chore(release): v0.2.0

`lazysecrets list` prints every source, vault and secret lazysecrets can find, one per line, for fzf, editor pickers and scripts: what Go to searches, without the TUI. What's cached prints at once; what's missing or older than `--max-age` loads in the background and streams in. It stops when the reader goes (a pick in fzf), saving what it loaded.

- Text: kind, mark (✗/⚠, ★, ◷ and the provider icon), name, status (why it couldn't be read, or expired / expires in 12d), note, account and link, tab-separated; kind first and account and link last, so new fields go between. Coloured from the theme; `--color never`, `--icons=false`, `--stars=false`, `--recent`, `--notes=false`, `--expiry=false`.
- `--format json`: an object per line, with starred, recent, lastUsed and uses, expires, enabled, note, reference and url too.
- `--kind` lists only some kinds, and doesn't load lists only other kinds need; `--cached` loads nothing.
- `lazysecrets open --action go|copy|show` skips the "what to do" menu and ends in the list, like Go to; `open` and `get` take `--account`, the account list printed, rather than asking which.
- The cache file moved to `internal/cachefile`: saves merge with the file under a lock, so list and the TUI don't undo each other.
- `ui.recentIcon` marks items used lately with ◷ in the TUI's lists too; Recent now means the last 90 days.
- --demo has stars, notes, recent use, and expired, expiring and disabled secrets.
- docs/integration.md documents get, list and an fzf picker; docs/links.md is docs/sharing.md.

Reviewed-on: #70
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>

.mailmap

@@ -0,0 +1,2 @@
+<1+keb@noreply.git.kebcloud.no> <1+keb@noreply.localhost>
+<3+renovate-bot@noreply.git.kebcloud.no> <3+renovate-bot@noreply.localhost>

CHANGELOG.md

@@ -2,6 +2,38 @@
 
 Every release of lazysecrets, newest first.
 
+## v0.2.0 – 2026-10-14
+
+### Added
+
+- Lazysecrets list prints everything lazysecrets can find, for fzf and editor pickers ([#70](https://git.kebcloud.no/keb/lazysecrets/pulls/70)) ([39454d4](https://git.kebcloud.no/keb/lazysecrets/commit/39454d47a864c8628c50b023aee9539d33be2f44))
+
+### Fixed
+
+- Lazysecrets starts from fzf's become, on a non-blocking terminal ([#67](https://git.kebcloud.no/keb/lazysecrets/pulls/67)) ([4480e8f](https://git.kebcloud.no/keb/lazysecrets/commit/4480e8fed00024691091eb7096abb9dc83b8044d))
+- Local builds are dev-<commit> again, not a Go pseudo-version ([#68](https://git.kebcloud.no/keb/lazysecrets/pulls/68)) ([e825a51](https://git.kebcloud.no/keb/lazysecrets/commit/e825a51b30261b55c536af18fefde79dc6308377))
+- A wrapped value in the details keeps its colour on every line ([#69](https://git.kebcloud.no/keb/lazysecrets/pulls/69)) ([dbb0eb2](https://git.kebcloud.no/keb/lazysecrets/commit/dbb0eb2bbdf6d695cf0d9ac15a1b513af8ba431d))
+
+## v0.1.2 – 2026-10-13
+
+### Added
+
+- Look for repos in the usual folders, not just ~/git ([#57](https://git.kebcloud.no/keb/lazysecrets/pulls/57)) ([47ef862](https://git.kebcloud.no/keb/lazysecrets/commit/47ef86293d757f965069b1ea100a4d53d5a9b876))
+- Config grouped by area, with per-provider timeouts and an update interval ([#60](https://git.kebcloud.no/keb/lazysecrets/pulls/60)) ([10d1fc6](https://git.kebcloud.no/keb/lazysecrets/commit/10d1fc63c75fbb91088119a2e81884e44c36c4a3))
+- The update changelog covers every version you missed ([#61](https://git.kebcloud.no/keb/lazysecrets/pulls/61)) ([75bab25](https://git.kebcloud.no/keb/lazysecrets/commit/75bab2528677086219817ff9bc08a36755c96dcd))
+
+### Fixed
+
+- Help and errors name sharing.key and sharing.keyRules, not share.* ([#64](https://git.kebcloud.no/keb/lazysecrets/pulls/64)) ([6b3edd4](https://git.kebcloud.no/keb/lazysecrets/commit/6b3edd45d83b9b2af06a40f1f7e67f35c6861a69))
+- Unambiguous repo key names, clearer config and key names, and a newer lazysecrets's files no longer stop an older one ([#66](https://git.kebcloud.no/keb/lazysecrets/pulls/66)) ([a81fcaa](https://git.kebcloud.no/keb/lazysecrets/commit/a81fcaa5a6cef3ce0d07d6195f3e7bbb98808253))
+
+## v0.1.1 – 2026-10-13
+
+### Added
+
+- `e` on the status pane edits the config ([#55](https://git.kebcloud.no/keb/lazysecrets/pulls/55)) ([2044341](https://git.kebcloud.no/keb/lazysecrets/commit/2044341b20d795fa7cadcabb9514631990993e0a))
+- Share env files as encrypted links ([#54](https://git.kebcloud.no/keb/lazysecrets/pulls/54)) ([4377eb9](https://git.kebcloud.no/keb/lazysecrets/commit/4377eb98bf0dd523d5c4371bf84668412053290e))
+
 ## v0.1.0 – 2026-10-12
 
 Hello world 👋

README.md

@@ -12,9 +12,7 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
   CLI, `sops`, `git`). No config file needed.
 - **Search everything**: `ctrl+s` searches every source at once, with
   fzf-style matching.
-- **Share links**: Share `lazysecrets://` links with colleagues. A colleague opens it
-  with their own access, from the terminal or with a click in the browser
-  or chat.
+- **Share links**: Share `lazysecrets://` links with colleagues.
 - **Neovim integration**: via [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
 - **Careful with values**: values stay hidden until you reveal them, and
   copied values are cleared from the clipboard after 30 seconds.
@@ -33,18 +31,20 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 ## Install
 
 On macOS or Linux (arm64 or x86_64):
-
+```sh
+curl -fsSL https://raw.githubusercontent.com/karleinarb/lazysecrets/main/install.sh | sh
+```
+Or
 ```sh
 curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
 ```
 
-It installs the latest release, from GitHub or else
+Both approaches will install the latest release from [GitHub](https://github.com/karleinarb/lazysecrets/releases) with fallback to
 [git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets/releases), into
 `~/.local/bin` after checking it against the release's checksums.
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
 
-
 lazysecrets looks for a newer release once a day: the footer then shows
 `↑ v0.2.0`, and `U` shows its changelog and updates in place (or run
 `lazysecrets update`).
@@ -77,29 +77,47 @@ use most:
 | `?` | every key, searchable |
 | `q` | quit |
 
+
+## Integration
+Lazysecret let you integrate it into your workflows by `lazysecrets` `list`/`get`/`open`
+
+Here is an example of implementing a picker in `fzf`:
+```sh
+lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1 \
+  --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
+  --bind 'ctrl-o:become(lazysecrets open --action go --account {-2} {-1})' \
+  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {3})' \
+  --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'
+```
+
+![fzf-example](docs/assets/fzf-example.png)
+
+More defails in the [Integration](docs/integration.md) docs
+
 ## Docs
 
 - [Keys](docs/keys.md): every key, Go to, the layout, and rebinding keys
 - [Azure Key Vault](docs/azure.md): accounts, permissions, pinned vaults
 - [Databricks](docs/databricks.md): profiles and Key Vault-backed scopes
 - [SOPS and .env files](docs/repos.md): which repos and files, decrypting
-- [Links](docs/links.md): sharing, opening, `lazysecrets get` in scripts,
-  and opening links from the browser and chat
+- [Sharing](docs/sharing.md): links to secrets, encrypted env files, and
+  opening links, also from the browser and chat
+- [Integration](docs/integration.md): how lazysecrets can integrate into other systems
 - [Custom commands](docs/custom-commands.md): run your own commands on a
   secret
 - [Config](docs/config.md): every option, themes, layered configs, the
   state file
-- [Development](docs/development.md): building, tests, pull requests and
+- [Development](docs/development.md): building, tests, how changes land and
   releasing
 
 ## Privacy
 
 lazysecrets never stores, caches or sends your secret values. It keeps the
 names and metadata of what you've loaded in a cache file readable only by
-you, to show it at once next time (`cache: false` turns it off). It talks
+you, to show it at once next time (`storage.cache: false` turns it off). It talks
 only to the services you use it with, and collects no usage data. The one
 call of its own is a daily check for a new release, on GitHub or else
-git.kebcloud.no, which `updateCheck: false` turns off.
+git.kebcloud.no, which `updates.autoCheck: false` turns off.
 
 ## Repositories
 

SECURITY.md

@@ -0,0 +1,11 @@
+# Security
+
+Please report a vulnerability privately, not in a public issue:
+
+- on GitHub, with **Report a vulnerability** under the
+  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
+- by email to karl-einarb@outlook.com.
+
+Say what's affected, how to reproduce it and the version
+(`lazysecrets --version`). Fixes go into the next release, and only the
+latest release gets them.

cliff.toml

@@ -51,6 +51,8 @@ commit_preprocessors = [
   { pattern = "^Merge pull request '(.+)' \\((#[0-9]+)\\) from .*", replace = "${1} (${2})" },
   # #11 was squash-merged with #10 (the status pane) in it: name both.
   { pattern = "^feat: link each changelog entry to its PR and commit \\(#11\\)", replace = "feat: a status pane (0) with version, updates, accounts, files and links; changelog entries link to their PR and commit (#11)" },
+  # #55's title starts with a key, which capitalised reads as another.
+  { pattern = "^feat: e on the status pane edits the config", replace = "feat: `e` on the status pane edits the config" },
   # Titles may be written "[feat] x", "[feat]: x" or "feat:x" (see
   # pr-title.yml); all become "feat: x".
   { pattern = "^\\[(feat|fix|perf|refactor|docs|test|ci|chore|build|style|revert)(\\([^)]*\\))?(!?)\\](!?):?\\s*", replace = "${1}${2}${3}${4}: " },

cmd/lazysecrets/get.go

@@ -1,10 +1,7 @@
 package main
 
 import (
-	"cmp"
 	"context"
-	"errors"
-	"fmt"
 	"os"
 
 	"golang.org/x/term"
@@ -33,82 +30,22 @@ func get(ctx context.Context, providers []provider.Provider, st *store.Store, r
 	return err
 }
 
-// value reads what r points at without listing its vault: the vault and
-// name are enough for Azure, tried with each account (the one that last
-// read it first); for Databricks the workspace's profile is found by its
-// host.
+// value reads what r points at (ref.Read), with the account that last
+// read it first.
 func value(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, error) {
-	if r.IsSource() || r.IsContainer() {
-		return provider.SecretValue{}, fmt.Errorf("%s points at a %s, not a secret", r, map[bool]string{true: "subscription or workspace", false: "vault or scope"}[r.IsSource()])
-	}
-	if r.Kind != provider.KindAzure && r.Host == "" {
-		return provider.SecretValue{}, errors.New("{{secrets/…}} names no workspace: use its lazysecrets:// link (s in lazysecrets)")
+	v, _, err := readKey(ctx, providers, st, r)
+	return v, err
 }
+
+// readKey is value, also returning the version read. The account asked
+// for (--account) goes first, else the one that last read it.
+func readKey(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, string, error) {
 	key := r
 	key.Version = ""
 	node := st.Node(key.String())
-
-	type try struct {
-		p provider.Provider
-		o provider.Object
+	account, source := node.Account, node.Source
+	if r.Account != "" && r.Account != account {
+		account, source = r.Account, ""
 	}
-	var tries []try
-	for _, p := range providers {
-		if p.Kind() != r.Kind {
-			continue
-		}
-		o := provider.Object{Name: r.Name, Type: cmp.Or(r.Type, provider.TypeSecret), Version: r.Version}
-		if r.Kind != provider.KindAzure { // by host: workspaces, repos
-			loc, ok := p.(provider.Locator)
-			if !ok {
-				continue
-			}
-			profile, found, err := loc.Locate(ctx, r.Host)
-			if err != nil || !found {
-				continue
-			}
-			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: profile}
-			o.Container = provider.Container{Source: src, Name: r.Scope}
-			// Listing the scopes tells a Key Vault-backed one, whose value
-			// can then be read from the vault if Databricks refuses.
-			if cs, err := p.Containers(ctx, src); err == nil {
-				for _, c := range cs {
-					if c.Name == r.Scope {
-						c.Source = src
-						o.Container = c
-					}
-				}
-			}
-		} else {
-			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: node.Source}
-			o.Container = provider.Container{Source: src, Name: r.ContainerName(), Detail: r.VaultURL()}
-		}
-		t := try{p, o}
-		if p.ID() == node.Account {
-			tries = append([]try{t}, tries...)
-		} else {
-			tries = append(tries, t)
-		}
-	}
-	if len(tries) == 0 {
-		switch r.Kind {
-		case provider.KindDatabricks:
-			return provider.SecretValue{}, fmt.Errorf("no Databricks profile for workspace %s", r.Host)
-		case provider.KindRepo:
-			return provider.SecretValue{}, fmt.Errorf("repo %s isn't here: run it inside the repo, or list it under providers.repos.paths", r.Host)
-		}
-		return provider.SecretValue{}, fmt.Errorf("no %s account to read %s with", r.Kind, r)
-	}
-	var errs []error
-	for _, t := range tries {
-		v, err := t.p.Value(ctx, t.o)
-		if err == nil {
-			return v, nil
-		}
-		if len(tries) == 1 {
-			return provider.SecretValue{}, err
-		}
-		errs = append(errs, fmt.Errorf("%s: %w", t.p.Label(), err))
-	}
-	return provider.SecretValue{}, errors.Join(errs...)
+	return ref.Read(ctx, providers, r, account, source)
 }

cmd/lazysecrets/list.go

@@ -0,0 +1,269 @@
+package main
+
+import (
+	"cmp"
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"slices"
+	"strings"
+	"syscall"
+	"time"
+
+	"charm.land/lipgloss/v2"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
+	"git.kebcloud.no/keb/lazysecrets/internal/listing"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
+)
+
+// listCmd prints every source, vault and secret lazysecrets can find, one
+// per line, for fzf, editor pickers and scripts:
+//
+//	lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1
+//
+// Each line is the kind, a mark (✗ or ⚠, ★, ◷ and the provider's icon),
+// the name, a status (why it couldn't be read, or that it has expired or
+// expires soon; else empty), its note (muted, or empty), the account and
+// the link, tab-separated. The mark has a field of its own so a search can
+// leave it out (fzf --nth), and ^prod finds names starting with prod. The
+// name is coloured from the theme,
+// with the provider's icon (as in the TUI: --icons, LAZYSECRETS_ICONS,
+// ui.icons); the link never is.
+//
+// What's cached prints at once; what's missing or older than --max-age
+// follows as it loads. A list that can't be read is a line too, as it
+// fails: the vault or source, then ✗ and why in the theme's error colour.
+// They're in the output rather than on stderr, which would draw over fzf.
+func listCmd(providers []provider.Provider, st *store.Store, cachePath string, timeout func(provider.Kind) time.Duration, theme styles.Styles, withIcons, withRecent bool, expiryWarn time.Duration, args []string, out io.Writer) error {
+	fs := flag.NewFlagSet("list", flag.ContinueOnError)
+	cached := fs.Bool("cached", false, "only what's cached, and repos: load nothing from Azure or Databricks")
+	maxAge := fs.Duration("max-age", 2*time.Minute, "load cached lists older than this again")
+	format := fs.String("format", "text", "text: kind, mark, name, status, note, account and link, tab-separated; json: an object per line")
+	color := fs.String("color", "always", "colour the names (text): always or never; fzf needs --ansi")
+	iconsOn := fs.Bool("icons", withIcons, "put the provider's Nerd Font icon before names (text)")
+	stars := fs.Bool("stars", true, "put ★ before starred names, in the theme's favouriteColor (text)")
+	recent := fs.Bool("recent", withRecent, "put ◷ before names used lately, in mutedColor (text; default ui.recentIcon)")
+	notes := fs.Bool("notes", true, "start a note with a note icon (✎ without --icons) (text; the note is printed either way)")
+	expiry := fs.Bool("expiry", true, "mark and say which have expired (✗ expired) or expire within ui.expiryWarningDays (⚠ expires in 12d) (text)")
+	kinds := fs.String("kind", "", "only these kinds, comma-separated: "+strings.Join(listing.Kinds, ", ")+" (vault: also scopes and repo files)")
+	showErrors := fs.Bool("errors", true, "list the lists that can't be read, with why (text: ✗ lines; json: \"error\")")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() > 0 {
+		return fmt.Errorf("usage: lazysecrets list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]")
+	}
+	var only []string
+	for k := range strings.SplitSeq(*kinds, ",") {
+		if k = strings.TrimSpace(k); k == "" {
+			continue
+		}
+		if !slices.Contains(listing.Kinds, k) {
+			return fmt.Errorf("--kind: %q is not one of %s", k, strings.Join(listing.Kinds, ", "))
+		}
+		only = append(only, k)
+	}
+	if *color != "always" && *color != "never" {
+		return fmt.Errorf("--color: %q is not always or never", *color)
+	}
+	now := time.Now()
+	m := marks{theme: theme, icons: icons.None, stars: *stars, recent: *recent, expiry: *expiry,
+		color: *color == "always", warn: expiryWarn, now: now}
+	if *iconsOn {
+		m.icons = icons.NerdFont
+	}
+	var write func(listing.Entry) error
+	switch *format {
+	case "text":
+		write = func(e listing.Entry) error {
+			colored := *color == "always"
+			mark := m.of(e)
+			name := nameOf(e, theme, colored)
+			// Why it couldn't be read (vaults, sources), or when it
+			// expires (secrets, keys, certificates): never both.
+			status := errorOf(e, theme, colored)
+			if status == "" && *expiry {
+				status = expiryOf(e, theme, expiryWarn, now, colored)
+			}
+			note := noteOf(e, theme, m.icons, *notes, colored)
+			// A tab or line break in a name would break the line up.
+			_, err := fmt.Fprintf(out, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", e.Kind, mark, oneLine.Replace(name), oneLine.Replace(status),
+				oneLine.Replace(note), e.Account, e.Link)
+			return err
+		}
+	case "json":
+		enc := json.NewEncoder(out)
+		enc.SetEscapeHTML(false)
+		write = func(e listing.Entry) error { return enc.Encode(e) }
+	default:
+		return fmt.Errorf("--format: %q is not text or json", *format)
+	}
+
+	// When the reader goes away (a pick in fzf), writing fails instead of
+	// killing the process, so what loaded is still saved.
+	signal.Notify(make(chan os.Signal, 1), syscall.SIGPIPE)
+	var gone error
+	emit := func(e listing.Entry) error {
+		if e.Error != "" && !*showErrors {
+			return nil
+		}
+		if err := write(e); err != nil {
+			gone = err
+			return err
+		}
+		return nil
+	}
+
+	f := cachefile.New()
+	if cachePath != "" {
+		f = cachefile.Read(cachePath)
+	}
+	f, loaded := listing.Run(context.Background(), listing.Options{
+		Providers: providers, Cache: f, MaxAge: *maxAge, Cached: *cached, Kinds: only, Timeout: timeout,
+		Mark: func(link, account string) listing.Marks {
+			n := st.Node(link)
+			return listing.Marks{Starred: n.StarredFor(account), Recent: n.UsedLately(now),
+				LastUsed: n.LastUsed, Uses: n.Uses, Note: n.Note}
+		},
+	}, emit)
+	// Only what was loaded: list never moves a cursor, so the TUI's stay.
+	if cachePath != "" && loaded {
+		f.Cursor = nil
+		if err := cachefile.Save(cachePath, f, cachefile.Keep(providers), time.Now()); err != nil {
+			return err
+		}
+	}
+	if gone != nil && !errors.Is(gone, syscall.EPIPE) {
+		return gone
+	}
+	return nil // or the reader has what it wanted
+}
+
+var oneLine = strings.NewReplacer("\t", " ", "\r\n", " ", "\n", " ", "\r", " ")
+
+// noteOf is the entry's note, muted, after a note icon (✎ without Nerd
+// Font icons) with icon; or "".
+func noteOf(e listing.Entry, theme styles.Styles, iconSet icons.Set, icon, color bool) string {
+	if e.Note == "" {
+		return ""
+	}
+	note := e.Note
+	if icon {
+		note = cmp.Or(iconSet.Note, "✎") + " " + note
+	}
+	return renderer(color)(theme.Muted, note)
+}
+
+// expiryOf says that a secret, key or certificate has expired, in red,
+// or when it will if that's within warn (expires in 12d), in yellow, or
+// is "". Its mark (✗, ⚠) is before the name.
+func expiryOf(e listing.Entry, theme styles.Styles, warn time.Duration, now time.Time, color bool) string {
+	render := renderer(color)
+	switch state, left := expiry.Of(e.Expires, now, warn); state {
+	case expiry.Expired:
+		return render(theme.Error, "expired")
+	case expiry.Soon:
+		return render(theme.Warning, "expires in "+expiry.Left(left))
+	}
+	return ""
+}
+
+// errorOf is why a list couldn't be read, in red, or "". Its mark (✗)
+// is before the name.
+func errorOf(e listing.Entry, theme styles.Styles, color bool) string {
+	return renderer(color)(theme.Error, e.Error)
+}
+
+// nameOf is an entry's name for the text format: the path with the
+// item's own name standing out, and the account.
+func nameOf(e listing.Entry, theme styles.Styles, color bool) string {
+	render := renderer(color)
+	var name string
+	if n := len(e.Path); n > 0 {
+		if n > 1 {
+			name = render(theme.Muted, strings.Join(e.Path[:n-1], " / ")+" / ")
+		}
+		name += e.Path[n-1]
+	}
+	if e.AccountLabel != "" {
+		name += render(theme.Muted, " · "+e.AccountLabel)
+	}
+	return name
+}
+
+// marks says what goes before the name, in a field of its own so a
+// search leaves it out: ✗ in red when something's wrong (it couldn't be
+// read, or has expired) or ⚠ when it expires within warn; ★ for a starred
+// entry and ◷ for one used lately, as the TUI marks them; then the
+// provider's icon. The marks are right-aligned in room for every kind
+// turned on, so they sit by the icon and names line up.
+type marks struct {
+	theme                        styles.Styles
+	icons                        icons.Set
+	stars, recent, expiry, color bool
+	warn                         time.Duration // ui.expiryWarningDays
+	now                          time.Time
+}
+
+func (m marks) of(e listing.Entry) string {
+	render := renderer(m.color)
+	var parts []string
+	room := 0 // marks turned on
+	mark := func(on bool, st lipgloss.Style, s string) {
+		room++
+		if on {
+			parts = append(parts, render(st, s))
+		}
+	}
+	// What's wrong, then what to watch: room for one of them.
+	state := expiry.None
+	if m.expiry {
+		state, _ = expiry.Of(e.Expires, m.now, m.warn)
+	}
+	switch {
+	case e.Error != "" || state == expiry.Expired:
+		mark(true, m.theme.Error, "✗")
+	case state == expiry.Soon:
+		mark(true, m.theme.Warning, "⚠")
+	default:
+		mark(false, m.theme.Error, "")
+	}
+	if m.stars {
+		mark(e.Starred, m.theme.Favourite, "★")
+	}
+	if m.recent {
+		mark(e.Recent, m.theme.Muted, "◷")
+	}
+	pad := strings.Repeat("  ", room-len(parts)) // each mark and its space
+	kind := provider.Kind("")
+	for _, k := range []provider.Kind{provider.KindAzure, provider.KindDatabricks, provider.KindRepo} {
+		if strings.EqualFold(string(k), e.Provider) {
+			kind = k
+		}
+	}
+	if icon := strings.TrimSpace(m.icons.Prefix(kind)); icon != "" {
+		parts = append(parts, render(m.theme.Kind(kind), icon))
+	} else if len(parts) == 0 {
+		pad = strings.TrimSuffix(pad, " ") // no mark after the room
+	}
+	return pad + strings.Join(parts, " ")
+}
+
+func renderer(color bool) func(lipgloss.Style, string) string {
+	return func(st lipgloss.Style, s string) string {
+		if !color || s == "" {
+			return s
+		}
+		return st.Render(s)
+	}
+}

cmd/lazysecrets/list_test.go

@@ -0,0 +1,152 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/listing"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
+)
+
+func TestListNames(t *testing.T) {
+	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-app-prod", "db-password"}, AccountLabel: "alice"}
+	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-app-prod / db-password · alice" {
+		t.Errorf("plain: %q", got)
+	}
+	// The item's own name isn't muted with its path.
+	if got := nameOf(e, styles.Default(), true); !strings.Contains(got, "\x1b[mdb-password") {
+		t.Errorf("name not set apart: %q", got)
+	}
+}
+
+func TestListMarks(t *testing.T) {
+	az := icons.NerdFont.Azure
+	plain := marks{theme: styles.Default(), icons: icons.NerdFont, stars: true}
+	noIcons := plain
+	noIcons.icons = icons.None
+	colored := noIcons
+	colored.color = true
+	for _, c := range []struct {
+		m    marks
+		e    listing.Entry
+		want string
+	}{
+		// Room for the status mark and the star, so names line up.
+		{plain, listing.Entry{Provider: "azure", Starred: true}, "  ★ " + az},
+		{plain, listing.Entry{Provider: "azure"}, "    " + az},
+		{marks{icons: icons.NerdFont}, listing.Entry{Provider: "azure", Starred: true}, "  " + az},
+		{noIcons, listing.Entry{Provider: "azure", Starred: true}, "  ★"},
+		{marks{}, listing.Entry{Provider: "azure", Starred: true}, " "},
+		{colored, listing.Entry{Provider: "azure", Starred: true}, "  " + styles.Default().Favourite.Render("★")},
+	} {
+		if got := c.m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+}
+
+func TestListRecentMarks(t *testing.T) {
+	az := icons.NerdFont.Azure
+	m := marks{icons: icons.NerdFont, stars: true, recent: true}
+	for _, c := range []struct {
+		e    listing.Entry
+		want string
+	}{
+		// Right-aligned in room for three: by the icon, names lined up.
+		{listing.Entry{Provider: "azure", Starred: true, Recent: true}, "  ★ ◷ " + az},
+		{listing.Entry{Provider: "azure", Recent: true}, "    ◷ " + az},
+		{listing.Entry{Provider: "azure"}, "      " + az},
+	} {
+		if got := m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+}
+
+func TestListExpiry(t *testing.T) {
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	warn := 30 * 24 * time.Hour
+	for _, c := range []struct {
+		expires time.Time
+		want    string
+	}{
+		{time.Time{}, ""},
+		{now.Add(-time.Hour), "expired"},
+		{now.Add(12*24*time.Hour + time.Hour), "expires in 12d"},
+		{now.Add(5 * time.Hour), "expires in 5h"},
+		{now.Add(60 * 24 * time.Hour), ""},
+	} {
+		if got := expiryOf(listing.Entry{Expires: c.expires}, styles.Default(), warn, now, false); got != c.want {
+			t.Errorf("expires %v: %q, want %q", c.expires, got, c.want)
+		}
+	}
+	if got := expiryOf(listing.Entry{Expires: now.Add(-time.Hour)}, styles.Default(), warn, now, true); got != styles.Default().Error.Render("expired") {
+		t.Errorf("expired isn't red: %q", got)
+	}
+}
+
+func TestListNotes(t *testing.T) {
+	e := listing.Entry{Note: "rotate in May"}
+	if got := noteOf(e, styles.Default(), icons.NerdFont, true, false); got != icons.NerdFont.Note+" rotate in May" {
+		t.Errorf("icons: %q", got)
+	}
+	if got := noteOf(e, styles.Default(), icons.None, true, false); got != "✎ rotate in May" {
+		t.Errorf("no icons: %q", got)
+	}
+	if got := noteOf(e, styles.Default(), icons.NerdFont, false, false); got != "rotate in May" {
+		t.Errorf("--notes=false: %q", got)
+	}
+	if got := noteOf(listing.Entry{}, styles.Default(), icons.NerdFont, true, true); got != "" {
+		t.Errorf("no note: %q", got)
+	}
+}
+
+func TestListStatusMark(t *testing.T) {
+	az := icons.NerdFont.Azure
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	m := marks{icons: icons.NerdFont, stars: true, expiry: true, warn: 30 * 24 * time.Hour, now: now}
+	for _, c := range []struct {
+		e    listing.Entry
+		want string
+	}{
+		// Right-aligned in room for two, as with ★ and ◷.
+		{listing.Entry{Provider: "azure", Error: "403 Forbidden"}, "  ✗ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}, "  ✗ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour), Starred: true}, "✗ ★ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(5 * 24 * time.Hour)}, "  ⚠ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(60 * 24 * time.Hour), Starred: true}, "  ★ " + az},
+	} {
+		if got := m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+	m.expiry = false // --expiry=false: no ⚠ or ✗ for expiry; errors still
+	if got := m.of(listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}); got != "    "+az {
+		t.Errorf("--expiry=false: %q", got)
+	}
+	m.expiry, m.color, m.theme = true, true, styles.Default()
+	if got := m.of(listing.Entry{Error: "403"}); !strings.Contains(got, styles.Default().Error.Render("✗")) {
+		t.Errorf("not a red ✗: %q", got)
+	}
+	if got := m.of(listing.Entry{Expires: now.Add(time.Hour)}); !strings.Contains(got, styles.Default().Warning.Render("⚠")) {
+		t.Errorf("not a yellow ⚠: %q", got)
+	}
+}
+
+func TestListErrors(t *testing.T) {
+	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-restricted"}, Error: "403 Forbidden"}
+	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-restricted" {
+		t.Errorf("the name has more: %q", got)
+	}
+	if got := errorOf(e, styles.Default(), false); got != "403 Forbidden" {
+		t.Errorf("plain: %q", got)
+	}
+	if got := errorOf(e, styles.Default(), true); got != styles.Default().Error.Render("403 Forbidden") {
+		t.Errorf("why isn't red: %q", got)
+	}
+	if got := errorOf(listing.Entry{}, styles.Default(), true); got != "" {
+		t.Errorf("no error: %q", got)
+	}
+}

cmd/lazysecrets/main.go

@@ -3,7 +3,9 @@
 package main
 
 import (
+	"cmp"
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -87,6 +89,32 @@ func cmpOr(a, b string) string {
 	return b
 }
 
+// refArg parses get's and open's arguments: a reference, and optionally
+// the account to use when several could (lazysecrets list's column) and,
+// for open, what to do with it rather than asking (--action).
+func refArg(cmd string, args []string) (r ref.Ref, action string, err error) {
+	fs := flag.NewFlagSet(cmd, flag.ContinueOnError)
+	account := fs.String("account", "", "the account to use when several could, as lazysecrets list prints it")
+	usage := "usage: lazysecrets get [--account <account>] <ref>"
+	act := new(string)
+	if cmd == "open" {
+		act = fs.String("action", "", "do this rather than ask: go (to it), copy (go, and copy its value) or show (go, and show it)")
+		usage = "usage: lazysecrets open [--account <account>] [--action go|copy|show] <ref>"
+	}
+	if err := fs.Parse(args); err != nil {
+		return r, "", err
+	}
+	if fs.NArg() != 1 {
+		return r, "", errors.New(usage)
+	}
+	if _, ok := app.OpenActions[*act]; *act != "" && !ok {
+		return r, "", fmt.Errorf("--action: %q is not go, copy or show", *act)
+	}
+	r, err = ref.Parse(fs.Arg(0))
+	r.Account = *account
+	return r, *act, err
+}
+
 // defaultConfigPath is $LAZYSECRETS_CONFIG_FILE, else config.yaml in the
 // config directory.
 func defaultConfigPath() string {
@@ -106,18 +134,28 @@ func run() error {
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	dir := flag.String("dir", "", "start in this directory: its git repo's SOPS files, the ones under it first (default: the current directory)")
 	demo := flag.Bool("demo", false, "browse built-in sample data instead of real backends")
-	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request")
+	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request, every provider's (overrides the config)")
 	icons := flag.Bool("icons", true,
 		"show Nerd Font icons (needs a Nerd Font v3+); disable with --icons=false or LAZYSECRETS_ICONS=0")
 	clipClear := flag.Duration("clipboard-clear", 30*time.Second, "clear copied values from the clipboard after this long (0 disables)")
 	flag.Usage = func() {
 		fmt.Fprintf(flag.CommandLine.Output(), `Usage:
   lazysecrets [flags]             browse secrets
-  lazysecrets [flags] [open] <ref>
-                                  open a lazysecrets:// link, Key Vault URL,
-                                  @Microsoft.KeyVault(...) or {{secrets/scope/key}}
-  lazysecrets [flags] get <ref>   print the value a lazysecrets:// link points at,
+  lazysecrets [flags] [open [--account <account>] [--action go|copy|show]] <ref>
+                                  open a lazysecrets:// link (also a share link),
+                                  Key Vault URL, @Microsoft.KeyVault(...) or
+                                  {{secrets/scope/key}}
+  lazysecrets [flags] get [--account <account>] <ref>
+                                  print the value a lazysecrets:// link points at,
                                   for scripts: VAR=$(lazysecrets get <ref>)
+  lazysecrets [flags] list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]
+                          [--color always|never] [--icons=false] [--errors=false]
+                                  print every source, vault and secret it can
+                                  find, one per line, for fzf and pickers:
+                                  what's cached at once, then what loads
+  lazysecrets [flags] share [--key <secret>] <env file>...
+                                  print a link to env files of a repo, encrypted
+                                  with a secret's value (default: sharing.key)
   lazysecrets [flags] keybindings print every action and its keys (with your
                                   config applied), as config to copy and edit
   lazysecrets handler install [--terminal NAME]
@@ -140,12 +178,21 @@ Flags:
 	}
 
 	var open, getRef *ref.Ref
+	var openAction string
+	var shareArgs, listArgs []string
 	printKeys := false
 	switch args := flag.Args(); {
+	case len(args) > 0 && args[0] == "share":
+		shareArgs = args[1:]
+		if len(shareArgs) == 0 {
+			shareArgs = []string{} // still sharing: says how
+		}
+	case len(args) > 0 && args[0] == "list":
+		listArgs = append([]string{}, args[1:]...) // not nil: listing
 	case len(args) == 1 && args[0] == "keybindings":
 		printKeys = true
-	case len(args) == 2 && args[0] == "get":
-		r, err := ref.Parse(args[1])
+	case len(args) > 0 && args[0] == "get":
+		r, _, err := refArg("get", args[1:])
 		if err != nil {
 			return err
 		}
@@ -157,12 +204,12 @@ Flags:
 	case len(args) > 0 && args[0] == "update":
 		return updateCmd(*configPath, args[1:])
 	case len(args) == 0:
-	case args[0] == "open" && len(args) == 2:
-		r, err := ref.Parse(args[1])
+	case args[0] == "open" && len(args) >= 2:
+		r, act, err := refArg("open", args[1:])
 		if err != nil {
 			return err
 		}
-		open = &r
+		open, openAction = &r, act
 	case len(args) == 1 && looksLikeRef(args[0]):
 		// lazysecrets <link>, like lazysecrets open <link>
 		r, err := ref.Parse(args[0])
@@ -183,6 +230,11 @@ Flags:
 	if err != nil {
 		return err
 	}
+	// Warnings show when the window opens.
+	var warnings []string
+	if w := styles.Unknown(cfg.Theme); w != "" {
+		warnings = append(warnings, w)
+	}
 	keymap := keys.Default()
 	if err := keymap.Apply(cfg.Keybinding); err != nil {
 		return err
@@ -197,33 +249,57 @@ Flags:
 	// Precedence: flag > environment > config file > default.
 	set := map[string]bool{}
 	flag.Visit(func(f *flag.Flag) { set[f.Name] = true })
-	if !set["timeout"] && cfg.Timeout > 0 {
-		*timeout = cfg.Timeout
+	if *timeout <= 0 {
+		return fmt.Errorf("--timeout: %s is not positive", *timeout)
 	}
-	if !set["clipboard-clear"] && cfg.ClipboardClear != nil {
-		*clipClear = *cfg.ClipboardClear
+	// Each provider's own timeout, unless --timeout sets them all.
+	timeouts := map[provider.Kind]time.Duration{}
+	if !set["timeout"] {
+		if cfg.Providers.Timeout > 0 {
+			*timeout = cfg.Providers.Timeout
+		}
+		for k, d := range map[provider.Kind]time.Duration{
+			provider.KindAzure:      cfg.Providers.Azure.Timeout,
+			provider.KindDatabricks: cfg.Providers.Databricks.Timeout,
+			provider.KindRepo:       cfg.Providers.Repos.Timeout,
+		} {
+			if d > 0 {
+				timeouts[k] = d
+			}
+		}
+	}
+	// timeoutFor is how long a request to a provider of kind k may take.
+	timeoutFor := func(k provider.Kind) time.Duration { return cmp.Or(timeouts[k], *timeout) }
+	if !set["clipboard-clear"] && cfg.Values.ClipboardClear != nil {
+		*clipClear = *cfg.Values.ClipboardClear
 	}
 	expiryDays := 30
-	if cfg.ExpiryWarningDays != nil {
-		expiryDays = *cfg.ExpiryWarningDays
+	if cfg.UI.ExpiryWarningDays != nil {
+		expiryDays = *cfg.UI.ExpiryWarningDays
 	}
 	revealTimeout := 60 * time.Second
-	if cfg.RevealTimeout != nil {
-		revealTimeout = *cfg.RevealTimeout
+	if cfg.Values.RevealTimeout != nil {
+		revealTimeout = *cfg.Values.RevealTimeout
 	}
 	loadDelay := 150 * time.Millisecond
-	if cfg.LoadDelay != nil {
-		loadDelay = *cfg.LoadDelay
+	if cfg.UI.LoadDelay != nil {
+		loadDelay = *cfg.UI.LoadDelay
+	}
+	var updateEvery time.Duration // 0: the app's default, a day
+	if cfg.Updates.AutoCheckInterval != nil {
+		updateEvery = *cfg.Updates.AutoCheckInterval
 	}
 	if !set["icons"] {
 		switch {
 		case os.Getenv("LAZYSECRETS_ICONS") != "":
 			*icons = os.Getenv("LAZYSECRETS_ICONS") != "0"
-		case cfg.Icons != nil:
-			*icons = *cfg.Icons
+		case cfg.UI.Icons != nil:
+			*icons = *cfg.UI.Icons
 		}
 	}
 
+	recentIcon := cfg.UI.RecentIcon != nil && *cfg.UI.RecentIcon
+
 	// Stars, notes and the layout. Demo mode keeps them in memory, so
 	// sample vaults never end up in the real file.
 	stateDir, err := config.StateDir()
@@ -235,16 +311,23 @@ Flags:
 		statePath = filepath.Join(stateDir, "state.json")
 	}
 	st, err := store.Load(statePath)
-	if err != nil {
+	if errors.Is(err, store.ErrNewer) {
+		warnings = append(warnings, err.Error()+": stars, notes and the layout won't be saved; update lazysecrets")
+	} else if err != nil {
 		return err
 	}
 
 	var providers []provider.Provider
 	if *demo {
 		// Two Azure accounts, like a personal and an admin login in az.
+		alice, admin := "Azure:alice@example.com/demo", "Azure:admin.alice@example.com/demo"
+		fake.Seed(st, alice, admin)
+		az := fake.Azure(400*time.Millisecond).As(alice, "Azure · alice")
+		// Due soon whenever the demo runs (the tests' dates are fixed).
+		az.Expire("kv-app-prod", "api-key", time.Now().AddDate(0, 0, 9).Truncate(24*time.Hour))
 		providers = []provider.Provider{
-			fake.Azure(400*time.Millisecond).As("Azure:alice@example.com/demo", "Azure · alice"),
-			fake.AzureOps(700*time.Millisecond).As("Azure:admin.alice@example.com/demo", "Azure · admin.alice"),
+			az,
+			fake.AzureOps(700*time.Millisecond).As(admin, "Azure · admin.alice"),
 			fake.Databricks(600 * time.Millisecond),
 			fake.Repos(),
 		}
@@ -277,7 +360,7 @@ Flags:
 			if start == "" {
 				start, _ = os.Getwd()
 			}
-			roots := []string{"~/git"}
+			roots := repo.DefaultRoots
 			if pc.Repos.Roots != nil {
 				roots = *pc.Repos.Roots
 			}
@@ -300,10 +383,28 @@ Flags:
 	log.SetOutput(io.Discard)
 
 	if getRef != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), timeoutFor(getRef.Kind))
 		defer cancel()
 		return get(ctx, providers, st, *getRef)
 	}
+	if listArgs != nil {
+		cachePath := ""
+		if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
+			cachePath = filepath.Join(d, "cache.json")
+		}
+		return listCmd(providers, st, cachePath, timeoutFor, theme, *icons, recentIcon, time.Duration(expiryDays)*24*time.Hour, listArgs, os.Stdout)
+	}
+	if shareArgs != nil {
+		// The files from a repo, the key from whichever provider it's
+		// in: the longest timeout.
+		d := *timeout
+		for _, t := range timeouts {
+			d = max(d, t)
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), d)
+		defer cancel()
+		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), shareArgs, os.Stdout)
+	}
 
 	// Links opened elsewhere (lazysecrets launch) can come here.
 	var p *tea.Program
@@ -339,7 +440,7 @@ Flags:
 	// What was loaded last time, and where it was left in this folder.
 	var cacheFile, placeDir string
 	if !*demo {
-		if d, err := config.CacheDir(); err == nil && config.On(cfg.Cache) {
+		if d, err := config.CacheDir(); err == nil && config.On(cfg.Storage.Cache) {
 			cacheFile = filepath.Join(d, "cache.json")
 		}
 		placeDir = *dir
@@ -353,32 +454,40 @@ Flags:
 
 	m := app.New(providers, app.Options{
 		Timeout:        *timeout,
+		Timeouts:       timeouts,
 		Icons:          *icons,
 		ClipboardClear: *clipClear,
-		FlatSources:    cfg.SourcesView == "flat",
-		CollapseGroups: config.On(cfg.CollapseGroups),
+		FlatSources:    cfg.UI.SourcesView == "flat",
+		CollapseGroups: config.On(cfg.UI.CollapseGroups),
 		LoadDelay:      loadDelay,
-		NoHistory:      !config.On(cfg.History),
+		NoHistory:      !config.On(cfg.Storage.History),
 		OnActive:       onActive,
 		RevealTimeout:  revealTimeout,
 		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
-		HideOnBlur:     config.On(cfg.HideOnBlur),
+		HideOnBlur:     config.On(cfg.Values.HideOnBlur),
 		HandlerSetup:   setup,
-		Updater:        updater(cfg.Releases),
-		UpdateCheck:    config.On(cfg.UpdateCheck),
+		Updater:        updater(cfg.Updates.Sources),
+		UpdateCheck:    config.On(cfg.Updates.AutoCheck),
+		UpdateEvery:    updateEvery,
 		Keys:           &keymap,
 		Commands:       cfg.CustomCommands,
 		Version:        versionString(),
 		Store:          st,
+		Warning:        strings.Join(warnings, " · "),
 		CacheFile:      cacheFile,
 		ConfigFiles:    configFiles(*configPath),
 		StatePath:      statePath,
 		Changelog:      lazysecrets.Changelog,
 		Dir:            placeDir,
+		ShareKey:       cfg.Sharing.Key,
+		ShareRules:     shareRules(cfg),
 		Open:           open,
+		OpenAction:     openAction,
+		RecentIcon:     recentIcon,
 		Styles:         &theme,
 		DefaultFg:      defaultFg,
 	})
+	blockingStdin()
 	p = tea.NewProgram(m)
 	final, err := p.Run()
 	if fm, ok := final.(app.Model); ok {

cmd/lazysecrets/share.go

@@ -0,0 +1,93 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/config"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+)
+
+// shareFiles prints a share link to env files of one repo, encrypted with
+// the --key secret's value, else the repo's or the config's sharing.key:
+//
+//	lazysecrets share .env apps/api/.env
+func shareFiles(ctx context.Context, providers []provider.Provider, st *store.Store, general string, rules share.Rules, args []string, out io.Writer) error {
+	fs := flag.NewFlagSet("share", flag.ContinueOnError)
+	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: sharing.key)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() == 0 {
+		return errors.New("usage: lazysecrets share [--key <secret>] <env files>")
+	}
+
+	var root, id string
+	var files []share.File
+	for _, name := range fs.Args() {
+		abs, err := filepath.Abs(name)
+		if err != nil {
+			return err
+		}
+		r, i, err := repo.Root(filepath.Dir(abs))
+		if err != nil {
+			return err
+		}
+		if root == "" {
+			root, id = r, i
+		} else if r != root {
+			return fmt.Errorf("%s isn't in %s: share files of one repo at a time", name, root)
+		}
+		real, err := filepath.EvalSymlinks(abs)
+		if err != nil {
+			return err
+		}
+		rel, err := filepath.Rel(root, real)
+		if err != nil {
+			return err
+		}
+		f := share.File{Path: filepath.ToSlash(rel)}
+		if err := share.CheckPath(f.Path); err != nil {
+			return err
+		}
+		if f.Data, err = os.ReadFile(real); err != nil {
+			return err
+		}
+		files = append(files, f)
+	}
+
+	key, ok, err := share.DefaultKey(root, general)
+	if *keyLink != "" {
+		key, err = share.ParseKey(*keyLink)
+		ok = err == nil
+	}
+	if err != nil {
+		return err
+	}
+	if !ok {
+		return errors.New("which secret to encrypt with? --key <secret>, or sharing.key in the repo's .lazysecrets.yaml or the config")
+	}
+	v, version, err := readKey(ctx, providers, st, key)
+	if err != nil {
+		return fmt.Errorf("reading the key %s: %w", key, err)
+	}
+	link, err := share.Seal(share.Header{Key: share.Pin(key, version), Repo: id}, []byte(v.Reveal()), files, rules)
+	if err != nil {
+		return err
+	}
+	_, err = fmt.Fprintln(out, link)
+	return err
+}
+
+// shareRules are the config's sharing.keyRules.
+func shareRules(cfg config.Config) share.Rules {
+	return share.Rules{MinLength: cfg.Sharing.KeyRules.MinLength, MinClasses: cfg.Sharing.KeyRules.MinClasses}
+}

cmd/lazysecrets/share_test.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+)
+
+// demoRules take the demo key, made up to be remembered.
+var demoRules = share.Rules{MinLength: 16, MinClasses: 1}
+
+func TestShareFiles(t *testing.T) {
+	root, _ := filepath.EvalSymlinks(t.TempDir())
+	for _, args := range [][]string{{"init", "-q"}, {"remote", "add", "origin", "git@git.example.com:team/app.git"}} {
+		if out, err := exec.Command("git", append([]string{"-C", root}, args...)...).CombinedOutput(); err != nil {
+			t.Skip("git:", string(out))
+		}
+	}
+	os.WriteFile(filepath.Join(root, ".env"), []byte("A=1\n"), 0o600)
+	os.WriteFile(filepath.Join(root, "main.go"), []byte("package main\n"), 0o644)
+	providers := []provider.Provider{fake.Azure(0)}
+	st, _ := store.Load("")
+	ctx := context.Background()
+	key := "lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password"
+
+	var out bytes.Buffer
+	if err := shareFiles(ctx, providers, st, key, demoRules, []string{filepath.Join(root, ".env")}, &out); err != nil {
+		t.Fatal(err)
+	}
+	r, err := ref.Parse(strings.TrimSpace(out.String()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	s, err := share.Read(r)
+	if err != nil || s.Repo != "git.example.com/team/app" || s.Key.Name != "db-password" {
+		t.Fatalf("%+v, %v", s.Header, err)
+	}
+	files, err := s.Open([]byte("correct-horse-battery-staple"))
+	if err != nil || len(files) != 1 || files[0].Path != ".env" || string(files[0].Data) != "A=1\n" {
+		t.Errorf("%+v, %v", files, err)
+	}
+
+	for _, c := range []struct {
+		general string
+		args    []string
+		want    string
+	}{
+		{"", []string{filepath.Join(root, ".env")}, "which secret"},
+		{key, []string{filepath.Join(root, "main.go")}, "isn't an env file"},
+		{key, nil, "usage"},
+		{"", []string{"--key", "lazysecrets://azure/kv-app-prod.vault.azure.net", filepath.Join(root, ".env")}, "isn't a secret"},
+	} {
+		if err := shareFiles(ctx, providers, st, c.general, demoRules, c.args, &out); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%v: %v, want %q", c.args, err, c.want)
+		}
+	}
+}

cmd/lazysecrets/stdin_other.go

@@ -0,0 +1,5 @@
+//go:build !unix
+
+package main
+
+func blockingStdin() {}

cmd/lazysecrets/stdin_unix.go

@@ -0,0 +1,20 @@
+//go:build unix
+
+package main
+
+import (
+	"os"
+	"syscall"
+
+	"golang.org/x/term"
+)
+
+// blockingStdin makes a terminal on stdin blocking again. fzf's become
+// hands on its /dev/tty non-blocking; Go can't poll /dev/tty on macOS,
+// so it reads it directly, and the TUI's first read would fail with
+// EAGAIN ("resource temporarily unavailable").
+func blockingStdin() {
+	if fd := int(os.Stdin.Fd()); term.IsTerminal(fd) {
+		_ = syscall.SetNonblock(fd, false)
+	}
+}

cmd/lazysecrets/update.go

@@ -43,7 +43,7 @@ func updateCmd(configPath string, args []string) error {
 	current := versionString()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
-	c := &update.Client{Servers: cfg.Releases}
+	c := &update.Client{Servers: cfg.Updates.Sources}
 	r, err := c.Latest(ctx)
 	if err != nil {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)
@@ -55,7 +55,7 @@ func updateCmd(configPath string, args []string) error {
 		fmt.Printf("lazysecrets %s is the latest (%s)\n", current, r.Tag)
 		return nil
 	}
-	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes()))
+	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes(current)))
 	if check {
 		fmt.Println("lazysecrets update installs it.")
 		return nil

cmd/lazysecrets/version.go

@@ -1,6 +1,10 @@
 package main
 
-import "runtime/debug"
+import (
+	"regexp"
+	"runtime/debug"
+	"strings"
+)
 
 // version is set by release builds:
 //
@@ -8,7 +12,12 @@ import "runtime/debug"
 var version string
 
 // versionString is the release version, or for other builds what Go
-// recorded: the module version (go install …@v1.2.3), else the commit.
+// recorded: the module version (go install …@v1.2.3), else the commit
+// (dev-c1a4f90, -dirty with changes not committed).
+// pseudo matches a Go pseudo-version (v0.1.3-0.20261014174204-1c31a75d0507,
+// maybe +dirty): its commit.
+var pseudo = regexp.MustCompile(`[-.]\d{14}-([0-9a-f]{12})(\+.*)?$`)
+
 func versionString() string {
 	if version != "" {
 		return version
@@ -18,6 +27,15 @@ func versionString() string {
 		return "dev"
 	}
 	if v := bi.Main.Version; v != "" && v != "(devel)" {
+		// A commit, not a release: a local build (Go stamps those too) or
+		// go install …@<commit>.
+		if m := pseudo.FindStringSubmatch(v); m != nil {
+			dirty := ""
+			if strings.HasSuffix(v, "+dirty") {
+				dirty = "-dirty"
+			}
+			return "dev-" + m[1][:7] + dirty
+		}
 		return v
 	}
 	var rev, dirty string

cmd/lazysecrets/version_test.go

@@ -0,0 +1,22 @@
+package main
+
+import "testing"
+
+func TestPseudoVersions(t *testing.T) {
+	for v, want := range map[string]string{
+		"v0.1.3-0.20261014174204-1c31a75d0507":       "1c31a75d0507",
+		"v0.1.3-0.20261014174204-1c31a75d0507+dirty": "1c31a75d0507",
+		"v0.0.0-20261014174204-1c31a75d0507":         "1c31a75d0507",
+		"v0.2.0-rc.1.0.20261014174204-1c31a75d0507":  "1c31a75d0507",
+		"v0.1.2":      "",
+		"v0.2.0-rc.1": "",
+	} {
+		got := ""
+		if m := pseudo.FindStringSubmatch(v); m != nil {
+			got = m[1]
+		}
+		if got != want {
+			t.Errorf("%s: %q, want %q", v, got, want)
+		}
+	}
+}

docs/azure.md

@@ -63,7 +63,7 @@ Secrets, keys and certificates, each on their own tab of the Secrets pane
 (`[`/`]`). `space` reveals a secret's value, or the public material of a
 key (PEM public key) or certificate; private key material is never
 fetched. `v` lists an item's versions. Items expiring within
-`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
+`ui.expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
 
 The status pane (`0`) lists them across every vault loaded, opened or
 cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`

docs/config.md

@@ -2,43 +2,60 @@
 
 Optional, at `~/.config/lazysecrets/config.yaml` (or
 `$XDG_CONFIG_HOME/lazysecrets/config.yaml`, or `--config`). Flags override
-it. Unknown keys are an error, so typos don't go unnoticed.
+it. Unknown keys are an error, so typos don't go unnoticed. `e` on the
+status pane (`0`) opens it in your editor, as in lazygit (making it if
+it isn't there yet); changes apply when lazysecrets starts again.
 
 ```yaml
+ui:
   icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
-clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
-revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
-hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
-expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
-timeout: 30s           # per backend request
-loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
+  recentIcon: false      # mark items used lately (Recent, R) with ◷, here and in lazysecrets list
   sourcesView: grouped   # or flat; ` toggles it
   collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
-updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
-releases:              # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
+  loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
+  expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d; ⚠ in lazysecrets list); expired ones get ✗
+values:
+  revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
+  hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
+  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
+storage:
+  cache: true            # keep what was loaded (never values) for the next start
+  history: true          # count uses of items for Recent (R)
+updates:
+  autoCheck: true          # look for a newer release at startup (U and lazysecrets update work either way)
+  autoCheckInterval: 24h   # at most this often
+  sources:                 # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
     - https://github.com/karleinarb/lazysecrets
     - https://git.kebcloud.no/keb/lazysecrets
-history: true          # count uses of items for Recent (R)
-cache: true            # keep what was loaded (never values) for the next start
 providers:
+  timeout: 30s                           # per backend request; a provider's own timeout overrides it
   azure:                                 # applies to every az account
     enabled: true                        # default
+    timeout: 30s
     hideSubscriptions: [platform-mgmt]   # by name or ID
     vaults:                              # listed under "Pinned vaults", for vaults
       - https://kv-foo.vault.azure.net/  # you can read but not discover
   databricks:
     enabled: true
+    timeout: 30s
     hideProfiles: [test]
   repos:
     enabled: true
+    timeout: 30s
     roots: [~/git]
     paths: [~/work/infra]
     include: ["secrets/**"]
     exclude: ["**/testdata/**"]
+sharing:               # sharing env files as encrypted links
+  key: https://kv-team.vault.azure.net/secrets/env-share  # or its lazysecrets:// link; for repos naming none
+  keyRules:            # what a key's value must be
+    minLength: 32      # characters, 16 at least
+    minClasses: 2      # kinds: lowercase, uppercase, digits, symbols
 ```
 
-More, each on its own page: [repos](repos.md) (`providers.repos`), the
-[link handler](links.md#from-the-browser-and-chat) (`linkHandler`),
+More, each on its own page: [repos](repos.md) (`providers.repos`),
+[sharing env files](sharing.md#sharing-env-files) (`sharing`), the
+[link handler](sharing.md#from-the-browser-and-chat) (`linkHandler`),
 [keybindings](keys.md#rebinding-keys) (`keybinding`) and
 [custom commands](custom-commands.md) (`customCommands`).
 
@@ -75,8 +92,11 @@ theme:
   repoColor: ["#c099ff"]
 ```
 
+A role lazysecrets doesn't know, a typo or one from a newer version, is
+skipped with a warning.
+
 Icons need a [Nerd Font](https://www.nerdfonts.com) (v3+). If they render
-as boxes, turn them off with `icons: false`.
+as boxes, turn them off with `ui.icons: false`.
 
 ## Layering
 
@@ -100,11 +120,13 @@ starred the item under (a vault two of your accounts can see can be starred
 for one); a note describes the item, so it shows under every account. It's
 JSON so an editor plugin can read it with a built-in parser; several
 lazysecrets windows can save to it without losing each other's changes.
+One written by a newer lazysecrets is read but not saved to, with a
+warning, until you update.
 
 Revealing, copying, opening in the browser, sharing and jumping to an item
 count as using it: its record keeps when it was last used and how often,
 for Recent (`R`). Records kept only for usage are dropped after 90 days
-unused, and beyond the 100 most recent. `history: false` stops counting.
+unused, and beyond the 100 most recent. `storage.history: false` stops counting.
 
 It also keeps where you left lazysecrets in each folder (the selected
 source, vault or secret), and goes back there the next time it starts in
@@ -119,22 +141,24 @@ you: the Sources lists, vaults and scopes, and secrets' names and metadata
 once, and anything older than two minutes reloads in the background when
 you go to it, or when Go to searches it. While it does, the pane's
 bottom border says how old what it shows is (`cached 3h ago`). Revealing
-and copying always fetch the value live.
+and copying always fetch the value live. [`lazysecrets list`](integration.md#listing-for-fzf-and-pickers)
+reads it and adds to it too.
 
 Lists not loaded for 30 days are dropped, and so is everything from an
 account you're no longer signed in to. Repos aren't cached: their files
 are read from disk anyway. Deleting the file is always safe, and
-`cache: false` stops using it.
+`storage.cache: false` stops using it.
 
 ## Updates
 
-Once a day (`updateCheck`), in the background, lazysecrets asks for the
-latest release; within the day it reuses the answer from the state file.
-Releases are published on GitHub and on git.kebcloud.no, and it asks
-them in that order, the next when one doesn't answer within 5 seconds;
-`releases` lists others, such as a mirror of your own. Offline, or with
+At startup, in the background, lazysecrets asks for the latest release
+(`updates.autoCheck`), once a day or every `updates.autoCheckInterval`;
+until then it reuses the answer from the state file. Releases are
+published on GitHub and on git.kebcloud.no, and it asks them in that
+order, the next when one doesn't answer within 5 seconds;
+`updates.sources` lists others, such as a mirror of your own. Offline, or with
 every server down, it says nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
-`lazysecrets update --check`) shows its changelog.
+`lazysecrets update --check`) shows what changed since your version, across the last 10 releases.
 
 Updating (`u` there, or `lazysecrets update`) downloads the release for
 your OS and CPU from the first server that has it, checks it against

docs/development.md

@@ -7,6 +7,11 @@ go test ./...
 go test ./internal/ui/app -run TestGolden -update   # after intentional UI changes
 ```
 
+In `--demo`, sharing env files works end to end: `S` → `f` on a demo
+repo, pick `kv-shared-prod / env-share` (the second account's) as the
+key, then paste the link back. The demo repos aren't on disk, so opening
+asks where to save, as for a repo you haven't cloned.
+
 A stripped binary is about 21 MB instead of 30 MB:
 
 ```sh
@@ -17,7 +22,7 @@ Development builds show `dev-<commit>` as their version (`-dirty` with
 uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
 version they were built for.
 
-## Pull requests
+## How changes land
 
 Pull requests into `main` are squash-merged, so each is one commit titled
 like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)

docs/integration.md

@@ -0,0 +1,94 @@
+# Integration
+
+lazysecrets works outside its own window too: `lazysecrets get` reads a
+value for scripts, and `lazysecrets list` lists everything for fzf, editor
+pickers and your own tools. Both take the [links](sharing.md) lazysecrets
+copies and shares. For Neovim, there's
+[lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim).
+
+## Reading a value
+
+`lazysecrets get <link>` prints the value, for scripts and pipes:
+
+```sh
+export DB_PASSWORD=$(lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password)
+lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password | kubectl create secret generic db --from-file=password=/dev/stdin
+```
+
+It reads the value directly, with your az accounts (the one that last read
+it first), the Databricks profile for the workspace, or sops in your clone
+of the repo; a version in the link reads that version. `--account` tries
+that account first, as [`list`](#listing-for-fzf-and-pickers) prints it.
+The value ends with a newline only on a terminal. When it can't read the
+value, it says why on stderr and exits with status 1.
+
+## Listing, for fzf and pickers
+
+`lazysecrets list` prints every source, vault and secret, one per line,
+tab-separated:
+
+| Field | |
+|---|---|
+| kind | `source`, `vault`, `secret`, `key` or `certificate` |
+| mark | ✗ when something's wrong (expired, or couldn't be read) or ⚠ when it expires soon; ★ when starred; ◷ when used lately (with `--recent`); and the provider's icon |
+| name | `platform-prod / kv-app-prod / db-password` |
+| status | why a vault or source couldn't be read, or that it has `expired` or `expires in 12d` (within `ui.expiryWarningDays`), or empty |
+| note | your note on it (`n` in lazysecrets), after a note icon (✎ without icons), or empty |
+| account | what it's listed through: an az account (`Azure:<user>/<tenant>`), `Databricks` or `Repos` |
+| link | its `lazysecrets://` link |
+
+What's cached prints at once, then what loads follows as it arrives: read
+it as a stream. Values are never listed. It stops quietly when the reader
+goes, like fzf after a pick. Kind stays the first field, and account and
+link the last two; new fields only ever go between. The mark has a field of
+its own so a search can leave it out: in fzf, `--nth` searches the name,
+so `^prod` finds names starting with prod.
+
+| Flag | |
+|---|---|
+| `--format json` | an object per line instead, for editor plugins (below) |
+| `--kind secret,vault` | only these kinds: `source`, `vault`, `secret`, `key`, `certificate`; lists only other kinds need aren't loaded |
+| `--cached` | only what's cached, at once: nothing is loaded from Azure or Databricks |
+| `--max-age 2m` | load cached lists older than this again |
+| `--errors=false` | leave out the vaults and sources it couldn't read |
+| `--color never` | no colours, for scripts |
+| `--icons=false` | no provider icons |
+| `--stars=false` | no ★ before starred names (in `favouriteColor`) |
+| `--notes=false` | no note icon before a note |
+| `--recent` | ◷ before names used lately, in `mutedColor`; default `ui.recentIcon` |
+| `--expiry=false` | no expiry: not in the status, and no ✗ or ⚠ for it |
+
+With `--format json`, each line is an object with these fields; new ones
+may be added:
+
+| Field | |
+|---|---|
+| `link`, `kind`, `account` | as above |
+| `error` | why it couldn't be read, only then |
+| `provider` | `azure`, `databricks` or `repo` |
+| `path` | the names: `["platform-prod", "kv-app-prod", "db-password"]` |
+| `accountLabel` | the account's short name, when several az accounts are signed in |
+| `starred` | starred for this account |
+| `note` | your note on it, if any |
+| `reference` | how config refers to a secret: `@Microsoft.KeyVault(SecretUri=…)` or `{{secrets/scope/key}}` (`Y` in lazysecrets) |
+| `url` | its web page, in the Azure portal or the Databricks workspace (`o` in lazysecrets) |
+| `recent` | used lately, as Recent (`R`) lists: in the last 90 days |
+| `lastUsed`, `uses` | when it was last used, and how often; only when `recent`, to sort by |
+| `expires` | when a secret, key or certificate expires, if it does (Azure) |
+| `enabled` | `false` for a disabled one; only where the provider says (Azure) |
+
+`lazysecrets open --action go --account <account> <link>` opens one in
+lazysecrets without asking what to do or which account, ending in the
+secrets list, like Go to.
+
+
+### Example usage with fzf
+```sh
+lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1 \
+  --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
+  --bind 'ctrl-o:become(lazysecrets open --action go --account {-2} {-1})' \
+  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {3})' \
+  --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'
+```
+![fzf-example](assets/fzf-example.png)
+

docs/keys.md

@@ -54,7 +54,7 @@ match case exactly.
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
 | `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
-| `s` / `S` | copy a [link](links.md) to the selected item / share menu |
+| `s` / `S` | copy a [link](sharing.md) to the selected item / share menu (also env files, [encrypted](sharing.md#sharing-env-files)) |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |
 | `L` | sign in again (shown when a login has expired) |
@@ -65,8 +65,8 @@ certificates as their subject, issuer, dates, names and thumbprint, with
 any other PEM block (a private key) named but not shown. `y` still copies
 it exactly as stored.
 
-A revealed value hides again after `revealTimeout` (60s) and when the
-terminal loses focus (`hideOnBlur`); see [config](config.md).
+A revealed value hides again after `values.revealTimeout` (60s) and
+when the terminal loses focus (`values.hideOnBlur`); see [config](config.md).
 
 ## Stars and notes
 
@@ -122,7 +122,8 @@ Secrets. Going into it (`l`, or `4`) keeps it on that; there `j`/`k`,
 it's hidden.
 
 On top, the status pane (`0`) shows the version, a newer release and how
-your accounts are doing. Focused, the right pane lists more under the
+your accounts are doing; `e` there opens your [config](config.md) in your
+editor, as in lazygit. Focused, the right pane lists more under the
 logo (when there's room): the version and updates (`U`), each account
 (`L` on one that needs it signs in), what's expiring (`enter` goes to
 it), this session's errors, newest first (what a pane showed, or the

docs/repos.md

@@ -3,14 +3,16 @@
 lazysecrets shows git repositories under **Repos**: their
 [SOPS](https://github.com/getsops/sops)-encrypted files (YAML, JSON,
 `.env`, INI) and plain env files as vaults, and the keys in them
-(`db.password`, `list[0]`) as secrets.
+(`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
+escaped, `app\.name`, so it doesn't read as nesting.
 
 ## Which repos
 
-**Repos** lists every repo with secret files under the `roots` (`~/git`
-by default; one or two levels down, `repo` or `org/repo`), any listed in
-`paths`, and any you starred something in (the repo, a file or a key),
-wherever it is. They're checked in the background.
+**Repos** lists every repo with secret files under the `roots` (by
+default whichever of `~/git`, `~/repo`, `~/repos`, `~/projects`, `~/code`,
+`~/source` and `~/src` exist; one or two levels down, `repo` or
+`org/repo`), any listed in `paths`, and any you starred something in
+(the repo, a file or a key), wherever it is. They're checked in the background.
 
 Started inside a repo, that repo gets a row of its own at the top,
 `Repo · <name>`, and lazysecrets opens on it, with the files under the
@@ -49,12 +51,20 @@ Folders of dependencies and caches are never looked in, tracked or not:
 ```yaml
 providers:
   repos:
-    roots: [~/git]                             # folders of repos (the default; [] turns it off)
+    roots: [~/git]                             # folders of repos (replaces the defaults; [] turns it off)
     paths: [~/work/infra]                      # single repos elsewhere
     include: ["secrets/**", "**/*.sops.yaml"]  # globs from the repo root; ** for any depth
     exclude: ["**/testdata/**"]
 ```
 
+A repo's `.lazysecrets.yaml` can also name the secret its env files are
+[shared](sharing.md#sharing-env-files) with:
+
+```yaml
+sharing:
+  key: https://kv-team.vault.azure.net/secrets/env-share   # or its lazysecrets:// link
+```
+
 ## Decrypting
 
 Listing never decrypts: SOPS encrypts values only, so keys and metadata
@@ -90,6 +100,8 @@ sops 3.8 or later.
 
 ## Links
 
+`S` → `f` shares env files as an [encrypted link](sharing.md#sharing-env-files).
+
 Links name the repo by its git remote, so they open in a colleague's clone
 wherever it is:
 
@@ -97,4 +109,4 @@ wherever it is:
 lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 ```
 
-See [links](links.md).
+See [sharing](sharing.md).

docs/sharing.md

@@ -1,9 +1,10 @@
-# Links
+# Sharing
 
-Every subscription, workspace, vault, scope, repo, file and secret has a
-`lazysecrets://` link. Share one in chat or a ticket, and whoever opens it
-lands on that item, reading it with their own account and permissions:
-links carry names, never values.
+Subscriptions, workspaces, vaults, scopes, repos, files and secrets are
+shared as a `lazysecrets://` link, in chat or a ticket. Whoever opens
+it lands on that item, reading it with their own account and
+permissions: the link names the item, never its value. Env files can
+also be [shared encrypted](#sharing-env-files), in the link itself.
 
 ```
 lazysecrets://azure/kv-app-prod.vault.azure.net                              vault
@@ -14,18 +15,91 @@ lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/app/storage
 lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 ```
 
-## Sharing
+## Sharing a link
 
 `s` copies a link to the selected item (from the versions view, pinned to
 that version). `S` opens the share menu:
 
 - secrets: the link (`o`), the plain Key Vault URL (`u`), the config
-  reference (`y`) or the web page (`b`)
+  reference (`y`) or the web page (`b`); in an env file, also the file as
+  an [encrypted link](#sharing-env-files) (`f`)
 - vaults and scopes: a link (`o`), a link that opens on the current tab
   (`t`), the plain vault URL (`u`) or the web page (`b`)
 - subscriptions and workspaces: a link (`o`) or the web page (`b`)
+- repos and env files: also their env files as an
+  [encrypted link](#sharing-env-files) (`f`)
 
-## Opening
+## Sharing env files
+
+`.env` files usually live only on your machine. `S` → `f` shares them as
+an encrypted link, on a repo (all its plain env files), an env file, or a
+key in one (its file):
+
+```
+lazysecrets://share/AQ…
+```
+
+The files are encrypted with a secret's value, so whoever can read that
+secret (in Key Vault, Databricks or a repo's SOPS file) can open the link,
+and nobody else: who may open it is up to the vault's access, as for
+everything else. Make a secret for it once, random:
+
+```sh
+az keyvault secret set --vault-name kv-team --name env-share --value "$(openssl rand -base64 32)"
+```
+
+and name it in the repo's `.lazysecrets.yaml` (committed: the whole team
+uses it) or your config (for repos that don't name one), by its
+`lazysecrets://` link, Key Vault URL or `@Microsoft.KeyVault(...)`
+reference:
+
+```yaml
+sharing:
+  key: https://kv-team.vault.azure.net/secrets/env-share
+```
+
+With neither, sharing asks which secret, in [Go to](keys.md#go-to): it
+lists only secrets, and `enter` picks one (pasting a reference picks it
+too).
+
+Anyone with a link can try to guess the key, so sharing refuses one that
+isn't long and varied enough, saying how (never showing it). By default
+that's 32 characters of two kinds; your config can ask for more, or less:
+
+```yaml
+sharing:
+  keyRules:
+    minLength: 32    # characters; 16 at least
+    minClasses: 2    # kinds of character: lowercase, uppercase, digits, symbols
+```
+
+Opening a link doesn't check them.
+
+On the command line, `lazysecrets share [--key <secret>] <env file>...`
+prints the link.
+
+Opening a share link says which repo it's from, how many files and which
+secret it's encrypted with, and decrypts only when asked: lazysecrets
+reads the secret with your access, then shows where each file goes in
+your clone of the repo (or asks for a folder, if it isn't here), which
+ones would replace a file there and which ones git doesn't ignore. It
+saves them all, only the new ones, or none. New files are readable by you
+only.
+
+A link holds the files' paths and contents encrypted ([age](https://age-encryption.org),
+the secret's value as passphrase); the repo, the secret and the number of
+files are in the clear. Links stay under 16 KB, which fits chat and
+tickets.
+
+A link stays readable as long as its secret is. On Azure it's pinned to
+the secret's version, so adding a new version (rotating) doesn't break
+old links, and disabling the old version, or taking away someone's
+access, shuts them out; Databricks secrets have no versions, so changing
+the value breaks every old link. Whoever has read the secret's value
+before can decrypt links made with it without asking the vault, so rotate
+it now and then: new links use the newest version.
+
+## Opening a link
 
 - Paste it into lazysecrets, or press `ctrl+o`, which reads the clipboard
   and fills in any reference it finds there. Key Vault URLs,
@@ -44,23 +118,13 @@ read the clipboard over SSH.
 
 lazysecrets finds the vault in your accounts (one Resource Graph query per
 account) and jumps to it, asking which account to use when several can see
-it. Links say what, not what to do: opening a link to a secret asks whether
-to just go to it, also copy or show its value, or (`y`) copy its value
-without going there.
-
-## In scripts
-
-`lazysecrets get <link>` prints the value, for scripts and pipes:
-
-```sh
-export DB_PASSWORD=$(lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password)
-lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password | kubectl create secret generic db --from-file=password=/dev/stdin
-```
-
-It reads the value directly, with your az accounts (the one that last read
-it first), the Databricks profile for the workspace, or sops in your clone
-of the repo; a version in the link reads that version. The value ends with
-a newline only on a terminal.
+it, ending on a secret's details as `enter` on it would. Links say what,
+not what to do: opening a link to a secret asks whether to just go to it,
+also copy or show its value, or (`y`) copy its value without going there.
+`lazysecrets open --action go|copy|show <link>` does one without asking
+and ends in the list, like Go to,
+and `--account <account>` picks the account (as [`list`](integration.md#listing-for-fzf-and-pickers)
+prints it) when several can see it.
 
 ## From the browser and chat
 

go.mod

@@ -6,6 +6,7 @@ require (
 	charm.land/bubbles/v2 v2.2.1
 	charm.land/bubbletea/v2 v2.1.0
 	charm.land/lipgloss/v2 v2.0.6
+	filippo.io/age v1.3.2
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2 v2.1.0
@@ -17,8 +18,8 @@ require (
 	github.com/atotto/clipboard v0.1.4
 	github.com/charmbracelet/x/ansi v0.11.9
 	github.com/charmbracelet/x/exp/golden v0.0.0-20251109135125-8916d276318f
-	github.com/databricks/databricks-sdk-go v0.187.0
-	github.com/junegunn/fzf v0.74.4
+	github.com/databricks/databricks-sdk-go v0.188.0
+	github.com/junegunn/fzf v0.74.5
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/mod v0.42.0
 	golang.org/x/term v0.47.0
@@ -29,6 +30,7 @@ require (
 	cloud.google.com/go/auth v0.18.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	filippo.io/hpke v0.4.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect

go.sum

@@ -1,3 +1,5 @@
+c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d h1:Blprhc2SbChNZtWcU+BLTM4YdoqYAS9V7cJgOwJKyAs=
+c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
 charm.land/bubbles/v2 v2.2.1 h1:Fq1+qm5hV6GkvzLQDhCBpXXE5tLgvh1PRriCLwSvIQU=
 charm.land/bubbles/v2 v2.2.1/go.mod h1:wdMgn+sje1KNXdwFizIWjbf328fIUBxqEmJ/vYPo8yc=
 charm.land/bubbletea/v2 v2.1.0 h1:A9fj9h5LFrvQhQHFNggp8K8rvY6CUfgn9dMbb6p2HIw=
@@ -10,6 +12,10 @@ cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIi
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
+filippo.io/age v1.3.2 h1:r6RSZLFSMm6rzKepZ7ZAYkKCu14f3/Me8c7uKYh7C8c=
+filippo.io/age v1.3.2/go.mod h1:TH/Yr2sSRhCKbaH4XPxpUV0Us8Gv6txYUpiZQWz8Evk=
+filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=
+filippo.io/hpke v0.4.0/go.mod h1:EmAN849/P3qdeK+PCMkDpDm83vRHM5cDipBJ8xbQLVY=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 h1:qgnWTiWs1G7AqcKZegFvkJD1bmXJcaDU3uC0ELSgZ5U=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3/go.mod h1:XtxD48QPInqoj+GMlcRlXHEYsoOxFnP6w2JgIZ9rDS4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo=
@@ -66,8 +72,8 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/databricks/databricks-sdk-go v0.187.0 h1:V1rGbEUaEdGS7tTZSyplDLnE2Vp5N1aIPiIh/LzjOC8=
-github.com/databricks/databricks-sdk-go v0.187.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
+github.com/databricks/databricks-sdk-go v0.188.0 h1:1nxBqlctGnPzlReyziG199abHs9cR/KNjsCnSM+oDGA=
+github.com/databricks/databricks-sdk-go v0.188.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -94,8 +100,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dq
 github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
 github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
 github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
-github.com/junegunn/fzf v0.74.4 h1:DSqIW3ZxtkuuPzeLKrVnHdoWqT9VCIGRbjc/lXiGCso=
-github.com/junegunn/fzf v0.74.4/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
+github.com/junegunn/fzf v0.74.5 h1:mpJlCdgGuddKerHrdjvV3cnezEBgyjZAVn8KCo/4OMc=
+github.com/junegunn/fzf v0.74.5/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741 h1:7dYDtfMDfKzjT+DVfIS4iqknSEKtZpEcXtu6vuaasHs=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741/go.mod h1:6EILKtGpo5t+KLb85LNZLAF6P9LKp78hJI80PXMcn3c=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=

internal/cachefile/cachefile.go

@@ -0,0 +1,172 @@
+// Package cachefile is the cache of what lazysecrets has loaded
+// (cache.json): the Sources lists, vaults, secrets' metadata and where
+// the cursor was in each, never values. The TUI and lazysecrets list
+// both read it and save to it; a save merges with what's on disk, so
+// neither undoes what the other loaded.
+package cachefile
+
+import (
+	"encoding/json"
+	"maps"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+// Version is the file's format; a file of another version is ignored,
+// and replaced on the next save.
+const Version = 1
+
+// MaxAge drops what hasn't been loaded again for this long.
+const MaxAge = 30 * 24 * time.Hour
+
+// File is the cache. Every key starts with the provider ID: Sources are
+// keyed by it, the rest by Row, Objects' keys and the like.
+type File struct {
+	Version    int                                      `json:"version"`
+	Sources    map[string]Stamped[[]provider.Source]    `json:"sources,omitempty"` // by provider ID
+	Containers map[string]Stamped[[]provider.Container] `json:"containers,omitempty"`
+	Objects    map[string]Stamped[[]provider.Object]    `json:"objects,omitempty"`
+	Details    map[string]Stamped[provider.Object]      `json:"details,omitempty"`
+	Cursor     map[string]string                        `json:"cursor,omitempty"`
+	// Dropped are keys deleted since the file was read (a list that
+	// failed to load): Save deletes them from the file too, rather than
+	// merging the old entry back. Not saved.
+	Dropped map[string]bool `json:"-"`
+}
+
+// Stamped is a list or detail with when it was loaded.
+type Stamped[T any] struct {
+	At    time.Time `json:"at"`
+	Value T         `json:"value"`
+}
+
+// New is an empty cache.
+func New() File {
+	return File{
+		Version:    Version,
+		Sources:    map[string]Stamped[[]provider.Source]{},
+		Containers: map[string]Stamped[[]provider.Container]{},
+		Objects:    map[string]Stamped[[]provider.Object]{},
+		Details:    map[string]Stamped[provider.Object]{},
+		Cursor:     map[string]string{},
+	}
+}
+
+// Row keys a source's vaults or scopes.
+func Row(providerID, sourceID string) string { return providerID + "|" + sourceID }
+
+// ContainerKey keys what's cached about a vault or scope.
+func ContainerKey(c provider.Container) string { return c.Source.Provider + "|" + c.ID }
+
+// ObjectsKey keys a vault's secrets, keys or certificates.
+func ObjectsKey(c provider.Container, t provider.ObjectType) string {
+	return ContainerKey(c) + "|" + string(t)
+}
+
+// ProviderOf is the provider ID a key starts with.
+func ProviderOf(key string) string {
+	id, _, _ := strings.Cut(key, "|")
+	return id
+}
+
+// Keep is Save's keep for these providers: their lists are kept, but not
+// repos', whose files are read from disk anyway, nor other accounts'.
+func Keep(providers []provider.Provider) func(providerID string) bool {
+	keep := map[string]bool{}
+	for _, p := range providers {
+		keep[p.ID()] = p.Kind() != provider.KindRepo
+	}
+	return func(id string) bool { return keep[id] }
+}
+
+// Read reads path; a missing, unreadable or other version's file is an
+// empty cache.
+func Read(path string) File {
+	f := New()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return f
+	}
+	var d File
+	if json.Unmarshal(b, &d) != nil || d.Version != Version {
+		return f
+	}
+	maps.Copy(f.Sources, d.Sources)
+	maps.Copy(f.Containers, d.Containers)
+	maps.Copy(f.Objects, d.Objects)
+	maps.Copy(f.Details, d.Details)
+	maps.Copy(f.Cursor, d.Cursor)
+	return f
+}
+
+// Save writes f to path, merged with the file there: of a list in both,
+// the one loaded last wins, and f's cursors win (a nil Cursor keeps the
+// file's). Entries older than MaxAge, those of providers keep says no to
+// (accounts signed out of), and f.Dropped are dropped, from the file's
+// side as well. Saves from several lazysecrets take turns (a lock file),
+// so none undoes another's.
+func Save(path string, f File, keep func(providerID string) bool, now time.Time) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return err
+	}
+	unlock, err := lock(path + ".lock")
+	if err != nil {
+		return err
+	}
+	defer unlock()
+	out := New()
+	ok := func(key string, at time.Time) bool { return keep(ProviderOf(key)) && now.Sub(at) < MaxAge }
+	disk := Read(path)
+	merge(out.Sources, disk.Sources, f.Sources, ok, f.Dropped)
+	merge(out.Containers, disk.Containers, f.Containers, ok, f.Dropped)
+	merge(out.Objects, disk.Objects, f.Objects, ok, f.Dropped)
+	merge(out.Details, disk.Details, f.Details, ok, f.Dropped)
+	for _, m := range []map[string]string{disk.Cursor, f.Cursor} {
+		for k, v := range m {
+			if keep(ProviderOf(k)) {
+				out.Cursor[k] = v
+			}
+		}
+	}
+	return write(path, out)
+}
+
+// merge puts disk's entries in out, but not those dropped, then ours
+// where they're newer.
+func merge[T any](out, disk, ours map[string]Stamped[T], ok func(string, time.Time) bool, dropped map[string]bool) {
+	for k, e := range disk {
+		if ok(k, e.At) && !dropped[k] {
+			out[k] = e
+		}
+	}
+	for k, e := range ours {
+		if old, seen := out[k]; ok(k, e.At) && (!seen || !e.At.Before(old.At)) {
+			out[k] = e
+		}
+	}
+}
+
+// write writes f atomically, readable by the user only.
+func write(path string, f File) error {
+	b, err := json.Marshal(f)
+	if err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(filepath.Dir(path), ".cache-*.json")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name()) // after a successful rename, nothing there
+	if _, err := tmp.Write(b); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), path)
+}

internal/cachefile/cachefile_test.go

@@ -0,0 +1,122 @@
+package cachefile
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+func list(at time.Time, names ...string) Stamped[[]provider.Container] {
+	var cs []provider.Container
+	for _, n := range names {
+		cs = append(cs, provider.Container{Name: n})
+	}
+	return Stamped[[]provider.Container]{At: at, Value: cs}
+}
+
+func TestSaveMerges(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	now := time.Now()
+	all := func(string) bool { return true }
+
+	// The TUI saved two lists.
+	tui := New()
+	tui.Containers["az|a"] = list(now.Add(-time.Hour), "kv-a-old")
+	tui.Containers["az|b"] = list(now.Add(-time.Minute), "kv-b")
+	tui.Cursor["az|b"] = "kv-b"
+	if err := Save(path, tui, all, now); err != nil {
+		t.Fatal(err)
+	}
+	// lazysecrets list loads a again, and c.
+	listed := Read(path)
+	listed.Containers["az|a"] = list(now, "kv-a-new")
+	listed.Containers["az|c"] = list(now, "kv-c")
+	if err := Save(path, listed, all, now); err != nil {
+		t.Fatal(err)
+	}
+	// The TUI saves what it has, older: list's lists stay.
+	if err := Save(path, tui, all, now); err != nil {
+		t.Fatal(err)
+	}
+	f := Read(path)
+	for key, want := range map[string]string{"az|a": "kv-a-new", "az|b": "kv-b", "az|c": "kv-c"} {
+		if got := f.Containers[key].Value; len(got) != 1 || got[0].Name != want {
+			t.Errorf("%s = %v, want %s", key, got, want)
+		}
+	}
+	if f.Cursor["az|b"] != "kv-b" {
+		t.Error("cursor lost")
+	}
+}
+
+func TestSaveDrops(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	now := time.Now()
+	f := New()
+	f.Containers["az|old"] = list(now.Add(-MaxAge-time.Hour), "kv-old")
+	f.Containers["gone|x"] = list(now, "kv-gone")
+	f.Containers["az|x"] = list(now, "kv-x")
+	if err := Save(path, f, func(id string) bool { return true }, now); err != nil {
+		t.Fatal(err)
+	}
+	// Signed out of "gone" since: dropped from the file too.
+	if err := Save(path, New(), func(id string) bool { return id == "az" }, now); err != nil {
+		t.Fatal(err)
+	}
+	got := Read(path).Containers
+	if _, ok := got["az|old"]; ok {
+		t.Error("kept a list older than MaxAge")
+	}
+	if _, ok := got["gone|x"]; ok {
+		t.Error("kept a signed-out account's list")
+	}
+	if _, ok := got["az|x"]; !ok {
+		t.Error("dropped a list on disk the save didn't have")
+	}
+}
+
+func TestReadOtherVersion(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	f := New()
+	f.Version = Version + 1
+	f.Containers["az|x"] = list(time.Now(), "kv-x")
+	if err := write(path, f); err != nil {
+		t.Fatal(err)
+	}
+	if got := Read(path); len(got.Containers) != 0 || got.Version != Version {
+		t.Errorf("read another version's file: %+v", got)
+	}
+}
+
+func TestSaveDroppedAndCursors(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	now := time.Now()
+	all := func(string) bool { return true }
+	f := New()
+	f.Containers["az|bad"] = list(now, "kv-old")
+	f.Cursor["az|x"] = "kv-tui"
+	if err := Save(path, f, all, now); err != nil {
+		t.Fatal(err)
+	}
+	// The TUI fails to load it again and drops it: it stays gone.
+	f = New()
+	f.Dropped = map[string]bool{"az|bad": true}
+	if err := Save(path, f, all, now); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := Read(path).Containers["az|bad"]; ok {
+		t.Error("a dropped list came back")
+	}
+	// lazysecrets list saves without cursors: the TUI's stay.
+	listed := New()
+	listed.Cursor = nil
+	listed.Containers["az|y"] = list(now, "kv-y")
+	if err := Save(path, listed, all, now); err != nil {
+		t.Fatal(err)
+	}
+	if Read(path).Cursor["az|x"] != "kv-tui" {
+		t.Error("the TUI's cursor was lost")
+	}
+}

internal/cachefile/lock_other.go

@@ -0,0 +1,7 @@
+//go:build !unix
+
+package cachefile
+
+// lock does nothing here: saves can then race, losing lists that load
+// again.
+func lock(string) (func(), error) { return func() {}, nil }

internal/cachefile/lock_unix.go

@@ -0,0 +1,25 @@
+//go:build unix
+
+package cachefile
+
+import (
+	"os"
+	"syscall"
+)
+
+// lock takes path as a lock file, waiting while another lazysecrets has
+// it, and returns how to let go.
+func lock(path string) (unlock func(), err error) {
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
+		f.Close()
+		return nil, err
+	}
+	return func() {
+		_ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+		f.Close()
+	}, nil
+}

internal/config/config.go

@@ -14,46 +14,23 @@ import (
 	"go.yaml.in/yaml/v3"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 
 type Config struct {
-	Icons          *bool          `yaml:"icons"`
-	ClipboardClear *time.Duration `yaml:"clipboardClear"`
-	// RevealTimeout hides a revealed value after this long; 0s never.
-	// Defaults to 60s.
-	RevealTimeout *time.Duration `yaml:"revealTimeout"`
-	// ExpiryWarningDays marks secrets, keys and certificates expiring
-	// within this many days; 0 marks only expired ones. Defaults to 30.
-	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
-	// HideOnBlur hides a revealed value when the terminal loses focus.
-	// Defaults to true.
-	HideOnBlur *bool         `yaml:"hideOnBlur"`
-	Timeout    time.Duration `yaml:"timeout"`
-	// LoadDelay is how long the cursor must rest on a row before its
-	// contents load; 0s loads at once. Defaults to 150ms.
-	LoadDelay *time.Duration `yaml:"loadDelay"`
-	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
-	SourcesView string `yaml:"sourcesView"`
-	// History counts uses of items for the Recent list; defaults to true.
-	History *bool `yaml:"history"`
-	// UpdateCheck looks for a newer release once a day, in the
-	// background; defaults to true. U and lazysecrets update work either
-	// way.
-	UpdateCheck *bool `yaml:"updateCheck"`
-	// Releases are the repositories updates come from, tried in order:
-	// on GitHub, or a Gitea or Forgejo server. Defaults to GitHub, then
-	// git.kebcloud.no (update.DefaultServers).
-	Releases []string `yaml:"releases"`
-	// Cache keeps what was loaded (never values) between runs, so lists
-	// show at once and refresh in the background; defaults to true.
-	Cache *bool `yaml:"cache"`
-	// CollapseGroups starts the Sources pane with its groups folded;
-	// defaults to true.
-	CollapseGroups *bool     `yaml:"collapseGroups"`
+	UI UI `yaml:"ui"`
+	// Values keeps revealed and copied values from lingering.
+	Values Values `yaml:"values"`
+	// Storage is what's kept between runs.
+	Storage Storage `yaml:"storage"`
+	// Updates sets how lazysecrets looks for newer releases.
+	Updates   Updates   `yaml:"updates"`
 	Providers Providers `yaml:"providers"`
 	// LinkHandler sets how lazysecrets:// links open; see linkhandler.
 	LinkHandler LinkHandler `yaml:"linkHandler"`
+	// Sharing sets how env files are shared; see package share.
+	Sharing Sharing `yaml:"sharing"`
 	// CustomCommands run shell commands on the selected item; see
 	// package commands.
 	CustomCommands []commands.Command `yaml:"customCommands"`
@@ -65,6 +42,55 @@ type Config struct {
 	Theme map[string][]string `yaml:"theme"`
 }
 
+type UI struct {
+	Icons *bool `yaml:"icons"`
+	// RecentIcon marks items used lately (Recent, R) with ◷, in the lists
+	// and in lazysecrets list. Defaults to false.
+	RecentIcon *bool `yaml:"recentIcon"`
+	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
+	SourcesView string `yaml:"sourcesView"`
+	// CollapseGroups starts the Sources pane with its groups folded;
+	// defaults to true.
+	CollapseGroups *bool `yaml:"collapseGroups"`
+	// LoadDelay is how long the cursor must rest on a row before its
+	// contents load; 0s loads at once. Defaults to 150ms.
+	LoadDelay *time.Duration `yaml:"loadDelay"`
+	// ExpiryWarningDays marks secrets, keys and certificates expiring
+	// within this many days; 0 marks only expired ones. Defaults to 30.
+	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
+}
+
+type Values struct {
+	// RevealTimeout hides a revealed value after this long; 0s never.
+	// Defaults to 60s.
+	RevealTimeout *time.Duration `yaml:"revealTimeout"`
+	// HideOnBlur hides a revealed value when the terminal loses focus.
+	// Defaults to true.
+	HideOnBlur     *bool          `yaml:"hideOnBlur"`
+	ClipboardClear *time.Duration `yaml:"clipboardClear"`
+}
+
+type Storage struct {
+	// Cache keeps what was loaded (never values) between runs, so lists
+	// show at once and refresh in the background; defaults to true.
+	Cache *bool `yaml:"cache"`
+	// History counts uses of items for the Recent list; defaults to true.
+	History *bool `yaml:"history"`
+}
+
+type Updates struct {
+	// AutoCheck looks for a newer release in the background at startup,
+	// at most once per AutoCheckInterval; defaults to true. U and
+	// lazysecrets update work either way.
+	AutoCheck *bool `yaml:"autoCheck"`
+	// AutoCheckInterval defaults to 24h.
+	AutoCheckInterval *time.Duration `yaml:"autoCheckInterval"`
+	// Sources are the repositories updates come from, tried in
+	// order: on GitHub, or a Gitea or Forgejo server. Defaults to GitHub,
+	// then git.kebcloud.no (update.DefaultServers).
+	Sources []string `yaml:"sources"`
+}
+
 type LinkHandler struct {
 	// Terminal to open links in, overriding the one handler install
 	// detected: kitty, ghostty, wezterm, iterm2, terminal, alacritty,
@@ -82,7 +108,27 @@ type LinkHandler struct {
 	Prompt *bool `yaml:"prompt"`
 }
 
+type Sharing struct {
+	// Key is the secret whose value encrypts shared files (its
+	// lazysecrets:// link, Key Vault URL or reference), for repos whose
+	// .lazysecrets.yaml doesn't name one.
+	Key string `yaml:"key"`
+	// KeyRules are what a key's value must be to share with it.
+	KeyRules KeyRules `yaml:"keyRules"`
+}
+
+// KeyRules default to 32 characters of 2 kinds (share.DefaultRules).
+type KeyRules struct {
+	MinLength int `yaml:"minLength"` // at least 16
+	// MinClasses is how many kinds of character: lowercase, uppercase,
+	// digits, symbols.
+	MinClasses int `yaml:"minClasses"`
+}
+
 type Providers struct {
+	// Timeout bounds each backend request; defaults to 30s. Each
+	// provider's own timeout overrides it for that provider.
+	Timeout    time.Duration `yaml:"timeout"`
 	Azure      Azure         `yaml:"azure"`
 	Databricks Databricks    `yaml:"databricks"`
 	Repos      Repos         `yaml:"repos"`
@@ -92,11 +138,13 @@ type Providers struct {
 // that repo is the only one shown; elsewhere, the ones in Paths and under
 // Roots.
 type Repos struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool    `yaml:"enabled"`
 	Paths   []string `yaml:"paths"`
-	// Roots are folders of repos. Defaults to ~/git; an empty list
-	// turns it off.
+	// Roots are folders of repos. Defaults to repo.DefaultRoots (~/git,
+	// ~/src, ~/code and the like); an empty list turns it off.
 	Roots *[]string `yaml:"roots"`
 	// Include and Exclude are globs relative to a repo's root (** for any
 	// depth), for repos without their own .lazysecrets.yaml. Without them,
@@ -106,6 +154,8 @@ type Repos struct {
 }
 
 type Azure struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool `yaml:"enabled"`
 	// HideSubscriptions lists subscriptions to leave out, by name or ID.
@@ -116,6 +166,8 @@ type Azure struct {
 }
 
 type Databricks struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled      *bool    `yaml:"enabled"`
 	HideProfiles []string `yaml:"hideProfiles"`
@@ -202,23 +254,47 @@ func decodeInto(c *Config, path string) error {
 }
 
 func (c Config) validate(path string) error {
-	if v := c.SourcesView; v != "" && v != "grouped" && v != "flat" {
-		return fmt.Errorf("%s: sourcesView: %q is not grouped or flat", path, v)
+	if v := c.UI.SourcesView; v != "" && v != "grouped" && v != "flat" {
+		return fmt.Errorf("%s: ui.sourcesView: %q is not grouped or flat", path, v)
 	}
 	for _, cmd := range c.CustomCommands {
 		if err := cmd.Validate(); err != nil {
 			return fmt.Errorf("%s: %w", path, err)
 		}
 	}
-	if d := c.ExpiryWarningDays; d != nil && *d < 0 {
-		return fmt.Errorf("%s: expiryWarningDays: %d is negative", path, *d)
+	if d := c.UI.ExpiryWarningDays; d != nil && *d < 0 {
+		return fmt.Errorf("%s: ui.expiryWarningDays: %d is negative", path, *d)
 	}
-	if d := c.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
-		return fmt.Errorf("%s: loadDelay: %s is not between 0s and 5s", path, *d)
+	if d := c.UI.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
+		return fmt.Errorf("%s: ui.loadDelay: %s is not between 0s and 5s", path, *d)
 	}
-	for i, r := range c.Releases {
+	if d := c.Updates.AutoCheckInterval; d != nil && *d <= 0 {
+		return fmt.Errorf("%s: updates.autoCheckInterval: %s is not positive (autoCheck: false turns it off)", path, *d)
+	}
+	for i, r := range c.Updates.Sources {
 		if _, err := update.API(r); err != nil || !strings.HasPrefix(r, "https://") {
-			return fmt.Errorf("%s: releases[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
+			return fmt.Errorf("%s: updates.sources[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
+		}
+	}
+	if k := c.Sharing.Key; k != "" {
+		if _, err := share.ParseKey(k); err != nil {
+			return fmt.Errorf("%s: sharing.key: %w", path, err)
+		}
+	}
+	if n := c.Sharing.KeyRules.MinLength; n != 0 && n < 16 {
+		return fmt.Errorf("%s: sharing.keyRules.minLength: %d is under 16", path, n)
+	}
+	if n := c.Sharing.KeyRules.MinClasses; n < 0 || n > 4 {
+		return fmt.Errorf("%s: sharing.keyRules.minClasses: %d is not between 1 and 4", path, n)
+	}
+	for name, d := range map[string]time.Duration{
+		"providers.timeout":            c.Providers.Timeout,
+		"providers.azure.timeout":      c.Providers.Azure.Timeout,
+		"providers.databricks.timeout": c.Providers.Databricks.Timeout,
+		"providers.repos.timeout":      c.Providers.Repos.Timeout,
+	} {
+		if d < 0 {
+			return fmt.Errorf("%s: %s: %s is negative", path, name, d)
 		}
 	}
 	for i, v := range c.Providers.Azure.Vaults {

internal/config/config_test.go

@@ -19,12 +19,17 @@ func write(t *testing.T, content string) string {
 
 func TestLoad(t *testing.T) {
 	c, err := Load(write(t, `
+ui:
   icons: false
   sourcesView: flat
+values:
   clipboardClear: 45s
-timeout: 1m
+storage:
+  history: false
 providers:
+  timeout: 1m
   azure:
+    timeout: 2m
     hideSubscriptions: [platform-mgmt]
     vaults:
       - https://kv-foo.vault.azure.net/
@@ -35,12 +40,12 @@ providers:
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || c.ClipboardClear == nil || *c.ClipboardClear != 45*time.Second ||
-		c.Timeout != time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
+	if c.UI.Icons == nil || *c.UI.Icons || c.Values.ClipboardClear == nil || *c.Values.ClipboardClear != 45*time.Second ||
+		c.Providers.Timeout != time.Minute || c.Providers.Azure.Timeout != 2*time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
 		t.Errorf("config = %+v", c)
 	}
-	if c.SourcesView != "flat" {
-		t.Errorf("sourcesView = %q", c.SourcesView)
+	if c.UI.SourcesView != "flat" || On(c.Storage.History) || !On(c.Storage.Cache) {
+		t.Errorf("ui = %+v, storage = %+v", c.UI, c.Storage)
 	}
 	if !On(c.Providers.Azure.Enabled) || On(c.Providers.Databricks.Enabled) {
 		t.Error("enabled flags wrong")
@@ -57,7 +62,7 @@ func TestLoadMissingAndEmpty(t *testing.T) {
 		"empty":   write(t, ""),
 	} {
 		c, err := Load(path)
-		if err != nil || c.Icons != nil || c.ClipboardClear != nil {
+		if err != nil || c.UI.Icons != nil || c.Values.ClipboardClear != nil {
 			t.Errorf("%s: %+v, %v", name, c, err)
 		}
 	}
@@ -68,10 +73,17 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"typo":       "icon: true\n",
 		"bad vault":  "providers:\n  azure:\n    vaults: [kv-foo]\n",
 		"old layout": "azure:\n  vaults: [https://kv.vault.azure.net/]\n",
-		"duration":   "timeout: soon\n",
-		"view":       "sourcesView: tree\n",
-		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
-		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
+		"flat keys":  "icons: false\n",
+		"duration":   "providers:\n  timeout: soon\n",
+		"negative":   "providers:\n  repos:\n    timeout: -1s\n",
+		"view":       "ui:\n  sourcesView: tree\n",
+		"sources":    "updates:\n  sources: [git.example.com/team/lazysecrets]\n",
+		"http":       "updates:\n  sources: [http://git.example.com/team/lazysecrets]\n",
+		"interval":   "updates:\n  autoCheckInterval: 0s\n",
+		"share key":  "sharing:\n  key: https://kv.vault.azure.net/\n",
+		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
+		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
+		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
 	} {
 		if _, err := Load(write(t, content)); err == nil {
 			t.Errorf("%s: no error", name)
@@ -83,6 +95,7 @@ func TestLoadRejectsMistakes(t *testing.T) {
 
 func TestLoadAllLayers(t *testing.T) {
 	user := write(t, `
+ui:
   icons: false
 theme:
   azureColor: [blue]
@@ -92,6 +105,8 @@ providers:
     hideSubscriptions: [a]
 `)
 	theme := write(t, `
+ui:
+  sourcesView: flat
 theme:
   azureColor: ["#82aaff"]
   activeBorderColor: ["#ff966c", bold]
@@ -100,7 +115,8 @@ theme:
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || len(c.Providers.Azure.HideSubscriptions) != 1 {
+	// A group set in both files merges: icons from one, sourcesView the other.
+	if c.UI.Icons == nil || *c.UI.Icons || c.UI.SourcesView != "flat" || len(c.Providers.Azure.HideSubscriptions) != 1 {
 		t.Errorf("user settings lost: %+v", c)
 	}
 	want := map[string][]string{
@@ -115,19 +131,19 @@ theme:
 	}
 }
 
-func TestReleases(t *testing.T) {
-	c, err := Load(write(t, "releases: [https://git.example.com/team/lazysecrets]\n"))
-	if err != nil || len(c.Releases) != 1 {
-		t.Errorf("releases = %v, %v", c.Releases, err)
+func TestUpdates(t *testing.T) {
+	c, err := Load(write(t, "updates:\n  autoCheck: false\n  autoCheckInterval: 168h\n  sources: [https://git.example.com/team/lazysecrets]\n"))
+	if err != nil || On(c.Updates.AutoCheck) || *c.Updates.AutoCheckInterval != 7*24*time.Hour || len(c.Updates.Sources) != 1 {
+		t.Errorf("updates = %+v, %v", c.Updates, err)
 	}
 }
 
 func TestLoadDelay(t *testing.T) {
-	c, err := Load(write(t, "loadDelay: 300ms\n"))
-	if err != nil || c.LoadDelay == nil || *c.LoadDelay != 300*time.Millisecond {
-		t.Errorf("loadDelay = %v, %v", c.LoadDelay, err)
+	c, err := Load(write(t, "ui:\n  loadDelay: 300ms\n"))
+	if err != nil || c.UI.LoadDelay == nil || *c.UI.LoadDelay != 300*time.Millisecond {
+		t.Errorf("loadDelay = %v, %v", c.UI.LoadDelay, err)
 	}
-	if _, err := Load(write(t, "loadDelay: 1m\n")); err == nil {
+	if _, err := Load(write(t, "ui:\n  loadDelay: 1m\n")); err == nil {
 		t.Error("a minute's delay accepted")
 	}
 }

internal/expiry/expiry.go

@@ -0,0 +1,41 @@
+// Package expiry says whether a secret, key or certificate has expired
+// or will soon, and how long it has left, the same way everywhere: the
+// TUI's lists and status pane, and lazysecrets list.
+package expiry
+
+import (
+	"fmt"
+	"time"
+)
+
+type State int
+
+const (
+	None    State = iota // no expiry, or not within the warning period
+	Soon                 // within the warning period
+	Expired              // already
+)
+
+// Of tells whether something expiring at expires (zero: never) has
+// expired by now or will within warn, and how long it has left.
+func Of(expires, now time.Time, warn time.Duration) (State, time.Duration) {
+	if expires.IsZero() {
+		return None, 0
+	}
+	left := expires.Sub(now)
+	switch {
+	case left <= 0:
+		return Expired, 0
+	case left <= warn:
+		return Soon, left
+	}
+	return None, left
+}
+
+// Left is a short "12d", or "5h" on the last day.
+func Left(d time.Duration) string {
+	if d < 24*time.Hour {
+		return fmt.Sprintf("%dh", max(1, int(d.Hours())))
+	}
+	return fmt.Sprintf("%dd", int(d.Hours()/24))
+}

internal/expiry/expiry_test.go

@@ -0,0 +1,27 @@
+package expiry
+
+import (
+	"testing"
+	"time"
+)
+
+func TestOf(t *testing.T) {
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	warn := 30 * 24 * time.Hour
+	for _, c := range []struct {
+		expires time.Time
+		want    State
+		left    string
+	}{
+		{time.Time{}, None, ""},
+		{now.Add(-time.Hour), Expired, ""},
+		{now.Add(12*24*time.Hour + time.Hour), Soon, "12d"},
+		{now.Add(5 * time.Hour), Soon, "5h"},
+		{now.Add(60 * 24 * time.Hour), None, ""},
+	} {
+		state, left := Of(c.expires, now, warn)
+		if state != c.want || (c.left != "" && Left(left) != c.left) {
+			t.Errorf("%v: %v %s, want %v %s", c.expires, state, Left(left), c.want, c.left)
+		}
+	}
+}

internal/listing/listing.go

@@ -0,0 +1,399 @@
+// Package listing lists what lazysecrets can find, for lazysecrets list:
+// what Go to searches, without the TUI. What's cached comes first, at
+// once; then lists that are missing or older than MaxAge load in the
+// background, a few at a time, and what's new in them follows as they
+// arrive. Repos are always read, from disk. Values are never listed.
+package listing
+
+import (
+	"cmp"
+	"context"
+	"slices"
+	"strings"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+)
+
+// Workers is how many lists load at once, as in Go to.
+const Workers = 4
+
+// Kinds are the kinds of entry, from sources down.
+var Kinds = []string{"source", "vault", "secret", "key", "certificate"}
+
+// Entry is a source, vault or item, by its lazysecrets:// link.
+type Entry struct {
+	Link string `json:"link"`
+	// Kind is source (a subscription, workspace or repo), vault (a Key
+	// Vault, secret scope or repo file), secret, key or certificate.
+	Kind string `json:"kind"`
+	// Provider is azure, databricks or repo, as in links.
+	Provider string `json:"provider"`
+	// Path names it: its source's, vault's and own names.
+	Path []string `json:"path"`
+	// Account is the provider it's listed through: an az account
+	// (Azure:<user>/<tenant>), Databricks or Repos. lazysecrets open and
+	// get take it (--account) to use that account when several could.
+	Account string `json:"account"`
+	// AccountLabel names the az account, when there are several.
+	AccountLabel string `json:"accountLabel,omitempty"`
+	// Starred is starred for this account; Recent is used lately (Recent,
+	// R, in the TUI): LastUsed is when, Uses how often.
+	Starred  bool      `json:"starred"`
+	Recent   bool      `json:"recent"`
+	LastUsed time.Time `json:"lastUsed,omitzero"`
+	Uses     int       `json:"uses,omitempty"`
+	// Expires is when a secret, key or certificate expires, if it does;
+	// Enabled whether it's enabled, where the provider says (Azure).
+	Expires time.Time `json:"expires,omitzero"`
+	Enabled *bool     `json:"enabled,omitempty"`
+	// Note is the user's note on it, if any.
+	Note string `json:"note,omitempty"`
+	// Reference is how config refers to a secret, where the provider has
+	// a way (@Microsoft.KeyVault(...), {{secrets/scope/key}}); URL its
+	// web page (portal, workspace), if any.
+	Reference string `json:"reference,omitempty"`
+	URL       string `json:"url,omitempty"`
+	// Error says why a source's vaults or a vault's secrets couldn't be
+	// listed. The entry is then that source or vault, again, or with an
+	// account's sources unreadable, the account without a link.
+	Error string `json:"error,omitempty"`
+}
+
+type Options struct {
+	Providers []provider.Provider
+	// Cache is what was loaded before; Run adds what it loads.
+	Cache cachefile.File
+	// MaxAge: cached lists loaded longer ago are loaded again.
+	MaxAge time.Duration
+	// Cached lists only what's cached (and repos): nothing is loaded.
+	Cached bool
+	// Kinds are the kinds of entry to list (Kinds' names); none is all.
+	// Lists only needed for other kinds aren't loaded: sources and vaults
+	// alone don't load any secrets. Lists that fail are always listed.
+	Kinds []string
+	// Mark tells what's remembered about the entry with link, seen
+	// through account; nil marks nothing.
+	Mark    func(link, account string) Marks
+	Timeout func(provider.Kind) time.Duration // nil: 30s
+	Now     func() time.Time
+}
+
+// Marks are what's remembered about an entry: starred for the account,
+// used lately (Recent) and when and how often, and its note.
+type Marks struct {
+	Starred, Recent bool
+	LastUsed        time.Time
+	Uses            int
+	Note            string
+}
+
+// Run lists everything, calling emit for each entry once, from this
+// goroutine, and for each list that can't be loaded, as it fails. An
+// error from emit (the reader went away) stops it. It returns the cache
+// with what was loaded, and whether anything was.
+func Run(ctx context.Context, o Options, emit func(Entry) error) (cachefile.File, bool) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	l := &lister{o: o, emit: emit, seen: map[string]bool{}, pending: map[string]bool{}, failed: map[string]bool{},
+		results: make(chan result)}
+	if l.o.Now == nil {
+		l.o.Now = time.Now
+	}
+	if l.o.Timeout == nil {
+		l.o.Timeout = func(provider.Kind) time.Duration { return 30 * time.Second }
+	}
+	for _, p := range o.Providers {
+		if l.stopped != nil {
+			break
+		}
+		l.provider(p)
+	}
+	l.start(ctx)
+	for l.active > 0 {
+		r := <-l.results
+		l.active--
+		if l.stopped == nil {
+			l.handle(r)
+			l.start(ctx)
+		}
+		if l.stopped != nil {
+			cancel()
+		}
+	}
+	return l.o.Cache, l.loaded
+}
+
+type job struct {
+	p   provider.Provider
+	src *provider.Source    // list its vaults
+	c   *provider.Container // list its secrets, keys or certificates (t)
+	t   provider.ObjectType
+	key string // where the list is cached
+}
+
+type result struct {
+	job
+	sources    []provider.Source
+	containers []provider.Container
+	objects    []provider.Object
+	err        error
+}
+
+type lister struct {
+	o       Options
+	emit    func(Entry) error
+	seen    map[string]bool // provider ID + link of entries emitted
+	pending map[string]bool // cache keys queued or loading
+	failed  map[string]bool // cache keys that couldn't be loaded: not again
+	loaded  bool            // something was cached
+	queue   []job
+	active  int
+	results chan result
+	stopped error // emit's error
+}
+
+func (l *lister) cacheable(p provider.Provider) bool { return p.Kind() != provider.KindRepo }
+
+// load reports whether to load a list: a repo's always (from disk), else
+// unless Cached, when it isn't cached or is older than MaxAge.
+func (l *lister) load(p provider.Provider, cached bool, at time.Time) bool {
+	if !l.cacheable(p) {
+		return true
+	}
+	return !l.o.Cached && (!cached || l.o.Now().Sub(at) >= l.o.MaxAge)
+}
+
+func (l *lister) provider(p provider.Provider) {
+	e, ok := l.o.Cache.Sources[p.ID()]
+	if l.cacheable(p) && ok {
+		for _, src := range sorted(e.Value, func(s provider.Source) string { return s.Name }) {
+			l.source(p, src)
+		}
+	}
+	if l.load(p, ok, e.At) {
+		l.enqueue(job{p: p, key: p.ID()})
+	}
+}
+
+// source emits src, and what's cached under it, and queues what's not.
+func (l *lister) source(p provider.Provider, src provider.Source) {
+	src.Provider, src.ProviderLabel = p.ID(), p.Label()
+	l.put(p, sourceEntry(src))
+	row := cachefile.Row(p.ID(), src.ID)
+	e, ok := l.o.Cache.Containers[row]
+	if l.cacheable(p) && ok {
+		l.containers(p, src, e.Value)
+	}
+	if l.load(p, ok, e.At) {
+		if l.wants("vault", "secret", "key", "certificate") {
+			l.enqueue(job{p: p, src: &src, key: row})
+		}
+	}
+}
+
+func (l *lister) containers(p provider.Provider, src provider.Source, cs []provider.Container) {
+	for _, c := range sorted(cs, func(c provider.Container) string { return c.Name }) {
+		c.Source = src
+		l.put(p, containerEntry(c))
+		for _, t := range c.ObjectTypes() {
+			key := cachefile.ObjectsKey(c, t)
+			e, ok := l.o.Cache.Objects[key]
+			if l.cacheable(p) {
+				l.objects(p, c, e.Value)
+			}
+			// Keys and certificates load only when asked for; else,
+			// like Go to, only as far as the TUI opened them.
+			asked := l.wants(strings.ToLower(string(t)))
+			if t != provider.TypeSecret {
+				asked = len(l.o.Kinds) > 0 && asked
+			}
+			if asked && l.load(p, ok, e.At) {
+				l.enqueue(job{p: p, c: &c, t: t, key: key})
+			}
+		}
+	}
+}
+
+func (l *lister) objects(p provider.Provider, c provider.Container, objs []provider.Object) {
+	for _, o := range sorted(objs, func(o provider.Object) string { return o.Name }) {
+		o.Container = c
+		r, err := ref.ForObject(o, "")
+		if err != nil {
+			continue
+		}
+		l.put(p, Entry{Link: r.String(), Kind: strings.ToLower(string(o.Type)), Provider: kindOf(c.Source.Kind),
+			Path: []string{c.Source.Name, c.Name, o.Name}, AccountLabel: accountOf(c.Source),
+			Expires: o.Expires, Enabled: o.Enabled, Reference: o.Reference, URL: o.URL})
+	}
+}
+
+func sourceEntry(src provider.Source) Entry {
+	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src), URL: src.URL}
+	if r, err := ref.ForSource(src); err == nil {
+		e.Link = r.String()
+	}
+	return e
+}
+
+func containerEntry(c provider.Container) Entry {
+	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source), URL: c.URL}
+	if r, err := ref.ForContainer(c, provider.TypeSecret); err == nil {
+		e.Link = r.String()
+	}
+	return e
+}
+
+// put emits e, unless it was already (or emitting has failed). Entries
+// without a link (one couldn't be made) are left out, but not errors.
+func (l *lister) put(p provider.Provider, e Entry) {
+	if (e.Link == "" || !l.wants(e.Kind)) && e.Error == "" {
+		return
+	}
+	e.Account = p.ID()
+	if l.o.Mark != nil && e.Link != "" {
+		m := l.o.Mark(e.Link, e.Account)
+		e.Starred, e.Recent, e.Note = m.Starred, m.Recent, m.Note
+		if m.Recent {
+			e.LastUsed, e.Uses = m.LastUsed, m.Uses
+		}
+	}
+	id := p.ID() + "\x00" + e.Link + "\x00" + e.Error
+	if l.stopped != nil || l.seen[id] {
+		return
+	}
+	l.seen[id] = true
+	l.stopped = l.emit(e)
+}
+
+// wants reports whether any of kinds is listed.
+func (l *lister) wants(kinds ...string) bool {
+	if len(l.o.Kinds) == 0 {
+		return true
+	}
+	for _, k := range kinds {
+		if slices.Contains(l.o.Kinds, k) {
+			return true
+		}
+	}
+	return false
+}
+
+func (l *lister) enqueue(j job) {
+	if l.pending[j.key] || l.failed[j.key] {
+		return
+	}
+	l.pending[j.key] = true
+	l.queue = append(l.queue, j)
+}
+
+func (l *lister) start(ctx context.Context) {
+	for l.stopped == nil && l.active < Workers && len(l.queue) > 0 {
+		j := l.queue[0]
+		l.queue = l.queue[1:]
+		l.active++
+		go func() { l.results <- l.fetch(ctx, j) }()
+	}
+}
+
+func (l *lister) fetch(ctx context.Context, j job) result {
+	kind := j.p.Kind()
+	ctx, cancel := context.WithTimeout(ctx, l.o.Timeout(kind))
+	defer cancel()
+	r := result{job: j}
+	switch {
+	case j.c != nil:
+		r.objects, r.err = j.p.Objects(ctx, *j.c, j.t)
+	case j.src != nil:
+		r.containers, r.err = j.p.Containers(ctx, *j.src)
+	default:
+		r.sources, r.err = j.p.Sources(ctx)
+	}
+	return r
+}
+
+func (l *lister) handle(r result) {
+	delete(l.pending, r.key)
+	now := l.o.Now()
+	if r.err != nil {
+		l.failed[r.key] = true
+		l.put(r.p, r.failed())
+		return
+	}
+	l.loaded = l.loaded || l.cacheable(r.p)
+	cache := l.cacheable(r.p)
+	switch {
+	case r.c != nil:
+		if cache {
+			l.o.Cache.Objects[r.key] = cachefile.Stamped[[]provider.Object]{At: now, Value: r.objects}
+		}
+		l.objects(r.p, *r.c, r.objects)
+	case r.src != nil:
+		r.containers = slices.Clone(r.containers) // the provider's may be shared
+		for i := range r.containers {
+			r.containers[i].Source = *r.src
+		}
+		if cache {
+			l.o.Cache.Containers[r.key] = cachefile.Stamped[[]provider.Container]{At: now, Value: r.containers}
+		}
+		l.containers(r.p, *r.src, r.containers)
+	default:
+		if cache {
+			l.o.Cache.Sources[r.key] = cachefile.Stamped[[]provider.Source]{At: now, Value: r.sources}
+		}
+		for _, src := range r.sources {
+			l.source(r.p, src)
+		}
+	}
+}
+
+// failed is the entry for a list that couldn't be loaded.
+func (r result) failed() Entry {
+	var e Entry
+	switch {
+	case r.c != nil:
+		e = containerEntry(*r.c)
+	case r.src != nil:
+		src := *r.src
+		src.Provider, src.ProviderLabel = r.p.ID(), r.p.Label()
+		e = sourceEntry(src)
+	default:
+		e = Entry{Kind: "source", Provider: kindOf(r.p.Kind()), Path: []string{r.p.Label()}}
+	}
+	e.Error = firstLine(r.err.Error())
+	return e
+}
+
+// firstLine is an error's first line, the summary (Azure's go on with
+// the caller's IDs and more): an entry is one line. Tabs, which would
+// split it into columns, are spaces.
+func firstLine(s string) string {
+	for line := range strings.Lines(s) {
+		if line = strings.TrimSpace(line); line != "" {
+			return strings.ReplaceAll(line, "\t", " ")
+		}
+	}
+	return "unreadable"
+}
+
+func kindOf(k provider.Kind) string { return strings.ToLower(string(k)) }
+
+// accountOf is the account part of a source's provider label ("alice" in
+// "Azure · alice"), or "" when there's a single account.
+func accountOf(src provider.Source) string {
+	account, ok := strings.CutPrefix(src.ProviderLabel, string(src.Kind)+" · ")
+	if !ok {
+		return ""
+	}
+	return account
+}
+
+func sorted[T any](s []T, name func(T) string) []T {
+	s = slices.Clone(s)
+	slices.SortStableFunc(s, func(a, b T) int {
+		return cmp.Compare(strings.ToLower(name(a)), strings.ToLower(name(b)))
+	})
+	return s
+}

internal/listing/listing_test.go

@@ -0,0 +1,297 @@
+package listing
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+)
+
+// counting counts a provider's requests.
+type counting struct {
+	provider.Provider
+	calls atomic.Int32
+}
+
+func (c *counting) Sources(ctx context.Context) ([]provider.Source, error) {
+	c.calls.Add(1)
+	return c.Provider.Sources(ctx)
+}
+
+func (c *counting) Containers(ctx context.Context, src provider.Source) ([]provider.Container, error) {
+	c.calls.Add(1)
+	return c.Provider.Containers(ctx, src)
+}
+
+func (c *counting) Objects(ctx context.Context, ct provider.Container, t provider.ObjectType) ([]provider.Object, error) {
+	c.calls.Add(1)
+	return c.Provider.Objects(ctx, ct, t)
+}
+
+// run lists, returning the entries and, apart, the lists that failed.
+func run(t *testing.T, o Options) ([]Entry, cachefile.File, []Entry) {
+	t.Helper()
+	if o.Cache.Version == 0 {
+		o.Cache = cachefile.New()
+	}
+	o.Timeout = func(provider.Kind) time.Duration { return 5 * time.Second }
+	var got, failed []Entry
+	f, _ := Run(context.Background(), o, func(e Entry) error {
+		if e.Error != "" {
+			failed = append(failed, e)
+		} else {
+			got = append(got, e)
+		}
+		return nil
+	})
+	return got, f, failed
+}
+
+func has(es []Entry, kind, path string) bool {
+	for _, e := range es {
+		if e.Kind == kind && strings.Join(e.Path, "/") == path {
+			return true
+		}
+	}
+	return false
+}
+
+func TestListLoadsAndCaches(t *testing.T) {
+	t.Parallel()
+	az := &counting{Provider: fake.Azure(0)}
+	got, f, errs := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, MaxAge: time.Minute})
+	for _, want := range [][2]string{
+		{"source", "platform-prod"}, {"vault", "platform-prod/kv-app-prod"}, {"secret", "platform-prod/kv-app-prod/db-password"},
+		{"source", "lazysecrets-demo"}, {"secret", "lazysecrets-demo/.env/DATABASE_URL"},
+	} {
+		if !has(got, want[0], want[1]) {
+			t.Errorf("no %s %s", want[0], want[1])
+		}
+	}
+	if len(errs) != 1 || errs[0].Kind != "vault" || errs[0].Path[1] != "kv-restricted" || !strings.Contains(errs[0].Error, "403") || errs[0].Link == "" {
+		t.Errorf("failed = %+v", errs)
+	}
+	seen := map[string]bool{}
+	for _, e := range got {
+		if seen[e.Link] {
+			t.Errorf("%s listed twice", e.Link)
+		}
+		seen[e.Link] = true
+		if e.Provider != "azure" && e.Provider != "repo" {
+			t.Errorf("provider %q", e.Provider)
+		}
+	}
+	for _, e := range got {
+		if e.Kind == "secret" && e.Provider == "azure" && (!strings.HasPrefix(e.Reference, "@Microsoft.KeyVault(") || e.URL == "") {
+			t.Errorf("%s: reference %q, url %q", e.Link, e.Reference, e.URL)
+		}
+	}
+	if len(f.Sources) != 1 || len(f.Containers) == 0 || len(f.Objects) == 0 {
+		t.Errorf("not cached: %d sources, %d containers, %d objects", len(f.Sources), len(f.Containers), len(f.Objects))
+	}
+	for k := range f.Containers {
+		if cachefile.ProviderOf(k) != az.ID() {
+			t.Errorf("cached a repo: %s", k)
+		}
+	}
+
+	// Again with that cache: the same, without asking Azure.
+	before := az.calls.Load()
+	again, _, _ := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, Cache: f, MaxAge: time.Minute})
+	if len(again) != len(got) {
+		t.Errorf("%d entries from the cache, %d loaded", len(again), len(got))
+	}
+	// The vault that couldn't be read wasn't cached: it's asked again.
+	if n := az.calls.Load() - before; n != 1 {
+		t.Errorf("%d requests with a fresh cache, want 1 (kv-restricted)", n)
+	}
+
+	// Stale: loaded again, but each entry is still listed once.
+	before = az.calls.Load()
+	stale, _, _ := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute,
+		Now: func() time.Time { return time.Now().Add(time.Hour) }})
+	if az.calls.Load()-before < 3 {
+		t.Error("stale lists weren't loaded again")
+	}
+	links := map[string]bool{}
+	for _, e := range stale {
+		if links[e.Link] {
+			t.Errorf("%s listed twice", e.Link)
+		}
+		links[e.Link] = true
+	}
+}
+
+func TestListCachedOnly(t *testing.T) {
+	t.Parallel()
+	az := &counting{Provider: fake.Azure(0)}
+	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
+	before := az.calls.Load()
+	got, _, errs := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, Cache: f, Cached: true,
+		Now: func() time.Time { return time.Now().Add(24 * time.Hour) }})
+	if az.calls.Load() != before || len(errs) != 0 {
+		t.Errorf("--cached asked Azure: %d requests, %v", az.calls.Load()-before, errs)
+	}
+	if !has(got, "secret", "platform-prod/kv-app-prod/db-password") || !has(got, "secret", "lazysecrets-demo/.env/DATABASE_URL") {
+		t.Error("cached secrets or repos missing")
+	}
+}
+
+func TestListCachedFirst(t *testing.T) {
+	t.Parallel()
+	az := fake.Azure(0)
+	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
+	// Forget one vault's secrets: they load, after everything cached.
+	var dropped string
+	for k := range f.Objects {
+		if strings.Contains(k, "kv-app-prod") && strings.HasSuffix(k, "|Secret") {
+			dropped = k
+			delete(f.Objects, k)
+			break
+		}
+	}
+	if dropped == "" {
+		t.Fatalf("no kv-app-prod in %v", f.Objects)
+	}
+	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute})
+	last := got[len(got)-1]
+	if last.Kind != "secret" || last.Path[1] != "kv-app-prod" {
+		t.Errorf("last = %+v, want a kv-app-prod secret, loaded after the cache", last)
+	}
+}
+
+func TestListStopsWhenTheReaderGoes(t *testing.T) {
+	t.Parallel()
+	gone := errors.New("broken pipe")
+	n := 0
+	var errs []Entry
+	Run(context.Background(), Options{
+		Providers: []provider.Provider{fake.Azure(0), fake.Repos()}, Cache: cachefile.New(), MaxAge: time.Minute,
+		Timeout: func(provider.Kind) time.Duration { return time.Second },
+	}, func(e Entry) error {
+		if e.Error != "" {
+			errs = append(errs, e)
+		}
+		n++
+		if n == 2 {
+			return gone
+		}
+		return nil
+	})
+	if n != 2 || len(errs) != 0 {
+		t.Errorf("emitted %d after the reader went, errs %v", n, errs)
+	}
+}
+
+func TestListKinds(t *testing.T) {
+	t.Parallel()
+	// Sources only: nothing under them is asked for.
+	az := &counting{Provider: fake.Azure(0)}
+	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute, Kinds: []string{"source"}})
+	if len(got) == 0 || az.calls.Load() != 1 {
+		t.Errorf("%d sources, %d requests, want just the sources'", len(got), az.calls.Load())
+	}
+	for _, e := range got {
+		if e.Kind != "source" {
+			t.Errorf("listed a %s", e.Kind)
+		}
+	}
+	// Keys, asked for: loaded, though Go to wouldn't; no secrets.
+	got, _, failed := run(t, Options{Providers: []provider.Provider{fake.Azure(0)}, MaxAge: time.Minute, Kinds: []string{"key"}})
+	if !has(got, "key", "platform-prod/kv-app-prod/signing-key") {
+		t.Errorf("no keys: %+v", got)
+	}
+	for _, e := range got {
+		if e.Kind != "key" {
+			t.Errorf("listed a %s", e.Kind)
+		}
+	}
+	if len(failed) == 0 {
+		t.Error("a list that failed wasn't listed")
+	}
+}
+
+func TestErrorsAreOneLine(t *testing.T) {
+	for in, want := range map[string]string{
+		"403 Forbidden: Caller is not authorized\nCaller: appid=x;oid=y\nVault: kv;location=z": "403 Forbidden: Caller is not authorized",
+		"\n  timeout\tafter 30s\n": "timeout after 30s",
+		"":                         "unreadable",
+	} {
+		if got := firstLine(in); got != want {
+			t.Errorf("firstLine(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestListMarks(t *testing.T) {
+	t.Parallel()
+	az := fake.Azure(0)
+	var starredLink string
+	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute, Kinds: []string{"secret"},
+		Mark: func(link, account string) Marks {
+			if starredLink == "" && strings.HasSuffix(link, "/db-password") {
+				starredLink = link
+			}
+			if strings.HasSuffix(link, "/api-key") {
+				return Marks{Recent: true, LastUsed: time.Now(), Uses: 3, Note: "rotate in May"}
+			}
+			if strings.HasSuffix(link, "/legacy-token") { // used, but too long ago
+				return Marks{LastUsed: time.Now().AddDate(-2, 0, 0), Uses: 9}
+			}
+			return Marks{Starred: link == starredLink && account == az.ID()}
+		}})
+	var starred, recent int
+	for _, e := range got {
+		if e.Starred {
+			starred++
+			if e.Link != starredLink {
+				t.Errorf("%s starred", e.Link)
+			}
+		}
+		if (e.Note != "") != strings.HasSuffix(e.Link, "/api-key") {
+			t.Errorf("%s: note %q", e.Link, e.Note)
+		}
+		if e.Recent {
+			recent++
+			if e.Uses != 3 || e.LastUsed.IsZero() {
+				t.Errorf("%s: %d uses, last %v", e.Link, e.Uses, e.LastUsed)
+			}
+		} else if e.Uses != 0 || !e.LastUsed.IsZero() {
+			t.Errorf("%s not recent, but %d uses, last %v", e.Link, e.Uses, e.LastUsed)
+		}
+	}
+	if starred != 1 || recent == 0 {
+		t.Errorf("%d starred, %d recent", starred, recent)
+	}
+}
+
+func TestFailedListNotRetried(t *testing.T) {
+	t.Parallel()
+	az := &counting{Provider: fake.Azure(0)}
+	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
+	// Everything stale: sources reload, and their vaults are queued again
+	// as each list arrives. kv-restricted fails once, and isn't asked again.
+	before := az.calls.Load()
+	_, _, failed := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute,
+		Now: func() time.Time { return time.Now().Add(time.Hour) }})
+	if len(failed) != 1 {
+		t.Errorf("failed: %+v", failed)
+	}
+	fresh := &counting{Provider: fake.Azure(0)}
+	run(t, Options{Providers: []provider.Provider{fresh}, MaxAge: time.Minute})
+	if n := az.calls.Load() - before; n > fresh.calls.Load() {
+		t.Errorf("%d requests with a stale cache, more than %d from scratch: something was asked twice", n, fresh.calls.Load())
+	}
+}
+
+func TestRunWithoutTimeout(t *testing.T) {
+	t.Parallel()
+	Run(context.Background(), Options{Providers: []provider.Provider{fake.Repos()}, Cache: cachefile.New()},
+		func(Entry) error { return nil }) // no Timeout: a default, not a panic
+}

internal/provider/azure/azure.go

@@ -299,7 +299,7 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 				if s.ID == nil || deref(s.Managed) {
 					continue
 				}
-				out = append(out, secretObject(c, s))
+				out = append(out, secretObject(c, s, p.tenant(c.Source.ID)))
 			}
 		}
 	case provider.TypeKey:
@@ -392,7 +392,7 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 			}
 			for _, s := range page.Value {
 				if s.ID != nil {
-					out = append(out, secretObject(o.Container, s))
+					out = append(out, secretObject(o.Container, s, p.tenant(o.Container.Source.ID)))
 				}
 			}
 		}
@@ -425,8 +425,13 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	default:
 		return nil, provider.ErrUnsupported
 	}
+	tenant := p.tenant(o.Container.Source.ID)
 	for i := range out {
 		out[i].Reference = versionedReference(out[i])
+		if o.Type != provider.TypeSecret { // secretObject's is the version's already
+			kind := map[provider.ObjectType]string{provider.TypeKey: "Key", provider.TypeCertificate: "Certificate"}[o.Type]
+			out[i].URL = portalAssetURL(tenant, kind, out[i].ID+"/"+out[i].Version) // the version's page
+		}
 	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return b.Updated.Compare(a.Updated) })
 	return out, nil
@@ -453,11 +458,8 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	}
 	switch o.Type {
 	case provider.TypeSecret:
-		resp, err := vc.secrets.GetSecret(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, cleanError(err)
-		}
-		return provider.NewSecretValue([]byte(deref(resp.Value))), nil
+		v, _, err := p.VersionedValue(ctx, o)
+		return v, err
 	case provider.TypeKey:
 		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
 		if err != nil {
@@ -481,7 +483,31 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return provider.SecretValue{}, provider.ErrUnsupported
 }
 
-var _ provider.Locator = (*Provider)(nil)
+// VersionedValue is Value, with the version read.
+func (p *Provider) VersionedValue(ctx context.Context, o provider.Object) (provider.SecretValue, string, error) {
+	if o.Type != provider.TypeSecret {
+		v, err := p.Value(ctx, o)
+		return v, o.Version, err
+	}
+	vc, err := p.clients(o.Container.Detail)
+	if err != nil {
+		return provider.SecretValue{}, "", err
+	}
+	resp, err := vc.secrets.GetSecret(ctx, o.Name, o.Version, nil)
+	if err != nil {
+		return provider.SecretValue{}, "", cleanError(err)
+	}
+	version := o.Version
+	if resp.ID != nil {
+		version = resp.ID.Version()
+	}
+	return provider.NewSecretValue([]byte(deref(resp.Value))), version, nil
+}
+
+var (
+	_ provider.Locator   = (*Provider)(nil)
+	_ provider.Versioned = (*Provider)(nil)
+)
 
 // validHost guards the Resource Graph query against odd input.
 var validHost = regexp.MustCompile(`^[a-z0-9.-]+$`)

internal/provider/azure/azure_test.go

@@ -30,6 +30,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
+	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
@@ -334,6 +335,21 @@ func TestPortalURLs(t *testing.T) {
 	}
 }
 
+func TestSecretPages(t *testing.T) {
+	c := provider.Container{Detail: "https://kv-app.vault.azure.net/"}
+	base := "https://portal.azure.com/#@contoso.onmicrosoft.com/asset/Microsoft_Azure_KeyVault/Secret/https://kv-app.vault.azure.net/secrets/db"
+	for id, want := range map[string]string{
+		"https://kv-app.vault.azure.net/secrets/db":                                  base,                                       // listed: the secret's page
+		"https://kv-app.vault.azure.net/secrets/db/06140fa2b9a64869a96ef040f6d4dcab": base + "/06140fa2b9a64869a96ef040f6d4dcab", // a version's
+	} {
+		sid := azsecrets.ID(id)
+		o := secretObject(c, &azsecrets.SecretProperties{ID: &sid}, "contoso.onmicrosoft.com")
+		if o.URL != want {
+			t.Errorf("%s: %q, want %q", id, o.URL, want)
+		}
+	}
+}
+
 func TestVersionedReference(t *testing.T) {
 	sec := provider.Object{Type: provider.TypeSecret, Version: "v1",
 		Reference: "@Microsoft.KeyVault(SecretUri=https://kv.vault.azure.net/secrets/s)"}

internal/provider/azure/convert.go

@@ -53,8 +53,8 @@ func PortalResourceURL(tenant, resourceID, blade string) string {
 	return portal + tenantPrefix(tenant) + "resource" + resourceID + "/" + blade
 }
 
-// portalAssetURL links to a Key Vault object's page; objectID must include
-// the version.
+// portalAssetURL links to a Key Vault object's page: a version's with
+// one in objectID; a secret's own (its versions) without.
 func portalAssetURL(tenant, kind, objectID string) string {
 	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + kind + "/" + objectID
 }
@@ -88,7 +88,10 @@ func objectURL(c provider.Container, collection, name string) string {
 	return strings.TrimSuffix(c.Detail, "/") + "/" + collection + "/" + name
 }
 
-func secretObject(c provider.Container, p *azsecrets.SecretProperties) provider.Object {
+// secretObject is a secret, or a version of one, from a listing. Its URL
+// is its page in the portal: the secret's (with its versions), or with
+// a version, that version's.
+func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant string) provider.Object {
 	name := p.ID.Name()
 	url := objectURL(c, "secrets", name)
 	o := provider.Object{
@@ -100,7 +103,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties) provider.
 		ContentType: deref(p.ContentType),
 		Tags:        tags(p.Tags),
 		Reference:   "@Microsoft.KeyVault(SecretUri=" + url + ")",
-		URL:         ObjectListURL(c, provider.TypeSecret),
+		URL:         portalAssetURL(tenant, "Secret", strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
 	}
 	if a := p.Attributes; a != nil {
 		o.Enabled, o.Updated, o.Expires = a.Enabled, deref(a.Updated), deref(a.Expires)

internal/provider/fake/fake.go

@@ -134,13 +134,14 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return provider.NewSecretValue([]byte(v)), nil
 }
 
-// Locate finds the source holding the vault (by host) or the workspace.
+// Locate finds the source holding the vault (by host), the workspace or
+// the repo (by its remote).
 func (p *Provider) Locate(ctx context.Context, host string) (string, bool, error) {
 	if err := p.wait(ctx); err != nil {
 		return "", false, err
 	}
 	for _, src := range p.sources {
-		if p.kind == provider.KindDatabricks && src.Detail == host {
+		if (p.kind == provider.KindDatabricks || p.kind == provider.KindRepo) && strings.EqualFold(src.Detail, host) {
 			return src.ID, true, nil
 		}
 		for _, c := range p.containers[src.ID] {
@@ -217,6 +218,19 @@ func (p *Provider) addContainer(src provider.Source, name, detail string, types
 	return c
 }
 
+// Expire sets when the object name in vault expires, for --demo: a date
+// relative to today in the test data would change the tests' screenshots
+// from day to day.
+func (p *Provider) Expire(vault, name string, at time.Time) {
+	for _, objs := range p.objects {
+		for i := range objs {
+			if objs[i].Container.Name == vault && objs[i].Name == name {
+				objs[i].Expires = at
+			}
+		}
+	}
+}
+
 func (p *Provider) add(c provider.Container, t provider.ObjectType, o provider.Object, value string) provider.Object {
 	o.Container = c
 	o.Type = t
@@ -286,9 +300,13 @@ func Azure(delay time.Duration) *Provider {
 		Reference: secretRef("kv-app-prod", "api-key"),
 	}, "sk_live_51HxDEMO0000000000000000")
 	p.add(kv, provider.TypeSecret, provider.Object{
-		Name: "legacy-token", Version: "0c11de", Enabled: &no, Updated: base.AddDate(-1, 0, 0),
-		Reference: secretRef("kv-app-prod", "legacy-token"),
+		Name: "legacy-token", Version: "0c11de", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
+		Expires: base.AddDate(0, -3, 0), Reference: secretRef("kv-app-prod", "legacy-token"),
 	}, "deprecated")
+	p.add(kv, provider.TypeSecret, provider.Object{
+		Name: "smtp-password", Version: "7d2e90", Enabled: &no, Updated: base.AddDate(0, -2, 0),
+		Reference: secretRef("kv-app-prod", "smtp-password"),
+	}, "smtp-demo-password")
 
 	p.add(kv, provider.TypeKey, provider.Object{
 		Name: "signing-key", Version: "5e21b7", Enabled: &yes, Updated: base.AddDate(0, -3, 0),
@@ -331,6 +349,10 @@ func Azure(delay time.Duration) *Provider {
 	}, demoCert)
 
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
+	// A key to share env files with (S → f): random, as sharing.keyRules wants.
+	p.add(shared, provider.TypeSecret, provider.Object{
+		Name: "env-share", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
+	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")
 	p.add(shared, provider.TypeSecret, provider.Object{
 		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
@@ -344,6 +366,19 @@ func Azure(delay time.Duration) *Provider {
 	p.add(kvDev, provider.TypeSecret, provider.Object{
 		Name: "db-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
 	}, "dev-password")
+	// Left behind, as dev vaults are: expired, disabled, or both.
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "stripe-webhook-secret", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
+		Expires: base.AddDate(0, -2, 0), Reference: secretRef("kv-app-dev", "stripe-webhook-secret"),
+	}, "whsec_demo_expired")
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "test-user-password", Enabled: &no, Updated: base.AddDate(0, -5, 0),
+		Reference: secretRef("kv-app-dev", "test-user-password"),
+	}, "disabled-demo-password")
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "vendor-token", Enabled: &no, Updated: base.AddDate(-2, 0, 0),
+		Expires: base.AddDate(-1, 0, 0), Reference: secretRef("kv-app-dev", "vendor-token"),
+	}, "expired-and-disabled")
 
 	return p
 }
@@ -361,6 +396,7 @@ func AzureOps(delay time.Duration) *Provider {
 	breakGlass := p.addContainer(prod, "kv-breakglass", "https://kv-breakglass.vault.azure.net", allTypes...)
 	p.add(breakGlass, provider.TypeSecret, provider.Object{
 		Name: "emergency-admin", Enabled: &yes, Updated: base.AddDate(0, -4, 0),
+		Expires: time.Now().AddDate(0, 0, 5).Truncate(24 * time.Hour), // soon, whenever the demo runs
 		Tags:    map[string]string{"owner": "ops"}, Reference: secretRef("kv-breakglass", "emergency-admin"),
 	}, "break-glass-demo-password")
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
@@ -379,6 +415,12 @@ func AzureOps(delay time.Duration) *Provider {
 	p.add(kv, provider.TypeSecret, provider.Object{
 		Name: "pagerduty-token", Enabled: &yes, Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
 	}, "pd-demo-token")
+	// Expiring soon whenever the demo runs: the other dates are fixed,
+	// and would have passed. Tests use the first account only.
+	p.add(kv, provider.TypeSecret, provider.Object{
+		Name: "grafana-api-key", Enabled: &yes, Updated: base.AddDate(0, -11, 0),
+		Expires: time.Now().AddDate(0, 0, 12).Truncate(24 * time.Hour), Reference: secretRef("kv-ops-tools", "grafana-api-key"),
+	}, "glsa_demo_expiring")
 
 	return p
 }

internal/provider/fake/repos.go

@@ -35,7 +35,7 @@ func Repos() *Provider {
 	// commit are what git says of it: "tracked", "ignored" or "untracked".
 	file := func(src provider.Source, path, method, git, commit string, kv ...string) {
 		sops := method != ""
-		detail := "env · plain text"
+		detail := provider.DetailPlainEnv
 		if sops {
 			detail = "sops · " + method
 		}
@@ -94,7 +94,7 @@ func Repos() *Provider {
 		"database.url", "postgres://app:stg-Pg-2b8d1L@pg-demo-stg:5432/app",
 		"stripe.secret_key", "sk_test_demo_51NxDemoKey0000")
 	file(api, "config/oauth.enc.json", "age", "tracked", "e03b6f1 · 2 months ago",
-		"github.client_secret", "ghs_demo0000000000000000000000",
+		"github.client_secret", "8f3c2a9d7e1b6f4a0c5d2e9b8a7f6c3d1e0b4a5f",
 		"google.client_secret", "GOCSPX-demo-000000000000")
 	file(api, ".env", "", "ignored", "",
 		"DATABASE_URL", "postgres://app:local@localhost:5432/app",
@@ -134,3 +134,18 @@ func format(path string) string {
 	}
 	return "dotenv"
 }
+
+var _ provider.Contents = (*Provider)(nil)
+
+// Contents is a plain env file as KEY=value lines, from its keys, so the
+// demo repos' env files can be shared.
+func (p *Provider) Contents(ctx context.Context, c provider.Container) ([]byte, error) {
+	if c.Detail != provider.DetailPlainEnv {
+		return nil, provider.ErrUnsupported
+	}
+	var b strings.Builder
+	for _, o := range p.objects[listKey{c.ID, provider.TypeSecret}] {
+		b.WriteString(o.Name + "=" + p.values[o.ID] + "\n")
+	}
+	return []byte(b.String()), ctx.Err()
+}

internal/provider/fake/seed.go

@@ -0,0 +1,65 @@
+package fake
+
+import (
+	"cmp"
+	"strings"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+)
+
+// Seed stars, notes and uses a few of the demo's secrets, so --demo
+// shows Favourites (F), Recent (R), notes, and stars in lazysecrets list. alice and
+// admin are the two Azure accounts' provider IDs.
+func Seed(st *store.Store, alice, admin string) {
+	type item struct {
+		link, account, source string
+		name                  string // else the link's last part
+		note                  string
+		path                  []string
+		star                  bool
+		uses                  int
+		ago                   time.Duration
+	}
+	const azure, dbx = "lazysecrets://azure/", "lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/"
+	for _, it := range []item{
+		{link: azure + "kv-app-prod.vault.azure.net/secrets/db-password", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-app-prod"}, star: true, uses: 12, ago: 20 * time.Minute,
+			note: "rotated by the data team each quarter"},
+		{link: azure + "kv-app-prod.vault.azure.net/secrets/api-key", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-app-prod"}, uses: 4, ago: 2 * time.Hour},
+		{link: azure + "kv-breakglass.vault.azure.net/secrets/emergency-admin", account: admin, source: "sub-prod",
+			path: []string{"platform-prod", "kv-breakglass"}, star: true, note: "incidents only: tell #ops when used"},
+		{link: azure + "kv-shared-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-shared-prod"}, uses: 2, ago: 26 * time.Hour},
+		{link: azure + "kv-app-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-app-prod"}, note: "migrated to Microsoft Graph sendMail; delete after Q4"},
+		{link: dbx + "app/storage-key", account: "Databricks", source: "dbx-prod",
+			path: []string{"prod", "app"}, star: true, uses: 3, ago: 5 * time.Hour},
+		// A subscription, for both accounts, and a repo's file.
+		{link: azure + "subscriptions/sub-prod", account: alice, source: "sub-prod",
+			name: "platform-prod", star: true},
+		{link: azure + "subscriptions/sub-prod", account: admin, source: "sub-prod",
+			name: "platform-prod", star: true},
+		{link: "lazysecrets://repo/github.com%2Facme%2Flazysecrets-demo/deploy%2Fprod%2Fsecrets.yaml", account: "Repos",
+			source: "/home/dev/git/lazysecrets-demo", name: "deploy/prod/secrets.yaml",
+			path: []string{"lazysecrets-demo"}, star: true},
+	} {
+		context := func(n *store.Node) {
+			n.Name = cmp.Or(it.name, it.link[strings.LastIndex(it.link, "/")+1:])
+			n.Path, n.Source, n.Account = it.path, it.source, it.account
+		}
+		if it.star || it.note != "" {
+			_ = st.Update(it.link, func(n *store.Node) {
+				context(n)
+				if it.star {
+					n.ToggleStar(it.account)
+				}
+				n.Note = it.note
+			})
+		}
+		for range it.uses {
+			_ = st.Use(it.link, time.Now().Add(-it.ago), context)
+		}
+	}
+}

internal/provider/provider.go

@@ -167,6 +167,13 @@ type Current interface {
 	Current(ctx context.Context) (Source, bool)
 }
 
+// Versioned is implemented by providers whose secrets have versions: it
+// is Value, also returning the version read (the current one when
+// o.Version is empty), so a link can pin it.
+type Versioned interface {
+	VersionedValue(ctx context.Context, o Object) (SecretValue, string, error)
+}
+
 // Locator is implemented by providers that can find where a container lives,
 // to open links. address is a vault host (kv.vault.azure.net) or a
 // workspace host. It returns the ID of the source holding it.
@@ -182,6 +189,12 @@ type Files interface {
 	File(c Container, o *Object) (File, error)
 }
 
+// Contents is implemented by providers whose containers are files, so
+// they can be shared (package share): the file as it is.
+type Contents interface {
+	Contents(ctx context.Context, c Container) ([]byte, error)
+}
+
 // File is a container's file, to open.
 type File struct {
 	Path string
@@ -220,6 +233,10 @@ func (d *Denied) Error() string {
 
 func (d *Denied) Unwrap() error { return d.Err }
 
+// DetailPlainEnv is the Detail of a container that is a plain (not
+// encrypted) env file in a repo.
+const DetailPlainEnv = "env · plain text"
+
 // ContainerDetails is implemented by providers that can say more about a
 // container than its listing does: how a file is encrypted and what git
 // knows of it. ErrUnsupported means there's nothing more for c.

internal/provider/repo/repo.go

@@ -80,6 +80,10 @@ type repoInfo struct {
 	here   bool   // the repo lazysecrets started in
 }
 
+// DefaultRoots are the usual folders of repos, used when the config
+// doesn't set roots. Ones that don't exist cost a stat each.
+var DefaultRoots = []string{"~/git", "~/repo", "~/repos", "~/projects", "~/code", "~/source", "~/src"}
+
 func New(s Settings) *Provider {
 	if s.Sops == "" {
 		s.Sops = "sops"
@@ -116,10 +120,18 @@ func (p *Provider) load() {
 			}
 			add(root)
 		}
+		// Missing roots are skipped (most of the defaults are), and one
+		// that's a symlink to another is scanned once.
+		scanned := map[string]bool{}
 		for _, dir := range p.s.Roots {
-			base, _ := filepath.EvalSymlinks(expandHome(dir))
-			for _, root := range reposIn(expandHome(dir), 2) {
-				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") {
+			base, err := filepath.EvalSymlinks(expandHome(dir))
+			if err != nil || scanned[base] {
+				continue
+			}
+			scanned[base] = true
+			for _, root := range reposIn(base, 2) {
+				// A repo under two roots keeps the first one's name.
+				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") && names[root] == "" {
 					names[root] = filepath.ToSlash(name)
 				}
 				add(root)
@@ -311,8 +323,8 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 			c.Detail = "sops · " + strings.Join(meta.methods, ", ")
 		case isSops:
 			return // a SOPS file where .sops.yaml says SOPS files don't go
-		case isEnv(f):
-			c.Detail = "env · plain text"
+		case IsEnv(f):
+			c.Detail = provider.DetailPlainEnv
 		default:
 			return
 		}
@@ -391,10 +403,11 @@ func (p *Provider) Versions(context.Context, provider.Object) ([]provider.Object
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	file, extract, ok := strings.Cut(o.ID, "\x00")
 	if !ok { // made from a link: the repo's root, the file's path, the key
-		file, extract = o.Container.ID, extractFor(o.Name)
+		file = o.Container.ID
 		if file == "" {
 			file = filepath.Join(o.Container.Source.ID, filepath.FromSlash(o.Container.Name))
 		}
+		extract = extractFor(file, o.Name)
 	}
 	if _, isSops := readMeta(file); !isSops {
 		return plainValue(file, o.Name)
@@ -412,6 +425,15 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return provider.NewSecretValue(stdout.Bytes()), nil
 }
 
+// Contents reads the file c is.
+func (p *Provider) Contents(_ context.Context, c provider.Container) ([]byte, error) {
+	f, err := p.File(c, nil)
+	if err != nil {
+		return nil, err
+	}
+	return os.ReadFile(f.Path)
+}
+
 // File is the file c is, and the line o's key is on.
 func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File, error) {
 	path := c.ID
@@ -464,6 +486,16 @@ func (p *Provider) Locate(_ context.Context, host string) (string, bool, error)
 	return "", false, nil
 }
 
+// Root is the root of the git repo dir is in, and the repo's ID: its
+// remote without scheme or .git (a repo link's host), else the root.
+func Root(dir string) (root, id string, err error) {
+	root, err = gitRoot(dir)
+	if err != nil {
+		return "", "", fmt.Errorf("%s isn't in a git repository", dir)
+	}
+	return root, info(root, "").id, nil
+}
+
 // --- git ---
 
 func gitRoot(dir string) (string, error) {
@@ -568,6 +600,27 @@ func normalizeRemote(remote string) (string, string) {
 type lazysecretsFile struct {
 	Include []string `yaml:"include"`
 	Exclude []string `yaml:"exclude"`
+	Sharing struct {
+		// Key is the link to the secret that encrypts the repo's
+		// shared env files (package share).
+		Key string `yaml:"key"`
+	} `yaml:"sharing"`
+}
+
+// ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
+func ShareKey(root string) (string, error) {
+	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
+	if errors.Is(err, os.ErrNotExist) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	var f lazysecretsFile
+	if err := yaml.Unmarshal(b, &f); err != nil {
+		return "", fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
+	}
+	return f.Sharing.Key, nil
 }
 
 // selector says which files to look at: user (the include/exclude of the
@@ -618,7 +671,7 @@ func envFiles(root string, tracked []string) []string {
 	dirs := map[string]bool{".": true}
 	for _, f := range tracked {
 		isTracked[f] = true
-		if isEnv(f) {
+		if IsEnv(f) {
 			out = append(out, f)
 		}
 		if d := path.Dir(f); !dirs[d] && !inPackages(f) {
@@ -632,7 +685,7 @@ func envFiles(root string, tracked []string) []string {
 		}
 		for _, e := range entries {
 			f := path.Join(d, e.Name())
-			if e.Type().IsRegular() && !isTracked[f] && isEnv(f) {
+			if e.Type().IsRegular() && !isTracked[f] && IsEnv(f) {
 				out = append(out, f)
 			}
 		}
@@ -663,10 +716,10 @@ func inPackages(f string) bool {
 	return false
 }
 
-// isEnv reports whether a file is named like an env file with real values:
+// IsEnv reports whether a file is named like an env file with real values:
 // .env, .env.local, prod.env; not .env.example and the like, nor one in
 // dependencies.
-func isEnv(f string) bool {
+func IsEnv(f string) bool {
 	if inPackages(f) {
 		return false
 	}
@@ -960,7 +1013,7 @@ func formatOf(file string) string {
 }
 
 type key struct {
-	name      string // db.password, list[0]
+	name      string // db.password, list[0], with . [ ] \ in keys escaped
 	extract   string // sops --extract: ["db"]["password"]
 	encrypted bool
 	line      int // 1-based
@@ -1005,7 +1058,7 @@ func parseKeys(file string, b []byte) ([]key, error) {
 					continue
 				}
 				k, v = strings.TrimSpace(k), strings.TrimSpace(v)
-				out = append(out, key{name: section + "." + k, extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
+				out = append(out, key{name: escape(section) + "." + escape(k), extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
 			}
 		}
 		return out, nil
@@ -1022,9 +1075,9 @@ func walk(n *yaml.Node, name, extract string, top bool, out *[]key) {
 			if top && k == "sops" {
 				continue
 			}
-			child := k
+			child := escape(k)
 			if name != "" {
-				child = name + "." + k
+				child = name + "." + child
 			}
 			walk(n.Content[i+1], child, extract+quote(k), false, out)
 		}
@@ -1046,23 +1099,56 @@ func quote(k string) string {
 	return `["` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(k) + `"]`
 }
 
+// escape keeps a key's dots and brackets from reading as nesting in a
+// name: app\.name is one key, app.name two.
+func escape(k string) string {
+	return strings.NewReplacer(`\`, `\\`, `.`, `\.`, `[`, `\[`, `]`, `\]`).Replace(k)
+}
+
 // extractFor rebuilds the extract path from a key name, for objects made
-// from a link (db.password, list[0]). Names with dots in keys can't be
-// told apart from nesting: those come from the listing instead.
-func extractFor(name string) string {
-	var b strings.Builder
-	for _, part := range strings.Split(name, ".") {
-		base, idx, _ := strings.Cut(part, "[")
-		if base != "" {
-			b.WriteString(quote(base))
+// from a link (db.password, list[0], app\.name). A dotenv file is flat:
+// its names are the keys as they are.
+func extractFor(file, name string) string {
+	if formatOf(file) == "dotenv" {
+		return quote(name)
 	}
-		if idx != "" {
-			b.WriteString("[" + idx)
+	var b, part strings.Builder
+	flush := func() {
+		if part.Len() > 0 {
+			b.WriteString(quote(part.String()))
+			part.Reset()
 		}
 	}
+	for i := 0; i < len(name); i++ {
+		switch c := name[i]; c {
+		case '\\':
+			if i+1 < len(name) {
+				i++
+			}
+			part.WriteByte(name[i])
+		case '.':
+			flush()
+		case '[':
+			end := strings.IndexByte(name[i:], ']')
+			if end < 0 || !digits(name[i+1:i+end]) {
+				part.WriteByte(c)
+				continue
+			}
+			flush()
+			b.WriteString(name[i : i+end+1])
+			i += end
+		default:
+			part.WriteByte(c)
+		}
+	}
+	flush()
 	return b.String()
 }
 
+func digits(s string) bool {
+	return s != "" && strings.Trim(s, "0123456789") == ""
+}
+
 func absPath(p string) string {
 	if a, err := filepath.Abs(p); err == nil {
 		return a

internal/provider/repo/repo_test.go

@@ -336,6 +336,30 @@ func TestRoots(t *testing.T) {
 	}
 }
 
+func TestRootsDeduped(t *testing.T) {
+	root, _ := filepath.EvalSymlinks(t.TempDir())
+	os.Rename(gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML}), filepath.Join(root, "infra"))
+	os.MkdirAll(filepath.Join(root, "acme"), 0o755)
+	os.Rename(gitRepo(t, map[string]string{"prod.env": sopsEnv}), filepath.Join(root, "acme", "billing"))
+
+	// ~/src → ~/git, and a root reaching one repo at another depth.
+	links := t.TempDir()
+	alias := filepath.Join(links, "src")
+	os.Symlink(root, alias)
+	missing := filepath.Join(links, "nope")
+	acme := filepath.Join(root, "acme")
+
+	srcs, err := New(Settings{Dir: links, Roots: []string{missing, root, alias, acme}}).Sources(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := names(srcs, func(s provider.Source) string { return s.Name })
+	slices.Sort(got)
+	if !slices.Equal(got, []string{"acme/billing", "infra"}) {
+		t.Errorf("repos: %v, want each once, named from the first root", got)
+	}
+}
+
 func TestStarredReposAlongside(t *testing.T) {
 	here := gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML})
 	starred := gitRepo(t, map[string]string{"prod.env": sopsEnv})
@@ -521,3 +545,24 @@ func TestFileDetails(t *testing.T) {
 		t.Errorf("untracked env: %+v", d)
 	}
 }
+
+func TestKeyNamesEscaped(t *testing.T) {
+	keys, err := parseKeys("s.yaml", []byte("app.name: x\ndb:\n  password: y\nlist: [a, b]\nodd[1]: z\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got []string
+	for _, k := range keys {
+		got = append(got, k.name+" "+k.extract)
+		if e := extractFor("s.yaml", k.name); e != k.extract {
+			t.Errorf("extractFor(%q) = %s, want %s", k.name, e, k.extract)
+		}
+	}
+	want := `app\.name ["app.name"]|db.password ["db"]["password"]|list[0] ["list"][0]|list[1] ["list"][1]|odd\[1\] ["odd[1]"]`
+	if strings.Join(got, "|") != want {
+		t.Errorf("keys = %s\nwant   %s", strings.Join(got, "|"), want)
+	}
+	if e := extractFor(".env", "spring.url"); e != `["spring.url"]` {
+		t.Errorf("dotenv: %s", e)
+	}
+}

internal/ref/read.go

@@ -0,0 +1,103 @@
+package ref
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+// Read reads what r points at without listing its vault: the vault and
+// name are enough for Azure, tried with each account (account, the one
+// that last read it, first, in source); for Databricks and repos the
+// profile or repo is found by its host. It also returns the version read,
+// when the provider tells (provider.Versioned).
+func Read(ctx context.Context, providers []provider.Provider, r Ref, account, source string) (provider.SecretValue, string, error) {
+	if r.IsShare() || r.IsSource() || r.IsContainer() {
+		what := "vault or scope"
+		switch {
+		case r.IsShare():
+			what = "share link"
+		case r.IsSource():
+			what = "subscription or workspace"
+		}
+		return provider.SecretValue{}, "", fmt.Errorf("%s points at a %s, not a secret", r, what)
+	}
+	if r.Kind != provider.KindAzure && r.Host == "" {
+		return provider.SecretValue{}, "", errors.New("{{secrets/…}} names no workspace: use its lazysecrets:// link (s in lazysecrets)")
+	}
+
+	type try struct {
+		p provider.Provider
+		o provider.Object
+	}
+	var tries []try
+	for _, p := range providers {
+		if p.Kind() != r.Kind {
+			continue
+		}
+		o := provider.Object{Name: r.Name, Type: cmp.Or(r.Type, provider.TypeSecret), Version: r.Version}
+		if r.Kind != provider.KindAzure { // by host: workspaces, repos
+			loc, ok := p.(provider.Locator)
+			if !ok {
+				continue
+			}
+			profile, found, err := loc.Locate(ctx, r.Host)
+			if err != nil || !found {
+				continue
+			}
+			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: profile}
+			o.Container = provider.Container{Source: src, Name: r.Scope}
+			// Listing the scopes tells a Key Vault-backed one, whose value
+			// can then be read from the vault if Databricks refuses.
+			if cs, err := p.Containers(ctx, src); err == nil {
+				for _, c := range cs {
+					if c.Name == r.Scope {
+						c.Source = src
+						o.Container = c
+					}
+				}
+			}
+		} else {
+			src := provider.Source{Kind: r.Kind, Provider: p.ID(), ID: source}
+			o.Container = provider.Container{Source: src, Name: r.ContainerName(), Detail: r.VaultURL()}
+		}
+		t := try{p, o}
+		if p.ID() == account {
+			tries = append([]try{t}, tries...)
+		} else {
+			tries = append(tries, t)
+		}
+	}
+	if len(tries) == 0 {
+		switch r.Kind {
+		case provider.KindDatabricks:
+			return provider.SecretValue{}, "", fmt.Errorf("no Databricks profile for workspace %s", r.Host)
+		case provider.KindRepo:
+			return provider.SecretValue{}, "", fmt.Errorf("repo %s isn't here: run it inside the repo, or list it under providers.repos.paths", r.Host)
+		}
+		return provider.SecretValue{}, "", fmt.Errorf("no %s account to read %s with", r.Kind, r)
+	}
+	var errs []error
+	for _, t := range tries {
+		v, version, err := value(ctx, t.p, t.o)
+		if err == nil {
+			return v, version, nil
+		}
+		if len(tries) == 1 || ctx.Err() != nil {
+			return provider.SecretValue{}, "", err
+		}
+		errs = append(errs, fmt.Errorf("%s: %w", t.p.Label(), err))
+	}
+	return provider.SecretValue{}, "", errors.Join(errs...)
+}
+
+func value(ctx context.Context, p provider.Provider, o provider.Object) (provider.SecretValue, string, error) {
+	if vp, ok := p.(provider.Versioned); ok {
+		return vp.VersionedValue(ctx, o)
+	}
+	v, err := p.Value(ctx, o)
+	return v, o.Version, err
+}

internal/ref/ref.go

@@ -10,11 +10,15 @@
 //	lazysecrets://azure/<vault-host>[/<secrets|keys|certificates>[/<name>[/<version>]]]
 //	lazysecrets://databricks/<workspace-host>[/<scope>[/<key>]]
 //	lazysecrets://repo/<repo>[/<file>[/<key>]]
+//	lazysecrets://share/<sealed files>
 //
 // A repo is its git remote without scheme or .git
 // (git.kebcloud.no/keb/infra), the file its path in the repo and the key
 // its path in the file (db.password); slashes inside them are escaped.
 //
+// A share link carries files, encrypted (package share), instead of
+// naming something.
+//
 // Vault hosts always contain dots, so "subscriptions" can't be one.
 //
 // Every path segment is percent-encoded, so names may hold any character.
@@ -49,10 +53,23 @@ type Ref struct {
 	Type    provider.ObjectType
 	Name    string // object name; empty for a container link
 	Version string
+	// Share is a share link's sealed files, as in the link; the other
+	// fields are empty. Package share reads it.
+	Share string
+	// Account, when set, is the provider (its ID) to open or read it
+	// with when several could, from lazysecrets list. It isn't part of
+	// the link.
+	Account string
 }
 
+// IsShare reports whether r is a share link.
+func (r Ref) IsShare() bool { return r.Share != "" }
+
 // IsSource reports whether r points at a subscription or workspace.
 func (r Ref) IsSource() bool {
+	if r.IsShare() {
+		return false
+	}
 	if r.Kind != provider.KindAzure {
 		return r.Scope == ""
 	}
@@ -60,7 +77,7 @@ func (r Ref) IsSource() bool {
 }
 
 // IsContainer reports whether r points at a vault or scope.
-func (r Ref) IsContainer() bool { return r.Name == "" && !r.IsSource() }
+func (r Ref) IsContainer() bool { return r.Name == "" && !r.IsSource() && !r.IsShare() }
 
 // ContainerName is the vault name (from its host) or the scope.
 func (r Ref) ContainerName() string {
@@ -111,6 +128,9 @@ func (r Ref) IdentifierURL() string {
 
 // String is the lazysecrets:// link.
 func (r Ref) String() string {
+	if r.IsShare() {
+		return Scheme + "://share/" + r.Share
+	}
 	if r.Kind == provider.KindAzure && r.Subscription != "" {
 		return Scheme + "://azure/subscriptions/" + url.PathEscape(r.Subscription)
 	}
@@ -208,6 +228,8 @@ var (
 	portalVault = regexp.MustCompile(`(?i)/providers/Microsoft\.KeyVault/vaults/([A-Za-z0-9-]+)`)
 	// …/asset/Microsoft_Azure_KeyVault/<Secret|Key|Certificate>/<identifier URL>
 	portalAsset = regexp.MustCompile(`(?i)/asset/Microsoft_Azure_KeyVault/[A-Za-z]+/(https://\S+)$`)
+	// a share link's sealed files: unpadded base64url
+	sealed = regexp.MustCompile(`^[A-Za-z0-9_-]{16,}$`)
 )
 
 // Parse reads any supported reference.
@@ -238,6 +260,12 @@ func parseLink(s string) (Ref, error) {
 	if err != nil {
 		return Ref{}, err
 	}
+	if strings.EqualFold(u.Host, "share") {
+		if len(segs) != 1 || !sealed.MatchString(segs[0]) {
+			return Ref{}, errors.New("share link is cut short or garbled: copy all of it")
+		}
+		return Ref{Share: segs[0]}, nil
+	}
 	var r Ref
 	if len(segs) == 0 || segs[0] == "" {
 		return Ref{}, errors.New("link has no vault or workspace")
@@ -286,7 +314,7 @@ func parseLink(s string) (Ref, error) {
 		}
 
 	default:
-		return Ref{}, fmt.Errorf("unknown provider %q in link", u.Host)
+		return Ref{}, fmt.Errorf("unknown provider %q in link: a newer lazysecrets may know it (lazysecrets update)", u.Host)
 	}
 	return r, nil
 }

internal/share/rules.go

@@ -0,0 +1,69 @@
+package share
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+)
+
+// Rules are what a key's value must be to share with it: random enough
+// that guessing it is out of reach, since anyone with a link can try.
+type Rules struct {
+	MinLength  int // characters
+	MinClasses int // kinds of character: lowercase, uppercase, digits, symbols
+}
+
+// DefaultRules take a random base64 or hex value (openssl rand -base64
+// 32, or -hex 32) and refuse passwords made up to be remembered.
+var DefaultRules = Rules{MinLength: 32, MinClasses: 2}
+
+// Check reports what key lacks, without showing it.
+func (r Rules) Check(key []byte) error {
+	r = r.withDefaults()
+	s := string(key)
+	var lower, upper, digit, symbol bool
+	for _, c := range s {
+		switch {
+		case unicode.IsLower(c):
+			lower = true
+		case unicode.IsUpper(c):
+			upper = true
+		case unicode.IsDigit(c):
+			digit = true
+		default:
+			symbol = true
+		}
+	}
+	kinds := 0
+	for _, has := range []bool{lower, upper, digit, symbol} {
+		if has {
+			kinds++
+		}
+	}
+	n := len([]rune(s))
+	var has, needs []string
+	if n < r.MinLength {
+		has = append(has, fmt.Sprintf("%d characters", n))
+		needs = append(needs, fmt.Sprintf("%d (minLength)", r.MinLength))
+	}
+	if kinds < r.MinClasses {
+		has = append(has, fmt.Sprintf("%d %s of character", kinds, map[bool]string{true: "kind", false: "kinds"}[kinds == 1]))
+		needs = append(needs, fmt.Sprintf("%d of lowercase, uppercase, digits and symbols (minClasses)", r.MinClasses))
+	}
+	if len(has) == 0 {
+		return nil
+	}
+	return fmt.Errorf("its value has %s; sharing.keyRules needs %s",
+		strings.Join(has, " and "), strings.Join(needs, " and "))
+}
+
+func (r Rules) withDefaults() Rules {
+	if r.MinLength == 0 {
+		r.MinLength = DefaultRules.MinLength
+	}
+	if r.MinClasses == 0 {
+		r.MinClasses = DefaultRules.MinClasses
+	}
+	r.MinLength = max(r.MinLength, MinKey)
+	return r
+}

internal/share/share.go

@@ -0,0 +1,308 @@
+// Package share seals env files into a lazysecrets://share link, so they
+// can be passed on in chat or a ticket. They're encrypted with the value of
+// a secret (in Key Vault, Databricks or a repo's SOPS file): whoever can
+// read that secret can open the link, nobody else.
+//
+// A link says in the clear which secret it's encrypted with, the repo the
+// files are from and how many there are, which is what's needed to open
+// it. The files' paths and contents are encrypted, with age
+// (https://age-encryption.org), the secret's value as its passphrase.
+//
+// The link's payload is unpadded base64url of:
+//
+//	version (1) | uvarint length of the header | header (JSON) | age file
+//
+// The age file holds the files as deflated JSON.
+//
+// A change to the format gets the next version, and Read keeps reading
+// every earlier one: links stay in chat and tickets for years. A
+// version it doesn't know is from a newer lazysecrets.
+package share
+
+import (
+	"bytes"
+	"compress/flate"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"path"
+	"strings"
+	"unicode/utf8"
+
+	"filippo.io/age"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+)
+
+const (
+	// version is the format's, written first; see the package doc.
+	version = 1
+	// MaxLink keeps a link short enough for chat and tickets (Teams takes
+	// about 28 KB) and for passing it to a terminal window.
+	MaxLink = 16 << 10
+	// MinKey is the shortest key the rules can ask for.
+	MinKey = 16
+	// maxUnpacked caps the bytes opening a link unpacks.
+	maxUnpacked = 1 << 20
+)
+
+// workFactor is the scrypt work factor for sealing: 2^15, about 40 ms
+// each way, instead of age's 2^18 (a third of a second). scrypt makes
+// guessing a weak passphrase slow; a key keeping to the rules is random
+// and long enough not to need that. maxWorkFactor is the most opening
+// accepts, so a link can't make it work for minutes.
+var workFactor, maxWorkFactor = 15, 20
+
+// File is a shared file.
+type File struct {
+	Path string // relative to the repo's root, with slashes
+	Data []byte
+}
+
+// Header is what a link says in the clear.
+type Header struct {
+	// Key is the secret whose value the files are encrypted with.
+	Key ref.Ref
+	// Repo is the repo the files are from: its remote without scheme or
+	// .git (a repo link's host).
+	Repo string
+	// Files is how many files the link holds.
+	Files int
+}
+
+// Sealed is a share link read, its files still encrypted.
+type Sealed struct {
+	Header
+	box []byte
+}
+
+type header struct {
+	Key   string `json:"key"`
+	Repo  string `json:"repo,omitempty"`
+	Files int    `json:"files"`
+}
+
+type file struct {
+	Path string `json:"path"`
+	Data string `json:"data"`
+}
+
+// Seal encrypts files with key, the value of h.Key, into a share link,
+// if key keeps to rules (*KeyError if not).
+func Seal(h Header, key []byte, files []File, rules Rules) (ref.Ref, error) {
+	if _, err := ParseKey(h.Key.String()); err != nil {
+		return ref.Ref{}, fmt.Errorf("the key: %w", err)
+	}
+	if err := rules.Check(key); err != nil {
+		return ref.Ref{}, &KeyError{Name: h.Key.Name, Err: err}
+	}
+	if len(files) == 0 {
+		return ref.Ref{}, errors.New("no files to share")
+	}
+	plain := make([]file, len(files))
+	for i, f := range files {
+		if err := CheckPath(f.Path); err != nil {
+			return ref.Ref{}, err
+		}
+		if !utf8.Valid(f.Data) {
+			return ref.Ref{}, fmt.Errorf("%s isn't text", f.Path)
+		}
+		plain[i] = file{Path: f.Path, Data: string(f.Data)}
+	}
+	b, err := json.Marshal(plain)
+	if err != nil {
+		return ref.Ref{}, err
+	}
+
+	rcpt, err := age.NewScryptRecipient(string(key))
+	if err != nil {
+		return ref.Ref{}, err
+	}
+	rcpt.SetWorkFactor(workFactor)
+	var box bytes.Buffer
+	enc, err := age.Encrypt(&box, rcpt)
+	if err != nil {
+		return ref.Ref{}, err
+	}
+	z, _ := flate.NewWriter(enc, flate.BestCompression)
+	if _, err := z.Write(b); err != nil {
+		return ref.Ref{}, err
+	}
+	if err := z.Close(); err != nil {
+		return ref.Ref{}, err
+	}
+	if err := enc.Close(); err != nil {
+		return ref.Ref{}, err
+	}
+
+	hb, err := json.Marshal(header{Key: h.Key.String(), Repo: h.Repo, Files: len(files)})
+	if err != nil {
+		return ref.Ref{}, err
+	}
+	payload := binary.AppendUvarint([]byte{version}, uint64(len(hb)))
+	payload = append(append(payload, hb...), box.Bytes()...)
+	r := ref.Ref{Share: base64.RawURLEncoding.EncodeToString(payload)}
+	if n := len(r.String()); n > MaxLink {
+		return ref.Ref{}, fmt.Errorf("the link would be %d KB, more than the %d KB it can be: share fewer files", n>>10, MaxLink>>10)
+	}
+	return r, nil
+}
+
+// KeyError is a key that can't be used: it can't be read, or doesn't
+// keep to the rules.
+type KeyError struct {
+	Name string // the secret's
+	Err  error
+}
+
+func (e *KeyError) Error() string { return "can't use " + e.Name + ": " + e.Err.Error() }
+func (e *KeyError) Unwrap() error { return e.Err }
+
+// Read reads a share link's header.
+func Read(r ref.Ref) (Sealed, error) {
+	bad := errors.New("share link is cut short or garbled: copy all of it")
+	b, err := base64.RawURLEncoding.DecodeString(r.Share)
+	if err != nil || len(b) < 2 {
+		return Sealed{}, bad
+	}
+	if b[0] != version {
+		return Sealed{}, errors.New("share link is from a newer lazysecrets: update it (lazysecrets update)")
+	}
+	n, size := binary.Uvarint(b[1:])
+	if size <= 0 || n > uint64(len(b)) {
+		return Sealed{}, bad
+	}
+	rest := b[1+size:]
+	if n > uint64(len(rest)) {
+		return Sealed{}, bad
+	}
+	var h header
+	if err := json.Unmarshal(rest[:n], &h); err != nil {
+		return Sealed{}, bad
+	}
+	key, err := ParseKey(h.Key)
+	if err != nil {
+		return Sealed{}, fmt.Errorf("share link's key: %w", err)
+	}
+	return Sealed{Header: Header{Key: key, Repo: h.Repo, Files: h.Files}, box: rest[n:]}, nil
+}
+
+// Open decrypts the files with key, the value of s.Key.
+func (s Sealed) Open(key []byte) ([]File, error) {
+	id, err := age.NewScryptIdentity(string(key))
+	if err != nil {
+		return nil, err
+	}
+	id.SetMaxWorkFactor(maxWorkFactor)
+	dec, err := age.Decrypt(bytes.NewReader(s.box), id)
+	if err != nil {
+		var wrong *age.NoIdentityMatchError
+		if errors.As(err, &wrong) {
+			return nil, s.wrongKey()
+		}
+		return nil, fmt.Errorf("can't decrypt the link: %w", err)
+	}
+	b, err := io.ReadAll(io.LimitReader(flate.NewReader(dec), maxUnpacked+1))
+	if err != nil {
+		return nil, fmt.Errorf("can't decrypt the link: %w", err)
+	}
+	if len(b) > maxUnpacked {
+		return nil, errors.New("the link holds more than lazysecrets unpacks")
+	}
+	var plain []file
+	if err := json.Unmarshal(b, &plain); err != nil {
+		return nil, fmt.Errorf("can't read the link's files: %w", err)
+	}
+	out := make([]File, len(plain))
+	for i, f := range plain {
+		if err := CheckPath(f.Path); err != nil {
+			return nil, err
+		}
+		out[i] = File{Path: f.Path, Data: []byte(f.Data)}
+	}
+	return out, nil
+}
+
+// wrongKey says why the key, read fine, doesn't decrypt the link: its
+// value isn't the one the link was made with.
+func (s Sealed) wrongKey() error {
+	name := s.Key.Name
+	switch {
+	case s.Key.Kind == provider.KindAzure && s.Key.Version != "":
+		// A version's value never changes.
+		return fmt.Errorf("%s at version %s doesn't decrypt it: the link may be damaged", name, s.Key.Version)
+	case s.Key.Kind == provider.KindAzure:
+		return fmt.Errorf("%s's current version isn't the one the link was made with, so it can't decrypt it: ask for a new link", name)
+	}
+	// Databricks secrets and SOPS values are changed in place.
+	return fmt.Errorf("%s has changed since the link was made, so it can't decrypt it: ask for a new link", name)
+}
+
+// CheckPath accepts a path relative to a repo's root, with slashes, of an
+// env file (.env, .env.local, prod.env) outside .git: what a link may
+// write.
+func CheckPath(p string) error {
+	switch {
+	case p == "" || path.IsAbs(p) || strings.ContainsAny(p, "\\\x00") || path.Clean(p) != p ||
+		p == ".." || strings.HasPrefix(p, "../"):
+		return fmt.Errorf("%q isn't a path inside a repo", p)
+	case p == ".git" || strings.HasPrefix(p, ".git/") || strings.Contains(p, "/.git/"):
+		return fmt.Errorf("%q is inside .git", p)
+	case !repo.IsEnv(p):
+		return fmt.Errorf("%q isn't an env file: only those can be shared", p)
+	}
+	return nil
+}
+
+// DefaultKey is the key for a repo's files: sharing.key in the repo's
+// .lazysecrets.yaml, else general (sharing.key in the config). ok is false
+// when neither names one.
+func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
+	link, err := repo.ShareKey(root)
+	if err != nil {
+		return ref.Ref{}, false, err
+	}
+	where := root + "/.lazysecrets.yaml"
+	if link == "" {
+		link, where = general, "the config"
+	}
+	if link == "" {
+		return ref.Ref{}, false, nil
+	}
+	key, err = ParseKey(link)
+	if err != nil {
+		return ref.Ref{}, false, fmt.Errorf("sharing.key in %s: %w", where, err)
+	}
+	return key, true, nil
+}
+
+// ParseKey reads which secret is the key: its lazysecrets:// link, Key
+// Vault URL or @Microsoft.KeyVault(...) reference.
+func ParseKey(s string) (ref.Ref, error) {
+	key, err := ref.Parse(s)
+	if err != nil {
+		return ref.Ref{}, err
+	}
+	switch {
+	case key.IsShare() || key.IsSource() || key.IsContainer() || (key.Type != "" && key.Type != provider.TypeSecret):
+		return ref.Ref{}, fmt.Errorf("%s isn't a secret", s)
+	case key.Kind == provider.KindDatabricks && key.Host == "":
+		return ref.Ref{}, fmt.Errorf("%s names no workspace: use its lazysecrets:// link", s)
+	}
+	return key, nil
+}
+
+// Pin is key at version, the version its value was read at, for Azure,
+// whose old versions stay readable: a link keeps working when the key
+// is rotated, until that version is disabled.
+func Pin(key ref.Ref, version string) ref.Ref {
+	if key.Kind == provider.KindAzure && key.Version == "" {
+		key.Version = version
+	}
+	return key
+}

internal/share/share_test.go

@@ -0,0 +1,258 @@
+package share
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+)
+
+func init() { workFactor = 10 } // fast; opening accepts any up to maxWorkFactor
+
+var (
+	key  = ref.Ref{Kind: provider.KindAzure, Host: "kv-team.vault.azure.net", Type: provider.TypeSecret, Name: "env-share", Version: "91d3e0"}
+	pass = []byte("0123456789abcdef0123456789abcdef")
+)
+
+func TestSealOpen(t *testing.T) {
+	files := []File{
+		{Path: ".env", Data: []byte("DB_PASSWORD=hunter2\n")},
+		{Path: "apps/api/.env.local", Data: []byte("TOKEN=\"a b\" # quoted\n")},
+	}
+	link, err := Seal(Header{Key: key, Repo: "git.example.com/team/app"}, pass, files, Rules{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(link.String(), "hunter2") || strings.Contains(link.String(), "apps") {
+		t.Errorf("link shows what it shares: %s", link)
+	}
+	// It goes through ref.Parse like any link.
+	r, err := ref.Parse(link.String())
+	if err != nil || !r.IsShare() {
+		t.Fatalf("parse: %v, %+v", err, r)
+	}
+	s, err := Read(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Key != key || s.Repo != "git.example.com/team/app" || s.Files != 2 {
+		t.Errorf("header %+v", s.Header)
+	}
+	got, err := s.Open(pass)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 || got[1].Path != files[1].Path || string(got[1].Data) != string(files[1].Data) {
+		t.Errorf("opened %+v", got)
+	}
+	if _, err := s.Open([]byte("another key, long enough to use")); err == nil || !strings.Contains(err.Error(), "env-share at version 91d3e0 doesn't decrypt it") {
+		t.Errorf("wrong key: %v", err)
+	}
+}
+
+func TestWrongKeySaysWhy(t *testing.T) {
+	files := []File{{Path: ".env", Data: []byte("A=1\n")}}
+	for link, want := range map[string]string{
+		"lazysecrets://databricks/adb-1.1.azuredatabricks.net/team/env-share": "env-share has changed since the link was made",
+		"lazysecrets://repo/git.example.com%2Fteam%2Fapp/secrets.yaml/share":  "share has changed since the link was made",
+		"lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share":       "env-share's current version isn't the one the link was made with",
+	} {
+		k, err := ParseKey(link)
+		if err != nil {
+			t.Fatal(err)
+		}
+		r, err := Seal(Header{Key: k}, pass, files, Rules{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		s, _ := Read(r)
+		if _, err := s.Open([]byte("rotated since, and long enough to be a key")); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: %v, want %q", link, err, want)
+		}
+	}
+}
+
+func TestSealRefuses(t *testing.T) {
+	ok := []File{{Path: ".env", Data: []byte("A=1")}}
+	for name, c := range map[string]struct {
+		h     Header
+		pass  []byte
+		files []File
+		want  string
+	}{
+		"short key":    {Header{Key: key}, []byte("short"), ok, "needs 32 (minLength)"},
+		"vault as key": {Header{Key: ref.Ref{Kind: provider.KindAzure, Host: "kv.vault.azure.net"}}, pass, ok, "isn't a secret"},
+		"no files":     {Header{Key: key}, pass, nil, "no files"},
+		"not env":      {Header{Key: key}, pass, []File{{Path: "main.go", Data: []byte("x")}}, "isn't an env file"},
+		"escapes":      {Header{Key: key}, pass, []File{{Path: "../.env", Data: []byte("x")}}, "inside a repo"},
+		"binary":       {Header{Key: key}, pass, []File{{Path: ".env", Data: []byte{0xff, 0xfe}}}, "isn't text"},
+		"too big":      {Header{Key: key}, pass, []File{{Path: ".env", Data: []byte(random(2 * MaxLink))}}, "more than the 16 KB"},
+	} {
+		if _, err := Seal(c.h, c.pass, c.files, Rules{}); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s: %v, want %q", name, err, c.want)
+		}
+	}
+}
+
+// random is text that doesn't compress.
+func random(n int) string {
+	var b strings.Builder
+	x := uint32(1)
+	for b.Len() < n {
+		x ^= x << 13
+		x ^= x >> 17
+		x ^= x << 5
+		b.WriteByte("abcdefghijklmnopqrstuvwxyz0123456789"[x%36])
+	}
+	return b.String()
+}
+
+func TestRules(t *testing.T) {
+	for _, c := range []struct {
+		r    Rules
+		key  string
+		pass bool
+	}{
+		{Rules{}, "q2Hd8bT4Lw1sZp9Kf6Vx3Nc7Rm0Ya5Ue", true},                                 // base64-like, 32
+		{Rules{}, "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", true}, // hex
+		{Rules{}, "correct-horse-battery-staple", false},                                    // 28: short
+		{Rules{}, strings.Repeat("a", 40), false},                                           // one kind
+		{Rules{MinLength: 16, MinClasses: 1}, strings.Repeat("a", 16), true},
+		{Rules{MinLength: 4}, "abc123", false}, // never under MinKey
+		{Rules{MinClasses: 4}, "q2Hd8bT4Lw1sZp9Kf6Vx3Nc7Rm0Ya5Ue", false},
+		{Rules{MinClasses: 4}, "q2Hd8bT4Lw1sZp9Kf6Vx3Nc7Rm0Ya5U+", true},
+	} {
+		if err := c.r.Check([]byte(c.key)); (err == nil) != c.pass {
+			t.Errorf("%+v %q: %v", c.r, c.key, err)
+		} else if err != nil && strings.Contains(err.Error(), c.key) {
+			t.Errorf("the error shows the key: %v", err)
+		}
+	}
+}
+
+func TestReadGarbled(t *testing.T) {
+	link, err := Seal(Header{Key: key}, pass, []File{{Path: ".env", Data: []byte("A=1")}}, Rules{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	cut := ref.Ref{Share: link.Share[:len(link.Share)/2]}
+	s, err := Read(cut)
+	if err == nil {
+		_, err = s.Open(pass)
+	}
+	if err == nil {
+		t.Error("a link cut in half opened")
+	}
+	if _, err := Read(ref.Ref{Share: "AgAAAAAAAAAAAAAAAAAAAA"}); err == nil || !strings.Contains(err.Error(), "newer lazysecrets") {
+		t.Errorf("version 2: %v", err)
+	}
+}
+
+func TestCheckPath(t *testing.T) {
+	for _, p := range []string{".env", "apps/api/.env.local", "prod.env"} {
+		if err := CheckPath(p); err != nil {
+			t.Errorf("%s: %v", p, err)
+		}
+	}
+	for _, p := range []string{"", "/etc/.env", "../.env", "a/../.env", ".git/.env", "a/.git/x.env", `a\.env`, ".env.example", "node_modules/x/.env", "Makefile"} {
+		if err := CheckPath(p); err == nil {
+			t.Errorf("%q accepted", p)
+		}
+	}
+}
+
+func TestPlanWrite(t *testing.T) {
+	dir := t.TempDir()
+	if out, err := exec.Command("git", "-C", dir, "init", "-q").CombinedOutput(); err != nil {
+		t.Skip("git:", string(out))
+	}
+	os.WriteFile(filepath.Join(dir, ".gitignore"), []byte(".env\n"), 0o644)
+	os.WriteFile(filepath.Join(dir, ".env"), []byte("OLD=1\n"), 0o644)
+	targets, err := Plan(dir, []File{
+		{Path: ".env", Data: []byte("NEW=1\n")},
+		{Path: "apps/api/.env.local", Data: []byte("B=2\n")},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !targets[0].Exists || targets[0].Exposed {
+		t.Errorf(".env: %+v", targets[0])
+	}
+	if targets[1].Exists || !targets[1].Exposed {
+		t.Errorf("apps/api/.env.local: %+v", targets[1])
+	}
+	for _, tg := range targets {
+		if err := tg.Write(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if b, _ := os.ReadFile(filepath.Join(dir, ".env")); string(b) != "NEW=1\n" {
+		t.Errorf(".env is %q", b)
+	}
+	info, err := os.Stat(filepath.Join(dir, "apps", "api", ".env.local"))
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Errorf("new file: %v, %v", info.Mode(), err)
+	}
+}
+
+func TestPlanSymlinks(t *testing.T) {
+	dir, outside := t.TempDir(), t.TempDir()
+	if err := os.Symlink(outside, filepath.Join(dir, "apps")); err != nil {
+		t.Skip(err)
+	}
+	if _, err := Plan(dir, []File{{Path: "apps/.env"}}); err == nil || !strings.Contains(err.Error(), "out of the folder") {
+		t.Errorf("through a linked folder: %v", err)
+	}
+	os.Symlink(filepath.Join(outside, "x"), filepath.Join(dir, ".env"))
+	if _, err := Plan(dir, []File{{Path: ".env"}}); err == nil || !strings.Contains(err.Error(), "symlink") {
+		t.Errorf("onto a symlink: %v", err)
+	}
+}
+
+func TestParseKey(t *testing.T) {
+	for _, s := range []string{
+		"lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share",
+		"https://kv-team.vault.azure.net/secrets/env-share",
+		"@Microsoft.KeyVault(VaultName=kv-team;SecretName=env-share)",
+		"lazysecrets://databricks/adb-1.1.azuredatabricks.net/team/env-share",
+	} {
+		if k, err := ParseKey(s); err != nil || k.Name != "env-share" {
+			t.Errorf("%s: %+v, %v", s, k, err)
+		}
+	}
+	for s, want := range map[string]string{
+		"{{secrets/team/env-share}}":                  "names no workspace",
+		"https://kv-team.vault.azure.net/keys/sops":   "isn't a secret",
+		"https://kv-team.vault.azure.net/":            "isn't a secret",
+		"lazysecrets://azure/subscriptions/0000-1111": "isn't a secret",
+	} {
+		if _, err := ParseKey(s); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: %v, want %q", s, err, want)
+		}
+	}
+}
+
+func TestDefaultKey(t *testing.T) {
+	dir := t.TempDir()
+	general := "lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share"
+	k, ok, err := DefaultKey(dir, general)
+	if err != nil || !ok || k.Name != "env-share" {
+		t.Errorf("general: %+v %v %v", k, ok, err)
+	}
+	os.WriteFile(filepath.Join(dir, ".lazysecrets.yaml"), []byte("sharing:\n  key: lazysecrets://azure/kv-app.vault.azure.net/secrets/app-share\n"), 0o644)
+	if k, _, _ := DefaultKey(dir, general); k.Name != "app-share" {
+		t.Errorf("the repo's should win: %+v", k)
+	}
+	if _, ok, _ := DefaultKey(t.TempDir(), ""); ok {
+		t.Error("a key with none set")
+	}
+	unpinned := key
+	unpinned.Version = ""
+	if p := Pin(unpinned, "abc"); p.Version != "abc" {
+		t.Errorf("pin: %+v", p)
+	}
+}

internal/share/write.go

@@ -0,0 +1,87 @@
+package share
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+// Target is where an opened file goes.
+type Target struct {
+	File
+	Abs    string
+	Exists bool
+	// Exposed is set when dir is a git repo that doesn't ignore the file:
+	// its values could end up in a commit.
+	Exposed bool
+}
+
+// Plan says where files go under dir, without writing anything. A path
+// that leads out of dir through a symlink, or is one, is an error.
+func Plan(dir string, files []File) ([]Target, error) {
+	root, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]Target, len(files))
+	for i, f := range files {
+		if err := CheckPath(f.Path); err != nil {
+			return nil, err
+		}
+		t := Target{File: f, Abs: filepath.Join(root, filepath.FromSlash(f.Path))}
+		if err := inside(root, filepath.Dir(t.Abs)); err != nil {
+			return nil, fmt.Errorf("%s: %w", f.Path, err)
+		}
+		switch info, err := os.Lstat(t.Abs); {
+		case err == nil && info.Mode()&fs.ModeSymlink != 0:
+			return nil, fmt.Errorf("%s is a symlink: not writing through it", f.Path)
+		case err == nil && !info.Mode().IsRegular():
+			return nil, fmt.Errorf("%s isn't a file", f.Path)
+		case err == nil:
+			t.Exists = true
+		case !errors.Is(err, fs.ErrNotExist):
+			return nil, err
+		}
+		t.Exposed = exposed(root, f.Path)
+		out[i] = t
+	}
+	return out, nil
+}
+
+// inside checks that dir, or the part of it that exists, is under root
+// once symlinks are followed.
+func inside(root, dir string) error {
+	for {
+		real, err := filepath.EvalSymlinks(dir)
+		if errors.Is(err, fs.ErrNotExist) && dir != root {
+			dir = filepath.Dir(dir) // created when writing
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		if real != root && !strings.HasPrefix(real, root+string(filepath.Separator)) {
+			return errors.New("leads out of the folder through a symlink")
+		}
+		return nil
+	}
+}
+
+// exposed reports whether root is in a git repo that doesn't ignore p.
+func exposed(root, p string) bool {
+	err := exec.Command("git", "-C", root, "check-ignore", "-q", "--", p).Run()
+	var exit *exec.ExitError
+	return errors.As(err, &exit) && exit.ExitCode() == 1 // 0: ignored; 128: no repo
+}
+
+// Write writes the file, readable by the user only when it's new.
+func (t Target) Write() error {
+	if err := os.MkdirAll(filepath.Dir(t.Abs), 0o755); err != nil {
+		return err
+	}
+	return os.WriteFile(t.Abs, t.Data, 0o600)
+}

internal/store/store.go

@@ -43,6 +43,13 @@ type Node struct {
 // alone isn't.
 func (n Node) keep() bool { return len(n.StarredBy) > 0 || n.Note != "" || n.Uses > 0 }
 
+// UsedLately reports whether the item was used within the last 90 days
+// (what Recent lists). Starred and noted records are kept longer, so a
+// use alone doesn't say.
+func (n Node) UsedLately(now time.Time) bool {
+	return !n.LastUsed.IsZero() && now.Sub(n.LastUsed) <= usageMaxAge
+}
+
 // StarredFor reports whether the item is starred for account.
 func (n Node) StarredFor(account string) bool { return slices.Contains(n.StarredBy, account) }
 
@@ -145,16 +152,23 @@ type Store struct {
 	data file
 }
 
+// ErrNewer is a state file written by a newer lazysecrets.
+var ErrNewer = errors.New("written by a newer lazysecrets")
+
 // Load reads path; a missing file is an empty store. path "" gives a store
-// that never saves, for tests and --demo.
+// that never saves, for tests and --demo. A file from a newer lazysecrets
+// is read but never saved, so nothing it keeps is lost: Load returns the
+// store with an ErrNewer error.
 func Load(path string) (*Store, error) {
 	s := &Store{path: path}
 	d, err := read(path)
-	if err != nil {
+	if errors.Is(err, ErrNewer) {
+		s.path = ""
+	} else if err != nil {
 		return nil, err
 	}
 	s.data = d
-	return s, nil
+	return s, err
 }
 
 func read(path string) (file, error) {
@@ -172,12 +186,12 @@ func read(path string) (file, error) {
 	if err := json.Unmarshal(b, &d); err != nil {
 		return d, fmt.Errorf("%s: %w", path, err)
 	}
-	if d.Version > version {
-		return d, fmt.Errorf("%s: written by a newer lazysecrets (version %d)", path, d.Version)
-	}
 	if d.Nodes == nil {
 		d.Nodes = map[string]Node{}
 	}
+	if d.Version > version {
+		return d, fmt.Errorf("%s: %w (version %d)", path, ErrNewer, d.Version)
+	}
 	return d, nil
 }
 

internal/store/store_test.go

@@ -1,6 +1,7 @@
 package store
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -65,11 +66,17 @@ func TestTwoWindowsDontLoseEachOthersChanges(t *testing.T) {
 	}
 }
 
-func TestNewerVersionRefused(t *testing.T) {
+func TestNewerVersionReadOnly(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state.json")
-	_ = os.WriteFile(path, []byte(`{"version": 99, "nodes": {}}`), 0o600)
-	if _, err := Load(path); err == nil {
-		t.Error("a newer file was accepted")
+	newer := `{"version": 99, "nodes": {"one": {"note": "hi"}}}`
+	_ = os.WriteFile(path, []byte(newer), 0o600)
+	s, err := Load(path)
+	if !errors.Is(err, ErrNewer) || s == nil || s.Node("one").Note != "hi" {
+		t.Fatalf("Load = %v, %v", s, err)
+	}
+	_ = s.SetFlag("x", true)
+	if b, _ := os.ReadFile(path); string(b) != newer {
+		t.Errorf("the newer file was overwritten: %s", b)
 	}
 }
 
@@ -112,3 +119,15 @@ func TestStarsPerAccount(t *testing.T) {
 		t.Errorf("unstar alice: %v", n.StarredBy)
 	}
 }
+
+func TestUsedLately(t *testing.T) {
+	now := time.Now()
+	for ago, want := range map[time.Duration]bool{time.Hour: true, 89 * 24 * time.Hour: true, 2 * 365 * 24 * time.Hour: false} {
+		if got := (Node{LastUsed: now.Add(-ago)}).UsedLately(now); got != want {
+			t.Errorf("used %v ago: %v", ago, got)
+		}
+	}
+	if (Node{}).UsedLately(now) {
+		t.Error("never used is lately")
+	}
+}

internal/ui/app/app.go

@@ -24,6 +24,7 @@ import (
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/keys"
@@ -64,6 +65,8 @@ const (
 type Options struct {
 	// Timeout bounds every provider call. Defaults to 30s.
 	Timeout time.Duration
+	// Timeouts override Timeout for the providers of a kind.
+	Timeouts map[provider.Kind]time.Duration
 	// Icons shows Nerd Font glyphs next to backends.
 	Icons bool
 	// Clipboard defaults to the system clipboard, or OSC52 over SSH.
@@ -76,11 +79,19 @@ type Options struct {
 	// and keeps its state, for the status pane.
 	ConfigFiles []string
 	StatePath   string
+	// Warning shows when the window opens: what lazysecrets skipped
+	// instead of failing to start.
+	Warning string
 	// Changelog is CHANGELOG.md, for the status pane.
 	Changelog string
 	// CacheFile keeps what was loaded between runs; "" keeps it for this
 	// run only.
 	CacheFile string
+	// ShareKey is the config's sharing.key: the secret that encrypts shared
+	// env files, for repos whose .lazysecrets.yaml names none.
+	ShareKey string
+	// ShareRules are what a key's value must be to share with it.
+	ShareRules share.Rules
 	// Dir is the folder lazysecrets runs in: it goes back to where it was
 	// left there, unless it was started on a link. "" doesn't.
 	Dir string
@@ -111,15 +122,24 @@ type Options struct {
 	// Keys, if set, replaces the default keymap (keys.Map.Apply).
 	Keys *keys.Map
 	// Updater, if set, finds and installs newer releases (U); with
-	// UpdateCheck, lazysecrets also looks once a day on its own.
+	// UpdateCheck, lazysecrets also looks on its own at startup, at most
+	// once per UpdateEvery (0 for a day).
 	Updater     *Updater
 	UpdateCheck bool
+	UpdateEvery time.Duration
 	// HandlerSetup, if set, offers to set up the link handler at startup.
 	HandlerSetup *HandlerSetup
 	// NoHistory stops counting uses of items for the Recent list.
 	NoHistory bool
+	// RecentIcon marks items used lately with ◷ in the lists
+	// (ui.recentIcon).
+	RecentIcon bool
 	// Open is a reference to open at startup (lazysecrets open <ref>).
 	Open *ref.Ref
+	// OpenAction, if set, is what to do with Open, rather than asking:
+	// go to it, and maybe copy or show its value (OpenActions). It ends in
+	// the list, like Go to, rather than on the details.
+	OpenAction string
 	// Styles, if set, replaces the default theme (styles.FromTheme), and
 	// DefaultFg the terminal's default text colour.
 	Styles    *styles.Styles
@@ -138,7 +158,7 @@ type Clipboard interface {
 type Model struct {
 	providers []provider.Provider
 	byID      map[string]provider.Provider
-	timeout   time.Duration
+	timeout   timeouts
 
 	keys keys.Map
 	st   styles.Styles
@@ -193,6 +213,9 @@ type Model struct {
 	statusW     int // the status pane's width: the left column's, zoomed or not
 	changelog   []panes.Field
 	cacheDirty  bool
+	// cacheDropped are cache keys deleted since the last save, so saving
+	// deletes them from the file too.
+	cacheDropped map[string]bool
 	sourcesAt    map[string]time.Time
 	placeDir     string
 	savedPlace   string // the link last saved as the place
@@ -230,6 +253,7 @@ type Model struct {
 
 	updater      *Updater
 	updateCheck  bool
+	updateEvery  time.Duration
 	fetchOnStart bool            // look for a newer release in Init
 	newer        *update.Release // a newer release to offer
 	updated      string          // the release installed, waiting for a restart
@@ -269,6 +293,11 @@ type Model struct {
 	prompt     *modal               // popup that has the keyboard
 	linked     []provider.Container // vaults opened from links, this session
 	open       *ref.Ref             // reference to open at startup
+	recentIcon bool                 // mark items used lately (◷)
+	openAction string               // and what to do with it, or ask
+
+	shareKey   string      // the config's sharing.key
+	shareRules share.Rules // and sharing.keyRules
 
 	// A lazysecrets:// link found on the clipboard, offered in the footer.
 	dismissedLink string // the last link offered: not offered again
@@ -366,7 +395,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	m := Model{
 		providers:     providers,
 		byID:          map[string]provider.Provider{},
-		timeout:       opts.Timeout,
+		timeout:       timeouts{def: opts.Timeout, byKind: opts.Timeouts},
 		keys:          keys.Default(),
 		st:            styles.Default(),
 		spin:          spinner.New(spinner.WithSpinner(spinner.Dot)),
@@ -398,7 +427,8 @@ func New(providers []provider.Provider, opts Options) Model {
 	if m.store == nil {
 		m.store, _ = store.Load("")
 	}
-	m.sources = newSourcesList(iconSet, m.store)
+	m.recentIcon = opts.RecentIcon
+	m.sources = newSourcesList(iconSet, m.store, m.recentIcon)
 	m.sources.Empty = "no sources found"
 	m.collapsed = map[string]bool{}
 	m.flatSources = opts.FlatSources
@@ -418,7 +448,10 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.revealTimeout, m.hideOnBlur = opts.RevealTimeout, opts.HideOnBlur
 	m.expiryWarning = opts.ExpiryWarning
 	m.handlerSetup = opts.HandlerSetup
-	m.updater, m.updateCheck = opts.Updater, opts.UpdateCheck
+	m.updater, m.updateCheck, m.updateEvery = opts.Updater, opts.UpdateCheck, opts.UpdateEvery
+	if m.updateEvery == 0 {
+		m.updateEvery = updateEvery
+	}
 	m.startUpdateCheck()
 	m.askHandler = opts.HandlerSetup != nil && !m.store.Flag(flagNoHandlerPrompt)
 	m.settle = opts.LoadDelay
@@ -427,7 +460,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	}
 	m.defaultFg = opts.DefaultFg
 	m.help = newHelp(m.st)
-	m.open = opts.Open
+	m.open, m.openAction = opts.Open, opts.OpenAction
 	saved := m.store.Layout()
 	m.split, m.heights = saved.Split, saved.Heights
 
@@ -455,7 +488,11 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.spinning = true
 
 	m.cachePath, m.placeDir, m.sourcesAt = opts.CacheFile, opts.Dir, map[string]time.Time{}
+	m.shareKey, m.shareRules = opts.ShareKey, opts.ShareRules
 	m.configFiles, m.statePath, m.changelog = opts.ConfigFiles, opts.StatePath, changelogFields(opts.Changelog)
+	if opts.Warning != "" {
+		m.flash = warning(opts.Warning)
+	}
 	if m.cachePath != "" {
 		m.loadCacheFile()
 		if len(m.sourceResults) > 0 {
@@ -497,18 +534,26 @@ func (m Model) Init() tea.Cmd {
 		cmds = append(cmds, m.fetchLatest(false))
 	}
 	if m.open != nil {
-		r := *m.open
-		cmds = append(cmds, func() tea.Msg { return openRefMsg{r} })
+		msg := openRefMsg{ref: *m.open, action: m.openAction}
+		cmds = append(cmds, func() tea.Msg { return msg })
 	}
 	return tea.Batch(cmds...)
 }
 
-// openRefMsg starts opening a reference from outside the key handler.
-type openRefMsg struct{ ref ref.Ref }
+// openRefMsg starts opening a reference from outside the key handler:
+// asking what to do with it, or doing action (OpenActions).
+type openRefMsg struct {
+	ref    ref.Ref
+	action string
+}
+
+// OpenActions are what lazysecrets open --action takes, the Open link
+// menu's choices that go there.
+var OpenActions = map[string]linkAction{"go": actGo, "copy": actCopy, "show": actShow}
 
 // OpenLink is a message offering r in the Open link popup, for links
 // handed over by the link handler (Program.Send).
-func OpenLink(r ref.Ref) tea.Msg { return openRefMsg{r} }
+func OpenLink(r ref.Ref) tea.Msg { return openRefMsg{ref: r} }
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	var cmds []tea.Cmd
@@ -565,11 +610,24 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	case openRefMsg:
 		m.deferHandlerSetup() // the link first
+		if act, ok := OpenActions[msg.action]; ok && !msg.ref.IsShare() {
+			cmds = append(cmds, m.findRef(msg.ref, act))
+		} else {
 			cmds = append(cmds, m.offerRef("Open link", msg.ref, false))
+		}
 
 	case resolvedMsg:
 		m.handleResolved(msg)
 
+	case shareFilesMsg:
+		cmds = append(cmds, m.handleShareFiles(msg))
+
+	case sealedMsg:
+		cmds = append(cmds, m.handleSealed(msg))
+
+	case shareOpenedMsg:
+		cmds = append(cmds, m.handleShareOpened(msg))
+
 	case tea.PasteMsg:
 		cmds = append(cmds, m.handlePaste(msg))
 
@@ -633,7 +691,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if src, ok := m.selectedSource(); ok {
 				m.logErrOf(src.Name, msg.err)
 			}
-			delete(m.cache.containers, msg.key)
+			uncache(&m, m.cache.containers, msg.key)
 			m.containers.SetError(msg.err)
 		} else {
 			m.cache.containers[msg.key] = entry[[]provider.Container]{msg.items, m.now()}
@@ -654,18 +712,20 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if c, ok := m.containers.Selected(); ok {
 				m.logErrOf(c.Name, msg.err)
 			}
-			delete(m.cache.objects, msg.key)
+			uncache(&m, m.cache.objects, msg.key)
 			m.secrets.SetError(msg.err)
 		} else {
 			if msg.bound != nil {
 				msg.key = m.rebind(*msg.bound)
 			}
+			before := m.cache.objects[msg.key].value
 			m.cache.objects[msg.key] = entry[[]provider.Object]{msg.items, m.now()}
 			m.cacheDirty = true
 			if m.versionsOf != nil {
 				m.setVersions(msg.items)
 			} else {
 				m.secrets.SetItems(m.starredFirst(msg.items))
+				cmds = append(cmds, m.refreshShown(before))
 			}
 		}
 
@@ -1219,7 +1279,7 @@ func (m *Model) showVersions(o provider.Object, key string) tea.Cmd {
 	}
 	m.secrets.SetLoading()
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, o.Container.Source.Kind)
 	return func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1249,7 +1309,7 @@ func (m *Model) countVersions(o provider.Object) tea.Cmd {
 		}
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotVersions)
+	ctx, req := m.begin(slotVersions, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1400,11 +1460,26 @@ func (m *Model) autoLoad(msg sourcesMsg) tea.Cmd {
 	return m.crawlStart()
 }
 
-// begin starts a cancellable request for pane p, cancelling any in flight.
-func (m *Model) begin(p slot) (context.Context, int) {
+// timeouts bound each provider request: its kind's, else the default.
+type timeouts struct {
+	def    time.Duration
+	byKind map[provider.Kind]time.Duration
+}
+
+// of is how long a request to a provider of kind k may take.
+func (t timeouts) of(k provider.Kind) time.Duration {
+	if d, ok := t.byKind[k]; ok {
+		return d
+	}
+	return t.def
+}
+
+// begin starts a cancellable request for pane p to a provider of kind k,
+// cancelling any in flight.
+func (m *Model) begin(p slot, k provider.Kind) (context.Context, int) {
 	m.cancelReq(p)
 	m.seq++
-	ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+	ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(k))
 	m.reqID[p], m.cancel[p] = m.seq, cancel
 	return ctx, m.seq
 }
@@ -1458,7 +1533,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 	gen := m.sourcesGen
 	var cmds []tea.Cmd
 	for _, p := range m.providers {
-		ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 		cmds = append(cmds, func() tea.Msg {
 			defer cancel()
 			s, err := p.Sources(ctx)
@@ -1469,7 +1544,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 		})
 		// The source it started in, quickly, on its own.
 		if c, ok := p.(provider.Current); ok {
-			ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+			ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 			cmds = append(cmds, func() tea.Msg {
 				defer cancel()
 				src, ok := c.Current(ctx)
@@ -1486,7 +1561,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 
 func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 	p := m.providerFor(src)
-	ctx, req := m.begin(slotContainers)
+	ctx, req := m.begin(slotContainers, src.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Containers(ctx, src)
 		// Carry the source as given, with its provider ID, so later
@@ -1505,7 +1580,7 @@ func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key string) tea.Cmd {
 	cands := m.candidates(c.Source)
 	known := len(cands) == 1 && cands[0].ID() == c.Source.Provider
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, c.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		var errs []error
 		for _, p := range cands {
@@ -1533,7 +1608,7 @@ func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key str
 
 func (m *Model) fetchValue(s provider.Object) tea.Cmd {
 	p := m.providerFor(s.Container.Source)
-	ctx, req := m.begin(slotValue)
+	ctx, req := m.begin(slotValue, s.Container.Source.Kind)
 	m.detail.SetLoading()
 	return func() tea.Msg {
 		v, err := p.Value(ctx, s)
@@ -1552,7 +1627,7 @@ func (m *Model) describe(o provider.Object) tea.Cmd {
 		m.detail.SetDescribing()
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotDescribe)
+	ctx, req := m.begin(slotDescribe, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		obj, err := p.Describe(ctx, o)
 		return describeMsg{req: req, key: key, obj: obj, err: err}
@@ -1580,7 +1655,7 @@ func (m *Model) copyValue() tea.Cmd {
 		return m.copyText(o.Name, v.Reveal(), true)
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotCopy)
+	ctx, req := m.begin(slotCopy, o.Container.Source.Kind)
 	m.flash = flash{text: "copying " + o.Name + "…"}
 	return func() tea.Msg {
 		v, err := p.Value(ctx, o)

internal/ui/app/app_test.go

@@ -536,7 +536,7 @@ func TestBackspaceGoesBack(t *testing.T) {
 	}
 	// While typing a filter, backspace deletes a character instead.
 	d.keys("/")
-	d.typeText("apx")
+	d.typeText("api-x")
 	d.send(tea.KeyPressMsg{Code: tea.KeyBackspace})
 	if !d.m.secrets.Filtering() || d.m.secrets.Len() != 1 {
 		t.Errorf("backspace in filter: filtering=%v visible=%d", d.m.secrets.Filtering(), d.m.secrets.Len())
@@ -666,7 +666,7 @@ func TestFilter(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("api")
+	d.typeText("api-k")
 	if d.m.secrets.Len() != 1 {
 		t.Fatalf("visible = %d, want 1", d.m.secrets.Len())
 	}
@@ -684,9 +684,9 @@ func TestFilter(t *testing.T) {
 	}
 	d.keys("esc") // leave filter mode, clearing the query
 	d.keys("/")
-	d.typeText("api")
+	d.typeText("api-k")
 	d.keys("enter", "esc") // apply, then esc clears the applied filter
-	if d.m.secrets.Len() != 3 {
+	if d.m.secrets.Len() != 4 {
 		t.Errorf("esc should clear the applied filter, visible = %d", d.m.secrets.Len())
 	}
 	if _, _, s := d.selected(); s != "api-key" {
@@ -698,13 +698,13 @@ func TestMoveWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("a") // all three secrets contain an a
-	if d.m.secrets.Len() != 3 {
+	d.typeText("a") // all four secrets contain an a
+	if d.m.secrets.Len() != 4 {
 		t.Fatalf("visible = %d", d.m.secrets.Len())
 	}
 	_, _, initial := d.selected() // kept from before filtering: the middle row
 	var seen []string
-	for _, k := range []rune{'j', 'j', 'k'} {
+	for _, k := range []rune{'j', 'j', 'j', 'k'} {
 		d.send(tea.KeyPressMsg{Code: k, Mod: tea.ModCtrl})
 		_, _, s := d.selected()
 		seen = append(seen, s)
@@ -712,9 +712,9 @@ func TestMoveWhileFiltering(t *testing.T) {
 	if !d.m.secrets.Filtering() {
 		t.Fatal("ctrl+j/k left filter mode")
 	}
-	// down to the bottom, stay there, back up to where it started
-	if seen[0] == initial || seen[1] != seen[0] || seen[2] != initial {
-		t.Errorf("from %q, ctrl+j, ctrl+j, ctrl+k selected %v", initial, seen)
+	// down to the bottom, stay there, back up one
+	if seen[0] == initial || seen[2] != seen[1] || seen[3] != seen[0] {
+		t.Errorf("from %q, ctrl+j ×3, ctrl+k selected %v", initial, seen)
 	}
 	if !strings.Contains(d.screen(), "ctrl+j/n down") {
 		t.Errorf("filter help missing ctrl+j:\n%s", d.screen())
@@ -848,7 +848,7 @@ func TestCopyAndRevealWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("api")
+	d.typeText("api-k")
 	d.send(tea.KeyPressMsg{Code: 'y', Mod: tea.ModCtrl})
 	if d.clip().content != "sk_live_51HxDEMO0000000000000000" {
 		t.Errorf("ctrl+y copied %q", d.clip().content)
@@ -1187,7 +1187,8 @@ func TestDetailsFollowFocus(t *testing.T) {
 func TestStatusLineCountsRepos(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, fake.Azure(0), fake.Repos())
-	if line := strings.Split(d.screen(), "\n")[1]; !strings.Contains(line, "1 account · 3 repos") {
+	// The status line, not the pane, which an expired secret's ⚠ fills.
+	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "1 account · 3 repos") {
 		t.Errorf("status line: %q", line)
 	}
 	d = newDriver(t, fake.Azure(0))
@@ -1202,8 +1203,8 @@ func TestStatusPane(t *testing.T) {
 	d := newDriverOpts(t, Options{Version: "0.1.0", ConfigFiles: []string{"/cfg/config.yaml"}, StatePath: "/state/state.json",
 		OpenURL: func(u string) error { opened = append(opened, u); return nil }},
 		fake.Azure(0), signedOut{fake.Azure(0)})
-	if !strings.Contains(d.screen(), "2 accounts · 1 need sign-in") {
-		t.Errorf("status line:\n%s", d.screen())
+	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "2 accounts · 1 need sign-in") {
+		t.Errorf("status line: %q", line)
 	}
 	d.keys("0")
 	if d.m.focus != paneStatus {
@@ -1303,7 +1304,8 @@ func TestExpiringInStatus(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{ExpiryWarning: 30 * 24 * time.Hour}, fake.Azure(0))
 	d.keys("3", "]", "]") // load kv-app-prod's certificates
-	if !strings.Contains(d.screen(), "⚠ 1 expiring") {
+	// old-tls and legacy-token.
+	if !strings.Contains(d.screen(), "⚠ 2 expiring") {
 		t.Errorf("status line:\n%s", d.screen())
 	}
 	d.keys("0")

internal/ui/app/cache.go

@@ -1,8 +1,12 @@
 package app
 
 import (
+	"maps"
+	"slices"
 	"time"
 
+	tea "charm.land/bubbletea/v2"
+
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
@@ -48,3 +52,44 @@ func (c cache) rememberCursor(parent, child string) {
 		c.cursor[parent] = child
 	}
 }
+
+// refreshShown shows the selected secret's newer metadata when its list
+// reloaded with it changed from before (a cached list refreshed in the
+// background), and describes it afresh: its cached details came from
+// the old listing.
+func (m *Model) refreshShown(before []provider.Object) tea.Cmd {
+	s, ok := m.secrets.Selected()
+	if !ok || m.secrets.SelectedID() != m.selSecret {
+		return nil // a new selection is shown as usual
+	}
+	i := slices.IndexFunc(before, func(o provider.Object) bool { return o.ID == s.ID })
+	if i < 0 || sameListing(before[i], s) {
+		return nil
+	}
+	m.detail.Refresh(s)
+	uncache(m, m.cache.details, detailKey(s))
+	return m.describe(s)
+}
+
+// uncache deletes key from a cache, and, at the next save, from the file.
+func uncache[T any](m *Model, c map[string]entry[T], key string) {
+	if _, ok := c[key]; !ok {
+		return
+	}
+	delete(c, key)
+	if m.cacheDropped == nil {
+		m.cacheDropped = map[string]bool{}
+	}
+	m.cacheDropped[key] = true
+	m.cacheDirty = true
+}
+
+// sameListing reports whether a and b list the same: what a list
+// says of an object, not what describing it adds.
+func sameListing(a, b provider.Object) bool {
+	enabled := func(e *bool) bool { return e == nil || *e }
+	return a.Name == b.Name && a.Version == b.Version && enabled(a.Enabled) == enabled(b.Enabled) &&
+		a.Updated.Equal(b.Updated) && a.Expires.Equal(b.Expires) && a.ContentType == b.ContentType &&
+		maps.Equal(a.Tags, b.Tags) && a.Reference == b.Reference && a.URL == b.URL &&
+		slices.Equal(a.Attrs, b.Attrs)
+}

internal/ui/app/cache_test.go

@@ -2,6 +2,7 @@ package app
 
 import (
 	"context"
+	"slices"
 	"testing"
 	"time"
 
@@ -159,3 +160,33 @@ func TestMovingOnDropsUnsettledLoads(t *testing.T) {
 		t.Errorf("stopping on a subscription: %d calls, want 1", c.containers-before)
 	}
 }
+
+func TestReloadedListRefreshesShownSecret(t *testing.T) {
+	t.Parallel()
+	d, _, clock := newCachingDriver(t)
+	d.keys("3") // kv-app-prod's secrets, db-password selected
+	shown, _ := d.m.detail.Secret()
+	// What an older lazysecrets listed and cached for it.
+	const old = "https://portal.example/old"
+	key := d.m.selContainer
+	e := d.m.cache.objects[key]
+	items := slices.Clone(e.value)
+	for i := range items {
+		if items[i].ID == shown.ID {
+			items[i].URL = old
+		}
+	}
+	d.m.cache.objects[key] = entry[[]provider.Object]{items, e.at}
+	stale := shown
+	stale.URL = old
+	d.m.cache.details[detailKey(shown)] = entry[provider.Object]{stale, *clock}
+
+	// Away and back once the list is stale: it's shown from the cache,
+	// then reloaded, and the details pane follows.
+	d.keys("1", "j")
+	*clock = clock.Add(cacheTTL + time.Second)
+	d.keys("k", "3")
+	if got, _ := d.m.detail.Secret(); got.ID != shown.ID || got.URL == old {
+		t.Errorf("shown %s with %q after the reload", got.Name, got.URL)
+	}
+}

internal/ui/app/commands.go

@@ -165,7 +165,7 @@ func (m *Model) runCommand(c commands.Command, rendered string, obj *provider.Ob
 	o := *obj
 	p := m.providerFor(o.Container.Source)
 	m.flash = flash{text: "fetching " + o.Name + " for " + c.Description + "…"}
-	timeout := m.timeout
+	timeout := m.timeout.of(o.Container.Source.Kind)
 	m.usedObject(o)
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)

internal/ui/app/edit.go

@@ -3,6 +3,7 @@ package app
 import (
 	"cmp"
 	"errors"
+	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -13,9 +14,10 @@ import (
 
 	"git.kebcloud.no/keb/lazysecrets/internal/browser"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 
-// Opening a repo's file (e): SOPS files with sops edit, which decrypts
+// Opening a repo's file (e), or on the status pane the config: SOPS files with sops edit, which decrypts
 // them for the editor and encrypts them again after. Other files, inside
 // nvim: in that nvim, once lazysecrets has quit; else in $VISUAL or
 // $EDITOR, coming back after; else in the system's default app. On a
@@ -24,6 +26,7 @@ import (
 type editDoneMsg struct {
 	c      provider.Container
 	name   string
+	config bool // the config file: read at startup
 	err    error
 }
 
@@ -44,6 +47,8 @@ func (m *Model) edit() tea.Cmd {
 	var c provider.Container
 	var o *provider.Object
 	switch m.focus {
+	case paneStatus: // like lazygit's status panel
+		return m.editConfig()
 	case paneSources:
 		m.flash = warning("select a file to open it")
 		return nil
@@ -93,6 +98,33 @@ func (m *Model) edit() tea.Cmd {
 	return m.openInEditor(f, finished)
 }
 
+// configHeader starts a config file made to be edited.
+const configHeader = "# lazysecrets config: " + update.DefaultRepo + "/src/branch/main/docs/config.md\n"
+
+// editConfig opens the user's config file (the first of them), as e
+// opens a file, making it if it isn't there yet: e on the status pane.
+func (m *Model) editConfig() tea.Cmd {
+	if len(m.configFiles) == 0 {
+		m.flash = warning("no config file")
+		return nil
+	}
+	path := m.configFiles[0]
+	if _, err := os.Stat(path); errors.Is(err, fs.ErrNotExist) {
+		err := os.MkdirAll(filepath.Dir(path), 0o755)
+		if err == nil {
+			err = os.WriteFile(path, []byte(configHeader), 0o644)
+		}
+		if err != nil {
+			m.flash = flash{text: "edit config: " + err.Error(), isErr: true}
+			return nil
+		}
+	}
+	name := filepath.Base(path)
+	return m.openInEditor(provider.File{Path: path}, func(err error) tea.Msg {
+		return editDoneMsg{name: name, config: true, err: err}
+	})
+}
+
 // plusLine are editors that open at a line with +N before the file.
 var plusLine = map[string]bool{
 	"vi": true, "vim": true, "nvim": true, "nano": true, "emacs": true, "emacsclient": true,
@@ -142,6 +174,10 @@ func (m *Model) handleEditDone(msg editDoneMsg) tea.Cmd {
 		m.flash = flash{text: "open " + msg.name + ": " + msg.err.Error(), isErr: true}
 		return nil
 	}
+	if msg.config {
+		m.flash = done("closed " + msg.name + ": restart lazysecrets to use it")
+		return nil
+	}
 	m.flash = done("closed " + msg.name)
 	if c, ok := m.containers.Selected(); ok && containerKey(c) == containerKey(msg.c) {
 		m.hideValue()

internal/ui/app/expiring.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"slices"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
@@ -28,7 +29,7 @@ func (m Model) expiringItems() []expiringItem {
 			row := sourceRowKey(p.ID(), src.ID)
 			for _, c := range m.cache.containers[row].value {
 				for _, t := range c.ObjectTypes() {
-					for _, o := range m.cache.objects[containerKey(c)+"|"+string(t)].value {
+					for _, o := range m.cache.objects[cachefile.ObjectsKey(c, t)].value {
 						if state, _ := m.expiry(o); state != notExpiring {
 							out = append(out, expiringItem{o, row})
 						}

internal/ui/app/expiry.go

@@ -1,9 +1,10 @@
 package app
 
 import (
-	"fmt"
 	"time"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
+
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
@@ -11,28 +12,18 @@ import (
 // list once they have expired (✗ expired) or will within the configured
 // warning period (⚠ 12d), and typing "expir" in the filter finds them.
 
-type expiryState int
+type expiryState = expiry.State
 
 const (
-	notExpiring expiryState = iota
-	expiresSoon
-	expired
+	notExpiring = expiry.None
+	expiresSoon = expiry.Soon
+	expired     = expiry.Expired
 )
 
 // expiry tells whether o has expired or will within the warning period,
 // and how long it has left.
 func (m Model) expiry(o provider.Object) (expiryState, time.Duration) {
-	if o.Expires.IsZero() {
-		return notExpiring, 0
-	}
-	left := o.Expires.Sub(m.now())
-	switch {
-	case left <= 0:
-		return expired, 0
-	case left <= m.expiryWarning:
-		return expiresSoon, left
-	}
-	return notExpiring, left
+	return expiry.Of(o.Expires, m.now(), m.expiryWarning)
 }
 
 // expiryWord is matched by the filter: "expired" or "expiring".
@@ -47,9 +38,4 @@ func (m Model) expiryWord(o provider.Object) string {
 }
 
 // daysLeft is a short "12d", or "5h" on the last day.
-func daysLeft(d time.Duration) string {
-	if d < 24*time.Hour {
-		return fmt.Sprintf("%dh", max(1, int(d.Hours())))
-	}
-	return fmt.Sprintf("%dd", int(d.Hours()/24))
-}
+func daysLeft(d time.Duration) string { return expiry.Left(d) }

internal/ui/app/favourites.go

@@ -3,9 +3,11 @@ package app
 import (
 	"slices"
 	"strings"
+	"time"
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
@@ -19,6 +21,22 @@ import (
 
 const star = "★ "
 
+// recentMark marks items used lately (Recent), with ui.recentIcon.
+const recentMark = "◷ "
+
+// marks is what goes before a list row's name: ★ when it's starred for
+// account and, with recent, ◷ when it was used lately.
+func marks(st styles.Styles, n store.Node, account string, recent bool, now time.Time) string {
+	var s string
+	if n.StarredFor(account) {
+		s = st.Favourite.Render(star)
+	}
+	if recent && n.UsedLately(now) {
+		s += st.Muted.Render(recentMark)
+	}
+	return s
+}
+
 func sourceKey(s provider.Source) string {
 	if r, err := ref.ForSource(s); err == nil {
 		return r.String()
@@ -94,9 +112,7 @@ func (m Model) containerRender(withSource bool) func(styles.Styles, provider.Con
 			}
 			line += sty.Muted.Render("  " + c.Detail)
 		}
-		if n.StarredFor(c.Source.Provider) {
-			line = sty.Favourite.Render(star) + line
-		}
+		line = marks(sty, n, c.Source.Provider, m.recentIcon, m.now()) + line
 		if withSource {
 			src := c.Source.Name
 			if account, ok := strings.CutPrefix(c.Source.ProviderLabel, string(c.Source.Kind)+" · "); ok {
@@ -116,9 +132,7 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 		if o.Enabled != nil && !*o.Enabled {
 			line = sty.Muted.Render(o.Name + " (disabled)")
 		}
-		if n.StarredFor(o.Container.Source.Provider) {
-			line = sty.Favourite.Render(star) + line
-		}
+		line = marks(sty, n, o.Container.Source.Provider, m.recentIcon, m.now()) + line
 		switch state, left := m.expiry(o); state {
 		case expired:
 			line += " " + sty.Error.Render("✗ expired")
@@ -167,7 +181,7 @@ func (m *Model) rebind(c provider.Container) string {
 			m.linked[i].Source = c.Source
 		}
 	}
-	key := containerKey(c) + "|" + string(m.objType)
+	key := cachefile.ObjectsKey(c, m.objType)
 	if m.onLinks() {
 		m.containers.SetItems(m.linked)
 		m.containers.Select(containerKey(c))

internal/ui/app/favourites_test.go

@@ -6,6 +6,7 @@ import (
 	"slices"
 	"strings"
 	"testing"
+	"time"
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
@@ -394,7 +395,7 @@ func TestStarWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	for _, r := range "api" {
+	for _, r := range "api-k" {
 		d.send(tea.KeyPressMsg{Code: r, Text: string(r)})
 	}
 	d.send(tea.KeyPressMsg{Code: 'f', Mod: tea.ModCtrl})
@@ -434,3 +435,20 @@ func TestStarIsPerAccount(t *testing.T) {
 		t.Errorf("favourites should list alice's star only: %q", labels)
 	}
 }
+
+func TestRecentIcon(t *testing.T) {
+	t.Parallel()
+	mem, _ := store.Load("")
+	_ = mem.Use("lazysecrets://azure/"+kv+"/secrets/api-key", time.Now(), func(*store.Node) {})
+	d := newDriverOpts(t, Options{Store: mem, RecentIcon: true})
+	d.keys("3")
+	scr := d.screen()
+	if !strings.Contains(scr, "◷ api-key") || strings.Contains(scr, "◷ db-password") {
+		t.Errorf("want ◷ on api-key only:\n%s", scr)
+	}
+	off := newDriverOpts(t, Options{Store: mem})
+	off.keys("3")
+	if strings.Contains(off.screen(), "◷") {
+		t.Errorf("◷ without ui.recentIcon:\n%s", off.screen())
+	}
+}

internal/ui/app/fields.go

@@ -8,6 +8,7 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
 )
@@ -160,7 +161,7 @@ func (m Model) containerFields(c provider.Container) []panes.Field {
 	add("source", cmpOr(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
 	add("web", c.URL)
 	for _, t := range c.ObjectTypes() {
-		if e, ok := m.cache.objects[containerKey(c)+"|"+string(t)]; ok {
+		if e, ok := m.cache.objects[cachefile.ObjectsKey(c, t)]; ok {
 			add(strings.ToLower(string(t))+"s", fmt.Sprint(len(e.value)))
 		}
 	}
@@ -196,7 +197,7 @@ func (m *Model) loadDetails(c provider.Container) tea.Cmd {
 		}
 	}
 	m.details[key] = detailsState{loading: true}
-	ctx, req := m.begin(slotDetails)
+	ctx, req := m.begin(slotDetails, c.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		attrs, err := d.Details(ctx, c)
 		if ctx.Err() != nil {

internal/ui/app/help.go

@@ -54,7 +54,8 @@ func (c contextHelp) ShortHelp() []key.Binding {
 	switch {
 	case c.focus == paneStatus:
 		details := key.NewBinding(key.WithKeys(k.Enter.Keys()...), key.WithHelp(k.Enter.Help().Key, "details"))
-		return append(b, details, k.Update, k.Help, k.Quit)
+		config := key.NewBinding(key.WithKeys(k.Edit.Keys()...), key.WithHelp(k.Edit.Help().Key, "edit config"))
+		return append(b, details, config, k.Update, k.Help, k.Quit)
 	case c.focus == paneDetail && c.account && c.of == paneStatus:
 		open := key.NewBinding(key.WithKeys(k.Open.Keys()...), key.WithHelp(k.Open.Help().Key, "open link"))
 		return append(b, k.Up, k.Down, copyField, open, k.Edit, k.Filter, k.Help, k.Quit)

internal/ui/app/jump.go

@@ -47,6 +47,7 @@ func (m *Model) storeEntries() (favs, recent []option) {
 			out = append(out, entry{depth, sort, option{
 				label: m.pathLabel(r.Kind, path, account), note: n.Note, mark: " ",
 				id: prefix + key + "|" + acct, star: key, starAccount: acct, starred: n.StarredFor(acct),
+				plain: m.inPlainEnv(r),
 				run: func(m *Model) tea.Cmd {
 					m.used(key)
 					return run(m)
@@ -106,7 +107,7 @@ func (m *Model) storeEntries() (favs, recent []option) {
 	if m.history {
 		var used []string
 		for _, k := range keys {
-			if !nodes[k].LastUsed.IsZero() {
+			if nodes[k].UsedLately(m.now()) {
 				used = append(used, k)
 			}
 		}
@@ -138,6 +139,30 @@ func (m Model) pathLabel(kind provider.Kind, path []string, account string) stri
 	return label
 }
 
+// inPlainEnv reports whether r is a key in a plain env file, as far as
+// the files loaded tell.
+func (m Model) inPlainEnv(r ref.Ref) bool {
+	if r.Kind != provider.KindRepo || r.Name == "" {
+		return false
+	}
+	file := r
+	file.Name, file.Type = "", ""
+	for _, e := range m.cache.containers {
+		for _, c := range e.value {
+			if c.Detail == provider.DetailPlainEnv && storeKey(c) == file.String() {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// repoLabel draws a repo, or a file in it, as everywhere else: the repo
+// icon and colour, "app / apps/api/.env".
+func (m Model) repoLabel(repo string, file ...string) string {
+	return m.pathLabel(provider.KindRepo, append([]string{repo}, file...), "")
+}
+
 // sourceMatches reports whether src is the subscription or workspace r
 // links to.
 func sourceMatches(r ref.Ref, src provider.Source) bool {
@@ -192,7 +217,7 @@ func (m *Model) jumpTo(r ref.Ref, n store.Node) tea.Cmd {
 	case 1:
 		m.startNav(r, actGo, choices[0].sourceRow)
 	default:
-		m.chooseSource("Several accounts can see "+r.ContainerName(), r, actGo, choices)
+		m.chooseSource("Several accounts can see "+r.ContainerName(), r, actGo, choices, false)
 	}
 	return nil
 }

internal/ui/app/links.go

@@ -46,6 +46,9 @@ type nav struct {
 	// quiet gives up without a word: going back to where lazysecrets
 	// was left, which may be gone.
 	quiet bool
+	// link ends on the object's details, as enter on it would: opening
+	// a link to it opens it, rather than just finding it in its list.
+	link bool
 }
 
 type resolvedMsg struct {
@@ -53,6 +56,9 @@ type resolvedMsg struct {
 	act       linkAction
 	sourceRow string
 	others    []string // other accounts' rows that also found the vault
+	// find ends in the list, like Go to, not on the details: opened by a
+	// tool that found it (lazysecrets open --action, from fzf).
+	find    bool
 	choices []choice // several candidates: ask
 	linked  *provider.Container
 	err     error
@@ -78,6 +84,9 @@ const (
 // just open it.
 // With ask false, vault and scope links open straight away.
 func (m *Model) offerRef(title string, r ref.Ref, ask bool) tea.Cmd {
+	if r.IsShare() {
+		return m.offerShare(r)
+	}
 	if r.IsContainer() || r.IsSource() {
 		if !ask {
 			return m.openRef(r, actGo)
@@ -152,7 +161,7 @@ func (m *Model) copyFromRef(r ref.Ref) tea.Cmd {
 		m.flash = flash{text: "copy: no account or profile for " + describeRef(r), isErr: true}
 		return nil
 	}
-	ctx, req := m.begin(slotCopy)
+	ctx, req := m.begin(slotCopy, r.Kind)
 	m.flash = flash{text: "copying " + r.Name + "…"}
 	return func() tea.Msg {
 		var errs []error
@@ -212,6 +221,9 @@ func (m *Model) openSource(r ref.Ref) {
 			}
 		}
 	}
+	if row, ok := preferredRow(r, choices); ok {
+		choices = []choice{{sourceRow: row}}
+	}
 	switch len(choices) {
 	case 0:
 		m.flash = flash{text: "open: " + describeRef(r) + " isn't in your sources", isErr: true}
@@ -398,23 +410,71 @@ func (m *Model) handleResolved(msg resolvedMsg) {
 		for i := range msg.choices {
 			msg.choices[i].label = "Open in " + msg.choices[i].label
 		}
-		m.chooseSource("Scope "+msg.ref.Scope+" is in several workspaces", msg.ref, msg.act, msg.choices)
+		m.chooseSource("Scope "+msg.ref.Scope+" is in several workspaces", msg.ref, msg.act, msg.choices, !msg.find)
 	case len(msg.others) > 0:
 		var choices []choice
 		for _, row := range append([]string{msg.sourceRow}, msg.others...) {
 			choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
 		}
-		m.chooseSource("Several accounts can see "+msg.ref.ContainerName(), msg.ref, msg.act, choices)
+		if row, ok := preferredRow(msg.ref, choices); ok {
+			m.navResolved(msg, row)
+			return
+		}
+		m.chooseSource("Several accounts can see "+msg.ref.ContainerName(), msg.ref, msg.act, choices, !msg.find)
 	case msg.linked != nil:
 		m.addLinked(*msg.linked)
-		m.startNav(msg.ref, msg.act, linksRowID)
+		m.navResolved(msg, linksRowID)
 	default:
-		m.startNav(msg.ref, msg.act, msg.sourceRow)
+		m.navResolved(msg, msg.sourceRow)
 	}
 }
 
+// preferredRow is the choice under the account the reference asks for
+// (ref.Ref.Account), if it's one of them.
+func preferredRow(r ref.Ref, choices []choice) (string, bool) {
+	for _, c := range choices {
+		if r.Account != "" && providerOf(c.sourceRow) == r.Account {
+			return c.sourceRow, true
+		}
+	}
+	return "", false
+}
+
+// navResolved goes to what a resolved link points at, under row.
+func (m *Model) navResolved(msg resolvedMsg, row string) {
+	if msg.find {
+		m.startNav(msg.ref, msg.act, row)
+		return
+	}
+	m.startLinkNav(msg.ref, msg.act, row)
+}
+
+// findRef is openRef ending in the list, like Go to: for a link a tool
+// found (lazysecrets open --action).
+func (m *Model) findRef(r ref.Ref, act linkAction) tea.Cmd {
+	cmd := m.openRef(r, act)
+	if cmd == nil {
+		return nil
+	}
+	return func() tea.Msg {
+		msg := cmd()
+		if rm, ok := msg.(resolvedMsg); ok {
+			rm.find = true
+			return rm
+		}
+		return msg
+	}
+}
+
+// startLinkNav opens a link: like startNav, ending on its object's
+// details.
+func (m *Model) startLinkNav(r ref.Ref, act linkAction, sourceRow string) {
+	m.startNav(r, act, sourceRow)
+	m.nav.link = true
+}
+
 // chooseSource asks where to open r.
-func (m *Model) chooseSource(title string, r ref.Ref, act linkAction, choices []choice) {
+func (m *Model) chooseSource(title string, r ref.Ref, act linkAction, choices []choice, link bool) {
 	var opts []option
 	for i, c := range choices {
 		key := ""
@@ -424,6 +484,7 @@ func (m *Model) chooseSource(title string, r ref.Ref, act linkAction, choices []
 		row := c.sourceRow
 		opts = append(opts, option{key: key, label: c.label, run: func(m *Model) tea.Cmd {
 			m.startNav(r, act, row)
+			m.nav.link = link
 			return nil
 		}})
 	}
@@ -574,6 +635,9 @@ func (m *Model) advanceNav() bool {
 				m.pendingCmd = m.toggleReveal()
 			}
 		}
+		if n.link {
+			m.focus = paneDetail // after: copying acts on the focused pane
+		}
 		return true
 	}
 	return false
@@ -607,6 +671,9 @@ func (m *Model) share(menu bool) tea.Cmd {
 		if s.URL != "" {
 			opts = append(opts, option{key: "b", label: webLabel(s.Kind), run: share("b")})
 		}
+		if m.canShareFiles(s) {
+			opts = append(opts, option{key: "f", label: "Encrypted link to its env files", run: func(m *Model) tea.Cmd { return m.shareFiles(s, nil) }})
+		}
 		m.showMenu("Share "+s.Name, nil, opts)
 	case paneContainers:
 		c, ok := m.containers.Selected()
@@ -629,6 +696,11 @@ func (m *Model) share(menu bool) tea.Cmd {
 		if c.URL != "" {
 			opts = append(opts, option{key: "b", label: webLabel(c.Source.Kind), run: share("b")})
 		}
+		if c.Detail == provider.DetailPlainEnv && m.canShareFiles(c.Source) {
+			opts = append(opts, option{key: "f", label: "Encrypted link to the file", run: func(m *Model) tea.Cmd {
+				return m.shareFiles(c.Source, []provider.Container{c})
+			}})
+		}
 		m.showMenu("Share "+c.Name, nil, opts)
 	default:
 		o, ok := m.detail.Secret()
@@ -653,6 +725,11 @@ func (m *Model) share(menu bool) tea.Cmd {
 		if o.URL != "" {
 			opts = append(opts, option{key: "b", label: webLabel(o.Container.Source.Kind), run: share("b")})
 		}
+		if c := o.Container; c.Detail == provider.DetailPlainEnv && m.canShareFiles(c.Source) {
+			opts = append(opts, option{key: "f", label: "Encrypted link to its file", run: func(m *Model) tea.Cmd {
+				return m.shareFiles(c.Source, []provider.Container{c})
+			}})
+		}
 		m.showMenu("Share "+o.Name, nil, opts)
 	}
 	return nil
@@ -802,6 +879,9 @@ func (m *Model) openText(s string) tea.Cmd {
 
 // handlePaste opens a pasted reference, unless a text input has focus.
 func (m *Model) handlePaste(msg tea.PasteMsg) tea.Cmd {
+	if m.search != nil && m.search.picker != nil {
+		return m.pickPasted(msg.Content) // a reference to the secret
+	}
 	if p := m.prompt; p != nil && p.input != nil {
 		in, cmd := p.input.Update(msg)
 		p.input = &in

internal/ui/app/links_test.go

@@ -40,7 +40,8 @@ func TestOpenSecretLink(t *testing.T) {
 	if src, c, s := d.selected(); src != "platform-prod" || c != "kv-app-prod" || s != "api-key" {
 		t.Fatalf("opened %s/%s/%s", src, c, s)
 	}
-	if d.m.focus != paneSecrets || d.m.detail.State() != panes.ValueHidden {
+	// Opened: on its details, as enter on it would; its value hidden.
+	if d.m.focus != paneDetail || d.m.detail.State() != panes.ValueHidden {
 		t.Errorf("focus %d, value state %d", d.m.focus, d.m.detail.State())
 	}
 }
@@ -180,7 +181,7 @@ func TestPasteWhileFilteringFilters(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.send(tea.PasteMsg{Content: "api"})
+	d.send(tea.PasteMsg{Content: "api-k"})
 	if d.m.secrets.Len() != 1 || d.m.nav != nil {
 		t.Errorf("paste in filter: visible %d", d.m.secrets.Len())
 	}
@@ -202,8 +203,21 @@ func TestOpenPromptAndStartupOpen(t *testing.T) {
 		t.Fatal("open at startup didn't ask what to do")
 	}
 	d2.keys("o")
-	if _, _, s := d2.selected(); s != "api-key" {
-		t.Errorf("open at startup: selected %q", s)
+	if _, _, s := d2.selected(); s != "api-key" || d2.m.focus != paneDetail {
+		t.Errorf("open at startup: selected %q, focus %v, want the details", s, d2.m.focus)
+	}
+
+	// --action: no question, it does that.
+	d3 := newDriverOpts(t, Options{Open: &r, OpenAction: "go"})
+	if d3.m.prompt != nil {
+		t.Fatalf("--action go asked: %q", d3.m.prompt.title)
+	}
+	if _, _, s := d3.selected(); s != "api-key" || d3.m.focus != paneSecrets {
+		t.Errorf("--action go: selected %q, focus %v, want the secrets list, like Go to", s, d3.m.focus)
+	}
+	d4 := newDriverOpts(t, Options{Open: &r, OpenAction: "copy"})
+	if _, _, s := d4.selected(); s != "api-key" || d4.clip().content == "" {
+		t.Errorf("--action copy: selected %q, copied %q", s, d4.clip().content)
 	}
 }
 
@@ -304,6 +318,20 @@ func TestOpenAsksWhichAccount(t *testing.T) {
 		t.Errorf("j enter picked %q", c.Source.Provider)
 	}
 
+	// lazysecrets open --account: no question, that account.
+	r, _ := ref.Parse("lazysecrets://azure/" + kv + "/secrets/api-key")
+	r.Account = "Azure:bob@example.com/t1"
+	d.send(OpenLink(r))
+	if d.m.prompt != nil && d.m.prompt.title == "Open link" {
+		d.keys("o")
+	}
+	if strings.Contains(d.screen(), "Several accounts can see") {
+		t.Fatalf("asked, with an account given:\n%s", d.screen())
+	}
+	if c, _ := d.m.containers.Selected(); c.Source.Provider != r.Account {
+		t.Errorf("--account opened via %q", c.Source.Provider)
+	}
+
 	// Opening into a folded account unfolds it.
 	d.keys("1", "g") // alice's header
 	d.keys("enter")  // fold it

internal/ui/app/modal.go

@@ -1,9 +1,11 @@
 package app
 
 import (
+	"cmp"
 	"fmt"
 	"slices"
 	"strings"
+	"unicode"
 	"unicode/utf8"
 
 	"charm.land/bubbles/v2/key"
@@ -40,6 +42,7 @@ type option struct {
 	group  string        // the source row it's in (search)
 	kind   provider.Kind // the kind of provider it's from (search)
 	hits   []int         // characters of the label the filter matched (Go to)
+	plain  bool          // a key in a plain env file: no key to encrypt with (Go to)
 	run    func(m *Model) tea.Cmd
 	// header makes this a section title: not selectable, and hidden
 	// while a filter narrows the list.
@@ -53,9 +56,13 @@ type modal struct {
 	options []option
 	cursor  int
 
-	// A text input instead of options; submit runs on enter.
+	// A text input instead of options; submit runs on enter (named
+	// submitLabel in the footer; "open" if empty). err says why the last
+	// one wasn't taken, under the input.
 	input       *textinput.Model
 	submit      func(m *Model, text string) tea.Cmd
+	submitLabel string
+	err         string
 
 	// A filter over the options: typing narrows them (all holds them
 	// all), so moving uses arrows or ctrl+j/k.
@@ -259,7 +266,10 @@ func (m Model) modalView() string {
 	foot := footer(move(km.MenuUp, km.MenuDown), hint(km.MenuSelect, "select"), hint(km.MenuClose, "dismiss"))
 	if p.input != nil {
 		body = append(body, " "+p.input.View())
-		foot = footer(hint(km.PopupSelect, "open"), hint(km.PopupClose, "cancel"))
+		if p.err != "" {
+			body = append(body, "", " "+m.st.Error.Render("✗ "+capitalize(p.err)))
+		}
+		foot = footer(hint(km.PopupSelect, cmp.Or(p.submitLabel, "open")), hint(km.PopupClose, "cancel"))
 	}
 
 	// Size from all options, not the ones shown or the cursor's, so the
@@ -406,3 +416,9 @@ func (m Model) overlay(base string) string {
 		lipgloss.NewLayer(box).X(x).Y(y).Z(1),
 	).Render()
 }
+
+// capitalize upper-cases the first letter of a message.
+func capitalize(s string) string {
+	r, n := utf8.DecodeRuneInString(s)
+	return string(unicode.ToUpper(r)) + s[n:]
+}

internal/ui/app/persist.go

@@ -1,14 +1,12 @@
 package app
 
 import (
-	"encoding/json"
 	"errors"
-	"os"
-	"path/filepath"
 	"time"
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
@@ -23,58 +21,28 @@ import (
 // And where lazysecrets was left, per folder it ran in, goes in the store,
 // to go back there on the next start.
 
-// cacheFileVersion is the file's format; a file of another version is
-// ignored, and replaced on the next save.
-const cacheFileVersion = 1
-
-// cacheMaxAge drops what hasn't been loaded again for this long.
-const cacheMaxAge = 30 * 24 * time.Hour
-
 // persistEvery is how often a changed cache is saved while running, so
 // little is lost if lazysecrets is killed rather than quit.
 const persistEvery = 30 * time.Second
 
-type cacheFile struct {
-	Version    int                                      `json:"version"`
-	Sources    map[string]stamped[[]provider.Source]    `json:"sources,omitempty"` // by provider ID
-	Containers map[string]stamped[[]provider.Container] `json:"containers,omitempty"`
-	Objects    map[string]stamped[[]provider.Object]    `json:"objects,omitempty"`
-	Details    map[string]stamped[provider.Object]      `json:"details,omitempty"`
-	Cursor     map[string]string                        `json:"cursor,omitempty"`
-}
-
-type stamped[T any] struct {
-	At    time.Time `json:"at"`
-	Value T         `json:"value"`
-}
-
 type persistTickMsg struct{}
 
 type persistedMsg struct{ err error }
 
 // keepCached reports whether a cache key's account still exists and
 // isn't a repo: every key starts with the provider ID.
-func (m *Model) keepCached(key string) bool {
-	id, _ := splitSourceRow(key)
-	p, ok := m.byID[id]
-	return ok && p.Kind() != provider.KindRepo
-}
+func (m *Model) keepCached(key string) bool { return m.keepProvider(cachefile.ProviderOf(key)) }
+
+func (m *Model) keepProvider(id string) bool { return cachefile.Keep(m.providers)(id) }
 
 // loadCacheFile fills the cache from the file, leaving out what's too
 // old or belongs to accounts that aren't signed in any more.
 func (m *Model) loadCacheFile() {
-	b, err := os.ReadFile(m.cachePath)
-	if err != nil {
-		return
-	}
-	var f cacheFile
-	if json.Unmarshal(b, &f) != nil || f.Version != cacheFileVersion {
-		return
-	}
+	f := cachefile.Read(m.cachePath)
 	now := m.now()
-	recent := func(at time.Time) bool { return now.Sub(at) < cacheMaxAge }
+	recent := func(at time.Time) bool { return now.Sub(at) < cachefile.MaxAge }
 	for id, e := range f.Sources {
-		if m.keepCached(id+"|") && recent(e.At) {
+		if m.keepProvider(id) && recent(e.At) {
 			m.sourceResults[id] = sourcesMsg{gen: m.sourcesGen, provider: id, sources: e.Value}
 			m.sourcesAt[id] = e.At
 		}
@@ -102,33 +70,27 @@ func (m *Model) loadCacheFile() {
 }
 
 // cacheSnapshot is the cache as the file holds it.
-func (m *Model) cacheSnapshot() cacheFile {
-	f := cacheFile{
-		Version:    cacheFileVersion,
-		Sources:    map[string]stamped[[]provider.Source]{},
-		Containers: map[string]stamped[[]provider.Container]{},
-		Objects:    map[string]stamped[[]provider.Object]{},
-		Details:    map[string]stamped[provider.Object]{},
-		Cursor:     map[string]string{},
-	}
+func (m *Model) cacheSnapshot() cachefile.File {
+	f := cachefile.New()
+	f.Dropped, m.cacheDropped = m.cacheDropped, nil
 	for id, r := range m.sourceResults {
-		if r.err == nil && m.keepCached(id+"|") {
-			f.Sources[id] = stamped[[]provider.Source]{m.sourcesAt[id], r.sources}
+		if r.err == nil && m.keepProvider(id) {
+			f.Sources[id] = cachefile.Stamped[[]provider.Source]{At: m.sourcesAt[id], Value: r.sources}
 		}
 	}
 	for k, e := range m.cache.containers {
 		if m.keepCached(k) {
-			f.Containers[k] = stamped[[]provider.Container]{e.at, e.value}
+			f.Containers[k] = cachefile.Stamped[[]provider.Container]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.objects {
 		if m.keepCached(k) {
-			f.Objects[k] = stamped[[]provider.Object]{e.at, e.value}
+			f.Objects[k] = cachefile.Stamped[[]provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.details {
 		if m.keepCached(k) {
-			f.Details[k] = stamped[provider.Object]{e.at, e.value}
+			f.Details[k] = cachefile.Stamped[provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, v := range m.cache.cursor {
@@ -139,28 +101,11 @@ func (m *Model) cacheSnapshot() cacheFile {
 	return f
 }
 
-// writeCacheFile writes f atomically, readable by the user only.
-func writeCacheFile(path string, f cacheFile) error {
-	b, err := json.Marshal(f)
-	if err != nil {
-		return err
-	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		return err
-	}
-	tmp, err := os.CreateTemp(filepath.Dir(path), ".cache-*.json")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(tmp.Name()) // after a successful rename, nothing there
-	if _, err := tmp.Write(b); err != nil {
-		tmp.Close()
-		return err
-	}
-	if err := tmp.Close(); err != nil {
-		return err
-	}
-	return os.Rename(tmp.Name(), path)
+// saveCache saves f, merged with the file (lazysecrets list may have
+// loaded more since), from any goroutine.
+func (m *Model) saveCache(f cachefile.File) func() error {
+	path, keep, now := m.cachePath, cachefile.Keep(m.providers), m.now()
+	return func() error { return cachefile.Save(path, f, keep, now) }
 }
 
 // persistTick saves the cache, and where lazysecrets is, in the
@@ -169,8 +114,8 @@ func (m *Model) persistTick() tea.Cmd {
 	cmds := []tea.Cmd{tea.Tick(persistEvery, func(time.Time) tea.Msg { return persistTickMsg{} })}
 	if m.cacheDirty && m.cachePath != "" {
 		m.cacheDirty = false
-		f, path := m.cacheSnapshot(), m.cachePath
-		cmds = append(cmds, func() tea.Msg { return persistedMsg{writeCacheFile(path, f)} })
+		save := m.saveCache(m.cacheSnapshot())
+		cmds = append(cmds, func() tea.Msg { return persistedMsg{save()} })
 	}
 	if p, ok := m.place(); ok && m.placeDir != "" && p.Link != m.savedPlace {
 		m.savedPlace = p.Link
@@ -185,7 +130,7 @@ func (m *Model) persistTick() tea.Cmd {
 func (m Model) Persist() error {
 	var errs []error
 	if m.cachePath != "" {
-		errs = append(errs, writeCacheFile(m.cachePath, m.cacheSnapshot()))
+		errs = append(errs, m.saveCache(m.cacheSnapshot())())
 	}
 	if m.placeDir != "" {
 		if p, ok := m.place(); ok {

internal/ui/app/persist_test.go

@@ -1,12 +1,14 @@
 package app
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
@@ -80,15 +82,16 @@ func TestCacheFileDropsOldAndSignedOut(t *testing.T) {
 	file := filepath.Join(t.TempDir(), "cache.json")
 	az := fake.Azure(0)
 	now := time.Now()
-	f := cacheFile{
-		Version: cacheFileVersion,
-		Containers: map[string]stamped[[]provider.Container]{
-			az.ID() + "|recent":     {now.Add(-time.Hour), []provider.Container{{Name: "kv-recent"}}},
-			az.ID() + "|old":        {now.Add(-cacheMaxAge - time.Hour), []provider.Container{{Name: "kv-old"}}},
-			"Azure:gone@x/t|recent": {now, []provider.Container{{Name: "kv-gone"}}},
+	f := cachefile.File{
+		Version: cachefile.Version,
+		Containers: map[string]cachefile.Stamped[[]provider.Container]{
+			az.ID() + "|recent":     {At: now.Add(-time.Hour), Value: []provider.Container{{Name: "kv-recent"}}},
+			az.ID() + "|old":        {At: now.Add(-cachefile.MaxAge - time.Hour), Value: []provider.Container{{Name: "kv-old"}}},
+			"Azure:gone@x/t|recent": {At: now, Value: []provider.Container{{Name: "kv-gone"}}},
 		},
 	}
-	if err := writeCacheFile(file, f); err != nil {
+	b, _ := json.Marshal(f) // as an older lazysecrets left it
+	if err := os.WriteFile(file, b, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	d := newDriverOpts(t, Options{CacheFile: file}, az)
@@ -97,7 +100,7 @@ func TestCacheFileDropsOldAndSignedOut(t *testing.T) {
 		t.Error("dropped a recent entry")
 	}
 	if _, ok := c[az.ID()+"|old"]; ok {
-		t.Error("kept an entry older than cacheMaxAge")
+		t.Error("kept an entry older than cachefile.MaxAge")
 	}
 	if _, ok := c["Azure:gone@x/t|recent"]; ok {
 		t.Error("kept an entry of an account that isn't signed in")

internal/ui/app/repo_test.go

@@ -342,3 +342,53 @@ func TestEditorAtLine(t *testing.T) {
 		}
 	}
 }
+
+func TestEditConfig(t *testing.T) {
+	t.Parallel()
+	path := filepath.Join(t.TempDir(), "lazysecrets", "config.yaml")
+	var opened []string
+	d := newDriverOpts(t, Options{ConfigFiles: []string{path}, OpenURL: func(u string) error { opened = append(opened, u); return nil }})
+	d.m.getenv = func(string) string { return "" }
+
+	// e on the status pane. No editor: the system's default app, on a
+	// config made for it.
+	d.keys("0", "e")
+	if !slices.Equal(opened, []string{path}) {
+		t.Errorf("opened %q", opened)
+	}
+	if b, err := os.ReadFile(path); err != nil || !strings.HasPrefix(string(b), "# lazysecrets config") {
+		t.Errorf("config made: %q, %v", b, err)
+	}
+
+	// Inside nvim: in that nvim; an existing config is left as it is.
+	os.WriteFile(path, []byte("icons: false\n"), 0o644)
+	d.m.getenv = func(k string) string { return map[string]string{"NVIM": "/tmp/nvim.sock"}[k] }
+	var nvim []string
+	d.m.nvimOpen = func(server, path string, line int) error {
+		nvim = append(nvim, server+" "+path)
+		return nil
+	}
+	if msg := d.m.editConfig()(); msg != (tea.QuitMsg{}) {
+		t.Errorf("didn't quit for nvim: %v", msg)
+	}
+	if want := []string{"/tmp/nvim.sock " + path}; !slices.Equal(nvim, want) {
+		t.Errorf("nvim got %q", nvim)
+	}
+	if b, _ := os.ReadFile(path); string(b) != "icons: false\n" {
+		t.Errorf("config changed: %q", b)
+	}
+
+	d.send(editDoneMsg{name: "config.yaml", config: true})
+	if !strings.Contains(d.m.flash.text, "restart") {
+		t.Errorf("flash %q", d.m.flash.text)
+	}
+}
+
+func TestStatusFooterEditsConfig(t *testing.T) {
+	t.Parallel()
+	d := newDriver(t)
+	d.keys("0")
+	if !strings.Contains(d.screen(), "e edit config") {
+		t.Errorf("no edit config in the footer:\n%s", d.screen())
+	}
+}

internal/ui/app/route.go

@@ -5,13 +5,14 @@ import (
 	"fmt"
 	"slices"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
 // containerKey identifies a container in the UI and caches. The same vault
 // seen through two accounts must not share cached lists, since each
 // account may see different things.
-func containerKey(c provider.Container) string { return c.Source.Provider + "|" + c.ID }
+func containerKey(c provider.Container) string { return cachefile.ContainerKey(c) }
 
 // providerFor finds the provider instance a source came from. Sources
 // remembered from an earlier run (favourites) may name an account that

internal/ui/app/search.go

@@ -10,6 +10,7 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 )
@@ -61,13 +62,14 @@ func (m *Model) searchEntries() (sources, items []option) {
 	var es []entry
 	// key is the store key, so ctrl+f stars the entry; mark shows how
 	// much is loaded, reload (ctrl+r) loads it again.
-	add := func(depth int, row string, kind provider.Kind, path []string, account, key, mark string, run, reload func(*Model) tea.Cmd) {
+	add := func(depth int, row string, kind provider.Kind, path []string, account, key, mark string, run, reload func(*Model) tea.Cmd) *option {
 		n := m.store.Node(key)
 		sort := strings.ToLower(strings.Join(path, "/")) + " " + account
 		es = append(es, entry{depth, sort,
 			option{label: m.pathLabel(kind, path, account), note: n.Note, star: key,
 				starAccount: providerOf(row), starred: n.StarredFor(providerOf(row)),
 				mark: mark, run: run, reload: reload, id: sort, group: row, kind: kind}})
+		return &es[len(es)-1].opt
 	}
 	for _, p := range m.providers {
 		for _, src := range m.sourceResults[p.ID()].sources {
@@ -88,7 +90,7 @@ func (m *Model) searchEntries() (sources, items []option) {
 					return nil
 				}, reload)
 				for _, t := range []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate} {
-					for _, o := range m.cache.objects[containerKey(c)+"|"+string(t)].value {
+					for _, o := range m.cache.objects[cachefile.ObjectsKey(c, t)].value {
 						r, err := ref.ForObject(o, "")
 						if err != nil {
 							continue
@@ -98,10 +100,11 @@ func (m *Model) searchEntries() (sources, items []option) {
 							typ := strings.TrimSuffix(strings.ToLower(pluralLabels[t]), "s") // "key"
 							suffix = strings.Trim(typ+" · "+suffix, " ·")
 						}
-						add(2, row, c.Source.Kind, []string{src.Name, c.Name, o.Name}, suffix, objectKey(o), " ", func(m *Model) tea.Cmd {
+						e := add(2, row, c.Source.Kind, []string{src.Name, c.Name, o.Name}, suffix, objectKey(o), " ", func(m *Model) tea.Cmd {
 							m.startNav(r, actGo, row)
 							return nil
 						}, reload)
+						e.plain = c.Detail == provider.DetailPlainEnv
 					}
 				}
 			}
@@ -164,7 +167,7 @@ func (m *Model) coverageOf(in providerFilter) coverage {
 			}
 			for _, v := range e.value {
 				c.vaults++
-				key := containerKey(v) + "|" + string(provider.TypeSecret)
+				key := cachefile.ObjectsKey(v, provider.TypeSecret)
 				if objs, ok := m.cache.objects[key]; ok {
 					c.vaultsLoaded++
 					c.secrets += len(objs.value)
@@ -261,7 +264,7 @@ func (m *Model) queueSource(src provider.Source, force bool) {
 // queueContainer queues loading c's secrets, unless loaded lately and not
 // force.
 func (m *Model) queueContainer(c provider.Container, row string, force bool) {
-	key := containerKey(c) + "|" + string(provider.TypeSecret)
+	key := cachefile.ObjectsKey(c, provider.TypeSecret)
 	if e, ok := m.cache.objects[key]; ok && e.fresh(m.now()) && !force {
 		return
 	}
@@ -293,10 +296,10 @@ func (m *Model) crawlNext() tea.Cmd {
 }
 
 func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
-	timeout := m.timeout
 	if job.src != nil {
 		p := m.providerFor(*job.src)
 		src := *job.src
+		timeout := m.timeout.of(src.Kind)
 		return func() tea.Msg {
 			ctx, cancel := contextWithTimeout(timeout)
 			defer cancel()
@@ -309,6 +312,7 @@ func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
 	}
 	c := *job.container
 	p := m.providerFor(c.Source)
+	timeout := m.timeout.of(c.Source.Kind)
 	return func() tea.Msg {
 		ctx, cancel := contextWithTimeout(timeout)
 		defer cancel()
@@ -324,7 +328,7 @@ func (m *Model) handleCrawl(msg crawlMsg) tea.Cmd {
 	m.crawl.active--
 	key := msg.job.row
 	if msg.job.container != nil {
-		key = containerKey(*msg.job.container) + "|" + string(provider.TypeSecret)
+		key = cachefile.ObjectsKey(*msg.job.container, provider.TypeSecret)
 	}
 	delete(m.crawl.pending, key)
 	switch {
@@ -362,7 +366,7 @@ func (m *Model) sourceMark(row string) string {
 	}
 	loaded, loading := 0, false
 	for _, c := range e.value {
-		key := containerKey(c) + "|" + string(provider.TypeSecret)
+		key := cachefile.ObjectsKey(c, provider.TypeSecret)
 		loading = loading || m.crawl.pending[key]
 		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
 			loaded++
@@ -383,7 +387,7 @@ func (m *Model) sourceMark(row string) string {
 // (✗) or are loading (◌): whether a subscription is loaded says whether
 // its vaults are searchable.
 func (m *Model) vaultMark(c provider.Container) string {
-	key := containerKey(c) + "|" + string(provider.TypeSecret)
+	key := cachefile.ObjectsKey(c, provider.TypeSecret)
 	switch {
 	case m.crawl.pending[key]:
 		return m.st.Muted.Render("◌")

internal/ui/app/searchview.go

@@ -12,8 +12,10 @@ import (
 	"charm.land/lipgloss/v2"
 	"github.com/charmbracelet/x/ansi"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/match"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/keys"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
@@ -52,6 +54,9 @@ type searchView struct {
 	res    int      // cursor in shown
 	here   string   // the scope of the source Go to was opened from, if any
 
+	// picker, if set, makes Go to pick a secret instead of going to it.
+	picker *picker
+
 	// loaded are the scopes a search has loaded since the popup opened:
 	// typing loads the scope once, so lists that fail aren't asked for
 	// again on every key.
@@ -267,6 +272,9 @@ func (v *searchView) match() []option {
 			}
 		}
 	}
+	if v.picker != nil {
+		cand = slices.DeleteFunc(slices.Clone(cand), func(o option) bool { _, ok := pickable(o); return !ok })
+	}
 	q := v.input.Value()
 	if q == "" {
 		return slices.Clone(cand)
@@ -423,9 +431,14 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 		return nil
 	case key.Matches(msg, k.sel):
 		switch {
+		case v.results && v.res < len(v.shown) && v.picker != nil:
+			r, _ := pickable(v.shown[v.res])
+			return v.picker.choose(m, r)
 		case v.results && v.res < len(v.shown):
 			m.search = nil
 			return v.shown[v.res].run(m)
+		case !v.results && v.picker != nil:
+			v.results = true // a picker only narrows to the scope
 		case !v.results && v.onSource():
 			m.search = nil
 			return v.scope().run(m)
@@ -605,7 +618,7 @@ func (m Model) loadHint() string {
 	}
 	loaded := 0
 	for _, c := range e.value {
-		key := containerKey(c) + "|" + string(provider.TypeSecret)
+		key := cachefile.ObjectsKey(c, provider.TypeSecret)
 		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
 			loaded++
 		}
@@ -641,7 +654,16 @@ func (m Model) searchViewBox() string {
 	v := m.search
 	focused := !m.termBlurred
 	w := searchWidth(m.w)
+	popupW := w
+	if v.picker != nil {
+		w -= 4 // inside the picker's border, in the popup
+	}
 	listH := max(5, min(m.h-10, 14))
+	if v.picker != nil {
+		// What it's for, the help, a line or two on the key picked, the
+		// tabs and a border more.
+		listH = max(5, min(m.h-10-len(v.picker.lines)-len(v.picker.help)-8, 14))
+	}
 
 	srcW := 10
 	for _, o := range v.scopes {
@@ -733,7 +755,24 @@ func (m Model) searchViewBox() string {
 		lists = panes.BoxCounted(m.st, title(resultsTitle, true), "", counter(v.res, len(v.shown)), right, resW, listH, focused)
 	}
 
-	body := []string{" " + v.input.View(), ""}
+	ts := panes.TitleStyle(m.st, focused)
+	var body []string
+	if p := v.picker; p != nil {
+		for _, l := range p.help {
+			body = append(body, " "+l)
+		}
+		switch {
+		case p.busy != "":
+			body = append(body, "", " "+m.st.Notice.Render(p.busy))
+		case p.err != "":
+			body = append(body, "")
+			for _, l := range strings.Split(ansi.Wordwrap(p.err, w-4, " "), "\n") {
+				body = append(body, " "+m.st.Error.Render(l))
+			}
+		}
+		body = append(body, "", " "+m.goToTabs(ts))
+	}
+	body = append(body, " "+v.input.View(), "")
 	for _, l := range strings.Split(lists, "\n") {
 		body = append(body, " "+l)
 	}
@@ -753,26 +792,83 @@ func (m Model) searchViewBox() string {
 		if v.tab == tabSearch {
 			hints = append(hints, keyHint{joinKeys(km.SearchSources, km.SearchResults), "switch list"}, hint(km.SearchLoad, "load"))
 		}
-		foot = footer(append(hints, hint(km.PopupStar, "star"), hint(km.PopupSelect, "go"), hint(km.PopupClose, "stop typing"))...)
+		foot = footer(append(hints, hint(km.PopupStar, "star"), hint(km.PopupSelect, v.selectLabel()), hint(km.PopupClose, "stop typing"))...)
 	default:
 		hints := []keyHint{move(km.GoUp, km.GoDown), {joinKeys(km.GoPrevTab, km.GoNextTab), "tab"}}
 		if v.tab == tabSearch {
 			hints = append(hints, keyHint{joinKeys(km.GoSources, km.GoResults), "list"}, hint(km.GoLoad, "load"), hint(km.GoLoadAll, "load all"))
 		}
-		foot = footer(append(hints, hint(km.GoFilter, "filter"), hint(km.GoStar, "star"), hint(km.GoSelect, "go"), hint(km.GoClose, "close"))...)
-	}
-	// Tabs in the title, the current one underlined, like the panes.
-	ts := panes.TitleStyle(m.st, focused)
-	head := ts.Render(goToTitle + " ")
-	for i, name := range tabNames {
-		if i > 0 {
-			head += ts.Render(" - ")
-		}
-		if i == v.tab {
-			head += ts.Underline(true).Render(name)
-		} else {
-			head += m.st.Muted.Render(name)
-		}
+		foot = footer(append(hints, hint(km.GoFilter, "filter"), hint(km.GoStar, "star"), hint(km.GoSelect, v.selectLabel()), hint(km.GoClose, "close"))...)
 	}
+	// Tabs in the title, the current one underlined, like the panes; a
+	// picker has its own title, and the tabs over the input.
+	if v.picker == nil {
+		head := ts.Render(goToTitle+" ") + m.goToTabs(ts)
 		return panes.Box(m.st, head, foot, body, w, len(body)+2, focused)
 	}
+	// A picker: in its own border, under what it's for.
+	var outer []string
+	for _, l := range v.picker.lines {
+		outer = append(outer, " "+l)
+	}
+	outer = append(outer, "")
+	for _, l := range strings.Split(panes.Box(m.st, ts.Render(v.picker.heading), "", body, w, len(body)+2, focused), "\n") {
+		outer = append(outer, " "+l)
+	}
+	return panes.Box(m.st, ts.Render(v.picker.title), foot, outer, popupW, len(outer)+2, focused)
+}
+
+// picker is Go to picking a secret for something (the key to share
+// with): it lists secrets only, and enter hands the selected one's link
+// to pick, which closes Go to when it's done with it.
+type picker struct {
+	pick    func(m *Model, r ref.Ref) tea.Cmd
+	title   string   // the popup's
+	lines   []string // what picking is for, above the picker
+	heading string   // the picker's title, on its border
+	help    []string // inside it, above the tabs
+	busy    string   // what the pick is doing (picks wait meanwhile)
+	err     string   // why the secret picked can't be used
+}
+
+// choose hands r to the picker, unless it's still busy with one.
+func (p *picker) choose(m *Model, r ref.Ref) tea.Cmd {
+	if p.busy != "" {
+		return nil
+	}
+	return p.pick(m, r)
+}
+
+// selectLabel names what enter does with the selected entry.
+func (v *searchView) selectLabel() string {
+	if v.picker != nil {
+		return "pick"
+	}
+	return "go"
+}
+
+// pickable is the link of a Go to entry that a picker can pick: a
+// secret (not a key or certificate, nor a key in a plain env file).
+func pickable(o option) (ref.Ref, bool) {
+	r, err := ref.Parse(o.star)
+	if err != nil || o.plain || r.IsShare() || r.IsSource() || r.IsContainer() || (r.Type != "" && r.Type != provider.TypeSecret) {
+		return ref.Ref{}, false
+	}
+	return r, true
+}
+
+// goToTabs draws Go to's tabs, the current one underlined.
+func (m Model) goToTabs(ts lipgloss.Style) string {
+	var out string
+	for i, name := range tabNames {
+		if i > 0 {
+			out += ts.Render(" - ")
+		}
+		if i == m.search.tab {
+			out += ts.Underline(true).Render(name)
+		} else {
+			out += m.st.Muted.Render(name)
+		}
+	}
+	return out
+}

internal/ui/app/sharefiles.go

@@ -0,0 +1,471 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"charm.land/bubbles/v2/textinput"
+	tea "charm.land/bubbletea/v2"
+	"github.com/charmbracelet/x/ansi"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
+)
+
+// Sharing env files as an encrypted lazysecrets://share link (package
+// share), and opening one: the files are encrypted with a secret's value,
+// so whoever can read that secret can open the link.
+
+// sharing is a share being made: the files read, and the key to use.
+type sharing struct {
+	repo  provider.Source
+	files []share.File
+	key   ref.Ref // zero until chosen
+}
+
+type shareFilesMsg struct {
+	sharing
+	err error
+}
+
+type sealedMsg struct {
+	link ref.Ref
+	n    int
+	// from is the picker the key was picked in; nil for sharing.key's.
+	from *picker
+	err  error
+}
+
+// canShareFiles reports whether src's env files can be shared: it's a
+// repo whose files can be read.
+func (m Model) canShareFiles(src provider.Source) bool {
+	_, ok := m.providerFor(src).(provider.Contents)
+	return src.Kind == provider.KindRepo && ok
+}
+
+// shareFiles shares env files of a repo: cs, or with cs nil all its
+// plain ones.
+func (m *Model) shareFiles(src provider.Source, cs []provider.Container) tea.Cmd {
+	p := m.providerFor(src)
+	files, ok := p.(provider.Contents)
+	if !ok {
+		m.flash = warning("these files can't be shared")
+		return nil
+	}
+	general, timeout := m.shareKey, m.timeout.of(src.Kind)
+	m.flash = flash{text: "reading the files…"}
+	return func() tea.Msg {
+		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		defer cancel()
+		msg := shareFilesMsg{sharing: sharing{repo: src}}
+		if cs == nil {
+			all, err := p.Containers(ctx, src)
+			if err != nil {
+				msg.err = err
+				return msg
+			}
+			for _, c := range all {
+				if c.Detail == provider.DetailPlainEnv {
+					cs = append(cs, c)
+				}
+			}
+			if len(cs) == 0 {
+				msg.err = errors.New(src.Name + " has no plain env files")
+				return msg
+			}
+		}
+		for _, c := range cs {
+			b, err := files.Contents(ctx, c)
+			if err != nil {
+				msg.err = err
+				return msg
+			}
+			msg.files = append(msg.files, share.File{Path: c.Name, Data: b})
+		}
+		key, ok, err := share.DefaultKey(src.ID, general)
+		if ok {
+			msg.key = key
+		}
+		msg.err = err
+		return msg
+	}
+}
+
+func (m *Model) handleShareFiles(msg shareFilesMsg) tea.Cmd {
+	switch {
+	case msg.err != nil:
+		m.flash = flash{text: "share: " + msg.err.Error(), isErr: true}
+	case msg.key == (ref.Ref{}):
+		return m.pickShareKey(msg.sharing)
+	default:
+		m.confirmShare(msg.sharing)
+	}
+	return nil
+}
+
+// shareTitle names the action: "Share .env", "Share 2 env files".
+func shareTitle(s sharing) string {
+	if len(s.files) == 1 {
+		return "Share " + path.Base(s.files[0].Path)
+	}
+	return "Share " + plural(len(s.files), "env file")
+}
+
+// sharedFiles lists the files being shared, under what's happening.
+func (m *Model) sharedFiles(s sharing) []string {
+	lines := []string{"Sharing " + plural(len(s.files), "env file") + " as an encrypted link:"}
+	for _, f := range s.files {
+		lines = append(lines, "  "+m.repoLabel(s.repo.Name, f.Path))
+	}
+	return lines
+}
+
+// confirmShare says what the link will hold before making it.
+func (m *Model) confirmShare(s sharing) {
+	lines := append(m.sharedFiles(s), "", m.st.Muted.Render("encrypted with ")+m.refLabel(s.key))
+	m.showMenu(shareTitle(s), lines, []option{
+		{key: "c", label: "Copy the link", run: func(m *Model) tea.Cmd { return m.seal(s, nil) }},
+		{key: "k", label: "Encrypt with another secret…", run: func(m *Model) tea.Cmd { return m.pickShareKey(s) }},
+	})
+}
+
+// pickShareKey asks which secret to encrypt with, in Go to, then shares
+// with it: the picker showed what's shared, so there's no asking again.
+// It stays open until the link is made, to say why a secret can't be
+// used.
+func (m *Model) pickShareKey(s sharing) tea.Cmd {
+	cmd := m.openGoTo(tabSearch, true)
+	p := &picker{
+		title:   shareTitle(s),
+		lines:   m.sharedFiles(s),
+		heading: "Pick a secret to encrypt with",
+		help: []string{
+			m.st.Muted.Render("The recipient needs read access to it to decrypt the files."),
+			m.st.Muted.Render("Its value isn't shown or put in the link."),
+		},
+	}
+	p.pick = func(m *Model, key ref.Ref) tea.Cmd {
+		s.key = key
+		p.err, p.busy = "", "encrypting with "+key.Name+"…"
+		cmd := m.seal(s, p)
+		m.flash = flash{}
+		return cmd
+	}
+	m.search.picker = p
+	m.search.input.SetWidth(searchWidth(m.w) - 10) // inside the picker's border
+	m.fillSearch(false)
+	return tea.Batch(cmd, m.searchLoads())
+}
+
+// pickPasted picks a pasted reference to a secret, while picking one.
+func (m *Model) pickPasted(text string) tea.Cmd {
+	key, err := share.ParseKey(strings.TrimSpace(text))
+	if err != nil {
+		m.search.picker.err = "✗ " + capitalize(err.Error())
+		return nil
+	}
+	return m.search.picker.choose(m, key)
+}
+
+// seal reads the key and encrypts the files with it, for the picker
+// from (nil: the key wasn't picked).
+func (m *Model) seal(s sharing, from *picker) tea.Cmd {
+	read, rules := m.keyReader(), m.shareRules
+	m.flash = flash{text: "encrypting with " + s.key.Name + "…"}
+	return func() tea.Msg {
+		v, version, err := read(s.key)
+		if err != nil {
+			return sealedMsg{from: from, err: &share.KeyError{Name: s.key.Name, Err: err}}
+		}
+		link, err := share.Seal(share.Header{Key: share.Pin(s.key, version), Repo: s.repo.Detail}, []byte(v.Reveal()), s.files, rules)
+		return sealedMsg{link: link, n: len(s.files), from: from, err: err}
+	}
+}
+
+func (m *Model) handleSealed(msg sealedMsg) tea.Cmd {
+	if p := msg.from; p != nil {
+		if m.search == nil || m.search.picker != p {
+			return nil // the picker was closed: cancelled
+		}
+		p.busy = ""
+		var bad *share.KeyError
+		if errors.As(msg.err, &bad) {
+			p.err = "✗ " + capitalize(bad.Error()) // to pick another
+			return nil
+		}
+		m.search = nil
+	}
+	if msg.err != nil {
+		m.noteErr(msg.err)
+		m.flash = flash{text: "share: " + msg.err.Error(), isErr: true}
+		return nil
+	}
+	m.dismissedLink = msg.link.String() // not offered back on focus
+	return m.copyText("encrypted link to "+plural(msg.n, "file"), msg.link.String(), false)
+}
+
+// keyReader reads a key's value with the providers, the account that
+// last read it first, off the UI goroutine.
+func (m *Model) keyReader() func(ref.Ref) (provider.SecretValue, string, error) {
+	providers, st, timeout := m.providers, m.store, m.timeout
+	return func(key ref.Ref) (provider.SecretValue, string, error) {
+		ctx, cancel := context.WithTimeout(context.Background(), timeout.of(key.Kind))
+		defer cancel()
+		k := key
+		k.Version = ""
+		node := st.Node(k.String())
+		return ref.Read(ctx, providers, key, node.Account, node.Source)
+	}
+}
+
+// --- opening ---
+
+type shareOpenedMsg struct {
+	sealed share.Sealed
+	files  []share.File
+	dir    string // the repo's clone; "" when it isn't here
+	err    error
+}
+
+// offerShare says what a share link holds before decrypting it: links
+// can come from anywhere, so nothing is read or written unasked.
+func (m *Model) offerShare(r ref.Ref) tea.Cmd {
+	s, err := share.Read(r)
+	if err != nil {
+		m.showMenu("Share link can't be read", []string{m.st.Error.Render(err.Error())}, nil)
+		return nil
+	}
+	from := ""
+	if s.Repo != "" {
+		from = m.st.Muted.Render(" from ") + m.repoLabel(s.Repo)
+	}
+	m.showMenu("Shared env files", []string{
+		m.st.Muted.Render(plural(s.Files, "env file")) + from,
+		m.st.Muted.Render("encrypted with ") + m.refLabel(s.Key),
+	}, []option{
+		{key: "o", label: "Decrypt…", tip: "reads the secret, then asks before saving", run: func(m *Model) tea.Cmd { return m.openShare(s) }},
+	})
+	return nil
+}
+
+// openShare reads the key, decrypts the files and finds the repo's clone.
+func (m *Model) openShare(s share.Sealed) tea.Cmd {
+	read := m.keyReader()
+	providers, timeout := m.providers, m.timeout.of(provider.KindRepo)
+	m.flash = flash{text: "decrypting with " + s.Key.Name + "…"}
+	return func() tea.Msg {
+		msg := shareOpenedMsg{sealed: s}
+		v, _, err := read(s.Key)
+		if err != nil {
+			msg.err = &share.KeyError{Name: s.Key.Name, Err: err}
+			return msg
+		}
+		if msg.files, msg.err = s.Open([]byte(v.Reveal())); msg.err != nil {
+			return msg
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		defer cancel()
+		for _, p := range providers {
+			if loc, ok := p.(provider.Locator); ok && p.Kind() == provider.KindRepo && s.Repo != "" {
+				// Its clone, if it's on disk (the demo's aren't).
+				if root, found, _ := loc.Locate(ctx, s.Repo); found && isDir(root) {
+					msg.dir = root
+					break
+				}
+			}
+		}
+		return msg
+	}
+}
+
+func (m *Model) handleShareOpened(msg shareOpenedMsg) tea.Cmd {
+	switch {
+	case msg.err != nil:
+		m.noteErr(msg.err)
+		m.openFailed(msg.sealed, msg.err, false)
+	case msg.dir == "":
+		return m.askShareDir(msg)
+	default:
+		targets, err := planSave(msg.files, msg.dir)
+		if err != nil {
+			m.flash = flash{text: "save: " + err.Error(), isErr: true}
+			return nil
+		}
+		m.offerSave(targets, msg.dir)
+	}
+	return nil
+}
+
+// openFailed says why a share link couldn't be decrypted, in a popup
+// where its offer was: its first line (wrapped), or with whole all of it
+// (Key Vault's refusals say what to check on later lines). From there,
+// the key's secret can be gone to: its version, which may be disabled.
+func (m *Model) openFailed(s share.Sealed, err error, whole bool) {
+	width := max(30, min(m.w-12, 76))
+	text := capitalize(err.Error())
+	first, rest, _ := strings.Cut(text, "\n")
+	cut := !whole && rest != "" // more than the reason: what to check
+	if !whole {
+		text = first
+	}
+	var lines []string
+	for i, l := range strings.Split(ansi.Wordwrap(text, width-2, " "), "\n") {
+		if i == 0 {
+			l = "✗ " + l
+		} else if l != "" {
+			l = "  " + l
+		}
+		lines = append(lines, m.st.Error.Render(l))
+	}
+	var opts []option
+	if cut {
+		opts = append(opts, option{key: "r", label: "Show the whole message", run: func(m *Model) tea.Cmd {
+			m.openFailed(s, err, true)
+			return nil
+		}})
+	}
+	opts = append(opts, option{key: "g", label: "Go to " + s.Key.Name, run: func(m *Model) tea.Cmd { return m.openRef(s.Key, actGo) }})
+	m.showMenu("Can't decrypt the shared files", lines, opts)
+}
+
+// askShareDir asks where to save files from a repo that isn't here. It
+// stays until they're saved, saying why when they can't be.
+func (m *Model) askShareDir(msg shareOpenedMsg) tea.Cmd {
+	in := textinput.New()
+	in.Prompt = "folder: "
+	in.SetWidth(max(20, min(m.w-12, 64)))
+	dir := m.placeDir
+	if dir == "" {
+		dir, _ = os.Getwd()
+	}
+	in.SetValue(dir)
+	in.CursorEnd()
+	lines := []string{m.st.Muted.Render("Paths are from the repo's root.")}
+	if msg.sealed.Repo != "" {
+		lines = append([]string{m.repoLabel(msg.sealed.Repo) + m.st.Muted.Render(" isn't among your repos. Save where?")}, lines...)
+	}
+	p := &modal{title: "Save the files", input: &in, lines: lines, submitLabel: "save"}
+	p.submit = func(m *Model, text string) tea.Cmd {
+		dir := expandHome(strings.TrimSpace(text))
+		targets, err := planSave(msg.files, dir)
+		switch {
+		case err == nil && slices.ContainsFunc(targets, func(t share.Target) bool { return t.Exists }):
+			m.offerSave(targets, dir) // ask before replacing
+			return nil
+		case err == nil:
+			// Chosen, with nothing to replace: saved at once.
+			if err = m.writeShared(targets, dir, false); err == nil {
+				return nil
+			}
+		}
+		p.err = err.Error()
+		m.prompt = p // again, to fix the folder
+		return p.input.Focus()
+	}
+	m.prompt = p
+	return p.input.Focus()
+}
+
+// planSave says where each file goes in dir, which must be a folder.
+func planSave(files []share.File, dir string) ([]share.Target, error) {
+	if !isDir(dir) {
+		return nil, fmt.Errorf("no folder %s", dir)
+	}
+	return share.Plan(dir, files)
+}
+
+// offerSave shows where each file goes, then saves them as chosen:
+// files there already are replaced only when asked.
+func (m *Model) offerSave(targets []share.Target, dir string) {
+	var lines []string
+	exist := 0
+	for _, t := range targets {
+		file := "  " + m.repoLabel(filepath.Base(dir), t.Path)
+		line := file + m.st.Muted.Render(" · new")
+		if t.Exists {
+			exist++
+			line = file + m.st.Muted.Render(" · replaces the one there")
+		}
+		if t.Exposed {
+			line += m.st.Error.Render(" · not ignored by git")
+		}
+		lines = append(lines, line)
+	}
+	lines = append([]string{m.st.Muted.Render("In " + dir + ":")}, lines...)
+	write := func(onlyNew bool) func(*Model) tea.Cmd {
+		return func(m *Model) tea.Cmd {
+			if err := m.writeShared(targets, dir, onlyNew); err != nil {
+				m.flash = flash{text: "save: " + err.Error(), isErr: true}
+			}
+			return nil
+		}
+	}
+	var opts []option
+	switch {
+	case exist == 0:
+		opts = append(opts, option{key: "w", label: "Save", run: write(false)})
+	case exist == len(targets):
+		opts = append(opts, option{key: "w", label: "Replace", run: write(false)})
+	default:
+		opts = append(opts,
+			option{key: "w", label: fmt.Sprintf("Save all, replacing %d", exist), run: write(false)},
+			option{key: "n", label: onlyNew(len(targets) - exist), run: write(true)},
+		)
+	}
+	m.showMenu("Save the shared files", lines, opts)
+}
+
+// writeShared writes the files (with onlyNew, those not there yet) and
+// says where, and which ones git doesn't ignore.
+func (m *Model) writeShared(targets []share.Target, dir string, onlyNew bool) error {
+	n := 0
+	var exposed []string
+	for _, t := range targets {
+		if onlyNew && t.Exists {
+			continue
+		}
+		if err := t.Write(); err != nil {
+			return fmt.Errorf("%s: %w", t.Path, err)
+		}
+		n++
+		if t.Exposed {
+			exposed = append(exposed, t.Path)
+		}
+	}
+	m.flash = done("saved " + plural(n, "file") + " in " + dir)
+	if len(exposed) > 0 {
+		m.flash = warning("saved " + plural(n, "file") + " in " + dir + "; git doesn't ignore " + strings.Join(exposed, ", "))
+	}
+	return nil
+}
+
+// isDir reports whether dir is a folder on disk.
+func isDir(dir string) bool {
+	info, err := os.Stat(dir)
+	return err == nil && info.IsDir()
+}
+
+// expandHome expands a leading ~/ to the home folder.
+func expandHome(dir string) string {
+	if rest, ok := strings.CutPrefix(dir, "~/"); ok {
+		if home, err := os.UserHomeDir(); err == nil {
+			return filepath.Join(home, rest)
+		}
+	}
+	return dir
+}
+
+// onlyNew labels saving only the n files not there yet.
+func onlyNew(n int) string {
+	if n == 1 {
+		return "Save only the new one"
+	}
+	return fmt.Sprintf("Save only the %d new ones", n)
+}

internal/ui/app/sharefiles_test.go

@@ -0,0 +1,355 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	tea "charm.land/bubbletea/v2"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+)
+
+// scryptWait is how long the driver waits for encrypting and decrypting:
+// tens of milliseconds, more than its usual wait, and more under load.
+const scryptWait = 20 * time.Second
+
+// demoRules take the demo key, made up to be remembered.
+var demoRules = share.Rules{MinLength: 16, MinClasses: 1}
+
+// cloneWith makes a clone of git.example.com/team/app holding files.
+func cloneWith(t *testing.T, files map[string]string) string {
+	t.Helper()
+	root := gitRepoWith(t, "https://git.example.com/team/app.git")
+	os.WriteFile(filepath.Join(root, ".gitignore"), []byte(".env\n"), 0o644)
+	for name, data := range files {
+		os.MkdirAll(filepath.Dir(filepath.Join(root, name)), 0o755)
+		os.WriteFile(filepath.Join(root, name), []byte(data), 0o600)
+	}
+	return root
+}
+
+// shareFrom shares a repo's env files from lazysecrets started in it,
+// returning the link copied.
+func shareFrom(t *testing.T, root string, paste bool) string {
+	t.Helper()
+	clip := &fakeClipboard{}
+	d := newDriverOpts(t, Options{Clipboard: clip, ShareRules: demoRules}, fake.Azure(0), repo.New(repo.Settings{Dir: root}))
+	d.wait = scryptWait
+	if src, ok := d.m.selectedSource(); !ok || src.ID != root {
+		t.Fatalf("selected %v, want the repo", src.ID)
+	}
+	d.keys("S", "f")
+	// No sharing.key set: it asks which secret, in Go to, which lists
+	// only secrets.
+	v := d.m.search
+	if v == nil || v.picker == nil {
+		t.Fatalf("no secret picker: %s", d.m.flash.text)
+	}
+	for _, o := range v.shown {
+		if o.plain || strings.Contains(o.label, ".env") {
+			t.Errorf("a plain env value offered as the key: %s", o.label)
+		}
+	}
+	if !strings.Contains(d.screen(), "as an encrypted link") {
+		t.Errorf("doesn't say what picking does:\n%s", d.screen())
+	}
+	if paste {
+		// A reference pasted is picked as it is.
+		d.send(tea.PasteMsg{Content: "https://" + kv + "/secrets/db-password"})
+	} else {
+		for _, r := range "app-prod db-password" {
+			d.keys(string(r))
+		}
+		if len(v.shown) == 0 {
+			t.Fatalf("no secrets to pick:\n%s", d.screen())
+		}
+		for _, o := range v.shown {
+			if _, ok := pickable(o); !ok {
+				t.Errorf("not a secret: %s", o.label)
+			}
+		}
+		if !strings.Contains(d.screen(), "Share 2 env files") && !strings.Contains(d.screen(), "Share .env") {
+			t.Errorf("not titled as a picker:\n%s", d.screen())
+		}
+		d.keys("enter")
+	}
+	// Picking it shares: the picker said what.
+	if !strings.HasPrefix(clip.content, "lazysecrets://share/") {
+		t.Fatalf("copied %q (%s)", clip.content, d.m.flash.text)
+	}
+	return clip.content
+}
+
+func TestShareFilesRoundTrip(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("no git")
+	}
+	link := shareFrom(t, cloneWith(t, map[string]string{
+		".env":     "DB_PASSWORD=hunter2\n",
+		"prod.env": "TOKEN=abc\n",
+	}), false)
+
+	// A colleague's clone: .env is there already, prod.env isn't.
+	theirs := cloneWith(t, map[string]string{".env": "DB_PASSWORD=old\n"})
+	d := newDriverOpts(t, Options{}, fake.Azure(0), repo.New(repo.Settings{Dir: theirs}))
+	d.wait = scryptWait
+	d.send(tea.PasteMsg{Content: link})
+	if d.m.prompt == nil || d.m.prompt.title != "Shared env files" || !strings.Contains(d.screen(), "2 env files from git.example.com/team/app") {
+		t.Fatalf("not offered:\n%s", d.screen())
+	}
+	d.keys("o")
+	if d.m.prompt == nil || d.m.prompt.title != "Save the shared files" {
+		t.Fatalf("no save menu (%s)", d.m.flash.text)
+	}
+	if s := d.screen(); !strings.Contains(s, "replaces the one there") || !strings.Contains(s, "not ignored by git") {
+		t.Errorf("save menu doesn't say what happens:\n%s", s)
+	}
+	d.keys("n") // only the new one
+	if b, _ := os.ReadFile(filepath.Join(theirs, ".env")); string(b) != "DB_PASSWORD=old\n" {
+		t.Errorf(".env replaced: %q", b)
+	}
+	if b, _ := os.ReadFile(filepath.Join(theirs, "prod.env")); string(b) != "TOKEN=abc\n" {
+		t.Errorf("prod.env: %q", b)
+	}
+
+	// Again, replacing.
+	d.send(tea.PasteMsg{Content: link})
+	d.keys("o", "w")
+	if b, _ := os.ReadFile(filepath.Join(theirs, ".env")); string(b) != "DB_PASSWORD=hunter2\n" {
+		t.Errorf(".env not replaced: %q", b)
+	}
+}
+
+func TestShareWithShareKeyConfirms(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("no git")
+	}
+	root := cloneWith(t, map[string]string{
+		".env":              "A=1\n",
+		".lazysecrets.yaml": "sharing:\n  key: https://" + kv + "/secrets/db-password\n",
+	})
+	clip := &fakeClipboard{}
+	d := newDriverOpts(t, Options{Clipboard: clip, ShareRules: demoRules}, fake.Azure(0), repo.New(repo.Settings{Dir: root}))
+	d.wait = scryptWait
+	d.keys("S", "f")
+	// The key wasn't picked: it shows which, before sharing.
+	if d.m.search != nil || d.m.prompt == nil || d.m.prompt.title != "Share .env" || !strings.Contains(d.screen(), "db-password") {
+		t.Fatalf("no confirmation:\n%s", d.screen())
+	}
+	d.keys("c")
+	if !strings.HasPrefix(clip.content, "lazysecrets://share/") {
+		t.Errorf("copied %q (%s)", clip.content, d.m.flash.text)
+	}
+}
+
+func TestShareLinkElsewhereAsksWhere(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("no git")
+	}
+	link := shareFrom(t, cloneWith(t, map[string]string{".env": "A=1\n"}), true)
+	dir, _ := filepath.EvalSymlinks(t.TempDir())
+	d := newDriverOpts(t, Options{Dir: dir}, fake.Azure(0))
+	d.wait = scryptWait
+	d.send(tea.PasteMsg{Content: link})
+	d.keys("o")
+	if d.m.prompt == nil || d.m.prompt.input == nil || d.m.prompt.input.Value() != dir {
+		t.Fatalf("doesn't ask where, starting from where it runs:\n%s", d.screen())
+	}
+	// A folder that isn't there: the prompt stays, saying so.
+	d.m.prompt.input.SetValue(filepath.Join(dir, "nope"))
+	d.keys("enter")
+	if d.m.prompt == nil || d.m.prompt.input == nil || !strings.Contains(d.screen(), "✗ No folder") {
+		t.Fatalf("a missing folder isn't said in the prompt:\n%s", d.screen())
+	}
+	if !strings.Contains(d.screen(), "enter save") {
+		t.Errorf("the footer doesn't say enter saves:\n%s", d.screen())
+	}
+	d.m.prompt.input.SetValue(dir)
+	d.keys("enter") // saved at once: nothing there to replace
+	if b, _ := os.ReadFile(filepath.Join(dir, ".env")); string(b) != "A=1\n" {
+		t.Errorf(".env: %q (%s)", b, d.m.flash.text)
+	}
+	if d.m.prompt != nil || !strings.Contains(d.m.flash.text, "saved 1 file in "+dir) {
+		t.Errorf("not closed with where it saved: %q", d.m.flash.text)
+	}
+}
+
+func TestShareLinkGarbled(t *testing.T) {
+	t.Parallel()
+	d := newDriver(t)
+	d.send(tea.PasteMsg{Content: "lazysecrets://share/AQ" + strings.Repeat("A", 30)})
+	if d.m.prompt == nil || !strings.Contains(d.screen(), "garbled") {
+		t.Errorf("not reported:\n%s", d.screen())
+	}
+}
+
+// TestShareInDemo shares a demo repo's env files with the demo key and
+// opens the link, as lazysecrets --demo does: the demo repos aren't on
+// disk, so it asks where to save.
+func TestShareInDemo(t *testing.T) {
+	clip := &fakeClipboard{}
+	d := newDriverOpts(t, Options{Clipboard: clip},
+		fake.Azure(0), fake.AzureOps(0).As("Azure:admin", "Azure · admin"), fake.Repos())
+	d.wait = scryptWait
+	var src provider.Source
+	for _, s := range d.m.sourceResults["Repos"].sources {
+		if s.Here {
+			src = s
+		}
+	}
+	if src.ID == "" {
+		t.Fatal("no demo repo")
+	}
+	src.Provider = "Repos"
+	d.run(d.m.shareFiles(src, nil))
+	if d.m.search == nil || d.m.search.picker == nil {
+		t.Fatalf("no picker: %s", d.m.flash.text)
+	}
+	// Too short a key: the picker stays, saying why.
+	d.send(tea.PasteMsg{Content: "https://kv-app-prod.vault.azure.net/secrets/db-password"})
+	if d.m.search == nil || !strings.Contains(d.m.search.picker.err, "Can't use db-password: its value has 28 characters; sharing.keyRules needs 32 (minLength)") {
+		t.Fatalf("not said in the picker: %v\n%s", d.m.search != nil, d.screen())
+	}
+	if !strings.Contains(d.screen(), "28 characters") {
+		t.Errorf("not shown:\n%s", d.screen())
+	}
+	d.send(tea.PasteMsg{Content: "https://kv-shared-prod.vault.azure.net/secrets/env-share"})
+	if !strings.HasPrefix(clip.content, "lazysecrets://share/") || d.m.search != nil {
+		t.Fatalf("copied %q (%s)", clip.content, d.m.flash.text)
+	}
+	link := clip.content
+	// A value in a demo repo's SOPS file can be the key too, found by
+	// the repo's remote.
+	clip.content = ""
+	d.run(d.m.shareFiles(src, nil))
+	d.send(tea.PasteMsg{Content: "lazysecrets://repo/" + url.PathEscape(src.Detail) + "/config%2Foauth.enc.json/github.client_secret"})
+	if !strings.HasPrefix(clip.content, "lazysecrets://share/") {
+		t.Errorf("with the demo repo's key: copied %q (%s)", clip.content, d.m.flash.text)
+	}
+
+	dir, _ := filepath.EvalSymlinks(t.TempDir())
+	d.m.placeDir = dir
+	d.send(tea.PasteMsg{Content: link})
+	d.keys("o")
+	if d.m.prompt == nil || d.m.prompt.input == nil || !strings.Contains(d.screen(), "isn't among your repos") {
+		t.Fatalf("doesn't ask where:\n%s", d.screen())
+	}
+	d.keys("enter") // saved at once: nothing there to replace
+	entries, _ := os.ReadDir(dir)
+	if len(entries) == 0 {
+		t.Fatalf("nothing saved (%s)", d.m.flash.text)
+	}
+}
+
+func TestPickerCancelAndBusy(t *testing.T) {
+	clip := &fakeClipboard{}
+	d := newDriverOpts(t, Options{Clipboard: clip},
+		fake.Azure(0), fake.AzureOps(0).As("Azure:admin", "Azure · admin"), fake.Repos())
+	var src provider.Source
+	for _, s := range d.m.sourceResults["Repos"].sources {
+		if s.Here {
+			src = s
+		}
+	}
+	src.Provider = "Repos"
+	d.run(d.m.shareFiles(src, nil))
+	p := d.m.search.picker
+	key, _ := share.ParseKey("https://kv-shared-prod.vault.azure.net/secrets/env-share")
+
+	// Picking starts sealing; another pick meanwhile is ignored.
+	cmd := p.choose(&d.m, key)
+	if cmd == nil || p.busy == "" {
+		t.Fatal("picking didn't start")
+	}
+	if again := p.choose(&d.m, key); again != nil {
+		t.Error("a second pick while busy wasn't ignored")
+	}
+
+	// Closed before the link is made: cancelled, nothing copied.
+	d.m.search = nil
+	d.wait = scryptWait
+	d.run(cmd)
+	if clip.content != "" {
+		t.Errorf("copied after the picker was closed: %q", clip.content)
+	}
+}
+
+func TestPlainEnvNotPickableFromFavourites(t *testing.T) {
+	mem, _ := store.Load("")
+	d := newDriverOpts(t, Options{Store: mem}, fake.Azure(0), fake.Repos())
+	var src provider.Source
+	for _, s := range d.m.sourceResults["Repos"].sources {
+		if s.Here {
+			src = s
+		}
+	}
+	// A key in the demo repo's plain .env, starred.
+	key := "lazysecrets://repo/" + url.PathEscape(src.Detail) + "/.env/DATABASE_URL"
+	mem.Update(key, func(n *store.Node) {
+		n.StarredBy = []string{"Repos"}
+		n.Path = []string{src.Name, ".env"}
+		n.Source = src.ID
+	})
+	src.Provider = "Repos"
+	d.run(d.m.shareFiles(src, nil))
+	favs, _ := d.m.storeEntries()
+	for _, o := range favs {
+		if o.star == key {
+			if _, ok := pickable(o); ok {
+				t.Error("a plain .env value is offered as a key in Favourites")
+			}
+			return
+		}
+	}
+	t.Fatalf("the starred key isn't among the favourites: %d", len(favs))
+}
+
+// refusing is a provider whose values can't be read, like a disabled
+// version in Key Vault.
+type refusing struct{ provider.Provider }
+
+func (refusing) Value(context.Context, provider.Object) (provider.SecretValue, error) {
+	return provider.SecretValue{}, &provider.Denied{
+		Err:    errors.New("Operation get is not allowed on a disabled secret."),
+		Checks: []string{"the secret's version is enabled"},
+	}
+}
+
+func TestOpenFailsInAPopup(t *testing.T) {
+	key, _ := share.ParseKey("https://" + kv + "/secrets/db-password")
+	link, err := share.Seal(share.Header{Key: key, Repo: "git.example.com/team/app"},
+		[]byte("correct-horse-battery-staple"), []share.File{{Path: ".env", Data: []byte("A=1\n")}}, demoRules)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d := newDriverOpts(t, Options{}, refusing{fake.Azure(0)})
+	d.wait = scryptWait
+	d.send(tea.PasteMsg{Content: link.String()})
+	d.keys("o")
+	p := d.m.prompt
+	if p == nil || p.title != "Can't decrypt the shared files" || !strings.Contains(d.screen(), "Can't use db-password: Operation get is not allowed") {
+		t.Fatalf("not in a popup:\n%s", d.screen())
+	}
+	if strings.Contains(d.screen(), "version is enabled") {
+		t.Error("the whole message is shown before asking")
+	}
+	d.keys("r")
+	if !strings.Contains(d.screen(), "version is enabled") {
+		t.Errorf("r doesn't show the whole message:\n%s", d.screen())
+	}
+	d.keys("g")
+	if _, _, sel := d.selected(); d.m.prompt != nil || (sel != "db-password" && (d.m.nav == nil || d.m.nav.ref.Name != "db-password")) {
+		t.Errorf("g doesn't go to the key: %q, %q\n%s", sel, d.m.flash.text, d.screen())
+	}
+}

internal/ui/app/sources.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"slices"
 	"strings"
+	"time"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
@@ -39,7 +41,7 @@ type sourceRow struct {
 
 // sourceRowKey joins a provider ID and a source ID. "|" doesn't occur in
 // either; provider IDs contain "/" (Azure:user/tenant).
-func sourceRowKey(providerID, sourceID string) string { return providerID + "|" + sourceID }
+func sourceRowKey(providerID, sourceID string) string { return cachefile.Row(providerID, sourceID) }
 
 func splitSourceRow(row string) (providerID, sourceID string) {
 	providerID, sourceID, _ = strings.Cut(row, "|")
@@ -56,7 +58,7 @@ func sourceRowID(r sourceRow) string {
 	return sourceRowKey(r.provider, r.source.ID)
 }
 
-func newSourcesList(iconSet icons.Set, mem *store.Store) panes.List[sourceRow] {
+func newSourcesList(iconSet icons.Set, mem *store.Store, recent bool) panes.List[sourceRow] {
 	return panes.NewList("[1] Sources", panes.Item[sourceRow]{
 		ID: sourceRowID,
 		// Headers have no filter text, so filtering shows just sources.
@@ -78,8 +80,8 @@ func newSourcesList(iconSet icons.Set, mem *store.Store) panes.List[sourceRow] {
 			node := mem.Node(sourceKey(r.source))
 			kind := st.Kind(r.group)
 			starred := ""
-			if r.kind == rowSource && node.StarredFor(r.source.Provider) {
-				starred = st.Favourite.Render(star)
+			if r.kind == rowSource {
+				starred = marks(st, node, r.source.Provider, recent, time.Now())
 			}
 			switch {
 			case r.kind == rowLinks:

internal/ui/app/testdata/TestGolden.golden

@@ -1,5 +1,5 @@
 ╭─ [0] lazysecrets ─────────────╮╭─ platform-prod ─────────────────────────────────────────────────╮
-│ 2 accounts                    ││ name       platform-prod                                        │
+│ ⚠ 1 expiring · 2 accounts     ││ name       platform-prod                                        │
 ╰───────────────────────────────╯│ ID         sub-prod                                             │
 ╭─ [1] Sources - Favourites ────╮│ web        https://portal.azure.com/#resource/subscriptions/sub…│
 │ ▾ Azure (2)                   ││ vaults     3                                                    │
@@ -20,7 +20,8 @@
 ╭─ [3] Secrets - Keys - Certs ──╮│                                                                 │
 │ db-password                   ││                                                                 │
 │ api-key                       ││                                                                 │
-│ legacy-token (disabled)       ││                                                                 │
+│ legacy-token ✗ expired        ││                                                                 │
+│ smtp-password (disabled)      ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
@@ -28,6 +29,5 @@
 │                               ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
-│                               ││                                                                 │
-╰────────────────────── 1 of 3 ─╯╰──────────────────────────────────────────────────────── 1 of 4 ─╯
+╰────────────────────── 1 of 4 ─╯╰──────────────────────────────────────────────────────── 1 of 4 ─╯
  enter open • ctrl+s search • s copy link • S share • f star • F favourites • … • ? help • q quit

internal/ui/app/timeout_test.go

@@ -0,0 +1,25 @@
+package app
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+)
+
+// A provider's own timeout applies to it alone.
+func TestTimeoutPerProvider(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{Timeout: 5 * time.Second, Timeouts: map[provider.Kind]time.Duration{provider.KindAzure: 10 * time.Millisecond}},
+		fake.Azure(300*time.Millisecond), fake.Databricks(300*time.Millisecond))
+	scr := d.screen()
+	if !strings.Contains(scr, "✗ Azure: context deadline exceeded") || !strings.Contains(scr, "Databricks (…)") ||
+		strings.Contains(scr, "Databricks: context deadline") {
+		t.Errorf("want Azure timed out and Databricks still loading:\n%s", scr)
+	}
+	if got := (timeouts{def: time.Minute}).of(provider.KindRepo); got != time.Minute {
+		t.Errorf("no override: %s, want the default", got)
+	}
+}

internal/ui/app/update.go

@@ -20,7 +20,8 @@ type Updater struct {
 }
 
 // updateEvery is how often lazysecrets looks for a newer release on its
-// own; within that, the last answer (in the state file) is used.
+// own unless the config says otherwise; within that, the last answer (in
+// the state file) is used.
 const updateEvery = 24 * time.Hour
 
 type updateMsg struct {
@@ -35,14 +36,14 @@ type installedMsg struct {
 }
 
 // startUpdateCheck sets up the startup look for a newer release: the
-// state file's answer when it looked less than a day ago, else a quiet
+// state file's answer when it looked within updateEvery, else a quiet
 // look at the server (fetchOnStart, for Init).
 func (m *Model) startUpdateCheck() {
 	if m.updater == nil || !m.updateCheck {
 		return
 	}
 	last := m.store.UpdateCheck()
-	if m.now().Sub(last.At) < updateEvery {
+	if m.now().Sub(last.At) < m.updateEvery {
 		m.offer(update.Release{Tag: last.Tag, Body: last.Notes, URL: last.URL})
 		return
 	}
@@ -109,15 +110,22 @@ func (m *Model) update() tea.Cmd {
 func (m *Model) showUpdate() {
 	r := *m.newer
 	lines := []string{m.st.Muted.Render("You have " + m.versionLabel() + ".")}
-	if notes := r.Notes(); notes != "" {
+	if notes := r.Notes(m.version); notes != "" {
 		lines = append(lines, "")
 		for _, l := range strings.Split(notes, "\n") {
 			if h, ok := strings.CutPrefix(l, "### "); ok {
 				l = m.st.Label.Render(h)
+			} else if h, ok := strings.CutPrefix(l, "## "); ok { // a release, when several are new
+				l = m.st.TitleFocused.Render(h)
 			}
 			lines = append(lines, l)
 		}
 	}
+	// A popup doesn't scroll: several releases behind, the rest is on
+	// the release pages.
+	if most := max(6, m.h-12); len(lines) > most {
+		lines = append(lines[:most-1], m.st.Muted.Render("… and more on the release pages"))
+	}
 	opts := []option{{key: "u", label: "Update now", tip: "Download, check and replace this lazysecrets; restart to use it.",
 		run: func(m *Model) tea.Cmd { return m.install(r) }}}
 	if r.URL != "" {

internal/ui/app/update_test.go

@@ -83,6 +83,12 @@ func TestUpdate(t *testing.T) {
 	if f2.asked != 1 {
 		t.Errorf("asked %d times a day later", f2.asked)
 	}
+	// With autoCheckInterval: 1h, two hours on is long enough.
+	mem.SetUpdateCheck(store.UpdateCheck{At: time.Now().Add(-2 * time.Hour), Tag: "v0.2.0"})
+	newDriverOpts(t, Options{Version: "0.1.1", Updater: f2.updater(), UpdateCheck: true, UpdateEvery: time.Hour, Store: mem})
+	if f2.asked != 2 {
+		t.Errorf("asked %d times, want a look after the hour", f2.asked)
+	}
 }
 
 func TestUpdateAsked(t *testing.T) {
@@ -116,3 +122,11 @@ func TestUpdateAsked(t *testing.T) {
 		t.Errorf("U on a dev build:\n%s", dev.screen())
 	}
 }
+
+func TestStartupWarning(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{Warning: "theme: skipped unknown activeBorder"})
+	if !strings.Contains(d.screen(), "theme: skipped unknown activeBorder") {
+		t.Errorf("no warning:\n%s", d.screen())
+	}
+}

internal/ui/app/usage.go

@@ -8,7 +8,7 @@ import (
 // Usage: revealing, copying, opening in the browser, sharing and jumping
 // to an item count as using it. The store keeps when each item was last
 // used and how often, for the Recent section of the jump list. The config's
-// history: false turns this off.
+// storage.history: false turns this off.
 
 // used counts a use of the remembered item key, keeping its context.
 func (m *Model) used(key string) {

internal/ui/icons/icons.go

@@ -11,6 +11,7 @@ type Set struct {
 	Repo       string
 	Encrypted  string // an encrypted file (SOPS)
 	PlainFile  string // a plain text secrets file (.env)
+	Note       string // has a note (lazysecrets list)
 }
 
 // None renders no icons.
@@ -24,6 +25,7 @@ var NerdFont = Set{
 	Repo:       "\U000F02A2", // md-git
 	Encrypted:  "\U000F033E", // md-lock
 	PlainFile:  "\U000F0214", // md-file
+	Note:       "\U000F09ED",
 }
 
 // Prefix returns the icon for kind followed by a space, or "" if the set has

internal/ui/keys/keys.go

@@ -95,7 +95,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "pane3", &m.Pane3, "Secrets pane", "move", "Focus the Secrets pane."),
 		a(Lists, "pane4", &m.Pane4, "detail pane", "move", "Focus the detail pane."),
 		a(Lists, "pane0", &m.Pane0, "status", "move", "Focus the status pane: version and updates, accounts, config files, links and the changelog, on the right."),
-		a(Lists, "enter", &m.Enter, "open", "move", "Go into the selected item: from a subscription to its vaults, from a vault to its secrets. On a provider header, fold or unfold it."),
+		a(Lists, "open", &m.Enter, "open", "move", "Go into the selected item: from a subscription to its vaults, from a vault to its secrets. On a provider header, fold or unfold it."),
 		a(Lists, "back", &m.Back, "back", "move", "Go back: clear an applied filter, leave the versions view, or focus the previous pane."),
 
 		a(Lists, "filter", &m.Filter, "filter", "lists", "Filter the focused list by name, fuzzily: dbpw finds db-password. In Sources the provider and account match too."),
@@ -103,7 +103,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "nextTab", &m.NextTab, "next tab", "lists", "Next tab of the focused pane."),
 		a(Lists, "sourcesView", &m.SourcesView, "grouped/flat sources", "lists", "Switch the Sources pane between grouped by provider and a flat list."),
 		a(Lists, "star", &m.Favourite, "star", "lists", "Star or unstar the selected subscription, vault or secret, for the account showing it. Starred items get a ★ and sort first."),
-		a(Lists, "search", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one. Again in Go to: only the source or group you're in, and back to all. On the left, the scope: All, an account (or Databricks, or Repos), or one source (○ ◐ ● for how much of it is loaded)."),
+		a(Lists, "goTo", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one. Again in Go to: only the source or group you're in, and back to all. On the left, the scope: All, an account (or Databricks, or Repos), or one source (○ ◐ ● for how much of it is loaded)."),
 		a(Lists, "favourites", &m.Favourites, "favourites", "lists", "Go to, on Favourites: everything you've starred, to search and jump to."),
 		a(Lists, "recent", &m.Recent, "recent", "lists", "Go to, on Recent: what you used last, newest first."),
 		a(Lists, "commands", &m.Commands, "commands", "lists", "List the custom commands for the focused pane (customCommands in the config) and run one."),
@@ -114,10 +114,10 @@ func (m *Map) Actions() []Action {
 		a(Lists, "copyReference", &m.CopyRef, "copy reference", "secrets", "Copy the reference to use in config, e.g. @Microsoft.KeyVault(SecretUri=…) or {{secrets/scope/key}}."),
 		a(Lists, "versions", &m.Versions, "versions", "secrets", "List the versions of the selected item (Azure). Reveal, copy and share then act on the selected version."),
 		a(Lists, "openInBrowser", &m.Open, "open in browser", "secrets", "Open the selected subscription, vault or item in the browser (Azure portal or Databricks workspace)."),
-		a(Lists, "edit", &m.Edit, "open file", "secrets", "Open the selected SOPS or .env file, or the file of the selected secret at its line. SOPS files open with sops edit. Others open in the nvim lazysecrets runs in (quitting lazysecrets), else in $VISUAL or $EDITOR, else in the system's default app."),
+		a(Lists, "edit", &m.Edit, "open file", "secrets", "Open the selected SOPS or .env file, or the file of the selected secret at its line; on the status pane, your config (made if it isn't there yet). SOPS files open with sops edit. Others open in the nvim lazysecrets runs in (quitting lazysecrets), else in $VISUAL or $EDITOR, else in the system's default app."),
 
-		a(Lists, "share", &m.Share, "copy link", "share", "Copy a lazysecrets:// link to the selected subscription, workspace, vault, scope or secret, for sharing. From the versions view the link is pinned to that version."),
-		a(Lists, "shareMenu", &m.ShareMenu, "share", "share", "Choose what to share: the lazysecrets link, the plain Key Vault URL, the config reference, or the web page."),
+		a(Lists, "copyLink", &m.Share, "copy link", "share", "Copy a lazysecrets:// link to the selected subscription, workspace, vault, scope or secret, for sharing. From the versions view the link is pinned to that version."),
+		a(Lists, "shareMenu", &m.ShareMenu, "share", "share", "Choose what to share: the lazysecrets link, the plain Key Vault URL, the config reference, the web page, or env files as an encrypted link."),
 		a(Lists, "openLink", &m.OpenRef, "open link", "share", "Open a lazysecrets:// link, Key Vault URL or reference. Pasting one into lazysecrets does the same."),
 
 		a(Lists, "dividerLeft", &m.SplitLeft, "divider left", "layout", "Move the divider between the left panes and the detail pane to the left."),
@@ -184,13 +184,13 @@ var defaults = map[string][]string{
 	"lists.top": {"g", "home"}, "lists.bottom": {"G", "end"},
 	"lists.nextPane": {"tab"}, "lists.prevPane": {"shift+tab", "h", "left"}, "lists.details": {"l", "right"},
 	"lists.pane1": {"1"}, "lists.pane2": {"2"}, "lists.pane3": {"3"}, "lists.pane4": {"4"}, "lists.pane0": {"0"},
-	"lists.enter": {"enter"}, "lists.back": {"esc", "backspace"},
+	"lists.open": {"enter"}, "lists.back": {"esc", "backspace"},
 	"lists.filter": {"/"}, "lists.prevTab": {"["}, "lists.nextTab": {"]"}, "lists.sourcesView": {"`"},
-	"lists.star": {"f"}, "lists.favourites": {"F"}, "lists.recent": {"R"}, "lists.search": {"ctrl+s"}, "lists.note": {"n"},
+	"lists.star": {"f"}, "lists.favourites": {"F"}, "lists.recent": {"R"}, "lists.goTo": {"ctrl+s"}, "lists.note": {"n"},
 	"lists.commands": {"x"},
 	"lists.reveal":   {"space"}, "lists.copyValue": {"y"}, "lists.copyReference": {"Y"},
 	"lists.versions": {"v"}, "lists.openInBrowser": {"o"}, "lists.edit": {"e"},
-	"lists.share": {"s"}, "lists.shareMenu": {"S"}, "lists.openLink": {"ctrl+o"},
+	"lists.copyLink": {"s"}, "lists.shareMenu": {"S"}, "lists.openLink": {"ctrl+o"},
 	"lists.dividerLeft": {"ctrl+left", "<"}, "lists.dividerRight": {"ctrl+right", ">"},
 	"lists.taller": {"ctrl+down", "}"}, "lists.shorter": {"ctrl+up", "{"},
 	"lists.zoomIn": {"+"}, "lists.zoomOut": {"_"}, "lists.resetLayout": {"="},

internal/ui/panes/detail.go

@@ -60,6 +60,16 @@ func (d *Detail) ShowSecret(s provider.Object) {
 	d.container = &s.Container
 }
 
+// Refresh shows s's newer metadata if s is the secret shown, keeping
+// its account and any value shown or loading.
+func (d *Detail) Refresh(s provider.Object) {
+	if d.secret == nil || d.secret.ID != s.ID {
+		return
+	}
+	s.Container = d.secret.Container
+	d.secret = &s
+}
+
 // ShowContainer shows a container summary when no secret is selected.
 func (d *Detail) ShowContainer(c provider.Container) {
 	d.Clear()
@@ -170,6 +180,24 @@ func (d Detail) View(st styles.Styles, focused bool, spin string) string {
 
 const spinnerPlaceholder = "\x00spin\x00"
 
+// carryStyle starts each wrapped line with the styles still on at the end
+// of the line before: a styled value wrapped in the middle (a long ref)
+// would go on unstyled, as each line is drawn on its own.
+func carryStyle(lines []string) []string {
+	var on string
+	for i, line := range lines {
+		lines[i] = on + line
+		for _, code := range sgr.FindAllString(line, -1) {
+			if code == "\x1b[m" || code == "\x1b[0m" {
+				on = ""
+			} else {
+				on += code
+			}
+		}
+	}
+	return lines
+}
+
 // lines renders the body, wrapped to the pane width.
 func (d Detail) lines(st styles.Styles) []string {
 	inner := max(1, d.w-3)
@@ -177,7 +205,7 @@ func (d Detail) lines(st styles.Styles) []string {
 	field := func(label, value string) {
 		prefix := " " + st.Label.Render(fmt.Sprintf("%-10s", label)) + " "
 		indent := strings.Repeat(" ", 12)
-		wrapped := strings.Split(ansi.Hardwrap(value, max(1, inner-11), true), "\n")
+		wrapped := carryStyle(strings.Split(ansi.Hardwrap(value, max(1, inner-11), true), "\n"))
 		out = append(out, prefix+wrapped[0])
 		for _, w := range wrapped[1:] {
 			out = append(out, indent+w)

internal/ui/panes/detail_test.go

@@ -0,0 +1,17 @@
+package panes
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestWrappedValueKeepsItsStyle(t *testing.T) {
+	red := "\x1b[31m"
+	got := carryStyle([]string{red + "@Microsoft.KeyVault(SecretUri=https://kv", "-app-prod.vault.azure.net/secrets/x)\x1b[m", "after"})
+	if !strings.HasPrefix(got[1], red) {
+		t.Errorf("the wrapped line lost the style: %q", got[1])
+	}
+	if strings.HasPrefix(got[2], red) {
+		t.Errorf("the style went on past its reset: %q", got[2])
+	}
+}

internal/ui/styles/theme.go

@@ -45,7 +45,9 @@ var Roles = map[string]string{
 }
 
 // FromTheme returns the default styles with the theme's roles applied, and
-// the default text colour if the theme sets one.
+// the default text colour if the theme sets one. Roles it doesn't know are
+// skipped (see Unknown): a theme file made for a newer lazysecrets still
+// works.
 func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 	st := Default()
 	var fg color.Color
@@ -56,7 +58,7 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 	sort.Strings(roles)
 	for _, role := range roles {
 		if _, ok := Roles[role]; !ok {
-			return st, nil, fmt.Errorf("theme: unknown role %q (known: %s)", role, strings.Join(sortedRoles(), ", "))
+			continue
 		}
 		v, err := parse(theme[role])
 		if err != nil {
@@ -107,13 +109,20 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 	return st, fg, nil
 }
 
-func sortedRoles() []string {
-	var out []string
-	for r := range Roles {
-		out = append(out, r)
+// Unknown says which of the theme's roles aren't known, for a warning, or
+// is empty.
+func Unknown(theme map[string][]string) string {
+	var unknown []string
+	for r := range theme {
+		if _, ok := Roles[r]; !ok {
+			unknown = append(unknown, r)
 		}
-	slices.Sort(out)
-	return out
+	}
+	if len(unknown) == 0 {
+		return ""
+	}
+	slices.Sort(unknown)
+	return "theme: skipped unknown " + strings.Join(unknown, ", ") + " (a typo, or from a newer lazysecrets)"
 }
 
 // value is a parsed role: a colour (nil for default) and attributes.

internal/ui/styles/theme_test.go

@@ -44,19 +44,29 @@ func TestFromTheme(t *testing.T) {
 
 func TestFromThemeRejectsMistakes(t *testing.T) {
 	for name, theme := range map[string]map[string][]string{
-		"role":    {"activeBorder": {"red"}},
 		"colour":  {"errorColor": {"redish"}},
 		"hex":     {"errorColor": {"#fff"}},
 		"palette": {"errorColor": {"300"}},
 	} {
 		if _, _, err := FromTheme(theme); err == nil {
 			t.Errorf("%s: no error", name)
-		} else if name == "role" && !strings.Contains(err.Error(), "activeBorderColor") {
-			t.Errorf("unknown role error should list the known ones: %v", err)
 		}
 	}
 }
 
+func TestUnknownRolesSkipped(t *testing.T) {
+	theme := map[string][]string{"activeBorder": {"red"}, "errorColor": {"red"}}
+	if _, _, err := FromTheme(theme); err != nil {
+		t.Errorf("unknown role failed the theme: %v", err)
+	}
+	if w := Unknown(theme); !strings.Contains(w, "unknown activeBorder ") || strings.Contains(w, "errorColor") {
+		t.Errorf("warning = %q", w)
+	}
+	if w := Unknown(map[string][]string{"errorColor": {"red"}}); w != "" {
+		t.Errorf("warning for known roles: %q", w)
+	}
+}
+
 func TestEmptyThemeIsDefault(t *testing.T) {
 	st, fg, err := FromTheme(nil)
 	if err != nil || fg != nil || st.Selected.GetReverse() || st.Selected.GetBackground() != lipgloss.BrightBlack {

internal/update/update.go

@@ -28,6 +28,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"slices"
 	"strings"
 	"time"
 
@@ -54,17 +55,43 @@ const maxDownload = 200 << 20
 // Release is a published release.
 type Release struct {
 	Tag string `json:"tag_name"`
-	Body string `json:"body"` // the changelog section, then install notes
+	// Body is the changelog section, then install notes. From Latest,
+	// it's the changelogs of the recent releases, each under a "## v…"
+	// heading, so someone a few versions behind sees all they missed.
+	Body       string `json:"body"`
 	URL        string `json:"html_url"`
+	Draft      bool   `json:"draft"`
+	Prerelease bool   `json:"prerelease"`
 }
 
-// Notes is the release's changelog: its body without the install notes
-// every release ends with.
-func (r Release) Notes() string {
-	notes, _, _ := strings.Cut(r.Body, "## Install")
+// Notes is the changelog since the version current: of each release
+// newer than it (just this one for a dev build), without the install
+// notes every release ends with.
+func (r Release) Notes(current string) string {
+	body, _, _ := strings.Cut(r.Body, "## Install")
+	var keep, headings []string
+	in := true // before any heading: a single release's notes
+	for _, l := range strings.Split(body, "\n") {
+		if tag, ok := strings.CutPrefix(l, "## "); ok && semver.IsValid(tag) {
+			in = Newer(current, tag) || tag == r.Tag
+			if in {
+				headings = append(headings, l)
+			}
+		}
+		if in {
+			keep = append(keep, l)
+		}
+	}
+	notes := strings.Join(keep, "\n")
+	if len(headings) == 1 { // the title names it
+		notes = strings.Replace(notes, headings[0], "", 1)
+	}
 	return PlainLinks(strings.TrimSpace(notes))
 }
 
+// recentReleases is how many releases Latest reads the changelogs of.
+const recentReleases = 10
+
 // PlainLinks shows Markdown links as their text, for a terminal.
 func PlainLinks(s string) string { return mdLink.ReplaceAllString(s, "$1") }
 
@@ -128,18 +155,29 @@ func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
 	}
 	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
 	defer cancel()
-	b, err := c.get(ctx, api+"/releases/latest", 1<<20)
+	// The recent releases in one request (per_page on GitHub, limit on
+	// Gitea), for their changelogs.
+	b, err := c.get(ctx, fmt.Sprintf("%s/releases?per_page=%d&limit=%[2]d", api, recentReleases), 1<<20)
 	if err != nil {
 		return Release{}, err
 	}
-	var r Release
-	if err := json.Unmarshal(b, &r); err != nil {
-		return Release{}, fmt.Errorf("reading the latest release from %s: %w", repo, err)
+	var all []Release
+	if err := json.Unmarshal(b, &all); err != nil {
+		return Release{}, fmt.Errorf("reading the releases from %s: %w", repo, err)
 	}
-	if !semver.IsValid(r.Tag) {
-		return Release{}, fmt.Errorf("latest release %q on %s isn't a version", r.Tag, repo)
+	all = slices.DeleteFunc(all, func(r Release) bool { return r.Draft || r.Prerelease || !semver.IsValid(r.Tag) })
+	if len(all) == 0 {
+		return Release{}, fmt.Errorf("no releases on %s", repo)
 	}
-	return r, nil
+	slices.SortFunc(all, func(a, b Release) int { return semver.Compare(b.Tag, a.Tag) })
+	var notes strings.Builder
+	for _, r := range all {
+		section, _, _ := strings.Cut(r.Body, "## Install")
+		fmt.Fprintf(&notes, "## %s\n\n%s\n\n", r.Tag, strings.TrimSpace(section))
+	}
+	latest := all[0]
+	latest.Body = strings.TrimSpace(notes.String())
+	return latest, nil
 }
 
 // Newer reports whether latest is newer than current. A build that isn't

internal/update/update_test.go

@@ -39,11 +39,42 @@ func TestNewer(t *testing.T) {
 
 func TestNotes(t *testing.T) {
 	r := Release{Body: "### Added\n\n- Install with a one-liner (#7)\n\n## Install\n\nOn macOS…"}
-	if got := r.Notes(); got != "### Added\n\n- Install with a one-liner (#7)" {
+	if got := r.Notes("0.1.1"); got != "### Added\n\n- Install with a one-liner (#7)" {
 		t.Errorf("notes %q", got)
 	}
 }
 
+// Latest reads the recent releases, so the notes cover every version
+// since the one running.
+func TestNotesSince(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/keb/lazysecrets/releases" {
+			http.NotFound(w, r)
+			return
+		}
+		fmt.Fprint(w, `[
+			{"tag_name":"v0.4.0-rc1","body":"### Added\n\n- rc","prerelease":true},
+			{"tag_name":"v0.2.0","body":"### Added\n\n- two\n\n## Install\n\ncurl"},
+			{"tag_name":"v0.3.0","body":"### Fixed\n\n- three\n\n## Install\n\ncurl","html_url":"https://example.com/v0.3.0"},
+			{"tag_name":"v0.1.1","body":"### Added\n\n- one"},
+			{"tag_name":"v9.0.0","body":"draft","draft":true}]`)
+	}))
+	t.Cleanup(srv.Close)
+	r, err := (&Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}).Latest(context.Background())
+	if err != nil || r.Tag != "v0.3.0" || r.URL != "https://example.com/v0.3.0" {
+		t.Fatalf("latest %+v %v", r, err)
+	}
+	for current, want := range map[string]string{
+		"0.1.1":       "## v0.3.0\n\n### Fixed\n\n- three\n\n## v0.2.0\n\n### Added\n\n- two",
+		"0.2.0":       "### Fixed\n\n- three",
+		"dev-2ba762c": "### Fixed\n\n- three",
+	} {
+		if got := r.Notes(current); got != want {
+			t.Errorf("notes since %s: %q, want %q", current, got, want)
+		}
+	}
+}
+
 func TestManaged(t *testing.T) {
 	if Managed("/opt/homebrew/Cellar/lazysecrets/0.2.0/bin/lazysecrets") == "" || Managed("/nix/store/abc-lazysecrets/bin/lazysecrets") == "" {
 		t.Error("package managers not recognised")
@@ -70,8 +101,8 @@ func server(t *testing.T, tamper bool) *httptest.Server {
 		sum[0] ^= 0xff
 	}
 	mux := http.NewServeMux()
-	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
-		fmt.Fprint(w, `{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}`)
+	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases", func(w http.ResponseWriter, _ *http.Request) {
+		fmt.Fprint(w, `[{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}]`)
 	})
 	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintf(w, "%s  %s.tar.gz\n", hex.EncodeToString(sum[:]), name)
@@ -173,7 +204,7 @@ func TestInstallRefusesATamperedArchive(t *testing.T) {
 
 func TestNotesShowLinksAsText(t *testing.T) {
 	r := Release{Body: "### Added\n\n- Search ([#11](https://git.example.com/pulls/11)) ([65dc2d7](https://git.example.com/commit/65dc2d7abc))\n\n## Install\n\ncurl …"}
-	if got, want := r.Notes(), "### Added\n\n- Search (#11) (65dc2d7)"; got != want {
+	if got, want := r.Notes("0.1.1"), "### Added\n\n- Search (#11) (65dc2d7)"; got != want {
 		t.Errorf("notes %q, want %q", got, want)
 	}
 }