feat: lazysecrets list marks entries with a note (✎)

README.md

@@ -20,7 +20,8 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 - **Careful with values**: values stay hidden until you reveal them, and
   copied values are cleared from the clipboard after 30 seconds.
 - **Scriptable**: `lazysecrets get <link>` prints a value for scripts and
-  pipes.
+  pipes, and `lazysecrets list` everything it can find, for fzf and editor
+  pickers ([integration](docs/integration.md)).
 - **Favourites**: star the secrets you use most for easy access.
 - **Expiry warnings**: secrets, keys and certificates that expire soon are
   marked, listed together in the status pane.
@@ -86,8 +87,10 @@ use most:
 - [Azure Key Vault](docs/azure.md): accounts, permissions, pinned vaults
 - [Databricks](docs/databricks.md): profiles and Key Vault-backed scopes
 - [SOPS and .env files](docs/repos.md): which repos and files, decrypting
-- [Links](docs/links.md): sharing, opening, `lazysecrets get` in scripts,
+- [Links](docs/links.md): sharing, opening, and opening links from the
-  and opening links from the browser and chat
+  browser and chat
+- [Integration](docs/integration.md): `lazysecrets get` in scripts, and
+  `lazysecrets list` for fzf and editor pickers
 - [Custom commands](docs/custom-commands.md): run your own commands on a
   secret
 - [Config](docs/config.md): every option, themes, layered configs, the

cmd/lazysecrets/get.go

@@ -37,10 +37,15 @@ func value(ctx context.Context, providers []provider.Provider, st *store.Store,
 	return v, err
 }
 
-// readKey is value, also returning the version read.
+// readKey is value, also returning the version read. The account asked
+// for (--account) goes first, else the one that last read it.
 func readKey(ctx context.Context, providers []provider.Provider, st *store.Store, r ref.Ref) (provider.SecretValue, string, error) {
 	key := r
 	key.Version = ""
 	node := st.Node(key.String())
-	return ref.Read(ctx, providers, r, node.Account, node.Source)
+	account, source := node.Account, node.Source
+	if r.Account != "" && r.Account != account {
+		account, source = r.Account, ""
+	}
+	return ref.Read(ctx, providers, r, account, source)
 }

cmd/lazysecrets/list.go

@@ -0,0 +1,258 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"slices"
+	"strings"
+	"syscall"
+	"time"
+
+	"charm.land/lipgloss/v2"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/listing"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
+)
+
+// listCmd prints every source, vault and secret lazysecrets can find, one
+// per line, for fzf, editor pickers and scripts:
+//
+//	lazysecrets list | fzf --ansi --delimiter='\t' --with-nth='2..-3' --nth='2..' --accept-nth=-1
+//
+// Each line is the kind, a mark (✗ or ⚠, ★, ◷ and the provider's icon),
+// the name, a status (why it couldn't be read, or that it has expired or
+// expires soon; else empty), its note (muted, or empty), the account and
+// the link, tab-separated. The mark has a field of its own so a search can
+// leave it out (fzf --nth), and ^prod finds names starting with prod. The
+// name is coloured from the theme,
+// with the provider's icon (as in the TUI: --icons, LAZYSECRETS_ICONS,
+// ui.icons); the link never is.
+//
+// What's cached prints at once; what's missing or older than --max-age
+// follows as it loads. A list that can't be read is a line too, as it
+// fails: the vault or source, then ✗ and why in the theme's error colour.
+// They're in the output rather than on stderr, which would draw over fzf.
+func listCmd(providers []provider.Provider, st *store.Store, cachePath string, timeout func(provider.Kind) time.Duration, theme styles.Styles, withIcons, withRecent bool, expiryWarn time.Duration, args []string, out io.Writer) error {
+	fs := flag.NewFlagSet("list", flag.ContinueOnError)
+	cached := fs.Bool("cached", false, "only what's cached, and repos: load nothing from Azure or Databricks")
+	maxAge := fs.Duration("max-age", 2*time.Minute, "load cached lists older than this again")
+	format := fs.String("format", "text", "text: kind, mark, name, status, note, account and link, tab-separated; json: an object per line")
+	color := fs.String("color", "always", "colour the names (text): always or never; fzf needs --ansi")
+	iconsOn := fs.Bool("icons", withIcons, "put the provider's Nerd Font icon before names (text)")
+	stars := fs.Bool("stars", true, "put ★ before starred names, in the theme's favouriteColor (text)")
+	recent := fs.Bool("recent", withRecent, "put ◷ before names used lately, in mutedColor (text; default ui.recentIcon)")
+	notes := fs.Bool("notes", true, "put ✎ before names with a note, in mutedColor (text; the note is printed either way)")
+	expiry := fs.Bool("expiry", true, "mark and say which have expired (✗ expired) or expire within ui.expiryWarningDays (⚠ expires in 12d) (text)")
+	kinds := fs.String("kind", "", "only these kinds, comma-separated: "+strings.Join(listing.Kinds, ", ")+" (vault: also scopes and repo files)")
+	showErrors := fs.Bool("errors", true, "list the lists that can't be read, with why (text: ✗ lines; json: \"error\")")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() > 0 {
+		return fmt.Errorf("usage: lazysecrets list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]")
+	}
+	var only []string
+	for k := range strings.SplitSeq(*kinds, ",") {
+		if k = strings.TrimSpace(k); k == "" {
+			continue
+		}
+		if !slices.Contains(listing.Kinds, k) {
+			return fmt.Errorf("--kind: %q is not one of %s", k, strings.Join(listing.Kinds, ", "))
+		}
+		only = append(only, k)
+	}
+	if *color != "always" && *color != "never" {
+		return fmt.Errorf("--color: %q is not always or never", *color)
+	}
+	now := time.Now()
+	m := marks{theme: theme, icons: icons.None, stars: *stars, recent: *recent, notes: *notes, expiry: *expiry,
+		color: *color == "always", warn: expiryWarn, now: now}
+	if *iconsOn {
+		m.icons = icons.NerdFont
+	}
+	var write func(listing.Entry) error
+	switch *format {
+	case "text":
+		write = func(e listing.Entry) error {
+			colored := *color == "always"
+			mark := m.of(e)
+			name := nameOf(e, theme, colored)
+			// Why it couldn't be read (vaults, sources), or when it
+			// expires (secrets, keys, certificates): never both.
+			status := errorOf(e, theme, colored)
+			if status == "" && *expiry {
+				status = expiryOf(e, theme, expiryWarn, now, colored)
+			}
+			note := renderer(colored)(theme.Muted, e.Note)
+			// A tab or line break in a name would break the line up.
+			_, err := fmt.Fprintf(out, "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", e.Kind, mark, oneLine.Replace(name), oneLine.Replace(status),
+				oneLine.Replace(note), e.Account, e.Link)
+			return err
+		}
+	case "json":
+		enc := json.NewEncoder(out)
+		enc.SetEscapeHTML(false)
+		write = func(e listing.Entry) error { return enc.Encode(e) }
+	default:
+		return fmt.Errorf("--format: %q is not text or json", *format)
+	}
+
+	// When the reader goes away (a pick in fzf), writing fails instead of
+	// killing the process, so what loaded is still saved.
+	signal.Notify(make(chan os.Signal, 1), syscall.SIGPIPE)
+	var gone error
+	emit := func(e listing.Entry) error {
+		if e.Error != "" && !*showErrors {
+			return nil
+		}
+		if err := write(e); err != nil {
+			gone = err
+			return err
+		}
+		return nil
+	}
+
+	f := cachefile.New()
+	if cachePath != "" {
+		f = cachefile.Read(cachePath)
+	}
+	f = listing.Run(context.Background(), listing.Options{
+		Providers: providers, Cache: f, MaxAge: *maxAge, Cached: *cached, Kinds: only, Timeout: timeout,
+		Mark: func(link, account string) (bool, time.Time, int, string) {
+			n := st.Node(link)
+			return n.StarredFor(account), n.LastUsed, n.Uses, n.Note
+		},
+	}, emit)
+	if cachePath != "" && !*cached {
+		byID := map[string]provider.Provider{}
+		for _, p := range providers {
+			byID[p.ID()] = p
+		}
+		keep := func(id string) bool { p, ok := byID[id]; return ok && p.Kind() != provider.KindRepo }
+		if err := cachefile.Save(cachePath, f, keep, time.Now()); err != nil {
+			return err
+		}
+	}
+	if gone != nil && !errors.Is(gone, syscall.EPIPE) {
+		return gone
+	}
+	return nil // or the reader has what it wanted
+}
+
+var oneLine = strings.NewReplacer("\t", " ", "\r\n", " ", "\n", " ", "\r", " ")
+
+// expiryOf says that a secret, key or certificate has expired, in red,
+// or when it will if that's within warn (expires in 12d), in yellow, or
+// is "". Its mark (✗, ⚠) is before the name.
+func expiryOf(e listing.Entry, theme styles.Styles, warn time.Duration, now time.Time, color bool) string {
+	render := renderer(color)
+	left := e.Expires.Sub(now)
+	switch {
+	case e.Expires.IsZero() || left > warn:
+		return ""
+	case left <= 0:
+		return render(theme.Error, "expired")
+	case left < 24*time.Hour:
+		return render(theme.Warning, fmt.Sprintf("expires in %dh", max(1, int(left.Hours()))))
+	}
+	return render(theme.Warning, fmt.Sprintf("expires in %dd", int(left.Hours()/24)))
+}
+
+// errorOf is why a list couldn't be read, in red, or "". Its mark (✗)
+// is before the name.
+func errorOf(e listing.Entry, theme styles.Styles, color bool) string {
+	return renderer(color)(theme.Error, e.Error)
+}
+
+// nameOf is an entry's name for the text format: the path with the
+// item's own name standing out, and the account.
+func nameOf(e listing.Entry, theme styles.Styles, color bool) string {
+	render := renderer(color)
+	var name string
+	if n := len(e.Path); n > 0 {
+		if n > 1 {
+			name = render(theme.Muted, strings.Join(e.Path[:n-1], " / ")+" / ")
+		}
+		name += e.Path[n-1]
+	}
+	if e.AccountLabel != "" {
+		name += render(theme.Muted, " · "+e.AccountLabel)
+	}
+	return name
+}
+
+// marks says what goes before the name, in a field of its own so a
+// search leaves it out: ✗ in red when something's wrong (it couldn't be
+// read, or has expired) or ⚠ when it expires within warn; ★ for a starred
+// entry and ◷ for one used lately, as the TUI marks them; ✎ for one with a
+// note; then the provider's icon. The marks are right-aligned in room for every kind
+// turned on, so they sit by the icon and names line up.
+type marks struct {
+	theme                               styles.Styles
+	icons                               icons.Set
+	stars, recent, notes, expiry, color bool
+	warn                                time.Duration // ui.expiryWarningDays
+	now                                 time.Time
+}
+
+func (m marks) of(e listing.Entry) string {
+	render := renderer(m.color)
+	var parts []string
+	room := 0 // marks turned on
+	mark := func(on bool, st lipgloss.Style, s string) {
+		room++
+		if on {
+			parts = append(parts, render(st, s))
+		}
+	}
+	// What's wrong, then what to watch: room for one of them.
+	switch left := e.Expires.Sub(m.now); {
+	case e.Error != "" || (m.expiry && !e.Expires.IsZero() && left <= 0):
+		mark(true, m.theme.Error, "✗")
+	case m.expiry && !e.Expires.IsZero() && left <= m.warn:
+		mark(true, m.theme.Warning, "⚠")
+	default:
+		mark(false, m.theme.Error, "")
+	}
+	if m.stars {
+		mark(e.Starred, m.theme.Favourite, "★")
+	}
+	if m.recent {
+		mark(e.Recent, m.theme.Muted, "◷")
+	}
+	if m.notes {
+		mark(e.Note != "", m.theme.Muted, "✎")
+	}
+	pad := strings.Repeat("  ", room-len(parts)) // each mark and its space
+	kind := provider.Kind("")
+	for _, k := range []provider.Kind{provider.KindAzure, provider.KindDatabricks, provider.KindRepo} {
+		if strings.EqualFold(string(k), e.Provider) {
+			kind = k
+		}
+	}
+	if icon := strings.TrimSpace(m.icons.Prefix(kind)); icon != "" {
+		parts = append(parts, render(m.theme.Kind(kind), icon))
+	} else if len(parts) == 0 {
+		pad = strings.TrimSuffix(pad, " ") // no mark after the room
+	}
+	return pad + strings.Join(parts, " ")
+}
+
+func renderer(color bool) func(lipgloss.Style, string) string {
+	return func(st lipgloss.Style, s string) string {
+		if !color || s == "" {
+			return s
+		}
+		return st.Render(s)
+	}
+}

cmd/lazysecrets/list_test.go

@@ -0,0 +1,153 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/listing"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
+)
+
+func TestListNames(t *testing.T) {
+	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-app-prod", "db-password"}, AccountLabel: "alice"}
+	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-app-prod / db-password · alice" {
+		t.Errorf("plain: %q", got)
+	}
+	// The item's own name isn't muted with its path.
+	if got := nameOf(e, styles.Default(), true); !strings.Contains(got, "\x1b[mdb-password") {
+		t.Errorf("name not set apart: %q", got)
+	}
+}
+
+func TestListMarks(t *testing.T) {
+	az := icons.NerdFont.Azure
+	plain := marks{theme: styles.Default(), icons: icons.NerdFont, stars: true}
+	noIcons := plain
+	noIcons.icons = icons.None
+	colored := noIcons
+	colored.color = true
+	for _, c := range []struct {
+		m    marks
+		e    listing.Entry
+		want string
+	}{
+		// Room for the status mark and the star, so names line up.
+		{plain, listing.Entry{Provider: "azure", Starred: true}, "  ★ " + az},
+		{plain, listing.Entry{Provider: "azure"}, "    " + az},
+		{marks{icons: icons.NerdFont}, listing.Entry{Provider: "azure", Starred: true}, "  " + az},
+		{noIcons, listing.Entry{Provider: "azure", Starred: true}, "  ★"},
+		{marks{}, listing.Entry{Provider: "azure", Starred: true}, " "},
+		{colored, listing.Entry{Provider: "azure", Starred: true}, "  " + styles.Default().Favourite.Render("★")},
+	} {
+		if got := c.m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+}
+
+func TestListRecentMarks(t *testing.T) {
+	az := icons.NerdFont.Azure
+	m := marks{icons: icons.NerdFont, stars: true, recent: true}
+	for _, c := range []struct {
+		e    listing.Entry
+		want string
+	}{
+		// Right-aligned in room for three: by the icon, names lined up.
+		{listing.Entry{Provider: "azure", Starred: true, Recent: true}, "  ★ ◷ " + az},
+		{listing.Entry{Provider: "azure", Recent: true}, "    ◷ " + az},
+		{listing.Entry{Provider: "azure"}, "      " + az},
+	} {
+		if got := m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+}
+
+func TestListExpiry(t *testing.T) {
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	warn := 30 * 24 * time.Hour
+	for _, c := range []struct {
+		expires time.Time
+		want    string
+	}{
+		{time.Time{}, ""},
+		{now.Add(-time.Hour), "expired"},
+		{now.Add(12*24*time.Hour + time.Hour), "expires in 12d"},
+		{now.Add(5 * time.Hour), "expires in 5h"},
+		{now.Add(60 * 24 * time.Hour), ""},
+	} {
+		if got := expiryOf(listing.Entry{Expires: c.expires}, styles.Default(), warn, now, false); got != c.want {
+			t.Errorf("expires %v: %q, want %q", c.expires, got, c.want)
+		}
+	}
+	if got := expiryOf(listing.Entry{Expires: now.Add(-time.Hour)}, styles.Default(), warn, now, true); got != styles.Default().Error.Render("expired") {
+		t.Errorf("expired isn't red: %q", got)
+	}
+}
+
+func TestListNoteMark(t *testing.T) {
+	az := icons.NerdFont.Azure
+	m := marks{icons: icons.NerdFont, stars: true, notes: true}
+	for _, c := range []struct {
+		e    listing.Entry
+		want string
+	}{
+		{listing.Entry{Provider: "azure", Note: "rotate in May"}, "    ✎ " + az},
+		{listing.Entry{Provider: "azure", Note: "x", Starred: true}, "  ★ ✎ " + az},
+		{listing.Entry{Provider: "azure"}, "      " + az},
+	} {
+		if got := m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+}
+
+func TestListStatusMark(t *testing.T) {
+	az := icons.NerdFont.Azure
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	m := marks{icons: icons.NerdFont, stars: true, expiry: true, warn: 30 * 24 * time.Hour, now: now}
+	for _, c := range []struct {
+		e    listing.Entry
+		want string
+	}{
+		// Right-aligned in room for two, as with ★ and ◷.
+		{listing.Entry{Provider: "azure", Error: "403 Forbidden"}, "  ✗ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}, "  ✗ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour), Starred: true}, "✗ ★ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(5 * 24 * time.Hour)}, "  ⚠ " + az},
+		{listing.Entry{Provider: "azure", Expires: now.Add(60 * 24 * time.Hour), Starred: true}, "  ★ " + az},
+	} {
+		if got := m.of(c.e); got != c.want {
+			t.Errorf("%+v: %q, want %q", c.e, got, c.want)
+		}
+	}
+	m.expiry = false // --expiry=false: no ⚠ or ✗ for expiry; errors still
+	if got := m.of(listing.Entry{Provider: "azure", Expires: now.Add(-time.Hour)}); got != "    "+az {
+		t.Errorf("--expiry=false: %q", got)
+	}
+	m.expiry, m.color, m.theme = true, true, styles.Default()
+	if got := m.of(listing.Entry{Error: "403"}); !strings.Contains(got, styles.Default().Error.Render("✗")) {
+		t.Errorf("not a red ✗: %q", got)
+	}
+	if got := m.of(listing.Entry{Expires: now.Add(time.Hour)}); !strings.Contains(got, styles.Default().Warning.Render("⚠")) {
+		t.Errorf("not a yellow ⚠: %q", got)
+	}
+}
+
+func TestListErrors(t *testing.T) {
+	e := listing.Entry{Provider: "azure", Path: []string{"platform-prod", "kv-restricted"}, Error: "403 Forbidden"}
+	if got := nameOf(e, styles.Default(), false); got != "platform-prod / kv-restricted" {
+		t.Errorf("the name has more: %q", got)
+	}
+	if got := errorOf(e, styles.Default(), false); got != "403 Forbidden" {
+		t.Errorf("plain: %q", got)
+	}
+	if got := errorOf(e, styles.Default(), true); got != styles.Default().Error.Render("403 Forbidden") {
+		t.Errorf("why isn't red: %q", got)
+	}
+	if got := errorOf(listing.Entry{}, styles.Default(), true); got != "" {
+		t.Errorf("no error: %q", got)
+	}
+}

cmd/lazysecrets/main.go

@@ -89,6 +89,32 @@ func cmpOr(a, b string) string {
 	return b
 }
 
+// refArg parses get's and open's arguments: a reference, and optionally
+// the account to use when several could (lazysecrets list's column) and,
+// for open, what to do with it rather than asking (--action).
+func refArg(cmd string, args []string) (r ref.Ref, action string, err error) {
+	fs := flag.NewFlagSet(cmd, flag.ContinueOnError)
+	account := fs.String("account", "", "the account to use when several could, as lazysecrets list prints it")
+	usage := "usage: lazysecrets get [--account <account>] <ref>"
+	act := new(string)
+	if cmd == "open" {
+		act = fs.String("action", "", "do this rather than ask: go (to it), copy (go, and copy its value) or show (go, and show it)")
+		usage = "usage: lazysecrets open [--account <account>] [--action go|copy|show] <ref>"
+	}
+	if err := fs.Parse(args); err != nil {
+		return r, "", err
+	}
+	if fs.NArg() != 1 {
+		return r, "", errors.New(usage)
+	}
+	if _, ok := app.OpenActions[*act]; *act != "" && !ok {
+		return r, "", fmt.Errorf("--action: %q is not go, copy or show", *act)
+	}
+	r, err = ref.Parse(fs.Arg(0))
+	r.Account = *account
+	return r, *act, err
+}
+
 // defaultConfigPath is $LAZYSECRETS_CONFIG_FILE, else config.yaml in the
 // config directory.
 func defaultConfigPath() string {
@@ -115,12 +141,18 @@ func run() error {
 	flag.Usage = func() {
 		fmt.Fprintf(flag.CommandLine.Output(), `Usage:
   lazysecrets [flags]             browse secrets
-  lazysecrets [flags] [open] <ref>
+  lazysecrets [flags] [open [--account <account>] [--action go|copy|show]] <ref>
                                   open a lazysecrets:// link (also a share link),
                                   Key Vault URL, @Microsoft.KeyVault(...) or
                                   {{secrets/scope/key}}
-  lazysecrets [flags] get <ref>   print the value a lazysecrets:// link points at,
+  lazysecrets [flags] get [--account <account>] <ref>
+                                  print the value a lazysecrets:// link points at,
                                   for scripts: VAR=$(lazysecrets get <ref>)
+  lazysecrets [flags] list [--kind secret,…] [--cached] [--max-age 2m] [--format text|json]
+                          [--color always|never] [--icons=false] [--errors=false]
+                                  print every source, vault and secret it can
+                                  find, one per line, for fzf and pickers:
+                                  what's cached at once, then what loads
   lazysecrets [flags] share [--key <secret>] <env file>...
                                   print a link to env files of a repo, encrypted
                                   with a secret's value (default: sharing.key)
@@ -146,7 +178,8 @@ Flags:
 	}
 
 	var open, getRef *ref.Ref
-	var shareArgs []string
+	var openAction string
+	var shareArgs, listArgs []string
 	printKeys := false
 	switch args := flag.Args(); {
 	case len(args) > 0 && args[0] == "share":
@@ -154,10 +187,12 @@ Flags:
 		if len(shareArgs) == 0 {
 			shareArgs = []string{} // still sharing: says how
 		}
+	case len(args) > 0 && args[0] == "list":
+		listArgs = append([]string{}, args[1:]...) // not nil: listing
 	case len(args) == 1 && args[0] == "keybindings":
 		printKeys = true
-	case len(args) == 2 && args[0] == "get":
+	case len(args) > 0 && args[0] == "get":
-		r, err := ref.Parse(args[1])
+		r, _, err := refArg("get", args[1:])
 		if err != nil {
 			return err
 		}
@@ -169,12 +204,12 @@ Flags:
 	case len(args) > 0 && args[0] == "update":
 		return updateCmd(*configPath, args[1:])
 	case len(args) == 0:
-	case args[0] == "open" && len(args) == 2:
+	case args[0] == "open" && len(args) >= 2:
-		r, err := ref.Parse(args[1])
+		r, act, err := refArg("open", args[1:])
 		if err != nil {
 			return err
 		}
-		open = &r
+		open, openAction = &r, act
 	case len(args) == 1 && looksLikeRef(args[0]):
 		// lazysecrets <link>, like lazysecrets open <link>
 		r, err := ref.Parse(args[0])
@@ -263,6 +298,8 @@ Flags:
 		}
 	}
 
+	recentIcon := cfg.UI.RecentIcon != nil && *cfg.UI.RecentIcon
+
 	// Stars, notes and the layout. Demo mode keeps them in memory, so
 	// sample vaults never end up in the real file.
 	stateDir, err := config.StateDir()
@@ -283,9 +320,11 @@ Flags:
 	var providers []provider.Provider
 	if *demo {
 		// Two Azure accounts, like a personal and an admin login in az.
+		alice, admin := "Azure:alice@example.com/demo", "Azure:admin.alice@example.com/demo"
+		fake.Seed(st, alice, admin)
 		providers = []provider.Provider{
-			fake.Azure(400*time.Millisecond).As("Azure:alice@example.com/demo", "Azure · alice"),
+			fake.Azure(400*time.Millisecond).As(alice, "Azure · alice"),
-			fake.AzureOps(700*time.Millisecond).As("Azure:admin.alice@example.com/demo", "Azure · admin.alice"),
+			fake.AzureOps(700*time.Millisecond).As(admin, "Azure · admin.alice"),
 			fake.Databricks(600 * time.Millisecond),
 			fake.Repos(),
 		}
@@ -345,6 +384,13 @@ Flags:
 		defer cancel()
 		return get(ctx, providers, st, *getRef)
 	}
+	if listArgs != nil {
+		cachePath := ""
+		if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
+			cachePath = filepath.Join(d, "cache.json")
+		}
+		return listCmd(providers, st, cachePath, timeoutFor, theme, *icons, recentIcon, time.Duration(expiryDays)*24*time.Hour, listArgs, os.Stdout)
+	}
 	if shareArgs != nil {
 		// The files from a repo, the key from whichever provider it's
 		// in: the longest timeout.
@@ -433,6 +479,8 @@ Flags:
 		ShareKey:       cfg.Sharing.Key,
 		ShareRules:     shareRules(cfg),
 		Open:           open,
+		OpenAction:     openAction,
+		RecentIcon:     recentIcon,
 		Styles:         &theme,
 		DefaultFg:      defaultFg,
 	})

docs/config.md

@@ -9,10 +9,11 @@ it isn't there yet); changes apply when lazysecrets starts again.
 ```yaml
 ui:
   icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
+  recentIcon: false      # mark items used lately (Recent, R) with ◷, here and in lazysecrets list
   sourcesView: grouped   # or flat; ` toggles it
   collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
   loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
-  expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
+  expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d; ⚠ in lazysecrets list); expired ones get ✗
 values:
   revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
   hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
@@ -140,7 +141,8 @@ you: the Sources lists, vaults and scopes, and secrets' names and metadata
 once, and anything older than two minutes reloads in the background when
 you go to it, or when Go to searches it. While it does, the pane's
 bottom border says how old what it shows is (`cached 3h ago`). Revealing
-and copying always fetch the value live.
+and copying always fetch the value live. [`lazysecrets list`](integration.md#listing-for-fzf-and-pickers)
+reads it and adds to it too.
 
 Lists not loaded for 30 days are dropped, and so is everything from an
 account you're no longer signed in to. Repos aren't cached: their files

docs/integration.md

@@ -0,0 +1,97 @@
+# Integration
+
+lazysecrets works outside its own window too: `lazysecrets get` reads a
+value for scripts, and `lazysecrets list` lists everything for fzf, editor
+pickers and your own tools. Both take the [links](links.md) lazysecrets
+copies and shares. For Neovim, there's
+[lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim).
+
+## Reading a value
+
+`lazysecrets get <link>` prints the value, for scripts and pipes:
+
+```sh
+export DB_PASSWORD=$(lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password)
+lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password | kubectl create secret generic db --from-file=password=/dev/stdin
+```
+
+It reads the value directly, with your az accounts (the one that last read
+it first), the Databricks profile for the workspace, or sops in your clone
+of the repo; a version in the link reads that version. `--account` tries
+that account first, as [`list`](#listing-for-fzf-and-pickers) prints it.
+The value ends with a newline only on a terminal.
+
+## Listing, for fzf and pickers
+
+`lazysecrets list` prints every source, vault and secret, one per line,
+tab-separated:
+
+| Field | |
+|---|---|
+| kind | `source`, `vault`, `secret`, `key` or `certificate` |
+| name | `platform-prod / kv-app-prod / db-password` |
+| account | what it's listed through: an az account (`Azure:<user>/<tenant>`), `Databricks` or `Repos` |
+| link | its `lazysecrets://` link |
+
+It's what Go to searches, so fzf, or an editor's picker, can search it
+instead, showing the names and acting on the links:
+
+```sh
+lazysecrets list | fzf --ansi --with-nth='2..-3' --accept-nth=-1 \
+  --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
+  --bind 'ctrl-o:become(lazysecrets open --action go --account {-2} {-1})' \
+  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {2..-3})' \
+  --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'
+```
+
+`--with-nth='2..-3'` shows and searches only the names; `{-1}` and
+`--accept-nth=-1` are the link, `{-2}` the account. All but the name are
+one word, so this works without `--delimiter`. To filter by kind
+yourself: `awk -F'\t' '$1 == "secret"'`.
+
+`enter` prints the link (`lazysecrets get $(…)`), `ctrl-o` opens it in
+lazysecrets, `ctrl-y` copies the value, saying so in the header, and
+`ctrl-x` copies it and closes fzf (`pbcopy` on macOS; `wl-copy` or `xclip`
+on Linux). A value copied this way isn't cleared from the
+clipboard after `values.clipboardClear`, as one copied in lazysecrets is.
+
+`--account` makes `open` and `get` use the account it was listed through,
+when several of yours can see it: without, `open` asks which, and `get`
+tries the one that last read it first. The link stays as it is, to copy
+and share; the account isn't part of it. `--action` tells `open` what to
+do rather than asking, as it does for a link clicked elsewhere: `go` to
+it, `copy` its value too, or `show` it. It ends in the secrets list, like
+Go to, rather than on the details as a clicked link does.
+
+What's [cached](config.md#cache) prints at once. Then, like Go to, it loads
+what's missing or older than `--max-age` (2m), and what's new in it follows
+as it arrives: fzf shows it while you type. `--cached` loads nothing from
+Azure or Databricks, for an answer at once. Repos are always read, from
+disk. What it loads is cached for the TUI too. It stops when the reader
+goes, after a pick in fzf.
+
+`--kind` lists only some kinds, comma-separated: `source`, `vault` (also
+Databricks scopes and repo files), `secret`, `key`, `certificate`. Lists
+only other kinds need aren't loaded: `--kind source,vault` asks for no
+secrets. Keys and certificates load only when asked for this way; else,
+like Go to, they're listed as far as you opened them in lazysecrets.
+
+A vault or source it can't read is a line too, as it fails: its name,
+then `✗` and why in red (`errorColor`), with its link, so opening it
+shows more. They're in the list, not on stderr, which would draw over fzf.
+`--errors=false` leaves them out.
+
+The name is coloured from your [theme](config.md#theme), with the
+provider's icon when [icons](config.md#theme) are on (`ui.icons`); fzf
+shows the colours with `--ansi`. `--color never` leaves them out, for
+scripts, and `--icons=false` the icons. The link is never coloured.
+
+`--format json` prints an object per line instead, for editor plugins,
+without colours or icons, and with `error` on a list it couldn't read:
+
+```json
+{"link":"lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password","kind":"secret","provider":"azure","path":["platform-prod","kv-app-prod","db-password"],"account":"Azure:alice@example.com/<tenant>","accountLabel":"alice"}
+```
+
+`accountLabel`, the account's short name, is there when several az
+accounts are signed in. Values are never listed.

docs/links.md

@@ -121,20 +121,10 @@ account) and jumps to it, asking which account to use when several can see
 it, ending on a secret's details as `enter` on it would. Links say what,
 not what to do: opening a link to a secret asks whether to just go to it,
 also copy or show its value, or (`y`) copy its value without going there.
-
+`lazysecrets open --action go|copy|show <link>` does one without asking
-## In scripts
+and ends in the list, like Go to,
-
+and `--account <account>` picks the account (as [`list`](integration.md#listing-for-fzf-and-pickers)
-`lazysecrets get <link>` prints the value, for scripts and pipes:
+prints it) when several can see it.
-
-```sh
-export DB_PASSWORD=$(lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password)
-lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password | kubectl create secret generic db --from-file=password=/dev/stdin
-```
-
-It reads the value directly, with your az accounts (the one that last read
-it first), the Databricks profile for the workspace, or sops in your clone
-of the repo; a version in the link reads that version. The value ends with
-a newline only on a terminal.
 
 ## From the browser and chat
 

internal/cachefile/cachefile.go

@@ -0,0 +1,146 @@
+// Package cachefile is the cache of what lazysecrets has loaded
+// (cache.json): the Sources lists, vaults, secrets' metadata and where
+// the cursor was in each, never values. The TUI and lazysecrets list
+// both read it and save to it; a save merges with what's on disk, so
+// neither undoes what the other loaded.
+package cachefile
+
+import (
+	"encoding/json"
+	"maps"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+// Version is the file's format; a file of another version is ignored,
+// and replaced on the next save.
+const Version = 1
+
+// MaxAge drops what hasn't been loaded again for this long.
+const MaxAge = 30 * 24 * time.Hour
+
+// File is the cache. Every key starts with the provider ID: Sources are
+// keyed by it, the rest by Row, Objects' keys and the like.
+type File struct {
+	Version    int                                      `json:"version"`
+	Sources    map[string]Stamped[[]provider.Source]    `json:"sources,omitempty"` // by provider ID
+	Containers map[string]Stamped[[]provider.Container] `json:"containers,omitempty"`
+	Objects    map[string]Stamped[[]provider.Object]    `json:"objects,omitempty"`
+	Details    map[string]Stamped[provider.Object]      `json:"details,omitempty"`
+	Cursor     map[string]string                        `json:"cursor,omitempty"`
+}
+
+// Stamped is a list or detail with when it was loaded.
+type Stamped[T any] struct {
+	At    time.Time `json:"at"`
+	Value T         `json:"value"`
+}
+
+// New is an empty cache.
+func New() File {
+	return File{
+		Version:    Version,
+		Sources:    map[string]Stamped[[]provider.Source]{},
+		Containers: map[string]Stamped[[]provider.Container]{},
+		Objects:    map[string]Stamped[[]provider.Object]{},
+		Details:    map[string]Stamped[provider.Object]{},
+		Cursor:     map[string]string{},
+	}
+}
+
+// Row keys a source's vaults or scopes.
+func Row(providerID, sourceID string) string { return providerID + "|" + sourceID }
+
+// ContainerKey keys what's cached about a vault or scope.
+func ContainerKey(c provider.Container) string { return c.Source.Provider + "|" + c.ID }
+
+// ObjectsKey keys a vault's secrets, keys or certificates.
+func ObjectsKey(c provider.Container, t provider.ObjectType) string {
+	return ContainerKey(c) + "|" + string(t)
+}
+
+// ProviderOf is the provider ID a key starts with.
+func ProviderOf(key string) string {
+	id, _, _ := strings.Cut(key, "|")
+	return id
+}
+
+// Read reads path; a missing, unreadable or other version's file is an
+// empty cache.
+func Read(path string) File {
+	f := New()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return f
+	}
+	var d File
+	if json.Unmarshal(b, &d) != nil || d.Version != Version {
+		return f
+	}
+	maps.Copy(f.Sources, d.Sources)
+	maps.Copy(f.Containers, d.Containers)
+	maps.Copy(f.Objects, d.Objects)
+	maps.Copy(f.Details, d.Details)
+	maps.Copy(f.Cursor, d.Cursor)
+	return f
+}
+
+// Save writes f to path, merged with the file there: of a list in both,
+// the one loaded last wins, and f's cursors win. Entries older than
+// MaxAge, and those of providers keep says no to (accounts signed out
+// of), are dropped, from the file's side as well.
+func Save(path string, f File, keep func(providerID string) bool, now time.Time) error {
+	out := New()
+	ok := func(key string, at time.Time) bool { return keep(ProviderOf(key)) && now.Sub(at) < MaxAge }
+	disk := Read(path)
+	merge(out.Sources, disk.Sources, f.Sources, ok)
+	merge(out.Containers, disk.Containers, f.Containers, ok)
+	merge(out.Objects, disk.Objects, f.Objects, ok)
+	merge(out.Details, disk.Details, f.Details, ok)
+	for _, m := range []map[string]string{disk.Cursor, f.Cursor} {
+		for k, v := range m {
+			if keep(ProviderOf(k)) {
+				out.Cursor[k] = v
+			}
+		}
+	}
+	return write(path, out)
+}
+
+func merge[T any](out, disk, ours map[string]Stamped[T], ok func(string, time.Time) bool) {
+	for _, m := range []map[string]Stamped[T]{disk, ours} {
+		for k, e := range m {
+			if old, seen := out[k]; ok(k, e.At) && (!seen || !e.At.Before(old.At)) {
+				out[k] = e
+			}
+		}
+	}
+}
+
+// write writes f atomically, readable by the user only.
+func write(path string, f File) error {
+	b, err := json.Marshal(f)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(filepath.Dir(path), ".cache-*.json")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name()) // after a successful rename, nothing there
+	if _, err := tmp.Write(b); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), path)
+}

internal/cachefile/cachefile_test.go

@@ -0,0 +1,91 @@
+package cachefile
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+func list(at time.Time, names ...string) Stamped[[]provider.Container] {
+	var cs []provider.Container
+	for _, n := range names {
+		cs = append(cs, provider.Container{Name: n})
+	}
+	return Stamped[[]provider.Container]{At: at, Value: cs}
+}
+
+func TestSaveMerges(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	now := time.Now()
+	all := func(string) bool { return true }
+
+	// The TUI saved two lists.
+	tui := New()
+	tui.Containers["az|a"] = list(now.Add(-time.Hour), "kv-a-old")
+	tui.Containers["az|b"] = list(now.Add(-time.Minute), "kv-b")
+	tui.Cursor["az|b"] = "kv-b"
+	if err := Save(path, tui, all, now); err != nil {
+		t.Fatal(err)
+	}
+	// lazysecrets list loads a again, and c.
+	listed := Read(path)
+	listed.Containers["az|a"] = list(now, "kv-a-new")
+	listed.Containers["az|c"] = list(now, "kv-c")
+	if err := Save(path, listed, all, now); err != nil {
+		t.Fatal(err)
+	}
+	// The TUI saves what it has, older: list's lists stay.
+	if err := Save(path, tui, all, now); err != nil {
+		t.Fatal(err)
+	}
+	f := Read(path)
+	for key, want := range map[string]string{"az|a": "kv-a-new", "az|b": "kv-b", "az|c": "kv-c"} {
+		if got := f.Containers[key].Value; len(got) != 1 || got[0].Name != want {
+			t.Errorf("%s = %v, want %s", key, got, want)
+		}
+	}
+	if f.Cursor["az|b"] != "kv-b" {
+		t.Error("cursor lost")
+	}
+}
+
+func TestSaveDrops(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	now := time.Now()
+	f := New()
+	f.Containers["az|old"] = list(now.Add(-MaxAge-time.Hour), "kv-old")
+	f.Containers["gone|x"] = list(now, "kv-gone")
+	f.Containers["az|x"] = list(now, "kv-x")
+	if err := Save(path, f, func(id string) bool { return true }, now); err != nil {
+		t.Fatal(err)
+	}
+	// Signed out of "gone" since: dropped from the file too.
+	if err := Save(path, New(), func(id string) bool { return id == "az" }, now); err != nil {
+		t.Fatal(err)
+	}
+	got := Read(path).Containers
+	if _, ok := got["az|old"]; ok {
+		t.Error("kept a list older than MaxAge")
+	}
+	if _, ok := got["gone|x"]; ok {
+		t.Error("kept a signed-out account's list")
+	}
+	if _, ok := got["az|x"]; !ok {
+		t.Error("dropped a list on disk the save didn't have")
+	}
+}
+
+func TestReadOtherVersion(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.json")
+	f := New()
+	f.Version = Version + 1
+	f.Containers["az|x"] = list(time.Now(), "kv-x")
+	if err := write(path, f); err != nil {
+		t.Fatal(err)
+	}
+	if got := Read(path); len(got.Containers) != 0 || got.Version != Version {
+		t.Errorf("read another version's file: %+v", got)
+	}
+}

internal/config/config.go

@@ -44,6 +44,9 @@ type Config struct {
 
 type UI struct {
 	Icons *bool `yaml:"icons"`
+	// RecentIcon marks items used lately (Recent, R) with ◷, in the lists
+	// and in lazysecrets list. Defaults to false.
+	RecentIcon *bool `yaml:"recentIcon"`
 	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
 	SourcesView string `yaml:"sourcesView"`
 	// CollapseGroups starts the Sources pane with its groups folded;

internal/listing/listing.go

@@ -0,0 +1,375 @@
+// Package listing lists what lazysecrets can find, for lazysecrets list:
+// what Go to searches, without the TUI. What's cached comes first, at
+// once; then lists that are missing or older than MaxAge load in the
+// background, a few at a time, and what's new in them follows as they
+// arrive. Repos are always read, from disk. Values are never listed.
+package listing
+
+import (
+	"cmp"
+	"context"
+	"slices"
+	"strings"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+)
+
+// Workers is how many lists load at once, as in Go to.
+const Workers = 4
+
+// Kinds are the kinds of entry, from sources down.
+var Kinds = []string{"source", "vault", "secret", "key", "certificate"}
+
+// Entry is a source, vault or item, by its lazysecrets:// link.
+type Entry struct {
+	Link string `json:"link"`
+	// Kind is source (a subscription, workspace or repo), vault (a Key
+	// Vault, secret scope or repo file), secret, key or certificate.
+	Kind string `json:"kind"`
+	// Provider is azure, databricks or repo, as in links.
+	Provider string `json:"provider"`
+	// Path names it: its source's, vault's and own names.
+	Path []string `json:"path"`
+	// Account is the provider it's listed through: an az account
+	// (Azure:<user>/<tenant>), Databricks or Repos. lazysecrets open and
+	// get take it (--account) to use that account when several could.
+	Account string `json:"account"`
+	// AccountLabel names the az account, when there are several.
+	AccountLabel string `json:"accountLabel,omitempty"`
+	// Starred is starred for this account; Recent is used lately (Recent,
+	// R, in the TUI): LastUsed is when, Uses how often.
+	Starred  bool      `json:"starred"`
+	Recent   bool      `json:"recent"`
+	LastUsed time.Time `json:"lastUsed,omitzero"`
+	Uses     int       `json:"uses,omitempty"`
+	// Expires is when a secret, key or certificate expires, if it does;
+	// Enabled whether it's enabled, where the provider says (Azure).
+	Expires time.Time `json:"expires,omitzero"`
+	Enabled *bool     `json:"enabled,omitempty"`
+	// Note is the user's note on it, if any.
+	Note string `json:"note,omitempty"`
+	// Error says why a source's vaults or a vault's secrets couldn't be
+	// listed. The entry is then that source or vault, again, or with an
+	// account's sources unreadable, the account without a link.
+	Error string `json:"error,omitempty"`
+}
+
+type Options struct {
+	Providers []provider.Provider
+	// Cache is what was loaded before; Run adds what it loads.
+	Cache cachefile.File
+	// MaxAge: cached lists loaded longer ago are loaded again.
+	MaxAge time.Duration
+	// Cached lists only what's cached (and repos): nothing is loaded.
+	Cached bool
+	// Kinds are the kinds of entry to list (Kinds' names); none is all.
+	// Lists only needed for other kinds aren't loaded: sources and vaults
+	// alone don't load any secrets. Lists that fail are always listed.
+	Kinds []string
+	// Mark tells whether the entry with link is starred for account,
+	// when it was last used and how often (zero: not lately), and its
+	// note; nil marks nothing.
+	Mark    func(link, account string) (starred bool, lastUsed time.Time, uses int, note string)
+	Timeout func(provider.Kind) time.Duration
+	Now     func() time.Time
+}
+
+// Run lists everything, calling emit for each entry once, from this
+// goroutine, and for each list that can't be loaded, as it fails. An
+// error from emit (the reader went away) stops it. It returns the cache
+// with what was loaded.
+func Run(ctx context.Context, o Options, emit func(Entry) error) cachefile.File {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	l := &lister{o: o, emit: emit, seen: map[string]bool{}, pending: map[string]bool{}, results: make(chan result)}
+	if l.o.Now == nil {
+		l.o.Now = time.Now
+	}
+	for _, p := range o.Providers {
+		if l.stopped != nil {
+			break
+		}
+		l.provider(p)
+	}
+	l.start(ctx)
+	for l.active > 0 {
+		r := <-l.results
+		l.active--
+		if l.stopped == nil {
+			l.handle(r)
+			l.start(ctx)
+		}
+		if l.stopped != nil {
+			cancel()
+		}
+	}
+	return l.o.Cache
+}
+
+type job struct {
+	p   provider.Provider
+	src *provider.Source    // list its vaults
+	c   *provider.Container // list its secrets, keys or certificates (t)
+	t   provider.ObjectType
+	key string // where the list is cached
+}
+
+type result struct {
+	job
+	sources    []provider.Source
+	containers []provider.Container
+	objects    []provider.Object
+	err        error
+}
+
+type lister struct {
+	o       Options
+	emit    func(Entry) error
+	seen    map[string]bool // provider ID + link of entries emitted
+	pending map[string]bool // cache keys queued or loading
+	queue   []job
+	active  int
+	results chan result
+	stopped error // emit's error
+}
+
+func (l *lister) cacheable(p provider.Provider) bool { return p.Kind() != provider.KindRepo }
+
+// load reports whether to load a list: a repo's always (from disk), else
+// unless Cached, when it isn't cached or is older than MaxAge.
+func (l *lister) load(p provider.Provider, cached bool, at time.Time) bool {
+	if !l.cacheable(p) {
+		return true
+	}
+	return !l.o.Cached && (!cached || l.o.Now().Sub(at) >= l.o.MaxAge)
+}
+
+func (l *lister) provider(p provider.Provider) {
+	e, ok := l.o.Cache.Sources[p.ID()]
+	if l.cacheable(p) && ok {
+		for _, src := range sorted(e.Value, func(s provider.Source) string { return s.Name }) {
+			l.source(p, src)
+		}
+	}
+	if l.load(p, ok, e.At) {
+		l.enqueue(job{p: p, key: p.ID()})
+	}
+}
+
+// source emits src, and what's cached under it, and queues what's not.
+func (l *lister) source(p provider.Provider, src provider.Source) {
+	src.Provider, src.ProviderLabel = p.ID(), p.Label()
+	l.put(p, sourceEntry(src))
+	row := cachefile.Row(p.ID(), src.ID)
+	e, ok := l.o.Cache.Containers[row]
+	if l.cacheable(p) && ok {
+		l.containers(p, src, e.Value)
+	}
+	if l.load(p, ok, e.At) {
+		if l.wants("vault", "secret", "key", "certificate") {
+			l.enqueue(job{p: p, src: &src, key: row})
+		}
+	}
+}
+
+func (l *lister) containers(p provider.Provider, src provider.Source, cs []provider.Container) {
+	for _, c := range sorted(cs, func(c provider.Container) string { return c.Name }) {
+		c.Source = src
+		l.put(p, containerEntry(c))
+		for _, t := range c.ObjectTypes() {
+			key := cachefile.ObjectsKey(c, t)
+			e, ok := l.o.Cache.Objects[key]
+			if l.cacheable(p) {
+				l.objects(p, c, e.Value)
+			}
+			// Keys and certificates load only when asked for; else,
+			// like Go to, only as far as the TUI opened them.
+			asked := l.wants(strings.ToLower(string(t)))
+			if t != provider.TypeSecret {
+				asked = len(l.o.Kinds) > 0 && asked
+			}
+			if asked && l.load(p, ok, e.At) {
+				l.enqueue(job{p: p, c: &c, t: t, key: key})
+			}
+		}
+	}
+}
+
+func (l *lister) objects(p provider.Provider, c provider.Container, objs []provider.Object) {
+	for _, o := range sorted(objs, func(o provider.Object) string { return o.Name }) {
+		o.Container = c
+		r, err := ref.ForObject(o, "")
+		if err != nil {
+			continue
+		}
+		l.put(p, Entry{Link: r.String(), Kind: strings.ToLower(string(o.Type)), Provider: kindOf(c.Source.Kind),
+			Path: []string{c.Source.Name, c.Name, o.Name}, AccountLabel: accountOf(c.Source),
+			Expires: o.Expires, Enabled: o.Enabled})
+	}
+}
+
+func sourceEntry(src provider.Source) Entry {
+	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src)}
+	if r, err := ref.ForSource(src); err == nil {
+		e.Link = r.String()
+	}
+	return e
+}
+
+func containerEntry(c provider.Container) Entry {
+	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source)}
+	if r, err := ref.ForContainer(c, provider.TypeSecret); err == nil {
+		e.Link = r.String()
+	}
+	return e
+}
+
+// put emits e, unless it was already (or emitting has failed). Entries
+// without a link (one couldn't be made) are left out, but not errors.
+func (l *lister) put(p provider.Provider, e Entry) {
+	if (e.Link == "" || !l.wants(e.Kind)) && e.Error == "" {
+		return
+	}
+	e.Account = p.ID()
+	if l.o.Mark != nil && e.Link != "" {
+		e.Starred, e.LastUsed, e.Uses, e.Note = l.o.Mark(e.Link, e.Account)
+		e.Recent = !e.LastUsed.IsZero()
+	}
+	id := p.ID() + "\x00" + e.Link + "\x00" + e.Error
+	if l.stopped != nil || l.seen[id] {
+		return
+	}
+	l.seen[id] = true
+	l.stopped = l.emit(e)
+}
+
+// wants reports whether any of kinds is listed.
+func (l *lister) wants(kinds ...string) bool {
+	if len(l.o.Kinds) == 0 {
+		return true
+	}
+	for _, k := range kinds {
+		if slices.Contains(l.o.Kinds, k) {
+			return true
+		}
+	}
+	return false
+}
+
+func (l *lister) enqueue(j job) {
+	if l.pending[j.key] {
+		return
+	}
+	l.pending[j.key] = true
+	l.queue = append(l.queue, j)
+}
+
+func (l *lister) start(ctx context.Context) {
+	for l.stopped == nil && l.active < Workers && len(l.queue) > 0 {
+		j := l.queue[0]
+		l.queue = l.queue[1:]
+		l.active++
+		go func() { l.results <- l.fetch(ctx, j) }()
+	}
+}
+
+func (l *lister) fetch(ctx context.Context, j job) result {
+	kind := j.p.Kind()
+	ctx, cancel := context.WithTimeout(ctx, l.o.Timeout(kind))
+	defer cancel()
+	r := result{job: j}
+	switch {
+	case j.c != nil:
+		r.objects, r.err = j.p.Objects(ctx, *j.c, j.t)
+	case j.src != nil:
+		r.containers, r.err = j.p.Containers(ctx, *j.src)
+	default:
+		r.sources, r.err = j.p.Sources(ctx)
+	}
+	return r
+}
+
+func (l *lister) handle(r result) {
+	delete(l.pending, r.key)
+	now := l.o.Now()
+	if r.err != nil {
+		l.put(r.p, r.failed())
+		return
+	}
+	cache := l.cacheable(r.p)
+	switch {
+	case r.c != nil:
+		if cache {
+			l.o.Cache.Objects[r.key] = cachefile.Stamped[[]provider.Object]{At: now, Value: r.objects}
+		}
+		l.objects(r.p, *r.c, r.objects)
+	case r.src != nil:
+		r.containers = slices.Clone(r.containers) // the provider's may be shared
+		for i := range r.containers {
+			r.containers[i].Source = *r.src
+		}
+		if cache {
+			l.o.Cache.Containers[r.key] = cachefile.Stamped[[]provider.Container]{At: now, Value: r.containers}
+		}
+		l.containers(r.p, *r.src, r.containers)
+	default:
+		if cache {
+			l.o.Cache.Sources[r.key] = cachefile.Stamped[[]provider.Source]{At: now, Value: r.sources}
+		}
+		for _, src := range r.sources {
+			l.source(r.p, src)
+		}
+	}
+}
+
+// failed is the entry for a list that couldn't be loaded.
+func (r result) failed() Entry {
+	var e Entry
+	switch {
+	case r.c != nil:
+		e = containerEntry(*r.c)
+	case r.src != nil:
+		src := *r.src
+		src.Provider, src.ProviderLabel = r.p.ID(), r.p.Label()
+		e = sourceEntry(src)
+	default:
+		e = Entry{Kind: "source", Provider: kindOf(r.p.Kind()), Path: []string{r.p.Label()}}
+	}
+	e.Error = firstLine(r.err.Error())
+	return e
+}
+
+// firstLine is an error's first line, the summary (Azure's go on with
+// the caller's IDs and more): an entry is one line. Tabs, which would
+// split it into columns, are spaces.
+func firstLine(s string) string {
+	for line := range strings.Lines(s) {
+		if line = strings.TrimSpace(line); line != "" {
+			return strings.ReplaceAll(line, "\t", " ")
+		}
+	}
+	return "unreadable"
+}
+
+func kindOf(k provider.Kind) string { return strings.ToLower(string(k)) }
+
+// accountOf is the account part of a source's provider label ("alice" in
+// "Azure · alice"), or "" when there's a single account.
+func accountOf(src provider.Source) string {
+	account, ok := strings.CutPrefix(src.ProviderLabel, string(src.Kind)+" · ")
+	if !ok {
+		return ""
+	}
+	return account
+}
+
+func sorted[T any](s []T, name func(T) string) []T {
+	s = slices.Clone(s)
+	slices.SortStableFunc(s, func(a, b T) int {
+		return cmp.Compare(strings.ToLower(name(a)), strings.ToLower(name(b)))
+	})
+	return s
+}

internal/listing/listing_test.go

@@ -0,0 +1,264 @@
+package listing
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+)
+
+// counting counts a provider's requests.
+type counting struct {
+	provider.Provider
+	calls atomic.Int32
+}
+
+func (c *counting) Sources(ctx context.Context) ([]provider.Source, error) {
+	c.calls.Add(1)
+	return c.Provider.Sources(ctx)
+}
+
+func (c *counting) Containers(ctx context.Context, src provider.Source) ([]provider.Container, error) {
+	c.calls.Add(1)
+	return c.Provider.Containers(ctx, src)
+}
+
+func (c *counting) Objects(ctx context.Context, ct provider.Container, t provider.ObjectType) ([]provider.Object, error) {
+	c.calls.Add(1)
+	return c.Provider.Objects(ctx, ct, t)
+}
+
+// run lists, returning the entries and, apart, the lists that failed.
+func run(t *testing.T, o Options) ([]Entry, cachefile.File, []Entry) {
+	t.Helper()
+	if o.Cache.Version == 0 {
+		o.Cache = cachefile.New()
+	}
+	o.Timeout = func(provider.Kind) time.Duration { return 5 * time.Second }
+	var got, failed []Entry
+	f := Run(context.Background(), o, func(e Entry) error {
+		if e.Error != "" {
+			failed = append(failed, e)
+		} else {
+			got = append(got, e)
+		}
+		return nil
+	})
+	return got, f, failed
+}
+
+func has(es []Entry, kind, path string) bool {
+	for _, e := range es {
+		if e.Kind == kind && strings.Join(e.Path, "/") == path {
+			return true
+		}
+	}
+	return false
+}
+
+func TestListLoadsAndCaches(t *testing.T) {
+	t.Parallel()
+	az := &counting{Provider: fake.Azure(0)}
+	got, f, errs := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, MaxAge: time.Minute})
+	for _, want := range [][2]string{
+		{"source", "platform-prod"}, {"vault", "platform-prod/kv-app-prod"}, {"secret", "platform-prod/kv-app-prod/db-password"},
+		{"source", "lazysecrets-demo"}, {"secret", "lazysecrets-demo/.env/DATABASE_URL"},
+	} {
+		if !has(got, want[0], want[1]) {
+			t.Errorf("no %s %s", want[0], want[1])
+		}
+	}
+	if len(errs) != 1 || errs[0].Kind != "vault" || errs[0].Path[1] != "kv-restricted" || !strings.Contains(errs[0].Error, "403") || errs[0].Link == "" {
+		t.Errorf("failed = %+v", errs)
+	}
+	seen := map[string]bool{}
+	for _, e := range got {
+		if seen[e.Link] {
+			t.Errorf("%s listed twice", e.Link)
+		}
+		seen[e.Link] = true
+		if e.Provider != "azure" && e.Provider != "repo" {
+			t.Errorf("provider %q", e.Provider)
+		}
+	}
+	if len(f.Sources) != 1 || len(f.Containers) == 0 || len(f.Objects) == 0 {
+		t.Errorf("not cached: %d sources, %d containers, %d objects", len(f.Sources), len(f.Containers), len(f.Objects))
+	}
+	for k := range f.Containers {
+		if cachefile.ProviderOf(k) != az.ID() {
+			t.Errorf("cached a repo: %s", k)
+		}
+	}
+
+	// Again with that cache: the same, without asking Azure.
+	before := az.calls.Load()
+	again, _, _ := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, Cache: f, MaxAge: time.Minute})
+	if len(again) != len(got) {
+		t.Errorf("%d entries from the cache, %d loaded", len(again), len(got))
+	}
+	// The vault that couldn't be read wasn't cached: it's asked again.
+	if n := az.calls.Load() - before; n != 1 {
+		t.Errorf("%d requests with a fresh cache, want 1 (kv-restricted)", n)
+	}
+
+	// Stale: loaded again, but each entry is still listed once.
+	before = az.calls.Load()
+	stale, _, _ := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute,
+		Now: func() time.Time { return time.Now().Add(time.Hour) }})
+	if az.calls.Load()-before < 3 {
+		t.Error("stale lists weren't loaded again")
+	}
+	links := map[string]bool{}
+	for _, e := range stale {
+		if links[e.Link] {
+			t.Errorf("%s listed twice", e.Link)
+		}
+		links[e.Link] = true
+	}
+}
+
+func TestListCachedOnly(t *testing.T) {
+	t.Parallel()
+	az := &counting{Provider: fake.Azure(0)}
+	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
+	before := az.calls.Load()
+	got, _, errs := run(t, Options{Providers: []provider.Provider{az, fake.Repos()}, Cache: f, Cached: true,
+		Now: func() time.Time { return time.Now().Add(24 * time.Hour) }})
+	if az.calls.Load() != before || len(errs) != 0 {
+		t.Errorf("--cached asked Azure: %d requests, %v", az.calls.Load()-before, errs)
+	}
+	if !has(got, "secret", "platform-prod/kv-app-prod/db-password") || !has(got, "secret", "lazysecrets-demo/.env/DATABASE_URL") {
+		t.Error("cached secrets or repos missing")
+	}
+}
+
+func TestListCachedFirst(t *testing.T) {
+	t.Parallel()
+	az := fake.Azure(0)
+	_, f, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute})
+	// Forget one vault's secrets: they load, after everything cached.
+	var dropped string
+	for k := range f.Objects {
+		if strings.Contains(k, "kv-app-prod") && strings.HasSuffix(k, "|Secret") {
+			dropped = k
+			delete(f.Objects, k)
+			break
+		}
+	}
+	if dropped == "" {
+		t.Fatalf("no kv-app-prod in %v", f.Objects)
+	}
+	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, Cache: f, MaxAge: time.Minute})
+	last := got[len(got)-1]
+	if last.Kind != "secret" || last.Path[1] != "kv-app-prod" {
+		t.Errorf("last = %+v, want a kv-app-prod secret, loaded after the cache", last)
+	}
+}
+
+func TestListStopsWhenTheReaderGoes(t *testing.T) {
+	t.Parallel()
+	gone := errors.New("broken pipe")
+	n := 0
+	var errs []Entry
+	Run(context.Background(), Options{
+		Providers: []provider.Provider{fake.Azure(0), fake.Repos()}, Cache: cachefile.New(), MaxAge: time.Minute,
+		Timeout: func(provider.Kind) time.Duration { return time.Second },
+	}, func(e Entry) error {
+		if e.Error != "" {
+			errs = append(errs, e)
+		}
+		n++
+		if n == 2 {
+			return gone
+		}
+		return nil
+	})
+	if n != 2 || len(errs) != 0 {
+		t.Errorf("emitted %d after the reader went, errs %v", n, errs)
+	}
+}
+
+func TestListKinds(t *testing.T) {
+	t.Parallel()
+	// Sources only: nothing under them is asked for.
+	az := &counting{Provider: fake.Azure(0)}
+	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute, Kinds: []string{"source"}})
+	if len(got) == 0 || az.calls.Load() != 1 {
+		t.Errorf("%d sources, %d requests, want just the sources'", len(got), az.calls.Load())
+	}
+	for _, e := range got {
+		if e.Kind != "source" {
+			t.Errorf("listed a %s", e.Kind)
+		}
+	}
+	// Keys, asked for: loaded, though Go to wouldn't; no secrets.
+	got, _, failed := run(t, Options{Providers: []provider.Provider{fake.Azure(0)}, MaxAge: time.Minute, Kinds: []string{"key"}})
+	if !has(got, "key", "platform-prod/kv-app-prod/signing-key") {
+		t.Errorf("no keys: %+v", got)
+	}
+	for _, e := range got {
+		if e.Kind != "key" {
+			t.Errorf("listed a %s", e.Kind)
+		}
+	}
+	if len(failed) == 0 {
+		t.Error("a list that failed wasn't listed")
+	}
+}
+
+func TestErrorsAreOneLine(t *testing.T) {
+	for in, want := range map[string]string{
+		"403 Forbidden: Caller is not authorized\nCaller: appid=x;oid=y\nVault: kv;location=z": "403 Forbidden: Caller is not authorized",
+		"\n  timeout\tafter 30s\n": "timeout after 30s",
+		"":                         "unreadable",
+	} {
+		if got := firstLine(in); got != want {
+			t.Errorf("firstLine(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestListMarks(t *testing.T) {
+	t.Parallel()
+	az := fake.Azure(0)
+	var starredLink string
+	got, _, _ := run(t, Options{Providers: []provider.Provider{az}, MaxAge: time.Minute, Kinds: []string{"secret"},
+		Mark: func(link, account string) (bool, time.Time, int, string) {
+			if starredLink == "" && strings.HasSuffix(link, "/db-password") {
+				starredLink = link
+			}
+			if strings.HasSuffix(link, "/api-key") {
+				return false, time.Now(), 3, "rotate in May"
+			}
+			return link == starredLink && account == az.ID(), time.Time{}, 0, ""
+		}})
+	var starred, recent int
+	for _, e := range got {
+		if e.Starred {
+			starred++
+			if e.Link != starredLink {
+				t.Errorf("%s starred", e.Link)
+			}
+		}
+		if (e.Note != "") != strings.HasSuffix(e.Link, "/api-key") {
+			t.Errorf("%s: note %q", e.Link, e.Note)
+		}
+		if e.Recent {
+			recent++
+			if e.Uses != 3 || e.LastUsed.IsZero() {
+				t.Errorf("%s: %d uses, last %v", e.Link, e.Uses, e.LastUsed)
+			}
+		} else if e.Uses != 0 || !e.LastUsed.IsZero() {
+			t.Errorf("%s not recent, but %d uses, last %v", e.Link, e.Uses, e.LastUsed)
+		}
+	}
+	if starred != 1 || recent == 0 {
+		t.Errorf("%d starred, %d recent", starred, recent)
+	}
+}

internal/provider/fake/fake.go

@@ -288,7 +288,7 @@ func Azure(delay time.Duration) *Provider {
 	}, "sk_live_51HxDEMO0000000000000000")
 	p.add(kv, provider.TypeSecret, provider.Object{
 		Name: "legacy-token", Version: "0c11de", Enabled: &no, Updated: base.AddDate(-1, 0, 0),
-		Reference: secretRef("kv-app-prod", "legacy-token"),
+		Expires: base.AddDate(0, -3, 0), Reference: secretRef("kv-app-prod", "legacy-token"),
 	}, "deprecated")
 
 	p.add(kv, provider.TypeKey, provider.Object{
@@ -349,6 +349,19 @@ func Azure(delay time.Duration) *Provider {
 	p.add(kvDev, provider.TypeSecret, provider.Object{
 		Name: "db-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
 	}, "dev-password")
+	// Left behind, as dev vaults are: expired, disabled, or both.
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "stripe-webhook-secret", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
+		Expires: base.AddDate(0, -2, 0), Reference: secretRef("kv-app-dev", "stripe-webhook-secret"),
+	}, "whsec_demo_expired")
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "test-user-password", Enabled: &no, Updated: base.AddDate(0, -5, 0),
+		Reference: secretRef("kv-app-dev", "test-user-password"),
+	}, "disabled-demo-password")
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "vendor-token", Enabled: &no, Updated: base.AddDate(-2, 0, 0),
+		Expires: base.AddDate(-1, 0, 0), Reference: secretRef("kv-app-dev", "vendor-token"),
+	}, "expired-and-disabled")
 
 	return p
 }
@@ -366,6 +379,7 @@ func AzureOps(delay time.Duration) *Provider {
 	breakGlass := p.addContainer(prod, "kv-breakglass", "https://kv-breakglass.vault.azure.net", allTypes...)
 	p.add(breakGlass, provider.TypeSecret, provider.Object{
 		Name: "emergency-admin", Enabled: &yes, Updated: base.AddDate(0, -4, 0),
+		Expires: time.Now().AddDate(0, 0, 5).Truncate(24 * time.Hour), // soon, whenever the demo runs
 		Tags:    map[string]string{"owner": "ops"}, Reference: secretRef("kv-breakglass", "emergency-admin"),
 	}, "break-glass-demo-password")
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
@@ -384,6 +398,12 @@ func AzureOps(delay time.Duration) *Provider {
 	p.add(kv, provider.TypeSecret, provider.Object{
 		Name: "pagerduty-token", Enabled: &yes, Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
 	}, "pd-demo-token")
+	// Expiring soon whenever the demo runs: the other dates are fixed,
+	// and would have passed. Tests use the first account only.
+	p.add(kv, provider.TypeSecret, provider.Object{
+		Name: "grafana-api-key", Enabled: &yes, Updated: base.AddDate(0, -11, 0),
+		Expires: time.Now().AddDate(0, 0, 12).Truncate(24 * time.Hour), Reference: secretRef("kv-ops-tools", "grafana-api-key"),
+	}, "glsa_demo_expiring")
 
 	return p
 }

internal/provider/fake/seed.go

@@ -0,0 +1,61 @@
+package fake
+
+import (
+	"cmp"
+	"strings"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/store"
+)
+
+// Seed stars, notes and uses a few of the demo's secrets, so --demo
+// shows Favourites (F), Recent (R), notes, and stars in lazysecrets list. alice and
+// admin are the two Azure accounts' provider IDs.
+func Seed(st *store.Store, alice, admin string) {
+	type item struct {
+		link, account, source string
+		name                  string // else the link's last part
+		note                  string
+		path                  []string
+		star                  bool
+		uses                  int
+		ago                   time.Duration
+	}
+	const azure, dbx = "lazysecrets://azure/", "lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/"
+	for _, it := range []item{
+		{link: azure + "kv-app-prod.vault.azure.net/secrets/db-password", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-app-prod"}, star: true, uses: 12, ago: 20 * time.Minute,
+			note: "rotated by the data team each quarter"},
+		{link: azure + "kv-app-prod.vault.azure.net/secrets/api-key", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-app-prod"}, uses: 4, ago: 2 * time.Hour},
+		{link: azure + "kv-breakglass.vault.azure.net/secrets/emergency-admin", account: admin, source: "sub-prod",
+			path: []string{"platform-prod", "kv-breakglass"}, star: true, note: "incidents only: tell #ops when used"},
+		{link: azure + "kv-shared-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
+			path: []string{"platform-prod", "kv-shared-prod"}, uses: 2, ago: 26 * time.Hour},
+		{link: dbx + "app/storage-key", account: "Databricks", source: "dbx-prod",
+			path: []string{"prod", "app"}, star: true, uses: 3, ago: 5 * time.Hour},
+		// A subscription, and a repo's file.
+		{link: azure + "subscriptions/sub-prod", account: admin, source: "sub-prod",
+			name: "platform-prod", star: true},
+		{link: "lazysecrets://repo/github.com%2Facme%2Flazysecrets-demo/deploy%2Fprod%2Fsecrets.yaml", account: "Repos",
+			source: "/home/dev/git/lazysecrets-demo", name: "deploy/prod/secrets.yaml",
+			path: []string{"lazysecrets-demo"}, star: true},
+	} {
+		context := func(n *store.Node) {
+			n.Name = cmp.Or(it.name, it.link[strings.LastIndex(it.link, "/")+1:])
+			n.Path, n.Source, n.Account = it.path, it.source, it.account
+		}
+		if it.star || it.note != "" {
+			_ = st.Update(it.link, func(n *store.Node) {
+				context(n)
+				if it.star {
+					n.ToggleStar(it.account)
+				}
+				n.Note = it.note
+			})
+		}
+		for range it.uses {
+			_ = st.Use(it.link, time.Now().Add(-it.ago), context)
+		}
+	}
+}

internal/ref/ref.go

@@ -56,6 +56,10 @@ type Ref struct {
 	// Share is a share link's sealed files, as in the link; the other
 	// fields are empty. Package share reads it.
 	Share string
+	// Account, when set, is the provider (its ID) to open or read it
+	// with when several could, from lazysecrets list. It isn't part of
+	// the link.
+	Account string
 }
 
 // IsShare reports whether r is a share link.

internal/ui/app/app.go

@@ -131,8 +131,15 @@ type Options struct {
 	HandlerSetup *HandlerSetup
 	// NoHistory stops counting uses of items for the Recent list.
 	NoHistory bool
+	// RecentIcon marks items used lately with ◷ in the lists
+	// (ui.recentIcon).
+	RecentIcon bool
 	// Open is a reference to open at startup (lazysecrets open <ref>).
 	Open *ref.Ref
+	// OpenAction, if set, is what to do with Open, rather than asking:
+	// go to it, and maybe copy or show its value (OpenActions). It ends in
+	// the list, like Go to, rather than on the details.
+	OpenAction string
 	// Styles, if set, replaces the default theme (styles.FromTheme), and
 	// DefaultFg the terminal's default text colour.
 	Styles    *styles.Styles
@@ -283,6 +290,8 @@ type Model struct {
 	prompt     *modal               // popup that has the keyboard
 	linked     []provider.Container // vaults opened from links, this session
 	open       *ref.Ref             // reference to open at startup
+	recentIcon bool                 // mark items used lately (◷)
+	openAction string               // and what to do with it, or ask
 
 	shareKey   string      // the config's sharing.key
 	shareRules share.Rules // and sharing.keyRules
@@ -415,7 +424,8 @@ func New(providers []provider.Provider, opts Options) Model {
 	if m.store == nil {
 		m.store, _ = store.Load("")
 	}
-	m.sources = newSourcesList(iconSet, m.store)
+	m.recentIcon = opts.RecentIcon
+	m.sources = newSourcesList(iconSet, m.store, m.recentIcon)
 	m.sources.Empty = "no sources found"
 	m.collapsed = map[string]bool{}
 	m.flatSources = opts.FlatSources
@@ -447,7 +457,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	}
 	m.defaultFg = opts.DefaultFg
 	m.help = newHelp(m.st)
-	m.open = opts.Open
+	m.open, m.openAction = opts.Open, opts.OpenAction
 	saved := m.store.Layout()
 	m.split, m.heights = saved.Split, saved.Heights
 
@@ -521,18 +531,26 @@ func (m Model) Init() tea.Cmd {
 		cmds = append(cmds, m.fetchLatest(false))
 	}
 	if m.open != nil {
-		r := *m.open
+		msg := openRefMsg{ref: *m.open, action: m.openAction}
-		cmds = append(cmds, func() tea.Msg { return openRefMsg{r} })
+		cmds = append(cmds, func() tea.Msg { return msg })
 	}
 	return tea.Batch(cmds...)
 }
 
-// openRefMsg starts opening a reference from outside the key handler.
+// openRefMsg starts opening a reference from outside the key handler:
-type openRefMsg struct{ ref ref.Ref }
+// asking what to do with it, or doing action (OpenActions).
+type openRefMsg struct {
+	ref    ref.Ref
+	action string
+}
+
+// OpenActions are what lazysecrets open --action takes, the Open link
+// menu's choices that go there.
+var OpenActions = map[string]linkAction{"go": actGo, "copy": actCopy, "show": actShow}
 
 // OpenLink is a message offering r in the Open link popup, for links
 // handed over by the link handler (Program.Send).
-func OpenLink(r ref.Ref) tea.Msg { return openRefMsg{r} }
+func OpenLink(r ref.Ref) tea.Msg { return openRefMsg{ref: r} }
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	var cmds []tea.Cmd
@@ -589,7 +607,11 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	case openRefMsg:
 		m.deferHandlerSetup() // the link first
+		if act, ok := OpenActions[msg.action]; ok && !msg.ref.IsShare() {
+			cmds = append(cmds, m.findRef(msg.ref, act))
+		} else {
 			cmds = append(cmds, m.offerRef("Open link", msg.ref, false))
+		}
 
 	case resolvedMsg:
 		m.handleResolved(msg)

internal/ui/app/app_test.go

@@ -536,7 +536,7 @@ func TestBackspaceGoesBack(t *testing.T) {
 	}
 	// While typing a filter, backspace deletes a character instead.
 	d.keys("/")
-	d.typeText("apx")
+	d.typeText("api-x")
 	d.send(tea.KeyPressMsg{Code: tea.KeyBackspace})
 	if !d.m.secrets.Filtering() || d.m.secrets.Len() != 1 {
 		t.Errorf("backspace in filter: filtering=%v visible=%d", d.m.secrets.Filtering(), d.m.secrets.Len())
@@ -666,7 +666,7 @@ func TestFilter(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("api")
+	d.typeText("api-k")
 	if d.m.secrets.Len() != 1 {
 		t.Fatalf("visible = %d, want 1", d.m.secrets.Len())
 	}
@@ -684,7 +684,7 @@ func TestFilter(t *testing.T) {
 	}
 	d.keys("esc") // leave filter mode, clearing the query
 	d.keys("/")
-	d.typeText("api")
+	d.typeText("api-k")
 	d.keys("enter", "esc") // apply, then esc clears the applied filter
 	if d.m.secrets.Len() != 3 {
 		t.Errorf("esc should clear the applied filter, visible = %d", d.m.secrets.Len())
@@ -848,7 +848,7 @@ func TestCopyAndRevealWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.typeText("api")
+	d.typeText("api-k")
 	d.send(tea.KeyPressMsg{Code: 'y', Mod: tea.ModCtrl})
 	if d.clip().content != "sk_live_51HxDEMO0000000000000000" {
 		t.Errorf("ctrl+y copied %q", d.clip().content)
@@ -1187,7 +1187,8 @@ func TestDetailsFollowFocus(t *testing.T) {
 func TestStatusLineCountsRepos(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, fake.Azure(0), fake.Repos())
-	if line := strings.Split(d.screen(), "\n")[1]; !strings.Contains(line, "1 account · 3 repos") {
+	// The status line, not the pane, which an expired secret's ⚠ fills.
+	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "1 account · 3 repos") {
 		t.Errorf("status line: %q", line)
 	}
 	d = newDriver(t, fake.Azure(0))
@@ -1202,8 +1203,8 @@ func TestStatusPane(t *testing.T) {
 	d := newDriverOpts(t, Options{Version: "0.1.0", ConfigFiles: []string{"/cfg/config.yaml"}, StatePath: "/state/state.json",
 		OpenURL: func(u string) error { opened = append(opened, u); return nil }},
 		fake.Azure(0), signedOut{fake.Azure(0)})
-	if !strings.Contains(d.screen(), "2 accounts · 1 need sign-in") {
+	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "2 accounts · 1 need sign-in") {
-		t.Errorf("status line:\n%s", d.screen())
+		t.Errorf("status line: %q", line)
 	}
 	d.keys("0")
 	if d.m.focus != paneStatus {
@@ -1303,7 +1304,8 @@ func TestExpiringInStatus(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{ExpiryWarning: 30 * 24 * time.Hour}, fake.Azure(0))
 	d.keys("3", "]", "]") // load kv-app-prod's certificates
-	if !strings.Contains(d.screen(), "⚠ 1 expiring") {
+	// old-tls and legacy-token.
+	if !strings.Contains(d.screen(), "⚠ 2 expiring") {
 		t.Errorf("status line:\n%s", d.screen())
 	}
 	d.keys("0")

internal/ui/app/favourites.go

@@ -19,6 +19,22 @@ import (
 
 const star = "★ "
 
+// recentMark marks items used lately (Recent), with ui.recentIcon.
+const recentMark = "◷ "
+
+// marks is what goes before a list row's name: ★ when it's starred for
+// account and, with recent, ◷ when it was used lately.
+func marks(st styles.Styles, n store.Node, account string, recent bool) string {
+	var s string
+	if n.StarredFor(account) {
+		s = st.Favourite.Render(star)
+	}
+	if recent && !n.LastUsed.IsZero() {
+		s += st.Muted.Render(recentMark)
+	}
+	return s
+}
+
 func sourceKey(s provider.Source) string {
 	if r, err := ref.ForSource(s); err == nil {
 		return r.String()
@@ -94,9 +110,7 @@ func (m Model) containerRender(withSource bool) func(styles.Styles, provider.Con
 			}
 			line += sty.Muted.Render("  " + c.Detail)
 		}
-		if n.StarredFor(c.Source.Provider) {
+		line = marks(sty, n, c.Source.Provider, m.recentIcon) + line
-			line = sty.Favourite.Render(star) + line
-		}
 		if withSource {
 			src := c.Source.Name
 			if account, ok := strings.CutPrefix(c.Source.ProviderLabel, string(c.Source.Kind)+" · "); ok {
@@ -116,9 +130,7 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 		if o.Enabled != nil && !*o.Enabled {
 			line = sty.Muted.Render(o.Name + " (disabled)")
 		}
-		if n.StarredFor(o.Container.Source.Provider) {
+		line = marks(sty, n, o.Container.Source.Provider, m.recentIcon) + line
-			line = sty.Favourite.Render(star) + line
-		}
 		switch state, left := m.expiry(o); state {
 		case expired:
 			line += " " + sty.Error.Render("✗ expired")

internal/ui/app/favourites_test.go

@@ -6,6 +6,7 @@ import (
 	"slices"
 	"strings"
 	"testing"
+	"time"
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
@@ -394,7 +395,7 @@ func TestStarWhileFiltering(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	for _, r := range "api" {
+	for _, r := range "api-k" {
 		d.send(tea.KeyPressMsg{Code: r, Text: string(r)})
 	}
 	d.send(tea.KeyPressMsg{Code: 'f', Mod: tea.ModCtrl})
@@ -434,3 +435,20 @@ func TestStarIsPerAccount(t *testing.T) {
 		t.Errorf("favourites should list alice's star only: %q", labels)
 	}
 }
+
+func TestRecentIcon(t *testing.T) {
+	t.Parallel()
+	mem, _ := store.Load("")
+	_ = mem.Use("lazysecrets://azure/"+kv+"/secrets/api-key", time.Now(), func(*store.Node) {})
+	d := newDriverOpts(t, Options{Store: mem, RecentIcon: true})
+	d.keys("3")
+	scr := d.screen()
+	if !strings.Contains(scr, "◷ api-key") || strings.Contains(scr, "◷ db-password") {
+		t.Errorf("want ◷ on api-key only:\n%s", scr)
+	}
+	off := newDriverOpts(t, Options{Store: mem})
+	off.keys("3")
+	if strings.Contains(off.screen(), "◷") {
+		t.Errorf("◷ without ui.recentIcon:\n%s", off.screen())
+	}
+}

internal/ui/app/links.go

@@ -56,6 +56,9 @@ type resolvedMsg struct {
 	act       linkAction
 	sourceRow string
 	others    []string // other accounts' rows that also found the vault
+	// find ends in the list, like Go to, not on the details: opened by a
+	// tool that found it (lazysecrets open --action, from fzf).
+	find    bool
 	choices []choice // several candidates: ask
 	linked  *provider.Container
 	err     error
@@ -218,6 +221,9 @@ func (m *Model) openSource(r ref.Ref) {
 			}
 		}
 	}
+	if row, ok := preferredRow(r, choices); ok {
+		choices = []choice{{sourceRow: row}}
+	}
 	switch len(choices) {
 	case 0:
 		m.flash = flash{text: "open: " + describeRef(r) + " isn't in your sources", isErr: true}
@@ -404,18 +410,59 @@ func (m *Model) handleResolved(msg resolvedMsg) {
 		for i := range msg.choices {
 			msg.choices[i].label = "Open in " + msg.choices[i].label
 		}
-		m.chooseSource("Scope "+msg.ref.Scope+" is in several workspaces", msg.ref, msg.act, msg.choices, true)
+		m.chooseSource("Scope "+msg.ref.Scope+" is in several workspaces", msg.ref, msg.act, msg.choices, !msg.find)
 	case len(msg.others) > 0:
 		var choices []choice
 		for _, row := range append([]string{msg.sourceRow}, msg.others...) {
 			choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
 		}
-		m.chooseSource("Several accounts can see "+msg.ref.ContainerName(), msg.ref, msg.act, choices, true)
+		if row, ok := preferredRow(msg.ref, choices); ok {
+			m.navResolved(msg, row)
+			return
+		}
+		m.chooseSource("Several accounts can see "+msg.ref.ContainerName(), msg.ref, msg.act, choices, !msg.find)
 	case msg.linked != nil:
 		m.addLinked(*msg.linked)
-		m.startLinkNav(msg.ref, msg.act, linksRowID)
+		m.navResolved(msg, linksRowID)
 	default:
-		m.startLinkNav(msg.ref, msg.act, msg.sourceRow)
+		m.navResolved(msg, msg.sourceRow)
+	}
+}
+
+// preferredRow is the choice under the account the reference asks for
+// (ref.Ref.Account), if it's one of them.
+func preferredRow(r ref.Ref, choices []choice) (string, bool) {
+	for _, c := range choices {
+		if r.Account != "" && providerOf(c.sourceRow) == r.Account {
+			return c.sourceRow, true
+		}
+	}
+	return "", false
+}
+
+// navResolved goes to what a resolved link points at, under row.
+func (m *Model) navResolved(msg resolvedMsg, row string) {
+	if msg.find {
+		m.startNav(msg.ref, msg.act, row)
+		return
+	}
+	m.startLinkNav(msg.ref, msg.act, row)
+}
+
+// findRef is openRef ending in the list, like Go to: for a link a tool
+// found (lazysecrets open --action).
+func (m *Model) findRef(r ref.Ref, act linkAction) tea.Cmd {
+	cmd := m.openRef(r, act)
+	if cmd == nil {
+		return nil
+	}
+	return func() tea.Msg {
+		msg := cmd()
+		if rm, ok := msg.(resolvedMsg); ok {
+			rm.find = true
+			return rm
+		}
+		return msg
 	}
 }
 

internal/ui/app/links_test.go

@@ -181,7 +181,7 @@ func TestPasteWhileFilteringFilters(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
 	d.keys("3", "/")
-	d.send(tea.PasteMsg{Content: "api"})
+	d.send(tea.PasteMsg{Content: "api-k"})
 	if d.m.secrets.Len() != 1 || d.m.nav != nil {
 		t.Errorf("paste in filter: visible %d", d.m.secrets.Len())
 	}
@@ -203,8 +203,21 @@ func TestOpenPromptAndStartupOpen(t *testing.T) {
 		t.Fatal("open at startup didn't ask what to do")
 	}
 	d2.keys("o")
-	if _, _, s := d2.selected(); s != "api-key" {
+	if _, _, s := d2.selected(); s != "api-key" || d2.m.focus != paneDetail {
-		t.Errorf("open at startup: selected %q", s)
+		t.Errorf("open at startup: selected %q, focus %v, want the details", s, d2.m.focus)
+	}
+
+	// --action: no question, it does that.
+	d3 := newDriverOpts(t, Options{Open: &r, OpenAction: "go"})
+	if d3.m.prompt != nil {
+		t.Fatalf("--action go asked: %q", d3.m.prompt.title)
+	}
+	if _, _, s := d3.selected(); s != "api-key" || d3.m.focus != paneSecrets {
+		t.Errorf("--action go: selected %q, focus %v, want the secrets list, like Go to", s, d3.m.focus)
+	}
+	d4 := newDriverOpts(t, Options{Open: &r, OpenAction: "copy"})
+	if _, _, s := d4.selected(); s != "api-key" || d4.clip().content == "" {
+		t.Errorf("--action copy: selected %q, copied %q", s, d4.clip().content)
 	}
 }
 
@@ -305,6 +318,20 @@ func TestOpenAsksWhichAccount(t *testing.T) {
 		t.Errorf("j enter picked %q", c.Source.Provider)
 	}
 
+	// lazysecrets open --account: no question, that account.
+	r, _ := ref.Parse("lazysecrets://azure/" + kv + "/secrets/api-key")
+	r.Account = "Azure:bob@example.com/t1"
+	d.send(OpenLink(r))
+	if d.m.prompt != nil && d.m.prompt.title == "Open link" {
+		d.keys("o")
+	}
+	if strings.Contains(d.screen(), "Several accounts can see") {
+		t.Fatalf("asked, with an account given:\n%s", d.screen())
+	}
+	if c, _ := d.m.containers.Selected(); c.Source.Provider != r.Account {
+		t.Errorf("--account opened via %q", c.Source.Provider)
+	}
+
 	// Opening into a folded account unfolds it.
 	d.keys("1", "g") // alice's header
 	d.keys("enter")  // fold it

internal/ui/app/persist.go

@@ -1,14 +1,12 @@
 package app
 
 import (
-	"encoding/json"
 	"errors"
-	"os"
-	"path/filepath"
 	"time"
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
@@ -23,58 +21,35 @@ import (
 // And where lazysecrets was left, per folder it ran in, goes in the store,
 // to go back there on the next start.
 
-// cacheFileVersion is the file's format; a file of another version is
-// ignored, and replaced on the next save.
-const cacheFileVersion = 1
-
-// cacheMaxAge drops what hasn't been loaded again for this long.
-const cacheMaxAge = 30 * 24 * time.Hour
-
 // persistEvery is how often a changed cache is saved while running, so
 // little is lost if lazysecrets is killed rather than quit.
 const persistEvery = 30 * time.Second
 
-type cacheFile struct {
-	Version    int                                      `json:"version"`
-	Sources    map[string]stamped[[]provider.Source]    `json:"sources,omitempty"` // by provider ID
-	Containers map[string]stamped[[]provider.Container] `json:"containers,omitempty"`
-	Objects    map[string]stamped[[]provider.Object]    `json:"objects,omitempty"`
-	Details    map[string]stamped[provider.Object]      `json:"details,omitempty"`
-	Cursor     map[string]string                        `json:"cursor,omitempty"`
-}
-
-type stamped[T any] struct {
-	At    time.Time `json:"at"`
-	Value T         `json:"value"`
-}
-
 type persistTickMsg struct{}
 
 type persistedMsg struct{ err error }
 
 // keepCached reports whether a cache key's account still exists and
 // isn't a repo: every key starts with the provider ID.
-func (m *Model) keepCached(key string) bool {
+func (m *Model) keepCached(key string) bool { return m.keepProvider(cachefile.ProviderOf(key)) }
-	id, _ := splitSourceRow(key)
+
-	p, ok := m.byID[id]
+func (m *Model) keepProvider(id string) bool { return keepIn(m.byID)(id) }
+
+func keepIn(byID map[string]provider.Provider) func(id string) bool {
+	return func(id string) bool {
+		p, ok := byID[id]
 		return ok && p.Kind() != provider.KindRepo
 	}
+}
 
 // loadCacheFile fills the cache from the file, leaving out what's too
 // old or belongs to accounts that aren't signed in any more.
 func (m *Model) loadCacheFile() {
-	b, err := os.ReadFile(m.cachePath)
+	f := cachefile.Read(m.cachePath)
-	if err != nil {
-		return
-	}
-	var f cacheFile
-	if json.Unmarshal(b, &f) != nil || f.Version != cacheFileVersion {
-		return
-	}
 	now := m.now()
-	recent := func(at time.Time) bool { return now.Sub(at) < cacheMaxAge }
+	recent := func(at time.Time) bool { return now.Sub(at) < cachefile.MaxAge }
 	for id, e := range f.Sources {
-		if m.keepCached(id+"|") && recent(e.At) {
+		if m.keepProvider(id) && recent(e.At) {
 			m.sourceResults[id] = sourcesMsg{gen: m.sourcesGen, provider: id, sources: e.Value}
 			m.sourcesAt[id] = e.At
 		}
@@ -102,33 +77,26 @@ func (m *Model) loadCacheFile() {
 }
 
 // cacheSnapshot is the cache as the file holds it.
-func (m *Model) cacheSnapshot() cacheFile {
+func (m *Model) cacheSnapshot() cachefile.File {
-	f := cacheFile{
+	f := cachefile.New()
-		Version:    cacheFileVersion,
-		Sources:    map[string]stamped[[]provider.Source]{},
-		Containers: map[string]stamped[[]provider.Container]{},
-		Objects:    map[string]stamped[[]provider.Object]{},
-		Details:    map[string]stamped[provider.Object]{},
-		Cursor:     map[string]string{},
-	}
 	for id, r := range m.sourceResults {
-		if r.err == nil && m.keepCached(id+"|") {
+		if r.err == nil && m.keepProvider(id) {
-			f.Sources[id] = stamped[[]provider.Source]{m.sourcesAt[id], r.sources}
+			f.Sources[id] = cachefile.Stamped[[]provider.Source]{At: m.sourcesAt[id], Value: r.sources}
 		}
 	}
 	for k, e := range m.cache.containers {
 		if m.keepCached(k) {
-			f.Containers[k] = stamped[[]provider.Container]{e.at, e.value}
+			f.Containers[k] = cachefile.Stamped[[]provider.Container]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.objects {
 		if m.keepCached(k) {
-			f.Objects[k] = stamped[[]provider.Object]{e.at, e.value}
+			f.Objects[k] = cachefile.Stamped[[]provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.details {
 		if m.keepCached(k) {
-			f.Details[k] = stamped[provider.Object]{e.at, e.value}
+			f.Details[k] = cachefile.Stamped[provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, v := range m.cache.cursor {
@@ -139,28 +107,11 @@ func (m *Model) cacheSnapshot() cacheFile {
 	return f
 }
 
-// writeCacheFile writes f atomically, readable by the user only.
+// saveCache saves f, merged with the file (lazysecrets list may have
-func writeCacheFile(path string, f cacheFile) error {
+// loaded more since), from any goroutine.
-	b, err := json.Marshal(f)
+func (m *Model) saveCache(f cachefile.File) func() error {
-	if err != nil {
+	path, keep, now := m.cachePath, keepIn(m.byID), m.now()
-		return err
+	return func() error { return cachefile.Save(path, f, keep, now) }
-	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		return err
-	}
-	tmp, err := os.CreateTemp(filepath.Dir(path), ".cache-*.json")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(tmp.Name()) // after a successful rename, nothing there
-	if _, err := tmp.Write(b); err != nil {
-		tmp.Close()
-		return err
-	}
-	if err := tmp.Close(); err != nil {
-		return err
-	}
-	return os.Rename(tmp.Name(), path)
 }
 
 // persistTick saves the cache, and where lazysecrets is, in the
@@ -169,8 +120,8 @@ func (m *Model) persistTick() tea.Cmd {
 	cmds := []tea.Cmd{tea.Tick(persistEvery, func(time.Time) tea.Msg { return persistTickMsg{} })}
 	if m.cacheDirty && m.cachePath != "" {
 		m.cacheDirty = false
-		f, path := m.cacheSnapshot(), m.cachePath
+		save := m.saveCache(m.cacheSnapshot())
-		cmds = append(cmds, func() tea.Msg { return persistedMsg{writeCacheFile(path, f)} })
+		cmds = append(cmds, func() tea.Msg { return persistedMsg{save()} })
 	}
 	if p, ok := m.place(); ok && m.placeDir != "" && p.Link != m.savedPlace {
 		m.savedPlace = p.Link
@@ -185,7 +136,7 @@ func (m *Model) persistTick() tea.Cmd {
 func (m Model) Persist() error {
 	var errs []error
 	if m.cachePath != "" {
-		errs = append(errs, writeCacheFile(m.cachePath, m.cacheSnapshot()))
+		errs = append(errs, m.saveCache(m.cacheSnapshot())())
 	}
 	if m.placeDir != "" {
 		if p, ok := m.place(); ok {

internal/ui/app/persist_test.go

@@ -1,12 +1,14 @@
 package app
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"git.kebcloud.no/keb/lazysecrets/internal/ref"
@@ -80,15 +82,16 @@ func TestCacheFileDropsOldAndSignedOut(t *testing.T) {
 	file := filepath.Join(t.TempDir(), "cache.json")
 	az := fake.Azure(0)
 	now := time.Now()
-	f := cacheFile{
+	f := cachefile.File{
-		Version: cacheFileVersion,
+		Version: cachefile.Version,
-		Containers: map[string]stamped[[]provider.Container]{
+		Containers: map[string]cachefile.Stamped[[]provider.Container]{
-			az.ID() + "|recent":     {now.Add(-time.Hour), []provider.Container{{Name: "kv-recent"}}},
+			az.ID() + "|recent":     {At: now.Add(-time.Hour), Value: []provider.Container{{Name: "kv-recent"}}},
-			az.ID() + "|old":        {now.Add(-cacheMaxAge - time.Hour), []provider.Container{{Name: "kv-old"}}},
+			az.ID() + "|old":        {At: now.Add(-cachefile.MaxAge - time.Hour), Value: []provider.Container{{Name: "kv-old"}}},
-			"Azure:gone@x/t|recent": {now, []provider.Container{{Name: "kv-gone"}}},
+			"Azure:gone@x/t|recent": {At: now, Value: []provider.Container{{Name: "kv-gone"}}},
 		},
 	}
-	if err := writeCacheFile(file, f); err != nil {
+	b, _ := json.Marshal(f) // as an older lazysecrets left it
+	if err := os.WriteFile(file, b, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	d := newDriverOpts(t, Options{CacheFile: file}, az)
@@ -97,7 +100,7 @@ func TestCacheFileDropsOldAndSignedOut(t *testing.T) {
 		t.Error("dropped a recent entry")
 	}
 	if _, ok := c[az.ID()+"|old"]; ok {
-		t.Error("kept an entry older than cacheMaxAge")
+		t.Error("kept an entry older than cachefile.MaxAge")
 	}
 	if _, ok := c["Azure:gone@x/t|recent"]; ok {
 		t.Error("kept an entry of an account that isn't signed in")

internal/ui/app/route.go

@@ -5,13 +5,14 @@ import (
 	"fmt"
 	"slices"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
 // containerKey identifies a container in the UI and caches. The same vault
 // seen through two accounts must not share cached lists, since each
 // account may see different things.
-func containerKey(c provider.Container) string { return c.Source.Provider + "|" + c.ID }
+func containerKey(c provider.Container) string { return cachefile.ContainerKey(c) }
 
 // providerFor finds the provider instance a source came from. Sources
 // remembered from an earlier run (favourites) may name an account that

internal/ui/app/sources.go

@@ -6,6 +6,7 @@ import (
 	"slices"
 	"strings"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
@@ -39,7 +40,7 @@ type sourceRow struct {
 
 // sourceRowKey joins a provider ID and a source ID. "|" doesn't occur in
 // either; provider IDs contain "/" (Azure:user/tenant).
-func sourceRowKey(providerID, sourceID string) string { return providerID + "|" + sourceID }
+func sourceRowKey(providerID, sourceID string) string { return cachefile.Row(providerID, sourceID) }
 
 func splitSourceRow(row string) (providerID, sourceID string) {
 	providerID, sourceID, _ = strings.Cut(row, "|")
@@ -56,7 +57,7 @@ func sourceRowID(r sourceRow) string {
 	return sourceRowKey(r.provider, r.source.ID)
 }
 
-func newSourcesList(iconSet icons.Set, mem *store.Store) panes.List[sourceRow] {
+func newSourcesList(iconSet icons.Set, mem *store.Store, recent bool) panes.List[sourceRow] {
 	return panes.NewList("[1] Sources", panes.Item[sourceRow]{
 		ID: sourceRowID,
 		// Headers have no filter text, so filtering shows just sources.
@@ -78,8 +79,8 @@ func newSourcesList(iconSet icons.Set, mem *store.Store) panes.List[sourceRow] {
 			node := mem.Node(sourceKey(r.source))
 			kind := st.Kind(r.group)
 			starred := ""
-			if r.kind == rowSource && node.StarredFor(r.source.Provider) {
+			if r.kind == rowSource {
-				starred = st.Favourite.Render(star)
+				starred = marks(st, node, r.source.Provider, recent)
 			}
 			switch {
 			case r.kind == rowLinks:

internal/ui/app/testdata/TestGolden.golden

@@ -1,5 +1,5 @@
 ╭─ [0] lazysecrets ─────────────╮╭─ platform-prod ─────────────────────────────────────────────────╮
-│ 2 accounts                    ││ name       platform-prod                                        │
+│ ⚠ 1 expiring · 2 accounts     ││ name       platform-prod                                        │
 ╰───────────────────────────────╯│ ID         sub-prod                                             │
 ╭─ [1] Sources - Favourites ────╮│ web        https://portal.azure.com/#resource/subscriptions/sub…│
 │ ▾ Azure (2)                   ││ vaults     3                                                    │
@@ -20,7 +20,7 @@
 ╭─ [3] Secrets - Keys - Certs ──╮│                                                                 │
 │ db-password                   ││                                                                 │
 │ api-key                       ││                                                                 │
-│ legacy-token (disabled)       ││                                                                 │
+│ legacy-token (disabled) ✗ exp…││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │