chore(release): v0.2.1

- Text inputs come from newTextInput; the link and folder prompts share one width.
- One starred-first sort for sources, vaults and secrets; accountOf where the account was cut from the label by hand.
- One helper each for the reveal and clipboard countdowns' tick and seconds, the "Open with" choices, the vaults-loaded count, and Go to's and the panes' tabs.
- The details pane builds its label prefix, indent, note and source once; list rows mark matches with MarkMatches.
- The release page opens through openPage, so it now says it opened, as other pages do.
- The cache's account filter is built once per load or save, not per key.

Reviewed-on: #77
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>

.gitignore

@@ -1,33 +1,13 @@
-# ---> Go
-# If you prefer the allow list template instead of the deny list, see community template:
-# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
-#
-# Binaries for programs and plugins
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-
-# Test binary, built with `go test -c`
-*.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
-
-# Dependency directories (remove the comment below to include it)
-# vendor/
-
-# Go workspace file
-go.work
-go.work.sum
-
-# env file
-.env
-
-
 # Build output
 /lazysecrets
 
 # Release builds (GoReleaser, see .goreleaser.yaml)
 /dist/
+
+# go test -c, coverage profiles
+*.test
+*.out
+
+go.work
+go.work.sum
+.env

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 Every release of lazysecrets, newest first.
 
+## v0.2.1 – 2026-10-15
+
+### Fixed
+
+- A link opens lazysecrets with your cache and next to your running instances ([#71](https://git.kebcloud.no/keb/lazysecrets/pulls/71)) ([bb41767](https://git.kebcloud.no/keb/lazysecrets/commit/bb41767cbad00bab4f1824f4e0754cc7abd98c59))
+
+## v0.2.0 – 2026-10-14
+
+### Added
+
+- Lazysecrets list prints everything lazysecrets can find, for fzf and editor pickers ([#70](https://git.kebcloud.no/keb/lazysecrets/pulls/70)) ([39454d4](https://git.kebcloud.no/keb/lazysecrets/commit/39454d47a864c8628c50b023aee9539d33be2f44))
+
+### Fixed
+
+- Lazysecrets starts from fzf's become, on a non-blocking terminal ([#67](https://git.kebcloud.no/keb/lazysecrets/pulls/67)) ([4480e8f](https://git.kebcloud.no/keb/lazysecrets/commit/4480e8fed00024691091eb7096abb9dc83b8044d))
+- Local builds are dev-<commit> again, not a Go pseudo-version ([#68](https://git.kebcloud.no/keb/lazysecrets/pulls/68)) ([e825a51](https://git.kebcloud.no/keb/lazysecrets/commit/e825a51b30261b55c536af18fefde79dc6308377))
+- A wrapped value in the details keeps its colour on every line ([#69](https://git.kebcloud.no/keb/lazysecrets/pulls/69)) ([dbb0eb2](https://git.kebcloud.no/keb/lazysecrets/commit/dbb0eb2bbdf6d695cf0d9ac15a1b513af8ba431d))
+
 ## v0.1.2 – 2026-10-13
 
 ### Added

README.md

@@ -7,28 +7,23 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 ## Main features
 
 - **Read-only**: lazysecrets never creates, changes or deletes a secret.
-  That's by design and may stay that way.
 - **Zero setup**: uses the logins you already have (`az`, the Databricks
   CLI, `sops`, `git`). No config file needed.
 - **Search everything**: `ctrl+s` searches every source at once, with
   fzf-style matching.
-- **Share links**: Share `lazysecrets://` links with colleagues. A colleague opens it
+- **Share links**: Share `lazysecrets://` links with colleagues.
-  with their own access, from the terminal or with a click in the browser
-  or chat. `.env` files can be shared too, as a link encrypted with a
-  secret your team can read.
-- **Neovim integration**: via [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
 - **Careful with values**: values stay hidden until you reveal them, and
   copied values are cleared from the clipboard after 30 seconds.
-- **Scriptable**: `lazysecrets get <link>` prints a value for scripts and
+- **Scriptable**: `get`, `list` and `open` for scripts, fzf and editor
-  pipes, and `lazysecrets list` everything it can find, for fzf and editor
+  pickers; [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
-  pickers ([integration](docs/integration.md)).
+  for Neovim.
 - **Favourites**: star the secrets you use most for easy access.
 - **Expiry warnings**: secrets, keys and certificates that expire soon are
   marked, listed together in the status pane.
 - **Your way**: rebind any key, pick a theme, and add custom commands to run
   on a secret.
 - **Try it first**: `lazysecrets --demo` runs on built-in sample data.
-- **Supported platforms**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos. 
+- **Sources**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos.
 
 > **Early development:** expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.
 
@@ -49,9 +44,8 @@ Both approaches will install the latest release from [GitHub](https://github.com
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
 
-lazysecrets looks for a newer release once a day: the footer then shows
+`U` (or `lazysecrets update`) updates in place when there's a newer
-`↑ v0.2.0`, and `U` shows its changelog and updates in place (or run
+release.
-`lazysecrets update`).
 
 Or build it yourself:
 `go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest`.
@@ -74,23 +68,29 @@ use most:
 | `l` / `h` | the details of what's selected / back |
 | `/` | filter the list you're in |
 | `space` | reveal / hide the value |
-| `y` | copy the value (cleared from the clipboard after 30s) |
+| `y` | copy the value |
 | `ctrl+s` | Go to: search everything and jump there |
 | `f` / `F` | star / your favourites |
 | `s` | copy a link to share |
 | `?` | every key, searchable |
 | `q` | quit |
 
+## Integration
+
+`lazysecrets list`, `get` and `open` plug lazysecrets into fzf, editor
+pickers and scripts: see [Integration](docs/integration.md#an-fzf-picker).
+
+![fzf-example](docs/assets/fzf-example.png)
+
 ## Docs
 
 - [Keys](docs/keys.md): every key, Go to, the layout, and rebinding keys
 - [Azure Key Vault](docs/azure.md): accounts, permissions, pinned vaults
 - [Databricks](docs/databricks.md): profiles and Key Vault-backed scopes
 - [SOPS and .env files](docs/repos.md): which repos and files, decrypting
-- [Links](docs/links.md): sharing, opening, and opening links from the
+- [Sharing](docs/sharing.md): links to secrets, encrypted env files, and
-  browser and chat
+  opening links, also from the browser and chat
-- [Integration](docs/integration.md): `lazysecrets get` in scripts, and
+- [Integration](docs/integration.md): how lazysecrets can integrate into other systems
-  `lazysecrets list` for fzf and editor pickers
 - [Custom commands](docs/custom-commands.md): run your own commands on a
   secret
 - [Config](docs/config.md): every option, themes, layered configs, the

cmd/lazysecrets/get.go

@@ -18,7 +18,7 @@ import (
 // It ends with a newline only when printing to a terminal, so command
 // substitution and pipes get the value exactly.
 func get(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) error {
-	v, err := value(ctx, providers, st, r)
+	v, _, err := readKey(ctx, providers, st, r)
 	if err != nil {
 		return err
 	}
@@ -30,15 +30,9 @@ func get(ctx context.Context, providers []provider.Provider, st *store.Store, r
 	return err
 }
 
-// value reads what r points at (ref.Read), with the account that last
+// readKey reads what r points at (ref.Read), and the version read. The
-// read it first.
+// account asked for (--account) goes first, else the one that last read
-func value(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, error) {
+// it.
-	v, _, err := readKey(ctx, providers, st, r)
-	return v, err
-}
-
-// readKey is value, also returning the version read. The account asked
-// for (--account) goes first, else the one that last read it.
 func readKey(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, string, error) {
 	key := r
 	key.Version = ""

cmd/lazysecrets/get_test.go

@@ -20,7 +20,7 @@ func TestValue(t *testing.T) {
 		"lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app/storage-key": "storage-demo-key",
 	} {
 		r, _ := ref.Parse(link)
-		v, err := value(context.Background(), providers, st, r)
+		v, _, err := readKey(context.Background(), providers, st, r)
 		if err != nil || v.Reveal() != want {
 			t.Errorf("%s: %q, %v", link, v.Reveal(), err)
 		}
@@ -31,7 +31,7 @@ func TestValue(t *testing.T) {
 		"{{secrets/app/storage-key}}":                                          "names no workspace",
 	} {
 		r, _ := ref.Parse(link)
-		if _, err := value(context.Background(), providers, st, r); err == nil || !strings.Contains(err.Error(), wantErr) {
+		if _, _, err := readKey(context.Background(), providers, st, r); err == nil || !strings.Contains(err.Error(), wantErr) {
 			t.Errorf("%s: %v, want %q", link, err, wantErr)
 		}
 	}

cmd/lazysecrets/handler.go

@@ -69,11 +69,7 @@ func installHandler(cfg config.Config, configPath, term string) (string, string,
 	if _, err := launchCommand(cfg, configPath, term, exe, "lazysecrets://check"); err != nil {
 		return "", "", err
 	}
-	launch := []string{exe}
+	launch := append(append([]string{exe}, configArgs(configPath)...), "launch")
-	if configPath != defaultConfigPath() {
-		launch = append(launch, "--config", configPath)
-	}
-	launch = append(launch, "launch")
 	if term != "" {
 		launch = append(launch, "--terminal", term)
 	}
@@ -188,8 +184,14 @@ func launchCommand(cfg config.Config, configPath, term, exe, link string) ([]str
 // innerCommand runs lazysecrets on link, with the environment it needs.
 func innerCommand(configPath, exe, link string) []string {
 	inner := append(append([]string{"/usr/bin/env"}, linkhandler.Env(os.Getenv)...), exe)
-	if configPath != defaultConfigPath() {
+	inner = append(inner, configArgs(configPath)...)
-		inner = append(inner, "--config", configPath)
-	}
 	return append(inner, "open", link)
 }
+
+// configArgs passes the config files on, unless they're the default.
+func configArgs(configPath string) []string {
+	if configPath == defaultConfigPath() {
+		return nil
+	}
+	return []string{"--config", configPath}
+}

cmd/lazysecrets/list.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"cmp"
 	"context"
 	"encoding/json"
 	"errors"
@@ -17,6 +18,7 @@ import (
 	"charm.land/lipgloss/v2"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
 	"git.kebcloud.no/keb/lazysecrets/internal/listing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
@@ -51,7 +53,7 @@ func listCmd(providers []provider.Provider, st *store.Store, cachePath string, t
 	iconsOn := fs.Bool("icons", withIcons, "put the provider's Nerd Font icon before names (text)")
 	stars := fs.Bool("stars", true, "put ★ before starred names, in the theme's favouriteColor (text)")
 	recent := fs.Bool("recent", withRecent, "put ◷ before names used lately, in mutedColor (text; default ui.recentIcon)")
-	notes := fs.Bool("notes", true, "put ✎ before names with a note, in mutedColor (text; the note is printed either way)")
+	notes := fs.Bool("notes", true, "start a note with a note icon (✎ without --icons) (text; the note is printed either way)")
 	expiry := fs.Bool("expiry", true, "mark and say which have expired (✗ expired) or expire within ui.expiryWarningDays (⚠ expires in 12d) (text)")
 	kinds := fs.String("kind", "", "only these kinds, comma-separated: "+strings.Join(listing.Kinds, ", ")+" (vault: also scopes and repo files)")
 	showErrors := fs.Bool("errors", true, "list the lists that can't be read, with why (text: ✗ lines; json: \"error\")")
@@ -75,7 +77,7 @@ func listCmd(providers []provider.Provider, st *store.Store, cachePath string, t
 		return fmt.Errorf("--color: %q is not always or never", *color)
 	}
 	now := time.Now()
-	m := marks{theme: theme, icons: icons.None, stars: *stars, recent: *recent, notes: *notes, expiry: *expiry,
+	m := marks{theme: theme, icons: icons.None, stars: *stars, recent: *recent, expiry: *expiry,
 		color: *color == "always", warn: expiryWarn, now: now}
 	if *iconsOn {
 		m.icons = icons.NerdFont
@@ -93,7 +95,7 @@ func listCmd(providers []provider.Provider, st *store.Store, cachePath string, t
 			if status == "" && *expiry {
 				status = expiryOf(e, theme, expiryWarn, now, colored)
 			}
-			note := renderer(colored)(theme.Muted, e.Note)
+			note := noteOf(e, theme, m.icons, *notes, colored)
 			// A tab or line break in a name would break the line up.
 			_, err := fmt.Fprintf(out, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", e.Kind, mark, oneLine.Replace(name), oneLine.Replace(status),
 				oneLine.Replace(note), e.Account, e.Link)
@@ -126,20 +128,18 @@ func listCmd(providers []provider.Provider, st *store.Store, cachePath string, t
 	if cachePath != "" {
 		f = cachefile.Read(cachePath)
 	}
-	f = listing.Run(context.Background(), listing.Options{
+	f, loaded := listing.Run(context.Background(), listing.Options{
 		Providers: providers, Cache: f, MaxAge: *maxAge, Cached: *cached, Kinds: only, Timeout: timeout,
-		Mark: func(link, account string) (bool, time.Time, int, string) {
+		Mark: func(link, account string) listing.Marks {
 			n := st.Node(link)
-			return n.StarredFor(account), n.LastUsed, n.Uses, n.Note
+			return listing.Marks{Starred: n.StarredFor(account), Recent: n.UsedLately(now),
+				LastUsed: n.LastUsed, Uses: n.Uses, Note: n.Note}
 		},
 	}, emit)
-	if cachePath != "" && !*cached {
+	// Only what was loaded: list never moves a cursor, so the TUI's stay.
-		byID := map[string]provider.Provider{}
+	if cachePath != "" && loaded {
-		for _, p := range providers {
+		f.Cursor = nil
-			byID[p.ID()] = p
+		if err := cachefile.Save(cachePath, f, cachefile.Keep(providers), time.Now()); err != nil {
-		}
-		keep := func(id string) bool { p, ok := byID[id]; return ok && p.Kind() != provider.KindRepo }
-		if err := cachefile.Save(cachePath, f, keep, time.Now()); err != nil {
 			return err
 		}
 	}
@@ -151,21 +151,31 @@ func listCmd(providers []provider.Provider, st *store.Store, cachePath string, t
 
 var oneLine = strings.NewReplacer("\t", " ", "\r\n", " ", "\n", " ", "\r", " ")
 
+// noteOf is the entry's note, muted, after a note icon (✎ without Nerd
+// Font icons) with icon; or "".
+func noteOf(e listing.Entry, theme styles.Styles, iconSet icons.Set, icon, color bool) string {
+	if e.Note == "" {
+		return ""
+	}
+	note := e.Note
+	if icon {
+		note = cmp.Or(iconSet.Note, "✎") + " " + note
+	}
+	return renderer(color)(theme.Muted, note)
+}
+
 // expiryOf says that a secret, key or certificate has expired, in red,
 // or when it will if that's within warn (expires in 12d), in yellow, or
 // is "". Its mark (✗, ⚠) is before the name.
 func expiryOf(e listing.Entry, theme styles.Styles, warn time.Duration, now time.Time, color bool) string {
 	render := renderer(color)
-	left := e.Expires.Sub(now)
+	switch state, left := expiry.Of(e.Expires, now, warn); state {
-	switch {
+	case expiry.Expired:
-	case e.Expires.IsZero() || left > warn:
-		return ""
-	case left <= 0:
 		return render(theme.Error, "expired")
-	case left < 24*time.Hour:
+	case expiry.Soon:
-		return render(theme.Warning, fmt.Sprintf("expires in %dh", max(1, int(left.Hours()))))
+		return render(theme.Warning, "expires in "+expiry.Left(left))
 	}
-	return render(theme.Warning, fmt.Sprintf("expires in %dd", int(left.Hours()/24)))
+	return ""
 }
 
 // errorOf is why a list couldn't be read, in red, or "". Its mark (✗)
@@ -194,13 +204,13 @@ func nameOf(e listing.Entry, theme styles.Styles, color bool) string {
 // marks says what goes before the name, in a field of its own so a
 // search leaves it out: ✗ in red when something's wrong (it couldn't be
 // read, or has expired) or ⚠ when it expires within warn; ★ for a starred
-// entry and ◷ for one used lately, as the TUI marks them; ✎ for one with a
+// entry and ◷ for one used lately, as the TUI marks them; then the
-// note; then the provider's icon. The marks are right-aligned in room for every kind
+// provider's icon. The marks are right-aligned in room for every kind
 // turned on, so they sit by the icon and names line up.
 type marks struct {
 	theme                        styles.Styles
 	icons                        icons.Set
-	stars, recent, notes, expiry, color bool
+	stars, recent, expiry, color bool
 	warn                         time.Duration // ui.expiryWarningDays
 	now                          time.Time
 }
@@ -216,10 +226,14 @@ func (m marks) of(e listing.Entry) string {
 		}
 	}
 	// What's wrong, then what to watch: room for one of them.
-	switch left := e.Expires.Sub(m.now); {
+	state := expiry.None
-	case e.Error != "" || (m.expiry && !e.Expires.IsZero() && left <= 0):
+	if m.expiry {
+		state, _ = expiry.Of(e.Expires, m.now, m.warn)
+	}
+	switch {
+	case e.Error != "" || state == expiry.Expired:
 		mark(true, m.theme.Error, "✗")
-	case m.expiry && !e.Expires.IsZero() && left <= m.warn:
+	case state == expiry.Soon:
 		mark(true, m.theme.Warning, "⚠")
 	default:
 		mark(false, m.theme.Error, "")
@@ -230,9 +244,6 @@ func (m marks) of(e listing.Entry) string {
 	if m.recent {
 		mark(e.Recent, m.theme.Muted, "◷")
 	}
-	if m.notes {
-		mark(e.Note != "", m.theme.Muted, "✎")
-	}
 	pad := strings.Repeat("  ", room-len(parts)) // each mark and its space
 	kind := provider.Kind("")
 	for _, k := range []provider.Kind{provider.KindAzure, provider.KindDatabricks, provider.KindRepo} {

cmd/lazysecrets/list_test.go

@@ -87,20 +87,19 @@ func TestListExpiry(t *testing.T) {
 	}
 }
 
-func TestListNoteMark(t *testing.T) {
+func TestListNotes(t *testing.T) {
-	az := icons.NerdFont.Azure
+	e := listing.Entry{Note: "rotate in May"}
-	m := marks{icons: icons.NerdFont, stars: true, notes: true}
+	if got := noteOf(e, styles.Default(), icons.NerdFont, true, false); got != icons.NerdFont.Note+" rotate in May" {
-	for _, c := range []struct {
+		t.Errorf("icons: %q", got)
-		e    listing.Entry
-		want string
-	}{
-		{listing.Entry{Provider: "azure", Note: "rotate in May"}, "    ✎ " + az},
-		{listing.Entry{Provider: "azure", Note: "x", Starred: true}, "  ★ ✎ " + az},
-		{listing.Entry{Provider: "azure"}, "      " + az},
-	} {
-		if got := m.of(c.e); got != c.want {
-			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
 	}
+	if got := noteOf(e, styles.Default(), icons.None, true, false); got != "✎ rotate in May" {
+		t.Errorf("no icons: %q", got)
+	}
+	if got := noteOf(e, styles.Default(), icons.NerdFont, false, false); got != "rotate in May" {
+		t.Errorf("--notes=false: %q", got)
+	}
+	if got := noteOf(listing.Entry{}, styles.Default(), icons.NerdFont, true, true); got != "" {
+		t.Errorf("no note: %q", got)
 	}
 }
 

cmd/lazysecrets/main.go

@@ -68,27 +68,20 @@ func checkCommandKeys(km *keys.Map, cmds []commands.Command) error {
 		if c.Key == "" {
 			continue
 		}
-		name := fmt.Sprintf("custom command %q", cmpOr(c.Description, c.Command))
+		name := fmt.Sprintf("custom command %q", cmp.Or(c.Description, c.Command))
 		if err := km.CheckExtra(c.Key, name); err != nil {
 			return err
 		}
 		for _, d := range cmds[:i] {
 			overlap := c.Context == d.Context || c.Context == commands.Global || d.Context == commands.Global
 			if d.Key == c.Key && overlap {
-				return fmt.Errorf("%s: %q is also the key of custom command %q", name, c.Key, cmpOr(d.Description, d.Command))
+				return fmt.Errorf("%s: %q is also the key of custom command %q", name, c.Key, cmp.Or(d.Description, d.Command))
 			}
 		}
 	}
 	return nil
 }
 
-func cmpOr(a, b string) string {
-	if a != "" {
-		return a
-	}
-	return b
-}
-
 // refArg parses get's and open's arguments: a reference, and optionally
 // the account to use when several could (lazysecrets list's column) and,
 // for open, what to do with it rather than asking (--action).
@@ -150,6 +143,7 @@ func run() error {
                                   for scripts: VAR=$(lazysecrets get <ref>)
   lazysecrets [flags] list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]
                           [--color always|never] [--icons=false] [--errors=false]
+                          [--stars=false] [--notes=false] [--recent] [--expiry=false]
                                   print every source, vault and secret it can
                                   find, one per line, for fzf and pickers:
                                   what's cached at once, then what loads
@@ -177,26 +171,22 @@ Flags:
 		return nil
 	}
 
-	var open, getRef *ref.Ref
+	sub := "" // the subcommand; "" browses
+	var subArgs []string
+	var open *ref.Ref
+	var getRef ref.Ref
 	var openAction string
-	var shareArgs, listArgs []string
-	printKeys := false
 	switch args := flag.Args(); {
-	case len(args) > 0 && args[0] == "share":
+	case len(args) > 0 && (args[0] == "share" || args[0] == "list"):
-		shareArgs = args[1:]
+		sub, subArgs = args[0], args[1:]
-		if len(shareArgs) == 0 {
-			shareArgs = []string{} // still sharing: says how
-		}
-	case len(args) > 0 && args[0] == "list":
-		listArgs = append([]string{}, args[1:]...) // not nil: listing
 	case len(args) == 1 && args[0] == "keybindings":
-		printKeys = true
+		sub = "keybindings"
 	case len(args) > 0 && args[0] == "get":
 		r, _, err := refArg("get", args[1:])
 		if err != nil {
 			return err
 		}
-		getRef = &r
+		sub, getRef = "get", r
 	case len(args) > 0 && args[0] == "handler":
 		return handler(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "launch":
@@ -242,7 +232,7 @@ Flags:
 	if err := checkCommandKeys(&keymap, cfg.CustomCommands); err != nil {
 		return err
 	}
-	if printKeys {
+	if sub == "keybindings" {
 		fmt.Print(keymap.YAML())
 		return nil
 	}
@@ -270,25 +260,13 @@ Flags:
 	}
 	// timeoutFor is how long a request to a provider of kind k may take.
 	timeoutFor := func(k provider.Kind) time.Duration { return cmp.Or(timeouts[k], *timeout) }
-	if !set["clipboard-clear"] && cfg.Values.ClipboardClear != nil {
+	if !set["clipboard-clear"] {
-		*clipClear = *cfg.Values.ClipboardClear
+		*clipClear = valueOr(cfg.Values.ClipboardClear, *clipClear)
-	}
-	expiryDays := 30
-	if cfg.UI.ExpiryWarningDays != nil {
-		expiryDays = *cfg.UI.ExpiryWarningDays
-	}
-	revealTimeout := 60 * time.Second
-	if cfg.Values.RevealTimeout != nil {
-		revealTimeout = *cfg.Values.RevealTimeout
-	}
-	loadDelay := 150 * time.Millisecond
-	if cfg.UI.LoadDelay != nil {
-		loadDelay = *cfg.UI.LoadDelay
-	}
-	var updateEvery time.Duration // 0: the app's default, a day
-	if cfg.Updates.AutoCheckInterval != nil {
-		updateEvery = *cfg.Updates.AutoCheckInterval
 	}
+	expiryWarning := time.Duration(valueOr(cfg.UI.ExpiryWarningDays, 30)) * 24 * time.Hour
+	revealTimeout := valueOr(cfg.Values.RevealTimeout, 60*time.Second)
+	loadDelay := valueOr(cfg.UI.LoadDelay, 150*time.Millisecond)
+	updateEvery := valueOr(cfg.Updates.AutoCheckInterval, 0) // 0: the app's default, a day
 	if !set["icons"] {
 		switch {
 		case os.Getenv("LAZYSECRETS_ICONS") != "":
@@ -298,7 +276,17 @@ Flags:
 		}
 	}
 
-	recentIcon := cfg.UI.RecentIcon != nil && *cfg.UI.RecentIcon
+	recentIcon := valueOr(cfg.UI.RecentIcon, false)
+
+	startDir := *dir
+	if startDir == "" {
+		startDir, _ = os.Getwd()
+	}
+	// What was loaded last time.
+	cacheFile := ""
+	if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
+		cacheFile = filepath.Join(d, "cache.json")
+	}
 
 	// Stars, notes and the layout. Demo mode keeps them in memory, so
 	// sample vaults never end up in the real file.
@@ -322,8 +310,11 @@ Flags:
 		// Two Azure accounts, like a personal and an admin login in az.
 		alice, admin := "Azure:alice@example.com/demo", "Azure:admin.alice@example.com/demo"
 		fake.Seed(st, alice, admin)
+		az := fake.Azure(400*time.Millisecond).As(alice, "Azure · alice")
+		// Due soon whenever the demo runs (the tests' dates are fixed).
+		az.Expire("kv-app-prod", "api-key", time.Now().AddDate(0, 0, 9).Truncate(24*time.Hour))
 		providers = []provider.Provider{
-			fake.Azure(400*time.Millisecond).As(alice, "Azure · alice"),
+			az,
 			fake.AzureOps(700*time.Millisecond).As(admin, "Azure · admin.alice"),
 			fake.Databricks(600 * time.Millisecond),
 			fake.Repos(),
@@ -353,17 +344,9 @@ Flags:
 			providers = append(providers, dbx)
 		}
 		if config.On(pc.Repos.Enabled) {
-			start := *dir
-			if start == "" {
-				start, _ = os.Getwd()
-			}
-			roots := repo.DefaultRoots
-			if pc.Repos.Roots != nil {
-				roots = *pc.Repos.Roots
-			}
 			repos := repo.New(repo.Settings{
-				Dir: start, Paths: pc.Repos.Paths, Roots: roots, Starred: starredRepos(st),
+				Dir: startDir, Paths: pc.Repos.Paths, Roots: valueOr(pc.Repos.Roots, repo.DefaultRoots),
-				Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
+				Starred: starredRepos(st), Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
 			})
 			// The repo it started in (shown on top as Repo) and the
 			// others, checked for secret files in the background like
@@ -379,19 +362,14 @@ Flags:
 	// the standard logger, which would draw over the TUI.
 	log.SetOutput(io.Discard)
 
-	if getRef != nil {
+	switch sub {
+	case "get":
 		ctx, cancel := context.WithTimeout(context.Background(), timeoutFor(getRef.Kind))
 		defer cancel()
-		return get(ctx, providers, st, *getRef)
+		return get(ctx, providers, st, getRef)
-	}
+	case "list":
-	if listArgs != nil {
+		return listCmd(providers, st, cacheFile, timeoutFor, theme, *icons, recentIcon, expiryWarning, subArgs, os.Stdout)
-		cachePath := ""
+	case "share":
-		if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
-			cachePath = filepath.Join(d, "cache.json")
-		}
-		return listCmd(providers, st, cachePath, timeoutFor, theme, *icons, recentIcon, time.Duration(expiryDays)*24*time.Hour, listArgs, os.Stdout)
-	}
-	if shareArgs != nil {
 		// The files from a repo, the key from whichever provider it's
 		// in: the longest timeout.
 		d := *timeout
@@ -400,7 +378,7 @@ Flags:
 		}
 		ctx, cancel := context.WithTimeout(context.Background(), d)
 		defer cancel()
-		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), shareArgs, os.Stdout)
+		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), subArgs, os.Stdout)
 	}
 
 	// Links opened elsewhere (lazysecrets launch) can come here.
@@ -434,16 +412,10 @@ Flags:
 		onActive = srv.Touch
 	}
 
-	// What was loaded last time, and where it was left in this folder.
+	// Where it was left in this folder.
-	var cacheFile, placeDir string
+	placeDir := ""
 	if !*demo {
-		if d, err := config.CacheDir(); err == nil && config.On(cfg.Storage.Cache) {
+		placeDir = startDir
-			cacheFile = filepath.Join(d, "cache.json")
-		}
-		placeDir = *dir
-		if placeDir == "" {
-			placeDir, _ = os.Getwd()
-		}
 		if abs, err := filepath.Abs(placeDir); err == nil {
 			placeDir = abs
 		}
@@ -460,7 +432,7 @@ Flags:
 		NoHistory:      !config.On(cfg.Storage.History),
 		OnActive:       onActive,
 		RevealTimeout:  revealTimeout,
-		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
+		ExpiryWarning:  expiryWarning,
 		HideOnBlur:     config.On(cfg.Values.HideOnBlur),
 		HandlerSetup:   setup,
 		Updater:        updater(cfg.Updates.Sources),
@@ -493,6 +465,14 @@ Flags:
 	return err
 }
 
+// valueOr is *p, or def when p is nil (not set in the config).
+func valueOr[T any](p *T, def T) T {
+	if p == nil {
+		return def
+	}
+	return *p
+}
+
 // configFiles are the config files given, for the status pane: those
 // that exist, or the first if none does (where to create one).
 func configFiles(list string) []string {

cmd/lazysecrets/update.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"errors"
+	"flag"
 	"fmt"
 	"strings"
 	"time"
@@ -32,8 +33,12 @@ func updater(servers []string) *app.Updater {
 // updateCmd is lazysecrets update [--check]: the newer release's
 // changelog, then (unless --check) install it.
 func updateCmd(configPath string, args []string) error {
-	check := len(args) == 1 && args[0] == "--check"
+	fs := flag.NewFlagSet("update", flag.ContinueOnError)
-	if len(args) > 0 && !check {
+	check := fs.Bool("check", false, "just say if there's a newer release")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 {
 		return errors.New("usage: lazysecrets update [--check]")
 	}
 	cfg, err := config.LoadAll(strings.Split(configPath, ","))
@@ -49,14 +54,14 @@ func updateCmd(configPath string, args []string) error {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)
 	}
 	if !update.Newer(current, r.Tag) {
-		if !update.Newer(current, "v999.0.0") {
+		if strings.HasPrefix(current, "dev") {
 			return fmt.Errorf("this is a development build (%s); the latest release is %s: install it with install.sh, or go install …@%s", current, r.Tag, r.Tag)
 		}
 		fmt.Printf("lazysecrets %s is the latest (%s)\n", current, r.Tag)
 		return nil
 	}
 	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes(current)))
-	if check {
+	if *check {
 		fmt.Println("lazysecrets update installs it.")
 		return nil
 	}

cmd/lazysecrets/version.go

@@ -3,7 +3,6 @@ package main
 import (
 	"regexp"
 	"runtime/debug"
-	"strings"
 )
 
 // version is set by release builds:
@@ -11,13 +10,13 @@ import (
 //	go build -ldflags "-X main.version=1.2.3" ./cmd/lazysecrets
 var version string
 
-// versionString is the release version, or for other builds what Go
-// recorded: the module version (go install …@v1.2.3), else the commit
-// (dev-c1a4f90, -dirty with changes not committed).
 // pseudo matches a Go pseudo-version (v0.1.3-0.20261014174204-1c31a75d0507,
 // maybe +dirty): its commit.
 var pseudo = regexp.MustCompile(`[-.]\d{14}-([0-9a-f]{12})(\+.*)?$`)
 
+// versionString is the release version, or for other builds what Go
+// recorded: the module version (go install …@v1.2.3), else the commit
+// (dev-c1a4f90, -dirty with changes not committed).
 func versionString() string {
 	if version != "" {
 		return version
@@ -31,7 +30,7 @@ func versionString() string {
 		// go install …@<commit>.
 		if m := pseudo.FindStringSubmatch(v); m != nil {
 			dirty := ""
-			if strings.HasSuffix(v, "+dirty") {
+			if m[2] != "" {
 				dirty = "-dirty"
 			}
 			return "dev-" + m[1][:7] + dirty

docs/azure.md

@@ -16,7 +16,7 @@ A service principal is used instead when `AZURE_CLIENT_ID`,
 On an account's group row, the fourth pane shows who it signs in as: name,
 user, tenant, object ID, whether the session used MFA, directory roles
 (built-in ones by name) and its subscriptions, read from az's account list
-and the token lazysecrets already has: no requests of their own. `y` on
+and the token lazysecrets already has. `y` on
 the row copies the object ID, the one access policies and role
 assignments ask for; `l` goes into the pane, where `j`/`k` pick any
 field, `/` filters them (`/tenant`) and `y` copies the selected one.
@@ -67,9 +67,8 @@ fetched. `v` lists an item's versions. Items expiring within
 
 The status pane (`0`) lists them across every vault loaded, opened or
 cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`
-on one goes to it. That makes no requests of its own: expiry dates come
+on one goes to it. Expiry dates come with the lists. It says how many
-with the lists. It says how many vaults it covers; `ctrl+a` in search
+vaults it covers; `ctrl+a` in search loads the rest.
-loads the rest.
 
 On a vault, the right pane shows its settings: resource group, location,
 SKU, whether access is by Azure roles or access policies, soft delete and

docs/config.md

@@ -1,10 +1,11 @@
 # Config
 
 Optional, at `~/.config/lazysecrets/config.yaml` (or
-`$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags override
+`$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags (noted
-it. Unknown keys are an error, so typos don't go unnoticed. `e` on the
+below) override it. Unknown keys are an error, so typos don't go
-status pane (`0`) opens it in your editor, as in lazygit (making it if
+unnoticed. `e` on the status pane (`0`) opens it in your editor, as in
-it isn't there yet); changes apply when lazysecrets starts again.
+lazygit (making it if it isn't there yet); changes apply when lazysecrets
+starts again.
 
 ```yaml
 ui:
@@ -17,7 +18,7 @@ ui:
 values:
   revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
   hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
-  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
+  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables; also --clipboard-clear
 storage:
   cache: true            # keep what was loaded (never values) for the next start
   history: true          # count uses of items for Recent (R)
@@ -28,34 +29,17 @@ updates:
     - https://github.com/karleinarb/lazysecrets
     - https://git.kebcloud.no/keb/lazysecrets
 providers:
-  timeout: 30s                           # per backend request; a provider's own timeout overrides it
+  timeout: 30s           # per backend request; a provider's own timeout overrides it; also --timeout
-  azure:                                 # applies to every az account
+  azure:                 # likewise databricks and repos; azure covers every az account
     enabled: true        # default
     timeout: 30s
-    hideSubscriptions: [platform-mgmt]   # by name or ID
-    vaults:                              # listed under "Pinned vaults", for vaults
-      - https://kv-foo.vault.azure.net/  # you can read but not discover
-  databricks:
-    enabled: true
-    timeout: 30s
-    hideProfiles: [test]
-  repos:
-    enabled: true
-    timeout: 30s
-    roots: [~/git]
-    paths: [~/work/infra]
-    include: ["secrets/**"]
-    exclude: ["**/testdata/**"]
-sharing:               # sharing env files as encrypted links
-  key: https://kv-team.vault.azure.net/secrets/env-share  # or its lazysecrets:// link; for repos naming none
-  keyRules:            # what a key's value must be
-    minLength: 32      # characters, 16 at least
-    minClasses: 2      # kinds: lowercase, uppercase, digits, symbols
 ```
 
-More, each on its own page: [repos](repos.md) (`providers.repos`),
+More, each on its own page: [Azure](azure.md#vaults-you-cant-discover)
-[sharing env files](links.md#sharing-env-files) (`sharing`), the
+(`providers.azure`), [Databricks](databricks.md) (`providers.databricks`),
-[link handler](links.md#from-the-browser-and-chat) (`linkHandler`),
+[repos](repos.md#which-files) (`providers.repos`),
+[sharing env files](sharing.md#sharing-env-files) (`sharing`), the
+[link handler](sharing.md#from-the-browser-and-chat) (`linkHandler`),
 [keybindings](keys.md#rebinding-keys) (`keybinding`) and
 [custom commands](custom-commands.md) (`customCommands`).
 
@@ -102,9 +86,8 @@ as boxes, turn them off with `ui.icons: false`.
 
 Several config files can be layered, later ones winning (theme roles and
 keybindings merge one by one), with a comma-separated `--config` or
-`LAZYSECRETS_CONFIG_FILE`, like lazygit's `LG_CONFIG_FILE`. An editor
+`LAZYSECRETS_CONFIG_FILE`, like lazygit's `LG_CONFIG_FILE`; e.g. your
-plugin can so add a generated theme file to your own config, the way
+config plus an editor-generated theme:
-snacks.nvim themes lazygit from Neovim's highlight groups:
 
 ```sh
 LAZYSECRETS_CONFIG_FILE=~/.config/lazysecrets/config.yaml,~/.cache/nvim/lazysecrets-theme.yml lazysecrets
@@ -117,11 +100,10 @@ Stars, notes, usage and the layout are kept in
 by you: one record per source, vault or secret, keyed by its
 `lazysecrets://` link, never with values. A star belongs to the account you
 starred the item under (a vault two of your accounts can see can be starred
-for one); a note describes the item, so it shows under every account. It's
+for one); a note describes the item, so it shows under every account.
-JSON so an editor plugin can read it with a built-in parser; several
+Several lazysecrets windows can save to it without losing each other's
-lazysecrets windows can save to it without losing each other's changes.
+changes. One written by a newer lazysecrets is read but not saved to,
-One written by a newer lazysecrets is read but not saved to, with a
+with a warning, until you update.
-warning, until you update.
 
 Revealing, copying, opening in the browser, sharing and jumping to an item
 count as using it: its record keeps when it was last used and how often,
@@ -157,8 +139,9 @@ until then it reuses the answer from the state file. Releases are
 published on GitHub and on git.kebcloud.no, and it asks them in that
 order, the next when one doesn't answer within 5 seconds;
 `updates.sources` lists others, such as a mirror of your own. Offline, or with
-every server down, it says nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
+every server down, it says nothing. A newer release shows in the status
-`lazysecrets update --check`) shows what changed since your version, across the last 10 releases.
+pane, `↑ v0.2.0`; `U` (or `lazysecrets update --check`) shows what
+changed since your version, across the last 10 releases.
 
 Updating (`u` there, or `lazysecrets update`) downloads the release for
 your OS and CPU from the first server that has it, checks it against

docs/development.md

@@ -12,7 +12,7 @@ repo, pick `kv-shared-prod / env-share` (the second account's) as the
 key, then paste the link back. The demo repos aren't on disk, so opening
 asks where to save, as for a repo you haven't cloned.
 
-A stripped binary is about 21 MB instead of 30 MB:
+A stripped binary is a third smaller:
 
 ```sh
 go build -trimpath -ldflags "-s -w" -o lazysecrets ./cmd/lazysecrets
@@ -35,10 +35,8 @@ subject, checked by `pr-title.yml`:
 | `fix` | a bug fix | Fixed |
 | `refactor`, `docs`, `test`, `ci`, `chore`, `build`, `style`, `revert` | everything users don't need to hear about | no |
 
-`feat!:` marks a breaking change, `feat(scope):` names a part. Brackets
+`feat!:` marks a breaking change, `feat(scope):` names a part.
-and a missing space work too: `[feat] x`, `[feat]: x` and `feat:x` all
+`[skip changelog]` in the description leaves a pull request out.
-become `feat: x` in the changelog. `[skip changelog]` in the description
-leaves a pull request out.
 
 CI (`ci.yml`) runs gofmt, vet, staticcheck, the tests and a build for each
 platform on pull requests into `main`. `main` is protected: a pull request

docs/integration.md

@@ -2,7 +2,7 @@
 
 lazysecrets works outside its own window too: `lazysecrets get` reads a
 value for scripts, and `lazysecrets list` lists everything for fzf, editor
-pickers and your own tools. Both take the [links](links.md) lazysecrets
+pickers and your own tools. Both take the [links](sharing.md) lazysecrets
 copies and shares. For Neovim, there's
 [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim).
 
@@ -19,7 +19,8 @@ It reads the value directly, with your az accounts (the one that last read
 it first), the Databricks profile for the workspace, or sops in your clone
 of the repo; a version in the link reads that version. `--account` tries
 that account first, as [`list`](#listing-for-fzf-and-pickers) prints it.
-The value ends with a newline only on a terminal.
+The value ends with a newline only on a terminal. When it can't read the
+value, it says why on stderr and exits with status 1.
 
 ## Listing, for fzf and pickers
 
@@ -29,69 +30,65 @@ tab-separated:
 | Field | |
 |---|---|
 | kind | `source`, `vault`, `secret`, `key` or `certificate` |
+| mark | ✗ when something's wrong (expired, or couldn't be read) or ⚠ when it expires soon; ★ when starred; ◷ when used lately (with `--recent`); and the provider's icon |
 | name | `platform-prod / kv-app-prod / db-password` |
-| account | what it's listed through: an az account (`Azure:<user>/<tenant>`), `Databricks` or `Repos` |
+| status | why a vault or source couldn't be read, or that it has `expired` or `expires in 12d` (within `ui.expiryWarningDays`), or empty |
+| note | your note on it (`n` in lazysecrets), after a note icon (✎ without icons), or empty |
+| account | what it's listed through: `Azure` (`Azure:<user>/<tenant>` with several az accounts), `Databricks` or `Repos` |
 | link | its `lazysecrets://` link |
 
-It's what Go to searches, so fzf, or an editor's picker, can search it
+What's cached prints at once, then what loads follows as it arrives: read
-instead, showing the names and acting on the links:
+it as a stream. Values are never listed. It stops quietly when the reader
+goes, like fzf after a pick. Kind stays the first field, and account and
+link the last two; new fields only ever go between. The mark has a field of
+its own so a search can leave it out: in fzf, `--nth` searches the name,
+so `^prod` finds names starting with prod.
+
+| Flag | |
+|---|---|
+| `--format json` | an object per line instead, for editor plugins (below) |
+| `--kind secret,vault` | only these kinds: `source`, `vault` (also scopes and repo files), `secret`, `key`, `certificate`; lists they don't need aren't loaded |
+| `--cached` | only what's cached, at once: nothing is loaded from Azure or Databricks |
+| `--max-age 2m` | load cached lists older than this again |
+| `--errors=false` | leave out the vaults and sources it couldn't read |
+| `--color never` | no colours, for scripts |
+| `--icons=false` | no provider icons |
+| `--stars=false` | no ★ before starred names (in `favouriteColor`) |
+| `--notes=false` | no note icon before a note |
+| `--recent` | ◷ before names used lately, in `mutedColor`; default `ui.recentIcon` |
+| `--expiry=false` | no expiry: not in the status, and no ✗ or ⚠ for it |
+
+With `--format json`, each line is an object with these fields; new ones
+may be added:
+
+| Field | |
+|---|---|
+| `link`, `kind`, `account` | as above |
+| `error` | why it couldn't be read, only then |
+| `provider` | `azure`, `databricks` or `repo` |
+| `path` | the names: `["platform-prod", "kv-app-prod", "db-password"]` |
+| `accountLabel` | the account's short name, when several az accounts are signed in |
+| `starred` | starred for this account |
+| `note` | your note on it, if any |
+| `reference` | how config refers to a secret: `@Microsoft.KeyVault(SecretUri=…)` or `{{secrets/scope/key}}` (`Y` in lazysecrets) |
+| `url` | its web page, in the Azure portal or the Databricks workspace (`o` in lazysecrets) |
+| `recent` | used lately, as Recent (`R`) lists: in the last 90 days |
+| `lastUsed`, `uses` | when it was last used, and how often; only when `recent`, to sort by |
+| `expires` | when a secret, key or certificate expires, if it does (Azure) |
+| `enabled` | `false` for a disabled one; only where the provider says (Azure) |
+
+[`lazysecrets open --action go --account <account> <link>`](sharing.md#opening-a-link)
+opens one in lazysecrets without asking what to do or which account.
+
+### An fzf picker
 
 ```sh
-lazysecrets list | fzf --ansi --with-nth='2..-3' --accept-nth=-1 \
+lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1 \
   --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
   --bind 'ctrl-o:become(lazysecrets open --action go --account {-2} {-1})' \
-  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {2..-3})' \
+  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {3})' \
   --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'
 ```
 
-`--with-nth='2..-3'` shows and searches only the names; `{-1}` and
+![fzf-example](assets/fzf-example.png)
-`--accept-nth=-1` are the link, `{-2}` the account. All but the name are
-one word, so this works without `--delimiter`. To filter by kind
-yourself: `awk -F'\t' '$1 == "secret"'`.
 
-`enter` prints the link (`lazysecrets get $(…)`), `ctrl-o` opens it in
-lazysecrets, `ctrl-y` copies the value, saying so in the header, and
-`ctrl-x` copies it and closes fzf (`pbcopy` on macOS; `wl-copy` or `xclip`
-on Linux). A value copied this way isn't cleared from the
-clipboard after `values.clipboardClear`, as one copied in lazysecrets is.
-
-`--account` makes `open` and `get` use the account it was listed through,
-when several of yours can see it: without, `open` asks which, and `get`
-tries the one that last read it first. The link stays as it is, to copy
-and share; the account isn't part of it. `--action` tells `open` what to
-do rather than asking, as it does for a link clicked elsewhere: `go` to
-it, `copy` its value too, or `show` it. It ends in the secrets list, like
-Go to, rather than on the details as a clicked link does.
-
-What's [cached](config.md#cache) prints at once. Then, like Go to, it loads
-what's missing or older than `--max-age` (2m), and what's new in it follows
-as it arrives: fzf shows it while you type. `--cached` loads nothing from
-Azure or Databricks, for an answer at once. Repos are always read, from
-disk. What it loads is cached for the TUI too. It stops when the reader
-goes, after a pick in fzf.
-
-`--kind` lists only some kinds, comma-separated: `source`, `vault` (also
-Databricks scopes and repo files), `secret`, `key`, `certificate`. Lists
-only other kinds need aren't loaded: `--kind source,vault` asks for no
-secrets. Keys and certificates load only when asked for this way; else,
-like Go to, they're listed as far as you opened them in lazysecrets.
-
-A vault or source it can't read is a line too, as it fails: its name,
-then `✗` and why in red (`errorColor`), with its link, so opening it
-shows more. They're in the list, not on stderr, which would draw over fzf.
-`--errors=false` leaves them out.
-
-The name is coloured from your [theme](config.md#theme), with the
-provider's icon when [icons](config.md#theme) are on (`ui.icons`); fzf
-shows the colours with `--ansi`. `--color never` leaves them out, for
-scripts, and `--icons=false` the icons. The link is never coloured.
-
-`--format json` prints an object per line instead, for editor plugins,
-without colours or icons, and with `error` on a list it couldn't read:
-
-```json
-{"link":"lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password","kind":"secret","provider":"azure","path":["platform-prod","kv-app-prod","db-password"],"account":"Azure:alice@example.com/<tenant>","accountLabel":"alice"}
-```
-
-`accountLabel`, the account's short name, is there when several az
-accounts are signed in. Values are never listed.

docs/keys.md

@@ -49,12 +49,12 @@ match case exactly.
 | Key | Action |
 |---|---|
 | `space` | reveal / hide the selected value (public material for keys and certificates) |
-| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID; in its pane, the selected field |
+| `y` | copy the value without revealing it. On an Azure account's row: its object ID; in its pane, the selected field |
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
 | `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
-| `s` / `S` | copy a [link](links.md) to the selected item / share menu (also env files, [encrypted](links.md#sharing-env-files)) |
+| `s` / `S` | copy a [link](sharing.md) to the selected item / share menu (also env files, [encrypted](sharing.md#sharing-env-files)) |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |
 | `L` | sign in again (shown when a login has expired) |
@@ -63,10 +63,8 @@ match case exactly.
 A revealed value is shown as it reads best: JSON indented, and PEM
 certificates as their subject, issuer, dates, names and thumbprint, with
 any other PEM block (a private key) named but not shown. `y` still copies
-it exactly as stored.
+it exactly as stored. It hides again after a while, and when the terminal
-
+loses focus ([config](config.md)).
-A revealed value hides again after `values.revealTimeout` (60s) and
-when the terminal loses focus (`values.hideOnBlur`); see [config](config.md).
 
 ## Stars and notes
 
@@ -75,8 +73,7 @@ when the terminal loses focus (`values.hideOnBlur`); see [config](config.md).
 | `f` | star the selected source, vault or secret: it gets a ★ and sorts first in its list |
 | `n` | write a short note on it, shown dimmed on its row and in the detail pane |
 
-A star belongs to the account you starred the item under; a note shows
+Both are kept in the [state file](config.md#state).
-under every account. Both are kept in the [state file](config.md#state).
 
 ## Go to
 
@@ -124,15 +121,16 @@ it's hidden.
 On top, the status pane (`0`) shows the version, a newer release and how
 your accounts are doing; `e` there opens your [config](config.md) in your
 editor, as in lazygit. Focused, the right pane lists more under the
-logo (when there's room): the version and updates (`U`), each account
+logo; `y` copies any row:
-(`L` on one that needs it signs in), what's expiring (`enter` goes to
+
-it), this session's errors, newest first (what a pane showed, or the
+- the version and updates (`U`)
-footer flashed before you moved on; not kept after quitting), the config,
+- each account (`L` on one that needs it signs in)
-state and cache files (`e` opens one in your editor), and links to the
+- what's expiring (`enter` goes to it)
-docs, source, issues, releases and changelog (`o` opens one; on the
+- this session's errors, newest first (not kept after quitting)
-version or update, its release), then the changelog of every release up
+- the config, state and cache files (`e` opens one in your editor)
-to yours, built in so it needs no network: `/` filters it (`/fixed`,
+- links to the docs, source, issues, releases and changelog (`o` opens one)
-`/search`). `y` copies any row.
+- the changelog of every release up to yours, built in: `/` filters it
+  (`/fixed`, `/search`)
 
 | Key | Action |
 |---|---|
@@ -141,9 +139,8 @@ to yours, built in so it needs no network: `/` filters it (`/fixed`,
 | `+` / `_` | zoom the focused pane: normal → half → full screen, and back |
 | `=` | reset the layout (divider, heights, zoom) |
 
-The divider and pane heights are remembered (zoom isn't). macOS uses
+The divider and pane heights are remembered (zoom isn't). `<>{}` are for
-ctrl+arrows for Mission Control and switching desktops by default, hence
+macOS, where ctrl+arrows switch desktops.
-the `<` `>` `{` `}` alternatives.
 
 ## Rebinding keys
 

docs/repos.md

@@ -58,7 +58,7 @@ providers:
 ```
 
 A repo's `.lazysecrets.yaml` can also name the secret its env files are
-[shared](links.md#sharing-env-files) with:
+[shared](sharing.md#sharing-env-files) with:
 
 ```yaml
 sharing:
@@ -100,13 +100,5 @@ sops 3.8 or later.
 
 ## Links
 
-`S` → `f` shares env files as an [encrypted link](links.md#sharing-env-files).
+Repo links name the repo by its git remote, so they open in a colleague's
-
+clone wherever it is ([sharing](sharing.md)).
-Links name the repo by its git remote, so they open in a colleague's clone
-wherever it is:
-
-```
-lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
-```
-
-See [links](links.md).

docs/sharing.md

@@ -1,21 +1,24 @@
-# Links
+# Sharing
 
-Subscriptions, workspaces, vaults, scopes, repos, files and secrets can
+Subscriptions, workspaces, vaults, scopes, repos, files and secrets are
-be shared as a `lazysecrets://` link, in chat or a ticket. Whoever opens
+shared as a `lazysecrets://` link, in chat or a ticket. Whoever opens
 it lands on that item, reading it with their own account and
 permissions: the link names the item, never its value. Env files can
 also be [shared encrypted](#sharing-env-files), in the link itself.
 
 ```
+lazysecrets://azure/subscriptions/<subscription-id>                          subscription
 lazysecrets://azure/kv-app-prod.vault.azure.net                              vault
 lazysecrets://azure/kv-app-prod.vault.azure.net/keys                         vault, Keys tab
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password          secret
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password/91d3e0   one version
+lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net         workspace
+lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app     scope
 lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app/storage-key
 lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 ```
 
-## Sharing
+## Sharing a link
 
 `s` copies a link to the selected item (from the versions view, pinned to
 that version). `S` opens the share menu:
@@ -99,11 +102,11 @@ the value breaks every old link. Whoever has read the secret's value
 before can decrypt links made with it without asking the vault, so rotate
 it now and then: new links use the newest version.
 
-## Opening
+## Opening a link
 
 - Paste it into lazysecrets, or press `ctrl+o`, which reads the clipboard
-  and fills in any reference it finds there. Key Vault URLs,
+  and fills in any reference it finds there. Key Vault URLs, Azure portal
-  `@Microsoft.KeyVault(...)` and `{{secrets/scope/key}}` work too.
+  links, `@Microsoft.KeyVault(...)` and `{{secrets/scope/key}}` work too.
 - `lazysecrets <link>` (or `lazysecrets open <link>`) in a terminal.
 - Click it anywhere, once the [link handler](#from-the-browser-and-chat) is
   set up.
@@ -143,9 +146,10 @@ turns the question off too.
 link then opens a new window of the terminal you ran it in, with
 lazysecrets on that link. It recognises kitty, Ghostty, WezTerm, iTerm2,
 Terminal.app, Alacritty, GNOME Terminal, Konsole and foot, also inside
-tmux; `--terminal NAME` picks another. It records your `PATH` and config
+tmux; `--terminal NAME` picks another. It records your `PATH`, config
-locations, since apps start without your shell's environment (and so
+locations and XDG directories, since apps start without your shell's
-without `az`): run it again after moving lazysecrets or changing those.
+environment (and so without `az`): run it again after moving lazysecrets
+or changing those.
 
 - macOS: a small background app, `~/Applications/Lazysecrets Links.app`
 - Linux: a desktop entry claiming `x-scheme-handler/lazysecrets`, set as

internal/cachefile/cachefile.go

@@ -32,6 +32,10 @@ type File struct {
 	Objects    map[string]Stamped[[]provider.Object]    `json:"objects,omitempty"`
 	Details    map[string]Stamped[provider.Object]      `json:"details,omitempty"`
 	Cursor     map[string]string                        `json:"cursor,omitempty"`
+	// Dropped are keys deleted since the file was read (a list that
+	// failed to load): Save deletes them from the file too, rather than
+	// merging the old entry back. Not saved.
+	Dropped map[string]bool `json:"-"`
 }
 
 // Stamped is a list or detail with when it was loaded.
@@ -69,6 +73,16 @@ func ProviderOf(key string) string {
 	return id
 }
 
+// Keep is Save's keep for these providers: their lists are kept, but not
+// repos', whose files are read from disk anyway, nor other accounts'.
+func Keep(providers []provider.Provider) func(providerID string) bool {
+	keep := map[string]bool{}
+	for _, p := range providers {
+		keep[p.ID()] = p.Kind() != provider.KindRepo
+	}
+	return func(id string) bool { return keep[id] }
+}
+
 // Read reads path; a missing, unreadable or other version's file is an
 // empty cache.
 func Read(path string) File {
@@ -90,17 +104,27 @@ func Read(path string) File {
 }
 
 // Save writes f to path, merged with the file there: of a list in both,
-// the one loaded last wins, and f's cursors win. Entries older than
+// the one loaded last wins, and f's cursors win (a nil Cursor keeps the
-// MaxAge, and those of providers keep says no to (accounts signed out
+// file's). Entries older than MaxAge, those of providers keep says no to
-// of), are dropped, from the file's side as well.
+// (accounts signed out of), and f.Dropped are dropped, from the file's
+// side as well. Saves from several lazysecrets take turns (a lock file),
+// so none undoes another's.
 func Save(path string, f File, keep func(providerID string) bool, now time.Time) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return err
+	}
+	unlock, err := lock(path + ".lock")
+	if err != nil {
+		return err
+	}
+	defer unlock()
 	out := New()
 	ok := func(key string, at time.Time) bool { return keep(ProviderOf(key)) && now.Sub(at) < MaxAge }
 	disk := Read(path)
-	merge(out.Sources, disk.Sources, f.Sources, ok)
+	merge(out.Sources, disk.Sources, f.Sources, ok, f.Dropped)
-	merge(out.Containers, disk.Containers, f.Containers, ok)
+	merge(out.Containers, disk.Containers, f.Containers, ok, f.Dropped)
-	merge(out.Objects, disk.Objects, f.Objects, ok)
+	merge(out.Objects, disk.Objects, f.Objects, ok, f.Dropped)
-	merge(out.Details, disk.Details, f.Details, ok)
+	merge(out.Details, disk.Details, f.Details, ok, f.Dropped)
 	for _, m := range []map[string]string{disk.Cursor, f.Cursor} {
 		for k, v := range m {
 			if keep(ProviderOf(k)) {
@@ -111,13 +135,18 @@ func Save(path string, f File, keep func(providerID string) bool, now time.Time)
 	return write(path, out)
 }
 
-func merge[T any](out, disk, ours map[string]Stamped[T], ok func(string, time.Time) bool) {
+// merge puts disk's entries in out, but not those dropped, then ours
-	for _, m := range []map[string]Stamped[T]{disk, ours} {
+// where they're newer.
-		for k, e := range m {
+func merge[T any](out, disk, ours map[string]Stamped[T], ok func(string, time.Time) bool, dropped map[string]bool) {
-			if old, seen := out[k]; ok(k, e.At) && (!seen || !e.At.Before(old.At)) {
+	for k, e := range disk {
+		if ok(k, e.At) && !dropped[k] {
 			out[k] = e
 		}
 	}
+	for k, e := range ours {
+		if old, seen := out[k]; ok(k, e.At) && (!seen || !e.At.Before(old.At)) {
+			out[k] = e
+		}
 	}
 }
 
@@ -127,9 +156,6 @@ func write(path string, f File) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		return err
-	}
 	tmp, err := os.CreateTemp(filepath.Dir(path), ".cache-*.json")
 	if err != nil {
 		return err

internal/cachefile/cachefile_test.go

@@ -89,3 +89,34 @@ func TestReadOtherVersion(t *testing.T) {
 		t.Errorf("read another version's file: %+v", got)
 	}
 }
+
+func TestSaveDroppedAndCursors(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	now := time.Now()
+	all := func(string) bool { return true }
+	f := New()
+	f.Containers["az|bad"] = list(now, "kv-old")
+	f.Cursor["az|x"] = "kv-tui"
+	if err := Save(path, f, all, now); err != nil {
+		t.Fatal(err)
+	}
+	// The TUI fails to load it again and drops it: it stays gone.
+	f = New()
+	f.Dropped = map[string]bool{"az|bad": true}
+	if err := Save(path, f, all, now); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := Read(path).Containers["az|bad"]; ok {
+		t.Error("a dropped list came back")
+	}
+	// lazysecrets list saves without cursors: the TUI's stay.
+	listed := New()
+	listed.Cursor = nil
+	listed.Containers["az|y"] = list(now, "kv-y")
+	if err := Save(path, listed, all, now); err != nil {
+		t.Fatal(err)
+	}
+	if Read(path).Cursor["az|x"] != "kv-tui" {
+		t.Error("the TUI's cursor was lost")
+	}
+}

internal/cachefile/lock_other.go

@@ -0,0 +1,7 @@
+//go:build !unix
+
+package cachefile
+
+// lock does nothing here: saves can then race, losing lists that load
+// again.
+func lock(string) (func(), error) { return func() {}, nil }

internal/cachefile/lock_unix.go

@@ -0,0 +1,25 @@
+//go:build unix
+
+package cachefile
+
+import (
+	"os"
+	"syscall"
+)
+
+// lock takes path as a lock file, waiting while another lazysecrets has
+// it, and returns how to let go.
+func lock(path string) (unlock func(), err error) {
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
+		f.Close()
+		return nil, err
+	}
+	return func() {
+		_ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+		f.Close()
+	}, nil
+}

internal/clipboard/clipboard.go

@@ -42,9 +42,6 @@ func New() Clipboard {
 	}
 }
 
-// Native reports whether the system clipboard is used rather than OSC52.
-func (c Clipboard) Native() bool { return c.native }
-
 // Write puts s on the clipboard.
 func (c Clipboard) Write(s string) tea.Cmd {
 	if !c.native {

internal/commands/commands.go

@@ -16,6 +16,7 @@
 package commands
 
 import (
+	"cmp"
 	"fmt"
 	"regexp"
 	"strings"
@@ -60,10 +61,7 @@ var envName = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
 
 // Validate checks a command from the config.
 func (c Command) Validate() error {
-	name := c.Description
+	name := cmp.Or(c.Description, c.Command)
-	if name == "" {
-		name = c.Command
-	}
 	switch {
 	case c.Command == "":
 		return fmt.Errorf("custom command %q has no command", c.Description)

internal/config/config.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"os"
 	"path/filepath"
 	"strings"
@@ -47,7 +48,8 @@ type UI struct {
 	// RecentIcon marks items used lately (Recent, R) with ◷, in the lists
 	// and in lazysecrets list. Defaults to false.
 	RecentIcon *bool `yaml:"recentIcon"`
-	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
+	// SourcesView is "grouped" (default) or "flat"; the backtick key
+	// toggles it.
 	SourcesView string `yaml:"sourcesView"`
 	// CollapseGroups starts the Sources pane with its groups folded;
 	// defaults to true.
@@ -203,17 +205,12 @@ func xdgDir(env, fallback string) (string, error) {
 	return filepath.Join(base, "lazysecrets"), nil
 }
 
-// Load reads path. A missing file is an empty config. Unknown keys are an
-// error, so typos don't silently do nothing.
-func Load(path string) (Config, error) {
-	return LoadAll([]string{path})
-}
-
 // LoadAll reads several config files in order, each on top of the ones
 // before, like lazygit's LG_CONFIG_FILE: a later file overrides the
 // settings it sets, and theme roles merge one by one. That lets an editor
 // plugin add a generated theme file to the user's own config. Missing
-// files are skipped.
+// files are skipped. Unknown keys are an error, so typos don't silently do
+// nothing.
 func LoadAll(paths []string) (Config, error) {
 	var c Config
 	keybinding := map[string]map[string][]string{}
@@ -228,9 +225,7 @@ func LoadAll(paths []string) (Config, error) {
 			if keybinding[ctx] == nil {
 				keybinding[ctx] = map[string][]string{}
 			}
-			for name, keys := range actions {
+			maps.Copy(keybinding[ctx], actions)
-				keybinding[ctx][name] = keys
-			}
 		}
 	}
 	c.Keybinding = keybinding

internal/config/config_test.go

@@ -18,7 +18,7 @@ func write(t *testing.T, content string) string {
 }
 
 func TestLoad(t *testing.T) {
-	c, err := Load(write(t, `
+	c, err := LoadAll([]string{write(t, `
 ui:
   icons: false
   sourcesView: flat
@@ -36,7 +36,7 @@ providers:
   databricks:
     enabled: false
     hideProfiles: [test]
-`))
+`)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -61,7 +61,7 @@ func TestLoadMissingAndEmpty(t *testing.T) {
 		"missing": filepath.Join(t.TempDir(), "nope.yaml"),
 		"empty":   write(t, ""),
 	} {
-		c, err := Load(path)
+		c, err := LoadAll([]string{path})
 		if err != nil || c.UI.Icons != nil || c.Values.ClipboardClear != nil {
 			t.Errorf("%s: %+v, %v", name, c, err)
 		}
@@ -85,7 +85,7 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
 	} {
-		if _, err := Load(write(t, content)); err == nil {
+		if _, err := LoadAll([]string{write(t, content)}); err == nil {
 			t.Errorf("%s: no error", name)
 		} else if !strings.Contains(err.Error(), "config.yaml") {
 			t.Errorf("%s: error doesn't name the file: %v", name, err)
@@ -132,18 +132,18 @@ theme:
 }
 
 func TestUpdates(t *testing.T) {
-	c, err := Load(write(t, "updates:\n  autoCheck: false\n  autoCheckInterval: 168h\n  sources: [https://git.example.com/team/lazysecrets]\n"))
+	c, err := LoadAll([]string{write(t, "updates:\n  autoCheck: false\n  autoCheckInterval: 168h\n  sources: [https://git.example.com/team/lazysecrets]\n")})
 	if err != nil || On(c.Updates.AutoCheck) || *c.Updates.AutoCheckInterval != 7*24*time.Hour || len(c.Updates.Sources) != 1 {
 		t.Errorf("updates = %+v, %v", c.Updates, err)
 	}
 }
 
 func TestLoadDelay(t *testing.T) {
-	c, err := Load(write(t, "ui:\n  loadDelay: 300ms\n"))
+	c, err := LoadAll([]string{write(t, "ui:\n  loadDelay: 300ms\n")})
 	if err != nil || c.UI.LoadDelay == nil || *c.UI.LoadDelay != 300*time.Millisecond {
 		t.Errorf("loadDelay = %v, %v", c.UI.LoadDelay, err)
 	}
-	if _, err := Load(write(t, "ui:\n  loadDelay: 1m\n")); err == nil {
+	if _, err := LoadAll([]string{write(t, "ui:\n  loadDelay: 1m\n")}); err == nil {
 		t.Error("a minute's delay accepted")
 	}
 }

internal/expiry/expiry.go

@@ -0,0 +1,41 @@
+// Package expiry says whether a secret, key or certificate has expired
+// or will soon, and how long it has left, the same way everywhere: the
+// TUI's lists and status pane, and lazysecrets list.
+package expiry
+
+import (
+	"fmt"
+	"time"
+)
+
+type State int
+
+const (
+	None    State = iota // no expiry, or not within the warning period
+	Soon                 // within the warning period
+	Expired              // already
+)
+
+// Of tells whether something expiring at expires (zero: never) has
+// expired by now or will within warn, and how long it has left.
+func Of(expires, now time.Time, warn time.Duration) (State, time.Duration) {
+	if expires.IsZero() {
+		return None, 0
+	}
+	left := expires.Sub(now)
+	switch {
+	case left <= 0:
+		return Expired, 0
+	case left <= warn:
+		return Soon, left
+	}
+	return None, left
+}
+
+// Left is a short "12d", or "5h" on the last day.
+func Left(d time.Duration) string {
+	if d < 24*time.Hour {
+		return fmt.Sprintf("%dh", max(1, int(d.Hours())))
+	}
+	return fmt.Sprintf("%dd", int(d.Hours()/24))
+}

internal/expiry/expiry_test.go

@@ -0,0 +1,27 @@
+package expiry
+
+import (
+	"testing"
+	"time"
+)
+
+func TestOf(t *testing.T) {
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	warn := 30 * 24 * time.Hour
+	for _, c := range []struct {
+		expires time.Time
+		want    State
+		left    string
+	}{
+		{time.Time{}, None, ""},
+		{now.Add(-time.Hour), Expired, ""},
+		{now.Add(12*24*time.Hour + time.Hour), Soon, "12d"},
+		{now.Add(5 * time.Hour), Soon, "5h"},
+		{now.Add(60 * 24 * time.Hour), None, ""},
+	} {
+		state, left := Of(c.expires, now, warn)
+		if state != c.want || (c.left != "" && Left(left) != c.left) {
+			t.Errorf("%v: %v %s, want %v %s", c.expires, state, Left(left), c.want, c.left)
+		}
+	}
+}

internal/instance/instance.go

@@ -9,7 +9,6 @@
 package instance
 
 import (
-	"bufio"
 	"context"
 	"encoding/json"
 	"errors"
@@ -36,15 +35,18 @@ func Dir(stateDir string) string {
 type Status struct {
 	PID        int       `json:"pid"`
 	LastActive time.Time `json:"lastActive"` // last key press or focus
-	// Reach is how readily it can be shown: 2 in view (outside tmux, or
+	Reach      int       `json:"reach"`      // how readily it can be shown: unreachable, switchable or inView
-	// in a tmux session a client shows), 1 in a tmux session that a tmux
-	// client can be switched to, 0 not at all.
-	Reach int `json:"reach"`
 	// App is the terminal app it would show in (macOS), preferring the
 	// app the link was clicked in.
 	App string `json:"app,omitempty"`
 }
 
+const (
+	unreachable = 0
+	switchable  = 1 // in a tmux session that a tmux client can be switched to
+	inView      = 2 // outside tmux, or in a tmux session a client shows
+)
+
 type request struct {
 	Op    string `json:"op"` // "status" or "open"
 	Link  string `json:"link,omitempty"`
@@ -114,7 +116,7 @@ func (s *Server) handle(c net.Conn) {
 	defer c.Close()
 	_ = c.SetDeadline(time.Now().Add(5 * time.Second))
 	var req request
-	if err := json.NewDecoder(bufio.NewReader(c)).Decode(&req); err != nil {
+	if err := json.NewDecoder(c).Decode(&req); err != nil {
 		return
 	}
 	var resp response
@@ -188,7 +190,7 @@ func Best(found []Found, front string, terminal bool) (Found, bool) {
 			best = f
 		}
 	}
-	return best, best.Reach > 0
+	return best, best.Reach > unreachable
 }
 
 // Open hands link, clicked in front, to f.

internal/instance/tmux.go

@@ -1,6 +1,7 @@
 package instance
 
 import (
+	"cmp"
 	"os"
 	"os/exec"
 	"slices"
@@ -25,7 +26,8 @@ func tmux(args ...string) (string, error) {
 func inTmux() bool { return os.Getenv("TMUX") != "" && os.Getenv("TMUX_PANE") != "" }
 
 type client struct {
-	name, session, activity string // activity: Unix seconds
+	name, session string
+	activity      int // Unix seconds
 	pid           int
 	app           string
 }
@@ -42,30 +44,31 @@ func clients() []client {
 		if len(f) < 4 {
 			continue
 		}
-		pid, err := strconv.Atoi(f[1])
+		activity, err1 := strconv.Atoi(f[0])
-		if err != nil {
+		pid, err2 := strconv.Atoi(f[1])
+		if err1 != nil || err2 != nil {
 			continue
 		}
-		cs = append(cs, client{name: f[2], session: f[3], activity: f[0], pid: pid, app: linkhandler.HostApp(pid)})
+		cs = append(cs, client{name: f[2], session: f[3], activity: activity, pid: pid, app: linkhandler.HostApp(pid)})
 	}
-	// Activity has the same width for centuries: strings compare like
+	slices.SortStableFunc(cs, func(a, b client) int { return cmp.Compare(b.activity, a.activity) })
-	// numbers.
-	slices.SortStableFunc(cs, func(a, b client) int { return strings.Compare(b.activity, a.activity) })
 	return cs
 }
 
 // place is where this instance would show: the tmux client (zero outside
-// tmux), the app, and reach: 2 already on screen there (outside tmux, or
+// tmux), the app, and its reach.
-// a client on its session), 1 after switching a client, 0 nowhere.
 func place(front string) (client, string, int) {
 	if !inTmux() {
-		return client{}, linkhandler.HostApp(os.Getpid()), 2
+		return client{}, linkhandler.HostApp(os.Getpid()), inView
 	}
 	session, err := tmux("display-message", "-p", "-t", os.Getenv("TMUX_PANE"), "#{session_name}")
 	if err != nil {
-		return client{}, "", 0
+		return client{}, "", unreachable
 	}
 	cs := clients()
+	if len(cs) == 0 {
+		return client{}, "", unreachable
+	}
 	// Best first: in the front app on its session, in the front app,
 	// on its session, any.
 	rank := func(c client) int {
@@ -78,20 +81,16 @@ func place(front string) (client, string, int) {
 		}
 		return r
 	}
-	var best client
+	best := cs[0]
-	found := false
+	for _, c := range cs[1:] {
-	for _, c := range cs {
+		if rank(c) > rank(best) {
-		if !found || rank(c) > rank(best) {
+			best = c
-			best, found = c, true
 		}
 	}
-	if !found {
-		return client{}, "", 0
-	}
 	if best.session == session {
-		return best, best.app, 2
+		return best, best.app, inView
 	}
-	return best, best.app, 1
+	return best, best.app, switchable
 }
 
 // Raise brings this instance into view for a link clicked in front: in
@@ -99,14 +98,14 @@ func place(front string) (client, string, int) {
 // then its app to the front, showing a hidden dropdown terminal.
 func Raise(front string) {
 	c, app, reach := place(front)
-	if reach == 0 {
+	if reach == unreachable {
 		return
 	}
 	if inTmux() {
 		pane := os.Getenv("TMUX_PANE")
 		_, _ = tmux("select-window", "-t", pane)
 		_, _ = tmux("select-pane", "-t", pane)
-		if reach == 1 {
+		if reach == switchable {
 			_, _ = tmux("switch-client", "-c", c.name, "-t", pane)
 		}
 	}

internal/linkhandler/install_darwin.go

@@ -114,19 +114,15 @@ func Check() string {
 	}
 	out, err := exec.Command("plutil", "-extract", exeKey, "raw", filepath.Join(app, "Contents", "Info.plist")).Output()
 	if err != nil {
-		return "" // installed before the key was recorded: assume it works
+		return "" // can't tell: assume it works
 	}
-	if exe := strings.TrimSpace(string(out)); !exists(exe) {
+	exe := strings.TrimSpace(string(out))
+	if _, err := os.Stat(exe); err != nil {
 		return "lazysecrets:// links run " + exe + ", which no longer exists"
 	}
 	return ""
 }
 
-func exists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}
-
 // Uninstall removes the applet and its registration.
 func Uninstall() (string, error) {
 	app, err := AppPath()

internal/linkhandler/terminal.go

@@ -140,11 +140,10 @@ func appleString(s string) string {
 	return `"` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(s) + `"`
 }
 
-// Launch opens a new terminal window running inner, without waiting for
+// Launch opens a new terminal window running argv, without waiting for
 // it.
 func Launch(argv []string) error {
 	cmd := exec.Command(argv[0], argv[1:]...)
-	cmd.Stdin, cmd.Stdout, cmd.Stderr = nil, nil, nil
 	if err := cmd.Start(); err != nil {
 		return err
 	}
@@ -166,9 +165,11 @@ func Executable() (string, error) {
 
 // passEnv lists the variables carried from the install's environment to
 // lazysecrets in the new window: apps start with a minimal environment,
-// without Homebrew's PATH (so no az) or the user's config locations.
+// without Homebrew's PATH (so no az) or the user's XDG directories, so
+// the window would use another cache and miss running instances' sockets.
 var passEnv = []string{
-	"PATH", "LAZYSECRETS_CONFIG_FILE", "LAZYSECRETS_ICONS", "XDG_CONFIG_HOME", "XDG_STATE_HOME",
+	"PATH", "LAZYSECRETS_CONFIG_FILE", "LAZYSECRETS_ICONS",
+	"XDG_CONFIG_HOME", "XDG_STATE_HOME", "XDG_CACHE_HOME", "XDG_RUNTIME_DIR", "XDG_DATA_HOME",
 	"AZURE_CONFIG_DIR", "DATABRICKS_CONFIG_FILE",
 }
 

internal/listing/listing.go

@@ -51,6 +51,11 @@ type Entry struct {
 	Enabled *bool     `json:"enabled,omitempty"`
 	// Note is the user's note on it, if any.
 	Note string `json:"note,omitempty"`
+	// Reference is how config refers to a secret, where the provider has
+	// a way (@Microsoft.KeyVault(...), {{secrets/scope/key}}); URL its
+	// web page (portal, workspace), if any.
+	Reference string `json:"reference,omitempty"`
+	URL       string `json:"url,omitempty"`
 	// Error says why a source's vaults or a vault's secrets couldn't be
 	// listed. The entry is then that source or vault, again, or with an
 	// account's sources unreadable, the account without a link.
@@ -69,25 +74,37 @@ type Options struct {
 	// Lists only needed for other kinds aren't loaded: sources and vaults
 	// alone don't load any secrets. Lists that fail are always listed.
 	Kinds []string
-	// Mark tells whether the entry with link is starred for account,
+	// Mark tells what's remembered about the entry with link, seen
-	// when it was last used and how often (zero: not lately), and its
+	// through account; nil marks nothing.
-	// note; nil marks nothing.
+	Mark    func(link, account string) Marks
-	Mark    func(link, account string) (starred bool, lastUsed time.Time, uses int, note string)
+	Timeout func(provider.Kind) time.Duration // nil: 30s
-	Timeout func(provider.Kind) time.Duration
 	Now     func() time.Time
 }
 
+// Marks are what's remembered about an entry: starred for the account,
+// used lately (Recent) and when and how often, and its note.
+type Marks struct {
+	Starred, Recent bool
+	LastUsed        time.Time
+	Uses            int
+	Note            string
+}
+
 // Run lists everything, calling emit for each entry once, from this
 // goroutine, and for each list that can't be loaded, as it fails. An
 // error from emit (the reader went away) stops it. It returns the cache
-// with what was loaded.
+// with what was loaded, and whether anything was.
-func Run(ctx context.Context, o Options, emit func(Entry) error) cachefile.File {
+func Run(ctx context.Context, o Options, emit func(Entry) error) (cachefile.File, bool) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
-	l := &lister{o: o, emit: emit, seen: map[string]bool{}, pending: map[string]bool{}, results: make(chan result)}
+	l := &lister{o: o, emit: emit, seen: map[string]bool{}, pending: map[string]bool{}, failed: map[string]bool{},
+		results: make(chan result)}
 	if l.o.Now == nil {
 		l.o.Now = time.Now
 	}
+	if l.o.Timeout == nil {
+		l.o.Timeout = func(provider.Kind) time.Duration { return 30 * time.Second }
+	}
 	for _, p := range o.Providers {
 		if l.stopped != nil {
 			break
@@ -106,7 +123,7 @@ func Run(ctx context.Context, o Options, emit func(Entry) error) cachefile.File
 			cancel()
 		}
 	}
-	return l.o.Cache
+	return l.o.Cache, l.loaded
 }
 
 type job struct {
@@ -130,6 +147,8 @@ type lister struct {
 	emit    func(Entry) error
 	seen    map[string]bool // provider ID + link of entries emitted
 	pending map[string]bool // cache keys queued or loading
+	failed  map[string]bool // cache keys that couldn't be loaded: not again
+	loaded  bool            // something was cached
 	queue   []job
 	active  int
 	results chan result
@@ -207,12 +226,12 @@ func (l *lister) objects(p provider.Provider, c provider.Container, objs []provi
 		}
 		l.put(p, Entry{Link: r.String(), Kind: strings.ToLower(string(o.Type)), Provider: kindOf(c.Source.Kind),
 			Path: []string{c.Source.Name, c.Name, o.Name}, AccountLabel: accountOf(c.Source),
-			Expires: o.Expires, Enabled: o.Enabled})
+			Expires: o.Expires, Enabled: o.Enabled, Reference: o.Reference, URL: o.URL})
 	}
 }
 
 func sourceEntry(src provider.Source) Entry {
-	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src)}
+	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src), URL: src.URL}
 	if r, err := ref.ForSource(src); err == nil {
 		e.Link = r.String()
 	}
@@ -220,7 +239,7 @@ func sourceEntry(src provider.Source) Entry {
 }
 
 func containerEntry(c provider.Container) Entry {
-	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source)}
+	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source), URL: c.URL}
 	if r, err := ref.ForContainer(c, provider.TypeSecret); err == nil {
 		e.Link = r.String()
 	}
@@ -235,8 +254,11 @@ func (l *lister) put(p provider.Provider, e Entry) {
 	}
 	e.Account = p.ID()
 	if l.o.Mark != nil && e.Link != "" {
-		e.Starred, e.LastUsed, e.Uses, e.Note = l.o.Mark(e.Link, e.Account)
+		m := l.o.Mark(e.Link, e.Account)
-		e.Recent = !e.LastUsed.IsZero()
+		e.Starred, e.Recent, e.Note = m.Starred, m.Recent, m.Note
+		if m.Recent {
+			e.LastUsed, e.Uses = m.LastUsed, m.Uses
+		}
 	}
 	id := p.ID() + "\x00" + e.Link + "\x00" + e.Error
 	if l.stopped != nil || l.seen[id] {
@@ -260,7 +282,7 @@ func (l *lister) wants(kinds ...string) bool {
 }
 
 func (l *lister) enqueue(j job) {
-	if l.pending[j.key] {
+	if l.pending[j.key] || l.failed[j.key] {
 		return
 	}
 	l.pending[j.key] = true
@@ -296,9 +318,11 @@ func (l *lister) handle(r result) {
 	delete(l.pending, r.key)
 	now := l.o.Now()
 	if r.err != nil {
+		l.failed[r.key] = true
 		l.put(r.p, r.failed())
 		return
 	}
+	l.loaded = l.loaded || l.cacheable(r.p)
 	cache := l.cacheable(r.p)
 	switch {
 	case r.c != nil:

internal/listing/listing_test.go

@@ -42,7 +42,7 @@ func run(t *testing.T, o Options) ([]Entry, cachefile.File, []Entry) {
 	}
 	o.Timeout = func(provider.Kind) time.Duration { return 5 * time.Second }
 	var got, failed []Entry
-	f := Run(context.Background(), o, func(e Entry) error {
+	f, _ := Run(context.Background(), o, func(e Entry) error {
 		if e.Error != "" {
 			failed = append(failed, e)
 		} else {
@@ -87,6 +87,11 @@ func TestListLoadsAndCaches(t *testing.T) {
 			t.Errorf("provider %q", e.Provider)
 		}
 	}
+	for _, e := range got {
+		if e.Kind == "secret" && e.Provider == "azure" && (!strings.HasPrefix(e.Reference, "@Microsoft.KeyVault(") || e.URL == "") {
+			t.Errorf("%s: reference %q, url %q", e.Link, e.Reference, e.URL)
+		}
+	}
 	if len(f.Sources) != 1 || len(f.Containers) == 0 || len(f.Objects) == 0 {
 		t.Errorf("not cached: %d sources, %d containers, %d objects", len(f.Sources), len(f.Containers), len(f.Objects))
 	}
@@ -229,14 +234,17 @@ func TestListMarks(t *testing.T) {
 	az := fake.Azure(0)
 	var starredLink string
 	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute, Kinds: []string{"secret"},
-		Mark: func(link, account string) (bool, time.Time, int, string) {
+		Mark: func(link, account string) Marks {
 			if starredLink == "" && strings.HasSuffix(link, "/db-password") {
 				starredLink = link
 			}
 			if strings.HasSuffix(link, "/api-key") {
-				return false, time.Now(), 3, "rotate in May"
+				return Marks{Recent: true, LastUsed: time.Now(), Uses: 3, Note: "rotate in May"}
 			}
-			return link == starredLink && account == az.ID(), time.Time{}, 0, ""
+			if strings.HasSuffix(link, "/legacy-token") { // used, but too long ago
+				return Marks{LastUsed: time.Now().AddDate(-2, 0, 0), Uses: 9}
+			}
+			return Marks{Starred: link == starredLink && account == az.ID()}
 		}})
 	var starred, recent int
 	for _, e := range got {
@@ -262,3 +270,28 @@ func TestListMarks(t *testing.T) {
 		t.Errorf("%d starred, %d recent", starred, recent)
 	}
 }
+
+func TestFailedListNotRetried(t *testing.T) {
+	t.Parallel()
+	az := &counting{Provider: fake.Azure(0)}
+	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
+	// Everything stale: sources reload, and their vaults are queued again
+	// as each list arrives. kv-restricted fails once, and isn't asked again.
+	before := az.calls.Load()
+	_, _, failed := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute,
+		Now: func() time.Time { return time.Now().Add(time.Hour) }})
+	if len(failed) != 1 {
+		t.Errorf("failed: %+v", failed)
+	}
+	fresh := &counting{Provider: fake.Azure(0)}
+	run(t, Options{Providers: []provider.Provider{fresh}, MaxAge: time.Minute})
+	if n := az.calls.Load() - before; n > fresh.calls.Load() {
+		t.Errorf("%d requests with a stale cache, more than %d from scratch: something was asked twice", n, fresh.calls.Load())
+	}
+}
+
+func TestRunWithoutTimeout(t *testing.T) {
+	t.Parallel()
+	Run(context.Background(), Options{Providers: []provider.Provider{fake.Repos()}, Cache: cachefile.New()},
+		func(Entry) error { return nil }) // no Timeout: a default, not a panic
+}

internal/match/match.go

@@ -107,9 +107,6 @@ func parseTerm(tok string) (term, bool) {
 	return t, true
 }
 
-// Empty reports whether the query has no terms: everything matches.
-func (q Query) Empty() bool { return len(q.groups) == 0 }
-
 // Item is a row to match: Text is everything searched, and runes
 // NameStart up to NameEnd of it are the row's name (the rest is context,
 // like a path or a note). Without a name, nothing gets the name bonus.

internal/match/match_test.go

@@ -99,9 +99,3 @@ func TestAnchorsOnTheName(t *testing.T) {
 		t.Errorf("password$: %v", got)
 	}
 }
-
-func TestEmpty(t *testing.T) {
-	if !Parse("  | ").Empty() || Parse("x").Empty() {
-		t.Error("Empty")
-	}
-}

internal/provider/azure/azure.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph"
@@ -99,13 +100,7 @@ func (p *Provider) Label() string { return cmp.Or(p.label, string(provider.KindA
 // Sources lists the subscriptions the signed-in identity can see, skipping
 // disabled and deleted ones.
 func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
-	var out []provider.Source
+	out, err := all(ctx, p.subs.NewListPager(nil), func(page armsubscriptions.ClientListResponse) (srcs []provider.Source) {
-	pager := p.subs.NewListPager(nil)
-	for pager.More() {
-		page, err := pager.NextPage(ctx)
-		if err != nil {
-			return nil, cleanError(err)
-		}
 		for _, s := range page.Value {
 			switch deref(s.State) {
 			case armsubscriptions.SubscriptionStateDisabled, armsubscriptions.SubscriptionStateDeleted:
@@ -118,7 +113,7 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 			p.mu.Lock()
 			p.tenants[id] = tenant
 			p.mu.Unlock()
-			out = append(out, provider.Source{
+			srcs = append(srcs, provider.Source{
 				Kind:   provider.KindAzure,
 				ID:     id,
 				Name:   deref(s.DisplayName),
@@ -126,6 +121,10 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 				URL:    PortalResourceURL(tenant, "/subscriptions/"+id, "overview"),
 			})
 		}
+		return srcs
+	})
+	if err != nil {
+		return nil, err
 	}
 	slices.SortFunc(out, func(a, b provider.Source) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	if len(p.opts.Vaults) > 0 {
@@ -230,22 +229,29 @@ func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provid
 	if err != nil {
 		return nil, err
 	}
-	var out []provider.Container
+	return all(ctx, client.NewListBySubscriptionPager(nil), func(page armkeyvault.VaultsClientListBySubscriptionResponse) (vaults []provider.Container) {
-	pager := client.NewListBySubscriptionPager(nil)
+		for _, v := range page.Value {
+			if v.Properties == nil || v.Properties.VaultURI == nil {
+				continue
+			}
+			vaults = append(vaults, provider.Container{
+				Source: src, ID: deref(v.ID), Name: deref(v.Name),
+				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
+			})
+		}
+		return vaults
+	})
+}
+
+// all lists every page, items picking out what to keep of each.
+func all[P, T any](ctx context.Context, pager *runtime.Pager[P], items func(P) []T) ([]T, error) {
+	var out []T
 	for pager.More() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return nil, cleanError(err)
 		}
-		for _, v := range page.Value {
+		out = append(out, items(page)...)
-			if v.Properties == nil || v.Properties.VaultURI == nil {
-				continue
-			}
-			out = append(out, provider.Container{
-				Source: src, ID: deref(v.ID), Name: deref(v.Name),
-				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
-			})
-		}
 	}
 	return out, nil
 }
@@ -288,51 +294,40 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 	var out []provider.Object
 	switch t {
 	case provider.TypeSecret:
-		pager := vc.secrets.NewListSecretPropertiesPager(nil)
+		tenant := p.tenant(c.Source.ID)
-		for pager.More() {
+		out, err = all(ctx, vc.secrets.NewListSecretPropertiesPager(nil), func(page azsecrets.ListSecretPropertiesResponse) (objs []provider.Object) {
-			page, err := pager.NextPage(ctx)
-			if err != nil {
-				return nil, cleanError(err)
-			}
 			for _, s := range page.Value {
 				// Certificate-backing secrets appear under Certificates.
-				if s.ID == nil || deref(s.Managed) {
+				if s.ID != nil && !deref(s.Managed) {
-					continue
+					objs = append(objs, secretObject(c, s, tenant))
-				}
-				out = append(out, secretObject(c, s, p.tenant(c.Source.ID)))
 				}
 			}
+			return objs
+		})
 	case provider.TypeKey:
-		pager := vc.keys.NewListKeyPropertiesPager(nil)
+		out, err = all(ctx, vc.keys.NewListKeyPropertiesPager(nil), func(page azkeys.ListKeyPropertiesResponse) (objs []provider.Object) {
-		for pager.More() {
-			page, err := pager.NextPage(ctx)
-			if err != nil {
-				return nil, cleanError(err)
-			}
 			for _, k := range page.Value {
-				if k.KID == nil || deref(k.Managed) {
+				if k.KID != nil && !deref(k.Managed) {
-					continue
+					objs = append(objs, keyObject(c, k))
-				}
-				out = append(out, keyObject(c, k))
 				}
 			}
+			return objs
+		})
 	case provider.TypeCertificate:
-		pager := vc.certs.NewListCertificatePropertiesPager(nil)
+		out, err = all(ctx, vc.certs.NewListCertificatePropertiesPager(nil), func(page azcertificates.ListCertificatePropertiesResponse) (objs []provider.Object) {
-		for pager.More() {
-			page, err := pager.NextPage(ctx)
-			if err != nil {
-				return nil, cleanError(err)
-			}
 			for _, cp := range page.Value {
-				if cp.ID == nil {
+				if cp.ID != nil {
-					continue
+					objs = append(objs, certObject(c, cp))
-				}
-				out = append(out, certObject(c, cp))
 				}
 			}
+			return objs
+		})
 	default:
 		return nil, provider.ErrUnsupported
 	}
+	if err != nil {
+		return nil, err
+	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	return out, nil
 }
@@ -353,7 +348,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		if resp.Key != nil {
 			if resp.Key.KID != nil {
 				o.Version = resp.Key.KID.Version()
-				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Key", string(*resp.Key.KID))
+				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.Key.KID))
 			}
 			o.Attrs = keyAttrs(resp.Key)
 		}
@@ -364,7 +359,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		}
 		if resp.ID != nil {
 			o.Version = resp.ID.Version()
-			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Certificate", string(*resp.ID))
+			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.ID))
 		}
 		if pol := resp.Policy; pol != nil && pol.SecretProperties != nil {
 			o.ContentType = deref(pol.SecretProperties.ContentType)
@@ -381,56 +376,46 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	if err != nil {
 		return nil, err
 	}
+	tenant := p.tenant(o.Container.Source.ID)
 	var out []provider.Object
 	switch o.Type {
 	case provider.TypeSecret:
-		pager := vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil)
+		out, err = all(ctx, vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil), func(page azsecrets.ListSecretPropertiesVersionsResponse) (objs []provider.Object) {
-		for pager.More() {
-			page, err := pager.NextPage(ctx)
-			if err != nil {
-				return nil, cleanError(err)
-			}
 			for _, s := range page.Value {
 				if s.ID != nil {
-					out = append(out, secretObject(o.Container, s, p.tenant(o.Container.Source.ID)))
+					objs = append(objs, secretObject(o.Container, s, tenant))
-				}
 				}
 			}
+			return objs
+		})
 	case provider.TypeKey:
-		pager := vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil)
+		out, err = all(ctx, vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil), func(page azkeys.ListKeyPropertiesVersionsResponse) (objs []provider.Object) {
-		for pager.More() {
-			page, err := pager.NextPage(ctx)
-			if err != nil {
-				return nil, cleanError(err)
-			}
 			for _, k := range page.Value {
 				if k.KID != nil {
-					out = append(out, keyObject(o.Container, k))
+					objs = append(objs, keyObject(o.Container, k))
-				}
 				}
 			}
+			return objs
+		})
 	case provider.TypeCertificate:
-		pager := vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil)
+		out, err = all(ctx, vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil), func(page azcertificates.ListCertificatePropertiesVersionsResponse) (objs []provider.Object) {
-		for pager.More() {
-			page, err := pager.NextPage(ctx)
-			if err != nil {
-				return nil, cleanError(err)
-			}
 			for _, cp := range page.Value {
 				if cp.ID != nil {
-					out = append(out, certObject(o.Container, cp))
+					objs = append(objs, certObject(o.Container, cp))
-				}
 				}
 			}
+			return objs
+		})
 	default:
 		return nil, provider.ErrUnsupported
 	}
-	tenant := p.tenant(o.Container.Source.ID)
+	if err != nil {
+		return nil, err
+	}
 	for i := range out {
 		out[i].Reference = versionedReference(out[i])
 		if o.Type != provider.TypeSecret { // secretObject's is the version's already
-			kind := map[provider.ObjectType]string{provider.TypeKey: "Key", provider.TypeCertificate: "Certificate"}[o.Type]
+			out[i].URL = portalAssetURL(tenant, o.Type, out[i].ID+"/"+out[i].Version) // the version's page
-			out[i].URL = portalAssetURL(tenant, kind, out[i].ID+"/"+out[i].Version) // the version's page
 		}
 	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return b.Updated.Compare(a.Updated) })
@@ -452,47 +437,19 @@ func versionedReference(o provider.Object) string {
 // Value returns a secret's value, a key's public key or a certificate's
 // public certificate, as of o.Version (latest if empty).
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
-	vc, err := p.clients(o.Container.Detail)
-	if err != nil {
-		return provider.SecretValue{}, err
-	}
-	switch o.Type {
-	case provider.TypeSecret:
 	v, _, err := p.VersionedValue(ctx, o)
 	return v, err
-	case provider.TypeKey:
-		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, cleanError(err)
-		}
-		pemKey, err := publicKeyPEM(resp.Key)
-		if err != nil {
-			return provider.SecretValue{}, err
-		}
-		return provider.NewSecretValue([]byte(pemKey)), nil
-	case provider.TypeCertificate:
-		resp, err := vc.certs.GetCertificate(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, cleanError(err)
-		}
-		if len(resp.CER) == 0 {
-			return provider.SecretValue{}, errors.New("certificate has no public certificate yet (pending issuance?)")
-		}
-		return provider.NewSecretValue([]byte(certPEM(resp.CER))), nil
-	}
-	return provider.SecretValue{}, provider.ErrUnsupported
 }
 
 // VersionedValue is Value, with the version read.
 func (p *Provider) VersionedValue(ctx context.Context, o provider.Object) (provider.SecretValue, string, error) {
-	if o.Type != provider.TypeSecret {
-		v, err := p.Value(ctx, o)
-		return v, o.Version, err
-	}
 	vc, err := p.clients(o.Container.Detail)
 	if err != nil {
 		return provider.SecretValue{}, "", err
 	}
+	var text string
+	switch o.Type {
+	case provider.TypeSecret:
 		resp, err := vc.secrets.GetSecret(ctx, o.Name, o.Version, nil)
 		if err != nil {
 			return provider.SecretValue{}, "", cleanError(err)
@@ -502,6 +459,27 @@ func (p *Provider) VersionedValue(ctx context.Context, o provider.Object) (provi
 			version = resp.ID.Version()
 		}
 		return provider.NewSecretValue([]byte(deref(resp.Value))), version, nil
+	case provider.TypeKey:
+		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
+		if err != nil {
+			return provider.SecretValue{}, "", cleanError(err)
+		}
+		if text, err = publicKeyPEM(resp.Key); err != nil {
+			return provider.SecretValue{}, "", err
+		}
+	case provider.TypeCertificate:
+		resp, err := vc.certs.GetCertificate(ctx, o.Name, o.Version, nil)
+		if err != nil {
+			return provider.SecretValue{}, "", cleanError(err)
+		}
+		if len(resp.CER) == 0 {
+			return provider.SecretValue{}, "", errors.New("certificate has no public certificate yet (pending issuance?)")
+		}
+		text = certPEM(resp.CER)
+	default:
+		return provider.SecretValue{}, "", provider.ErrUnsupported
+	}
+	return provider.NewSecretValue([]byte(text)), o.Version, nil
 }
 
 var (

internal/provider/azure/convert.go

@@ -55,8 +55,8 @@ func PortalResourceURL(tenant, resourceID, blade string) string {
 
 // portalAssetURL links to a Key Vault object's page: a version's with
 // one in objectID; a secret's own (its versions) without.
-func portalAssetURL(tenant, kind, objectID string) string {
+func portalAssetURL(tenant string, t provider.ObjectType, objectID string) string {
-	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + kind + "/" + objectID
+	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + string(t) + "/" + objectID
 }
 
 func tenantPrefix(tenant string) string {
@@ -73,19 +73,13 @@ func ObjectListURL(c provider.Container, t provider.ObjectType) string {
 	if !ok {
 		return ""
 	}
-	switch t {
+	return base + "/" + t.Collection()
-	case provider.TypeKey:
-		return base + "/keys"
-	case provider.TypeCertificate:
-		return base + "/certificates"
-	}
-	return base + "/secrets"
 }
 
 // objectURL is the data-plane URL of an object, e.g.
 // https://kv.vault.azure.net/secrets/name.
-func objectURL(c provider.Container, collection, name string) string {
+func objectURL(c provider.Container, t provider.ObjectType, name string) string {
-	return strings.TrimSuffix(c.Detail, "/") + "/" + collection + "/" + name
+	return strings.TrimSuffix(c.Detail, "/") + "/" + t.Collection() + "/" + name
 }
 
 // secretObject is a secret, or a version of one, from a listing. Its URL
@@ -93,7 +87,7 @@ func objectURL(c provider.Container, collection, name string) string {
 // a version, that version's.
 func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant string) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, "secrets", name)
+	url := objectURL(c, provider.TypeSecret, name)
 	o := provider.Object{
 		Container:   c,
 		Type:        provider.TypeSecret,
@@ -103,7 +97,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant st
 		ContentType: deref(p.ContentType),
 		Tags:        tags(p.Tags),
 		Reference:   "@Microsoft.KeyVault(SecretUri=" + url + ")",
-		URL:         portalAssetURL(tenant, "Secret", strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
+		URL:         portalAssetURL(tenant, provider.TypeSecret, strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
 	}
 	if a := p.Attributes; a != nil {
 		o.Enabled, o.Updated, o.Expires = a.Enabled, deref(a.Updated), deref(a.Expires)
@@ -113,7 +107,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant st
 
 func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 	name := p.KID.Name()
-	url := objectURL(c, "keys", name)
+	url := objectURL(c, provider.TypeKey, name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeKey,
@@ -132,7 +126,7 @@ func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 
 func certObject(c provider.Container, p *azcertificates.CertificateProperties) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, "certificates", name)
+	url := objectURL(c, provider.TypeCertificate, name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeCertificate,

internal/provider/azure/details.go

@@ -2,6 +2,7 @@ package azure
 
 import (
 	"fmt"
+	"maps"
 	"slices"
 	"strings"
 
@@ -70,13 +71,10 @@ func graphInfo(m map[string]any) vaultInfo {
 
 // armInfo reads a vault's settings from the management API.
 func armInfo(v *armkeyvault.Vault) vaultInfo {
-	info := vaultInfo{location: deref(v.Location), tags: map[string]string{}}
+	info := vaultInfo{location: deref(v.Location), tags: tags(v.Tags)}
 	if id, err := arm.ParseResourceID(deref(v.ID)); err == nil {
 		info.group = id.ResourceGroupName
 	}
-	for k, t := range v.Tags {
-		info.tags[k] = deref(t)
-	}
 	pr := v.Properties
 	if pr == nil {
 		return info
@@ -122,7 +120,11 @@ func (v vaultInfo) attrs() []provider.Attr {
 	} else {
 		add("soft delete", "off")
 	}
-	add("purge prot.", map[bool]string{true: "on", false: "off"}[on(v.purge, false)])
+	if on(v.purge, false) {
+		add("purge prot.", "on")
+	} else {
+		add("purge prot.", "off")
+	}
 	switch {
 	case strings.EqualFold(v.publicAccess, "disabled"):
 		add("network", "private endpoints only")
@@ -131,15 +133,13 @@ func (v vaultInfo) attrs() []provider.Attr {
 	default:
 		add("network", "all networks")
 	}
-	if v.endpoints > 0 {
+	switch {
-		add("private", fmt.Sprintf("%d endpoint%s", v.endpoints, map[bool]string{true: "s"}[v.endpoints > 1]))
+	case v.endpoints == 1:
+		add("private", "1 endpoint")
+	case v.endpoints > 1:
+		add("private", fmt.Sprintf("%d endpoints", v.endpoints))
 	}
-	keys := make([]string, 0, len(v.tags))
+	for i, k := range slices.Sorted(maps.Keys(v.tags)) {
-	for k := range v.tags {
-		keys = append(keys, k)
-	}
-	slices.Sort(keys)
-	for i, k := range keys {
 		label := ""
 		if i == 0 {
 			label = "tags"

internal/provider/databricks/databricks.go

@@ -203,17 +203,20 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 	return out, nil
 }
 
-// vaultURL is the backing vault of an AKV-backed scope, or "". It falls
+// fallbackVault is the backing vault of an AKV-backed scope, to read it
-// back to the scope's Detail, so a scope remembered from an earlier session
+// from when Databricks fails, or "" when there's none to fall back to. It
-// (a favourite) works before its workspace's scopes are listed.
+// falls back to the scope's Detail, so a scope remembered from an earlier
-func (p *Provider) vaultURL(c provider.Container) string {
+// session (a favourite) works before its workspace's scopes are listed.
+func (p *Provider) fallbackVault(ctx context.Context, c provider.Container) string {
+	if p.keyVault == nil || ctx.Err() != nil {
+		return ""
+	}
 	p.mu.Lock()
 	url := p.vaults[c.ID]
 	p.mu.Unlock()
 	if url == "" {
-		url, _ = strings.CutPrefix(c.Detail, akvDetail)
+		if detail, ok := strings.CutPrefix(c.Detail, akvDetail); ok {
-		if url == c.Detail {
+			url = detail
-			url = ""
 		}
 	}
 	return url
@@ -264,8 +267,8 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 
 // vaultObjects lists an AKV-backed scope's secrets from the vault itself.
 func (p *Provider) vaultObjects(ctx context.Context, c provider.Container) ([]provider.Object, error) {
-	url := p.vaultURL(c)
+	url := p.fallbackVault(ctx, c)
-	if url == "" || p.keyVault == nil || ctx.Err() != nil {
+	if url == "" {
 		return nil, errNoFallback
 	}
 	secrets, err := p.keyVault.Objects(ctx, provider.Container{Detail: url}, provider.TypeSecret)
@@ -302,8 +305,8 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	}
 	dbxErr := classify(pr, err)
 
-	url := p.vaultURL(o.Container)
+	url := p.fallbackVault(ctx, o.Container)
-	if url == "" || p.keyVault == nil || ctx.Err() != nil {
+	if url == "" {
 		return provider.SecretValue{}, dbxErr
 	}
 	v, kvErr := p.keyVault.Value(ctx, provider.Object{

internal/provider/fake/fake.go

@@ -48,19 +48,8 @@ func newProvider(kind provider.Kind, delay time.Duration) *Provider {
 
 func (p *Provider) Kind() provider.Kind { return p.kind }
 
-func (p *Provider) ID() string {
+func (p *Provider) ID() string    { return cmp.Or(p.id, string(p.kind)) }
-	if p.id != "" {
+func (p *Provider) Label() string { return cmp.Or(p.label, string(p.kind)) }
-		return p.id
-	}
-	return string(p.kind)
-}
-
-func (p *Provider) Label() string {
-	if p.label != "" {
-		return p.label
-	}
-	return string(p.kind)
-}
 
 // As renames the provider, to simulate several accounts of one kind.
 func (p *Provider) As(id, label string) *Provider {
@@ -218,14 +207,25 @@ func (p *Provider) addContainer(src provider.Source, name, detail string, types
 	return c
 }
 
+// Expire sets when the object name in vault expires, for --demo: a date
+// relative to today in the test data would change the tests' screenshots
+// from day to day.
+func (p *Provider) Expire(vault, name string, at time.Time) {
+	for _, objs := range p.objects {
+		for i := range objs {
+			if objs[i].Container.Name == vault && objs[i].Name == name {
+				objs[i].Expires = at
+			}
+		}
+	}
+}
+
 func (p *Provider) add(c provider.Container, t provider.ObjectType, o provider.Object, value string) provider.Object {
 	o.Container = c
 	o.Type = t
 	o.ID = c.ID + "/" + strings.ToLower(string(t)) + "/" + o.Name
 	if base, ok := strings.CutSuffix(c.URL, "/overview"); ok {
-		o.URL = base + map[provider.ObjectType]string{
+		o.URL = base + "/" + t.Collection()
-			provider.TypeSecret: "/secrets", provider.TypeKey: "/keys", provider.TypeCertificate: "/certificates",
-		}[t]
 	}
 	k := listKey{c.ID, t}
 	p.objects[k] = append(p.objects[k], o)
@@ -239,11 +239,7 @@ func (p *Provider) fail(c provider.Container, err error, types ...provider.Objec
 	}
 }
 
-var (
+var base = time.Date(2026, 9, 1, 9, 30, 0, 0, time.UTC)
-	base = time.Date(2026, 9, 1, 9, 30, 0, 0, time.UTC)
-	yes  = true
-	no   = false
-)
 
 // ErrForbidden mimics a data-plane permission error from a backend.
 var ErrForbidden = errors.New("403 Forbidden: caller lacks permission to list secrets")
@@ -258,12 +254,13 @@ const (
 
 var allTypes = []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate}
 
+func secretRef(vault, name string) string {
+	return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
+}
+
 // Azure returns a fake Azure provider with two subscriptions.
 func Azure(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
-	secretRef := func(vault, name string) string {
-		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
-	}
 	objectURL := func(vault, kind, name string) string {
 		return fmt.Sprintf("https://%s.vault.azure.net/%s/%s", vault, kind, name)
 	}
@@ -271,28 +268,32 @@ func Azure(delay time.Duration) *Provider {
 	prod := p.addSource("sub-prod", "platform-prod", "tenant: example.onmicrosoft.com")
 	kv := p.addContainer(prod, "kv-app-prod", "https://kv-app-prod.vault.azure.net", allTypes...)
 	dbPassword := p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "db-password", Version: "3f9c2a", Enabled: &yes, Updated: base,
+		Name: "db-password", Version: "3f9c2a", Enabled: new(true), Updated: base,
 		Expires: base.AddDate(1, 0, 0), ContentType: "text/plain",
 		Tags: map[string]string{"owner": "data", "env": "prod"}, Reference: secretRef("kv-app-prod", "db-password"),
 	}, "correct-horse-battery-staple")
 	p.versions[dbPassword.ID] = []provider.Object{
-		{Version: "3f9c2a", Enabled: &yes, Updated: base, Expires: base.AddDate(1, 0, 0), ContentType: "text/plain"},
+		{Version: "3f9c2a", Enabled: new(true), Updated: base, Expires: base.AddDate(1, 0, 0), ContentType: "text/plain"},
-		{Version: "91d3e0", Enabled: &yes, Updated: base.AddDate(0, -6, 0), Expires: base.AddDate(0, -1, 0)},
+		{Version: "91d3e0", Enabled: new(true), Updated: base.AddDate(0, -6, 0), Expires: base.AddDate(0, -1, 0)},
-		{Version: "0a77c4", Enabled: &no, Updated: base.AddDate(-1, 0, 0)},
+		{Version: "0a77c4", Enabled: new(false), Updated: base.AddDate(-1, 0, 0)},
 	}
 	p.values[dbPassword.ID+"@91d3e0"] = "previous-password"
 	p.values[dbPassword.ID+"@0a77c4"] = "original-password"
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "api-key", Version: "a17b04", Enabled: &yes, Updated: base.AddDate(0, -2, 0),
+		Name: "api-key", Version: "a17b04", Enabled: new(true), Updated: base.AddDate(0, -2, 0),
 		Reference: secretRef("kv-app-prod", "api-key"),
 	}, "sk_live_51HxDEMO0000000000000000")
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "legacy-token", Version: "0c11de", Enabled: &no, Updated: base.AddDate(-1, 0, 0),
+		Name: "legacy-token", Version: "0c11de", Enabled: new(true), Updated: base.AddDate(-1, 0, 0),
 		Expires: base.AddDate(0, -3, 0), Reference: secretRef("kv-app-prod", "legacy-token"),
 	}, "deprecated")
+	p.add(kv, provider.TypeSecret, provider.Object{
+		Name: "smtp-password", Version: "7d2e90", Enabled: new(false), Updated: base.AddDate(0, -2, 0),
+		Reference: secretRef("kv-app-prod", "smtp-password"),
+	}, "smtp-demo-password")
 
 	p.add(kv, provider.TypeKey, provider.Object{
-		Name: "signing-key", Version: "5e21b7", Enabled: &yes, Updated: base.AddDate(0, -3, 0),
+		Name: "signing-key", Version: "5e21b7", Enabled: new(true), Updated: base.AddDate(0, -3, 0),
 		Attrs: []provider.Attr{
 			{Label: "key type", Value: "RSA 2048"},
 			{Label: "ops", Value: "sign, verify"},
@@ -300,7 +301,7 @@ func Azure(delay time.Duration) *Provider {
 		Reference: objectURL("kv-app-prod", "keys", "signing-key"),
 	}, demoPublicKey)
 	p.add(kv, provider.TypeKey, provider.Object{
-		Name: "data-encryption", Version: "c40f19", Enabled: &yes, Updated: base.AddDate(0, -5, 0),
+		Name: "data-encryption", Version: "c40f19", Enabled: new(true), Updated: base.AddDate(0, -5, 0),
 		Attrs: []provider.Attr{
 			{Label: "key type", Value: "EC P-256"},
 			{Label: "ops", Value: "wrapKey, unwrapKey"},
@@ -309,7 +310,7 @@ func Azure(delay time.Duration) *Provider {
 	}, demoPublicKey)
 
 	p.add(kv, provider.TypeCertificate, provider.Object{
-		Name: "app-tls", Version: "77e0aa", Enabled: &yes, Updated: base.AddDate(0, -1, 0),
+		Name: "app-tls", Version: "77e0aa", Enabled: new(true), Updated: base.AddDate(0, -1, 0),
 		Expires: base.AddDate(0, 11, 0), ContentType: "application/x-pem-file",
 		Attrs: []provider.Attr{
 			{Label: "subject", Value: "CN=app.example.com"},
@@ -321,7 +322,7 @@ func Azure(delay time.Duration) *Provider {
 		Reference: objectURL("kv-app-prod", "certificates", "app-tls"),
 	}, demoCert)
 	p.add(kv, provider.TypeCertificate, provider.Object{
-		Name: "old-tls", Version: "19ab3c", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
+		Name: "old-tls", Version: "19ab3c", Enabled: new(true), Updated: base.AddDate(-1, 0, 0),
 		Expires: base.AddDate(0, -6, 0), ContentType: "application/x-pkcs12",
 		Attrs: []provider.Attr{
 			{Label: "subject", Value: "CN=old.example.com"},
@@ -334,10 +335,10 @@ func Azure(delay time.Duration) *Provider {
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
 	// A key to share env files with (S → f): random, as sharing.keyRules wants.
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "env-share", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
+		Name: "env-share", Enabled: new(true), Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
 	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "smtp-password", Enabled: new(true), Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	p.fail(shared, ErrForbiddenKeys, provider.TypeKey)
 
@@ -347,19 +348,19 @@ func Azure(delay time.Duration) *Provider {
 	dev := p.addSource("sub-dev", "platform-dev", "tenant: example.onmicrosoft.com")
 	kvDev := p.addContainer(dev, "kv-app-dev", "https://kv-app-dev.vault.azure.net", allTypes...)
 	p.add(kvDev, provider.TypeSecret, provider.Object{
-		Name: "db-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
+		Name: "db-password", Enabled: new(true), Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
 	}, "dev-password")
 	// Left behind, as dev vaults are: expired, disabled, or both.
 	p.add(kvDev, provider.TypeSecret, provider.Object{
-		Name: "stripe-webhook-secret", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
+		Name: "stripe-webhook-secret", Enabled: new(true), Updated: base.AddDate(-1, 0, 0),
 		Expires: base.AddDate(0, -2, 0), Reference: secretRef("kv-app-dev", "stripe-webhook-secret"),
 	}, "whsec_demo_expired")
 	p.add(kvDev, provider.TypeSecret, provider.Object{
-		Name: "test-user-password", Enabled: &no, Updated: base.AddDate(0, -5, 0),
+		Name: "test-user-password", Enabled: new(false), Updated: base.AddDate(0, -5, 0),
 		Reference: secretRef("kv-app-dev", "test-user-password"),
 	}, "disabled-demo-password")
 	p.add(kvDev, provider.TypeSecret, provider.Object{
-		Name: "vendor-token", Enabled: &no, Updated: base.AddDate(-2, 0, 0),
+		Name: "vendor-token", Enabled: new(false), Updated: base.AddDate(-2, 0, 0),
 		Expires: base.AddDate(-1, 0, 0), Reference: secretRef("kv-app-dev", "vendor-token"),
 	}, "expired-and-disabled")
 
@@ -371,24 +372,21 @@ func Azure(delay time.Duration) *Provider {
 // its own, like an admin account next to a personal one.
 func AzureOps(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
-	secretRef := func(vault, name string) string {
-		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
-	}
 
 	prod := p.addSource("sub-prod", "platform-prod", "tenant: example.onmicrosoft.com")
 	breakGlass := p.addContainer(prod, "kv-breakglass", "https://kv-breakglass.vault.azure.net", allTypes...)
 	p.add(breakGlass, provider.TypeSecret, provider.Object{
-		Name: "emergency-admin", Enabled: &yes, Updated: base.AddDate(0, -4, 0),
+		Name: "emergency-admin", Enabled: new(true), Updated: base.AddDate(0, -4, 0),
 		Expires: time.Now().AddDate(0, 0, 5).Truncate(24 * time.Hour), // soon, whenever the demo runs
 		Tags:    map[string]string{"owner": "ops"}, Reference: secretRef("kv-breakglass", "emergency-admin"),
 	}, "break-glass-demo-password")
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "smtp-password", Enabled: new(true), Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	// Unlike the first account, ops may read keys here.
 	p.add(shared, provider.TypeKey, provider.Object{
-		Name: "backup-encryption", Version: "e9a102", Enabled: &yes, Updated: base.AddDate(0, -2, 0),
+		Name: "backup-encryption", Version: "e9a102", Enabled: new(true), Updated: base.AddDate(0, -2, 0),
 		Attrs:     []provider.Attr{{Label: "key type", Value: "RSA-HSM 3072"}, {Label: "ops", Value: "wrapKey, unwrapKey"}},
 		Reference: "https://kv-shared-prod.vault.azure.net/keys/backup-encryption",
 	}, demoPublicKey)
@@ -396,12 +394,12 @@ func AzureOps(delay time.Duration) *Provider {
 	sandbox := p.addSource("sub-ops", "ops-sandbox", "tenant: example.onmicrosoft.com")
 	kv := p.addContainer(sandbox, "kv-ops-tools", "https://kv-ops-tools.vault.azure.net", allTypes...)
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "pagerduty-token", Enabled: &yes, Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
+		Name: "pagerduty-token", Enabled: new(true), Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
 	}, "pd-demo-token")
 	// Expiring soon whenever the demo runs: the other dates are fixed,
 	// and would have passed. Tests use the first account only.
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "grafana-api-key", Enabled: &yes, Updated: base.AddDate(0, -11, 0),
+		Name: "grafana-api-key", Enabled: new(true), Updated: base.AddDate(0, -11, 0),
 		Expires: time.Now().AddDate(0, 0, 12).Truncate(24 * time.Hour), Reference: secretRef("kv-ops-tools", "grafana-api-key"),
 	}, "glsa_demo_expiring")
 

internal/provider/fake/seed.go

@@ -32,9 +32,13 @@ func Seed(st *store.Store, alice, admin string) {
 			path: []string{"platform-prod", "kv-breakglass"}, star: true, note: "incidents only: tell #ops when used"},
 		{link: azure + "kv-shared-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
 			path: []string{"platform-prod", "kv-shared-prod"}, uses: 2, ago: 26 * time.Hour},
+		{link: azure + "kv-app-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-app-prod"}, note: "migrated to Microsoft Graph sendMail; delete after Q4"},
 		{link: dbx + "app/storage-key", account: "Databricks", source: "dbx-prod",
 			path: []string{"prod", "app"}, star: true, uses: 3, ago: 5 * time.Hour},
-		// A subscription, and a repo's file.
+		// A subscription, for both accounts, and a repo's file.
+		{link: azure + "subscriptions/sub-prod", account: alice, source: "sub-prod",
+			name: "platform-prod", star: true},
 		{link: azure + "subscriptions/sub-prod", account: admin, source: "sub-prod",
 			name: "platform-prod", star: true},
 		{link: "lazysecrets://repo/github.com%2Facme%2Flazysecrets-demo/deploy%2Fprod%2Fsecrets.yaml", account: "Repos",

internal/provider/provider.go

@@ -84,6 +84,20 @@ const (
 	TypeCertificate ObjectType = "Certificate"
 )
 
+// Collection is the type's path segment in Key Vault URLs and links, e.g.
+// "secrets".
+func (t ObjectType) Collection() string {
+	switch t {
+	case TypeSecret:
+		return "secrets"
+	case TypeKey:
+		return "keys"
+	case TypeCertificate:
+		return "certificates"
+	}
+	return ""
+}
+
 // Container holds objects: a Key Vault or a Databricks secret scope.
 type Container struct {
 	Source Source

internal/provider/repo/repo.go

@@ -1,6 +1,6 @@
 // Package repo browses the encrypted secret files in git repositories:
 // a repo is a source, its secret files the containers (vault level), and
-// their keys the secrets. SOPS files are the one type so far.
+// their keys the secrets. Secret files are SOPS files and plain env files.
 //
 // Listing never decrypts: SOPS encrypts values only, so a file's keys and
 // metadata are read directly. A value is decrypted when it's revealed or
@@ -106,8 +106,6 @@ func (p *Provider) load() {
 				roots = append(roots, root)
 			}
 		}
-		// The repo lazysecrets started in, if any: marked, so the UI can
-		// put it on top, with its files under Dir first.
 		here, inRepo := p.current()
 		if inRepo {
 			seen[here.root] = true
@@ -137,7 +135,6 @@ func (p *Provider) load() {
 				add(root)
 			}
 		}
-		// Repos you starred something in, wherever they are.
 		for _, dir := range p.s.Starred {
 			if root, err := gitRoot(dir); err == nil {
 				add(root)
@@ -206,13 +203,11 @@ func parallel(n int, f func(i int)) {
 	var wg sync.WaitGroup
 	sem := make(chan struct{}, max(8, runtime.NumCPU()))
 	for i := range n {
-		wg.Add(1)
+		wg.Go(func() {
-		go func() {
-			defer wg.Done()
 			sem <- struct{}{}
 			defer func() { <-sem }()
 			f(i)
-		}()
+		})
 	}
 	wg.Wait()
 }
@@ -361,30 +356,23 @@ func (p *Provider) Objects(_ context.Context, c provider.Container, t provider.O
 	if err != nil {
 		return nil, err
 	}
-	meta, isSops := readMeta(c.ID)
+	meta, isSops := parseMeta(c.ID, b)
 	keys, err := parseKeys(c.ID, b)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", c.Name, err)
 	}
-	if !isSops { // a plain env file
+	attrs := []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}}
-		out := make([]provider.Object, 0, len(keys))
+	if isSops {
-		for _, k := range keys {
+		attrs = []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}}
-			out = append(out, provider.Object{
-				Container: c, Type: provider.TypeSecret, ID: c.ID + "\x00" + k.extract, Name: k.name,
-				Attrs: []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}},
-			})
-		}
-		return out, nil
 	}
 	out := make([]provider.Object, 0, len(keys))
 	for _, k := range keys {
 		o := provider.Object{
 			Container: c, Type: provider.TypeSecret,
-			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified,
+			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified, Attrs: attrs,
-			Attrs: []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}},
 		}
-		if !k.encrypted {
+		if isSops && !k.encrypted {
-			o.Attrs = append(o.Attrs, provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
+			o.Attrs = append(slices.Clip(attrs), provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
 		}
 		out = append(out, o)
 	}
@@ -403,10 +391,7 @@ func (p *Provider) Versions(context.Context, provider.Object) ([]provider.Object
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	file, extract, ok := strings.Cut(o.ID, "\x00")
 	if !ok { // made from a link: the repo's root, the file's path, the key
-		file = o.Container.ID
+		file = filePath(o.Container)
-		if file == "" {
-			file = filepath.Join(o.Container.Source.ID, filepath.FromSlash(o.Container.Name))
-		}
 		extract = extractFor(file, o.Name)
 	}
 	if _, isSops := readMeta(file); !isSops {
@@ -434,12 +419,18 @@ func (p *Provider) Contents(_ context.Context, c provider.Container) ([]byte, er
 	return os.ReadFile(f.Path)
 }
 
+// filePath is the file c is. A container made from a link has no ID: the
+// file is its path in the repo.
+func filePath(c provider.Container) string {
+	if c.ID != "" {
+		return c.ID
+	}
+	return filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
+}
+
 // File is the file c is, and the line o's key is on.
 func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File, error) {
-	path := c.ID
+	path := filePath(c)
-	if path == "" { // made from a link
-		path = filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
-	}
 	f := provider.File{Path: path}
 	if _, isSops := readMeta(path); isSops {
 		f.Sops = p.s.Sops
@@ -609,34 +600,39 @@ type lazysecretsFile struct {
 
 // ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
 func ShareKey(root string) (string, error) {
+	f, err := readLazysecretsFile(root)
+	return f.Sharing.Key, err
+}
+
+// readLazysecretsFile reads the repo's .lazysecrets.yaml; without one, it's
+// empty.
+func readLazysecretsFile(root string) (lazysecretsFile, error) {
+	var f lazysecretsFile
 	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
 	if errors.Is(err, os.ErrNotExist) {
-		return "", nil
+		return f, nil
 	}
 	if err != nil {
-		return "", err
+		return f, err
 	}
-	var f lazysecretsFile
 	if err := yaml.Unmarshal(b, &f); err != nil {
-		return "", fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
+		return f, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 	}
-	return f.Sharing.Key, nil
+	return f, nil
 }
 
 // selector says which files to look at: user (the include/exclude of the
 // repo's .lazysecrets.yaml or the config) for every file, and sopsWhere
 // (.sops.yaml's creation_rules, when there's no include) for SOPS files.
 func (p *Provider) selector(root string, files []string) (user, sopsWhere func(string) bool, err error) {
-	include, exclude := p.s.Include, p.s.Exclude
+	f, err := readLazysecretsFile(root)
-	if b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml")); err == nil {
+	if err != nil {
-		var f lazysecretsFile
+		return nil, nil, err
-		if err := yaml.Unmarshal(b, &f); err != nil {
-			return nil, nil, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 	}
+	include, exclude := p.s.Include, p.s.Exclude
 	if len(f.Include) > 0 || len(f.Exclude) > 0 {
 		include, exclude = f.Include, f.Exclude
 	}
-	}
 	inc, err := globs(include)
 	if err != nil {
 		return nil, nil, err
@@ -907,12 +903,21 @@ func readMeta(file string) (sopsMeta, bool) {
 		return sopsMeta{}, false // not a format sops writes: skip reading
 	}
 	b, err := os.ReadFile(file)
-	if err != nil || !bytes.Contains(b, []byte("sops")) {
+	if err != nil {
+		return sopsMeta{}, false
+	}
+	return parseMeta(file, b)
+}
+
+// parseMeta is readMeta, of the file's contents b.
+func parseMeta(file string, b []byte) (sopsMeta, bool) {
+	format := formatOf(file)
+	if len(b) > maxFileSize || format == "" || !bytes.Contains(b, []byte("sops")) {
 		return sopsMeta{}, false // cheap: most files aren't sops, no parsing
 	}
 	var m sopsMeta
 	known := []string{"age", "azure_kv", "kms", "gcp_kms", "hc_vault", "pgp"}
-	switch formatOf(file) {
+	switch format {
 	case "yaml", "json":
 		var doc struct {
 			Sops map[string]any `yaml:"sops"`

internal/provider/value.go

@@ -21,8 +21,6 @@ func NewSecretValue(b []byte) SecretValue {
 // Reveal returns the plaintext. Call it only to display or copy the value.
 func (v SecretValue) Reveal() string { return string(v.b) }
 
-func (v SecretValue) Len() int { return len(v.b) }
-
 func (v SecretValue) String() string   { return masked }
 func (v SecretValue) GoString() string { return masked }
 

internal/ref/ref.go

@@ -92,15 +92,9 @@ func (r Ref) ContainerName() string {
 // Container.Detail.
 func (r Ref) VaultURL() string { return "https://" + r.Host + "/" }
 
-var collections = map[provider.ObjectType]string{
-	provider.TypeSecret:      "secrets",
-	provider.TypeKey:         "keys",
-	provider.TypeCertificate: "certificates",
-}
-
 func typeOf(collection string) (provider.ObjectType, bool) {
-	for t, c := range collections {
+	for _, t := range []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate} {
-		if strings.EqualFold(c, collection) {
+		if strings.EqualFold(t.Collection(), collection) {
 			return t, true
 		}
 	}
@@ -118,7 +112,7 @@ func (r Ref) IdentifierURL() string {
 	if r.Type == "" {
 		return u + "/"
 	}
-	for _, seg := range []string{collections[r.Type], r.Name, r.Version} {
+	for _, seg := range []string{r.Type.Collection(), r.Name, r.Version} {
 		if seg != "" {
 			u += "/" + url.PathEscape(seg)
 		}
@@ -140,7 +134,7 @@ func (r Ref) String() string {
 		segs = append(segs, r.Scope, r.Name)
 	default:
 		if r.Type != "" {
-			segs = append(segs, collections[r.Type])
+			segs = append(segs, r.Type.Collection())
 		}
 		segs = append(segs, r.Name, r.Version)
 	}
@@ -273,7 +267,7 @@ func parseLink(s string) (Ref, error) {
 	r.Host = strings.ToLower(segs[0])
 	rest := segs[1:]
 
-	switch strings.ToLower(u.Host) {
+	switch host := strings.ToLower(u.Host); host {
 	case "azure":
 		r.Kind = provider.KindAzure
 		if r.Host == "subscriptions" {
@@ -300,11 +294,11 @@ func parseLink(s string) (Ref, error) {
 		}
 	case "databricks", "repo":
 		r.Kind = provider.KindDatabricks
-		if strings.EqualFold(u.Host, "repo") {
+		if host == "repo" {
 			r.Kind = provider.KindRepo
 		}
 		if len(rest) > 2 {
-			return Ref{}, fmt.Errorf("%s link has too many parts", strings.ToLower(u.Host))
+			return Ref{}, fmt.Errorf("%s link has too many parts", host)
 		}
 		if len(rest) > 0 {
 			r.Scope = rest[0]

internal/share/rules.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strings"
 	"unicode"
+	"unicode/utf8"
 )
 
 // Rules are what a key's value must be to share with it: random enough
@@ -40,14 +41,18 @@ func (r Rules) Check(key []byte) error {
 			kinds++
 		}
 	}
-	n := len([]rune(s))
+	n := utf8.RuneCountInString(s)
 	var has, needs []string
 	if n < r.MinLength {
 		has = append(has, fmt.Sprintf("%d characters", n))
 		needs = append(needs, fmt.Sprintf("%d (minLength)", r.MinLength))
 	}
 	if kinds < r.MinClasses {
-		has = append(has, fmt.Sprintf("%d %s of character", kinds, map[bool]string{true: "kind", false: "kinds"}[kinds == 1]))
+		kind := "kinds"
+		if kinds == 1 {
+			kind = "kind"
+		}
+		has = append(has, fmt.Sprintf("%d %s of character", kinds, kind))
 		needs = append(needs, fmt.Sprintf("%d of lowercase, uppercase, digits and symbols (minClasses)", r.MinClasses))
 	}
 	if len(has) == 0 {

internal/share/share.go

@@ -174,7 +174,7 @@ func Read(r ref.Ref) (Sealed, error) {
 		return Sealed{}, errors.New("share link is from a newer lazysecrets: update it (lazysecrets update)")
 	}
 	n, size := binary.Uvarint(b[1:])
-	if size <= 0 || n > uint64(len(b)) {
+	if size <= 0 {
 		return Sealed{}, bad
 	}
 	rest := b[1+size:]

internal/store/store.go

@@ -43,6 +43,13 @@ type Node struct {
 // alone isn't.
 func (n Node) keep() bool { return len(n.StarredBy) > 0 || n.Note != "" || n.Uses > 0 }
 
+// UsedLately reports whether the item was used within the last 90 days
+// (what Recent lists). Starred and noted records are kept longer, so a
+// use alone doesn't say.
+func (n Node) UsedLately(now time.Time) bool {
+	return !n.LastUsed.IsZero() && now.Sub(n.LastUsed) <= usageMaxAge
+}
+
 // StarredFor reports whether the item is starred for account.
 func (n Node) StarredFor(account string) bool { return slices.Contains(n.StarredBy, account) }
 

internal/store/store_test.go

@@ -119,3 +119,15 @@ func TestStarsPerAccount(t *testing.T) {
 		t.Errorf("unstar alice: %v", n.StarredBy)
 	}
 }
+
+func TestUsedLately(t *testing.T) {
+	now := time.Now()
+	for ago, want := range map[time.Duration]bool{time.Hour: true, 89 * 24 * time.Hour: true, 2 * 365 * 24 * time.Hour: false} {
+		if got := (Node{LastUsed: now.Add(-ago)}).UsedLately(now); got != want {
+			t.Errorf("used %v ago: %v", ago, got)
+		}
+	}
+	if (Node{}).UsedLately(now) {
+		t.Error("never used is lately")
+	}
+}

internal/ui/app/app.go

@@ -3,11 +3,11 @@
 package app
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"image/color"
-	"math"
 	"os"
 	"os/exec"
 	"strings"
@@ -213,6 +213,9 @@ type Model struct {
 	statusW     int // the status pane's width: the left column's, zoomed or not
 	changelog   []panes.Field
 	cacheDirty  bool
+	// cacheDropped are cache keys deleted since the last save, so saving
+	// deletes them from the file too.
+	cacheDropped map[string]bool
 	sourcesAt    map[string]time.Time
 	placeDir     string
 	savedPlace   string // the link last saved as the place
@@ -651,7 +654,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	case detailsMsg:
 		if msg.req == m.reqID[slotDetails] {
-			m.done(slotDetails)
+			m.cancelReq(slotDetails)
 		}
 		if errors.Is(msg.err, context.Canceled) || errors.Is(msg.err, context.DeadlineExceeded) {
 			delete(m.details, msg.key) // tried again when shown again
@@ -682,13 +685,13 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotContainers] {
 			break
 		}
-		m.done(slotContainers)
+		m.cancelReq(slotContainers)
 		if msg.err != nil {
 			m.noteErr(msg.err)
 			if src, ok := m.selectedSource(); ok {
 				m.logErrOf(src.Name, msg.err)
 			}
-			delete(m.cache.containers, msg.key)
+			uncache(&m, m.cache.containers, msg.key)
 			m.containers.SetError(msg.err)
 		} else {
 			m.cache.containers[msg.key] = entry[[]provider.Container]{msg.items, m.now()}
@@ -700,7 +703,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotObjects] {
 			break
 		}
-		m.done(slotObjects)
+		m.cancelReq(slotObjects)
 		if errors.Is(msg.err, provider.ErrUnsupported) && m.versionsOf != nil {
 			m.flash = warning(fmt.Sprintf("versions aren't supported for %s", m.versionsOf.Container.Source.Kind))
 			m.closeVersions()
@@ -709,7 +712,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if c, ok := m.containers.Selected(); ok {
 				m.logErrOf(c.Name, msg.err)
 			}
-			delete(m.cache.objects, msg.key)
+			uncache(&m, m.cache.objects, msg.key)
 			m.secrets.SetError(msg.err)
 		} else {
 			if msg.bound != nil {
@@ -721,7 +724,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if m.versionsOf != nil {
 				m.setVersions(msg.items)
 			} else {
-				m.secrets.SetItems(m.starredFirst(msg.items))
+				m.secrets.SetItems(m.starredObjectsFirst(msg.items))
 				cmds = append(cmds, m.refreshShown(before))
 			}
 		}
@@ -730,7 +733,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotValue] {
 			break
 		}
-		m.done(slotValue)
+		m.cancelReq(slotValue)
 		if msg.err != nil {
 			m.noteErr(msg.err)
 			m.logErrOf(msg.obj.Container.Name+"/"+msg.obj.Name, msg.err)
@@ -745,7 +748,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotVersions] {
 			break
 		}
-		m.done(slotVersions)
+		m.cancelReq(slotVersions)
 		// Errors and unsupported providers just leave the count out.
 		if msg.err == nil {
 			m.cache.objects[msg.key] = entry[[]provider.Object]{msg.items, m.now()}
@@ -757,7 +760,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotDescribe] {
 			break
 		}
-		m.done(slotDescribe)
+		m.cancelReq(slotDescribe)
 		if msg.err != nil {
 			m.noteErr(msg.err)
 			m.logErrOf(msg.obj.Container.Name+"/"+msg.obj.Name, msg.err)
@@ -772,7 +775,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotCopy] {
 			break
 		}
-		m.done(slotCopy)
+		m.cancelReq(slotCopy)
 		if msg.err != nil {
 			m.noteErr(msg.err)
 			m.flash = flash{text: "copy failed: " + msg.err.Error(), isErr: true}
@@ -884,7 +887,7 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 	case key.Matches(msg, k.Quit):
 		return nil, true
 	case key.Matches(msg, k.Help):
-		return m.showKeybindings(), false
+		return m.showKeybindingsFor(""), false
 	case key.Matches(msg, k.Up):
 		m.move(-1)
 	case key.Matches(msg, k.Down):
@@ -1164,14 +1167,11 @@ func (m *Model) syncSelection() tea.Cmd {
 		if m.onLinks() {
 			m.showLinkedContainers()
 		} else if src, ok := m.selectedSource(); ok {
-			m.containers.Title = "[2] Vaults"
 			m.containers.Empty = "no vaults found"
 			switch src.Kind {
 			case provider.KindDatabricks:
-				m.containers.Title = "[2] Scopes"
 				m.containers.Empty = "no secret scopes"
 			case provider.KindRepo:
-				m.containers.Title = "[2] Files"
 				m.containers.Empty = "no SOPS or env files here (see docs/repos.md)"
 			}
 			cmds = append(cmds, m.showContainers(src, id))
@@ -1256,7 +1256,7 @@ func (m *Model) showObjects(c provider.Container, key string) tea.Cmd {
 		m.secrets.SetLoading()
 		return m.loadObjects(c, m.objType, key)
 	}
-	m.secrets.SetItems(m.starredFirst(e.value))
+	m.secrets.SetItems(m.starredObjectsFirst(e.value))
 	m.secrets.Select(m.cache.cursor[key])
 	if e.fresh(m.now()) {
 		return nil
@@ -1316,8 +1316,7 @@ func (m *Model) countVersions(o provider.Object) tea.Cmd {
 	})
 }
 
-// closeVersions returns the Secrets pane to the object list, with the
+// closeVersions returns the Secrets pane to the object list.
-// cursor on the object whose versions were shown.
 func (m *Model) closeVersions() {
 	m.versionsOf = nil
 }
@@ -1514,9 +1513,6 @@ func (m *Model) settled(ctx context.Context, load tea.Cmd) tea.Cmd {
 	}
 }
 
-// done releases the context of a completed request.
-func (m *Model) done(p slot) { m.cancelReq(p) }
-
 // loadSources starts a new generation of source loads, superseding any in
 // flight.
 func (m *Model) loadSources() tea.Cmd {
@@ -1636,7 +1632,7 @@ func (m *Model) describe(o provider.Object) tea.Cmd {
 func (m *Model) copyValue() tea.Cmd {
 	if m.focus == paneDetail && m.fields.Shown() {
 		if f, ok := m.fields.Selected(); ok {
-			return m.copyText(fieldName(f), cmpOr(f.URL, f.Value), false)
+			return m.copyText(fieldName(f), cmp.Or(f.URL, f.Value), false)
 		}
 		return nil
 	}
@@ -1679,12 +1675,8 @@ func (m *Model) copyText(label, text string, sensitive bool) tea.Cmd {
 
 // clipTick fires when the countdown's displayed second next changes.
 func (m *Model) clipTick() tea.Cmd {
-	wait := m.clipDeadline.Sub(m.now()) % time.Second
-	if wait <= 0 {
-		wait = time.Second
-	}
 	token := m.clipToken
-	return tea.Tick(wait, func(time.Time) tea.Msg { return clipTickMsg{token: token} })
+	return tea.Tick(untilNextSecond(m.clipDeadline, m.now()), func(time.Time) tea.Msg { return clipTickMsg{token: token} })
 }
 
 func (m *Model) cancelClipClear() {
@@ -1791,13 +1783,15 @@ func (m Model) footerView() string {
 	} else if l != nil && l.Filtering() {
 		help = m.helpBar(keys.FilterHelp{Map: m.keys}.ShortHelp(), 2)
 	} else {
-		revealed := m.detail.State() == panes.ValueShown
+		reveal := "show"
-		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), revealed: &revealed}.ShortHelp(), 2)
+		if m.detail.State() == panes.ValueShown {
+			reveal = "hide"
+		}
+		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), reveal: reveal}.ShortHelp(), 2)
 	}
 	var lines []string
 	if !m.clipDeadline.IsZero() {
-		left := max(0, int(math.Ceil(m.clipDeadline.Sub(m.now()).Seconds())))
+		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, secondsLeft(m.clipDeadline, m.now())))))
-		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, left))))
 	}
 	if m.flash.text != "" {
 		lines = append(lines, m.flashLine(m.flash))

internal/ui/app/app_test.go

@@ -686,7 +686,7 @@ func TestFilter(t *testing.T) {
 	d.keys("/")
 	d.typeText("api-k")
 	d.keys("enter", "esc") // apply, then esc clears the applied filter
-	if d.m.secrets.Len() != 3 {
+	if d.m.secrets.Len() != 4 {
 		t.Errorf("esc should clear the applied filter, visible = %d", d.m.secrets.Len())
 	}
 	if _, _, s := d.selected(); s != "api-key" {
@@ -698,13 +698,13 @@ func TestMoveWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("a") // all three secrets contain an a
+	d.typeText("a") // all four secrets contain an a
-	if d.m.secrets.Len() != 3 {
+	if d.m.secrets.Len() != 4 {
 		t.Fatalf("visible = %d", d.m.secrets.Len())
 	}
 	_, _, initial := d.selected() // kept from before filtering: the middle row
 	var seen []string
-	for _, k := range []rune{'j', 'j', 'k'} {
+	for _, k := range []rune{'j', 'j', 'j', 'k'} {
 		d.send(tea.KeyPressMsg{Code: k, Mod: tea.ModCtrl})
 		_, _, s := d.selected()
 		seen = append(seen, s)
@@ -712,9 +712,9 @@ func TestMoveWhileFiltering(t *testing.T) {
 	if !d.m.secrets.Filtering() {
 		t.Fatal("ctrl+j/k left filter mode")
 	}
-	// down to the bottom, stay there, back up to where it started
+	// down to the bottom, stay there, back up one
-	if seen[0] == initial || seen[1] != seen[0] || seen[2] != initial {
+	if seen[0] == initial || seen[2] != seen[1] || seen[3] != seen[0] {
-		t.Errorf("from %q, ctrl+j, ctrl+j, ctrl+k selected %v", initial, seen)
+		t.Errorf("from %q, ctrl+j ×3, ctrl+k selected %v", initial, seen)
 	}
 	if !strings.Contains(d.screen(), "ctrl+j/n down") {
 		t.Errorf("filter help missing ctrl+j:\n%s", d.screen())
@@ -991,11 +991,11 @@ func TestRebindingShowsEverywhere(t *testing.T) {
 	if !strings.Contains(scr, "z to reveal") || strings.Contains(scr, "space to reveal") {
 		t.Errorf("detail hint doesn't follow the binding:\n%s", scr)
 	}
-	if !strings.Contains(lastLine(scr), "z show") {
+	if !strings.Contains(lastLines(scr, 1), "z show") {
-		t.Errorf("help bar: %q", lastLine(scr))
+		t.Errorf("help bar: %q", lastLines(scr, 1))
 	}
 	d.keys("z")
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "z hide") {
+	if bar := lastLines(d.screen(), 1); !strings.Contains(bar, "z hide") {
 		t.Errorf("help bar with the value shown: %q", bar)
 	}
 	d.keys("z")
@@ -1125,7 +1125,7 @@ func TestAccountPane(t *testing.T) {
 	if !strings.Contains(scr, "Alice Example") {
 		t.Errorf("account not shown:\n%s", scr)
 	}
-	bar := lastLine(scr)
+	bar := lastLines(scr, 1)
 	if !strings.Contains(bar, "copy") || strings.Contains(bar, "reveal") || strings.Contains(bar, "versions") {
 		t.Errorf("help bar: %q", bar)
 	}

internal/ui/app/cache.go

@@ -66,11 +66,24 @@ func (m *Model) refreshShown(before []provider.Object) tea.Cmd {
 	if i < 0 || sameListing(before[i], s) {
 		return nil
 	}
-	m.detail.Refresh(s)
+	m.detail.SetDescribed(s)
-	delete(m.cache.details, detailKey(s))
+	uncache(m, m.cache.details, detailKey(s))
 	return m.describe(s)
 }
 
+// uncache deletes key from a cache, and, at the next save, from the file.
+func uncache[T any](m *Model, c map[string]entry[T], key string) {
+	if _, ok := c[key]; !ok {
+		return
+	}
+	delete(c, key)
+	if m.cacheDropped == nil {
+		m.cacheDropped = map[string]bool{}
+	}
+	m.cacheDropped[key] = true
+	m.cacheDirty = true
+}
+
 // sameListing reports whether a and b list the same: what a list
 // says of an object, not what describing it adds.
 func sameListing(a, b provider.Object) bool {

internal/ui/app/commands.go

@@ -1,6 +1,7 @@
 package app
 
 import (
+	"cmp"
 	"context"
 	"fmt"
 	"os"
@@ -84,10 +85,7 @@ func (m *Model) showCommands() tea.Cmd {
 	}
 	var opts []option
 	for _, c := range cmds {
-		label := c.Description
+		label := cmp.Or(c.Description, c.Command)
-		if label == "" {
-			label = c.Command
-		}
 		if c.Key != "" {
 			label = m.st.Label.Render(fmt.Sprintf("%-8s", c.Key)) + label
 		}
@@ -122,7 +120,7 @@ func (m *Model) askPrompt(c commands.Command, it commands.Item, obj *provider.Ob
 	in.SetValue(p.Default)
 	in.CursorEnd()
 	m.prompt = &modal{
-		title: cmpOr(c.Description, "Command"), input: &in,
+		title: cmp.Or(c.Description, "Command"), input: &in,
 		submit: func(m *Model, text string) tea.Cmd {
 			it.Prompt[p.Name] = commands.Q(text)
 			return m.askPrompt(c, it, obj, i+1)
@@ -151,7 +149,7 @@ func (m *Model) confirmCommand(c commands.Command, it commands.Item, obj *provid
 	case strings.HasPrefix(c.Value, "env:"):
 		lines = append(lines, "", "It gets the value of "+string(it.Name)+" in $"+strings.TrimPrefix(c.Value, "env:")+".")
 	}
-	m.showMenu("Run "+cmpOr(c.Description, "command")+"?", lines, []option{
+	m.showMenu("Run "+cmp.Or(c.Description, "command")+"?", lines, []option{
 		{key: "y", label: "Run it", run: func(m *Model) tea.Cmd { return m.runCommand(c, rendered, obj) }},
 	})
 	return nil
@@ -177,7 +175,7 @@ func (m *Model) runCommand(c commands.Command, rendered string, obj *provider.Ob
 
 // execCommand runs the command as its output mode says.
 func (m *Model) execCommand(c commands.Command, rendered string, value provider.SecretValue) tea.Cmd {
-	shell := cmpOr(os.Getenv("SHELL"), "/bin/sh")
+	shell := cmp.Or(os.Getenv("SHELL"), "/bin/sh")
 	setValue := func(cmd *exec.Cmd) {
 		switch {
 		case c.Value == "stdin":
@@ -195,7 +193,7 @@ func (m *Model) execCommand(c commands.Command, rendered string, value provider.
 		m.flash = flash{}
 		return tea.ExecProcess(cmd, func(err error) tea.Msg { return commandDoneMsg{cmd: c, err: err} })
 	}
-	m.flash = flash{text: "running " + cmpOr(c.Description, "command") + "…"}
+	m.flash = flash{text: "running " + cmp.Or(c.Description, "command") + "…"}
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
 		defer cancel()
@@ -219,7 +217,7 @@ func (m *Model) handleCommandValue(msg commandValueMsg) tea.Cmd {
 const maxOutputLines = 30
 
 func (m *Model) handleCommandDone(msg commandDoneMsg) {
-	name := cmpOr(msg.cmd.Description, "command")
+	name := cmp.Or(msg.cmd.Description, "command")
 	if msg.cmd.Out() != commands.Popup || m.prompt != nil || m.search != nil {
 		switch {
 		case msg.err != nil:
@@ -298,11 +296,7 @@ func (m *Model) commandItem(ctx string) (commands.Item, *provider.Object, bool)
 	if r, err := ref.ForObject(o, version); err == nil {
 		it.Link = commands.Q(r.String())
 	}
-	if version != "" {
+	o.Version = version // "": the current value, like copying it
-		o.Version = version
-	} else {
-		o.Version = "" // the current value, like copying it
-	}
 	return it, &o, true
 }
 
@@ -313,9 +307,5 @@ func newTextInput(prompt string, width int) textinput.Model {
 	return in
 }
 
-func cmpOr(a, b string) string {
+// pathInputWidth fits a link or a folder path in a prompt, in the window.
-	if a != "" {
+func (m Model) pathInputWidth() int { return max(20, min(m.w-12, 64)) }
-		return a
-	}
-	return b
-}

internal/ui/app/commands_test.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
+	"github.com/charmbracelet/x/ansi"
 )
 
 func commandDriver(t *testing.T, cmds ...commands.Command) *driver {
@@ -34,7 +35,7 @@ func TestCommandGetsValueOnInput(t *testing.T) {
 	// temporary path's length.
 	shown := ""
 	if d.m.prompt != nil {
-		shown = ansiStrip(strings.Join(d.m.prompt.lines, ""))
+		shown = ansi.Strip(strings.Join(d.m.prompt.lines, ""))
 	}
 	if !strings.Contains(scr, "Run Save it?") || !strings.Contains(shown, "db-password 'team a'") || !strings.Contains(shown, "on its input") {
 		t.Fatalf("no confirmation with the command %q:\n%s", shown, scr)

internal/ui/app/edit.go

@@ -242,7 +242,7 @@ func (m *Model) openInEditor(f provider.File, finished func(error) tea.Msg) tea.
 			return tea.QuitMsg{}
 		}
 	}
-	if editor := cmpOr(m.getenv("VISUAL"), m.getenv("EDITOR")); editor != "" {
+	if editor := cmp.Or(m.getenv("VISUAL"), m.getenv("EDITOR")); editor != "" {
 		// Through the shell, so EDITOR can carry arguments ("code -w").
 		args := append([]string{"-c", editor + ` "$@"`, "lazysecrets"}, editorArgs(editor, f)...)
 		m.flash = flash{}

internal/ui/app/expiring.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"slices"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
@@ -28,8 +30,8 @@ func (m Model) expiringItems() []expiringItem {
 			row := sourceRowKey(p.ID(), src.ID)
 			for _, c := range m.cache.containers[row].value {
 				for _, t := range c.ObjectTypes() {
-					for _, o := range m.cache.objects[containerKey(c)+"|"+string(t)].value {
+					for _, o := range m.cache.objects[cachefile.ObjectsKey(c, t)].value {
-						if state, _ := m.expiry(o); state != notExpiring {
+						if state, _ := m.expiry(o); state != expiry.None {
 							out = append(out, expiringItem{o, row})
 						}
 					}
@@ -50,11 +52,11 @@ func (m Model) expiringFields() []panes.Field {
 	var out []panes.Field
 	for _, it := range items {
 		state, left := m.expiry(it.o)
-		mark := "⚠ " + daysLeft(left)
+		mark := "⚠ " + expiry.Left(left)
-		if state == expired {
+		if state == expiry.Expired {
 			mark = "✗ expired"
 		}
-		f := panes.Field{Value: mark + "  " + it.o.Name + " · " + it.o.Container.Name, Err: state == expired, Row: it.row}
+		f := panes.Field{Value: mark + "  " + it.o.Name + " · " + it.o.Container.Name, Err: state == expiry.Expired, Row: it.row}
 		if r, err := ref.ForObject(it.o, ""); err == nil {
 			f.Link = r.String()
 		}

internal/ui/app/expiry.go

@@ -1,9 +1,9 @@
 package app
 
 import (
-	"fmt"
 	"time"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
@@ -11,45 +11,19 @@ import (
 // list once they have expired (✗ expired) or will within the configured
 // warning period (⚠ 12d), and typing "expir" in the filter finds them.
 
-type expiryState int
-
-const (
-	notExpiring expiryState = iota
-	expiresSoon
-	expired
-)
-
 // expiry tells whether o has expired or will within the warning period,
 // and how long it has left.
-func (m Model) expiry(o provider.Object) (expiryState, time.Duration) {
+func (m Model) expiry(o provider.Object) (expiry.State, time.Duration) {
-	if o.Expires.IsZero() {
+	return expiry.Of(o.Expires, m.now(), m.expiryWarning)
-		return notExpiring, 0
-	}
-	left := o.Expires.Sub(m.now())
-	switch {
-	case left <= 0:
-		return expired, 0
-	case left <= m.expiryWarning:
-		return expiresSoon, left
-	}
-	return notExpiring, left
 }
 
 // expiryWord is matched by the filter: "expired" or "expiring".
 func (m Model) expiryWord(o provider.Object) string {
 	switch state, _ := m.expiry(o); state {
-	case expired:
+	case expiry.Expired:
 		return "expired"
-	case expiresSoon:
+	case expiry.Soon:
 		return "expiring"
 	}
 	return ""
 }
-
-// daysLeft is a short "12d", or "5h" on the last day.
-func daysLeft(d time.Duration) string {
-	if d < 24*time.Hour {
-		return fmt.Sprintf("%dh", max(1, int(d.Hours())))
-	}
-	return fmt.Sprintf("%dd", int(d.Hours()/24))
-}

internal/ui/app/favourites.go

@@ -3,9 +3,12 @@ package app
 import (
 	"slices"
 	"strings"
+	"time"
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
@@ -24,12 +27,12 @@ const recentMark = "◷ "
 
 // marks is what goes before a list row's name: ★ when it's starred for
 // account and, with recent, ◷ when it was used lately.
-func marks(st styles.Styles, n store.Node, account string, recent bool) string {
+func marks(st styles.Styles, n store.Node, account string, recent bool, now time.Time) string {
 	var s string
 	if n.StarredFor(account) {
 		s = st.Favourite.Render(star)
 	}
-	if recent && !n.LastUsed.IsZero() {
+	if recent && n.UsedLately(now) {
 		s += st.Muted.Render(recentMark)
 	}
 	return s
@@ -110,10 +113,10 @@ func (m Model) containerRender(withSource bool) func(styles.Styles, provider.Con
 			}
 			line += sty.Muted.Render("  " + c.Detail)
 		}
-		line = marks(sty, n, c.Source.Provider, m.recentIcon) + line
+		line = marks(sty, n, c.Source.Provider, m.recentIcon, m.now()) + line
 		if withSource {
 			src := c.Source.Name
-			if account, ok := strings.CutPrefix(c.Source.ProviderLabel, string(c.Source.Kind)+" · "); ok {
+			if account := accountOf(c.Source); account != "" {
 				src = account + " / " + src
 			}
 			line += sty.Muted.Render(" · " + src)
@@ -130,35 +133,47 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 		if o.Enabled != nil && !*o.Enabled {
 			line = sty.Muted.Render(o.Name + " (disabled)")
 		}
-		line = marks(sty, n, o.Container.Source.Provider, m.recentIcon) + line
+		line = marks(sty, n, o.Container.Source.Provider, m.recentIcon, m.now()) + line
 		switch state, left := m.expiry(o); state {
-		case expired:
+		case expiry.Expired:
 			line += " " + sty.Error.Render("✗ expired")
-		case expiresSoon:
+		case expiry.Soon:
-			line += " " + sty.Warning.Render("⚠ "+daysLeft(left))
+			line += " " + sty.Warning.Render("⚠ "+expiry.Left(left))
 		}
 		return withNote(sty, line, n.Note, width)
 	}
 }
 
-// starredContainersFirst moves starred vaults and scopes to the front,
+// starredFirst moves starred items to the front, keeping the order
-// keeping the order otherwise. It doesn't modify items, which may be cached.
+// otherwise. It doesn't modify items, which may be cached.
-func (m Model) starredContainersFirst(items []provider.Container) []provider.Container {
+func starredFirst[T any](items []T, starred func(T) bool) []T {
+	rank := func(x T) int {
+		if starred(x) {
+			return 0
+		}
+		return 1
+	}
 	out := slices.Clone(items)
-	slices.SortStableFunc(out, func(a, b provider.Container) int {
+	slices.SortStableFunc(out, func(a, b T) int { return rank(a) - rank(b) })
-		return boolRank(m.store.Node(storeKey(a)).StarredFor(a.Source.Provider)) - boolRank(m.store.Node(storeKey(b)).StarredFor(b.Source.Provider))
-	})
 	return out
 }
 
-// starredFirst moves starred objects to the front, keeping the order
+func (m Model) starredSourcesFirst(sources []provider.Source) []provider.Source {
-// otherwise. It doesn't modify items, which may be cached.
+	return starredFirst(sources, func(s provider.Source) bool {
-func (m Model) starredFirst(items []provider.Object) []provider.Object {
+		return m.store.Node(sourceKey(s)).StarredFor(s.Provider)
-	out := slices.Clone(items)
+	})
-	slices.SortStableFunc(out, func(a, b provider.Object) int {
+}
-		return boolRank(m.store.Node(objectKey(a)).StarredFor(a.Container.Source.Provider)) - boolRank(m.store.Node(objectKey(b)).StarredFor(b.Container.Source.Provider))
+
+func (m Model) starredContainersFirst(items []provider.Container) []provider.Container {
+	return starredFirst(items, func(c provider.Container) bool {
+		return m.store.Node(storeKey(c)).StarredFor(c.Source.Provider)
+	})
+}
+
+func (m Model) starredObjectsFirst(items []provider.Object) []provider.Object {
+	return starredFirst(items, func(o provider.Object) bool {
+		return m.store.Node(objectKey(o)).StarredFor(o.Container.Source.Provider)
 	})
-	return out
 }
 
 // showLinkedContainers lists the vaults opened from links.
@@ -179,7 +194,7 @@ func (m *Model) rebind(c provider.Container) string {
 			m.linked[i].Source = c.Source
 		}
 	}
-	key := containerKey(c) + "|" + string(m.objType)
+	key := cachefile.ObjectsKey(c, m.objType)
 	if m.onLinks() {
 		m.containers.SetItems(m.linked)
 		m.containers.Select(containerKey(c))
@@ -196,7 +211,7 @@ func (m *Model) resortStarred() {
 		m.containers.SetItems(m.starredContainersFirst(m.containers.Items()))
 	}
 	if m.versionsOf == nil {
-		m.secrets.SetItems(m.starredFirst(m.secrets.Items()))
+		m.secrets.SetItems(m.starredObjectsFirst(m.secrets.Items()))
 	}
 }
 
@@ -242,7 +257,7 @@ func (m *Model) toggleFavourite() tea.Cmd {
 		c := o.Container
 		toggle := func(n *store.Node) { on = n.ToggleStar(c.Source.Provider) }
 		if err = m.remember(objectKey(o), o.Name, []string{c.Source.Name, c.Name}, c.Source, toggle); err == nil {
-			m.secrets.SetItems(m.starredFirst(m.secrets.Items()))
+			m.secrets.SetItems(m.starredObjectsFirst(m.secrets.Items()))
 		}
 	}
 	switch {

internal/ui/app/favourites_test.go

@@ -14,6 +14,7 @@ import (
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
+	"github.com/charmbracelet/x/ansi"
 )
 
 // jump opens the favourites list, filters it and jumps to the first match.
@@ -429,7 +430,7 @@ func TestStarIsPerAccount(t *testing.T) {
 	d.keys("F")
 	var labels []string
 	for _, o := range d.m.search.shown {
-		labels = append(labels, ansiStrip(o.label))
+		labels = append(labels, ansi.Strip(o.label))
 	}
 	if len(labels) != 1 || !strings.Contains(labels[0], "platform-prod · alice") {
 		t.Errorf("favourites should list alice's star only: %q", labels)

internal/ui/app/fields.go

@@ -1,6 +1,7 @@
 package app
 
 import (
+	"cmp"
 	"errors"
 	"fmt"
 	"strings"
@@ -8,6 +9,7 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
 )
@@ -60,7 +62,7 @@ func (m *Model) syncFields() tea.Cmd {
 		case !ok:
 			m.fields.Show("", nil)
 		case m.selectedProblem() != "":
-			m.fields.Show(cmpOr(r.label, r.source.Name), m.problemFields(m.selectedProblem()))
+			m.fields.Show(cmp.Or(r.label, r.source.Name), m.problemFields(m.selectedProblem()))
 		case r.kind == rowGroup:
 			m.showAccount(r)
 		case r.kind == rowSource:
@@ -133,7 +135,7 @@ func (m Model) sourceFields(src provider.Source) []panes.Field {
 	add("web", src.URL)
 	if e, ok := m.cache.containers[sourceRowKey(src.Provider, src.ID)]; ok {
 		label := map[provider.Kind]string{provider.KindDatabricks: "scopes", provider.KindRepo: "files"}[src.Kind]
-		add(cmpOr(label, "vaults"), fmt.Sprint(len(e.value)))
+		add(cmp.Or(label, "vaults"), fmt.Sprint(len(e.value)))
 	}
 	return out
 }
@@ -157,10 +159,10 @@ func (m Model) containerFields(c provider.Container) []panes.Field {
 	case provider.KindRepo:
 		add("format", c.Detail)
 	}
-	add("source", cmpOr(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
+	add("source", cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
 	add("web", c.URL)
 	for _, t := range c.ObjectTypes() {
-		if e, ok := m.cache.objects[containerKey(c)+"|"+string(t)]; ok {
+		if e, ok := m.cache.objects[cachefile.ObjectsKey(c, t)]; ok {
 			add(strings.ToLower(string(t))+"s", fmt.Sprint(len(e.value)))
 		}
 	}
@@ -220,5 +222,5 @@ func (m Model) problemFields(problem string) []panes.Field {
 // fieldName names a copied field: its label, or a row of several under
 // one label (a tag), its value.
 func fieldName(f panes.Field) string {
-	return cmpOr(f.Label, f.Value)
+	return cmp.Or(f.Label, f.Value)
 }

internal/ui/app/help.go

@@ -1,6 +1,7 @@
 package app
 
 import (
+	"cmp"
 	"fmt"
 	"slices"
 	"strings"
@@ -16,7 +17,7 @@ import (
 )
 
 // The help bar shows the keys that matter in the focused pane; ? lists all
-// of them in a menu (showKeybindings).
+// of them in a menu (showKeybindingsFor).
 
 // newHelp styles the help bar to read clearly: keys like labels elsewhere,
 // descriptions in the normal text colour, only the separators dimmed. The
@@ -38,10 +39,9 @@ type contextHelp struct {
 	commands bool // custom commands apply here
 	account  bool // the fourth pane shows Fields (fields.go)
 	of       pane // what the fourth pane describes
-	// revealed, when set, says whether the selected value is shown, so
+	// reveal, when set, is what the reveal key will do, "show" or "hide":
-	// the reveal key says just what it'll do: show or hide, the same
+	// the same width so the bar doesn't shift.
-	// width so the bar doesn't shift.
+	reveal string
-	revealed *bool
 }
 
 func (c contextHelp) ShortHelp() []key.Binding {
@@ -69,8 +69,8 @@ func (c contextHelp) ShortHelp() []key.Binding {
 		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Open, k.Filter)
 	default:
 		reveal := k.Reveal
-		if c.revealed != nil {
+		if c.reveal != "" {
-			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, map[bool]string{false: "show", true: "hide"}[*c.revealed]))
+			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, c.reveal))
 		}
 		b = append(b, reveal, k.Copy, k.Share, k.ShareMenu, k.Versions, k.Favourite, k.Filter)
 	}
@@ -84,11 +84,6 @@ func (c contextHelp) FullHelp() [][]key.Binding { return [][]key.Binding{c.Short
 
 var paneNames = [paneCount]string{"Sources", "Vaults", "Secrets", "Detail", "Status"}
 
-// showKeybindings opens the ? menu, like lazygit's: every binding with
-// what it does, the focused pane's first, filterable by key, description
-// and group. Enter runs the selected one.
-func (m *Model) showKeybindings() tea.Cmd { return m.showKeybindingsFor("") }
-
 // showKeybindingsFor opens the ? menu, like lazygit's: every binding with
 // what it does, filterable by key, description and group; enter runs the
 // selected one. Opened from the panes, it lists the focused pane's keys
@@ -154,7 +149,7 @@ func (m *Model) showKeybindingsFor(ctx string) tea.Cmd {
 	if cmds := m.commandsHere(); ctx == "" && len(cmds) > 0 {
 		opts = append(opts, option{label: "Custom commands", header: true})
 		for _, c := range cmds {
-			label := m.st.Label.Render(fmt.Sprintf("%-14s", c.Key)) + fmt.Sprintf("%-26s", cmpOr(c.Description, "command")) + m.st.Muted.Render("custom")
+			label := m.st.Label.Render(fmt.Sprintf("%-14s", c.Key)) + fmt.Sprintf("%-26s", cmp.Or(c.Description, "command")) + m.st.Muted.Render("custom")
 			opts = append(opts, option{label: label, tip: c.Command, run: func(m *Model) tea.Cmd { return m.startCommand(c) }})
 		}
 	}
@@ -263,11 +258,7 @@ func hint(b key.Binding, desc string) keyHint { return keyHint{keys.Name(b), des
 
 // move is "↑/↓ move" for an up and a down binding.
 func move(up, down key.Binding) keyHint {
-	u, d := keys.Name(up), keys.Name(down)
+	return keyHint{joinKeys(up, down), "move"}
-	if u == "" || d == "" {
-		return keyHint{u + d, "move"}
-	}
-	return keyHint{u + "/" + d, "move"}
 }
 
 // withKey fills a hint's format with the binding's key ("· %s loads

internal/ui/app/jump.go

@@ -107,7 +107,7 @@ func (m *Model) storeEntries() (favs, recent []option) {
 	if m.history {
 		var used []string
 		for _, k := range keys {
-			if !nodes[k].LastUsed.IsZero() {
+			if nodes[k].UsedLately(m.now()) {
 				used = append(used, k)
 			}
 		}
@@ -199,18 +199,7 @@ func (m *Model) jumpTo(r ref.Ref, n store.Node) tea.Cmd {
 		m.startNav(r, actGo, sourceRowKey(n.Account, n.Source))
 		return nil
 	}
-	var choices []choice
+	choices := m.openWith(r.Kind, func(src provider.Source) bool { return src.ID == n.Source && n.Source != "" })
-	for _, p := range m.providers {
-		if p.Kind() != r.Kind {
-			continue
-		}
-		for _, src := range m.sourceResults[p.ID()].sources {
-			if src.ID == n.Source && n.Source != "" {
-				row := sourceRowKey(p.ID(), src.ID)
-				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
-			}
-		}
-	}
 	switch len(choices) {
 	case 0:
 		return m.openRef(r, actGo)

internal/ui/app/layout_test.go

@@ -136,11 +136,11 @@ func TestLayoutIsSaved(t *testing.T) {
 func TestContextHelpBar(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "S share") || !strings.HasSuffix(strings.TrimSpace(bar), "? help • q quit") || strings.Contains(bar, "space show") {
+	if bar := lastLines(d.screen(), 1); !strings.Contains(bar, "S share") || !strings.HasSuffix(strings.TrimSpace(bar), "? help • q quit") || strings.Contains(bar, "space show") {
 		t.Errorf("Sources help bar: %q", bar)
 	}
 	d.keys("3")
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "s copy link") || !strings.Contains(bar, "S share") {
+	if bar := lastLines(d.screen(), 1); !strings.Contains(bar, "s copy link") || !strings.Contains(bar, "S share") {
 		t.Errorf("Secrets help bar: %q", bar)
 	}
 }
@@ -225,11 +225,6 @@ func TestKeyPress(t *testing.T) {
 	}
 }
 
-func lastLine(s string) string {
-	lines := strings.Split(strings.TrimRight(s, "\n"), "\n")
-	return lines[len(lines)-1]
-}
-
 func TestNoHighlightWhileTerminalBlurred(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
@@ -264,7 +259,7 @@ func TestVersionInStatus(t *testing.T) {
 	if !strings.Contains(d.screen(), "[0] lazysecrets v0.1.0") {
 		t.Errorf("no version in the status pane:\n%s", d.screen())
 	}
-	if bar := lastLine(d.screen()); strings.Contains(bar, "v0.1.0") || !strings.Contains(bar, "? help • q quit") {
+	if bar := lastLines(d.screen(), 1); strings.Contains(bar, "v0.1.0") || !strings.Contains(bar, "? help • q quit") {
 		t.Errorf("help line %q", bar)
 	}
 }

internal/ui/app/links.go

@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"
 
-	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
@@ -209,18 +209,7 @@ const defaultResolveTimeout = 30 * time.Second
 // openSource goes to a subscription or workspace, asking which account
 // when several list it. Sources are loaded already, so it needs no lookup.
 func (m *Model) openSource(r ref.Ref) {
-	var choices []choice
+	choices := m.openWith(r.Kind, func(src provider.Source) bool { return sourceMatches(r, src) })
-	for _, p := range m.providers {
-		if p.Kind() != r.Kind {
-			continue
-		}
-		for _, src := range m.sourceResults[p.ID()].sources {
-			if sourceMatches(r, src) {
-				row := sourceRowKey(p.ID(), src.ID)
-				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
-			}
-		}
-	}
 	if row, ok := preferredRow(r, choices); ok {
 		choices = []choice{{sourceRow: row}}
 	}
@@ -242,6 +231,24 @@ func (m *Model) openSource(r ref.Ref) {
 	}
 }
 
+// openWith offers each loaded source of kind that matches, one per
+// account that lists it.
+func (m Model) openWith(kind provider.Kind, matches func(provider.Source) bool) []choice {
+	var choices []choice
+	for _, p := range m.providers {
+		if p.Kind() != kind {
+			continue
+		}
+		for _, src := range m.sourceResults[p.ID()].sources {
+			if matches(src) {
+				row := sourceRowKey(p.ID(), src.ID)
+				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
+			}
+		}
+	}
+	return choices
+}
+
 // refLabel draws what a link points at like the favourites list: the
 // provider's icon and the path in its colour, "󰠅 platform-prod /
 // kv-app-prod / api-key", with the type and version after it. The
@@ -433,7 +440,7 @@ func (m *Model) handleResolved(msg resolvedMsg) {
 // (ref.Ref.Account), if it's one of them.
 func preferredRow(r ref.Ref, choices []choice) (string, bool) {
 	for _, c := range choices {
-		if r.Account != "" && providerOf(c.sourceRow) == r.Account {
+		if r.Account != "" && cachefile.ProviderOf(c.sourceRow) == r.Account {
 			return c.sourceRow, true
 		}
 	}
@@ -686,7 +693,7 @@ func (m *Model) share(menu bool) tea.Cmd {
 		share := func(k string) func(*Model) tea.Cmd {
 			return func(m *Model) tea.Cmd { return m.shareContainer(c, k) }
 		}
-		opts := []option{option{key: "o", label: "Lazysecrets link", run: share("o")}}
+		opts := []option{{key: "o", label: "Lazysecrets link", run: share("o")}}
 		if c.Source.Kind == provider.KindAzure && m.objType != provider.TypeSecret {
 			opts = append(opts, option{key: "t", label: "Lazysecrets link to the " + tabLabels[m.objType] + " tab", run: share("t")})
 		}
@@ -714,7 +721,7 @@ func (m *Model) share(menu bool) tea.Cmd {
 			return func(m *Model) tea.Cmd { return m.shareObject(o, k) }
 		}
 		opts := []option{
-			option{key: "o", label: "Lazysecrets link", run: share("o")},
+			{key: "o", label: "Lazysecrets link", run: share("o")},
 		}
 		if o.Container.Source.Kind == provider.KindAzure {
 			opts = append(opts, option{key: "u", label: "Key Vault URL", run: share("u")})
@@ -830,10 +837,8 @@ func (m *Model) shareObject(o provider.Object, k string) tea.Cmd {
 }
 
 func (m *Model) startOpenPrompt() tea.Cmd {
-	in := textinput.New()
+	in := newTextInput("open: ", m.pathInputWidth())
-	in.Prompt = "open: "
 	in.Placeholder = "lazysecrets:// link, Key Vault URL or reference"
-	in.SetWidth(max(20, min(m.w-12, 64)))
 	m.prompt = &modal{
 		title: "Open a link", input: &in,
 		lines:  []string{m.st.Muted.Render("lazysecrets:// link, Key Vault URL or reference")},

internal/ui/app/modal.go

@@ -75,10 +75,8 @@ type modal struct {
 
 // showFilterMenu opens a menu with a filter input above the options.
 func (m *Model) showFilterMenu(title string, options []option) tea.Cmd {
-	in := textinput.New()
+	in := newTextInput("/", 40)
-	in.Prompt = "/"
 	in.Placeholder = "type to filter"
-	in.SetWidth(40)
 	m.prompt = &modal{title: title, options: options, all: options, filter: &in}
 	m.prompt.move(0)
 	m.flash = flash{}

internal/ui/app/notes.go

@@ -3,7 +3,6 @@ package app
 import (
 	"strings"
 
-	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
@@ -58,11 +57,9 @@ func (m *Model) editNote() tea.Cmd {
 		c := o.Container
 		key, name, path, src = objectKey(o), o.Name, []string{c.Source.Name, c.Name}, c.Source
 	}
-	in := textinput.New()
+	in := newTextInput("note: ", 48)
-	in.Prompt = "note: "
 	in.Placeholder = "e.g. prod SQL admin"
 	in.CharLimit = 80
-	in.SetWidth(48)
 	in.SetValue(m.store.Node(key).Note)
 	in.CursorEnd()
 	m.prompt = &modal{

internal/ui/app/notes_test.go

@@ -77,17 +77,15 @@ func TestNotesOnRows(t *testing.T) {
 func TestWithNoteGivesWay(t *testing.T) {
 	t.Parallel()
 	st := styles.Default()
-	if got := withNote(st, "db-password", "prod SQL admin", 30); len([]rune(stripANSI(got))) != 30 ||
+	if got := withNote(st, "db-password", "prod SQL admin", 30); len([]rune(ansi.Strip(got))) != 30 ||
-		!strings.HasSuffix(stripANSI(got), "prod SQL admin") {
+		!strings.HasSuffix(ansi.Strip(got), "prod SQL admin") {
-		t.Errorf("fits: %q", stripANSI(got))
+		t.Errorf("fits: %q", ansi.Strip(got))
 	}
-	if got := stripANSI(withNote(st, "db-password", "prod SQL admin", 20)); !strings.HasPrefix(got, "db-password") ||
+	if got := ansi.Strip(withNote(st, "db-password", "prod SQL admin", 20)); !strings.HasPrefix(got, "db-password") ||
 		!strings.HasSuffix(got, "…") {
 		t.Errorf("tight: %q", got)
 	}
-	if got := stripANSI(withNote(st, "a-very-long-secret-name", "note", 20)); got != "a-very-long-secret-name" {
+	if got := ansi.Strip(withNote(st, "a-very-long-secret-name", "note", 20)); got != "a-very-long-secret-name" {
 		t.Errorf("no room: %q", got)
 	}
 }
-
-func stripANSI(s string) string { return ansi.Strip(s) }

internal/ui/app/persist.go

@@ -29,48 +29,43 @@ type persistTickMsg struct{}
 
 type persistedMsg struct{ err error }
 
-// keepCached reports whether a cache key's account still exists and
+// keepers report whether a provider ID, or a cache key's, is an account
-// isn't a repo: every key starts with the provider ID.
+// that still exists and isn't a repo.
-func (m *Model) keepCached(key string) bool { return m.keepProvider(cachefile.ProviderOf(key)) }
+func (m *Model) keepers() (keep, keepKey func(string) bool) {
-
+	keep = cachefile.Keep(m.providers)
-func (m *Model) keepProvider(id string) bool { return keepIn(m.byID)(id) }
+	return keep, func(key string) bool { return keep(cachefile.ProviderOf(key)) }
-
-func keepIn(byID map[string]provider.Provider) func(id string) bool {
-	return func(id string) bool {
-		p, ok := byID[id]
-		return ok && p.Kind() != provider.KindRepo
-	}
 }
 
 // loadCacheFile fills the cache from the file, leaving out what's too
 // old or belongs to accounts that aren't signed in any more.
 func (m *Model) loadCacheFile() {
 	f := cachefile.Read(m.cachePath)
+	keep, keepKey := m.keepers()
 	now := m.now()
 	recent := func(at time.Time) bool { return now.Sub(at) < cachefile.MaxAge }
 	for id, e := range f.Sources {
-		if m.keepProvider(id) && recent(e.At) {
+		if keep(id) && recent(e.At) {
 			m.sourceResults[id] = sourcesMsg{gen: m.sourcesGen, provider: id, sources: e.Value}
 			m.sourcesAt[id] = e.At
 		}
 	}
 	for k, e := range f.Containers {
-		if m.keepCached(k) && recent(e.At) {
+		if keepKey(k) && recent(e.At) {
 			m.cache.containers[k] = entry[[]provider.Container]{e.Value, e.At}
 		}
 	}
 	for k, e := range f.Objects {
-		if m.keepCached(k) && recent(e.At) {
+		if keepKey(k) && recent(e.At) {
 			m.cache.objects[k] = entry[[]provider.Object]{e.Value, e.At}
 		}
 	}
 	for k, e := range f.Details {
-		if m.keepCached(k) && recent(e.At) {
+		if keepKey(k) && recent(e.At) {
 			m.cache.details[k] = entry[provider.Object]{e.Value, e.At}
 		}
 	}
 	for k, v := range f.Cursor {
-		if m.keepCached(k) {
+		if keepKey(k) {
 			m.cache.cursor[k] = v
 		}
 	}
@@ -79,28 +74,30 @@ func (m *Model) loadCacheFile() {
 // cacheSnapshot is the cache as the file holds it.
 func (m *Model) cacheSnapshot() cachefile.File {
 	f := cachefile.New()
+	keep, keepKey := m.keepers()
+	f.Dropped, m.cacheDropped = m.cacheDropped, nil
 	for id, r := range m.sourceResults {
-		if r.err == nil && m.keepProvider(id) {
+		if r.err == nil && keep(id) {
 			f.Sources[id] = cachefile.Stamped[[]provider.Source]{At: m.sourcesAt[id], Value: r.sources}
 		}
 	}
 	for k, e := range m.cache.containers {
-		if m.keepCached(k) {
+		if keepKey(k) {
 			f.Containers[k] = cachefile.Stamped[[]provider.Container]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.objects {
-		if m.keepCached(k) {
+		if keepKey(k) {
 			f.Objects[k] = cachefile.Stamped[[]provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.details {
-		if m.keepCached(k) {
+		if keepKey(k) {
 			f.Details[k] = cachefile.Stamped[provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, v := range m.cache.cursor {
-		if m.keepCached(k) {
+		if keepKey(k) {
 			f.Cursor[k] = v
 		}
 	}
@@ -110,7 +107,7 @@ func (m *Model) cacheSnapshot() cachefile.File {
 // saveCache saves f, merged with the file (lazysecrets list may have
 // loaded more since), from any goroutine.
 func (m *Model) saveCache(f cachefile.File) func() error {
-	path, keep, now := m.cachePath, keepIn(m.byID), m.now()
+	path, keep, now := m.cachePath, cachefile.Keep(m.providers), m.now()
 	return func() error { return cachefile.Save(path, f, keep, now) }
 }
 

internal/ui/app/repo_test.go

@@ -16,6 +16,7 @@ import (
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
+	"github.com/charmbracelet/x/ansi"
 )
 
 const sopsFile = `db:
@@ -225,9 +226,9 @@ func TestSearchAllRepos(t *testing.T) {
 	var got []string
 	for _, o := range d.m.search.shown {
 		if o.kind != provider.KindRepo {
-			t.Errorf("not a repo: %s", ansiStrip(o.label))
+			t.Errorf("not a repo: %s", ansi.Strip(o.label))
 		}
-		got = append(got, ansiStrip(o.label))
+		got = append(got, ansi.Strip(o.label))
 	}
 	if len(got) != 2 {
 		t.Errorf("want db.password in both repos: %v", got)

internal/ui/app/reveal.go

@@ -28,12 +28,22 @@ func (m *Model) startRevealTimer() tea.Cmd {
 
 // revealTickCmd fires when the displayed second next changes.
 func (m *Model) revealTickCmd() tea.Cmd {
-	wait := m.revealDeadline.Sub(m.now()) % time.Second
-	if wait <= 0 {
-		wait = time.Second
-	}
 	token := m.revealToken
-	return tea.Tick(wait, func(time.Time) tea.Msg { return revealTickMsg{token} })
+	return tea.Tick(untilNextSecond(m.revealDeadline, m.now()), func(time.Time) tea.Msg { return revealTickMsg{token} })
+}
+
+// untilNextSecond is how long until a countdown to deadline shows its
+// next whole second.
+func untilNextSecond(deadline, now time.Time) time.Duration {
+	if wait := deadline.Sub(now) % time.Second; wait > 0 {
+		return wait
+	}
+	return time.Second
+}
+
+// secondsLeft is a countdown to deadline, in whole seconds rounded up.
+func secondsLeft(deadline, now time.Time) int {
+	return max(0, int(math.Ceil(deadline.Sub(now).Seconds())))
 }
 
 func (m *Model) revealTick(msg revealTickMsg) tea.Cmd {
@@ -49,8 +59,7 @@ func (m *Model) revealTick(msg revealTickMsg) tea.Cmd {
 }
 
 func (m *Model) showHidesIn() {
-	left := max(0, int(math.Ceil(m.revealDeadline.Sub(m.now()).Seconds())))
+	m.detail.SetHidesIn(fmt.Sprintf("%ds", secondsLeft(m.revealDeadline, m.now())))
-	m.detail.SetHidesIn(fmt.Sprintf("%ds", left))
 }
 
 // hideValue hides the revealed value and stops its countdown.

internal/ui/app/search.go

@@ -6,10 +6,10 @@ import (
 	"fmt"
 	"slices"
 	"strings"
-	"time"
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 )
@@ -45,10 +45,6 @@ type crawlMsg struct {
 	err        error
 }
 
-func contextWithTimeout(d time.Duration) (context.Context, context.CancelFunc) {
-	return context.WithTimeout(context.Background(), d)
-}
-
 // searchEntries lists everything loaded: the sources (with how much of
 // each is loaded) and the vaults, scopes and secrets in them, each with
 // its source's row key as group.
@@ -66,7 +62,7 @@ func (m *Model) searchEntries() (sources, items []option) {
 		sort := strings.ToLower(strings.Join(path, "/")) + " " + account
 		es = append(es, entry{depth, sort,
 			option{label: m.pathLabel(kind, path, account), note: n.Note, star: key,
-				starAccount: providerOf(row), starred: n.StarredFor(providerOf(row)),
+				starAccount: cachefile.ProviderOf(row), starred: n.StarredFor(cachefile.ProviderOf(row)),
 				mark: mark, run: run, reload: reload, id: sort, group: row, kind: kind}})
 		return &es[len(es)-1].opt
 	}
@@ -89,7 +85,7 @@ func (m *Model) searchEntries() (sources, items []option) {
 					return nil
 				}, reload)
 				for _, t := range []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate} {
-					for _, o := range m.cache.objects[containerKey(c)+"|"+string(t)].value {
+					for _, o := range m.cache.objects[cachefile.ObjectsKey(c, t)].value {
 						r, err := ref.ForObject(o, "")
 						if err != nil {
 							continue
@@ -133,8 +129,6 @@ func (c coverage) complete() bool {
 	return c.sourcesListed == c.sources && c.vaultsLoaded == c.vaults
 }
 
-func (m *Model) searchCoverage() coverage { return m.coverageOf(nil) }
-
 // providerFilter picks the providers a search or a load covers; nil is
 // all of them.
 type providerFilter func(provider.Provider) bool
@@ -147,7 +141,7 @@ func ofProvider(id string) providerFilter {
 	return func(p provider.Provider) bool { return p.ID() == id }
 }
 
-// coverageOf is searchCoverage for the providers in.
+// coverageOf is the coverage of the providers in.
 func (m *Model) coverageOf(in providerFilter) coverage {
 	var c coverage
 	for _, p := range m.providers {
@@ -166,7 +160,7 @@ func (m *Model) coverageOf(in providerFilter) coverage {
 			}
 			for _, v := range e.value {
 				c.vaults++
-				key := containerKey(v) + "|" + string(provider.TypeSecret)
+				key := cachefile.ObjectsKey(v, provider.TypeSecret)
 				if objs, ok := m.cache.objects[key]; ok {
 					c.vaultsLoaded++
 					c.secrets += len(objs.value)
@@ -182,7 +176,7 @@ func (m *Model) coverageOf(in providerFilter) coverage {
 
 // searchLines says what the search covers.
 func (m *Model) searchLines() []string {
-	c := m.searchCoverage()
+	c := m.coverageOf(nil)
 	switch {
 	case m.crawl.running:
 		return []string{m.st.Notice.Render(fmt.Sprintf("Loading… %d lists left; results appear as they arrive.",
@@ -209,11 +203,8 @@ func plural(n int, word string) string {
 	return fmt.Sprintf("%d %ss", n, word)
 }
 
-// startCrawl loads every unlisted subscription's vaults and every vault's
+// startCrawlOf loads, for the providers in, every unlisted subscription's
-// secrets not loaded yet.
+// vaults and every vault's secrets not loaded yet.
-func (m *Model) startCrawl() tea.Cmd { return m.startCrawlOf(nil) }
-
-// startCrawlOf is startCrawl for the providers in.
 func (m *Model) startCrawlOf(in providerFilter) tea.Cmd {
 	for _, p := range m.providers {
 		if in != nil && !in(p) {
@@ -263,7 +254,7 @@ func (m *Model) queueSource(src provider.Source, force bool) {
 // queueContainer queues loading c's secrets, unless loaded lately and not
 // force.
 func (m *Model) queueContainer(c provider.Container, row string, force bool) {
-	key := containerKey(c) + "|" + string(provider.TypeSecret)
+	key := cachefile.ObjectsKey(c, provider.TypeSecret)
 	if e, ok := m.cache.objects[key]; ok && e.fresh(m.now()) && !force {
 		return
 	}
@@ -300,7 +291,7 @@ func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
 		src := *job.src
 		timeout := m.timeout.of(src.Kind)
 		return func() tea.Msg {
-			ctx, cancel := contextWithTimeout(timeout)
+			ctx, cancel := context.WithTimeout(context.Background(), timeout)
 			defer cancel()
 			items, err := p.Containers(ctx, src)
 			for i := range items {
@@ -313,7 +304,7 @@ func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
 	p := m.providerFor(c.Source)
 	timeout := m.timeout.of(c.Source.Kind)
 	return func() tea.Msg {
-		ctx, cancel := contextWithTimeout(timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), timeout)
 		defer cancel()
 		items, err := p.Objects(ctx, c, provider.TypeSecret)
 		for i := range items {
@@ -327,7 +318,7 @@ func (m *Model) handleCrawl(msg crawlMsg) tea.Cmd {
 	m.crawl.active--
 	key := msg.job.row
 	if msg.job.container != nil {
-		key = containerKey(*msg.job.container) + "|" + string(provider.TypeSecret)
+		key = cachefile.ObjectsKey(*msg.job.container, provider.TypeSecret)
 	}
 	delete(m.crawl.pending, key)
 	switch {
@@ -350,6 +341,19 @@ func (m *Model) handleCrawl(msg crawlMsg) tea.Cmd {
 	return cmd
 }
 
+// vaultsLoaded counts the vaults whose secrets are cached or can't be
+// read, and says whether any are loading.
+func (m *Model) vaultsLoaded(vaults []provider.Container) (loaded int, loading bool) {
+	for _, c := range vaults {
+		key := cachefile.ObjectsKey(c, provider.TypeSecret)
+		loading = loading || m.crawl.pending[key]
+		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
+			loaded++
+		}
+	}
+	return loaded, loading
+}
+
 // sourceMark shows how much of a subscription or workspace is loaded:
 // ○ nothing, ◐ some vaults, ● every vault, ◌ loading, ✗ unreadable.
 func (m *Model) sourceMark(row string) string {
@@ -363,14 +367,7 @@ func (m *Model) sourceMark(row string) string {
 	if !ok {
 		return m.st.Muted.Render("○")
 	}
-	loaded, loading := 0, false
+	loaded, loading := m.vaultsLoaded(e.value)
-	for _, c := range e.value {
-		key := containerKey(c) + "|" + string(provider.TypeSecret)
-		loading = loading || m.crawl.pending[key]
-		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
-			loaded++
-		}
-	}
 	switch {
 	case loading:
 		return m.st.Muted.Render("◌")
@@ -386,7 +383,7 @@ func (m *Model) sourceMark(row string) string {
 // (✗) or are loading (◌): whether a subscription is loaded says whether
 // its vaults are searchable.
 func (m *Model) vaultMark(c provider.Container) string {
-	key := containerKey(c) + "|" + string(provider.TypeSecret)
+	key := cachefile.ObjectsKey(c, provider.TypeSecret)
 	switch {
 	case m.crawl.pending[key]:
 		return m.st.Muted.Render("◌")
@@ -395,9 +392,3 @@ func (m *Model) vaultMark(c provider.Container) string {
 	}
 	return " "
 }
-
-// providerOf is the provider ID in a source row key.
-func providerOf(row string) string {
-	p, _ := splitSourceRow(row)
-	return p
-}

internal/ui/app/search_test.go

@@ -6,6 +6,7 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"github.com/charmbracelet/x/ansi"
 )
@@ -115,19 +116,19 @@ func TestSearchSourceNarrowsAndLoads(t *testing.T) {
 			t.Fatal("platform-dev not in sources")
 		}
 	}
-	if !strings.Contains(ansiStrip(d.m.search.scopes[d.m.search.src].mark), "○") {
+	if !strings.Contains(ansi.Strip(d.m.search.scopes[d.m.search.src].mark), "○") {
 		t.Errorf("unloaded source mark %q", d.m.search.scopes[d.m.search.src].mark)
 	}
 	if len(d.m.search.shown) != 0 {
 		t.Errorf("results not narrowed to platform-dev: %d", len(d.m.search.shown))
 	}
 	d.send(ctrl('r'))
-	if !strings.Contains(ansiStrip(d.m.search.scopes[d.m.search.src].mark), "●") {
+	if !strings.Contains(ansi.Strip(d.m.search.scopes[d.m.search.src].mark), "●") {
 		t.Errorf("loaded source mark %q", d.m.search.scopes[d.m.search.src].mark)
 	}
 	for _, o := range d.m.search.shown {
-		if !strings.Contains(ansiStrip(o.label), "platform-dev") {
+		if !strings.Contains(ansi.Strip(o.label), "platform-dev") {
-			t.Errorf("result from elsewhere: %q", ansiStrip(o.label))
+			t.Errorf("result from elsewhere: %q", ansi.Strip(o.label))
 		}
 	}
 	if len(d.m.search.shown) == 0 {
@@ -177,19 +178,17 @@ func TestStarFromSearch(t *testing.T) {
 	}
 }
 
-func ansiStrip(s string) string { return ansi.Strip(s) }
-
 func TestSearchStartsWhereYouAre(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("2", "j") // platform-prod / kv-shared-prod
 	d.openSearch()
 	v := d.m.search
-	scope := func() string { return ansiStrip(v.scopes[v.src].label) }
+	scope := func() string { return ansi.Strip(v.scopes[v.src].label) }
 	if scope() != "All" {
 		t.Errorf("opened on %q, want All", scope())
 	}
-	if v.res >= len(v.shown) || !strings.Contains(ansiStrip(v.shown[v.res].label), "kv-shared-prod") {
+	if v.res >= len(v.shown) || !strings.Contains(ansi.Strip(v.shown[v.res].label), "kv-shared-prod") {
 		t.Errorf("vault not under the cursor:\n%s", d.screen())
 	}
 	d.send(ctrl('s')) // narrows to the source, and back
@@ -233,13 +232,13 @@ func TestSearchNarrowsToAccount(t *testing.T) {
 		t.Errorf("no results in the account:\n%s", d.screen())
 	}
 	for _, o := range v.shown {
-		if providerOf(o.group) != header.provider {
+		if cachefile.ProviderOf(o.group) != header.provider {
-			t.Errorf("result from another account: %q", ansiStrip(o.label))
+			t.Errorf("result from another account: %q", ansi.Strip(o.label))
 		}
 	}
 	// The account's sources are under it, indented.
-	if next := v.scopes[v.src+1]; next.group == "" || providerOf(next.group) != header.provider || !strings.HasPrefix(ansiStrip(next.label), "  ") {
+	if next := v.scopes[v.src+1]; next.group == "" || cachefile.ProviderOf(next.group) != header.provider || !strings.HasPrefix(ansi.Strip(next.label), "  ") {
-		t.Errorf("after the account: %q", ansiStrip(next.label))
+		t.Errorf("after the account: %q", ansi.Strip(next.label))
 	}
 }
 
@@ -327,7 +326,7 @@ func TestSearchHighlightsMatches(t *testing.T) {
 		t.Fatal("no results")
 	}
 	o := d.m.search.shown[0]
-	plain := []rune(ansiStrip(o.label))
+	plain := []rune(ansi.Strip(o.label))
 	var got string
 	for _, h := range o.hits {
 		got += string(plain[h])
@@ -348,14 +347,14 @@ func TestHelpBarFollowsPopup(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("F")
-	bar := lastLine(d.screen())
+	bar := lastLines(d.screen(), 1)
 	for _, want := range []string{"[ prev tab", "] next tab", "/ filter", "f star"} {
 		if !strings.Contains(bar, want) {
 			t.Errorf("browsing: help bar %q lacks %q", bar, want)
 		}
 	}
 	d.keys("/")
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "ctrl+f star") || !strings.Contains(bar, "esc stop typing") {
+	if bar := lastLines(d.screen(), 1); !strings.Contains(bar, "ctrl+f star") || !strings.Contains(bar, "esc stop typing") {
 		t.Errorf("typing: help bar %q", bar)
 	}
 }
@@ -375,8 +374,8 @@ func TestHelpFromPopups(t *testing.T) {
 		if o.header {
 			sections = append(sections, o.label)
 		}
-		if strings.Contains(ansiStrip(o.label), "copy value") {
+		if strings.Contains(ansi.Strip(o.label), "copy value") {
-			t.Errorf("pane key listed in Go to's help: %q", ansiStrip(o.label))
+			t.Errorf("pane key listed in Go to's help: %q", ansi.Strip(o.label))
 		}
 	}
 	if strings.Join(sections, ",") != "Go to,While typing, after /" {
@@ -428,7 +427,7 @@ func TestGoToHelpBarEndsWithHelp(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t) // 100 columns: Go to's keys don't all fit
 	d.keys("ctrl+s", "esc")
-	bar := strings.TrimSpace(lastLine(d.screen()))
+	bar := strings.TrimSpace(lastLines(d.screen(), 1))
 	if !strings.HasSuffix(bar, "? help") || !strings.Contains(bar, "…") {
 		t.Errorf("help bar %q", bar)
 	}
@@ -443,11 +442,11 @@ func TestLoadWithEmptyResults(t *testing.T) {
 	for d.m.search.src > 0 {
 		d.send(tea.KeyPressMsg{Code: tea.KeyUp})
 	}
-	for i := 0; !strings.Contains(ansiStrip(d.m.search.scope().label), "platform-dev"); i++ {
+	for i := 0; !strings.Contains(ansi.Strip(d.m.search.scope().label), "platform-dev"); i++ {
 		if i > len(d.m.search.scopes) {
 			var labels []string
 			for _, o := range d.m.search.scopes {
-				labels = append(labels, ansiStrip(o.label))
+				labels = append(labels, ansi.Strip(o.label))
 			}
 			t.Fatalf("no platform-dev scope: %q (at %d, results %v)", labels, d.m.search.src, d.m.search.results)
 		}

internal/ui/app/searchview.go

@@ -12,6 +12,7 @@ import (
 	"charm.land/lipgloss/v2"
 	"github.com/charmbracelet/x/ansi"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/match"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
@@ -94,9 +95,7 @@ func (m *Model) showFavourites() tea.Cmd { return m.openGoTo(tabFavs, false) }
 func (m *Model) showRecent() tea.Cmd     { return m.openGoTo(tabRecent, false) }
 
 func (m *Model) openGoTo(tab int, typing bool) tea.Cmd {
-	in := textinput.New()
+	in := newTextInput("/", searchWidth(m.w)-6) // as wide as the popup
-	in.Prompt = "/"
-	in.SetWidth(searchWidth(m.w) - 6) // as wide as the popup
 	v := &searchView{input: in, tab: tab, results: true}
 	v.favs, v.recent = m.storeEntries()
 	m.search = v
@@ -202,7 +201,7 @@ func (m *Model) fillSearch(keep bool) {
 				id:    accountScope + p.ID(), kind: k, mark: m.coverageMark(ofProvider(p.ID())),
 			})
 			for _, o := range sources {
-				if providerOf(o.group) == p.ID() {
+				if cachefile.ProviderOf(o.group) == p.ID() {
 					o.label = "  " + o.label
 					scopes = append(scopes, o)
 				}
@@ -266,7 +265,7 @@ func (v *searchView) match() []option {
 	default:
 		account, ofAccount := v.scopeAccount()
 		for _, o := range v.items {
-			if sc.id == allSources || ofAccount && providerOf(o.group) == account || sc.group != "" && o.group == sc.group {
+			if sc.id == allSources || ofAccount && cachefile.ProviderOf(o.group) == account || sc.group != "" && o.group == sc.group {
 				cand = append(cand, o)
 			}
 		}
@@ -522,7 +521,7 @@ func (m *Model) searchLoads() tea.Cmd {
 		return m.startCrawlOf(v.scopeFilter())
 	}
 	if !v.onSource() {
-		return m.startCrawl()
+		return m.startCrawlOf(nil)
 	}
 	providerID, sourceID := splitSourceRow(sc.group)
 	for _, src := range m.sourceResults[providerID].sources {
@@ -615,13 +614,7 @@ func (m Model) loadHint() string {
 		}
 		return m.st.Warning.Render("⚠ not loaded" + withKey(m.loadKey(), " · %s loads "+name))
 	}
-	loaded := 0
+	loaded, _ := m.vaultsLoaded(e.value)
-	for _, c := range e.value {
-		key := containerKey(c) + "|" + string(provider.TypeSecret)
-		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
-			loaded++
-		}
-	}
 	if loaded == len(e.value) {
 		return ""
 	}
@@ -769,7 +762,7 @@ func (m Model) searchViewBox() string {
 				body = append(body, " "+m.st.Error.Render(l))
 			}
 		}
-		body = append(body, "", " "+m.goToTabs(ts))
+		body = append(body, "", " "+panes.Tabs(m.st, ts, tabNames[:], m.search.tab))
 	}
 	body = append(body, " "+v.input.View(), "")
 	for _, l := range strings.Split(lists, "\n") {
@@ -802,7 +795,7 @@ func (m Model) searchViewBox() string {
 	// Tabs in the title, the current one underlined, like the panes; a
 	// picker has its own title, and the tabs over the input.
 	if v.picker == nil {
-		head := ts.Render(goToTitle+" ") + m.goToTabs(ts)
+		head := ts.Render(goToTitle+" ") + panes.Tabs(m.st, ts, tabNames[:], m.search.tab)
 		return panes.Box(m.st, head, foot, body, w, len(body)+2, focused)
 	}
 	// A picker: in its own border, under what it's for.
@@ -855,19 +848,3 @@ func pickable(o option) (ref.Ref, bool) {
 	}
 	return r, true
 }
-
-// goToTabs draws Go to's tabs, the current one underlined.
-func (m Model) goToTabs(ts lipgloss.Style) string {
-	var out string
-	for i, name := range tabNames {
-		if i > 0 {
-			out += ts.Render(" - ")
-		}
-		if i == m.search.tab {
-			out += ts.Underline(true).Render(name)
-		} else {
-			out += m.st.Muted.Render(name)
-		}
-	}
-	return out
-}

internal/ui/app/sharefiles.go

@@ -10,7 +10,6 @@ import (
 	"slices"
 	"strings"
 
-	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
@@ -304,7 +303,7 @@ func (m *Model) handleShareOpened(msg shareOpenedMsg) tea.Cmd {
 }
 
 // openFailed says why a share link couldn't be decrypted, in a popup
-// where its offer was: its first line (wrapped), or with whole all of it
+// where its offer was: its first line (wrapped), or, with whole, all of it
 // (Key Vault's refusals say what to check on later lines). From there,
 // the key's secret can be gone to: its version, which may be disabled.
 func (m *Model) openFailed(s share.Sealed, err error, whole bool) {
@@ -338,9 +337,7 @@ func (m *Model) openFailed(s share.Sealed, err error, whole bool) {
 // askShareDir asks where to save files from a repo that isn't here. It
 // stays until they're saved, saying why when they can't be.
 func (m *Model) askShareDir(msg shareOpenedMsg) tea.Cmd {
-	in := textinput.New()
+	in := newTextInput("folder: ", m.pathInputWidth())
-	in.Prompt = "folder: "
-	in.SetWidth(max(20, min(m.w-12, 64)))
 	dir := m.placeDir
 	if dir == "" {
 		dir, _ = os.Getwd()

internal/ui/app/sources.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"slices"
 	"strings"
+	"time"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
@@ -80,7 +81,7 @@ func newSourcesList(iconSet icons.Set, mem *store.Store, recent bool) panes.List
 			kind := st.Kind(r.group)
 			starred := ""
 			if r.kind == rowSource {
-				starred = marks(st, node, r.source.Provider, recent)
+				starred = marks(st, node, r.source.Provider, recent, time.Now())
 			}
 			switch {
 			case r.kind == rowLinks:
@@ -133,10 +134,7 @@ func (m *Model) rebuildSources() {
 	}
 	for _, p := range m.providers {
 		kind, id := p.Kind(), p.ID()
-		account, _ := strings.CutPrefix(p.Label(), string(kind)+" · ")
+		account := accountOf(provider.Source{Kind: kind, ProviderLabel: p.Label()})
-		if account == p.Label() {
-			account = ""
-		}
 		r, done := m.sourceResults[id]
 		sources := r.sources
 		if !flat {
@@ -214,17 +212,6 @@ func (m Model) currentSource() (provider.Source, bool) {
 	return provider.Source{}, false
 }
 
-// starredSourcesFirst moves starred sources to the front, keeping the
-// order otherwise. It doesn't modify sources.
-func (m Model) starredSourcesFirst(sources []provider.Source) []provider.Source {
-	out := slices.Clone(sources)
-	rank := func(s provider.Source) int {
-		return boolRank(m.store.Node(sourceKey(s)).StarredFor(s.Provider))
-	}
-	slices.SortStableFunc(out, func(a, b provider.Source) int { return rank(a) - rank(b) })
-	return out
-}
-
 // starRank orders the Favourites row, then starred sources, then the rest.
 func starRank(mem *store.Store, r sourceRow) int {
 	switch {
@@ -238,13 +225,6 @@ func starRank(mem *store.Store, r sourceRow) int {
 	return 3
 }
 
-func boolRank(starred bool) int {
-	if starred {
-		return 0
-	}
-	return 1
-}
-
 // selectedSource is the source under the cursor; false on a header.
 func (m Model) selectedSource() (provider.Source, bool) {
 	r, ok := m.sources.Selected()

internal/ui/app/status.go

@@ -1,6 +1,7 @@
 package app
 
 import (
+	"cmp"
 	"errors"
 	"fmt"
 	"strings"
@@ -83,7 +84,7 @@ func (m Model) statusFields() []panes.Field {
 		}
 	}
 	// A release's rows open its release page.
-	version := panes.Field{Label: "version", Value: cmpOr(m.versionLabel(), "dev")}
+	version := panes.Field{Label: "version", Value: cmp.Or(m.versionLabel(), "dev")}
 	if strings.HasPrefix(version.Value, "v") {
 		version.URL = update.DefaultRepo + "/releases/tag/" + version.Value
 	}
@@ -159,7 +160,7 @@ func (m Model) accountStatus(p provider.Provider) string {
 		return r.err.Error()
 	}
 	noun := map[provider.Kind]string{provider.KindAzure: "subscription", provider.KindDatabricks: "workspace", provider.KindRepo: "repo"}[p.Kind()]
-	return plural(len(r.sources), cmpOr(noun, "source"))
+	return plural(len(r.sources), cmp.Or(noun, "source"))
 }
 
 // ago is a duration as people say it: "just now", "5m ago", "2h ago".

internal/ui/app/testdata/TestGolden.golden

@@ -20,7 +20,8 @@
 ╭─ [3] Secrets - Keys - Certs ──╮│                                                                 │
 │ db-password                   ││                                                                 │
 │ api-key                       ││                                                                 │
-│ legacy-token (disabled) ✗ exp…││                                                                 │
+│ legacy-token ✗ expired        ││                                                                 │
+│ smtp-password (disabled)      ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
@@ -28,6 +29,5 @@
 │                               ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
-│                               ││                                                                 │
+╰────────────────────── 1 of 4 ─╯╰──────────────────────────────────────────────────────── 1 of 4 ─╯
-╰────────────────────── 1 of 3 ─╯╰──────────────────────────────────────────────────────── 1 of 4 ─╯
  enter open • ctrl+s search • s copy link • S share • f star • F favourites • … • ? help • q quit

internal/ui/app/update.go

@@ -2,13 +2,11 @@ package app
 
 import (
 	"context"
-	"errors"
 	"strings"
 	"time"
 
 	tea "charm.land/bubbletea/v2"
 
-	"git.kebcloud.no/keb/lazysecrets/internal/browser"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
@@ -130,15 +128,7 @@ func (m *Model) showUpdate() {
 		run: func(m *Model) tea.Cmd { return m.install(r) }}}
 	if r.URL != "" {
 		opts = append(opts, option{key: "o", label: "Open the release page", run: func(m *Model) tea.Cmd {
-			switch err := m.openURL(r.URL); {
+			return m.openPage("the release page", r.URL, func() {})
-			case errors.Is(err, browser.ErrRemote):
-				cmd := m.copyText("link to the release", r.URL, false)
-				m.flash.text += " (can't open a browser over SSH)"
-				return cmd
-			case err != nil:
-				m.flash = flash{text: "open: " + err.Error(), isErr: true}
-			}
-			return nil
 		}})
 	}
 	m.showMenu("lazysecrets "+r.Tag, lines, opts)

internal/ui/app/usage_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
+	"github.com/charmbracelet/x/ansi"
 )
 
 func TestRecentScope(t *testing.T) {
@@ -21,7 +22,7 @@ func TestRecentScope(t *testing.T) {
 	d.keys("R")
 	var recent []string
 	for _, o := range d.m.search.shown {
-		recent = append(recent, ansiStrip(o.label))
+		recent = append(recent, ansi.Strip(o.label))
 	}
 	if len(recent) < 2 || !strings.Contains(recent[0], "legacy-token") || !strings.Contains(recent[1], "api-key") {
 		t.Fatalf("want newest first: %q", recent)
@@ -31,7 +32,7 @@ func TestRecentScope(t *testing.T) {
 		t.Errorf("jumped to %q", s)
 	}
 	d.keys("F")
-	if len(d.m.search.shown) != 1 || !strings.Contains(ansiStrip(d.m.search.shown[0].label), "kv-shared-prod") {
+	if len(d.m.search.shown) != 1 || !strings.Contains(ansi.Strip(d.m.search.shown[0].label), "kv-shared-prod") {
 		t.Errorf("favourites: %d entries\n%s", len(d.m.search.shown), d.screen())
 	}
 }

internal/ui/icons/icons.go

@@ -11,6 +11,7 @@ type Set struct {
 	Repo       string
 	Encrypted  string // an encrypted file (SOPS)
 	PlainFile  string // a plain text secrets file (.env)
+	Note       string // has a note (lazysecrets list)
 }
 
 // None renders no icons.
@@ -24,6 +25,7 @@ var NerdFont = Set{
 	Repo:       "\U000F02A2", // md-git
 	Encrypted:  "\U000F033E", // md-lock
 	PlainFile:  "\U000F0214", // md-file
+	Note:       "\U000F09ED",
 }
 
 // Prefix returns the icon for kind followed by a space, or "" if the set has

internal/ui/keys/keys.go

@@ -15,8 +15,8 @@ package keys
 
 import (
 	"fmt"
+	"maps"
 	"slices"
-	"sort"
 	"strings"
 
 	"charm.land/bubbles/v2/key"
@@ -266,11 +266,11 @@ func (m *Map) Apply(cfg map[string]map[string][]string) error {
 		byName[a.Context+"."+a.Name] = a
 		contexts[a.Context] = true
 	}
-	for _, ctx := range sortedKeys(cfg) {
+	for _, ctx := range slices.Sorted(maps.Keys(cfg)) {
 		if !contexts[ctx] {
-			return fmt.Errorf("keybinding: unknown context %q (known: %s)", ctx, strings.Join(sortedKeys(contexts), ", "))
+			return fmt.Errorf("keybinding: unknown context %q (known: %s)", ctx, strings.Join(slices.Sorted(maps.Keys(contexts)), ", "))
 		}
-		for _, name := range sortedKeys(cfg[ctx]) {
+		for _, name := range slices.Sorted(maps.Keys(cfg[ctx])) {
 			a, ok := byName[ctx+"."+name]
 			if !ok {
 				return fmt.Errorf("keybinding.%s: unknown action %q (known: %s)", ctx, name, strings.Join(m.names(ctx), ", "))
@@ -289,16 +289,7 @@ func (m *Map) names(ctx string) []string {
 			out = append(out, a.Name)
 		}
 	}
-	sort.Strings(out)
+	slices.Sort(out)
-	return out
-}
-
-func sortedKeys[V any](set map[string]V) []string {
-	out := make([]string, 0, len(set))
-	for k := range set {
-		out = append(out, k)
-	}
-	sort.Strings(out)
 	return out
 }
 

internal/ui/panes/box.go

@@ -69,3 +69,20 @@ func TitleStyle(st styles.Styles, focused bool) lipgloss.Style {
 	}
 	return st.TitleBlurred
 }
+
+// Tabs draws tab names for a title in style ts, the current one
+// underlined and the rest muted.
+func Tabs(st styles.Styles, ts lipgloss.Style, names []string, current int) string {
+	var out string
+	for i, name := range names {
+		if i > 0 {
+			out += ts.Render(" - ")
+		}
+		if i == current {
+			out += ts.Underline(true).Render(name)
+		} else {
+			out += st.Muted.Render(name)
+		}
+	}
+	return out
+}

internal/ui/panes/detail.go

@@ -60,16 +60,6 @@ func (d *Detail) ShowSecret(s provider.Object) {
 	d.container = &s.Container
 }
 
-// Refresh shows s's newer metadata if s is the secret shown, keeping
-// its account and any value shown or loading.
-func (d *Detail) Refresh(s provider.Object) {
-	if d.secret == nil || d.secret.ID != s.ID {
-		return
-	}
-	s.Container = d.secret.Container
-	d.secret = &s
-}
-
 // ShowContainer shows a container summary when no secret is selected.
 func (d *Detail) ShowContainer(c provider.Container) {
 	d.Clear()
@@ -198,20 +188,31 @@ func carryStyle(lines []string) []string {
 	return lines
 }
 
+var valueIndent = strings.Repeat(" ", 12)
+
+// fieldLabel starts a detail line: the label, padded so values line up
+// at valueIndent.
+func fieldLabel(st styles.Styles, label string) string {
+	return " " + st.Label.Render(fmt.Sprintf("%-10s", label)) + " "
+}
+
 // lines renders the body, wrapped to the pane width.
 func (d Detail) lines(st styles.Styles) []string {
 	inner := max(1, d.w-3)
 	var out []string
 	field := func(label, value string) {
-		prefix := " " + st.Label.Render(fmt.Sprintf("%-10s", label)) + " "
-		indent := strings.Repeat(" ", 12)
 		wrapped := carryStyle(strings.Split(ansi.Hardwrap(value, max(1, inner-11), true), "\n"))
-		out = append(out, prefix+wrapped[0])
+		out = append(out, fieldLabel(st, label)+wrapped[0])
 		for _, w := range wrapped[1:] {
-			out = append(out, indent+w)
+			out = append(out, valueIndent+w)
 		}
 	}
 	muted := st.Muted.Render
+	note := func() {
+		if d.note != "" {
+			field("note", st.Favourite.Render(d.note))
+		}
+	}
 
 	if d.container == nil {
 		return []string{muted(" Select a vault or scope to browse its secrets.")}
@@ -221,30 +222,27 @@ func (d Detail) lines(st styles.Styles) []string {
 	if containerLabel == "" {
 		containerLabel = "vault"
 	}
+	source := d.Icons.Prefix(c.Source.Kind) + cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind)) + " / " + c.Source.Name
 
 	if d.secret == nil {
 		field(containerLabel, c.Name)
-		if d.note != "" {
+		note()
-			field("note", st.Favourite.Render(d.note))
-		}
 		if c.Detail != "" {
 			field("", muted(c.Detail))
 		}
-		field("source", d.Icons.Prefix(c.Source.Kind)+cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
+		field("source", source)
 		out = append(out, "", muted(" Select a secret to see its details."))
 		return out
 	}
 
 	s := *d.secret
 	field("name", s.Name)
-	if d.note != "" {
+	note()
-		field("note", st.Favourite.Render(d.note))
-	}
 	field(containerLabel, c.Name)
 	if c.Source.Kind != provider.KindAzure && c.Detail != "" {
 		field("", muted(c.Detail))
 	}
-	field("source", d.Icons.Prefix(c.Source.Kind)+cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
+	field("source", source)
 	if s.Version != "" {
 		field("version", s.Version)
 	}
@@ -308,14 +306,12 @@ func (d Detail) lines(st styles.Styles) []string {
 	case provider.TypeCertificate:
 		label, hidden, reveal = "cert", "", "show the certificate"
 	}
-	indent := strings.Repeat(" ", 12)
-
 	out = append(out, "")
 	switch d.state {
 	case ValueHidden:
 		if hidden != "" {
 			field(label, hidden)
-			out = append(out, indent+hints(reveal))
+			out = append(out, valueIndent+hints(reveal))
 		} else {
 			field(label, hints(reveal))
 		}
@@ -332,9 +328,9 @@ func (d Detail) lines(st styles.Styles) []string {
 			for j, w := range strings.Split(ansi.Wrap(text, max(1, inner-11-len(lead)), ""), "\n") {
 				w = lead + w
 				if i == 0 && j == 0 {
-					out = append(out, " "+st.Label.Render(fmt.Sprintf("%-10s", label))+" "+st.Error.Render(w))
+					out = append(out, fieldLabel(st, label)+st.Error.Render(w))
 				} else {
-					out = append(out, strings.Repeat(" ", 12)+st.Error.Render(w))
+					out = append(out, valueIndent+st.Error.Render(w))
 				}
 			}
 		}
@@ -345,10 +341,10 @@ func (d Detail) lines(st styles.Styles) []string {
 		for _, line := range lines {
 			for _, w := range strings.Split(ansi.Hardwrap(line, max(1, inner-11), true), "\n") {
 				if first {
-					out = append(out, " "+st.Label.Render(fmt.Sprintf("%-10s", label))+" "+st.Value.Render(w))
+					out = append(out, fieldLabel(st, label)+st.Value.Render(w))
 					first = false
 				} else {
-					out = append(out, indent+st.Value.Render(w))
+					out = append(out, valueIndent+st.Value.Render(w))
 				}
 			}
 		}
@@ -362,7 +358,7 @@ func (d Detail) lines(st styles.Styles) []string {
 		if d.hidesIn != "" {
 			more = append(more, "hides in "+d.hidesIn)
 		}
-		out = append(out, indent+hints("hide", more...))
+		out = append(out, valueIndent+hints("hide", more...))
 	}
 	return append(out, d.versionLines(st)...)
 }
@@ -383,7 +379,7 @@ func (d Detail) versionLines(st styles.Styles) []string {
 			head += muted(" · " + d.VersionsKey + " to browse")
 		}
 	}
-	out := []string{"", " " + st.Label.Render(fmt.Sprintf("%-10s", "versions")) + " " + head}
+	out := []string{"", fieldLabel(st, "versions") + head}
 	current := d.versions[0].Version
 	for i, v := range d.versions {
 		if i == maxVersionLines {

internal/ui/panes/highlight.go

@@ -9,7 +9,6 @@ import (
 	"github.com/charmbracelet/x/ansi"
 )
 
-// sgr matches SGR escape sequences.
 var sgr = regexp.MustCompile("\x1b\\[([0-9;:]*)m")
 
 // Highlight draws a cursor row: line, padded to width, on style's

internal/ui/panes/list.go

@@ -301,15 +301,6 @@ func matchRanges(plain string, hits []int, style lipgloss.Style) []lipgloss.Rang
 	return out
 }
 
-// RuneIndexes converts byte offsets in s to rune offsets.
-func RuneIndexes(s string, bytes []int) []int {
-	out := make([]int, 0, len(bytes))
-	for _, b := range bytes {
-		out = append(out, utf8.RuneCountInString(s[:b]))
-	}
-	return out
-}
-
 // highlight returns the rune indexes to highlight in a row's plain text:
 // the filter hits, shifted to where the Filter text appears in the row.
 // It returns nil if the row doesn't contain the Filter text verbatim.
@@ -338,17 +329,7 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	ts := TitleStyle(st, focused)
 	title := ts.Render(l.Title)
 	if len(l.Tabs) > 1 {
-		for i, tab := range l.Tabs {
+		title += ts.Render(" ") + Tabs(st, ts, l.Tabs, l.Tab)
-			sep := " - "
-			if i == 0 {
-				sep = " "
-			}
-			if i == l.Tab {
-				title += ts.Render(sep) + ts.Underline(true).Render(tab)
-			} else {
-				title += ts.Render(sep) + st.Muted.Render(tab)
-			}
-		}
 	}
 	if q := l.input.Value(); q != "" && !l.filtering {
 		title += ts.Render(" /" + q)
@@ -379,26 +360,13 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	default:
 		for i := l.offset; i < len(l.visible) && i < l.offset+rows; i++ {
 			line := l.item.Render(st, l.items[l.visible[i]], inner-1)
-			plain := ansi.Strip(line)
+			line = " " + MarkMatches(line, l.highlight(i, ansi.Strip(line)), st.Match)
-			hits := l.highlight(i, plain)
 			if i == l.cursor {
 				base := st.SelectedBlurred
 				if focused {
 					base = st.Selected
 				}
-				text := " " + line
+				line = Highlight(ansi.Truncate(line, inner, "…"), base, inner)
-				if len(hits) > 0 {
-					for j := range hits {
-						hits[j]++ // leading space
-					}
-					text = lipgloss.StyleRanges(text, matchRanges(" "+plain, hits, st.Match)...)
-				}
-				line = Highlight(ansi.Truncate(text, inner, "…"), base, inner)
-			} else if len(hits) > 0 {
-				// Style just the matches, keeping the row's own colours.
-				line = " " + lipgloss.StyleRanges(line, matchRanges(plain, hits, st.Match)...)
-			} else {
-				line = " " + line
 			}
 			body = append(body, line)
 		}

internal/ui/styles/theme.go

@@ -3,8 +3,8 @@ package styles
 import (
 	"fmt"
 	"image/color"
+	"maps"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 
@@ -51,12 +51,7 @@ var Roles = map[string]string{
 func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 	st := Default()
 	var fg color.Color
-	roles := make([]string, 0, len(theme))
+	for _, role := range slices.Sorted(maps.Keys(theme)) {
-	for r := range theme {
-		roles = append(roles, r)
-	}
-	sort.Strings(roles)
-	for _, role := range roles {
 		if _, ok := Roles[role]; !ok {
 			continue
 		}
@@ -131,7 +126,6 @@ type value struct {
 	bold, italic, underline, reverse, faint bool
 }
 
-// fg styles s with the value as foreground, bg as background.
 func (v value) fg(s lipgloss.Style) lipgloss.Style {
 	if v.color != nil {
 		s = s.Foreground(v.color)

internal/update/update.go

@@ -45,9 +45,9 @@ const (
 // DefaultServers are where releases are looked for, in order.
 var DefaultServers = []string{GitHubRepo, DefaultRepo}
 
-// latestTimeout bounds asking one server for the latest release, so a
+// serverTimeout bounds asking one server for the latest release or its
-// server that's down leaves time for the next.
+// checksums, so a server that's down leaves time for the next.
-const latestTimeout = 5 * time.Second
+const serverTimeout = 5 * time.Second
 
 // maxDownload bounds what's read from the server.
 const maxDownload = 200 << 20
@@ -89,14 +89,9 @@ func (r Release) Notes(current string) string {
 	return PlainLinks(strings.TrimSpace(notes))
 }
 
-// recentReleases is how many releases Latest reads the changelogs of.
-const recentReleases = 10
-
 // PlainLinks shows Markdown links as their text, for a terminal.
 func PlainLinks(s string) string { return mdLink.ReplaceAllString(s, "$1") }
 
-// mdLink is a Markdown link, [text](url): the notes link PRs and commits,
-// and a terminal shows them as their text.
 var mdLink = regexp.MustCompile(`\[([^\]]+)\]\((https?://[^)\s]+)\)`)
 
 // Client talks to the release servers.
@@ -148,12 +143,15 @@ func (c *Client) Latest(ctx context.Context) (Release, error) {
 	return Release{}, errors.Join(errs...)
 }
 
+// recentReleases is how many releases Latest reads the changelogs of.
+const recentReleases = 10
+
 func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
 	api, err := API(repo)
 	if err != nil {
 		return Release{}, err
 	}
-	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
+	ctx, cancel := context.WithTimeout(ctx, serverTimeout)
 	defer cancel()
 	// The recent releases in one request (per_page on GitHub, limit on
 	// Gitea), for their changelogs.
@@ -222,7 +220,7 @@ func (c *Client) Install(ctx context.Context, r Release, exe string) error {
 	if m := Managed(exe); m != "" {
 		return fmt.Errorf("%s is managed by %s: update it there", exe, m)
 	}
-	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" || runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" {
+	if (runtime.GOOS != "darwin" && runtime.GOOS != "linux") || (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") {
 		return fmt.Errorf("no release build for %s/%s", runtime.GOOS, runtime.GOARCH)
 	}
 	version := strings.TrimPrefix(r.Tag, "v")
@@ -272,7 +270,7 @@ func (c *Client) download(ctx context.Context, tag, file string) ([]byte, error)
 	var errs []error
 	for _, repo := range c.servers() {
 		base := strings.TrimSuffix(repo, "/") + "/releases/download/" + tag + "/"
-		sctx, cancel := context.WithTimeout(ctx, latestTimeout)
+		sctx, cancel := context.WithTimeout(ctx, serverTimeout)
 		sums, err := c.get(sctx, base+"checksums.txt", 1<<20)
 		cancel()
 		if err != nil {