refactor: drop dead code and use the standard library where it already does the job

No behaviour change.

- Deleted, unused or one-line wrappers: panes.RuneIndexes, Detail.Refresh (SetDescribed does it), SecretValue.Len, Query.Empty, Clipboard.Native, config.Load, get's value, Model.done, providerOf (cachefile.ProviderOf), contextWithTimeout, searchCoverage, startCrawl, showKeybindings, the expiry aliases and daysLeft.
- cmp.Or instead of the two cmpOr copies; slices.Sorted(maps.Keys(…)), maps.Copy, wg.Go, utf8.RuneCountInString and new(true) instead of loops and helpers that do the same.
- A container's pane title is set once, not twice; a redundant length check in share links and a no-op assignment in linkhandler.Launch are gone.
- Tests call ansi.Strip and lastLines directly; gofmt -s on links.go.

CHANGELOG.md

@@ -2,28 +2,6 @@
 
 Every release of lazysecrets, newest first.
 
-## v0.3.0 – 2026-10-15
-
-### Added
-
-- Spring Boot config files in repos ([#79](https://git.kebcloud.no/keb/lazysecrets/pulls/79)) ([96395cb](https://git.kebcloud.no/keb/lazysecrets/commit/96395cb6a27a94293e35401790296a894821d075))
-- Decrypt Jasypt values in .env and Spring files ([#80](https://git.kebcloud.no/keb/lazysecrets/pulls/80)) ([17da9ea](https://git.kebcloud.no/keb/lazysecrets/commit/17da9eaa3271dfa315a517ad0092ab5cda0b0597))
-- H shows what's hidden; Spring keys that don't look secret are hidden ([#81](https://git.kebcloud.no/keb/lazysecrets/pulls/81)) ([913b3db](https://git.kebcloud.no/keb/lazysecrets/commit/913b3db6a938d21c6d8c9285a3111418495c7345))
-- Secret patterns for all of a repo's config files, with per-type overrides ([#82](https://git.kebcloud.no/keb/lazysecrets/pulls/82)) ([4bac06a](https://git.kebcloud.no/keb/lazysecrets/commit/4bac06ae5ba6fcb8c96d46198f01235391e29f1a))
-- Example env files are listed hidden, not skipped ([#83](https://git.kebcloud.no/keb/lazysecrets/pulls/83)) ([580c7ef](https://git.kebcloud.no/keb/lazysecrets/commit/580c7ef985599b98277d80be38e39abe169b2dc4))
-- Docker Compose files in repos ([#84](https://git.kebcloud.no/keb/lazysecrets/pulls/84)) ([0f5248d](https://git.kebcloud.no/keb/lazysecrets/commit/0f5248d8f6d27e3f95f8b9cbc28310ee7b0581f7))
-- Go to shows a repo file's icon before its name ([#85](https://git.kebcloud.no/keb/lazysecrets/pulls/85)) ([e2f289d](https://git.kebcloud.no/keb/lazysecrets/commit/e2f289da5c54dab869e7ba10ca35bdc1ab74bf28))
-
-### Fixed
-
-- Decrypt SOPS .env keys written with export or spaces ([#78](https://git.kebcloud.no/keb/lazysecrets/pulls/78)) ([39cbac9](https://git.kebcloud.no/keb/lazysecrets/commit/39cbac9aabcea11e9915363e4adae5873f9724de))
-
-## v0.2.1 – 2026-10-15
-
-### Fixed
-
-- A link opens lazysecrets with your cache and next to your running instances ([#71](https://git.kebcloud.no/keb/lazysecrets/pulls/71)) ([bb41767](https://git.kebcloud.no/keb/lazysecrets/commit/bb41767cbad00bab4f1824f4e0754cc7abd98c59))
-
 ## v0.2.0 – 2026-10-14
 
 ### Added

README.md

@@ -23,7 +23,7 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 - **Your way**: rebind any key, pick a theme, and add custom commands to run
   on a secret.
 - **Try it first**: `lazysecrets --demo` runs on built-in sample data.
-- **Sources**: Azure Key Vault, Databricks secret scopes, and SOPS, `.env`, Spring Boot, Docker Compose and .NET appsettings files in your git repos.
+- **Sources**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos.
 
 > **Early development:** expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.
 
@@ -87,7 +87,7 @@ pickers and scripts: see [Integration](docs/integration.md#an-fzf-picker).
 - [Keys](docs/keys.md): every key, Go to, the layout, and rebinding keys
 - [Azure Key Vault](docs/azure.md): accounts, permissions, pinned vaults
 - [Databricks](docs/databricks.md): profiles and Key Vault-backed scopes
-- [SOPS, .env, Spring, compose and .NET files](docs/repos.md): which repos and files, decrypting
+- [SOPS and .env files](docs/repos.md): which repos and files, decrypting
 - [Sharing](docs/sharing.md): links to secrets, encrypted env files, and
   opening links, also from the browser and chat
 - [Integration](docs/integration.md): how lazysecrets can integrate into other systems

cmd/lazysecrets/handler.go

@@ -69,7 +69,11 @@ func installHandler(cfg config.Config, configPath, term string) (string, string,
 	if _, err := launchCommand(cfg, configPath, term, exe, "lazysecrets://check"); err != nil {
 		return "", "", err
 	}
-	launch := append(append([]string{exe}, configArgs(configPath)...), "launch")
+	launch := []string{exe}
+	if configPath != defaultConfigPath() {
+		launch = append(launch, "--config", configPath)
+	}
+	launch = append(launch, "launch")
 	if term != "" {
 		launch = append(launch, "--terminal", term)
 	}
@@ -184,14 +188,8 @@ func launchCommand(cfg config.Config, configPath, term, exe, link string) ([]str
 // innerCommand runs lazysecrets on link, with the environment it needs.
 func innerCommand(configPath, exe, link string) []string {
 	inner := append(append([]string{"/usr/bin/env"}, linkhandler.Env(os.Getenv)...), exe)
-	inner = append(inner, configArgs(configPath)...)
+	if configPath != defaultConfigPath() {
+		inner = append(inner, "--config", configPath)
+	}
 	return append(inner, "open", link)
 }
-
-// configArgs passes the config files on, unless they're the default.
-func configArgs(configPath string) []string {
-	if configPath == defaultConfigPath() {
-		return nil
-	}
-	return []string{"--config", configPath}
-}

cmd/lazysecrets/list.go

@@ -57,7 +57,6 @@ func listCmd(providers []provider.Provider, st *store.Store, cachePath string, t
 	expiry := fs.Bool("expiry", true, "mark and say which have expired (✗ expired) or expire within ui.expiryWarningDays (⚠ expires in 12d) (text)")
 	kinds := fs.String("kind", "", "only these kinds, comma-separated: "+strings.Join(listing.Kinds, ", ")+" (vault: also scopes and repo files)")
 	showErrors := fs.Bool("errors", true, "list the lists that can't be read, with why (text: ✗ lines; json: \"error\")")
-	hidden := fs.Bool("hidden", false, "list what's hidden too, as H does in the TUI: config file keys (Spring, compose, .NET) that don't look secret, example files, and files and repos with only those (json: \"hidden\")")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
@@ -130,7 +129,7 @@ func listCmd(providers []provider.Provider, st *store.Store, cachePath string, t
 		f = cachefile.Read(cachePath)
 	}
 	f, loaded := listing.Run(context.Background(), listing.Options{
-		Providers: providers, Cache: f, MaxAge: *maxAge, Cached: *cached, Kinds: only, Timeout: timeout, Hidden: *hidden,
+		Providers: providers, Cache: f, MaxAge: *maxAge, Cached: *cached, Kinds: only, Timeout: timeout,
 		Mark: func(link, account string) listing.Marks {
 			n := st.Node(link)
 			return listing.Marks{Starred: n.StarredFor(account), Recent: n.UsedLately(now),

cmd/lazysecrets/main.go

@@ -171,22 +171,26 @@ Flags:
 		return nil
 	}
 
-	sub := "" // the subcommand; "" browses
+	var open, getRef *ref.Ref
-	var subArgs []string
-	var open *ref.Ref
-	var getRef ref.Ref
 	var openAction string
+	var shareArgs, listArgs []string
+	printKeys := false
 	switch args := flag.Args(); {
-	case len(args) > 0 && (args[0] == "share" || args[0] == "list"):
+	case len(args) > 0 && args[0] == "share":
-		sub, subArgs = args[0], args[1:]
+		shareArgs = args[1:]
+		if len(shareArgs) == 0 {
+			shareArgs = []string{} // still sharing: says how
+		}
+	case len(args) > 0 && args[0] == "list":
+		listArgs = append([]string{}, args[1:]...) // not nil: listing
 	case len(args) == 1 && args[0] == "keybindings":
-		sub = "keybindings"
+		printKeys = true
 	case len(args) > 0 && args[0] == "get":
 		r, _, err := refArg("get", args[1:])
 		if err != nil {
 			return err
 		}
-		sub, getRef = "get", r
+		getRef = &r
 	case len(args) > 0 && args[0] == "handler":
 		return handler(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "launch":
@@ -232,7 +236,7 @@ Flags:
 	if err := checkCommandKeys(&keymap, cfg.CustomCommands); err != nil {
 		return err
 	}
-	if sub == "keybindings" {
+	if printKeys {
 		fmt.Print(keymap.YAML())
 		return nil
 	}
@@ -260,13 +264,25 @@ Flags:
 	}
 	// timeoutFor is how long a request to a provider of kind k may take.
 	timeoutFor := func(k provider.Kind) time.Duration { return cmp.Or(timeouts[k], *timeout) }
-	if !set["clipboard-clear"] {
+	if !set["clipboard-clear"] && cfg.Values.ClipboardClear != nil {
-		*clipClear = valueOr(cfg.Values.ClipboardClear, *clipClear)
+		*clipClear = *cfg.Values.ClipboardClear
+	}
+	expiryDays := 30
+	if cfg.UI.ExpiryWarningDays != nil {
+		expiryDays = *cfg.UI.ExpiryWarningDays
+	}
+	revealTimeout := 60 * time.Second
+	if cfg.Values.RevealTimeout != nil {
+		revealTimeout = *cfg.Values.RevealTimeout
+	}
+	loadDelay := 150 * time.Millisecond
+	if cfg.UI.LoadDelay != nil {
+		loadDelay = *cfg.UI.LoadDelay
+	}
+	var updateEvery time.Duration // 0: the app's default, a day
+	if cfg.Updates.AutoCheckInterval != nil {
+		updateEvery = *cfg.Updates.AutoCheckInterval
 	}
-	expiryWarning := time.Duration(valueOr(cfg.UI.ExpiryWarningDays, 30)) * 24 * time.Hour
-	revealTimeout := valueOr(cfg.Values.RevealTimeout, 60*time.Second)
-	loadDelay := valueOr(cfg.UI.LoadDelay, 150*time.Millisecond)
-	updateEvery := valueOr(cfg.Updates.AutoCheckInterval, 0) // 0: the app's default, a day
 	if !set["icons"] {
 		switch {
 		case os.Getenv("LAZYSECRETS_ICONS") != "":
@@ -276,17 +292,7 @@ Flags:
 		}
 	}
 
-	recentIcon := valueOr(cfg.UI.RecentIcon, false)
+	recentIcon := cfg.UI.RecentIcon != nil && *cfg.UI.RecentIcon
-
-	startDir := *dir
-	if startDir == "" {
-		startDir, _ = os.Getwd()
-	}
-	// What was loaded last time.
-	cacheFile := ""
-	if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
-		cacheFile = filepath.Join(d, "cache.json")
-	}
 
 	// Stars, notes and the layout. Demo mode keeps them in memory, so
 	// sample vaults never end up in the real file.
@@ -344,10 +350,17 @@ Flags:
 			providers = append(providers, dbx)
 		}
 		if config.On(pc.Repos.Enabled) {
+			start := *dir
+			if start == "" {
+				start, _ = os.Getwd()
+			}
+			roots := repo.DefaultRoots
+			if pc.Repos.Roots != nil {
+				roots = *pc.Repos.Roots
+			}
 			repos := repo.New(repo.Settings{
-				Dir: startDir, Paths: pc.Repos.Paths, Roots: valueOr(pc.Repos.Roots, repo.DefaultRoots),
+				Dir: start, Paths: pc.Repos.Paths, Roots: roots, Starred: starredRepos(st),
-				Starred: starredRepos(st), Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
+				Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
-				SecretPatterns: pc.Repos.SecretPatterns, Types: map[string]repo.FileType{"spring": pc.Repos.Spring, "compose": pc.Repos.Compose, "dotnet": pc.Repos.Dotnet},
 			})
 			// The repo it started in (shown on top as Repo) and the
 			// others, checked for secret files in the background like
@@ -363,14 +376,19 @@ Flags:
 	// the standard logger, which would draw over the TUI.
 	log.SetOutput(io.Discard)
 
-	switch sub {
+	if getRef != nil {
-	case "get":
 		ctx, cancel := context.WithTimeout(context.Background(), timeoutFor(getRef.Kind))
 		defer cancel()
-		return get(ctx, providers, st, getRef)
+		return get(ctx, providers, st, *getRef)
-	case "list":
+	}
-		return listCmd(providers, st, cacheFile, timeoutFor, theme, *icons, recentIcon, expiryWarning, subArgs, os.Stdout)
+	if listArgs != nil {
-	case "share":
+		cachePath := ""
+		if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
+			cachePath = filepath.Join(d, "cache.json")
+		}
+		return listCmd(providers, st, cachePath, timeoutFor, theme, *icons, recentIcon, time.Duration(expiryDays)*24*time.Hour, listArgs, os.Stdout)
+	}
+	if shareArgs != nil {
 		// The files from a repo, the key from whichever provider it's
 		// in: the longest timeout.
 		d := *timeout
@@ -379,7 +397,7 @@ Flags:
 		}
 		ctx, cancel := context.WithTimeout(context.Background(), d)
 		defer cancel()
-		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), subArgs, os.Stdout)
+		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), shareArgs, os.Stdout)
 	}
 
 	// Links opened elsewhere (lazysecrets launch) can come here.
@@ -413,10 +431,16 @@ Flags:
 		onActive = srv.Touch
 	}
 
-	// Where it was left in this folder.
+	// What was loaded last time, and where it was left in this folder.
-	placeDir := ""
+	var cacheFile, placeDir string
 	if !*demo {
-		placeDir = startDir
+		if d, err := config.CacheDir(); err == nil && config.On(cfg.Storage.Cache) {
+			cacheFile = filepath.Join(d, "cache.json")
+		}
+		placeDir = *dir
+		if placeDir == "" {
+			placeDir, _ = os.Getwd()
+		}
 		if abs, err := filepath.Abs(placeDir); err == nil {
 			placeDir = abs
 		}
@@ -433,7 +457,7 @@ Flags:
 		NoHistory:      !config.On(cfg.Storage.History),
 		OnActive:       onActive,
 		RevealTimeout:  revealTimeout,
-		ExpiryWarning:  expiryWarning,
+		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
 		HideOnBlur:     config.On(cfg.Values.HideOnBlur),
 		HandlerSetup:   setup,
 		Updater:        updater(cfg.Updates.Sources),
@@ -466,14 +490,6 @@ Flags:
 	return err
 }
 
-// valueOr is *p, or def when p is nil (not set in the config).
-func valueOr[T any](p *T, def T) T {
-	if p == nil {
-		return def
-	}
-	return *p
-}
-
 // configFiles are the config files given, for the status pane: those
 // that exist, or the first if none does (where to create one).
 func configFiles(list string) []string {

cmd/lazysecrets/update.go

@@ -3,7 +3,6 @@ package main
 import (
 	"context"
 	"errors"
-	"flag"
 	"fmt"
 	"strings"
 	"time"
@@ -33,12 +32,8 @@ func updater(servers []string) *app.Updater {
 // updateCmd is lazysecrets update [--check]: the newer release's
 // changelog, then (unless --check) install it.
 func updateCmd(configPath string, args []string) error {
-	fs := flag.NewFlagSet("update", flag.ContinueOnError)
+	check := len(args) == 1 && args[0] == "--check"
-	check := fs.Bool("check", false, "just say if there's a newer release")
+	if len(args) > 0 && !check {
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if fs.NArg() != 0 {
 		return errors.New("usage: lazysecrets update [--check]")
 	}
 	cfg, err := config.LoadAll(strings.Split(configPath, ","))
@@ -54,14 +49,14 @@ func updateCmd(configPath string, args []string) error {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)
 	}
 	if !update.Newer(current, r.Tag) {
-		if strings.HasPrefix(current, "dev") {
+		if !update.Newer(current, "v999.0.0") {
 			return fmt.Errorf("this is a development build (%s); the latest release is %s: install it with install.sh, or go install …@%s", current, r.Tag, r.Tag)
 		}
 		fmt.Printf("lazysecrets %s is the latest (%s)\n", current, r.Tag)
 		return nil
 	}
 	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes(current)))
-	if *check {
+	if check {
 		fmt.Println("lazysecrets update installs it.")
 		return nil
 	}

cmd/lazysecrets/version.go

@@ -3,6 +3,7 @@ package main
 import (
 	"regexp"
 	"runtime/debug"
+	"strings"
 )
 
 // version is set by release builds:
@@ -30,7 +31,7 @@ func versionString() string {
 		// go install …@<commit>.
 		if m := pseudo.FindStringSubmatch(v); m != nil {
 			dirty := ""
-			if m[2] != "" {
+			if strings.HasSuffix(v, "+dirty") {
 				dirty = "-dirty"
 			}
 			return "dev-" + m[1][:7] + dirty

docs/config.md

@@ -74,9 +74,6 @@ theme:
   azureColor: ["#82aaff"]
   databricksColor: ["#ff757f"]
   repoColor: ["#c099ff"]
-  springColor: ["#c3e88d"]               # Spring Boot config files
-  composeColor: ["#82aaff"]              # Docker Compose files
-  dotnetColor: ["#c099ff"]               # .NET appsettings files
 ```
 
 A role lazysecrets doesn't know, a typo or one from a newer version, is

docs/development.md

@@ -49,14 +49,10 @@ what its pull request tested, and CI doesn't run again there.
 Merge as many pull requests as you like, then release `main`:
 
 ```sh
-scripts/release.sh --dry-run minor    # the tag and notes the release would have
+scripts/release.sh --dry-run v0.2.0   # the notes the release would have
-scripts/release.sh minor              # CHANGELOG.md, commit, tag, push
+scripts/release.sh v0.2.0             # CHANGELOG.md, commit, tag, push
 ```
 
-`patch`, `minor` and `major` bump the latest release (`v0.2.1` → `v0.2.2`,
-`v0.3.0`, `v1.0.0`; pre-releases don't count); a tag (`v0.3.0`,
-`v0.3.0-rc.1`) is taken as it is.
-
 It refuses unless you're on a clean `main` that matches `origin/main`.
 [git-cliff](https://git-cliff.org) (`cliff.toml`) writes `CHANGELOG.md`
 from the pull request titles. The tag runs the release workflow

docs/integration.md

@@ -51,7 +51,6 @@ so `^prod` finds names starting with prod.
 | `--cached` | only what's cached, at once: nothing is loaded from Azure or Databricks |
 | `--max-age 2m` | load cached lists older than this again |
 | `--errors=false` | leave out the vaults and sources it couldn't read |
-| `--hidden` | list what's [hidden](repos.md#spring-boot-config) too, as `H` shows it (json: `"hidden": true`) |
 | `--color never` | no colours, for scripts |
 | `--icons=false` | no provider icons |
 | `--stars=false` | no ★ before starred names (in `favouriteColor`) |

docs/keys.md

@@ -20,7 +20,6 @@ The rule: a letter in the lists, ctrl+ that letter where you type a filter
 | `[` / `]` | previous / next tab of the focused pane: Sources and Favourites in Sources; Secrets, Keys, Certs in Secrets |
 | `/` | filter the focused list by name or note ([how it matches](#searching)); `enter` keeps it, `esc` clears it. While typing: `ctrl+j`/`ctrl+k` move, `ctrl+y` copies, `ctrl+r` reveals, `ctrl+f` stars |
 | `` ` `` | switch the Sources pane between grouped by provider and a flat list; `enter`/`space` on a provider folds it |
-| `H` | show / hide what's hidden: [config file keys](repos.md#spring-boot-config) (Spring, compose, .NET) that don't look secret, example files, and files and repos with only those; shown dimmed |
 | `r` | refresh the focused pane |
 | `q`, `ctrl+c` | quit |
 
@@ -54,7 +53,7 @@ match case exactly.
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
-| `e` | open the selected SOPS, `.env`, Spring, compose or .NET file, or a secret's file at its line ([how](repos.md#opening-files)) |
+| `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
 | `s` / `S` | copy a [link](sharing.md) to the selected item / share menu (also env files, [encrypted](sharing.md#sharing-env-files)) |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |

docs/repos.md

@@ -1,10 +1,9 @@
-# SOPS, .env, Spring, compose and .NET files in git repos
+# SOPS and .env files in git repos
 
 lazysecrets shows git repositories under **Repos**: their
 [SOPS](https://github.com/getsops/sops)-encrypted files (YAML, JSON,
-`.env`, INI), plain env files, [Spring Boot config](#spring-boot-config)
+`.env`, INI) and plain env files as vaults, and the keys in them
-[Docker Compose files](#docker-compose) and [.NET appsettings](#net-appsettings)
+(`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
-as vaults, and the keys in them (`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
 escaped, `app\.name`, so it doesn't read as nesting.
 
 ## Which repos
@@ -30,9 +29,8 @@ anything by hand.
 ## Which files
 
 **Env files**: `.env`, `.env.local`, `prod.env` and the like, also when
-git-ignored (as they usually are), in the folders git tracks files in.
+git-ignored (as they usually are), in the folders git tracks files in;
-`.env.example`, `.sample`, `.template` and the like are listed hidden
+not `.env.example`, `.sample`, `.template` and the like. They're read
-(`H` shows them): someone may have put a real value in one. They're read
 directly; a file with SOPS metadata is always treated as SOPS, whatever
 its name.
 
@@ -48,7 +46,7 @@ Folders of dependencies and caches are never looked in, tracked or not:
 3. where the repo's `.sops.yaml` `creation_rules` say SOPS files go,
 4. the whole repo.
 
-`include`/`exclude` apply to env, Spring, compose and .NET files too.
+`include`/`exclude` apply to env files too.
 
 ```yaml
 providers:
@@ -67,92 +65,13 @@ sharing:
   key: https://kv-team.vault.azure.net/secrets/env-share   # or its lazysecrets:// link
 ```
 
-## Spring Boot config
-
-`application.yml`, `application-prod.properties`, `bootstrap.yaml` and the
-like, tracked by git (not those in a Helm chart's `templates/`). Most of
-their keys aren't secret, so only those that look like one are listed; the
-rest are hidden:
-
-- **keys** named like a secret: ending in `password`, `pwd`, `secret`,
-  `token`, `key`, `credentials`, `salt`, `connection-string` and the
-  like (`spring.datasource.password`, `client-secret`, `checkoutKey`),
-- **values** that look like one: Jasypt's `ENC(...)`, a URL with a
-  password (`jdbc:postgresql://app:pw@db/app`), or a connection string
-  with `AccountKey=`, `SharedAccessKey=` or `Password=`.
-
-A file with none is hidden too, and a repo with only such files. `H` shows
-what's hidden, dimmed, in the panes and in Go to (`lazysecrets list
---hidden` lists it); a pane's counter says how many it hides. A file's
-details count its hidden keys, and `e` opens it whole. A `${DB_PASSWORD}`
-value is marked as a reference: the secret is set elsewhere. A tracked
-file is marked in red only when a listed key has its value in plain text.
-
-The patterns are regexps, for all of a repo's config files and per type of
-file; each list replaces the one it falls back to, and `keys: [".*"]`
-lists every key:
-
-```yaml
-providers:
-  repos:
-    secretPatterns:                             # all config files
-      keys: ["(?i)(password|secret|token|key)$"]  # matched against the key's name
-      values: ["^ENC\\(.+\\)$"]                   # and against its value
-    spring:
-      secretPatterns:                           # Spring's: only what differs
-        keys: ["(?i)(password|secret)$", "bearer$"]
-    compose:
-      secretPatterns:                           # and compose's
-        values: []
-```
-
-A repo's `.lazysecrets.yaml` can set them too, the same way
-(`secretPatterns:`, `spring:`, `compose:` or `dotnet: secretPatterns:`),
-for everyone. Each list
-comes from the first that sets it: the repo's for the type, the repo's,
-the config's for the type, the config's, the defaults.
-
-Keys are named as Spring names them, `spring.datasource.password`; in a
-file with several documents (`---`, or `#---` in `.properties`), a later
-document's keys get its profile, `spring.datasource.password (prod)`.
-Values Maven fills in at build time (`@project.version@`) are read as
-they are.
-
-## Docker Compose
-
-`compose.yaml`, `docker-compose.yml` and their variants
-(`docker-compose.test.yml`), tracked by git; `docker-compose.example.yml`
-and the like are hidden. Their secrets are the services' `environment`
-variables, as a map (`DB_PASSWORD: x`) or a list (`- DB_PASSWORD=x`),
-named `service.VAR` (`api.DB_PASSWORD`); a `<<: *anchor` shared between
-services is read too. The same [secret patterns](#spring-boot-config)
-pick them, the rest hidden, with `compose: secretPatterns:` for compose
-files' own.
-
-`${DB_PASSWORD}`, `$DB_PASSWORD` and `${DB_PASSWORD:?…}`, and a variable
-without a value (`DB_PASSWORD:`, `- DB_PASSWORD`), taken from where
-compose runs, are marked as references; `${DB_PASSWORD:-x}` has its
-default in the file.
-
-## .NET appsettings
-
-`appsettings.json` and `appsettings.<Environment>.json`, tracked by git.
-Keys are named as .NET's configuration names them, sections joined by
-colons: `ConnectionStrings:Default`, `Servers:0:Name`. The same
-[secret patterns](#spring-boot-config) pick them, the rest hidden, with
-`dotnet: secretPatterns:` for .NET files' own; a connection string with
-`Password=` is listed by its value. An App Service Key Vault reference,
-`@Microsoft.KeyVault(…)`, is marked as a reference. Jasypt values decrypt
-with `$JASYPT_ENCRYPTOR_PASSWORD` only.
-
 ## Decrypting
 
-Listing never decrypts: SOPS and Jasypt encrypt values only, so keys and
+Listing never decrypts: SOPS encrypts values only, so keys and metadata
-metadata (encryption, last modified) are read straight from the files.
+(encryption, last modified) are read straight from the files. Revealing,
-Revealing, copying or `lazysecrets get` decrypts one value; SOPS's with
+copying or `lazysecrets get` decrypts one value with your `sops` binary, so
-your `sops` binary, so whatever sops uses works (age keys, Azure Key Vault
+whatever sops uses works (age keys, Azure Key Vault through az, AWS/GCP
-through az, AWS/GCP KMS, PGP). When sops can't decrypt, its whole error
+KMS, PGP). When sops can't decrypt, its whole error message is shown.
-message is shown.
 
 On a file, the right pane shows how it's encrypted and the keys it's
 encrypted for (public: age recipients, Key Vault keys, KMS ARNs, PGP
@@ -161,24 +80,6 @@ tracked, ignored or neither, and its last commit. A plain `.env` file that
 git tracks, or that isn't ignored, is marked in red: its values are in the
 repo's history, or easily could be.
 
-### Jasypt
-
-A value like `ENC(...)` in a plain `.env`, Spring, compose or .NET file is
-[Jasypt](http://www.jasypt.org)'s, decrypted when it's revealed or copied
-with jasypt-spring-boot's default algorithm (3.0+:
-`PBEWITHHMACSHA512ANDAES_256`). The password is, as in Spring:
-
-1. `$JASYPT_ENCRYPTOR_PASSWORD`,
-2. the file's own: `jasypt.encryptor.password` in a Spring file, the
-   service's `JASYPT_ENCRYPTOR_PASSWORD` in a compose file,
-   `JASYPT_ENCRYPTOR_PASSWORD` in a `.env`; a `${VAR}` in it (with a
-   default: `${VAR:default}` in Spring, `${VAR:-default}` elsewhere) is
-   read from the environment.
-
-Environment variables are lazysecrets' own: a link opened from the browser
-starts it without your shell's. A `.env` whose values are all Jasypt's
-isn't marked in red.
-
 ## Opening files
 
 `e` opens the selected file, or on a secret, its file at that key's line:

internal/config/config.go

@@ -15,7 +15,6 @@ import (
 	"go.yaml.in/yaml/v3"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
-	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
 	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
@@ -154,12 +153,6 @@ type Repos struct {
 	// a repo's .sops.yaml creation_rules say where to look.
 	Include []string `yaml:"include"`
 	Exclude []string `yaml:"exclude"`
-	// SecretPatterns say which keys of config files are secrets; Spring,
-	// Compose and Dotnet override them for their files, list by list.
-	SecretPatterns repo.SecretPatterns `yaml:"secretPatterns"`
-	Spring         repo.FileType       `yaml:"spring"`
-	Compose        repo.FileType       `yaml:"compose"`
-	Dotnet         repo.FileType       `yaml:"dotnet"`
 }
 
 type Azure struct {
@@ -299,12 +292,6 @@ func (c Config) validate(path string) error {
 			return fmt.Errorf("%s: %s: %s is negative", path, name, d)
 		}
 	}
-	if err := errors.Join(c.Providers.Repos.SecretPatterns.Check("providers.repos.secretPatterns"),
-		c.Providers.Repos.Spring.SecretPatterns.Check("providers.repos.spring.secretPatterns"),
-		c.Providers.Repos.Compose.SecretPatterns.Check("providers.repos.compose.secretPatterns"),
-		c.Providers.Repos.Dotnet.SecretPatterns.Check("providers.repos.dotnet.secretPatterns")); err != nil {
-		return fmt.Errorf("%s: %w", path, err)
-	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {
 			return fmt.Errorf("%s: providers.azure.vaults[%d]: %q is not an https:// vault URL", path, i, v)

internal/config/config_test.go

@@ -84,8 +84,6 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
 		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
-		"regexp":     "providers:\n  repos:\n    secretPatterns:\n      keys: [\"(pass\"]\n",
-		"spring re":  "providers:\n  repos:\n    spring:\n      secretPatterns:\n        values: [\"(\"]\n",
 	} {
 		if _, err := LoadAll([]string{write(t, content)}); err == nil {
 			t.Errorf("%s: no error", name)

internal/instance/instance.go

@@ -35,18 +35,15 @@ func Dir(stateDir string) string {
 type Status struct {
 	PID        int       `json:"pid"`
 	LastActive time.Time `json:"lastActive"` // last key press or focus
-	Reach      int       `json:"reach"`      // how readily it can be shown: unreachable, switchable or inView
+	// Reach is how readily it can be shown: 2 in view (outside tmux, or
+	// in a tmux session a client shows), 1 in a tmux session that a tmux
+	// client can be switched to, 0 not at all.
+	Reach int `json:"reach"`
 	// App is the terminal app it would show in (macOS), preferring the
 	// app the link was clicked in.
 	App string `json:"app,omitempty"`
 }
 
-const (
-	unreachable = 0
-	switchable  = 1 // in a tmux session that a tmux client can be switched to
-	inView      = 2 // outside tmux, or in a tmux session a client shows
-)
-
 type request struct {
 	Op    string `json:"op"` // "status" or "open"
 	Link  string `json:"link,omitempty"`
@@ -190,7 +187,7 @@ func Best(found []Found, front string, terminal bool) (Found, bool) {
 			best = f
 		}
 	}
-	return best, best.Reach > unreachable
+	return best, best.Reach > 0
 }
 
 // Open hands link, clicked in front, to f.

internal/instance/tmux.go

@@ -1,7 +1,6 @@
 package instance
 
 import (
-	"cmp"
 	"os"
 	"os/exec"
 	"slices"
@@ -26,10 +25,9 @@ func tmux(args ...string) (string, error) {
 func inTmux() bool { return os.Getenv("TMUX") != "" && os.Getenv("TMUX_PANE") != "" }
 
 type client struct {
-	name, session string
+	name, session, activity string // activity: Unix seconds
-	activity      int // Unix seconds
+	pid                     int
-	pid           int
+	app                     string
-	app           string
 }
 
 // clients lists the tmux server's clients, the one last typed in first.
@@ -44,31 +42,30 @@ func clients() []client {
 		if len(f) < 4 {
 			continue
 		}
-		activity, err1 := strconv.Atoi(f[0])
+		pid, err := strconv.Atoi(f[1])
-		pid, err2 := strconv.Atoi(f[1])
+		if err != nil {
-		if err1 != nil || err2 != nil {
 			continue
 		}
-		cs = append(cs, client{name: f[2], session: f[3], activity: activity, pid: pid, app: linkhandler.HostApp(pid)})
+		cs = append(cs, client{name: f[2], session: f[3], activity: f[0], pid: pid, app: linkhandler.HostApp(pid)})
 	}
-	slices.SortStableFunc(cs, func(a, b client) int { return cmp.Compare(b.activity, a.activity) })
+	// Activity has the same width for centuries: strings compare like
+	// numbers.
+	slices.SortStableFunc(cs, func(a, b client) int { return strings.Compare(b.activity, a.activity) })
 	return cs
 }
 
 // place is where this instance would show: the tmux client (zero outside
-// tmux), the app, and its reach.
+// tmux), the app, and reach: 2 already on screen there (outside tmux, or
+// a client on its session), 1 after switching a client, 0 nowhere.
 func place(front string) (client, string, int) {
 	if !inTmux() {
-		return client{}, linkhandler.HostApp(os.Getpid()), inView
+		return client{}, linkhandler.HostApp(os.Getpid()), 2
 	}
 	session, err := tmux("display-message", "-p", "-t", os.Getenv("TMUX_PANE"), "#{session_name}")
 	if err != nil {
-		return client{}, "", unreachable
+		return client{}, "", 0
 	}
 	cs := clients()
-	if len(cs) == 0 {
-		return client{}, "", unreachable
-	}
 	// Best first: in the front app on its session, in the front app,
 	// on its session, any.
 	rank := func(c client) int {
@@ -81,16 +78,20 @@ func place(front string) (client, string, int) {
 		}
 		return r
 	}
-	best := cs[0]
+	var best client
-	for _, c := range cs[1:] {
+	found := false
-		if rank(c) > rank(best) {
+	for _, c := range cs {
-			best = c
+		if !found || rank(c) > rank(best) {
+			best, found = c, true
 		}
 	}
-	if best.session == session {
+	if !found {
-		return best, best.app, inView
+		return client{}, "", 0
 	}
-	return best, best.app, switchable
+	if best.session == session {
+		return best, best.app, 2
+	}
+	return best, best.app, 1
 }
 
 // Raise brings this instance into view for a link clicked in front: in
@@ -98,14 +99,14 @@ func place(front string) (client, string, int) {
 // then its app to the front, showing a hidden dropdown terminal.
 func Raise(front string) {
 	c, app, reach := place(front)
-	if reach == unreachable {
+	if reach == 0 {
 		return
 	}
 	if inTmux() {
 		pane := os.Getenv("TMUX_PANE")
 		_, _ = tmux("select-window", "-t", pane)
 		_, _ = tmux("select-pane", "-t", pane)
-		if reach == switchable {
+		if reach == 1 {
 			_, _ = tmux("switch-client", "-c", c.name, "-t", pane)
 		}
 	}

internal/jasypt/jasypt.go

@@ -1,67 +0,0 @@
-// Package jasypt decrypts values encrypted with Jasypt the way
-// jasypt-spring-boot 3.0 and later does by default: ENC(...) around the
-// base64 of a random salt, a random IV and the ciphertext, with
-// PBEWITHHMACSHA512ANDAES_256 (PBKDF2-HMAC-SHA512, 1000 iterations,
-// AES-256-CBC).
-package jasypt
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/pbkdf2"
-	"crypto/sha512"
-	"encoding/base64"
-	"errors"
-	"strings"
-	"unicode/utf8"
-)
-
-const iterations = 1000
-
-// ErrDecrypt is a value that doesn't decrypt with the password: a wrong
-// password, or one encrypted with another algorithm.
-var ErrDecrypt = errors.New("doesn't decrypt: a wrong password, or not Jasypt's default algorithm (PBEWITHHMACSHA512ANDAES_256)")
-
-// Is reports whether v is a Jasypt value, ENC(...).
-func Is(v string) bool {
-	return len(v) > len("ENC()") && strings.HasPrefix(v, "ENC(") && strings.HasSuffix(v, ")")
-}
-
-// Decrypt decrypts an ENC(...) value.
-func Decrypt(v, password string) (string, error) {
-	b, err := base64.StdEncoding.DecodeString(strings.TrimSuffix(strings.TrimPrefix(v, "ENC("), ")"))
-	if err != nil {
-		return "", errors.New("not Jasypt: ENC(...) isn't base64")
-	}
-	const size = aes.BlockSize // the salt's and the IV's too
-	if len(b) < 3*size || len(b)%size != 0 {
-		return "", ErrDecrypt
-	}
-	salt, iv, data := b[:size], b[size:2*size], b[2*size:]
-	key, err := pbkdf2.Key(sha512.New, password, salt, iterations, 32)
-	if err != nil {
-		return "", err
-	}
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return "", err
-	}
-	plain := make([]byte, len(data))
-	cipher.NewCBCDecrypter(block, iv).CryptBlocks(plain, data)
-	// A wrong password decrypts to noise: its padding is almost never
-	// valid, and the rest rarely UTF-8.
-	n := int(plain[len(plain)-1])
-	if n == 0 || n > size {
-		return "", ErrDecrypt
-	}
-	for _, c := range plain[len(plain)-n:] {
-		if int(c) != n {
-			return "", ErrDecrypt
-		}
-	}
-	plain = plain[:len(plain)-n]
-	if !utf8.Valid(plain) {
-		return "", ErrDecrypt
-	}
-	return string(plain), nil
-}

internal/jasypt/jasypt_test.go

@@ -1,37 +0,0 @@
-package jasypt
-
-import (
-	"errors"
-	"testing"
-)
-
-// Encrypted by Jasypt 1.9.3 itself, set up as jasypt-spring-boot's default
-// encryptor, with the password "test-password".
-var vectors = map[string]string{
-	"ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)":                         "hunter2",
-	"ENC(w4pm2JVZcbG5R+Ud9uKHg8VhJ/0aAK7sFXtNBv+Vo450SAchTQtfhw0TnIJ9gN+D0VFbwqJzfXU369coTJz2rw==)": "blåbærsyltetøy ✓",
-}
-
-func TestDecrypt(t *testing.T) {
-	for enc, want := range vectors {
-		if !Is(enc) {
-			t.Errorf("%s: not Jasypt", enc)
-		}
-		if got, err := Decrypt(enc, "test-password"); err != nil || got != want {
-			t.Errorf("%s: %q %v, want %q", enc, got, err, want)
-		}
-		if _, err := Decrypt(enc, "wrong"); !errors.Is(err, ErrDecrypt) {
-			t.Errorf("%s with a wrong password: %v", enc, err)
-		}
-	}
-	for _, v := range []string{"ENC(not base64!)", "ENC(aGVsbG8=)"} {
-		if _, err := Decrypt(v, "test-password"); err == nil {
-			t.Errorf("%s: no error", v)
-		}
-	}
-	for _, v := range []string{"ENC()", "hunter2", "ENC[AES256_GCM,data:x]", "${DB_PASSWORD}"} {
-		if Is(v) {
-			t.Errorf("%s: Jasypt", v)
-		}
-	}
-}

internal/listing/listing.go

@@ -56,9 +56,6 @@ type Entry struct {
 	// web page (portal, workspace), if any.
 	Reference string `json:"reference,omitempty"`
 	URL       string `json:"url,omitempty"`
-	// Hidden is left out by its provider's rules (a Spring file's key
-	// that doesn't look secret), listed only with Options.Hidden.
-	Hidden bool `json:"hidden,omitempty"`
 	// Error says why a source's vaults or a vault's secrets couldn't be
 	// listed. The entry is then that source or vault, again, or with an
 	// account's sources unreadable, the account without a link.
@@ -73,8 +70,6 @@ type Options struct {
 	MaxAge time.Duration
 	// Cached lists only what's cached (and repos): nothing is loaded.
 	Cached bool
-	// Hidden lists what providers hide too, as H does in the TUI.
-	Hidden bool
 	// Kinds are the kinds of entry to list (Kinds' names); none is all.
 	// Lists only needed for other kinds aren't loaded: sources and vaults
 	// alone don't load any secrets. Lists that fail are always listed.
@@ -185,9 +180,6 @@ func (l *lister) provider(p provider.Provider) {
 
 // source emits src, and what's cached under it, and queues what's not.
 func (l *lister) source(p provider.Provider, src provider.Source) {
-	if src.Hidden && !l.o.Hidden {
-		return
-	}
 	src.Provider, src.ProviderLabel = p.ID(), p.Label()
 	l.put(p, sourceEntry(src))
 	row := cachefile.Row(p.ID(), src.ID)
@@ -204,9 +196,6 @@ func (l *lister) source(p provider.Provider, src provider.Source) {
 
 func (l *lister) containers(p provider.Provider, src provider.Source, cs []provider.Container) {
 	for _, c := range sorted(cs, func(c provider.Container) string { return c.Name }) {
-		if c.Hidden && !l.o.Hidden {
-			continue
-		}
 		c.Source = src
 		l.put(p, containerEntry(c))
 		for _, t := range c.ObjectTypes() {
@@ -232,17 +221,17 @@ func (l *lister) objects(p provider.Provider, c provider.Container, objs []provi
 	for _, o := range sorted(objs, func(o provider.Object) string { return o.Name }) {
 		o.Container = c
 		r, err := ref.ForObject(o, "")
-		if err != nil || (o.Hidden && !l.o.Hidden) {
+		if err != nil {
 			continue
 		}
 		l.put(p, Entry{Link: r.String(), Kind: strings.ToLower(string(o.Type)), Provider: kindOf(c.Source.Kind),
 			Path: []string{c.Source.Name, c.Name, o.Name}, AccountLabel: accountOf(c.Source),
-			Expires: o.Expires, Enabled: o.Enabled, Reference: o.Reference, URL: o.URL, Hidden: o.Hidden})
+			Expires: o.Expires, Enabled: o.Enabled, Reference: o.Reference, URL: o.URL})
 	}
 }
 
 func sourceEntry(src provider.Source) Entry {
-	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src), URL: src.URL, Hidden: src.Hidden}
+	e := Entry{Kind: "source", Provider: kindOf(src.Kind), Path: []string{src.Name}, AccountLabel: accountOf(src), URL: src.URL}
 	if r, err := ref.ForSource(src); err == nil {
 		e.Link = r.String()
 	}
@@ -250,7 +239,7 @@ func sourceEntry(src provider.Source) Entry {
 }
 
 func containerEntry(c provider.Container) Entry {
-	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source), URL: c.URL, Hidden: c.Hidden}
+	e := Entry{Kind: "vault", Provider: kindOf(c.Source.Kind), Path: []string{c.Source.Name, c.Name}, AccountLabel: accountOf(c.Source), URL: c.URL}
 	if r, err := ref.ForContainer(c, provider.TypeSecret); err == nil {
 		e.Link = r.String()
 	}

internal/provider/azure/azure.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph"
@@ -100,7 +99,13 @@ func (p *Provider) Label() string { return cmp.Or(p.label, string(provider.KindA
 // Sources lists the subscriptions the signed-in identity can see, skipping
 // disabled and deleted ones.
 func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
-	out, err := all(ctx, p.subs.NewListPager(nil), func(page armsubscriptions.ClientListResponse) (srcs []provider.Source) {
+	var out []provider.Source
+	pager := p.subs.NewListPager(nil)
+	for pager.More() {
+		page, err := pager.NextPage(ctx)
+		if err != nil {
+			return nil, cleanError(err)
+		}
 		for _, s := range page.Value {
 			switch deref(s.State) {
 			case armsubscriptions.SubscriptionStateDisabled, armsubscriptions.SubscriptionStateDeleted:
@@ -113,7 +118,7 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 			p.mu.Lock()
 			p.tenants[id] = tenant
 			p.mu.Unlock()
-			srcs = append(srcs, provider.Source{
+			out = append(out, provider.Source{
 				Kind:   provider.KindAzure,
 				ID:     id,
 				Name:   deref(s.DisplayName),
@@ -121,10 +126,6 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 				URL:    PortalResourceURL(tenant, "/subscriptions/"+id, "overview"),
 			})
 		}
-		return srcs
-	})
-	if err != nil {
-		return nil, err
 	}
 	slices.SortFunc(out, func(a, b provider.Source) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	if len(p.opts.Vaults) > 0 {
@@ -229,29 +230,22 @@ func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provid
 	if err != nil {
 		return nil, err
 	}
-	return all(ctx, client.NewListBySubscriptionPager(nil), func(page armkeyvault.VaultsClientListBySubscriptionResponse) (vaults []provider.Container) {
+	var out []provider.Container
-		for _, v := range page.Value {
+	pager := client.NewListBySubscriptionPager(nil)
-			if v.Properties == nil || v.Properties.VaultURI == nil {
-				continue
-			}
-			vaults = append(vaults, provider.Container{
-				Source: src, ID: deref(v.ID), Name: deref(v.Name),
-				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
-			})
-		}
-		return vaults
-	})
-}
-
-// all lists every page, items picking out what to keep of each.
-func all[P, T any](ctx context.Context, pager *runtime.Pager[P], items func(P) []T) ([]T, error) {
-	var out []T
 	for pager.More() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return nil, cleanError(err)
 		}
-		out = append(out, items(page)...)
+		for _, v := range page.Value {
+			if v.Properties == nil || v.Properties.VaultURI == nil {
+				continue
+			}
+			out = append(out, provider.Container{
+				Source: src, ID: deref(v.ID), Name: deref(v.Name),
+				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
+			})
+		}
 	}
 	return out, nil
 }
@@ -294,40 +288,51 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 	var out []provider.Object
 	switch t {
 	case provider.TypeSecret:
-		tenant := p.tenant(c.Source.ID)
+		pager := vc.secrets.NewListSecretPropertiesPager(nil)
-		out, err = all(ctx, vc.secrets.NewListSecretPropertiesPager(nil), func(page azsecrets.ListSecretPropertiesResponse) (objs []provider.Object) {
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, s := range page.Value {
 				// Certificate-backing secrets appear under Certificates.
-				if s.ID != nil && !deref(s.Managed) {
+				if s.ID == nil || deref(s.Managed) {
-					objs = append(objs, secretObject(c, s, tenant))
+					continue
 				}
+				out = append(out, secretObject(c, s, p.tenant(c.Source.ID)))
 			}
-			return objs
+		}
-		})
 	case provider.TypeKey:
-		out, err = all(ctx, vc.keys.NewListKeyPropertiesPager(nil), func(page azkeys.ListKeyPropertiesResponse) (objs []provider.Object) {
+		pager := vc.keys.NewListKeyPropertiesPager(nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, k := range page.Value {
-				if k.KID != nil && !deref(k.Managed) {
+				if k.KID == nil || deref(k.Managed) {
-					objs = append(objs, keyObject(c, k))
+					continue
 				}
+				out = append(out, keyObject(c, k))
 			}
-			return objs
+		}
-		})
 	case provider.TypeCertificate:
-		out, err = all(ctx, vc.certs.NewListCertificatePropertiesPager(nil), func(page azcertificates.ListCertificatePropertiesResponse) (objs []provider.Object) {
+		pager := vc.certs.NewListCertificatePropertiesPager(nil)
-			for _, cp := range page.Value {
+		for pager.More() {
-				if cp.ID != nil {
+			page, err := pager.NextPage(ctx)
-					objs = append(objs, certObject(c, cp))
+			if err != nil {
-				}
+				return nil, cleanError(err)
 			}
-			return objs
+			for _, cp := range page.Value {
-		})
+				if cp.ID == nil {
+					continue
+				}
+				out = append(out, certObject(c, cp))
+			}
+		}
 	default:
 		return nil, provider.ErrUnsupported
 	}
-	if err != nil {
-		return nil, err
-	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	return out, nil
 }
@@ -348,7 +353,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		if resp.Key != nil {
 			if resp.Key.KID != nil {
 				o.Version = resp.Key.KID.Version()
-				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.Key.KID))
+				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Key", string(*resp.Key.KID))
 			}
 			o.Attrs = keyAttrs(resp.Key)
 		}
@@ -359,7 +364,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		}
 		if resp.ID != nil {
 			o.Version = resp.ID.Version()
-			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.ID))
+			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Certificate", string(*resp.ID))
 		}
 		if pol := resp.Policy; pol != nil && pol.SecretProperties != nil {
 			o.ContentType = deref(pol.SecretProperties.ContentType)
@@ -376,46 +381,56 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	if err != nil {
 		return nil, err
 	}
-	tenant := p.tenant(o.Container.Source.ID)
 	var out []provider.Object
 	switch o.Type {
 	case provider.TypeSecret:
-		out, err = all(ctx, vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil), func(page azsecrets.ListSecretPropertiesVersionsResponse) (objs []provider.Object) {
+		pager := vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, s := range page.Value {
 				if s.ID != nil {
-					objs = append(objs, secretObject(o.Container, s, tenant))
+					out = append(out, secretObject(o.Container, s, p.tenant(o.Container.Source.ID)))
 				}
 			}
-			return objs
+		}
-		})
 	case provider.TypeKey:
-		out, err = all(ctx, vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil), func(page azkeys.ListKeyPropertiesVersionsResponse) (objs []provider.Object) {
+		pager := vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, k := range page.Value {
 				if k.KID != nil {
-					objs = append(objs, keyObject(o.Container, k))
+					out = append(out, keyObject(o.Container, k))
 				}
 			}
-			return objs
+		}
-		})
 	case provider.TypeCertificate:
-		out, err = all(ctx, vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil), func(page azcertificates.ListCertificatePropertiesVersionsResponse) (objs []provider.Object) {
+		pager := vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, cp := range page.Value {
 				if cp.ID != nil {
-					objs = append(objs, certObject(o.Container, cp))
+					out = append(out, certObject(o.Container, cp))
 				}
 			}
-			return objs
+		}
-		})
 	default:
 		return nil, provider.ErrUnsupported
 	}
-	if err != nil {
+	tenant := p.tenant(o.Container.Source.ID)
-		return nil, err
-	}
 	for i := range out {
 		out[i].Reference = versionedReference(out[i])
 		if o.Type != provider.TypeSecret { // secretObject's is the version's already
-			out[i].URL = portalAssetURL(tenant, o.Type, out[i].ID+"/"+out[i].Version) // the version's page
+			kind := map[provider.ObjectType]string{provider.TypeKey: "Key", provider.TypeCertificate: "Certificate"}[o.Type]
+			out[i].URL = portalAssetURL(tenant, kind, out[i].ID+"/"+out[i].Version) // the version's page
 		}
 	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return b.Updated.Compare(a.Updated) })
@@ -437,49 +452,56 @@ func versionedReference(o provider.Object) string {
 // Value returns a secret's value, a key's public key or a certificate's
 // public certificate, as of o.Version (latest if empty).
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
-	v, _, err := p.VersionedValue(ctx, o)
+	vc, err := p.clients(o.Container.Detail)
-	return v, err
+	if err != nil {
+		return provider.SecretValue{}, err
+	}
+	switch o.Type {
+	case provider.TypeSecret:
+		v, _, err := p.VersionedValue(ctx, o)
+		return v, err
+	case provider.TypeKey:
+		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
+		if err != nil {
+			return provider.SecretValue{}, cleanError(err)
+		}
+		pemKey, err := publicKeyPEM(resp.Key)
+		if err != nil {
+			return provider.SecretValue{}, err
+		}
+		return provider.NewSecretValue([]byte(pemKey)), nil
+	case provider.TypeCertificate:
+		resp, err := vc.certs.GetCertificate(ctx, o.Name, o.Version, nil)
+		if err != nil {
+			return provider.SecretValue{}, cleanError(err)
+		}
+		if len(resp.CER) == 0 {
+			return provider.SecretValue{}, errors.New("certificate has no public certificate yet (pending issuance?)")
+		}
+		return provider.NewSecretValue([]byte(certPEM(resp.CER))), nil
+	}
+	return provider.SecretValue{}, provider.ErrUnsupported
 }
 
 // VersionedValue is Value, with the version read.
 func (p *Provider) VersionedValue(ctx context.Context, o provider.Object) (provider.SecretValue, string, error) {
+	if o.Type != provider.TypeSecret {
+		v, err := p.Value(ctx, o)
+		return v, o.Version, err
+	}
 	vc, err := p.clients(o.Container.Detail)
 	if err != nil {
 		return provider.SecretValue{}, "", err
 	}
-	var text string
+	resp, err := vc.secrets.GetSecret(ctx, o.Name, o.Version, nil)
-	switch o.Type {
+	if err != nil {
-	case provider.TypeSecret:
+		return provider.SecretValue{}, "", cleanError(err)
-		resp, err := vc.secrets.GetSecret(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, "", cleanError(err)
-		}
-		version := o.Version
-		if resp.ID != nil {
-			version = resp.ID.Version()
-		}
-		return provider.NewSecretValue([]byte(deref(resp.Value))), version, nil
-	case provider.TypeKey:
-		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, "", cleanError(err)
-		}
-		if text, err = publicKeyPEM(resp.Key); err != nil {
-			return provider.SecretValue{}, "", err
-		}
-	case provider.TypeCertificate:
-		resp, err := vc.certs.GetCertificate(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, "", cleanError(err)
-		}
-		if len(resp.CER) == 0 {
-			return provider.SecretValue{}, "", errors.New("certificate has no public certificate yet (pending issuance?)")
-		}
-		text = certPEM(resp.CER)
-	default:
-		return provider.SecretValue{}, "", provider.ErrUnsupported
 	}
-	return provider.NewSecretValue([]byte(text)), o.Version, nil
+	version := o.Version
+	if resp.ID != nil {
+		version = resp.ID.Version()
+	}
+	return provider.NewSecretValue([]byte(deref(resp.Value))), version, nil
 }
 
 var (

internal/provider/azure/convert.go

@@ -55,8 +55,8 @@ func PortalResourceURL(tenant, resourceID, blade string) string {
 
 // portalAssetURL links to a Key Vault object's page: a version's with
 // one in objectID; a secret's own (its versions) without.
-func portalAssetURL(tenant string, t provider.ObjectType, objectID string) string {
+func portalAssetURL(tenant, kind, objectID string) string {
-	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + string(t) + "/" + objectID
+	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + kind + "/" + objectID
 }
 
 func tenantPrefix(tenant string) string {
@@ -73,13 +73,19 @@ func ObjectListURL(c provider.Container, t provider.ObjectType) string {
 	if !ok {
 		return ""
 	}
-	return base + "/" + t.Collection()
+	switch t {
+	case provider.TypeKey:
+		return base + "/keys"
+	case provider.TypeCertificate:
+		return base + "/certificates"
+	}
+	return base + "/secrets"
 }
 
 // objectURL is the data-plane URL of an object, e.g.
 // https://kv.vault.azure.net/secrets/name.
-func objectURL(c provider.Container, t provider.ObjectType, name string) string {
+func objectURL(c provider.Container, collection, name string) string {
-	return strings.TrimSuffix(c.Detail, "/") + "/" + t.Collection() + "/" + name
+	return strings.TrimSuffix(c.Detail, "/") + "/" + collection + "/" + name
 }
 
 // secretObject is a secret, or a version of one, from a listing. Its URL
@@ -87,7 +93,7 @@ func objectURL(c provider.Container, t provider.ObjectType, name string) string
 // a version, that version's.
 func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant string) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, provider.TypeSecret, name)
+	url := objectURL(c, "secrets", name)
 	o := provider.Object{
 		Container:   c,
 		Type:        provider.TypeSecret,
@@ -97,7 +103,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant st
 		ContentType: deref(p.ContentType),
 		Tags:        tags(p.Tags),
 		Reference:   "@Microsoft.KeyVault(SecretUri=" + url + ")",
-		URL:         portalAssetURL(tenant, provider.TypeSecret, strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
+		URL:         portalAssetURL(tenant, "Secret", strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
 	}
 	if a := p.Attributes; a != nil {
 		o.Enabled, o.Updated, o.Expires = a.Enabled, deref(a.Updated), deref(a.Expires)
@@ -107,7 +113,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant st
 
 func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 	name := p.KID.Name()
-	url := objectURL(c, provider.TypeKey, name)
+	url := objectURL(c, "keys", name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeKey,
@@ -126,7 +132,7 @@ func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 
 func certObject(c provider.Container, p *azcertificates.CertificateProperties) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, provider.TypeCertificate, name)
+	url := objectURL(c, "certificates", name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeCertificate,

internal/provider/azure/details.go

@@ -71,10 +71,13 @@ func graphInfo(m map[string]any) vaultInfo {
 
 // armInfo reads a vault's settings from the management API.
 func armInfo(v *armkeyvault.Vault) vaultInfo {
-	info := vaultInfo{location: deref(v.Location), tags: tags(v.Tags)}
+	info := vaultInfo{location: deref(v.Location), tags: map[string]string{}}
 	if id, err := arm.ParseResourceID(deref(v.ID)); err == nil {
 		info.group = id.ResourceGroupName
 	}
+	for k, t := range v.Tags {
+		info.tags[k] = deref(t)
+	}
 	pr := v.Properties
 	if pr == nil {
 		return info
@@ -120,11 +123,7 @@ func (v vaultInfo) attrs() []provider.Attr {
 	} else {
 		add("soft delete", "off")
 	}
-	if on(v.purge, false) {
+	add("purge prot.", map[bool]string{true: "on", false: "off"}[on(v.purge, false)])
-		add("purge prot.", "on")
-	} else {
-		add("purge prot.", "off")
-	}
 	switch {
 	case strings.EqualFold(v.publicAccess, "disabled"):
 		add("network", "private endpoints only")
@@ -133,11 +132,8 @@ func (v vaultInfo) attrs() []provider.Attr {
 	default:
 		add("network", "all networks")
 	}
-	switch {
+	if v.endpoints > 0 {
-	case v.endpoints == 1:
+		add("private", fmt.Sprintf("%d endpoint%s", v.endpoints, map[bool]string{true: "s"}[v.endpoints > 1]))
-		add("private", "1 endpoint")
-	case v.endpoints > 1:
-		add("private", fmt.Sprintf("%d endpoints", v.endpoints))
 	}
 	for i, k := range slices.Sorted(maps.Keys(v.tags)) {
 		label := ""

internal/provider/databricks/databricks.go

@@ -203,20 +203,17 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 	return out, nil
 }
 
-// fallbackVault is the backing vault of an AKV-backed scope, to read it
+// vaultURL is the backing vault of an AKV-backed scope, or "". It falls
-// from when Databricks fails, or "" when there's none to fall back to. It
+// back to the scope's Detail, so a scope remembered from an earlier session
-// falls back to the scope's Detail, so a scope remembered from an earlier
+// (a favourite) works before its workspace's scopes are listed.
-// session (a favourite) works before its workspace's scopes are listed.
+func (p *Provider) vaultURL(c provider.Container) string {
-func (p *Provider) fallbackVault(ctx context.Context, c provider.Container) string {
-	if p.keyVault == nil || ctx.Err() != nil {
-		return ""
-	}
 	p.mu.Lock()
 	url := p.vaults[c.ID]
 	p.mu.Unlock()
 	if url == "" {
-		if detail, ok := strings.CutPrefix(c.Detail, akvDetail); ok {
+		url, _ = strings.CutPrefix(c.Detail, akvDetail)
-			url = detail
+		if url == c.Detail {
+			url = ""
 		}
 	}
 	return url
@@ -267,8 +264,8 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 
 // vaultObjects lists an AKV-backed scope's secrets from the vault itself.
 func (p *Provider) vaultObjects(ctx context.Context, c provider.Container) ([]provider.Object, error) {
-	url := p.fallbackVault(ctx, c)
+	url := p.vaultURL(c)
-	if url == "" {
+	if url == "" || p.keyVault == nil || ctx.Err() != nil {
 		return nil, errNoFallback
 	}
 	secrets, err := p.keyVault.Objects(ctx, provider.Container{Detail: url}, provider.TypeSecret)
@@ -305,8 +302,8 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	}
 	dbxErr := classify(pr, err)
 
-	url := p.fallbackVault(ctx, o.Container)
+	url := p.vaultURL(o.Container)
-	if url == "" {
+	if url == "" || p.keyVault == nil || ctx.Err() != nil {
 		return provider.SecretValue{}, dbxErr
 	}
 	v, kvErr := p.keyVault.Value(ctx, provider.Object{

internal/provider/fake/fake.go

@@ -225,7 +225,9 @@ func (p *Provider) add(c provider.Container, t provider.ObjectType, o provider.O
 	o.Type = t
 	o.ID = c.ID + "/" + strings.ToLower(string(t)) + "/" + o.Name
 	if base, ok := strings.CutSuffix(c.URL, "/overview"); ok {
-		o.URL = base + "/" + t.Collection()
+		o.URL = base + map[provider.ObjectType]string{
+			provider.TypeSecret: "/secrets", provider.TypeKey: "/keys", provider.TypeCertificate: "/certificates",
+		}[t]
 	}
 	k := listKey{c.ID, t}
 	p.objects[k] = append(p.objects[k], o)
@@ -254,13 +256,12 @@ const (
 
 var allTypes = []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate}
 
-func secretRef(vault, name string) string {
-	return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
-}
-
 // Azure returns a fake Azure provider with two subscriptions.
 func Azure(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
+	secretRef := func(vault, name string) string {
+		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
+	}
 	objectURL := func(vault, kind, name string) string {
 		return fmt.Sprintf("https://%s.vault.azure.net/%s/%s", vault, kind, name)
 	}
@@ -372,6 +373,9 @@ func Azure(delay time.Duration) *Provider {
 // its own, like an admin account next to a personal one.
 func AzureOps(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
+	secretRef := func(vault, name string) string {
+		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
+	}
 
 	prod := p.addSource("sub-prod", "platform-prod", "tenant: example.onmicrosoft.com")
 	breakGlass := p.addContainer(prod, "kv-breakglass", "https://kv-breakglass.vault.azure.net", allTypes...)

internal/provider/fake/repos.go

@@ -2,7 +2,6 @@ package fake
 
 import (
 	"context"
-	"fmt"
 	"strings"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
@@ -19,9 +18,8 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 	return attrs, ctx.Err()
 }
 
-// Repos returns a fake repo provider: four git repos with SOPS, plain
+// Repos returns a fake repo provider: three git repos with SOPS and plain
-// .env, Spring and compose files, the first one the repo lazysecrets was
+// .env files, the first one the repo lazysecrets was started in.
-// started in.
 func Repos() *Provider {
 	p := newProvider(provider.KindRepo, 0)
 	p.id, p.label = "Repos", "Repos"
@@ -115,90 +113,6 @@ func Repos() *Provider {
 		"AZURE_CLIENT_SECRET", "azure-demo-client-secret",
 		"ARM_SUBSCRIPTION_ID", "00000000-0000-0000-0000-000000000000")
 
-	// config adds a Spring or compose file (kind) and its keys as name,
-	// value and how it's listed: "" a secret, "hidden", "reference" (the
-	// value is a placeholder) or "jasypt" (the value is the decrypted one).
-	config := func(src provider.Source, path, kind, git, commit string, kv ...string) {
-		form := "yaml"
-		if strings.HasSuffix(path, ".properties") {
-			form = "properties"
-		}
-		c := p.addContainer(src, path, kind+" · "+form, provider.TypeSecret)
-		format := provider.Attr{Label: "format", Value: kind + " " + form}
-		secrets, hidden, jasypt, plain := 0, 0, 0, false
-		for i := 0; i+2 < len(kv); i += 3 {
-			o := provider.Object{Name: kv[i], Attrs: []provider.Attr{format, {Label: "encrypted", Value: "no: plain text in the file"}}}
-			switch kv[i+2] {
-			case "hidden":
-				o.Hidden = true
-				hidden++
-				continue
-			case "reference":
-				o.Detail, o.Attrs[1] = "reference", provider.Attr{Label: "value", Value: "a reference: the secret is set elsewhere"}
-			case "jasypt":
-				o.Detail, o.Attrs[1] = "jasypt", provider.Attr{Label: "encrypted", Value: "jasypt"}
-				jasypt++
-			default:
-				plain = plain || kv[i+1] != ""
-			}
-			secrets++
-			p.add(c, provider.TypeSecret, o, kv[i+1])
-		}
-		// Hidden keys after the rest, so the list opens on a secret.
-		for i := 0; i+2 < len(kv); i += 3 {
-			if kv[i+2] == "hidden" {
-				p.add(c, provider.TypeSecret, provider.Object{Name: kv[i], Hidden: true, Attrs: []provider.Attr{format}}, kv[i+1])
-			}
-		}
-		if secrets == 0 {
-			p.hide(src, path)
-		}
-		encryption := "none: plain text"
-		if jasypt > 0 {
-			encryption = fmt.Sprintf("jasypt: %d of %d values", jasypt, secrets+hidden)
-		}
-		d := []provider.Attr{
-			{Label: "encryption", Value: encryption},
-			{Label: "hidden keys", Value: fmt.Sprintf("%d, not matched by the secret patterns", hidden)},
-		}
-		if git == "tracked" && plain {
-			d = append(d, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
-		} else {
-			d = append(d, provider.Attr{Label: "git", Value: git})
-		}
-		p.details[c.ID] = append(d, provider.Attr{Label: "commit", Value: commit})
-	}
-
-	orders := repo("orders-service", false)
-	config(orders, "src/main/resources/application.yml", "spring", "tracked", "5be2c07 · 6 days ago",
-		"spring.application.name", "orders-service", "hidden",
-		"server.port", "8080", "hidden",
-		"spring.datasource.url", "jdbc:postgresql://orders-db:5432/orders", "hidden",
-		"spring.datasource.password", "${DB_PASSWORD}", "reference",
-		"spring.security.oauth2.client.provider.idp.token-uri", "https://idp.acme.example/token", "hidden",
-		"spring.security.oauth2.client.registration.orders.client-secret", "orders-demo-client-secret", "jasypt",
-		"jasypt.encryptor.password", "${JASYPT_ENCRYPTOR_PASSWORD}", "reference",
-		"app.payment.api-key", "pay_live_demo_7Hq2", "jasypt")
-	config(orders, "src/main/resources/application-local.properties", "spring", "tracked", "5be2c07 · 6 days ago",
-		"spring.datasource.url", "jdbc:postgresql://localhost:5432/orders", "hidden",
-		"spring.datasource.password", "local-orders-pw", "",
-		"logging.level.com.acme", "DEBUG", "hidden")
-	config(orders, "src/test/resources/application-test.yml", "spring", "tracked", "d81a3f9 · 3 weeks ago",
-		"spring.datasource.url", "jdbc:h2:mem:orders", "hidden",
-		"spring.jpa.hibernate.ddl-auto", "create-drop", "hidden")
-	config(orders, "docker-compose.yml", "compose", "tracked", "5be2c07 · 6 days ago",
-		"api.SPRING_PROFILES_ACTIVE", "local", "hidden",
-		"api.DB_PASSWORD", "${DB_PASSWORD}", "reference",
-		"db.POSTGRES_USER", "orders", "hidden",
-		"db.POSTGRES_PASSWORD", "orders-db-demo-pw", "")
-	config(orders, "docker-compose.example.yml", "compose", "tracked", "5be2c07 · 6 days ago",
-		"db.POSTGRES_PASSWORD", "changeme", "")
-	p.hide(orders, "docker-compose.example.yml")
-	file(orders, ".env.example", "", "tracked", "5be2c07 · 6 days ago",
-		"DB_PASSWORD", "changeme",
-		"JASYPT_ENCRYPTOR_PASSWORD", "changeme")
-	p.hide(orders, ".env.example")
-
 	web := repo("web-frontend", false)
 	file(web, ".env.production", "age", "tracked", "b2e91f4 · 4 days ago",
 		"SENTRY_AUTH_TOKEN", "sntrys_demo_token",
@@ -235,13 +149,3 @@ func (p *Provider) Contents(ctx context.Context, c provider.Container) ([]byte,
 	}
 	return []byte(b.String()), ctx.Err()
 }
-
-// hide marks a file hidden, as the repo provider does an example file or
-// a config file without secrets.
-func (p *Provider) hide(src provider.Source, name string) {
-	for i, c := range p.containers[src.ID] {
-		if c.Name == name {
-			p.containers[src.ID][i].Hidden = true
-		}
-	}
-}

internal/provider/provider.go

@@ -73,10 +73,6 @@ type Source struct {
 	// Here marks the source lazysecrets was started in (the current git
 	// repo): listed first, starred or not, and labelled.
 	Here bool
-	// Hidden marks a source, container or object the provider's rules
-	// left out (a Spring file with no secret-looking keys): listed only
-	// while the app shows hidden ones.
-	Hidden bool `json:",omitempty"`
 }
 
 // ObjectType is the kind of object stored in a container.
@@ -88,20 +84,6 @@ const (
 	TypeCertificate ObjectType = "Certificate"
 )
 
-// Collection is the type's path segment in Key Vault URLs and links, e.g.
-// "secrets".
-func (t ObjectType) Collection() string {
-	switch t {
-	case TypeSecret:
-		return "secrets"
-	case TypeKey:
-		return "keys"
-	case TypeCertificate:
-		return "certificates"
-	}
-	return ""
-}
-
 // Container holds objects: a Key Vault or a Databricks secret scope.
 type Container struct {
 	Source Source
@@ -113,8 +95,7 @@ type Container struct {
 	Types []ObjectType
 	URL   string // web page for the container, if any
 	// Attrs describe it further, from the listing (a vault's settings).
-	Attrs  []Attr `json:",omitempty"`
+	Attrs []Attr `json:",omitempty"`
-	Hidden bool   `json:",omitempty"` // see Source.Hidden
 }
 
 // ObjectTypes returns the container's object types, defaulting to secrets.
@@ -138,8 +119,6 @@ type Object struct {
 	Type        ObjectType
 	ID          string
 	Name        string
-	Detail      string // shown after the name, e.g. "jasypt" for how its value is kept
-	Hidden      bool   `json:",omitempty"` // see Source.Hidden
 	Version     string
 	Enabled     *bool
 	Updated     time.Time

internal/provider/repo/compose.go

@@ -1,141 +0,0 @@
-package repo
-
-import (
-	"path"
-	"regexp"
-	"strings"
-
-	"go.yaml.in/yaml/v3"
-)
-
-// Docker Compose files: compose.yaml, docker-compose.yml and their
-// variants (docker-compose.test.yml). Their keys are the services'
-// environment variables, named service.VAR.
-
-var composeType = configType{
-	name: "compose", is: IsCompose, format: func(string) string { return "yaml" }, parse: parseCompose,
-	jasyptSetting: func(name string) string {
-		service, _, _ := strings.Cut(name, ".")
-		return service + "." + jasyptEnv
-	},
-	placeholder: composePlaceholder,
-}
-
-var composeName = regexp.MustCompile(`^(docker-)?compose([.-][^/]+)?\.ya?ml$`)
-
-// IsCompose reports whether f is named like a Docker Compose file.
-func IsCompose(f string) bool {
-	return composeName.MatchString(strings.ToLower(path.Base(f)))
-}
-
-// composePlaceholderRe is compose's ${VAR}, ${VAR:-default}, ${VAR-default},
-// ${VAR:?error}, ${VAR?error} or $VAR.
-var composePlaceholderRe = regexp.MustCompile(`^\$(?:\{(\w+)(?:(:?-)([^}]*)|:?\?[^}]*)?\}|(\w+))$`)
-
-func composePlaceholder(v string) (name, def string, hasDef, ok bool) {
-	m := composePlaceholderRe.FindStringSubmatch(v)
-	if m == nil {
-		return "", "", false, false
-	}
-	return m[1] + m[4], m[3], m[2] != "", true
-}
-
-func parseCompose(_ string, b []byte) ([]configKey, error) {
-	var doc yaml.Node
-	if err := yaml.Unmarshal(b, &doc); err != nil {
-		return nil, err
-	}
-	if len(doc.Content) == 0 {
-		return nil, nil
-	}
-	var out []configKey
-	for _, service := range pairs(field(doc.Content[0], "services")) {
-		for _, k := range environment(field(service.value, "environment")) {
-			k.name = service.key.Value + "." + k.key
-			out = append(out, k)
-		}
-	}
-	return out, nil
-}
-
-// environment reads a service's environment, a map (KEY: value) or a list
-// (- KEY=value). A variable without a value (KEY:, - KEY) is taken from
-// where compose runs: a reference.
-func environment(n *yaml.Node) []configKey {
-	var out []configKey
-	switch n = deref(n); {
-	case n == nil:
-	case n.Kind == yaml.MappingNode:
-		for _, p := range pairs(n) {
-			v := deref(p.value)
-			ref := v.Tag == "!!null" || reference(composePlaceholder, v.Value)
-			out = append(out, configKey{key: p.key.Value, value: v.Value, ref: ref, line: p.key.Line})
-		}
-	case n.Kind == yaml.SequenceNode:
-		for _, item := range n.Content {
-			item = deref(item)
-			k, v, ok := strings.Cut(item.Value, "=")
-			out = append(out, configKey{key: k, value: v, ref: !ok || reference(composePlaceholder, v), line: item.Line})
-		}
-	}
-	return out
-}
-
-type pair struct{ key, value *yaml.Node }
-
-// pairs are a mapping's entries, with those merged in by << (anchors
-// shared between services) first and its own over them.
-func pairs(n *yaml.Node) []pair {
-	n = deref(n)
-	if n == nil || n.Kind != yaml.MappingNode {
-		return nil
-	}
-	var merged, own []pair
-	for i := 0; i+1 < len(n.Content); i += 2 {
-		k, v := n.Content[i], n.Content[i+1]
-		if k.Value != "<<" {
-			own = append(own, pair{k, v})
-			continue
-		}
-		from := []*yaml.Node{v}
-		if v.Kind == yaml.SequenceNode {
-			from = v.Content
-		}
-		for _, m := range from {
-			merged = append(merged, pairs(m)...)
-		}
-	}
-	var out []pair
-	for _, p := range append(merged, own...) {
-		if i := indexOf(out, p.key.Value); i >= 0 {
-			out[i] = p
-		} else {
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-func indexOf(ps []pair, key string) int {
-	for i, p := range ps {
-		if p.key.Value == key {
-			return i
-		}
-	}
-	return -1
-}
-
-func field(n *yaml.Node, key string) *yaml.Node {
-	ps := pairs(n)
-	if i := indexOf(ps, key); i >= 0 {
-		return ps[i].value
-	}
-	return nil
-}
-
-func deref(n *yaml.Node) *yaml.Node {
-	for n != nil && n.Kind == yaml.AliasNode {
-		n = n.Alias
-	}
-	return n
-}

internal/provider/repo/compose_test.go

@@ -1,140 +0,0 @@
-package repo
-
-import (
-	"context"
-	"maps"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-func TestIsCompose(t *testing.T) {
-	for f, want := range map[string]bool{
-		"docker-compose.yml":         true,
-		"deploy/compose.yaml":        true,
-		"docker-compose.test.yml":    true,
-		"docker-compose-dev.yaml":    true,
-		"docker-compose.example.yml": true, // listed hidden
-		"applications.yaml":          false,
-		"composer.json":              false,
-		"compose.yml.bak":            false,
-	} {
-		if IsCompose(f) != want {
-			t.Errorf("%s: %t", f, !want)
-		}
-	}
-}
-
-func TestComposePlaceholder(t *testing.T) {
-	for v, want := range map[string]bool{
-		"${DB_PASSWORD}": true, "$DB_PASSWORD": true, "${DB_PASSWORD:?set it}": true, "${DB_PASSWORD?}": true,
-		"${DB_PASSWORD:-hunter2}": false, "${DB_PASSWORD-hunter2}": false, // the default is in the file
-		"hunter2": false, "pre-${DB_PASSWORD}": false, "$": false,
-	} {
-		if got := reference(composePlaceholder, v); got != want {
-			t.Errorf("%s: reference %t", v, got)
-		}
-	}
-	if name, def, hasDef, _ := composePlaceholder("${PW:-x}"); name != "PW" || def != "x" || !hasDef {
-		t.Errorf("default: %s %s %t", name, def, hasDef)
-	}
-}
-
-func TestParseCompose(t *testing.T) {
-	keys, err := parseCompose("", []byte(`x-db: &db
-  DB_USER: app
-  DB_PASSWORD: shared
-services:
-  api:
-    image: api
-    environment:
-      <<: *db
-      DB_PASSWORD: own
-      API_KEY: ${API_KEY}
-      FROM_HOST:
-  worker:
-    environment:
-      - QUEUE_PASSWORD=hunter2
-      - TOKEN
-      - EMPTY=
-  web:
-    image: web
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := map[string]string{}
-	for _, k := range keys {
-		ref := ""
-		if k.ref {
-			ref = " (ref)"
-		}
-		got[k.name] = k.value + ref
-	}
-	want := map[string]string{
-		"api.DB_USER": "app", "api.DB_PASSWORD": "own", "api.API_KEY": "${API_KEY} (ref)", "api.FROM_HOST": " (ref)",
-		"worker.QUEUE_PASSWORD": "hunter2", "worker.TOKEN": " (ref)", "worker.EMPTY": "",
-	}
-	if !maps.Equal(got, want) {
-		t.Errorf("got  %v\nwant %v", got, want)
-	}
-	for _, k := range keys {
-		if k.name == "worker.QUEUE_PASSWORD" && (k.line != 14 || k.key != "QUEUE_PASSWORD") {
-			t.Errorf("%s: line %d, key %s", k.name, k.line, k.key)
-		}
-	}
-}
-
-func TestComposeFiles(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		"docker-compose.yml": `services:
-  api:
-    environment:
-      PORT: "8080"
-      DB_PASSWORD: ${DB_PASSWORD}
-      JASYPT_ENCRYPTOR_PASSWORD: test-password
-      API_TOKEN: ` + jasyptHunter2 + `
-`,
-		"docker-compose.example.yml": "services:\n  api:\n    environment:\n      DB_PASSWORD: changeme\n",
-	})
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
-	ctx := context.Background()
-	p := New(Settings{Dir: root})
-	srcs, _ := p.Sources(ctx)
-	cs, err := p.Containers(ctx, srcs[0])
-	if err != nil || len(cs) != 2 {
-		t.Fatalf("files: %+v %v", cs, err)
-	}
-	for _, c := range cs {
-		if c.Detail != "compose · yaml" || c.Hidden != (c.Name == "docker-compose.example.yml") {
-			t.Errorf("%s: %q hidden %t", c.Name, c.Detail, c.Hidden)
-		}
-	}
-	compose := cs[1] // after docker-compose.example.yml
-
-	keys, _ := p.Objects(ctx, compose, provider.TypeSecret)
-	got := map[string]string{}
-	for _, k := range shown(keys) {
-		got[k.Name] = k.Detail
-	}
-	if want := map[string]string{"api.DB_PASSWORD": "reference", "api.JASYPT_ENCRYPTOR_PASSWORD": "", "api.API_TOKEN": "jasypt"}; !maps.Equal(got, want) {
-		t.Errorf("keys %v, want %v", got, want)
-	}
-	// The service's JASYPT_ENCRYPTOR_PASSWORD decrypts its values.
-	link := provider.Object{Container: provider.Container{Source: srcs[0], Name: "docker-compose.yml"}, Name: "api.API_TOKEN"}
-	if v, err := p.Value(ctx, link); err != nil || v.Reveal() != "hunter2" {
-		t.Errorf("jasypt: %q %v", v.Reveal(), err)
-	}
-	if f, _ := p.File(compose, &link); f.Line != 7 {
-		t.Errorf("line %d", f.Line)
-	}
-
-	// compose.secretPatterns over the shared ones.
-	os.WriteFile(filepath.Join(root, ".lazysecrets.yaml"), []byte("secretPatterns:\n  keys: [\"^nothing$\"]\ncompose:\n  secretPatterns:\n    keys: [\"^PORT$\"]\n    values: []\n"), 0o644)
-	keys, _ = p.Objects(ctx, compose, provider.TypeSecret)
-	if s := shown(keys); len(s) != 1 || s[0].Name != "api.PORT" {
-		t.Errorf("compose's patterns: %v", s)
-	}
-}

internal/provider/repo/configfile.go

@@ -1,170 +0,0 @@
-package repo
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"slices"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// Config files (Spring's, compose's) are read directly, like env files,
-// but most of their keys aren't secret: those the secret patterns
-// (patterns.go) don't match are hidden, and a file with none of them is.
-
-// configType is a type of config file: what it's called (in settings, as
-// spring:, and on the file's row) and how its keys are read.
-type configType struct {
-	name   string
-	is     func(file string) bool
-	format func(file string) string // yaml, properties
-	parse  func(file string, b []byte) ([]configKey, error)
-	// jasyptSetting is the key that holds the Jasypt password for the
-	// key named name; nil when only $JASYPT_ENCRYPTOR_PASSWORD can.
-	jasyptSetting func(name string) string
-	// placeholder reads a value that only refers to another,
-	// ${DB_PASSWORD}: what it names, and its default if it has one.
-	placeholder func(v string) (name, def string, hasDef, ok bool)
-}
-
-var configTypes = []configType{springType, composeType, dotnetType}
-
-func isConfig(f string) bool {
-	_, ok := configTypeOf(f)
-	return ok
-}
-
-// configTypeOf is the type of config file f is, if it's one.
-func configTypeOf(f string) (configType, bool) {
-	for _, t := range configTypes {
-		if t.is(f) {
-			return t, true
-		}
-	}
-	return configType{}, false
-}
-
-// detail is the file's row: "spring · yaml".
-func (t configType) detail(file string) string { return t.name + " · " + t.format(file) }
-
-// configKey is a key of a config file, with its value.
-type configKey struct {
-	key   string // as the app sees it: spring.datasource.password, DB_PASSWORD
-	name  string // one key in the file: spring.datasource.password (prod), api.DB_PASSWORD
-	value string
-	ref   bool // the value only refers to the secret, set elsewhere: ${DB_PASSWORD}
-	line  int  // 1-based
-}
-
-func (k configKey) jasypt() bool { return jasypt.Is(k.value) }
-
-// plain reports whether the file holds the value itself, readable.
-func (k configKey) plain() bool { return k.value != "" && !k.ref && !k.jasypt() }
-
-// reference reports whether v is only a placeholder without a default:
-// one with a default has the default in the file.
-func reference(placeholder func(string) (string, string, bool, bool), v string) bool {
-	_, _, hasDef, ok := placeholder(v)
-	return ok && !hasDef
-}
-
-func (t configType) read(file string) ([]configKey, error) {
-	b, err := os.ReadFile(file)
-	if err != nil {
-		return nil, err
-	}
-	return t.parse(file, b)
-}
-
-func (t configType) keyNamed(file, name string) (configKey, error) {
-	keys, err := t.read(file)
-	if err != nil {
-		return configKey{}, err
-	}
-	for _, k := range keys {
-		if k.name == name {
-			return k, nil
-		}
-	}
-	return configKey{}, fmt.Errorf("%s isn't in %s", name, filepath.Base(file))
-}
-
-func (t configType) value(file, name string) (provider.SecretValue, error) {
-	k, err := t.keyNamed(file, name)
-	if err != nil {
-		return provider.SecretValue{}, err
-	}
-	return provider.NewSecretValue([]byte(k.value)), nil
-}
-
-// configHidden reports whether a config file has no secret keys. One that
-// can't be read isn't hidden: its error is worth seeing.
-func (p *Provider) configHidden(t configType, root, file string) bool {
-	keys, err := t.read(file)
-	if err != nil {
-		return false
-	}
-	filter, err := p.filterFor(root, t.name)
-	if err != nil {
-		return false
-	}
-	return !slices.ContainsFunc(keys, func(k configKey) bool { return filter.secret(k.key, k.value) })
-}
-
-// configObjects lists the file's keys, those that don't look like secrets
-// hidden.
-func (p *Provider) configObjects(t configType, c provider.Container, b []byte) ([]provider.Object, error) {
-	keys, err := t.parse(c.ID, b)
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", c.Name, err)
-	}
-	filter, err := p.filterFor(c.Source.ID, t.name)
-	if err != nil {
-		return nil, err
-	}
-	format := provider.Attr{Label: "format", Value: t.name + " " + t.format(c.ID)}
-	var out []provider.Object
-	for _, k := range keys {
-		state, detail := provider.Attr{Label: "encrypted", Value: "no: plain text in the file"}, ""
-		switch {
-		case k.ref:
-			state, detail = provider.Attr{Label: "value", Value: "a reference: the secret is set elsewhere"}, "reference"
-		case k.jasypt():
-			state, detail = provider.Attr{Label: "encrypted", Value: "jasypt"}, "jasypt"
-		}
-		out = append(out, provider.Object{
-			Container: c, Type: provider.TypeSecret, ID: c.ID + "\x00" + k.name, Name: k.name, Detail: detail,
-			Hidden: !filter.secret(k.key, k.value), Attrs: []provider.Attr{format, state},
-		})
-	}
-	return out, nil
-}
-
-// configDetails says how many of the file's keys aren't listed, and
-// whether any listed one is in plain text.
-func (p *Provider) configDetails(t configType, c provider.Container) (attrs []provider.Attr, plain bool) {
-	keys, err := t.read(c.ID)
-	if err != nil {
-		return []provider.Attr{{Label: "keys", Value: err.Error(), Warn: true}}, false
-	}
-	filter, err := p.filterFor(c.Source.ID, t.name)
-	if err != nil {
-		return []provider.Attr{{Label: "keys", Value: err.Error(), Warn: true}}, false
-	}
-	secrets, jasypt := 0, 0
-	for _, k := range keys {
-		if filter.secret(k.key, k.value) {
-			secrets++
-			plain = plain || k.plain()
-		}
-		if k.jasypt() {
-			jasypt++
-		}
-	}
-	return []provider.Attr{
-		{Label: "encryption", Value: jasyptShare(jasypt, len(keys))},
-		{Label: "hidden keys", Value: fmt.Sprintf("%d, not matched by the secret patterns", len(keys)-secrets)},
-	}, plain
-}

internal/provider/repo/details.go

@@ -2,8 +2,6 @@ package repo
 
 import (
 	"context"
-	"fmt"
-	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
@@ -24,12 +22,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 	}
 	var out []provider.Attr
 	meta, isSops := readMeta(c.ID)
-	// A plain file's values are at risk in git, unless they're all Jasypt;
+	if isSops {
-	// a config file's only when one of its secrets is in plain text.
-	plain := !isSops
-	if t, ok := configTypeOf(c.ID); ok && !isSops {
-		out, plain = p.configDetails(t, c)
-	} else if isSops {
 		out = append(out, provider.Attr{Label: "encryption", Value: "sops · " + strings.Join(meta.methods, ", ")})
 		for i, k := range meta.recipients {
 			label := ""
@@ -42,7 +35,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 			out = append(out, provider.Attr{Label: "encrypted", Value: meta.modified.Local().Format("2006-01-02 15:04")})
 		}
 	} else {
-		out, plain = envDetails(c.ID)
+		out = append(out, provider.Attr{Label: "encryption", Value: "none: plain text"})
 	}
 
 	git := func(args ...string) (string, bool) {
@@ -50,7 +43,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 		return strings.TrimSpace(string(b)), err == nil
 	}
 	switch _, tracked := git("ls-files", "--error-unmatch", "--", rel); {
-	case tracked && plain:
+	case tracked && !isSops:
 		out = append(out, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
 	case tracked:
 		out = append(out, provider.Attr{Label: "git", Value: "tracked"})
@@ -58,7 +51,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 		if _, ignored := git("check-ignore", "-q", "--", rel); ignored {
 			out = append(out, provider.Attr{Label: "git", Value: "ignored"})
 		} else {
-			out = append(out, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: plain})
+			out = append(out, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: !isSops})
 		}
 		return out, nil
 	}
@@ -67,28 +60,3 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 	}
 	return out, nil
 }
-
-// envDetails says how a plain env file's values are encrypted, and whether
-// any is in plain text.
-func envDetails(file string) (attrs []provider.Attr, plain bool) {
-	b, err := os.ReadFile(file)
-	if err != nil {
-		return []provider.Attr{{Label: "encryption", Value: err.Error(), Warn: true}}, true
-	}
-	keys, _ := parseKeys(file, b)
-	n := 0
-	for _, k := range keys {
-		if k.jasypt {
-			n++
-		}
-	}
-	return []provider.Attr{{Label: "encryption", Value: jasyptShare(n, len(keys))}}, n < len(keys)
-}
-
-// jasyptShare is how many of a plain file's values are Jasypt's.
-func jasyptShare(n, of int) string {
-	if n == 0 {
-		return "none: plain text"
-	}
-	return fmt.Sprintf("jasypt: %d of %d values", n, of)
-}

internal/provider/repo/dotnet.go

@@ -1,74 +0,0 @@
-package repo
-
-import (
-	"fmt"
-	"path"
-	"regexp"
-	"strings"
-
-	"go.yaml.in/yaml/v3"
-)
-
-// .NET config files: appsettings.json and appsettings.<Environment>.json.
-// Keys are named as .NET's configuration names them, sections joined by
-// colons: ConnectionStrings:Default, Servers:0:Name.
-
-var dotnetType = configType{
-	name: "dotnet", is: IsDotnet, format: func(string) string { return "json" }, parse: parseDotnet,
-	placeholder: dotnetPlaceholder,
-}
-
-var dotnetName = regexp.MustCompile(`^appsettings(\.[^/]+)?\.json$`)
-
-// IsDotnet reports whether f is named like a .NET appsettings file.
-func IsDotnet(f string) bool {
-	return dotnetName.MatchString(strings.ToLower(path.Base(f)))
-}
-
-// dotnetPlaceholder reads an App Service Key Vault reference,
-// @Microsoft.KeyVault(SecretUri=…): the secret is in the vault.
-func dotnetPlaceholder(v string) (name, def string, hasDef, ok bool) {
-	if strings.HasPrefix(v, "@Microsoft.KeyVault(") && strings.HasSuffix(v, ")") {
-		return v, "", false, true
-	}
-	return "", "", false, false
-}
-
-func parseDotnet(_ string, b []byte) ([]configKey, error) {
-	var doc yaml.Node // JSON is YAML, and the YAML parser says where each key is
-	if err := yaml.Unmarshal(b, &doc); err != nil {
-		return nil, err
-	}
-	var out []configKey
-	if len(doc.Content) > 0 {
-		dotnetWalk(doc.Content[0], "", &out)
-	}
-	for i := range out {
-		out[i].name = out[i].key
-		out[i].ref = reference(dotnetPlaceholder, out[i].value)
-	}
-	return out, nil
-}
-
-func dotnetWalk(n *yaml.Node, name string, out *[]configKey) {
-	join := func(child string) string {
-		if name == "" {
-			return child
-		}
-		return name + ":" + child
-	}
-	switch n.Kind {
-	case yaml.MappingNode:
-		for i := 0; i+1 < len(n.Content); i += 2 {
-			dotnetWalk(n.Content[i+1], join(n.Content[i].Value), out)
-		}
-	case yaml.SequenceNode:
-		for i, c := range n.Content {
-			dotnetWalk(c, join(fmt.Sprint(i)), out)
-		}
-	case yaml.ScalarNode:
-		if name != "" {
-			*out = append(*out, configKey{key: name, value: n.Value, line: n.Line})
-		}
-	}
-}

internal/provider/repo/dotnet_test.go

@@ -1,100 +0,0 @@
-package repo
-
-import (
-	"context"
-	"maps"
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-func TestIsDotnet(t *testing.T) {
-	for f, want := range map[string]bool{
-		"appsettings.json":                    true,
-		"src/Api/appsettings.Production.json": true,
-		"appsettings.Example.json":            true, // listed hidden
-		"appsettings.json.bak":                false,
-		"settings.json":                       false,
-		"package.json":                        false,
-	} {
-		if IsDotnet(f) != want {
-			t.Errorf("%s: %t", f, !want)
-		}
-	}
-}
-
-func TestParseDotnet(t *testing.T) {
-	keys, err := parseDotnet("", []byte("\xef\xbb\xbf"+`{
-  "ConnectionStrings": { "Default": "Server=db;Password=hunter2" },
-  "AzureAd": { "ClientId": "abc", "ClientSecret": "@Microsoft.KeyVault(SecretUri=https://kv.vault.azure.net/secrets/ad)" },
-  "Servers": [ { "Name": "a", "ApiKey": "k" } ],
-  "Logging": { "LogLevel": { "Default": "Information" } }
-}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := map[string]string{}
-	for _, k := range keys {
-		ref := ""
-		if k.ref {
-			ref = " (ref)"
-		}
-		got[k.name] = k.value + ref
-	}
-	want := map[string]string{
-		"ConnectionStrings:Default": "Server=db;Password=hunter2",
-		"AzureAd:ClientId":          "abc",
-		"AzureAd:ClientSecret":      "@Microsoft.KeyVault(SecretUri=https://kv.vault.azure.net/secrets/ad) (ref)",
-		"Servers:0:Name":            "a",
-		"Servers:0:ApiKey":          "k",
-		"Logging:LogLevel:Default":  "Information",
-	}
-	if !maps.Equal(got, want) {
-		t.Errorf("got  %v\nwant %v", got, want)
-	}
-}
-
-func TestDotnetFiles(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		"src/Api/appsettings.json": `{
-  "Logging": { "LogLevel": { "Default": "Information" } },
-  "ConnectionStrings": { "Default": "Server=db;User Id=app;Password=hunter2" },
-  "AzureAd": { "ClientSecret": "@Microsoft.KeyVault(VaultName=kv;SecretName=ad)" }
-}`,
-		"src/Api/appsettings.Development.json": `{ "Logging": { "LogLevel": { "Default": "Debug" } } }`,
-	})
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
-	ctx := context.Background()
-	p := New(Settings{Dir: root})
-	srcs, _ := p.Sources(ctx)
-	cs, err := p.Containers(ctx, srcs[0])
-	if err != nil || len(cs) != 2 {
-		t.Fatalf("files: %+v %v", cs, err)
-	}
-	for _, c := range cs {
-		if c.Detail != "dotnet · json" || c.Hidden != (c.Name == "src/Api/appsettings.Development.json") {
-			t.Errorf("%s: %q hidden %t", c.Name, c.Detail, c.Hidden)
-		}
-	}
-	settings := cs[1]
-
-	keys, _ := p.Objects(ctx, settings, provider.TypeSecret)
-	got := map[string]string{}
-	for _, k := range shown(keys) {
-		got[k.Name] = k.Detail
-	}
-	// The connection string by its value, the client secret by its name.
-	if want := map[string]string{"ConnectionStrings:Default": "", "AzureAd:ClientSecret": "reference"}; !maps.Equal(got, want) {
-		t.Errorf("keys %v, want %v", got, want)
-	}
-	link := provider.Object{Container: provider.Container{Source: srcs[0], Name: "src/Api/appsettings.json"}, Name: "ConnectionStrings:Default"}
-	if v, err := p.Value(ctx, link); err != nil || v.Reveal() != "Server=db;User Id=app;Password=hunter2" {
-		t.Errorf("value: %q %v", v.Reveal(), err)
-	}
-	if f, _ := p.File(settings, &link); f.Line != 3 {
-		t.Errorf("line %d", f.Line)
-	}
-	if d, plain := p.configDetails(dotnetType, settings); !plain || d[1].Value != "1, not matched by the secret patterns" {
-		t.Errorf("details: %+v %t", d, plain)
-	}
-}

internal/provider/repo/jasypt.go

@@ -1,69 +0,0 @@
-package repo
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// jasyptEnv is where Spring looks for the password first, before the
-// config's jasypt.encryptor.password, and so does lazysecrets.
-const jasyptEnv = "JASYPT_ENCRYPTOR_PASSWORD"
-
-// jasyptValue decrypts v when it's a Jasypt value, ENC(...), from a plain
-// file; other values are as they are.
-func jasyptValue(file, name string, v provider.SecretValue) (provider.SecretValue, error) {
-	s := v.Reveal()
-	if !jasypt.Is(s) {
-		return v, nil
-	}
-	password, from, err := jasyptPassword(file, name)
-	if err != nil {
-		return provider.SecretValue{}, err
-	}
-	plain, err := jasypt.Decrypt(s, password)
-	if errors.Is(err, jasypt.ErrDecrypt) {
-		return provider.SecretValue{}, fmt.Errorf("jasypt: with the password from %s: %w", from, err)
-	}
-	if err != nil {
-		return provider.SecretValue{}, fmt.Errorf("jasypt: %w", err)
-	}
-	return provider.NewSecretValue([]byte(plain)), nil
-}
-
-// jasyptPassword is the password for the Jasypt value of the key named
-// name, and where it's from: $JASYPT_ENCRYPTOR_PASSWORD, else the file's
-// own setting (jasypt.encryptor.password in a Spring file; the service's
-// JASYPT_ENCRYPTOR_PASSWORD in a compose file, the file's in an env file),
-// with a ${VAR} in it read from the environment.
-func jasyptPassword(file, name string) (password, from string, err error) {
-	if v := os.Getenv(jasyptEnv); v != "" {
-		return v, "$" + jasyptEnv, nil
-	}
-	setting, read, placeholder := jasyptEnv, plainValue, composePlaceholder // env files interpolate like compose
-	if t, ok := configTypeOf(file); ok {
-		if t.jasyptSetting == nil {
-			return "", "", fmt.Errorf("jasypt: no password: set $%s", jasyptEnv)
-		}
-		setting, read, placeholder = t.jasyptSetting(name), t.value, t.placeholder
-	}
-	v, err := read(file, setting)
-	if err != nil {
-		return "", "", fmt.Errorf("jasypt: no password: set $%s, or %s in %s", jasyptEnv, setting, filepath.Base(file))
-	}
-	from = setting + " in " + filepath.Base(file)
-	env, def, hasDef, ok := placeholder(v.Reveal())
-	switch {
-	case !ok:
-		return v.Reveal(), from, nil
-	case os.Getenv(env) != "":
-		return os.Getenv(env), "$" + env + " (" + from + ")", nil
-	case hasDef:
-		return def, "the default in " + from, nil
-	}
-	return "", "", fmt.Errorf("jasypt: no password: %s is %s, and $%s isn't set", from, v.Reveal(), env)
-}

internal/provider/repo/jasypt_test.go

@@ -1,102 +0,0 @@
-package repo
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// hunter2, encrypted by Jasypt with the password "test-password".
-const jasyptHunter2 = "ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)"
-
-func TestJasyptPassword(t *testing.T) {
-	dir := t.TempDir()
-	value := func(name, body string) (string, error) {
-		file := filepath.Join(dir, name)
-		if err := os.WriteFile(file, []byte(body), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		key := "app.token"
-		if !IsSpring(name) {
-			key = "TOKEN"
-		}
-		v, err := (&Provider{}).Value(context.Background(), provider.Object{ID: file + "\x00" + key, Name: key})
-		return v.Reveal(), err
-	}
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
-	t.Setenv("MY_PASSWORD", "")
-	spring := func(password string) string {
-		return "jasypt.encryptor.password: " + password + "\napp.token: " + jasyptHunter2 + "\n"
-	}
-
-	for _, c := range []struct{ name, file, body, env, want string }{
-		{"the file's own", "application.yml", spring("test-password"), "", "hunter2"},
-		{"a ${VAR}", "application.yml", spring("${MY_PASSWORD}"), "test-password", "hunter2"},
-		{"a ${VAR}'s default", "application.yml", spring("${MY_PASSWORD:test-password}"), "", "hunter2"},
-		{"properties", "application-local.properties", "jasypt.encryptor.password=test-password\napp.token=" + jasyptHunter2 + "\n", "", "hunter2"},
-		{"env file", ".env", "JASYPT_ENCRYPTOR_PASSWORD=test-password\nTOKEN=" + jasyptHunter2 + "\n", "", "hunter2"},
-		{"not jasypt", ".env", "TOKEN=hunter2\n", "", "hunter2"},
-	} {
-		t.Setenv("MY_PASSWORD", c.env)
-		if got, err := value(c.file, c.body); err != nil || got != c.want {
-			t.Errorf("%s: %q %v", c.name, got, err)
-		}
-	}
-
-	// $JASYPT_ENCRYPTOR_PASSWORD wins over the file's, as in Spring.
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "test-password")
-	if got, err := value("application.yml", spring("wrong")); err != nil || got != "hunter2" {
-		t.Errorf("environment first: %q %v", got, err)
-	}
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "wrong")
-	if _, err := value("application.yml", spring("test-password")); err == nil || !strings.Contains(err.Error(), "the password from $JASYPT_ENCRYPTOR_PASSWORD") {
-		t.Errorf("a wrong one says where it's from: %v", err)
-	}
-
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
-	t.Setenv("MY_PASSWORD", "")
-	for body, want := range map[string]string{
-		spring("${MY_PASSWORD}"):      "$MY_PASSWORD isn't set",
-		"app.token: " + jasyptHunter2: "set $JASYPT_ENCRYPTOR_PASSWORD, or jasypt.encryptor.password in application.yml",
-	} {
-		if _, err := value("application.yml", body); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("no password: %v, want %q", err, want)
-		}
-	}
-}
-
-func TestJasyptEnvFile(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		"jasypt.env": "TOKEN=" + jasyptHunter2 + "\n",
-		"mixed.env":  "TOKEN=" + jasyptHunter2 + "\nURL=https://example.com\n",
-	})
-	ctx := context.Background()
-	p := New(Settings{Dir: root})
-	srcs, _ := p.Sources(ctx)
-	cs, _ := p.Containers(ctx, srcs[0])
-	for _, c := range cs {
-		attrs, _ := p.Details(ctx, c)
-		got := map[string]provider.Attr{}
-		for _, a := range attrs {
-			got[a.Label] = a
-		}
-		switch c.Name {
-		case "jasypt.env":
-			if got["encryption"].Value != "jasypt: 1 of 1 values" || got["git"].Warn {
-				t.Errorf("all jasypt: %+v", got)
-			}
-			keys, _ := p.Objects(ctx, c, provider.TypeSecret)
-			if len(keys) != 1 || keys[0].Attrs[1].Value != "jasypt" || keys[0].Detail != "jasypt" {
-				t.Errorf("keys: %+v", keys)
-			}
-		case "mixed.env":
-			if got["encryption"].Value != "jasypt: 1 of 2 values" || !got["git"].Warn {
-				t.Errorf("mixed: %+v", got)
-			}
-		}
-	}
-}

internal/provider/repo/patterns.go

@@ -1,113 +0,0 @@
-package repo
-
-import (
-	"errors"
-	"fmt"
-	"path/filepath"
-	"regexp"
-)
-
-// Config files (Spring's) hold all of an app's config, most of it not
-// secret: of their keys, those named like a secret or with a value that
-// looks like one are listed, the rest hidden (H shows them). The patterns
-// can be set for all of a repo's files and per file type, in the config
-// and in a repo's .lazysecrets.yaml.
-
-// DefaultSecretKeys and DefaultSecretValues are the patterns used when
-// nothing sets them. The key pattern is anchored at the end of the name:
-// spring.datasource.password, client-secret, DB_PASSWORD and checkoutKey,
-// not the oauth2.*, keycloak.* and token-uri keys every Spring app has.
-// passord is Norwegian. They err on listing too much: a row too many is
-// cheap, a secret missed isn't.
-var (
-	DefaultSecretKeys = []string{
-		`(?i)(pass(word|wd|phrase|ord)?|pwd|secret|token|key|credentials?|salt|connection-?string)$`,
-	}
-	DefaultSecretValues = []string{
-		`^ENC\(.+\)$`,            // Jasypt
-		`://[^/\s:@]*:[^/\s@]+@`, // a URL with a password: jdbc:postgresql://user:pass@host
-		`(?i)(AccountKey|SharedAccessKey|Password|Pwd)=`, // a connection string with one
-	}
-)
-
-// SecretPatterns are regexps matched against a key's name and its value:
-// a key is a secret when either matches. A list that isn't set is taken
-// from the next place that sets it (see filterFor).
-type SecretPatterns struct {
-	Keys   *[]string `yaml:"keys"`
-	Values *[]string `yaml:"values"`
-}
-
-// FileType holds the settings of one type of file (spring:), for now its
-// own secret patterns.
-type FileType struct {
-	SecretPatterns SecretPatterns `yaml:"secretPatterns"`
-}
-
-// Check says which pattern doesn't compile; field is where they're set
-// (spring.secretPatterns), for the message.
-func (p SecretPatterns) Check(field string) error {
-	var errs []error
-	for name, list := range map[string]*[]string{"keys": p.Keys, "values": p.Values} {
-		if list == nil {
-			continue
-		}
-		for i, s := range *list {
-			if _, err := regexp.Compile(s); err != nil {
-				errs = append(errs, fmt.Errorf("%s.%s[%d]: %w", field, name, i, err))
-			}
-		}
-	}
-	return errors.Join(errs...)
-}
-
-type secretFilter struct{ keys, values []*regexp.Regexp }
-
-func (f secretFilter) secret(key, value string) bool {
-	return anyMatch(f.keys, key) || anyMatch(f.values, value)
-}
-
-// filterFor is the patterns for a repo's files of one type (spring), each
-// list from the first that sets it: the repo's .lazysecrets.yaml for the
-// type, then for all its files, the config for the type, then for all
-// repos, then the defaults.
-func (p *Provider) filterFor(root, fileType string) (secretFilter, error) {
-	f, err := readLazysecretsFile(root)
-	if err != nil {
-		return secretFilter{}, err
-	}
-	own := filepath.Join(root, ".lazysecrets.yaml") + ": "
-	type source struct {
-		field    string
-		patterns SecretPatterns
-	}
-	sources := []source{
-		{own + fileType + ".secretPatterns", f.types()[fileType].SecretPatterns},
-		{own + "secretPatterns", f.SecretPatterns},
-		{"providers.repos." + fileType + ".secretPatterns", p.s.Types[fileType].SecretPatterns},
-		{"providers.repos.secretPatterns", p.s.SecretPatterns},
-	}
-	pick := func(name string, list func(SecretPatterns) *[]string, defaults []string) ([]*regexp.Regexp, error) {
-		for _, s := range sources {
-			if l := list(s.patterns); l != nil {
-				return compileAll(*l, s.field+"."+name)
-			}
-		}
-		return compileAll(defaults, "default "+name)
-	}
-	keys, kerr := pick("keys", func(p SecretPatterns) *[]string { return p.Keys }, DefaultSecretKeys)
-	values, verr := pick("values", func(p SecretPatterns) *[]string { return p.Values }, DefaultSecretValues)
-	return secretFilter{keys, values}, errors.Join(kerr, verr)
-}
-
-func compileAll(patterns []string, field string) ([]*regexp.Regexp, error) {
-	out := make([]*regexp.Regexp, 0, len(patterns))
-	for i, s := range patterns {
-		re, err := regexp.Compile(s)
-		if err != nil {
-			return nil, fmt.Errorf("%s[%d]: %w", field, i, err)
-		}
-		out = append(out, re)
-	}
-	return out, nil
-}

internal/provider/repo/patterns_test.go

@@ -1,49 +0,0 @@
-package repo
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// Each list comes from the first that sets it: the repo's spring, the
-// repo's, the config's spring, the config's, the defaults.
-func TestSecretPatternsOrder(t *testing.T) {
-	list := func(s ...string) *[]string { return &s }
-	root := t.TempDir()
-	write := func(body string) {
-		if err := os.WriteFile(filepath.Join(root, ".lazysecrets.yaml"), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	p := New(Settings{
-		SecretPatterns: SecretPatterns{Keys: list("^config$"), Values: list("^config$")},
-		Types:          map[string]FileType{"spring": {SecretPatterns: SecretPatterns{Keys: list("^config-spring$")}}},
-	})
-	secret := func(key, value string) bool {
-		t.Helper()
-		f, err := p.filterFor(root, "spring")
-		if err != nil {
-			t.Fatal(err)
-		}
-		return f.secret(key, value)
-	}
-
-	if !secret("config-spring", "") || secret("config", "") || !secret("", "config") {
-		t.Error("the config's spring keys, its shared values")
-	}
-	write("secretPatterns:\n  keys: [\"^repo$\"]\n")
-	if !secret("repo", "") || secret("config-spring", "") || !secret("", "config") {
-		t.Error("the repo's shared keys over the config's")
-	}
-	write("secretPatterns:\n  keys: [\"^repo$\"]\nspring:\n  secretPatterns:\n    keys: [\"^repo-spring$\"]\n    values: []\n")
-	if !secret("repo-spring", "") || secret("repo", "") || secret("", "config") {
-		t.Error("the repo's spring over everything; an empty list matches nothing")
-	}
-
-	p = New(Settings{})
-	write("")
-	if !secret("spring.datasource.password", "") || secret("server.port", "") {
-		t.Error("the defaults")
-	}
-}

internal/provider/repo/repo.go

@@ -1,7 +1,6 @@
 // Package repo browses the encrypted secret files in git repositories:
 // a repo is a source, its secret files the containers (vault level), and
-// their keys the secrets. Secret files are SOPS files, plain env files and
+// their keys the secrets. Secret files are SOPS files and plain env files.
-// config files: Spring Boot's, Docker Compose's and .NET's (configfile.go).
 //
 // Listing never decrypts: SOPS encrypts values only, so a file's keys and
 // metadata are read directly. A value is decrypted when it's revealed or
@@ -32,7 +31,6 @@ import (
 
 	"go.yaml.in/yaml/v3"
 
-	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
@@ -51,11 +49,6 @@ type Settings struct {
 	// Include and Exclude are globs relative to a repo's root (** matches
 	// any depth), for repos without their own .lazysecrets.yaml.
 	Include, Exclude []string
-	// SecretPatterns say which keys of config files are secrets, Types
-	// per type of file (spring), for repos whose .lazysecrets.yaml
-	// doesn't.
-	SecretPatterns SecretPatterns
-	Types          map[string]FileType
 	// Sops is the sops binary; "sops" (on PATH) when empty.
 	Sops string
 }
@@ -192,19 +185,12 @@ func (p *Provider) Current(ctx context.Context) (provider.Source, bool) {
 		return provider.Source{}, false
 	}
 	src := p.source(r)
-	files, err := p.Containers(ctx, src)
+	if files, err := p.Containers(ctx, src); err == nil && len(files) == 0 {
-	if err == nil && len(files) == 0 {
 		return provider.Source{}, false
 	}
-	src.Hidden = err == nil && allHidden(files)
 	return src, true
 }
 
-// allHidden reports whether a repo's files are all hidden: the repo is too.
-func allHidden(files []provider.Container) bool {
-	return !slices.ContainsFunc(files, func(c provider.Container) bool { return !c.Hidden })
-}
-
 func (p *Provider) source(r repoInfo) provider.Source {
 	return provider.Source{
 		Kind: provider.KindRepo, Provider: p.ID(), ProviderLabel: p.Label(),
@@ -273,7 +259,6 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 	parallel(len(srcs), func(i int) {
 		files, err := p.Containers(ctx, srcs[i])
 		keep[i] = err != nil || len(files) > 0
-		srcs[i].Hidden = err == nil && allHidden(files)
 	})
 	var out []provider.Source
 	for i, src := range srcs {
@@ -333,13 +318,8 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 			c.Detail = "sops · " + strings.Join(meta.methods, ", ")
 		case isSops:
 			return // a SOPS file where .sops.yaml says SOPS files don't go
-		case isEnvNamed(f):
+		case IsEnv(f):
 			c.Detail = provider.DetailPlainEnv
-			c.Hidden = isExample(f)
-		case isConfig(f):
-			t, _ := configTypeOf(f)
-			c.Detail = t.detail(f)
-			c.Hidden = isExample(f) || p.configHidden(t, r.root, path)
 		default:
 			return
 		}
@@ -376,29 +356,30 @@ func (p *Provider) Objects(_ context.Context, c provider.Container, t provider.O
 	if err != nil {
 		return nil, err
 	}
-	meta, isSops := parseMeta(c.ID, b)
+	meta, isSops := readMeta(c.ID)
-	if t, ok := configTypeOf(c.ID); ok && !isSops {
-		return p.configObjects(t, c, b)
-	}
 	keys, err := parseKeys(c.ID, b)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", c.Name, err)
 	}
-	attrs := []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}}
+	if !isSops { // a plain env file
-	if isSops {
+		out := make([]provider.Object, 0, len(keys))
-		attrs = []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}}
+		for _, k := range keys {
+			out = append(out, provider.Object{
+				Container: c, Type: provider.TypeSecret, ID: c.ID + "\x00" + k.extract, Name: k.name,
+				Attrs: []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}},
+			})
+		}
+		return out, nil
 	}
 	out := make([]provider.Object, 0, len(keys))
 	for _, k := range keys {
 		o := provider.Object{
 			Container: c, Type: provider.TypeSecret,
-			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified, Attrs: attrs,
+			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified,
+			Attrs: []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}},
 		}
-		switch {
+		if !k.encrypted {
-		case isSops && !k.encrypted:
+			o.Attrs = append(o.Attrs, provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
-			o.Attrs = append(slices.Clip(attrs), provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
-		case !isSops && k.jasypt:
-			o.Attrs, o.Detail = []provider.Attr{attrs[0], {Label: "encrypted", Value: "jasypt"}}, "jasypt"
 		}
 		out = append(out, o)
 	}
@@ -413,29 +394,18 @@ func (p *Provider) Versions(context.Context, provider.Object) ([]provider.Object
 	return nil, provider.ErrUnsupported
 }
 
-// Value reads one key: from a plain file, decrypting a Jasypt value; from
+// Value decrypts one key with sops.
-// a SOPS file, with sops.
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	file, extract, ok := strings.Cut(o.ID, "\x00")
 	if !ok { // made from a link: the repo's root, the file's path, the key
-		file = filePath(o.Container)
+		file = o.Container.ID
+		if file == "" {
+			file = filepath.Join(o.Container.Source.ID, filepath.FromSlash(o.Container.Name))
+		}
+		extract = extractFor(file, o.Name)
 	}
 	if _, isSops := readMeta(file); !isSops {
-		read := plainValue
+		return plainValue(file, o.Name)
-		if t, ok := configTypeOf(file); ok {
-			read = t.value
-		}
-		v, err := read(file, o.Name)
-		if err != nil {
-			return v, err
-		}
-		return jasyptValue(file, o.Name, v)
-	}
-	if !ok {
-		var err error
-		if extract, err = extractOf(file, o.Name); err != nil {
-			return provider.SecretValue{}, err
-		}
 	}
 	cmd := exec.CommandContext(ctx, p.s.Sops, "decrypt", "--extract", extract, file)
 	cmd.Dir = filepath.Dir(file) // sops looks for .sops.yaml from here
@@ -459,18 +429,12 @@ func (p *Provider) Contents(_ context.Context, c provider.Container) ([]byte, er
 	return os.ReadFile(f.Path)
 }
 
-// filePath is the file c is. A container made from a link has no ID: the
-// file is its path in the repo.
-func filePath(c provider.Container) string {
-	if c.ID != "" {
-		return c.ID
-	}
-	return filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
-}
-
 // File is the file c is, and the line o's key is on.
 func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File, error) {
-	path := filePath(c)
+	path := c.ID
+	if path == "" { // made from a link
+		path = filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
+	}
 	f := provider.File{Path: path}
 	if _, isSops := readMeta(path); isSops {
 		f.Sops = p.s.Sops
@@ -478,12 +442,6 @@ func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File
 	if o == nil {
 		return f, nil
 	}
-	if t, ok := configTypeOf(path); ok && f.Sops == "" {
-		if k, err := t.keyNamed(path, o.Name); err == nil {
-			f.Line = k.line
-		}
-		return f, nil
-	}
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return f, err
@@ -635,57 +593,44 @@ func normalizeRemote(remote string) (string, string) {
 
 // lazysecretsFile is a repo's own .lazysecrets.yaml.
 type lazysecretsFile struct {
-	Include        []string       `yaml:"include"`
+	Include []string `yaml:"include"`
-	Exclude        []string       `yaml:"exclude"`
+	Exclude []string `yaml:"exclude"`
-	SecretPatterns SecretPatterns `yaml:"secretPatterns"`
+	Sharing struct {
-	Spring         FileType       `yaml:"spring"`
-	Compose        FileType       `yaml:"compose"`
-	Dotnet         FileType       `yaml:"dotnet"`
-	Sharing        struct {
 		// Key is the link to the secret that encrypts the repo's
 		// shared env files (package share).
 		Key string `yaml:"key"`
 	} `yaml:"sharing"`
 }
 
-func (f lazysecretsFile) types() map[string]FileType {
-	return map[string]FileType{"spring": f.Spring, "compose": f.Compose, "dotnet": f.Dotnet}
-}
-
 // ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
 func ShareKey(root string) (string, error) {
-	f, err := readLazysecretsFile(root)
-	return f.Sharing.Key, err
-}
-
-// readLazysecretsFile reads the repo's .lazysecrets.yaml; without one, it's
-// empty.
-func readLazysecretsFile(root string) (lazysecretsFile, error) {
-	var f lazysecretsFile
 	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
 	if errors.Is(err, os.ErrNotExist) {
-		return f, nil
+		return "", nil
 	}
 	if err != nil {
-		return f, err
+		return "", err
 	}
+	var f lazysecretsFile
 	if err := yaml.Unmarshal(b, &f); err != nil {
-		return f, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
+		return "", fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 	}
-	return f, nil
+	return f.Sharing.Key, nil
 }
 
 // selector says which files to look at: user (the include/exclude of the
 // repo's .lazysecrets.yaml or the config) for every file, and sopsWhere
 // (.sops.yaml's creation_rules, when there's no include) for SOPS files.
 func (p *Provider) selector(root string, files []string) (user, sopsWhere func(string) bool, err error) {
-	f, err := readLazysecretsFile(root)
-	if err != nil {
-		return nil, nil, err
-	}
 	include, exclude := p.s.Include, p.s.Exclude
-	if len(f.Include) > 0 || len(f.Exclude) > 0 {
+	if b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml")); err == nil {
-		include, exclude = f.Include, f.Exclude
+		var f lazysecretsFile
+		if err := yaml.Unmarshal(b, &f); err != nil {
+			return nil, nil, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
+		}
+		if len(f.Include) > 0 || len(f.Exclude) > 0 {
+			include, exclude = f.Include, f.Exclude
+		}
 	}
 	inc, err := globs(include)
 	if err != nil {
@@ -721,7 +666,7 @@ func envFiles(root string, tracked []string) []string {
 	dirs := map[string]bool{".": true}
 	for _, f := range tracked {
 		isTracked[f] = true
-		if isEnvNamed(f) {
+		if IsEnv(f) {
 			out = append(out, f)
 		}
 		if d := path.Dir(f); !dirs[d] && !inPackages(f) {
@@ -735,7 +680,7 @@ func envFiles(root string, tracked []string) []string {
 		}
 		for _, e := range entries {
 			f := path.Join(d, e.Name())
-			if e.Type().IsRegular() && !isTracked[f] && isEnvNamed(f) {
+			if e.Type().IsRegular() && !isTracked[f] && IsEnv(f) {
 				out = append(out, f)
 			}
 		}
@@ -770,29 +715,16 @@ func inPackages(f string) bool {
 // .env, .env.local, prod.env; not .env.example and the like, nor one in
 // dependencies.
 func IsEnv(f string) bool {
-	return isEnvNamed(f) && !isExample(f)
+	if inPackages(f) {
-}
+		return false
-
+	}
-// isEnvNamed reports whether a file outside dependencies is named like an
-// env file, examples too.
-func isEnvNamed(f string) bool {
 	base := strings.ToLower(path.Base(f))
-	return !inPackages(f) && (base == ".env" || strings.HasPrefix(base, ".env.") || strings.HasSuffix(base, ".env"))
+	for _, ext := range []string{".example", ".sample", ".template", ".dist", ".tmpl"} {
-}
+		if strings.HasSuffix(base, ext) {
-
+			return false
-var exampleWords = []string{"example", "sample", "template", "dist", "tmpl"}
-
-// isExample reports whether a file is an example or template of another:
-// .env.example, docker-compose.example.yml. They're listed hidden: someone
-// may have put a real value in one.
-func isExample(f string) bool {
-	base := strings.ToLower(path.Base(f))
-	for _, w := range exampleWords {
-		if strings.HasSuffix(base, "."+w) || strings.Contains(base, "."+w+".") {
-			return true
 		}
 	}
-	return false
+	return base == ".env" || strings.HasPrefix(base, ".env.") || strings.HasSuffix(base, ".env")
 }
 
 // plainValue reads a key from a plain env file.
@@ -970,21 +902,12 @@ func readMeta(file string) (sopsMeta, bool) {
 		return sopsMeta{}, false // not a format sops writes: skip reading
 	}
 	b, err := os.ReadFile(file)
-	if err != nil {
+	if err != nil || !bytes.Contains(b, []byte("sops")) {
-		return sopsMeta{}, false
-	}
-	return parseMeta(file, b)
-}
-
-// parseMeta is readMeta, of the file's contents b.
-func parseMeta(file string, b []byte) (sopsMeta, bool) {
-	format := formatOf(file)
-	if len(b) > maxFileSize || format == "" || !bytes.Contains(b, []byte("sops")) {
 		return sopsMeta{}, false // cheap: most files aren't sops, no parsing
 	}
 	var m sopsMeta
 	known := []string{"age", "azure_kv", "kms", "gcp_kms", "hc_vault", "pgp"}
-	switch format {
+	switch formatOf(file) {
 	case "yaml", "json":
 		var doc struct {
 			Sops map[string]any `yaml:"sops"`
@@ -1088,8 +1011,7 @@ type key struct {
 	name      string // db.password, list[0], with . [ ] \ in keys escaped
 	extract   string // sops --extract: ["db"]["password"]
 	encrypted bool
-	jasypt    bool // a plain env file's ENC(...) value
+	line      int // 1-based
-	line      int  // 1-based
 }
 
 // parseKeys lists a sops file's keys without decrypting anything.
@@ -1113,8 +1035,7 @@ func parseKeys(file string, b []byte) ([]key, error) {
 			if !ok || strings.HasPrefix(k, "sops_") {
 				continue
 			}
-			sopsKey, _, _ := strings.Cut(line, "=") // sops keeps export and spaces in the key
+			out = append(out, key{name: k, extract: quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
-			out = append(out, key{name: k, extract: quote(sopsKey), encrypted: strings.HasPrefix(v, "ENC["), jasypt: jasypt.Is(v), line: i + 1})
 		}
 		return out, nil
 	case "ini":
@@ -1179,23 +1100,48 @@ func escape(k string) string {
 	return strings.NewReplacer(`\`, `\\`, `.`, `\.`, `[`, `\[`, `]`, `\]`).Replace(k)
 }
 
-// extractOf is the sops --extract path of the key named name, for objects
+// extractFor rebuilds the extract path from a key name, for objects made
-// made from a link.
+// from a link (db.password, list[0], app\.name). A dotenv file is flat:
-func extractOf(file, name string) (string, error) {
+// its names are the keys as they are.
-	b, err := os.ReadFile(file)
+func extractFor(file, name string) string {
-	if err != nil {
+	if formatOf(file) == "dotenv" {
-		return "", err
+		return quote(name)
 	}
-	keys, err := parseKeys(file, b)
+	var b, part strings.Builder
-	if err != nil {
+	flush := func() {
-		return "", err
+		if part.Len() > 0 {
-	}
+			b.WriteString(quote(part.String()))
-	for _, k := range keys {
+			part.Reset()
-		if k.name == name {
-			return k.extract, nil
 		}
 	}
-	return "", fmt.Errorf("%s isn't in %s", name, filepath.Base(file))
+	for i := 0; i < len(name); i++ {
+		switch c := name[i]; c {
+		case '\\':
+			if i+1 < len(name) {
+				i++
+			}
+			part.WriteByte(name[i])
+		case '.':
+			flush()
+		case '[':
+			end := strings.IndexByte(name[i:], ']')
+			if end < 0 || !digits(name[i+1:i+end]) {
+				part.WriteByte(c)
+				continue
+			}
+			flush()
+			b.WriteString(name[i : i+end+1])
+			i += end
+		default:
+			part.WriteByte(c)
+		}
+	}
+	flush()
+	return b.String()
+}
+
+func digits(s string) bool {
+	return s != "" && strings.Trim(s, "0123456789") == ""
 }
 
 func absPath(p string) string {

internal/provider/repo/repo_test.go

@@ -237,25 +237,6 @@ func TestDecrypt(t *testing.T) {
 		t.Errorf("from a link: %q %v", v.Reveal(), err)
 	}
 
-	// A dotenv file's export lines: sops keeps export in the key.
-	os.WriteFile(plain, []byte("export TOKEN=s3cret\n"), 0o600)
-	enc, err = exec.Command("sops", "encrypt", "--age", recipient, "--input-type", "dotenv", "--output-type", "dotenv", plain).Output()
-	if err != nil {
-		t.Fatal(err)
-	}
-	envFile := filepath.Join(root, "prod.env")
-	os.WriteFile(envFile, enc, 0o600)
-	envC := provider.Container{Source: srcs[0], ID: envFile, Name: "prod.env"}
-	envKeys, _ := p.Objects(ctx, envC, provider.TypeSecret)
-	if len(envKeys) != 1 {
-		t.Fatalf("env keys: %v", envKeys)
-	}
-	for _, o := range []provider.Object{envKeys[0], {Container: provider.Container{Source: srcs[0], Name: "prod.env"}, Name: "TOKEN"}} {
-		if v, err := p.Value(ctx, o); err != nil || v.Reveal() != "s3cret" {
-			t.Errorf("export line (link: %t): %q %v", o.ID == "", v.Reveal(), err)
-		}
-	}
-
 	// Without the key: sops' own error.
 	t.Setenv("SOPS_AGE_KEY_FILE", filepath.Join(dir, "missing.txt"))
 	if _, err := p.Value(ctx, keys[0]); err == nil || !strings.Contains(err.Error(), "no identity matched any of the recipients") {
@@ -292,12 +273,9 @@ func TestPlainEnvFiles(t *testing.T) {
 	got := map[string]string{}
 	for _, c := range files {
 		got[c.Name] = c.Detail
-		if c.Hidden != (c.Name == ".env.example") {
-			t.Errorf("%s: hidden %t", c.Name, c.Hidden)
-		}
 	}
-	if len(got) != 3 || got[".env"] != "env · plain text" || got[".env.example"] != "env · plain text" || got["secrets/app.yaml"] != "sops · age" {
+	if len(got) != 2 || got[".env"] != "env · plain text" || got["secrets/app.yaml"] != "sops · age" {
-		t.Fatalf("files %v (want .env, the example, hidden, and the sops file; not node_modules)", got)
+		t.Fatalf("files %v (want .env and the sops file; not the example or node_modules)", got)
 	}
 
 	var env provider.Container
@@ -322,7 +300,7 @@ func TestPlainEnvFiles(t *testing.T) {
 	os.WriteFile(filepath.Join(root, ".sops.yaml"), []byte("creation_rules:\n  - path_regex: nowhere/.*\n"), 0o644)
 	exec.Command("git", "-C", root, "add", ".sops.yaml").Run()
 	files, _ = New(Settings{Dir: root}).Containers(ctx, srcs[0])
-	if names := names(files, func(c provider.Container) string { return c.Name }); !slices.Equal(names, []string{".env", ".env.example"}) {
+	if names := names(files, func(c provider.Container) string { return c.Name }); !slices.Equal(names, []string{".env"}) {
 		t.Errorf("with rules elsewhere: %v", names)
 	}
 }
@@ -576,22 +554,15 @@ func TestKeyNamesEscaped(t *testing.T) {
 	var got []string
 	for _, k := range keys {
 		got = append(got, k.name+" "+k.extract)
+		if e := extractFor("s.yaml", k.name); e != k.extract {
+			t.Errorf("extractFor(%q) = %s, want %s", k.name, e, k.extract)
+		}
 	}
 	want := `app\.name ["app.name"]|db.password ["db"]["password"]|list[0] ["list"][0]|list[1] ["list"][1]|odd\[1\] ["odd[1]"]`
 	if strings.Join(got, "|") != want {
 		t.Errorf("keys = %s\nwant   %s", strings.Join(got, "|"), want)
 	}
-
+	if e := extractFor(".env", "spring.url"); e != `["spring.url"]` {
-	keys, err = parseKeys(".env", []byte("spring.url=a\nexport TOKEN=b\nSPACED = c\n"))
+		t.Errorf("dotenv: %s", e)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got = nil
-	for _, k := range keys {
-		got = append(got, k.name+" "+k.extract)
-	}
-	want = `spring.url ["spring.url"]|TOKEN ["export TOKEN"]|SPACED ["SPACED "]`
-	if strings.Join(got, "|") != want {
-		t.Errorf("dotenv keys = %s\nwant   %s", strings.Join(got, "|"), want)
 	}
 }

internal/provider/repo/spring.go

@@ -1,236 +0,0 @@
-package repo
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"path"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"strings"
-	"unicode"
-
-	"go.yaml.in/yaml/v3"
-)
-
-// Spring Boot config files: application*.properties/.yml and bootstrap*,
-// their keys filtered by the secret patterns (patterns.go).
-
-// springName is application.yml, application-prod.properties, bootstrap.yaml
-// and the like; not applications.yaml (Argo CD's) or application.yml.example.
-var springName = regexp.MustCompile(`^(application|bootstrap)(-[^.]+)?\.(properties|ya?ml)$`)
-
-// IsSpring reports whether f is named like a Spring Boot config file, and
-// isn't a Helm chart's template of one.
-func IsSpring(f string) bool {
-	return springName.MatchString(strings.ToLower(path.Base(f))) && path.Base(path.Dir(f)) != "templates"
-}
-
-func springFormat(f string) string {
-	if strings.ToLower(filepath.Ext(f)) == ".properties" {
-		return "properties"
-	}
-	return "yaml"
-}
-
-var springType = configType{
-	name: "spring", is: IsSpring, format: springFormat, parse: parseSpring,
-	jasyptSetting: func(string) string { return "jasypt.encryptor.password" },
-	placeholder:   springPlaceholder,
-}
-
-// springPlaceholderRe is Spring's ${name} or ${name:default}.
-var springPlaceholderRe = regexp.MustCompile(`^\$\{([^:}]+)(:([^}]*))?\}$`)
-
-func springPlaceholder(v string) (name, def string, hasDef, ok bool) {
-	m := springPlaceholderRe.FindStringSubmatch(v)
-	if m == nil {
-		return "", "", false, false
-	}
-	return m[1], m[3], m[2] != "", true
-}
-
-func parseSpring(file string, b []byte) ([]configKey, error) {
-	var keys []configKey
-	var err error
-	if springFormat(file) == "properties" {
-		keys = parseProperties(b)
-	} else {
-		keys, err = parseSpringYAML(b)
-	}
-	for i := range keys {
-		keys[i].ref = reference(springPlaceholder, keys[i].value)
-	}
-	return keys, err
-}
-
-// springDocs names the keys of a multi-document file's later documents
-// after the profile they're for, so each name is one key:
-// spring.datasource.password (prod).
-func springDocs(docs [][]configKey) []configKey {
-	var out []configKey
-	for i, doc := range docs {
-		suffix := ""
-		if i > 0 {
-			suffix = fmt.Sprintf(" (document %d)", i+1)
-			for _, k := range doc {
-				if k.key == "spring.config.activate.on-profile" || k.key == "spring.profiles" {
-					suffix = " (" + k.value + ")"
-				}
-			}
-		}
-		for _, k := range doc {
-			k.name = k.key + suffix
-			out = append(out, k)
-		}
-	}
-	return out
-}
-
-// mavenFiltered is a value Maven fills in at build time, @project.version@:
-// not YAML until it's quoted.
-var mavenFiltered = regexp.MustCompile(`(?m)(:[ \t]+|^[ \t]*-[ \t]+)(@[^\n]*?)[ \t]*$`)
-
-func parseSpringYAML(b []byte) ([]configKey, error) {
-	b = mavenFiltered.ReplaceAllFunc(b, func(m []byte) []byte {
-		sub := mavenFiltered.FindSubmatch(m)
-		return fmt.Appendf(nil, "%s'%s'", sub[1], bytes.ReplaceAll(sub[2], []byte("'"), []byte("''")))
-	})
-	dec := yaml.NewDecoder(bytes.NewReader(b))
-	var docs [][]configKey
-	for {
-		var doc yaml.Node
-		err := dec.Decode(&doc)
-		if errors.Is(err, io.EOF) {
-			break
-		}
-		if err != nil {
-			return nil, err
-		}
-		var keys []configKey
-		if len(doc.Content) > 0 {
-			springWalk(doc.Content[0], "", &keys)
-		}
-		docs = append(docs, keys)
-	}
-	return springDocs(docs), nil
-}
-
-// springWalk names keys the way Spring does: nested keys joined by dots,
-// list items by index (servers[0]).
-func springWalk(n *yaml.Node, name string, out *[]configKey) {
-	switch n.Kind {
-	case yaml.MappingNode:
-		for i := 0; i+1 < len(n.Content); i += 2 {
-			child := n.Content[i].Value
-			if name != "" {
-				child = name + "." + child
-			}
-			springWalk(n.Content[i+1], child, out)
-		}
-	case yaml.SequenceNode:
-		for i, c := range n.Content {
-			springWalk(c, fmt.Sprintf("%s[%d]", name, i), out)
-		}
-	case yaml.AliasNode:
-		if n.Alias != nil {
-			springWalk(n.Alias, name, out)
-		}
-	case yaml.ScalarNode:
-		if name != "" {
-			*out = append(*out, configKey{key: name, value: n.Value, line: n.Line})
-		}
-	}
-}
-
-// parseProperties reads a Java .properties file: key=value, key: value or
-// key value, lines continued with a trailing backslash, # and ! comments,
-// and #--- between documents (Spring Boot 2.4+).
-func parseProperties(b []byte) []configKey {
-	lines := strings.Split(strings.ReplaceAll(string(b), "\r\n", "\n"), "\n")
-	var docs [][]configKey
-	var doc []configKey
-	for i := 0; i < len(lines); i++ {
-		start := i + 1
-		line := strings.TrimLeftFunc(lines[i], unicode.IsSpace)
-		if line == "#---" || line == "!---" {
-			docs, doc = append(docs, doc), nil
-			continue
-		}
-		if line == "" || line[0] == '#' || line[0] == '!' {
-			continue
-		}
-		for continued(line) && i+1 < len(lines) {
-			i++
-			line = line[:len(line)-1] + strings.TrimLeftFunc(lines[i], unicode.IsSpace)
-		}
-		k, v := splitProperty(line)
-		doc = append(doc, configKey{key: unescapeProperty(k), value: unescapeProperty(v), line: start})
-	}
-	return springDocs(append(docs, doc))
-}
-
-// continued reports whether the line ends in an odd number of backslashes.
-func continued(line string) bool {
-	n := len(line) - len(strings.TrimRight(line, `\`))
-	return n%2 == 1
-}
-
-// splitProperty cuts a logical line at its first unescaped =, : or
-// whitespace; whitespace around the separator isn't part of either side.
-func splitProperty(line string) (key, value string) {
-	const space = " \t\f"
-	for i := 0; i < len(line); i++ {
-		switch c := line[i]; {
-		case c == '\\':
-			i++
-		case c == '=' || c == ':':
-			return line[:i], strings.TrimLeft(line[i+1:], space)
-		case strings.IndexByte(space, c) >= 0:
-			rest := strings.TrimLeft(line[i:], space)
-			if rest != "" && (rest[0] == '=' || rest[0] == ':') {
-				rest = strings.TrimLeft(rest[1:], space)
-			}
-			return line[:i], rest
-		}
-	}
-	return line, ""
-}
-
-func unescapeProperty(s string) string {
-	if !strings.Contains(s, `\`) {
-		return s
-	}
-	var b strings.Builder
-	for i := 0; i < len(s); i++ {
-		if s[i] != '\\' || i+1 == len(s) {
-			b.WriteByte(s[i])
-			continue
-		}
-		i++
-		switch s[i] {
-		case 't':
-			b.WriteByte('\t')
-		case 'n':
-			b.WriteByte('\n')
-		case 'r':
-			b.WriteByte('\r')
-		case 'f':
-			b.WriteByte('\f')
-		case 'u':
-			if i+5 <= len(s) {
-				if r, err := strconv.ParseUint(s[i+1:i+5], 16, 32); err == nil {
-					b.WriteRune(rune(r))
-					i += 4
-					continue
-				}
-			}
-			b.WriteByte('u')
-		default:
-			b.WriteByte(s[i])
-		}
-	}
-	return b.String()
-}

internal/provider/repo/spring_test.go

@@ -1,255 +0,0 @@
-package repo
-
-import (
-	"context"
-	"maps"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-func TestIsSpring(t *testing.T) {
-	for f, want := range map[string]bool{
-		"src/main/resources/application.yml":        true,
-		"application-prod.properties":               true,
-		"config/application-local.yaml":             true,
-		"bootstrap.yml":                             true,
-		"applicationset/dev/applications.yaml":      false, // Argo CD's
-		"chart/templates/application.yaml":          false, // Helm's
-		"application.yml.example":                   false,
-		"application.json":                          false,
-		"src/main/resources/applicationContext.xml": false,
-	} {
-		if IsSpring(f) != want {
-			t.Errorf("%s: %t", f, !want)
-		}
-	}
-}
-
-func springNames(keys []configKey) map[string]string {
-	out := map[string]string{}
-	for _, k := range keys {
-		out[k.name] = k.value
-	}
-	return out
-}
-
-func TestParseProperties(t *testing.T) {
-	got := springNames(parseProperties([]byte(`# a comment
-! another
-a=1
-b : 2
-c 3
-d\:e=4
-long=one, \
-     two
-unicode=café
-empty=
-#---
-spring.config.activate.on-profile=prod
-a=prod-1
-`)))
-	want := map[string]string{
-		"a": "1", "b": "2", "c": "3", "d:e": "4", "long": "one, two", "unicode": "café", "empty": "",
-		"spring.config.activate.on-profile (prod)": "prod", "a (prod)": "prod-1",
-	}
-	if !maps.Equal(got, want) {
-		t.Errorf("got  %v\nwant %v", got, want)
-	}
-}
-
-func TestParseSpringYAML(t *testing.T) {
-	keys, err := parseSpringYAML([]byte(`info.version: @project.version@
-artifacts:
-  - @project.artifactId@
-spring:
-  datasource:
-    password: ${DB_PASSWORD}
-servers:
-  - name: a
-    secret: x
-logging.level:
-  com.example: DEBUG
----
-spring:
-  config.activate.on-profile: prod
-  datasource:
-    password: hunter2
----
-other: y
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]string{
-		"info.version": "@project.version@", "artifacts[0]": "@project.artifactId@",
-		"spring.datasource.password": "${DB_PASSWORD}", "servers[0].name": "a", "servers[0].secret": "x",
-		"logging.level.com.example":                "DEBUG",
-		"spring.config.activate.on-profile (prod)": "prod", "spring.datasource.password (prod)": "hunter2",
-		"other (document 3)": "y",
-	}
-	if got := springNames(keys); !maps.Equal(got, want) {
-		t.Errorf("got  %v\nwant %v", got, want)
-	}
-}
-
-func TestSpringDefaults(t *testing.T) {
-	f, err := (&Provider{}).filterFor(t.TempDir(), "spring")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for key, value := range map[string]string{
-		"spring.datasource.password":                                 "x",
-		"spring.security.oauth2.client.registration.a.client-secret": "x",
-		"profapp.payment.checkoutKey":                                "x",
-		"app.clients.sgig.sgig-passord":                              "x",
-		"jasypt.encryptor.password":                                  "${JASYPT_ENCRYPTOR_PASSWORD}",
-		"spring.datasource.url":                                      "jdbc:postgresql://app:hunter2@db:5432/app",
-		"app.servicebus.connection":                                  "Endpoint=sb://x/;SharedAccessKeyName=a;SharedAccessKey=b",
-		"app.name":                                                   "ENC(abc==)",
-	} {
-		if !f.secret(key, value) {
-			t.Errorf("%s=%s isn't listed", key, value)
-		}
-	}
-	for key, value := range map[string]string{
-		"spring.security.oauth2.client.provider.a.token-uri":                    "https://idp/token",
-		"spring.security.oauth2.client.registration.a.authorization-grant-type": "client_credentials",
-		"app.frontend.keycloak.url":                                             "https://keycloak",
-		"server.port":                                                           "8080",
-		"spring.datasource.url":                                                 "jdbc:postgresql://db:5432/app",
-	} {
-		if f.secret(key, value) {
-			t.Errorf("%s=%s is listed", key, value)
-		}
-	}
-}
-
-func TestSpringFiles(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		"src/main/resources/application.yml": `server:
-  port: 8080
-spring:
-  datasource:
-    url: jdbc:postgresql://db/app
-    password: ${DB_PASSWORD}
-jasypt:
-  encryptor:
-    password: ${JASYPT_ENCRYPTOR_PASSWORD}
-app:
-  api-key: ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)
-`,
-		"src/main/resources/application-local.properties": "server.port=8081\nspring.datasource.password=hunter2\n",
-		"applicationset/applications.yaml":                "kind: ApplicationSet\n",
-	})
-	ctx := context.Background()
-	details := func(p *Provider, c provider.Container) map[string]provider.Attr {
-		attrs, err := p.Details(ctx, c)
-		if err != nil {
-			t.Fatal(err)
-		}
-		out := map[string]provider.Attr{}
-		for _, a := range attrs {
-			out[a.Label] = a
-		}
-		return out
-	}
-
-	p := New(Settings{Dir: root})
-	srcs, _ := p.Sources(ctx)
-	cs, err := p.Containers(ctx, srcs[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	var files []string
-	for _, c := range cs {
-		files = append(files, c.Name+" · "+c.Detail)
-	}
-	if want := []string{
-		"src/main/resources/application-local.properties · spring · properties",
-		"src/main/resources/application.yml · spring · yaml",
-	}; !slices.Equal(files, want) {
-		t.Fatalf("files %v\nwant  %v", files, want)
-	}
-	local, yml := cs[0], cs[1]
-
-	listed, _ := p.Objects(ctx, yml, provider.TypeSecret)
-	keys := shown(listed)
-	var names []string
-	for _, k := range keys {
-		names = append(names, strings.TrimSpace(k.Name+" "+k.Detail))
-	}
-	if len(listed) != 5 || !listed[0].Hidden || listed[0].Name != "server.port" {
-		t.Errorf("hidden keys: %+v", listed)
-	}
-	if want := []string{"spring.datasource.password reference", "jasypt.encryptor.password reference", "app.api-key jasypt"}; !slices.Equal(names, want) {
-		t.Errorf("keys %v, want %v", names, want)
-	}
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "test-password")
-	if v, err := p.Value(ctx, keys[2]); err != nil || v.Reveal() != "hunter2" {
-		t.Errorf("value: %q %v", v.Reveal(), err)
-	}
-	link := provider.Object{Container: provider.Container{Source: srcs[0], Name: "src/main/resources/application.yml"}, Name: "spring.datasource.password"}
-	if v, err := p.Value(ctx, link); err != nil || v.Reveal() != "${DB_PASSWORD}" {
-		t.Errorf("from a link: %q %v", v.Reveal(), err)
-	}
-	if f, _ := p.File(yml, &keys[1]); f.Line != 9 || f.Sops != "" {
-		t.Errorf("file: %+v", f)
-	}
-
-	// References and Jasypt aren't plain text in git; a password is.
-	if d := details(p, yml); d["hidden keys"].Value != "2, not matched by the secret patterns" || d["git"].Warn || d["encryption"].Value != "jasypt: 1 of 5 values" {
-		t.Errorf("yml: %+v", d)
-	}
-	if d := details(p, local); !d["git"].Warn {
-		t.Errorf("local: %+v", d)
-	}
-
-	// The config's patterns, and the repo's over them.
-	all := []string{".*"}
-	p = New(Settings{Dir: root, SecretPatterns: SecretPatterns{Keys: &all}})
-	if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(shown(keys)) != 5 {
-		t.Errorf("every key: %d", len(shown(keys)))
-	}
-	lazysecrets := filepath.Join(root, ".lazysecrets.yaml")
-	os.WriteFile(lazysecrets, []byte("spring:\n  secretPatterns:\n    keys: [\"url$\"]\n    values: []\n"), 0o644)
-	if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(shown(keys)) != 1 || shown(keys)[0].Name != "spring.datasource.url" {
-		t.Errorf("repo's patterns: %v", keys)
-	}
-	os.WriteFile(lazysecrets, []byte("spring:\n  secretPatterns:\n    keys: [\"(\"]\n"), 0o644)
-	if _, err := p.Objects(ctx, yml, provider.TypeSecret); err == nil || !strings.Contains(err.Error(), ".lazysecrets.yaml: spring.secretPatterns.keys[0]") {
-		t.Errorf("bad pattern: %v", err)
-	}
-}
-
-func shown(objects []provider.Object) []provider.Object {
-	return slices.DeleteFunc(slices.Clone(objects), func(o provider.Object) bool { return o.Hidden })
-}
-
-func TestHiddenFiles(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		"a/application.yml": "server:\n  port: 8080\n",
-		"b/application.yml": "spring.datasource.password: x\n",
-	})
-	ctx := context.Background()
-	p := New(Settings{Dir: root})
-	srcs, _ := p.Sources(ctx)
-	if len(srcs) != 1 || srcs[0].Hidden {
-		t.Fatalf("sources: %+v", srcs)
-	}
-	cs, _ := p.Containers(ctx, srcs[0])
-	if len(cs) != 2 || !cs[0].Hidden || cs[1].Hidden {
-		t.Errorf("files: %+v", cs)
-	}
-
-	// A repo with only hidden files is hidden too.
-	root = gitRepo(t, map[string]string{"application.yml": "server:\n  port: 8080\n"})
-	srcs, _ = New(Settings{Dir: root}).Sources(ctx)
-	if len(srcs) != 1 || !srcs[0].Hidden {
-		t.Errorf("hidden repo: %+v", srcs)
-	}
-}

internal/ref/ref.go

@@ -92,9 +92,15 @@ func (r Ref) ContainerName() string {
 // Container.Detail.
 func (r Ref) VaultURL() string { return "https://" + r.Host + "/" }
 
+var collections = map[provider.ObjectType]string{
+	provider.TypeSecret:      "secrets",
+	provider.TypeKey:         "keys",
+	provider.TypeCertificate: "certificates",
+}
+
 func typeOf(collection string) (provider.ObjectType, bool) {
-	for _, t := range []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate} {
+	for t, c := range collections {
-		if strings.EqualFold(t.Collection(), collection) {
+		if strings.EqualFold(c, collection) {
 			return t, true
 		}
 	}
@@ -112,7 +118,7 @@ func (r Ref) IdentifierURL() string {
 	if r.Type == "" {
 		return u + "/"
 	}
-	for _, seg := range []string{r.Type.Collection(), r.Name, r.Version} {
+	for _, seg := range []string{collections[r.Type], r.Name, r.Version} {
 		if seg != "" {
 			u += "/" + url.PathEscape(seg)
 		}
@@ -134,7 +140,7 @@ func (r Ref) String() string {
 		segs = append(segs, r.Scope, r.Name)
 	default:
 		if r.Type != "" {
-			segs = append(segs, r.Type.Collection())
+			segs = append(segs, collections[r.Type])
 		}
 		segs = append(segs, r.Name, r.Version)
 	}
@@ -267,7 +273,7 @@ func parseLink(s string) (Ref, error) {
 	r.Host = strings.ToLower(segs[0])
 	rest := segs[1:]
 
-	switch host := strings.ToLower(u.Host); host {
+	switch strings.ToLower(u.Host) {
 	case "azure":
 		r.Kind = provider.KindAzure
 		if r.Host == "subscriptions" {
@@ -294,11 +300,11 @@ func parseLink(s string) (Ref, error) {
 		}
 	case "databricks", "repo":
 		r.Kind = provider.KindDatabricks
-		if host == "repo" {
+		if strings.EqualFold(u.Host, "repo") {
 			r.Kind = provider.KindRepo
 		}
 		if len(rest) > 2 {
-			return Ref{}, fmt.Errorf("%s link has too many parts", host)
+			return Ref{}, fmt.Errorf("%s link has too many parts", strings.ToLower(u.Host))
 		}
 		if len(rest) > 0 {
 			r.Scope = rest[0]

internal/share/rules.go

@@ -48,11 +48,7 @@ func (r Rules) Check(key []byte) error {
 		needs = append(needs, fmt.Sprintf("%d (minLength)", r.MinLength))
 	}
 	if kinds < r.MinClasses {
-		kind := "kinds"
+		has = append(has, fmt.Sprintf("%d %s of character", kinds, map[bool]string{true: "kind", false: "kinds"}[kinds == 1]))
-		if kinds == 1 {
-			kind = "kind"
-		}
-		has = append(has, fmt.Sprintf("%d %s of character", kinds, kind))
 		needs = append(needs, fmt.Sprintf("%d of lowercase, uppercase, digits and symbols (minClasses)", r.MinClasses))
 	}
 	if len(has) == 0 {

internal/ui/app/app.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"image/color"
+	"math"
 	"os"
 	"os/exec"
 	"strings"
@@ -232,7 +233,6 @@ type Model struct {
 	// provider finds it (provider.Current), before Sources lists them all.
 	current     *provider.Source
 	flatSources bool // Sources pane without provider groups
-	showHidden  bool // H: what providers hide is listed too, dimmed
 	sourcesFavs bool // Sources pane on its Favourites tab
 	history     bool // count uses of items (usage.go)
 	onActive    func()
@@ -470,7 +470,6 @@ func New(providers []provider.Provider, opts Options) Model {
 		Filter:      func(c provider.Container) string { return c.Name },
 		FilterExtra: func(c provider.Container) string { return m.store.Node(storeKey(c)).Note },
 		Render:      m.containerRender(false),
-		Hidden:      func(c provider.Container) bool { return c.Hidden },
 	})
 
 	m.secrets = panes.NewList("[3] Secrets", panes.Item[provider.Object]{
@@ -480,7 +479,6 @@ func New(providers []provider.Provider, opts Options) Model {
 		// Typing "expir" finds what has expired or soon will.
 		FilterExtra: func(o provider.Object) string { return m.store.Node(objectKey(o)).Note + " " + m.expiryWord(o) },
 		Render:      m.objectRender(),
-		Hidden:      func(o provider.Object) bool { return o.Hidden },
 	})
 	m.secrets.Empty = "no secrets"
 	m.objType, m.wantType = provider.TypeSecret, provider.TypeSecret
@@ -727,7 +725,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if m.versionsOf != nil {
 				m.setVersions(msg.items)
 			} else {
-				m.secrets.SetItems(m.starredObjectsFirst(msg.items))
+				m.secrets.SetItems(m.starredFirst(msg.items))
 				cmds = append(cmds, m.refreshShown(before))
 			}
 		}
@@ -982,8 +980,6 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 		m.cycleZoom(-1)
 	case key.Matches(msg, k.SourcesView):
 		m.toggleSourcesView()
-	case key.Matches(msg, k.ToggleHidden):
-		m.toggleHidden()
 	case key.Matches(msg, k.Versions):
 		if m.versionsOf != nil {
 			m.closeVersions()
@@ -1261,7 +1257,7 @@ func (m *Model) showObjects(c provider.Container, key string) tea.Cmd {
 		m.secrets.SetLoading()
 		return m.loadObjects(c, m.objType, key)
 	}
-	m.secrets.SetItems(m.starredObjectsFirst(e.value))
+	m.secrets.SetItems(m.starredFirst(e.value))
 	m.secrets.Select(m.cache.cursor[key])
 	if e.fresh(m.now()) {
 		return nil
@@ -1680,8 +1676,12 @@ func (m *Model) copyText(label, text string, sensitive bool) tea.Cmd {
 
 // clipTick fires when the countdown's displayed second next changes.
 func (m *Model) clipTick() tea.Cmd {
+	wait := m.clipDeadline.Sub(m.now()) % time.Second
+	if wait <= 0 {
+		wait = time.Second
+	}
 	token := m.clipToken
-	return tea.Tick(untilNextSecond(m.clipDeadline, m.now()), func(time.Time) tea.Msg { return clipTickMsg{token: token} })
+	return tea.Tick(wait, func(time.Time) tea.Msg { return clipTickMsg{token: token} })
 }
 
 func (m *Model) cancelClipClear() {
@@ -1788,15 +1788,13 @@ func (m Model) footerView() string {
 	} else if l != nil && l.Filtering() {
 		help = m.helpBar(keys.FilterHelp{Map: m.keys}.ShortHelp(), 2)
 	} else {
-		reveal := "show"
+		revealed := m.detail.State() == panes.ValueShown
-		if m.detail.State() == panes.ValueShown {
+		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), revealed: &revealed}.ShortHelp(), 2)
-			reveal = "hide"
-		}
-		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), reveal: reveal}.ShortHelp(), 2)
 	}
 	var lines []string
 	if !m.clipDeadline.IsZero() {
-		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, secondsLeft(m.clipDeadline, m.now())))))
+		left := max(0, int(math.Ceil(m.clipDeadline.Sub(m.now()).Seconds())))
+		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, left))))
 	}
 	if m.flash.text != "" {
 		lines = append(lines, m.flashLine(m.flash))

internal/ui/app/app_test.go

@@ -1188,7 +1188,7 @@ func TestStatusLineCountsRepos(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, fake.Azure(0), fake.Repos())
 	// The status line, not the pane, which an expired secret's ⚠ fills.
-	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "1 account · 4 repos") {
+	if line := ansi.Strip(d.m.statusLine()); !strings.Contains(line, "1 account · 3 repos") {
 		t.Errorf("status line: %q", line)
 	}
 	d = newDriver(t, fake.Azure(0))
@@ -1344,34 +1344,3 @@ func TestErrorLog(t *testing.T) {
 		t.Errorf("log %+v", d.m.errLog)
 	}
 }
-
-// hiding marks the secret db-password hidden, as the repo provider does
-// a Spring key that doesn't look secret.
-type hiding struct{ provider.Provider }
-
-func (h hiding) Objects(ctx context.Context, c provider.Container, t provider.ObjectType) ([]provider.Object, error) {
-	objs, err := h.Provider.Objects(ctx, c, t)
-	for i := range objs {
-		objs[i].Hidden = objs[i].Name == "db-password"
-	}
-	return objs, err
-}
-
-func TestToggleHidden(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t, hiding{fake.Azure(0)})
-	if _, _, s := d.selected(); s == "db-password" || s == "" {
-		t.Fatalf("selected %q: the hidden one, or none", s)
-	}
-	if strings.Contains(d.screen(), "db-password") || !strings.Contains(d.screen(), "1 hidden") {
-		t.Fatalf("hidden one listed:\n%s", d.screen())
-	}
-	d.keys("H")
-	if !strings.Contains(d.screen(), "db-password") || !strings.Contains(d.screen(), "showing hidden") {
-		t.Fatalf("H doesn't show it:\n%s", d.screen())
-	}
-	d.keys("H")
-	if strings.Contains(d.screen(), "db-password") {
-		t.Fatalf("H again doesn't hide it:\n%s", d.screen())
-	}
-}

internal/ui/app/commands.go

@@ -306,6 +306,3 @@ func newTextInput(prompt string, width int) textinput.Model {
 	in.SetWidth(width)
 	return in
 }
-
-// pathInputWidth fits a link or a folder path in a prompt, in the window.
-func (m Model) pathInputWidth() int { return max(20, min(m.w-12, 64)) }

internal/ui/app/favourites.go

@@ -6,7 +6,6 @@ import (
 	"time"
 
 	tea "charm.land/bubbletea/v2"
-	"github.com/charmbracelet/x/ansi"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/expiry"
@@ -97,22 +96,27 @@ func (m *Model) refreshContext(key, name string, path []string, src provider.Sou
 // containerRender draws a vault or scope, starred or not. In the
 // Opened links list it also names the source, since they come from many.
 func (m Model) containerRender(withSource bool) func(styles.Styles, provider.Container, int) string {
-	st := m.store
+	st, iconSet := m.store, m.icons
 	return func(sty styles.Styles, c provider.Container, width int) string {
 		n := st.Node(storeKey(c))
 		line := c.Name
 		if c.Source.Kind == provider.KindRepo {
-			// A secret file: its icon, and its type after it ("sops ·
+			// A secret file: a lock for an encrypted one, a file in the
-			// age", "env · plain text").
+			// warning colour for plain text, and its type after it
-			if icon := m.fileIcon(sty, c); icon != "" {
+			// ("sops · age", "env · plain text").
-				line = icon + " " + line
+			icon, style := iconSet.Encrypted, sty.KindRepo
+			if !strings.HasPrefix(c.Detail, "sops") {
+				icon, style = iconSet.PlainFile, sty.Warning
+			}
+			if icon != "" {
+				line = style.Render(icon) + " " + line
 			}
 			line += sty.Muted.Render("  " + c.Detail)
 		}
-		line = dimIf(sty, c.Hidden, marks(sty, n, c.Source.Provider, m.recentIcon, m.now())+line)
+		line = marks(sty, n, c.Source.Provider, m.recentIcon, m.now()) + line
 		if withSource {
 			src := c.Source.Name
-			if account := accountOf(c.Source); account != "" {
+			if account, ok := strings.CutPrefix(c.Source.ProviderLabel, string(c.Source.Kind)+" · "); ok {
 				src = account + " / " + src
 			}
 			line += sty.Muted.Render(" · " + src)
@@ -130,10 +134,6 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 			line = sty.Muted.Render(o.Name + " (disabled)")
 		}
 		line = marks(sty, n, o.Container.Source.Provider, m.recentIcon, m.now()) + line
-		if o.Detail != "" {
-			line += sty.Muted.Render("  " + o.Detail)
-		}
-		line = dimIf(sty, o.Hidden, line)
 		switch state, left := m.expiry(o); state {
 		case expiry.Expired:
 			line += " " + sty.Error.Render("✗ expired")
@@ -144,69 +144,24 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 	}
 }
 
-// fileIcon is a repo file's icon, in its colour: a lock for an encrypted
+// starredContainersFirst moves starred vaults and scopes to the front,
-// one, a leaf for Spring config, a whale for compose, .NET's for
+// keeping the order otherwise. It doesn't modify items, which may be cached.
-// appsettings, a file in the warning colour for plain text; "" for other vaults, or without icons.
+func (m Model) starredContainersFirst(items []provider.Container) []provider.Container {
-func (m Model) fileIcon(sty styles.Styles, c provider.Container) string {
-	if c.Source.Kind != provider.KindRepo {
-		return ""
-	}
-	icon, style := m.icons.Encrypted, sty.KindRepo
-	switch {
-	case strings.HasPrefix(c.Detail, "spring"):
-		icon, style = m.icons.Spring, sty.Spring
-	case strings.HasPrefix(c.Detail, "compose"):
-		icon, style = m.icons.Compose, sty.Compose
-	case strings.HasPrefix(c.Detail, "dotnet"):
-		icon, style = m.icons.Dotnet, sty.Dotnet
-	case !strings.HasPrefix(c.Detail, "sops"):
-		icon, style = m.icons.PlainFile, sty.Warning
-	}
-	if icon == "" {
-		return ""
-	}
-	return style.Render(icon)
-}
-
-// dimIf draws a hidden item's row (shown with H) in the muted colour,
-// whole, so it stands apart from what's listed by the provider's rules.
-func dimIf(sty styles.Styles, hidden bool, line string) string {
-	if !hidden {
-		return line
-	}
-	return sty.Muted.Render(ansi.Strip(line))
-}
-
-// starredFirst moves starred items to the front, keeping the order
-// otherwise. It doesn't modify items, which may be cached.
-func starredFirst[T any](items []T, starred func(T) bool) []T {
-	rank := func(x T) int {
-		if starred(x) {
-			return 0
-		}
-		return 1
-	}
 	out := slices.Clone(items)
-	slices.SortStableFunc(out, func(a, b T) int { return rank(a) - rank(b) })
+	slices.SortStableFunc(out, func(a, b provider.Container) int {
+		return boolRank(m.store.Node(storeKey(a)).StarredFor(a.Source.Provider)) - boolRank(m.store.Node(storeKey(b)).StarredFor(b.Source.Provider))
+	})
 	return out
 }
 
-func (m Model) starredSourcesFirst(sources []provider.Source) []provider.Source {
+// starredFirst moves starred objects to the front, keeping the order
-	return starredFirst(sources, func(s provider.Source) bool {
+// otherwise. It doesn't modify items, which may be cached.
-		return m.store.Node(sourceKey(s)).StarredFor(s.Provider)
+func (m Model) starredFirst(items []provider.Object) []provider.Object {
-	})
+	out := slices.Clone(items)
-}
+	slices.SortStableFunc(out, func(a, b provider.Object) int {
-
+		return boolRank(m.store.Node(objectKey(a)).StarredFor(a.Container.Source.Provider)) - boolRank(m.store.Node(objectKey(b)).StarredFor(b.Container.Source.Provider))
-func (m Model) starredContainersFirst(items []provider.Container) []provider.Container {
-	return starredFirst(items, func(c provider.Container) bool {
-		return m.store.Node(storeKey(c)).StarredFor(c.Source.Provider)
-	})
-}
-
-func (m Model) starredObjectsFirst(items []provider.Object) []provider.Object {
-	return starredFirst(items, func(o provider.Object) bool {
-		return m.store.Node(objectKey(o)).StarredFor(o.Container.Source.Provider)
 	})
+	return out
 }
 
 // showLinkedContainers lists the vaults opened from links.
@@ -244,7 +199,7 @@ func (m *Model) resortStarred() {
 		m.containers.SetItems(m.starredContainersFirst(m.containers.Items()))
 	}
 	if m.versionsOf == nil {
-		m.secrets.SetItems(m.starredObjectsFirst(m.secrets.Items()))
+		m.secrets.SetItems(m.starredFirst(m.secrets.Items()))
 	}
 }
 
@@ -290,7 +245,7 @@ func (m *Model) toggleFavourite() tea.Cmd {
 		c := o.Container
 		toggle := func(n *store.Node) { on = n.ToggleStar(c.Source.Provider) }
 		if err = m.remember(objectKey(o), o.Name, []string{c.Source.Name, c.Name}, c.Source, toggle); err == nil {
-			m.secrets.SetItems(m.starredObjectsFirst(m.secrets.Items()))
+			m.secrets.SetItems(m.starredFirst(m.secrets.Items()))
 		}
 	}
 	switch {

internal/ui/app/help.go

@@ -39,9 +39,10 @@ type contextHelp struct {
 	commands bool // custom commands apply here
 	account  bool // the fourth pane shows Fields (fields.go)
 	of       pane // what the fourth pane describes
-	// reveal, when set, is what the reveal key will do, "show" or "hide":
+	// revealed, when set, says whether the selected value is shown, so
-	// the same width so the bar doesn't shift.
+	// the reveal key says just what it'll do: show or hide, the same
-	reveal string
+	// width so the bar doesn't shift.
+	revealed *bool
 }
 
 func (c contextHelp) ShortHelp() []key.Binding {
@@ -69,8 +70,8 @@ func (c contextHelp) ShortHelp() []key.Binding {
 		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Open, k.Filter)
 	default:
 		reveal := k.Reveal
-		if c.reveal != "" {
+		if c.revealed != nil {
-			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, c.reveal))
+			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, map[bool]string{false: "show", true: "hide"}[*c.revealed]))
 		}
 		b = append(b, reveal, k.Copy, k.Share, k.ShareMenu, k.Versions, k.Favourite, k.Filter)
 	}
@@ -258,7 +259,11 @@ func hint(b key.Binding, desc string) keyHint { return keyHint{keys.Name(b), des
 
 // move is "↑/↓ move" for an up and a down binding.
 func move(up, down key.Binding) keyHint {
-	return keyHint{joinKeys(up, down), "move"}
+	u, d := keys.Name(up), keys.Name(down)
+	if u == "" || d == "" {
+		return keyHint{u + d, "move"}
+	}
+	return keyHint{u + "/" + d, "move"}
 }
 
 // withKey fills a hint's format with the binding's key ("· %s loads

internal/ui/app/jump.go

@@ -38,16 +38,14 @@ func (m *Model) storeEntries() (favs, recent []option) {
 			return nil
 		}
 		var out []entry
-		detail := m.objectDetail(key)
 		add := func(path []string, acct string, depth int, run func(*Model) tea.Cmd) {
 			account := ""
 			if p, ok := m.byID[acct]; ok {
 				account = accountOf(provider.Source{Kind: p.Kind(), ProviderLabel: p.Label()})
 			}
-			account = strings.Trim(detail+" · "+account, " ·")
 			sort := strings.ToLower(strings.Join(path, "/")) + " " + account
 			out = append(out, entry{depth, sort, option{
-				label: m.pathLabel(r.Kind, path, account, m.refFileIcon(r)), note: n.Note, mark: " ",
+				label: m.pathLabel(r.Kind, path, account), note: n.Note, mark: " ",
 				id: prefix + key + "|" + acct, star: key, starAccount: acct, starred: n.StarredFor(acct),
 				plain: m.inPlainEnv(r),
 				run: func(m *Model) tea.Cmd {
@@ -128,15 +126,12 @@ const recentMax = 20
 
 // pathLabel draws a jump list entry: the provider's icon and the path in
 // its colour, then the account.
-func (m Model) pathLabel(kind provider.Kind, path []string, account, fileIcon string) string {
+func (m Model) pathLabel(kind provider.Kind, path []string, account string) string {
 	style := m.st.Kind(kind)
 	parts := make([]string, len(path))
 	for i, p := range path {
 		parts[i] = style.Render(p)
 	}
-	if fileIcon != "" && len(parts) > 1 {
-		parts[1] = fileIcon + " " + parts[1]
-	}
 	label := style.Render(m.icons.Prefix(kind)) + strings.Join(parts, m.st.Muted.Render(" / "))
 	if account != "" {
 		label += m.st.Muted.Render(" · " + account)
@@ -147,53 +142,25 @@ func (m Model) pathLabel(kind provider.Kind, path []string, account, fileIcon st
 // inPlainEnv reports whether r is a key in a plain env file, as far as
 // the files loaded tell.
 func (m Model) inPlainEnv(r ref.Ref) bool {
-	c, ok := m.repoFile(r)
+	if r.Kind != provider.KindRepo || r.Name == "" {
-	return ok && r.Name != "" && c.Detail == provider.DetailPlainEnv
+		return false
-}
-
-// repoFile is the repo file r is or is in, as far as the files loaded
-// tell.
-func (m Model) repoFile(r ref.Ref) (provider.Container, bool) {
-	if r.Kind != provider.KindRepo || r.IsSource() {
-		return provider.Container{}, false
 	}
 	file := r
 	file.Name, file.Type = "", ""
 	for _, e := range m.cache.containers {
 		for _, c := range e.value {
-			if storeKey(c) == file.String() {
+			if c.Detail == provider.DetailPlainEnv && storeKey(c) == file.String() {
-				return c, true
+				return true
 			}
 		}
 	}
-	return provider.Container{}, false
+	return false
-}
-
-// refFileIcon is the icon of the repo file r is or is in, if it's loaded.
-func (m Model) refFileIcon(r ref.Ref) string {
-	if c, ok := m.repoFile(r); ok {
-		return m.fileIcon(m.st, c)
-	}
-	return ""
-}
-
-// objectDetail is the Detail of the secret with the store key key, as far
-// as the lists loaded tell.
-func (m Model) objectDetail(key string) string {
-	for _, e := range m.cache.objects {
-		for _, o := range e.value {
-			if o.Detail != "" && objectKey(o) == key {
-				return o.Detail
-			}
-		}
-	}
-	return ""
 }
 
 // repoLabel draws a repo, or a file in it, as everywhere else: the repo
 // icon and colour, "app / apps/api/.env".
 func (m Model) repoLabel(repo string, file ...string) string {
-	return m.pathLabel(provider.KindRepo, append([]string{repo}, file...), "", "")
+	return m.pathLabel(provider.KindRepo, append([]string{repo}, file...), "")
 }
 
 // sourceMatches reports whether src is the subscription or workspace r
@@ -232,7 +199,18 @@ func (m *Model) jumpTo(r ref.Ref, n store.Node) tea.Cmd {
 		m.startNav(r, actGo, sourceRowKey(n.Account, n.Source))
 		return nil
 	}
-	choices := m.openWith(r.Kind, func(src provider.Source) bool { return src.ID == n.Source && n.Source != "" })
+	var choices []choice
+	for _, p := range m.providers {
+		if p.Kind() != r.Kind {
+			continue
+		}
+		for _, src := range m.sourceResults[p.ID()].sources {
+			if src.ID == n.Source && n.Source != "" {
+				row := sourceRowKey(p.ID(), src.ID)
+				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
+			}
+		}
+	}
 	switch len(choices) {
 	case 0:
 		return m.openRef(r, actGo)

internal/ui/app/links.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
@@ -209,7 +210,18 @@ const defaultResolveTimeout = 30 * time.Second
 // openSource goes to a subscription or workspace, asking which account
 // when several list it. Sources are loaded already, so it needs no lookup.
 func (m *Model) openSource(r ref.Ref) {
-	choices := m.openWith(r.Kind, func(src provider.Source) bool { return sourceMatches(r, src) })
+	var choices []choice
+	for _, p := range m.providers {
+		if p.Kind() != r.Kind {
+			continue
+		}
+		for _, src := range m.sourceResults[p.ID()].sources {
+			if sourceMatches(r, src) {
+				row := sourceRowKey(p.ID(), src.ID)
+				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
+			}
+		}
+	}
 	if row, ok := preferredRow(r, choices); ok {
 		choices = []choice{{sourceRow: row}}
 	}
@@ -231,24 +243,6 @@ func (m *Model) openSource(r ref.Ref) {
 	}
 }
 
-// openWith offers each loaded source of kind that matches, one per
-// account that lists it.
-func (m Model) openWith(kind provider.Kind, matches func(provider.Source) bool) []choice {
-	var choices []choice
-	for _, p := range m.providers {
-		if p.Kind() != kind {
-			continue
-		}
-		for _, src := range m.sourceResults[p.ID()].sources {
-			if matches(src) {
-				row := sourceRowKey(p.ID(), src.ID)
-				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
-			}
-		}
-	}
-	return choices
-}
-
 // refLabel draws what a link points at like the favourites list: the
 // provider's icon and the path in its colour, "󰠅 platform-prod /
 // kv-app-prod / api-key", with the type and version after it. The
@@ -269,7 +263,7 @@ func (m Model) refLabel(r ref.Ref) string {
 	default:
 		path = append(path, r.ContainerName(), r.Name)
 	}
-	label := m.pathLabel(r.Kind, path, "", m.refFileIcon(r))
+	label := m.pathLabel(r.Kind, path, "")
 	var extra []string
 	if t := strings.ToLower(pluralLabels[r.Type]); t != "" && r.Type != provider.TypeSecret {
 		if r.IsContainer() {
@@ -837,8 +831,10 @@ func (m *Model) shareObject(o provider.Object, k string) tea.Cmd {
 }
 
 func (m *Model) startOpenPrompt() tea.Cmd {
-	in := newTextInput("open: ", m.pathInputWidth())
+	in := textinput.New()
+	in.Prompt = "open: "
 	in.Placeholder = "lazysecrets:// link, Key Vault URL or reference"
+	in.SetWidth(max(20, min(m.w-12, 64)))
 	m.prompt = &modal{
 		title: "Open a link", input: &in,
 		lines:  []string{m.st.Muted.Render("lazysecrets:// link, Key Vault URL or reference")},

internal/ui/app/modal.go

@@ -75,8 +75,10 @@ type modal struct {
 
 // showFilterMenu opens a menu with a filter input above the options.
 func (m *Model) showFilterMenu(title string, options []option) tea.Cmd {
-	in := newTextInput("/", 40)
+	in := textinput.New()
+	in.Prompt = "/"
 	in.Placeholder = "type to filter"
+	in.SetWidth(40)
 	m.prompt = &modal{title: title, options: options, all: options, filter: &in}
 	m.prompt.move(0)
 	m.flash = flash{}

internal/ui/app/notes.go

@@ -3,6 +3,7 @@ package app
 import (
 	"strings"
 
+	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
@@ -57,9 +58,11 @@ func (m *Model) editNote() tea.Cmd {
 		c := o.Container
 		key, name, path, src = objectKey(o), o.Name, []string{c.Source.Name, c.Name}, c.Source
 	}
-	in := newTextInput("note: ", 48)
+	in := textinput.New()
+	in.Prompt = "note: "
 	in.Placeholder = "e.g. prod SQL admin"
 	in.CharLimit = 80
+	in.SetWidth(48)
 	in.SetValue(m.store.Node(key).Note)
 	in.CursorEnd()
 	m.prompt = &modal{

internal/ui/app/persist.go

@@ -29,43 +29,41 @@ type persistTickMsg struct{}
 
 type persistedMsg struct{ err error }
 
-// keepers report whether a provider ID, or a cache key's, is an account
+// keepCached reports whether a cache key's account still exists and
-// that still exists and isn't a repo.
+// isn't a repo: every key starts with the provider ID.
-func (m *Model) keepers() (keep, keepKey func(string) bool) {
+func (m *Model) keepCached(key string) bool { return m.keepProvider(cachefile.ProviderOf(key)) }
-	keep = cachefile.Keep(m.providers)
+
-	return keep, func(key string) bool { return keep(cachefile.ProviderOf(key)) }
+func (m *Model) keepProvider(id string) bool { return cachefile.Keep(m.providers)(id) }
-}
 
 // loadCacheFile fills the cache from the file, leaving out what's too
 // old or belongs to accounts that aren't signed in any more.
 func (m *Model) loadCacheFile() {
 	f := cachefile.Read(m.cachePath)
-	keep, keepKey := m.keepers()
 	now := m.now()
 	recent := func(at time.Time) bool { return now.Sub(at) < cachefile.MaxAge }
 	for id, e := range f.Sources {
-		if keep(id) && recent(e.At) {
+		if m.keepProvider(id) && recent(e.At) {
 			m.sourceResults[id] = sourcesMsg{gen: m.sourcesGen, provider: id, sources: e.Value}
 			m.sourcesAt[id] = e.At
 		}
 	}
 	for k, e := range f.Containers {
-		if keepKey(k) && recent(e.At) {
+		if m.keepCached(k) && recent(e.At) {
 			m.cache.containers[k] = entry[[]provider.Container]{e.Value, e.At}
 		}
 	}
 	for k, e := range f.Objects {
-		if keepKey(k) && recent(e.At) {
+		if m.keepCached(k) && recent(e.At) {
 			m.cache.objects[k] = entry[[]provider.Object]{e.Value, e.At}
 		}
 	}
 	for k, e := range f.Details {
-		if keepKey(k) && recent(e.At) {
+		if m.keepCached(k) && recent(e.At) {
 			m.cache.details[k] = entry[provider.Object]{e.Value, e.At}
 		}
 	}
 	for k, v := range f.Cursor {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			m.cache.cursor[k] = v
 		}
 	}
@@ -74,30 +72,29 @@ func (m *Model) loadCacheFile() {
 // cacheSnapshot is the cache as the file holds it.
 func (m *Model) cacheSnapshot() cachefile.File {
 	f := cachefile.New()
-	keep, keepKey := m.keepers()
 	f.Dropped, m.cacheDropped = m.cacheDropped, nil
 	for id, r := range m.sourceResults {
-		if r.err == nil && keep(id) {
+		if r.err == nil && m.keepProvider(id) {
 			f.Sources[id] = cachefile.Stamped[[]provider.Source]{At: m.sourcesAt[id], Value: r.sources}
 		}
 	}
 	for k, e := range m.cache.containers {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Containers[k] = cachefile.Stamped[[]provider.Container]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.objects {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Objects[k] = cachefile.Stamped[[]provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.details {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Details[k] = cachefile.Stamped[provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, v := range m.cache.cursor {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Cursor[k] = v
 		}
 	}

internal/ui/app/reveal.go

@@ -28,22 +28,12 @@ func (m *Model) startRevealTimer() tea.Cmd {
 
 // revealTickCmd fires when the displayed second next changes.
 func (m *Model) revealTickCmd() tea.Cmd {
-	token := m.revealToken
+	wait := m.revealDeadline.Sub(m.now()) % time.Second
-	return tea.Tick(untilNextSecond(m.revealDeadline, m.now()), func(time.Time) tea.Msg { return revealTickMsg{token} })
+	if wait <= 0 {
-}
+		wait = time.Second
-
-// untilNextSecond is how long until a countdown to deadline shows its
-// next whole second.
-func untilNextSecond(deadline, now time.Time) time.Duration {
-	if wait := deadline.Sub(now) % time.Second; wait > 0 {
-		return wait
 	}
-	return time.Second
+	token := m.revealToken
-}
+	return tea.Tick(wait, func(time.Time) tea.Msg { return revealTickMsg{token} })
-
-// secondsLeft is a countdown to deadline, in whole seconds rounded up.
-func secondsLeft(deadline, now time.Time) int {
-	return max(0, int(math.Ceil(deadline.Sub(now).Seconds())))
 }
 
 func (m *Model) revealTick(msg revealTickMsg) tea.Cmd {
@@ -59,7 +49,8 @@ func (m *Model) revealTick(msg revealTickMsg) tea.Cmd {
 }
 
 func (m *Model) showHidesIn() {
-	m.detail.SetHidesIn(fmt.Sprintf("%ds", secondsLeft(m.revealDeadline, m.now())))
+	left := max(0, int(math.Ceil(m.revealDeadline.Sub(m.now()).Seconds())))
+	m.detail.SetHidesIn(fmt.Sprintf("%ds", left))
 }
 
 // hideValue hides the revealed value and stops its countdown.

internal/ui/app/search.go

@@ -8,7 +8,6 @@ import (
 	"strings"
 
 	tea "charm.land/bubbletea/v2"
-	"github.com/charmbracelet/x/ansi"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
@@ -58,63 +57,49 @@ func (m *Model) searchEntries() (sources, items []option) {
 	var es []entry
 	// key is the store key, so ctrl+f stars the entry; mark shows how
 	// much is loaded, reload (ctrl+r) loads it again.
-	add := func(depth int, row string, kind provider.Kind, path []string, account, fileIcon, key, mark string, run, reload func(*Model) tea.Cmd) *option {
+	add := func(depth int, row string, kind provider.Kind, path []string, account, key, mark string, run, reload func(*Model) tea.Cmd) *option {
 		n := m.store.Node(key)
 		sort := strings.ToLower(strings.Join(path, "/")) + " " + account
 		es = append(es, entry{depth, sort,
-			option{label: m.pathLabel(kind, path, account, fileIcon), note: n.Note, star: key,
+			option{label: m.pathLabel(kind, path, account), note: n.Note, star: key,
 				starAccount: cachefile.ProviderOf(row), starred: n.StarredFor(cachefile.ProviderOf(row)),
 				mark: mark, run: run, reload: reload, id: sort, group: row, kind: kind}})
 		return &es[len(es)-1].opt
 	}
-	// What providers hide is left out, unless H shows it, dimmed.
-	skip := func(hidden bool) bool { return hidden && !m.showHidden }
-	dim := func(hidden bool, e *option) {
-		if hidden {
-			e.label = m.st.Muted.Render(ansi.Strip(e.label))
-		}
-	}
 	for _, p := range m.providers {
 		for _, src := range m.sourceResults[p.ID()].sources {
-			if skip(src.Hidden) {
-				continue
-			}
 			src.Provider, src.ProviderLabel = p.ID(), p.Label()
 			row := sourceRowKey(p.ID(), src.ID)
-			dim(src.Hidden, add(0, row, src.Kind, []string{src.Name}, accountOf(src), "", sourceKey(src), m.sourceMark(row), func(m *Model) tea.Cmd {
+			add(0, row, src.Kind, []string{src.Name}, accountOf(src), sourceKey(src), m.sourceMark(row), func(m *Model) tea.Cmd {
 				m.nav = &nav{sourceRow: row, sourceOnly: true}
 				return nil
-			}, func(m *Model) tea.Cmd { return m.loadSource(src) }))
+			}, func(m *Model) tea.Cmd { return m.loadSource(src) })
 			for _, c := range m.cache.containers[row].value {
-				if skip(c.Hidden) {
-					continue
-				}
 				r, err := ref.ForContainer(c, provider.TypeSecret)
 				if err != nil {
 					continue
 				}
 				reload := func(m *Model) tea.Cmd { return m.loadContainer(c) }
-				dim(c.Hidden, add(1, row, c.Source.Kind, []string{src.Name, c.Name}, accountOf(src), m.fileIcon(m.st, c), storeKey(c), m.vaultMark(c), func(m *Model) tea.Cmd {
+				add(1, row, c.Source.Kind, []string{src.Name, c.Name}, accountOf(src), storeKey(c), m.vaultMark(c), func(m *Model) tea.Cmd {
 					m.startNav(r, actGo, row)
 					return nil
-				}, reload))
+				}, reload)
 				for _, t := range []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate} {
 					for _, o := range m.cache.objects[cachefile.ObjectsKey(c, t)].value {
 						r, err := ref.ForObject(o, "")
-						if err != nil || skip(o.Hidden) {
+						if err != nil {
 							continue
 						}
-						suffix := strings.Trim(o.Detail+" · "+accountOf(src), " ·")
+						suffix := accountOf(src)
 						if t != provider.TypeSecret {
 							typ := strings.TrimSuffix(strings.ToLower(pluralLabels[t]), "s") // "key"
 							suffix = strings.Trim(typ+" · "+suffix, " ·")
 						}
-						e := add(2, row, c.Source.Kind, []string{src.Name, c.Name, o.Name}, suffix, m.fileIcon(m.st, c), objectKey(o), " ", func(m *Model) tea.Cmd {
+						e := add(2, row, c.Source.Kind, []string{src.Name, c.Name, o.Name}, suffix, objectKey(o), " ", func(m *Model) tea.Cmd {
 							m.startNav(r, actGo, row)
 							return nil
 						}, reload)
 						e.plain = c.Detail == provider.DetailPlainEnv
-						dim(o.Hidden, e)
 					}
 				}
 			}
@@ -356,19 +341,6 @@ func (m *Model) handleCrawl(msg crawlMsg) tea.Cmd {
 	return cmd
 }
 
-// vaultsLoaded counts the vaults whose secrets are cached or can't be
-// read, and says whether any are loading.
-func (m *Model) vaultsLoaded(vaults []provider.Container) (loaded int, loading bool) {
-	for _, c := range vaults {
-		key := cachefile.ObjectsKey(c, provider.TypeSecret)
-		loading = loading || m.crawl.pending[key]
-		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
-			loaded++
-		}
-	}
-	return loaded, loading
-}
-
 // sourceMark shows how much of a subscription or workspace is loaded:
 // ○ nothing, ◐ some vaults, ● every vault, ◌ loading, ✗ unreadable.
 func (m *Model) sourceMark(row string) string {
@@ -382,7 +354,14 @@ func (m *Model) sourceMark(row string) string {
 	if !ok {
 		return m.st.Muted.Render("○")
 	}
-	loaded, loading := m.vaultsLoaded(e.value)
+	loaded, loading := 0, false
+	for _, c := range e.value {
+		key := cachefile.ObjectsKey(c, provider.TypeSecret)
+		loading = loading || m.crawl.pending[key]
+		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
+			loaded++
+		}
+	}
 	switch {
 	case loading:
 		return m.st.Muted.Render("◌")

internal/ui/app/searchview.go

@@ -95,7 +95,9 @@ func (m *Model) showFavourites() tea.Cmd { return m.openGoTo(tabFavs, false) }
 func (m *Model) showRecent() tea.Cmd     { return m.openGoTo(tabRecent, false) }
 
 func (m *Model) openGoTo(tab int, typing bool) tea.Cmd {
-	in := newTextInput("/", searchWidth(m.w)-6) // as wide as the popup
+	in := textinput.New()
+	in.Prompt = "/"
+	in.SetWidth(searchWidth(m.w) - 6) // as wide as the popup
 	v := &searchView{input: in, tab: tab, results: true}
 	v.favs, v.recent = m.storeEntries()
 	m.search = v
@@ -614,7 +616,13 @@ func (m Model) loadHint() string {
 		}
 		return m.st.Warning.Render("⚠ not loaded" + withKey(m.loadKey(), " · %s loads "+name))
 	}
-	loaded, _ := m.vaultsLoaded(e.value)
+	loaded := 0
+	for _, c := range e.value {
+		key := cachefile.ObjectsKey(c, provider.TypeSecret)
+		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
+			loaded++
+		}
+	}
 	if loaded == len(e.value) {
 		return ""
 	}
@@ -762,7 +770,7 @@ func (m Model) searchViewBox() string {
 				body = append(body, " "+m.st.Error.Render(l))
 			}
 		}
-		body = append(body, "", " "+panes.Tabs(m.st, ts, tabNames[:], m.search.tab))
+		body = append(body, "", " "+m.goToTabs(ts))
 	}
 	body = append(body, " "+v.input.View(), "")
 	for _, l := range strings.Split(lists, "\n") {
@@ -795,7 +803,7 @@ func (m Model) searchViewBox() string {
 	// Tabs in the title, the current one underlined, like the panes; a
 	// picker has its own title, and the tabs over the input.
 	if v.picker == nil {
-		head := ts.Render(goToTitle+" ") + panes.Tabs(m.st, ts, tabNames[:], m.search.tab)
+		head := ts.Render(goToTitle+" ") + m.goToTabs(ts)
 		return panes.Box(m.st, head, foot, body, w, len(body)+2, focused)
 	}
 	// A picker: in its own border, under what it's for.
@@ -848,3 +856,19 @@ func pickable(o option) (ref.Ref, bool) {
 	}
 	return r, true
 }
+
+// goToTabs draws Go to's tabs, the current one underlined.
+func (m Model) goToTabs(ts lipgloss.Style) string {
+	var out string
+	for i, name := range tabNames {
+		if i > 0 {
+			out += ts.Render(" - ")
+		}
+		if i == m.search.tab {
+			out += ts.Underline(true).Render(name)
+		} else {
+			out += m.st.Muted.Render(name)
+		}
+	}
+	return out
+}

internal/ui/app/sharefiles.go

@@ -10,6 +10,7 @@ import (
 	"slices"
 	"strings"
 
+	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
@@ -71,7 +72,7 @@ func (m *Model) shareFiles(src provider.Source, cs []provider.Container) tea.Cmd
 				return msg
 			}
 			for _, c := range all {
-				if c.Detail == provider.DetailPlainEnv && !c.Hidden { // not .env.example
+				if c.Detail == provider.DetailPlainEnv {
 					cs = append(cs, c)
 				}
 			}
@@ -337,7 +338,9 @@ func (m *Model) openFailed(s share.Sealed, err error, whole bool) {
 // askShareDir asks where to save files from a repo that isn't here. It
 // stays until they're saved, saying why when they can't be.
 func (m *Model) askShareDir(msg shareOpenedMsg) tea.Cmd {
-	in := newTextInput("folder: ", m.pathInputWidth())
+	in := textinput.New()
+	in.Prompt = "folder: "
+	in.SetWidth(max(20, min(m.w-12, 64)))
 	dir := m.placeDir
 	if dir == "" {
 		dir, _ = os.Getwd()

internal/ui/app/sources.go

@@ -59,7 +59,6 @@ func sourceRowID(r sourceRow) string {
 }
 
 func newSourcesList(iconSet icons.Set, mem *store.Store, recent bool) panes.List[sourceRow] {
-	render := renderSourceRow(iconSet, mem, recent)
 	return panes.NewList("[1] Sources", panes.Item[sourceRow]{
 		ID: sourceRowID,
 		// Headers have no filter text, so filtering shows just sources.
@@ -78,48 +77,40 @@ func newSourcesList(iconSet icons.Set, mem *store.Store, recent bool) panes.List
 			return cmp.Or(r.source.ProviderLabel, string(r.group)) + " " + mem.Node(sourceKey(r.source)).Note
 		},
 		Render: func(st styles.Styles, r sourceRow, width int) string {
-			return dimIf(st, r.kind == rowSource && r.source.Hidden, render(st, r, width))
+			node := mem.Node(sourceKey(r.source))
+			kind := st.Kind(r.group)
+			starred := ""
+			if r.kind == rowSource {
+				starred = marks(st, node, r.source.Provider, recent, time.Now())
+			}
+			switch {
+			case r.kind == rowLinks:
+				return st.Notice.Render("↗ Opened links") + " " + st.Muted.Render(fmt.Sprintf("(%s)", r.status))
+			case r.kind == rowSource && r.top:
+				return withNote(st, kind.Render(iconSet.Prefix(r.group)+"Repo · ")+starred+kind.Render(r.source.Name), node.Note, width)
+			case r.kind == rowSource && r.flat:
+				line := kind.Render(iconSet.Prefix(r.group)+fmt.Sprintf("%-10s", r.group)) + " " + starred + r.source.Name
+				if r.account != "" {
+					line += st.Muted.Render(" · " + r.account)
+				}
+				return withNote(st, line+here(st, r.source), node.Note, width)
+			case r.kind == rowSource:
+				// The provider's colour, so long groups stay recognisable.
+				return withNote(st, "  "+starred+kind.Render(r.source.Name), node.Note, width)
+			}
+			arrow := "▾"
+			if r.collapsed {
+				arrow = "▸"
+			}
+			status := st.Muted.Render(fmt.Sprintf("(%s)", r.status))
+			if r.status == "!" {
+				status = st.Error.Render("(!)")
+			}
+			return kind.Render(arrow+" "+iconSet.Prefix(r.group)+r.label) + " " + status
 		},
 	})
 }
 
-// renderSourceRow draws a source, a provider's header or the Opened links
-// row.
-func renderSourceRow(iconSet icons.Set, mem *store.Store, recent bool) func(styles.Styles, sourceRow, int) string {
-	return func(st styles.Styles, r sourceRow, width int) string {
-		node := mem.Node(sourceKey(r.source))
-		kind := st.Kind(r.group)
-		starred := ""
-		if r.kind == rowSource {
-			starred = marks(st, node, r.source.Provider, recent, time.Now())
-		}
-		switch {
-		case r.kind == rowLinks:
-			return st.Notice.Render("↗ Opened links") + " " + st.Muted.Render(fmt.Sprintf("(%s)", r.status))
-		case r.kind == rowSource && r.top:
-			return withNote(st, kind.Render(iconSet.Prefix(r.group)+"Repo · ")+starred+kind.Render(r.source.Name), node.Note, width)
-		case r.kind == rowSource && r.flat:
-			line := kind.Render(iconSet.Prefix(r.group)+fmt.Sprintf("%-10s", r.group)) + " " + starred + r.source.Name
-			if r.account != "" {
-				line += st.Muted.Render(" · " + r.account)
-			}
-			return withNote(st, line+here(st, r.source), node.Note, width)
-		case r.kind == rowSource:
-			// The provider's colour, so long groups stay recognisable.
-			return withNote(st, "  "+starred+kind.Render(r.source.Name), node.Note, width)
-		}
-		arrow := "▾"
-		if r.collapsed {
-			arrow = "▸"
-		}
-		status := st.Muted.Render(fmt.Sprintf("(%s)", r.status))
-		if r.status == "!" {
-			status = st.Error.Render("(!)")
-		}
-		return kind.Render(arrow+" "+iconSet.Prefix(r.group)+r.label) + " " + status
-	}
-}
-
 // rebuildSources lays out the Sources pane from the per-provider results.
 func (m *Model) rebuildSources() {
 	// While filtering, headers drop out, so rows show their provider and
@@ -138,16 +129,20 @@ func (m *Model) rebuildSources() {
 	}
 	// The repo lazysecrets started in gets a row of its own on top, so it
 	// opens on it; flat, it sorts first instead.
-	if src, ok := m.currentSource(); ok && !flat && (!src.Hidden || m.showHidden) {
+	if src, ok := m.currentSource(); ok && !flat {
 		rows = append(rows, sourceRow{kind: rowSource, group: src.Kind, provider: src.Provider, top: true, source: src})
 	}
 	for _, p := range m.providers {
 		kind, id := p.Kind(), p.ID()
-		account := accountOf(provider.Source{Kind: kind, ProviderLabel: p.Label()})
+		account, _ := strings.CutPrefix(p.Label(), string(kind)+" · ")
+		if account == p.Label() {
+			account = ""
+		}
 		r, done := m.sourceResults[id]
-		sources := slices.DeleteFunc(slices.Clone(r.sources), func(s provider.Source) bool {
+		sources := r.sources
-			return (s.Here && !flat) || (s.Hidden && !m.showHidden)
+		if !flat {
-		})
+			sources = slices.DeleteFunc(slices.Clone(sources), func(s provider.Source) bool { return s.Here })
+		}
 		if kind == provider.KindRepo && !(done && (r.err != nil || len(sources) > 0)) {
 			continue // repos show once some are found to have secret files
 		}
@@ -220,6 +215,17 @@ func (m Model) currentSource() (provider.Source, bool) {
 	return provider.Source{}, false
 }
 
+// starredSourcesFirst moves starred sources to the front, keeping the
+// order otherwise. It doesn't modify sources.
+func (m Model) starredSourcesFirst(sources []provider.Source) []provider.Source {
+	out := slices.Clone(sources)
+	rank := func(s provider.Source) int {
+		return boolRank(m.store.Node(sourceKey(s)).StarredFor(s.Provider))
+	}
+	slices.SortStableFunc(out, func(a, b provider.Source) int { return rank(a) - rank(b) })
+	return out
+}
+
 // starRank orders the Favourites row, then starred sources, then the rest.
 func starRank(mem *store.Store, r sourceRow) int {
 	switch {
@@ -233,6 +239,13 @@ func starRank(mem *store.Store, r sourceRow) int {
 	return 3
 }
 
+func boolRank(starred bool) int {
+	if starred {
+		return 0
+	}
+	return 1
+}
+
 // selectedSource is the source under the cursor; false on a header.
 func (m Model) selectedSource() (provider.Source, bool) {
 	r, ok := m.sources.Selected()
@@ -247,18 +260,6 @@ func (m Model) onLinks() bool {
 	return m.sources.SelectedID() == linksRowID
 }
 
-// toggleHidden lists what providers hide, dimmed, or leaves it out again.
-func (m *Model) toggleHidden() {
-	m.showHidden = !m.showHidden
-	m.containers.SetShowHidden(m.showHidden)
-	m.secrets.SetShowHidden(m.showHidden)
-	m.rebuildSources()
-	m.flash = flash{text: "hidden items hidden"}
-	if m.showHidden {
-		m.flash = flash{text: "showing hidden items, dimmed"}
-	}
-}
-
 // toggleSourcesView switches between grouped and flat, keeping the cursor
 // on the same source.
 func (m *Model) toggleSourcesView() {

internal/ui/app/update.go

@@ -2,11 +2,13 @@ package app
 
 import (
 	"context"
+	"errors"
 	"strings"
 	"time"
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/browser"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
@@ -128,7 +130,15 @@ func (m *Model) showUpdate() {
 		run: func(m *Model) tea.Cmd { return m.install(r) }}}
 	if r.URL != "" {
 		opts = append(opts, option{key: "o", label: "Open the release page", run: func(m *Model) tea.Cmd {
-			return m.openPage("the release page", r.URL, func() {})
+			switch err := m.openURL(r.URL); {
+			case errors.Is(err, browser.ErrRemote):
+				cmd := m.copyText("link to the release", r.URL, false)
+				m.flash.text += " (can't open a browser over SSH)"
+				return cmd
+			case err != nil:
+				m.flash = flash{text: "open: " + err.Error(), isErr: true}
+			}
+			return nil
 		}})
 	}
 	m.showMenu("lazysecrets "+r.Tag, lines, opts)

internal/ui/icons/icons.go

@@ -11,9 +11,6 @@ type Set struct {
 	Repo       string
 	Encrypted  string // an encrypted file (SOPS)
 	PlainFile  string // a plain text secrets file (.env)
-	Spring     string // a Spring Boot config file
-	Compose    string // a Docker Compose file
-	Dotnet     string // a .NET appsettings file
 	Note       string // has a note (lazysecrets list)
 }
 
@@ -28,9 +25,6 @@ var NerdFont = Set{
 	Repo:       "\U000F02A2", // md-git
 	Encrypted:  "\U000F033E", // md-lock
 	PlainFile:  "\U000F0214", // md-file
-	Spring:     "\U000F032A", // md-leaf
-	Compose:    "\U000F0868", // md-docker
-	Dotnet:     "\U000F0AAE", // md-dot_net
 	Note:       "\U000F09ED",
 }
 

internal/ui/keys/keys.go

@@ -45,7 +45,6 @@ type Map struct {
 	Recent                            key.Binding
 	Note, Share, ShareMenu, OpenRef   key.Binding
 	Search, SourcesView, Commands     key.Binding
-	ToggleHidden                      key.Binding
 	SplitLeft, SplitRight, SplitReset key.Binding
 	Taller, Shorter, ZoomIn, ZoomOut  key.Binding
 	Login, Refresh, Help, Quit        key.Binding
@@ -103,7 +102,6 @@ func (m *Map) Actions() []Action {
 		a(Lists, "prevTab", &m.PrevTab, "prev tab", "lists", "Previous tab of the focused pane: Sources and Favourites in Sources; Secrets, Keys, Certs in Secrets."),
 		a(Lists, "nextTab", &m.NextTab, "next tab", "lists", "Next tab of the focused pane."),
 		a(Lists, "sourcesView", &m.SourcesView, "grouped/flat sources", "lists", "Switch the Sources pane between grouped by provider and a flat list."),
-		a(Lists, "toggleHidden", &m.ToggleHidden, "show/hide hidden", "lists", "Show or hide what's hidden: config file keys (Spring, compose, .NET) that don't look like secrets, example files (.env.example), and files and repos with only those. Shown, they're dimmed; Go to finds them too."),
 		a(Lists, "star", &m.Favourite, "star", "lists", "Star or unstar the selected subscription, vault or secret, for the account showing it. Starred items get a ★ and sort first."),
 		a(Lists, "goTo", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one. Again in Go to: only the source or group you're in, and back to all. On the left, the scope: All, an account (or Databricks, or Repos), or one source (○ ◐ ● for how much of it is loaded)."),
 		a(Lists, "favourites", &m.Favourites, "favourites", "lists", "Go to, on Favourites: everything you've starred, to search and jump to."),
@@ -187,7 +185,7 @@ var defaults = map[string][]string{
 	"lists.nextPane": {"tab"}, "lists.prevPane": {"shift+tab", "h", "left"}, "lists.details": {"l", "right"},
 	"lists.pane1": {"1"}, "lists.pane2": {"2"}, "lists.pane3": {"3"}, "lists.pane4": {"4"}, "lists.pane0": {"0"},
 	"lists.open": {"enter"}, "lists.back": {"esc", "backspace"},
-	"lists.filter": {"/"}, "lists.prevTab": {"["}, "lists.nextTab": {"]"}, "lists.sourcesView": {"`"}, "lists.toggleHidden": {"H"},
+	"lists.filter": {"/"}, "lists.prevTab": {"["}, "lists.nextTab": {"]"}, "lists.sourcesView": {"`"},
 	"lists.star": {"f"}, "lists.favourites": {"F"}, "lists.recent": {"R"}, "lists.goTo": {"ctrl+s"}, "lists.note": {"n"},
 	"lists.commands": {"x"},
 	"lists.reveal":   {"space"}, "lists.copyValue": {"y"}, "lists.copyReference": {"Y"},

internal/ui/panes/box.go

@@ -69,20 +69,3 @@ func TitleStyle(st styles.Styles, focused bool) lipgloss.Style {
 	}
 	return st.TitleBlurred
 }
-
-// Tabs draws tab names for a title in style ts, the current one
-// underlined and the rest muted.
-func Tabs(st styles.Styles, ts lipgloss.Style, names []string, current int) string {
-	var out string
-	for i, name := range names {
-		if i > 0 {
-			out += ts.Render(" - ")
-		}
-		if i == current {
-			out += ts.Underline(true).Render(name)
-		} else {
-			out += st.Muted.Render(name)
-		}
-	}
-	return out
-}

internal/ui/panes/detail.go

@@ -188,31 +188,20 @@ func carryStyle(lines []string) []string {
 	return lines
 }
 
-var valueIndent = strings.Repeat(" ", 12)
-
-// fieldLabel starts a detail line: the label, padded so values line up
-// at valueIndent.
-func fieldLabel(st styles.Styles, label string) string {
-	return " " + st.Label.Render(fmt.Sprintf("%-10s", label)) + " "
-}
-
 // lines renders the body, wrapped to the pane width.
 func (d Detail) lines(st styles.Styles) []string {
 	inner := max(1, d.w-3)
 	var out []string
 	field := func(label, value string) {
+		prefix := " " + st.Label.Render(fmt.Sprintf("%-10s", label)) + " "
+		indent := strings.Repeat(" ", 12)
 		wrapped := carryStyle(strings.Split(ansi.Hardwrap(value, max(1, inner-11), true), "\n"))
-		out = append(out, fieldLabel(st, label)+wrapped[0])
+		out = append(out, prefix+wrapped[0])
 		for _, w := range wrapped[1:] {
-			out = append(out, valueIndent+w)
+			out = append(out, indent+w)
 		}
 	}
 	muted := st.Muted.Render
-	note := func() {
-		if d.note != "" {
-			field("note", st.Favourite.Render(d.note))
-		}
-	}
 
 	if d.container == nil {
 		return []string{muted(" Select a vault or scope to browse its secrets.")}
@@ -222,27 +211,30 @@ func (d Detail) lines(st styles.Styles) []string {
 	if containerLabel == "" {
 		containerLabel = "vault"
 	}
-	source := d.Icons.Prefix(c.Source.Kind) + cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind)) + " / " + c.Source.Name
 
 	if d.secret == nil {
 		field(containerLabel, c.Name)
-		note()
+		if d.note != "" {
+			field("note", st.Favourite.Render(d.note))
+		}
 		if c.Detail != "" {
 			field("", muted(c.Detail))
 		}
-		field("source", source)
+		field("source", d.Icons.Prefix(c.Source.Kind)+cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
 		out = append(out, "", muted(" Select a secret to see its details."))
 		return out
 	}
 
 	s := *d.secret
 	field("name", s.Name)
-	note()
+	if d.note != "" {
+		field("note", st.Favourite.Render(d.note))
+	}
 	field(containerLabel, c.Name)
 	if c.Source.Kind != provider.KindAzure && c.Detail != "" {
 		field("", muted(c.Detail))
 	}
-	field("source", source)
+	field("source", d.Icons.Prefix(c.Source.Kind)+cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
 	if s.Version != "" {
 		field("version", s.Version)
 	}
@@ -306,12 +298,14 @@ func (d Detail) lines(st styles.Styles) []string {
 	case provider.TypeCertificate:
 		label, hidden, reveal = "cert", "", "show the certificate"
 	}
+	indent := strings.Repeat(" ", 12)
+
 	out = append(out, "")
 	switch d.state {
 	case ValueHidden:
 		if hidden != "" {
 			field(label, hidden)
-			out = append(out, valueIndent+hints(reveal))
+			out = append(out, indent+hints(reveal))
 		} else {
 			field(label, hints(reveal))
 		}
@@ -328,29 +322,23 @@ func (d Detail) lines(st styles.Styles) []string {
 			for j, w := range strings.Split(ansi.Wrap(text, max(1, inner-11-len(lead)), ""), "\n") {
 				w = lead + w
 				if i == 0 && j == 0 {
-					out = append(out, fieldLabel(st, label)+st.Error.Render(w))
+					out = append(out, " "+st.Label.Render(fmt.Sprintf("%-10s", label))+" "+st.Error.Render(w))
 				} else {
-					out = append(out, valueIndent+st.Error.Render(w))
+					out = append(out, strings.Repeat(" ", 12)+st.Error.Render(w))
 				}
 			}
 		}
 	case ValueShown:
-		if d.value.Reveal() == "" {
-			// Not in the value's colour, nor a word a value could be.
-			field(label, st.Muted.Italic(true).Render("∅ no value (an empty string)"))
-			out = append(out, valueIndent+hints("hide"))
-			break
-		}
 		// Where the dots were, continuing under itself; the keys below.
 		first := true
 		lines, note := valueView(d.value.Reveal())
 		for _, line := range lines {
 			for _, w := range strings.Split(ansi.Hardwrap(line, max(1, inner-11), true), "\n") {
 				if first {
-					out = append(out, fieldLabel(st, label)+st.Value.Render(w))
+					out = append(out, " "+st.Label.Render(fmt.Sprintf("%-10s", label))+" "+st.Value.Render(w))
 					first = false
 				} else {
-					out = append(out, valueIndent+st.Value.Render(w))
+					out = append(out, indent+st.Value.Render(w))
 				}
 			}
 		}
@@ -364,7 +352,7 @@ func (d Detail) lines(st styles.Styles) []string {
 		if d.hidesIn != "" {
 			more = append(more, "hides in "+d.hidesIn)
 		}
-		out = append(out, valueIndent+hints("hide", more...))
+		out = append(out, indent+hints("hide", more...))
 	}
 	return append(out, d.versionLines(st)...)
 }
@@ -385,7 +373,7 @@ func (d Detail) versionLines(st styles.Styles) []string {
 			head += muted(" · " + d.VersionsKey + " to browse")
 		}
 	}
-	out := []string{"", fieldLabel(st, "versions") + head}
+	out := []string{"", " " + st.Label.Render(fmt.Sprintf("%-10s", "versions")) + " " + head}
 	current := d.versions[0].Version
 	for i, v := range d.versions {
 		if i == maxVersionLines {

internal/ui/panes/detail_test.go

@@ -3,12 +3,6 @@ package panes
 import (
 	"strings"
 	"testing"
-
-	"github.com/charmbracelet/x/ansi"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/icons"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
 )
 
 func TestWrappedValueKeepsItsStyle(t *testing.T) {
@@ -21,17 +15,3 @@ func TestWrappedValueKeepsItsStyle(t *testing.T) {
 		t.Errorf("the style went on past its reset: %q", got[2])
 	}
 }
-
-func TestEmptyValue(t *testing.T) {
-	d := NewDetail(icons.None)
-	d.SetSize(80, 20)
-	d.ShowSecret(provider.Object{Name: "spring.datasource.password", Type: provider.TypeSecret})
-	d.SetValue(provider.NewSecretValue(nil))
-	if view := ansi.Strip(d.View(styles.Default(), true, "")); !strings.Contains(view, "∅ no value (an empty string)") {
-		t.Errorf("empty value:\n%s", view)
-	}
-	d.SetValue(provider.NewSecretValue([]byte("empty")))
-	if view := ansi.Strip(d.View(styles.Default(), true, "")); strings.Contains(view, "∅") || !strings.Contains(view, "empty") {
-		t.Errorf("the word empty:\n%s", view)
-	}
-}

internal/ui/panes/list.go

@@ -22,9 +22,6 @@ type Item[T any] struct {
 	// text the row doesn't show (e.g. the provider of a grouped source).
 	FilterExtra func(T) string
 	Render      func(st styles.Styles, v T, width int) string
-	// Hidden, if set, says which items are listed only while the list
-	// shows hidden ones (SetShowHidden).
-	Hidden func(T) bool
 }
 
 // List is a scrollable, filterable list pane with loading and error states.
@@ -56,9 +53,6 @@ type List[T any] struct {
 
 	input     textinput.Model
 	filtering bool
-
-	showHidden bool
-	hidden     int // items left out for being hidden
 }
 
 func NewList[T any](title string, item Item[T]) List[T] {
@@ -83,12 +77,6 @@ func (l *List[T]) SetItems(items []T) {
 	l.applyFilter(prev)
 }
 
-// SetShowHidden lists hidden items too, or leaves them out again.
-func (l *List[T]) SetShowHidden(on bool) {
-	l.showHidden = on
-	l.applyFilter(l.SelectedID())
-}
-
 // Reset clears items, error, filter and cursor.
 func (l *List[T]) Reset() {
 	l.items, l.visible = nil, nil
@@ -249,28 +237,21 @@ func (l *List[T]) UpdateFilter(msg tea.Msg) tea.Cmd {
 // applyFilter recomputes the visible items and puts the cursor back on the
 // item with ID keep if it is still visible.
 func (l *List[T]) applyFilter(keep string) {
-	l.visible, l.hits, l.hidden = l.visible[:0], nil, 0
+	l.visible, l.hits = l.visible[:0], nil
-	shown := make([]int, 0, len(l.items))
-	for i, v := range l.items {
-		if !l.showHidden && l.item.Hidden != nil && l.item.Hidden(v) {
-			l.hidden++
-			continue
-		}
-		shown = append(shown, i)
-	}
 	if q := l.input.Value(); q == "" {
-		l.visible = append(l.visible, shown...)
+		for i := range l.items {
+			l.visible = append(l.visible, i)
+		}
 	} else {
 		// The row's own text is the name; FilterExtra (a note, a provider)
 		// is context, matched too but ranked lower.
-		items := make([]match.Item, len(shown))
+		items := make([]match.Item, len(l.items))
-		for j, i := range shown {
+		for i, v := range l.items {
-			v := l.items[i]
 			text := l.item.Filter(v)
-			items[j] = match.Item{Text: text, NameEnd: utf8.RuneCountInString(text)}
+			items[i] = match.Item{Text: text, NameEnd: utf8.RuneCountInString(text)}
 			if l.item.FilterExtra != nil {
 				if extra := l.item.FilterExtra(v); extra != "" {
-					items[j].Text += " " + extra
+					items[i].Text += " " + extra
 				}
 			}
 		}
@@ -281,7 +262,7 @@ func (l *List[T]) applyFilter(keep string) {
 					hits = append(hits, p)
 				}
 			}
-			l.visible = append(l.visible, shown[h.Index])
+			l.visible = append(l.visible, h.Index)
 			l.hits = append(l.hits, hits)
 		}
 	}
@@ -348,7 +329,17 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	ts := TitleStyle(st, focused)
 	title := ts.Render(l.Title)
 	if len(l.Tabs) > 1 {
-		title += ts.Render(" ") + Tabs(st, ts, l.Tabs, l.Tab)
+		for i, tab := range l.Tabs {
+			sep := " - "
+			if i == 0 {
+				sep = " "
+			}
+			if i == l.Tab {
+				title += ts.Render(sep) + ts.Underline(true).Render(tab)
+			} else {
+				title += ts.Render(sep) + st.Muted.Render(tab)
+			}
+		}
 	}
 	if q := l.input.Value(); q != "" && !l.filtering {
 		title += ts.Render(" /" + q)
@@ -372,22 +363,33 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 		for _, line := range wrapLines(l.Err.Error(), inner-1) {
 			body = append(body, st.Error.Render(" "+line))
 		}
-	case len(l.visible) == 0 && len(l.items) > l.hidden:
+	case len(l.visible) == 0 && len(l.items) > 0:
 		body = append(body, st.Muted.Render(" no matches"))
-	case len(l.visible) == 0 && l.hidden > 0:
-		body = append(body, st.Muted.Render(fmt.Sprintf(" %s (%d hidden)", l.Empty, l.hidden)))
 	case len(l.visible) == 0:
 		body = append(body, st.Muted.Render(" "+l.Empty))
 	default:
 		for i := l.offset; i < len(l.visible) && i < l.offset+rows; i++ {
 			line := l.item.Render(st, l.items[l.visible[i]], inner-1)
-			line = " " + MarkMatches(line, l.highlight(i, ansi.Strip(line)), st.Match)
+			plain := ansi.Strip(line)
+			hits := l.highlight(i, plain)
 			if i == l.cursor {
 				base := st.SelectedBlurred
 				if focused {
 					base = st.Selected
 				}
-				line = Highlight(ansi.Truncate(line, inner, "…"), base, inner)
+				text := " " + line
+				if len(hits) > 0 {
+					for j := range hits {
+						hits[j]++ // leading space
+					}
+					text = lipgloss.StyleRanges(text, matchRanges(" "+plain, hits, st.Match)...)
+				}
+				line = Highlight(ansi.Truncate(text, inner, "…"), base, inner)
+			} else if len(hits) > 0 {
+				// Style just the matches, keeping the row's own colours.
+				line = " " + lipgloss.StyleRanges(line, matchRanges(plain, hits, st.Match)...)
+			} else {
+				line = " " + line
 			}
 			body = append(body, line)
 		}
@@ -397,9 +399,6 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	if len(l.visible) > 0 {
 		counter = fmt.Sprintf("%d of %d", l.cursor+1, len(l.visible))
 	}
-	if l.hidden > 0 {
-		counter = strings.Trim(counter+fmt.Sprintf(" · %d hidden", l.hidden), " ·")
-	}
 	if l.Loading && l.Age != "" && len(l.items) > 0 {
 		counter = "cached " + l.Age + " · " + counter
 	}

internal/ui/panes/list_test.go

@@ -201,41 +201,3 @@ func TestListHeader(t *testing.T) {
 		t.Errorf("no room, the text:\n%s", v)
 	}
 }
-
-func TestListHidden(t *testing.T) {
-	l := NewList("Items", Item[string]{
-		ID:     func(s string) string { return s },
-		Filter: func(s string) string { return s },
-		Render: func(_ styles.Styles, s string, _ int) string { return s },
-		Hidden: func(s string) bool { return strings.HasPrefix(s, "hidden") },
-	})
-	l.SetSize(40, 7)
-	l.SetItems([]string{"shown-a", "hidden-b", "shown-c"})
-	view := ansi.Strip(l.View(styles.Default(), true, ""))
-	if l.Len() != 2 || strings.Contains(view, "hidden-b") || !strings.Contains(view, "1 hidden") {
-		t.Fatalf("hidden listed:\n%s", view)
-	}
-	l.Move(1)
-	l.SetShowHidden(true)
-	if l.Len() != 3 || l.SelectedID() != "shown-c" {
-		t.Fatalf("shown: %d, selected %q", l.Len(), l.SelectedID())
-	}
-	l.StartFilter()
-	l.input.SetValue("hid")
-	l.applyFilter("")
-	if l.Len() != 1 || l.SelectedID() != "hidden-b" {
-		t.Fatalf("filtered with hidden shown: %d %q", l.Len(), l.SelectedID())
-	}
-
-	l = NewList("Items", Item[string]{
-		ID: func(s string) string { return s }, Filter: func(s string) string { return s },
-		Render: func(_ styles.Styles, s string, _ int) string { return s },
-		Hidden: func(string) bool { return true },
-	})
-	l.Empty = "no secrets"
-	l.SetSize(40, 7)
-	l.SetItems([]string{"a", "b"})
-	if view := ansi.Strip(l.View(styles.Default(), true, "")); !strings.Contains(view, "no secrets (2 hidden)") {
-		t.Fatalf("all hidden:\n%s", view)
-	}
-}

internal/ui/styles/styles.go

@@ -34,9 +34,6 @@ type Styles struct {
 	KindAzure      lipgloss.Style
 	KindDatabricks lipgloss.Style
 	KindRepo       lipgloss.Style
-	Spring         lipgloss.Style // Spring Boot config files
-	Compose        lipgloss.Style // Docker Compose files
-	Dotnet         lipgloss.Style // .NET appsettings files
 
 	// themed marks the selection colours as set by the theme, so
 	// OnBackground leaves them.
@@ -73,9 +70,6 @@ func Default() Styles {
 		KindAzure:      lipgloss.NewStyle().Foreground(lipgloss.Blue),
 		KindDatabricks: lipgloss.NewStyle().Foreground(lipgloss.Red),
 		KindRepo:       lipgloss.NewStyle().Foreground(lipgloss.Magenta),
-		Spring:         lipgloss.NewStyle().Foreground(lipgloss.Green),
-		Compose:        lipgloss.NewStyle().Foreground(lipgloss.Blue),
-		Dotnet:         lipgloss.NewStyle().Foreground(lipgloss.BrightMagenta),
 	}
 }
 

internal/ui/styles/theme.go

@@ -42,9 +42,6 @@ var Roles = map[string]string{
 	"azureColor":                      "Azure sources and vaults",
 	"databricksColor":                 "Databricks workspaces and scopes",
 	"repoColor":                       "repos and their secret files (SOPS)",
-	"springColor":                     "Spring Boot config files",
-	"composeColor":                    "Docker Compose files",
-	"dotnetColor":                     ".NET appsettings files",
 }
 
 // FromTheme returns the default styles with the theme's roles applied, and
@@ -102,12 +99,6 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 			st.KindDatabricks = v.fg(lipgloss.NewStyle())
 		case "repoColor":
 			st.KindRepo = v.fg(lipgloss.NewStyle())
-		case "springColor":
-			st.Spring = v.fg(lipgloss.NewStyle())
-		case "composeColor":
-			st.Compose = v.fg(lipgloss.NewStyle())
-		case "dotnetColor":
-			st.Dotnet = v.fg(lipgloss.NewStyle())
 		}
 	}
 	return st, fg, nil

internal/update/update.go

@@ -45,9 +45,9 @@ const (
 // DefaultServers are where releases are looked for, in order.
 var DefaultServers = []string{GitHubRepo, DefaultRepo}
 
-// serverTimeout bounds asking one server for the latest release or its
+// latestTimeout bounds asking one server for the latest release, so a
-// checksums, so a server that's down leaves time for the next.
+// server that's down leaves time for the next.
-const serverTimeout = 5 * time.Second
+const latestTimeout = 5 * time.Second
 
 // maxDownload bounds what's read from the server.
 const maxDownload = 200 << 20
@@ -151,7 +151,7 @@ func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
 	if err != nil {
 		return Release{}, err
 	}
-	ctx, cancel := context.WithTimeout(ctx, serverTimeout)
+	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
 	defer cancel()
 	// The recent releases in one request (per_page on GitHub, limit on
 	// Gitea), for their changelogs.
@@ -220,7 +220,7 @@ func (c *Client) Install(ctx context.Context, r Release, exe string) error {
 	if m := Managed(exe); m != "" {
 		return fmt.Errorf("%s is managed by %s: update it there", exe, m)
 	}
-	if (runtime.GOOS != "darwin" && runtime.GOOS != "linux") || (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") {
+	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" || runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" {
 		return fmt.Errorf("no release build for %s/%s", runtime.GOOS, runtime.GOARCH)
 	}
 	version := strings.TrimPrefix(r.Tag, "v")
@@ -270,7 +270,7 @@ func (c *Client) download(ctx context.Context, tag, file string) ([]byte, error)
 	var errs []error
 	for _, repo := range c.servers() {
 		base := strings.TrimSuffix(repo, "/") + "/releases/download/" + tag + "/"
-		sctx, cancel := context.WithTimeout(ctx, serverTimeout)
+		sctx, cancel := context.WithTimeout(ctx, latestTimeout)
 		sums, err := c.get(sctx, base+"checksums.txt", 1<<20)
 		cancel()
 		if err != nil {

scripts/release.sh

@@ -3,55 +3,26 @@
 # it, tags the commit and pushes both; the tag runs
 # .gitea/workflows/release.yml, which builds and publishes the release.
 #
-#   scripts/release.sh minor           # or patch, major: after the latest release
 #   scripts/release.sh v0.2.0          # or v0.2.0-rc.1 for a pre-release
-#   scripts/release.sh --dry-run minor # print the tag and notes, change nothing
+#   scripts/release.sh --dry-run v0.2.0  # print the notes, change nothing
 #
 # A pre-release is tagged without touching CHANGELOG.md: its changes are
 # listed under the release that follows.
 set -euo pipefail
 
-usage="usage: $0 [--dry-run] <patch|minor|major, or a tag like v0.2.0>"
+dry=false
-# Options anywhere: minor --dry-run must not release.
+if [ "${1:-}" = "--dry-run" ]; then
-dry=false tag=""
+  dry=true
-for arg in "$@"; do
+  shift
-  case "$arg" in
+fi
-    --dry-run | -n) dry=true ;;
+tag="${1:?usage: $0 [--dry-run] <tag, e.g. v0.2.0>}"
-    -*) echo "$arg: unknown option. $usage" >&2; exit 1 ;;
+if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
-    *)
+  echo "$tag is not vMAJOR.MINOR.PATCH (optionally -suffix)" >&2
-      [ -z "$tag" ] || { echo "$arg: one version only. $usage" >&2; exit 1; }
+  exit 1
-      tag=$arg
+fi
-      ;;
-  esac
-done
-[ -n "$tag" ] || { echo "$usage" >&2; exit 1; }
 command -v git-cliff >/dev/null || { echo "git-cliff is needed: brew install git-cliff" >&2; exit 1; }
 
 cd "$(dirname "$0")/.."
-git fetch -q origin main --tags
-
-bumped=""
-case "$tag" in
-  patch | minor | major)
-    # The latest release, pre-releases left out: v0.3.0-rc.1 isn't one.
-    tags=$(git tag -l 'v*' --sort=-v:refname)
-    last=$(grep -m1 -E '^v[0-9]+\.[0-9]+\.[0-9]+$' <<<"$tags" || true)
-    [ -n "$last" ] || { echo "No vMAJOR.MINOR.PATCH tag to bump from; give the tag." >&2; exit 1; }
-    IFS=. read -r major minor patch <<<"${last#v}"
-    case "$tag" in
-      major) next="v$((major + 1)).0.0" ;;
-      minor) next="v$major.$((minor + 1)).0" ;;
-      patch) next="v$major.$minor.$((patch + 1))" ;;
-    esac
-    bumped=" ($tag after $last)"
-    tag=$next
-    ;;
-esac
-if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
-  echo "$tag is not patch, minor, major or vMAJOR.MINOR.PATCH (optionally -suffix)" >&2
-  exit 1
-fi
-echo "$tag$bumped"
 
 notes=$(git cliff --unreleased --tag "$tag" --strip all)
 if ! grep -q '^- ' <<<"$notes"; then
@@ -69,6 +40,7 @@ if [ -n "$(git status --porcelain)" ]; then
   echo "The working tree has changes; commit or stash them first." >&2
   exit 1
 fi
+git fetch -q origin main --tags
 if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]; then
   echo "main isn't origin/main; pull (or push) first." >&2
   exit 1
@@ -79,7 +51,7 @@ if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
 fi
 
 echo
-read -r -p "Release $tag$bumped with these notes? [y/N] " ok
+read -r -p "Release $tag with these notes? [y/N] " ok
 [ "$ok" = y ] || [ "$ok" = Y ] || exit 1
 
 if [[ "$tag" != *-* ]]; then