chore(release): v0.3.0

chore: release.sh takes patch, minor or major (#87 )
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
2026-10-15 16:13:49 +02:00 · 2026-10-15 16:13:07 +02:00 · 2026-10-15 14:46:23 +02:00 · 2026-10-15 14:31:10 +02:00 · 2026-10-15 14:20:17 +02:00 · 2026-10-15 14:07:02 +02:00
156 changed files with 11592 additions and 2052 deletions
@@ -16,10 +16,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          # The runner mounts Go, the module cache and the build cache as
@@ -40,7 +40,7 @@ jobs:
      - name: staticcheck
        # Pinned, so a new release can't fail CI on its own.
-        run: go run honnef.co/go/tools/cmd/staticcheck@v0.8.1 ./...
+        run: go run honnef.co/go/tools/cmd/staticcheck@v0.8.2 ./...
      - name: go test
        run: go test ./...
@@ -4,8 +4,9 @@ name: Release
 # as a pre-release) tests lazysecrets, then GoReleaser (.goreleaser.yaml)
 # builds it for macOS and Linux, arm64 and amd64, and publishes a Gitea
 # release with the archives, checksums and this release's section of the
-# changelog (git-cliff, cliff.toml). Pushing the same tag again (after
+# changelog (git-cliff, cliff.toml), then copies it to the GitHub
-# deleting it) replaces the release.
+# mirror. Pushing the same tag again (after deleting it) replaces the
 # release in both places.
 #
 #   scripts/release.sh v0.2.0    # updates CHANGELOG.md, tags and pushes
@@ -22,12 +23,12 @@ jobs:
      contents: write
    steps:
      - name: Checkout (full history, for the changelog)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          # The runner mounts Go, the module cache and the build cache as
@@ -74,10 +75,21 @@ jobs:
          cat "$RUNNER_TEMP/notes.md"
      - name: GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: v2.18.3
          args: release --clean --release-notes ${{ runner.temp }}/notes.md
        env:
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Copy the release to GitHub
        # The same notes and files on the GitHub mirror, which lazysecrets
        # updates from first (internal/update). GH_RELEASE_TOKEN is a
        # fine-grained token that can write the mirror's contents; without
        # it the step does nothing.
        run: node scripts/github-release.mjs
        env:
          TAG: ${{ github.ref_name }}
          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,46 @@
 name: Bug report
 description: Something in lazysecrets doesn't work as it should.
 labels: [bug]
 body:
  - type: markdown
    attributes:
      value: |
        Thanks for reporting! Please leave out secret values, tokens and anything else private: names of vaults and secrets are enough.
  - type: textarea
    id: what
    attributes:
      label: What happened
      description: What you did, what you expected, and what happened instead.
    validations:
      required: true
  - type: textarea
    id: steps
    attributes:
      label: Steps to reproduce
      description: If you can, try `lazysecrets --demo` first.
      placeholder: |
        1. lazysecrets --demo
        2. ctrl+s, type …
  - type: input
    id: version
    attributes:
      label: Version
      description: The status pane shows it, e.g. `v0.1.0`.
    validations:
      required: true
  - type: dropdown
    id: source
    attributes:
      label: Where
      multiple: true
      options:
        - Azure Key Vault
        - Databricks
        - SOPS or .env files
        - Links
        - Everywhere / not sure
  - type: input
    id: platform
    attributes:
      label: OS and terminal
      placeholder: macOS 26, kitty + tmux
@@ -0,0 +1,5 @@
 blank_issues_enabled: false
 contact_links:
  - name: Docs
    url: https://git.kebcloud.no/keb/lazysecrets/src/branch/main/docs
    about: Keys, sources, links, config and more.
@@ -0,0 +1,20 @@
 name: Feature request
 description: An idea for lazysecrets, or something that could work better.
 labels: [enhancement]
 body:
  - type: markdown
    attributes:
      value: |
        lazysecrets stays focused on finding, reading and sharing secrets, so not every idea will make it in, but they're all read.
  - type: textarea
    id: problem
    attributes:
      label: What you're trying to do
      description: The problem or the situation, more than the solution.
    validations:
      required: true
  - type: textarea
    id: idea
    attributes:
      label: Your idea
      description: How you'd like it to work, if you have one in mind.
@@ -1,33 +1,13 @@
 # ---> Go
 # If you prefer the allow list template instead of the deny list, see community template:
 # https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
 #
 # Binaries for programs and plugins
 *.exe
 *.exe~
 *.dll
 *.so
 *.dylib
 # Test binary, built with `go test -c`
 *.test
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 # Dependency directories (remove the comment below to include it)
 # vendor/
 # Go workspace file
 go.work
 go.work.sum
 # env file
 .env
 # Build output
 /lazysecrets
 # Release builds (GoReleaser, see .goreleaser.yaml)
 /dist/
 # go test -c, coverage profiles
 *.test
 *.out
 go.work
 go.work.sum
 .env
@@ -0,0 +1,2 @@
 <1+keb@noreply.git.kebcloud.no> <1+keb@noreply.localhost>
 <3+renovate-bot@noreply.git.kebcloud.no> <3+renovate-bot@noreply.localhost>
@@ -2,7 +2,61 @@
 Every release of lazysecrets, newest first.
-## v0.1.0 – 2026-10-10
+## v0.3.0 – 2026-10-15
 ### Added
 - Spring Boot config files in repos ([#79](https://git.kebcloud.no/keb/lazysecrets/pulls/79)) ([96395cb](https://git.kebcloud.no/keb/lazysecrets/commit/96395cb6a27a94293e35401790296a894821d075))
 - Decrypt Jasypt values in .env and Spring files ([#80](https://git.kebcloud.no/keb/lazysecrets/pulls/80)) ([17da9ea](https://git.kebcloud.no/keb/lazysecrets/commit/17da9eaa3271dfa315a517ad0092ab5cda0b0597))
 - H shows what's hidden; Spring keys that don't look secret are hidden ([#81](https://git.kebcloud.no/keb/lazysecrets/pulls/81)) ([913b3db](https://git.kebcloud.no/keb/lazysecrets/commit/913b3db6a938d21c6d8c9285a3111418495c7345))
 - Secret patterns for all of a repo's config files, with per-type overrides ([#82](https://git.kebcloud.no/keb/lazysecrets/pulls/82)) ([4bac06a](https://git.kebcloud.no/keb/lazysecrets/commit/4bac06ae5ba6fcb8c96d46198f01235391e29f1a))
 - Example env files are listed hidden, not skipped ([#83](https://git.kebcloud.no/keb/lazysecrets/pulls/83)) ([580c7ef](https://git.kebcloud.no/keb/lazysecrets/commit/580c7ef985599b98277d80be38e39abe169b2dc4))
 - Docker Compose files in repos ([#84](https://git.kebcloud.no/keb/lazysecrets/pulls/84)) ([0f5248d](https://git.kebcloud.no/keb/lazysecrets/commit/0f5248d8f6d27e3f95f8b9cbc28310ee7b0581f7))
 - Go to shows a repo file's icon before its name ([#85](https://git.kebcloud.no/keb/lazysecrets/pulls/85)) ([e2f289d](https://git.kebcloud.no/keb/lazysecrets/commit/e2f289da5c54dab869e7ba10ca35bdc1ab74bf28))
 ### Fixed
 - Decrypt SOPS .env keys written with export or spaces ([#78](https://git.kebcloud.no/keb/lazysecrets/pulls/78)) ([39cbac9](https://git.kebcloud.no/keb/lazysecrets/commit/39cbac9aabcea11e9915363e4adae5873f9724de))
 ## v0.2.1 – 2026-10-15
 ### Fixed
 - A link opens lazysecrets with your cache and next to your running instances ([#71](https://git.kebcloud.no/keb/lazysecrets/pulls/71)) ([bb41767](https://git.kebcloud.no/keb/lazysecrets/commit/bb41767cbad00bab4f1824f4e0754cc7abd98c59))
 ## v0.2.0 – 2026-10-14
 ### Added
 - Lazysecrets list prints everything lazysecrets can find, for fzf and editor pickers ([#70](https://git.kebcloud.no/keb/lazysecrets/pulls/70)) ([39454d4](https://git.kebcloud.no/keb/lazysecrets/commit/39454d47a864c8628c50b023aee9539d33be2f44))
 ### Fixed
 - Lazysecrets starts from fzf's become, on a non-blocking terminal ([#67](https://git.kebcloud.no/keb/lazysecrets/pulls/67)) ([4480e8f](https://git.kebcloud.no/keb/lazysecrets/commit/4480e8fed00024691091eb7096abb9dc83b8044d))
 - Local builds are dev-<commit> again, not a Go pseudo-version ([#68](https://git.kebcloud.no/keb/lazysecrets/pulls/68)) ([e825a51](https://git.kebcloud.no/keb/lazysecrets/commit/e825a51b30261b55c536af18fefde79dc6308377))
 - A wrapped value in the details keeps its colour on every line ([#69](https://git.kebcloud.no/keb/lazysecrets/pulls/69)) ([dbb0eb2](https://git.kebcloud.no/keb/lazysecrets/commit/dbb0eb2bbdf6d695cf0d9ac15a1b513af8ba431d))
 ## v0.1.2 – 2026-10-13
 ### Added
 - Look for repos in the usual folders, not just ~/git ([#57](https://git.kebcloud.no/keb/lazysecrets/pulls/57)) ([47ef862](https://git.kebcloud.no/keb/lazysecrets/commit/47ef86293d757f965069b1ea100a4d53d5a9b876))
 - Config grouped by area, with per-provider timeouts and an update interval ([#60](https://git.kebcloud.no/keb/lazysecrets/pulls/60)) ([10d1fc6](https://git.kebcloud.no/keb/lazysecrets/commit/10d1fc63c75fbb91088119a2e81884e44c36c4a3))
 - The update changelog covers every version you missed ([#61](https://git.kebcloud.no/keb/lazysecrets/pulls/61)) ([75bab25](https://git.kebcloud.no/keb/lazysecrets/commit/75bab2528677086219817ff9bc08a36755c96dcd))
 ### Fixed
 - Help and errors name sharing.key and sharing.keyRules, not share.* ([#64](https://git.kebcloud.no/keb/lazysecrets/pulls/64)) ([6b3edd4](https://git.kebcloud.no/keb/lazysecrets/commit/6b3edd45d83b9b2af06a40f1f7e67f35c6861a69))
 - Unambiguous repo key names, clearer config and key names, and a newer lazysecrets's files no longer stop an older one ([#66](https://git.kebcloud.no/keb/lazysecrets/pulls/66)) ([a81fcaa](https://git.kebcloud.no/keb/lazysecrets/commit/a81fcaa5a6cef3ce0d07d6195f3e7bbb98808253))
 ## v0.1.1 – 2026-10-13
 ### Added
 - `e` on the status pane edits the config ([#55](https://git.kebcloud.no/keb/lazysecrets/pulls/55)) ([2044341](https://git.kebcloud.no/keb/lazysecrets/commit/2044341b20d795fa7cadcabb9514631990993e0a))
 - Share env files as encrypted links ([#54](https://git.kebcloud.no/keb/lazysecrets/pulls/54)) ([4377eb9](https://git.kebcloud.no/keb/lazysecrets/commit/4377eb98bf0dd523d5c4371bf84668412053290e))
 ## v0.1.0 – 2026-10-12
 Hello world 👋
@@ -1,53 +1,51 @@
 # lazysecrets
-A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.
+A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic [lazygit](https://github.com/jesseduffield/lazygit).
 ![lazysecrets](docs/assets/lazysecrets.png)
 ## Main features
- **Read-only**: lazysecrets never creates, changes or deletes a secret, so
+- **Read-only**: lazysecrets never creates, changes or deletes a secret.
  it's safe to point at production. That's by design and may stay that way.
  (`e` opens a repo's SOPS or `.env` file in your editor, or `sops edit`;
  any change is yours.)
 - **Zero setup**: uses the logins you already have (`az`, the Databricks
  CLI, `sops`, `git`). No config file needed.
 - **Search everything**: `ctrl+s` searches every source at once, with
-  fzf-style matching (`'exact`, `^prefix`, `suffix$`, `!not`), and jumps
+  fzf-style matching.
-  straight to the result.
+- **Share links**: Share `lazysecrets://` links with colleagues.
 - **Share links**: `s` copies a `lazysecrets://` link. A colleague opens it
  with their own access, from the terminal or with a click in the browser
  or chat.
 - **Careful with values**: values stay hidden until you reveal them, and
  copied values are cleared from the clipboard after 30 seconds.
- **Scriptable**: `lazysecrets get <link>` prints a value for scripts and
+- **Scriptable**: `get`, `list` and `open` for scripts, fzf and editor
-  pipes.
+  pickers; [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
- **Favourites**: star the secrets you use most and get back to them in one
+  for Neovim.
-  key.
+- **Favourites**: star the secrets you use most for easy access.
 - **Expiry warnings**: secrets, keys and certificates that expire soon are
-  marked.
+  marked, listed together in the status pane.
 - **Your way**: rebind any key, pick a theme, and add custom commands to run
  on a secret.
 - **Try it first**: `lazysecrets --demo` runs on built-in sample data.
- **Supported platforms**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos. 
+- **Sources**: Azure Key Vault, Databricks secret scopes, and SOPS, `.env`, Spring Boot and Docker Compose files in your git repos.
 > **Early development:** expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.
 ## Install
 On macOS or Linux (arm64 or x86_64):
-
+```sh
 curl -fsSL https://raw.githubusercontent.com/karleinarb/lazysecrets/main/install.sh | sh
 ```
 Or
 ```sh
 curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
 ```
-It installs the latest [release](https://git.kebcloud.no/keb/lazysecrets/releases)
+Both approaches will install the latest release from [GitHub](https://github.com/karleinarb/lazysecrets/releases) with fallback to
-into `~/.local/bin` after checking it against the release's checksums.
+[git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets/releases), into
 `~/.local/bin` after checking it against the release's checksums.
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
-
+`U` (or `lazysecrets update`) updates in place when there's a newer
-lazysecrets looks for a newer release once a day: the footer then shows
+release.
 `↑ v0.2.0`, and `U` shows its changelog and updates in place (or run
 `lazysecrets update`).
 Or build it yourself:
 `go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest`.
@@ -60,45 +58,66 @@ lazysecrets         # start lazysecrets
 lazysecrets --demo  # test with demo data
 ```
-Pick a source on the left, then a vault, then a secret. The keys you'll
+Pick a source on the left, then a vault, then a secret. With nothing
 signed in yet, the right pane says how to get started. The keys you'll
 use most:
 | Key | Action |
 |---|---|
-| `j`/`k`, `h`/`l`, `enter`, `esc` | move, switch panes, drill in, back |
+| `j`/`k`, `enter`, `esc` | move, drill in, back |
 | `l` / `h` | the details of what's selected / back |
 | `/` | filter the list you're in |
 | `space` | reveal / hide the value |
-| `y` | copy the value (cleared from the clipboard after 30s) |
+| `y` | copy the value |
 | `ctrl+s` | Go to: search everything and jump there |
 | `f` / `F` | star / your favourites |
 | `s` | copy a link to share |
 | `?` | every key, searchable |
 | `q` | quit |
 ## Integration
 `lazysecrets list`, `get` and `open` plug lazysecrets into fzf, editor
 pickers and scripts: see [Integration](docs/integration.md#an-fzf-picker).
 ![fzf-example](docs/assets/fzf-example.png)
 ## Docs
 - [Keys](docs/keys.md): every key, Go to, the layout, and rebinding keys
 - [Azure Key Vault](docs/azure.md): accounts, permissions, pinned vaults
 - [Databricks](docs/databricks.md): profiles and Key Vault-backed scopes
- [SOPS and .env files](docs/repos.md): which repos and files, decrypting
+- [SOPS, .env, Spring and compose files](docs/repos.md): which repos and files, decrypting
- [Links](docs/links.md): sharing, opening, `lazysecrets get` in scripts,
+- [Sharing](docs/sharing.md): links to secrets, encrypted env files, and
-  and opening links from the browser and chat
+  opening links, also from the browser and chat
 - [Integration](docs/integration.md): how lazysecrets can integrate into other systems
 - [Custom commands](docs/custom-commands.md): run your own commands on a
  secret
 - [Config](docs/config.md): every option, themes, layered configs, the
  state file
- [Development](docs/development.md): building, tests, pull requests and
+- [Development](docs/development.md): building, tests, how changes land and
  releasing
 ## Privacy
 lazysecrets never stores, caches or sends your secret values. It keeps the
 names and metadata of what you've loaded in a cache file readable only by
-you, to show it at once next time (`cache: false` turns it off). It talks
+you, to show it at once next time (`storage.cache: false` turns it off). It talks
 only to the services you use it with, and collects no usage data. The one
-call of its own is a daily check for a new release on this server, which
+call of its own is a daily check for a new release, on GitHub or else
-`updateCheck: false` turns off.
+git.kebcloud.no, which `updates.autoCheck: false` turns off.
 ## Repositories
 The main repo of this codebase is at [git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets).
 The [GitHub mirror](https://github.com/karleinarb/lazysecrets) is for discoverability, issue-tracking and releases.
 It also makes it possible to give a ⭐ if you like lazysecrets!
 ## Contributing
 I don't take pull requests as I don't have time to review and test them.
 But bug reports and ideas are very welcome!
 Open an [issue on GitHub](https://github.com/karleinarb/lazysecrets/issues) and I'll have a look.
 ## AI disclosure
@@ -0,0 +1,11 @@
 # Security
 Please report a vulnerability privately, not in a public issue:
 - on GitHub, with **Report a vulnerability** under the
  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
 - by email to karl-einarb@outlook.com.
 Say what's affected, how to reproduce it and the version
 (`lazysecrets --version`). Fixes go into the next release, and only the
 latest release gets them.
@@ -0,0 +1,10 @@
 // Package lazysecrets holds what the module's root has for the app: the
 // changelog, embedded so the status pane can show it offline.
 package lazysecrets
 import _ "embed"
 // Changelog is CHANGELOG.md as of the build: every release up to it.
 //
 //go:embed CHANGELOG.md
 var Changelog string
@@ -24,7 +24,8 @@ Hello world 👋
 {% for group, commits in commits | group_by(attribute="group") %}
 ### {{ group | striptags | trim }}
 {% for commit in commits %}
- {% if commit.breaking %}**Breaking:** {% endif %}{{ commit.message | split(pat="\n") | first | upper_first | trim }}\
+- {% if commit.breaking %}**Breaking:** {% endif %}{{ commit.message | split(pat="\n") | first | upper_first | trim }} \
 ([{{ commit.id | truncate(length=7, end="") }}](https://git.kebcloud.no/keb/lazysecrets/commit/{{ commit.id }}))\
 {% endfor %}
 {% endfor %}\n
 """
@@ -33,6 +34,8 @@ trim = true
 # Runs on each part (header, every release) separately.
 postprocessors = [
  { pattern = "\n{3,}", replace = "\n\n" },
  # Squash commits end in the PR's number: link it.
  { pattern = "\\(#([0-9]+)\\)", replace = "([#${1}](https://git.kebcloud.no/keb/lazysecrets/pulls/${1}))" },
 ]
 [git]
@@ -46,6 +49,10 @@ commit_preprocessors = [
  # A merge commit (not a squash) says "Merge pull request 'feat: …' (#4)
  # from branch into main": keep the title and number.
  { pattern = "^Merge pull request '(.+)' \\((#[0-9]+)\\) from .*", replace = "${1} (${2})" },
  # #11 was squash-merged with #10 (the status pane) in it: name both.
  { pattern = "^feat: link each changelog entry to its PR and commit \\(#11\\)", replace = "feat: a status pane (0) with version, updates, accounts, files and links; changelog entries link to their PR and commit (#11)" },
  # #55's title starts with a key, which capitalised reads as another.
  { pattern = "^feat: e on the status pane edits the config", replace = "feat: `e` on the status pane edits the config" },
  # Titles may be written "[feat] x", "[feat]: x" or "feat:x" (see
  # pr-title.yml); all become "feat: x".
  { pattern = "^\\[(feat|fix|perf|refactor|docs|test|ci|chore|build|style|revert)(\\([^)]*\\))?(!?)\\](!?):?\\s*", replace = "${1}${2}${3}${4}: " },
@@ -1,10 +1,7 @@
 package main
 import (
 	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"os"
 	"golang.org/x/term"
@@ -21,7 +18,7 @@ import (
 // It ends with a newline only when printing to a terminal, so command
 // substitution and pipes get the value exactly.
 func get(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) error {
-	v, err := value(ctx, providers, st, r)
+	v, _, err := readKey(ctx, providers, st, r)
 	if err != nil {
 		return err
 	}
@@ -33,82 +30,16 @@ func get(ctx context.Context, providers []provider.Provider, st *store.Store, r
 	return err
 }
-// value reads what r points at without listing its vault: the vault and
+// readKey reads what r points at (ref.Read), and the version read. The
-// name are enough for Azure, tried with each account (the one that last
+// account asked for (--account) goes first, else the one that last read
-// read it first); for Databricks the workspace's profile is found by its
+// it.
-// host.
+func readKey(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, string, error) {
 func value(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, error) {
 	if r.IsSource() || r.IsContainer() {
 		return provider.SecretValue{}, fmt.Errorf("%s points at a %s, not a secret", r, map[bool]string{true: "subscription or workspace", false: "vault or scope"}[r.IsSource()])
 	}
 	if r.Kind != provider.KindAzure && r.Host == "" {
 		return provider.SecretValue{}, errors.New("{{secrets/…}} names no workspace: use its lazysecrets:// link (s in lazysecrets)")
 	}
 	key := r
 	key.Version = ""
 	node := st.Node(key.String())
-
+	account, source := node.Account, node.Source
-	type try struct {
+	if r.Account != "" && r.Account != account {
-		p provider.Provider
+		account, source = r.Account, ""
 		o provider.Object
 	}
-	var tries []try
+	return ref.Read(ctx, providers, r, account, source)
 	for _, p := range providers {
 		if p.Kind() != r.Kind {
 			continue
 		}
 		o := provider.Object{Name: r.Name, Type: cmp.Or(r.Type, provider.TypeSecret), Version: r.Version}
 		if r.Kind != provider.KindAzure { // by host: workspaces, repos
 			loc, ok := p.(provider.Locator)
 			if !ok {
 				continue
 			}
 			profile, found, err := loc.Locate(ctx, r.Host)
 			if err != nil || !found {
 				continue
 			}
 			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: profile}
 			o.Container = provider.Container{Source: src, Name: r.Scope}
 			// Listing the scopes tells a Key Vault-backed one, whose value
 			// can then be read from the vault if Databricks refuses.
 			if cs, err := p.Containers(ctx, src); err == nil {
 				for _, c := range cs {
 					if c.Name == r.Scope {
 						c.Source = src
 						o.Container = c
 					}
 				}
 			}
 		} else {
 			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: node.Source}
 			o.Container = provider.Container{Source: src, Name: r.ContainerName(), Detail: r.VaultURL()}
 		}
 		t := try{p, o}
 		if p.ID() == node.Account {
 			tries = append([]try{t}, tries...)
 		} else {
 			tries = append(tries, t)
 		}
 	}
 	if len(tries) == 0 {
 		switch r.Kind {
 		case provider.KindDatabricks:
 			return provider.SecretValue{}, fmt.Errorf("no Databricks profile for workspace %s", r.Host)
 		case provider.KindRepo:
 			return provider.SecretValue{}, fmt.Errorf("repo %s isn't here: run it inside the repo, or list it under providers.repos.paths", r.Host)
 		}
 		return provider.SecretValue{}, fmt.Errorf("no %s account to read %s with", r.Kind, r)
 	}
 	var errs []error
 	for _, t := range tries {
 		v, err := t.p.Value(ctx, t.o)
 		if err == nil {
 			return v, nil
 		}
 		if len(tries) == 1 {
 			return provider.SecretValue{}, err
 		}
 		errs = append(errs, fmt.Errorf("%s: %w", t.p.Label(), err))
 	}
 	return provider.SecretValue{}, errors.Join(errs...)
 }
@@ -20,7 +20,7 @@ func TestValue(t *testing.T) {
 		"lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app/storage-key": "storage-demo-key",
 	} {
 		r, _ := ref.Parse(link)
-		v, err := value(context.Background(), providers, st, r)
+		v, _, err := readKey(context.Background(), providers, st, r)
 		if err != nil || v.Reveal() != want {
 			t.Errorf("%s: %q, %v", link, v.Reveal(), err)
 		}
@@ -31,7 +31,7 @@ func TestValue(t *testing.T) {
 		"{{secrets/app/storage-key}}":                                          "names no workspace",
 	} {
 		r, _ := ref.Parse(link)
-		if _, err := value(context.Background(), providers, st, r); err == nil || !strings.Contains(err.Error(), wantErr) {
+		if _, _, err := readKey(context.Background(), providers, st, r); err == nil || !strings.Contains(err.Error(), wantErr) {
 			t.Errorf("%s: %v, want %q", link, err, wantErr)
 		}
 	}
@@ -69,11 +69,7 @@ func installHandler(cfg config.Config, configPath, term string) (string, string,
 	if _, err := launchCommand(cfg, configPath, term, exe, "lazysecrets://check"); err != nil {
 		return "", "", err
 	}
-	launch := []string{exe}
+	launch := append(append([]string{exe}, configArgs(configPath)...), "launch")
 	if configPath != defaultConfigPath() {
 		launch = append(launch, "--config", configPath)
 	}
 	launch = append(launch, "launch")
 	if term != "" {
 		launch = append(launch, "--terminal", term)
 	}
@@ -188,8 +184,14 @@ func launchCommand(cfg config.Config, configPath, term, exe, link string) ([]str
 // innerCommand runs lazysecrets on link, with the environment it needs.
 func innerCommand(configPath, exe, link string) []string {
 	inner := append(append([]string{"/usr/bin/env"}, linkhandler.Env(os.Getenv)...), exe)
-	if configPath != defaultConfigPath() {
+	inner = append(inner, configArgs(configPath)...)
 		inner = append(inner, "--config", configPath)
 	}
 	return append(inner, "open", link)
 }
 // configArgs passes the config files on, unless they're the default.
 func configArgs(configPath string) []string {
 	if configPath == defaultConfigPath() {
 		return nil
 	}
 	return []string{"--config", configPath}
 }
@@ -0,0 +1,270 @@
 package main
 import (
 	"cmp"
 	"context"
 	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"os/signal"
 	"slices"
 	"strings"
 	"syscall"
 	"time"
 	"charm.land/lipgloss/v2"
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
 	"git.kebcloud.no/keb/lazysecrets/internal/listing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
 )
 // listCmd prints every source, vault and secret lazysecrets can find, one
 // per line, for fzf, editor pickers and scripts:
 //
 //	lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1
 //
 // Each line is the kind, a mark (✗ or ⚠, ★, ◷ and the provider's icon),
 // the name, a status (why it couldn't be read, or that it has expired or
 // expires soon; else empty), its note (muted, or empty), the account and
 // the link, tab-separated. The mark has a field of its own so a search can
 // leave it out (fzf --nth), and ^prod finds names starting with prod. The
 // name is coloured from the theme,
 // with the provider's icon (as in the TUI: --icons, LAZYSECRETS_ICONS,
 // ui.icons); the link never is.
 //
 // What's cached prints at once; what's missing or older than --max-age
 // follows as it loads. A list that can't be read is a line too, as it
 // fails: the vault or source, then ✗ and why in the theme's error colour.
 // They're in the output rather than on stderr, which would draw over fzf.
 func listCmd(providers []provider.Provider, st *store.Store, cachePath string, timeout func(provider.Kind) time.Duration, theme styles.Styles, withIcons, withRecent bool, expiryWarn time.Duration, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("list", flag.ContinueOnError)
 	cached := fs.Bool("cached", false, "only what's cached, and repos: load nothing from Azure or Databricks")
 	maxAge := fs.Duration("max-age", 2*time.Minute, "load cached lists older than this again")
 	format := fs.String("format", "text", "text: kind, mark, name, status, note, account and link, tab-separated; json: an object per line")
 	color := fs.String("color", "always", "colour the names (text): always or never; fzf needs --ansi")
 	iconsOn := fs.Bool("icons", withIcons, "put the provider's Nerd Font icon before names (text)")
 	stars := fs.Bool("stars", true, "put ★ before starred names, in the theme's favouriteColor (text)")
 	recent := fs.Bool("recent", withRecent, "put ◷ before names used lately, in mutedColor (text; default ui.recentIcon)")
 	notes := fs.Bool("notes", true, "start a note with a note icon (✎ without --icons) (text; the note is printed either way)")
 	expiry := fs.Bool("expiry", true, "mark and say which have expired (✗ expired) or expire within ui.expiryWarningDays (⚠ expires in 12d) (text)")
 	kinds := fs.String("kind", "", "only these kinds, comma-separated: "+strings.Join(listing.Kinds, ", ")+" (vault: also scopes and repo files)")
 	showErrors := fs.Bool("errors", true, "list the lists that can't be read, with why (text: ✗ lines; json: \"error\")")
 	hidden := fs.Bool("hidden", false, "list what's hidden too, as H does in the TUI: Spring and compose keys that don't look secret, example files, and files and repos with only those (json: \"hidden\")")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
 	if fs.NArg() > 0 {
 		return fmt.Errorf("usage: lazysecrets list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]")
 	}
 	var only []string
 	for k := range strings.SplitSeq(*kinds, ",") {
 		if k = strings.TrimSpace(k); k == "" {
 			continue
 		}
 		if !slices.Contains(listing.Kinds, k) {
 			return fmt.Errorf("--kind: %q is not one of %s", k, strings.Join(listing.Kinds, ", "))
 		}
 		only = append(only, k)
 	}
 	if *color != "always" && *color != "never" {
 		return fmt.Errorf("--color: %q is not always or never", *color)
 	}
 	now := time.Now()
 	m := marks{theme: theme, icons: icons.None, stars: *stars, recent: *recent, expiry: *expiry,
 		color: *color == "always", warn: expiryWarn, now: now}
 	if *iconsOn {
 		m.icons = icons.NerdFont
 	}
 	var write func(listing.Entry) error
 	switch *format {
 	case "text":
 		write = func(e listing.Entry) error {
 			colored := *color == "always"
 			mark := m.of(e)
 			name := nameOf(e, theme, colored)
 			// Why it couldn't be read (vaults, sources), or when it
 			// expires (secrets, keys, certificates): never both.
 			status := errorOf(e, theme, colored)
 			if status == "" && *expiry {
 				status = expiryOf(e, theme, expiryWarn, now, colored)
 			}
 			note := noteOf(e, theme, m.icons, *notes, colored)
 			// A tab or line break in a name would break the line up.
 			_, err := fmt.Fprintf(out, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", e.Kind, mark, oneLine.Replace(name), oneLine.Replace(status),
 				oneLine.Replace(note), e.Account, e.Link)
 			return err
 		}
 	case "json":
 		enc := json.NewEncoder(out)
 		enc.SetEscapeHTML(false)
 		write = func(e listing.Entry) error { return enc.Encode(e) }
 	default:
 		return fmt.Errorf("--format: %q is not text or json", *format)
 	}
 	// When the reader goes away (a pick in fzf), writing fails instead of
 	// killing the process, so what loaded is still saved.
 	signal.Notify(make(chan os.Signal, 1), syscall.SIGPIPE)
 	var gone error
 	emit := func(e listing.Entry) error {
 		if e.Error != "" && !*showErrors {
 			return nil
 		}
 		if err := write(e); err != nil {
 			gone = err
 			return err
 		}
 		return nil
 	}
 	f := cachefile.New()
 	if cachePath != "" {
 		f = cachefile.Read(cachePath)
 	}
 	f, loaded := listing.Run(context.Background(), listing.Options{
 		Providers: providers, Cache: f, MaxAge: *maxAge, Cached: *cached, Kinds: only, Timeout: timeout, Hidden: *hidden,
 		Mark: func(link, account string) listing.Marks {
 			n := st.Node(link)
 			return listing.Marks{Starred: n.StarredFor(account), Recent: n.UsedLately(now),
 				LastUsed: n.LastUsed, Uses: n.Uses, Note: n.Note}
 		},
 	}, emit)
 	// Only what was loaded: list never moves a cursor, so the TUI's stay.
 	if cachePath != "" && loaded {
 		f.Cursor = nil
 		if err := cachefile.Save(cachePath, f, cachefile.Keep(providers), time.Now()); err != nil {
 			return err
 		}
 	}
 	if gone != nil && !errors.Is(gone, syscall.EPIPE) {
 		return gone
 	}
 	return nil // or the reader has what it wanted
 }
 var oneLine = strings.NewReplacer("\t", " ", "\r\n", " ", "\n", " ", "\r", " ")
 // noteOf is the entry's note, muted, after a note icon (✎ without Nerd
 // Font icons) with icon; or "".
 func noteOf(e listing.Entry, theme styles.Styles, iconSet icons.Set, icon, color bool) string {
 	if e.Note == "" {
 		return ""
 	}
 	note := e.Note
 	if icon {
 		note = cmp.Or(iconSet.Note, "✎") + " " + note
 	}
 	return renderer(color)(theme.Muted, note)
 }
 // expiryOf says that a secret, key or certificate has expired, in red,
 // or when it will if that's within warn (expires in 12d), in yellow, or
 // is "". Its mark (✗, ⚠) is before the name.
 func expiryOf(e listing.Entry, theme styles.Styles, warn time.Duration, now time.Time, color bool) string {
 	render := renderer(color)
 	switch state, left := expiry.Of(e.Expires, now, warn); state {
 	case expiry.Expired:
 		return render(theme.Error, "expired")
 	case expiry.Soon:
 		return render(theme.Warning, "expires in "+expiry.Left(left))
 	}
 	return ""
 }
 // errorOf is why a list couldn't be read, in red, or "". Its mark (✗)
 // is before the name.
 func errorOf(e listing.Entry, theme styles.Styles, color bool) string {
 	return renderer(color)(theme.Error, e.Error)
 }
 // nameOf is an entry's name for the text format: the path with the
 // item's own name standing out, and the account.
 func nameOf(e listing.Entry, theme styles.Styles, color bool) string {
 	render := renderer(color)
 	var name string
 	if n := len(e.Path); n > 0 {
 		if n > 1 {
 			name = render(theme.Muted, strings.Join(e.Path[:n-1], " / ")+" / ")
 		}
 		name += e.Path[n-1]
 	}
 	if e.AccountLabel != "" {
 		name += render(theme.Muted, " · "+e.AccountLabel)
 	}
 	return name
 }
 // marks says what goes before the name, in a field of its own so a
 // search leaves it out: ✗ in red when something's wrong (it couldn't be
 // read, or has expired) or ⚠ when it expires within warn; ★ for a starred
 // entry and ◷ for one used lately, as the TUI marks them; then the
 // provider's icon. The marks are right-aligned in room for every kind
 // turned on, so they sit by the icon and names line up.
 type marks struct {
 	theme                        styles.Styles
 	icons                        icons.Set
 	stars, recent, expiry, color bool
 	warn                         time.Duration // ui.expiryWarningDays
 	now                          time.Time
 }
 func (m marks) of(e listing.Entry) string {
 	render := renderer(m.color)
 	var parts []string
 	room := 0 // marks turned on
 	mark := func(on bool, st lipgloss.Style, s string) {
 		room++
 		if on {
 			parts = append(parts, render(st, s))
 		}
 	}
 	// What's wrong, then what to watch: room for one of them.
 	state := expiry.None
 	if m.expiry {
 		state, _ = expiry.Of(e.Expires, m.now, m.warn)
 	}
 	switch {
 	case e.Error != "" || state == expiry.Expired:
 		mark(true, m.theme.Error, "✗")
 	case state == expiry.Soon:
 		mark(true, m.theme.Warning, "⚠")
 	default:
 		mark(false, m.theme.Error, "")
 	}
 	if m.stars {
 		mark(e.Starred, m.theme.Favourite, "★")
 	}
 	if m.recent {
 		mark(e.Recent, m.theme.Muted, "◷")
 	}
 	pad := strings.Repeat("  ", room-len(parts)) // each mark and its space
 	kind := provider.Kind("")
 	for _, k := range []provider.Kind{provider.KindAzure, provider.KindDatabricks, provider.KindRepo} {
 		if strings.EqualFold(string(k), e.Provider) {
 			kind = k
 		}
 	}
 	if icon := strings.TrimSpace(m.icons.Prefix(kind)); icon != "" {
 		parts = append(parts, render(m.theme.Kind(kind), icon))
 	} else if len(parts) == 0 {
 		pad = strings.TrimSuffix(pad, " ") // no mark after the room
 	}
 	return pad + strings.Join(parts, " ")
 }
 func renderer(color bool) func(lipgloss.Style, string) string {
 	return func(st lipgloss.Style, s string) string {
 		if !color || s == "" {
 			return s
 		}
 		return st.Render(s)
 	}
 }
@@ -0,0 +1,152 @@
 package main
 import (
 	"strings"
 	"testing"
 	"time"
 	"git.kebcloud.no/keb/lazysecrets/internal/listing"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
 )
 func TestListNames(t *testing.T) {
 	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-app-prod", "db-password"}, AccountLabel: "alice"}
 	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-app-prod / db-password · alice" {
 		t.Errorf("plain: %q", got)
 	}
 	// The item's own name isn't muted with its path.
 	if got := nameOf(e, styles.Default(), true); !strings.Contains(got, "\x1b[mdb-password") {
 		t.Errorf("name not set apart: %q", got)
 	}
 }
 func TestListMarks(t *testing.T) {
 	az := icons.NerdFont.Azure
 	plain := marks{theme: styles.Default(), icons: icons.NerdFont, stars: true}
 	noIcons := plain
 	noIcons.icons = icons.None
 	colored := noIcons
 	colored.color = true
 	for _, c := range []struct {
 		m    marks
 		e    listing.Entry
 		want string
 	}{
 		// Room for the status mark and the star, so names line up.
 		{plain, listing.Entry{Provider: "azure", Starred: true}, "  ★ " + az},
 		{plain, listing.Entry{Provider: "azure"}, "    " + az},
 		{marks{icons: icons.NerdFont}, listing.Entry{Provider: "azure", Starred: true}, "  " + az},
 		{noIcons, listing.Entry{Provider: "azure", Starred: true}, "  ★"},
 		{marks{}, listing.Entry{Provider: "azure", Starred: true}, " "},
 		{colored, listing.Entry{Provider: "azure", Starred: true}, "  " + styles.Default().Favourite.Render("★")},
 	} {
 		if got := c.m.of(c.e); got != c.want {
 			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
 		}
 	}
 }
 func TestListRecentMarks(t *testing.T) {
 	az := icons.NerdFont.Azure
 	m := marks{icons: icons.NerdFont, stars: true, recent: true}
 	for _, c := range []struct {
 		e    listing.Entry
 		want string
 	}{
 		// Right-aligned in room for three: by the icon, names lined up.
 		{listing.Entry{Provider: "azure", Starred: true, Recent: true}, "  ★ ◷ " + az},
 		{listing.Entry{Provider: "azure", Recent: true}, "    ◷ " + az},
 		{listing.Entry{Provider: "azure"}, "      " + az},
 	} {
 		if got := m.of(c.e); got != c.want {
 			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
 		}
 	}
 }
 func TestListExpiry(t *testing.T) {
 	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
 	warn := 30 * 24 * time.Hour
 	for _, c := range []struct {
 		expires time.Time
 		want    string
 	}{
 		{time.Time{}, ""},
 		{now.Add(-time.Hour), "expired"},
 		{now.Add(12*24*time.Hour + time.Hour), "expires in 12d"},
 		{now.Add(5 * time.Hour), "expires in 5h"},
 		{now.Add(60 * 24 * time.Hour), ""},
 	} {
 		if got := expiryOf(listing.Entry{Expires: c.expires}, styles.Default(), warn, now, false); got != c.want {
 			t.Errorf("expires %v: %q, want %q", c.expires, got, c.want)
 		}
 	}
 	if got := expiryOf(listing.Entry{Expires: now.Add(-time.Hour)}, styles.Default(), warn, now, true); got != styles.Default().Error.Render("expired") {
 		t.Errorf("expired isn't red: %q", got)
 	}
 }
 func TestListNotes(t *testing.T) {
 	e := listing.Entry{Note: "rotate in May"}
 	if got := noteOf(e, styles.Default(), icons.NerdFont, true, false); got != icons.NerdFont.Note+" rotate in May" {
 		t.Errorf("icons: %q", got)
 	}
 	if got := noteOf(e, styles.Default(), icons.None, true, false); got != "✎ rotate in May" {
 		t.Errorf("no icons: %q", got)
 	}
 	if got := noteOf(e, styles.Default(), icons.NerdFont, false, false); got != "rotate in May" {
 		t.Errorf("--notes=false: %q", got)
 	}
 	if got := noteOf(listing.Entry{}, styles.Default(), icons.NerdFont, true, true); got != "" {
 		t.Errorf("no note: %q", got)
 	}
 }
 func TestListStatusMark(t *testing.T) {
 	az := icons.NerdFont.Azure
 	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
 	m := marks{icons: icons.NerdFont, stars: true, expiry: true, warn: 30 * 24 * time.Hour, now: now}
 	for _, c := range []struct {
 		e    listing.Entry
 		want string
 	}{
 		// Right-aligned in room for two, as with ★ and ◷.
 		{listing.Entry{Provider: "azure", Error: "403 Forbidden"}, "  ✗ " + az},
 		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}, "  ✗ " + az},
 		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour), Starred: true}, "✗ ★ " + az},
 		{listing.Entry{Provider: "azure", Expires: now.Add(5 * 24 * time.Hour)}, "  ⚠ " + az},
 		{listing.Entry{Provider: "azure", Expires: now.Add(60 * 24 * time.Hour), Starred: true}, "  ★ " + az},
 	} {
 		if got := m.of(c.e); got != c.want {
 			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
 		}
 	}
 	m.expiry = false // --expiry=false: no ⚠ or ✗ for expiry; errors still
 	if got := m.of(listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}); got != "    "+az {
 		t.Errorf("--expiry=false: %q", got)
 	}
 	m.expiry, m.color, m.theme = true, true, styles.Default()
 	if got := m.of(listing.Entry{Error: "403"}); !strings.Contains(got, styles.Default().Error.Render("✗")) {
 		t.Errorf("not a red ✗: %q", got)
 	}
 	if got := m.of(listing.Entry{Expires: now.Add(time.Hour)}); !strings.Contains(got, styles.Default().Warning.Render("⚠")) {
 		t.Errorf("not a yellow ⚠: %q", got)
 	}
 }
 func TestListErrors(t *testing.T) {
 	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-restricted"}, Error: "403 Forbidden"}
 	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-restricted" {
 		t.Errorf("the name has more: %q", got)
 	}
 	if got := errorOf(e, styles.Default(), false); got != "403 Forbidden" {
 		t.Errorf("plain: %q", got)
 	}
 	if got := errorOf(e, styles.Default(), true); got != styles.Default().Error.Render("403 Forbidden") {
 		t.Errorf("why isn't red: %q", got)
 	}
 	if got := errorOf(listing.Entry{}, styles.Default(), true); got != "" {
 		t.Errorf("no error: %q", got)
 	}
 }
@@ -3,7 +3,9 @@
 package main
 import (
 	"cmp"
 	"context"
 	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -16,6 +18,7 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"git.kebcloud.no/keb/lazysecrets"
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
 	"git.kebcloud.no/keb/lazysecrets/internal/config"
 	"git.kebcloud.no/keb/lazysecrets/internal/instance"
@@ -65,25 +68,44 @@ func checkCommandKeys(km *keys.Map, cmds []commands.Command) error {
 		if c.Key == "" {
 			continue
 		}
-		name := fmt.Sprintf("custom command %q", cmpOr(c.Description, c.Command))
+		name := fmt.Sprintf("custom command %q", cmp.Or(c.Description, c.Command))
 		if err := km.CheckExtra(c.Key, name); err != nil {
 			return err
 		}
 		for _, d := range cmds[:i] {
 			overlap := c.Context == d.Context || c.Context == commands.Global || d.Context == commands.Global
 			if d.Key == c.Key && overlap {
-				return fmt.Errorf("%s: %q is also the key of custom command %q", name, c.Key, cmpOr(d.Description, d.Command))
+				return fmt.Errorf("%s: %q is also the key of custom command %q", name, c.Key, cmp.Or(d.Description, d.Command))
 			}
 		}
 	}
 	return nil
 }
-func cmpOr(a, b string) string {
+// refArg parses get's and open's arguments: a reference, and optionally
-	if a != "" {
+// the account to use when several could (lazysecrets list's column) and,
-		return a
+// for open, what to do with it rather than asking (--action).
 func refArg(cmd string, args []string) (r ref.Ref, action string, err error) {
 	fs := flag.NewFlagSet(cmd, flag.ContinueOnError)
 	account := fs.String("account", "", "the account to use when several could, as lazysecrets list prints it")
 	usage := "usage: lazysecrets get [--account <account>] <ref>"
 	act := new(string)
 	if cmd == "open" {
 		act = fs.String("action", "", "do this rather than ask: go (to it), copy (go, and copy its value) or show (go, and show it)")
 		usage = "usage: lazysecrets open [--account <account>] [--action go|copy|show] <ref>"
 	}
-	return b
+	if err := fs.Parse(args); err != nil {
 		return r, "", err
 	}
 	if fs.NArg() != 1 {
 		return r, "", errors.New(usage)
 	}
 	if _, ok := app.OpenActions[*act]; *act != "" && !ok {
 		return r, "", fmt.Errorf("--action: %q is not go, copy or show", *act)
 	}
 	r, err = ref.Parse(fs.Arg(0))
 	r.Account = *account
 	return r, *act, err
 }
 // defaultConfigPath is $LAZYSECRETS_CONFIG_FILE, else config.yaml in the
@@ -105,18 +127,29 @@ func run() error {
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	dir := flag.String("dir", "", "start in this directory: its git repo's SOPS files, the ones under it first (default: the current directory)")
 	demo := flag.Bool("demo", false, "browse built-in sample data instead of real backends")
-	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request")
+	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request, every provider's (overrides the config)")
 	icons := flag.Bool("icons", true,
 		"show Nerd Font icons (needs a Nerd Font v3+); disable with --icons=false or LAZYSECRETS_ICONS=0")
 	clipClear := flag.Duration("clipboard-clear", 30*time.Second, "clear copied values from the clipboard after this long (0 disables)")
 	flag.Usage = func() {
 		fmt.Fprintf(flag.CommandLine.Output(), `Usage:
  lazysecrets [flags]             browse secrets
-  lazysecrets [flags] [open] <ref>
+  lazysecrets [flags] [open [--account <account>] [--action go|copy|show]] <ref>
-                                  open a lazysecrets:// link, Key Vault URL,
+                                  open a lazysecrets:// link (also a share link),
-                                  @Microsoft.KeyVault(...) or {{secrets/scope/key}}
+                                  Key Vault URL, @Microsoft.KeyVault(...) or
-  lazysecrets [flags] get <ref>   print the value a lazysecrets:// link points at,
+                                  {{secrets/scope/key}}
  lazysecrets [flags] get [--account <account>] <ref>
                                  print the value a lazysecrets:// link points at,
                                  for scripts: VAR=$(lazysecrets get <ref>)
  lazysecrets [flags] list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]
                          [--color always|never] [--icons=false] [--errors=false]
                          [--stars=false] [--notes=false] [--recent] [--expiry=false]
                                  print every source, vault and secret it can
                                  find, one per line, for fzf and pickers:
                                  what's cached at once, then what loads
  lazysecrets [flags] share [--key <secret>] <env file>...
                                  print a link to env files of a repo, encrypted
                                  with a secret's value (default: sharing.key)
  lazysecrets [flags] keybindings print every action and its keys (with your
                                  config applied), as config to copy and edit
  lazysecrets handler install [--terminal NAME]
@@ -138,30 +171,35 @@ Flags:
 		return nil
 	}
-	var open, getRef *ref.Ref
+	sub := "" // the subcommand; "" browses
-	printKeys := false
+	var subArgs []string
 	var open *ref.Ref
 	var getRef ref.Ref
 	var openAction string
 	switch args := flag.Args(); {
 	case len(args) > 0 && (args[0] == "share" || args[0] == "list"):
 		sub, subArgs = args[0], args[1:]
 	case len(args) == 1 && args[0] == "keybindings":
-		printKeys = true
+		sub = "keybindings"
-	case len(args) == 2 && args[0] == "get":
+	case len(args) > 0 && args[0] == "get":
-		r, err := ref.Parse(args[1])
+		r, _, err := refArg("get", args[1:])
 		if err != nil {
 			return err
 		}
-		getRef = &r
+		sub, getRef = "get", r
 	case len(args) > 0 && args[0] == "handler":
 		return handler(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "launch":
 		return launch(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "update":
-		return updateCmd(args[1:])
+		return updateCmd(*configPath, args[1:])
 	case len(args) == 0:
-	case args[0] == "open" && len(args) == 2:
+	case args[0] == "open" && len(args) >= 2:
-		r, err := ref.Parse(args[1])
+		r, act, err := refArg("open", args[1:])
 		if err != nil {
 			return err
 		}
-		open = &r
+		open, openAction = &r, act
 	case len(args) == 1 && looksLikeRef(args[0]):
 		// lazysecrets <link>, like lazysecrets open <link>
 		r, err := ref.Parse(args[0])
@@ -182,6 +220,11 @@ Flags:
 	if err != nil {
 		return err
 	}
 	// Warnings show when the window opens.
 	var warnings []string
 	if w := styles.Unknown(cfg.Theme); w != "" {
 		warnings = append(warnings, w)
 	}
 	keymap := keys.Default()
 	if err := keymap.Apply(cfg.Keybinding); err != nil {
 		return err
@@ -189,40 +232,62 @@ Flags:
 	if err := checkCommandKeys(&keymap, cfg.CustomCommands); err != nil {
 		return err
 	}
-	if printKeys {
+	if sub == "keybindings" {
 		fmt.Print(keymap.YAML())
 		return nil
 	}
 	// Precedence: flag > environment > config file > default.
 	set := map[string]bool{}
 	flag.Visit(func(f *flag.Flag) { set[f.Name] = true })
-	if !set["timeout"] && cfg.Timeout > 0 {
+	if *timeout <= 0 {
-		*timeout = cfg.Timeout
+		return fmt.Errorf("--timeout: %s is not positive", *timeout)
 	}
-	if !set["clipboard-clear"] && cfg.ClipboardClear != nil {
+	// Each provider's own timeout, unless --timeout sets them all.
-		*clipClear = *cfg.ClipboardClear
+	timeouts := map[provider.Kind]time.Duration{}
 	if !set["timeout"] {
 		if cfg.Providers.Timeout > 0 {
 			*timeout = cfg.Providers.Timeout
 		}
 		for k, d := range map[provider.Kind]time.Duration{
 			provider.KindAzure:      cfg.Providers.Azure.Timeout,
 			provider.KindDatabricks: cfg.Providers.Databricks.Timeout,
 			provider.KindRepo:       cfg.Providers.Repos.Timeout,
 		} {
 			if d > 0 {
 				timeouts[k] = d
 			}
 		}
 	}
-	expiryDays := 30
+	// timeoutFor is how long a request to a provider of kind k may take.
-	if cfg.ExpiryWarningDays != nil {
+	timeoutFor := func(k provider.Kind) time.Duration { return cmp.Or(timeouts[k], *timeout) }
-		expiryDays = *cfg.ExpiryWarningDays
+	if !set["clipboard-clear"] {
-	}
+		*clipClear = valueOr(cfg.Values.ClipboardClear, *clipClear)
 	revealTimeout := 60 * time.Second
 	if cfg.RevealTimeout != nil {
 		revealTimeout = *cfg.RevealTimeout
 	}
 	loadDelay := 150 * time.Millisecond
 	if cfg.LoadDelay != nil {
 		loadDelay = *cfg.LoadDelay
 	}
 	expiryWarning := time.Duration(valueOr(cfg.UI.ExpiryWarningDays, 30)) * 24 * time.Hour
 	revealTimeout := valueOr(cfg.Values.RevealTimeout, 60*time.Second)
 	loadDelay := valueOr(cfg.UI.LoadDelay, 150*time.Millisecond)
 	updateEvery := valueOr(cfg.Updates.AutoCheckInterval, 0) // 0: the app's default, a day
 	if !set["icons"] {
 		switch {
 		case os.Getenv("LAZYSECRETS_ICONS") != "":
 			*icons = os.Getenv("LAZYSECRETS_ICONS") != "0"
-		case cfg.Icons != nil:
+		case cfg.UI.Icons != nil:
-			*icons = *cfg.Icons
+			*icons = *cfg.UI.Icons
 		}
 	}
 	recentIcon := valueOr(cfg.UI.RecentIcon, false)
 	startDir := *dir
 	if startDir == "" {
 		startDir, _ = os.Getwd()
 	}
 	// What was loaded last time.
 	cacheFile := ""
 	if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
 		cacheFile = filepath.Join(d, "cache.json")
 	}
 	// Stars, notes and the layout. Demo mode keeps them in memory, so
 	// sample vaults never end up in the real file.
 	stateDir, err := config.StateDir()
@@ -234,17 +299,25 @@ Flags:
 		statePath = filepath.Join(stateDir, "state.json")
 	}
 	st, err := store.Load(statePath)
-	if err != nil {
+	if errors.Is(err, store.ErrNewer) {
 		warnings = append(warnings, err.Error()+": stars, notes and the layout won't be saved; update lazysecrets")
 	} else if err != nil {
 		return err
 	}
 	var providers []provider.Provider
 	if *demo {
 		// Two Azure accounts, like a personal and an admin login in az.
 		alice, admin := "Azure:alice@example.com/demo", "Azure:admin.alice@example.com/demo"
 		fake.Seed(st, alice, admin)
 		az := fake.Azure(400*time.Millisecond).As(alice, "Azure · alice")
 		// Due soon whenever the demo runs (the tests' dates are fixed).
 		az.Expire("kv-app-prod", "api-key", time.Now().AddDate(0, 0, 9).Truncate(24*time.Hour))
 		providers = []provider.Provider{
-			fake.Azure(400*time.Millisecond).As("Azure:dev@example.com/demo", "Azure · dev"),
+			az,
-			fake.AzureOps(700*time.Millisecond).As("Azure:ops@example.com/demo", "Azure · ops"),
+			fake.AzureOps(700*time.Millisecond).As(admin, "Azure · admin.alice"),
 			fake.Databricks(600 * time.Millisecond),
 			fake.Repos(),
 		}
 	} else {
 		pc := cfg.Providers
@@ -271,17 +344,10 @@ Flags:
 			providers = append(providers, dbx)
 		}
 		if config.On(pc.Repos.Enabled) {
 			start := *dir
 			if start == "" {
 				start, _ = os.Getwd()
 			}
 			roots := []string{"~/git"}
 			if pc.Repos.Roots != nil {
 				roots = *pc.Repos.Roots
 			}
 			repos := repo.New(repo.Settings{
-				Dir: start, Paths: pc.Repos.Paths, Roots: roots, Starred: starredRepos(st),
+				Dir: startDir, Paths: pc.Repos.Paths, Roots: valueOr(pc.Repos.Roots, repo.DefaultRoots),
-				Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
+				Starred: starredRepos(st), Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
 				SecretPatterns: pc.Repos.SecretPatterns, Types: map[string]repo.FileType{"spring": pc.Repos.Spring, "compose": pc.Repos.Compose},
 			})
 			// The repo it started in (shown on top as Repo) and the
 			// others, checked for secret files in the background like
@@ -297,10 +363,23 @@ Flags:
 	// the standard logger, which would draw over the TUI.
 	log.SetOutput(io.Discard)
-	if getRef != nil {
+	switch sub {
-		ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+	case "get":
 		ctx, cancel := context.WithTimeout(context.Background(), timeoutFor(getRef.Kind))
 		defer cancel()
-		return get(ctx, providers, st, *getRef)
+		return get(ctx, providers, st, getRef)
 	case "list":
 		return listCmd(providers, st, cacheFile, timeoutFor, theme, *icons, recentIcon, expiryWarning, subArgs, os.Stdout)
 	case "share":
 		// The files from a repo, the key from whichever provider it's
 		// in: the longest timeout.
 		d := *timeout
 		for _, t := range timeouts {
 			d = max(d, t)
 		}
 		ctx, cancel := context.WithTimeout(context.Background(), d)
 		defer cancel()
 		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), subArgs, os.Stdout)
 	}
 	// Links opened elsewhere (lazysecrets launch) can come here.
@@ -334,16 +413,10 @@ Flags:
 		onActive = srv.Touch
 	}
-	// What was loaded last time, and where it was left in this folder.
+	// Where it was left in this folder.
-	var cacheFile, placeDir string
+	placeDir := ""
 	if !*demo {
-		if d, err := config.CacheDir(); err == nil && config.On(cfg.Cache) {
+		placeDir = startDir
 			cacheFile = filepath.Join(d, "cache.json")
 		}
 		placeDir = *dir
 		if placeDir == "" {
 			placeDir, _ = os.Getwd()
 		}
 		if abs, err := filepath.Abs(placeDir); err == nil {
 			placeDir = abs
 		}
@@ -351,29 +424,40 @@ Flags:
 	m := app.New(providers, app.Options{
 		Timeout:        *timeout,
 		Timeouts:       timeouts,
 		Icons:          *icons,
 		ClipboardClear: *clipClear,
-		FlatSources:    cfg.SourcesView == "flat",
+		FlatSources:    cfg.UI.SourcesView == "flat",
-		CollapseGroups: config.On(cfg.CollapseGroups),
+		CollapseGroups: config.On(cfg.UI.CollapseGroups),
 		LoadDelay:      loadDelay,
-		NoHistory:      !config.On(cfg.History),
+		NoHistory:      !config.On(cfg.Storage.History),
 		OnActive:       onActive,
 		RevealTimeout:  revealTimeout,
-		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
+		ExpiryWarning:  expiryWarning,
-		HideOnBlur:     config.On(cfg.HideOnBlur),
+		HideOnBlur:     config.On(cfg.Values.HideOnBlur),
 		HandlerSetup:   setup,
-		Updater:        updater(),
+		Updater:        updater(cfg.Updates.Sources),
-		UpdateCheck:    config.On(cfg.UpdateCheck),
+		UpdateCheck:    config.On(cfg.Updates.AutoCheck),
 		UpdateEvery:    updateEvery,
 		Keys:           &keymap,
 		Commands:       cfg.CustomCommands,
 		Version:        versionString(),
 		Store:          st,
 		Warning:        strings.Join(warnings, " · "),
 		CacheFile:      cacheFile,
 		ConfigFiles:    configFiles(*configPath),
 		StatePath:      statePath,
 		Changelog:      lazysecrets.Changelog,
 		Dir:            placeDir,
 		ShareKey:       cfg.Sharing.Key,
 		ShareRules:     shareRules(cfg),
 		Open:           open,
 		OpenAction:     openAction,
 		RecentIcon:     recentIcon,
 		Styles:         &theme,
 		DefaultFg:      defaultFg,
 	})
 	blockingStdin()
 	p = tea.NewProgram(m)
 	final, err := p.Run()
 	if fm, ok := final.(app.Model); ok {
@@ -381,3 +465,30 @@ Flags:
 	}
 	return err
 }
 // valueOr is *p, or def when p is nil (not set in the config).
 func valueOr[T any](p *T, def T) T {
 	if p == nil {
 		return def
 	}
 	return *p
 }
 // configFiles are the config files given, for the status pane: those
 // that exist, or the first if none does (where to create one).
 func configFiles(list string) []string {
 	var all, found []string
 	for _, f := range strings.Split(list, ",") {
 		if f = strings.TrimSpace(f); f == "" {
 			continue
 		}
 		all = append(all, f)
 		if _, err := os.Stat(f); err == nil {
 			found = append(found, f)
 		}
 	}
 	if len(found) == 0 && len(all) > 0 {
 		return all[:1]
 	}
 	return found
 }
@@ -0,0 +1,93 @@
 package main
 import (
 	"context"
 	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"git.kebcloud.no/keb/lazysecrets/internal/config"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
 	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 )
 // shareFiles prints a share link to env files of one repo, encrypted with
 // the --key secret's value, else the repo's or the config's sharing.key:
 //
 //	lazysecrets share .env apps/api/.env
 func shareFiles(ctx context.Context, providers []provider.Provider, st *store.Store, general string, rules share.Rules, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("share", flag.ContinueOnError)
 	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: sharing.key)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
 	if fs.NArg() == 0 {
 		return errors.New("usage: lazysecrets share [--key <secret>] <env files>")
 	}
 	var root, id string
 	var files []share.File
 	for _, name := range fs.Args() {
 		abs, err := filepath.Abs(name)
 		if err != nil {
 			return err
 		}
 		r, i, err := repo.Root(filepath.Dir(abs))
 		if err != nil {
 			return err
 		}
 		if root == "" {
 			root, id = r, i
 		} else if r != root {
 			return fmt.Errorf("%s isn't in %s: share files of one repo at a time", name, root)
 		}
 		real, err := filepath.EvalSymlinks(abs)
 		if err != nil {
 			return err
 		}
 		rel, err := filepath.Rel(root, real)
 		if err != nil {
 			return err
 		}
 		f := share.File{Path: filepath.ToSlash(rel)}
 		if err := share.CheckPath(f.Path); err != nil {
 			return err
 		}
 		if f.Data, err = os.ReadFile(real); err != nil {
 			return err
 		}
 		files = append(files, f)
 	}
 	key, ok, err := share.DefaultKey(root, general)
 	if *keyLink != "" {
 		key, err = share.ParseKey(*keyLink)
 		ok = err == nil
 	}
 	if err != nil {
 		return err
 	}
 	if !ok {
 		return errors.New("which secret to encrypt with? --key <secret>, or sharing.key in the repo's .lazysecrets.yaml or the config")
 	}
 	v, version, err := readKey(ctx, providers, st, key)
 	if err != nil {
 		return fmt.Errorf("reading the key %s: %w", key, err)
 	}
 	link, err := share.Seal(share.Header{Key: share.Pin(key, version), Repo: id}, []byte(v.Reveal()), files, rules)
 	if err != nil {
 		return err
 	}
 	_, err = fmt.Fprintln(out, link)
 	return err
 }
 // shareRules are the config's sharing.keyRules.
 func shareRules(cfg config.Config) share.Rules {
 	return share.Rules{MinLength: cfg.Sharing.KeyRules.MinLength, MinClasses: cfg.Sharing.KeyRules.MinClasses}
 }
@@ -0,0 +1,67 @@
 package main
 import (
 	"bytes"
 	"context"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 )
 // demoRules take the demo key, made up to be remembered.
 var demoRules = share.Rules{MinLength: 16, MinClasses: 1}
 func TestShareFiles(t *testing.T) {
 	root, _ := filepath.EvalSymlinks(t.TempDir())
 	for _, args := range [][]string{{"init", "-q"}, {"remote", "add", "origin", "git@git.example.com:team/app.git"}} {
 		if out, err := exec.Command("git", append([]string{"-C", root}, args...)...).CombinedOutput(); err != nil {
 			t.Skip("git:", string(out))
 		}
 	}
 	os.WriteFile(filepath.Join(root, ".env"), []byte("A=1\n"), 0o600)
 	os.WriteFile(filepath.Join(root, "main.go"), []byte("package main\n"), 0o644)
 	providers := []provider.Provider{fake.Azure(0)}
 	st, _ := store.Load("")
 	ctx := context.Background()
 	key := "lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password"
 	var out bytes.Buffer
 	if err := shareFiles(ctx, providers, st, key, demoRules, []string{filepath.Join(root, ".env")}, &out); err != nil {
 		t.Fatal(err)
 	}
 	r, err := ref.Parse(strings.TrimSpace(out.String()))
 	if err != nil {
 		t.Fatal(err)
 	}
 	s, err := share.Read(r)
 	if err != nil || s.Repo != "git.example.com/team/app" || s.Key.Name != "db-password" {
 		t.Fatalf("%+v, %v", s.Header, err)
 	}
 	files, err := s.Open([]byte("correct-horse-battery-staple"))
 	if err != nil || len(files) != 1 || files[0].Path != ".env" || string(files[0].Data) != "A=1\n" {
 		t.Errorf("%+v, %v", files, err)
 	}
 	for _, c := range []struct {
 		general string
 		args    []string
 		want    string
 	}{
 		{"", []string{filepath.Join(root, ".env")}, "which secret"},
 		{key, []string{filepath.Join(root, "main.go")}, "isn't an env file"},
 		{key, nil, "usage"},
 		{"", []string{"--key", "lazysecrets://azure/kv-app-prod.vault.azure.net", filepath.Join(root, ".env")}, "isn't a secret"},
 	} {
 		if err := shareFiles(ctx, providers, st, c.general, demoRules, c.args, &out); err == nil || !strings.Contains(err.Error(), c.want) {
 			t.Errorf("%v: %v, want %q", c.args, err, c.want)
 		}
 	}
 }
@@ -0,0 +1,5 @@
 //go:build !unix
 package main
 func blockingStdin() {}
@@ -0,0 +1,20 @@
 //go:build unix
 package main
 import (
 	"os"
 	"syscall"
 	"golang.org/x/term"
 )
 // blockingStdin makes a terminal on stdin blocking again. fzf's become
 // hands on its /dev/tty non-blocking; Go can't poll /dev/tty on macOS,
 // so it reads it directly, and the TUI's first read would fail with
 // EAGAIN ("resource temporarily unavailable").
 func blockingStdin() {
 	if fd := int(os.Stdin.Fd()); term.IsTerminal(fd) {
 		_ = syscall.SetNonblock(fd, false)
 	}
 }
@@ -3,18 +3,21 @@ package main
 import (
 	"context"
 	"errors"
 	"flag"
 	"fmt"
 	"strings"
 	"time"
 	"git.kebcloud.no/keb/lazysecrets/internal/config"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/app"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 // updater is the app's way to find and install releases, replacing the
-// binary that's running.
+// binary that's running, from the servers (config releases) or the
-func updater() *app.Updater {
+// default ones.
-	c := &update.Client{}
+func updater(servers []string) *app.Updater {
 	c := &update.Client{Servers: servers}
 	return &app.Updater{
 		Latest: c.Latest,
 		Install: func(ctx context.Context, r update.Release) error {
@@ -29,28 +32,36 @@ func updater() *app.Updater {
 // updateCmd is lazysecrets update [--check]: the newer release's
 // changelog, then (unless --check) install it.
-func updateCmd(args []string) error {
+func updateCmd(configPath string, args []string) error {
-	check := len(args) == 1 && args[0] == "--check"
+	fs := flag.NewFlagSet("update", flag.ContinueOnError)
-	if len(args) > 0 && !check {
+	check := fs.Bool("check", false, "just say if there's a newer release")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
 	if fs.NArg() != 0 {
 		return errors.New("usage: lazysecrets update [--check]")
 	}
 	cfg, err := config.LoadAll(strings.Split(configPath, ","))
 	if err != nil {
 		return err
 	}
 	current := versionString()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
-	c := &update.Client{}
+	c := &update.Client{Servers: cfg.Updates.Sources}
 	r, err := c.Latest(ctx)
 	if err != nil {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)
 	}
 	if !update.Newer(current, r.Tag) {
-		if !update.Newer(current, "v999.0.0") {
+		if strings.HasPrefix(current, "dev") {
 			return fmt.Errorf("this is a development build (%s); the latest release is %s: install it with install.sh, or go install …@%s", current, r.Tag, r.Tag)
 		}
 		fmt.Printf("lazysecrets %s is the latest (%s)\n", current, r.Tag)
 		return nil
 	}
-	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes()))
+	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes(current)))
-	if check {
+	if *check {
 		fmt.Println("lazysecrets update installs it.")
 		return nil
 	}
@@ -1,14 +1,22 @@
 package main
-import "runtime/debug"
+import (
 	"regexp"
 	"runtime/debug"
 )
 // version is set by release builds:
 //
 //	go build -ldflags "-X main.version=1.2.3" ./cmd/lazysecrets
 var version string
 // pseudo matches a Go pseudo-version (v0.1.3-0.20261014174204-1c31a75d0507,
 // maybe +dirty): its commit.
 var pseudo = regexp.MustCompile(`[-.]\d{14}-([0-9a-f]{12})(\+.*)?$`)
 // versionString is the release version, or for other builds what Go
-// recorded: the module version (go install …@v1.2.3), else the commit.
+// recorded: the module version (go install …@v1.2.3), else the commit
 // (dev-c1a4f90, -dirty with changes not committed).
 func versionString() string {
 	if version != "" {
 		return version
@@ -18,6 +26,15 @@ func versionString() string {
 		return "dev"
 	}
 	if v := bi.Main.Version; v != "" && v != "(devel)" {
 		// A commit, not a release: a local build (Go stamps those too) or
 		// go install …@<commit>.
 		if m := pseudo.FindStringSubmatch(v); m != nil {
 			dirty := ""
 			if m[2] != "" {
 				dirty = "-dirty"
 			}
 			return "dev-" + m[1][:7] + dirty
 		}
 		return v
 	}
 	var rev, dirty string
@@ -0,0 +1,22 @@
 package main
 import "testing"
 func TestPseudoVersions(t *testing.T) {
 	for v, want := range map[string]string{
 		"v0.1.3-0.20261014174204-1c31a75d0507":       "1c31a75d0507",
 		"v0.1.3-0.20261014174204-1c31a75d0507+dirty": "1c31a75d0507",
 		"v0.0.0-20261014174204-1c31a75d0507":         "1c31a75d0507",
 		"v0.2.0-rc.1.0.20261014174204-1c31a75d0507":  "1c31a75d0507",
 		"v0.1.2":      "",
 		"v0.2.0-rc.1": "",
 	} {
 		got := ""
 		if m := pseudo.FindStringSubmatch(v); m != nil {
 			got = m[1]
 		}
 		if got != want {
 			t.Errorf("%s: %q, want %q", v, got, want)
 		}
 	}
 }
@@ -13,8 +13,18 @@ is listed under each, since their permissions can differ.
 A service principal is used instead when `AZURE_CLIENT_ID`,
 `AZURE_TENANT_ID` and a secret or certificate are set in the environment.
-If your az login expires mid-session, the status line says so: press `L` to
+On an account's group row, the fourth pane shows who it signs in as: name,
-run `az login` without leaving lazysecrets, and everything reloads.
+user, tenant, object ID, whether the session used MFA, directory roles
 (built-in ones by name) and its subscriptions, read from az's account list
 and the token lazysecrets already has. `y` on
 the row copies the object ID, the one access policies and role
 assignments ask for; `l` goes into the pane, where `j`/`k` pick any
 field, `/` filters them (`/tenant`) and `y` copies the selected one.
 If an account's az login has expired, the status line says so once, and the
 Details pane on that account's rows says it until you sign in: press `L`
 there to run `az login` for it without leaving lazysecrets, and everything
 reloads.
 ## Permissions
@@ -28,8 +38,10 @@ vault resources (e.g. *Reader*). Key Vault data-plane access is separate
 | read secret values | *Key Vault Secrets User* |
 | read certificate details | *Key Vault Certificate User* |
-A missing permission is shown in the pane, including the action that was
+A missing permission is shown in the pane, shortened to what was denied
-denied.
+(the action, or the access policy permission), with what to check: a
 role or group to activate in PIM, access from the vault's owner, or, when
 its firewall refused, the network you're on.
 ## Vaults you can't discover
@@ -51,4 +63,15 @@ Secrets, keys and certificates, each on their own tab of the Secrets pane
 (`[`/`]`). `space` reveals a secret's value, or the public material of a
 key (PEM public key) or certificate; private key material is never
 fetched. `v` lists an item's versions. Items expiring within
-`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
+`ui.expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
 The status pane (`0`) lists them across every vault loaded, opened or
 cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`
 on one goes to it. Expiry dates come with the lists. It says how many
 vaults it covers; `ctrl+a` in search loads the rest.
 On a vault, the right pane shows its settings: resource group, location,
 SKU, whether access is by Azure roles or access policies, soft delete and
 purge protection, which networks can reach it, private endpoints and tags.
 They come with the list of vaults, so they cost no extra requests and are
 cached with it.
@@ -1,41 +1,45 @@
 # Config
 Optional, at `~/.config/lazysecrets/config.yaml` (or
-`$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags override
+`$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags (noted
-it. Unknown keys are an error, so typos don't go unnoticed.
+below) override it. Unknown keys are an error, so typos don't go
 unnoticed. `e` on the status pane (`0`) opens it in your editor, as in
 lazygit (making it if it isn't there yet); changes apply when lazysecrets
 starts again.
 ```yaml
-icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
+ui:
-clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
+  icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
-revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
+  recentIcon: false      # mark items used lately (Recent, R) with ◷, here and in lazysecrets list
-hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
+  sourcesView: grouped   # or flat; ` toggles it
-expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
+  collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
-timeout: 30s           # per backend request
+  loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
-loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
+  expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d; ⚠ in lazysecrets list); expired ones get ✗
-sourcesView: grouped   # or flat; ` toggles it
+values:
-collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
+  revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
-updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
+  hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
-history: true          # count uses of items for Recent (R)
+  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables; also --clipboard-clear
-cache: true            # keep what was loaded (never values) for the next start
+storage:
  cache: true            # keep what was loaded (never values) for the next start
  history: true          # count uses of items for Recent (R)
 updates:
  autoCheck: true          # look for a newer release at startup (U and lazysecrets update work either way)
  autoCheckInterval: 24h   # at most this often
  sources:                 # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
    - https://github.com/karleinarb/lazysecrets
    - https://git.kebcloud.no/keb/lazysecrets
 providers:
-  azure:                                 # applies to every az account
+  timeout: 30s           # per backend request; a provider's own timeout overrides it; also --timeout
-    enabled: true                        # default
+  azure:                 # likewise databricks and repos; azure covers every az account
-    hideSubscriptions: [platform-mgmt]   # by name or ID
+    enabled: true        # default
-    vaults:                              # listed under "Pinned vaults", for vaults
+    timeout: 30s
      - https://kv-foo.vault.azure.net/  # you can read but not discover
  databricks:
    enabled: true
    hideProfiles: [test]
  repos:
    enabled: true
    roots: [~/git]
    paths: [~/work/infra]
    include: ["secrets/**"]
    exclude: ["**/testdata/**"]
 ```
-More, each on its own page: [repos](repos.md) (`providers.repos`), the
+More, each on its own page: [Azure](azure.md#vaults-you-cant-discover)
-[link handler](links.md#from-the-browser-and-chat) (`linkHandler`),
+(`providers.azure`), [Databricks](databricks.md) (`providers.databricks`),
 [repos](repos.md#which-files) (`providers.repos`),
 [sharing env files](sharing.md#sharing-env-files) (`sharing`), the
 [link handler](sharing.md#from-the-browser-and-chat) (`linkHandler`),
 [keybindings](keys.md#rebinding-keys) (`keybinding`) and
 [custom commands](custom-commands.md) (`customCommands`).
@@ -56,7 +60,7 @@ theme:
  activeBorderColor: ["#ff966c", bold]   # focused pane
  inactiveBorderColor: ["#589ed7"]
  selectedLineBgColor: ["#2d3f76"]       # cursor row background (default: palette 8)
-  inactiveViewSelectedLineBgColor: ["#2f334d"]
+  inactiveViewSelectedLineBgColor: ["#2f334d"] # in the other panes (default: palette 8, not bold)
  defaultFgColor: ["#c8d3f5"]
  optionsTextColor: ["#82aaff"]          # keys and labels
  searchMatchColor: ["#ffc777", bold]
@@ -70,18 +74,22 @@ theme:
  azureColor: ["#82aaff"]
  databricksColor: ["#ff757f"]
  repoColor: ["#c099ff"]
  springColor: ["#c3e88d"]               # Spring Boot config files
  composeColor: ["#82aaff"]              # Docker Compose files
 ```
 A role lazysecrets doesn't know, a typo or one from a newer version, is
 skipped with a warning.
 Icons need a [Nerd Font](https://www.nerdfonts.com) (v3+). If they render
-as boxes, turn them off with `icons: false`.
+as boxes, turn them off with `ui.icons: false`.
 ## Layering
 Several config files can be layered, later ones winning (theme roles and
 keybindings merge one by one), with a comma-separated `--config` or
-`LAZYSECRETS_CONFIG_FILE`, like lazygit's `LG_CONFIG_FILE`. An editor
+`LAZYSECRETS_CONFIG_FILE`, like lazygit's `LG_CONFIG_FILE`; e.g. your
-plugin can so add a generated theme file to your own config, the way
+config plus an editor-generated theme:
 snacks.nvim themes lazygit from Neovim's highlight groups:
 ```sh
 LAZYSECRETS_CONFIG_FILE=~/.config/lazysecrets/config.yaml,~/.cache/nvim/lazysecrets-theme.yml lazysecrets
@@ -94,14 +102,15 @@ Stars, notes, usage and the layout are kept in
 by you: one record per source, vault or secret, keyed by its
 `lazysecrets://` link, never with values. A star belongs to the account you
 starred the item under (a vault two of your accounts can see can be starred
-for one); a note describes the item, so it shows under every account. It's
+for one); a note describes the item, so it shows under every account.
-JSON so an editor plugin can read it with a built-in parser; several
+Several lazysecrets windows can save to it without losing each other's
-lazysecrets windows can save to it without losing each other's changes.
+changes. One written by a newer lazysecrets is read but not saved to,
 with a warning, until you update.
 Revealing, copying, opening in the browser, sharing and jumping to an item
 count as using it: its record keeps when it was last used and how often,
 for Recent (`R`). Records kept only for usage are dropped after 90 days
-unused, and beyond the 100 most recent. `history: false` stops counting.
+unused, and beyond the 100 most recent. `storage.history: false` stops counting.
 It also keeps where you left lazysecrets in each folder (the selected
 source, vault or secret), and goes back there the next time it starts in
@@ -114,24 +123,31 @@ What lazysecrets has loaded is kept in
 you: the Sources lists, vaults and scopes, and secrets' names and metadata
 (tags, dates, references), never values. On the next start they show at
 once, and anything older than two minutes reloads in the background when
-you go to it, or when Go to searches it. Revealing and copying always
+you go to it, or when Go to searches it. While it does, the pane's
-fetch the value live.
+bottom border says how old what it shows is (`cached 3h ago`). Revealing
 and copying always fetch the value live. [`lazysecrets list`](integration.md#listing-for-fzf-and-pickers)
 reads it and adds to it too.
 Lists not loaded for 30 days are dropped, and so is everything from an
 account you're no longer signed in to. Repos aren't cached: their files
 are read from disk anyway. Deleting the file is always safe, and
-`cache: false` stops using it.
+`storage.cache: false` stops using it.
 ## Updates
-Once a day (`updateCheck`), in the background, lazysecrets asks the
+At startup, in the background, lazysecrets asks for the latest release
-release server for the latest release; within the day it reuses the
+(`updates.autoCheck`), once a day or every `updates.autoCheckInterval`;
-answer from the state file. Offline, or with the server down, it says
+until then it reuses the answer from the state file. Releases are
-nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
+published on GitHub and on git.kebcloud.no, and it asks them in that
-`lazysecrets update --check`) shows its changelog.
+order, the next when one doesn't answer within 5 seconds;
 `updates.sources` lists others, such as a mirror of your own. Offline, or with
 every server down, it says nothing. A newer release shows in the status
 pane, `↑ v0.2.0`; `U` (or `lazysecrets update --check`) shows what
 changed since your version, across the last 10 releases.
 Updating (`u` there, or `lazysecrets update`) downloads the release for
-your OS and CPU, checks it against the release's `checksums.txt`, makes
+your OS and CPU from the first server that has it, checks it against
 that server's `checksums.txt`, makes
 sure it runs, and only then replaces the binary, atomically: a
 lazysecrets that's running keeps working, and the next start is the new
 version. A binary a package manager owns (Homebrew, Nix, a distro
@@ -13,6 +13,10 @@ Secrets in Azure Key Vault-backed scopes are read through Databricks; if
 Databricks refuses, lazysecrets reads the backing vault directly with your
 az login (which then needs the [Key Vault roles](azure.md#permissions)).
 When Databricks refuses, the pane says what to check: access to the
 workspace and READ on the scope, or, when the workspace's IP access list
 refused, the network you're on.
 Hide profiles you don't want in the [config](config.md):
 ```yaml
@@ -7,7 +7,12 @@ go test ./...
 go test ./internal/ui/app -run TestGolden -update   # after intentional UI changes
 ```
-A stripped binary is about 21 MB instead of 30 MB:
+In `--demo`, sharing env files works end to end: `S` → `f` on a demo
 repo, pick `kv-shared-prod / env-share` (the second account's) as the
 key, then paste the link back. The demo repos aren't on disk, so opening
 asks where to save, as for a repo you haven't cloned.
 A stripped binary is a third smaller:
 ```sh
 go build -trimpath -ldflags "-s -w" -o lazysecrets ./cmd/lazysecrets
@@ -17,7 +22,7 @@ Development builds show `dev-<commit>` as their version (`-dirty` with
 uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
 version they were built for.
-## Pull requests
+## How changes land
 Pull requests into `main` are squash-merged, so each is one commit titled
 like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)
@@ -30,10 +35,8 @@ subject, checked by `pr-title.yml`:
 | `fix` | a bug fix | Fixed |
 | `refactor`, `docs`, `test`, `ci`, `chore`, `build`, `style`, `revert` | everything users don't need to hear about | no |
-`feat!:` marks a breaking change, `feat(scope):` names a part. Brackets
+`feat!:` marks a breaking change, `feat(scope):` names a part.
-and a missing space work too: `[feat] x`, `[feat]: x` and `feat:x` all
+`[skip changelog]` in the description leaves a pull request out.
 become `feat: x` in the changelog. `[skip changelog]` in the description
 leaves a pull request out.
 CI (`ci.yml`) runs gofmt, vet, staticcheck, the tests and a build for each
 platform on pull requests into `main`. `main` is protected: a pull request
@@ -46,18 +49,26 @@ what its pull request tested, and CI doesn't run again there.
 Merge as many pull requests as you like, then release `main`:
 ```sh
-scripts/release.sh --dry-run v0.2.0   # the notes the release would have
+scripts/release.sh --dry-run minor    # the tag and notes the release would have
-scripts/release.sh v0.2.0             # CHANGELOG.md, commit, tag, push
+scripts/release.sh minor              # CHANGELOG.md, commit, tag, push
 ```
 `patch`, `minor` and `major` bump the latest release (`v0.2.1` → `v0.2.2`,
 `v0.3.0`, `v1.0.0`; pre-releases don't count); a tag (`v0.3.0`,
 `v0.3.0-rc.1`) is taken as it is.
 It refuses unless you're on a clean `main` that matches `origin/main`.
 [git-cliff](https://git-cliff.org) (`cliff.toml`) writes `CHANGELOG.md`
 from the pull request titles. The tag runs the release workflow
 (`.gitea/workflows/release.yml`): it tests, then
 [GoReleaser](https://goreleaser.com) (`.goreleaser.yaml`) builds the
 archives and publishes a Gitea release with them and the release's
-changelog section. `goreleaser release --snapshot --clean` builds the same
+changelog section. Then `scripts/github-release.mjs` copies that release,
-archives locally, into `dist/`, without publishing.
+notes and files, to the GitHub mirror, with the `GH_RELEASE_TOKEN`
 secret (a fine-grained token that can write the mirror's contents);
 without the secret it skips that. `goreleaser release --snapshot
 --clean` builds the same archives locally, into `dist/`, without
 publishing.
 A suffix (`v0.2.0-rc.1`) makes a pre-release, which leaves `CHANGELOG.md`
 alone.
@@ -0,0 +1,95 @@
 # Integration
 lazysecrets works outside its own window too: `lazysecrets get` reads a
 value for scripts, and `lazysecrets list` lists everything for fzf, editor
 pickers and your own tools. Both take the [links](sharing.md) lazysecrets
 copies and shares. For Neovim, there's
 [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim).
 ## Reading a value
 `lazysecrets get <link>` prints the value, for scripts and pipes:
 ```sh
 export DB_PASSWORD=$(lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password)
 lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password | kubectl create secret generic db --from-file=password=/dev/stdin
 ```
 It reads the value directly, with your az accounts (the one that last read
 it first), the Databricks profile for the workspace, or sops in your clone
 of the repo; a version in the link reads that version. `--account` tries
 that account first, as [`list`](#listing-for-fzf-and-pickers) prints it.
 The value ends with a newline only on a terminal. When it can't read the
 value, it says why on stderr and exits with status 1.
 ## Listing, for fzf and pickers
 `lazysecrets list` prints every source, vault and secret, one per line,
 tab-separated:
 | Field | |
 |---|---|
 | kind | `source`, `vault`, `secret`, `key` or `certificate` |
 | mark | ✗ when something's wrong (expired, or couldn't be read) or ⚠ when it expires soon; ★ when starred; ◷ when used lately (with `--recent`); and the provider's icon |
 | name | `platform-prod / kv-app-prod / db-password` |
 | status | why a vault or source couldn't be read, or that it has `expired` or `expires in 12d` (within `ui.expiryWarningDays`), or empty |
 | note | your note on it (`n` in lazysecrets), after a note icon (✎ without icons), or empty |
 | account | what it's listed through: `Azure` (`Azure:<user>/<tenant>` with several az accounts), `Databricks` or `Repos` |
 | link | its `lazysecrets://` link |
 What's cached prints at once, then what loads follows as it arrives: read
 it as a stream. Values are never listed. It stops quietly when the reader
 goes, like fzf after a pick. Kind stays the first field, and account and
 link the last two; new fields only ever go between. The mark has a field of
 its own so a search can leave it out: in fzf, `--nth` searches the name,
 so `^prod` finds names starting with prod.
 | Flag | |
 |---|---|
 | `--format json` | an object per line instead, for editor plugins (below) |
 | `--kind secret,vault` | only these kinds: `source`, `vault` (also scopes and repo files), `secret`, `key`, `certificate`; lists they don't need aren't loaded |
 | `--cached` | only what's cached, at once: nothing is loaded from Azure or Databricks |
 | `--max-age 2m` | load cached lists older than this again |
 | `--errors=false` | leave out the vaults and sources it couldn't read |
 | `--hidden` | list what's [hidden](repos.md#spring-boot-config) too, as `H` shows it (json: `"hidden": true`) |
 | `--color never` | no colours, for scripts |
 | `--icons=false` | no provider icons |
 | `--stars=false` | no ★ before starred names (in `favouriteColor`) |
 | `--notes=false` | no note icon before a note |
 | `--recent` | ◷ before names used lately, in `mutedColor`; default `ui.recentIcon` |
 | `--expiry=false` | no expiry: not in the status, and no ✗ or ⚠ for it |
 With `--format json`, each line is an object with these fields; new ones
 may be added:
 | Field | |
 |---|---|
 | `link`, `kind`, `account` | as above |
 | `error` | why it couldn't be read, only then |
 | `provider` | `azure`, `databricks` or `repo` |
 | `path` | the names: `["platform-prod", "kv-app-prod", "db-password"]` |
 | `accountLabel` | the account's short name, when several az accounts are signed in |
 | `starred` | starred for this account |
 | `note` | your note on it, if any |
 | `reference` | how config refers to a secret: `@Microsoft.KeyVault(SecretUri=…)` or `{{secrets/scope/key}}` (`Y` in lazysecrets) |
 | `url` | its web page, in the Azure portal or the Databricks workspace (`o` in lazysecrets) |
 | `recent` | used lately, as Recent (`R`) lists: in the last 90 days |
 | `lastUsed`, `uses` | when it was last used, and how often; only when `recent`, to sort by |
 | `expires` | when a secret, key or certificate expires, if it does (Azure) |
 | `enabled` | `false` for a disabled one; only where the provider says (Azure) |
 [`lazysecrets open --action go --account <account> <link>`](sharing.md#opening-a-link)
 opens one in lazysecrets without asking what to do or which account.
 ### An fzf picker
 ```sh
 lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1 \
  --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
  --bind 'ctrl-o:become(lazysecrets open --action go --account {-2} {-1})' \
  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {3})' \
  --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'
 ```
 ![fzf-example](assets/fzf-example.png)
@@ -13,12 +13,14 @@ The rule: a letter in the lists, ctrl+ that letter where you type a filter
 |---|---|
 | `j`/`k`, `↑`/`↓` | move |
 | `g`/`G` | top / bottom |
-| `tab`/`l`, `shift+tab`/`h` | next / previous pane |
+| `tab`, `shift+tab`/`h` | next / previous pane |
 | `l` | the details of what's selected, on the right (`h` goes back) |
 | `1`–`4` | jump to pane |
 | `enter` / `esc`, `⌫` | drill in / back (also clears a filter or leaves the versions view) |
 | `[` / `]` | previous / next tab of the focused pane: Sources and Favourites in Sources; Secrets, Keys, Certs in Secrets |
 | `/` | filter the focused list by name or note ([how it matches](#searching)); `enter` keeps it, `esc` clears it. While typing: `ctrl+j`/`ctrl+k` move, `ctrl+y` copies, `ctrl+r` reveals, `ctrl+f` stars |
 | `` ` `` | switch the Sources pane between grouped by provider and a flat list; `enter`/`space` on a provider folds it |
 | `H` | show / hide what's hidden: [Spring and compose keys](repos.md#spring-boot-config) that don't look secret, example files, and files and repos with only those; shown dimmed |
 | `r` | refresh the focused pane |
 | `q`, `ctrl+c` | quit |
@@ -48,19 +50,22 @@ match case exactly.
 | Key | Action |
 |---|---|
 | `space` | reveal / hide the selected value (public material for keys and certificates) |
-| `y` | copy the value without revealing it; cleared from the clipboard after 30s |
+| `y` | copy the value without revealing it. On an Azure account's row: its object ID; in its pane, the selected field |
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
-| `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
+| `e` | open the selected SOPS, `.env`, Spring or compose file, or a secret's file at its line ([how](repos.md#opening-files)) |
-| `s` / `S` | copy a [link](links.md) to the selected item / share menu |
+| `s` / `S` | copy a [link](sharing.md) to the selected item / share menu (also env files, [encrypted](sharing.md#sharing-env-files)) |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |
 | `L` | sign in again (shown when a login has expired) |
 | `U` | a newer lazysecrets: its changelog, and update in place (restart to use it); or look for one |
-A revealed value hides again after `revealTimeout` (60s) and when the
+A revealed value is shown as it reads best: JSON indented, and PEM
-terminal loses focus (`hideOnBlur`); see [config](config.md).
+certificates as their subject, issuer, dates, names and thumbprint, with
 any other PEM block (a private key) named but not shown. `y` still copies
 it exactly as stored. It hides again after a while, and when the terminal
 loses focus ([config](config.md)).
 ## Stars and notes
@@ -69,8 +74,7 @@ terminal loses focus (`hideOnBlur`); see [config](config.md).
 | `f` | star the selected source, vault or secret: it gets a ★ and sorts first in its list |
 | `n` | write a short note on it, shown dimmed on its row and in the detail pane |
-A star belongs to the account you starred the item under; a note shows
+Both are kept in the [state file](config.md#state).
 under every account. Both are kept in the [state file](config.md#state).
 ## Go to
@@ -78,20 +82,24 @@ under every account. Both are kept in the [state file](config.md#state).
 starred) and `R` on Recent (what you used last). `enter` goes to the
 selected item.
-Search has the scope on the left (All; all of Azure, Databricks or repos;
+Search has the scope on the left and what's in it on the right. The
-or one source; with `○ ◐ ●` for how much of it is loaded) and what's in
+scopes are All, then grouped like the Sources pane: each account (or
-it on the right. All repos searches every repo without asking Azure or
+Databricks, or Repos) with its sources under it, with `○ ◐ ●` for how
-Databricks for anything. It opens on the
+much of each is loaded. Repos searches every repo without asking Azure
-source you're in. Typing a search loads what it covers: everything on
+or Databricks for anything. Go to opens on All; `ctrl+s` again narrows
-All, else the source picked; results appear as lists arrive. That's once
+it to the source or group selected in the Sources pane, and once more
-each time Go to opens, and only what isn't loaded yet; `ctrl+a` loads
+goes back to All. Typing a search loads what it covers: everything on
-again, lists that failed included.
+All, else the account or source picked; results appear as lists
 arrive. That's once each time Go to opens, and only what isn't loaded
 yet; `ctrl+a` loads again, lists that failed included.
 Like a pane, Go to is either browsing or typing a filter:
 | Browsing | Typing | Action |
 |---|---|---|
 | `j`/`k` | `ctrl+j`/`ctrl+k` | move |
 | `g`/`G` | | top / bottom |
 | `ctrl+s` | `ctrl+s` | only the source or group you're in / All |
 | `h`/`l`, `tab` | `ctrl+h`/`ctrl+l`, `tab` | scope list / results |
 | `[` / `]` | | previous / next tab |
 | `f` | `ctrl+f` | star |
@@ -105,6 +113,26 @@ anything loads.
 ## Layout
 The pane on the right describes what's selected in the pane you're in: the
 account or subscription in Sources, the vault in Vaults, the secret in
 Secrets. Going into it (`l`, or `4`) keeps it on that; there `j`/`k`,
 `/` and `y` work on its rows, and `h` goes back. A value you reveal stays in view whichever pane you're in, until
 it's hidden.
 On top, the status pane (`0`) shows the version, a newer release and how
 your accounts are doing; `e` there opens your [config](config.md) in your
 editor, as in lazygit. Focused, the right pane lists more under the
 logo; `y` copies any row:
 - the version and updates (`U`)
 - each account (`L` on one that needs it signs in)
 - what's expiring (`enter` goes to it)
 - this session's errors, newest first (not kept after quitting)
 - the config, state and cache files (`e` opens one in your editor)
 - links to the docs, source, issues, releases and changelog (`o` opens one)
 - the changelog of every release up to yours, built in: `/` filters it
  (`/fixed`, `/search`)
 | Key | Action |
 |---|---|
 | `ctrl+←`/`ctrl+→` or `<`/`>` | move the divider between the left panes and the detail pane |
@@ -112,9 +140,8 @@ anything loads.
 | `+` / `_` | zoom the focused pane: normal → half → full screen, and back |
 | `=` | reset the layout (divider, heights, zoom) |
-The divider and pane heights are remembered (zoom isn't). macOS uses
+The divider and pane heights are remembered (zoom isn't). `<>{}` are for
-ctrl+arrows for Mission Control and switching desktops by default, hence
+macOS, where ctrl+arrows switch desktops.
 the `<` `>` `{` `}` alternatives.
 ## Rebinding keys
@@ -1,118 +0,0 @@
 # Links
 Every subscription, workspace, vault, scope, repo, file and secret has a
 `lazysecrets://` link. Share one in chat or a ticket, and whoever opens it
 lands on that item, reading it with their own account and permissions:
 links carry names, never values.
 ```
 lazysecrets://azure/kv-app-prod.vault.azure.net                              vault
 lazysecrets://azure/kv-app-prod.vault.azure.net/keys                         vault, Keys tab
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password          secret
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password/91d3e0   one version
 lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app/storage-key
 lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 ```
 ## Sharing
 `s` copies a link to the selected item (from the versions view, pinned to
 that version). `S` opens the share menu:
 - secrets: the link (`o`), the plain Key Vault URL (`u`), the config
  reference (`y`) or the web page (`b`)
 - vaults and scopes: a link (`o`), a link that opens on the current tab
  (`t`), the plain vault URL (`u`) or the web page (`b`)
 - subscriptions and workspaces: a link (`o`) or the web page (`b`)
 ## Opening
 - Paste it into lazysecrets, or press `ctrl+o`, which reads the clipboard
  and fills in any reference it finds there. Key Vault URLs,
  `@Microsoft.KeyVault(...)` and `{{secrets/scope/key}}` work too.
 - `lazysecrets <link>` (or `lazysecrets open <link>`) in a terminal.
 - Click it anywhere, once the [link handler](#from-the-browser-and-chat) is
  set up.
 If you copy a `lazysecrets://` link elsewhere and switch back, lazysecrets
 offers to open it, once per link. It looks at the clipboard at startup,
 when the terminal regains focus (in tmux: `set -g focus-events on`) and,
 for terminals that don't report focus, on a key press at most every 3
 seconds. It keeps nothing but `lazysecrets://` links, doesn't offer a link
 to what's already selected (like one you just copied with `s`), and can't
 read the clipboard over SSH.
 lazysecrets finds the vault in your accounts (one Resource Graph query per
 account) and jumps to it, asking which account to use when several can see
 it. Links say what, not what to do: opening a link to a secret asks whether
 to just go to it, also copy or show its value, or (`y`) copy its value
 without going there.
 ## In scripts
 `lazysecrets get <link>` prints the value, for scripts and pipes:
 ```sh
 export DB_PASSWORD=$(lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password)
 lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password | kubectl create secret generic db --from-file=password=/dev/stdin
 ```
 It reads the value directly, with your az accounts (the one that last read
 it first), the Databricks profile for the workspace, or sops in your clone
 of the repo; a version in the link reads that version. The value ends with
 a newline only on a terminal.
 ## From the browser and chat
 ```sh
 lazysecrets handler install     # run it in the terminal links should open in
 lazysecrets handler uninstall
 ```
 Use an installed binary (`go run`'s is temporary). lazysecrets offers to do
 this at startup when links don't open it (or open a lazysecrets that no
 longer exists): set it up, not now, or don't ask again, which is
 remembered in the state file. `linkHandler.prompt: false` in the config
 turns the question off too.
 `handler install` registers `lazysecrets://` with the system: clicking a
 link then opens a new window of the terminal you ran it in, with
 lazysecrets on that link. It recognises kitty, Ghostty, WezTerm, iTerm2,
 Terminal.app, Alacritty, GNOME Terminal, Konsole and foot, also inside
 tmux; `--terminal NAME` picks another. It records your `PATH` and config
 locations, since apps start without your shell's environment (and so
 without `az`): run it again after moving lazysecrets or changing those.
 - macOS: a small background app, `~/Applications/Lazysecrets Links.app`
 - Linux: a desktop entry claiming `x-scheme-handler/lazysecrets`, set as
  the default with `xdg-mime` (desktops following freedesktop.org)
 - Windows: not yet
 The config can override the terminal, or run any other:
 ```yaml
 linkHandler:
  terminal: ghostty                          # instead of the one install detected
  command: [foot, --title, secrets, "{cmd}"] # any terminal; {cmd} is the lazysecrets command
  reuse: true                                # hand links to a running lazysecrets first
  prompt: true                               # offer to set up the handler at startup
 ```
 ### Where a clicked link opens
 - **In a terminal** (a link in a terminal app): a lazysecrets that
  terminal shows (or whose tmux session one of its tmux clients can switch
  to) gets it, never one elsewhere; otherwise a new window opens.
 - **Anywhere else** (Slack, a browser): the lazysecrets you used last (key
  press or focus), preferring one already on screen; a tmux client is
  switched to its session if needed, its terminal comes to the front, and
  a hidden dropdown terminal (kitty's quick access terminal) is shown.
  With none running, a new window opens.
 The link is then offered as if pasted. `linkHandler.reuse: false` always
 opens a new window.
 Running instances listen on a socket in `$XDG_RUNTIME_DIR/lazysecrets`, or
 `run/` in the state directory, readable only by you. A link from a web page
 can only make lazysecrets go somewhere: it asks before copying or showing
 anything.
@@ -1,16 +1,18 @@
-# SOPS and .env files in git repos
+# SOPS, .env, Spring and compose files in git repos
 lazysecrets shows git repositories under **Repos**: their
 [SOPS](https://github.com/getsops/sops)-encrypted files (YAML, JSON,
-`.env`, INI) and plain env files as vaults, and the keys in them
+`.env`, INI), plain env files, [Spring Boot config](#spring-boot-config)
-(`db.password`, `list[0]`) as secrets.
+and [Docker Compose files](#docker-compose) as vaults, and the keys in them (`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
 escaped, `app\.name`, so it doesn't read as nesting.
 ## Which repos
-**Repos** lists every repo with secret files under the `roots` (`~/git`
+**Repos** lists every repo with secret files under the `roots` (by
-by default; one or two levels down, `repo` or `org/repo`), any listed in
+default whichever of `~/git`, `~/repo`, `~/repos`, `~/projects`, `~/code`,
-`paths`, and any you starred something in (the repo, a file or a key),
+`~/source` and `~/src` exist; one or two levels down, `repo` or
-wherever it is. They're checked in the background.
+`org/repo`), any listed in `paths`, and any you starred something in
 (the repo, a file or a key), wherever it is. They're checked in the background.
 Started inside a repo, that repo gets a row of its own at the top,
 `Repo · <name>`, and lazysecrets opens on it, with the files under the
@@ -27,8 +29,9 @@ anything by hand.
 ## Which files
 **Env files**: `.env`, `.env.local`, `prod.env` and the like, also when
-git-ignored (as they usually are), in the folders git tracks files in;
+git-ignored (as they usually are), in the folders git tracks files in.
-not `.env.example`, `.sample`, `.template` and the like. They're read
+`.env.example`, `.sample`, `.template` and the like are listed hidden
 (`H` shows them): someone may have put a real value in one. They're read
 directly; a file with SOPS metadata is always treated as SOPS, whatever
 its name.
@@ -44,24 +47,125 @@ Folders of dependencies and caches are never looked in, tracked or not:
 3. where the repo's `.sops.yaml` `creation_rules` say SOPS files go,
 4. the whole repo.
-`include`/`exclude` apply to env files too.
+`include`/`exclude` apply to env, Spring and compose files too.
 ```yaml
 providers:
  repos:
-    roots: [~/git]                             # folders of repos (the default; [] turns it off)
+    roots: [~/git]                             # folders of repos (replaces the defaults; [] turns it off)
    paths: [~/work/infra]                      # single repos elsewhere
    include: ["secrets/**", "**/*.sops.yaml"]  # globs from the repo root; ** for any depth
    exclude: ["**/testdata/**"]
 ```
 A repo's `.lazysecrets.yaml` can also name the secret its env files are
 [shared](sharing.md#sharing-env-files) with:
 ```yaml
 sharing:
  key: https://kv-team.vault.azure.net/secrets/env-share   # or its lazysecrets:// link
 ```
 ## Spring Boot config
 `application.yml`, `application-prod.properties`, `bootstrap.yaml` and the
 like, tracked by git (not those in a Helm chart's `templates/`). Most of
 their keys aren't secret, so only those that look like one are listed; the
 rest are hidden:
 - **keys** named like a secret: ending in `password`, `pwd`, `secret`,
  `token`, `key`, `credentials`, `salt`, `connection-string` and the
  like (`spring.datasource.password`, `client-secret`, `checkoutKey`),
 - **values** that look like one: Jasypt's `ENC(...)`, a URL with a
  password (`jdbc:postgresql://app:pw@db/app`), or a connection string
  with `AccountKey=`, `SharedAccessKey=` or `Password=`.
 A file with none is hidden too, and a repo with only such files. `H` shows
 what's hidden, dimmed, in the panes and in Go to (`lazysecrets list
 --hidden` lists it); a pane's counter says how many it hides. A file's
 details count its hidden keys, and `e` opens it whole. A `${DB_PASSWORD}`
 value is marked as a reference: the secret is set elsewhere. A tracked
 file is marked in red only when a listed key has its value in plain text.
 The patterns are regexps, for all of a repo's config files and per type of
 file; each list replaces the one it falls back to, and `keys: [".*"]`
 lists every key:
 ```yaml
 providers:
  repos:
    secretPatterns:                             # all config files
      keys: ["(?i)(password|secret|token|key)$"]  # matched against the key's name
      values: ["^ENC\\(.+\\)$"]                   # and against its value
    spring:
      secretPatterns:                           # Spring's: only what differs
        keys: ["(?i)(password|secret)$", "bearer$"]
    compose:
      secretPatterns:                           # and compose's
        values: []
 ```
 A repo's `.lazysecrets.yaml` can set them too, the same way
 (`secretPatterns:`, `spring: secretPatterns:`, `compose:
 secretPatterns:`), for everyone. Each list
 comes from the first that sets it: the repo's for the type, the repo's,
 the config's for the type, the config's, the defaults.
 Keys are named as Spring names them, `spring.datasource.password`; in a
 file with several documents (`---`, or `#---` in `.properties`), a later
 document's keys get its profile, `spring.datasource.password (prod)`.
 Values Maven fills in at build time (`@project.version@`) are read as
 they are.
 ## Docker Compose
 `compose.yaml`, `docker-compose.yml` and their variants
 (`docker-compose.test.yml`), tracked by git; `docker-compose.example.yml`
 and the like are hidden. Their secrets are the services' `environment`
 variables, as a map (`DB_PASSWORD: x`) or a list (`- DB_PASSWORD=x`),
 named `service.VAR` (`api.DB_PASSWORD`); a `<<: *anchor` shared between
 services is read too. The same [secret patterns](#spring-boot-config)
 pick them, the rest hidden, with `compose: secretPatterns:` for compose
 files' own.
 `${DB_PASSWORD}`, `$DB_PASSWORD` and `${DB_PASSWORD:?…}`, and a variable
 without a value (`DB_PASSWORD:`, `- DB_PASSWORD`), taken from where
 compose runs, are marked as references; `${DB_PASSWORD:-x}` has its
 default in the file.
 ## Decrypting
-Listing never decrypts: SOPS encrypts values only, so keys and metadata
+Listing never decrypts: SOPS and Jasypt encrypt values only, so keys and
-(encryption, last modified) are read straight from the files. Revealing,
+metadata (encryption, last modified) are read straight from the files.
-copying or `lazysecrets get` decrypts one value with your `sops` binary, so
+Revealing, copying or `lazysecrets get` decrypts one value; SOPS's with
-whatever sops uses works (age keys, Azure Key Vault through az, AWS/GCP
+your `sops` binary, so whatever sops uses works (age keys, Azure Key Vault
-KMS, PGP). When sops can't decrypt, its whole error message is shown.
+through az, AWS/GCP KMS, PGP). When sops can't decrypt, its whole error
 message is shown.
 On a file, the right pane shows how it's encrypted and the keys it's
 encrypted for (public: age recipients, Key Vault keys, KMS ARNs, PGP
 fingerprints), when it was last encrypted, and what git knows of it:
 tracked, ignored or neither, and its last commit. A plain `.env` file that
 git tracks, or that isn't ignored, is marked in red: its values are in the
 repo's history, or easily could be.
 ### Jasypt
 A value like `ENC(...)` in a plain `.env`, Spring or compose file is
 [Jasypt](http://www.jasypt.org)'s, decrypted when it's revealed or copied
 with jasypt-spring-boot's default algorithm (3.0+:
 `PBEWITHHMACSHA512ANDAES_256`). The password is, as in Spring:
 1. `$JASYPT_ENCRYPTOR_PASSWORD`,
 2. the file's own: `jasypt.encryptor.password` in a Spring file, the
   service's `JASYPT_ENCRYPTOR_PASSWORD` in a compose file,
   `JASYPT_ENCRYPTOR_PASSWORD` in a `.env`; a `${VAR}` in it (with a
   default: `${VAR:default}` in Spring, `${VAR:-default}` elsewhere) is
   read from the environment.
 Environment variables are lazysecrets' own: a link opened from the browser
 starts it without your shell's. A `.env` whose values are all Jasypt's
 isn't marked in red.
 ## Opening files
@@ -83,11 +187,5 @@ sops 3.8 or later.
 ## Links
-Links name the repo by its git remote, so they open in a colleague's clone
+Repo links name the repo by its git remote, so they open in a colleague's
-wherever it is:
+clone wherever it is ([sharing](sharing.md)).
 ```
 lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 ```
 See [links](links.md).
@@ -0,0 +1,186 @@
 # Sharing
 Subscriptions, workspaces, vaults, scopes, repos, files and secrets are
 shared as a `lazysecrets://` link, in chat or a ticket. Whoever opens
 it lands on that item, reading it with their own account and
 permissions: the link names the item, never its value. Env files can
 also be [shared encrypted](#sharing-env-files), in the link itself.
 ```
 lazysecrets://azure/subscriptions/<subscription-id>                          subscription
 lazysecrets://azure/kv-app-prod.vault.azure.net                              vault
 lazysecrets://azure/kv-app-prod.vault.azure.net/keys                         vault, Keys tab
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password          secret
 lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password/91d3e0   one version
 lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net         workspace
 lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app     scope
 lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app/storage-key
 lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 ```
 ## Sharing a link
 `s` copies a link to the selected item (from the versions view, pinned to
 that version). `S` opens the share menu:
 - secrets: the link (`o`), the plain Key Vault URL (`u`), the config
  reference (`y`) or the web page (`b`); in an env file, also the file as
  an [encrypted link](#sharing-env-files) (`f`)
 - vaults and scopes: a link (`o`), a link that opens on the current tab
  (`t`), the plain vault URL (`u`) or the web page (`b`)
 - subscriptions and workspaces: a link (`o`) or the web page (`b`)
 - repos and env files: also their env files as an
  [encrypted link](#sharing-env-files) (`f`)
 ## Sharing env files
 `.env` files usually live only on your machine. `S` → `f` shares them as
 an encrypted link, on a repo (all its plain env files), an env file, or a
 key in one (its file):
 ```
 lazysecrets://share/AQ…
 ```
 The files are encrypted with a secret's value, so whoever can read that
 secret (in Key Vault, Databricks or a repo's SOPS file) can open the link,
 and nobody else: who may open it is up to the vault's access, as for
 everything else. Make a secret for it once, random:
 ```sh
 az keyvault secret set --vault-name kv-team --name env-share --value "$(openssl rand -base64 32)"
 ```
 and name it in the repo's `.lazysecrets.yaml` (committed: the whole team
 uses it) or your config (for repos that don't name one), by its
 `lazysecrets://` link, Key Vault URL or `@Microsoft.KeyVault(...)`
 reference:
 ```yaml
 sharing:
  key: https://kv-team.vault.azure.net/secrets/env-share
 ```
 With neither, sharing asks which secret, in [Go to](keys.md#go-to): it
 lists only secrets, and `enter` picks one (pasting a reference picks it
 too).
 Anyone with a link can try to guess the key, so sharing refuses one that
 isn't long and varied enough, saying how (never showing it). By default
 that's 32 characters of two kinds; your config can ask for more, or less:
 ```yaml
 sharing:
  keyRules:
    minLength: 32    # characters; 16 at least
    minClasses: 2    # kinds of character: lowercase, uppercase, digits, symbols
 ```
 Opening a link doesn't check them.
 On the command line, `lazysecrets share [--key <secret>] <env file>...`
 prints the link.
 Opening a share link says which repo it's from, how many files and which
 secret it's encrypted with, and decrypts only when asked: lazysecrets
 reads the secret with your access, then shows where each file goes in
 your clone of the repo (or asks for a folder, if it isn't here), which
 ones would replace a file there and which ones git doesn't ignore. It
 saves them all, only the new ones, or none. New files are readable by you
 only.
 A link holds the files' paths and contents encrypted ([age](https://age-encryption.org),
 the secret's value as passphrase); the repo, the secret and the number of
 files are in the clear. Links stay under 16 KB, which fits chat and
 tickets.
 A link stays readable as long as its secret is. On Azure it's pinned to
 the secret's version, so adding a new version (rotating) doesn't break
 old links, and disabling the old version, or taking away someone's
 access, shuts them out; Databricks secrets have no versions, so changing
 the value breaks every old link. Whoever has read the secret's value
 before can decrypt links made with it without asking the vault, so rotate
 it now and then: new links use the newest version.
 ## Opening a link
 - Paste it into lazysecrets, or press `ctrl+o`, which reads the clipboard
  and fills in any reference it finds there. Key Vault URLs, Azure portal
  links, `@Microsoft.KeyVault(...)` and `{{secrets/scope/key}}` work too.
 - `lazysecrets <link>` (or `lazysecrets open <link>`) in a terminal.
 - Click it anywhere, once the [link handler](#from-the-browser-and-chat) is
  set up.
 If you copy a `lazysecrets://` link elsewhere and switch back, lazysecrets
 offers to open it, once per link. It looks at the clipboard at startup,
 when the terminal regains focus (in tmux: `set -g focus-events on`) and,
 for terminals that don't report focus, on a key press at most every 3
 seconds. It keeps nothing but `lazysecrets://` links, doesn't offer a link
 to what's already selected (like one you just copied with `s`), and can't
 read the clipboard over SSH.
 lazysecrets finds the vault in your accounts (one Resource Graph query per
 account) and jumps to it, asking which account to use when several can see
 it, ending on a secret's details as `enter` on it would. Links say what,
 not what to do: opening a link to a secret asks whether to just go to it,
 also copy or show its value, or (`y`) copy its value without going there.
 `lazysecrets open --action go|copy|show <link>` does one without asking
 and ends in the list, like Go to,
 and `--account <account>` picks the account (as [`list`](integration.md#listing-for-fzf-and-pickers)
 prints it) when several can see it.
 ## From the browser and chat
 ```sh
 lazysecrets handler install     # run it in the terminal links should open in
 lazysecrets handler uninstall
 ```
 Use an installed binary (`go run`'s is temporary). lazysecrets offers to do
 this at startup when links don't open it (or open a lazysecrets that no
 longer exists): set it up, not now, or don't ask again, which is
 remembered in the state file. `linkHandler.prompt: false` in the config
 turns the question off too.
 `handler install` registers `lazysecrets://` with the system: clicking a
 link then opens a new window of the terminal you ran it in, with
 lazysecrets on that link. It recognises kitty, Ghostty, WezTerm, iTerm2,
 Terminal.app, Alacritty, GNOME Terminal, Konsole and foot, also inside
 tmux; `--terminal NAME` picks another. It records your `PATH`, config
 locations and XDG directories, since apps start without your shell's
 environment (and so without `az`): run it again after moving lazysecrets
 or changing those.
 - macOS: a small background app, `~/Applications/Lazysecrets Links.app`
 - Linux: a desktop entry claiming `x-scheme-handler/lazysecrets`, set as
  the default with `xdg-mime` (desktops following freedesktop.org)
 - Windows: not yet
 The config can override the terminal, or run any other:
 ```yaml
 linkHandler:
  terminal: ghostty                          # instead of the one install detected
  command: [foot, --title, secrets, "{cmd}"] # any terminal; {cmd} is the lazysecrets command
  reuse: true                                # hand links to a running lazysecrets first
  prompt: true                               # offer to set up the handler at startup
 ```
 ### Where a clicked link opens
 - **In a terminal** (a link in a terminal app): a lazysecrets that
  terminal shows (or whose tmux session one of its tmux clients can switch
  to) gets it, never one elsewhere; otherwise a new window opens.
 - **Anywhere else** (Slack, a browser): the lazysecrets you used last (key
  press or focus), preferring one already on screen; a tmux client is
  switched to its session if needed, its terminal comes to the front, and
  a hidden dropdown terminal (kitty's quick access terminal) is shown.
  With none running, a new window opens.
 The link is then offered as if pasted. `linkHandler.reuse: false` always
 opens a new window.
 Running instances listen on a socket in `$XDG_RUNTIME_DIR/lazysecrets`, or
 `run/` in the state directory, readable only by you. A link from a web page
 can only make lazysecrets go somewhere: it asks before copying or showing
 anything.
@@ -1,41 +1,43 @@
 module git.kebcloud.no/keb/lazysecrets
-go 1.26.4
+go 1.27.2
 require (
 	charm.land/bubbles/v2 v2.2.1
-	charm.land/bubbletea/v2 v2.0.10
+	charm.land/bubbletea/v2 v2.1.0
 	charm.land/lipgloss/v2 v2.0.6
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1
+	filippo.io/age v1.3.2
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault v1.5.0
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2 v2.1.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph v0.10.0
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions v1.3.0
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions/v2 v2.0.0
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.5.0
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.5.0
 	github.com/atotto/clipboard v0.1.4
-	github.com/charmbracelet/x/ansi v0.11.8
+	github.com/charmbracelet/x/ansi v0.11.9
 	github.com/charmbracelet/x/exp/golden v0.0.0-20251109135125-8916d276318f
-	github.com/databricks/databricks-sdk-go v0.187.0
+	github.com/databricks/databricks-sdk-go v0.188.0
-	github.com/junegunn/fzf v0.74.4
+	github.com/junegunn/fzf v0.74.5
 	go.yaml.in/yaml/v3 v3.0.5
-	golang.org/x/mod v0.38.0
+	golang.org/x/mod v0.42.0
-	golang.org/x/term v0.45.0
+	golang.org/x/term v0.47.0
-	gopkg.in/ini.v1 v1.67.0
+	gopkg.in/ini.v1 v1.67.3
 )
 require (
-	cloud.google.com/go/auth v0.4.2 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
+	filippo.io/hpke v0.4.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect
 	github.com/aymanbagabas/go-udiff v0.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20261008173134-6b8d4baf91b4 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
@@ -45,37 +47,35 @@ require (
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
 	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/mattn/go-runewidth v0.0.27 // indirect
+	github.com/mattn/go-runewidth v0.0.30 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/xo/terminfo v1.0.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.39.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.39.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
-	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
-	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/api v0.182.0 // indirect
+	google.golang.org/api v0.264.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )
@@ -1,36 +1,41 @@
 c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d h1:Blprhc2SbChNZtWcU+BLTM4YdoqYAS9V7cJgOwJKyAs=
 c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
 charm.land/bubbles/v2 v2.2.1 h1:Fq1+qm5hV6GkvzLQDhCBpXXE5tLgvh1PRriCLwSvIQU=
 charm.land/bubbles/v2 v2.2.1/go.mod h1:wdMgn+sje1KNXdwFizIWjbf328fIUBxqEmJ/vYPo8yc=
-charm.land/bubbletea/v2 v2.0.10 h1:oolvo20VBpI0PfqE7iFjkZ1bx0WpmXGfnKz5Yldjq5o=
+charm.land/bubbletea/v2 v2.1.0 h1:A9fj9h5LFrvQhQHFNggp8K8rvY6CUfgn9dMbb6p2HIw=
-charm.land/bubbletea/v2 v2.0.10/go.mod h1:QOatcnhOjYIfxzUSTz6raF7Ex4R/rIuHa3SnBdCCpMc=
+charm.land/bubbletea/v2 v2.1.0/go.mod h1:xWHeyxIX9/wiFU2kgPW04ojOZyTzrWf+8lGjUCaftiU=
 charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
 charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.4.2 h1:sb0eyLkhRtpq5jA+a8KWw0W70YcdVca7KJ8TM0AFYDg=
+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
-cloud.google.com/go/auth v0.4.2/go.mod h1:Kqvlz1cf1sNA0D+sYJnkPQOP+JMHkuHeIgVmCRtZOLc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
-cloud.google.com/go/auth/oauth2adapt v0.2.2 h1:+TTV8aXpjeChS9M+aTtN/TjdQnzJvmzKFt//oWu7HX4=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/auth/oauth2adapt v0.2.2/go.mod h1:wcYjgpZI9+Yu7LyYBg4pqSiaRkfEK3GQcpb7C/uyF1Q=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 h1:zvXfGJCWvywnCA814d8ZiVyt+fm9nnTE8xSb99zRyfo=
+filippo.io/age v1.3.2 h1:r6RSZLFSMm6rzKepZ7ZAYkKCu14f3/Me8c7uKYh7C8c=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1/go.mod h1:iptorS+VYKFL2N6PnebpS91dubG35eAOEERnT4PJbQU=
+filippo.io/age v1.3.2/go.mod h1:TH/Yr2sSRhCKbaH4XPxpUV0Us8Gv6txYUpiZQWz8Evk=
 filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=
 filippo.io/hpke v0.4.0/go.mod h1:EmAN849/P3qdeK+PCMkDpDm83vRHM5cDipBJ8xbQLVY=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 h1:qgnWTiWs1G7AqcKZegFvkJD1bmXJcaDU3uC0ELSgZ5U=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3/go.mod h1:XtxD48QPInqoj+GMlcRlXHEYsoOxFnP6w2JgIZ9rDS4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1/go.mod h1:oXtinPO4OLj9d1DOTrqrL1oRwGhcqadvAmrl6wTeGlk=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 h1:Terj1CMW4+NY5CpWjSRkqLoxh2DkYDdv/FH2z0897Uc=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0/go.mod h1:7Ut2Qw9vcwpLW5Q4MBy43uSxXS7tK2yjs94OJ6j5thE=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0 h1:PTFGRSlMKCQelWwxUyYVEUqseBJVemLyqWJjvMyt0do=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.2.0 h1:+lnLQhKh3cgSOIOVH61UZ3s/l9d+bAZp5d/spt1+7UI=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0/go.mod h1:LRr2FzBTQlONPPa5HREE5+RjSCTXl7BwOvYOaWTqCaI=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.2.0/go.mod h1:tStOHrivWUrcBolspvKV70Us1ckESYGYSHdG4LX8zyY=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0 h1:2qsIIvxVT+uE6yrNldntJKlLRgxGbZ85kgtz5SNBhMw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2 v2.1.0 h1:4dT2wTR+ViaGvwcAoMjqt0BvgwBkT6nXxg8flJhnLfw=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0/go.mod h1:AW8VEadnhw9xox+VaVd9sP7NjzOAnaZBLRH6Tq3cJ38=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2 v2.1.0/go.mod h1:7fgu6AtY2gkWhtZt9SEHK/MkTVUn2HPvAZjv6XsrjuI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault v1.5.0 h1:nnQ9vXH039UrEFxi08pPuZBE7VfqSJt343uJLw0rhWI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault v1.5.0/go.mod h1:4YIVtzMFVsPwBvitCDX7J9sqthSj43QD1sP6fYc1egc=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph v0.10.0 h1:+1fJwTilk/X7inNqwREnYEOgFCdg8ut7GULxARDbu34=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph v0.10.0/go.mod h1:EGwSLlGqrrfYQhtCi9JcIkPQKl9WxsL6ZPJd+63Vy1A=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armdeployments v1.0.0 h1:67nFqWXpo0x5Nz0XEb1yI7s8D+EHy8NsTinYw9sZnLk=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armdeployments v1.0.0/go.mod h1:fewgRjNVE84QVVh798sIMFb7gPXPp7NmnekGnboSnXk=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions v1.3.0 h1:wxQx2Bt4xzPIKvW59WQf1tJNx/ZZKPfN+EhPX3Z6CYY=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources/v3 v3.0.1 h1:guyQA4b8XB2sbJZXzUnOF9mn0WDBv/ZT7me9wTipKtE=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions v1.3.0/go.mod h1:TpiwjwnW/khS0LKs4vW5UmmT9OWcxaveS8U7+tlknzo=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources/v3 v3.0.1/go.mod h1:8h8yhzh9o+0HeSIhUxYny+rEQajScrfIpNktvgYG3Q8=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions/v2 v2.0.0 h1:TPaLKUUZw3XUaQy5aU+ApHXFKB2VnTWUA0xufkvFDE8=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions/v2 v2.0.0/go.mod h1:Rn/a97OKDAoOGvk5/OFjqObHHqWyoMMVSGtikqbKcAg=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.5.0 h1:15MiSirdxWpIKFEHwfwfMWYieETCUnPTERPIlnytQeo=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.5.0/go.mod h1:0AAf/fHAqhIsvD6XGKlCsDO8u+cCiYBBuro+lWS6os4=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 h1:MaKvxE6D0KkjOg6Wd9M00iqP5PR0kUxCfiezes4JweM=
@@ -43,20 +48,18 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJ
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 h1:Nljr4q1GRA/5vCrMONS+g4u4LRHNgOXVSh3O43J2CnI=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
+github.com/charmbracelet/ultraviolet v0.0.0-20261008173134-6b8d4baf91b4 h1:hISLzUbwcvJbGoNR6A3L/TpguRRnACBmZOee8LcHLJw=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/ultraviolet v0.0.0-20261008173134-6b8d4baf91b4/go.mod h1:aJDVk+WOVM1K04rdc/71PMPoUGfjxjhvXfP3Pjz1Zio=
-github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.9 h1:kIrqLBxtTVbLyyHO2Evoi93EjQo1mylWmpNEsfPxXAM=
-github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
+github.com/charmbracelet/x/ansi v0.11.9/go.mod h1:DG/hpOnaI2QJ/KMMqLL2h0KVhluuJLazf8973P+Vy5w=
 github.com/charmbracelet/x/exp/golden v0.0.0-20251109135125-8916d276318f h1:8CnFOYzrMArVN42jYaGvnBo3mxdONgt09fly+9B96GY=
 github.com/charmbracelet/x/exp/golden v0.0.0-20251109135125-8916d276318f/go.mod h1:V8n/g3qVKNxr2FR37Y+otCsMySvZr601T0C7coEP0bw=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
@@ -65,20 +68,14 @@ github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8
 github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
 github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM=
 github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/databricks/databricks-sdk-go v0.188.0 h1:1nxBqlctGnPzlReyziG199abHs9cR/KNjsCnSM+oDGA=
-github.com/databricks/databricks-sdk-go v0.187.0 h1:V1rGbEUaEdGS7tTZSyplDLnE2Vp5N1aIPiIh/LzjOC8=
+github.com/databricks/databricks-sdk-go v0.188.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
 github.com/databricks/databricks-sdk-go v0.187.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -88,44 +85,23 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
-github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
-github.com/googleapis/gax-go/v2 v2.12.4 h1:9gWcmF85Wvq4ryPFvGFaOgPIs1AQX0d0bcbGw4Z96qg=
+github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
-github.com/googleapis/gax-go/v2 v2.12.4/go.mod h1:KYEYLorsnIGDi/rPC8b5TdlB9kbKoFubselGIoBMCwI=
+github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
-github.com/junegunn/fzf v0.74.4 h1:DSqIW3ZxtkuuPzeLKrVnHdoWqT9VCIGRbjc/lXiGCso=
+github.com/junegunn/fzf v0.74.5 h1:mpJlCdgGuddKerHrdjvV3cnezEBgyjZAVn8KCo/4OMc=
-github.com/junegunn/fzf v0.74.4/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
+github.com/junegunn/fzf v0.74.5/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741 h1:7dYDtfMDfKzjT+DVfIS4iqknSEKtZpEcXtu6vuaasHs=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741/go.mod h1:6EILKtGpo5t+KLb85LNZLAF6P9LKp78hJI80PXMcn3c=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
@@ -136,128 +112,79 @@ github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBql
 github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
-github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
+github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk=
-github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-runewidth v0.0.30/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 h1:4Pp6oUg3+e/6M4C0A/3kJ2VYa++dsWVTtGgLVj5xtHg=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0/go.mod h1:Mjt1i1INqiaoZOMGR1RIUJN+i3ChKoFRqzrRQhlkbs0=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
 golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.182.0 h1:if5fPvudRQ78GeRx3RayIoiuV7modtErPIZC/T2bIvE=
+google.golang.org/api v0.264.0 h1:+Fo3DQXBK8gLdf8rFZ3uLu39JpOnhvzJrLMQSoSYZJM=
-google.golang.org/api v0.182.0/go.mod h1:cGhjy4caqA5yXRzEhkHI8Y9mfyC2VLTlER2l08xaqtM=
+google.golang.org/api v0.264.0/go.mod h1:fAU1xtNNisHgOF5JooAs8rRaTkl2rT3uaoNGo9NS3R8=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
 google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
 google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=
-gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -7,10 +7,12 @@
 #
 # LAZYSECRETS_INSTALL_DIR installs somewhere else. macOS and Linux, arm64
 # and x86_64.
 #
 # Releases are on GitHub and git.kebcloud.no, tried in that order;
 # LAZYSECRETS_RELEASES (repository addresses, space-separated) uses others.
 set -eu
-repo=https://git.kebcloud.no/keb/lazysecrets
+repos="${LAZYSECRETS_RELEASES:-https://github.com/karleinarb/lazysecrets https://git.kebcloud.no/keb/lazysecrets}"
 api=https://git.kebcloud.no/api/v1/repos/keb/lazysecrets
 dir="${LAZYSECRETS_INSTALL_DIR:-$HOME/.local/bin}"
 fail() {
@@ -18,12 +20,13 @@ fail() {
 	exit 1
 }
 # Short timeouts, so a server that's down leaves time for the next.
 if command -v curl >/dev/null 2>&1; then
-	fetch() { curl -fsSL "$1"; }
+	fetch() { curl -fsSL --connect-timeout 5 --max-time 15 "$1"; }
-	download() { curl -fsSL -o "$2" "$1"; }
+	download() { curl -fsSL --connect-timeout 5 -o "$2" "$1"; }
 elif command -v wget >/dev/null 2>&1; then
-	fetch() { wget -qO- "$1"; }
+	fetch() { wget -qO- -T 15 "$1"; }
-	download() { wget -qO "$2" "$1"; }
+	download() { wget -qO "$2" -T 30 "$1"; }
 else
 	fail "needs curl or wget"
 fi
@@ -39,11 +42,26 @@ arm64 | aarch64) arch=arm64 ;;
 *) fail "no release for $(uname -m)" ;;
 esac
 # api is a repository's API: GitHub's, or Gitea's (and Forgejo's).
 api() {
 	case "$1" in
 	https://github.com/*) echo "https://api.github.com/repos/${1#https://github.com/}" ;;
 	*)
 		host=${1#*://}
 		host=${host%%/*}
 		echo "${1%%://*}://$host/api/v1/repos/${1#*://"$host"/}"
 		;;
 	esac
 }
 tag="${1:-}"
 if [ -z "$tag" ]; then
-	tag=$(fetch "$api/releases/latest" | sed -n 's/.*"tag_name":"\([^"]*\)".*/\1/p') ||
+	for repo in $repos; do
-		fail "couldn't look up the latest release"
+		tag=$(fetch "$(api "$repo")/releases/latest" 2>/dev/null |
-	[ -n "$tag" ] || fail "couldn't look up the latest release"
+			sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' | head -n 1) || tag=
 		[ -n "$tag" ] && break
 	done
 	[ -n "$tag" ] || fail "couldn't look up the latest release on $repos"
 fi
 case "$tag" in
 v*) ;;
@@ -55,11 +73,19 @@ name="lazysecrets_${version}_${os}_${arch}"
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
-echo "Downloading lazysecrets $tag for $os/$arch"
+# The archive and its checksums.txt from the first server that has both.
-download "$repo/releases/download/$tag/$name.tar.gz" "$tmp/$name.tar.gz" ||
+from=
-	fail "couldn't download $tag for $os/$arch: see $repo/releases"
+for repo in $repos; do
-download "$repo/releases/download/$tag/checksums.txt" "$tmp/checksums.txt" ||
+	base="$repo/releases/download/$tag"
-	fail "couldn't download $tag's checksums.txt"
+	if download "$base/checksums.txt" "$tmp/checksums.txt" 2>/dev/null; then
 		echo "Downloading lazysecrets $tag for $os/$arch from $repo"
 		if download "$base/$name.tar.gz" "$tmp/$name.tar.gz"; then
 			from=$repo
 			break
 		fi
 	fi
 done
 [ -n "$from" ] || fail "couldn't download $tag for $os/$arch from $repos"
 want=$(awk -v f="$name.tar.gz" '$2 == f { print $1 }' "$tmp/checksums.txt")
 [ -n "$want" ] || fail "$name.tar.gz isn't in checksums.txt"
@@ -0,0 +1,172 @@
 // Package cachefile is the cache of what lazysecrets has loaded
 // (cache.json): the Sources lists, vaults, secrets' metadata and where
 // the cursor was in each, never values. The TUI and lazysecrets list
 // both read it and save to it; a save merges with what's on disk, so
 // neither undoes what the other loaded.
 package cachefile
 import (
 	"encoding/json"
 	"maps"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // Version is the file's format; a file of another version is ignored,
 // and replaced on the next save.
 const Version = 1
 // MaxAge drops what hasn't been loaded again for this long.
 const MaxAge = 30 * 24 * time.Hour
 // File is the cache. Every key starts with the provider ID: Sources are
 // keyed by it, the rest by Row, Objects' keys and the like.
 type File struct {
 	Version    int                                      `json:"version"`
 	Sources    map[string]Stamped[[]provider.Source]    `json:"sources,omitempty"` // by provider ID
 	Containers map[string]Stamped[[]provider.Container] `json:"containers,omitempty"`
 	Objects    map[string]Stamped[[]provider.Object]    `json:"objects,omitempty"`
 	Details    map[string]Stamped[provider.Object]      `json:"details,omitempty"`
 	Cursor     map[string]string                        `json:"cursor,omitempty"`
 	// Dropped are keys deleted since the file was read (a list that
 	// failed to load): Save deletes them from the file too, rather than
 	// merging the old entry back. Not saved.
 	Dropped map[string]bool `json:"-"`
 }
 // Stamped is a list or detail with when it was loaded.
 type Stamped[T any] struct {
 	At    time.Time `json:"at"`
 	Value T         `json:"value"`
 }
 // New is an empty cache.
 func New() File {
 	return File{
 		Version:    Version,
 		Sources:    map[string]Stamped[[]provider.Source]{},
 		Containers: map[string]Stamped[[]provider.Container]{},
 		Objects:    map[string]Stamped[[]provider.Object]{},
 		Details:    map[string]Stamped[provider.Object]{},
 		Cursor:     map[string]string{},
 	}
 }
 // Row keys a source's vaults or scopes.
 func Row(providerID, sourceID string) string { return providerID + "|" + sourceID }
 // ContainerKey keys what's cached about a vault or scope.
 func ContainerKey(c provider.Container) string { return c.Source.Provider + "|" + c.ID }
 // ObjectsKey keys a vault's secrets, keys or certificates.
 func ObjectsKey(c provider.Container, t provider.ObjectType) string {
 	return ContainerKey(c) + "|" + string(t)
 }
 // ProviderOf is the provider ID a key starts with.
 func ProviderOf(key string) string {
 	id, _, _ := strings.Cut(key, "|")
 	return id
 }
 // Keep is Save's keep for these providers: their lists are kept, but not
 // repos', whose files are read from disk anyway, nor other accounts'.
 func Keep(providers []provider.Provider) func(providerID string) bool {
 	keep := map[string]bool{}
 	for _, p := range providers {
 		keep[p.ID()] = p.Kind() != provider.KindRepo
 	}
 	return func(id string) bool { return keep[id] }
 }
 // Read reads path; a missing, unreadable or other version's file is an
 // empty cache.
 func Read(path string) File {
 	f := New()
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return f
 	}
 	var d File
 	if json.Unmarshal(b, &d) != nil || d.Version != Version {
 		return f
 	}
 	maps.Copy(f.Sources, d.Sources)
 	maps.Copy(f.Containers, d.Containers)
 	maps.Copy(f.Objects, d.Objects)
 	maps.Copy(f.Details, d.Details)
 	maps.Copy(f.Cursor, d.Cursor)
 	return f
 }
 // Save writes f to path, merged with the file there: of a list in both,
 // the one loaded last wins, and f's cursors win (a nil Cursor keeps the
 // file's). Entries older than MaxAge, those of providers keep says no to
 // (accounts signed out of), and f.Dropped are dropped, from the file's
 // side as well. Saves from several lazysecrets take turns (a lock file),
 // so none undoes another's.
 func Save(path string, f File, keep func(providerID string) bool, now time.Time) error {
 	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
 		return err
 	}
 	unlock, err := lock(path + ".lock")
 	if err != nil {
 		return err
 	}
 	defer unlock()
 	out := New()
 	ok := func(key string, at time.Time) bool { return keep(ProviderOf(key)) && now.Sub(at) < MaxAge }
 	disk := Read(path)
 	merge(out.Sources, disk.Sources, f.Sources, ok, f.Dropped)
 	merge(out.Containers, disk.Containers, f.Containers, ok, f.Dropped)
 	merge(out.Objects, disk.Objects, f.Objects, ok, f.Dropped)
 	merge(out.Details, disk.Details, f.Details, ok, f.Dropped)
 	for _, m := range []map[string]string{disk.Cursor, f.Cursor} {
 		for k, v := range m {
 			if keep(ProviderOf(k)) {
 				out.Cursor[k] = v
 			}
 		}
 	}
 	return write(path, out)
 }
 // merge puts disk's entries in out, but not those dropped, then ours
 // where they're newer.
 func merge[T any](out, disk, ours map[string]Stamped[T], ok func(string, time.Time) bool, dropped map[string]bool) {
 	for k, e := range disk {
 		if ok(k, e.At) && !dropped[k] {
 			out[k] = e
 		}
 	}
 	for k, e := range ours {
 		if old, seen := out[k]; ok(k, e.At) && (!seen || !e.At.Before(old.At)) {
 			out[k] = e
 		}
 	}
 }
 // write writes f atomically, readable by the user only.
 func write(path string, f File) error {
 	b, err := json.Marshal(f)
 	if err != nil {
 		return err
 	}
 	tmp, err := os.CreateTemp(filepath.Dir(path), ".cache-*.json")
 	if err != nil {
 		return err
 	}
 	defer os.Remove(tmp.Name()) // after a successful rename, nothing there
 	if _, err := tmp.Write(b); err != nil {
 		tmp.Close()
 		return err
 	}
 	if err := tmp.Close(); err != nil {
 		return err
 	}
 	return os.Rename(tmp.Name(), path)
 }
@@ -0,0 +1,122 @@
 package cachefile
 import (
 	"path/filepath"
 	"testing"
 	"time"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 func list(at time.Time, names ...string) Stamped[[]provider.Container] {
 	var cs []provider.Container
 	for _, n := range names {
 		cs = append(cs, provider.Container{Name: n})
 	}
 	return Stamped[[]provider.Container]{At: at, Value: cs}
 }
 func TestSaveMerges(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "cache.json")
 	now := time.Now()
 	all := func(string) bool { return true }
 	// The TUI saved two lists.
 	tui := New()
 	tui.Containers["az|a"] = list(now.Add(-time.Hour), "kv-a-old")
 	tui.Containers["az|b"] = list(now.Add(-time.Minute), "kv-b")
 	tui.Cursor["az|b"] = "kv-b"
 	if err := Save(path, tui, all, now); err != nil {
 		t.Fatal(err)
 	}
 	// lazysecrets list loads a again, and c.
 	listed := Read(path)
 	listed.Containers["az|a"] = list(now, "kv-a-new")
 	listed.Containers["az|c"] = list(now, "kv-c")
 	if err := Save(path, listed, all, now); err != nil {
 		t.Fatal(err)
 	}
 	// The TUI saves what it has, older: list's lists stay.
 	if err := Save(path, tui, all, now); err != nil {
 		t.Fatal(err)
 	}
 	f := Read(path)
 	for key, want := range map[string]string{"az|a": "kv-a-new", "az|b": "kv-b", "az|c": "kv-c"} {
 		if got := f.Containers[key].Value; len(got) != 1 || got[0].Name != want {
 			t.Errorf("%s = %v, want %s", key, got, want)
 		}
 	}
 	if f.Cursor["az|b"] != "kv-b" {
 		t.Error("cursor lost")
 	}
 }
 func TestSaveDrops(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "cache.json")
 	now := time.Now()
 	f := New()
 	f.Containers["az|old"] = list(now.Add(-MaxAge-time.Hour), "kv-old")
 	f.Containers["gone|x"] = list(now, "kv-gone")
 	f.Containers["az|x"] = list(now, "kv-x")
 	if err := Save(path, f, func(id string) bool { return true }, now); err != nil {
 		t.Fatal(err)
 	}
 	// Signed out of "gone" since: dropped from the file too.
 	if err := Save(path, New(), func(id string) bool { return id == "az" }, now); err != nil {
 		t.Fatal(err)
 	}
 	got := Read(path).Containers
 	if _, ok := got["az|old"]; ok {
 		t.Error("kept a list older than MaxAge")
 	}
 	if _, ok := got["gone|x"]; ok {
 		t.Error("kept a signed-out account's list")
 	}
 	if _, ok := got["az|x"]; !ok {
 		t.Error("dropped a list on disk the save didn't have")
 	}
 }
 func TestReadOtherVersion(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "cache.json")
 	f := New()
 	f.Version = Version + 1
 	f.Containers["az|x"] = list(time.Now(), "kv-x")
 	if err := write(path, f); err != nil {
 		t.Fatal(err)
 	}
 	if got := Read(path); len(got.Containers) != 0 || got.Version != Version {
 		t.Errorf("read another version's file: %+v", got)
 	}
 }
 func TestSaveDroppedAndCursors(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "cache.json")
 	now := time.Now()
 	all := func(string) bool { return true }
 	f := New()
 	f.Containers["az|bad"] = list(now, "kv-old")
 	f.Cursor["az|x"] = "kv-tui"
 	if err := Save(path, f, all, now); err != nil {
 		t.Fatal(err)
 	}
 	// The TUI fails to load it again and drops it: it stays gone.
 	f = New()
 	f.Dropped = map[string]bool{"az|bad": true}
 	if err := Save(path, f, all, now); err != nil {
 		t.Fatal(err)
 	}
 	if _, ok := Read(path).Containers["az|bad"]; ok {
 		t.Error("a dropped list came back")
 	}
 	// lazysecrets list saves without cursors: the TUI's stay.
 	listed := New()
 	listed.Cursor = nil
 	listed.Containers["az|y"] = list(now, "kv-y")
 	if err := Save(path, listed, all, now); err != nil {
 		t.Fatal(err)
 	}
 	if Read(path).Cursor["az|x"] != "kv-tui" {
 		t.Error("the TUI's cursor was lost")
 	}
 }
@@ -0,0 +1,7 @@
 //go:build !unix
 package cachefile
 // lock does nothing here: saves can then race, losing lists that load
 // again.
 func lock(string) (func(), error) { return func() {}, nil }
@@ -0,0 +1,25 @@
 //go:build unix
 package cachefile
 import (
 	"os"
 	"syscall"
 )
 // lock takes path as a lock file, waiting while another lazysecrets has
 // it, and returns how to let go.
 func lock(path string) (unlock func(), err error) {
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
 	if err != nil {
 		return nil, err
 	}
 	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
 		f.Close()
 		return nil, err
 	}
 	return func() {
 		_ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
 		f.Close()
 	}, nil
 }
@@ -42,9 +42,6 @@ func New() Clipboard {
 	}
 }
 // Native reports whether the system clipboard is used rather than OSC52.
 func (c Clipboard) Native() bool { return c.native }
 // Write puts s on the clipboard.
 func (c Clipboard) Write(s string) tea.Cmd {
 	if !c.native {
@@ -16,6 +16,7 @@
 package commands
 import (
 	"cmp"
 	"fmt"
 	"regexp"
 	"strings"
@@ -60,10 +61,7 @@ var envName = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
 // Validate checks a command from the config.
 func (c Command) Validate() error {
-	name := c.Description
+	name := cmp.Or(c.Description, c.Command)
 	if name == "" {
 		name = c.Command
 	}
 	switch {
 	case c.Command == "":
 		return fmt.Errorf("custom command %q has no command", c.Description)
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
 	"maps"
 	"os"
 	"path/filepath"
 	"strings"
@@ -14,41 +15,24 @@ import (
 	"go.yaml.in/yaml/v3"
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
 	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 type Config struct {
-	Icons          *bool          `yaml:"icons"`
+	UI UI `yaml:"ui"`
-	ClipboardClear *time.Duration `yaml:"clipboardClear"`
+	// Values keeps revealed and copied values from lingering.
-	// RevealTimeout hides a revealed value after this long; 0s never.
+	Values Values `yaml:"values"`
-	// Defaults to 60s.
+	// Storage is what's kept between runs.
-	RevealTimeout *time.Duration `yaml:"revealTimeout"`
+	Storage Storage `yaml:"storage"`
-	// ExpiryWarningDays marks secrets, keys and certificates expiring
+	// Updates sets how lazysecrets looks for newer releases.
-	// within this many days; 0 marks only expired ones. Defaults to 30.
+	Updates   Updates   `yaml:"updates"`
-	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
+	Providers Providers `yaml:"providers"`
 	// HideOnBlur hides a revealed value when the terminal loses focus.
 	// Defaults to true.
 	HideOnBlur *bool         `yaml:"hideOnBlur"`
 	Timeout    time.Duration `yaml:"timeout"`
 	// LoadDelay is how long the cursor must rest on a row before its
 	// contents load; 0s loads at once. Defaults to 150ms.
 	LoadDelay *time.Duration `yaml:"loadDelay"`
 	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
 	SourcesView string `yaml:"sourcesView"`
 	// History counts uses of items for the Recent list; defaults to true.
 	History *bool `yaml:"history"`
 	// UpdateCheck looks for a newer release once a day, in the
 	// background; defaults to true. U and lazysecrets update work either
 	// way.
 	UpdateCheck *bool `yaml:"updateCheck"`
 	// Cache keeps what was loaded (never values) between runs, so lists
 	// show at once and refresh in the background; defaults to true.
 	Cache *bool `yaml:"cache"`
 	// CollapseGroups starts the Sources pane with its groups folded;
 	// defaults to true.
 	CollapseGroups *bool     `yaml:"collapseGroups"`
 	Providers      Providers `yaml:"providers"`
 	// LinkHandler sets how lazysecrets:// links open; see linkhandler.
 	LinkHandler LinkHandler `yaml:"linkHandler"`
 	// Sharing sets how env files are shared; see package share.
 	Sharing Sharing `yaml:"sharing"`
 	// CustomCommands run shell commands on the selected item; see
 	// package commands.
 	CustomCommands []commands.Command `yaml:"customCommands"`
@@ -60,6 +44,56 @@ type Config struct {
 	Theme map[string][]string `yaml:"theme"`
 }
 type UI struct {
 	Icons *bool `yaml:"icons"`
 	// RecentIcon marks items used lately (Recent, R) with ◷, in the lists
 	// and in lazysecrets list. Defaults to false.
 	RecentIcon *bool `yaml:"recentIcon"`
 	// SourcesView is "grouped" (default) or "flat"; the backtick key
 	// toggles it.
 	SourcesView string `yaml:"sourcesView"`
 	// CollapseGroups starts the Sources pane with its groups folded;
 	// defaults to true.
 	CollapseGroups *bool `yaml:"collapseGroups"`
 	// LoadDelay is how long the cursor must rest on a row before its
 	// contents load; 0s loads at once. Defaults to 150ms.
 	LoadDelay *time.Duration `yaml:"loadDelay"`
 	// ExpiryWarningDays marks secrets, keys and certificates expiring
 	// within this many days; 0 marks only expired ones. Defaults to 30.
 	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
 }
 type Values struct {
 	// RevealTimeout hides a revealed value after this long; 0s never.
 	// Defaults to 60s.
 	RevealTimeout *time.Duration `yaml:"revealTimeout"`
 	// HideOnBlur hides a revealed value when the terminal loses focus.
 	// Defaults to true.
 	HideOnBlur     *bool          `yaml:"hideOnBlur"`
 	ClipboardClear *time.Duration `yaml:"clipboardClear"`
 }
 type Storage struct {
 	// Cache keeps what was loaded (never values) between runs, so lists
 	// show at once and refresh in the background; defaults to true.
 	Cache *bool `yaml:"cache"`
 	// History counts uses of items for the Recent list; defaults to true.
 	History *bool `yaml:"history"`
 }
 type Updates struct {
 	// AutoCheck looks for a newer release in the background at startup,
 	// at most once per AutoCheckInterval; defaults to true. U and
 	// lazysecrets update work either way.
 	AutoCheck *bool `yaml:"autoCheck"`
 	// AutoCheckInterval defaults to 24h.
 	AutoCheckInterval *time.Duration `yaml:"autoCheckInterval"`
 	// Sources are the repositories updates come from, tried in
 	// order: on GitHub, or a Gitea or Forgejo server. Defaults to GitHub,
 	// then git.kebcloud.no (update.DefaultServers).
 	Sources []string `yaml:"sources"`
 }
 type LinkHandler struct {
 	// Terminal to open links in, overriding the one handler install
 	// detected: kitty, ghostty, wezterm, iterm2, terminal, alacritty,
@@ -77,30 +111,59 @@ type LinkHandler struct {
 	Prompt *bool `yaml:"prompt"`
 }
 type Sharing struct {
 	// Key is the secret whose value encrypts shared files (its
 	// lazysecrets:// link, Key Vault URL or reference), for repos whose
 	// .lazysecrets.yaml doesn't name one.
 	Key string `yaml:"key"`
 	// KeyRules are what a key's value must be to share with it.
 	KeyRules KeyRules `yaml:"keyRules"`
 }
 // KeyRules default to 32 characters of 2 kinds (share.DefaultRules).
 type KeyRules struct {
 	MinLength int `yaml:"minLength"` // at least 16
 	// MinClasses is how many kinds of character: lowercase, uppercase,
 	// digits, symbols.
 	MinClasses int `yaml:"minClasses"`
 }
 type Providers struct {
-	Azure      Azure      `yaml:"azure"`
+	// Timeout bounds each backend request; defaults to 30s. Each
-	Databricks Databricks `yaml:"databricks"`
+	// provider's own timeout overrides it for that provider.
-	Repos      Repos      `yaml:"repos"`
+	Timeout    time.Duration `yaml:"timeout"`
 	Azure      Azure         `yaml:"azure"`
 	Databricks Databricks    `yaml:"databricks"`
 	Repos      Repos         `yaml:"repos"`
 }
 // Repos are git repositories' secret files (SOPS, .env). Inside a repo,
 // that repo is the only one shown; elsewhere, the ones in Paths and under
 // Roots.
 type Repos struct {
 	// Timeout overrides providers.timeout for these requests.
 	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool    `yaml:"enabled"`
 	Paths   []string `yaml:"paths"`
-	// Roots are folders of repos. Defaults to ~/git; an empty list
+	// Roots are folders of repos. Defaults to repo.DefaultRoots (~/git,
-	// turns it off.
+	// ~/src, ~/code and the like); an empty list turns it off.
 	Roots *[]string `yaml:"roots"`
 	// Include and Exclude are globs relative to a repo's root (** for any
 	// depth), for repos without their own .lazysecrets.yaml. Without them,
 	// a repo's .sops.yaml creation_rules say where to look.
 	Include []string `yaml:"include"`
 	Exclude []string `yaml:"exclude"`
 	// SecretPatterns say which keys of config files are secrets; Spring
 	// and Compose override them for their files, list by list.
 	SecretPatterns repo.SecretPatterns `yaml:"secretPatterns"`
 	Spring         repo.FileType       `yaml:"spring"`
 	Compose        repo.FileType       `yaml:"compose"`
 }
 type Azure struct {
 	// Timeout overrides providers.timeout for these requests.
 	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool `yaml:"enabled"`
 	// HideSubscriptions lists subscriptions to leave out, by name or ID.
@@ -111,6 +174,8 @@ type Azure struct {
 }
 type Databricks struct {
 	// Timeout overrides providers.timeout for these requests.
 	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled      *bool    `yaml:"enabled"`
 	HideProfiles []string `yaml:"hideProfiles"`
@@ -146,17 +211,12 @@ func xdgDir(env, fallback string) (string, error) {
 	return filepath.Join(base, "lazysecrets"), nil
 }
 // Load reads path. A missing file is an empty config. Unknown keys are an
 // error, so typos don't silently do nothing.
 func Load(path string) (Config, error) {
 	return LoadAll([]string{path})
 }
 // LoadAll reads several config files in order, each on top of the ones
 // before, like lazygit's LG_CONFIG_FILE: a later file overrides the
 // settings it sets, and theme roles merge one by one. That lets an editor
 // plugin add a generated theme file to the user's own config. Missing
-// files are skipped.
+// files are skipped. Unknown keys are an error, so typos don't silently do
 // nothing.
 func LoadAll(paths []string) (Config, error) {
 	var c Config
 	keybinding := map[string]map[string][]string{}
@@ -171,9 +231,7 @@ func LoadAll(paths []string) (Config, error) {
 			if keybinding[ctx] == nil {
 				keybinding[ctx] = map[string][]string{}
 			}
-			for name, keys := range actions {
+			maps.Copy(keybinding[ctx], actions)
 				keybinding[ctx][name] = keys
 			}
 		}
 	}
 	c.Keybinding = keybinding
@@ -197,19 +255,53 @@ func decodeInto(c *Config, path string) error {
 }
 func (c Config) validate(path string) error {
-	if v := c.SourcesView; v != "" && v != "grouped" && v != "flat" {
+	if v := c.UI.SourcesView; v != "" && v != "grouped" && v != "flat" {
-		return fmt.Errorf("%s: sourcesView: %q is not grouped or flat", path, v)
+		return fmt.Errorf("%s: ui.sourcesView: %q is not grouped or flat", path, v)
 	}
 	for _, cmd := range c.CustomCommands {
 		if err := cmd.Validate(); err != nil {
 			return fmt.Errorf("%s: %w", path, err)
 		}
 	}
-	if d := c.ExpiryWarningDays; d != nil && *d < 0 {
+	if d := c.UI.ExpiryWarningDays; d != nil && *d < 0 {
-		return fmt.Errorf("%s: expiryWarningDays: %d is negative", path, *d)
+		return fmt.Errorf("%s: ui.expiryWarningDays: %d is negative", path, *d)
 	}
-	if d := c.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
+	if d := c.UI.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
-		return fmt.Errorf("%s: loadDelay: %s is not between 0s and 5s", path, *d)
+		return fmt.Errorf("%s: ui.loadDelay: %s is not between 0s and 5s", path, *d)
 	}
 	if d := c.Updates.AutoCheckInterval; d != nil && *d <= 0 {
 		return fmt.Errorf("%s: updates.autoCheckInterval: %s is not positive (autoCheck: false turns it off)", path, *d)
 	}
 	for i, r := range c.Updates.Sources {
 		if _, err := update.API(r); err != nil || !strings.HasPrefix(r, "https://") {
 			return fmt.Errorf("%s: updates.sources[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
 		}
 	}
 	if k := c.Sharing.Key; k != "" {
 		if _, err := share.ParseKey(k); err != nil {
 			return fmt.Errorf("%s: sharing.key: %w", path, err)
 		}
 	}
 	if n := c.Sharing.KeyRules.MinLength; n != 0 && n < 16 {
 		return fmt.Errorf("%s: sharing.keyRules.minLength: %d is under 16", path, n)
 	}
 	if n := c.Sharing.KeyRules.MinClasses; n < 0 || n > 4 {
 		return fmt.Errorf("%s: sharing.keyRules.minClasses: %d is not between 1 and 4", path, n)
 	}
 	for name, d := range map[string]time.Duration{
 		"providers.timeout":            c.Providers.Timeout,
 		"providers.azure.timeout":      c.Providers.Azure.Timeout,
 		"providers.databricks.timeout": c.Providers.Databricks.Timeout,
 		"providers.repos.timeout":      c.Providers.Repos.Timeout,
 	} {
 		if d < 0 {
 			return fmt.Errorf("%s: %s: %s is negative", path, name, d)
 		}
 	}
 	if err := errors.Join(c.Providers.Repos.SecretPatterns.Check("providers.repos.secretPatterns"),
 		c.Providers.Repos.Spring.SecretPatterns.Check("providers.repos.spring.secretPatterns"),
 		c.Providers.Repos.Compose.SecretPatterns.Check("providers.repos.compose.secretPatterns")); err != nil {
 		return fmt.Errorf("%s: %w", path, err)
 	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {
@@ -18,29 +18,34 @@ func write(t *testing.T, content string) string {
 }
 func TestLoad(t *testing.T) {
-	c, err := Load(write(t, `
+	c, err := LoadAll([]string{write(t, `
-icons: false
+ui:
-sourcesView: flat
+  icons: false
-clipboardClear: 45s
+  sourcesView: flat
-timeout: 1m
+values:
  clipboardClear: 45s
 storage:
  history: false
 providers:
  timeout: 1m
  azure:
    timeout: 2m
    hideSubscriptions: [platform-mgmt]
    vaults:
      - https://kv-foo.vault.azure.net/
  databricks:
    enabled: false
    hideProfiles: [test]
-`))
+`)})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || c.ClipboardClear == nil || *c.ClipboardClear != 45*time.Second ||
+	if c.UI.Icons == nil || *c.UI.Icons || c.Values.ClipboardClear == nil || *c.Values.ClipboardClear != 45*time.Second ||
-		c.Timeout != time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
+		c.Providers.Timeout != time.Minute || c.Providers.Azure.Timeout != 2*time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
 		t.Errorf("config = %+v", c)
 	}
-	if c.SourcesView != "flat" {
+	if c.UI.SourcesView != "flat" || On(c.Storage.History) || !On(c.Storage.Cache) {
-		t.Errorf("sourcesView = %q", c.SourcesView)
+		t.Errorf("ui = %+v, storage = %+v", c.UI, c.Storage)
 	}
 	if !On(c.Providers.Azure.Enabled) || On(c.Providers.Databricks.Enabled) {
 		t.Error("enabled flags wrong")
@@ -56,8 +61,8 @@ func TestLoadMissingAndEmpty(t *testing.T) {
 		"missing": filepath.Join(t.TempDir(), "nope.yaml"),
 		"empty":   write(t, ""),
 	} {
-		c, err := Load(path)
+		c, err := LoadAll([]string{path})
-		if err != nil || c.Icons != nil || c.ClipboardClear != nil {
+		if err != nil || c.UI.Icons != nil || c.Values.ClipboardClear != nil {
 			t.Errorf("%s: %+v, %v", name, c, err)
 		}
 	}
@@ -68,10 +73,21 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"typo":       "icon: true\n",
 		"bad vault":  "providers:\n  azure:\n    vaults: [kv-foo]\n",
 		"old layout": "azure:\n  vaults: [https://kv.vault.azure.net/]\n",
-		"duration":   "timeout: soon\n",
+		"flat keys":  "icons: false\n",
-		"view":       "sourcesView: tree\n",
+		"duration":   "providers:\n  timeout: soon\n",
 		"negative":   "providers:\n  repos:\n    timeout: -1s\n",
 		"view":       "ui:\n  sourcesView: tree\n",
 		"sources":    "updates:\n  sources: [git.example.com/team/lazysecrets]\n",
 		"http":       "updates:\n  sources: [http://git.example.com/team/lazysecrets]\n",
 		"interval":   "updates:\n  autoCheckInterval: 0s\n",
 		"share key":  "sharing:\n  key: https://kv.vault.azure.net/\n",
 		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
 		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
 		"regexp":     "providers:\n  repos:\n    secretPatterns:\n      keys: [\"(pass\"]\n",
 		"spring re":  "providers:\n  repos:\n    spring:\n      secretPatterns:\n        values: [\"(\"]\n",
 	} {
-		if _, err := Load(write(t, content)); err == nil {
+		if _, err := LoadAll([]string{write(t, content)}); err == nil {
 			t.Errorf("%s: no error", name)
 		} else if !strings.Contains(err.Error(), "config.yaml") {
 			t.Errorf("%s: error doesn't name the file: %v", name, err)
@@ -81,7 +97,8 @@ func TestLoadRejectsMistakes(t *testing.T) {
 func TestLoadAllLayers(t *testing.T) {
 	user := write(t, `
-icons: false
+ui:
  icons: false
 theme:
  azureColor: [blue]
  errorColor: [red, bold]
@@ -90,6 +107,8 @@ providers:
    hideSubscriptions: [a]
 `)
 	theme := write(t, `
 ui:
  sourcesView: flat
 theme:
  azureColor: ["#82aaff"]
  activeBorderColor: ["#ff966c", bold]
@@ -98,7 +117,8 @@ theme:
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || len(c.Providers.Azure.HideSubscriptions) != 1 {
+	// A group set in both files merges: icons from one, sourcesView the other.
 	if c.UI.Icons == nil || *c.UI.Icons || c.UI.SourcesView != "flat" || len(c.Providers.Azure.HideSubscriptions) != 1 {
 		t.Errorf("user settings lost: %+v", c)
 	}
 	want := map[string][]string{
@@ -113,12 +133,19 @@ theme:
 	}
 }
-func TestLoadDelay(t *testing.T) {
+func TestUpdates(t *testing.T) {
-	c, err := Load(write(t, "loadDelay: 300ms\n"))
+	c, err := LoadAll([]string{write(t, "updates:\n  autoCheck: false\n  autoCheckInterval: 168h\n  sources: [https://git.example.com/team/lazysecrets]\n")})
-	if err != nil || c.LoadDelay == nil || *c.LoadDelay != 300*time.Millisecond {
+	if err != nil || On(c.Updates.AutoCheck) || *c.Updates.AutoCheckInterval != 7*24*time.Hour || len(c.Updates.Sources) != 1 {
-		t.Errorf("loadDelay = %v, %v", c.LoadDelay, err)
+		t.Errorf("updates = %+v, %v", c.Updates, err)
 	}
-	if _, err := Load(write(t, "loadDelay: 1m\n")); err == nil {
+}
 func TestLoadDelay(t *testing.T) {
 	c, err := LoadAll([]string{write(t, "ui:\n  loadDelay: 300ms\n")})
 	if err != nil || c.UI.LoadDelay == nil || *c.UI.LoadDelay != 300*time.Millisecond {
 		t.Errorf("loadDelay = %v, %v", c.UI.LoadDelay, err)
 	}
 	if _, err := LoadAll([]string{write(t, "ui:\n  loadDelay: 1m\n")}); err == nil {
 		t.Error("a minute's delay accepted")
 	}
 }
@@ -0,0 +1,41 @@
 // Package expiry says whether a secret, key or certificate has expired
 // or will soon, and how long it has left, the same way everywhere: the
 // TUI's lists and status pane, and lazysecrets list.
 package expiry
 import (
 	"fmt"
 	"time"
 )
 type State int
 const (
 	None    State = iota // no expiry, or not within the warning period
 	Soon                 // within the warning period
 	Expired              // already
 )
 // Of tells whether something expiring at expires (zero: never) has
 // expired by now or will within warn, and how long it has left.
 func Of(expires, now time.Time, warn time.Duration) (State, time.Duration) {
 	if expires.IsZero() {
 		return None, 0
 	}
 	left := expires.Sub(now)
 	switch {
 	case left <= 0:
 		return Expired, 0
 	case left <= warn:
 		return Soon, left
 	}
 	return None, left
 }
 // Left is a short "12d", or "5h" on the last day.
 func Left(d time.Duration) string {
 	if d < 24*time.Hour {
 		return fmt.Sprintf("%dh", max(1, int(d.Hours())))
 	}
 	return fmt.Sprintf("%dd", int(d.Hours()/24))
 }
@@ -0,0 +1,27 @@
 package expiry
 import (
 	"testing"
 	"time"
 )
 func TestOf(t *testing.T) {
 	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
 	warn := 30 * 24 * time.Hour
 	for _, c := range []struct {
 		expires time.Time
 		want    State
 		left    string
 	}{
 		{time.Time{}, None, ""},
 		{now.Add(-time.Hour), Expired, ""},
 		{now.Add(12*24*time.Hour + time.Hour), Soon, "12d"},
 		{now.Add(5 * time.Hour), Soon, "5h"},
 		{now.Add(60 * 24 * time.Hour), None, ""},
 	} {
 		state, left := Of(c.expires, now, warn)
 		if state != c.want || (c.left != "" && Left(left) != c.left) {
 			t.Errorf("%v: %v %s, want %v %s", c.expires, state, Left(left), c.want, c.left)
 		}
 	}
 }
@@ -9,7 +9,6 @@
 package instance
 import (
 	"bufio"
 	"context"
 	"encoding/json"
 	"errors"
@@ -36,15 +35,18 @@ func Dir(stateDir string) string {
 type Status struct {
 	PID        int       `json:"pid"`
 	LastActive time.Time `json:"lastActive"` // last key press or focus
-	// Reach is how readily it can be shown: 2 in view (outside tmux, or
+	Reach      int       `json:"reach"`      // how readily it can be shown: unreachable, switchable or inView
 	// in a tmux session a client shows), 1 in a tmux session that a tmux
 	// client can be switched to, 0 not at all.
 	Reach int `json:"reach"`
 	// App is the terminal app it would show in (macOS), preferring the
 	// app the link was clicked in.
 	App string `json:"app,omitempty"`
 }
 const (
 	unreachable = 0
 	switchable  = 1 // in a tmux session that a tmux client can be switched to
 	inView      = 2 // outside tmux, or in a tmux session a client shows
 )
 type request struct {
 	Op    string `json:"op"` // "status" or "open"
 	Link  string `json:"link,omitempty"`
@@ -114,7 +116,7 @@ func (s *Server) handle(c net.Conn) {
 	defer c.Close()
 	_ = c.SetDeadline(time.Now().Add(5 * time.Second))
 	var req request
-	if err := json.NewDecoder(bufio.NewReader(c)).Decode(&req); err != nil {
+	if err := json.NewDecoder(c).Decode(&req); err != nil {
 		return
 	}
 	var resp response
@@ -188,7 +190,7 @@ func Best(found []Found, front string, terminal bool) (Found, bool) {
 			best = f
 		}
 	}
-	return best, best.Reach > 0
+	return best, best.Reach > unreachable
 }
 // Open hands link, clicked in front, to f.
@@ -1,6 +1,7 @@
 package instance
 import (
 	"cmp"
 	"os"
 	"os/exec"
 	"slices"
@@ -25,9 +26,10 @@ func tmux(args ...string) (string, error) {
 func inTmux() bool { return os.Getenv("TMUX") != "" && os.Getenv("TMUX_PANE") != "" }
 type client struct {
-	name, session, activity string // activity: Unix seconds
+	name, session string
-	pid                     int
+	activity      int // Unix seconds
-	app                     string
+	pid           int
 	app           string
 }
 // clients lists the tmux server's clients, the one last typed in first.
@@ -42,30 +44,31 @@ func clients() []client {
 		if len(f) < 4 {
 			continue
 		}
-		pid, err := strconv.Atoi(f[1])
+		activity, err1 := strconv.Atoi(f[0])
-		if err != nil {
+		pid, err2 := strconv.Atoi(f[1])
 		if err1 != nil || err2 != nil {
 			continue
 		}
-		cs = append(cs, client{name: f[2], session: f[3], activity: f[0], pid: pid, app: linkhandler.HostApp(pid)})
+		cs = append(cs, client{name: f[2], session: f[3], activity: activity, pid: pid, app: linkhandler.HostApp(pid)})
 	}
-	// Activity has the same width for centuries: strings compare like
+	slices.SortStableFunc(cs, func(a, b client) int { return cmp.Compare(b.activity, a.activity) })
 	// numbers.
 	slices.SortStableFunc(cs, func(a, b client) int { return strings.Compare(b.activity, a.activity) })
 	return cs
 }
 // place is where this instance would show: the tmux client (zero outside
-// tmux), the app, and reach: 2 already on screen there (outside tmux, or
+// tmux), the app, and its reach.
 // a client on its session), 1 after switching a client, 0 nowhere.
 func place(front string) (client, string, int) {
 	if !inTmux() {
-		return client{}, linkhandler.HostApp(os.Getpid()), 2
+		return client{}, linkhandler.HostApp(os.Getpid()), inView
 	}
 	session, err := tmux("display-message", "-p", "-t", os.Getenv("TMUX_PANE"), "#{session_name}")
 	if err != nil {
-		return client{}, "", 0
+		return client{}, "", unreachable
 	}
 	cs := clients()
 	if len(cs) == 0 {
 		return client{}, "", unreachable
 	}
 	// Best first: in the front app on its session, in the front app,
 	// on its session, any.
 	rank := func(c client) int {
@@ -78,20 +81,16 @@ func place(front string) (client, string, int) {
 		}
 		return r
 	}
-	var best client
+	best := cs[0]
-	found := false
+	for _, c := range cs[1:] {
-	for _, c := range cs {
+		if rank(c) > rank(best) {
-		if !found || rank(c) > rank(best) {
+			best = c
 			best, found = c, true
 		}
 	}
 	if !found {
 		return client{}, "", 0
 	}
 	if best.session == session {
-		return best, best.app, 2
+		return best, best.app, inView
 	}
-	return best, best.app, 1
+	return best, best.app, switchable
 }
 // Raise brings this instance into view for a link clicked in front: in
@@ -99,14 +98,14 @@ func place(front string) (client, string, int) {
 // then its app to the front, showing a hidden dropdown terminal.
 func Raise(front string) {
 	c, app, reach := place(front)
-	if reach == 0 {
+	if reach == unreachable {
 		return
 	}
 	if inTmux() {
 		pane := os.Getenv("TMUX_PANE")
 		_, _ = tmux("select-window", "-t", pane)
 		_, _ = tmux("select-pane", "-t", pane)
-		if reach == 1 {
+		if reach == switchable {
 			_, _ = tmux("switch-client", "-c", c.name, "-t", pane)
 		}
 	}
@@ -0,0 +1,67 @@
 // Package jasypt decrypts values encrypted with Jasypt the way
 // jasypt-spring-boot 3.0 and later does by default: ENC(...) around the
 // base64 of a random salt, a random IV and the ciphertext, with
 // PBEWITHHMACSHA512ANDAES_256 (PBKDF2-HMAC-SHA512, 1000 iterations,
 // AES-256-CBC).
 package jasypt
 import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/pbkdf2"
 	"crypto/sha512"
 	"encoding/base64"
 	"errors"
 	"strings"
 	"unicode/utf8"
 )
 const iterations = 1000
 // ErrDecrypt is a value that doesn't decrypt with the password: a wrong
 // password, or one encrypted with another algorithm.
 var ErrDecrypt = errors.New("doesn't decrypt: a wrong password, or not Jasypt's default algorithm (PBEWITHHMACSHA512ANDAES_256)")
 // Is reports whether v is a Jasypt value, ENC(...).
 func Is(v string) bool {
 	return len(v) > len("ENC()") && strings.HasPrefix(v, "ENC(") && strings.HasSuffix(v, ")")
 }
 // Decrypt decrypts an ENC(...) value.
 func Decrypt(v, password string) (string, error) {
 	b, err := base64.StdEncoding.DecodeString(strings.TrimSuffix(strings.TrimPrefix(v, "ENC("), ")"))
 	if err != nil {
 		return "", errors.New("not Jasypt: ENC(...) isn't base64")
 	}
 	const size = aes.BlockSize // the salt's and the IV's too
 	if len(b) < 3*size || len(b)%size != 0 {
 		return "", ErrDecrypt
 	}
 	salt, iv, data := b[:size], b[size:2*size], b[2*size:]
 	key, err := pbkdf2.Key(sha512.New, password, salt, iterations, 32)
 	if err != nil {
 		return "", err
 	}
 	block, err := aes.NewCipher(key)
 	if err != nil {
 		return "", err
 	}
 	plain := make([]byte, len(data))
 	cipher.NewCBCDecrypter(block, iv).CryptBlocks(plain, data)
 	// A wrong password decrypts to noise: its padding is almost never
 	// valid, and the rest rarely UTF-8.
 	n := int(plain[len(plain)-1])
 	if n == 0 || n > size {
 		return "", ErrDecrypt
 	}
 	for _, c := range plain[len(plain)-n:] {
 		if int(c) != n {
 			return "", ErrDecrypt
 		}
 	}
 	plain = plain[:len(plain)-n]
 	if !utf8.Valid(plain) {
 		return "", ErrDecrypt
 	}
 	return string(plain), nil
 }
@@ -0,0 +1,37 @@
 package jasypt
 import (
 	"errors"
 	"testing"
 )
 // Encrypted by Jasypt 1.9.3 itself, set up as jasypt-spring-boot's default
 // encryptor, with the password "test-password".
 var vectors = map[string]string{
 	"ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)":                         "hunter2",
 	"ENC(w4pm2JVZcbG5R+Ud9uKHg8VhJ/0aAK7sFXtNBv+Vo450SAchTQtfhw0TnIJ9gN+D0VFbwqJzfXU369coTJz2rw==)": "blåbærsyltetøy ✓",
 }
 func TestDecrypt(t *testing.T) {
 	for enc, want := range vectors {
 		if !Is(enc) {
 			t.Errorf("%s: not Jasypt", enc)
 		}
 		if got, err := Decrypt(enc, "test-password"); err != nil || got != want {
 			t.Errorf("%s: %q %v, want %q", enc, got, err, want)
 		}
 		if _, err := Decrypt(enc, "wrong"); !errors.Is(err, ErrDecrypt) {
 			t.Errorf("%s with a wrong password: %v", enc, err)
 		}
 	}
 	for _, v := range []string{"ENC(not base64!)", "ENC(aGVsbG8=)"} {
 		if _, err := Decrypt(v, "test-password"); err == nil {
 			t.Errorf("%s: no error", v)
 		}
 	}
 	for _, v := range []string{"ENC()", "hunter2", "ENC[AES256_GCM,data:x]", "${DB_PASSWORD}"} {
 		if Is(v) {
 			t.Errorf("%s: Jasypt", v)
 		}
 	}
 }
@@ -114,19 +114,15 @@ func Check() string {
 	}
 	out, err := exec.Command("plutil", "-extract", exeKey, "raw", filepath.Join(app, "Contents", "Info.plist")).Output()
 	if err != nil {
-		return "" // installed before the key was recorded: assume it works
+		return "" // can't tell: assume it works
 	}
-	if exe := strings.TrimSpace(string(out)); !exists(exe) {
+	exe := strings.TrimSpace(string(out))
 	if _, err := os.Stat(exe); err != nil {
 		return "lazysecrets:// links run " + exe + ", which no longer exists"
 	}
 	return ""
 }
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 // Uninstall removes the applet and its registration.
 func Uninstall() (string, error) {
 	app, err := AppPath()
@@ -140,11 +140,10 @@ func appleString(s string) string {
 	return `"` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(s) + `"`
 }
-// Launch opens a new terminal window running inner, without waiting for
+// Launch opens a new terminal window running argv, without waiting for
 // it.
 func Launch(argv []string) error {
 	cmd := exec.Command(argv[0], argv[1:]...)
 	cmd.Stdin, cmd.Stdout, cmd.Stderr = nil, nil, nil
 	if err := cmd.Start(); err != nil {
 		return err
 	}
@@ -166,9 +165,11 @@ func Executable() (string, error) {
 // passEnv lists the variables carried from the install's environment to
 // lazysecrets in the new window: apps start with a minimal environment,
-// without Homebrew's PATH (so no az) or the user's config locations.
+// without Homebrew's PATH (so no az) or the user's XDG directories, so
 // the window would use another cache and miss running instances' sockets.
 var passEnv = []string{
-	"PATH", "LAZYSECRETS_CONFIG_FILE", "LAZYSECRETS_ICONS", "XDG_CONFIG_HOME", "XDG_STATE_HOME",
+	"PATH", "LAZYSECRETS_CONFIG_FILE", "LAZYSECRETS_ICONS",
 	"XDG_CONFIG_HOME", "XDG_STATE_HOME", "XDG_CACHE_HOME", "XDG_RUNTIME_DIR", "XDG_DATA_HOME",
 	"AZURE_CONFIG_DIR", "DATABRICKS_CONFIG_FILE",
 }
@@ -0,0 +1,410 @@
 // Package listing lists what lazysecrets can find, for lazysecrets list:
 // what Go to searches, without the TUI. What's cached comes first, at
 // once; then lists that are missing or older than MaxAge load in the
 // background, a few at a time, and what's new in them follows as they
 // arrive. Repos are always read, from disk. Values are never listed.
 package listing
 import (
 	"cmp"
 	"context"
 	"slices"
 	"strings"
 	"time"
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 )
 // Workers is how many lists load at once, as in Go to.
 const Workers = 4
 // Kinds are the kinds of entry, from sources down.
 var Kinds = []string{"source", "vault", "secret", "key", "certificate"}
 // Entry is a source, vault or item, by its lazysecrets:// link.
 type Entry struct {
 	Link string `json:"link"`
 	// Kind is source (a subscription, workspace or repo), vault (a Key
 	// Vault, secret scope or repo file), secret, key or certificate.
 	Kind string `json:"kind"`
 	// Provider is azure, databricks or repo, as in links.
 	Provider string `json:"provider"`
 	// Path names it: its source's, vault's and own names.
 	Path []string `json:"path"`
 	// Account is the provider it's listed through: an az account
 	// (Azure:<user>/<tenant>), Databricks or Repos. lazysecrets open and
 	// get take it (--account) to use that account when several could.
 	Account string `json:"account"`
 	// AccountLabel names the az account, when there are several.
 	AccountLabel string `json:"accountLabel,omitempty"`
 	// Starred is starred for this account; Recent is used lately (Recent,
 	// R, in the TUI): LastUsed is when, Uses how often.
 	Starred  bool      `json:"starred"`
 	Recent   bool      `json:"recent"`
 	LastUsed time.Time `json:"lastUsed,omitzero"`
 	Uses     int       `json:"uses,omitempty"`
 	// Expires is when a secret, key or certificate expires, if it does;
 	// Enabled whether it's enabled, where the provider says (Azure).
 	Expires time.Time `json:"expires,omitzero"`
 	Enabled *bool     `json:"enabled,omitempty"`
 	// Note is the user's note on it, if any.
 	Note string `json:"note,omitempty"`
 	// Reference is how config refers to a secret, where the provider has
 	// a way (@Microsoft.KeyVault(...), {{secrets/scope/key}}); URL its
 	// web page (portal, workspace), if any.
 	Reference string `json:"reference,omitempty"`
 	URL       string `json:"url,omitempty"`
 	// Hidden is left out by its provider's rules (a Spring file's key
 	// that doesn't look secret), listed only with Options.Hidden.
 	Hidden bool `json:"hidden,omitempty"`
 	// Error says why a source's vaults or a vault's secrets couldn't be
 	// listed. The entry is then that source or vault, again, or with an
 	// account's sources unreadable, the account without a link.
 	Error string `json:"error,omitempty"`
 }
 type Options struct {
 	Providers []provider.Provider
 	// Cache is what was loaded before; Run adds what it loads.
 	Cache cachefile.File
 	// MaxAge: cached lists loaded longer ago are loaded again.
 	MaxAge time.Duration
 	// Cached lists only what's cached (and repos): nothing is loaded.
 	Cached bool
 	// Hidden lists what providers hide too, as H does in the TUI.
 	Hidden bool
 	// Kinds are the kinds of entry to list (Kinds' names); none is all.
 	// Lists only needed for other kinds aren't loaded: sources and vaults
 	// alone don't load any secrets. Lists that fail are always listed.
 	Kinds []string
 	// Mark tells what's remembered about the entry with link, seen
 	// through account; nil marks nothing.
 	Mark    func(link, account string) Marks
 	Timeout func(provider.Kind) time.Duration // nil: 30s
 	Now     func() time.Time
 }
 // Marks are what's remembered about an entry: starred for the account,
 // used lately (Recent) and when and how often, and its note.
 type Marks struct {
 	Starred, Recent bool
 	LastUsed        time.Time
 	Uses            int
 	Note            string
 }
 // Run lists everything, calling emit for each entry once, from this
 // goroutine, and for each list that can't be loaded, as it fails. An
 // error from emit (the reader went away) stops it. It returns the cache
 // with what was loaded, and whether anything was.
 func Run(ctx context.Context, o Options, emit func(Entry) error) (cachefile.File, bool) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	l := &lister{o: o, emit: emit, seen: map[string]bool{}, pending: map[string]bool{}, failed: map[string]bool{},
 		results: make(chan result)}
 	if l.o.Now == nil {
 		l.o.Now = time.Now
 	}
 	if l.o.Timeout == nil {
 		l.o.Timeout = func(provider.Kind) time.Duration { return 30 * time.Second }
 	}
 	for _, p := range o.Providers {
 		if l.stopped != nil {
 			break
 		}
 		l.provider(p)
 	}
 	l.start(ctx)
 	for l.active > 0 {
 		r := <-l.results
 		l.active--
 		if l.stopped == nil {
 			l.handle(r)
 			l.start(ctx)
 		}
 		if l.stopped != nil {
 			cancel()
 		}
 	}
 	return l.o.Cache, l.loaded
 }
 type job struct {
 	p   provider.Provider
 	src *provider.Source    // list its vaults
 	c   *provider.Container // list its secrets, keys or certificates (t)
 	t   provider.ObjectType
 	key string // where the list is cached
 }
 type result struct {
 	job
 	sources    []provider.Source
 	containers []provider.Container
 	objects    []provider.Object
 	err        error
 }
 type lister struct {
 	o       Options
 	emit    func(Entry) error
 	seen    map[string]bool // provider ID + link of entries emitted
 	pending map[string]bool // cache keys queued or loading
 	failed  map[string]bool // cache keys that couldn't be loaded: not again
 	loaded  bool            // something was cached
 	queue   []job
 	active  int
 	results chan result
 	stopped error // emit's error
 }
 func (l *lister) cacheable(p provider.Provider) bool { return p.Kind() != provider.KindRepo }
 // load reports whether to load a list: a repo's always (from disk), else
 // unless Cached, when it isn't cached or is older than MaxAge.
 func (l *lister) load(p provider.Provider, cached bool, at time.Time) bool {
 	if !l.cacheable(p) {
 		return true
 	}
 	return !l.o.Cached && (!cached || l.o.Now().Sub(at) >= l.o.MaxAge)
 }
 func (l *lister) provider(p provider.Provider) {
 	e, ok := l.o.Cache.Sources[p.ID()]
 	if l.cacheable(p) && ok {
 		for _, src := range sorted(e.Value, func(s provider.Source) string { return s.Name }) {
 			l.source(p, src)
 		}
 	}
 	if l.load(p, ok, e.At) {
 		l.enqueue(job{p: p, key: p.ID()})
 	}
 }
 // source emits src, and what's cached under it, and queues what's not.
 func (l *lister) source(p provider.Provider, src provider.Source) {
 	if src.Hidden && !l.o.Hidden {
 		return
 	}
 	src.Provider, src.ProviderLabel = p.ID(), p.Label()
 	l.put(p, sourceEntry(src))
 	row := cachefile.Row(p.ID(), src.ID)
 	e, ok := l.o.Cache.Containers[row]
 	if l.cacheable(p) && ok {
 		l.containers(p, src, e.Value)
 	}
 	if l.load(p, ok, e.At) {
 		if l.wants("vault", "secret", "key", "certificate") {
 			l.enqueue(job{p: p, src: &src, key: row})
 		}
 	}
 }
 func (l *lister) containers(p provider.Provider, src provider.Source, cs []provider.Container) {
 	for _, c := range sorted(cs, func(c provider.Container) string { return c.Name }) {
 		if c.Hidden && !l.o.Hidden {
 			continue
 		}
 		c.Source = src
 		l.put(p, containerEntry(c))
 		for _, t := range c.ObjectTypes() {
 			key := cachefile.ObjectsKey(c, t)
 			e, ok := l.o.Cache.Objects[key]
 			if l.cacheable(p) {
 				l.objects(p, c, e.Value)
 			}
 			// Keys and certificates load only when asked for; else,
 			// like Go to, only as far as the TUI opened them.
 			asked := l.wants(strings.ToLower(string(t)))
 			if t != provider.TypeSecret {
 				asked = len(l.o.Kinds) > 0 && asked
 			}
 			if asked && l.load(p, ok, e.At) {
 				l.enqueue(job{p: p, c: &c, t: t, key: key})
 			}
 		}
 	}
 }
 func (l *lister) objects(p provider.Provider, c provider.Container, objs []provider.Object) {
 	for _, o := range sorted(objs, func(o provider.Object) string { return o.Name }) {
 		o.Container = c
 		r, err := ref.ForObject(o, "")
 		if err != nil || (o.Hidden && !l.o.Hidden) {
 			continue
 		}
 		l.put(p, Entry{Link: r.String(), Kind: strings.ToLower(string(o.Type)), Provider: kindOf(c.Source.Kind),
 			Path: []string{c.Source.Name, c.Name, o.Name}, AccountLabel: accountOf(c.Source),
 			Expires: o.Expires, Enabled: o.Enabled, Reference: o.Reference, URL: o.URL, Hidden: o.Hidden})
 	}
 }
 func sourceEntry(src provider.Source) Entry {
 	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src), URL: src.URL, Hidden: src.Hidden}
 	if r, err := ref.ForSource(src); err == nil {
 		e.Link = r.String()
 	}
 	return e
 }
 func containerEntry(c provider.Container) Entry {
 	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source), URL: c.URL, Hidden: c.Hidden}
 	if r, err := ref.ForContainer(c, provider.TypeSecret); err == nil {
 		e.Link = r.String()
 	}
 	return e
 }
 // put emits e, unless it was already (or emitting has failed). Entries
 // without a link (one couldn't be made) are left out, but not errors.
 func (l *lister) put(p provider.Provider, e Entry) {
 	if (e.Link == "" || !l.wants(e.Kind)) && e.Error == "" {
 		return
 	}
 	e.Account = p.ID()
 	if l.o.Mark != nil && e.Link != "" {
 		m := l.o.Mark(e.Link, e.Account)
 		e.Starred, e.Recent, e.Note = m.Starred, m.Recent, m.Note
 		if m.Recent {
 			e.LastUsed, e.Uses = m.LastUsed, m.Uses
 		}
 	}
 	id := p.ID() + "\x00" + e.Link + "\x00" + e.Error
 	if l.stopped != nil || l.seen[id] {
 		return
 	}
 	l.seen[id] = true
 	l.stopped = l.emit(e)
 }
 // wants reports whether any of kinds is listed.
 func (l *lister) wants(kinds ...string) bool {
 	if len(l.o.Kinds) == 0 {
 		return true
 	}
 	for _, k := range kinds {
 		if slices.Contains(l.o.Kinds, k) {
 			return true
 		}
 	}
 	return false
 }
 func (l *lister) enqueue(j job) {
 	if l.pending[j.key] || l.failed[j.key] {
 		return
 	}
 	l.pending[j.key] = true
 	l.queue = append(l.queue, j)
 }
 func (l *lister) start(ctx context.Context) {
 	for l.stopped == nil && l.active < Workers && len(l.queue) > 0 {
 		j := l.queue[0]
 		l.queue = l.queue[1:]
 		l.active++
 		go func() { l.results <- l.fetch(ctx, j) }()
 	}
 }
 func (l *lister) fetch(ctx context.Context, j job) result {
 	kind := j.p.Kind()
 	ctx, cancel := context.WithTimeout(ctx, l.o.Timeout(kind))
 	defer cancel()
 	r := result{job: j}
 	switch {
 	case j.c != nil:
 		r.objects, r.err = j.p.Objects(ctx, *j.c, j.t)
 	case j.src != nil:
 		r.containers, r.err = j.p.Containers(ctx, *j.src)
 	default:
 		r.sources, r.err = j.p.Sources(ctx)
 	}
 	return r
 }
 func (l *lister) handle(r result) {
 	delete(l.pending, r.key)
 	now := l.o.Now()
 	if r.err != nil {
 		l.failed[r.key] = true
 		l.put(r.p, r.failed())
 		return
 	}
 	l.loaded = l.loaded || l.cacheable(r.p)
 	cache := l.cacheable(r.p)
 	switch {
 	case r.c != nil:
 		if cache {
 			l.o.Cache.Objects[r.key] = cachefile.Stamped[[]provider.Object]{At: now, Value: r.objects}
 		}
 		l.objects(r.p, *r.c, r.objects)
 	case r.src != nil:
 		r.containers = slices.Clone(r.containers) // the provider's may be shared
 		for i := range r.containers {
 			r.containers[i].Source = *r.src
 		}
 		if cache {
 			l.o.Cache.Containers[r.key] = cachefile.Stamped[[]provider.Container]{At: now, Value: r.containers}
 		}
 		l.containers(r.p, *r.src, r.containers)
 	default:
 		if cache {
 			l.o.Cache.Sources[r.key] = cachefile.Stamped[[]provider.Source]{At: now, Value: r.sources}
 		}
 		for _, src := range r.sources {
 			l.source(r.p, src)
 		}
 	}
 }
 // failed is the entry for a list that couldn't be loaded.
 func (r result) failed() Entry {
 	var e Entry
 	switch {
 	case r.c != nil:
 		e = containerEntry(*r.c)
 	case r.src != nil:
 		src := *r.src
 		src.Provider, src.ProviderLabel = r.p.ID(), r.p.Label()
 		e = sourceEntry(src)
 	default:
 		e = Entry{Kind: "source", Provider: kindOf(r.p.Kind()), Path: []string{r.p.Label()}}
 	}
 	e.Error = firstLine(r.err.Error())
 	return e
 }
 // firstLine is an error's first line, the summary (Azure's go on with
 // the caller's IDs and more): an entry is one line. Tabs, which would
 // split it into columns, are spaces.
 func firstLine(s string) string {
 	for line := range strings.Lines(s) {
 		if line = strings.TrimSpace(line); line != "" {
 			return strings.ReplaceAll(line, "\t", " ")
 		}
 	}
 	return "unreadable"
 }
 func kindOf(k provider.Kind) string { return strings.ToLower(string(k)) }
 // accountOf is the account part of a source's provider label ("alice" in
 // "Azure · alice"), or "" when there's a single account.
 func accountOf(src provider.Source) string {
 	account, ok := strings.CutPrefix(src.ProviderLabel, string(src.Kind)+" · ")
 	if !ok {
 		return ""
 	}
 	return account
 }
 func sorted[T any](s []T, name func(T) string) []T {
 	s = slices.Clone(s)
 	slices.SortStableFunc(s, func(a, b T) int {
 		return cmp.Compare(strings.ToLower(name(a)), strings.ToLower(name(b)))
 	})
 	return s
 }
@@ -0,0 +1,297 @@
 package listing
 import (
 	"context"
 	"errors"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 )
 // counting counts a provider's requests.
 type counting struct {
 	provider.Provider
 	calls atomic.Int32
 }
 func (c *counting) Sources(ctx context.Context) ([]provider.Source, error) {
 	c.calls.Add(1)
 	return c.Provider.Sources(ctx)
 }
 func (c *counting) Containers(ctx context.Context, src provider.Source) ([]provider.Container, error) {
 	c.calls.Add(1)
 	return c.Provider.Containers(ctx, src)
 }
 func (c *counting) Objects(ctx context.Context, ct provider.Container, t provider.ObjectType) ([]provider.Object, error) {
 	c.calls.Add(1)
 	return c.Provider.Objects(ctx, ct, t)
 }
 // run lists, returning the entries and, apart, the lists that failed.
 func run(t *testing.T, o Options) ([]Entry, cachefile.File, []Entry) {
 	t.Helper()
 	if o.Cache.Version == 0 {
 		o.Cache = cachefile.New()
 	}
 	o.Timeout = func(provider.Kind) time.Duration { return 5 * time.Second }
 	var got, failed []Entry
 	f, _ := Run(context.Background(), o, func(e Entry) error {
 		if e.Error != "" {
 			failed = append(failed, e)
 		} else {
 			got = append(got, e)
 		}
 		return nil
 	})
 	return got, f, failed
 }
 func has(es []Entry, kind, path string) bool {
 	for _, e := range es {
 		if e.Kind == kind && strings.Join(e.Path, "/") == path {
 			return true
 		}
 	}
 	return false
 }
 func TestListLoadsAndCaches(t *testing.T) {
 	t.Parallel()
 	az := &counting{Provider: fake.Azure(0)}
 	got, f, errs := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, MaxAge: time.Minute})
 	for _, want := range [][2]string{
 		{"source", "platform-prod"}, {"vault", "platform-prod/kv-app-prod"}, {"secret", "platform-prod/kv-app-prod/db-password"},
 		{"source", "lazysecrets-demo"}, {"secret", "lazysecrets-demo/.env/DATABASE_URL"},
 	} {
 		if !has(got, want[0], want[1]) {
 			t.Errorf("no %s %s", want[0], want[1])
 		}
 	}
 	if len(errs) != 1 || errs[0].Kind != "vault" || errs[0].Path[1] != "kv-restricted" || !strings.Contains(errs[0].Error, "403") || errs[0].Link == "" {
 		t.Errorf("failed = %+v", errs)
 	}
 	seen := map[string]bool{}
 	for _, e := range got {
 		if seen[e.Link] {
 			t.Errorf("%s listed twice", e.Link)
 		}
 		seen[e.Link] = true
 		if e.Provider != "azure" && e.Provider != "repo" {
 			t.Errorf("provider %q", e.Provider)
 		}
 	}
 	for _, e := range got {
 		if e.Kind == "secret" && e.Provider == "azure" && (!strings.HasPrefix(e.Reference, "@Microsoft.KeyVault(") || e.URL == "") {
 			t.Errorf("%s: reference %q, url %q", e.Link, e.Reference, e.URL)
 		}
 	}
 	if len(f.Sources) != 1 || len(f.Containers) == 0 || len(f.Objects) == 0 {
 		t.Errorf("not cached: %d sources, %d containers, %d objects", len(f.Sources), len(f.Containers), len(f.Objects))
 	}
 	for k := range f.Containers {
 		if cachefile.ProviderOf(k) != az.ID() {
 			t.Errorf("cached a repo: %s", k)
 		}
 	}
 	// Again with that cache: the same, without asking Azure.
 	before := az.calls.Load()
 	again, _, _ := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, Cache: f, MaxAge: time.Minute})
 	if len(again) != len(got) {
 		t.Errorf("%d entries from the cache, %d loaded", len(again), len(got))
 	}
 	// The vault that couldn't be read wasn't cached: it's asked again.
 	if n := az.calls.Load() - before; n != 1 {
 		t.Errorf("%d requests with a fresh cache, want 1 (kv-restricted)", n)
 	}
 	// Stale: loaded again, but each entry is still listed once.
 	before = az.calls.Load()
 	stale, _, _ := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute,
 		Now: func() time.Time { return time.Now().Add(time.Hour) }})
 	if az.calls.Load()-before < 3 {
 		t.Error("stale lists weren't loaded again")
 	}
 	links := map[string]bool{}
 	for _, e := range stale {
 		if links[e.Link] {
 			t.Errorf("%s listed twice", e.Link)
 		}
 		links[e.Link] = true
 	}
 }
 func TestListCachedOnly(t *testing.T) {
 	t.Parallel()
 	az := &counting{Provider: fake.Azure(0)}
 	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
 	before := az.calls.Load()
 	got, _, errs := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, Cache: f, Cached: true,
 		Now: func() time.Time { return time.Now().Add(24 * time.Hour) }})
 	if az.calls.Load() != before || len(errs) != 0 {
 		t.Errorf("--cached asked Azure: %d requests, %v", az.calls.Load()-before, errs)
 	}
 	if !has(got, "secret", "platform-prod/kv-app-prod/db-password") || !has(got, "secret", "lazysecrets-demo/.env/DATABASE_URL") {
 		t.Error("cached secrets or repos missing")
 	}
 }
 func TestListCachedFirst(t *testing.T) {
 	t.Parallel()
 	az := fake.Azure(0)
 	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
 	// Forget one vault's secrets: they load, after everything cached.
 	var dropped string
 	for k := range f.Objects {
 		if strings.Contains(k, "kv-app-prod") && strings.HasSuffix(k, "|Secret") {
 			dropped = k
 			delete(f.Objects, k)
 			break
 		}
 	}
 	if dropped == "" {
 		t.Fatalf("no kv-app-prod in %v", f.Objects)
 	}
 	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute})
 	last := got[len(got)-1]
 	if last.Kind != "secret" || last.Path[1] != "kv-app-prod" {
 		t.Errorf("last = %+v, want a kv-app-prod secret, loaded after the cache", last)
 	}
 }
 func TestListStopsWhenTheReaderGoes(t *testing.T) {
 	t.Parallel()
 	gone := errors.New("broken pipe")
 	n := 0
 	var errs []Entry
 	Run(context.Background(), Options{
 		Providers: []provider.Provider{fake.Azure(0), fake.Repos()}, Cache: cachefile.New(), MaxAge: time.Minute,
 		Timeout: func(provider.Kind) time.Duration { return time.Second },
 	}, func(e Entry) error {
 		if e.Error != "" {
 			errs = append(errs, e)
 		}
 		n++
 		if n == 2 {
 			return gone
 		}
 		return nil
 	})
 	if n != 2 || len(errs) != 0 {
 		t.Errorf("emitted %d after the reader went, errs %v", n, errs)
 	}
 }
 func TestListKinds(t *testing.T) {
 	t.Parallel()
 	// Sources only: nothing under them is asked for.
 	az := &counting{Provider: fake.Azure(0)}
 	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute, Kinds: []string{"source"}})
 	if len(got) == 0 || az.calls.Load() != 1 {
 		t.Errorf("%d sources, %d requests, want just the sources'", len(got), az.calls.Load())
 	}
 	for _, e := range got {
 		if e.Kind != "source" {
 			t.Errorf("listed a %s", e.Kind)
 		}
 	}
 	// Keys, asked for: loaded, though Go to wouldn't; no secrets.
 	got, _, failed := run(t, Options{Providers: []provider.Provider{fake.Azure(0)}, MaxAge: time.Minute, Kinds: []string{"key"}})
 	if !has(got, "key", "platform-prod/kv-app-prod/signing-key") {
 		t.Errorf("no keys: %+v", got)
 	}
 	for _, e := range got {
 		if e.Kind != "key" {
 			t.Errorf("listed a %s", e.Kind)
 		}
 	}
 	if len(failed) == 0 {
 		t.Error("a list that failed wasn't listed")
 	}
 }
 func TestErrorsAreOneLine(t *testing.T) {
 	for in, want := range map[string]string{
 		"403 Forbidden: Caller is not authorized\nCaller: appid=x;oid=y\nVault: kv;location=z": "403 Forbidden: Caller is not authorized",
 		"\n  timeout\tafter 30s\n": "timeout after 30s",
 		"":                         "unreadable",
 	} {
 		if got := firstLine(in); got != want {
 			t.Errorf("firstLine(%q) = %q, want %q", in, got, want)
 		}
 	}
 }
 func TestListMarks(t *testing.T) {
 	t.Parallel()
 	az := fake.Azure(0)
 	var starredLink string
 	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute, Kinds: []string{"secret"},
 		Mark: func(link, account string) Marks {
 			if starredLink == "" && strings.HasSuffix(link, "/db-password") {
 				starredLink = link
 			}
 			if strings.HasSuffix(link, "/api-key") {
 				return Marks{Recent: true, LastUsed: time.Now(), Uses: 3, Note: "rotate in May"}
 			}
 			if strings.HasSuffix(link, "/legacy-token") { // used, but too long ago
 				return Marks{LastUsed: time.Now().AddDate(-2, 0, 0), Uses: 9}
 			}
 			return Marks{Starred: link == starredLink && account == az.ID()}
 		}})
 	var starred, recent int
 	for _, e := range got {
 		if e.Starred {
 			starred++
 			if e.Link != starredLink {
 				t.Errorf("%s starred", e.Link)
 			}
 		}
 		if (e.Note != "") != strings.HasSuffix(e.Link, "/api-key") {
 			t.Errorf("%s: note %q", e.Link, e.Note)
 		}
 		if e.Recent {
 			recent++
 			if e.Uses != 3 || e.LastUsed.IsZero() {
 				t.Errorf("%s: %d uses, last %v", e.Link, e.Uses, e.LastUsed)
 			}
 		} else if e.Uses != 0 || !e.LastUsed.IsZero() {
 			t.Errorf("%s not recent, but %d uses, last %v", e.Link, e.Uses, e.LastUsed)
 		}
 	}
 	if starred != 1 || recent == 0 {
 		t.Errorf("%d starred, %d recent", starred, recent)
 	}
 }
 func TestFailedListNotRetried(t *testing.T) {
 	t.Parallel()
 	az := &counting{Provider: fake.Azure(0)}
 	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
 	// Everything stale: sources reload, and their vaults are queued again
 	// as each list arrives. kv-restricted fails once, and isn't asked again.
 	before := az.calls.Load()
 	_, _, failed := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute,
 		Now: func() time.Time { return time.Now().Add(time.Hour) }})
 	if len(failed) != 1 {
 		t.Errorf("failed: %+v", failed)
 	}
 	fresh := &counting{Provider: fake.Azure(0)}
 	run(t, Options{Providers: []provider.Provider{fresh}, MaxAge: time.Minute})
 	if n := az.calls.Load() - before; n > fresh.calls.Load() {
 		t.Errorf("%d requests with a stale cache, more than %d from scratch: something was asked twice", n, fresh.calls.Load())
 	}
 }
 func TestRunWithoutTimeout(t *testing.T) {
 	t.Parallel()
 	Run(context.Background(), Options{Providers: []provider.Provider{fake.Repos()}, Cache: cachefile.New()},
 		func(Entry) error { return nil }) // no Timeout: a default, not a panic
 }
@@ -107,9 +107,6 @@ func parseTerm(tok string) (term, bool) {
 	return t, true
 }
 // Empty reports whether the query has no terms: everything matches.
 func (q Query) Empty() bool { return len(q.groups) == 0 }
 // Item is a row to match: Text is everything searched, and runes
 // NameStart up to NameEnd of it are the row's name (the rest is context,
 // like a path or a note). Without a name, nothing gets the name bonus.
@@ -99,9 +99,3 @@ func TestAnchorsOnTheName(t *testing.T) {
 		t.Errorf("password$: %v", got)
 	}
 }
 func TestEmpty(t *testing.T) {
 	if !Parse("  | ").Empty() || Parse("x").Empty() {
 		t.Error("Empty")
 	}
 }
@@ -0,0 +1,157 @@
 package azure
 import (
 	"fmt"
 	"slices"
 	"strings"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // accountDetails describes an az account from az's account list and the
 // claims of the latest token lazysecrets got for it: nothing is fetched
 // for it.
 type accountDetails struct {
 	account
 	claims func() map[string]any
 }
 var _ provider.Accounts = (*Provider)(nil)
 // Account describes the az account, once a token has been fetched for it
 // (the user's name and object ID come from the token).
 func (p *Provider) Account() (provider.Account, bool) {
 	if p.account == nil {
 		return provider.Account{}, false
 	}
 	a := p.account
 	claims := a.claims()
 	str := func(k string) string { s, _ := claims[k].(string); return s }
 	var out provider.Account
 	add := func(label, value string) {
 		if value != "" {
 			out.Fields = append(out.Fields, provider.Attr{Label: label, Value: value})
 		}
 	}
 	add("name", str("name"))
 	user := a.user
 	if a.userType == "servicePrincipal" {
 		user += " (service principal)"
 	}
 	add("user", user)
 	add("tenant", a.tenantName)
 	add("tenant ID", a.tenant)
 	if oid := str("oid"); oid != "" {
 		add("object ID", oid)
 		out.Copy, out.CopyLabel = oid, "object ID"
 	}
 	if claims != nil {
 		add("sign-in", signInMethods(claims["amr"]))
 		add("roles", directoryRoles(claims["wids"]))
 	}
 	subs := fmt.Sprint(a.subscriptions)
 	if a.defaultSub != "" {
 		subs += " · default " + a.defaultSub
 	}
 	add("subs", subs)
 	if a.cloud != "" && a.cloud != "AzureCloud" {
 		add("cloud", a.cloud)
 	}
 	return out, len(out.Fields) > 0
 }
 // signInMethods says how the session was signed in to, from the amr
 // claim: with MFA or not, and by what.
 func signInMethods(amr any) string {
 	list, _ := amr.([]any)
 	var methods []string
 	mfa := false
 	for _, m := range list {
 		s, _ := m.(string)
 		switch s {
 		case "mfa", "ngcmfa":
 			mfa = true
 		case "pwd":
 			methods = append(methods, "password")
 		case "rsa":
 			methods = append(methods, "Windows Hello or certificate")
 		case "fido":
 			methods = append(methods, "security key")
 		case "wia":
 			methods = append(methods, "Windows sign-in")
 		case "otp", "sms":
 			methods = append(methods, "one-time code")
 		}
 	}
 	if len(list) == 0 {
 		return ""
 	}
 	how := strings.Join(methods, ", ")
 	switch {
 	case mfa && how != "":
 		return "MFA · " + how
 	case mfa:
 		return "MFA"
 	case how != "":
 		return "no MFA · " + how
 	}
 	return "no MFA"
 }
 // builtinRoles names Entra ID's built-in directory roles by template ID,
 // the IDs a token's wids claim lists.
 var builtinRoles = map[string]string{
 	"62e90394-69f5-4237-9190-012177145e10": "Global Administrator",
 	"f2ef992c-3afb-46b9-b7cf-a126ee74c451": "Global Reader",
 	"e8611ab8-c189-46e8-94e1-60213ab1f814": "Privileged Role Administrator",
 	"7be44c8a-adaf-4e2a-84d6-ab2649e08a13": "Privileged Authentication Administrator",
 	"194ae4cb-b126-40b2-bd5b-6091b380977d": "Security Administrator",
 	"5d6b6bb7-de71-4623-b4af-96380a352509": "Security Reader",
 	"5f2222b1-57c3-48ba-8ad5-d4759f1fde6f": "Security Operator",
 	"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3": "Application Administrator",
 	"158c047a-c907-4556-b7ef-446551a6b5f7": "Cloud Application Administrator",
 	"cf1c38e5-3621-4004-a7cb-879624dced7c": "Application Developer",
 	"fe930be7-5e62-47db-91af-98c3a49a38b1": "User Administrator",
 	"fdd7a751-b60b-444a-984c-02652fe8fa1c": "Groups Administrator",
 	"729827e3-9c14-49f7-bb1b-9608f156bbb8": "Helpdesk Administrator",
 	"966707d0-3269-4727-9be2-8c3a10f19b9d": "Password Administrator",
 	"c4e39bd9-1100-46d3-8c65-fb160da0071f": "Authentication Administrator",
 	"0526716b-113d-4c15-b2c8-68e3c22b9f80": "Authentication Policy Administrator",
 	"8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2": "Hybrid Identity Administrator",
 	"b0f54661-2d74-4c50-afa3-1ec803f12efe": "Billing Administrator",
 	"4d6ac14f-3453-41d0-bef9-a3e0c569773a": "License Administrator",
 	"17315797-102d-40b4-93e0-432062caca18": "Compliance Administrator",
 	"29232cdf-9323-42fd-ade2-1d097af3e4de": "Exchange Administrator",
 	"f28a1f50-f6e7-4571-818b-6a12f2af6b6c": "SharePoint Administrator",
 	"69091246-20e8-4a56-aa4d-066075b2a7a8": "Teams Administrator",
 	"3a2c62db-5318-420d-8d74-23affee5d9d5": "Intune Administrator",
 	"11648597-926c-4cf3-9c36-bcebb0ba8dcc": "Power Platform Administrator",
 	"e3973bdf-4987-49ae-837a-ba8e231c7286": "Azure DevOps Administrator",
 	"9360feb5-f418-4baa-8175-e2a00bac4301": "Directory Writers",
 	"88d8e3e3-8f55-4a1e-953a-9b9898b8876b": "Directory Readers",
 	"95e79109-95c0-4d8e-aee3-d01accf2d47b": "Guest Inviter",
 }
 // memberRole is in every member's token: not worth listing.
 const memberRole = "b79fbf4d-3ef9-4689-8143-76b194e85509"
 // directoryRoles names the roles in a wids claim: built-in ones by name,
 // others by their ID's first part.
 func directoryRoles(wids any) string {
 	list, _ := wids.([]any)
 	var names []string
 	for _, w := range list {
 		id, _ := w.(string)
 		switch name, ok := builtinRoles[strings.ToLower(id)]; {
 		case id == "" || id == memberRole:
 		case ok:
 			names = append(names, name)
 		default:
 			short, _, _ := strings.Cut(id, "-")
 			names = append(names, "role "+short)
 		}
 	}
 	slices.Sort(names)
 	return strings.Join(names, ", ")
 }
@@ -0,0 +1,67 @@
 package azure
 import (
 	"testing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 func TestAccount(t *testing.T) {
 	claims := map[string]any{
 		"name": "Alice Example", "oid": "11111111-2222-3333-4444-555555555555",
 		"amr":  []any{"pwd", "mfa"},
 		"wids": []any{"62e90394-69f5-4237-9190-012177145e10", memberRole, "aaaaaaaa-0000-0000-0000-000000000000"},
 	}
 	p := &Provider{account: &accountDetails{
 		account: account{user: "alice@contoso.com", tenant: "t1", tenantName: "Contoso", subscriptions: 3, defaultSub: "platform"},
 		claims:  func() map[string]any { return claims },
 	}}
 	a, ok := p.Account()
 	if !ok {
 		t.Fatal("no account")
 	}
 	got := map[string]string{}
 	for _, f := range a.Fields {
 		got[f.Label] = f.Value
 	}
 	want := map[string]string{
 		"name": "Alice Example", "user": "alice@contoso.com", "tenant": "Contoso", "tenant ID": "t1",
 		"object ID": "11111111-2222-3333-4444-555555555555", "sign-in": "MFA · password",
 		"roles": "Global Administrator, role aaaaaaaa", "subs": "3 · default platform",
 	}
 	for k, v := range want {
 		if got[k] != v {
 			t.Errorf("%s = %q, want %q", k, got[k], v)
 		}
 	}
 	if len(got) != len(want) {
 		t.Errorf("fields %v", got)
 	}
 	if a.Copy != claims["oid"] || a.CopyLabel != "object ID" {
 		t.Errorf("copy %q %q", a.Copy, a.CopyLabel)
 	}
 	// Before any token: what az's list says.
 	claims = nil
 	a, _ = p.Account()
 	if len(a.Fields) != 4 || a.Copy != "" {
 		t.Errorf("without a token: %+v", a)
 	}
 	if _, ok := (&Provider{}).Account(); ok {
 		t.Error("a service principal from AZURE_* has no account details")
 	}
 	var _ provider.Accounts = p
 }
 func TestSignInMethods(t *testing.T) {
 	for want, amr := range map[string][]any{
 		"MFA · password":                     {"pwd", "mfa"},
 		"MFA · Windows Hello or certificate": {"rsa", "ngcmfa"},
 		"no MFA · password":                  {"pwd"},
 		"":                                   nil,
 	} {
 		if got := signInMethods(amr); got != want {
 			t.Errorf("%v: %q, want %q", amr, got, want)
 		}
 	}
 }
@@ -19,7 +19,10 @@ import (
 // account is one az CLI identity in one tenant.
 type account struct {
 	user, tenant  string
 	userType      string // "user" or "servicePrincipal"
 	tenantName    string
 	cloud         string // az's environment: AzureCloud, AzureChinaCloud, …
 	defaultSub    string // az's default subscription's name, if this account's
 	anchor        string // a subscription az maps to this account, to pin it
 	anchorEnabled bool
 	isDefault     bool
@@ -52,12 +55,15 @@ func readAccounts(path string) ([]account, error) {
 	var profile struct {
 		Subscriptions []struct {
 			ID         string `json:"id"`
 			Name       string `json:"name"`
 			State      string `json:"state"`
 			IsDefault  bool   `json:"isDefault"`
 			TenantID   string `json:"tenantId"`
 			TenantName string `json:"tenantDisplayName"`
 			Cloud      string `json:"environmentName"`
 			User       struct {
 				Name string `json:"name"`
 				Type string `json:"type"`
 			} `json:"user"`
 		} `json:"subscriptions"`
 	}
@@ -72,7 +78,7 @@ func readAccounts(path string) ([]account, error) {
 		}
 		i := slices.IndexFunc(out, func(a account) bool { return a.user == s.User.Name && a.tenant == s.TenantID })
 		if i < 0 {
-			out = append(out, account{user: s.User.Name, tenant: s.TenantID, tenantName: s.TenantName})
+			out = append(out, account{user: s.User.Name, tenant: s.TenantID, tenantName: s.TenantName, userType: s.User.Type, cloud: s.Cloud})
 			i = len(out) - 1
 		}
 		a := &out[i]
@@ -82,12 +88,21 @@ func readAccounts(path string) ([]account, error) {
 		enabled := s.State == "Enabled"
 		switch {
 		case s.IsDefault:
-			a.anchor, a.anchorEnabled, a.isDefault = s.ID, enabled, true
+			a.anchor, a.anchorEnabled, a.isDefault, a.defaultSub = s.ID, enabled, true, s.Name
 		case a.isDefault:
 		case a.anchor == "" || enabled && !a.anchorEnabled:
 			a.anchor, a.anchorEnabled = s.ID, enabled
 		}
 	}
 	// az leaves the tenant's name out of some entries: take it from
 	// another in the same tenant.
 	for i := range out {
 		for _, b := range out {
 			if out[i].tenantName == "" && b.tenant == out[i].tenant {
 				out[i].tenantName = b.tenantName
 			}
 		}
 	}
 	slices.SortStableFunc(out, func(a, b account) int {
 		if a.isDefault != b.isDefault {
 			if a.isDefault {
@@ -179,6 +194,7 @@ func NewAccounts(s Settings) ([]*Provider, error) {
 		if err != nil {
 			return nil, err
 		}
 		p.account = &accountDetails{account: a, claims: cred.cred.(*cliCredential).claims}
 		if label != "" {
 			p.id = string(provider.KindAzure) + ":" + a.user + "/" + a.tenant
 			p.label = label
@@ -181,11 +181,11 @@ func TestTokenUser(t *testing.T) {
 		`{"upn":"alice@contoso.com"}`:                      false,
 		`{"appid":"00000000-0000-0000-0000-000000000000"}`: false,
 	} {
-		if _, got := tokenUser(jwt(claims), users); got != want {
+		if _, got := tokenUser(tokenClaims(jwt(claims)), users); got != want {
 			t.Errorf("%s: %v", claims, got)
 		}
 	}
-	if _, got := tokenUser("not-a-jwt", users); got {
+	if _, got := tokenUser(tokenClaims("not-a-jwt"), users); got {
 		t.Error("not a JWT")
 	}
 }
@@ -16,10 +16,11 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates"
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
@@ -36,10 +37,11 @@ var objectTypes = []provider.ObjectType{provider.TypeSecret, provider.TypeKey, p
 type Provider struct {
 	id, label string // "" for the single-account defaults
-	cred  azcore.TokenCredential
+	cred    azcore.TokenCredential
-	opts  options
+	opts    options
-	subs  *armsubscriptions.Client
+	account *accountDetails // nil for a service principal from AZURE_*
-	graph *armresourcegraph.Client
+	subs    *armsubscriptions.Client
 	graph   *armresourcegraph.Client
 	mu      sync.Mutex
 	vaults  map[string]*vaultClients // by vault URL
@@ -98,13 +100,7 @@ func (p *Provider) Label() string { return cmp.Or(p.label, string(provider.KindA
 // Sources lists the subscriptions the signed-in identity can see, skipping
 // disabled and deleted ones.
 func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
-	var out []provider.Source
+	out, err := all(ctx, p.subs.NewListPager(nil), func(page armsubscriptions.ClientListResponse) (srcs []provider.Source) {
 	pager := p.subs.NewListPager(nil)
 	for pager.More() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return nil, cleanError(err)
 		}
 		for _, s := range page.Value {
 			switch deref(s.State) {
 			case armsubscriptions.SubscriptionStateDisabled, armsubscriptions.SubscriptionStateDeleted:
@@ -117,7 +113,7 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 			p.mu.Lock()
 			p.tenants[id] = tenant
 			p.mu.Unlock()
-			out = append(out, provider.Source{
+			srcs = append(srcs, provider.Source{
 				Kind:   provider.KindAzure,
 				ID:     id,
 				Name:   deref(s.DisplayName),
@@ -125,6 +121,10 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 				URL:    PortalResourceURL(tenant, "/subscriptions/"+id, "overview"),
 			})
 		}
 		return srcs
 	})
 	if err != nil {
 		return nil, err
 	}
 	slices.SortFunc(out, func(a, b provider.Source) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	if len(p.opts.Vaults) > 0 {
@@ -182,10 +182,6 @@ func (p *Provider) tenant(subscriptionID string) string {
 	return p.tenants[subscriptionID]
 }
 const vaultQuery = `resources
 | where type =~ 'microsoft.keyvault/vaults'
 | project id, name, uri = tostring(properties.vaultUri)`
 func (p *Provider) graphVaults(ctx context.Context, src provider.Source) ([]provider.Container, error) {
 	var out []provider.Container
 	req := armresourcegraph.QueryRequest{
@@ -225,7 +221,7 @@ func graphVault(src provider.Source, row any) (provider.Container, bool) {
 	if id == "" || name == "" || uri == "" {
 		return provider.Container{}, false
 	}
-	return provider.Container{Source: src, ID: id, Name: name, Detail: uri, Types: objectTypes}, true
+	return provider.Container{Source: src, ID: id, Name: name, Detail: uri, Types: objectTypes, Attrs: graphInfo(m).attrs()}, true
 }
 func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provider.Container, error) {
@@ -233,22 +229,29 @@ func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provid
 	if err != nil {
 		return nil, err
 	}
-	var out []provider.Container
+	return all(ctx, client.NewListBySubscriptionPager(nil), func(page armkeyvault.VaultsClientListBySubscriptionResponse) (vaults []provider.Container) {
-	pager := client.NewListBySubscriptionPager(nil)
+		for _, v := range page.Value {
 			if v.Properties == nil || v.Properties.VaultURI == nil {
 				continue
 			}
 			vaults = append(vaults, provider.Container{
 				Source: src, ID: deref(v.ID), Name: deref(v.Name),
 				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
 			})
 		}
 		return vaults
 	})
 }
 // all lists every page, items picking out what to keep of each.
 func all[P, T any](ctx context.Context, pager *runtime.Pager[P], items func(P) []T) ([]T, error) {
 	var out []T
 	for pager.More() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return nil, cleanError(err)
 		}
-		for _, v := range page.Value {
+		out = append(out, items(page)...)
 			if v.Properties == nil || v.Properties.VaultURI == nil {
 				continue
 			}
 			out = append(out, provider.Container{
 				Source: src, ID: deref(v.ID), Name: deref(v.Name),
 				Detail: *v.Properties.VaultURI, Types: objectTypes,
 			})
 		}
 	}
 	return out, nil
 }
@@ -291,51 +294,40 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 	var out []provider.Object
 	switch t {
 	case provider.TypeSecret:
-		pager := vc.secrets.NewListSecretPropertiesPager(nil)
+		tenant := p.tenant(c.Source.ID)
-		for pager.More() {
+		out, err = all(ctx, vc.secrets.NewListSecretPropertiesPager(nil), func(page azsecrets.ListSecretPropertiesResponse) (objs []provider.Object) {
 			page, err := pager.NextPage(ctx)
 			if err != nil {
 				return nil, cleanError(err)
 			}
 			for _, s := range page.Value {
 				// Certificate-backing secrets appear under Certificates.
-				if s.ID == nil || deref(s.Managed) {
+				if s.ID != nil && !deref(s.Managed) {
-					continue
+					objs = append(objs, secretObject(c, s, tenant))
 				}
 				out = append(out, secretObject(c, s))
 			}
-		}
+			return objs
 		})
 	case provider.TypeKey:
-		pager := vc.keys.NewListKeyPropertiesPager(nil)
+		out, err = all(ctx, vc.keys.NewListKeyPropertiesPager(nil), func(page azkeys.ListKeyPropertiesResponse) (objs []provider.Object) {
 		for pager.More() {
 			page, err := pager.NextPage(ctx)
 			if err != nil {
 				return nil, cleanError(err)
 			}
 			for _, k := range page.Value {
-				if k.KID == nil || deref(k.Managed) {
+				if k.KID != nil && !deref(k.Managed) {
-					continue
+					objs = append(objs, keyObject(c, k))
 				}
 				out = append(out, keyObject(c, k))
 			}
-		}
+			return objs
 		})
 	case provider.TypeCertificate:
-		pager := vc.certs.NewListCertificatePropertiesPager(nil)
+		out, err = all(ctx, vc.certs.NewListCertificatePropertiesPager(nil), func(page azcertificates.ListCertificatePropertiesResponse) (objs []provider.Object) {
 		for pager.More() {
 			page, err := pager.NextPage(ctx)
 			if err != nil {
 				return nil, cleanError(err)
 			}
 			for _, cp := range page.Value {
-				if cp.ID == nil {
+				if cp.ID != nil {
-					continue
+					objs = append(objs, certObject(c, cp))
 				}
 				out = append(out, certObject(c, cp))
 			}
-		}
+			return objs
 		})
 	default:
 		return nil, provider.ErrUnsupported
 	}
 	if err != nil {
 		return nil, err
 	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	return out, nil
 }
@@ -356,7 +348,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		if resp.Key != nil {
 			if resp.Key.KID != nil {
 				o.Version = resp.Key.KID.Version()
-				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Key", string(*resp.Key.KID))
+				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.Key.KID))
 			}
 			o.Attrs = keyAttrs(resp.Key)
 		}
@@ -367,7 +359,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		}
 		if resp.ID != nil {
 			o.Version = resp.ID.Version()
-			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Certificate", string(*resp.ID))
+			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.ID))
 		}
 		if pol := resp.Policy; pol != nil && pol.SecretProperties != nil {
 			o.ContentType = deref(pol.SecretProperties.ContentType)
@@ -384,52 +376,47 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	if err != nil {
 		return nil, err
 	}
 	tenant := p.tenant(o.Container.Source.ID)
 	var out []provider.Object
 	switch o.Type {
 	case provider.TypeSecret:
-		pager := vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil)
+		out, err = all(ctx, vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil), func(page azsecrets.ListSecretPropertiesVersionsResponse) (objs []provider.Object) {
 		for pager.More() {
 			page, err := pager.NextPage(ctx)
 			if err != nil {
 				return nil, cleanError(err)
 			}
 			for _, s := range page.Value {
 				if s.ID != nil {
-					out = append(out, secretObject(o.Container, s))
+					objs = append(objs, secretObject(o.Container, s, tenant))
 				}
 			}
-		}
+			return objs
 		})
 	case provider.TypeKey:
-		pager := vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil)
+		out, err = all(ctx, vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil), func(page azkeys.ListKeyPropertiesVersionsResponse) (objs []provider.Object) {
 		for pager.More() {
 			page, err := pager.NextPage(ctx)
 			if err != nil {
 				return nil, cleanError(err)
 			}
 			for _, k := range page.Value {
 				if k.KID != nil {
-					out = append(out, keyObject(o.Container, k))
+					objs = append(objs, keyObject(o.Container, k))
 				}
 			}
-		}
+			return objs
 		})
 	case provider.TypeCertificate:
-		pager := vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil)
+		out, err = all(ctx, vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil), func(page azcertificates.ListCertificatePropertiesVersionsResponse) (objs []provider.Object) {
 		for pager.More() {
 			page, err := pager.NextPage(ctx)
 			if err != nil {
 				return nil, cleanError(err)
 			}
 			for _, cp := range page.Value {
 				if cp.ID != nil {
-					out = append(out, certObject(o.Container, cp))
+					objs = append(objs, certObject(o.Container, cp))
 				}
 			}
-		}
+			return objs
 		})
 	default:
 		return nil, provider.ErrUnsupported
 	}
 	if err != nil {
 		return nil, err
 	}
 	for i := range out {
 		out[i].Reference = versionedReference(out[i])
 		if o.Type != provider.TypeSecret { // secretObject's is the version's already
 			out[i].URL = portalAssetURL(tenant, o.Type, out[i].ID+"/"+out[i].Version) // the version's page
 		}
 	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return b.Updated.Compare(a.Updated) })
 	return out, nil
@@ -450,41 +437,55 @@ func versionedReference(o provider.Object) string {
 // Value returns a secret's value, a key's public key or a certificate's
 // public certificate, as of o.Version (latest if empty).
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	v, _, err := p.VersionedValue(ctx, o)
 	return v, err
 }
 // VersionedValue is Value, with the version read.
 func (p *Provider) VersionedValue(ctx context.Context, o provider.Object) (provider.SecretValue, string, error) {
 	vc, err := p.clients(o.Container.Detail)
 	if err != nil {
-		return provider.SecretValue{}, err
+		return provider.SecretValue{}, "", err
 	}
 	var text string
 	switch o.Type {
 	case provider.TypeSecret:
 		resp, err := vc.secrets.GetSecret(ctx, o.Name, o.Version, nil)
 		if err != nil {
-			return provider.SecretValue{}, cleanError(err)
+			return provider.SecretValue{}, "", cleanError(err)
 		}
-		return provider.NewSecretValue([]byte(deref(resp.Value))), nil
+		version := o.Version
 		if resp.ID != nil {
 			version = resp.ID.Version()
 		}
 		return provider.NewSecretValue([]byte(deref(resp.Value))), version, nil
 	case provider.TypeKey:
 		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
 		if err != nil {
-			return provider.SecretValue{}, cleanError(err)
+			return provider.SecretValue{}, "", cleanError(err)
 		}
-		pemKey, err := publicKeyPEM(resp.Key)
+		if text, err = publicKeyPEM(resp.Key); err != nil {
-		if err != nil {
+			return provider.SecretValue{}, "", err
 			return provider.SecretValue{}, err
 		}
 		return provider.NewSecretValue([]byte(pemKey)), nil
 	case provider.TypeCertificate:
 		resp, err := vc.certs.GetCertificate(ctx, o.Name, o.Version, nil)
 		if err != nil {
-			return provider.SecretValue{}, cleanError(err)
+			return provider.SecretValue{}, "", cleanError(err)
 		}
 		if len(resp.CER) == 0 {
-			return provider.SecretValue{}, errors.New("certificate has no public certificate yet (pending issuance?)")
+			return provider.SecretValue{}, "", errors.New("certificate has no public certificate yet (pending issuance?)")
 		}
-		return provider.NewSecretValue([]byte(certPEM(resp.CER))), nil
+		text = certPEM(resp.CER)
 	default:
 		return provider.SecretValue{}, "", provider.ErrUnsupported
 	}
-	return provider.SecretValue{}, provider.ErrUnsupported
+	return provider.NewSecretValue([]byte(text)), o.Version, nil
 }
-var _ provider.Locator = (*Provider)(nil)
+var (
 	_ provider.Locator   = (*Provider)(nil)
 	_ provider.Versioned = (*Provider)(nil)
 )
 // validHost guards the Resource Graph query against odd input.
 var validHost = regexp.MustCompile(`^[a-z0-9.-]+$`)
@@ -19,6 +19,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"reflect"
 	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -29,6 +30,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
@@ -174,8 +176,11 @@ func TestForbiddenIsShortened(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error")
 	}
-	if got, want := err.Error(), "403 Forbidden: Caller is not authorized to perform action on resource."; got != want {
+	if got, want := err.Error(), "403 Forbidden: Caller is not authorized to perform action on resource.\n\nCheck:\n• your role or group is activated in PIM\n• "; !strings.HasPrefix(got, want) {
-		t.Errorf("error = %q, want %q", got, want)
+		t.Errorf("error = %q, want %q…", got, want)
 	}
 	if checks := deniedChecks("Client address is not authorized and caller is not a trusted service."); !strings.Contains(checks[0], "network") {
 		t.Errorf("firewall checks = %q", checks)
 	}
 	var re *azcore.ResponseError
 	if !errors.As(err, &re) || re.StatusCode != 403 {
@@ -183,6 +188,13 @@ func TestForbiddenIsShortened(t *testing.T) {
 	}
 }
 func TestShortenPolicyDenied(t *testing.T) {
 	msg := "The user, group or application 'appid=04b07795;oid=1234;numgroups=83;iss=https://sts.windows.net/t/' does not have secrets list permission on key vault 'kv-app;location=norwayeast'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287"
 	if got := shortenDenied(msg); got != "no secrets list permission in the vault's access policies" {
 		t.Errorf("shortenDenied = %q", got)
 	}
 }
 func TestShortenDenied(t *testing.T) {
 	msg := "Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.\r\nCaller: appid=04b07795;oid=1234\r\nAction: 'Microsoft.KeyVault/vaults/secrets/readMetadata/action'\r\nResource: '/subscriptions/x/vaults/kv'"
 	want := "Caller is not authorized to perform action on resource; missing Microsoft.KeyVault/vaults/secrets/readMetadata/action"
@@ -323,6 +335,21 @@ func TestPortalURLs(t *testing.T) {
 	}
 }
 func TestSecretPages(t *testing.T) {
 	c := provider.Container{Detail: "https://kv-app.vault.azure.net/"}
 	base := "https://portal.azure.com/#@contoso.onmicrosoft.com/asset/Microsoft_Azure_KeyVault/Secret/https://kv-app.vault.azure.net/secrets/db"
 	for id, want := range map[string]string{
 		"https://kv-app.vault.azure.net/secrets/db":                                  base,                                       // listed: the secret's page
 		"https://kv-app.vault.azure.net/secrets/db/06140fa2b9a64869a96ef040f6d4dcab": base + "/06140fa2b9a64869a96ef040f6d4dcab", // a version's
 	} {
 		sid := azsecrets.ID(id)
 		o := secretObject(c, &azsecrets.SecretProperties{ID: &sid}, "contoso.onmicrosoft.com")
 		if o.URL != want {
 			t.Errorf("%s: %q, want %q", id, o.URL, want)
 		}
 	}
 }
 func TestVersionedReference(t *testing.T) {
 	sec := provider.Object{Type: provider.TypeSecret, Version: "v1",
 		Reference: "@Microsoft.KeyVault(SecretUri=https://kv.vault.azure.net/secrets/s)"}
@@ -417,3 +444,49 @@ func ecPoint(t *testing.T, k *ecdsa.PrivateKey) (x, y []byte) {
 	size := (len(b) - 1) / 2
 	return b[1 : 1+size], b[1+size:]
 }
 func TestVaultSettings(t *testing.T) {
 	want := []string{"group=rg-sec", "location=norwayeast", "SKU=premium", "access=Azure roles (RBAC)",
 		"soft delete=on, 30 days", "purge prot.=on", "network=selected networks (1 IP ranges, 0 subnets)",
 		"private=1 endpoint", "tags=env: prod", "=team: platform"}
 	check := func(name string, attrs []provider.Attr) {
 		t.Helper()
 		var got []string
 		for _, a := range attrs {
 			got = append(got, a.Label+"="+a.Value)
 		}
 		if !slices.Equal(got, want) {
 			t.Errorf("%s\n got %q\nwant %q", name, got, want)
 		}
 	}
 	// Resource Graph: the query's columns, as JSON gives them.
 	c, ok := graphVault(provider.Source{ID: "s"}, map[string]any{
 		"id": "/x/kv", "name": "kv", "uri": "https://kv.vault.azure.net/", "location": "norwayeast",
 		"resourceGroup": "rg-sec", "tags": map[string]any{"team": "platform", "env": "prod"},
 		"sku": "premium", "rbac": true, "softDelete": nil, "retention": 30.0, "purge": true,
 		"publicAccess": "", "defaultAction": "Deny", "ipRules": 1.0, "subnets": 0.0, "endpoints": 1.0, "policies": 0.0,
 	})
 	if !ok {
 		t.Fatal("row not read")
 	}
 	check("resource graph", c.Attrs)
 	// The management API, when Resource Graph fails.
 	id := "/subscriptions/s/resourceGroups/rg-sec/providers/Microsoft.KeyVault/vaults/kv"
 	p, _ := fakeAzure(t, staticCred{}, func(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, 200, map[string]any{"value": []any{map[string]any{"id": id, "name": "kv", "location": "norwayeast",
 			"tags": map[string]any{"team": "platform", "env": "prod"},
 			"properties": map[string]any{
 				"tenantId": "t", "vaultUri": "https://kv.vault.azure.net/", "sku": map[string]any{"family": "A", "name": "premium"},
 				"enableRbacAuthorization": true, "enablePurgeProtection": true, "softDeleteRetentionInDays": 30,
 				"networkAcls":                map[string]any{"defaultAction": "Deny", "ipRules": []any{map[string]any{"value": "10.0.0.0/8"}}},
 				"privateEndpointConnections": []any{map[string]any{"id": "pe1"}},
 			}}}})
 	})
 	vaults, err := p.armVaults(context.Background(), provider.Source{ID: "s"})
 	if err != nil || len(vaults) != 1 {
 		t.Fatalf("arm: %v %v", vaults, err)
 	}
 	check("management API", vaults[0].Attrs)
 }
@@ -42,6 +42,16 @@ type cliCredential struct {
 	mu    sync.Mutex
 	cache map[string]azcore.AccessToken // by resource and tenant argument
 	// last is the claims of the latest token in the account's own
 	// tenant, to describe the account (Provider.Account).
 	last map[string]any
 }
 // claims are the latest token's claims, nil before the first.
 func (c *cliCredential) claims() map[string]any {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	return c.last
 }
 func newCLICredential(user, tenant string, accounts func() ([]account, error)) *cliCredential {
@@ -110,29 +120,38 @@ func (c *cliCredential) GetToken(ctx context.Context, opts policy.TokenRequestOp
 	if err != nil {
 		return azcore.AccessToken{}, err
 	}
-	if u, ok := tokenUser(tok.Token, others); ok {
+	claims := tokenClaims(tok.Token)
 	if u, ok := tokenUser(claims, others); ok {
 		return azcore.AccessToken{}, fmt.Errorf("az gave a token for %s, not %s: sign in as %s again", u, c.user, c.user)
 	}
 	if !otherTenant && claims != nil {
 		c.last = claims
 	}
 	c.cache[key] = tok
 	return tok, nil
 }
-// tokenUser reports which of users a token was issued to, if any, from
+// tokenClaims reads a JWT's claims, without verifying it: they only
-// its claims. The token isn't verified: this only catches az picking the
+// describe the account and catch az picking the wrong one. nil if it
-// wrong signed-in account.
+// isn't a JWT.
-func tokenUser(token string, users []string) (string, bool) {
+func tokenClaims(token string) map[string]any {
 	parts := strings.Split(token, ".")
-	if len(parts) != 3 || len(users) == 0 {
+	if len(parts) != 3 {
-		return "", false
+		return nil
 	}
 	b, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(parts[1], "="))
 	if err != nil {
-		return "", false
+		return nil
 	}
 	var claims map[string]any
 	if json.Unmarshal(b, &claims) != nil {
-		return "", false
+		return nil
 	}
 	return claims
 }
 // tokenUser reports which of users a token's claims are for, if any.
 func tokenUser(claims map[string]any, users []string) (string, bool) {
 	for _, name := range []string{"upn", "unique_name", "preferred_username", "email"} {
 		v, _ := claims[name].(string)
 		if i := strings.LastIndexByte(v, '#'); i >= 0 {
@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"math/big"
 	"net/http"
 	"regexp"
 	"strings"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
@@ -52,10 +53,10 @@ func PortalResourceURL(tenant, resourceID, blade string) string {
 	return portal + tenantPrefix(tenant) + "resource" + resourceID + "/" + blade
 }
-// portalAssetURL links to a Key Vault object's page; objectID must include
+// portalAssetURL links to a Key Vault object's page: a version's with
-// the version.
+// one in objectID; a secret's own (its versions) without.
-func portalAssetURL(tenant, kind, objectID string) string {
+func portalAssetURL(tenant string, t provider.ObjectType, objectID string) string {
-	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + kind + "/" + objectID
+	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + string(t) + "/" + objectID
 }
 func tenantPrefix(tenant string) string {
@@ -72,24 +73,21 @@ func ObjectListURL(c provider.Container, t provider.ObjectType) string {
 	if !ok {
 		return ""
 	}
-	switch t {
+	return base + "/" + t.Collection()
 	case provider.TypeKey:
 		return base + "/keys"
 	case provider.TypeCertificate:
 		return base + "/certificates"
 	}
 	return base + "/secrets"
 }
 // objectURL is the data-plane URL of an object, e.g.
 // https://kv.vault.azure.net/secrets/name.
-func objectURL(c provider.Container, collection, name string) string {
+func objectURL(c provider.Container, t provider.ObjectType, name string) string {
-	return strings.TrimSuffix(c.Detail, "/") + "/" + collection + "/" + name
+	return strings.TrimSuffix(c.Detail, "/") + "/" + t.Collection() + "/" + name
 }
-func secretObject(c provider.Container, p *azsecrets.SecretProperties) provider.Object {
+// secretObject is a secret, or a version of one, from a listing. Its URL
 // is its page in the portal: the secret's (with its versions), or with
 // a version, that version's.
 func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant string) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, "secrets", name)
+	url := objectURL(c, provider.TypeSecret, name)
 	o := provider.Object{
 		Container:   c,
 		Type:        provider.TypeSecret,
@@ -99,7 +97,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties) provider.
 		ContentType: deref(p.ContentType),
 		Tags:        tags(p.Tags),
 		Reference:   "@Microsoft.KeyVault(SecretUri=" + url + ")",
-		URL:         ObjectListURL(c, provider.TypeSecret),
+		URL:         portalAssetURL(tenant, provider.TypeSecret, strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
 	}
 	if a := p.Attributes; a != nil {
 		o.Enabled, o.Updated, o.Expires = a.Enabled, deref(a.Updated), deref(a.Expires)
@@ -109,7 +107,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties) provider.
 func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 	name := p.KID.Name()
-	url := objectURL(c, "keys", name)
+	url := objectURL(c, provider.TypeKey, name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeKey,
@@ -128,7 +126,7 @@ func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 func certObject(c provider.Container, p *azcertificates.CertificateProperties) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, "certificates", name)
+	url := objectURL(c, provider.TypeCertificate, name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeCertificate,
@@ -279,13 +277,24 @@ func cleanError(err error) error {
 			}
 		}
 	}
-	return &serviceError{status: re.StatusCode, msg: shortenDenied(msg), err: err}
+	se := &serviceError{status: re.StatusCode, msg: shortenDenied(msg), err: err}
 	if se.status == http.StatusForbidden {
 		return &provider.Denied{Err: se, Checks: deniedChecks(se.msg)}
 	}
 	return se
 }
 var policyDenied = regexp.MustCompile(`does not have (\w+ \w+) permission on key vault`)
 // shortenDenied reduces Key Vault's RBAC denial, which runs to several
 // sentences plus caller and resource IDs, to its first sentence and the
 // missing action.
 func shortenDenied(msg string) string {
 	// Access policies: "The user, group or application 'appid=…;oid=…'
 	// does not have secrets list permission on key vault 'kv;location=…'".
 	if m := policyDenied.FindStringSubmatch(msg); m != nil {
 		return "no " + m[1] + " permission in the vault's access policies"
 	}
 	const marker = "Action: '"
 	i := strings.Index(msg, marker)
 	if i < 0 {
@@ -317,4 +326,20 @@ func (e *serviceError) Error() string {
 	return s
 }
 // deniedChecks are what to check when Key Vault refuses: the network,
 // for its firewall's refusals, else access.
 func deniedChecks(msg string) []string {
 	if strings.Contains(msg, "Client address is not authorized") || strings.Contains(msg, "network access") ||
 		strings.Contains(msg, "private link") {
 		return []string{
 			"you're on a network the vault lets in (VPN, office)",
 			"the vault's owner has let your network in",
 		}
 	}
 	return []string{
 		"your role or group is activated in PIM",
 		"the vault's owner has given you access: a Key Vault role, or its access policies",
 	}
 }
 func (e *serviceError) Unwrap() error { return e.err }
@@ -0,0 +1,158 @@
 package azure
 import (
 	"fmt"
 	"maps"
 	"slices"
 	"strings"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // A vault's settings come with the listing, from Resource Graph or the
 // Key Vault management API, with no requests of their own: where it is,
 // how access to it works, and how it's protected.
 type vaultInfo struct {
 	group, location, sku        string
 	rbac, softDelete, purge     *bool
 	retention                   *int32
 	publicAccess, defaultAction string
 	ipRules, subnets, endpoints int
 	policies                    int
 	tags                        map[string]string
 }
 // vaultQuery lists vaults with just the settings shown, not their whole
 // properties (access policies can be long).
 const vaultQuery = `resources
 | where type =~ 'microsoft.keyvault/vaults'
 | project id, name, uri = tostring(properties.vaultUri), location, resourceGroup, tags,
  sku = tostring(properties.sku.name), rbac = properties.enableRbacAuthorization,
  softDelete = properties.enableSoftDelete, retention = properties.softDeleteRetentionInDays,
  purge = properties.enablePurgeProtection, publicAccess = tostring(properties.publicNetworkAccess),
  defaultAction = tostring(properties.networkAcls.defaultAction),
  ipRules = array_length(properties.networkAcls.ipRules),
  subnets = array_length(properties.networkAcls.virtualNetworkRules),
  endpoints = array_length(properties.privateEndpointConnections),
  policies = array_length(properties.accessPolicies)`
 // graphInfo reads a vaultQuery row's settings.
 func graphInfo(m map[string]any) vaultInfo {
 	str := func(k string) string { s, _ := m[k].(string); return s }
 	num := func(k string) int { f, _ := m[k].(float64); return int(f) }
 	flag := func(k string) *bool {
 		if b, ok := m[k].(bool); ok {
 			return &b
 		}
 		return nil
 	}
 	v := vaultInfo{
 		group: str("resourceGroup"), location: str("location"), sku: str("sku"),
 		rbac: flag("rbac"), softDelete: flag("softDelete"), purge: flag("purge"),
 		publicAccess: str("publicAccess"), defaultAction: str("defaultAction"),
 		ipRules: num("ipRules"), subnets: num("subnets"), endpoints: num("endpoints"), policies: num("policies"),
 	}
 	if f, ok := m["retention"].(float64); ok {
 		r := int32(f)
 		v.retention = &r
 	}
 	if tags, ok := m["tags"].(map[string]any); ok {
 		v.tags = map[string]string{}
 		for k, t := range tags {
 			v.tags[k] = fmt.Sprint(t)
 		}
 	}
 	return v
 }
 // armInfo reads a vault's settings from the management API.
 func armInfo(v *armkeyvault.Vault) vaultInfo {
 	info := vaultInfo{location: deref(v.Location), tags: tags(v.Tags)}
 	if id, err := arm.ParseResourceID(deref(v.ID)); err == nil {
 		info.group = id.ResourceGroupName
 	}
 	pr := v.Properties
 	if pr == nil {
 		return info
 	}
 	if pr.SKU != nil && pr.SKU.Name != nil {
 		info.sku = string(*pr.SKU.Name)
 	}
 	info.rbac, info.softDelete, info.purge = pr.EnableRbacAuthorization, pr.EnableSoftDelete, pr.EnablePurgeProtection
 	info.retention, info.publicAccess = pr.SoftDeleteRetentionInDays, deref(pr.PublicNetworkAccess)
 	if acl := pr.NetworkACLs; acl != nil {
 		if acl.DefaultAction != nil {
 			info.defaultAction = string(*acl.DefaultAction)
 		}
 		info.ipRules, info.subnets = len(acl.IPRules), len(acl.VirtualNetworkRules)
 	}
 	info.endpoints, info.policies = len(pr.PrivateEndpointConnections), len(pr.AccessPolicies)
 	return info
 }
 func (v vaultInfo) attrs() []provider.Attr {
 	var out []provider.Attr
 	add := func(label, value string) {
 		if value != "" {
 			out = append(out, provider.Attr{Label: label, Value: value})
 		}
 	}
 	add("group", v.group)
 	add("location", v.location)
 	add("SKU", v.sku)
 	// Who may read secrets is decided by Azure roles or by the vault's
 	// own access policies, never both.
 	if on(v.rbac, false) {
 		add("access", "Azure roles (RBAC)")
 	} else {
 		add("access", fmt.Sprintf("access policies (%d)", v.policies))
 	}
 	if on(v.softDelete, true) {
 		days := int32(90)
 		if v.retention != nil {
 			days = *v.retention
 		}
 		add("soft delete", fmt.Sprintf("on, %d days", days))
 	} else {
 		add("soft delete", "off")
 	}
 	if on(v.purge, false) {
 		add("purge prot.", "on")
 	} else {
 		add("purge prot.", "off")
 	}
 	switch {
 	case strings.EqualFold(v.publicAccess, "disabled"):
 		add("network", "private endpoints only")
 	case strings.EqualFold(v.defaultAction, "deny"):
 		add("network", fmt.Sprintf("selected networks (%d IP ranges, %d subnets)", v.ipRules, v.subnets))
 	default:
 		add("network", "all networks")
 	}
 	switch {
 	case v.endpoints == 1:
 		add("private", "1 endpoint")
 	case v.endpoints > 1:
 		add("private", fmt.Sprintf("%d endpoints", v.endpoints))
 	}
 	for i, k := range slices.Sorted(maps.Keys(v.tags)) {
 		label := ""
 		if i == 0 {
 			label = "tags"
 		}
 		out = append(out, provider.Attr{Label: label, Value: k + ": " + v.tags[k]})
 	}
 	return out
 }
 // on is *b, or def when it isn't set.
 func on(b *bool, def bool) bool {
 	if b == nil {
 		return def
 	}
 	return *b
 }
@@ -203,17 +203,20 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 	return out, nil
 }
-// vaultURL is the backing vault of an AKV-backed scope, or "". It falls
+// fallbackVault is the backing vault of an AKV-backed scope, to read it
-// back to the scope's Detail, so a scope remembered from an earlier session
+// from when Databricks fails, or "" when there's none to fall back to. It
-// (a favourite) works before its workspace's scopes are listed.
+// falls back to the scope's Detail, so a scope remembered from an earlier
-func (p *Provider) vaultURL(c provider.Container) string {
+// session (a favourite) works before its workspace's scopes are listed.
 func (p *Provider) fallbackVault(ctx context.Context, c provider.Container) string {
 	if p.keyVault == nil || ctx.Err() != nil {
 		return ""
 	}
 	p.mu.Lock()
 	url := p.vaults[c.ID]
 	p.mu.Unlock()
 	if url == "" {
-		url, _ = strings.CutPrefix(c.Detail, akvDetail)
+		if detail, ok := strings.CutPrefix(c.Detail, akvDetail); ok {
-		if url == c.Detail {
+			url = detail
 			url = ""
 		}
 	}
 	return url
@@ -264,8 +267,8 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 // vaultObjects lists an AKV-backed scope's secrets from the vault itself.
 func (p *Provider) vaultObjects(ctx context.Context, c provider.Container) ([]provider.Object, error) {
-	url := p.vaultURL(c)
+	url := p.fallbackVault(ctx, c)
-	if url == "" || p.keyVault == nil || ctx.Err() != nil {
+	if url == "" {
 		return nil, errNoFallback
 	}
 	secrets, err := p.keyVault.Objects(ctx, provider.Container{Detail: url}, provider.TypeSecret)
@@ -302,8 +305,8 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	}
 	dbxErr := classify(pr, err)
-	url := p.vaultURL(o.Container)
+	url := p.fallbackVault(ctx, o.Container)
-	if url == "" || p.keyVault == nil || ctx.Err() != nil {
+	if url == "" {
 		return provider.SecretValue{}, dbxErr
 	}
 	v, kvErr := p.keyVault.Value(ctx, provider.Object{
@@ -317,15 +320,52 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return v, nil
 }
 // deniedChecks are what to check when Databricks refuses: the network,
 // when the workspace's IP access list refused, else access, and for a
 // profile signed in through az, which account az is on.
 func deniedChecks(pr profile, msg string) []string {
 	if strings.Contains(msg, "IP ACL") || strings.Contains(msg, "IP access list") {
 		return []string{
 			"you're on a network the workspace lets in (VPN, office)",
 			"the workspace's admin has let your network in",
 		}
 	}
 	var checks []string
 	if pr.authType == "azure-cli" {
 		checks = append(checks, "az is signed in as the account with access: profile "+pr.name+" uses your az login (az account show)")
 	}
 	return append(checks,
 		"you have access to the workspace",
 		"the scope's manager has given you READ on it, or a group you're in",
 	)
 }
 var errNoFallback = errors.New("no Key Vault fallback")
-// combine reports both the Databricks and the Key Vault failure. An auth
+// combine reports both the Databricks and the Key Vault failure, with
-// error from either stays reachable with errors.As.
+// both their checks after. An auth error from either stays reachable
 // with errors.As.
 func combine(dbxErr, kvErr error) error {
 	if errors.Is(kvErr, errNoFallback) {
 		return dbxErr
 	}
-	return fmt.Errorf("%w; Key Vault fallback: %w", dbxErr, kvErr)
+	var checks []string
 	strip := func(err error) error {
 		if d, ok := err.(*provider.Denied); ok {
 			for _, c := range d.Checks {
 				if !slices.Contains(checks, c) {
 					checks = append(checks, c)
 				}
 			}
 			return d.Err
 		}
 		return err
 	}
 	err := fmt.Errorf("%w; Key Vault fallback: %w", strip(dbxErr), strip(kvErr))
 	if len(checks) > 0 {
 		return &provider.Denied{Err: err, Checks: checks}
 	}
 	return err
 }
 // classify turns authentication failures into *provider.AuthError: a 401
@@ -336,6 +376,9 @@ func classify(pr profile, err error) error {
 	}
 	var api *apierr.APIError
 	if errors.As(err, &api) {
 		if api.StatusCode == 403 {
 			return &provider.Denied{Err: err, Checks: deniedChecks(pr, api.Message)}
 		}
 		if api.StatusCode != 401 {
 			return err
 		}
@@ -140,6 +140,8 @@ func workspaceAPI(t *testing.T, status int) *httptest.Server {
 				map[string]any{"key": "storage-key", "last_updated_timestamp": 1767225600000},
 				map[string]any{"key": "client-secret"},
 			}})
 		case r.URL.Path == "/api/2.0/secrets/list" && q.Get("scope") == "locked":
 			write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have READ permission on scope locked"})
 		case r.URL.Path == "/api/2.0/secrets/get" && q.Get("scope") == "app":
 			write(w, 200, map[string]any{"key": q.Get("key"),
 				"value": base64.StdEncoding.EncodeToString([]byte("value-of-" + q.Get("key")))})
@@ -291,3 +293,27 @@ func TestClassify(t *testing.T) {
 		t.Error("cancellation classified as auth")
 	}
 }
 func TestDeniedSaysWhatToCheck(t *testing.T) {
 	p := newTestProvider(t, workspaceAPI(t, 0), nil)
 	_, err := p.Objects(context.Background(), provider.Container{Source: provider.Source{ID: "prod"}, Name: "locked"}, provider.TypeSecret)
 	var d *provider.Denied
 	// The test profile signs in through az: that's the first check.
 	if !errors.As(err, &d) || !strings.Contains(err.Error(), "READ permission on scope locked\n\nCheck:\n• az is signed in as the account with access: profile prod uses your az login") ||
 		!strings.Contains(err.Error(), "\n• you have access to the workspace") {
 		t.Errorf("err %q", err)
 	}
 	if got := deniedChecks(profile{authType: "pat"}, "denied"); strings.Contains(got[0], "az") {
 		t.Errorf("a token profile's checks %q", got)
 	}
 	if got := deniedChecks(profile{}, "Source IP address: 1.2.3.4 is blocked by Databricks IP ACL for workspace: 1"); !strings.Contains(got[0], "network") {
 		t.Errorf("IP ACL checks %q", got)
 	}
 	// Both refused: one message, then both lists of checks.
 	err = combine(&provider.Denied{Err: errors.New("dbx"), Checks: []string{"a", "b"}},
 		&provider.Denied{Err: errors.New("kv"), Checks: []string{"b", "c"}})
 	if got := err.Error(); got != "dbx; Key Vault fallback: kv\n\nCheck:\n• a\n• b\n• c" {
 		t.Errorf("combined %q", got)
 	}
 }
@@ -24,6 +24,7 @@ type Provider struct {
 	errs       map[listKey]error
 	values     map[string]string            // by object ID
 	versions   map[string][]provider.Object // by object ID
 	details    map[string][]provider.Attr   // by container ID
 }
 type listKey struct {
@@ -47,19 +48,8 @@ func newProvider(kind provider.Kind, delay time.Duration) *Provider {
 func (p *Provider) Kind() provider.Kind { return p.kind }
-func (p *Provider) ID() string {
+func (p *Provider) ID() string    { return cmp.Or(p.id, string(p.kind)) }
-	if p.id != "" {
+func (p *Provider) Label() string { return cmp.Or(p.label, string(p.kind)) }
 		return p.id
 	}
 	return string(p.kind)
 }
 func (p *Provider) Label() string {
 	if p.label != "" {
 		return p.label
 	}
 	return string(p.kind)
 }
 // As renames the provider, to simulate several accounts of one kind.
 func (p *Provider) As(id, label string) *Provider {
@@ -101,7 +91,7 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	if err := p.wait(ctx); err != nil {
 		return nil, err
 	}
-	if p.kind == provider.KindDatabricks {
+	if p.kind != provider.KindAzure { // only Key Vault keeps versions
 		return nil, provider.ErrUnsupported
 	}
 	vs := p.versions[o.ID]
@@ -133,13 +123,14 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return provider.NewSecretValue([]byte(v)), nil
 }
-// Locate finds the source holding the vault (by host) or the workspace.
+// Locate finds the source holding the vault (by host), the workspace or
 // the repo (by its remote).
 func (p *Provider) Locate(ctx context.Context, host string) (string, bool, error) {
 	if err := p.wait(ctx); err != nil {
 		return "", false, err
 	}
 	for _, src := range p.sources {
-		if p.kind == provider.KindDatabricks && src.Detail == host {
+		if (p.kind == provider.KindDatabricks || p.kind == provider.KindRepo) && strings.EqualFold(src.Detail, host) {
 			return src.ID, true, nil
 		}
 		for _, c := range p.containers[src.ID] {
@@ -209,21 +200,32 @@ func (p *Provider) addContainer(src provider.Source, name, detail string, types
 	if p.kind == provider.KindDatabricks {
 		vault, _ = strings.CutPrefix(detail, "Azure Key Vault-backed: ")
 	}
-	if p.kind == provider.KindAzure || vault != detail {
+	if p.kind == provider.KindAzure || (p.kind == provider.KindDatabricks && vault != detail) {
 		c.URL = portal + "/subscriptions/sub/resourceGroups/rg/providers/Microsoft.KeyVault/vaults/" + vault + "/overview"
 	}
 	p.containers[src.ID] = append(p.containers[src.ID], c)
 	return c
 }
 // Expire sets when the object name in vault expires, for --demo: a date
 // relative to today in the test data would change the tests' screenshots
 // from day to day.
 func (p *Provider) Expire(vault, name string, at time.Time) {
 	for _, objs := range p.objects {
 		for i := range objs {
 			if objs[i].Container.Name == vault && objs[i].Name == name {
 				objs[i].Expires = at
 			}
 		}
 	}
 }
 func (p *Provider) add(c provider.Container, t provider.ObjectType, o provider.Object, value string) provider.Object {
 	o.Container = c
 	o.Type = t
 	o.ID = c.ID + "/" + strings.ToLower(string(t)) + "/" + o.Name
 	if base, ok := strings.CutSuffix(c.URL, "/overview"); ok {
-		o.URL = base + map[provider.ObjectType]string{
+		o.URL = base + "/" + t.Collection()
 			provider.TypeSecret: "/secrets", provider.TypeKey: "/keys", provider.TypeCertificate: "/certificates",
 		}[t]
 	}
 	k := listKey{c.ID, t}
 	p.objects[k] = append(p.objects[k], o)
@@ -237,11 +239,7 @@ func (p *Provider) fail(c provider.Container, err error, types ...provider.Objec
 	}
 }
-var (
+var base = time.Date(2026, 9, 1, 9, 30, 0, 0, time.UTC)
 	base = time.Date(2026, 9, 1, 9, 30, 0, 0, time.UTC)
 	yes  = true
 	no   = false
 )
 // ErrForbidden mimics a data-plane permission error from a backend.
 var ErrForbidden = errors.New("403 Forbidden: caller lacks permission to list secrets")
@@ -256,12 +254,13 @@ const (
 var allTypes = []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate}
 func secretRef(vault, name string) string {
 	return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
 }
 // Azure returns a fake Azure provider with two subscriptions.
 func Azure(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
 	secretRef := func(vault, name string) string {
 		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
 	}
 	objectURL := func(vault, kind, name string) string {
 		return fmt.Sprintf("https://%s.vault.azure.net/%s/%s", vault, kind, name)
 	}
@@ -269,28 +268,32 @@ func Azure(delay time.Duration) *Provider {
 	prod := p.addSource("sub-prod", "platform-prod", "tenant: example.onmicrosoft.com")
 	kv := p.addContainer(prod, "kv-app-prod", "https://kv-app-prod.vault.azure.net", allTypes...)
 	dbPassword := p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "db-password", Version: "3f9c2a", Enabled: &yes, Updated: base,
+		Name: "db-password", Version: "3f9c2a", Enabled: new(true), Updated: base,
 		Expires: base.AddDate(1, 0, 0), ContentType: "text/plain",
 		Tags: map[string]string{"owner": "data", "env": "prod"}, Reference: secretRef("kv-app-prod", "db-password"),
 	}, "correct-horse-battery-staple")
 	p.versions[dbPassword.ID] = []provider.Object{
-		{Version: "3f9c2a", Enabled: &yes, Updated: base, Expires: base.AddDate(1, 0, 0), ContentType: "text/plain"},
+		{Version: "3f9c2a", Enabled: new(true), Updated: base, Expires: base.AddDate(1, 0, 0), ContentType: "text/plain"},
-		{Version: "91d3e0", Enabled: &yes, Updated: base.AddDate(0, -6, 0), Expires: base.AddDate(0, -1, 0)},
+		{Version: "91d3e0", Enabled: new(true), Updated: base.AddDate(0, -6, 0), Expires: base.AddDate(0, -1, 0)},
-		{Version: "0a77c4", Enabled: &no, Updated: base.AddDate(-1, 0, 0)},
+		{Version: "0a77c4", Enabled: new(false), Updated: base.AddDate(-1, 0, 0)},
 	}
 	p.values[dbPassword.ID+"@91d3e0"] = "previous-password"
 	p.values[dbPassword.ID+"@0a77c4"] = "original-password"
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "api-key", Version: "a17b04", Enabled: &yes, Updated: base.AddDate(0, -2, 0),
+		Name: "api-key", Version: "a17b04", Enabled: new(true), Updated: base.AddDate(0, -2, 0),
 		Reference: secretRef("kv-app-prod", "api-key"),
 	}, "sk_live_51HxDEMO0000000000000000")
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "legacy-token", Version: "0c11de", Enabled: &no, Updated: base.AddDate(-1, 0, 0),
+		Name: "legacy-token", Version: "0c11de", Enabled: new(true), Updated: base.AddDate(-1, 0, 0),
-		Reference: secretRef("kv-app-prod", "legacy-token"),
+		Expires: base.AddDate(0, -3, 0), Reference: secretRef("kv-app-prod", "legacy-token"),
 	}, "deprecated")
 	p.add(kv, provider.TypeSecret, provider.Object{
 		Name: "smtp-password", Version: "7d2e90", Enabled: new(false), Updated: base.AddDate(0, -2, 0),
 		Reference: secretRef("kv-app-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	p.add(kv, provider.TypeKey, provider.Object{
-		Name: "signing-key", Version: "5e21b7", Enabled: &yes, Updated: base.AddDate(0, -3, 0),
+		Name: "signing-key", Version: "5e21b7", Enabled: new(true), Updated: base.AddDate(0, -3, 0),
 		Attrs: []provider.Attr{
 			{Label: "key type", Value: "RSA 2048"},
 			{Label: "ops", Value: "sign, verify"},
@@ -298,7 +301,7 @@ func Azure(delay time.Duration) *Provider {
 		Reference: objectURL("kv-app-prod", "keys", "signing-key"),
 	}, demoPublicKey)
 	p.add(kv, provider.TypeKey, provider.Object{
-		Name: "data-encryption", Version: "c40f19", Enabled: &yes, Updated: base.AddDate(0, -5, 0),
+		Name: "data-encryption", Version: "c40f19", Enabled: new(true), Updated: base.AddDate(0, -5, 0),
 		Attrs: []provider.Attr{
 			{Label: "key type", Value: "EC P-256"},
 			{Label: "ops", Value: "wrapKey, unwrapKey"},
@@ -307,7 +310,7 @@ func Azure(delay time.Duration) *Provider {
 	}, demoPublicKey)
 	p.add(kv, provider.TypeCertificate, provider.Object{
-		Name: "app-tls", Version: "77e0aa", Enabled: &yes, Updated: base.AddDate(0, -1, 0),
+		Name: "app-tls", Version: "77e0aa", Enabled: new(true), Updated: base.AddDate(0, -1, 0),
 		Expires: base.AddDate(0, 11, 0), ContentType: "application/x-pem-file",
 		Attrs: []provider.Attr{
 			{Label: "subject", Value: "CN=app.example.com"},
@@ -319,7 +322,7 @@ func Azure(delay time.Duration) *Provider {
 		Reference: objectURL("kv-app-prod", "certificates", "app-tls"),
 	}, demoCert)
 	p.add(kv, provider.TypeCertificate, provider.Object{
-		Name: "old-tls", Version: "19ab3c", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
+		Name: "old-tls", Version: "19ab3c", Enabled: new(true), Updated: base.AddDate(-1, 0, 0),
 		Expires: base.AddDate(0, -6, 0), ContentType: "application/x-pkcs12",
 		Attrs: []provider.Attr{
 			{Label: "subject", Value: "CN=old.example.com"},
@@ -330,8 +333,12 @@ func Azure(delay time.Duration) *Provider {
 	}, demoCert)
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
 	// A key to share env files with (S → f): random, as sharing.keyRules wants.
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "env-share", Enabled: new(true), Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
 	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")
 	p.add(shared, provider.TypeSecret, provider.Object{
 		Name: "smtp-password", Enabled: new(true), Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	p.fail(shared, ErrForbiddenKeys, provider.TypeKey)
@@ -341,8 +348,21 @@ func Azure(delay time.Duration) *Provider {
 	dev := p.addSource("sub-dev", "platform-dev", "tenant: example.onmicrosoft.com")
 	kvDev := p.addContainer(dev, "kv-app-dev", "https://kv-app-dev.vault.azure.net", allTypes...)
 	p.add(kvDev, provider.TypeSecret, provider.Object{
-		Name: "db-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
+		Name: "db-password", Enabled: new(true), Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
 	}, "dev-password")
 	// Left behind, as dev vaults are: expired, disabled, or both.
 	p.add(kvDev, provider.TypeSecret, provider.Object{
 		Name: "stripe-webhook-secret", Enabled: new(true), Updated: base.AddDate(-1, 0, 0),
 		Expires: base.AddDate(0, -2, 0), Reference: secretRef("kv-app-dev", "stripe-webhook-secret"),
 	}, "whsec_demo_expired")
 	p.add(kvDev, provider.TypeSecret, provider.Object{
 		Name: "test-user-password", Enabled: new(false), Updated: base.AddDate(0, -5, 0),
 		Reference: secretRef("kv-app-dev", "test-user-password"),
 	}, "disabled-demo-password")
 	p.add(kvDev, provider.TypeSecret, provider.Object{
 		Name: "vendor-token", Enabled: new(false), Updated: base.AddDate(-2, 0, 0),
 		Expires: base.AddDate(-1, 0, 0), Reference: secretRef("kv-app-dev", "vendor-token"),
 	}, "expired-and-disabled")
 	return p
 }
@@ -352,23 +372,21 @@ func Azure(delay time.Duration) *Provider {
 // its own, like an admin account next to a personal one.
 func AzureOps(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
 	secretRef := func(vault, name string) string {
 		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
 	}
 	prod := p.addSource("sub-prod", "platform-prod", "tenant: example.onmicrosoft.com")
 	breakGlass := p.addContainer(prod, "kv-breakglass", "https://kv-breakglass.vault.azure.net", allTypes...)
 	p.add(breakGlass, provider.TypeSecret, provider.Object{
-		Name: "emergency-admin", Enabled: &yes, Updated: base.AddDate(0, -4, 0),
+		Name: "emergency-admin", Enabled: new(true), Updated: base.AddDate(0, -4, 0),
-		Tags: map[string]string{"owner": "ops"}, Reference: secretRef("kv-breakglass", "emergency-admin"),
+		Expires: time.Now().AddDate(0, 0, 5).Truncate(24 * time.Hour), // soon, whenever the demo runs
 		Tags:    map[string]string{"owner": "ops"}, Reference: secretRef("kv-breakglass", "emergency-admin"),
 	}, "break-glass-demo-password")
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "smtp-password", Enabled: new(true), Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	// Unlike the first account, ops may read keys here.
 	p.add(shared, provider.TypeKey, provider.Object{
-		Name: "backup-encryption", Version: "e9a102", Enabled: &yes, Updated: base.AddDate(0, -2, 0),
+		Name: "backup-encryption", Version: "e9a102", Enabled: new(true), Updated: base.AddDate(0, -2, 0),
 		Attrs:     []provider.Attr{{Label: "key type", Value: "RSA-HSM 3072"}, {Label: "ops", Value: "wrapKey, unwrapKey"}},
 		Reference: "https://kv-shared-prod.vault.azure.net/keys/backup-encryption",
 	}, demoPublicKey)
@@ -376,8 +394,14 @@ func AzureOps(delay time.Duration) *Provider {
 	sandbox := p.addSource("sub-ops", "ops-sandbox", "tenant: example.onmicrosoft.com")
 	kv := p.addContainer(sandbox, "kv-ops-tools", "https://kv-ops-tools.vault.azure.net", allTypes...)
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "pagerduty-token", Enabled: &yes, Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
+		Name: "pagerduty-token", Enabled: new(true), Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
 	}, "pd-demo-token")
 	// Expiring soon whenever the demo runs: the other dates are fixed,
 	// and would have passed. Tests use the first account only.
 	p.add(kv, provider.TypeSecret, provider.Object{
 		Name: "grafana-api-key", Enabled: new(true), Updated: base.AddDate(0, -11, 0),
 		Expires: time.Now().AddDate(0, 0, 12).Truncate(24 * time.Hour), Reference: secretRef("kv-ops-tools", "grafana-api-key"),
 	}, "glsa_demo_expiring")
 	return p
 }
@@ -0,0 +1,247 @@
 package fake
 import (
 	"context"
 	"fmt"
 	"strings"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 var _ provider.ContainerDetails = (*Provider)(nil)
 // Details returns a file's details, like the repo provider's.
 func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
 	attrs, ok := p.details[c.ID]
 	if !ok {
 		return nil, provider.ErrUnsupported
 	}
 	return attrs, ctx.Err()
 }
 // Repos returns a fake repo provider: four git repos with SOPS, plain
 // .env, Spring and compose files, the first one the repo lazysecrets was
 // started in.
 func Repos() *Provider {
 	p := newProvider(provider.KindRepo, 0)
 	p.id, p.label = "Repos", "Repos"
 	p.details = map[string][]provider.Attr{}
 	repo := func(name string, here bool) provider.Source {
 		s := p.addSource("/home/dev/git/"+name, name, "github.com/acme/"+name)
 		s.Here = here
 		p.sources[len(p.sources)-1] = s
 		return s
 	}
 	// file adds a file and its keys, alternating name and value. git and
 	// commit are what git says of it: "tracked", "ignored" or "untracked".
 	file := func(src provider.Source, path, method, git, commit string, kv ...string) {
 		sops := method != ""
 		detail := provider.DetailPlainEnv
 		if sops {
 			detail = "sops · " + method
 		}
 		c := p.addContainer(src, path, detail, provider.TypeSecret)
 		attrs := []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}}
 		if sops {
 			attrs = []provider.Attr{{Label: "format", Value: "sops " + format(path)}, {Label: "encryption", Value: method}}
 		}
 		for i := 0; i+1 < len(kv); i += 2 {
 			o := provider.Object{Name: kv[i], Attrs: attrs}
 			if sops {
 				o.Updated = base
 			}
 			p.add(c, provider.TypeSecret, o, kv[i+1])
 		}
 		d := []provider.Attr{{Label: "encryption", Value: "none: plain text"}}
 		if sops {
 			d = []provider.Attr{{Label: "encryption", Value: detail}}
 			keys := map[string]string{
 				"age":      "age age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p",
 				"azure_kv": "azure_kv https://kv-sops-prod.vault.azure.net/keys/sops/1f2e3d4c",
 			}
 			for i, m := range strings.Split(method, ", ") {
 				label := ""
 				if i == 0 {
 					label = "keys" // on the first only, like the repo provider
 				}
 				d = append(d, provider.Attr{Label: label, Value: keys[m]})
 			}
 			d = append(d, provider.Attr{Label: "encrypted", Value: base.Local().Format("2006-01-02 15:04")})
 		}
 		switch {
 		case git == "tracked" && !sops:
 			d = append(d, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
 		case git == "untracked":
 			d = append(d, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: !sops})
 		default:
 			d = append(d, provider.Attr{Label: "git", Value: git})
 		}
 		if commit != "" {
 			d = append(d, provider.Attr{Label: "commit", Value: commit})
 		}
 		p.details[c.ID] = d
 	}
 	api := repo("lazysecrets-demo", true)
 	file(api, "deploy/prod/secrets.yaml", "age, azure_kv", "tracked", "4f9c2ab · 3 days ago",
 		"database.password", "pr0d-Pg-7f3k9QwZ",
 		"database.url", "postgres://app:pr0d-Pg-7f3k9QwZ@pg-demo-prod:5432/app",
 		"stripe.secret_key", "sk_live_demo_51NxDemoKey0000",
 		"jwt.signing_key", "c2lnbmluZy1rZXktZm9yLXRoZS1kZW1v",
 		"gcp.service_account", `{"type":"service_account","project_id":"lazysecrets-demo","client_email":"app@lazysecrets-demo.iam.gserviceaccount.com","private_key_id":"demo1234"}`)
 	file(api, "deploy/staging/secrets.yaml", "age", "tracked", "a71e05d · 2 weeks ago",
 		"database.password", "stg-Pg-2b8d1L",
 		"database.url", "postgres://app:stg-Pg-2b8d1L@pg-demo-stg:5432/app",
 		"stripe.secret_key", "sk_test_demo_51NxDemoKey0000")
 	file(api, "config/oauth.enc.json", "age", "tracked", "e03b6f1 · 2 months ago",
 		"github.client_secret", "8f3c2a9d7e1b6f4a0c5d2e9b8a7f6c3d1e0b4a5f",
 		"google.client_secret", "GOCSPX-demo-000000000000")
 	file(api, ".env", "", "ignored", "",
 		"DATABASE_URL", "postgres://app:local@localhost:5432/app",
 		"STRIPE_SECRET_KEY", "sk_test_demo_local",
 		"LOG_LEVEL", "debug")
 	infra := repo("platform-infra", false)
 	file(infra, "terraform/prod/secrets.enc.yaml", "azure_kv", "tracked", "9d40c3e · yesterday",
 		"postgres.admin_password", "infra-Pg-admin-0Xq",
 		"grafana.admin_password", "grafana-demo-admin",
 		"acr.pull_token", "acr-demo-pull-token")
 	file(infra, "k8s/monitoring/alertmanager.enc.yaml", "age", "tracked", "1c58e7a · 5 days ago",
 		"slack.webhook_url", "https://hooks.slack.com/services/T000/B000/demo",
 		"pagerduty.routing_key", "pd-demo-routing-key")
 	file(infra, "scripts/.env", "", "tracked", "77b2d90 · 8 months ago",
 		"AZURE_CLIENT_SECRET", "azure-demo-client-secret",
 		"ARM_SUBSCRIPTION_ID", "00000000-0000-0000-0000-000000000000")
 	// config adds a Spring or compose file (kind) and its keys as name,
 	// value and how it's listed: "" a secret, "hidden", "reference" (the
 	// value is a placeholder) or "jasypt" (the value is the decrypted one).
 	config := func(src provider.Source, path, kind, git, commit string, kv ...string) {
 		form := "yaml"
 		if strings.HasSuffix(path, ".properties") {
 			form = "properties"
 		}
 		c := p.addContainer(src, path, kind+" · "+form, provider.TypeSecret)
 		format := provider.Attr{Label: "format", Value: kind + " " + form}
 		secrets, hidden, jasypt, plain := 0, 0, 0, false
 		for i := 0; i+2 < len(kv); i += 3 {
 			o := provider.Object{Name: kv[i], Attrs: []provider.Attr{format, {Label: "encrypted", Value: "no: plain text in the file"}}}
 			switch kv[i+2] {
 			case "hidden":
 				o.Hidden = true
 				hidden++
 				continue
 			case "reference":
 				o.Detail, o.Attrs[1] = "reference", provider.Attr{Label: "value", Value: "a reference: the secret is set elsewhere"}
 			case "jasypt":
 				o.Detail, o.Attrs[1] = "jasypt", provider.Attr{Label: "encrypted", Value: "jasypt"}
 				jasypt++
 			default:
 				plain = plain || kv[i+1] != ""
 			}
 			secrets++
 			p.add(c, provider.TypeSecret, o, kv[i+1])
 		}
 		// Hidden keys after the rest, so the list opens on a secret.
 		for i := 0; i+2 < len(kv); i += 3 {
 			if kv[i+2] == "hidden" {
 				p.add(c, provider.TypeSecret, provider.Object{Name: kv[i], Hidden: true, Attrs: []provider.Attr{format}}, kv[i+1])
 			}
 		}
 		if secrets == 0 {
 			p.hide(src, path)
 		}
 		encryption := "none: plain text"
 		if jasypt > 0 {
 			encryption = fmt.Sprintf("jasypt: %d of %d values", jasypt, secrets+hidden)
 		}
 		d := []provider.Attr{
 			{Label: "encryption", Value: encryption},
 			{Label: "hidden keys", Value: fmt.Sprintf("%d, not matched by the secret patterns", hidden)},
 		}
 		if git == "tracked" && plain {
 			d = append(d, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
 		} else {
 			d = append(d, provider.Attr{Label: "git", Value: git})
 		}
 		p.details[c.ID] = append(d, provider.Attr{Label: "commit", Value: commit})
 	}
 	orders := repo("orders-service", false)
 	config(orders, "src/main/resources/application.yml", "spring", "tracked", "5be2c07 · 6 days ago",
 		"spring.application.name", "orders-service", "hidden",
 		"server.port", "8080", "hidden",
 		"spring.datasource.url", "jdbc:postgresql://orders-db:5432/orders", "hidden",
 		"spring.datasource.password", "${DB_PASSWORD}", "reference",
 		"spring.security.oauth2.client.provider.idp.token-uri", "https://idp.acme.example/token", "hidden",
 		"spring.security.oauth2.client.registration.orders.client-secret", "orders-demo-client-secret", "jasypt",
 		"jasypt.encryptor.password", "${JASYPT_ENCRYPTOR_PASSWORD}", "reference",
 		"app.payment.api-key", "pay_live_demo_7Hq2", "jasypt")
 	config(orders, "src/main/resources/application-local.properties", "spring", "tracked", "5be2c07 · 6 days ago",
 		"spring.datasource.url", "jdbc:postgresql://localhost:5432/orders", "hidden",
 		"spring.datasource.password", "local-orders-pw", "",
 		"logging.level.com.acme", "DEBUG", "hidden")
 	config(orders, "src/test/resources/application-test.yml", "spring", "tracked", "d81a3f9 · 3 weeks ago",
 		"spring.datasource.url", "jdbc:h2:mem:orders", "hidden",
 		"spring.jpa.hibernate.ddl-auto", "create-drop", "hidden")
 	config(orders, "docker-compose.yml", "compose", "tracked", "5be2c07 · 6 days ago",
 		"api.SPRING_PROFILES_ACTIVE", "local", "hidden",
 		"api.DB_PASSWORD", "${DB_PASSWORD}", "reference",
 		"db.POSTGRES_USER", "orders", "hidden",
 		"db.POSTGRES_PASSWORD", "orders-db-demo-pw", "")
 	config(orders, "docker-compose.example.yml", "compose", "tracked", "5be2c07 · 6 days ago",
 		"db.POSTGRES_PASSWORD", "changeme", "")
 	p.hide(orders, "docker-compose.example.yml")
 	file(orders, ".env.example", "", "tracked", "5be2c07 · 6 days ago",
 		"DB_PASSWORD", "changeme",
 		"JASYPT_ENCRYPTOR_PASSWORD", "changeme")
 	p.hide(orders, ".env.example")
 	web := repo("web-frontend", false)
 	file(web, ".env.production", "age", "tracked", "b2e91f4 · 4 days ago",
 		"SENTRY_AUTH_TOKEN", "sntrys_demo_token",
 		"NEXT_PUBLIC_API_URL", "https://api.acme.example")
 	file(web, ".env.local", "", "untracked", "",
 		"NEXT_PUBLIC_API_URL", "http://localhost:8080",
 		"ANALYTICS_KEY", "demo-analytics-key")
 	return p
 }
 // format is a SOPS file's format, by its name.
 func format(path string) string {
 	switch {
 	case strings.HasSuffix(path, ".json"):
 		return "json"
 	case strings.HasSuffix(path, ".yaml"):
 		return "yaml"
 	}
 	return "dotenv"
 }
 var _ provider.Contents = (*Provider)(nil)
 // Contents is a plain env file as KEY=value lines, from its keys, so the
 // demo repos' env files can be shared.
 func (p *Provider) Contents(ctx context.Context, c provider.Container) ([]byte, error) {
 	if c.Detail != provider.DetailPlainEnv {
 		return nil, provider.ErrUnsupported
 	}
 	var b strings.Builder
 	for _, o := range p.objects[listKey{c.ID, provider.TypeSecret}] {
 		b.WriteString(o.Name + "=" + p.values[o.ID] + "\n")
 	}
 	return []byte(b.String()), ctx.Err()
 }
 // hide marks a file hidden, as the repo provider does an example file or
 // a config file without secrets.
 func (p *Provider) hide(src provider.Source, name string) {
 	for i, c := range p.containers[src.ID] {
 		if c.Name == name {
 			p.containers[src.ID][i].Hidden = true
 		}
 	}
 }
@@ -0,0 +1,65 @@
 package fake
 import (
 	"cmp"
 	"strings"
 	"time"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 )
 // Seed stars, notes and uses a few of the demo's secrets, so --demo
 // shows Favourites (F), Recent (R), notes, and stars in lazysecrets list. alice and
 // admin are the two Azure accounts' provider IDs.
 func Seed(st *store.Store, alice, admin string) {
 	type item struct {
 		link, account, source string
 		name                  string // else the link's last part
 		note                  string
 		path                  []string
 		star                  bool
 		uses                  int
 		ago                   time.Duration
 	}
 	const azure, dbx = "lazysecrets://azure/", "lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/"
 	for _, it := range []item{
 		{link: azure + "kv-app-prod.vault.azure.net/secrets/db-password", account: alice, source: "sub-prod",
 			path: []string{"platform-prod", "kv-app-prod"}, star: true, uses: 12, ago: 20 * time.Minute,
 			note: "rotated by the data team each quarter"},
 		{link: azure + "kv-app-prod.vault.azure.net/secrets/api-key", account: alice, source: "sub-prod",
 			path: []string{"platform-prod", "kv-app-prod"}, uses: 4, ago: 2 * time.Hour},
 		{link: azure + "kv-breakglass.vault.azure.net/secrets/emergency-admin", account: admin, source: "sub-prod",
 			path: []string{"platform-prod", "kv-breakglass"}, star: true, note: "incidents only: tell #ops when used"},
 		{link: azure + "kv-shared-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
 			path: []string{"platform-prod", "kv-shared-prod"}, uses: 2, ago: 26 * time.Hour},
 		{link: azure + "kv-app-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
 			path: []string{"platform-prod", "kv-app-prod"}, note: "migrated to Microsoft Graph sendMail; delete after Q4"},
 		{link: dbx + "app/storage-key", account: "Databricks", source: "dbx-prod",
 			path: []string{"prod", "app"}, star: true, uses: 3, ago: 5 * time.Hour},
 		// A subscription, for both accounts, and a repo's file.
 		{link: azure + "subscriptions/sub-prod", account: alice, source: "sub-prod",
 			name: "platform-prod", star: true},
 		{link: azure + "subscriptions/sub-prod", account: admin, source: "sub-prod",
 			name: "platform-prod", star: true},
 		{link: "lazysecrets://repo/github.com%2Facme%2Flazysecrets-demo/deploy%2Fprod%2Fsecrets.yaml", account: "Repos",
 			source: "/home/dev/git/lazysecrets-demo", name: "deploy/prod/secrets.yaml",
 			path: []string{"lazysecrets-demo"}, star: true},
 	} {
 		context := func(n *store.Node) {
 			n.Name = cmp.Or(it.name, it.link[strings.LastIndex(it.link, "/")+1:])
 			n.Path, n.Source, n.Account = it.path, it.source, it.account
 		}
 		if it.star || it.note != "" {
 			_ = st.Update(it.link, func(n *store.Node) {
 				context(n)
 				if it.star {
 					n.ToggleStar(it.account)
 				}
 				n.Note = it.note
 			})
 		}
 		for range it.uses {
 			_ = st.Use(it.link, time.Now().Add(-it.ago), context)
 		}
 	}
 }
@@ -12,6 +12,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
 	"strings"
 	"time"
 )
@@ -72,6 +73,10 @@ type Source struct {
 	// Here marks the source lazysecrets was started in (the current git
 	// repo): listed first, starred or not, and labelled.
 	Here bool
 	// Hidden marks a source, container or object the provider's rules
 	// left out (a Spring file with no secret-looking keys): listed only
 	// while the app shows hidden ones.
 	Hidden bool `json:",omitempty"`
 }
 // ObjectType is the kind of object stored in a container.
@@ -83,6 +88,20 @@ const (
 	TypeCertificate ObjectType = "Certificate"
 )
 // Collection is the type's path segment in Key Vault URLs and links, e.g.
 // "secrets".
 func (t ObjectType) Collection() string {
 	switch t {
 	case TypeSecret:
 		return "secrets"
 	case TypeKey:
 		return "keys"
 	case TypeCertificate:
 		return "certificates"
 	}
 	return ""
 }
 // Container holds objects: a Key Vault or a Databricks secret scope.
 type Container struct {
 	Source Source
@@ -93,6 +112,9 @@ type Container struct {
 	// secrets only.
 	Types []ObjectType
 	URL   string // web page for the container, if any
 	// Attrs describe it further, from the listing (a vault's settings).
 	Attrs  []Attr `json:",omitempty"`
 	Hidden bool   `json:",omitempty"` // see Source.Hidden
 }
 // ObjectTypes returns the container's object types, defaulting to secrets.
@@ -107,6 +129,7 @@ func (c Container) ObjectTypes() []ObjectType {
 type Attr struct {
 	Label string
 	Value string
 	Warn  bool // worth a look (a plain .env tracked by git): shown in red
 }
 // Object describes a secret, key or certificate without its value.
@@ -115,6 +138,8 @@ type Object struct {
 	Type        ObjectType
 	ID          string
 	Name        string
 	Detail      string // shown after the name, e.g. "jasypt" for how its value is kept
 	Hidden      bool   `json:",omitempty"` // see Source.Hidden
 	Version     string
 	Enabled     *bool
 	Updated     time.Time
@@ -163,6 +188,13 @@ type Current interface {
 	Current(ctx context.Context) (Source, bool)
 }
 // Versioned is implemented by providers whose secrets have versions: it
 // is Value, also returning the version read (the current one when
 // o.Version is empty), so a link can pin it.
 type Versioned interface {
 	VersionedValue(ctx context.Context, o Object) (SecretValue, string, error)
 }
 // Locator is implemented by providers that can find where a container lives,
 // to open links. address is a vault host (kv.vault.azure.net) or a
 // workspace host. It returns the ID of the source holding it.
@@ -178,9 +210,57 @@ type Files interface {
 	File(c Container, o *Object) (File, error)
 }
 // Contents is implemented by providers whose containers are files, so
 // they can be shared (package share): the file as it is.
 type Contents interface {
 	Contents(ctx context.Context, c Container) ([]byte, error)
 }
 // File is a container's file, to open.
 type File struct {
 	Path string
 	Line int    // 1-based; 0 for the top
 	Sops string // the sops command to edit it with; empty for a plain file
 }
 // Accounts is implemented by providers that can describe the identity
 // they use, from what they have locally: for the Details pane on the
 // provider's row. ok is false when there's nothing to say.
 type Accounts interface {
 	Account() (Account, bool)
 }
 // Account describes a signed-in identity.
 type Account struct {
 	Fields []Attr
 	// Copy is what y copies on the provider's row, named CopyLabel.
 	Copy, CopyLabel string
 }
 // Denied is a refusal with what to check, from what the service said: a
 // role to activate in PIM, access to ask for, the network. Error is the
 // refusal, then the checks as a list.
 type Denied struct {
 	Err    error
 	Checks []string
 }
 func (d *Denied) Error() string {
 	if len(d.Checks) == 0 {
 		return d.Err.Error()
 	}
 	return d.Err.Error() + "\n\nCheck:\n• " + strings.Join(d.Checks, "\n• ")
 }
 func (d *Denied) Unwrap() error { return d.Err }
 // DetailPlainEnv is the Detail of a container that is a plain (not
 // encrypted) env file in a repo.
 const DetailPlainEnv = "env · plain text"
 // ContainerDetails is implemented by providers that can say more about a
 // container than its listing does: how a file is encrypted and what git
 // knows of it. ErrUnsupported means there's nothing more for c.
 type ContainerDetails interface {
 	Details(ctx context.Context, c Container) ([]Attr, error)
 }
@@ -0,0 +1,141 @@
 package repo
 import (
 	"path"
 	"regexp"
 	"strings"
 	"go.yaml.in/yaml/v3"
 )
 // Docker Compose files: compose.yaml, docker-compose.yml and their
 // variants (docker-compose.test.yml). Their keys are the services'
 // environment variables, named service.VAR.
 var composeType = configType{
 	name: "compose", is: IsCompose, format: func(string) string { return "yaml" }, parse: parseCompose,
 	jasyptSetting: func(name string) string {
 		service, _, _ := strings.Cut(name, ".")
 		return service + "." + jasyptEnv
 	},
 	placeholder: composePlaceholder,
 }
 var composeName = regexp.MustCompile(`^(docker-)?compose([.-][^/]+)?\.ya?ml$`)
 // IsCompose reports whether f is named like a Docker Compose file.
 func IsCompose(f string) bool {
 	return composeName.MatchString(strings.ToLower(path.Base(f)))
 }
 // composePlaceholderRe is compose's ${VAR}, ${VAR:-default}, ${VAR-default},
 // ${VAR:?error}, ${VAR?error} or $VAR.
 var composePlaceholderRe = regexp.MustCompile(`^\$(?:\{(\w+)(?:(:?-)([^}]*)|:?\?[^}]*)?\}|(\w+))$`)
 func composePlaceholder(v string) (name, def string, hasDef, ok bool) {
 	m := composePlaceholderRe.FindStringSubmatch(v)
 	if m == nil {
 		return "", "", false, false
 	}
 	return m[1] + m[4], m[3], m[2] != "", true
 }
 func parseCompose(_ string, b []byte) ([]configKey, error) {
 	var doc yaml.Node
 	if err := yaml.Unmarshal(b, &doc); err != nil {
 		return nil, err
 	}
 	if len(doc.Content) == 0 {
 		return nil, nil
 	}
 	var out []configKey
 	for _, service := range pairs(field(doc.Content[0], "services")) {
 		for _, k := range environment(field(service.value, "environment")) {
 			k.name = service.key.Value + "." + k.key
 			out = append(out, k)
 		}
 	}
 	return out, nil
 }
 // environment reads a service's environment, a map (KEY: value) or a list
 // (- KEY=value). A variable without a value (KEY:, - KEY) is taken from
 // where compose runs: a reference.
 func environment(n *yaml.Node) []configKey {
 	var out []configKey
 	switch n = deref(n); {
 	case n == nil:
 	case n.Kind == yaml.MappingNode:
 		for _, p := range pairs(n) {
 			v := deref(p.value)
 			ref := v.Tag == "!!null" || reference(composePlaceholder, v.Value)
 			out = append(out, configKey{key: p.key.Value, value: v.Value, ref: ref, line: p.key.Line})
 		}
 	case n.Kind == yaml.SequenceNode:
 		for _, item := range n.Content {
 			item = deref(item)
 			k, v, ok := strings.Cut(item.Value, "=")
 			out = append(out, configKey{key: k, value: v, ref: !ok || reference(composePlaceholder, v), line: item.Line})
 		}
 	}
 	return out
 }
 type pair struct{ key, value *yaml.Node }
 // pairs are a mapping's entries, with those merged in by << (anchors
 // shared between services) first and its own over them.
 func pairs(n *yaml.Node) []pair {
 	n = deref(n)
 	if n == nil || n.Kind != yaml.MappingNode {
 		return nil
 	}
 	var merged, own []pair
 	for i := 0; i+1 < len(n.Content); i += 2 {
 		k, v := n.Content[i], n.Content[i+1]
 		if k.Value != "<<" {
 			own = append(own, pair{k, v})
 			continue
 		}
 		from := []*yaml.Node{v}
 		if v.Kind == yaml.SequenceNode {
 			from = v.Content
 		}
 		for _, m := range from {
 			merged = append(merged, pairs(m)...)
 		}
 	}
 	var out []pair
 	for _, p := range append(merged, own...) {
 		if i := indexOf(out, p.key.Value); i >= 0 {
 			out[i] = p
 		} else {
 			out = append(out, p)
 		}
 	}
 	return out
 }
 func indexOf(ps []pair, key string) int {
 	for i, p := range ps {
 		if p.key.Value == key {
 			return i
 		}
 	}
 	return -1
 }
 func field(n *yaml.Node, key string) *yaml.Node {
 	ps := pairs(n)
 	if i := indexOf(ps, key); i >= 0 {
 		return ps[i].value
 	}
 	return nil
 }
 func deref(n *yaml.Node) *yaml.Node {
 	for n != nil && n.Kind == yaml.AliasNode {
 		n = n.Alias
 	}
 	return n
 }
@@ -0,0 +1,140 @@
 package repo
 import (
 	"context"
 	"maps"
 	"os"
 	"path/filepath"
 	"testing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 func TestIsCompose(t *testing.T) {
 	for f, want := range map[string]bool{
 		"docker-compose.yml":         true,
 		"deploy/compose.yaml":        true,
 		"docker-compose.test.yml":    true,
 		"docker-compose-dev.yaml":    true,
 		"docker-compose.example.yml": true, // listed hidden
 		"applications.yaml":          false,
 		"composer.json":              false,
 		"compose.yml.bak":            false,
 	} {
 		if IsCompose(f) != want {
 			t.Errorf("%s: %t", f, !want)
 		}
 	}
 }
 func TestComposePlaceholder(t *testing.T) {
 	for v, want := range map[string]bool{
 		"${DB_PASSWORD}": true, "$DB_PASSWORD": true, "${DB_PASSWORD:?set it}": true, "${DB_PASSWORD?}": true,
 		"${DB_PASSWORD:-hunter2}": false, "${DB_PASSWORD-hunter2}": false, // the default is in the file
 		"hunter2": false, "pre-${DB_PASSWORD}": false, "$": false,
 	} {
 		if got := reference(composePlaceholder, v); got != want {
 			t.Errorf("%s: reference %t", v, got)
 		}
 	}
 	if name, def, hasDef, _ := composePlaceholder("${PW:-x}"); name != "PW" || def != "x" || !hasDef {
 		t.Errorf("default: %s %s %t", name, def, hasDef)
 	}
 }
 func TestParseCompose(t *testing.T) {
 	keys, err := parseCompose("", []byte(`x-db: &db
  DB_USER: app
  DB_PASSWORD: shared
 services:
  api:
    image: api
    environment:
      <<: *db
      DB_PASSWORD: own
      API_KEY: ${API_KEY}
      FROM_HOST:
  worker:
    environment:
      - QUEUE_PASSWORD=hunter2
      - TOKEN
      - EMPTY=
  web:
    image: web
 `))
 	if err != nil {
 		t.Fatal(err)
 	}
 	got := map[string]string{}
 	for _, k := range keys {
 		ref := ""
 		if k.ref {
 			ref = " (ref)"
 		}
 		got[k.name] = k.value + ref
 	}
 	want := map[string]string{
 		"api.DB_USER": "app", "api.DB_PASSWORD": "own", "api.API_KEY": "${API_KEY} (ref)", "api.FROM_HOST": " (ref)",
 		"worker.QUEUE_PASSWORD": "hunter2", "worker.TOKEN": " (ref)", "worker.EMPTY": "",
 	}
 	if !maps.Equal(got, want) {
 		t.Errorf("got  %v\nwant %v", got, want)
 	}
 	for _, k := range keys {
 		if k.name == "worker.QUEUE_PASSWORD" && (k.line != 14 || k.key != "QUEUE_PASSWORD") {
 			t.Errorf("%s: line %d, key %s", k.name, k.line, k.key)
 		}
 	}
 }
 func TestComposeFiles(t *testing.T) {
 	root := gitRepo(t, map[string]string{
 		"docker-compose.yml": `services:
  api:
    environment:
      PORT: "8080"
      DB_PASSWORD: ${DB_PASSWORD}
      JASYPT_ENCRYPTOR_PASSWORD: test-password
      API_TOKEN: ` + jasyptHunter2 + `
 `,
 		"docker-compose.example.yml": "services:\n  api:\n    environment:\n      DB_PASSWORD: changeme\n",
 	})
 	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
 	ctx := context.Background()
 	p := New(Settings{Dir: root})
 	srcs, _ := p.Sources(ctx)
 	cs, err := p.Containers(ctx, srcs[0])
 	if err != nil || len(cs) != 2 {
 		t.Fatalf("files: %+v %v", cs, err)
 	}
 	for _, c := range cs {
 		if c.Detail != "compose · yaml" || c.Hidden != (c.Name == "docker-compose.example.yml") {
 			t.Errorf("%s: %q hidden %t", c.Name, c.Detail, c.Hidden)
 		}
 	}
 	compose := cs[1] // after docker-compose.example.yml
 	keys, _ := p.Objects(ctx, compose, provider.TypeSecret)
 	got := map[string]string{}
 	for _, k := range shown(keys) {
 		got[k.Name] = k.Detail
 	}
 	if want := map[string]string{"api.DB_PASSWORD": "reference", "api.JASYPT_ENCRYPTOR_PASSWORD": "", "api.API_TOKEN": "jasypt"}; !maps.Equal(got, want) {
 		t.Errorf("keys %v, want %v", got, want)
 	}
 	// The service's JASYPT_ENCRYPTOR_PASSWORD decrypts its values.
 	link := provider.Object{Container: provider.Container{Source: srcs[0], Name: "docker-compose.yml"}, Name: "api.API_TOKEN"}
 	if v, err := p.Value(ctx, link); err != nil || v.Reveal() != "hunter2" {
 		t.Errorf("jasypt: %q %v", v.Reveal(), err)
 	}
 	if f, _ := p.File(compose, &link); f.Line != 7 {
 		t.Errorf("line %d", f.Line)
 	}
 	// compose.secretPatterns over the shared ones.
 	os.WriteFile(filepath.Join(root, ".lazysecrets.yaml"), []byte("secretPatterns:\n  keys: [\"^nothing$\"]\ncompose:\n  secretPatterns:\n    keys: [\"^PORT$\"]\n    values: []\n"), 0o644)
 	keys, _ = p.Objects(ctx, compose, provider.TypeSecret)
 	if s := shown(keys); len(s) != 1 || s[0].Name != "api.PORT" {
 		t.Errorf("compose's patterns: %v", s)
 	}
 }
@@ -0,0 +1,170 @@
 package repo
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"slices"
 	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // Config files (Spring's, compose's) are read directly, like env files,
 // but most of their keys aren't secret: those the secret patterns
 // (patterns.go) don't match are hidden, and a file with none of them is.
 // configType is a type of config file: what it's called (in settings, as
 // spring:, and on the file's row) and how its keys are read.
 type configType struct {
 	name   string
 	is     func(file string) bool
 	format func(file string) string // yaml, properties
 	parse  func(file string, b []byte) ([]configKey, error)
 	// jasyptSetting is the key that holds the Jasypt password for the
 	// key named name.
 	jasyptSetting func(name string) string
 	// placeholder reads a value that only refers to another,
 	// ${DB_PASSWORD}: what it names, and its default if it has one.
 	placeholder func(v string) (name, def string, hasDef, ok bool)
 }
 var configTypes = []configType{springType, composeType}
 func isConfig(f string) bool {
 	_, ok := configTypeOf(f)
 	return ok
 }
 // configTypeOf is the type of config file f is, if it's one.
 func configTypeOf(f string) (configType, bool) {
 	for _, t := range configTypes {
 		if t.is(f) {
 			return t, true
 		}
 	}
 	return configType{}, false
 }
 // detail is the file's row: "spring · yaml".
 func (t configType) detail(file string) string { return t.name + " · " + t.format(file) }
 // configKey is a key of a config file, with its value.
 type configKey struct {
 	key   string // as the app sees it: spring.datasource.password, DB_PASSWORD
 	name  string // one key in the file: spring.datasource.password (prod), api.DB_PASSWORD
 	value string
 	ref   bool // the value only refers to the secret, set elsewhere: ${DB_PASSWORD}
 	line  int  // 1-based
 }
 func (k configKey) jasypt() bool { return jasypt.Is(k.value) }
 // plain reports whether the file holds the value itself, readable.
 func (k configKey) plain() bool { return k.value != "" && !k.ref && !k.jasypt() }
 // reference reports whether v is only a placeholder without a default:
 // one with a default has the default in the file.
 func reference(placeholder func(string) (string, string, bool, bool), v string) bool {
 	_, _, hasDef, ok := placeholder(v)
 	return ok && !hasDef
 }
 func (t configType) read(file string) ([]configKey, error) {
 	b, err := os.ReadFile(file)
 	if err != nil {
 		return nil, err
 	}
 	return t.parse(file, b)
 }
 func (t configType) keyNamed(file, name string) (configKey, error) {
 	keys, err := t.read(file)
 	if err != nil {
 		return configKey{}, err
 	}
 	for _, k := range keys {
 		if k.name == name {
 			return k, nil
 		}
 	}
 	return configKey{}, fmt.Errorf("%s isn't in %s", name, filepath.Base(file))
 }
 func (t configType) value(file, name string) (provider.SecretValue, error) {
 	k, err := t.keyNamed(file, name)
 	if err != nil {
 		return provider.SecretValue{}, err
 	}
 	return provider.NewSecretValue([]byte(k.value)), nil
 }
 // configHidden reports whether a config file has no secret keys. One that
 // can't be read isn't hidden: its error is worth seeing.
 func (p *Provider) configHidden(t configType, root, file string) bool {
 	keys, err := t.read(file)
 	if err != nil {
 		return false
 	}
 	filter, err := p.filterFor(root, t.name)
 	if err != nil {
 		return false
 	}
 	return !slices.ContainsFunc(keys, func(k configKey) bool { return filter.secret(k.key, k.value) })
 }
 // configObjects lists the file's keys, those that don't look like secrets
 // hidden.
 func (p *Provider) configObjects(t configType, c provider.Container, b []byte) ([]provider.Object, error) {
 	keys, err := t.parse(c.ID, b)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", c.Name, err)
 	}
 	filter, err := p.filterFor(c.Source.ID, t.name)
 	if err != nil {
 		return nil, err
 	}
 	format := provider.Attr{Label: "format", Value: t.name + " " + t.format(c.ID)}
 	var out []provider.Object
 	for _, k := range keys {
 		state, detail := provider.Attr{Label: "encrypted", Value: "no: plain text in the file"}, ""
 		switch {
 		case k.ref:
 			state, detail = provider.Attr{Label: "value", Value: "a reference: the secret is set elsewhere"}, "reference"
 		case k.jasypt():
 			state, detail = provider.Attr{Label: "encrypted", Value: "jasypt"}, "jasypt"
 		}
 		out = append(out, provider.Object{
 			Container: c, Type: provider.TypeSecret, ID: c.ID + "\x00" + k.name, Name: k.name, Detail: detail,
 			Hidden: !filter.secret(k.key, k.value), Attrs: []provider.Attr{format, state},
 		})
 	}
 	return out, nil
 }
 // configDetails says how many of the file's keys aren't listed, and
 // whether any listed one is in plain text.
 func (p *Provider) configDetails(t configType, c provider.Container) (attrs []provider.Attr, plain bool) {
 	keys, err := t.read(c.ID)
 	if err != nil {
 		return []provider.Attr{{Label: "keys", Value: err.Error(), Warn: true}}, false
 	}
 	filter, err := p.filterFor(c.Source.ID, t.name)
 	if err != nil {
 		return []provider.Attr{{Label: "keys", Value: err.Error(), Warn: true}}, false
 	}
 	secrets, jasypt := 0, 0
 	for _, k := range keys {
 		if filter.secret(k.key, k.value) {
 			secrets++
 			plain = plain || k.plain()
 		}
 		if k.jasypt() {
 			jasypt++
 		}
 	}
 	return []provider.Attr{
 		{Label: "encryption", Value: jasyptShare(jasypt, len(keys))},
 		{Label: "hidden keys", Value: fmt.Sprintf("%d, not matched by the secret patterns", len(keys)-secrets)},
 	}, plain
 }
@@ -0,0 +1,94 @@
 package repo
 import (
 	"context"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // Details are how a file is encrypted and for whom, and what git knows of
 // it: a plain .env file that git tracks, or could, is marked.
 func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
 	r, ok := p.repo(c.Source.ID)
 	if !ok {
 		return nil, provider.ErrUnsupported
 	}
 	rel, err := filepath.Rel(r.root, c.ID)
 	if err != nil {
 		return nil, err
 	}
 	var out []provider.Attr
 	meta, isSops := readMeta(c.ID)
 	// A plain file's values are at risk in git, unless they're all Jasypt;
 	// a config file's only when one of its secrets is in plain text.
 	plain := !isSops
 	if t, ok := configTypeOf(c.ID); ok && !isSops {
 		out, plain = p.configDetails(t, c)
 	} else if isSops {
 		out = append(out, provider.Attr{Label: "encryption", Value: "sops · " + strings.Join(meta.methods, ", ")})
 		for i, k := range meta.recipients {
 			label := ""
 			if i == 0 {
 				label = "keys"
 			}
 			out = append(out, provider.Attr{Label: label, Value: k})
 		}
 		if !meta.modified.IsZero() {
 			out = append(out, provider.Attr{Label: "encrypted", Value: meta.modified.Local().Format("2006-01-02 15:04")})
 		}
 	} else {
 		out, plain = envDetails(c.ID)
 	}
 	git := func(args ...string) (string, bool) {
 		b, err := exec.CommandContext(ctx, "git", append([]string{"-C", r.root}, args...)...).Output()
 		return strings.TrimSpace(string(b)), err == nil
 	}
 	switch _, tracked := git("ls-files", "--error-unmatch", "--", rel); {
 	case tracked && plain:
 		out = append(out, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
 	case tracked:
 		out = append(out, provider.Attr{Label: "git", Value: "tracked"})
 	default:
 		if _, ignored := git("check-ignore", "-q", "--", rel); ignored {
 			out = append(out, provider.Attr{Label: "git", Value: "ignored"})
 		} else {
 			out = append(out, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: plain})
 		}
 		return out, nil
 	}
 	if last, ok := git("log", "-1", "--format=%h · %ar", "--", rel); ok && last != "" {
 		out = append(out, provider.Attr{Label: "last commit", Value: last})
 	}
 	return out, nil
 }
 // envDetails says how a plain env file's values are encrypted, and whether
 // any is in plain text.
 func envDetails(file string) (attrs []provider.Attr, plain bool) {
 	b, err := os.ReadFile(file)
 	if err != nil {
 		return []provider.Attr{{Label: "encryption", Value: err.Error(), Warn: true}}, true
 	}
 	keys, _ := parseKeys(file, b)
 	n := 0
 	for _, k := range keys {
 		if k.jasypt {
 			n++
 		}
 	}
 	return []provider.Attr{{Label: "encryption", Value: jasyptShare(n, len(keys))}}, n < len(keys)
 }
 // jasyptShare is how many of a plain file's values are Jasypt's.
 func jasyptShare(n, of int) string {
 	if n == 0 {
 		return "none: plain text"
 	}
 	return fmt.Sprintf("jasypt: %d of %d values", n, of)
 }
@@ -0,0 +1,66 @@
 package repo
 import (
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // jasyptEnv is where Spring looks for the password first, before the
 // config's jasypt.encryptor.password, and so does lazysecrets.
 const jasyptEnv = "JASYPT_ENCRYPTOR_PASSWORD"
 // jasyptValue decrypts v when it's a Jasypt value, ENC(...), from a plain
 // file; other values are as they are.
 func jasyptValue(file, name string, v provider.SecretValue) (provider.SecretValue, error) {
 	s := v.Reveal()
 	if !jasypt.Is(s) {
 		return v, nil
 	}
 	password, from, err := jasyptPassword(file, name)
 	if err != nil {
 		return provider.SecretValue{}, err
 	}
 	plain, err := jasypt.Decrypt(s, password)
 	if errors.Is(err, jasypt.ErrDecrypt) {
 		return provider.SecretValue{}, fmt.Errorf("jasypt: with the password from %s: %w", from, err)
 	}
 	if err != nil {
 		return provider.SecretValue{}, fmt.Errorf("jasypt: %w", err)
 	}
 	return provider.NewSecretValue([]byte(plain)), nil
 }
 // jasyptPassword is the password for the Jasypt value of the key named
 // name, and where it's from: $JASYPT_ENCRYPTOR_PASSWORD, else the file's
 // own setting (jasypt.encryptor.password in a Spring file; the service's
 // JASYPT_ENCRYPTOR_PASSWORD in a compose file, the file's in an env file),
 // with a ${VAR} in it read from the environment.
 func jasyptPassword(file, name string) (password, from string, err error) {
 	if v := os.Getenv(jasyptEnv); v != "" {
 		return v, "$" + jasyptEnv, nil
 	}
 	setting, read, placeholder := jasyptEnv, plainValue, composePlaceholder // env files interpolate like compose
 	if t, ok := configTypeOf(file); ok {
 		setting, read, placeholder = t.jasyptSetting(name), t.value, t.placeholder
 	}
 	v, err := read(file, setting)
 	if err != nil {
 		return "", "", fmt.Errorf("jasypt: no password: set $%s, or %s in %s", jasyptEnv, setting, filepath.Base(file))
 	}
 	from = setting + " in " + filepath.Base(file)
 	env, def, hasDef, ok := placeholder(v.Reveal())
 	switch {
 	case !ok:
 		return v.Reveal(), from, nil
 	case os.Getenv(env) != "":
 		return os.Getenv(env), "$" + env + " (" + from + ")", nil
 	case hasDef:
 		return def, "the default in " + from, nil
 	}
 	return "", "", fmt.Errorf("jasypt: no password: %s is %s, and $%s isn't set", from, v.Reveal(), env)
 }
@@ -0,0 +1,102 @@
 package repo
 import (
 	"context"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // hunter2, encrypted by Jasypt with the password "test-password".
 const jasyptHunter2 = "ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)"
 func TestJasyptPassword(t *testing.T) {
 	dir := t.TempDir()
 	value := func(name, body string) (string, error) {
 		file := filepath.Join(dir, name)
 		if err := os.WriteFile(file, []byte(body), 0o600); err != nil {
 			t.Fatal(err)
 		}
 		key := "app.token"
 		if !IsSpring(name) {
 			key = "TOKEN"
 		}
 		v, err := (&Provider{}).Value(context.Background(), provider.Object{ID: file + "\x00" + key, Name: key})
 		return v.Reveal(), err
 	}
 	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
 	t.Setenv("MY_PASSWORD", "")
 	spring := func(password string) string {
 		return "jasypt.encryptor.password: " + password + "\napp.token: " + jasyptHunter2 + "\n"
 	}
 	for _, c := range []struct{ name, file, body, env, want string }{
 		{"the file's own", "application.yml", spring("test-password"), "", "hunter2"},
 		{"a ${VAR}", "application.yml", spring("${MY_PASSWORD}"), "test-password", "hunter2"},
 		{"a ${VAR}'s default", "application.yml", spring("${MY_PASSWORD:test-password}"), "", "hunter2"},
 		{"properties", "application-local.properties", "jasypt.encryptor.password=test-password\napp.token=" + jasyptHunter2 + "\n", "", "hunter2"},
 		{"env file", ".env", "JASYPT_ENCRYPTOR_PASSWORD=test-password\nTOKEN=" + jasyptHunter2 + "\n", "", "hunter2"},
 		{"not jasypt", ".env", "TOKEN=hunter2\n", "", "hunter2"},
 	} {
 		t.Setenv("MY_PASSWORD", c.env)
 		if got, err := value(c.file, c.body); err != nil || got != c.want {
 			t.Errorf("%s: %q %v", c.name, got, err)
 		}
 	}
 	// $JASYPT_ENCRYPTOR_PASSWORD wins over the file's, as in Spring.
 	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "test-password")
 	if got, err := value("application.yml", spring("wrong")); err != nil || got != "hunter2" {
 		t.Errorf("environment first: %q %v", got, err)
 	}
 	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "wrong")
 	if _, err := value("application.yml", spring("test-password")); err == nil || !strings.Contains(err.Error(), "the password from $JASYPT_ENCRYPTOR_PASSWORD") {
 		t.Errorf("a wrong one says where it's from: %v", err)
 	}
 	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
 	t.Setenv("MY_PASSWORD", "")
 	for body, want := range map[string]string{
 		spring("${MY_PASSWORD}"):      "$MY_PASSWORD isn't set",
 		"app.token: " + jasyptHunter2: "set $JASYPT_ENCRYPTOR_PASSWORD, or jasypt.encryptor.password in application.yml",
 	} {
 		if _, err := value("application.yml", body); err == nil || !strings.Contains(err.Error(), want) {
 			t.Errorf("no password: %v, want %q", err, want)
 		}
 	}
 }
 func TestJasyptEnvFile(t *testing.T) {
 	root := gitRepo(t, map[string]string{
 		"jasypt.env": "TOKEN=" + jasyptHunter2 + "\n",
 		"mixed.env":  "TOKEN=" + jasyptHunter2 + "\nURL=https://example.com\n",
 	})
 	ctx := context.Background()
 	p := New(Settings{Dir: root})
 	srcs, _ := p.Sources(ctx)
 	cs, _ := p.Containers(ctx, srcs[0])
 	for _, c := range cs {
 		attrs, _ := p.Details(ctx, c)
 		got := map[string]provider.Attr{}
 		for _, a := range attrs {
 			got[a.Label] = a
 		}
 		switch c.Name {
 		case "jasypt.env":
 			if got["encryption"].Value != "jasypt: 1 of 1 values" || got["git"].Warn {
 				t.Errorf("all jasypt: %+v", got)
 			}
 			keys, _ := p.Objects(ctx, c, provider.TypeSecret)
 			if len(keys) != 1 || keys[0].Attrs[1].Value != "jasypt" || keys[0].Detail != "jasypt" {
 				t.Errorf("keys: %+v", keys)
 			}
 		case "mixed.env":
 			if got["encryption"].Value != "jasypt: 1 of 2 values" || !got["git"].Warn {
 				t.Errorf("mixed: %+v", got)
 			}
 		}
 	}
 }
@@ -0,0 +1,113 @@
 package repo
 import (
 	"errors"
 	"fmt"
 	"path/filepath"
 	"regexp"
 )
 // Config files (Spring's) hold all of an app's config, most of it not
 // secret: of their keys, those named like a secret or with a value that
 // looks like one are listed, the rest hidden (H shows them). The patterns
 // can be set for all of a repo's files and per file type, in the config
 // and in a repo's .lazysecrets.yaml.
 // DefaultSecretKeys and DefaultSecretValues are the patterns used when
 // nothing sets them. The key pattern is anchored at the end of the name:
 // spring.datasource.password, client-secret, DB_PASSWORD and checkoutKey,
 // not the oauth2.*, keycloak.* and token-uri keys every Spring app has.
 // passord is Norwegian. They err on listing too much: a row too many is
 // cheap, a secret missed isn't.
 var (
 	DefaultSecretKeys = []string{
 		`(?i)(pass(word|wd|phrase|ord)?|pwd|secret|token|key|credentials?|salt|connection-?string)$`,
 	}
 	DefaultSecretValues = []string{
 		`^ENC\(.+\)$`,            // Jasypt
 		`://[^/\s:@]*:[^/\s@]+@`, // a URL with a password: jdbc:postgresql://user:pass@host
 		`(?i)(AccountKey|SharedAccessKey|Password|Pwd)=`, // a connection string with one
 	}
 )
 // SecretPatterns are regexps matched against a key's name and its value:
 // a key is a secret when either matches. A list that isn't set is taken
 // from the next place that sets it (see filterFor).
 type SecretPatterns struct {
 	Keys   *[]string `yaml:"keys"`
 	Values *[]string `yaml:"values"`
 }
 // FileType holds the settings of one type of file (spring:), for now its
 // own secret patterns.
 type FileType struct {
 	SecretPatterns SecretPatterns `yaml:"secretPatterns"`
 }
 // Check says which pattern doesn't compile; field is where they're set
 // (spring.secretPatterns), for the message.
 func (p SecretPatterns) Check(field string) error {
 	var errs []error
 	for name, list := range map[string]*[]string{"keys": p.Keys, "values": p.Values} {
 		if list == nil {
 			continue
 		}
 		for i, s := range *list {
 			if _, err := regexp.Compile(s); err != nil {
 				errs = append(errs, fmt.Errorf("%s.%s[%d]: %w", field, name, i, err))
 			}
 		}
 	}
 	return errors.Join(errs...)
 }
 type secretFilter struct{ keys, values []*regexp.Regexp }
 func (f secretFilter) secret(key, value string) bool {
 	return anyMatch(f.keys, key) || anyMatch(f.values, value)
 }
 // filterFor is the patterns for a repo's files of one type (spring), each
 // list from the first that sets it: the repo's .lazysecrets.yaml for the
 // type, then for all its files, the config for the type, then for all
 // repos, then the defaults.
 func (p *Provider) filterFor(root, fileType string) (secretFilter, error) {
 	f, err := readLazysecretsFile(root)
 	if err != nil {
 		return secretFilter{}, err
 	}
 	own := filepath.Join(root, ".lazysecrets.yaml") + ": "
 	type source struct {
 		field    string
 		patterns SecretPatterns
 	}
 	sources := []source{
 		{own + fileType + ".secretPatterns", f.types()[fileType].SecretPatterns},
 		{own + "secretPatterns", f.SecretPatterns},
 		{"providers.repos." + fileType + ".secretPatterns", p.s.Types[fileType].SecretPatterns},
 		{"providers.repos.secretPatterns", p.s.SecretPatterns},
 	}
 	pick := func(name string, list func(SecretPatterns) *[]string, defaults []string) ([]*regexp.Regexp, error) {
 		for _, s := range sources {
 			if l := list(s.patterns); l != nil {
 				return compileAll(*l, s.field+"."+name)
 			}
 		}
 		return compileAll(defaults, "default "+name)
 	}
 	keys, kerr := pick("keys", func(p SecretPatterns) *[]string { return p.Keys }, DefaultSecretKeys)
 	values, verr := pick("values", func(p SecretPatterns) *[]string { return p.Values }, DefaultSecretValues)
 	return secretFilter{keys, values}, errors.Join(kerr, verr)
 }
 func compileAll(patterns []string, field string) ([]*regexp.Regexp, error) {
 	out := make([]*regexp.Regexp, 0, len(patterns))
 	for i, s := range patterns {
 		re, err := regexp.Compile(s)
 		if err != nil {
 			return nil, fmt.Errorf("%s[%d]: %w", field, i, err)
 		}
 		out = append(out, re)
 	}
 	return out, nil
 }
@@ -0,0 +1,49 @@
 package repo
 import (
 	"os"
 	"path/filepath"
 	"testing"
 )
 // Each list comes from the first that sets it: the repo's spring, the
 // repo's, the config's spring, the config's, the defaults.
 func TestSecretPatternsOrder(t *testing.T) {
 	list := func(s ...string) *[]string { return &s }
 	root := t.TempDir()
 	write := func(body string) {
 		if err := os.WriteFile(filepath.Join(root, ".lazysecrets.yaml"), []byte(body), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	p := New(Settings{
 		SecretPatterns: SecretPatterns{Keys: list("^config$"), Values: list("^config$")},
 		Types:          map[string]FileType{"spring": {SecretPatterns: SecretPatterns{Keys: list("^config-spring$")}}},
 	})
 	secret := func(key, value string) bool {
 		t.Helper()
 		f, err := p.filterFor(root, "spring")
 		if err != nil {
 			t.Fatal(err)
 		}
 		return f.secret(key, value)
 	}
 	if !secret("config-spring", "") || secret("config", "") || !secret("", "config") {
 		t.Error("the config's spring keys, its shared values")
 	}
 	write("secretPatterns:\n  keys: [\"^repo$\"]\n")
 	if !secret("repo", "") || secret("config-spring", "") || !secret("", "config") {
 		t.Error("the repo's shared keys over the config's")
 	}
 	write("secretPatterns:\n  keys: [\"^repo$\"]\nspring:\n  secretPatterns:\n    keys: [\"^repo-spring$\"]\n    values: []\n")
 	if !secret("repo-spring", "") || secret("repo", "") || secret("", "config") {
 		t.Error("the repo's spring over everything; an empty list matches nothing")
 	}
 	p = New(Settings{})
 	write("")
 	if !secret("spring.datasource.password", "") || secret("server.port", "") {
 		t.Error("the defaults")
 	}
 }
@@ -1,6 +1,7 @@
 // Package repo browses the encrypted secret files in git repositories:
 // a repo is a source, its secret files the containers (vault level), and
-// their keys the secrets. SOPS files are the one type so far.
+// their keys the secrets. Secret files are SOPS files, plain env files and
 // config files: Spring Boot's and Docker Compose's (configfile.go).
 //
 // Listing never decrypts: SOPS encrypts values only, so a file's keys and
 // metadata are read directly. A value is decrypted when it's revealed or
@@ -31,6 +32,7 @@ import (
 	"go.yaml.in/yaml/v3"
 	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
@@ -49,6 +51,11 @@ type Settings struct {
 	// Include and Exclude are globs relative to a repo's root (** matches
 	// any depth), for repos without their own .lazysecrets.yaml.
 	Include, Exclude []string
 	// SecretPatterns say which keys of config files are secrets, Types
 	// per type of file (spring), for repos whose .lazysecrets.yaml
 	// doesn't.
 	SecretPatterns SecretPatterns
 	Types          map[string]FileType
 	// Sops is the sops binary; "sops" (on PATH) when empty.
 	Sops string
 }
@@ -80,6 +87,10 @@ type repoInfo struct {
 	here   bool   // the repo lazysecrets started in
 }
 // DefaultRoots are the usual folders of repos, used when the config
 // doesn't set roots. Ones that don't exist cost a stat each.
 var DefaultRoots = []string{"~/git", "~/repo", "~/repos", "~/projects", "~/code", "~/source", "~/src"}
 func New(s Settings) *Provider {
 	if s.Sops == "" {
 		s.Sops = "sops"
@@ -102,8 +113,6 @@ func (p *Provider) load() {
 				roots = append(roots, root)
 			}
 		}
 		// The repo lazysecrets started in, if any: marked, so the UI can
 		// put it on top, with its files under Dir first.
 		here, inRepo := p.current()
 		if inRepo {
 			seen[here.root] = true
@@ -116,16 +125,23 @@ func (p *Provider) load() {
 			}
 			add(root)
 		}
 		// Missing roots are skipped (most of the defaults are), and one
 		// that's a symlink to another is scanned once.
 		scanned := map[string]bool{}
 		for _, dir := range p.s.Roots {
-			base, _ := filepath.EvalSymlinks(expandHome(dir))
+			base, err := filepath.EvalSymlinks(expandHome(dir))
-			for _, root := range reposIn(expandHome(dir), 2) {
+			if err != nil || scanned[base] {
-				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") {
+				continue
 			}
 			scanned[base] = true
 			for _, root := range reposIn(base, 2) {
 				// A repo under two roots keeps the first one's name.
 				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") && names[root] == "" {
 					names[root] = filepath.ToSlash(name)
 				}
 				add(root)
 			}
 		}
 		// Repos you starred something in, wherever they are.
 		for _, dir := range p.s.Starred {
 			if root, err := gitRoot(dir); err == nil {
 				add(root)
@@ -176,12 +192,19 @@ func (p *Provider) Current(ctx context.Context) (provider.Source, bool) {
 		return provider.Source{}, false
 	}
 	src := p.source(r)
-	if files, err := p.Containers(ctx, src); err == nil && len(files) == 0 {
+	files, err := p.Containers(ctx, src)
 	if err == nil && len(files) == 0 {
 		return provider.Source{}, false
 	}
 	src.Hidden = err == nil && allHidden(files)
 	return src, true
 }
 // allHidden reports whether a repo's files are all hidden: the repo is too.
 func allHidden(files []provider.Container) bool {
 	return !slices.ContainsFunc(files, func(c provider.Container) bool { return !c.Hidden })
 }
 func (p *Provider) source(r repoInfo) provider.Source {
 	return provider.Source{
 		Kind: provider.KindRepo, Provider: p.ID(), ProviderLabel: p.Label(),
@@ -194,13 +217,11 @@ func parallel(n int, f func(i int)) {
 	var wg sync.WaitGroup
 	sem := make(chan struct{}, max(8, runtime.NumCPU()))
 	for i := range n {
-		wg.Add(1)
+		wg.Go(func() {
 		go func() {
 			defer wg.Done()
 			sem <- struct{}{}
 			defer func() { <-sem }()
 			f(i)
-		}()
+		})
 	}
 	wg.Wait()
 }
@@ -252,6 +273,7 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 	parallel(len(srcs), func(i int) {
 		files, err := p.Containers(ctx, srcs[i])
 		keep[i] = err != nil || len(files) > 0
 		srcs[i].Hidden = err == nil && allHidden(files)
 	})
 	var out []provider.Source
 	for i, src := range srcs {
@@ -311,8 +333,13 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 			c.Detail = "sops · " + strings.Join(meta.methods, ", ")
 		case isSops:
 			return // a SOPS file where .sops.yaml says SOPS files don't go
-		case isEnv(f):
+		case isEnvNamed(f):
-			c.Detail = "env · plain text"
+			c.Detail = provider.DetailPlainEnv
 			c.Hidden = isExample(f)
 		case isConfig(f):
 			t, _ := configTypeOf(f)
 			c.Detail = t.detail(f)
 			c.Hidden = isExample(f) || p.configHidden(t, r.root, path)
 		default:
 			return
 		}
@@ -349,30 +376,29 @@ func (p *Provider) Objects(_ context.Context, c provider.Container, t provider.O
 	if err != nil {
 		return nil, err
 	}
-	meta, isSops := readMeta(c.ID)
+	meta, isSops := parseMeta(c.ID, b)
 	if t, ok := configTypeOf(c.ID); ok && !isSops {
 		return p.configObjects(t, c, b)
 	}
 	keys, err := parseKeys(c.ID, b)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", c.Name, err)
 	}
-	if !isSops { // a plain env file
+	attrs := []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}}
-		out := make([]provider.Object, 0, len(keys))
+	if isSops {
-		for _, k := range keys {
+		attrs = []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}}
 			out = append(out, provider.Object{
 				Container: c, Type: provider.TypeSecret, ID: c.ID + "\x00" + k.extract, Name: k.name,
 				Attrs: []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}},
 			})
 		}
 		return out, nil
 	}
 	out := make([]provider.Object, 0, len(keys))
 	for _, k := range keys {
 		o := provider.Object{
 			Container: c, Type: provider.TypeSecret,
-			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified,
+			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified, Attrs: attrs,
 			Attrs: []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}},
 		}
-		if !k.encrypted {
+		switch {
-			o.Attrs = append(o.Attrs, provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
+		case isSops && !k.encrypted:
 			o.Attrs = append(slices.Clip(attrs), provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
 		case !isSops && k.jasypt:
 			o.Attrs, o.Detail = []provider.Attr{attrs[0], {Label: "encrypted", Value: "jasypt"}}, "jasypt"
 		}
 		out = append(out, o)
 	}
@@ -387,17 +413,29 @@ func (p *Provider) Versions(context.Context, provider.Object) ([]provider.Object
 	return nil, provider.ErrUnsupported
 }
-// Value decrypts one key with sops.
+// Value reads one key: from a plain file, decrypting a Jasypt value; from
 // a SOPS file, with sops.
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	file, extract, ok := strings.Cut(o.ID, "\x00")
 	if !ok { // made from a link: the repo's root, the file's path, the key
-		file, extract = o.Container.ID, extractFor(o.Name)
+		file = filePath(o.Container)
 		if file == "" {
 			file = filepath.Join(o.Container.Source.ID, filepath.FromSlash(o.Container.Name))
 		}
 	}
 	if _, isSops := readMeta(file); !isSops {
-		return plainValue(file, o.Name)
+		read := plainValue
 		if t, ok := configTypeOf(file); ok {
 			read = t.value
 		}
 		v, err := read(file, o.Name)
 		if err != nil {
 			return v, err
 		}
 		return jasyptValue(file, o.Name, v)
 	}
 	if !ok {
 		var err error
 		if extract, err = extractOf(file, o.Name); err != nil {
 			return provider.SecretValue{}, err
 		}
 	}
 	cmd := exec.CommandContext(ctx, p.s.Sops, "decrypt", "--extract", extract, file)
 	cmd.Dir = filepath.Dir(file) // sops looks for .sops.yaml from here
@@ -412,12 +450,27 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return provider.NewSecretValue(stdout.Bytes()), nil
 }
 // Contents reads the file c is.
 func (p *Provider) Contents(_ context.Context, c provider.Container) ([]byte, error) {
 	f, err := p.File(c, nil)
 	if err != nil {
 		return nil, err
 	}
 	return os.ReadFile(f.Path)
 }
 // filePath is the file c is. A container made from a link has no ID: the
 // file is its path in the repo.
 func filePath(c provider.Container) string {
 	if c.ID != "" {
 		return c.ID
 	}
 	return filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
 }
 // File is the file c is, and the line o's key is on.
 func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File, error) {
-	path := c.ID
+	path := filePath(c)
 	if path == "" { // made from a link
 		path = filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
 	}
 	f := provider.File{Path: path}
 	if _, isSops := readMeta(path); isSops {
 		f.Sops = p.s.Sops
@@ -425,6 +478,12 @@ func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File
 	if o == nil {
 		return f, nil
 	}
 	if t, ok := configTypeOf(path); ok && f.Sops == "" {
 		if k, err := t.keyNamed(path, o.Name); err == nil {
 			f.Line = k.line
 		}
 		return f, nil
 	}
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return f, err
@@ -464,6 +523,16 @@ func (p *Provider) Locate(_ context.Context, host string) (string, bool, error)
 	return "", false, nil
 }
 // Root is the root of the git repo dir is in, and the repo's ID: its
 // remote without scheme or .git (a repo link's host), else the root.
 func Root(dir string) (root, id string, err error) {
 	root, err = gitRoot(dir)
 	if err != nil {
 		return "", "", fmt.Errorf("%s isn't in a git repository", dir)
 	}
 	return root, info(root, "").id, nil
 }
 // --- git ---
 func gitRoot(dir string) (string, error) {
@@ -566,23 +635,56 @@ func normalizeRemote(remote string) (string, string) {
 // lazysecretsFile is a repo's own .lazysecrets.yaml.
 type lazysecretsFile struct {
-	Include []string `yaml:"include"`
+	Include        []string       `yaml:"include"`
-	Exclude []string `yaml:"exclude"`
+	Exclude        []string       `yaml:"exclude"`
 	SecretPatterns SecretPatterns `yaml:"secretPatterns"`
 	Spring         FileType       `yaml:"spring"`
 	Compose        FileType       `yaml:"compose"`
 	Sharing        struct {
 		// Key is the link to the secret that encrypts the repo's
 		// shared env files (package share).
 		Key string `yaml:"key"`
 	} `yaml:"sharing"`
 }
 func (f lazysecretsFile) types() map[string]FileType {
 	return map[string]FileType{"spring": f.Spring, "compose": f.Compose}
 }
 // ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
 func ShareKey(root string) (string, error) {
 	f, err := readLazysecretsFile(root)
 	return f.Sharing.Key, err
 }
 // readLazysecretsFile reads the repo's .lazysecrets.yaml; without one, it's
 // empty.
 func readLazysecretsFile(root string) (lazysecretsFile, error) {
 	var f lazysecretsFile
 	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
 	if errors.Is(err, os.ErrNotExist) {
 		return f, nil
 	}
 	if err != nil {
 		return f, err
 	}
 	if err := yaml.Unmarshal(b, &f); err != nil {
 		return f, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 	}
 	return f, nil
 }
 // selector says which files to look at: user (the include/exclude of the
 // repo's .lazysecrets.yaml or the config) for every file, and sopsWhere
 // (.sops.yaml's creation_rules, when there's no include) for SOPS files.
 func (p *Provider) selector(root string, files []string) (user, sopsWhere func(string) bool, err error) {
 	f, err := readLazysecretsFile(root)
 	if err != nil {
 		return nil, nil, err
 	}
 	include, exclude := p.s.Include, p.s.Exclude
-	if b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml")); err == nil {
+	if len(f.Include) > 0 || len(f.Exclude) > 0 {
-		var f lazysecretsFile
+		include, exclude = f.Include, f.Exclude
 		if err := yaml.Unmarshal(b, &f); err != nil {
 			return nil, nil, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 		}
 		if len(f.Include) > 0 || len(f.Exclude) > 0 {
 			include, exclude = f.Include, f.Exclude
 		}
 	}
 	inc, err := globs(include)
 	if err != nil {
@@ -618,7 +720,7 @@ func envFiles(root string, tracked []string) []string {
 	dirs := map[string]bool{".": true}
 	for _, f := range tracked {
 		isTracked[f] = true
-		if isEnv(f) {
+		if isEnvNamed(f) {
 			out = append(out, f)
 		}
 		if d := path.Dir(f); !dirs[d] && !inPackages(f) {
@@ -632,7 +734,7 @@ func envFiles(root string, tracked []string) []string {
 		}
 		for _, e := range entries {
 			f := path.Join(d, e.Name())
-			if e.Type().IsRegular() && !isTracked[f] && isEnv(f) {
+			if e.Type().IsRegular() && !isTracked[f] && isEnvNamed(f) {
 				out = append(out, f)
 			}
 		}
@@ -663,20 +765,33 @@ func inPackages(f string) bool {
 	return false
 }
-// isEnv reports whether a file is named like an env file with real values:
+// IsEnv reports whether a file is named like an env file with real values:
 // .env, .env.local, prod.env; not .env.example and the like, nor one in
 // dependencies.
-func isEnv(f string) bool {
+func IsEnv(f string) bool {
-	if inPackages(f) {
+	return isEnvNamed(f) && !isExample(f)
-		return false
+}
-	}
+
 // isEnvNamed reports whether a file outside dependencies is named like an
 // env file, examples too.
 func isEnvNamed(f string) bool {
 	base := strings.ToLower(path.Base(f))
-	for _, ext := range []string{".example", ".sample", ".template", ".dist", ".tmpl"} {
+	return !inPackages(f) && (base == ".env" || strings.HasPrefix(base, ".env.") || strings.HasSuffix(base, ".env"))
-		if strings.HasSuffix(base, ext) {
+}
-			return false
+
 var exampleWords = []string{"example", "sample", "template", "dist", "tmpl"}
 // isExample reports whether a file is an example or template of another:
 // .env.example, docker-compose.example.yml. They're listed hidden: someone
 // may have put a real value in one.
 func isExample(f string) bool {
 	base := strings.ToLower(path.Base(f))
 	for _, w := range exampleWords {
 		if strings.HasSuffix(base, "."+w) || strings.Contains(base, "."+w+".") {
 			return true
 		}
 	}
-	return base == ".env" || strings.HasPrefix(base, ".env.") || strings.HasSuffix(base, ".env")
+	return false
 }
 // plainValue reads a key from a plain env file.
@@ -815,8 +930,30 @@ func anyMatch(res []*regexp.Regexp, f string) bool {
 // --- sops files ---
 type sopsMeta struct {
-	methods  []string // age, azure_kv, …
+	methods    []string // age, azure_kv, …
-	modified time.Time
+	recipients []string // "age age1…", "azure_kv https://kv…/keys/sops"
 	modified   time.Time
 }
 // recipient names a key a file is encrypted for, from its sops metadata:
 // public, never a secret.
 func recipient(method string, f map[string]string) string {
 	var v string
 	switch method {
 	case "age":
 		v = f["recipient"]
 	case "pgp":
 		v = f["fp"]
 	case "kms":
 		v = f["arn"]
 	case "gcp_kms":
 		v = f["resource_id"]
 	case "azure_kv":
 		v = strings.TrimSuffix(f["vault_url"], "/") + "/keys/" + f["name"]
 	case "hc_vault":
 		v = strings.TrimSuffix(f["vault_address"], "/") + " " + f["engine_path"] + "/" + f["key_name"]
 	}
 	return method + " " + v
 }
 const maxFileSize = 4 << 20
@@ -832,12 +969,21 @@ func readMeta(file string) (sopsMeta, bool) {
 		return sopsMeta{}, false // not a format sops writes: skip reading
 	}
 	b, err := os.ReadFile(file)
-	if err != nil || !bytes.Contains(b, []byte("sops")) {
+	if err != nil {
 		return sopsMeta{}, false
 	}
 	return parseMeta(file, b)
 }
 // parseMeta is readMeta, of the file's contents b.
 func parseMeta(file string, b []byte) (sopsMeta, bool) {
 	format := formatOf(file)
 	if len(b) > maxFileSize || format == "" || !bytes.Contains(b, []byte("sops")) {
 		return sopsMeta{}, false // cheap: most files aren't sops, no parsing
 	}
 	var m sopsMeta
 	known := []string{"age", "azure_kv", "kms", "gcp_kms", "hc_vault", "pgp"}
-	switch formatOf(file) {
+	switch format {
 	case "yaml", "json":
 		var doc struct {
 			Sops map[string]any `yaml:"sops"`
@@ -848,6 +994,15 @@ func readMeta(file string) (sopsMeta, bool) {
 		for _, k := range known {
 			if v, ok := doc.Sops[k].([]any); ok && len(v) > 0 {
 				m.methods = append(m.methods, k)
 				for _, e := range v {
 					fields := map[string]string{}
 					if em, ok := e.(map[string]any); ok {
 						for fk, fv := range em {
 							fields[fk] = fmt.Sprint(fv)
 						}
 					}
 					m.recipients = append(m.recipients, recipient(k, fields))
 				}
 			}
 		}
 		if s, ok := doc.Sops["lastmodified"].(string); ok {
@@ -864,6 +1019,7 @@ func readMeta(file string) (sopsMeta, bool) {
 		for _, k := range known {
 			if strings.Contains(text, "sops_"+k+"__") {
 				m.methods = append(m.methods, k)
 				m.recipients = append(m.recipients, envRecipients(text, k)...)
 			}
 		}
 		if i := strings.Index(text, "sops_lastmodified"); i >= 0 {
@@ -881,6 +1037,35 @@ func readMeta(file string) (sopsMeta, bool) {
 	return m, true
 }
 // envRecipients are method's keys in a dotenv or ini sops file, whose
 // metadata is flattened: sops_age__list_0__map_recipient=age1….
 func envRecipients(text, method string) []string {
 	prefix := "sops_" + method + "__list_"
 	var order []string
 	keys := map[string]map[string]string{}
 	for line := range strings.Lines(text) {
 		k, v, ok := strings.Cut(strings.TrimSpace(line), "=")
 		rest, found := strings.CutPrefix(strings.TrimSpace(k), prefix)
 		if !ok || !found {
 			continue
 		}
 		n, field, ok := strings.Cut(rest, "__map_")
 		if !ok {
 			continue
 		}
 		if keys[n] == nil {
 			keys[n] = map[string]string{}
 			order = append(order, n)
 		}
 		keys[n][field] = strings.TrimSpace(v)
 	}
 	out := make([]string, len(order))
 	for i, n := range order {
 		out[i] = recipient(method, keys[n])
 	}
 	return out
 }
 func formatOf(file string) string {
 	switch strings.ToLower(filepath.Ext(file)) {
 	case ".yaml", ".yml":
@@ -899,10 +1084,11 @@ func formatOf(file string) string {
 }
 type key struct {
-	name      string // db.password, list[0]
+	name      string // db.password, list[0], with . [ ] \ in keys escaped
 	extract   string // sops --extract: ["db"]["password"]
 	encrypted bool
-	line      int // 1-based
+	jasypt    bool // a plain env file's ENC(...) value
 	line      int  // 1-based
 }
 // parseKeys lists a sops file's keys without decrypting anything.
@@ -926,7 +1112,8 @@ func parseKeys(file string, b []byte) ([]key, error) {
 			if !ok || strings.HasPrefix(k, "sops_") {
 				continue
 			}
-			out = append(out, key{name: k, extract: quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
+			sopsKey, _, _ := strings.Cut(line, "=") // sops keeps export and spaces in the key
 			out = append(out, key{name: k, extract: quote(sopsKey), encrypted: strings.HasPrefix(v, "ENC["), jasypt: jasypt.Is(v), line: i + 1})
 		}
 		return out, nil
 	case "ini":
@@ -944,7 +1131,7 @@ func parseKeys(file string, b []byte) ([]key, error) {
 					continue
 				}
 				k, v = strings.TrimSpace(k), strings.TrimSpace(v)
-				out = append(out, key{name: section + "." + k, extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
+				out = append(out, key{name: escape(section) + "." + escape(k), extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
 			}
 		}
 		return out, nil
@@ -961,9 +1148,9 @@ func walk(n *yaml.Node, name, extract string, top bool, out *[]key) {
 			if top && k == "sops" {
 				continue
 			}
-			child := k
+			child := escape(k)
 			if name != "" {
-				child = name + "." + k
+				child = name + "." + child
 			}
 			walk(n.Content[i+1], child, extract+quote(k), false, out)
 		}
@@ -985,21 +1172,29 @@ func quote(k string) string {
 	return `["` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(k) + `"]`
 }
-// extractFor rebuilds the extract path from a key name, for objects made
+// escape keeps a key's dots and brackets from reading as nesting in a
-// from a link (db.password, list[0]). Names with dots in keys can't be
+// name: app\.name is one key, app.name two.
-// told apart from nesting: those come from the listing instead.
+func escape(k string) string {
-func extractFor(name string) string {
+	return strings.NewReplacer(`\`, `\\`, `.`, `\.`, `[`, `\[`, `]`, `\]`).Replace(k)
-	var b strings.Builder
+}
-	for _, part := range strings.Split(name, ".") {
+
-		base, idx, _ := strings.Cut(part, "[")
+// extractOf is the sops --extract path of the key named name, for objects
-		if base != "" {
+// made from a link.
-			b.WriteString(quote(base))
+func extractOf(file, name string) (string, error) {
-		}
+	b, err := os.ReadFile(file)
-		if idx != "" {
+	if err != nil {
-			b.WriteString("[" + idx)
+		return "", err
 	}
 	keys, err := parseKeys(file, b)
 	if err != nil {
 		return "", err
 	}
 	for _, k := range keys {
 		if k.name == name {
 			return k.extract, nil
 		}
 	}
-	return b.String()
+	return "", fmt.Errorf("%s isn't in %s", name, filepath.Base(file))
 }
 func absPath(p string) string {
@@ -237,6 +237,25 @@ func TestDecrypt(t *testing.T) {
 		t.Errorf("from a link: %q %v", v.Reveal(), err)
 	}
 	// A dotenv file's export lines: sops keeps export in the key.
 	os.WriteFile(plain, []byte("export TOKEN=s3cret\n"), 0o600)
 	enc, err = exec.Command("sops", "encrypt", "--age", recipient, "--input-type", "dotenv", "--output-type", "dotenv", plain).Output()
 	if err != nil {
 		t.Fatal(err)
 	}
 	envFile := filepath.Join(root, "prod.env")
 	os.WriteFile(envFile, enc, 0o600)
 	envC := provider.Container{Source: srcs[0], ID: envFile, Name: "prod.env"}
 	envKeys, _ := p.Objects(ctx, envC, provider.TypeSecret)
 	if len(envKeys) != 1 {
 		t.Fatalf("env keys: %v", envKeys)
 	}
 	for _, o := range []provider.Object{envKeys[0], {Container: provider.Container{Source: srcs[0], Name: "prod.env"}, Name: "TOKEN"}} {
 		if v, err := p.Value(ctx, o); err != nil || v.Reveal() != "s3cret" {
 			t.Errorf("export line (link: %t): %q %v", o.ID == "", v.Reveal(), err)
 		}
 	}
 	// Without the key: sops' own error.
 	t.Setenv("SOPS_AGE_KEY_FILE", filepath.Join(dir, "missing.txt"))
 	if _, err := p.Value(ctx, keys[0]); err == nil || !strings.Contains(err.Error(), "no identity matched any of the recipients") {
@@ -273,9 +292,12 @@ func TestPlainEnvFiles(t *testing.T) {
 	got := map[string]string{}
 	for _, c := range files {
 		got[c.Name] = c.Detail
 		if c.Hidden != (c.Name == ".env.example") {
 			t.Errorf("%s: hidden %t", c.Name, c.Hidden)
 		}
 	}
-	if len(got) != 2 || got[".env"] != "env · plain text" || got["secrets/app.yaml"] != "sops · age" {
+	if len(got) != 3 || got[".env"] != "env · plain text" || got[".env.example"] != "env · plain text" || got["secrets/app.yaml"] != "sops · age" {
-		t.Fatalf("files %v (want .env and the sops file; not the example or node_modules)", got)
+		t.Fatalf("files %v (want .env, the example, hidden, and the sops file; not node_modules)", got)
 	}
 	var env provider.Container
@@ -300,7 +322,7 @@ func TestPlainEnvFiles(t *testing.T) {
 	os.WriteFile(filepath.Join(root, ".sops.yaml"), []byte("creation_rules:\n  - path_regex: nowhere/.*\n"), 0o644)
 	exec.Command("git", "-C", root, "add", ".sops.yaml").Run()
 	files, _ = New(Settings{Dir: root}).Containers(ctx, srcs[0])
-	if names := names(files, func(c provider.Container) string { return c.Name }); !slices.Equal(names, []string{".env"}) {
+	if names := names(files, func(c provider.Container) string { return c.Name }); !slices.Equal(names, []string{".env", ".env.example"}) {
 		t.Errorf("with rules elsewhere: %v", names)
 	}
 }
@@ -336,6 +358,30 @@ func TestRoots(t *testing.T) {
 	}
 }
 func TestRootsDeduped(t *testing.T) {
 	root, _ := filepath.EvalSymlinks(t.TempDir())
 	os.Rename(gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML}), filepath.Join(root, "infra"))
 	os.MkdirAll(filepath.Join(root, "acme"), 0o755)
 	os.Rename(gitRepo(t, map[string]string{"prod.env": sopsEnv}), filepath.Join(root, "acme", "billing"))
 	// ~/src → ~/git, and a root reaching one repo at another depth.
 	links := t.TempDir()
 	alias := filepath.Join(links, "src")
 	os.Symlink(root, alias)
 	missing := filepath.Join(links, "nope")
 	acme := filepath.Join(root, "acme")
 	srcs, err := New(Settings{Dir: links, Roots: []string{missing, root, alias, acme}}).Sources(context.Background())
 	if err != nil {
 		t.Fatal(err)
 	}
 	got := names(srcs, func(s provider.Source) string { return s.Name })
 	slices.Sort(got)
 	if !slices.Equal(got, []string{"acme/billing", "infra"}) {
 		t.Errorf("repos: %v, want each once, named from the first root", got)
 	}
 }
 func TestStarredReposAlongside(t *testing.T) {
 	here := gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML})
 	starred := gitRepo(t, map[string]string{"prod.env": sopsEnv})
@@ -477,3 +523,75 @@ func TestFile(t *testing.T) {
 		t.Errorf("lines %v\nwant  %v", lines, want)
 	}
 }
 func TestFileDetails(t *testing.T) {
 	root := gitRepo(t, map[string]string{
 		".gitignore":       ".env\n",
 		"secrets/app.yaml": sopsYAML,
 		"prod.env":         sopsEnv,
 		"tracked.env":      "TOKEN=x\n", // a plain .env in git: worth a look
 	})
 	os.WriteFile(filepath.Join(root, ".env"), []byte("TOKEN=x\n"), 0o600)
 	os.WriteFile(filepath.Join(root, "local.env"), []byte("TOKEN=x\n"), 0o600)
 	p := New(Settings{Dir: root})
 	ctx := context.Background()
 	srcs, _ := p.Sources(ctx)
 	details := func(name string) map[string]provider.Attr {
 		t.Helper()
 		attrs, err := p.Details(ctx, provider.Container{Source: srcs[0], ID: filepath.Join(root, name), Name: name})
 		if err != nil {
 			t.Fatal(err)
 		}
 		out := map[string]provider.Attr{}
 		for _, a := range attrs {
 			out[a.Label] = a
 		}
 		return out
 	}
 	d := details("secrets/app.yaml")
 	if d["encryption"].Value != "sops · age" || d["keys"].Value != "age age1xxxx" || d["git"].Value != "tracked" ||
 		!strings.HasSuffix(d["last commit"].Value, " ago") || strings.Contains(d["last commit"].Value, ":") || d["encrypted"].Value == "" {
 		t.Errorf("sops yaml: %+v", d)
 	}
 	if d := details("prod.env"); d["keys"].Value != "age age1xxxx" {
 		t.Errorf("sops env: %+v", d)
 	}
 	if d := details("tracked.env"); d["encryption"].Value != "none: plain text" || !d["git"].Warn {
 		t.Errorf("tracked plain env: %+v", d)
 	}
 	if d := details(".env"); d["git"].Value != "ignored" || d["git"].Warn {
 		t.Errorf("ignored env: %+v", d)
 	}
 	if d := details("local.env"); !d["git"].Warn || !strings.Contains(d["git"].Value, "not ignored") {
 		t.Errorf("untracked env: %+v", d)
 	}
 }
 func TestKeyNamesEscaped(t *testing.T) {
 	keys, err := parseKeys("s.yaml", []byte("app.name: x\ndb:\n  password: y\nlist: [a, b]\nodd[1]: z\n"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	var got []string
 	for _, k := range keys {
 		got = append(got, k.name+" "+k.extract)
 	}
 	want := `app\.name ["app.name"]|db.password ["db"]["password"]|list[0] ["list"][0]|list[1] ["list"][1]|odd\[1\] ["odd[1]"]`
 	if strings.Join(got, "|") != want {
 		t.Errorf("keys = %s\nwant   %s", strings.Join(got, "|"), want)
 	}
 	keys, err = parseKeys(".env", []byte("spring.url=a\nexport TOKEN=b\nSPACED = c\n"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	got = nil
 	for _, k := range keys {
 		got = append(got, k.name+" "+k.extract)
 	}
 	want = `spring.url ["spring.url"]|TOKEN ["export TOKEN"]|SPACED ["SPACED "]`
 	if strings.Join(got, "|") != want {
 		t.Errorf("dotenv keys = %s\nwant   %s", strings.Join(got, "|"), want)
 	}
 }
@@ -0,0 +1,236 @@
 package repo
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"io"
 	"path"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
 	"unicode"
 	"go.yaml.in/yaml/v3"
 )
 // Spring Boot config files: application*.properties/.yml and bootstrap*,
 // their keys filtered by the secret patterns (patterns.go).
 // springName is application.yml, application-prod.properties, bootstrap.yaml
 // and the like; not applications.yaml (Argo CD's) or application.yml.example.
 var springName = regexp.MustCompile(`^(application|bootstrap)(-[^.]+)?\.(properties|ya?ml)$`)
 // IsSpring reports whether f is named like a Spring Boot config file, and
 // isn't a Helm chart's template of one.
 func IsSpring(f string) bool {
 	return springName.MatchString(strings.ToLower(path.Base(f))) && path.Base(path.Dir(f)) != "templates"
 }
 func springFormat(f string) string {
 	if strings.ToLower(filepath.Ext(f)) == ".properties" {
 		return "properties"
 	}
 	return "yaml"
 }
 var springType = configType{
 	name: "spring", is: IsSpring, format: springFormat, parse: parseSpring,
 	jasyptSetting: func(string) string { return "jasypt.encryptor.password" },
 	placeholder:   springPlaceholder,
 }
 // springPlaceholderRe is Spring's ${name} or ${name:default}.
 var springPlaceholderRe = regexp.MustCompile(`^\$\{([^:}]+)(:([^}]*))?\}$`)
 func springPlaceholder(v string) (name, def string, hasDef, ok bool) {
 	m := springPlaceholderRe.FindStringSubmatch(v)
 	if m == nil {
 		return "", "", false, false
 	}
 	return m[1], m[3], m[2] != "", true
 }
 func parseSpring(file string, b []byte) ([]configKey, error) {
 	var keys []configKey
 	var err error
 	if springFormat(file) == "properties" {
 		keys = parseProperties(b)
 	} else {
 		keys, err = parseSpringYAML(b)
 	}
 	for i := range keys {
 		keys[i].ref = reference(springPlaceholder, keys[i].value)
 	}
 	return keys, err
 }
 // springDocs names the keys of a multi-document file's later documents
 // after the profile they're for, so each name is one key:
 // spring.datasource.password (prod).
 func springDocs(docs [][]configKey) []configKey {
 	var out []configKey
 	for i, doc := range docs {
 		suffix := ""
 		if i > 0 {
 			suffix = fmt.Sprintf(" (document %d)", i+1)
 			for _, k := range doc {
 				if k.key == "spring.config.activate.on-profile" || k.key == "spring.profiles" {
 					suffix = " (" + k.value + ")"
 				}
 			}
 		}
 		for _, k := range doc {
 			k.name = k.key + suffix
 			out = append(out, k)
 		}
 	}
 	return out
 }
 // mavenFiltered is a value Maven fills in at build time, @project.version@:
 // not YAML until it's quoted.
 var mavenFiltered = regexp.MustCompile(`(?m)(:[ \t]+|^[ \t]*-[ \t]+)(@[^\n]*?)[ \t]*$`)
 func parseSpringYAML(b []byte) ([]configKey, error) {
 	b = mavenFiltered.ReplaceAllFunc(b, func(m []byte) []byte {
 		sub := mavenFiltered.FindSubmatch(m)
 		return fmt.Appendf(nil, "%s'%s'", sub[1], bytes.ReplaceAll(sub[2], []byte("'"), []byte("''")))
 	})
 	dec := yaml.NewDecoder(bytes.NewReader(b))
 	var docs [][]configKey
 	for {
 		var doc yaml.Node
 		err := dec.Decode(&doc)
 		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {
 			return nil, err
 		}
 		var keys []configKey
 		if len(doc.Content) > 0 {
 			springWalk(doc.Content[0], "", &keys)
 		}
 		docs = append(docs, keys)
 	}
 	return springDocs(docs), nil
 }
 // springWalk names keys the way Spring does: nested keys joined by dots,
 // list items by index (servers[0]).
 func springWalk(n *yaml.Node, name string, out *[]configKey) {
 	switch n.Kind {
 	case yaml.MappingNode:
 		for i := 0; i+1 < len(n.Content); i += 2 {
 			child := n.Content[i].Value
 			if name != "" {
 				child = name + "." + child
 			}
 			springWalk(n.Content[i+1], child, out)
 		}
 	case yaml.SequenceNode:
 		for i, c := range n.Content {
 			springWalk(c, fmt.Sprintf("%s[%d]", name, i), out)
 		}
 	case yaml.AliasNode:
 		if n.Alias != nil {
 			springWalk(n.Alias, name, out)
 		}
 	case yaml.ScalarNode:
 		if name != "" {
 			*out = append(*out, configKey{key: name, value: n.Value, line: n.Line})
 		}
 	}
 }
 // parseProperties reads a Java .properties file: key=value, key: value or
 // key value, lines continued with a trailing backslash, # and ! comments,
 // and #--- between documents (Spring Boot 2.4+).
 func parseProperties(b []byte) []configKey {
 	lines := strings.Split(strings.ReplaceAll(string(b), "\r\n", "\n"), "\n")
 	var docs [][]configKey
 	var doc []configKey
 	for i := 0; i < len(lines); i++ {
 		start := i + 1
 		line := strings.TrimLeftFunc(lines[i], unicode.IsSpace)
 		if line == "#---" || line == "!---" {
 			docs, doc = append(docs, doc), nil
 			continue
 		}
 		if line == "" || line[0] == '#' || line[0] == '!' {
 			continue
 		}
 		for continued(line) && i+1 < len(lines) {
 			i++
 			line = line[:len(line)-1] + strings.TrimLeftFunc(lines[i], unicode.IsSpace)
 		}
 		k, v := splitProperty(line)
 		doc = append(doc, configKey{key: unescapeProperty(k), value: unescapeProperty(v), line: start})
 	}
 	return springDocs(append(docs, doc))
 }
 // continued reports whether the line ends in an odd number of backslashes.
 func continued(line string) bool {
 	n := len(line) - len(strings.TrimRight(line, `\`))
 	return n%2 == 1
 }
 // splitProperty cuts a logical line at its first unescaped =, : or
 // whitespace; whitespace around the separator isn't part of either side.
 func splitProperty(line string) (key, value string) {
 	const space = " \t\f"
 	for i := 0; i < len(line); i++ {
 		switch c := line[i]; {
 		case c == '\\':
 			i++
 		case c == '=' || c == ':':
 			return line[:i], strings.TrimLeft(line[i+1:], space)
 		case strings.IndexByte(space, c) >= 0:
 			rest := strings.TrimLeft(line[i:], space)
 			if rest != "" && (rest[0] == '=' || rest[0] == ':') {
 				rest = strings.TrimLeft(rest[1:], space)
 			}
 			return line[:i], rest
 		}
 	}
 	return line, ""
 }
 func unescapeProperty(s string) string {
 	if !strings.Contains(s, `\`) {
 		return s
 	}
 	var b strings.Builder
 	for i := 0; i < len(s); i++ {
 		if s[i] != '\\' || i+1 == len(s) {
 			b.WriteByte(s[i])
 			continue
 		}
 		i++
 		switch s[i] {
 		case 't':
 			b.WriteByte('\t')
 		case 'n':
 			b.WriteByte('\n')
 		case 'r':
 			b.WriteByte('\r')
 		case 'f':
 			b.WriteByte('\f')
 		case 'u':
 			if i+5 <= len(s) {
 				if r, err := strconv.ParseUint(s[i+1:i+5], 16, 32); err == nil {
 					b.WriteRune(rune(r))
 					i += 4
 					continue
 				}
 			}
 			b.WriteByte('u')
 		default:
 			b.WriteByte(s[i])
 		}
 	}
 	return b.String()
 }
@@ -0,0 +1,255 @@
 package repo
 import (
 	"context"
 	"maps"
 	"os"
 	"path/filepath"
 	"slices"
 	"strings"
 	"testing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 func TestIsSpring(t *testing.T) {
 	for f, want := range map[string]bool{
 		"src/main/resources/application.yml":        true,
 		"application-prod.properties":               true,
 		"config/application-local.yaml":             true,
 		"bootstrap.yml":                             true,
 		"applicationset/dev/applications.yaml":      false, // Argo CD's
 		"chart/templates/application.yaml":          false, // Helm's
 		"application.yml.example":                   false,
 		"application.json":                          false,
 		"src/main/resources/applicationContext.xml": false,
 	} {
 		if IsSpring(f) != want {
 			t.Errorf("%s: %t", f, !want)
 		}
 	}
 }
 func springNames(keys []configKey) map[string]string {
 	out := map[string]string{}
 	for _, k := range keys {
 		out[k.name] = k.value
 	}
 	return out
 }
 func TestParseProperties(t *testing.T) {
 	got := springNames(parseProperties([]byte(`# a comment
 ! another
 a=1
 b : 2
 c 3
 d\:e=4
 long=one, \
     two
 unicode=café
 empty=
 #---
 spring.config.activate.on-profile=prod
 a=prod-1
 `)))
 	want := map[string]string{
 		"a": "1", "b": "2", "c": "3", "d:e": "4", "long": "one, two", "unicode": "café", "empty": "",
 		"spring.config.activate.on-profile (prod)": "prod", "a (prod)": "prod-1",
 	}
 	if !maps.Equal(got, want) {
 		t.Errorf("got  %v\nwant %v", got, want)
 	}
 }
 func TestParseSpringYAML(t *testing.T) {
 	keys, err := parseSpringYAML([]byte(`info.version: @project.version@
 artifacts:
  - @project.artifactId@
 spring:
  datasource:
    password: ${DB_PASSWORD}
 servers:
  - name: a
    secret: x
 logging.level:
  com.example: DEBUG
 ---
 spring:
  config.activate.on-profile: prod
  datasource:
    password: hunter2
 ---
 other: y
 `))
 	if err != nil {
 		t.Fatal(err)
 	}
 	want := map[string]string{
 		"info.version": "@project.version@", "artifacts[0]": "@project.artifactId@",
 		"spring.datasource.password": "${DB_PASSWORD}", "servers[0].name": "a", "servers[0].secret": "x",
 		"logging.level.com.example":                "DEBUG",
 		"spring.config.activate.on-profile (prod)": "prod", "spring.datasource.password (prod)": "hunter2",
 		"other (document 3)": "y",
 	}
 	if got := springNames(keys); !maps.Equal(got, want) {
 		t.Errorf("got  %v\nwant %v", got, want)
 	}
 }
 func TestSpringDefaults(t *testing.T) {
 	f, err := (&Provider{}).filterFor(t.TempDir(), "spring")
 	if err != nil {
 		t.Fatal(err)
 	}
 	for key, value := range map[string]string{
 		"spring.datasource.password":                                 "x",
 		"spring.security.oauth2.client.registration.a.client-secret": "x",
 		"profapp.payment.checkoutKey":                                "x",
 		"app.clients.sgig.sgig-passord":                              "x",
 		"jasypt.encryptor.password":                                  "${JASYPT_ENCRYPTOR_PASSWORD}",
 		"spring.datasource.url":                                      "jdbc:postgresql://app:hunter2@db:5432/app",
 		"app.servicebus.connection":                                  "Endpoint=sb://x/;SharedAccessKeyName=a;SharedAccessKey=b",
 		"app.name":                                                   "ENC(abc==)",
 	} {
 		if !f.secret(key, value) {
 			t.Errorf("%s=%s isn't listed", key, value)
 		}
 	}
 	for key, value := range map[string]string{
 		"spring.security.oauth2.client.provider.a.token-uri":                    "https://idp/token",
 		"spring.security.oauth2.client.registration.a.authorization-grant-type": "client_credentials",
 		"app.frontend.keycloak.url":                                             "https://keycloak",
 		"server.port":                                                           "8080",
 		"spring.datasource.url":                                                 "jdbc:postgresql://db:5432/app",
 	} {
 		if f.secret(key, value) {
 			t.Errorf("%s=%s is listed", key, value)
 		}
 	}
 }
 func TestSpringFiles(t *testing.T) {
 	root := gitRepo(t, map[string]string{
 		"src/main/resources/application.yml": `server:
  port: 8080
 spring:
  datasource:
    url: jdbc:postgresql://db/app
    password: ${DB_PASSWORD}
 jasypt:
  encryptor:
    password: ${JASYPT_ENCRYPTOR_PASSWORD}
 app:
  api-key: ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)
 `,
 		"src/main/resources/application-local.properties": "server.port=8081\nspring.datasource.password=hunter2\n",
 		"applicationset/applications.yaml":                "kind: ApplicationSet\n",
 	})
 	ctx := context.Background()
 	details := func(p *Provider, c provider.Container) map[string]provider.Attr {
 		attrs, err := p.Details(ctx, c)
 		if err != nil {
 			t.Fatal(err)
 		}
 		out := map[string]provider.Attr{}
 		for _, a := range attrs {
 			out[a.Label] = a
 		}
 		return out
 	}
 	p := New(Settings{Dir: root})
 	srcs, _ := p.Sources(ctx)
 	cs, err := p.Containers(ctx, srcs[0])
 	if err != nil {
 		t.Fatal(err)
 	}
 	var files []string
 	for _, c := range cs {
 		files = append(files, c.Name+" · "+c.Detail)
 	}
 	if want := []string{
 		"src/main/resources/application-local.properties · spring · properties",
 		"src/main/resources/application.yml · spring · yaml",
 	}; !slices.Equal(files, want) {
 		t.Fatalf("files %v\nwant  %v", files, want)
 	}
 	local, yml := cs[0], cs[1]
 	listed, _ := p.Objects(ctx, yml, provider.TypeSecret)
 	keys := shown(listed)
 	var names []string
 	for _, k := range keys {
 		names = append(names, strings.TrimSpace(k.Name+" "+k.Detail))
 	}
 	if len(listed) != 5 || !listed[0].Hidden || listed[0].Name != "server.port" {
 		t.Errorf("hidden keys: %+v", listed)
 	}
 	if want := []string{"spring.datasource.password reference", "jasypt.encryptor.password reference", "app.api-key jasypt"}; !slices.Equal(names, want) {
 		t.Errorf("keys %v, want %v", names, want)
 	}
 	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "test-password")
 	if v, err := p.Value(ctx, keys[2]); err != nil || v.Reveal() != "hunter2" {
 		t.Errorf("value: %q %v", v.Reveal(), err)
 	}
 	link := provider.Object{Container: provider.Container{Source: srcs[0], Name: "src/main/resources/application.yml"}, Name: "spring.datasource.password"}
 	if v, err := p.Value(ctx, link); err != nil || v.Reveal() != "${DB_PASSWORD}" {
 		t.Errorf("from a link: %q %v", v.Reveal(), err)
 	}
 	if f, _ := p.File(yml, &keys[1]); f.Line != 9 || f.Sops != "" {
 		t.Errorf("file: %+v", f)
 	}
 	// References and Jasypt aren't plain text in git; a password is.
 	if d := details(p, yml); d["hidden keys"].Value != "2, not matched by the secret patterns" || d["git"].Warn || d["encryption"].Value != "jasypt: 1 of 5 values" {
 		t.Errorf("yml: %+v", d)
 	}
 	if d := details(p, local); !d["git"].Warn {
 		t.Errorf("local: %+v", d)
 	}
 	// The config's patterns, and the repo's over them.
 	all := []string{".*"}
 	p = New(Settings{Dir: root, SecretPatterns: SecretPatterns{Keys: &all}})
 	if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(shown(keys)) != 5 {
 		t.Errorf("every key: %d", len(shown(keys)))
 	}
 	lazysecrets := filepath.Join(root, ".lazysecrets.yaml")
 	os.WriteFile(lazysecrets, []byte("spring:\n  secretPatterns:\n    keys: [\"url$\"]\n    values: []\n"), 0o644)
 	if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(shown(keys)) != 1 || shown(keys)[0].Name != "spring.datasource.url" {
 		t.Errorf("repo's patterns: %v", keys)
 	}
 	os.WriteFile(lazysecrets, []byte("spring:\n  secretPatterns:\n    keys: [\"(\"]\n"), 0o644)
 	if _, err := p.Objects(ctx, yml, provider.TypeSecret); err == nil || !strings.Contains(err.Error(), ".lazysecrets.yaml: spring.secretPatterns.keys[0]") {
 		t.Errorf("bad pattern: %v", err)
 	}
 }
 func shown(objects []provider.Object) []provider.Object {
 	return slices.DeleteFunc(slices.Clone(objects), func(o provider.Object) bool { return o.Hidden })
 }
 func TestHiddenFiles(t *testing.T) {
 	root := gitRepo(t, map[string]string{
 		"a/application.yml": "server:\n  port: 8080\n",
 		"b/application.yml": "spring.datasource.password: x\n",
 	})
 	ctx := context.Background()
 	p := New(Settings{Dir: root})
 	srcs, _ := p.Sources(ctx)
 	if len(srcs) != 1 || srcs[0].Hidden {
 		t.Fatalf("sources: %+v", srcs)
 	}
 	cs, _ := p.Containers(ctx, srcs[0])
 	if len(cs) != 2 || !cs[0].Hidden || cs[1].Hidden {
 		t.Errorf("files: %+v", cs)
 	}
 	// A repo with only hidden files is hidden too.
 	root = gitRepo(t, map[string]string{"application.yml": "server:\n  port: 8080\n"})
 	srcs, _ = New(Settings{Dir: root}).Sources(ctx)
 	if len(srcs) != 1 || !srcs[0].Hidden {
 		t.Errorf("hidden repo: %+v", srcs)
 	}
 }
@@ -21,8 +21,6 @@ func NewSecretValue(b []byte) SecretValue {
 // Reveal returns the plaintext. Call it only to display or copy the value.
 func (v SecretValue) Reveal() string { return string(v.b) }
 func (v SecretValue) Len() int { return len(v.b) }
 func (v SecretValue) String() string   { return masked }
 func (v SecretValue) GoString() string { return masked }
@@ -0,0 +1,103 @@
 package ref
 import (
 	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 // Read reads what r points at without listing its vault: the vault and
 // name are enough for Azure, tried with each account (account, the one
 // that last read it, first, in source); for Databricks and repos the
 // profile or repo is found by its host. It also returns the version read,
 // when the provider tells (provider.Versioned).
 func Read(ctx context.Context, providers []provider.Provider, r Ref, account, source string) (provider.SecretValue, string, error) {
 	if r.IsShare() || r.IsSource() || r.IsContainer() {
 		what := "vault or scope"
 		switch {
 		case r.IsShare():
 			what = "share link"
 		case r.IsSource():
 			what = "subscription or workspace"
 		}
 		return provider.SecretValue{}, "", fmt.Errorf("%s points at a %s, not a secret", r, what)
 	}
 	if r.Kind != provider.KindAzure && r.Host == "" {
 		return provider.SecretValue{}, "", errors.New("{{secrets/…}} names no workspace: use its lazysecrets:// link (s in lazysecrets)")
 	}
 	type try struct {
 		p provider.Provider
 		o provider.Object
 	}
 	var tries []try
 	for _, p := range providers {
 		if p.Kind() != r.Kind {
 			continue
 		}
 		o := provider.Object{Name: r.Name, Type: cmp.Or(r.Type, provider.TypeSecret), Version: r.Version}
 		if r.Kind != provider.KindAzure { // by host: workspaces, repos
 			loc, ok := p.(provider.Locator)
 			if !ok {
 				continue
 			}
 			profile, found, err := loc.Locate(ctx, r.Host)
 			if err != nil || !found {
 				continue
 			}
 			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: profile}
 			o.Container = provider.Container{Source: src, Name: r.Scope}
 			// Listing the scopes tells a Key Vault-backed one, whose value
 			// can then be read from the vault if Databricks refuses.
 			if cs, err := p.Containers(ctx, src); err == nil {
 				for _, c := range cs {
 					if c.Name == r.Scope {
 						c.Source = src
 						o.Container = c
 					}
 				}
 			}
 		} else {
 			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: source}
 			o.Container = provider.Container{Source: src, Name: r.ContainerName(), Detail: r.VaultURL()}
 		}
 		t := try{p, o}
 		if p.ID() == account {
 			tries = append([]try{t}, tries...)
 		} else {
 			tries = append(tries, t)
 		}
 	}
 	if len(tries) == 0 {
 		switch r.Kind {
 		case provider.KindDatabricks:
 			return provider.SecretValue{}, "", fmt.Errorf("no Databricks profile for workspace %s", r.Host)
 		case provider.KindRepo:
 			return provider.SecretValue{}, "", fmt.Errorf("repo %s isn't here: run it inside the repo, or list it under providers.repos.paths", r.Host)
 		}
 		return provider.SecretValue{}, "", fmt.Errorf("no %s account to read %s with", r.Kind, r)
 	}
 	var errs []error
 	for _, t := range tries {
 		v, version, err := value(ctx, t.p, t.o)
 		if err == nil {
 			return v, version, nil
 		}
 		if len(tries) == 1 || ctx.Err() != nil {
 			return provider.SecretValue{}, "", err
 		}
 		errs = append(errs, fmt.Errorf("%s: %w", t.p.Label(), err))
 	}
 	return provider.SecretValue{}, "", errors.Join(errs...)
 }
 func value(ctx context.Context, p provider.Provider, o provider.Object) (provider.SecretValue, string, error) {
 	if vp, ok := p.(provider.Versioned); ok {
 		return vp.VersionedValue(ctx, o)
 	}
 	v, err := p.Value(ctx, o)
 	return v, o.Version, err
 }
@@ -10,11 +10,15 @@
 //	lazysecrets://azure/<vault-host>[/<secrets|keys|certificates>[/<name>[/<version>]]]
 //	lazysecrets://databricks/<workspace-host>[/<scope>[/<key>]]
 //	lazysecrets://repo/<repo>[/<file>[/<key>]]
 //	lazysecrets://share/<sealed files>
 //
 // A repo is its git remote without scheme or .git
 // (git.kebcloud.no/keb/infra), the file its path in the repo and the key
 // its path in the file (db.password); slashes inside them are escaped.
 //
 // A share link carries files, encrypted (package share), instead of
 // naming something.
 //
 // Vault hosts always contain dots, so "subscriptions" can't be one.
 //
 // Every path segment is percent-encoded, so names may hold any character.
@@ -49,10 +53,23 @@ type Ref struct {
 	Type    provider.ObjectType
 	Name    string // object name; empty for a container link
 	Version string
 	// Share is a share link's sealed files, as in the link; the other
 	// fields are empty. Package share reads it.
 	Share string
 	// Account, when set, is the provider (its ID) to open or read it
 	// with when several could, from lazysecrets list. It isn't part of
 	// the link.
 	Account string
 }
 // IsShare reports whether r is a share link.
 func (r Ref) IsShare() bool { return r.Share != "" }
 // IsSource reports whether r points at a subscription or workspace.
 func (r Ref) IsSource() bool {
 	if r.IsShare() {
 		return false
 	}
 	if r.Kind != provider.KindAzure {
 		return r.Scope == ""
 	}
@@ -60,7 +77,7 @@ func (r Ref) IsSource() bool {
 }
 // IsContainer reports whether r points at a vault or scope.
-func (r Ref) IsContainer() bool { return r.Name == "" && !r.IsSource() }
+func (r Ref) IsContainer() bool { return r.Name == "" && !r.IsSource() && !r.IsShare() }
 // ContainerName is the vault name (from its host) or the scope.
 func (r Ref) ContainerName() string {
@@ -75,15 +92,9 @@ func (r Ref) ContainerName() string {
 // Container.Detail.
 func (r Ref) VaultURL() string { return "https://" + r.Host + "/" }
 var collections = map[provider.ObjectType]string{
 	provider.TypeSecret:      "secrets",
 	provider.TypeKey:         "keys",
 	provider.TypeCertificate: "certificates",
 }
 func typeOf(collection string) (provider.ObjectType, bool) {
-	for t, c := range collections {
+	for _, t := range []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate} {
-		if strings.EqualFold(c, collection) {
+		if strings.EqualFold(t.Collection(), collection) {
 			return t, true
 		}
 	}
@@ -101,7 +112,7 @@ func (r Ref) IdentifierURL() string {
 	if r.Type == "" {
 		return u + "/"
 	}
-	for _, seg := range []string{collections[r.Type], r.Name, r.Version} {
+	for _, seg := range []string{r.Type.Collection(), r.Name, r.Version} {
 		if seg != "" {
 			u += "/" + url.PathEscape(seg)
 		}
@@ -111,6 +122,9 @@ func (r Ref) IdentifierURL() string {
 // String is the lazysecrets:// link.
 func (r Ref) String() string {
 	if r.IsShare() {
 		return Scheme + "://share/" + r.Share
 	}
 	if r.Kind == provider.KindAzure && r.Subscription != "" {
 		return Scheme + "://azure/subscriptions/" + url.PathEscape(r.Subscription)
 	}
@@ -120,7 +134,7 @@ func (r Ref) String() string {
 		segs = append(segs, r.Scope, r.Name)
 	default:
 		if r.Type != "" {
-			segs = append(segs, collections[r.Type])
+			segs = append(segs, r.Type.Collection())
 		}
 		segs = append(segs, r.Name, r.Version)
 	}
@@ -208,6 +222,8 @@ var (
 	portalVault = regexp.MustCompile(`(?i)/providers/Microsoft\.KeyVault/vaults/([A-Za-z0-9-]+)`)
 	// …/asset/Microsoft_Azure_KeyVault/<Secret|Key|Certificate>/<identifier URL>
 	portalAsset = regexp.MustCompile(`(?i)/asset/Microsoft_Azure_KeyVault/[A-Za-z]+/(https://\S+)$`)
 	// a share link's sealed files: unpadded base64url
 	sealed = regexp.MustCompile(`^[A-Za-z0-9_-]{16,}$`)
 )
 // Parse reads any supported reference.
@@ -238,6 +254,12 @@ func parseLink(s string) (Ref, error) {
 	if err != nil {
 		return Ref{}, err
 	}
 	if strings.EqualFold(u.Host, "share") {
 		if len(segs) != 1 || !sealed.MatchString(segs[0]) {
 			return Ref{}, errors.New("share link is cut short or garbled: copy all of it")
 		}
 		return Ref{Share: segs[0]}, nil
 	}
 	var r Ref
 	if len(segs) == 0 || segs[0] == "" {
 		return Ref{}, errors.New("link has no vault or workspace")
@@ -245,7 +267,7 @@ func parseLink(s string) (Ref, error) {
 	r.Host = strings.ToLower(segs[0])
 	rest := segs[1:]
-	switch strings.ToLower(u.Host) {
+	switch host := strings.ToLower(u.Host); host {
 	case "azure":
 		r.Kind = provider.KindAzure
 		if r.Host == "subscriptions" {
@@ -272,11 +294,11 @@ func parseLink(s string) (Ref, error) {
 		}
 	case "databricks", "repo":
 		r.Kind = provider.KindDatabricks
-		if strings.EqualFold(u.Host, "repo") {
+		if host == "repo" {
 			r.Kind = provider.KindRepo
 		}
 		if len(rest) > 2 {
-			return Ref{}, fmt.Errorf("%s link has too many parts", strings.ToLower(u.Host))
+			return Ref{}, fmt.Errorf("%s link has too many parts", host)
 		}
 		if len(rest) > 0 {
 			r.Scope = rest[0]
@@ -286,7 +308,7 @@ func parseLink(s string) (Ref, error) {
 		}
 	default:
-		return Ref{}, fmt.Errorf("unknown provider %q in link", u.Host)
+		return Ref{}, fmt.Errorf("unknown provider %q in link: a newer lazysecrets may know it (lazysecrets update)", u.Host)
 	}
 	return r, nil
 }
@@ -0,0 +1,74 @@
 package share
 import (
 	"fmt"
 	"strings"
 	"unicode"
 	"unicode/utf8"
 )
 // Rules are what a key's value must be to share with it: random enough
 // that guessing it is out of reach, since anyone with a link can try.
 type Rules struct {
 	MinLength  int // characters
 	MinClasses int // kinds of character: lowercase, uppercase, digits, symbols
 }
 // DefaultRules take a random base64 or hex value (openssl rand -base64
 // 32, or -hex 32) and refuse passwords made up to be remembered.
 var DefaultRules = Rules{MinLength: 32, MinClasses: 2}
 // Check reports what key lacks, without showing it.
 func (r Rules) Check(key []byte) error {
 	r = r.withDefaults()
 	s := string(key)
 	var lower, upper, digit, symbol bool
 	for _, c := range s {
 		switch {
 		case unicode.IsLower(c):
 			lower = true
 		case unicode.IsUpper(c):
 			upper = true
 		case unicode.IsDigit(c):
 			digit = true
 		default:
 			symbol = true
 		}
 	}
 	kinds := 0
 	for _, has := range []bool{lower, upper, digit, symbol} {
 		if has {
 			kinds++
 		}
 	}
 	n := utf8.RuneCountInString(s)
 	var has, needs []string
 	if n < r.MinLength {
 		has = append(has, fmt.Sprintf("%d characters", n))
 		needs = append(needs, fmt.Sprintf("%d (minLength)", r.MinLength))
 	}
 	if kinds < r.MinClasses {
 		kind := "kinds"
 		if kinds == 1 {
 			kind = "kind"
 		}
 		has = append(has, fmt.Sprintf("%d %s of character", kinds, kind))
 		needs = append(needs, fmt.Sprintf("%d of lowercase, uppercase, digits and symbols (minClasses)", r.MinClasses))
 	}
 	if len(has) == 0 {
 		return nil
 	}
 	return fmt.Errorf("its value has %s; sharing.keyRules needs %s",
 		strings.Join(has, " and "), strings.Join(needs, " and "))
 }
 func (r Rules) withDefaults() Rules {
 	if r.MinLength == 0 {
 		r.MinLength = DefaultRules.MinLength
 	}
 	if r.MinClasses == 0 {
 		r.MinClasses = DefaultRules.MinClasses
 	}
 	r.MinLength = max(r.MinLength, MinKey)
 	return r
 }
@@ -0,0 +1,308 @@
 // Package share seals env files into a lazysecrets://share link, so they
 // can be passed on in chat or a ticket. They're encrypted with the value of
 // a secret (in Key Vault, Databricks or a repo's SOPS file): whoever can
 // read that secret can open the link, nobody else.
 //
 // A link says in the clear which secret it's encrypted with, the repo the
 // files are from and how many there are, which is what's needed to open
 // it. The files' paths and contents are encrypted, with age
 // (https://age-encryption.org), the secret's value as its passphrase.
 //
 // The link's payload is unpadded base64url of:
 //
 //	version (1) | uvarint length of the header | header (JSON) | age file
 //
 // The age file holds the files as deflated JSON.
 //
 // A change to the format gets the next version, and Read keeps reading
 // every earlier one: links stay in chat and tickets for years. A
 // version it doesn't know is from a newer lazysecrets.
 package share
 import (
 	"bytes"
 	"compress/flate"
 	"encoding/base64"
 	"encoding/binary"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"path"
 	"strings"
 	"unicode/utf8"
 	"filippo.io/age"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 )
 const (
 	// version is the format's, written first; see the package doc.
 	version = 1
 	// MaxLink keeps a link short enough for chat and tickets (Teams takes
 	// about 28 KB) and for passing it to a terminal window.
 	MaxLink = 16 << 10
 	// MinKey is the shortest key the rules can ask for.
 	MinKey = 16
 	// maxUnpacked caps the bytes opening a link unpacks.
 	maxUnpacked = 1 << 20
 )
 // workFactor is the scrypt work factor for sealing: 2^15, about 40 ms
 // each way, instead of age's 2^18 (a third of a second). scrypt makes
 // guessing a weak passphrase slow; a key keeping to the rules is random
 // and long enough not to need that. maxWorkFactor is the most opening
 // accepts, so a link can't make it work for minutes.
 var workFactor, maxWorkFactor = 15, 20
 // File is a shared file.
 type File struct {
 	Path string // relative to the repo's root, with slashes
 	Data []byte
 }
 // Header is what a link says in the clear.
 type Header struct {
 	// Key is the secret whose value the files are encrypted with.
 	Key ref.Ref
 	// Repo is the repo the files are from: its remote without scheme or
 	// .git (a repo link's host).
 	Repo string
 	// Files is how many files the link holds.
 	Files int
 }
 // Sealed is a share link read, its files still encrypted.
 type Sealed struct {
 	Header
 	box []byte
 }
 type header struct {
 	Key   string `json:"key"`
 	Repo  string `json:"repo,omitempty"`
 	Files int    `json:"files"`
 }
 type file struct {
 	Path string `json:"path"`
 	Data string `json:"data"`
 }
 // Seal encrypts files with key, the value of h.Key, into a share link,
 // if key keeps to rules (*KeyError if not).
 func Seal(h Header, key []byte, files []File, rules Rules) (ref.Ref, error) {
 	if _, err := ParseKey(h.Key.String()); err != nil {
 		return ref.Ref{}, fmt.Errorf("the key: %w", err)
 	}
 	if err := rules.Check(key); err != nil {
 		return ref.Ref{}, &KeyError{Name: h.Key.Name, Err: err}
 	}
 	if len(files) == 0 {
 		return ref.Ref{}, errors.New("no files to share")
 	}
 	plain := make([]file, len(files))
 	for i, f := range files {
 		if err := CheckPath(f.Path); err != nil {
 			return ref.Ref{}, err
 		}
 		if !utf8.Valid(f.Data) {
 			return ref.Ref{}, fmt.Errorf("%s isn't text", f.Path)
 		}
 		plain[i] = file{Path: f.Path, Data: string(f.Data)}
 	}
 	b, err := json.Marshal(plain)
 	if err != nil {
 		return ref.Ref{}, err
 	}
 	rcpt, err := age.NewScryptRecipient(string(key))
 	if err != nil {
 		return ref.Ref{}, err
 	}
 	rcpt.SetWorkFactor(workFactor)
 	var box bytes.Buffer
 	enc, err := age.Encrypt(&box, rcpt)
 	if err != nil {
 		return ref.Ref{}, err
 	}
 	z, _ := flate.NewWriter(enc, flate.BestCompression)
 	if _, err := z.Write(b); err != nil {
 		return ref.Ref{}, err
 	}
 	if err := z.Close(); err != nil {
 		return ref.Ref{}, err
 	}
 	if err := enc.Close(); err != nil {
 		return ref.Ref{}, err
 	}
 	hb, err := json.Marshal(header{Key: h.Key.String(), Repo: h.Repo, Files: len(files)})
 	if err != nil {
 		return ref.Ref{}, err
 	}
 	payload := binary.AppendUvarint([]byte{version}, uint64(len(hb)))
 	payload = append(append(payload, hb...), box.Bytes()...)
 	r := ref.Ref{Share: base64.RawURLEncoding.EncodeToString(payload)}
 	if n := len(r.String()); n > MaxLink {
 		return ref.Ref{}, fmt.Errorf("the link would be %d KB, more than the %d KB it can be: share fewer files", n>>10, MaxLink>>10)
 	}
 	return r, nil
 }
 // KeyError is a key that can't be used: it can't be read, or doesn't
 // keep to the rules.
 type KeyError struct {
 	Name string // the secret's
 	Err  error
 }
 func (e *KeyError) Error() string { return "can't use " + e.Name + ": " + e.Err.Error() }
 func (e *KeyError) Unwrap() error { return e.Err }
 // Read reads a share link's header.
 func Read(r ref.Ref) (Sealed, error) {
 	bad := errors.New("share link is cut short or garbled: copy all of it")
 	b, err := base64.RawURLEncoding.DecodeString(r.Share)
 	if err != nil || len(b) < 2 {
 		return Sealed{}, bad
 	}
 	if b[0] != version {
 		return Sealed{}, errors.New("share link is from a newer lazysecrets: update it (lazysecrets update)")
 	}
 	n, size := binary.Uvarint(b[1:])
 	if size <= 0 {
 		return Sealed{}, bad
 	}
 	rest := b[1+size:]
 	if n > uint64(len(rest)) {
 		return Sealed{}, bad
 	}
 	var h header
 	if err := json.Unmarshal(rest[:n], &h); err != nil {
 		return Sealed{}, bad
 	}
 	key, err := ParseKey(h.Key)
 	if err != nil {
 		return Sealed{}, fmt.Errorf("share link's key: %w", err)
 	}
 	return Sealed{Header: Header{Key: key, Repo: h.Repo, Files: h.Files}, box: rest[n:]}, nil
 }
 // Open decrypts the files with key, the value of s.Key.
 func (s Sealed) Open(key []byte) ([]File, error) {
 	id, err := age.NewScryptIdentity(string(key))
 	if err != nil {
 		return nil, err
 	}
 	id.SetMaxWorkFactor(maxWorkFactor)
 	dec, err := age.Decrypt(bytes.NewReader(s.box), id)
 	if err != nil {
 		var wrong *age.NoIdentityMatchError
 		if errors.As(err, &wrong) {
 			return nil, s.wrongKey()
 		}
 		return nil, fmt.Errorf("can't decrypt the link: %w", err)
 	}
 	b, err := io.ReadAll(io.LimitReader(flate.NewReader(dec), maxUnpacked+1))
 	if err != nil {
 		return nil, fmt.Errorf("can't decrypt the link: %w", err)
 	}
 	if len(b) > maxUnpacked {
 		return nil, errors.New("the link holds more than lazysecrets unpacks")
 	}
 	var plain []file
 	if err := json.Unmarshal(b, &plain); err != nil {
 		return nil, fmt.Errorf("can't read the link's files: %w", err)
 	}
 	out := make([]File, len(plain))
 	for i, f := range plain {
 		if err := CheckPath(f.Path); err != nil {
 			return nil, err
 		}
 		out[i] = File{Path: f.Path, Data: []byte(f.Data)}
 	}
 	return out, nil
 }
 // wrongKey says why the key, read fine, doesn't decrypt the link: its
 // value isn't the one the link was made with.
 func (s Sealed) wrongKey() error {
 	name := s.Key.Name
 	switch {
 	case s.Key.Kind == provider.KindAzure && s.Key.Version != "":
 		// A version's value never changes.
 		return fmt.Errorf("%s at version %s doesn't decrypt it: the link may be damaged", name, s.Key.Version)
 	case s.Key.Kind == provider.KindAzure:
 		return fmt.Errorf("%s's current version isn't the one the link was made with, so it can't decrypt it: ask for a new link", name)
 	}
 	// Databricks secrets and SOPS values are changed in place.
 	return fmt.Errorf("%s has changed since the link was made, so it can't decrypt it: ask for a new link", name)
 }
 // CheckPath accepts a path relative to a repo's root, with slashes, of an
 // env file (.env, .env.local, prod.env) outside .git: what a link may
 // write.
 func CheckPath(p string) error {
 	switch {
 	case p == "" || path.IsAbs(p) || strings.ContainsAny(p, "\\\x00") || path.Clean(p) != p ||
 		p == ".." || strings.HasPrefix(p, "../"):
 		return fmt.Errorf("%q isn't a path inside a repo", p)
 	case p == ".git" || strings.HasPrefix(p, ".git/") || strings.Contains(p, "/.git/"):
 		return fmt.Errorf("%q is inside .git", p)
 	case !repo.IsEnv(p):
 		return fmt.Errorf("%q isn't an env file: only those can be shared", p)
 	}
 	return nil
 }
 // DefaultKey is the key for a repo's files: sharing.key in the repo's
 // .lazysecrets.yaml, else general (sharing.key in the config). ok is false
 // when neither names one.
 func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	link, err := repo.ShareKey(root)
 	if err != nil {
 		return ref.Ref{}, false, err
 	}
 	where := root + "/.lazysecrets.yaml"
 	if link == "" {
 		link, where = general, "the config"
 	}
 	if link == "" {
 		return ref.Ref{}, false, nil
 	}
 	key, err = ParseKey(link)
 	if err != nil {
 		return ref.Ref{}, false, fmt.Errorf("sharing.key in %s: %w", where, err)
 	}
 	return key, true, nil
 }
 // ParseKey reads which secret is the key: its lazysecrets:// link, Key
 // Vault URL or @Microsoft.KeyVault(...) reference.
 func ParseKey(s string) (ref.Ref, error) {
 	key, err := ref.Parse(s)
 	if err != nil {
 		return ref.Ref{}, err
 	}
 	switch {
 	case key.IsShare() || key.IsSource() || key.IsContainer() || (key.Type != "" && key.Type != provider.TypeSecret):
 		return ref.Ref{}, fmt.Errorf("%s isn't a secret", s)
 	case key.Kind == provider.KindDatabricks && key.Host == "":
 		return ref.Ref{}, fmt.Errorf("%s names no workspace: use its lazysecrets:// link", s)
 	}
 	return key, nil
 }
 // Pin is key at version, the version its value was read at, for Azure,
 // whose old versions stay readable: a link keeps working when the key
 // is rotated, until that version is disabled.
 func Pin(key ref.Ref, version string) ref.Ref {
 	if key.Kind == provider.KindAzure && key.Version == "" {
 		key.Version = version
 	}
 	return key
 }
@@ -0,0 +1,258 @@
 package share
 import (
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 )
 func init() { workFactor = 10 } // fast; opening accepts any up to maxWorkFactor
 var (
 	key  = ref.Ref{Kind: provider.KindAzure, Host: "kv-team.vault.azure.net", Type: provider.TypeSecret, Name: "env-share", Version: "91d3e0"}
 	pass = []byte("0123456789abcdef0123456789abcdef")
 )
 func TestSealOpen(t *testing.T) {
 	files := []File{
 		{Path: ".env", Data: []byte("DB_PASSWORD=hunter2\n")},
 		{Path: "apps/api/.env.local", Data: []byte("TOKEN=\"a b\" # quoted\n")},
 	}
 	link, err := Seal(Header{Key: key, Repo: "git.example.com/team/app"}, pass, files, Rules{})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if strings.Contains(link.String(), "hunter2") || strings.Contains(link.String(), "apps") {
 		t.Errorf("link shows what it shares: %s", link)
 	}
 	// It goes through ref.Parse like any link.
 	r, err := ref.Parse(link.String())
 	if err != nil || !r.IsShare() {
 		t.Fatalf("parse: %v, %+v", err, r)
 	}
 	s, err := Read(r)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if s.Key != key || s.Repo != "git.example.com/team/app" || s.Files != 2 {
 		t.Errorf("header %+v", s.Header)
 	}
 	got, err := s.Open(pass)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(got) != 2 || got[1].Path != files[1].Path || string(got[1].Data) != string(files[1].Data) {
 		t.Errorf("opened %+v", got)
 	}
 	if _, err := s.Open([]byte("another key, long enough to use")); err == nil || !strings.Contains(err.Error(), "env-share at version 91d3e0 doesn't decrypt it") {
 		t.Errorf("wrong key: %v", err)
 	}
 }
 func TestWrongKeySaysWhy(t *testing.T) {
 	files := []File{{Path: ".env", Data: []byte("A=1\n")}}
 	for link, want := range map[string]string{
 		"lazysecrets://databricks/adb-1.1.azuredatabricks.net/team/env-share": "env-share has changed since the link was made",
 		"lazysecrets://repo/git.example.com%2Fteam%2Fapp/secrets.yaml/share":  "share has changed since the link was made",
 		"lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share":       "env-share's current version isn't the one the link was made with",
 	} {
 		k, err := ParseKey(link)
 		if err != nil {
 			t.Fatal(err)
 		}
 		r, err := Seal(Header{Key: k}, pass, files, Rules{})
 		if err != nil {
 			t.Fatal(err)
 		}
 		s, _ := Read(r)
 		if _, err := s.Open([]byte("rotated since, and long enough to be a key")); err == nil || !strings.Contains(err.Error(), want) {
 			t.Errorf("%s: %v, want %q", link, err, want)
 		}
 	}
 }
 func TestSealRefuses(t *testing.T) {
 	ok := []File{{Path: ".env", Data: []byte("A=1")}}
 	for name, c := range map[string]struct {
 		h     Header
 		pass  []byte
 		files []File
 		want  string
 	}{
 		"short key":    {Header{Key: key}, []byte("short"), ok, "needs 32 (minLength)"},
 		"vault as key": {Header{Key: ref.Ref{Kind: provider.KindAzure, Host: "kv.vault.azure.net"}}, pass, ok, "isn't a secret"},
 		"no files":     {Header{Key: key}, pass, nil, "no files"},
 		"not env":      {Header{Key: key}, pass, []File{{Path: "main.go", Data: []byte("x")}}, "isn't an env file"},
 		"escapes":      {Header{Key: key}, pass, []File{{Path: "../.env", Data: []byte("x")}}, "inside a repo"},
 		"binary":       {Header{Key: key}, pass, []File{{Path: ".env", Data: []byte{0xff, 0xfe}}}, "isn't text"},
 		"too big":      {Header{Key: key}, pass, []File{{Path: ".env", Data: []byte(random(2 * MaxLink))}}, "more than the 16 KB"},
 	} {
 		if _, err := Seal(c.h, c.pass, c.files, Rules{}); err == nil || !strings.Contains(err.Error(), c.want) {
 			t.Errorf("%s: %v, want %q", name, err, c.want)
 		}
 	}
 }
 // random is text that doesn't compress.
 func random(n int) string {
 	var b strings.Builder
 	x := uint32(1)
 	for b.Len() < n {
 		x ^= x << 13
 		x ^= x >> 17
 		x ^= x << 5
 		b.WriteByte("abcdefghijklmnopqrstuvwxyz0123456789"[x%36])
 	}
 	return b.String()
 }
 func TestRules(t *testing.T) {
 	for _, c := range []struct {
 		r    Rules
 		key  string
 		pass bool
 	}{
 		{Rules{}, "q2Hd8bT4Lw1sZp9Kf6Vx3Nc7Rm0Ya5Ue", true},                                 // base64-like, 32
 		{Rules{}, "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", true}, // hex
 		{Rules{}, "correct-horse-battery-staple", false},                                    // 28: short
 		{Rules{}, strings.Repeat("a", 40), false},                                           // one kind
 		{Rules{MinLength: 16, MinClasses: 1}, strings.Repeat("a", 16), true},
 		{Rules{MinLength: 4}, "abc123", false}, // never under MinKey
 		{Rules{MinClasses: 4}, "q2Hd8bT4Lw1sZp9Kf6Vx3Nc7Rm0Ya5Ue", false},
 		{Rules{MinClasses: 4}, "q2Hd8bT4Lw1sZp9Kf6Vx3Nc7Rm0Ya5U+", true},
 	} {
 		if err := c.r.Check([]byte(c.key)); (err == nil) != c.pass {
 			t.Errorf("%+v %q: %v", c.r, c.key, err)
 		} else if err != nil && strings.Contains(err.Error(), c.key) {
 			t.Errorf("the error shows the key: %v", err)
 		}
 	}
 }
 func TestReadGarbled(t *testing.T) {
 	link, err := Seal(Header{Key: key}, pass, []File{{Path: ".env", Data: []byte("A=1")}}, Rules{})
 	if err != nil {
 		t.Fatal(err)
 	}
 	cut := ref.Ref{Share: link.Share[:len(link.Share)/2]}
 	s, err := Read(cut)
 	if err == nil {
 		_, err = s.Open(pass)
 	}
 	if err == nil {
 		t.Error("a link cut in half opened")
 	}
 	if _, err := Read(ref.Ref{Share: "AgAAAAAAAAAAAAAAAAAAAA"}); err == nil || !strings.Contains(err.Error(), "newer lazysecrets") {
 		t.Errorf("version 2: %v", err)
 	}
 }
 func TestCheckPath(t *testing.T) {
 	for _, p := range []string{".env", "apps/api/.env.local", "prod.env"} {
 		if err := CheckPath(p); err != nil {
 			t.Errorf("%s: %v", p, err)
 		}
 	}
 	for _, p := range []string{"", "/etc/.env", "../.env", "a/../.env", ".git/.env", "a/.git/x.env", `a\.env`, ".env.example", "node_modules/x/.env", "Makefile"} {
 		if err := CheckPath(p); err == nil {
 			t.Errorf("%q accepted", p)
 		}
 	}
 }
 func TestPlanWrite(t *testing.T) {
 	dir := t.TempDir()
 	if out, err := exec.Command("git", "-C", dir, "init", "-q").CombinedOutput(); err != nil {
 		t.Skip("git:", string(out))
 	}
 	os.WriteFile(filepath.Join(dir, ".gitignore"), []byte(".env\n"), 0o644)
 	os.WriteFile(filepath.Join(dir, ".env"), []byte("OLD=1\n"), 0o644)
 	targets, err := Plan(dir, []File{
 		{Path: ".env", Data: []byte("NEW=1\n")},
 		{Path: "apps/api/.env.local", Data: []byte("B=2\n")},
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !targets[0].Exists || targets[0].Exposed {
 		t.Errorf(".env: %+v", targets[0])
 	}
 	if targets[1].Exists || !targets[1].Exposed {
 		t.Errorf("apps/api/.env.local: %+v", targets[1])
 	}
 	for _, tg := range targets {
 		if err := tg.Write(); err != nil {
 			t.Fatal(err)
 		}
 	}
 	if b, _ := os.ReadFile(filepath.Join(dir, ".env")); string(b) != "NEW=1\n" {
 		t.Errorf(".env is %q", b)
 	}
 	info, err := os.Stat(filepath.Join(dir, "apps", "api", ".env.local"))
 	if err != nil || info.Mode().Perm() != 0o600 {
 		t.Errorf("new file: %v, %v", info.Mode(), err)
 	}
 }
 func TestPlanSymlinks(t *testing.T) {
 	dir, outside := t.TempDir(), t.TempDir()
 	if err := os.Symlink(outside, filepath.Join(dir, "apps")); err != nil {
 		t.Skip(err)
 	}
 	if _, err := Plan(dir, []File{{Path: "apps/.env"}}); err == nil || !strings.Contains(err.Error(), "out of the folder") {
 		t.Errorf("through a linked folder: %v", err)
 	}
 	os.Symlink(filepath.Join(outside, "x"), filepath.Join(dir, ".env"))
 	if _, err := Plan(dir, []File{{Path: ".env"}}); err == nil || !strings.Contains(err.Error(), "symlink") {
 		t.Errorf("onto a symlink: %v", err)
 	}
 }
 func TestParseKey(t *testing.T) {
 	for _, s := range []string{
 		"lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share",
 		"https://kv-team.vault.azure.net/secrets/env-share",
 		"@Microsoft.KeyVault(VaultName=kv-team;SecretName=env-share)",
 		"lazysecrets://databricks/adb-1.1.azuredatabricks.net/team/env-share",
 	} {
 		if k, err := ParseKey(s); err != nil || k.Name != "env-share" {
 			t.Errorf("%s: %+v, %v", s, k, err)
 		}
 	}
 	for s, want := range map[string]string{
 		"{{secrets/team/env-share}}":                  "names no workspace",
 		"https://kv-team.vault.azure.net/keys/sops":   "isn't a secret",
 		"https://kv-team.vault.azure.net/":            "isn't a secret",
 		"lazysecrets://azure/subscriptions/0000-1111": "isn't a secret",
 	} {
 		if _, err := ParseKey(s); err == nil || !strings.Contains(err.Error(), want) {
 			t.Errorf("%s: %v, want %q", s, err, want)
 		}
 	}
 }
 func TestDefaultKey(t *testing.T) {
 	dir := t.TempDir()
 	general := "lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share"
 	k, ok, err := DefaultKey(dir, general)
 	if err != nil || !ok || k.Name != "env-share" {
 		t.Errorf("general: %+v %v %v", k, ok, err)
 	}
 	os.WriteFile(filepath.Join(dir, ".lazysecrets.yaml"), []byte("sharing:\n  key: lazysecrets://azure/kv-app.vault.azure.net/secrets/app-share\n"), 0o644)
 	if k, _, _ := DefaultKey(dir, general); k.Name != "app-share" {
 		t.Errorf("the repo's should win: %+v", k)
 	}
 	if _, ok, _ := DefaultKey(t.TempDir(), ""); ok {
 		t.Error("a key with none set")
 	}
 	unpinned := key
 	unpinned.Version = ""
 	if p := Pin(unpinned, "abc"); p.Version != "abc" {
 		t.Errorf("pin: %+v", p)
 	}
 }
@@ -0,0 +1,87 @@
 package share
 import (
 	"errors"
 	"fmt"
 	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 )
 // Target is where an opened file goes.
 type Target struct {
 	File
 	Abs    string
 	Exists bool
 	// Exposed is set when dir is a git repo that doesn't ignore the file:
 	// its values could end up in a commit.
 	Exposed bool
 }
 // Plan says where files go under dir, without writing anything. A path
 // that leads out of dir through a symlink, or is one, is an error.
 func Plan(dir string, files []File) ([]Target, error) {
 	root, err := filepath.EvalSymlinks(dir)
 	if err != nil {
 		return nil, err
 	}
 	out := make([]Target, len(files))
 	for i, f := range files {
 		if err := CheckPath(f.Path); err != nil {
 			return nil, err
 		}
 		t := Target{File: f, Abs: filepath.Join(root, filepath.FromSlash(f.Path))}
 		if err := inside(root, filepath.Dir(t.Abs)); err != nil {
 			return nil, fmt.Errorf("%s: %w", f.Path, err)
 		}
 		switch info, err := os.Lstat(t.Abs); {
 		case err == nil && info.Mode()&fs.ModeSymlink != 0:
 			return nil, fmt.Errorf("%s is a symlink: not writing through it", f.Path)
 		case err == nil && !info.Mode().IsRegular():
 			return nil, fmt.Errorf("%s isn't a file", f.Path)
 		case err == nil:
 			t.Exists = true
 		case !errors.Is(err, fs.ErrNotExist):
 			return nil, err
 		}
 		t.Exposed = exposed(root, f.Path)
 		out[i] = t
 	}
 	return out, nil
 }
 // inside checks that dir, or the part of it that exists, is under root
 // once symlinks are followed.
 func inside(root, dir string) error {
 	for {
 		real, err := filepath.EvalSymlinks(dir)
 		if errors.Is(err, fs.ErrNotExist) && dir != root {
 			dir = filepath.Dir(dir) // created when writing
 			continue
 		}
 		if err != nil {
 			return err
 		}
 		if real != root && !strings.HasPrefix(real, root+string(filepath.Separator)) {
 			return errors.New("leads out of the folder through a symlink")
 		}
 		return nil
 	}
 }
 // exposed reports whether root is in a git repo that doesn't ignore p.
 func exposed(root, p string) bool {
 	err := exec.Command("git", "-C", root, "check-ignore", "-q", "--", p).Run()
 	var exit *exec.ExitError
 	return errors.As(err, &exit) && exit.ExitCode() == 1 // 0: ignored; 128: no repo
 }
 // Write writes the file, readable by the user only when it's new.
 func (t Target) Write() error {
 	if err := os.MkdirAll(filepath.Dir(t.Abs), 0o755); err != nil {
 		return err
 	}
 	return os.WriteFile(t.Abs, t.Data, 0o600)
 }
@@ -43,6 +43,13 @@ type Node struct {
 // alone isn't.
 func (n Node) keep() bool { return len(n.StarredBy) > 0 || n.Note != "" || n.Uses > 0 }
 // UsedLately reports whether the item was used within the last 90 days
 // (what Recent lists). Starred and noted records are kept longer, so a
 // use alone doesn't say.
 func (n Node) UsedLately(now time.Time) bool {
 	return !n.LastUsed.IsZero() && now.Sub(n.LastUsed) <= usageMaxAge
 }
 // StarredFor reports whether the item is starred for account.
 func (n Node) StarredFor(account string) bool { return slices.Contains(n.StarredBy, account) }
@@ -145,16 +152,23 @@ type Store struct {
 	data file
 }
 // ErrNewer is a state file written by a newer lazysecrets.
 var ErrNewer = errors.New("written by a newer lazysecrets")
 // Load reads path; a missing file is an empty store. path "" gives a store
-// that never saves, for tests and --demo.
+// that never saves, for tests and --demo. A file from a newer lazysecrets
 // is read but never saved, so nothing it keeps is lost: Load returns the
 // store with an ErrNewer error.
 func Load(path string) (*Store, error) {
 	s := &Store{path: path}
 	d, err := read(path)
-	if err != nil {
+	if errors.Is(err, ErrNewer) {
 		s.path = ""
 	} else if err != nil {
 		return nil, err
 	}
 	s.data = d
-	return s, nil
+	return s, err
 }
 func read(path string) (file, error) {
@@ -172,12 +186,12 @@ func read(path string) (file, error) {
 	if err := json.Unmarshal(b, &d); err != nil {
 		return d, fmt.Errorf("%s: %w", path, err)
 	}
 	if d.Version > version {
 		return d, fmt.Errorf("%s: written by a newer lazysecrets (version %d)", path, d.Version)
 	}
 	if d.Nodes == nil {
 		d.Nodes = map[string]Node{}
 	}
 	if d.Version > version {
 		return d, fmt.Errorf("%s: %w (version %d)", path, ErrNewer, d.Version)
 	}
 	return d, nil
 }
@@ -1,6 +1,7 @@
 package store
 import (
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -65,11 +66,17 @@ func TestTwoWindowsDontLoseEachOthersChanges(t *testing.T) {
 	}
 }
-func TestNewerVersionRefused(t *testing.T) {
+func TestNewerVersionReadOnly(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state.json")
-	_ = os.WriteFile(path, []byte(`{"version": 99, "nodes": {}}`), 0o600)
+	newer := `{"version": 99, "nodes": {"one": {"note": "hi"}}}`
-	if _, err := Load(path); err == nil {
+	_ = os.WriteFile(path, []byte(newer), 0o600)
-		t.Error("a newer file was accepted")
+	s, err := Load(path)
 	if !errors.Is(err, ErrNewer) || s == nil || s.Node("one").Note != "hi" {
 		t.Fatalf("Load = %v, %v", s, err)
 	}
 	_ = s.SetFlag("x", true)
 	if b, _ := os.ReadFile(path); string(b) != newer {
 		t.Errorf("the newer file was overwritten: %s", b)
 	}
 }
@@ -112,3 +119,15 @@ func TestStarsPerAccount(t *testing.T) {
 		t.Errorf("unstar alice: %v", n.StarredBy)
 	}
 }
 func TestUsedLately(t *testing.T) {
 	now := time.Now()
 	for ago, want := range map[time.Duration]bool{time.Hour: true, 89 * 24 * time.Hour: true, 2 * 365 * 24 * time.Hour: false} {
 		if got := (Node{LastUsed: now.Add(-ago)}).UsedLately(now); got != want {
 			t.Errorf("used %v ago: %v", ago, got)
 		}
 	}
 	if (Node{}).UsedLately(now) {
 		t.Error("never used is lately")
 	}
 }
@@ -3,11 +3,11 @@
 package app
 import (
 	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"image/color"
 	"math"
 	"os"
 	"os/exec"
 	"strings"
@@ -18,13 +18,13 @@ import (
 	"charm.land/bubbles/v2/spinner"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
 	"github.com/charmbracelet/x/ansi"
 	"git.kebcloud.no/keb/lazysecrets/internal/browser"
 	"git.kebcloud.no/keb/lazysecrets/internal/clipboard"
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/keys"
@@ -40,6 +40,9 @@ const (
 	paneContainers
 	paneSecrets
 	paneDetail
 	// paneStatus is on top of the left panes; after the right pane in
 	// the tab order (status.go).
 	paneStatus
 	paneCount
 )
@@ -54,6 +57,7 @@ const (
 	slotDescribe // extra metadata for the selected object
 	slotCopy     // fetch a value straight to the clipboard
 	slotVersions // count the selected object's versions
 	slotDetails  // a file's details
 	slotCount
 )
@@ -61,6 +65,8 @@ const (
 type Options struct {
 	// Timeout bounds every provider call. Defaults to 30s.
 	Timeout time.Duration
 	// Timeouts override Timeout for the providers of a kind.
 	Timeouts map[provider.Kind]time.Duration
 	// Icons shows Nerd Font glyphs next to backends.
 	Icons bool
 	// Clipboard defaults to the system clipboard, or OSC52 over SSH.
@@ -69,9 +75,23 @@ type Options struct {
 	ClipboardClear time.Duration
 	// OpenURL opens a web page; defaults to the system browser.
 	OpenURL func(url string) error
 	// ConfigFiles and StatePath are where lazysecrets reads its config
 	// and keeps its state, for the status pane.
 	ConfigFiles []string
 	StatePath   string
 	// Warning shows when the window opens: what lazysecrets skipped
 	// instead of failing to start.
 	Warning string
 	// Changelog is CHANGELOG.md, for the status pane.
 	Changelog string
 	// CacheFile keeps what was loaded between runs; "" keeps it for this
 	// run only.
 	CacheFile string
 	// ShareKey is the config's sharing.key: the secret that encrypts shared
 	// env files, for repos whose .lazysecrets.yaml names none.
 	ShareKey string
 	// ShareRules are what a key's value must be to share with it.
 	ShareRules share.Rules
 	// Dir is the folder lazysecrets runs in: it goes back to where it was
 	// left there, unless it was started on a link. "" doesn't.
 	Dir string
@@ -102,15 +122,24 @@ type Options struct {
 	// Keys, if set, replaces the default keymap (keys.Map.Apply).
 	Keys *keys.Map
 	// Updater, if set, finds and installs newer releases (U); with
-	// UpdateCheck, lazysecrets also looks once a day on its own.
+	// UpdateCheck, lazysecrets also looks on its own at startup, at most
 	// once per UpdateEvery (0 for a day).
 	Updater     *Updater
 	UpdateCheck bool
 	UpdateEvery time.Duration
 	// HandlerSetup, if set, offers to set up the link handler at startup.
 	HandlerSetup *HandlerSetup
 	// NoHistory stops counting uses of items for the Recent list.
 	NoHistory bool
 	// RecentIcon marks items used lately with ◷ in the lists
 	// (ui.recentIcon).
 	RecentIcon bool
 	// Open is a reference to open at startup (lazysecrets open <ref>).
 	Open *ref.Ref
 	// OpenAction, if set, is what to do with Open, rather than asking:
 	// go to it, and maybe copy or show its value (OpenActions). It ends in
 	// the list, like Go to, rather than on the details.
 	OpenAction string
 	// Styles, if set, replaces the default theme (styles.FromTheme), and
 	// DefaultFg the terminal's default text colour.
 	Styles    *styles.Styles
@@ -129,7 +158,7 @@ type Clipboard interface {
 type Model struct {
 	providers []provider.Provider
 	byID      map[string]provider.Provider
-	timeout   time.Duration
+	timeout   timeouts
 	keys keys.Map
 	st   styles.Styles
@@ -163,16 +192,33 @@ type Model struct {
 	clip      Clipboard
 	clipClear time.Duration
 	openURL   func(string) error
-	getenv    func(string) string
+	// fields is the fourth pane for anything but a secret; lastLeft is
-	nvimOpen  func(server, path string, line int) error // edit.go
+	// the left pane it describes while the fourth has focus (fields.go).
-	now       func() time.Time
+	fields   panes.Fields
 	lastLeft pane
 	details  map[string]detailsState // by containerKey
 	// errLog is this session's errors, newest first; loggedFlash the
 	// footer's text when last looked at (errlog.go).
 	errLog      []loggedErr
 	loggedFlash string
 	getenv      func(string) string
 	nvimOpen    func(server, path string, line int) error // edit.go
 	now         func() time.Time
 	// The cache file, whether the cache changed since it was saved, and
 	// when each provider's Sources list was loaded (persist.go).
-	cachePath  string
+	cachePath string
-	cacheDirty bool
+	// configFiles and statePath are for the status pane (status.go).
-	sourcesAt  map[string]time.Time
+	configFiles []string
-	placeDir   string
+	statePath   string
-	savedPlace string // the link last saved as the place
+	statusW     int // the status pane's width: the left column's, zoomed or not
 	changelog   []panes.Field
 	cacheDirty  bool
 	// cacheDropped are cache keys deleted since the last save, so saving
 	// deletes them from the file too.
 	cacheDropped map[string]bool
 	sourcesAt    map[string]time.Time
 	placeDir     string
 	savedPlace   string // the link last saved as the place
 	// A pending clear of a copied value, counted down in the footer.
 	// clipToken identifies the latest copy so older ticks are ignored.
@@ -186,6 +232,7 @@ type Model struct {
 	// provider finds it (provider.Current), before Sources lists them all.
 	current     *provider.Source
 	flatSources bool // Sources pane without provider groups
 	showHidden  bool // H: what providers hide is listed too, dimmed
 	sourcesFavs bool // Sources pane on its Favourites tab
 	history     bool // count uses of items (usage.go)
 	onActive    func()
@@ -207,6 +254,7 @@ type Model struct {
 	updater      *Updater
 	updateCheck  bool
 	updateEvery  time.Duration
 	fetchOnStart bool            // look for a newer release in Init
 	newer        *update.Release // a newer release to offer
 	updated      string          // the release installed, waiting for a restart
@@ -246,6 +294,11 @@ type Model struct {
 	prompt     *modal               // popup that has the keyboard
 	linked     []provider.Container // vaults opened from links, this session
 	open       *ref.Ref             // reference to open at startup
 	recentIcon bool                 // mark items used lately (◷)
 	openAction string               // and what to do with it, or ask
 	shareKey   string      // the config's sharing.key
 	shareRules share.Rules // and sharing.keyRules
 	// A lazysecrets:// link found on the clipboard, offered in the footer.
 	dismissedLink string // the last link offered: not offered again
@@ -343,7 +396,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	m := Model{
 		providers:     providers,
 		byID:          map[string]provider.Provider{},
-		timeout:       opts.Timeout,
+		timeout:       timeouts{def: opts.Timeout, byKind: opts.Timeouts},
 		keys:          keys.Default(),
 		st:            styles.Default(),
 		spin:          spinner.New(spinner.WithSpinner(spinner.Dot)),
@@ -356,6 +409,8 @@ func New(providers []provider.Provider, opts Options) Model {
 		getenv:        os.Getenv,
 		nvimOpen:      nvimOpen,
 		cache:         newCache(),
 		details:       map[string]detailsState{},
 		fields:        panes.NewFields(),
 	}
 	if m.clip == nil {
 		m.clip = clipboard.New()
@@ -373,7 +428,8 @@ func New(providers []provider.Provider, opts Options) Model {
 	if m.store == nil {
 		m.store, _ = store.Load("")
 	}
-	m.sources = newSourcesList(iconSet, m.store)
+	m.recentIcon = opts.RecentIcon
 	m.sources = newSourcesList(iconSet, m.store, m.recentIcon)
 	m.sources.Empty = "no sources found"
 	m.collapsed = map[string]bool{}
 	m.flatSources = opts.FlatSources
@@ -389,11 +445,14 @@ func New(providers []provider.Provider, opts Options) Model {
 	if opts.Keys != nil {
 		m.keys = *opts.Keys
 	}
-	m.detail.RevealKey, m.detail.VersionsKey = keys.Name(m.keys.Reveal), keys.Name(m.keys.Versions)
+	m.detail.RevealKey, m.detail.VersionsKey, m.detail.CopyKey = keys.Name(m.keys.Reveal), keys.Name(m.keys.Versions), keys.Name(m.keys.Copy)
 	m.revealTimeout, m.hideOnBlur = opts.RevealTimeout, opts.HideOnBlur
 	m.expiryWarning = opts.ExpiryWarning
 	m.handlerSetup = opts.HandlerSetup
-	m.updater, m.updateCheck = opts.Updater, opts.UpdateCheck
+	m.updater, m.updateCheck, m.updateEvery = opts.Updater, opts.UpdateCheck, opts.UpdateEvery
 	if m.updateEvery == 0 {
 		m.updateEvery = updateEvery
 	}
 	m.startUpdateCheck()
 	m.askHandler = opts.HandlerSetup != nil && !m.store.Flag(flagNoHandlerPrompt)
 	m.settle = opts.LoadDelay
@@ -402,7 +461,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	}
 	m.defaultFg = opts.DefaultFg
 	m.help = newHelp(m.st)
-	m.open = opts.Open
+	m.open, m.openAction = opts.Open, opts.OpenAction
 	saved := m.store.Layout()
 	m.split, m.heights = saved.Split, saved.Heights
@@ -411,6 +470,7 @@ func New(providers []provider.Provider, opts Options) Model {
 		Filter:      func(c provider.Container) string { return c.Name },
 		FilterExtra: func(c provider.Container) string { return m.store.Node(storeKey(c)).Note },
 		Render:      m.containerRender(false),
 		Hidden:      func(c provider.Container) bool { return c.Hidden },
 	})
 	m.secrets = panes.NewList("[3] Secrets", panes.Item[provider.Object]{
@@ -420,6 +480,7 @@ func New(providers []provider.Provider, opts Options) Model {
 		// Typing "expir" finds what has expired or soon will.
 		FilterExtra: func(o provider.Object) string { return m.store.Node(objectKey(o)).Note + " " + m.expiryWord(o) },
 		Render:      m.objectRender(),
 		Hidden:      func(o provider.Object) bool { return o.Hidden },
 	})
 	m.secrets.Empty = "no secrets"
 	m.objType, m.wantType = provider.TypeSecret, provider.TypeSecret
@@ -430,10 +491,17 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.spinning = true
 	m.cachePath, m.placeDir, m.sourcesAt = opts.CacheFile, opts.Dir, map[string]time.Time{}
 	m.shareKey, m.shareRules = opts.ShareKey, opts.ShareRules
 	m.configFiles, m.statePath, m.changelog = opts.ConfigFiles, opts.StatePath, changelogFields(opts.Changelog)
 	if opts.Warning != "" {
 		m.flash = warning(opts.Warning)
 	}
 	if m.cachePath != "" {
 		m.loadCacheFile()
 		if len(m.sourceResults) > 0 {
 			m.rebuildSources()
 			m.sources.Loading = true // reloading what the file had
 			m.sources.Age = m.cachedAge(m.oldestSources())
 		}
 	}
 	if m.placeDir != "" && opts.Open == nil {
@@ -461,7 +529,7 @@ func (m *Model) setVersions(items []provider.Object) {
 }
 func (m Model) Init() tea.Cmd {
-	cmds := []tea.Cmd{m.sourcesCmd(), m.spin.Tick, m.checkClipboard()}
+	cmds := []tea.Cmd{m.sourcesCmd(), m.spin.Tick, m.checkClipboard(), tea.RequestBackgroundColor}
 	if m.cachePath != "" || m.placeDir != "" {
 		cmds = append(cmds, tea.Tick(persistEvery, func(time.Time) tea.Msg { return persistTickMsg{} }))
 	}
@@ -469,23 +537,34 @@ func (m Model) Init() tea.Cmd {
 		cmds = append(cmds, m.fetchLatest(false))
 	}
 	if m.open != nil {
-		r := *m.open
+		msg := openRefMsg{ref: *m.open, action: m.openAction}
-		cmds = append(cmds, func() tea.Msg { return openRefMsg{r} })
+		cmds = append(cmds, func() tea.Msg { return msg })
 	}
 	return tea.Batch(cmds...)
 }
-// openRefMsg starts opening a reference from outside the key handler.
+// openRefMsg starts opening a reference from outside the key handler:
-type openRefMsg struct{ ref ref.Ref }
+// asking what to do with it, or doing action (OpenActions).
 type openRefMsg struct {
 	ref    ref.Ref
 	action string
 }
 // OpenActions are what lazysecrets open --action takes, the Open link
 // menu's choices that go there.
 var OpenActions = map[string]linkAction{"go": actGo, "copy": actCopy, "show": actShow}
 // OpenLink is a message offering r in the Open link popup, for links
 // handed over by the link handler (Program.Send).
-func OpenLink(r ref.Ref) tea.Msg { return openRefMsg{r} }
+func OpenLink(r ref.Ref) tea.Msg { return openRefMsg{ref: r} }
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	var cmds []tea.Cmd
 	switch msg := msg.(type) {
 	case tea.BackgroundColorMsg:
 		m.st = m.st.OnBackground(msg.Color, msg.IsDark())
 		return m, nil
 	case tea.WindowSizeMsg:
 		m.w, m.h = msg.Width, msg.Height
@@ -534,11 +613,24 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case openRefMsg:
 		m.deferHandlerSetup() // the link first
-		cmds = append(cmds, m.offerRef("Open link", msg.ref, false))
+		if act, ok := OpenActions[msg.action]; ok && !msg.ref.IsShare() {
 			cmds = append(cmds, m.findRef(msg.ref, act))
 		} else {
 			cmds = append(cmds, m.offerRef("Open link", msg.ref, false))
 		}
 	case resolvedMsg:
 		m.handleResolved(msg)
 	case shareFilesMsg:
 		cmds = append(cmds, m.handleShareFiles(msg))
 	case sealedMsg:
 		cmds = append(cmds, m.handleSealed(msg))
 	case shareOpenedMsg:
 		cmds = append(cmds, m.handleShareOpened(msg))
 	case tea.PasteMsg:
 		cmds = append(cmds, m.handlePaste(msg))
@@ -563,6 +655,16 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case persistedMsg:
 		m.handlePersisted(msg)
 	case detailsMsg:
 		if msg.req == m.reqID[slotDetails] {
 			m.cancelReq(slotDetails)
 		}
 		if errors.Is(msg.err, context.Canceled) || errors.Is(msg.err, context.DeadlineExceeded) {
 			delete(m.details, msg.key) // tried again when shown again
 		} else {
 			m.details[msg.key] = detailsState{attrs: msg.attrs, err: msg.err}
 		}
 	case crawlMsg:
 		cmds = append(cmds, m.handleCrawl(msg))
@@ -586,10 +688,13 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotContainers] {
 			break
 		}
-		m.done(slotContainers)
+		m.cancelReq(slotContainers)
 		if msg.err != nil {
 			m.noteErr(msg.err)
-			delete(m.cache.containers, msg.key)
+			if src, ok := m.selectedSource(); ok {
 				m.logErrOf(src.Name, msg.err)
 			}
 			uncache(&m, m.cache.containers, msg.key)
 			m.containers.SetError(msg.err)
 		} else {
 			m.cache.containers[msg.key] = entry[[]provider.Container]{msg.items, m.now()}
@@ -601,24 +706,29 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotObjects] {
 			break
 		}
-		m.done(slotObjects)
+		m.cancelReq(slotObjects)
 		if errors.Is(msg.err, provider.ErrUnsupported) && m.versionsOf != nil {
 			m.flash = warning(fmt.Sprintf("versions aren't supported for %s", m.versionsOf.Container.Source.Kind))
 			m.closeVersions()
 		} else if msg.err != nil {
 			m.noteErr(msg.err)
-			delete(m.cache.objects, msg.key)
+			if c, ok := m.containers.Selected(); ok {
 				m.logErrOf(c.Name, msg.err)
 			}
 			uncache(&m, m.cache.objects, msg.key)
 			m.secrets.SetError(msg.err)
 		} else {
 			if msg.bound != nil {
 				msg.key = m.rebind(*msg.bound)
 			}
 			before := m.cache.objects[msg.key].value
 			m.cache.objects[msg.key] = entry[[]provider.Object]{msg.items, m.now()}
 			m.cacheDirty = true
 			if m.versionsOf != nil {
 				m.setVersions(msg.items)
 			} else {
-				m.secrets.SetItems(m.starredFirst(msg.items))
+				m.secrets.SetItems(m.starredObjectsFirst(msg.items))
 				cmds = append(cmds, m.refreshShown(before))
 			}
 		}
@@ -626,9 +736,10 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotValue] {
 			break
 		}
-		m.done(slotValue)
+		m.cancelReq(slotValue)
 		if msg.err != nil {
 			m.noteErr(msg.err)
 			m.logErrOf(msg.obj.Container.Name+"/"+msg.obj.Name, msg.err)
 			m.detail.SetValueError(msg.err)
 		} else {
 			m.detail.SetValue(msg.value)
@@ -640,7 +751,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotVersions] {
 			break
 		}
-		m.done(slotVersions)
+		m.cancelReq(slotVersions)
 		// Errors and unsupported providers just leave the count out.
 		if msg.err == nil {
 			m.cache.objects[msg.key] = entry[[]provider.Object]{msg.items, m.now()}
@@ -652,9 +763,10 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotDescribe] {
 			break
 		}
-		m.done(slotDescribe)
+		m.cancelReq(slotDescribe)
 		if msg.err != nil {
 			m.noteErr(msg.err)
 			m.logErrOf(msg.obj.Container.Name+"/"+msg.obj.Name, msg.err)
 			m.detail.SetDescribeError(msg.err)
 		} else {
 			m.cache.details[msg.key] = entry[provider.Object]{msg.obj, m.now()}
@@ -666,7 +778,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if msg.req != m.reqID[slotCopy] {
 			break
 		}
-		m.done(slotCopy)
+		m.cancelReq(slotCopy)
 		if msg.err != nil {
 			m.noteErr(msg.err)
 			m.flash = flash{text: "copy failed: " + msg.err.Error(), isErr: true}
@@ -722,7 +834,11 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	m.waiting = 0
 	m.askHandlerSetup()
 	m.keys.Login.SetEnabled(m.loginFor() != nil)
-	m.detail.SetMessage(m.selectedProblem())
+	if m.focus != paneDetail {
 		m.lastLeft = m.focus
 	}
 	m.logFlash()
 	cmds = append(cmds, m.syncFields())
 	if m.anyLoading() && !m.spinning {
 		m.spinning = true
 		cmds = append(cmds, m.spin.Tick)
@@ -774,7 +890,7 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 	case key.Matches(msg, k.Quit):
 		return nil, true
 	case key.Matches(msg, k.Help):
-		return m.showKeybindings(), false
+		return m.showKeybindingsFor(""), false
 	case key.Matches(msg, k.Up):
 		m.move(-1)
 	case key.Matches(msg, k.Down):
@@ -788,9 +904,19 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 	case key.Matches(msg, k.Bottom):
 		m.jump(false)
 	case key.Matches(msg, k.NextPane):
-		m.focus = (m.focus + 1) % paneCount
+		// The four main panes, round; the status pane (0) leads into them.
 		m.focus = (m.focus + 1) % paneStatus
 		if r, ok := m.sources.Selected(); ok && m.focus == paneContainers && r.kind == rowGroup {
 			m.focus = paneDetail // an account's row: nothing between
 		}
 	case key.Matches(msg, k.Details):
 		m.focus = paneDetail // what's selected, on the right
 	case key.Matches(msg, k.PrevPane):
-		m.focus = (m.focus + paneCount - 1) % paneCount
+		if m.focus == paneDetail {
 			m.focus = m.lastLeft // back to what it describes
 		} else {
 			m.focus = (m.focus + paneStatus - 1) % paneStatus
 		}
 	case key.Matches(msg, k.Pane1):
 		m.focus = paneSources
 	case key.Matches(msg, k.Pane2):
@@ -799,8 +925,18 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 		m.focus = paneSecrets
 	case key.Matches(msg, k.Pane4):
 		m.focus = paneDetail
 	case key.Matches(msg, k.Pane0):
 		m.focus = paneStatus
 	case m.focus == paneStatus && key.Matches(msg, k.Enter):
 		m.focus = paneDetail // its rows are on the right
 	case m.focus == paneSources && (key.Matches(msg, k.Enter) || key.Matches(msg, k.Reveal)) && m.toggleGroup():
 		// folded or unfolded a provider group
 	case m.focus == paneDetail && key.Matches(msg, k.Enter) && m.fieldLink() != "":
 		r, err := ref.Parse(m.fieldLink())
 		if err == nil {
 			f, _ := m.fields.Selected()
 			m.startNav(r, actGo, f.Row)
 		}
 	case key.Matches(msg, k.Enter):
 		if m.focus < paneDetail {
 			m.focus++
@@ -846,6 +982,8 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 		m.cycleZoom(-1)
 	case key.Matches(msg, k.SourcesView):
 		m.toggleSourcesView()
 	case key.Matches(msg, k.ToggleHidden):
 		m.toggleHidden()
 	case key.Matches(msg, k.Versions):
 		if m.versionsOf != nil {
 			m.closeVersions()
@@ -856,8 +994,10 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 	case key.Matches(msg, k.Back):
 		if f := m.focusedFilter(); f != nil && f.HasFilter() {
 			f.ClearFilter()
-		} else if m.versionsOf != nil && m.focus >= paneSecrets {
+		} else if m.versionsOf != nil && (m.focus == paneSecrets || m.focus == paneDetail) {
 			m.closeVersions()
 		} else if m.focus == paneStatus {
 			m.focus = paneSources
 		} else if m.focus > paneSources {
 			m.focus--
 		}
@@ -912,6 +1052,10 @@ func (m *Model) focusedFilter() filterable {
 		return &m.containers
 	case paneSecrets:
 		return &m.secrets
 	case paneDetail:
 		if m.fields.Shown() {
 			return &m.fields
 		}
 	}
 	return nil
 }
@@ -926,7 +1070,11 @@ func (m *Model) move(delta int) {
 	case paneSecrets:
 		m.secrets.Move(delta)
 	case paneDetail:
-		m.detail.Scroll(delta)
+		if m.fields.Shown() {
 			m.fields.Move(delta)
 		} else {
 			m.detail.Scroll(delta)
 		}
 	}
 }
@@ -946,6 +1094,10 @@ func (m *Model) jump(top bool) {
 		m.secrets.Top()
 	case m.focus == paneSecrets:
 		m.secrets.Bottom()
 	case m.focus == paneDetail && m.fields.Shown() && top:
 		m.fields.Top()
 	case m.focus == paneDetail && m.fields.Shown():
 		m.fields.Bottom()
 	case m.focus == paneDetail && top:
 		m.detail.ScrollTop()
 	case m.focus == paneDetail:
@@ -978,6 +1130,7 @@ func (m *Model) refresh() tea.Cmd {
 	case paneContainers:
 		if src, ok := m.selectedSource(); ok {
 			m.containers.Refresh()
 			m.details = map[string]detailsState{}
 			return m.loadContainers(src, m.selSource)
 		}
 	case paneSecrets:
@@ -1019,14 +1172,11 @@ func (m *Model) syncSelection() tea.Cmd {
 		if m.onLinks() {
 			m.showLinkedContainers()
 		} else if src, ok := m.selectedSource(); ok {
 			m.containers.Title = "[2] Vaults"
 			m.containers.Empty = "no vaults found"
 			switch src.Kind {
 			case provider.KindDatabricks:
 				m.containers.Title = "[2] Scopes"
 				m.containers.Empty = "no secret scopes"
 			case provider.KindRepo:
 				m.containers.Title = "[2] Files"
 				m.containers.Empty = "no SOPS or env files here (see docs/repos.md)"
 			}
 			cmds = append(cmds, m.showContainers(src, id))
@@ -1100,6 +1250,7 @@ func (m *Model) showContainers(src provider.Source, key string) tea.Cmd {
 		return nil
 	}
 	m.containers.Refresh()
 	m.containers.Age = m.cachedAge(e.at)
 	return m.loadContainers(src, key)
 }
@@ -1110,12 +1261,13 @@ func (m *Model) showObjects(c provider.Container, key string) tea.Cmd {
 		m.secrets.SetLoading()
 		return m.loadObjects(c, m.objType, key)
 	}
-	m.secrets.SetItems(m.starredFirst(e.value))
+	m.secrets.SetItems(m.starredObjectsFirst(e.value))
 	m.secrets.Select(m.cache.cursor[key])
 	if e.fresh(m.now()) {
 		return nil
 	}
 	m.secrets.Refresh()
 	m.secrets.Age = m.cachedAge(e.at)
 	return m.loadObjects(c, m.objType, key)
 }
@@ -1129,7 +1281,7 @@ func (m *Model) showVersions(o provider.Object, key string) tea.Cmd {
 	}
 	m.secrets.SetLoading()
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, o.Container.Source.Kind)
 	return func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1159,7 +1311,7 @@ func (m *Model) countVersions(o provider.Object) tea.Cmd {
 		}
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotVersions)
+	ctx, req := m.begin(slotVersions, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1169,8 +1321,7 @@ func (m *Model) countVersions(o provider.Object) tea.Cmd {
 	})
 }
-// closeVersions returns the Secrets pane to the object list, with the
+// closeVersions returns the Secrets pane to the object list.
 // cursor on the object whose versions were shown.
 func (m *Model) closeVersions() {
 	m.versionsOf = nil
 }
@@ -1245,6 +1396,26 @@ func (m *Model) detailStale() bool {
 	return hasSecret || shown != m.containers.SelectedID()
 }
 // cachedAge is how old a list loaded at at is, if it's older than
 // cacheTTL: the panes say it while it reloads.
 func (m Model) cachedAge(at time.Time) string {
 	if d := m.now().Sub(at); d >= cacheTTL {
 		return ago(d)
 	}
 	return ""
 }
 // oldestSources is when the oldest of the cached Sources lists loaded.
 func (m Model) oldestSources() time.Time {
 	var oldest time.Time
 	for _, at := range m.sourcesAt {
 		if oldest.IsZero() || at.Before(oldest) {
 			oldest = at
 		}
 	}
 	return oldest
 }
 func (m *Model) handleSources(msg sourcesMsg) tea.Cmd {
 	if msg.gen != m.sourcesGen {
 		return nil
@@ -1259,6 +1430,7 @@ func (m *Model) handleSources(msg sourcesMsg) tea.Cmd {
 	for _, p := range m.providers {
 		if r, ok := m.sourceResults[p.ID()]; ok && r.err != nil {
 			m.noteErr(r.err)
 			m.logErrOf(p.Label(), r.err)
 			errs = append(errs, fmt.Sprintf("%s: %v", p.Label(), r.err))
 		}
 	}
@@ -1289,11 +1461,26 @@ func (m *Model) autoLoad(msg sourcesMsg) tea.Cmd {
 	return m.crawlStart()
 }
-// begin starts a cancellable request for pane p, cancelling any in flight.
+// timeouts bound each provider request: its kind's, else the default.
-func (m *Model) begin(p slot) (context.Context, int) {
+type timeouts struct {
 	def    time.Duration
 	byKind map[provider.Kind]time.Duration
 }
 // of is how long a request to a provider of kind k may take.
 func (t timeouts) of(k provider.Kind) time.Duration {
 	if d, ok := t.byKind[k]; ok {
 		return d
 	}
 	return t.def
 }
 // begin starts a cancellable request for pane p to a provider of kind k,
 // cancelling any in flight.
 func (m *Model) begin(p slot, k provider.Kind) (context.Context, int) {
 	m.cancelReq(p)
 	m.seq++
-	ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+	ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(k))
 	m.reqID[p], m.cancel[p] = m.seq, cancel
 	return ctx, m.seq
 }
@@ -1331,9 +1518,6 @@ func (m *Model) settled(ctx context.Context, load tea.Cmd) tea.Cmd {
 	}
 }
 // done releases the context of a completed request.
 func (m *Model) done(p slot) { m.cancelReq(p) }
 // loadSources starts a new generation of source loads, superseding any in
 // flight.
 func (m *Model) loadSources() tea.Cmd {
@@ -1347,7 +1531,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 	gen := m.sourcesGen
 	var cmds []tea.Cmd
 	for _, p := range m.providers {
-		ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 		cmds = append(cmds, func() tea.Msg {
 			defer cancel()
 			s, err := p.Sources(ctx)
@@ -1358,7 +1542,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 		})
 		// The source it started in, quickly, on its own.
 		if c, ok := p.(provider.Current); ok {
-			ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+			ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 			cmds = append(cmds, func() tea.Msg {
 				defer cancel()
 				src, ok := c.Current(ctx)
@@ -1375,7 +1559,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 	p := m.providerFor(src)
-	ctx, req := m.begin(slotContainers)
+	ctx, req := m.begin(slotContainers, src.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Containers(ctx, src)
 		// Carry the source as given, with its provider ID, so later
@@ -1394,7 +1578,7 @@ func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key string) tea.Cmd {
 	cands := m.candidates(c.Source)
 	known := len(cands) == 1 && cands[0].ID() == c.Source.Provider
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, c.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		var errs []error
 		for _, p := range cands {
@@ -1422,7 +1606,7 @@ func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key str
 func (m *Model) fetchValue(s provider.Object) tea.Cmd {
 	p := m.providerFor(s.Container.Source)
-	ctx, req := m.begin(slotValue)
+	ctx, req := m.begin(slotValue, s.Container.Source.Kind)
 	m.detail.SetLoading()
 	return func() tea.Msg {
 		v, err := p.Value(ctx, s)
@@ -1441,7 +1625,7 @@ func (m *Model) describe(o provider.Object) tea.Cmd {
 		m.detail.SetDescribing()
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotDescribe)
+	ctx, req := m.begin(slotDescribe, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		obj, err := p.Describe(ctx, o)
 		return describeMsg{req: req, key: key, obj: obj, err: err}
@@ -1451,6 +1635,15 @@ func (m *Model) describe(o provider.Object) tea.Cmd {
 // copyValue copies the selected object's value, fetching it without
 // revealing it if it isn't shown already.
 func (m *Model) copyValue() tea.Cmd {
 	if m.focus == paneDetail && m.fields.Shown() {
 		if f, ok := m.fields.Selected(); ok {
 			return m.copyText(fieldName(f), cmp.Or(f.URL, f.Value), false)
 		}
 		return nil
 	}
 	if a, ok := m.selectedAccount(); ok && a.Copy != "" && m.focus == paneSources {
 		return m.copyText(a.CopyLabel, a.Copy, false)
 	}
 	o, ok := m.detail.Secret()
 	if !ok {
 		return nil
@@ -1460,7 +1653,7 @@ func (m *Model) copyValue() tea.Cmd {
 		return m.copyText(o.Name, v.Reveal(), true)
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotCopy)
+	ctx, req := m.begin(slotCopy, o.Container.Source.Kind)
 	m.flash = flash{text: "copying " + o.Name + "…"}
 	return func() tea.Msg {
 		v, err := p.Value(ctx, o)
@@ -1487,12 +1680,8 @@ func (m *Model) copyText(label, text string, sensitive bool) tea.Cmd {
 // clipTick fires when the countdown's displayed second next changes.
 func (m *Model) clipTick() tea.Cmd {
 	wait := m.clipDeadline.Sub(m.now()) % time.Second
 	if wait <= 0 {
 		wait = time.Second
 	}
 	token := m.clipToken
-	return tea.Tick(wait, func(time.Time) tea.Msg { return clipTickMsg{token: token} })
+	return tea.Tick(untilNextSecond(m.clipDeadline, m.now()), func(time.Time) tea.Msg { return clipTickMsg{token: token} })
 }
 func (m *Model) cancelClipClear() {
@@ -1505,6 +1694,25 @@ func (m *Model) cancelClipClear() {
 func (m *Model) openSelected() tea.Cmd {
 	var name, url string
 	var used func()
 	switch {
 	case m.focus == paneDetail && m.fields.Shown():
 		f, _ := m.fields.Selected()
 		if f.URL == "" {
 			m.flash = warning("nothing to open in the browser here")
 			return nil
 		}
 		name, url, used = f.Label, f.URL, func() {}
 	default:
 		name, url, used = m.openTarget()
 	}
 	if name == "" {
 		return nil
 	}
 	return m.openPage(name, url, used)
 }
 // openTarget is the focused pane's selected item, for the browser.
 func (m *Model) openTarget() (name, url string, used func()) {
 	switch m.focus {
 	case paneSources:
 		s, _ := m.selectedSource()
@@ -1516,9 +1724,11 @@ func (m *Model) openSelected() tea.Cmd {
 		o, _ := m.detail.Secret()
 		name, url, used = o.Name, o.URL, func() { m.usedObject(o) }
 	}
-	if name == "" {
+	return name, url, used
-		return nil
+}
-	}
+
 // openPage opens url in the browser, or copies it over SSH.
 func (m *Model) openPage(name, url string, used func()) tea.Cmd {
 	if url == "" {
 		m.flash = warning("no web page for " + name)
 		return nil
@@ -1578,22 +1788,19 @@ func (m Model) footerView() string {
 	} else if l != nil && l.Filtering() {
 		help = m.helpBar(keys.FilterHelp{Map: m.keys}.ShortHelp(), 2)
 	} else {
-		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, commands: len(m.commandsHere()) > 0}.ShortHelp(), 2)
+		reveal := "show"
 		if m.detail.State() == panes.ValueShown {
 			reveal = "hide"
 		}
 		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), reveal: reveal}.ShortHelp(), 2)
 	}
 	var lines []string
 	if !m.clipDeadline.IsZero() {
-		left := max(0, int(math.Ceil(m.clipDeadline.Sub(m.now()).Seconds())))
+		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, secondsLeft(m.clipDeadline, m.now())))))
 		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, left))))
 	}
 	if m.flash.text != "" {
 		lines = append(lines, m.flashLine(m.flash))
 	}
 	// The version at the right end, one column in, like lazygit.
 	if v := m.versionLabel(); v != "" {
 		up := m.updateLabel() // a newer release, in colour
 		gap := max(1, m.w-1-ansi.StringWidth(help)-ansi.StringWidth(v+up)-1)
 		help += strings.Repeat(" ", gap) + m.st.Muted.Render(v) + m.st.Notice.Render(up) + " "
 	}
 	return strings.Join(append(lines, " "+help), "\n")
 }
@@ -1660,9 +1867,23 @@ func (m Model) problemText(providerID, err string) string {
 	return err
 }
 // fieldLink is the link of the selected Fields row, if it has one.
 func (m Model) fieldLink() string {
 	if f, ok := m.fields.Selected(); ok && m.fields.Shown() {
 		return f.Link
 	}
 	return ""
 }
 // loginFor is the sign-in L runs: the selected account's, if it needs
 // one, else the last one asked for.
 func (m Model) loginFor() *provider.AuthError {
 	if f, ok := m.fields.Selected(); ok && m.focus == paneDetail && m.fields.Shown() && f.Provider != "" {
 		var auth *provider.AuthError
 		if res := m.sourceResults[f.Provider]; errors.As(res.err, &auth) && len(auth.Login) > 0 {
 			return auth
 		}
 	}
 	if r, ok := m.sources.Selected(); ok {
 		var auth *provider.AuthError
 		if res := m.sourceResults[r.provider]; errors.As(res.err, &auth) && len(auth.Login) > 0 {
@@ -1674,3 +1895,20 @@ func (m Model) loginFor() *provider.AuthError {
 	}
 	return nil
 }
 // selectedAccount describes the account of the selected provider row, if
 // its provider can.
 func (m Model) selectedAccount() (provider.Account, bool) {
 	r, ok := m.sources.Selected()
 	if !ok || r.kind != rowGroup {
 		return provider.Account{}, false
 	}
 	if res := m.sourceResults[r.provider]; res.err != nil {
 		return provider.Account{}, false // the problem shows instead
 	}
 	a, ok := m.byID[r.provider].(provider.Accounts)
 	if !ok {
 		return provider.Account{}, false
 	}
 	return a.Account()
 }
@@ -19,6 +19,7 @@ import (
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/keys"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
 )
 func TestMain(m *testing.M) {
@@ -57,7 +58,7 @@ func newDriverOpts(t *testing.T, opts Options, providers ...provider.Provider) *
 	m := New(providers, opts)
 	m.detail.Now = func() time.Time { return time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC) }
 	d := &driver{t: t, m: m}
-	d.send(tea.WindowSizeMsg{Width: 100, Height: 30})
+	d.send(tea.WindowSizeMsg{Width: 100, Height: 33}) // 30 for the main panes, 3 for status
 	d.run(m.Init())
 	return d
 }
@@ -185,8 +186,9 @@ func TestIcons(t *testing.T) {
 	if !strings.Contains(screen, azure+" Azure") || !strings.Contains(screen, dbx+" Databricks") {
 		t.Errorf("icons missing:\n%s", screen)
 	}
-	if !strings.Contains(screen, "source     "+azure+" Azure / platform-prod") {
+	d.keys("3")
-		t.Errorf("detail source line missing icon:\n%s", screen)
+	if !strings.Contains(d.screen(), "source     "+azure+" Azure / platform-prod") {
 		t.Errorf("detail source line missing icon:\n%s", d.screen())
 	}
 }
@@ -204,7 +206,7 @@ func TestObjectTypeTabs(t *testing.T) {
 		t.Fatalf("selected = %q", s)
 	}
 	screen := d.screen()
-	for _, want := range []string{"key type   RSA 2048", "ops        sign, verify", "space to show public key"} {
+	for _, want := range []string{"key type   RSA 2048", "ops        sign, verify", "space to show the public key"} {
 		if !strings.Contains(screen, want) {
 			t.Errorf("missing %q:\n%s", want, screen)
 		}
@@ -400,6 +402,7 @@ func (describing) Describe(_ context.Context, o provider.Object) (provider.Objec
 func TestDescribeUpdatesDetail(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, describing{fake.Azure(0)})
 	d.keys("3") // the fourth pane follows focus: the secret
 	if !strings.Contains(d.screen(), "described  db-password") {
 		t.Fatalf("describe result not shown:\n%s", d.screen())
 	}
@@ -487,17 +490,21 @@ func TestVersions(t *testing.T) {
 func TestVersionHistoryInDetail(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3") // the fourth pane follows focus: the secret
 	screen := d.screen()
 	for _, want := range []string{
 		"versions   3 · v to browse",
-		"▸ 3f9c2a   2026-09-01 current", // the version shown above
+		"   3f9c2a   2026-09-01 current",
-		"  91d3e0   2026-03-01 expired",
+		"   91d3e0   2026-03-01 expired",
-		"  0a77c4   2025-09-01 disabled",
+		"   0a77c4   2025-09-01 disabled",
 	} {
 		if !strings.Contains(screen, want) {
 			t.Errorf("missing %q:\n%s", want, screen)
 		}
 	}
 	if strings.Contains(screen, "▸ 3f9c2a") {
 		t.Errorf("a cursor on a list that can't be moved in:\n%s", screen)
 	}
 	d.keys("3", "j") // api-key: only its current version
 	if !strings.Contains(d.screen(), "versions   1") || strings.Contains(d.screen(), "v to browse") {
 		t.Errorf("wrong history for api-key:\n%s", d.screen())
@@ -529,7 +536,7 @@ func TestBackspaceGoesBack(t *testing.T) {
 	}
 	// While typing a filter, backspace deletes a character instead.
 	d.keys("/")
-	d.typeText("apx")
+	d.typeText("api-x")
 	d.send(tea.KeyPressMsg{Code: tea.KeyBackspace})
 	if !d.m.secrets.Filtering() || d.m.secrets.Len() != 1 {
 		t.Errorf("backspace in filter: filtering=%v visible=%d", d.m.secrets.Filtering(), d.m.secrets.Len())
@@ -594,7 +601,7 @@ func TestPermissionErrorShownInPane(t *testing.T) {
 	if !strings.Contains(d.screen(), "403 Forbidden") {
 		t.Error("error not rendered")
 	}
-	if !strings.Contains(d.screen(), "Select a secret") {
+	if !strings.Contains(d.screen(), "name       kv-restricted") {
 		t.Error("detail should show the container summary")
 	}
 }
@@ -659,7 +666,7 @@ func TestFilter(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("api")
+	d.typeText("api-k")
 	if d.m.secrets.Len() != 1 {
 		t.Fatalf("visible = %d, want 1", d.m.secrets.Len())
 	}
@@ -677,9 +684,9 @@ func TestFilter(t *testing.T) {
 	}
 	d.keys("esc") // leave filter mode, clearing the query
 	d.keys("/")
-	d.typeText("api")
+	d.typeText("api-k")
 	d.keys("enter", "esc") // apply, then esc clears the applied filter
-	if d.m.secrets.Len() != 3 {
+	if d.m.secrets.Len() != 4 {
 		t.Errorf("esc should clear the applied filter, visible = %d", d.m.secrets.Len())
 	}
 	if _, _, s := d.selected(); s != "api-key" {
@@ -691,13 +698,13 @@ func TestMoveWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("a") // all three secrets contain an a
+	d.typeText("a") // all four secrets contain an a
-	if d.m.secrets.Len() != 3 {
+	if d.m.secrets.Len() != 4 {
 		t.Fatalf("visible = %d", d.m.secrets.Len())
 	}
 	_, _, initial := d.selected() // kept from before filtering: the middle row
 	var seen []string
-	for _, k := range []rune{'j', 'j', 'k'} {
+	for _, k := range []rune{'j', 'j', 'j', 'k'} {
 		d.send(tea.KeyPressMsg{Code: k, Mod: tea.ModCtrl})
 		_, _, s := d.selected()
 		seen = append(seen, s)
@@ -705,9 +712,9 @@ func TestMoveWhileFiltering(t *testing.T) {
 	if !d.m.secrets.Filtering() {
 		t.Fatal("ctrl+j/k left filter mode")
 	}
-	// down to the bottom, stay there, back up to where it started
+	// down to the bottom, stay there, back up one
-	if seen[0] == initial || seen[1] != seen[0] || seen[2] != initial {
+	if seen[0] == initial || seen[2] != seen[1] || seen[3] != seen[0] {
-		t.Errorf("from %q, ctrl+j, ctrl+j, ctrl+k selected %v", initial, seen)
+		t.Errorf("from %q, ctrl+j ×3, ctrl+k selected %v", initial, seen)
 	}
 	if !strings.Contains(d.screen(), "ctrl+j/n down") {
 		t.Errorf("filter help missing ctrl+j:\n%s", d.screen())
@@ -754,7 +761,9 @@ func TestFocusKeys(t *testing.T) {
 	}{
 		{"tab", paneContainers}, {"enter", paneSecrets}, {"enter", paneDetail},
 		{"enter", paneDetail}, {"esc", paneSecrets}, {"shift+tab", paneContainers},
-		{"4", paneDetail}, {"l", paneSources}, {"h", paneDetail},
+		{"4", paneDetail}, {"tab", paneSources}, {"shift+tab", paneDetail},
 		// l: what's selected, on the right; h: back to it.
 		{"2", paneContainers}, {"l", paneDetail}, {"h", paneContainers}, {"h", paneSources}, {"l", paneDetail},
 	} {
 		d.keys(tc.key)
 		if d.m.focus != tc.want {
@@ -839,7 +848,7 @@ func TestCopyAndRevealWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("api")
+	d.typeText("api-k")
 	d.send(tea.KeyPressMsg{Code: 'y', Mod: tea.ModCtrl})
 	if d.clip().content != "sk_live_51HxDEMO0000000000000000" {
 		t.Errorf("ctrl+y copied %q", d.clip().content)
@@ -979,12 +988,17 @@ func TestRebindingShowsEverywhere(t *testing.T) {
 	d := newDriverOpts(t, Options{Keys: &km})
 	d.keys("3")
 	scr := d.screen()
-	if !strings.Contains(scr, "(z to reveal)") || strings.Contains(scr, "space to reveal") {
+	if !strings.Contains(scr, "z to reveal") || strings.Contains(scr, "space to reveal") {
 		t.Errorf("detail hint doesn't follow the binding:\n%s", scr)
 	}
-	if !strings.Contains(lastLine(scr), "z reveal/hide") {
+	if !strings.Contains(lastLines(scr, 1), "z show") {
-		t.Errorf("help bar: %q", lastLine(scr))
+		t.Errorf("help bar: %q", lastLines(scr, 1))
 	}
 	d.keys("z")
 	if bar := lastLines(d.screen(), 1); !strings.Contains(bar, "z hide") {
 		t.Errorf("help bar with the value shown: %q", bar)
 	}
 	d.keys("z")
 	if strings.Contains(scr, "to browse") {
 		t.Errorf("hint for unbound versions:\n%s", scr)
 	}
@@ -1037,7 +1051,7 @@ func TestSignInMessageOnceThenInDetails(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{CollapseGroups: false}, fake.Azure(0), signedOut{fake.Azure(0)})
 	hint := "Azure · admin: sign-in required"
-	if !strings.Contains(lastLines(d.screen(), 2), hint) {
+	if !strings.Contains(lastLines(d.screen(), 2), hint) { // the footer: one line
 		t.Fatalf("not said at start:\n%s", d.screen())
 	}
 	d.keys("j")
@@ -1050,7 +1064,7 @@ func TestSignInMessageOnceThenInDetails(t *testing.T) {
 	if r, _ := d.m.sources.Selected(); r.provider != "Azure:admin@contoso.com/t1" {
 		t.Fatalf("selected %+v", r)
 	}
-	if !strings.Contains(d.screen(), hint) || !strings.Contains(d.screen(), "press L to run az login --tenant t1") {
+	if scr := d.screen(); !strings.Contains(scr, "problem") || !strings.Contains(scr, hint) || !strings.Contains(scr, "press L to run az login") {
 		t.Errorf("not in Details:\n%s", d.screen())
 	}
 	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
@@ -1069,3 +1083,295 @@ func lastLines(scr string, n int) string {
 	lines := strings.Split(strings.TrimRight(scr, "\n"), "\n")
 	return strings.Join(lines[max(0, len(lines)-n):], "\n")
 }
 // described is an account that can say who it is.
 type described struct{ provider.Provider }
 func (described) Account() (provider.Account, bool) {
 	return provider.Account{
 		Fields: []provider.Attr{{Label: "name", Value: "Alice Example"}, {Label: "object ID", Value: "oid-123"}},
 		Copy:   "oid-123", CopyLabel: "object ID",
 	}, true
 }
 func TestAccountInDetails(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, described{fake.Azure(0)})
 	d.keys("g") // the group's row
 	if r, _ := d.m.sources.Selected(); r.kind != rowGroup {
 		t.Fatalf("not on the group: %+v", r)
 	}
 	if scr := d.screen(); !strings.Contains(scr, "Alice Example") || !strings.Contains(scr, "oid-123") {
 		t.Errorf("account not in Details:\n%s", scr)
 	}
 	d.keys("y")
 	if got := d.clip().content; got != "oid-123" {
 		t.Errorf("y copied %q", got)
 	}
 	d.keys("j")
 	if strings.Contains(d.screen(), "Alice Example") {
 		t.Errorf("still shown on a subscription:\n%s", d.screen())
 	}
 }
 func TestAccountPane(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, described{fake.Azure(0)})
 	d.keys("g", "l") // the account's row, then its pane
 	if d.m.focus != paneDetail {
 		t.Fatalf("focus %v, want the fourth pane", d.m.focus)
 	}
 	scr := d.screen()
 	if !strings.Contains(scr, "Alice Example") {
 		t.Errorf("account not shown:\n%s", scr)
 	}
 	bar := lastLines(scr, 1)
 	if !strings.Contains(bar, "copy") || strings.Contains(bar, "reveal") || strings.Contains(bar, "versions") {
 		t.Errorf("help bar: %q", bar)
 	}
 	d.keys("j", "y")
 	if got := d.clip().content; got != "oid-123" {
 		t.Errorf("y on the object ID copied %q", got)
 	}
 	// / filters it, labels too.
 	d.keys("/")
 	d.typeText("object")
 	d.keys("enter")
 	if scr := d.screen(); !strings.Contains(scr, "oid-123") || strings.Contains(scr, "Alice Example") {
 		t.Errorf("filtered:\n%s", scr)
 	}
 	d.keys("esc")
 	if !strings.Contains(d.screen(), "Alice Example") {
 		t.Errorf("filter not cleared:\n%s", d.screen())
 	}
 	d.keys("h")
 	if d.m.focus != paneSources {
 		t.Errorf("back to %v, want Sources", d.m.focus)
 	}
 }
 func TestDetailsFollowFocus(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3") // a secret
 	if !strings.Contains(d.screen(), "version    3f9c2a") {
 		t.Fatalf("secret not shown:\n%s", d.screen())
 	}
 	d.keys("2") // its vault
 	if scr := d.screen(); !strings.Contains(scr, "name       kv-app-prod") || strings.Contains(scr, "version    3f9c2a") {
 		t.Errorf("vault not described:\n%s", scr)
 	}
 	d.keys("1") // its subscription
 	if scr := d.screen(); !strings.Contains(scr, "name       platform-prod") || !strings.Contains(scr, "vaults     3") {
 		t.Errorf("subscription not described:\n%s", scr)
 	}
 	// Into the fourth pane: it keeps describing the subscription, and
 	// shift+tab goes back there.
 	d.keys("4")
 	if !strings.Contains(d.screen(), "name       platform-prod") {
 		t.Errorf("lost the subscription:\n%s", d.screen())
 	}
 	d.keys("shift+tab")
 	if d.m.focus != paneSources {
 		t.Errorf("back to %v", d.m.focus)
 	}
 	// A value revealed from a left pane stays in view until hidden.
 	d.keys("space")
 	if !strings.Contains(d.screen(), "correct-horse-battery-staple") {
 		t.Errorf("value not shown:\n%s", d.screen())
 	}
 }
 func TestStatusLineCountsRepos(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, fake.Azure(0), fake.Repos())
 	// The status line, not the pane, which an expired secret's ⚠ fills.
 	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "1 account · 4 repos") {
 		t.Errorf("status line: %q", line)
 	}
 	d = newDriver(t, fake.Azure(0))
 	if line := strings.Split(d.screen(), "\n")[1]; strings.Contains(line, "repo") {
 		t.Errorf("repos counted without any: %q", line)
 	}
 }
 func TestStatusPane(t *testing.T) {
 	t.Parallel()
 	var opened []string
 	d := newDriverOpts(t, Options{Version: "0.1.0", ConfigFiles: []string{"/cfg/config.yaml"}, StatePath: "/state/state.json",
 		OpenURL: func(u string) error { opened = append(opened, u); return nil }},
 		fake.Azure(0), signedOut{fake.Azure(0)})
 	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "2 accounts · 1 need sign-in") {
 		t.Errorf("status line: %q", line)
 	}
 	d.keys("0")
 	if d.m.focus != paneStatus {
 		t.Fatalf("focus %v", d.m.focus)
 	}
 	scr := d.screen()
 	for _, want := range []string{logo[2], "version    v0.1.0", "GPL-3.0-or-later", "Azure · 2 subscriptions", "Azure · admin · sign-in required",
 		"/cfg/config.yaml", "/state/state.json", "lazysecrets/…/docs"} {
 		if !strings.Contains(scr, want) {
 			t.Errorf("missing %q:\n%s", want, scr)
 		}
 	}
 	// Into its rows: L signs in to the failing account, y copies a path,
 	// o opens a link.
 	d.keys("enter")
 	if d.m.focus != paneDetail {
 		t.Fatalf("enter: focus %v", d.m.focus)
 	}
 	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Provider == "Azure:admin@contoso.com/t1" })
 	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
 		t.Errorf("L signs in to %+v", a)
 	}
 	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "config" })
 	d.keys("y")
 	if got := d.clip().content; got != "/cfg/config.yaml" {
 		t.Errorf("y copied %q", got)
 	}
 	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "docs" })
 	d.keys("o")
 	if len(opened) != 1 || !strings.HasSuffix(opened[0], "/src/branch/main/docs") {
 		t.Errorf("o opened %q", opened)
 	}
 	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "version" })
 	d.keys("o")
 	if len(opened) != 2 || !strings.HasSuffix(opened[1], "/releases/tag/v0.1.0") {
 		t.Errorf("o on the version opened %q", opened)
 	}
 	d.keys("shift+tab")
 	if d.m.focus != paneStatus {
 		t.Errorf("back to %v", d.m.focus)
 	}
 }
 // empty is an account with nothing in it, like Databricks without profiles.
 type empty struct{ provider.Provider }
 func (empty) Sources(context.Context) ([]provider.Source, error) { return nil, nil }
 func TestGetStarted(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{}, signedOut{fake.Azure(0)}, empty{fake.Databricks(0)})
 	scr := d.screen()
 	for _, want := range []string{"get started", "Azure      az login", "L runs it here",
 		"databricks auth login --host", "lazysecrets --demo"} {
 		if !strings.Contains(scr, want) {
 			t.Errorf("missing %q:\n%s", want, scr)
 		}
 	}
 	d.keys("l", "j")
 	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
 		t.Errorf("L signs in to %+v", a)
 	}
 	d.keys("y")
 	if got := d.clip().content; got != "az login" {
 		t.Errorf("y copied %q", got)
 	}
 	// Once an account has something, an empty one says what it needs.
 	d = newDriverOpts(t, Options{}, fake.Azure(0), empty{fake.Databricks(0)})
 	d.m.sources.SelectWhere(func(r sourceRow) bool { return r.kind == rowGroup && r.provider == fake.Databricks(0).ID() })
 	d.send(nil)
 	if scr := d.screen(); strings.Contains(scr, "get started") || !strings.Contains(scr, "databricks auth login") {
 		t.Errorf("empty Databricks:\n%s", scr)
 	}
 }
 // detailed is an account whose vaults have details.
 type detailed struct{ provider.Provider }
 func (detailed) Details(_ context.Context, c provider.Container) ([]provider.Attr, error) {
 	return []provider.Attr{{Label: "access", Value: "Azure roles (RBAC)"}, {Label: "git", Value: "tracked", Warn: true}}, nil
 }
 func TestContainerDetails(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{}, detailed{fake.Azure(0)})
 	d.keys("2")
 	if scr := d.screen(); !strings.Contains(scr, "access     Azure roles (RBAC)") || !strings.Contains(scr, "URI") {
 		t.Errorf("details:\n%s", scr)
 	}
 	if st := d.m.details[d.m.containers.SelectedID()]; st.loading || len(st.attrs) != 2 {
 		t.Errorf("state %+v", st)
 	}
 }
 func TestExpiringInStatus(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{ExpiryWarning: 30 * 24 * time.Hour}, fake.Azure(0))
 	d.keys("3", "]", "]") // load kv-app-prod's certificates
 	// old-tls and legacy-token.
 	if !strings.Contains(d.screen(), "⚠ 2 expiring") {
 		t.Errorf("status line:\n%s", d.screen())
 	}
 	d.keys("0")
 	scr := d.screen()
 	for _, want := range []string{"expiring   ✗ expired  old-tls · kv-app-prod", "in 1 of 3 vaults (ctrl+a in search loads all)"} {
 		if !strings.Contains(scr, want) {
 			t.Errorf("missing %q:\n%s", want, scr)
 		}
 	}
 	d.keys("3", "[", "[", "0", "enter") // elsewhere, then to it from the status pane
 	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "expiring" })
 	d.keys("enter")
 	if _, v, o := d.selected(); v != "kv-app-prod" || o != "old-tls" {
 		t.Errorf("enter went to %s/%s\n%s", v, o, d.screen())
 	}
 }
 func TestErrorLog(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{}, fake.Azure(0))
 	d.keys("2", "j", "j", "3") // kv-restricted: its secrets can't be listed
 	d.m.flash = flash{text: "copy failed: no clipboard", isErr: true}
 	d.send(nil)
 	d.send(nil) // still showing: logged once
 	d.keys("0")
 	scr := d.screen()
 	if !strings.Contains(scr, "errors") || !strings.Contains(scr, "copy failed: no clipboard") || !strings.Contains(scr, "kv-restricted: 403 Forbidden") {
 		t.Errorf("errors not listed:\n%s", scr)
 	}
 	if n := len(d.m.errLog); n != 2 || !strings.HasPrefix(d.m.errLog[0].text, "copy failed") {
 		t.Errorf("log %+v", d.m.errLog)
 	}
 	d.m.logErr("403 Forbidden: again") // a new one, and an old one again: on top
 	d.m.logErr(d.m.errLog[2].text)
 	if len(d.m.errLog) != 3 || d.m.errLog[0].text == "403 Forbidden: again" {
 		t.Errorf("log %+v", d.m.errLog)
 	}
 }
 // hiding marks the secret db-password hidden, as the repo provider does
 // a Spring key that doesn't look secret.
 type hiding struct{ provider.Provider }
 func (h hiding) Objects(ctx context.Context, c provider.Container, t provider.ObjectType) ([]provider.Object, error) {
 	objs, err := h.Provider.Objects(ctx, c, t)
 	for i := range objs {
 		objs[i].Hidden = objs[i].Name == "db-password"
 	}
 	return objs, err
 }
 func TestToggleHidden(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, hiding{fake.Azure(0)})
 	if _, _, s := d.selected(); s == "db-password" || s == "" {
 		t.Fatalf("selected %q: the hidden one, or none", s)
 	}
 	if strings.Contains(d.screen(), "db-password") || !strings.Contains(d.screen(), "1 hidden") {
 		t.Fatalf("hidden one listed:\n%s", d.screen())
 	}
 	d.keys("H")
 	if !strings.Contains(d.screen(), "db-password") || !strings.Contains(d.screen(), "showing hidden") {
 		t.Fatalf("H doesn't show it:\n%s", d.screen())
 	}
 	d.keys("H")
 	if strings.Contains(d.screen(), "db-password") {
 		t.Fatalf("H again doesn't hide it:\n%s", d.screen())
 	}
 }
@@ -1,8 +1,12 @@
 package app
 import (
 	"maps"
 	"slices"
 	"time"
 	tea "charm.land/bubbletea/v2"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
@@ -48,3 +52,44 @@ func (c cache) rememberCursor(parent, child string) {
 		c.cursor[parent] = child
 	}
 }
 // refreshShown shows the selected secret's newer metadata when its list
 // reloaded with it changed from before (a cached list refreshed in the
 // background), and describes it afresh: its cached details came from
 // the old listing.
 func (m *Model) refreshShown(before []provider.Object) tea.Cmd {
 	s, ok := m.secrets.Selected()
 	if !ok || m.secrets.SelectedID() != m.selSecret {
 		return nil // a new selection is shown as usual
 	}
 	i := slices.IndexFunc(before, func(o provider.Object) bool { return o.ID == s.ID })
 	if i < 0 || sameListing(before[i], s) {
 		return nil
 	}
 	m.detail.SetDescribed(s)
 	uncache(m, m.cache.details, detailKey(s))
 	return m.describe(s)
 }
 // uncache deletes key from a cache, and, at the next save, from the file.
 func uncache[T any](m *Model, c map[string]entry[T], key string) {
 	if _, ok := c[key]; !ok {
 		return
 	}
 	delete(c, key)
 	if m.cacheDropped == nil {
 		m.cacheDropped = map[string]bool{}
 	}
 	m.cacheDropped[key] = true
 	m.cacheDirty = true
 }
 // sameListing reports whether a and b list the same: what a list
 // says of an object, not what describing it adds.
 func sameListing(a, b provider.Object) bool {
 	enabled := func(e *bool) bool { return e == nil || *e }
 	return a.Name == b.Name && a.Version == b.Version && enabled(a.Enabled) == enabled(b.Enabled) &&
 		a.Updated.Equal(b.Updated) && a.Expires.Equal(b.Expires) && a.ContentType == b.ContentType &&
 		maps.Equal(a.Tags, b.Tags) && a.Reference == b.Reference && a.URL == b.URL &&
 		slices.Equal(a.Attrs, b.Attrs)
 }
@@ -2,6 +2,7 @@ package app
 import (
 	"context"
 	"slices"
 	"testing"
 	"time"
@@ -159,3 +160,33 @@ func TestMovingOnDropsUnsettledLoads(t *testing.T) {
 		t.Errorf("stopping on a subscription: %d calls, want 1", c.containers-before)
 	}
 }
 func TestReloadedListRefreshesShownSecret(t *testing.T) {
 	t.Parallel()
 	d, _, clock := newCachingDriver(t)
 	d.keys("3") // kv-app-prod's secrets, db-password selected
 	shown, _ := d.m.detail.Secret()
 	// What an older lazysecrets listed and cached for it.
 	const old = "https://portal.example/old"
 	key := d.m.selContainer
 	e := d.m.cache.objects[key]
 	items := slices.Clone(e.value)
 	for i := range items {
 		if items[i].ID == shown.ID {
 			items[i].URL = old
 		}
 	}
 	d.m.cache.objects[key] = entry[[]provider.Object]{items, e.at}
 	stale := shown
 	stale.URL = old
 	d.m.cache.details[detailKey(shown)] = entry[provider.Object]{stale, *clock}
 	// Away and back once the list is stale: it's shown from the cache,
 	// then reloaded, and the details pane follows.
 	d.keys("1", "j")
 	*clock = clock.Add(cacheTTL + time.Second)
 	d.keys("k", "3")
 	if got, _ := d.m.detail.Secret(); got.ID != shown.ID || got.URL == old {
 		t.Errorf("shown %s with %q after the reload", got.Name, got.URL)
 	}
 }
@@ -1,6 +1,7 @@
 package app
 import (
 	"cmp"
 	"context"
 	"fmt"
 	"os"
@@ -53,6 +54,9 @@ func paneContext(p pane) string {
 // commandsHere are the custom commands for the focused pane.
 func (m *Model) commandsHere() []commands.Command {
 	if m.focus == paneStatus {
 		return nil
 	}
 	var out []commands.Command
 	for _, c := range m.commands {
 		if c.Context == commands.Global || c.Context == paneContext(m.focus) {
@@ -81,10 +85,7 @@ func (m *Model) showCommands() tea.Cmd {
 	}
 	var opts []option
 	for _, c := range cmds {
-		label := c.Description
+		label := cmp.Or(c.Description, c.Command)
 		if label == "" {
 			label = c.Command
 		}
 		if c.Key != "" {
 			label = m.st.Label.Render(fmt.Sprintf("%-8s", c.Key)) + label
 		}
@@ -119,7 +120,7 @@ func (m *Model) askPrompt(c commands.Command, it commands.Item, obj *provider.Ob
 	in.SetValue(p.Default)
 	in.CursorEnd()
 	m.prompt = &modal{
-		title: cmpOr(c.Description, "Command"), input: &in,
+		title: cmp.Or(c.Description, "Command"), input: &in,
 		submit: func(m *Model, text string) tea.Cmd {
 			it.Prompt[p.Name] = commands.Q(text)
 			return m.askPrompt(c, it, obj, i+1)
@@ -148,7 +149,7 @@ func (m *Model) confirmCommand(c commands.Command, it commands.Item, obj *provid
 	case strings.HasPrefix(c.Value, "env:"):
 		lines = append(lines, "", "It gets the value of "+string(it.Name)+" in $"+strings.TrimPrefix(c.Value, "env:")+".")
 	}
-	m.showMenu("Run "+cmpOr(c.Description, "command")+"?", lines, []option{
+	m.showMenu("Run "+cmp.Or(c.Description, "command")+"?", lines, []option{
 		{key: "y", label: "Run it", run: func(m *Model) tea.Cmd { return m.runCommand(c, rendered, obj) }},
 	})
 	return nil
@@ -162,7 +163,7 @@ func (m *Model) runCommand(c commands.Command, rendered string, obj *provider.Ob
 	o := *obj
 	p := m.providerFor(o.Container.Source)
 	m.flash = flash{text: "fetching " + o.Name + " for " + c.Description + "…"}
-	timeout := m.timeout
+	timeout := m.timeout.of(o.Container.Source.Kind)
 	m.usedObject(o)
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)
@@ -174,7 +175,7 @@ func (m *Model) runCommand(c commands.Command, rendered string, obj *provider.Ob
 // execCommand runs the command as its output mode says.
 func (m *Model) execCommand(c commands.Command, rendered string, value provider.SecretValue) tea.Cmd {
-	shell := cmpOr(os.Getenv("SHELL"), "/bin/sh")
+	shell := cmp.Or(os.Getenv("SHELL"), "/bin/sh")
 	setValue := func(cmd *exec.Cmd) {
 		switch {
 		case c.Value == "stdin":
@@ -192,7 +193,7 @@ func (m *Model) execCommand(c commands.Command, rendered string, value provider.
 		m.flash = flash{}
 		return tea.ExecProcess(cmd, func(err error) tea.Msg { return commandDoneMsg{cmd: c, err: err} })
 	}
-	m.flash = flash{text: "running " + cmpOr(c.Description, "command") + "…"}
+	m.flash = flash{text: "running " + cmp.Or(c.Description, "command") + "…"}
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
 		defer cancel()
@@ -216,7 +217,7 @@ func (m *Model) handleCommandValue(msg commandValueMsg) tea.Cmd {
 const maxOutputLines = 30
 func (m *Model) handleCommandDone(msg commandDoneMsg) {
-	name := cmpOr(msg.cmd.Description, "command")
+	name := cmp.Or(msg.cmd.Description, "command")
 	if msg.cmd.Out() != commands.Popup || m.prompt != nil || m.search != nil {
 		switch {
 		case msg.err != nil:
@@ -295,11 +296,7 @@ func (m *Model) commandItem(ctx string) (commands.Item, *provider.Object, bool)
 	if r, err := ref.ForObject(o, version); err == nil {
 		it.Link = commands.Q(r.String())
 	}
-	if version != "" {
+	o.Version = version // "": the current value, like copying it
 		o.Version = version
 	} else {
 		o.Version = "" // the current value, like copying it
 	}
 	return it, &o, true
 }
@@ -310,9 +307,5 @@ func newTextInput(prompt string, width int) textinput.Model {
 	return in
 }
-func cmpOr(a, b string) string {
+// pathInputWidth fits a link or a folder path in a prompt, in the window.
-	if a != "" {
+func (m Model) pathInputWidth() int { return max(20, min(m.w-12, 64)) }
 		return a
 	}
 	return b
 }
		`@@ -0,0 +1,2 @@`
							`<1+keb@noreply.git.kebcloud.no> <1+keb@noreply.localhost>`
							`<3+renovate-bot@noreply.git.kebcloud.no> <3+renovate-bot@noreply.localhost>`