.
- cmp.Or instead of the two cmpOr copies; slices.Sorted(maps.Keys(…)), maps.Copy, wg.Go, utf8.RuneCountInString and new(true) instead of loops and helpers that do the same.
- A container's pane title is set once, not twice; a redundant length check in share links and a no-op assignment in linkhandler.Launch are gone.
- Tests call ansi.Strip and lastLines directly; gofmt -s on links.go.

.gitignore

@@ -1,33 +1,13 @@
-# ---> Go
-# If you prefer the allow list template instead of the deny list, see community template:
-# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
-#
-# Binaries for programs and plugins
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-
-# Test binary, built with `go test -c`
-*.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
-
-# Dependency directories (remove the comment below to include it)
-# vendor/
-
-# Go workspace file
-go.work
-go.work.sum
-
-# env file
-.env
-
-
 # Build output
 /lazysecrets
 
 # Release builds (GoReleaser, see .goreleaser.yaml)
 /dist/
+
+# go test -c, coverage profiles
+*.test
+*.out
+
+go.work
+go.work.sum
+.env

README.md

@@ -7,24 +7,23 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 ## Main features
 
 - **Read-only**: lazysecrets never creates, changes or deletes a secret.
-  That's by design and may stay that way.
 - **Zero setup**: uses the logins you already have (`az`, the Databricks
   CLI, `sops`, `git`). No config file needed.
 - **Search everything**: `ctrl+s` searches every source at once, with
   fzf-style matching.
 - **Share links**: Share `lazysecrets://` links with colleagues.
-- **Neovim integration**: via [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
 - **Careful with values**: values stay hidden until you reveal them, and
   copied values are cleared from the clipboard after 30 seconds.
-- **Scriptable**: `lazysecrets get <link>` prints a value for scripts and
+- **Scriptable**: `get`, `list` and `open` for scripts, fzf and editor
-  pipes.
+  pickers; [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
+  for Neovim.
 - **Favourites**: star the secrets you use most for easy access.
 - **Expiry warnings**: secrets, keys and certificates that expire soon are
   marked, listed together in the status pane.
 - **Your way**: rebind any key, pick a theme, and add custom commands to run
   on a secret.
 - **Try it first**: `lazysecrets --demo` runs on built-in sample data.
-- **Supported platforms**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos. 
+- **Sources**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos.
 
 > **Early development:** expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.
 
@@ -45,9 +44,8 @@ Both approaches will install the latest release from [GitHub](https://github.com
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
 
-lazysecrets looks for a newer release once a day: the footer then shows
+`U` (or `lazysecrets update`) updates in place when there's a newer
-`↑ v0.2.0`, and `U` shows its changelog and updates in place (or run
+release.
-`lazysecrets update`).
 
 Or build it yourself:
 `go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest`.
@@ -70,30 +68,20 @@ use most:
 | `l` / `h` | the details of what's selected / back |
 | `/` | filter the list you're in |
 | `space` | reveal / hide the value |
-| `y` | copy the value (cleared from the clipboard after 30s) |
+| `y` | copy the value |
 | `ctrl+s` | Go to: search everything and jump there |
 | `f` / `F` | star / your favourites |
 | `s` | copy a link to share |
 | `?` | every key, searchable |
 | `q` | quit |
 
-
 ## Integration
-Lazysecret let you integrate it into your workflows by `lazysecrets` `list`/`get`/`open`
 
-Here is an example of implementing a picker in `fzf`:
+`lazysecrets list`, `get` and `open` plug lazysecrets into fzf, editor
-```sh
+pickers and scripts: see [Integration](docs/integration.md#an-fzf-picker).
-lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1 \
-  --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
-  --bind 'ctrl-o:become(lazysecrets open --action go --account {-2} {-1})' \
-  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {3})' \
-  --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'
-```
 
 ![fzf-example](docs/assets/fzf-example.png)
 
-More defails in the [Integration](docs/integration.md) docs
-
 ## Docs
 
 - [Keys](docs/keys.md): every key, Go to, the layout, and rebinding keys

cmd/lazysecrets/main.go

@@ -143,6 +143,7 @@ func run() error {
                                   for scripts: VAR=$(lazysecrets get <ref>)
   lazysecrets [flags] list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]
                           [--color always|never] [--icons=false] [--errors=false]
+                          [--stars=false] [--notes=false] [--recent] [--expiry=false]
                                   print every source, vault and secret it can
                                   find, one per line, for fzf and pickers:
                                   what's cached at once, then what loads

cmd/lazysecrets/version.go

@@ -11,13 +11,13 @@ import (
 //	go build -ldflags "-X main.version=1.2.3" ./cmd/lazysecrets
 var version string
 
-// versionString is the release version, or for other builds what Go
-// recorded: the module version (go install …@v1.2.3), else the commit
-// (dev-c1a4f90, -dirty with changes not committed).
 // pseudo matches a Go pseudo-version (v0.1.3-0.20261014174204-1c31a75d0507,
 // maybe +dirty): its commit.
 var pseudo = regexp.MustCompile(`[-.]\d{14}-([0-9a-f]{12})(\+.*)?$`)
 
+// versionString is the release version, or for other builds what Go
+// recorded: the module version (go install …@v1.2.3), else the commit
+// (dev-c1a4f90, -dirty with changes not committed).
 func versionString() string {
 	if version != "" {
 		return version

docs/azure.md

@@ -16,7 +16,7 @@ A service principal is used instead when `AZURE_CLIENT_ID`,
 On an account's group row, the fourth pane shows who it signs in as: name,
 user, tenant, object ID, whether the session used MFA, directory roles
 (built-in ones by name) and its subscriptions, read from az's account list
-and the token lazysecrets already has: no requests of their own. `y` on
+and the token lazysecrets already has. `y` on
 the row copies the object ID, the one access policies and role
 assignments ask for; `l` goes into the pane, where `j`/`k` pick any
 field, `/` filters them (`/tenant`) and `y` copies the selected one.
@@ -67,9 +67,8 @@ fetched. `v` lists an item's versions. Items expiring within
 
 The status pane (`0`) lists them across every vault loaded, opened or
 cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`
-on one goes to it. That makes no requests of its own: expiry dates come
+on one goes to it. Expiry dates come with the lists. It says how many
-with the lists. It says how many vaults it covers; `ctrl+a` in search
+vaults it covers; `ctrl+a` in search loads the rest.
-loads the rest.
 
 On a vault, the right pane shows its settings: resource group, location,
 SKU, whether access is by Azure roles or access policies, soft delete and

docs/config.md

@@ -1,10 +1,11 @@
 # Config
 
 Optional, at `~/.config/lazysecrets/config.yaml` (or
-`$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags override
+`$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags (noted
-it. Unknown keys are an error, so typos don't go unnoticed. `e` on the
+below) override it. Unknown keys are an error, so typos don't go
-status pane (`0`) opens it in your editor, as in lazygit (making it if
+unnoticed. `e` on the status pane (`0`) opens it in your editor, as in
-it isn't there yet); changes apply when lazysecrets starts again.
+lazygit (making it if it isn't there yet); changes apply when lazysecrets
+starts again.
 
 ```yaml
 ui:
@@ -17,7 +18,7 @@ ui:
 values:
   revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
   hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
-  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
+  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables; also --clipboard-clear
 storage:
   cache: true            # keep what was loaded (never values) for the next start
   history: true          # count uses of items for Recent (R)
@@ -28,32 +29,15 @@ updates:
     - https://github.com/karleinarb/lazysecrets
     - https://git.kebcloud.no/keb/lazysecrets
 providers:
-  timeout: 30s                           # per backend request; a provider's own timeout overrides it
+  timeout: 30s           # per backend request; a provider's own timeout overrides it; also --timeout
-  azure:                                 # applies to every az account
+  azure:                 # likewise databricks and repos; azure covers every az account
-    enabled: true                        # default
+    enabled: true        # default
     timeout: 30s
-    hideSubscriptions: [platform-mgmt]   # by name or ID
-    vaults:                              # listed under "Pinned vaults", for vaults
-      - https://kv-foo.vault.azure.net/  # you can read but not discover
-  databricks:
-    enabled: true
-    timeout: 30s
-    hideProfiles: [test]
-  repos:
-    enabled: true
-    timeout: 30s
-    roots: [~/git]
-    paths: [~/work/infra]
-    include: ["secrets/**"]
-    exclude: ["**/testdata/**"]
-sharing:               # sharing env files as encrypted links
-  key: https://kv-team.vault.azure.net/secrets/env-share  # or its lazysecrets:// link; for repos naming none
-  keyRules:            # what a key's value must be
-    minLength: 32      # characters, 16 at least
-    minClasses: 2      # kinds: lowercase, uppercase, digits, symbols
 ```
 
-More, each on its own page: [repos](repos.md) (`providers.repos`),
+More, each on its own page: [Azure](azure.md#vaults-you-cant-discover)
+(`providers.azure`), [Databricks](databricks.md) (`providers.databricks`),
+[repos](repos.md#which-files) (`providers.repos`),
 [sharing env files](sharing.md#sharing-env-files) (`sharing`), the
 [link handler](sharing.md#from-the-browser-and-chat) (`linkHandler`),
 [keybindings](keys.md#rebinding-keys) (`keybinding`) and
@@ -102,9 +86,8 @@ as boxes, turn them off with `ui.icons: false`.
 
 Several config files can be layered, later ones winning (theme roles and
 keybindings merge one by one), with a comma-separated `--config` or
-`LAZYSECRETS_CONFIG_FILE`, like lazygit's `LG_CONFIG_FILE`. An editor
+`LAZYSECRETS_CONFIG_FILE`, like lazygit's `LG_CONFIG_FILE`; e.g. your
-plugin can so add a generated theme file to your own config, the way
+config plus an editor-generated theme:
-snacks.nvim themes lazygit from Neovim's highlight groups:
 
 ```sh
 LAZYSECRETS_CONFIG_FILE=~/.config/lazysecrets/config.yaml,~/.cache/nvim/lazysecrets-theme.yml lazysecrets
@@ -117,11 +100,10 @@ Stars, notes, usage and the layout are kept in
 by you: one record per source, vault or secret, keyed by its
 `lazysecrets://` link, never with values. A star belongs to the account you
 starred the item under (a vault two of your accounts can see can be starred
-for one); a note describes the item, so it shows under every account. It's
+for one); a note describes the item, so it shows under every account.
-JSON so an editor plugin can read it with a built-in parser; several
+Several lazysecrets windows can save to it without losing each other's
-lazysecrets windows can save to it without losing each other's changes.
+changes. One written by a newer lazysecrets is read but not saved to,
-One written by a newer lazysecrets is read but not saved to, with a
+with a warning, until you update.
-warning, until you update.
 
 Revealing, copying, opening in the browser, sharing and jumping to an item
 count as using it: its record keeps when it was last used and how often,
@@ -157,8 +139,9 @@ until then it reuses the answer from the state file. Releases are
 published on GitHub and on git.kebcloud.no, and it asks them in that
 order, the next when one doesn't answer within 5 seconds;
 `updates.sources` lists others, such as a mirror of your own. Offline, or with
-every server down, it says nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
+every server down, it says nothing. A newer release shows in the status
-`lazysecrets update --check`) shows what changed since your version, across the last 10 releases.
+pane, `↑ v0.2.0`; `U` (or `lazysecrets update --check`) shows what
+changed since your version, across the last 10 releases.
 
 Updating (`u` there, or `lazysecrets update`) downloads the release for
 your OS and CPU from the first server that has it, checks it against

docs/development.md

@@ -12,7 +12,7 @@ repo, pick `kv-shared-prod / env-share` (the second account's) as the
 key, then paste the link back. The demo repos aren't on disk, so opening
 asks where to save, as for a repo you haven't cloned.
 
-A stripped binary is about 21 MB instead of 30 MB:
+A stripped binary is a third smaller:
 
 ```sh
 go build -trimpath -ldflags "-s -w" -o lazysecrets ./cmd/lazysecrets
@@ -35,10 +35,8 @@ subject, checked by `pr-title.yml`:
 | `fix` | a bug fix | Fixed |
 | `refactor`, `docs`, `test`, `ci`, `chore`, `build`, `style`, `revert` | everything users don't need to hear about | no |
 
-`feat!:` marks a breaking change, `feat(scope):` names a part. Brackets
+`feat!:` marks a breaking change, `feat(scope):` names a part.
-and a missing space work too: `[feat] x`, `[feat]: x` and `feat:x` all
+`[skip changelog]` in the description leaves a pull request out.
-become `feat: x` in the changelog. `[skip changelog]` in the description
-leaves a pull request out.
 
 CI (`ci.yml`) runs gofmt, vet, staticcheck, the tests and a build for each
 platform on pull requests into `main`. `main` is protected: a pull request

docs/integration.md

@@ -34,7 +34,7 @@ tab-separated:
 | name | `platform-prod / kv-app-prod / db-password` |
 | status | why a vault or source couldn't be read, or that it has `expired` or `expires in 12d` (within `ui.expiryWarningDays`), or empty |
 | note | your note on it (`n` in lazysecrets), after a note icon (✎ without icons), or empty |
-| account | what it's listed through: an az account (`Azure:<user>/<tenant>`), `Databricks` or `Repos` |
+| account | what it's listed through: `Azure` (`Azure:<user>/<tenant>` with several az accounts), `Databricks` or `Repos` |
 | link | its `lazysecrets://` link |
 
 What's cached prints at once, then what loads follows as it arrives: read
@@ -47,7 +47,7 @@ so `^prod` finds names starting with prod.
 | Flag | |
 |---|---|
 | `--format json` | an object per line instead, for editor plugins (below) |
-| `--kind secret,vault` | only these kinds: `source`, `vault`, `secret`, `key`, `certificate`; lists only other kinds need aren't loaded |
+| `--kind secret,vault` | only these kinds: `source`, `vault` (also scopes and repo files), `secret`, `key`, `certificate`; lists they don't need aren't loaded |
 | `--cached` | only what's cached, at once: nothing is loaded from Azure or Databricks |
 | `--max-age 2m` | load cached lists older than this again |
 | `--errors=false` | leave out the vaults and sources it couldn't read |
@@ -77,12 +77,11 @@ may be added:
 | `expires` | when a secret, key or certificate expires, if it does (Azure) |
 | `enabled` | `false` for a disabled one; only where the provider says (Azure) |
 
-`lazysecrets open --action go --account <account> <link>` opens one in
+[`lazysecrets open --action go --account <account> <link>`](sharing.md#opening-a-link)
-lazysecrets without asking what to do or which account, ending in the
+opens one in lazysecrets without asking what to do or which account.
-secrets list, like Go to.
 
+### An fzf picker
 
-### Example usage with fzf
 ```sh
 lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1 \
   --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
@@ -90,5 +89,6 @@ lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --
   --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {3})' \
   --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'
 ```
+
 ![fzf-example](assets/fzf-example.png)
 

docs/keys.md

@@ -49,7 +49,7 @@ match case exactly.
 | Key | Action |
 |---|---|
 | `space` | reveal / hide the selected value (public material for keys and certificates) |
-| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID; in its pane, the selected field |
+| `y` | copy the value without revealing it. On an Azure account's row: its object ID; in its pane, the selected field |
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
@@ -63,10 +63,8 @@ match case exactly.
 A revealed value is shown as it reads best: JSON indented, and PEM
 certificates as their subject, issuer, dates, names and thumbprint, with
 any other PEM block (a private key) named but not shown. `y` still copies
-it exactly as stored.
+it exactly as stored. It hides again after a while, and when the terminal
-
+loses focus ([config](config.md)).
-A revealed value hides again after `values.revealTimeout` (60s) and
-when the terminal loses focus (`values.hideOnBlur`); see [config](config.md).
 
 ## Stars and notes
 
@@ -75,8 +73,7 @@ when the terminal loses focus (`values.hideOnBlur`); see [config](config.md).
 | `f` | star the selected source, vault or secret: it gets a ★ and sorts first in its list |
 | `n` | write a short note on it, shown dimmed on its row and in the detail pane |
 
-A star belongs to the account you starred the item under; a note shows
+Both are kept in the [state file](config.md#state).
-under every account. Both are kept in the [state file](config.md#state).
 
 ## Go to
 
@@ -124,15 +121,16 @@ it's hidden.
 On top, the status pane (`0`) shows the version, a newer release and how
 your accounts are doing; `e` there opens your [config](config.md) in your
 editor, as in lazygit. Focused, the right pane lists more under the
-logo (when there's room): the version and updates (`U`), each account
+logo; `y` copies any row:
-(`L` on one that needs it signs in), what's expiring (`enter` goes to
+
-it), this session's errors, newest first (what a pane showed, or the
+- the version and updates (`U`)
-footer flashed before you moved on; not kept after quitting), the config,
+- each account (`L` on one that needs it signs in)
-state and cache files (`e` opens one in your editor), and links to the
+- what's expiring (`enter` goes to it)
-docs, source, issues, releases and changelog (`o` opens one; on the
+- this session's errors, newest first (not kept after quitting)
-version or update, its release), then the changelog of every release up
+- the config, state and cache files (`e` opens one in your editor)
-to yours, built in so it needs no network: `/` filters it (`/fixed`,
+- links to the docs, source, issues, releases and changelog (`o` opens one)
-`/search`). `y` copies any row.
+- the changelog of every release up to yours, built in: `/` filters it
+  (`/fixed`, `/search`)
 
 | Key | Action |
 |---|---|
@@ -141,9 +139,8 @@ to yours, built in so it needs no network: `/` filters it (`/fixed`,
 | `+` / `_` | zoom the focused pane: normal → half → full screen, and back |
 | `=` | reset the layout (divider, heights, zoom) |
 
-The divider and pane heights are remembered (zoom isn't). macOS uses
+The divider and pane heights are remembered (zoom isn't). `<>{}` are for
-ctrl+arrows for Mission Control and switching desktops by default, hence
+macOS, where ctrl+arrows switch desktops.
-the `<` `>` `{` `}` alternatives.
 
 ## Rebinding keys
 

docs/repos.md

@@ -100,13 +100,5 @@ sops 3.8 or later.
 
 ## Links
 
-`S` → `f` shares env files as an [encrypted link](sharing.md#sharing-env-files).
+Repo links name the repo by its git remote, so they open in a colleague's
-
+clone wherever it is ([sharing](sharing.md)).
-Links name the repo by its git remote, so they open in a colleague's clone
-wherever it is:
-
-```
-lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
-```
-
-See [sharing](sharing.md).

docs/sharing.md

@@ -7,10 +7,13 @@ permissions: the link names the item, never its value. Env files can
 also be [shared encrypted](#sharing-env-files), in the link itself.
 
 ```
+lazysecrets://azure/subscriptions/<subscription-id>                          subscription
 lazysecrets://azure/kv-app-prod.vault.azure.net                              vault
 lazysecrets://azure/kv-app-prod.vault.azure.net/keys                         vault, Keys tab
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password          secret
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password/91d3e0   one version
+lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net         workspace
+lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app     scope
 lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app/storage-key
 lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 ```
@@ -102,8 +105,8 @@ it now and then: new links use the newest version.
 ## Opening a link
 
 - Paste it into lazysecrets, or press `ctrl+o`, which reads the clipboard
-  and fills in any reference it finds there. Key Vault URLs,
+  and fills in any reference it finds there. Key Vault URLs, Azure portal
-  `@Microsoft.KeyVault(...)` and `{{secrets/scope/key}}` work too.
+  links, `@Microsoft.KeyVault(...)` and `{{secrets/scope/key}}` work too.
 - `lazysecrets <link>` (or `lazysecrets open <link>`) in a terminal.
 - Click it anywhere, once the [link handler](#from-the-browser-and-chat) is
   set up.
@@ -143,9 +146,10 @@ turns the question off too.
 link then opens a new window of the terminal you ran it in, with
 lazysecrets on that link. It recognises kitty, Ghostty, WezTerm, iTerm2,
 Terminal.app, Alacritty, GNOME Terminal, Konsole and foot, also inside
-tmux; `--terminal NAME` picks another. It records your `PATH` and config
+tmux; `--terminal NAME` picks another. It records your `PATH`, config
-locations, since apps start without your shell's environment (and so
+locations and XDG directories, since apps start without your shell's
-without `az`): run it again after moving lazysecrets or changing those.
+environment (and so without `az`): run it again after moving lazysecrets
+or changing those.
 
 - macOS: a small background app, `~/Applications/Lazysecrets Links.app`
 - Linux: a desktop entry claiming `x-scheme-handler/lazysecrets`, set as

internal/config/config.go

@@ -48,7 +48,8 @@ type UI struct {
 	// RecentIcon marks items used lately (Recent, R) with ◷, in the lists
 	// and in lazysecrets list. Defaults to false.
 	RecentIcon *bool `yaml:"recentIcon"`
-	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
+	// SourcesView is "grouped" (default) or "flat"; the backtick key
+	// toggles it.
 	SourcesView string `yaml:"sourcesView"`
 	// CollapseGroups starts the Sources pane with its groups folded;
 	// defaults to true.

internal/linkhandler/install_darwin.go

@@ -114,7 +114,7 @@ func Check() string {
 	}
 	out, err := exec.Command("plutil", "-extract", exeKey, "raw", filepath.Join(app, "Contents", "Info.plist")).Output()
 	if err != nil {
-		return "" // installed before the key was recorded: assume it works
+		return "" // can't tell: assume it works
 	}
 	exe := strings.TrimSpace(string(out))
 	if _, err := os.Stat(exe); err != nil {

internal/linkhandler/terminal.go

@@ -140,7 +140,7 @@ func appleString(s string) string {
 	return `"` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(s) + `"`
 }
 
-// Launch opens a new terminal window running inner, without waiting for
+// Launch opens a new terminal window running argv, without waiting for
 // it.
 func Launch(argv []string) error {
 	cmd := exec.Command(argv[0], argv[1:]...)
@@ -165,9 +165,11 @@ func Executable() (string, error) {
 
 // passEnv lists the variables carried from the install's environment to
 // lazysecrets in the new window: apps start with a minimal environment,
-// without Homebrew's PATH (so no az) or the user's config locations.
+// without Homebrew's PATH (so no az) or the user's XDG directories, so
+// the window would use another cache and miss running instances' sockets.
 var passEnv = []string{
-	"PATH", "LAZYSECRETS_CONFIG_FILE", "LAZYSECRETS_ICONS", "XDG_CONFIG_HOME", "XDG_STATE_HOME",
+	"PATH", "LAZYSECRETS_CONFIG_FILE", "LAZYSECRETS_ICONS",
+	"XDG_CONFIG_HOME", "XDG_STATE_HOME", "XDG_CACHE_HOME", "XDG_RUNTIME_DIR", "XDG_DATA_HOME",
 	"AZURE_CONFIG_DIR", "DATABRICKS_CONFIG_FILE",
 }
 

internal/provider/repo/repo.go

@@ -1,6 +1,6 @@
 // Package repo browses the encrypted secret files in git repositories:
 // a repo is a source, its secret files the containers (vault level), and
-// their keys the secrets. SOPS files are the one type so far.
+// their keys the secrets. Secret files are SOPS files and plain env files.
 //
 // Listing never decrypts: SOPS encrypts values only, so a file's keys and
 // metadata are read directly. A value is decrypted when it's revealed or
@@ -106,8 +106,6 @@ func (p *Provider) load() {
 				roots = append(roots, root)
 			}
 		}
-		// The repo lazysecrets started in, if any: marked, so the UI can
-		// put it on top, with its files under Dir first.
 		here, inRepo := p.current()
 		if inRepo {
 			seen[here.root] = true
@@ -137,7 +135,6 @@ func (p *Provider) load() {
 				add(root)
 			}
 		}
-		// Repos you starred something in, wherever they are.
 		for _, dir := range p.s.Starred {
 			if root, err := gitRoot(dir); err == nil {
 				add(root)

internal/ui/app/app.go

@@ -1317,8 +1317,7 @@ func (m *Model) countVersions(o provider.Object) tea.Cmd {
 	})
 }
 
-// closeVersions returns the Secrets pane to the object list, with the
+// closeVersions returns the Secrets pane to the object list.
-// cursor on the object whose versions were shown.
 func (m *Model) closeVersions() {
 	m.versionsOf = nil
 }

internal/ui/app/sharefiles.go

@@ -304,7 +304,7 @@ func (m *Model) handleShareOpened(msg shareOpenedMsg) tea.Cmd {
 }
 
 // openFailed says why a share link couldn't be decrypted, in a popup
-// where its offer was: its first line (wrapped), or with whole all of it
+// where its offer was: its first line (wrapped), or, with whole, all of it
 // (Key Vault's refusals say what to check on later lines). From there,
 // the key's secret can be gone to: its version, which may be disabled.
 func (m *Model) openFailed(s share.Sealed, err error, whole bool) {

internal/ui/panes/highlight.go

@@ -9,7 +9,6 @@ import (
 	"github.com/charmbracelet/x/ansi"
 )
 
-// sgr matches SGR escape sequences.
 var sgr = regexp.MustCompile("\x1b\\[([0-9;:]*)m")
 
 // Highlight draws a cursor row: line, padded to width, on style's

internal/ui/styles/theme.go

@@ -126,7 +126,6 @@ type value struct {
 	bold, italic, underline, reverse, faint bool
 }
 
-// fg styles s with the value as foreground, bg as background.
 func (v value) fg(s lipgloss.Style) lipgloss.Style {
 	if v.color != nil {
 		s = s.Foreground(v.color)

internal/update/update.go

@@ -89,14 +89,9 @@ func (r Release) Notes(current string) string {
 	return PlainLinks(strings.TrimSpace(notes))
 }
 
-// recentReleases is how many releases Latest reads the changelogs of.
-const recentReleases = 10
-
 // PlainLinks shows Markdown links as their text, for a terminal.
 func PlainLinks(s string) string { return mdLink.ReplaceAllString(s, "$1") }
 
-// mdLink is a Markdown link, [text](url): the notes link PRs and commits,
-// and a terminal shows them as their text.
 var mdLink = regexp.MustCompile(`\[([^\]]+)\]\((https?://[^)\s]+)\)`)
 
 // Client talks to the release servers.
@@ -148,6 +143,9 @@ func (c *Client) Latest(ctx context.Context) (Release, error) {
 	return Release{}, errors.Join(errs...)
 }
 
+// recentReleases is how many releases Latest reads the changelogs of.
+const recentReleases = 10
+
 func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
 	api, err := API(repo)
 	if err != nil {