feat: the demo's own repo is lazysecrets-demo

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -4,9 +4,8 @@ name: Release
 # as a pre-release) tests lazysecrets, then GoReleaser (.goreleaser.yaml)
 # builds it for macOS and Linux, arm64 and amd64, and publishes a Gitea
 # release with the archives, checksums and this release's section of the
-# changelog (git-cliff, cliff.toml), then copies it to the GitHub
+# changelog (git-cliff, cliff.toml). Pushing the same tag again (after
-# mirror. Pushing the same tag again (after deleting it) replaces the
+# deleting it) replaces the release.
-# release in both places.
 #
 #   scripts/release.sh v0.2.0    # updates CHANGELOG.md, tags and pushes
 
@@ -82,14 +81,3 @@ jobs:
           args: release --clean --release-notes ${{ runner.temp }}/notes.md
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Copy the release to GitHub
-        # The same notes and files on the GitHub mirror, which lazysecrets
-        # updates from first (internal/update). GH_RELEASE_TOKEN is a
-        # fine-grained token that can write the mirror's contents; without
-        # it the step does nothing.
-        run: node scripts/github-release.mjs
-        env:
-          TAG: ${{ github.ref_name }}
-          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,46 +0,0 @@
-name: Bug report
-description: Something in lazysecrets doesn't work as it should.
-labels: [bug]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for reporting! Please leave out secret values, tokens and anything else private: names of vaults and secrets are enough.
-  - type: textarea
-    id: what
-    attributes:
-      label: What happened
-      description: What you did, what you expected, and what happened instead.
-    validations:
-      required: true
-  - type: textarea
-    id: steps
-    attributes:
-      label: Steps to reproduce
-      description: If you can, try `lazysecrets --demo` first.
-      placeholder: |
-        1. lazysecrets --demo
-        2. ctrl+s, type …
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: The status pane shows it, e.g. `v0.1.0`.
-    validations:
-      required: true
-  - type: dropdown
-    id: source
-    attributes:
-      label: Where
-      multiple: true
-      options:
-        - Azure Key Vault
-        - Databricks
-        - SOPS or .env files
-        - Links
-        - Everywhere / not sure
-  - type: input
-    id: platform
-    attributes:
-      label: OS and terminal
-      placeholder: macOS 26, kitty + tmux

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Docs
-    url: https://git.kebcloud.no/keb/lazysecrets/src/branch/main/docs
-    about: Keys, sources, links, config and more.

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,20 +0,0 @@
-name: Feature request
-description: An idea for lazysecrets, or something that could work better.
-labels: [enhancement]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        lazysecrets stays focused on finding, reading and sharing secrets, so not every idea will make it in, but they're all read.
-  - type: textarea
-    id: problem
-    attributes:
-      label: What you're trying to do
-      description: The problem or the situation, more than the solution.
-    validations:
-      required: true
-  - type: textarea
-    id: idea
-    attributes:
-      label: Your idea
-      description: How you'd like it to work, if you have one in mind.

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 Every release of lazysecrets, newest first.
 
-## v0.1.0 – 2026-10-12
+## v0.1.0 – 2026-10-10
 
 Hello world 👋
 

README.md

@@ -1,8 +1,6 @@
 # lazysecrets
 
-A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic [lazygit](https://github.com/jesseduffield/lazygit).
+A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.
-
-![lazysecrets](docs/assets/lazysecrets.png)
 
 ## Main features
 
@@ -12,10 +10,9 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
   CLI, `sops`, `git`). No config file needed.
 - **Search everything**: `ctrl+s` searches every source at once, with
   fzf-style matching.
-- **Share links**: Share `lazysecrets://` links with colleagues. A colleague opens it
+- **Share links**: Share `lazysecrets://` links with colleages. A colleague opens it
   with their own access, from the terminal or with a click in the browser
   or chat.
-- **Neovim integration**: via [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
 - **Careful with values**: values stay hidden until you reveal them, and
   copied values are cleared from the clipboard after 30 seconds.
 - **Scriptable**: `lazysecrets get <link>` prints a value for scripts and
@@ -38,9 +35,8 @@ On macOS or Linux (arm64 or x86_64):
 curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
 ```
 
-It installs the latest release, from GitHub or else
+It installs the latest [release](https://git.kebcloud.no/keb/lazysecrets/releases)
-[git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets/releases), into
+into `~/.local/bin` after checking it against the release's checksums.
-`~/.local/bin` after checking it against the release's checksums.
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
 
@@ -98,20 +94,9 @@ lazysecrets never stores, caches or sends your secret values. It keeps the
 names and metadata of what you've loaded in a cache file readable only by
 you, to show it at once next time (`cache: false` turns it off). It talks
 only to the services you use it with, and collects no usage data. The one
-call of its own is a daily check for a new release, on GitHub or else
+call of its own is a daily check for a new release on this server, which
-git.kebcloud.no, which `updateCheck: false` turns off.
+`updateCheck: false` turns off.
 
-## Repositories
-
-The main repo of this codebase is at [git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets).
-The [GitHub mirror](https://github.com/karleinarb/lazysecrets) is for discoverability, issue-tracking and releases.
-It also makes it possible to give a ⭐ if you like lazysecrets!
-
-## Contributing
-
-I don't take pull requests as I don't have time to review and test them.
-But bug reports and ideas are very welcome!
-Open an [issue on GitHub](https://github.com/karleinarb/lazysecrets/issues) and I'll have a look.
 
 ## AI disclosure
 

cmd/lazysecrets/expiring.go

@@ -0,0 +1,192 @@
+package main
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"text/tabwriter"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+)
+
+// lazysecrets expiring lists what has expired, or will within --days,
+// in every vault of every account: for a pipeline or a cron job. Expiry
+// dates come with the lists, so it's one request per vault and type,
+// a few at a time. Only Key Vault has expiry dates.
+
+// The exit status is grep's: 1 when anything was listed (errExpiring),
+// else 2 when some lists couldn't be read (errIncomplete), else 0.
+var (
+	errExpiring   = errors.New("expiring")
+	errIncomplete = errors.New("incomplete")
+)
+
+// listLimit is how many lists load at once.
+const listLimit = 8
+
+type expiringOpts struct {
+	days    int
+	timeout time.Duration
+	now     time.Time
+}
+
+func parseExpiring(args []string, days int) (int, error) {
+	fs := flag.NewFlagSet("expiring", flag.ContinueOnError)
+	n := fs.Int("days", days, "list what expires within this many days (default: expiryWarningDays, else 30)")
+	if err := fs.Parse(args); err != nil {
+		return 0, err
+	}
+	if fs.NArg() > 0 || *n < 0 {
+		return 0, fmt.Errorf("usage: lazysecrets expiring [--days N]")
+	}
+	return *n, nil
+}
+
+func expiring(providers []provider.Provider, o expiringOpts, out, errs io.Writer) error {
+	var (
+		mu     sync.Mutex
+		found  []provider.Object
+		seen   = map[string]bool{}
+		failed int
+		vaults int
+		wg     sync.WaitGroup
+		limit  = make(chan struct{}, listLimit)
+		within = o.now.AddDate(0, 0, o.days)
+		// A vault's lists that couldn't be read, said once per vault.
+		denied  = map[string][]string{}
+		why     = map[string]string{}
+		warnErr = func(what string, err error) {
+			mu.Lock()
+			defer mu.Unlock()
+			failed++
+			fmt.Fprintf(errs, "lazysecrets: %s: %s\n", what, briefly(err))
+		}
+	)
+	run := func(f func(ctx context.Context)) {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			limit <- struct{}{}
+			defer func() { <-limit }()
+			ctx, cancel := context.WithTimeout(context.Background(), o.timeout)
+			defer cancel()
+			f(ctx)
+		}()
+	}
+	var vaultsDone sync.WaitGroup
+	for _, p := range providers {
+		if p.Kind() != provider.KindAzure {
+			continue
+		}
+		vaultsDone.Add(1)
+		run(func(ctx context.Context) {
+			defer vaultsDone.Done()
+			srcs, err := p.Sources(ctx)
+			if err != nil {
+				warnErr(p.Label(), err)
+				return
+			}
+			for _, src := range srcs {
+				vaultsDone.Add(1)
+				run(func(ctx context.Context) {
+					defer vaultsDone.Done()
+					cs, err := p.Containers(ctx, src)
+					if err != nil {
+						warnErr(src.Name, err)
+						return
+					}
+					for _, c := range cs {
+						mu.Lock()
+						fresh := !seen[c.ID]
+						seen[c.ID] = true
+						if fresh {
+							vaults++
+						}
+						mu.Unlock()
+						if !fresh { // the same vault through another account
+							continue
+						}
+						for _, t := range c.ObjectTypes() {
+							run(func(ctx context.Context) {
+								objs, err := p.Objects(ctx, c, t)
+								mu.Lock()
+								defer mu.Unlock()
+								if err != nil {
+									failed++
+									denied[c.Name] = append(denied[c.Name], strings.ToLower(string(t))+"s")
+									why[c.Name] = cmp.Or(why[c.Name], briefly(err))
+									return
+								}
+								for _, o := range objs {
+									if !o.Expires.IsZero() && o.Expires.Before(within) {
+										found = append(found, o)
+									}
+								}
+							})
+						}
+					}
+				})
+			}
+		})
+	}
+	// Listing vaults queues the lists of their secrets, so wait for both.
+	vaultsDone.Wait()
+	wg.Wait()
+	for _, name := range slices.Sorted(maps.Keys(denied)) {
+		fmt.Fprintf(errs, "lazysecrets: %s: can't list %s: %s\n", name, strings.Join(denied[name], ", "), why[name])
+	}
+
+	slices.SortFunc(found, func(a, b provider.Object) int { return a.Expires.Compare(b.Expires) })
+	if len(found) == 0 {
+		vault := "vaults"
+		if vaults == 1 {
+			vault = "vault"
+		}
+		fmt.Fprintf(errs, "nothing expires within %d days (checked %d of %d %s)\n", o.days, vaults-len(denied), vaults, vault)
+		if failed > 0 {
+			fmt.Fprintf(errs, "lazysecrets: %d lists couldn't be read: they weren't checked\n", failed)
+			return errIncomplete
+		}
+		return nil
+	}
+	tw := tabwriter.NewWriter(out, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(tw, "LEFT\tEXPIRES\tTYPE\tVAULT\tNAME\tLINK")
+	for _, x := range found {
+		left := "expired"
+		if d := x.Expires.Sub(o.now); d > 0 {
+			left = fmt.Sprintf("%dd", int(d.Hours()/24))
+		}
+		link := ""
+		if r, err := ref.ForObject(x, ""); err == nil {
+			link = r.String()
+		}
+		fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\t%s\n", left, x.Expires.Local().Format("2006-01-02"),
+			strings.ToLower(string(x.Type)), x.Container.Name, x.Name, link)
+	}
+	if err := tw.Flush(); err != nil {
+		return err
+	}
+	if failed > 0 {
+		fmt.Fprintf(errs, "lazysecrets: %d lists couldn't be read: the list may be incomplete\n", failed)
+	}
+	return errExpiring
+}
+
+// briefly is err on one line: for a sign-in, the command that signs in.
+func briefly(err error) string {
+	var auth *provider.AuthError
+	if errors.As(err, &auth) && len(auth.Login) > 0 {
+		return "sign-in required: " + strings.Join(auth.Login, " ")
+	}
+	line, _, _ := strings.Cut(err.Error(), "\n")
+	return line
+}

cmd/lazysecrets/expiring_test.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+)
+
+func TestExpiring(t *testing.T) {
+	providers := []provider.Provider{fake.Azure(0), fake.Databricks(0)}
+	now := time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+	var out, errs bytes.Buffer
+	err := expiring(providers, expiringOpts{days: 30, timeout: time.Minute, now: now}, &out, &errs)
+	if !errors.Is(err, errExpiring) {
+		t.Fatalf("err %v (want errExpiring: something listed)", err)
+	}
+	lines := strings.Split(strings.TrimSpace(out.String()), "\n")
+	if len(lines) != 2 || !strings.HasPrefix(lines[1], "expired  2026-03-01  certificate  kv-app-prod  old-tls") ||
+		!strings.Contains(lines[1], "lazysecrets://azure/kv-app-prod.vault.azure.net/certificates/old-tls") {
+		t.Errorf("out:\n%s", out.String())
+	}
+	if !strings.Contains(errs.String(), "kv-restricted: can't list ") || strings.Count(errs.String(), "kv-restricted") != 1 {
+		t.Errorf("unreadable vaults not said:\n%s", errs.String())
+	}
+
+	// Further ahead, the soonest first.
+	out.Reset()
+	expiring(providers, expiringOpts{days: 400, timeout: time.Minute, now: now}, &out, &errs)
+	if got := strings.Count(out.String(), "\n"); got != 4 || !strings.Contains(out.String(), "app-tls") {
+		t.Errorf("400 days:\n%s", out.String())
+	}
+
+	// Nothing listed, but not everything checked.
+	errs.Reset()
+	err = expiring(providers, expiringOpts{days: 0, timeout: time.Minute, now: time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)}, &out, &errs)
+	if !errors.Is(err, errIncomplete) {
+		t.Errorf("err %v, want errIncomplete", err)
+	}
+
+	if _, err := parseExpiring([]string{"--days", "-1"}, 30); err == nil {
+		t.Error("negative days accepted")
+	}
+}

cmd/lazysecrets/main.go

@@ -4,6 +4,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -33,7 +34,12 @@ import (
 )
 
 func main() {
-	if err := run(); err != nil {
+	switch err := run(); {
+	case errors.Is(err, errExpiring):
+		os.Exit(1) // listed: a pipeline fails on it
+	case errors.Is(err, errIncomplete):
+		os.Exit(2)
+	case err != nil:
 		fmt.Fprintln(os.Stderr, "lazysecrets:", err)
 		os.Exit(1)
 	}
@@ -118,6 +124,10 @@ func run() error {
                                   @Microsoft.KeyVault(...) or {{secrets/scope/key}}
   lazysecrets [flags] get <ref>   print the value a lazysecrets:// link points at,
                                   for scripts: VAR=$(lazysecrets get <ref>)
+  lazysecrets [flags] expiring [--days N]
+                                  list what has expired or will within N days
+                                  (default 30) in every vault; exits 1 if any,
+                                  2 if it couldn't check everything
   lazysecrets [flags] keybindings print every action and its keys (with your
                                   config applied), as config to copy and edit
   lazysecrets handler install [--terminal NAME]
@@ -140,6 +150,7 @@ Flags:
 	}
 
 	var open, getRef *ref.Ref
+	var expiringArgs []string
 	printKeys := false
 	switch args := flag.Args(); {
 	case len(args) == 1 && args[0] == "keybindings":
@@ -150,12 +161,14 @@ Flags:
 			return err
 		}
 		getRef = &r
+	case len(args) > 0 && args[0] == "expiring":
+		expiringArgs = append([]string{}, args[1:]...)
 	case len(args) > 0 && args[0] == "handler":
 		return handler(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "launch":
 		return launch(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "update":
-		return updateCmd(*configPath, args[1:])
+		return updateCmd(args[1:])
 	case len(args) == 0:
 	case args[0] == "open" && len(args) == 2:
 		r, err := ref.Parse(args[1])
@@ -243,8 +256,8 @@ Flags:
 	if *demo {
 		// Two Azure accounts, like a personal and an admin login in az.
 		providers = []provider.Provider{
-			fake.Azure(400*time.Millisecond).As("Azure:alice@example.com/demo", "Azure · alice"),
+			fake.Azure(400*time.Millisecond).As("Azure:dev@example.com/demo", "Azure · dev"),
-			fake.AzureOps(700*time.Millisecond).As("Azure:admin.alice@example.com/demo", "Azure · admin.alice"),
+			fake.AzureOps(700*time.Millisecond).As("Azure:ops@example.com/demo", "Azure · ops"),
 			fake.Databricks(600 * time.Millisecond),
 			fake.Repos(),
 		}
@@ -299,6 +312,15 @@ Flags:
 	// the standard logger, which would draw over the TUI.
 	log.SetOutput(io.Discard)
 
+	if expiringArgs != nil {
+		days, err := parseExpiring(expiringArgs, expiryDays)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "lazysecrets:", err)
+			return errIncomplete // 2, not 1: nothing was checked
+		}
+		return expiring(providers, expiringOpts{days: days, timeout: *timeout, now: time.Now()}, os.Stdout, os.Stderr)
+	}
+
 	if getRef != nil {
 		ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 		defer cancel()
@@ -364,7 +386,7 @@ Flags:
 		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
 		HideOnBlur:     config.On(cfg.HideOnBlur),
 		HandlerSetup:   setup,
-		Updater:        updater(cfg.Releases),
+		Updater:        updater(),
 		UpdateCheck:    config.On(cfg.UpdateCheck),
 		Keys:           &keymap,
 		Commands:       cfg.CustomCommands,

cmd/lazysecrets/update.go

@@ -7,16 +7,14 @@ import (
 	"strings"
 	"time"
 
-	"git.kebcloud.no/keb/lazysecrets/internal/config"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/app"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 
 // updater is the app's way to find and install releases, replacing the
-// binary that's running, from the servers (config releases) or the
+// binary that's running.
-// default ones.
+func updater() *app.Updater {
-func updater(servers []string) *app.Updater {
+	c := &update.Client{}
-	c := &update.Client{Servers: servers}
 	return &app.Updater{
 		Latest: c.Latest,
 		Install: func(ctx context.Context, r update.Release) error {
@@ -31,19 +29,15 @@ func updater(servers []string) *app.Updater {
 
 // updateCmd is lazysecrets update [--check]: the newer release's
 // changelog, then (unless --check) install it.
-func updateCmd(configPath string, args []string) error {
+func updateCmd(args []string) error {
 	check := len(args) == 1 && args[0] == "--check"
 	if len(args) > 0 && !check {
 		return errors.New("usage: lazysecrets update [--check]")
 	}
-	cfg, err := config.LoadAll(strings.Split(configPath, ","))
-	if err != nil {
-		return err
-	}
 	current := versionString()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
-	c := &update.Client{Servers: cfg.Releases}
+	c := &update.Client{}
 	r, err := c.Latest(ctx)
 	if err != nil {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)

docs/azure.md

@@ -71,6 +71,21 @@ on one goes to it. That makes no requests of its own: expiry dates come
 with the lists. It says how many vaults it covers; `ctrl+a` in search
 loads the rest.
 
+For a pipeline or a cron job, `lazysecrets expiring` lists them in every
+vault of every account, loading each vault's lists (a few at a time):
+
+```sh
+$ lazysecrets expiring --days 30
+LEFT     EXPIRES     TYPE         VAULT        NAME     LINK
+expired  2026-03-01  certificate  kv-app-prod  old-tls  lazysecrets://azure/kv-app-prod.vault.azure.net/certificates/old-tls
+12d      2026-10-23  secret       kv-app-prod  api-key  lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/api-key
+```
+
+`--days` defaults to `expiryWarningDays`. Accounts that need a sign-in and
+lists it can't read are named on stderr, one line each. Like grep, it
+exits 0 when nothing expires, 1 when it lists something, and 2 when it
+couldn't check everything.
+
 On a vault, the right pane shows its settings: resource group, location,
 SKU, whether access is by Azure roles or access policies, soft delete and
 purge protection, which networks can reach it, private endpoints and tags.

docs/config.md

@@ -15,9 +15,6 @@ loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s
 sourcesView: grouped   # or flat; ` toggles it
 collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
 updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
-releases:              # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
-  - https://github.com/karleinarb/lazysecrets
-  - https://git.kebcloud.no/keb/lazysecrets
 history: true          # count uses of items for Recent (R)
 cache: true            # keep what was loaded (never values) for the next start
 providers:
@@ -59,7 +56,7 @@ theme:
   activeBorderColor: ["#ff966c", bold]   # focused pane
   inactiveBorderColor: ["#589ed7"]
   selectedLineBgColor: ["#2d3f76"]       # cursor row background (default: palette 8)
-  inactiveViewSelectedLineBgColor: ["#2f334d"] # in the other panes (default: palette 8, not bold)
+  inactiveViewSelectedLineBgColor: ["#2f334d"]
   defaultFgColor: ["#c8d3f5"]
   optionsTextColor: ["#82aaff"]          # keys and labels
   searchMatchColor: ["#ffc777", bold]
@@ -128,17 +125,14 @@ are read from disk anyway. Deleting the file is always safe, and
 
 ## Updates
 
-Once a day (`updateCheck`), in the background, lazysecrets asks for the
+Once a day (`updateCheck`), in the background, lazysecrets asks the
-latest release; within the day it reuses the answer from the state file.
+release server for the latest release; within the day it reuses the
-Releases are published on GitHub and on git.kebcloud.no, and it asks
+answer from the state file. Offline, or with the server down, it says
-them in that order, the next when one doesn't answer within 5 seconds;
+nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
-`releases` lists others, such as a mirror of your own. Offline, or with
-every server down, it says nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
 `lazysecrets update --check`) shows its changelog.
 
 Updating (`u` there, or `lazysecrets update`) downloads the release for
-your OS and CPU from the first server that has it, checks it against
+your OS and CPU, checks it against the release's `checksums.txt`, makes
-that server's `checksums.txt`, makes
 sure it runs, and only then replaces the binary, atomically: a
 lazysecrets that's running keeps working, and the next start is the new
 version. A binary a package manager owns (Homebrew, Nix, a distro

docs/development.md

@@ -56,12 +56,8 @@ from the pull request titles. The tag runs the release workflow
 (`.gitea/workflows/release.yml`): it tests, then
 [GoReleaser](https://goreleaser.com) (`.goreleaser.yaml`) builds the
 archives and publishes a Gitea release with them and the release's
-changelog section. Then `scripts/github-release.mjs` copies that release,
+changelog section. `goreleaser release --snapshot --clean` builds the same
-notes and files, to the GitHub mirror, with the `GH_RELEASE_TOKEN`
+archives locally, into `dist/`, without publishing.
-secret (a fine-grained token that can write the mirror's contents);
-without the secret it skips that. `goreleaser release --snapshot
---clean` builds the same archives locally, into `dist/`, without
-publishing.
 
 A suffix (`v0.2.0-rc.1`) makes a pre-release, which leaves `CHANGELOG.md`
 alone.

docs/keys.md

@@ -84,24 +84,20 @@ under every account. Both are kept in the [state file](config.md#state).
 starred) and `R` on Recent (what you used last). `enter` goes to the
 selected item.
 
-Search has the scope on the left and what's in it on the right. The
+Search has the scope on the left (All; all of Azure, Databricks or repos;
-scopes are All, then grouped like the Sources pane: each account (or
+or one source; with `○ ◐ ●` for how much of it is loaded) and what's in
-Databricks, or Repos) with its sources under it, with `○ ◐ ●` for how
+it on the right. All repos searches every repo without asking Azure or
-much of each is loaded. Repos searches every repo without asking Azure
+Databricks for anything. It opens on the
-or Databricks for anything. Go to opens on All; `ctrl+s` again narrows
+source you're in. Typing a search loads what it covers: everything on
-it to the source or group selected in the Sources pane, and once more
+All, else the source picked; results appear as lists arrive. That's once
-goes back to All. Typing a search loads what it covers: everything on
+each time Go to opens, and only what isn't loaded yet; `ctrl+a` loads
-All, else the account or source picked; results appear as lists
+again, lists that failed included.
-arrive. That's once each time Go to opens, and only what isn't loaded
-yet; `ctrl+a` loads again, lists that failed included.
 
 Like a pane, Go to is either browsing or typing a filter:
 
 | Browsing | Typing | Action |
 |---|---|---|
 | `j`/`k` | `ctrl+j`/`ctrl+k` | move |
-| `g`/`G` | | top / bottom |
-| `ctrl+s` | `ctrl+s` | only the source or group you're in / All |
 | `h`/`l`, `tab` | `ctrl+h`/`ctrl+l`, `tab` | scope list / results |
 | `[` / `]` | | previous / next tab |
 | `f` | `ctrl+f` | star |

install.sh

@@ -7,12 +7,10 @@
 #
 # LAZYSECRETS_INSTALL_DIR installs somewhere else. macOS and Linux, arm64
 # and x86_64.
-#
-# Releases are on GitHub and git.kebcloud.no, tried in that order;
-# LAZYSECRETS_RELEASES (repository addresses, space-separated) uses others.
 set -eu
 
-repos="${LAZYSECRETS_RELEASES:-https://github.com/karleinarb/lazysecrets https://git.kebcloud.no/keb/lazysecrets}"
+repo=https://git.kebcloud.no/keb/lazysecrets
+api=https://git.kebcloud.no/api/v1/repos/keb/lazysecrets
 dir="${LAZYSECRETS_INSTALL_DIR:-$HOME/.local/bin}"
 
 fail() {
@@ -20,13 +18,12 @@ fail() {
 	exit 1
 }
 
-# Short timeouts, so a server that's down leaves time for the next.
 if command -v curl >/dev/null 2>&1; then
-	fetch() { curl -fsSL --connect-timeout 5 --max-time 15 "$1"; }
+	fetch() { curl -fsSL "$1"; }
-	download() { curl -fsSL --connect-timeout 5 -o "$2" "$1"; }
+	download() { curl -fsSL -o "$2" "$1"; }
 elif command -v wget >/dev/null 2>&1; then
-	fetch() { wget -qO- -T 15 "$1"; }
+	fetch() { wget -qO- "$1"; }
-	download() { wget -qO "$2" -T 30 "$1"; }
+	download() { wget -qO "$2" "$1"; }
 else
 	fail "needs curl or wget"
 fi
@@ -42,26 +39,11 @@ arm64 | aarch64) arch=arm64 ;;
 *) fail "no release for $(uname -m)" ;;
 esac
 
-# api is a repository's API: GitHub's, or Gitea's (and Forgejo's).
-api() {
-	case "$1" in
-	https://github.com/*) echo "https://api.github.com/repos/${1#https://github.com/}" ;;
-	*)
-		host=${1#*://}
-		host=${host%%/*}
-		echo "${1%%://*}://$host/api/v1/repos/${1#*://"$host"/}"
-		;;
-	esac
-}
-
 tag="${1:-}"
 if [ -z "$tag" ]; then
-	for repo in $repos; do
+	tag=$(fetch "$api/releases/latest" | sed -n 's/.*"tag_name":"\([^"]*\)".*/\1/p') ||
-		tag=$(fetch "$(api "$repo")/releases/latest" 2>/dev/null |
+		fail "couldn't look up the latest release"
-			sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' | head -n 1) || tag=
+	[ -n "$tag" ] || fail "couldn't look up the latest release"
-		[ -n "$tag" ] && break
-	done
-	[ -n "$tag" ] || fail "couldn't look up the latest release on $repos"
 fi
 case "$tag" in
 v*) ;;
@@ -73,19 +55,11 @@ name="lazysecrets_${version}_${os}_${arch}"
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 
-# The archive and its checksums.txt from the first server that has both.
+echo "Downloading lazysecrets $tag for $os/$arch"
-from=
+download "$repo/releases/download/$tag/$name.tar.gz" "$tmp/$name.tar.gz" ||
-for repo in $repos; do
+	fail "couldn't download $tag for $os/$arch: see $repo/releases"
-	base="$repo/releases/download/$tag"
+download "$repo/releases/download/$tag/checksums.txt" "$tmp/checksums.txt" ||
-	if download "$base/checksums.txt" "$tmp/checksums.txt" 2>/dev/null; then
+	fail "couldn't download $tag's checksums.txt"
-		echo "Downloading lazysecrets $tag for $os/$arch from $repo"
-		if download "$base/$name.tar.gz" "$tmp/$name.tar.gz"; then
-			from=$repo
-			break
-		fi
-	fi
-done
-[ -n "$from" ] || fail "couldn't download $tag for $os/$arch from $repos"
 
 want=$(awk -v f="$name.tar.gz" '$2 == f { print $1 }' "$tmp/checksums.txt")
 [ -n "$want" ] || fail "$name.tar.gz isn't in checksums.txt"

internal/config/config.go

@@ -14,7 +14,6 @@ import (
 	"go.yaml.in/yaml/v3"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
-	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 
 type Config struct {
@@ -41,10 +40,6 @@ type Config struct {
 	// background; defaults to true. U and lazysecrets update work either
 	// way.
 	UpdateCheck *bool `yaml:"updateCheck"`
-	// Releases are the repositories updates come from, tried in order:
-	// on GitHub, or a Gitea or Forgejo server. Defaults to GitHub, then
-	// git.kebcloud.no (update.DefaultServers).
-	Releases []string `yaml:"releases"`
 	// Cache keeps what was loaded (never values) between runs, so lists
 	// show at once and refresh in the background; defaults to true.
 	Cache *bool `yaml:"cache"`
@@ -216,11 +211,6 @@ func (c Config) validate(path string) error {
 	if d := c.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
 		return fmt.Errorf("%s: loadDelay: %s is not between 0s and 5s", path, *d)
 	}
-	for i, r := range c.Releases {
-		if _, err := update.API(r); err != nil || !strings.HasPrefix(r, "https://") {
-			return fmt.Errorf("%s: releases[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
-		}
-	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {
 			return fmt.Errorf("%s: providers.azure.vaults[%d]: %q is not an https:// vault URL", path, i, v)

internal/config/config_test.go

@@ -70,8 +70,6 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"old layout": "azure:\n  vaults: [https://kv.vault.azure.net/]\n",
 		"duration":   "timeout: soon\n",
 		"view":       "sourcesView: tree\n",
-		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
-		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
 	} {
 		if _, err := Load(write(t, content)); err == nil {
 			t.Errorf("%s: no error", name)
@@ -115,13 +113,6 @@ theme:
 	}
 }
 
-func TestReleases(t *testing.T) {
-	c, err := Load(write(t, "releases: [https://git.example.com/team/lazysecrets]\n"))
-	if err != nil || len(c.Releases) != 1 {
-		t.Errorf("releases = %v, %v", c.Releases, err)
-	}
-}
-
 func TestLoadDelay(t *testing.T) {
 	c, err := Load(write(t, "loadDelay: 300ms\n"))
 	if err != nil || c.LoadDelay == nil || *c.LoadDelay != 300*time.Millisecond {

internal/provider/repo/details.go

@@ -55,7 +55,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 		}
 		return out, nil
 	}
-	if last, ok := git("log", "-1", "--format=%h · %ar", "--", rel); ok && last != "" {
+	if last, ok := git("log", "-1", "--format=%h · %ar · %an: %s", "--", rel); ok && last != "" {
 		out = append(out, provider.Attr{Label: "last commit", Value: last})
 	}
 	return out, nil

internal/provider/repo/repo_test.go

@@ -505,7 +505,7 @@ func TestFileDetails(t *testing.T) {
 
 	d := details("secrets/app.yaml")
 	if d["encryption"].Value != "sops · age" || d["keys"].Value != "age age1xxxx" || d["git"].Value != "tracked" ||
-		!strings.HasSuffix(d["last commit"].Value, " ago") || strings.Contains(d["last commit"].Value, ":") || d["encrypted"].Value == "" {
+		!strings.Contains(d["last commit"].Value, "t: files") || d["encrypted"].Value == "" {
 		t.Errorf("sops yaml: %+v", d)
 	}
 	if d := details("prod.env"); d["keys"].Value != "age age1xxxx" {

internal/ui/app/app.go

@@ -489,7 +489,7 @@ func (m *Model) setVersions(items []provider.Object) {
 }
 
 func (m Model) Init() tea.Cmd {
-	cmds := []tea.Cmd{m.sourcesCmd(), m.spin.Tick, m.checkClipboard(), tea.RequestBackgroundColor}
+	cmds := []tea.Cmd{m.sourcesCmd(), m.spin.Tick, m.checkClipboard()}
 	if m.cachePath != "" || m.placeDir != "" {
 		cmds = append(cmds, tea.Tick(persistEvery, func(time.Time) tea.Msg { return persistTickMsg{} }))
 	}
@@ -514,9 +514,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	var cmds []tea.Cmd
 
 	switch msg := msg.(type) {
-	case tea.BackgroundColorMsg:
-		m.st = m.st.OnBackground(msg.Color, msg.IsDark())
-		return m, nil
 	case tea.WindowSizeMsg:
 		m.w, m.h = msg.Width, msg.Height
 
@@ -1719,8 +1716,7 @@ func (m Model) footerView() string {
 	} else if l != nil && l.Filtering() {
 		help = m.helpBar(keys.FilterHelp{Map: m.keys}.ShortHelp(), 2)
 	} else {
-		revealed := m.detail.State() == panes.ValueShown
+		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown()}.ShortHelp(), 2)
-		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), revealed: &revealed}.ShortHelp(), 2)
 	}
 	var lines []string
 	if !m.clipDeadline.IsZero() {

internal/ui/app/app_test.go

@@ -494,7 +494,7 @@ func TestVersionHistoryInDetail(t *testing.T) {
 	screen := d.screen()
 	for _, want := range []string{
 		"versions   3 · v to browse",
-		"   3f9c2a   2026-09-01 current",
+		"▸ 3f9c2a   2026-09-01 current", // the version shown above
 		"  91d3e0   2026-03-01 expired",
 		"  0a77c4   2025-09-01 disabled",
 	} {
@@ -502,9 +502,6 @@ func TestVersionHistoryInDetail(t *testing.T) {
 			t.Errorf("missing %q:\n%s", want, screen)
 		}
 	}
-	if strings.Contains(screen, "▸ 3f9c2a") {
-		t.Errorf("a cursor on a list that can't be moved in:\n%s", screen)
-	}
 	d.keys("3", "j") // api-key: only its current version
 	if !strings.Contains(d.screen(), "versions   1") || strings.Contains(d.screen(), "v to browse") {
 		t.Errorf("wrong history for api-key:\n%s", d.screen())
@@ -991,14 +988,9 @@ func TestRebindingShowsEverywhere(t *testing.T) {
 	if !strings.Contains(scr, "z to reveal") || strings.Contains(scr, "space to reveal") {
 		t.Errorf("detail hint doesn't follow the binding:\n%s", scr)
 	}
-	if !strings.Contains(lastLine(scr), "z show") {
+	if !strings.Contains(lastLine(scr), "z reveal/hide") {
 		t.Errorf("help bar: %q", lastLine(scr))
 	}
-	d.keys("z")
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "z hide") {
-		t.Errorf("help bar with the value shown: %q", bar)
-	}
-	d.keys("z")
 	if strings.Contains(scr, "to browse") {
 		t.Errorf("hint for unbound versions:\n%s", scr)
 	}
@@ -1184,18 +1176,6 @@ func TestDetailsFollowFocus(t *testing.T) {
 	}
 }
 
-func TestStatusLineCountsRepos(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t, fake.Azure(0), fake.Repos())
-	if line := strings.Split(d.screen(), "\n")[1]; !strings.Contains(line, "1 account · 3 repos") {
-		t.Errorf("status line: %q", line)
-	}
-	d = newDriver(t, fake.Azure(0))
-	if line := strings.Split(d.screen(), "\n")[1]; strings.Contains(line, "repo") {
-		t.Errorf("repos counted without any: %q", line)
-	}
-}
-
 func TestStatusPane(t *testing.T) {
 	t.Parallel()
 	var opened []string

internal/ui/app/expiring.go

@@ -60,7 +60,7 @@ func (m Model) expiringFields() []panes.Field {
 		}
 		out = append(out, f)
 	}
-	cov := m.coverageOf(ofKind(provider.KindAzure))
+	cov := m.coverageOf(provider.KindAzure)
 	switch {
 	case cov.vaults == 0 && len(items) == 0:
 		return nil

internal/ui/app/help.go

@@ -38,10 +38,6 @@ type contextHelp struct {
 	commands bool // custom commands apply here
 	account  bool // the fourth pane shows Fields (fields.go)
 	of       pane // what the fourth pane describes
-	// revealed, when set, says whether the selected value is shown, so
-	// the reveal key says just what it'll do: show or hide, the same
-	// width so the bar doesn't shift.
-	revealed *bool
 }
 
 func (c contextHelp) ShortHelp() []key.Binding {
@@ -63,15 +59,11 @@ func (c contextHelp) ShortHelp() []key.Binding {
 	}
 	switch c.focus {
 	case paneSources:
-		b = append(b, k.Enter, k.Search, k.Share, k.ShareMenu, k.Favourite, k.Favourites, k.Filter)
+		b = append(b, k.Enter, k.Search, k.Share, k.ShareMenu, k.Favourite, k.Favourites, k.Note, k.Filter)
 	case paneContainers:
-		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Open, k.Filter)
+		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Note, k.Open, k.Filter)
 	default:
-		reveal := k.Reveal
+		b = append(b, k.Reveal, k.Copy, k.Share, k.ShareMenu, k.Versions, k.Favourite, k.Note, k.Filter)
-		if c.revealed != nil {
-			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, map[bool]string{false: "show", true: "hide"}[*c.revealed]))
-		}
-		b = append(b, reveal, k.Copy, k.Share, k.ShareMenu, k.Versions, k.Favourite, k.Filter)
 	}
 	if c.commands {
 		b = append(b, k.Commands)

internal/ui/app/jump.go

@@ -147,8 +147,8 @@ func sourceMatches(r ref.Ref, src provider.Source) bool {
 	return src.ID == r.Subscription
 }
 
-// accountOf is the account part of a source's provider label ("alice" in
+// accountOf is the account part of a source's provider label ("dev" in
-// "Azure · alice"), or "" when there's a single account.
+// "Azure · dev"), or "" when there's a single account.
 func accountOf(src provider.Source) string {
 	account, ok := strings.CutPrefix(src.ProviderLabel, string(src.Kind)+" · ")
 	if !ok {

internal/ui/app/layout_test.go

@@ -136,11 +136,11 @@ func TestLayoutIsSaved(t *testing.T) {
 func TestContextHelpBar(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "S share") || !strings.HasSuffix(strings.TrimSpace(bar), "? help • q quit") || strings.Contains(bar, "space show") {
+	if bar := lastLine(d.screen()); !strings.Contains(bar, "S share…") || !strings.HasSuffix(strings.TrimSpace(bar), "? help • q quit") || strings.Contains(bar, "space reveal") {
 		t.Errorf("Sources help bar: %q", bar)
 	}
 	d.keys("3")
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "s copy link") || !strings.Contains(bar, "S share") {
+	if bar := lastLine(d.screen()); !strings.Contains(bar, "s copy link") || !strings.Contains(bar, "S share…") {
 		t.Errorf("Secrets help bar: %q", bar)
 	}
 }

internal/ui/app/repo_test.go

@@ -206,9 +206,9 @@ func TestSearchAllRepos(t *testing.T) {
 	for d.m.search.src > 0 {
 		d.send(tea.KeyPressMsg{Code: tea.KeyUp})
 	}
-	for d.m.search.scope().id != accountScope+"Repos" {
+	for d.m.search.scope().id != kindScope+string(provider.KindRepo) {
 		if d.m.search.src == len(d.m.search.scopes)-1 {
-			t.Fatalf("no Repos scope: %v", d.m.search.scopes)
+			t.Fatalf("no All repos scope: %v", d.m.search.scopes)
 		}
 		d.send(tea.KeyPressMsg{Code: tea.KeyDown})
 	}
@@ -235,7 +235,7 @@ func TestSearchAllRepos(t *testing.T) {
 	if azure() != azureBefore || d.m.crawl.running {
 		t.Errorf("searching all repos loaded Azure: %d → %d lists", azureBefore, azure())
 	}
-	if !strings.Contains(d.screen(), "Results in Repos") {
+	if !strings.Contains(d.screen(), "Results in all repos") {
 		t.Errorf("title:\n%s", d.screen())
 	}
 }

internal/ui/app/search.go

@@ -131,25 +131,13 @@ func (c coverage) complete() bool {
 	return c.sourcesListed == c.sources && c.vaultsLoaded == c.vaults
 }
 
-func (m *Model) searchCoverage() coverage { return m.coverageOf(nil) }
+func (m *Model) searchCoverage() coverage { return m.coverageOf("") }
 
-// providerFilter picks the providers a search or a load covers; nil is
+// coverageOf is searchCoverage for one kind of provider ("" for all).
-// all of them.
+func (m *Model) coverageOf(kind provider.Kind) coverage {
-type providerFilter func(provider.Provider) bool
-
-func ofKind(k provider.Kind) providerFilter {
-	return func(p provider.Provider) bool { return p.Kind() == k }
-}
-
-func ofProvider(id string) providerFilter {
-	return func(p provider.Provider) bool { return p.ID() == id }
-}
-
-// coverageOf is searchCoverage for the providers in.
-func (m *Model) coverageOf(in providerFilter) coverage {
 	var c coverage
 	for _, p := range m.providers {
-		if in != nil && !in(p) {
+		if kind != "" && p.Kind() != kind {
 			continue
 		}
 		for _, src := range m.sourceResults[p.ID()].sources {
@@ -209,12 +197,12 @@ func plural(n int, word string) string {
 
 // startCrawl loads every unlisted subscription's vaults and every vault's
 // secrets not loaded yet.
-func (m *Model) startCrawl() tea.Cmd { return m.startCrawlOf(nil) }
+func (m *Model) startCrawl() tea.Cmd { return m.startCrawlOf("") }
 
-// startCrawlOf is startCrawl for the providers in.
+// startCrawlOf is startCrawl for one kind of provider ("" for all).
-func (m *Model) startCrawlOf(in providerFilter) tea.Cmd {
+func (m *Model) startCrawlOf(kind provider.Kind) tea.Cmd {
 	for _, p := range m.providers {
-		if in != nil && !in(p) {
+		if kind != "" && p.Kind() != kind {
 			continue
 		}
 		for _, src := range m.sourceResults[p.ID()].sources {

internal/ui/app/search_test.go

@@ -42,15 +42,11 @@ func TestSearchLoaded(t *testing.T) {
 			t.Fatalf("missing %q:\n%s", want, d.screen())
 		}
 	}
-	d.typeText("api-key") // on All: found at once
+	d.typeText("api-key")
-	if !strings.Contains(d.screen(), "ctrl+s only platform-dev") {
+	if !strings.Contains(d.screen(), "no matches here · All searches everything") {
-		t.Errorf("no hint to narrow to the source:\n%s", d.screen())
-	}
-	d.send(ctrl('s'))
-	if !strings.Contains(d.screen(), "no matches here · All searches everything") || !strings.Contains(d.screen(), "ctrl+s searches all") {
 		t.Errorf("no hint to search everything:\n%s", d.screen())
 	}
-	d.send(ctrl('s'))
+	d.searchAll()
 	if !strings.Contains(d.screen(), "platform-prod / kv-app-prod / api-key") {
 		t.Fatalf("loaded secret not found:\n%s", d.screen())
 	}
@@ -66,8 +62,7 @@ func TestSearchLoaded(t *testing.T) {
 func TestSearchLoadsAsYouType(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
-	d.openSearch()
+	d.openSearch() // on the source the cursor is on: platform-prod
-	d.send(ctrl('s')) // only the source the cursor is on: platform-prod
 	// Typing loads the scope: that source, without ctrl+a.
 	d.typeText("smtp")
 	if !strings.Contains(d.screen(), "platform-prod / kv-shared-prod / smtp-password") {
@@ -81,7 +76,10 @@ func TestSearchLoadsAsYouType(t *testing.T) {
 	}
 
 	// On All: everything.
-	d.send(ctrl('s'))
+	d.keys("tab") // to the scopes
+	for d.m.search.src > 0 {
+		d.send(tea.KeyPressMsg{Code: tea.KeyUp})
+	}
 	d.typeText("-")
 	if _, ok := d.m.cache.containers[sourceRowKey("Azure", "sub-dev")]; !ok {
 		t.Errorf("typing on All didn't load the other sources:\n%s", d.screen())
@@ -185,61 +183,19 @@ func TestSearchStartsWhereYouAre(t *testing.T) {
 	d.keys("2", "j") // platform-prod / kv-shared-prod
 	d.openSearch()
 	v := d.m.search
-	scope := func() string { return ansiStrip(v.scopes[v.src].label) }
+	if got := ansiStrip(v.scopes[v.src].label); !strings.Contains(got, "platform-prod") {
-	if scope() != "All" {
+		t.Errorf("source not preselected: %q", got)
-		t.Errorf("opened on %q, want All", scope())
 	}
 	if v.res >= len(v.shown) || !strings.Contains(ansiStrip(v.shown[v.res].label), "kv-shared-prod") {
 		t.Errorf("vault not under the cursor:\n%s", d.screen())
 	}
-	d.send(ctrl('s')) // narrows to the source, and back
-	if !strings.Contains(scope(), "platform-prod") {
-		t.Errorf("ctrl+s narrowed to %q", scope())
-	}
-	d.send(ctrl('s'))
-	if scope() != "All" {
-		t.Errorf("second ctrl+s on %q, want All", scope())
-	}
 
-	// From Favourites: to Search, on All.
+	// From the Sources pane: just the source.
-	d.keys("esc", "]", "]") // stop typing; Favourites
+	d.keys("esc", "esc", "1", "j") // stop typing, close; platform-dev
-	d.send(ctrl('s'))
-	if v.tab != tabSearch || scope() != "All" {
-		t.Errorf("ctrl+s from another tab: tab %d, %q", v.tab, scope())
-	}
-
-	// From the Sources pane: the source.
-	d.keys("esc", "1", "j") // close; platform-dev
 	d.openSearch()
 	v = d.m.search
-	d.send(ctrl('s'))
+	if got := ansiStrip(v.scopes[v.src].label); !strings.Contains(got, "platform-dev") {
-	if !strings.Contains(scope(), "platform-dev") {
+		t.Errorf("source not preselected: %q", got)
-		t.Errorf("ctrl+s narrowed to %q", scope())
-	}
-}
-
-func TestSearchNarrowsToAccount(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t)
-	d.keys("1", "g") // the first group header
-	header, _ := d.m.sources.Selected()
-	d.openSearch()
-	d.send(ctrl('s'))
-	v := d.m.search
-	if v.scope().id != accountScope+header.provider {
-		t.Fatalf("ctrl+s on %q narrowed to %q", header.label, v.scope().id)
-	}
-	if len(v.shown) == 0 || !strings.Contains(d.screen(), "Results in "+header.label) {
-		t.Errorf("no results in the account:\n%s", d.screen())
-	}
-	for _, o := range v.shown {
-		if providerOf(o.group) != header.provider {
-			t.Errorf("result from another account: %q", ansiStrip(o.label))
-		}
-	}
-	// The account's sources are under it, indented.
-	if next := v.scopes[v.src+1]; next.group == "" || providerOf(next.group) != header.provider || !strings.HasPrefix(ansiStrip(next.label), "  ") {
-		t.Errorf("after the account: %q", ansiStrip(next.label))
 	}
 }
 
@@ -283,24 +239,6 @@ func TestGoToTabsAndModes(t *testing.T) {
 		t.Errorf("[ → tab %d, want Search:\n%s", v.tab, d.screen())
 	}
 
-	// g and G: top and bottom of the list with the cursor.
-	d.keys("G")
-	if v.res != len(v.shown)-1 || v.res == 0 {
-		t.Errorf("G on results: %d of %d", v.res, len(v.shown))
-	}
-	d.keys("g")
-	if v.res != 0 {
-		t.Errorf("g on results: %d", v.res)
-	}
-	d.keys("h", "G")
-	if v.src != len(v.scopes)-1 {
-		t.Errorf("G on scopes: %d of %d", v.src, len(v.scopes))
-	}
-	d.keys("g", "l")
-	if v.src != 0 {
-		t.Errorf("g on scopes: %d", v.src)
-	}
-
 	d.keys("/")
 	d.typeText("shared")
 	if !v.typing || len(v.shown) == 0 {

internal/ui/app/searchview.go

@@ -20,17 +20,16 @@ import (
 )
 
 // Go to is one popup for finding a place and going there. Tabs at the
-// top: Search has two lists side by side, the scope on the left (All, or
+// top: Favourites and Recent (from the store, so they work before
-// one source with how much of it is loaded: ○ ◐ ● ◌ ✗) and what's in it
+// anything loads) are one list each; Search has two lists side by side,
-// on the right; Favourites and Recent (from the store, so they work
+// the scope on the left (All, or one source with how much of it is
-// before anything loads) are one list each.
+// loaded: ○ ◐ ● ◌ ✗) and what's in it on the right.
 //
 // Like a pane, it's either browsing (letters: j/k, [ and ] for tabs, f
 // star, / to type) or typing a filter (ctrl+ letters). esc while typing
 // clears the text and goes back to browsing; esc while browsing closes.
 // F opens it on Favourites and R on Recent, browsing; search on Search,
-// typing, on All. search again narrows to the source you were in, and
+// typing.
-// back to All.
 //
 // The results don't move by themselves: as lists load, rows already shown
 // keep their order and new ones come after them, with the cursor on the
@@ -40,7 +39,7 @@ import (
 type searchView struct {
 	input   textinput.Model
 	typing  bool // the text field has the keyboard
-	tab     int  // tabSearch, tabFavs or tabRecent
+	tab     int  // tabFavs, tabRecent or tabSearch
 	results bool // in Search, the results have the cursor (else the scopes)
 
 	scopes []option // All, then the sources (Search)
@@ -50,7 +49,6 @@ type searchView struct {
 	shown  []option // the tab's (or scope's) entries matching the input
 	src    int      // cursor in scopes
 	res    int      // cursor in shown
-	here   string   // the scope of the source Go to was opened from, if any
 
 	// loaded are the scopes a search has loaded since the popup opened:
 	// typing loads the scope once, so lists that fail aren't asked for
@@ -59,25 +57,25 @@ type searchView struct {
 }
 
 const (
-	tabSearch = iota
+	tabFavs = iota
-	tabFavs
 	tabRecent
+	tabSearch
 	tabCount
 )
 
-var tabNames = [tabCount]string{"Search", "Favourites", "Recent"}
+var tabNames = [tabCount]string{"Favourites", "Recent", "Search"}
 
 const (
 	scopeFavs   = "#favs"
 	scopeRecent = "#recent"
 	allSources  = "#all"
-	accountScope = "#account:" // + a provider ID: an account's sources, or Databricks', or the repos
+	kindScope   = "#kind:" // + a provider kind: all of Azure, Databricks or repos
 )
 
 const goToTitle = "Go to"
 
-// showSearch opens Go to on Search, typing, on All, with the selected
+// showSearch opens Go to on Search, typing, in the source you're in
-// vault under the cursor.
+// (else All), with the selected vault under the cursor.
 func (m *Model) showSearch() tea.Cmd {
 	cmd := m.openGoTo(tabSearch, true)
 	m.preselect()
@@ -133,20 +131,17 @@ func (v *searchView) scope() option {
 // onSource reports whether the results come from one source.
 func (v *searchView) onSource() bool { return v.tab == tabSearch && v.scope().group != "" }
 
-// preselect starts where the user is: the selected source is the one
+// preselect starts where the user is: the selected source picked on the
-// search narrows to, and the selected vault or scope is under the cursor.
+// left, and the selected vault or scope under the cursor on the right.
 func (m *Model) preselect() {
 	v := m.search
 	row := m.sources.SelectedID()
-	account := ""
+	i := slices.IndexFunc(v.scopes, func(o option) bool { return o.group != "" && o.group == row })
-	if id, ok := strings.CutPrefix(row, "group:"); ok { // a group header
-		account = accountScope + id
-	}
-	i := slices.IndexFunc(v.scopes, func(o option) bool { return o.id == account || o.group != "" && o.group == row })
 	if i < 0 {
 		return
 	}
-	v.here = v.scopes[i].id
+	v.src = i
+	m.fillSearch(false)
 	if m.focus == paneSources {
 		return
 	}
@@ -176,36 +171,25 @@ func (m *Model) fillSearch(keep bool) {
 	}
 
 	sources, items := m.searchEntries()
-	all := option{label: "All", id: allSources, mark: m.coverageMark(nil)}
+	all := option{label: "All", id: allSources, mark: m.coverageMark("")}
-	// Grouped like the Sources pane: each account (or Databricks, or the
-	// repos) is a scope too, its sources under it, so a search can stay on
-	// one, like the repos (local, quick), without asking Azure for every
-	// vault. With only one, it's the same as All.
-	var groups []provider.Provider
-	for _, p := range m.providers {
-		if len(m.sourceResults[p.ID()].sources) > 0 {
-			groups = append(groups, p)
-		}
-	}
 	scopes := []option{all}
-	if len(groups) < 2 {
+	// All of one kind, so a search can stay on repos (local, quick)
-		scopes = append(scopes, sources...)
+	// without asking Azure for every vault; only with several kinds.
-	} else {
+	var kinds []provider.Kind
-		for _, p := range groups {
+	for _, p := range m.providers {
-			k := p.Kind()
+		if len(m.sourceResults[p.ID()].sources) > 0 && !slices.Contains(kinds, p.Kind()) {
+			kinds = append(kinds, p.Kind())
+		}
+	}
+	if len(kinds) > 1 {
+		for _, k := range kinds {
 			scopes = append(scopes, option{
-				label: m.st.Kind(k).Render(m.icons.Prefix(k) + p.Label()),
+				label: m.st.Kind(k).Render(m.icons.Prefix(k) + kindScopeLabel(k)),
-				id:    accountScope + p.ID(), kind: k, mark: m.coverageMark(ofProvider(p.ID())),
+				id:    kindScope + string(k), kind: k, mark: m.coverageMark(k),
 			})
-			for _, o := range sources {
-				if providerOf(o.group) == p.ID() {
-					o.label = "  " + o.label
-					scopes = append(scopes, o)
 		}
 	}
-		}
+	v.scopes, v.items = append(scopes, sources...), items
-	}
-	v.scopes, v.items = scopes, items
 	v.src = max(0, slices.IndexFunc(v.scopes, func(o option) bool { return o.id == atSrc }))
 
 	v.shown = v.match()
@@ -218,9 +202,17 @@ func (m *Model) fillSearch(keep bool) {
 	v.res = max(0, min(v.res, len(v.shown)-1))
 }
 
-// coverageMark is ○ ◐ ● for how much of the providers in is loaded.
+// kindScopeLabel names the scope of all of a kind's sources.
-func (m *Model) coverageMark(in providerFilter) string {
+func kindScopeLabel(k provider.Kind) string {
-	switch c := m.coverageOf(in); {
+	if k == provider.KindRepo {
+		return "All repos"
+	}
+	return "All " + string(k)
+}
+
+// coverageMark is ○ ◐ ● for how much of a kind ("" for all) is loaded.
+func (m *Model) coverageMark(kind provider.Kind) string {
+	switch c := m.coverageOf(kind); {
 	case c.complete():
 		return m.st.Success.Render("●")
 	case c.vaultsLoaded > 0:
@@ -229,28 +221,15 @@ func (m *Model) coverageMark(in providerFilter) string {
 	return m.st.Muted.Render("○")
 }
 
-// scopeAccount is the provider whose sources the scope covers, if it's
+// scopeKind is the kind a scope covers all of, if it's one of those.
-// an account's.
+func (v *searchView) scopeKind() (provider.Kind, bool) {
-func (v *searchView) scopeAccount() (string, bool) {
+	k, ok := strings.CutPrefix(v.scope().id, kindScope)
-	id, ok := strings.CutPrefix(v.scope().id, accountScope)
 	if !ok || v.tab != tabSearch {
 		return "", false
 	}
-	return id, true
+	return provider.Kind(k), true
 }
 
-// scopeFilter is what loading everything in the scope covers: an
-// account's, else all of them.
-func (v *searchView) scopeFilter() providerFilter {
-	if id, ok := v.scopeAccount(); ok {
-		return ofProvider(id)
-	}
-	return nil
-}
-
-// scopeName is the scope's label without colours or indent.
-func scopeName(o option) string { return strings.TrimSpace(ansi.Strip(o.label)) }
-
 // match lists the scope's entries matching the input, best first.
 func (v *searchView) match() []option {
 	var cand []option
@@ -260,9 +239,9 @@ func (v *searchView) match() []option {
 	case scopeRecent:
 		cand = v.recent
 	default:
-		account, ofAccount := v.scopeAccount()
+		kind, ofKind := v.scopeKind()
 		for _, o := range v.items {
-			if sc.id == allSources || ofAccount && providerOf(o.group) == account || sc.group != "" && o.group == sc.group {
+			if sc.id == allSources || ofKind && o.kind == kind || sc.group != "" && o.group == sc.group {
 				cand = append(cand, o)
 			}
 		}
@@ -341,9 +320,6 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 	// The actions shared by both modes, by their keys in the mode.
 	type modeKeys struct{ down, up, sources, results, switchList, star, load, loadAll, sel key.Binding }
 	k := modeKeys{km.GoDown, km.GoUp, km.GoSources, km.GoResults, km.GoSwitch, km.GoStar, km.GoLoad, km.GoLoadAll, km.GoSelect}
-	if key.Matches(msg, km.Search) {
-		return m.narrow()
-	}
 	if v.typing {
 		k = modeKeys{km.PopupDown, km.PopupUp, km.SearchSources, km.SearchResults, km.SearchSwitch, km.PopupStar, km.SearchLoad, km.SearchLoadAll, km.PopupSelect}
 		if key.Matches(msg, km.PopupClose) {
@@ -362,22 +338,6 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 			return nil
 		case key.Matches(msg, km.GoFilter):
 			return m.setTyping(true)
-		case key.Matches(msg, km.GoTop), key.Matches(msg, km.GoBottom):
-			n := len(v.shown)
-			if !v.results {
-				n = len(v.scopes)
-			}
-			i := 0
-			if key.Matches(msg, km.GoBottom) {
-				i = max(0, n-1)
-			}
-			if v.results {
-				v.res = i
-			} else if v.src != i {
-				v.src, v.res = i, 0
-				m.fillSearch(false)
-			}
-			return nil
 		case key.Matches(msg, km.Help):
 			return m.showKeybindingsFor(keys.GoTo)
 		case key.Matches(msg, km.GoNextTab), key.Matches(msg, km.GoPrevTab):
@@ -441,9 +401,11 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 		if v.onSource() {
 			return v.scope().reload(m)
 		}
-		return m.startCrawlOf(v.scopeFilter())
+		kind, _ := v.scopeKind()
+		return m.startCrawlOf(kind)
 	case inSearch && key.Matches(msg, k.loadAll):
-		return m.startCrawlOf(v.scopeFilter())
+		kind, _ := v.scopeKind()
+		return m.startCrawlOf(kind)
 	case key.Matches(msg, k.star):
 		if o, ok := v.selected(); ok && o.star != "" {
 			m.toggleStarKey(o.star, o.starAccount)
@@ -474,22 +436,6 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 	return cmd
 }
 
-// narrow switches Search between All and the source Go to was opened
-// from; from another tab, or another scope, it goes to Search on All.
-func (m *Model) narrow() tea.Cmd {
-	v := m.search
-	src := 0
-	if v.tab == tabSearch && v.scope().id == allSources {
-		src = slices.IndexFunc(v.scopes, func(o option) bool { return o.id == v.here })
-		if src < 0 {
-			return nil
-		}
-	}
-	v.tab, v.src, v.res, v.results = tabSearch, src, 0, true
-	m.fillSearch(false)
-	return m.searchLoads()
-}
-
 // searchLoads loads what a search in the Search tab covers, like the
 // load-all key: everything on All, else the source picked. Only what
 // isn't loaded yet, once a popup; repos load by themselves anyway.
@@ -506,8 +452,8 @@ func (m *Model) searchLoads() tea.Cmd {
 		v.loaded = map[string]bool{}
 	}
 	v.loaded[sc.id] = true
-	if _, ok := v.scopeAccount(); ok {
+	if kind, ok := v.scopeKind(); ok {
-		return m.startCrawlOf(v.scopeFilter())
+		return m.startCrawlOf(kind)
 	}
 	if !v.onSource() {
 		return m.startCrawl()
@@ -551,35 +497,6 @@ func (m *Model) toggleStarKey(key, account string) {
 // searchHint tops the results when what they come from isn't all
 // loaded, saying how to load it.
 func (m Model) searchHint() string {
-	load, narrow := m.loadHint(), m.narrowHint()
-	switch {
-	case narrow == "":
-		return load
-	case load != "":
-		narrow = " · " + narrow
-	}
-	return load + m.st.Muted.Render(narrow)
-}
-
-// narrowHint names the key for the other of All and the source Go to was
-// opened from.
-func (m Model) narrowHint() string {
-	v := m.search
-	if v.tab != tabSearch || m.crawl.running {
-		return ""
-	}
-	if v.scope().id == v.here && v.here != "" {
-		return withKey(m.keys.Search, "%s searches all")
-	}
-	i := slices.IndexFunc(v.scopes, func(o option) bool { return o.id == v.here })
-	if i < 0 || v.scope().id != allSources {
-		return ""
-	}
-	return withKey(m.keys.Search, "%s only "+scopeName(v.scopes[i]))
-}
-
-// loadHint says how much of the scope is loaded, and the key to load it.
-func (m Model) loadHint() string {
 	v := m.search
 	if m.crawl.running {
 		return m.st.Muted.Render(fmt.Sprintf("◌ loading… %d lists left", len(m.crawl.queue)+m.crawl.active))
@@ -587,8 +504,8 @@ func (m Model) loadHint() string {
 	if v.tab != tabSearch {
 		return "" // from the store: nothing to load
 	}
-	if _, ok := v.scopeAccount(); ok || v.scope().id == allSources {
+	if kind, ok := v.scopeKind(); ok || v.scope().id == allSources {
-		c := m.coverageOf(v.scopeFilter())
+		c := m.coverageOf(kind)
 		if c.complete() {
 			return ""
 		}
@@ -720,8 +637,14 @@ func (m Model) searchViewBox() string {
 	}
 	title := func(s string, active bool) string { return panes.TitleStyle(m.st, active && focused).Render(s) }
 	resultsTitle := map[string]string{scopeFavs: "Favourites", scopeRecent: "Recent", allSources: "Results in all sources"}[v.scope().id]
-	if _, ok := v.scopeAccount(); ok || v.onSource() {
+	if v.onSource() {
-		resultsTitle = "Results in " + scopeName(v.scope())
+		resultsTitle = "Results in " + ansi.Strip(v.scope().label)
+	}
+	if kind, ok := v.scopeKind(); ok {
+		resultsTitle = "Results in " + string(kind)
+		if kind == provider.KindRepo {
+			resultsTitle = "Results in all repos"
+		}
 	}
 	var lists string
 	if v.tab == tabSearch {

internal/ui/app/status.go

@@ -38,10 +38,9 @@ func (m Model) statusLine() string {
 	case m.newer != nil:
 		parts = append(parts, m.st.Notice.Render("↑ "+m.newer.Tag+withKey(m.keys.Update, " %s")))
 	}
-	accounts, failing, repos := 0, 0, 0
+	accounts, failing := 0, 0
 	for _, p := range m.providers {
 		if p.Kind() == provider.KindRepo {
-			repos += len(m.sourceResults[p.ID()].sources) // those with secret files
 			continue
 		}
 		accounts++
@@ -59,9 +58,6 @@ func (m Model) statusLine() string {
 		}
 		parts = append(parts, s)
 	}
-	if repos > 0 {
-		parts = append(parts, plural(repos, "repo"))
-	}
 	return " " + strings.Join(parts, m.st.Muted.Render(" · "))
 }
 
@@ -122,9 +118,7 @@ func (m Model) statusFields() []panes.Field {
 	repo := strings.TrimPrefix(update.DefaultRepo, "https://")
 	add(panes.Field{Label: "docs", Value: repo + "/…/docs", URL: update.DefaultRepo + "/src/branch/main/docs"})
 	add(panes.Field{Label: "source", Value: repo, URL: update.DefaultRepo})
-	// Issues are on the GitHub mirror.
+	add(panes.Field{Label: "issues", Value: repo + "/issues", URL: update.DefaultRepo + "/issues"})
-	github := strings.TrimPrefix(update.GitHubRepo, "https://")
-	add(panes.Field{Label: "issues", Value: github + "/issues", URL: update.GitHubRepo + "/issues"})
 	add(panes.Field{Label: "releases", Value: repo + "/releases", URL: update.DefaultRepo + "/releases"})
 	add(panes.Field{Label: "changelog", Value: repo + "/…/CHANGELOG.md", URL: update.DefaultRepo + "/src/branch/main/CHANGELOG.md"})
 	return append(out, m.changelog...)

internal/ui/app/testdata/TestGolden.golden

@@ -30,4 +30,4 @@
 │                               ││                                                                 │
 │                               ││                                                                 │
 ╰────────────────────── 1 of 3 ─╯╰──────────────────────────────────────────────────────── 1 of 4 ─╯
- enter open • ctrl+s search • s copy link • S share • f star • F favourites • … • ? help • q quit
+ enter open • ctrl+s search • s copy link • S share… • f star • F favourites • … • ? help • q quit

internal/ui/keys/keys.go

@@ -61,8 +61,7 @@ type Map struct {
 	SearchSources, SearchResults, SearchSwitch key.Binding
 	SearchLoad, SearchLoadAll                  key.Binding
 	// goto
-	GoDown, GoUp, GoTop, GoBottom       key.Binding
+	GoDown, GoUp, GoPrevTab, GoNextTab  key.Binding
-	GoPrevTab, GoNextTab                key.Binding
 	GoSources, GoResults, GoSwitch      key.Binding
 	GoStar, GoLoad, GoLoadAll, GoFilter key.Binding
 	GoSelect, GoClose                   key.Binding
@@ -103,7 +102,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "nextTab", &m.NextTab, "next tab", "lists", "Next tab of the focused pane."),
 		a(Lists, "sourcesView", &m.SourcesView, "grouped/flat sources", "lists", "Switch the Sources pane between grouped by provider and a flat list."),
 		a(Lists, "star", &m.Favourite, "star", "lists", "Star or unstar the selected subscription, vault or secret, for the account showing it. Starred items get a ★ and sort first."),
-		a(Lists, "search", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one. Again in Go to: only the source or group you're in, and back to all. On the left, the scope: All, an account (or Databricks, or Repos), or one source (○ ◐ ● for how much of it is loaded)."),
+		a(Lists, "search", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one, starting in the source you're in. On the left, the scope: Favourites, Recent, All, or one source (○ ◐ ● for how much of it is loaded)."),
 		a(Lists, "favourites", &m.Favourites, "favourites", "lists", "Go to, on Favourites: everything you've starred, to search and jump to."),
 		a(Lists, "recent", &m.Recent, "recent", "lists", "Go to, on Recent: what you used last, newest first."),
 		a(Lists, "commands", &m.Commands, "commands", "lists", "List the custom commands for the focused pane (customCommands in the config) and run one."),
@@ -117,7 +116,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "edit", &m.Edit, "open file", "secrets", "Open the selected SOPS or .env file, or the file of the selected secret at its line. SOPS files open with sops edit. Others open in the nvim lazysecrets runs in (quitting lazysecrets), else in $VISUAL or $EDITOR, else in the system's default app."),
 
 		a(Lists, "share", &m.Share, "copy link", "share", "Copy a lazysecrets:// link to the selected subscription, workspace, vault, scope or secret, for sharing. From the versions view the link is pinned to that version."),
-		a(Lists, "shareMenu", &m.ShareMenu, "share", "share", "Choose what to share: the lazysecrets link, the plain Key Vault URL, the config reference, or the web page."),
+		a(Lists, "shareMenu", &m.ShareMenu, "share…", "share", "Choose what to share: the lazysecrets link, the plain Key Vault URL, the config reference, or the web page."),
 		a(Lists, "openLink", &m.OpenRef, "open link", "share", "Open a lazysecrets:// link, Key Vault URL or reference. Pasting one into lazysecrets does the same."),
 
 		a(Lists, "dividerLeft", &m.SplitLeft, "divider left", "layout", "Move the divider between the left panes and the detail pane to the left."),
@@ -161,9 +160,7 @@ func (m *Map) Actions() []Action {
 
 		a(GoTo, "down", &m.GoDown, "down", "go to", "Move down in Go to while browsing."),
 		a(GoTo, "up", &m.GoUp, "up", "go to", "Move up in Go to while browsing."),
-		a(GoTo, "top", &m.GoTop, "top", "go to", "Jump to the top of the list in Go to while browsing."),
+		a(GoTo, "prevTab", &m.GoPrevTab, "prev tab", "go to", "Previous tab of Go to: Favourites, Recent, Search."),
-		a(GoTo, "bottom", &m.GoBottom, "bottom", "go to", "Jump to the bottom of the list in Go to while browsing."),
-		a(GoTo, "prevTab", &m.GoPrevTab, "prev tab", "go to", "Previous tab of Go to: Search, Favourites, Recent."),
 		a(GoTo, "nextTab", &m.GoNextTab, "next tab", "go to", "Next tab of Go to."),
 		a(GoTo, "sources", &m.GoSources, "sources", "go to", "Move to the sources list (Search tab)."),
 		a(GoTo, "results", &m.GoResults, "results", "go to", "Move to the results list (Search tab)."),
@@ -209,7 +206,7 @@ var defaults = map[string][]string{
 	"search.sources": {"ctrl+h"}, "search.results": {"ctrl+l"}, "search.switchList": {"tab", "shift+tab"},
 	"search.load": {"ctrl+r"}, "search.loadAll": {"ctrl+a"},
 
-	"goto.down": {"j", "down"}, "goto.up": {"k", "up"}, "goto.top": {"g", "home"}, "goto.bottom": {"G", "end"}, "goto.prevTab": {"["}, "goto.nextTab": {"]"},
+	"goto.down": {"j", "down"}, "goto.up": {"k", "up"}, "goto.prevTab": {"["}, "goto.nextTab": {"]"},
 	"goto.sources": {"h", "left"}, "goto.results": {"l", "right"}, "goto.switchList": {"tab", "shift+tab"},
 	"goto.star": {"f"}, "goto.load": {"r"}, "goto.loadAll": {"a"}, "goto.filter": {"/"},
 	"goto.select": {"enter"}, "goto.close": {"esc", "q"},

internal/ui/panes/detail.go

@@ -362,13 +362,11 @@ func (d Detail) versionLines(st styles.Styles) []string {
 			out = append(out, muted(fmt.Sprintf("   … %d more", len(d.versions)-i)))
 			break
 		}
-		// A list to read, not to move in (v browses them): no cursor. The
+		marker := "  "
-		// version shown above, when it isn't the current one, is named.
+		if d.secret.Version != "" && v.Version == d.secret.Version {
-		line := "   " + VersionLine(st, v, d.Now(), current)
+			marker = "▸ " // the version shown above
-		if d.secret.Version != "" && v.Version == d.secret.Version && v.Version != current {
-			line += muted(" · shown above")
 		}
-		out = append(out, line)
+		out = append(out, " "+marker+VersionLine(st, v, d.Now(), current))
 	}
 	return out
 }

internal/ui/styles/styles.go

@@ -3,8 +3,6 @@
 package styles
 
 import (
-	"image/color"
-
 	"charm.land/lipgloss/v2"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
@@ -34,10 +32,6 @@ type Styles struct {
 	KindAzure      lipgloss.Style
 	KindDatabricks lipgloss.Style
 	KindRepo       lipgloss.Style
-
-	// themed marks the selection colours as set by the theme, so
-	// OnBackground leaves them.
-	themed, themedBlurred bool
 }
 
 func Default() Styles {
@@ -49,12 +43,9 @@ func Default() Styles {
 		TitleBlurred:  lipgloss.NewStyle(),
 		Footer:        lipgloss.NewStyle().Faint(true),
 
-		// A background rather than reverse, so the row keeps its colours;
+		// A background rather than reverse, so the row keeps its colours.
-		// in every pane, so each shows what's selected in it. The focused
-		// pane's is bold too. Palette 8 until the terminal says what its
-		// background is (OnBackground).
 		Selected:        lipgloss.NewStyle().Background(lipgloss.BrightBlack).Bold(true),
-		SelectedBlurred: lipgloss.NewStyle().Background(lipgloss.BrightBlack),
+		SelectedBlurred: lipgloss.NewStyle().Bold(true),
 		Muted:           lipgloss.NewStyle().Faint(true),
 		Error:           lipgloss.NewStyle().Foreground(lipgloss.Red),
 		Notice:          lipgloss.NewStyle().Foreground(lipgloss.Green),
@@ -83,23 +74,3 @@ func (s Styles) Kind(k provider.Kind) lipgloss.Style {
 	}
 	return s.KindAzure
 }
-
-// OnBackground shades the selection colours from the terminal's
-// background, a little lighter on a dark one and darker on a light one:
-// a quiet band that keeps the row's colours readable, where palette 8 is
-// often too bright. Colours the theme sets are kept.
-func (s Styles) OnBackground(bg color.Color, dark bool) Styles {
-	shade := func(p float64) color.Color {
-		if dark {
-			return lipgloss.Lighten(bg, p)
-		}
-		return lipgloss.Darken(bg, p)
-	}
-	if !s.themed {
-		s.Selected = s.Selected.Background(shade(0.09))
-	}
-	if !s.themedBlurred {
-		s.SelectedBlurred = s.SelectedBlurred.Background(shade(0.05))
-	}
-	return s
-}

internal/ui/styles/theme.go

@@ -70,10 +70,8 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 			st.BorderBlurred = v.fg(lipgloss.NewStyle())
 		case "selectedLineBgColor":
 			st.Selected = v.bg(lipgloss.NewStyle()).Bold(true)
-			st.themed = true
 		case "inactiveViewSelectedLineBgColor":
 			st.SelectedBlurred = v.bg(lipgloss.NewStyle()).Bold(true)
-			st.themedBlurred = true
 		case "defaultFgColor":
 			fg = v.color
 		case "optionsTextColor":

internal/ui/styles/theme_test.go

@@ -1,7 +1,6 @@
 package styles
 
 import (
-	"fmt"
 	"strings"
 	"testing"
 
@@ -63,32 +62,3 @@ func TestEmptyThemeIsDefault(t *testing.T) {
 		t.Errorf("empty theme: %v %v reverse=%v bg=%v", err, fg, st.Selected.GetReverse(), st.Selected.GetBackground())
 	}
 }
-
-func TestOnBackground(t *testing.T) {
-	hex := func(c any) string {
-		r, g, b, _ := c.(interface{ RGBA() (r, g, b, a uint32) }).RGBA()
-		return fmt.Sprintf("#%02x%02x%02x", r>>8, g>>8, b>>8)
-	}
-	st := Default().OnBackground(lipgloss.Color("#282c34"), true)
-	if got := hex(st.Selected.GetBackground()); got != "#3e424a" {
-		t.Errorf("dark: selected %s", got)
-	}
-	if got := hex(st.SelectedBlurred.GetBackground()); got != "#343840" {
-		t.Errorf("dark: blurred %s", got)
-	}
-	if got := hex(Default().OnBackground(lipgloss.Color("#ffffff"), false).Selected.GetBackground()); got != "#e8e8e8" {
-		t.Errorf("light: selected %s", got)
-	}
-
-	themed, _, err := FromTheme(map[string][]string{"selectedLineBgColor": {"#2d3f76"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	st = themed.OnBackground(lipgloss.Color("#282c34"), true)
-	if got := hex(st.Selected.GetBackground()); got != "#2d3f76" {
-		t.Errorf("themed: selected %s (want the theme's)", got)
-	}
-	if got := hex(st.SelectedBlurred.GetBackground()); got != "#343840" {
-		t.Errorf("themed: blurred %s (not themed: shaded)", got)
-	}
-}

internal/update/update.go

@@ -3,9 +3,6 @@
 // against the release's checksums.txt, tried (--version), then renamed
 // over the binary. A running lazysecrets keeps its old binary until it
 // restarts.
-//
-// Releases are published in more than one place; each is tried in turn
-// (GitHub, then git.kebcloud.no), so one being down doesn't stop updates.
 package update
 
 import (
@@ -21,7 +18,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"os"
 	"os/exec"
 	"path"
@@ -34,20 +30,12 @@ import (
 	"golang.org/x/mod/semver"
 )
 
-// DefaultRepo is lazysecrets' home: its source, docs and releases.
+// Where releases are published.
-// GitHubRepo mirrors it, with the issues and the releases too.
 const (
+	DefaultAPI  = "https://git.kebcloud.no/api/v1/repos/keb/lazysecrets"
 	DefaultRepo = "https://git.kebcloud.no/keb/lazysecrets"
-	GitHubRepo  = "https://github.com/karleinarb/lazysecrets"
 )
 
-// DefaultServers are where releases are looked for, in order.
-var DefaultServers = []string{GitHubRepo, DefaultRepo}
-
-// latestTimeout bounds asking one server for the latest release, so a
-// server that's down leaves time for the next.
-const latestTimeout = 5 * time.Second
-
 // maxDownload bounds what's read from the server.
 const maxDownload = 200 << 20
 
@@ -72,20 +60,15 @@ func PlainLinks(s string) string { return mdLink.ReplaceAllString(s, "$1") }
 // and a terminal shows them as their text.
 var mdLink = regexp.MustCompile(`\[([^\]]+)\]\((https?://[^)\s]+)\)`)
 
-// Client talks to the release servers.
+// Client talks to the release server.
 type Client struct {
-	// Servers are the repositories' web addresses, on GitHub or a Gitea
+	API  string // the repository's API, DefaultAPI when empty
-	// or Forgejo server, tried in order; DefaultServers when empty.
+	Repo string // the repository's web address, DefaultRepo when empty
-	Servers []string
 	HTTP *http.Client
 }
 
-func (c *Client) servers() []string {
+func (c *Client) api() string  { return cmpOr(c.API, DefaultAPI) }
-	if len(c.Servers) > 0 {
+func (c *Client) repo() string { return cmpOr(c.Repo, DefaultRepo) }
-		return c.Servers
-	}
-	return DefaultServers
-}
 
 func (c *Client) client() *http.Client {
 	if c.HTTP != nil {
@@ -94,50 +77,25 @@ func (c *Client) client() *http.Client {
 	return &http.Client{Timeout: 2 * time.Minute}
 }
 
-// API is a repository's API: GitHub's for github.com, else Gitea's (and
+func cmpOr(a, b string) string {
-// Forgejo's).
+	if a != "" {
-func API(repo string) (string, error) {
+		return a
-	u, err := url.Parse(strings.TrimSuffix(repo, "/"))
-	if err != nil || u.Host == "" || strings.Count(u.Path, "/") != 2 {
-		return "", fmt.Errorf("%q isn't a repository's address, like %s", repo, GitHubRepo)
 	}
-	if u.Host == "github.com" {
+	return b
-		return "https://api.github.com/repos" + u.Path, nil
-	}
-	return u.Scheme + "://" + u.Host + "/api/v1/repos" + u.Path, nil
 }
 
-// Latest is the newest release (pre-releases aside), from the first
+// Latest is the newest release (pre-releases aside).
-// server that answers.
 func (c *Client) Latest(ctx context.Context) (Release, error) {
-	var errs []error
+	b, err := c.get(ctx, c.api()+"/releases/latest", 1<<20)
-	for _, repo := range c.servers() {
-		r, err := c.latest(ctx, repo)
-		if err == nil {
-			return r, nil
-		}
-		errs = append(errs, err)
-	}
-	return Release{}, errors.Join(errs...)
-}
-
-func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
-	api, err := API(repo)
-	if err != nil {
-		return Release{}, err
-	}
-	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
-	defer cancel()
-	b, err := c.get(ctx, api+"/releases/latest", 1<<20)
 	if err != nil {
 		return Release{}, err
 	}
 	var r Release
 	if err := json.Unmarshal(b, &r); err != nil {
-		return Release{}, fmt.Errorf("reading the latest release from %s: %w", repo, err)
+		return Release{}, fmt.Errorf("reading the latest release: %w", err)
 	}
 	if !semver.IsValid(r.Tag) {
-		return Release{}, fmt.Errorf("latest release %q on %s isn't a version", r.Tag, repo)
+		return Release{}, fmt.Errorf("latest release %q isn't a version", r.Tag)
 	}
 	return r, nil
 }
@@ -189,10 +147,23 @@ func (c *Client) Install(ctx context.Context, r Release, exe string) error {
 	}
 	version := strings.TrimPrefix(r.Tag, "v")
 	name := fmt.Sprintf("lazysecrets_%s_%s_%s", version, runtime.GOOS, runtime.GOARCH)
-	archive, err := c.download(ctx, r.Tag, name+".tar.gz")
+	base := c.repo() + "/releases/download/" + r.Tag + "/"
+
+	sums, err := c.get(ctx, base+"checksums.txt", 1<<20)
 	if err != nil {
 		return err
 	}
+	want, err := checksum(sums, name+".tar.gz")
+	if err != nil {
+		return err
+	}
+	archive, err := c.get(ctx, base+name+".tar.gz", maxDownload)
+	if err != nil {
+		return err
+	}
+	if got := sha256.Sum256(archive); hex.EncodeToString(got[:]) != want {
+		return fmt.Errorf("%s.tar.gz doesn't match checksums.txt: damaged, or not the release", name)
+	}
 	bin, err := extract(archive, path.Join(name, "lazysecrets"))
 	if err != nil {
 		return err
@@ -227,38 +198,6 @@ func (c *Client) Install(ctx context.Context, r Release, exe string) error {
 	return nil
 }
 
-// download fetches a release's file from the first server that has it,
-// checked against that server's checksums.txt. A file that doesn't match
-// stops there: it's damaged, or not the release.
-func (c *Client) download(ctx context.Context, tag, file string) ([]byte, error) {
-	var errs []error
-	for _, repo := range c.servers() {
-		base := strings.TrimSuffix(repo, "/") + "/releases/download/" + tag + "/"
-		sctx, cancel := context.WithTimeout(ctx, latestTimeout)
-		sums, err := c.get(sctx, base+"checksums.txt", 1<<20)
-		cancel()
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		want, err := checksum(sums, file)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", repo, err))
-			continue
-		}
-		b, err := c.get(ctx, base+file, maxDownload)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		if got := sha256.Sum256(b); hex.EncodeToString(got[:]) != want {
-			return nil, fmt.Errorf("%s from %s doesn't match checksums.txt: damaged, or not the release", file, repo)
-		}
-		return b, nil
-	}
-	return nil, errors.Join(errs...)
-}
-
 func (c *Client) get(ctx context.Context, url string, limit int64) ([]byte, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {

internal/update/update_test.go

@@ -70,13 +70,13 @@ func server(t *testing.T, tamper bool) *httptest.Server {
 		sum[0] ^= 0xff
 	}
 	mux := http.NewServeMux()
-	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/api/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprint(w, `{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}`)
 	})
-	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/repo/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintf(w, "%s  %s.tar.gz\n", hex.EncodeToString(sum[:]), name)
 	})
-	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/"+name+".tar.gz", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/repo/releases/download/v0.2.0/"+name+".tar.gz", func(w http.ResponseWriter, _ *http.Request) {
 		w.Write(archive.Bytes())
 	})
 	srv := httptest.NewServer(mux)
@@ -89,7 +89,7 @@ func TestInstall(t *testing.T) {
 		t.Skip("releases are for macOS and Linux")
 	}
 	srv := server(t, false)
-	c := &Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}
+	c := &Client{API: srv.URL + "/api", Repo: srv.URL + "/repo"}
 	r, err := c.Latest(context.Background())
 	if err != nil || r.Tag != "v0.2.0" {
 		t.Fatalf("latest %+v %v", r, err)
@@ -107,59 +107,12 @@ func TestInstall(t *testing.T) {
 	}
 }
 
-// A server that's down, or doesn't have the release, is skipped.
-func TestFallsBackToTheNextServer(t *testing.T) {
-	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
-		t.Skip("releases are for macOS and Linux")
-	}
-	down := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		http.Error(w, "down", http.StatusBadGateway)
-	}))
-	t.Cleanup(down.Close)
-	srv := server(t, false)
-	c := &Client{Servers: []string{down.URL + "/keb/lazysecrets", srv.URL + "/keb/lazysecrets"}}
-	r, err := c.Latest(context.Background())
-	if err != nil || r.Tag != "v0.2.0" {
-		t.Fatalf("latest %+v %v", r, err)
-	}
-	exe := filepath.Join(t.TempDir(), "lazysecrets")
-	os.WriteFile(exe, []byte("old"), 0o755)
-	if err := c.Install(context.Background(), r, exe); err != nil {
-		t.Fatal(err)
-	}
-	if b, _ := os.ReadFile(exe); !strings.Contains(string(b), "echo lazysecrets 0.2.0") {
-		t.Errorf("not replaced: %q", b)
-	}
-
-	// Every server down: both say why.
-	c = &Client{Servers: []string{down.URL + "/a/b", down.URL + "/c/d"}}
-	if _, err := c.Latest(context.Background()); err == nil || strings.Count(err.Error(), "502") != 2 {
-		t.Errorf("all down: %v", err)
-	}
-}
-
-func TestAPI(t *testing.T) {
-	for repo, want := range map[string]string{
-		"https://github.com/karleinarb/lazysecrets":   "https://api.github.com/repos/karleinarb/lazysecrets",
-		"https://git.kebcloud.no/keb/lazysecrets/":    "https://git.kebcloud.no/api/v1/repos/keb/lazysecrets",
-		"https://codeberg.org/someone/lazysecrets":    "https://codeberg.org/api/v1/repos/someone/lazysecrets",
-		"https://git.kebcloud.no/keb":                 "",
-		"git.kebcloud.no/keb/lazysecrets":             "",
-		"https://github.com/karleinarb/lazysecrets/x": "",
-	} {
-		got, err := API(repo)
-		if got != want || (err != nil) != (want == "") {
-			t.Errorf("API(%q) = %q, %v", repo, got, err)
-		}
-	}
-}
-
 func TestInstallRefusesATamperedArchive(t *testing.T) {
 	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
 		t.Skip("releases are for macOS and Linux")
 	}
 	srv := server(t, true)
-	c := &Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}
+	c := &Client{API: srv.URL + "/api", Repo: srv.URL + "/repo"}
 	exe := filepath.Join(t.TempDir(), "lazysecrets")
 	os.WriteFile(exe, []byte("old"), 0o755)
 	err := c.Install(context.Background(), Release{Tag: "v0.2.0"}, exe)

scripts/github-release.mjs

@@ -1,75 +0,0 @@
-// Copies a release GoReleaser published on Gitea to the GitHub mirror:
-// the same notes and the same files (dist/), so lazysecrets can update
-// from either (internal/update tries GitHub first). Run by the release
-// workflow after GoReleaser; a release already on GitHub for the tag is
-// replaced, like GoReleaser's mode: replace on Gitea.
-//
-//   TAG=v0.2.0 GH_TOKEN=… GITEA_TOKEN=… node scripts/github-release.mjs
-//
-// GH_TOKEN is a fine-grained token that can write the mirror's contents;
-// without it, this does nothing. No dependencies: Node 20's fetch.
-
-import { readdir, readFile } from "node:fs/promises";
-
-const github = "karleinarb/lazysecrets";
-const { TAG: tag, GH_TOKEN: token, GITEA_TOKEN: giteaToken, GITHUB_SHA: sha } = process.env;
-const gitea = `${process.env.GITHUB_SERVER_URL ?? "https://git.kebcloud.no"}/api/v1/repos/${process.env.GITHUB_REPOSITORY ?? "keb/lazysecrets"}`;
-
-if (!token) {
-  console.log("No GH_TOKEN: not copying the release to GitHub.");
-  process.exit(0);
-}
-if (!tag) throw new Error("TAG isn't set");
-
-const gh = (path, init = {}) =>
-  fetch(path.startsWith("https://") ? path : `https://api.github.com/repos/${github}${path}`, {
-    ...init,
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${token}`,
-      "X-GitHub-Api-Version": "2022-11-28",
-      ...init.headers,
-    },
-  });
-
-async function ok(res, what) {
-  if (!res.ok) throw new Error(`${what}: ${res.status} ${await res.text()}`);
-  return res;
-}
-
-// The notes as GoReleaser wrote them on Gitea.
-const rel = await (
-  await ok(await fetch(`${gitea}/releases/tags/${tag}`, { headers: giteaToken ? { Authorization: `token ${giteaToken}` } : {} }), "reading the Gitea release")
-).json();
-
-// Replace what's there for the tag.
-const old = await gh(`/releases/tags/${tag}`);
-if (old.ok) {
-  const { id } = await old.json();
-  await ok(await gh(`/releases/${id}`, { method: "DELETE" }), "deleting the old GitHub release");
-  console.log(`Deleted the GitHub release for ${tag}.`);
-}
-
-// The mirror may not have the tag's commit yet: it pushes on its own.
-// Wait for it a while.
-const body = JSON.stringify({ tag_name: tag, target_commitish: sha, name: rel.name || tag, body: rel.body, prerelease: rel.prerelease });
-let created;
-for (let i = 0; ; i++) {
-  const res = await gh("/releases", { method: "POST", body });
-  if (res.ok) {
-    created = await res.json();
-    break;
-  }
-  if (res.status !== 422 || i === 9) await ok(res, "creating the GitHub release");
-  console.log("GitHub doesn't have the commit yet; waiting for the mirror…");
-  await new Promise((r) => setTimeout(r, 30_000));
-}
-
-const files = (await readdir("dist")).filter((f) => f.endsWith(".tar.gz") || f === "checksums.txt");
-if (files.length === 0) throw new Error("nothing to upload in dist/");
-for (const f of files) {
-  const url = `https://uploads.github.com/repos/${github}/releases/${created.id}/assets?name=${encodeURIComponent(f)}`;
-  await ok(await gh(url, { method: "POST", headers: { "Content-Type": "application/octet-stream" }, body: await readFile(`dist/${f}`) }), `uploading ${f}`);
-  console.log(`Uploaded ${f}.`);
-}
-console.log(`Published ${tag} on GitHub: ${created.html_url}`);