feat: save the place on the periodic tick too

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -4,9 +4,8 @@ name: Release
 # as a pre-release) tests lazysecrets, then GoReleaser (.goreleaser.yaml)
 # builds it for macOS and Linux, arm64 and amd64, and publishes a Gitea
 # release with the archives, checksums and this release's section of the
-# changelog (git-cliff, cliff.toml), then copies it to the GitHub
-# mirror. Pushing the same tag again (after deleting it) replaces the
-# release in both places.
+# changelog (git-cliff, cliff.toml). Pushing the same tag again (after
+# deleting it) replaces the release.
 #
 #   scripts/release.sh v0.2.0    # updates CHANGELOG.md, tags and pushes
 
@@ -82,14 +81,3 @@ jobs:
           args: release --clean --release-notes ${{ runner.temp }}/notes.md
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Copy the release to GitHub
-        # The same notes and files on the GitHub mirror, which lazysecrets
-        # updates from first (internal/update). GH_RELEASE_TOKEN is a
-        # fine-grained token that can write the mirror's contents; without
-        # it the step does nothing.
-        run: node scripts/github-release.mjs
-        env:
-          TAG: ${{ github.ref_name }}
-          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,46 +0,0 @@
-name: Bug report
-description: Something in lazysecrets doesn't work as it should.
-labels: [bug]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for reporting! Please leave out secret values, tokens and anything else private: names of vaults and secrets are enough.
-  - type: textarea
-    id: what
-    attributes:
-      label: What happened
-      description: What you did, what you expected, and what happened instead.
-    validations:
-      required: true
-  - type: textarea
-    id: steps
-    attributes:
-      label: Steps to reproduce
-      description: If you can, try `lazysecrets --demo` first.
-      placeholder: |
-        1. lazysecrets --demo
-        2. ctrl+s, type …
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: The status pane shows it, e.g. `v0.1.0`.
-    validations:
-      required: true
-  - type: dropdown
-    id: source
-    attributes:
-      label: Where
-      multiple: true
-      options:
-        - Azure Key Vault
-        - Databricks
-        - SOPS or .env files
-        - Links
-        - Everywhere / not sure
-  - type: input
-    id: platform
-    attributes:
-      label: OS and terminal
-      placeholder: macOS 26, kitty + tmux

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Docs
-    url: https://git.kebcloud.no/keb/lazysecrets/src/branch/main/docs
-    about: Keys, sources, links, config and more.

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,20 +0,0 @@
-name: Feature request
-description: An idea for lazysecrets, or something that could work better.
-labels: [enhancement]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        lazysecrets stays focused on finding, reading and sharing secrets, so not every idea will make it in, but they're all read.
-  - type: textarea
-    id: problem
-    attributes:
-      label: What you're trying to do
-      description: The problem or the situation, more than the solution.
-    validations:
-      required: true
-  - type: textarea
-    id: idea
-    attributes:
-      label: Your idea
-      description: How you'd like it to work, if you have one in mind.

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 Every release of lazysecrets, newest first.
 
-## v0.1.0 – 2026-10-12
+## v0.1.0 – 2026-10-10
 
 Hello world 👋
 

README.md

@@ -1,28 +1,27 @@
 # lazysecrets
 
-A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic [lazygit](https://github.com/jesseduffield/lazygit).
-
-![lazysecrets](docs/assets/lazysecrets.png)
+A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.
 
 ## Main features
 
-- **Read-only**: lazysecrets never creates, changes or deletes a secret.
-  That's by design and may stay that way.
+- **Read-only**: lazysecrets never creates, changes or deletes a secret, so
+  it's safe to point at production. That's by design and may stay that way.
 - **Zero setup**: uses the logins you already have (`az`, the Databricks
   CLI, `sops`, `git`). No config file needed.
 - **Search everything**: `ctrl+s` searches every source at once, with
-  fzf-style matching.
-- **Share links**: Share `lazysecrets://` links with colleagues. A colleague opens it
+  fzf-style matching (`'exact`, `^prefix`, `suffix$`, `!not`), and jumps
+  straight to the result.
+- **Share links**: `s` copies a `lazysecrets://` link. A colleague opens it
   with their own access, from the terminal or with a click in the browser
   or chat.
-- **Neovim integration**: via [lazysecrets.nvim](https://github.com/karleinarb/lazysecrets.nvim)
 - **Careful with values**: values stay hidden until you reveal them, and
   copied values are cleared from the clipboard after 30 seconds.
 - **Scriptable**: `lazysecrets get <link>` prints a value for scripts and
   pipes.
-- **Favourites**: star the secrets you use most for easy access.
+- **Favourites**: star the secrets you use most and get back to them in one
+  key.
 - **Expiry warnings**: secrets, keys and certificates that expire soon are
-  marked, listed together in the status pane.
+  marked.
 - **Your way**: rebind any key, pick a theme, and add custom commands to run
   on a secret.
 - **Try it first**: `lazysecrets --demo` runs on built-in sample data.
@@ -38,9 +37,8 @@ On macOS or Linux (arm64 or x86_64):
 curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
 ```
 
-It installs the latest release, from GitHub or else
-[git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets/releases), into
-`~/.local/bin` after checking it against the release's checksums.
+It installs the latest [release](https://git.kebcloud.no/keb/lazysecrets/releases)
+into `~/.local/bin` after checking it against the release's checksums.
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
 
@@ -60,14 +58,12 @@ lazysecrets         # start lazysecrets
 lazysecrets --demo  # test with demo data
 ```
 
-Pick a source on the left, then a vault, then a secret. With nothing
-signed in yet, the right pane says how to get started. The keys you'll
+Pick a source on the left, then a vault, then a secret. The keys you'll
 use most:
 
 | Key | Action |
 |---|---|
-| `j`/`k`, `enter`, `esc` | move, drill in, back |
-| `l` / `h` | the details of what's selected / back |
+| `j`/`k`, `h`/`l`, `enter`, `esc` | move, switch panes, drill in, back |
 | `/` | filter the list you're in |
 | `space` | reveal / hide the value |
 | `y` | copy the value (cleared from the clipboard after 30s) |
@@ -98,20 +94,9 @@ lazysecrets never stores, caches or sends your secret values. It keeps the
 names and metadata of what you've loaded in a cache file readable only by
 you, to show it at once next time (`cache: false` turns it off). It talks
 only to the services you use it with, and collects no usage data. The one
-call of its own is a daily check for a new release, on GitHub or else
-git.kebcloud.no, which `updateCheck: false` turns off.
+call of its own is a daily check for a new release on this server, which
+`updateCheck: false` turns off.
 
-## Repositories
-
-The main repo of this codebase is at [git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets).
-The [GitHub mirror](https://github.com/karleinarb/lazysecrets) is for discoverability, issue-tracking and releases.
-It also makes it possible to give a ⭐ if you like lazysecrets!
-
-## Contributing
-
-I don't take pull requests as I don't have time to review and test them.
-But bug reports and ideas are very welcome!
-Open an [issue on GitHub](https://github.com/karleinarb/lazysecrets/issues) and I'll have a look.
 
 ## AI disclosure
 

changelog.go

@@ -1,10 +0,0 @@
-// Package lazysecrets holds what the module's root has for the app: the
-// changelog, embedded so the status pane can show it offline.
-package lazysecrets
-
-import _ "embed"
-
-// Changelog is CHANGELOG.md as of the build: every release up to it.
-//
-//go:embed CHANGELOG.md
-var Changelog string

cliff.toml

@@ -25,7 +25,6 @@ Hello world 👋
 ### {{ group | striptags | trim }}
 {% for commit in commits %}
 - {% if commit.breaking %}**Breaking:** {% endif %}{{ commit.message | split(pat="\n") | first | upper_first | trim }}\
-([{{ commit.id | truncate(length=7, end="") }}](https://git.kebcloud.no/keb/lazysecrets/commit/{{ commit.id }}))\
 {% endfor %}
 {% endfor %}\n
 """
@@ -34,8 +33,6 @@ trim = true
 # Runs on each part (header, every release) separately.
 postprocessors = [
   { pattern = "\n{3,}", replace = "\n\n" },
-  # Squash commits end in the PR's number: link it.
-  { pattern = "\\(#([0-9]+)\\)", replace = "([#${1}](https://git.kebcloud.no/keb/lazysecrets/pulls/${1}))" },
 ]
 
 [git]
@@ -49,8 +46,6 @@ commit_preprocessors = [
   # A merge commit (not a squash) says "Merge pull request 'feat: …' (#4)
   # from branch into main": keep the title and number.
   { pattern = "^Merge pull request '(.+)' \\((#[0-9]+)\\) from .*", replace = "${1} (${2})" },
-  # #11 was squash-merged with #10 (the status pane) in it: name both.
-  { pattern = "^feat: link each changelog entry to its PR and commit \\(#11\\)", replace = "feat: a status pane (0) with version, updates, accounts, files and links; changelog entries link to their PR and commit (#11)" },
   # Titles may be written "[feat] x", "[feat]: x" or "feat:x" (see
   # pr-title.yml); all become "feat: x".
   { pattern = "^\\[(feat|fix|perf|refactor|docs|test|ci|chore|build|style|revert)(\\([^)]*\\))?(!?)\\](!?):?\\s*", replace = "${1}${2}${3}${4}: " },

cmd/lazysecrets/main.go

@@ -16,7 +16,6 @@ import (
 
 	tea "charm.land/bubbletea/v2"
 
-	"git.kebcloud.no/keb/lazysecrets"
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
 	"git.kebcloud.no/keb/lazysecrets/internal/config"
 	"git.kebcloud.no/keb/lazysecrets/internal/instance"
@@ -155,7 +154,7 @@ Flags:
 	case len(args) > 0 && args[0] == "launch":
 		return launch(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "update":
-		return updateCmd(*configPath, args[1:])
+		return updateCmd(args[1:])
 	case len(args) == 0:
 	case args[0] == "open" && len(args) == 2:
 		r, err := ref.Parse(args[1])
@@ -243,10 +242,9 @@ Flags:
 	if *demo {
 		// Two Azure accounts, like a personal and an admin login in az.
 		providers = []provider.Provider{
-			fake.Azure(400*time.Millisecond).As("Azure:alice@example.com/demo", "Azure · alice"),
-			fake.AzureOps(700*time.Millisecond).As("Azure:admin.alice@example.com/demo", "Azure · admin.alice"),
+			fake.Azure(400*time.Millisecond).As("Azure:dev@example.com/demo", "Azure · dev"),
+			fake.AzureOps(700*time.Millisecond).As("Azure:ops@example.com/demo", "Azure · ops"),
 			fake.Databricks(600 * time.Millisecond),
-			fake.Repos(),
 		}
 	} else {
 		pc := cfg.Providers
@@ -364,16 +362,13 @@ Flags:
 		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
 		HideOnBlur:     config.On(cfg.HideOnBlur),
 		HandlerSetup:   setup,
-		Updater:        updater(cfg.Releases),
+		Updater:        updater(),
 		UpdateCheck:    config.On(cfg.UpdateCheck),
 		Keys:           &keymap,
 		Commands:       cfg.CustomCommands,
 		Version:        versionString(),
 		Store:          st,
 		CacheFile:      cacheFile,
-		ConfigFiles:    configFiles(*configPath),
-		StatePath:      statePath,
-		Changelog:      lazysecrets.Changelog,
 		Dir:            placeDir,
 		Open:           open,
 		Styles:         &theme,
@@ -386,22 +381,3 @@ Flags:
 	}
 	return err
 }
-
-// configFiles are the config files given, for the status pane: those
-// that exist, or the first if none does (where to create one).
-func configFiles(list string) []string {
-	var all, found []string
-	for _, f := range strings.Split(list, ",") {
-		if f = strings.TrimSpace(f); f == "" {
-			continue
-		}
-		all = append(all, f)
-		if _, err := os.Stat(f); err == nil {
-			found = append(found, f)
-		}
-	}
-	if len(found) == 0 && len(all) > 0 {
-		return all[:1]
-	}
-	return found
-}

cmd/lazysecrets/update.go

@@ -7,16 +7,14 @@ import (
 	"strings"
 	"time"
 
-	"git.kebcloud.no/keb/lazysecrets/internal/config"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/app"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 
 // updater is the app's way to find and install releases, replacing the
-// binary that's running, from the servers (config releases) or the
-// default ones.
-func updater(servers []string) *app.Updater {
-	c := &update.Client{Servers: servers}
+// binary that's running.
+func updater() *app.Updater {
+	c := &update.Client{}
 	return &app.Updater{
 		Latest: c.Latest,
 		Install: func(ctx context.Context, r update.Release) error {
@@ -31,19 +29,15 @@ func updater(servers []string) *app.Updater {
 
 // updateCmd is lazysecrets update [--check]: the newer release's
 // changelog, then (unless --check) install it.
-func updateCmd(configPath string, args []string) error {
+func updateCmd(args []string) error {
 	check := len(args) == 1 && args[0] == "--check"
 	if len(args) > 0 && !check {
 		return errors.New("usage: lazysecrets update [--check]")
 	}
-	cfg, err := config.LoadAll(strings.Split(configPath, ","))
-	if err != nil {
-		return err
-	}
 	current := versionString()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
-	c := &update.Client{Servers: cfg.Releases}
+	c := &update.Client{}
 	r, err := c.Latest(ctx)
 	if err != nil {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)

docs/azure.md

@@ -13,18 +13,8 @@ is listed under each, since their permissions can differ.
 A service principal is used instead when `AZURE_CLIENT_ID`,
 `AZURE_TENANT_ID` and a secret or certificate are set in the environment.
 
-On an account's group row, the fourth pane shows who it signs in as: name,
-user, tenant, object ID, whether the session used MFA, directory roles
-(built-in ones by name) and its subscriptions, read from az's account list
-and the token lazysecrets already has: no requests of their own. `y` on
-the row copies the object ID, the one access policies and role
-assignments ask for; `l` goes into the pane, where `j`/`k` pick any
-field, `/` filters them (`/tenant`) and `y` copies the selected one.
-
-If an account's az login has expired, the status line says so once, and the
-Details pane on that account's rows says it until you sign in: press `L`
-there to run `az login` for it without leaving lazysecrets, and everything
-reloads.
+If your az login expires mid-session, the status line says so: press `L` to
+run `az login` without leaving lazysecrets, and everything reloads.
 
 ## Permissions
 
@@ -38,10 +28,8 @@ vault resources (e.g. *Reader*). Key Vault data-plane access is separate
 | read secret values | *Key Vault Secrets User* |
 | read certificate details | *Key Vault Certificate User* |
 
-A missing permission is shown in the pane, shortened to what was denied
-(the action, or the access policy permission), with what to check: a
-role or group to activate in PIM, access from the vault's owner, or, when
-its firewall refused, the network you're on.
+A missing permission is shown in the pane, including the action that was
+denied.
 
 ## Vaults you can't discover
 
@@ -64,15 +52,3 @@ Secrets, keys and certificates, each on their own tab of the Secrets pane
 key (PEM public key) or certificate; private key material is never
 fetched. `v` lists an item's versions. Items expiring within
 `expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
-
-The status pane (`0`) lists them across every vault loaded, opened or
-cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`
-on one goes to it. That makes no requests of its own: expiry dates come
-with the lists. It says how many vaults it covers; `ctrl+a` in search
-loads the rest.
-
-On a vault, the right pane shows its settings: resource group, location,
-SKU, whether access is by Azure roles or access policies, soft delete and
-purge protection, which networks can reach it, private endpoints and tags.
-They come with the list of vaults, so they cost no extra requests and are
-cached with it.

docs/config.md

@@ -15,9 +15,6 @@ loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s
 sourcesView: grouped   # or flat; ` toggles it
 collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
 updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
-releases:              # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
-  - https://github.com/karleinarb/lazysecrets
-  - https://git.kebcloud.no/keb/lazysecrets
 history: true          # count uses of items for Recent (R)
 cache: true            # keep what was loaded (never values) for the next start
 providers:
@@ -59,7 +56,7 @@ theme:
   activeBorderColor: ["#ff966c", bold]   # focused pane
   inactiveBorderColor: ["#589ed7"]
   selectedLineBgColor: ["#2d3f76"]       # cursor row background (default: palette 8)
-  inactiveViewSelectedLineBgColor: ["#2f334d"] # in the other panes (default: palette 8, not bold)
+  inactiveViewSelectedLineBgColor: ["#2f334d"]
   defaultFgColor: ["#c8d3f5"]
   optionsTextColor: ["#82aaff"]          # keys and labels
   searchMatchColor: ["#ffc777", bold]
@@ -117,9 +114,8 @@ What lazysecrets has loaded is kept in
 you: the Sources lists, vaults and scopes, and secrets' names and metadata
 (tags, dates, references), never values. On the next start they show at
 once, and anything older than two minutes reloads in the background when
-you go to it, or when Go to searches it. While it does, the pane's
-bottom border says how old what it shows is (`cached 3h ago`). Revealing
-and copying always fetch the value live.
+you go to it, or when Go to searches it. Revealing and copying always
+fetch the value live.
 
 Lists not loaded for 30 days are dropped, and so is everything from an
 account you're no longer signed in to. Repos aren't cached: their files
@@ -128,17 +124,14 @@ are read from disk anyway. Deleting the file is always safe, and
 
 ## Updates
 
-Once a day (`updateCheck`), in the background, lazysecrets asks for the
-latest release; within the day it reuses the answer from the state file.
-Releases are published on GitHub and on git.kebcloud.no, and it asks
-them in that order, the next when one doesn't answer within 5 seconds;
-`releases` lists others, such as a mirror of your own. Offline, or with
-every server down, it says nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
+Once a day (`updateCheck`), in the background, lazysecrets asks the
+release server for the latest release; within the day it reuses the
+answer from the state file. Offline, or with the server down, it says
+nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
 `lazysecrets update --check`) shows its changelog.
 
 Updating (`u` there, or `lazysecrets update`) downloads the release for
-your OS and CPU from the first server that has it, checks it against
-that server's `checksums.txt`, makes
+your OS and CPU, checks it against the release's `checksums.txt`, makes
 sure it runs, and only then replaces the binary, atomically: a
 lazysecrets that's running keeps working, and the next start is the new
 version. A binary a package manager owns (Homebrew, Nix, a distro

docs/databricks.md

@@ -13,10 +13,6 @@ Secrets in Azure Key Vault-backed scopes are read through Databricks; if
 Databricks refuses, lazysecrets reads the backing vault directly with your
 az login (which then needs the [Key Vault roles](azure.md#permissions)).
 
-When Databricks refuses, the pane says what to check: access to the
-workspace and READ on the scope, or, when the workspace's IP access list
-refused, the network you're on.
-
 Hide profiles you don't want in the [config](config.md):
 
 ```yaml

docs/development.md

@@ -56,12 +56,8 @@ from the pull request titles. The tag runs the release workflow
 (`.gitea/workflows/release.yml`): it tests, then
 [GoReleaser](https://goreleaser.com) (`.goreleaser.yaml`) builds the
 archives and publishes a Gitea release with them and the release's
-changelog section. Then `scripts/github-release.mjs` copies that release,
-notes and files, to the GitHub mirror, with the `GH_RELEASE_TOKEN`
-secret (a fine-grained token that can write the mirror's contents);
-without the secret it skips that. `goreleaser release --snapshot
---clean` builds the same archives locally, into `dist/`, without
-publishing.
+changelog section. `goreleaser release --snapshot --clean` builds the same
+archives locally, into `dist/`, without publishing.
 
 A suffix (`v0.2.0-rc.1`) makes a pre-release, which leaves `CHANGELOG.md`
 alone.

docs/keys.md

@@ -13,8 +13,7 @@ The rule: a letter in the lists, ctrl+ that letter where you type a filter
 |---|---|
 | `j`/`k`, `↑`/`↓` | move |
 | `g`/`G` | top / bottom |
-| `tab`, `shift+tab`/`h` | next / previous pane |
-| `l` | the details of what's selected, on the right (`h` goes back) |
+| `tab`/`l`, `shift+tab`/`h` | next / previous pane |
 | `1`–`4` | jump to pane |
 | `enter` / `esc`, `⌫` | drill in / back (also clears a filter or leaves the versions view) |
 | `[` / `]` | previous / next tab of the focused pane: Sources and Favourites in Sources; Secrets, Keys, Certs in Secrets |
@@ -49,22 +48,16 @@ match case exactly.
 | Key | Action |
 |---|---|
 | `space` | reveal / hide the selected value (public material for keys and certificates) |
-| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID; in its pane, the selected field |
+| `y` | copy the value without revealing it; cleared from the clipboard after 30s |
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
-| `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
 | `s` / `S` | copy a [link](links.md) to the selected item / share menu |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |
 | `L` | sign in again (shown when a login has expired) |
 | `U` | a newer lazysecrets: its changelog, and update in place (restart to use it); or look for one |
 
-A revealed value is shown as it reads best: JSON indented, and PEM
-certificates as their subject, issuer, dates, names and thumbprint, with
-any other PEM block (a private key) named but not shown. `y` still copies
-it exactly as stored.
-
 A revealed value hides again after `revealTimeout` (60s) and when the
 terminal loses focus (`hideOnBlur`); see [config](config.md).
 
@@ -84,24 +77,20 @@ under every account. Both are kept in the [state file](config.md#state).
 starred) and `R` on Recent (what you used last). `enter` goes to the
 selected item.
 
-Search has the scope on the left and what's in it on the right. The
-scopes are All, then grouped like the Sources pane: each account (or
-Databricks, or Repos) with its sources under it, with `○ ◐ ●` for how
-much of each is loaded. Repos searches every repo without asking Azure
-or Databricks for anything. Go to opens on All; `ctrl+s` again narrows
-it to the source or group selected in the Sources pane, and once more
-goes back to All. Typing a search loads what it covers: everything on
-All, else the account or source picked; results appear as lists
-arrive. That's once each time Go to opens, and only what isn't loaded
-yet; `ctrl+a` loads again, lists that failed included.
+Search has the scope on the left (All; all of Azure, Databricks or repos;
+or one source; with `○ ◐ ●` for how much of it is loaded) and what's in
+it on the right. All repos searches every repo without asking Azure or
+Databricks for anything. It opens on the
+source you're in. Typing a search loads what it covers: everything on
+All, else the source picked; results appear as lists arrive. That's once
+each time Go to opens, and only what isn't loaded yet; `ctrl+a` loads
+again, lists that failed included.
 
 Like a pane, Go to is either browsing or typing a filter:
 
 | Browsing | Typing | Action |
 |---|---|---|
 | `j`/`k` | `ctrl+j`/`ctrl+k` | move |
-| `g`/`G` | | top / bottom |
-| `ctrl+s` | `ctrl+s` | only the source or group you're in / All |
 | `h`/`l`, `tab` | `ctrl+h`/`ctrl+l`, `tab` | scope list / results |
 | `[` / `]` | | previous / next tab |
 | `f` | `ctrl+f` | star |
@@ -115,24 +104,6 @@ anything loads.
 
 ## Layout
 
-The pane on the right describes what's selected in the pane you're in: the
-account or subscription in Sources, the vault in Vaults, the secret in
-Secrets. Going into it (`l`, or `4`) keeps it on that; there `j`/`k`,
-`/` and `y` work on its rows, and `h` goes back. A value you reveal stays in view whichever pane you're in, until
-it's hidden.
-
-On top, the status pane (`0`) shows the version, a newer release and how
-your accounts are doing. Focused, the right pane lists more under the
-logo (when there's room): the version and updates (`U`), each account
-(`L` on one that needs it signs in), what's expiring (`enter` goes to
-it), this session's errors, newest first (what a pane showed, or the
-footer flashed before you moved on; not kept after quitting), the config,
-state and cache files (`e` opens one in your editor), and links to the
-docs, source, issues, releases and changelog (`o` opens one; on the
-version or update, its release), then the changelog of every release up
-to yours, built in so it needs no network: `/` filters it (`/fixed`,
-`/search`). `y` copies any row.
-
 | Key | Action |
 |---|---|
 | `ctrl+←`/`ctrl+→` or `<`/`>` | move the divider between the left panes and the detail pane |

docs/repos.md

@@ -63,31 +63,6 @@ copying or `lazysecrets get` decrypts one value with your `sops` binary, so
 whatever sops uses works (age keys, Azure Key Vault through az, AWS/GCP
 KMS, PGP). When sops can't decrypt, its whole error message is shown.
 
-On a file, the right pane shows how it's encrypted and the keys it's
-encrypted for (public: age recipients, Key Vault keys, KMS ARNs, PGP
-fingerprints), when it was last encrypted, and what git knows of it:
-tracked, ignored or neither, and its last commit. A plain `.env` file that
-git tracks, or that isn't ignored, is marked in red: its values are in the
-repo's history, or easily could be.
-
-## Opening files
-
-`e` opens the selected file, or on a secret, its file at that key's line:
-
-- **SOPS files** open with `sops edit`, which decrypts them into your
-  editor (`$SOPS_EDITOR` or `$EDITOR`) and encrypts them again when you
-  save. lazysecrets comes back after, with the file's keys reloaded.
-- **Other files**, when lazysecrets runs inside nvim (its plugin, or
-  `:terminal`): lazysecrets quits and the file opens in that nvim, in the
-  window you came from.
-- Otherwise in `$VISUAL` or `$EDITOR` in the terminal, coming back after;
-  without either, in the system's default app for the file.
-
-Editors that take a line (vim, nvim, nano, emacs, micro, helix, VS Code,
-Zed, Sublime and others) start on the key. With `sops edit` that works for
-editors taking `+N` (vim, nvim, nano, emacs, micro and others), and needs
-sops 3.8 or later.
-
 ## Links
 
 Links name the repo by its git remote, so they open in a colleague's clone

install.sh

@@ -7,12 +7,10 @@
 #
 # LAZYSECRETS_INSTALL_DIR installs somewhere else. macOS and Linux, arm64
 # and x86_64.
-#
-# Releases are on GitHub and git.kebcloud.no, tried in that order;
-# LAZYSECRETS_RELEASES (repository addresses, space-separated) uses others.
 set -eu
 
-repos="${LAZYSECRETS_RELEASES:-https://github.com/karleinarb/lazysecrets https://git.kebcloud.no/keb/lazysecrets}"
+repo=https://git.kebcloud.no/keb/lazysecrets
+api=https://git.kebcloud.no/api/v1/repos/keb/lazysecrets
 dir="${LAZYSECRETS_INSTALL_DIR:-$HOME/.local/bin}"
 
 fail() {
@@ -20,13 +18,12 @@ fail() {
 	exit 1
 }
 
-# Short timeouts, so a server that's down leaves time for the next.
 if command -v curl >/dev/null 2>&1; then
-	fetch() { curl -fsSL --connect-timeout 5 --max-time 15 "$1"; }
-	download() { curl -fsSL --connect-timeout 5 -o "$2" "$1"; }
+	fetch() { curl -fsSL "$1"; }
+	download() { curl -fsSL -o "$2" "$1"; }
 elif command -v wget >/dev/null 2>&1; then
-	fetch() { wget -qO- -T 15 "$1"; }
-	download() { wget -qO "$2" -T 30 "$1"; }
+	fetch() { wget -qO- "$1"; }
+	download() { wget -qO "$2" "$1"; }
 else
 	fail "needs curl or wget"
 fi
@@ -42,26 +39,11 @@ arm64 | aarch64) arch=arm64 ;;
 *) fail "no release for $(uname -m)" ;;
 esac
 
-# api is a repository's API: GitHub's, or Gitea's (and Forgejo's).
-api() {
-	case "$1" in
-	https://github.com/*) echo "https://api.github.com/repos/${1#https://github.com/}" ;;
-	*)
-		host=${1#*://}
-		host=${host%%/*}
-		echo "${1%%://*}://$host/api/v1/repos/${1#*://"$host"/}"
-		;;
-	esac
-}
-
 tag="${1:-}"
 if [ -z "$tag" ]; then
-	for repo in $repos; do
-		tag=$(fetch "$(api "$repo")/releases/latest" 2>/dev/null |
-			sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' | head -n 1) || tag=
-		[ -n "$tag" ] && break
-	done
-	[ -n "$tag" ] || fail "couldn't look up the latest release on $repos"
+	tag=$(fetch "$api/releases/latest" | sed -n 's/.*"tag_name":"\([^"]*\)".*/\1/p') ||
+		fail "couldn't look up the latest release"
+	[ -n "$tag" ] || fail "couldn't look up the latest release"
 fi
 case "$tag" in
 v*) ;;
@@ -73,19 +55,11 @@ name="lazysecrets_${version}_${os}_${arch}"
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 
-# The archive and its checksums.txt from the first server that has both.
-from=
-for repo in $repos; do
-	base="$repo/releases/download/$tag"
-	if download "$base/checksums.txt" "$tmp/checksums.txt" 2>/dev/null; then
-		echo "Downloading lazysecrets $tag for $os/$arch from $repo"
-		if download "$base/$name.tar.gz" "$tmp/$name.tar.gz"; then
-			from=$repo
-			break
-		fi
-	fi
-done
-[ -n "$from" ] || fail "couldn't download $tag for $os/$arch from $repos"
+echo "Downloading lazysecrets $tag for $os/$arch"
+download "$repo/releases/download/$tag/$name.tar.gz" "$tmp/$name.tar.gz" ||
+	fail "couldn't download $tag for $os/$arch: see $repo/releases"
+download "$repo/releases/download/$tag/checksums.txt" "$tmp/checksums.txt" ||
+	fail "couldn't download $tag's checksums.txt"
 
 want=$(awk -v f="$name.tar.gz" '$2 == f { print $1 }' "$tmp/checksums.txt")
 [ -n "$want" ] || fail "$name.tar.gz isn't in checksums.txt"

internal/config/config.go

@@ -14,7 +14,6 @@ import (
 	"go.yaml.in/yaml/v3"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
-	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 
 type Config struct {
@@ -41,10 +40,6 @@ type Config struct {
 	// background; defaults to true. U and lazysecrets update work either
 	// way.
 	UpdateCheck *bool `yaml:"updateCheck"`
-	// Releases are the repositories updates come from, tried in order:
-	// on GitHub, or a Gitea or Forgejo server. Defaults to GitHub, then
-	// git.kebcloud.no (update.DefaultServers).
-	Releases []string `yaml:"releases"`
 	// Cache keeps what was loaded (never values) between runs, so lists
 	// show at once and refresh in the background; defaults to true.
 	Cache *bool `yaml:"cache"`
@@ -216,11 +211,6 @@ func (c Config) validate(path string) error {
 	if d := c.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
 		return fmt.Errorf("%s: loadDelay: %s is not between 0s and 5s", path, *d)
 	}
-	for i, r := range c.Releases {
-		if _, err := update.API(r); err != nil || !strings.HasPrefix(r, "https://") {
-			return fmt.Errorf("%s: releases[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
-		}
-	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {
 			return fmt.Errorf("%s: providers.azure.vaults[%d]: %q is not an https:// vault URL", path, i, v)

internal/config/config_test.go

@@ -70,8 +70,6 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"old layout": "azure:\n  vaults: [https://kv.vault.azure.net/]\n",
 		"duration":   "timeout: soon\n",
 		"view":       "sourcesView: tree\n",
-		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
-		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
 	} {
 		if _, err := Load(write(t, content)); err == nil {
 			t.Errorf("%s: no error", name)
@@ -115,13 +113,6 @@ theme:
 	}
 }
 
-func TestReleases(t *testing.T) {
-	c, err := Load(write(t, "releases: [https://git.example.com/team/lazysecrets]\n"))
-	if err != nil || len(c.Releases) != 1 {
-		t.Errorf("releases = %v, %v", c.Releases, err)
-	}
-}
-
 func TestLoadDelay(t *testing.T) {
 	c, err := Load(write(t, "loadDelay: 300ms\n"))
 	if err != nil || c.LoadDelay == nil || *c.LoadDelay != 300*time.Millisecond {

internal/provider/azure/account.go

@@ -1,157 +0,0 @@
-package azure
-
-import (
-	"fmt"
-	"slices"
-	"strings"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// accountDetails describes an az account from az's account list and the
-// claims of the latest token lazysecrets got for it: nothing is fetched
-// for it.
-type accountDetails struct {
-	account
-	claims func() map[string]any
-}
-
-var _ provider.Accounts = (*Provider)(nil)
-
-// Account describes the az account, once a token has been fetched for it
-// (the user's name and object ID come from the token).
-func (p *Provider) Account() (provider.Account, bool) {
-	if p.account == nil {
-		return provider.Account{}, false
-	}
-	a := p.account
-	claims := a.claims()
-	str := func(k string) string { s, _ := claims[k].(string); return s }
-
-	var out provider.Account
-	add := func(label, value string) {
-		if value != "" {
-			out.Fields = append(out.Fields, provider.Attr{Label: label, Value: value})
-		}
-	}
-	add("name", str("name"))
-	user := a.user
-	if a.userType == "servicePrincipal" {
-		user += " (service principal)"
-	}
-	add("user", user)
-	add("tenant", a.tenantName)
-	add("tenant ID", a.tenant)
-	if oid := str("oid"); oid != "" {
-		add("object ID", oid)
-		out.Copy, out.CopyLabel = oid, "object ID"
-	}
-	if claims != nil {
-		add("sign-in", signInMethods(claims["amr"]))
-		add("roles", directoryRoles(claims["wids"]))
-	}
-	subs := fmt.Sprint(a.subscriptions)
-	if a.defaultSub != "" {
-		subs += " · default " + a.defaultSub
-	}
-	add("subs", subs)
-	if a.cloud != "" && a.cloud != "AzureCloud" {
-		add("cloud", a.cloud)
-	}
-	return out, len(out.Fields) > 0
-}
-
-// signInMethods says how the session was signed in to, from the amr
-// claim: with MFA or not, and by what.
-func signInMethods(amr any) string {
-	list, _ := amr.([]any)
-	var methods []string
-	mfa := false
-	for _, m := range list {
-		s, _ := m.(string)
-		switch s {
-		case "mfa", "ngcmfa":
-			mfa = true
-		case "pwd":
-			methods = append(methods, "password")
-		case "rsa":
-			methods = append(methods, "Windows Hello or certificate")
-		case "fido":
-			methods = append(methods, "security key")
-		case "wia":
-			methods = append(methods, "Windows sign-in")
-		case "otp", "sms":
-			methods = append(methods, "one-time code")
-		}
-	}
-	if len(list) == 0 {
-		return ""
-	}
-	how := strings.Join(methods, ", ")
-	switch {
-	case mfa && how != "":
-		return "MFA · " + how
-	case mfa:
-		return "MFA"
-	case how != "":
-		return "no MFA · " + how
-	}
-	return "no MFA"
-}
-
-// builtinRoles names Entra ID's built-in directory roles by template ID,
-// the IDs a token's wids claim lists.
-var builtinRoles = map[string]string{
-	"62e90394-69f5-4237-9190-012177145e10": "Global Administrator",
-	"f2ef992c-3afb-46b9-b7cf-a126ee74c451": "Global Reader",
-	"e8611ab8-c189-46e8-94e1-60213ab1f814": "Privileged Role Administrator",
-	"7be44c8a-adaf-4e2a-84d6-ab2649e08a13": "Privileged Authentication Administrator",
-	"194ae4cb-b126-40b2-bd5b-6091b380977d": "Security Administrator",
-	"5d6b6bb7-de71-4623-b4af-96380a352509": "Security Reader",
-	"5f2222b1-57c3-48ba-8ad5-d4759f1fde6f": "Security Operator",
-	"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3": "Application Administrator",
-	"158c047a-c907-4556-b7ef-446551a6b5f7": "Cloud Application Administrator",
-	"cf1c38e5-3621-4004-a7cb-879624dced7c": "Application Developer",
-	"fe930be7-5e62-47db-91af-98c3a49a38b1": "User Administrator",
-	"fdd7a751-b60b-444a-984c-02652fe8fa1c": "Groups Administrator",
-	"729827e3-9c14-49f7-bb1b-9608f156bbb8": "Helpdesk Administrator",
-	"966707d0-3269-4727-9be2-8c3a10f19b9d": "Password Administrator",
-	"c4e39bd9-1100-46d3-8c65-fb160da0071f": "Authentication Administrator",
-	"0526716b-113d-4c15-b2c8-68e3c22b9f80": "Authentication Policy Administrator",
-	"8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2": "Hybrid Identity Administrator",
-	"b0f54661-2d74-4c50-afa3-1ec803f12efe": "Billing Administrator",
-	"4d6ac14f-3453-41d0-bef9-a3e0c569773a": "License Administrator",
-	"17315797-102d-40b4-93e0-432062caca18": "Compliance Administrator",
-	"29232cdf-9323-42fd-ade2-1d097af3e4de": "Exchange Administrator",
-	"f28a1f50-f6e7-4571-818b-6a12f2af6b6c": "SharePoint Administrator",
-	"69091246-20e8-4a56-aa4d-066075b2a7a8": "Teams Administrator",
-	"3a2c62db-5318-420d-8d74-23affee5d9d5": "Intune Administrator",
-	"11648597-926c-4cf3-9c36-bcebb0ba8dcc": "Power Platform Administrator",
-	"e3973bdf-4987-49ae-837a-ba8e231c7286": "Azure DevOps Administrator",
-	"9360feb5-f418-4baa-8175-e2a00bac4301": "Directory Writers",
-	"88d8e3e3-8f55-4a1e-953a-9b9898b8876b": "Directory Readers",
-	"95e79109-95c0-4d8e-aee3-d01accf2d47b": "Guest Inviter",
-}
-
-// memberRole is in every member's token: not worth listing.
-const memberRole = "b79fbf4d-3ef9-4689-8143-76b194e85509"
-
-// directoryRoles names the roles in a wids claim: built-in ones by name,
-// others by their ID's first part.
-func directoryRoles(wids any) string {
-	list, _ := wids.([]any)
-	var names []string
-	for _, w := range list {
-		id, _ := w.(string)
-		switch name, ok := builtinRoles[strings.ToLower(id)]; {
-		case id == "" || id == memberRole:
-		case ok:
-			names = append(names, name)
-		default:
-			short, _, _ := strings.Cut(id, "-")
-			names = append(names, "role "+short)
-		}
-	}
-	slices.Sort(names)
-	return strings.Join(names, ", ")
-}

internal/provider/azure/account_test.go

@@ -1,67 +0,0 @@
-package azure
-
-import (
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-func TestAccount(t *testing.T) {
-	claims := map[string]any{
-		"name": "Alice Example", "oid": "11111111-2222-3333-4444-555555555555",
-		"amr":  []any{"pwd", "mfa"},
-		"wids": []any{"62e90394-69f5-4237-9190-012177145e10", memberRole, "aaaaaaaa-0000-0000-0000-000000000000"},
-	}
-	p := &Provider{account: &accountDetails{
-		account: account{user: "alice@contoso.com", tenant: "t1", tenantName: "Contoso", subscriptions: 3, defaultSub: "platform"},
-		claims:  func() map[string]any { return claims },
-	}}
-	a, ok := p.Account()
-	if !ok {
-		t.Fatal("no account")
-	}
-	got := map[string]string{}
-	for _, f := range a.Fields {
-		got[f.Label] = f.Value
-	}
-	want := map[string]string{
-		"name": "Alice Example", "user": "alice@contoso.com", "tenant": "Contoso", "tenant ID": "t1",
-		"object ID": "11111111-2222-3333-4444-555555555555", "sign-in": "MFA · password",
-		"roles": "Global Administrator, role aaaaaaaa", "subs": "3 · default platform",
-	}
-	for k, v := range want {
-		if got[k] != v {
-			t.Errorf("%s = %q, want %q", k, got[k], v)
-		}
-	}
-	if len(got) != len(want) {
-		t.Errorf("fields %v", got)
-	}
-	if a.Copy != claims["oid"] || a.CopyLabel != "object ID" {
-		t.Errorf("copy %q %q", a.Copy, a.CopyLabel)
-	}
-
-	// Before any token: what az's list says.
-	claims = nil
-	a, _ = p.Account()
-	if len(a.Fields) != 4 || a.Copy != "" {
-		t.Errorf("without a token: %+v", a)
-	}
-	if _, ok := (&Provider{}).Account(); ok {
-		t.Error("a service principal from AZURE_* has no account details")
-	}
-	var _ provider.Accounts = p
-}
-
-func TestSignInMethods(t *testing.T) {
-	for want, amr := range map[string][]any{
-		"MFA · password":                     {"pwd", "mfa"},
-		"MFA · Windows Hello or certificate": {"rsa", "ngcmfa"},
-		"no MFA · password":                  {"pwd"},
-		"":                                   nil,
-	} {
-		if got := signInMethods(amr); got != want {
-			t.Errorf("%v: %q, want %q", amr, got, want)
-		}
-	}
-}

internal/provider/azure/accounts.go

@@ -19,10 +19,7 @@ import (
 // account is one az CLI identity in one tenant.
 type account struct {
 	user, tenant  string
-	userType      string // "user" or "servicePrincipal"
 	tenantName    string
-	cloud         string // az's environment: AzureCloud, AzureChinaCloud, …
-	defaultSub    string // az's default subscription's name, if this account's
 	anchor        string // a subscription az maps to this account, to pin it
 	anchorEnabled bool
 	isDefault     bool
@@ -55,15 +52,12 @@ func readAccounts(path string) ([]account, error) {
 	var profile struct {
 		Subscriptions []struct {
 			ID         string `json:"id"`
-			Name       string `json:"name"`
 			State      string `json:"state"`
 			IsDefault  bool   `json:"isDefault"`
 			TenantID   string `json:"tenantId"`
 			TenantName string `json:"tenantDisplayName"`
-			Cloud      string `json:"environmentName"`
 			User       struct {
 				Name string `json:"name"`
-				Type string `json:"type"`
 			} `json:"user"`
 		} `json:"subscriptions"`
 	}
@@ -78,7 +72,7 @@ func readAccounts(path string) ([]account, error) {
 		}
 		i := slices.IndexFunc(out, func(a account) bool { return a.user == s.User.Name && a.tenant == s.TenantID })
 		if i < 0 {
-			out = append(out, account{user: s.User.Name, tenant: s.TenantID, tenantName: s.TenantName, userType: s.User.Type, cloud: s.Cloud})
+			out = append(out, account{user: s.User.Name, tenant: s.TenantID, tenantName: s.TenantName})
 			i = len(out) - 1
 		}
 		a := &out[i]
@@ -88,21 +82,12 @@ func readAccounts(path string) ([]account, error) {
 		enabled := s.State == "Enabled"
 		switch {
 		case s.IsDefault:
-			a.anchor, a.anchorEnabled, a.isDefault, a.defaultSub = s.ID, enabled, true, s.Name
+			a.anchor, a.anchorEnabled, a.isDefault = s.ID, enabled, true
 		case a.isDefault:
 		case a.anchor == "" || enabled && !a.anchorEnabled:
 			a.anchor, a.anchorEnabled = s.ID, enabled
 		}
 	}
-	// az leaves the tenant's name out of some entries: take it from
-	// another in the same tenant.
-	for i := range out {
-		for _, b := range out {
-			if out[i].tenantName == "" && b.tenant == out[i].tenant {
-				out[i].tenantName = b.tenantName
-			}
-		}
-	}
 	slices.SortStableFunc(out, func(a, b account) int {
 		if a.isDefault != b.isDefault {
 			if a.isDefault {
@@ -166,7 +151,7 @@ func NewAccounts(s Settings) ([]*Provider, error) {
 	if len(accounts) == 0 {
 		// Not signed in yet: the first call fails with an AuthError and
 		// the UI offers az login.
-		cred := authCredential{cred: newCLICredential("", "", nil), login: []string{"az", "login"}}
+		cred := authCredential{cred: newCLICredential("", ""), login: []string{"az", "login"}}
 		p, err := newWithOptions(cred, options{Settings: s})
 		if err != nil {
 			return nil, err
@@ -186,7 +171,7 @@ func NewAccounts(s Settings) ([]*Provider, error) {
 			label = string(provider.KindAzure) + " · " + labels[i]
 		}
 		cred := authCredential{
-			cred:    newCLICredential(a.user, a.tenant, func() ([]account, error) { return readAccounts(path) }),
+			cred:    newCLICredential(a.anchor, a.tenant),
 			login:   []string{"az", "login", "--tenant", a.tenant},
 			account: label, // so "sign-in required" says which account
 		}
@@ -194,7 +179,6 @@ func NewAccounts(s Settings) ([]*Provider, error) {
 		if err != nil {
 			return nil, err
 		}
-		p.account = &accountDetails{account: a, claims: cred.cred.(*cliCredential).claims}
 		if label != "" {
 			p.id = string(provider.KindAzure) + ":" + a.user + "/" + a.tenant
 			p.label = label

internal/provider/azure/accounts_test.go

@@ -2,7 +2,6 @@ package azure
 
 import (
 	"context"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"os"
@@ -12,7 +11,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 )
 
@@ -69,9 +67,7 @@ func TestAccountLabels(t *testing.T) {
 
 func TestCLICredentialPinsAccount(t *testing.T) {
 	var calls [][]string
-	c := newCLICredential("alice@contoso.com", "t1", func() ([]account, error) {
-		return []account{{user: "alice@contoso.com", tenant: "t1", anchor: "s-alice-2"}}, nil
-	})
+	c := newCLICredential("s-alice-2", "t1")
 	c.run = func(_ context.Context, args ...string) ([]byte, error) {
 		calls = append(calls, args)
 		exp := time.Now().Add(time.Hour).Unix()
@@ -106,7 +102,7 @@ func TestCLICredentialPinsAccount(t *testing.T) {
 
 func TestCLICredentialRenewsAndReportsErrors(t *testing.T) {
 	n := 0
-	c := newCLICredential("", "", nil)
+	c := newCLICredential("", "")
 	c.run = func(context.Context, ...string) ([]byte, error) {
 		n++
 		if n == 2 {
@@ -123,69 +119,3 @@ func TestCLICredentialRenewsAndReportsErrors(t *testing.T) {
 		t.Errorf("err = %v", err)
 	}
 }
-
-// jwt is an unsigned token with claims, as az would print it.
-func jwt(claims string) string {
-	enc := base64.RawURLEncoding.EncodeToString
-	return enc([]byte(`{"alg":"none"}`)) + "." + enc([]byte(claims)) + ".sig"
-}
-
-func TestCLICredentialFollowsAzAndRefusesOtherUsers(t *testing.T) {
-	// az's profile has one entry per subscription: signing in as bob,
-	// who also sees s-shared, moved it from alice to bob.
-	profile := []account{
-		{user: "alice@contoso.com", tenant: "t1", anchor: "s-shared"},
-		{user: "bob@contoso.com", tenant: "t1", anchor: "s-bob"},
-	}
-	var args []string
-	issuedTo := "alice@contoso.com"
-	c := newCLICredential("alice@contoso.com", "t1", func() ([]account, error) { return profile, nil })
-	c.run = func(_ context.Context, a ...string) ([]byte, error) {
-		args = a
-		exp := time.Now().Add(time.Hour).Unix()
-		return []byte(fmt.Sprintf(`{"accessToken": %q, "expires_on": %d}`, jwt(`{"upn":"`+issuedTo+`"}`), exp)), nil
-	}
-	arm := policy.TokenRequestOptions{Scopes: []string{"https://management.azure.com/.default"}}
-	if _, err := c.GetToken(context.Background(), arm); err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(strings.Join(args, " "), "--subscription s-shared") {
-		t.Errorf("args %q", args)
-	}
-
-	// Now alice has another subscription, and az would hand out bob's
-	// token for the old one: the new pin is used, and bob's token refused.
-	profile[0].anchor = "s-alice"
-	c.cache = map[string]azcore.AccessToken{}
-	issuedTo = "bob@contoso.com"
-	_, err := c.GetToken(context.Background(), arm)
-	if !strings.Contains(strings.Join(args, " "), "--subscription s-alice") {
-		t.Errorf("args %q", args)
-	}
-	if err == nil || !strings.Contains(err.Error(), "token for bob@contoso.com, not alice@contoso.com") {
-		t.Errorf("err = %v", err)
-	}
-
-	// Alice gone from az entirely: sign in again.
-	profile = profile[1:]
-	if _, err := c.GetToken(context.Background(), arm); err == nil || !strings.Contains(err.Error(), "sign in as alice@contoso.com") {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestTokenUser(t *testing.T) {
-	users := []string{"bob@contoso.com"}
-	for claims, want := range map[string]bool{
-		`{"upn":"Bob@Contoso.com"}`:                        true,
-		`{"unique_name":"live.com#bob@contoso.com"}`:       true,
-		`{"upn":"alice@contoso.com"}`:                      false,
-		`{"appid":"00000000-0000-0000-0000-000000000000"}`: false,
-	} {
-		if _, got := tokenUser(tokenClaims(jwt(claims)), users); got != want {
-			t.Errorf("%s: %v", claims, got)
-		}
-	}
-	if _, got := tokenUser(tokenClaims("not-a-jwt"), users); got {
-		t.Error("not a JWT")
-	}
-}

internal/provider/azure/azure.go

@@ -38,7 +38,6 @@ type Provider struct {
 
 	cred  azcore.TokenCredential
 	opts  options
-	account *accountDetails // nil for a service principal from AZURE_*
 	subs  *armsubscriptions.Client
 	graph *armresourcegraph.Client
 
@@ -183,6 +182,10 @@ func (p *Provider) tenant(subscriptionID string) string {
 	return p.tenants[subscriptionID]
 }
 
+const vaultQuery = `resources
+| where type =~ 'microsoft.keyvault/vaults'
+| project id, name, uri = tostring(properties.vaultUri)`
+
 func (p *Provider) graphVaults(ctx context.Context, src provider.Source) ([]provider.Container, error) {
 	var out []provider.Container
 	req := armresourcegraph.QueryRequest{
@@ -222,7 +225,7 @@ func graphVault(src provider.Source, row any) (provider.Container, bool) {
 	if id == "" || name == "" || uri == "" {
 		return provider.Container{}, false
 	}
-	return provider.Container{Source: src, ID: id, Name: name, Detail: uri, Types: objectTypes, Attrs: graphInfo(m).attrs()}, true
+	return provider.Container{Source: src, ID: id, Name: name, Detail: uri, Types: objectTypes}, true
 }
 
 func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provider.Container, error) {
@@ -243,7 +246,7 @@ func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provid
 			}
 			out = append(out, provider.Container{
 				Source: src, ID: deref(v.ID), Name: deref(v.Name),
-				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
+				Detail: *v.Properties.VaultURI, Types: objectTypes,
 			})
 		}
 	}

internal/provider/azure/azure_test.go

@@ -19,7 +19,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"reflect"
-	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -175,11 +174,8 @@ func TestForbiddenIsShortened(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error")
 	}
-	if got, want := err.Error(), "403 Forbidden: Caller is not authorized to perform action on resource.\n\nCheck:\n• your role or group is activated in PIM\n• "; !strings.HasPrefix(got, want) {
-		t.Errorf("error = %q, want %q…", got, want)
-	}
-	if checks := deniedChecks("Client address is not authorized and caller is not a trusted service."); !strings.Contains(checks[0], "network") {
-		t.Errorf("firewall checks = %q", checks)
+	if got, want := err.Error(), "403 Forbidden: Caller is not authorized to perform action on resource."; got != want {
+		t.Errorf("error = %q, want %q", got, want)
 	}
 	var re *azcore.ResponseError
 	if !errors.As(err, &re) || re.StatusCode != 403 {
@@ -187,13 +183,6 @@ func TestForbiddenIsShortened(t *testing.T) {
 	}
 }
 
-func TestShortenPolicyDenied(t *testing.T) {
-	msg := "The user, group or application 'appid=04b07795;oid=1234;numgroups=83;iss=https://sts.windows.net/t/' does not have secrets list permission on key vault 'kv-app;location=norwayeast'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287"
-	if got := shortenDenied(msg); got != "no secrets list permission in the vault's access policies" {
-		t.Errorf("shortenDenied = %q", got)
-	}
-}
-
 func TestShortenDenied(t *testing.T) {
 	msg := "Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.\r\nCaller: appid=04b07795;oid=1234\r\nAction: 'Microsoft.KeyVault/vaults/secrets/readMetadata/action'\r\nResource: '/subscriptions/x/vaults/kv'"
 	want := "Caller is not authorized to perform action on resource; missing Microsoft.KeyVault/vaults/secrets/readMetadata/action"
@@ -428,49 +417,3 @@ func ecPoint(t *testing.T, k *ecdsa.PrivateKey) (x, y []byte) {
 	size := (len(b) - 1) / 2
 	return b[1 : 1+size], b[1+size:]
 }
-
-func TestVaultSettings(t *testing.T) {
-	want := []string{"group=rg-sec", "location=norwayeast", "SKU=premium", "access=Azure roles (RBAC)",
-		"soft delete=on, 30 days", "purge prot.=on", "network=selected networks (1 IP ranges, 0 subnets)",
-		"private=1 endpoint", "tags=env: prod", "=team: platform"}
-	check := func(name string, attrs []provider.Attr) {
-		t.Helper()
-		var got []string
-		for _, a := range attrs {
-			got = append(got, a.Label+"="+a.Value)
-		}
-		if !slices.Equal(got, want) {
-			t.Errorf("%s\n got %q\nwant %q", name, got, want)
-		}
-	}
-
-	// Resource Graph: the query's columns, as JSON gives them.
-	c, ok := graphVault(provider.Source{ID: "s"}, map[string]any{
-		"id": "/x/kv", "name": "kv", "uri": "https://kv.vault.azure.net/", "location": "norwayeast",
-		"resourceGroup": "rg-sec", "tags": map[string]any{"team": "platform", "env": "prod"},
-		"sku": "premium", "rbac": true, "softDelete": nil, "retention": 30.0, "purge": true,
-		"publicAccess": "", "defaultAction": "Deny", "ipRules": 1.0, "subnets": 0.0, "endpoints": 1.0, "policies": 0.0,
-	})
-	if !ok {
-		t.Fatal("row not read")
-	}
-	check("resource graph", c.Attrs)
-
-	// The management API, when Resource Graph fails.
-	id := "/subscriptions/s/resourceGroups/rg-sec/providers/Microsoft.KeyVault/vaults/kv"
-	p, _ := fakeAzure(t, staticCred{}, func(w http.ResponseWriter, r *http.Request) {
-		writeJSON(w, 200, map[string]any{"value": []any{map[string]any{"id": id, "name": "kv", "location": "norwayeast",
-			"tags": map[string]any{"team": "platform", "env": "prod"},
-			"properties": map[string]any{
-				"tenantId": "t", "vaultUri": "https://kv.vault.azure.net/", "sku": map[string]any{"family": "A", "name": "premium"},
-				"enableRbacAuthorization": true, "enablePurgeProtection": true, "softDeleteRetentionInDays": 30,
-				"networkAcls":                map[string]any{"defaultAction": "Deny", "ipRules": []any{map[string]any{"value": "10.0.0.0/8"}}},
-				"privateEndpointConnections": []any{map[string]any{"id": "pe1"}},
-			}}}})
-	})
-	vaults, err := p.armVaults(context.Background(), provider.Source{ID: "s"})
-	if err != nil || len(vaults) != 1 {
-		t.Fatalf("arm: %v %v", vaults, err)
-	}
-	check("management API", vaults[0].Attrs)
-}

internal/provider/azure/cli.go

@@ -3,7 +3,6 @@ package azure
 import (
 	"bytes"
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -25,61 +24,19 @@ import (
 // every Key Vault request (the vault's auth challenge names a tenant), so
 // this sends --tenant only for vaults in another tenant.
 //
-// Which account a subscription belongs to changes: az's profile has one
-// entry per subscription, and signing in to another account that sees it
-// moves it there. So the subscription is looked up for every new token,
-// and a token az issues for another of the signed-in users is refused.
-//
 // Tokens are cached in memory until shortly before they expire, so the
 // many SDK clients don't each start an az process.
 type cliCredential struct {
-	user   string // the account's user; "" for az's default account
+	subscription string // pins the account; "" for az's default account
 	tenant       string // the account's tenant, if known
-	// accounts reads az's accounts, to pin the user; nil for the default
-	// account.
-	accounts func() ([]account, error)
 	run          func(ctx context.Context, args ...string) ([]byte, error)
 
 	mu    sync.Mutex
 	cache map[string]azcore.AccessToken // by resource and tenant argument
-	// last is the claims of the latest token in the account's own
-	// tenant, to describe the account (Provider.Account).
-	last map[string]any
 }
 
-// claims are the latest token's claims, nil before the first.
-func (c *cliCredential) claims() map[string]any {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.last
-}
-
-func newCLICredential(user, tenant string, accounts func() ([]account, error)) *cliCredential {
-	return &cliCredential{user: user, tenant: tenant, accounts: accounts, run: runAz, cache: map[string]azcore.AccessToken{}}
-}
-
-// pin is a subscription az maps to the user now, and the other users az
-// holds.
-func (c *cliCredential) pin() (subscription string, others []string, err error) {
-	if c.accounts == nil {
-		return "", nil, nil
-	}
-	accts, err := c.accounts()
-	if err != nil {
-		return "", nil, err
-	}
-	for _, a := range accts {
-		switch {
-		case a.user == c.user && a.tenant == c.tenant:
-			subscription = a.anchor
-		case !strings.EqualFold(a.user, c.user):
-			others = append(others, a.user)
-		}
-	}
-	if subscription == "" {
-		return "", nil, fmt.Errorf("az has no subscriptions for %s any more: sign in as %s", c.user, c.user)
-	}
-	return subscription, others, nil
+func newCLICredential(subscription, tenant string) *cliCredential {
+	return &cliCredential{subscription: subscription, tenant: tenant, run: runAz, cache: map[string]azcore.AccessToken{}}
 }
 
 // refreshMargin renews tokens this long before they expire.
@@ -93,25 +50,21 @@ func (c *cliCredential) GetToken(ctx context.Context, opts policy.TokenRequestOp
 		return azcore.AccessToken{}, errors.New("az: this request needs multifactor authentication; run az login again")
 	}
 	resource := strings.TrimSuffix(opts.Scopes[0], "/.default")
-	otherTenant := opts.TenantID != "" && opts.TenantID != c.tenant
-	key := resource + " " + opts.TenantID
+	args := []string{"account", "get-access-token", "--output", "json", "--resource", resource}
+	switch {
+	case opts.TenantID != "" && opts.TenantID != c.tenant:
+		// Another tenant: az picks the account itself.
+		args = append(args, "--tenant", opts.TenantID)
+	case c.subscription != "":
+		args = append(args, "--subscription", c.subscription)
+	}
+	key := strings.Join(args[5:], " ")
 
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	if tok, ok := c.cache[key]; ok && time.Until(tok.ExpiresOn) > refreshMargin {
 		return tok, nil
 	}
-	args := []string{"account", "get-access-token", "--output", "json", "--resource", resource}
-	subscription, others, err := c.pin()
-	switch {
-	case otherTenant:
-		// Another tenant: az picks the account itself.
-		args = append(args, "--tenant", opts.TenantID)
-	case err != nil:
-		return azcore.AccessToken{}, err
-	case subscription != "":
-		args = append(args, "--subscription", subscription)
-	}
 	out, err := c.run(ctx, args...)
 	if err != nil {
 		return azcore.AccessToken{}, err
@@ -120,52 +73,10 @@ func (c *cliCredential) GetToken(ctx context.Context, opts policy.TokenRequestOp
 	if err != nil {
 		return azcore.AccessToken{}, err
 	}
-	claims := tokenClaims(tok.Token)
-	if u, ok := tokenUser(claims, others); ok {
-		return azcore.AccessToken{}, fmt.Errorf("az gave a token for %s, not %s: sign in as %s again", u, c.user, c.user)
-	}
-	if !otherTenant && claims != nil {
-		c.last = claims
-	}
 	c.cache[key] = tok
 	return tok, nil
 }
 
-// tokenClaims reads a JWT's claims, without verifying it: they only
-// describe the account and catch az picking the wrong one. nil if it
-// isn't a JWT.
-func tokenClaims(token string) map[string]any {
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return nil
-	}
-	b, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(parts[1], "="))
-	if err != nil {
-		return nil
-	}
-	var claims map[string]any
-	if json.Unmarshal(b, &claims) != nil {
-		return nil
-	}
-	return claims
-}
-
-// tokenUser reports which of users a token's claims are for, if any.
-func tokenUser(claims map[string]any, users []string) (string, bool) {
-	for _, name := range []string{"upn", "unique_name", "preferred_username", "email"} {
-		v, _ := claims[name].(string)
-		if i := strings.LastIndexByte(v, '#'); i >= 0 {
-			v = v[i+1:] // live.com#user@example.com
-		}
-		for _, u := range users {
-			if v != "" && strings.EqualFold(v, u) {
-				return u, true
-			}
-		}
-	}
-	return "", false
-}
-
 func parseCLIToken(b []byte) (azcore.AccessToken, error) {
 	var t struct {
 		AccessToken string `json:"accessToken"`

internal/provider/azure/convert.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"math/big"
 	"net/http"
-	"regexp"
 	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
@@ -280,24 +279,13 @@ func cleanError(err error) error {
 			}
 		}
 	}
-	se := &serviceError{status: re.StatusCode, msg: shortenDenied(msg), err: err}
-	if se.status == http.StatusForbidden {
-		return &provider.Denied{Err: se, Checks: deniedChecks(se.msg)}
+	return &serviceError{status: re.StatusCode, msg: shortenDenied(msg), err: err}
 }
-	return se
-}
-
-var policyDenied = regexp.MustCompile(`does not have (\w+ \w+) permission on key vault`)
 
 // shortenDenied reduces Key Vault's RBAC denial, which runs to several
 // sentences plus caller and resource IDs, to its first sentence and the
 // missing action.
 func shortenDenied(msg string) string {
-	// Access policies: "The user, group or application 'appid=…;oid=…'
-	// does not have secrets list permission on key vault 'kv;location=…'".
-	if m := policyDenied.FindStringSubmatch(msg); m != nil {
-		return "no " + m[1] + " permission in the vault's access policies"
-	}
 	const marker = "Action: '"
 	i := strings.Index(msg, marker)
 	if i < 0 {
@@ -329,20 +317,4 @@ func (e *serviceError) Error() string {
 	return s
 }
 
-// deniedChecks are what to check when Key Vault refuses: the network,
-// for its firewall's refusals, else access.
-func deniedChecks(msg string) []string {
-	if strings.Contains(msg, "Client address is not authorized") || strings.Contains(msg, "network access") ||
-		strings.Contains(msg, "private link") {
-		return []string{
-			"you're on a network the vault lets in (VPN, office)",
-			"the vault's owner has let your network in",
-		}
-	}
-	return []string{
-		"your role or group is activated in PIM",
-		"the vault's owner has given you access: a Key Vault role, or its access policies",
-	}
-}
-
 func (e *serviceError) Unwrap() error { return e.err }

internal/provider/azure/details.go

@@ -1,158 +0,0 @@
-package azure
-
-import (
-	"fmt"
-	"slices"
-	"strings"
-
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// A vault's settings come with the listing, from Resource Graph or the
-// Key Vault management API, with no requests of their own: where it is,
-// how access to it works, and how it's protected.
-
-type vaultInfo struct {
-	group, location, sku        string
-	rbac, softDelete, purge     *bool
-	retention                   *int32
-	publicAccess, defaultAction string
-	ipRules, subnets, endpoints int
-	policies                    int
-	tags                        map[string]string
-}
-
-// vaultQuery lists vaults with just the settings shown, not their whole
-// properties (access policies can be long).
-const vaultQuery = `resources
-| where type =~ 'microsoft.keyvault/vaults'
-| project id, name, uri = tostring(properties.vaultUri), location, resourceGroup, tags,
-  sku = tostring(properties.sku.name), rbac = properties.enableRbacAuthorization,
-  softDelete = properties.enableSoftDelete, retention = properties.softDeleteRetentionInDays,
-  purge = properties.enablePurgeProtection, publicAccess = tostring(properties.publicNetworkAccess),
-  defaultAction = tostring(properties.networkAcls.defaultAction),
-  ipRules = array_length(properties.networkAcls.ipRules),
-  subnets = array_length(properties.networkAcls.virtualNetworkRules),
-  endpoints = array_length(properties.privateEndpointConnections),
-  policies = array_length(properties.accessPolicies)`
-
-// graphInfo reads a vaultQuery row's settings.
-func graphInfo(m map[string]any) vaultInfo {
-	str := func(k string) string { s, _ := m[k].(string); return s }
-	num := func(k string) int { f, _ := m[k].(float64); return int(f) }
-	flag := func(k string) *bool {
-		if b, ok := m[k].(bool); ok {
-			return &b
-		}
-		return nil
-	}
-	v := vaultInfo{
-		group: str("resourceGroup"), location: str("location"), sku: str("sku"),
-		rbac: flag("rbac"), softDelete: flag("softDelete"), purge: flag("purge"),
-		publicAccess: str("publicAccess"), defaultAction: str("defaultAction"),
-		ipRules: num("ipRules"), subnets: num("subnets"), endpoints: num("endpoints"), policies: num("policies"),
-	}
-	if f, ok := m["retention"].(float64); ok {
-		r := int32(f)
-		v.retention = &r
-	}
-	if tags, ok := m["tags"].(map[string]any); ok {
-		v.tags = map[string]string{}
-		for k, t := range tags {
-			v.tags[k] = fmt.Sprint(t)
-		}
-	}
-	return v
-}
-
-// armInfo reads a vault's settings from the management API.
-func armInfo(v *armkeyvault.Vault) vaultInfo {
-	info := vaultInfo{location: deref(v.Location), tags: map[string]string{}}
-	if id, err := arm.ParseResourceID(deref(v.ID)); err == nil {
-		info.group = id.ResourceGroupName
-	}
-	for k, t := range v.Tags {
-		info.tags[k] = deref(t)
-	}
-	pr := v.Properties
-	if pr == nil {
-		return info
-	}
-	if pr.SKU != nil && pr.SKU.Name != nil {
-		info.sku = string(*pr.SKU.Name)
-	}
-	info.rbac, info.softDelete, info.purge = pr.EnableRbacAuthorization, pr.EnableSoftDelete, pr.EnablePurgeProtection
-	info.retention, info.publicAccess = pr.SoftDeleteRetentionInDays, deref(pr.PublicNetworkAccess)
-	if acl := pr.NetworkACLs; acl != nil {
-		if acl.DefaultAction != nil {
-			info.defaultAction = string(*acl.DefaultAction)
-		}
-		info.ipRules, info.subnets = len(acl.IPRules), len(acl.VirtualNetworkRules)
-	}
-	info.endpoints, info.policies = len(pr.PrivateEndpointConnections), len(pr.AccessPolicies)
-	return info
-}
-
-func (v vaultInfo) attrs() []provider.Attr {
-	var out []provider.Attr
-	add := func(label, value string) {
-		if value != "" {
-			out = append(out, provider.Attr{Label: label, Value: value})
-		}
-	}
-	add("group", v.group)
-	add("location", v.location)
-	add("SKU", v.sku)
-	// Who may read secrets is decided by Azure roles or by the vault's
-	// own access policies, never both.
-	if on(v.rbac, false) {
-		add("access", "Azure roles (RBAC)")
-	} else {
-		add("access", fmt.Sprintf("access policies (%d)", v.policies))
-	}
-	if on(v.softDelete, true) {
-		days := int32(90)
-		if v.retention != nil {
-			days = *v.retention
-		}
-		add("soft delete", fmt.Sprintf("on, %d days", days))
-	} else {
-		add("soft delete", "off")
-	}
-	add("purge prot.", map[bool]string{true: "on", false: "off"}[on(v.purge, false)])
-	switch {
-	case strings.EqualFold(v.publicAccess, "disabled"):
-		add("network", "private endpoints only")
-	case strings.EqualFold(v.defaultAction, "deny"):
-		add("network", fmt.Sprintf("selected networks (%d IP ranges, %d subnets)", v.ipRules, v.subnets))
-	default:
-		add("network", "all networks")
-	}
-	if v.endpoints > 0 {
-		add("private", fmt.Sprintf("%d endpoint%s", v.endpoints, map[bool]string{true: "s"}[v.endpoints > 1]))
-	}
-	keys := make([]string, 0, len(v.tags))
-	for k := range v.tags {
-		keys = append(keys, k)
-	}
-	slices.Sort(keys)
-	for i, k := range keys {
-		label := ""
-		if i == 0 {
-			label = "tags"
-		}
-		out = append(out, provider.Attr{Label: label, Value: k + ": " + v.tags[k]})
-	}
-	return out
-}
-
-// on is *b, or def when it isn't set.
-func on(b *bool, def bool) bool {
-	if b == nil {
-		return def
-	}
-	return *b
-}

internal/provider/databricks/databricks.go

@@ -317,52 +317,15 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return v, nil
 }
 
-// deniedChecks are what to check when Databricks refuses: the network,
-// when the workspace's IP access list refused, else access, and for a
-// profile signed in through az, which account az is on.
-func deniedChecks(pr profile, msg string) []string {
-	if strings.Contains(msg, "IP ACL") || strings.Contains(msg, "IP access list") {
-		return []string{
-			"you're on a network the workspace lets in (VPN, office)",
-			"the workspace's admin has let your network in",
-		}
-	}
-	var checks []string
-	if pr.authType == "azure-cli" {
-		checks = append(checks, "az is signed in as the account with access: profile "+pr.name+" uses your az login (az account show)")
-	}
-	return append(checks,
-		"you have access to the workspace",
-		"the scope's manager has given you READ on it, or a group you're in",
-	)
-}
-
 var errNoFallback = errors.New("no Key Vault fallback")
 
-// combine reports both the Databricks and the Key Vault failure, with
-// both their checks after. An auth error from either stays reachable
-// with errors.As.
+// combine reports both the Databricks and the Key Vault failure. An auth
+// error from either stays reachable with errors.As.
 func combine(dbxErr, kvErr error) error {
 	if errors.Is(kvErr, errNoFallback) {
 		return dbxErr
 	}
-	var checks []string
-	strip := func(err error) error {
-		if d, ok := err.(*provider.Denied); ok {
-			for _, c := range d.Checks {
-				if !slices.Contains(checks, c) {
-					checks = append(checks, c)
-				}
-			}
-			return d.Err
-		}
-		return err
-	}
-	err := fmt.Errorf("%w; Key Vault fallback: %w", strip(dbxErr), strip(kvErr))
-	if len(checks) > 0 {
-		return &provider.Denied{Err: err, Checks: checks}
-	}
-	return err
+	return fmt.Errorf("%w; Key Vault fallback: %w", dbxErr, kvErr)
 }
 
 // classify turns authentication failures into *provider.AuthError: a 401
@@ -373,9 +336,6 @@ func classify(pr profile, err error) error {
 	}
 	var api *apierr.APIError
 	if errors.As(err, &api) {
-		if api.StatusCode == 403 {
-			return &provider.Denied{Err: err, Checks: deniedChecks(pr, api.Message)}
-		}
 		if api.StatusCode != 401 {
 			return err
 		}

internal/provider/databricks/databricks_test.go

@@ -140,8 +140,6 @@ func workspaceAPI(t *testing.T, status int) *httptest.Server {
 				map[string]any{"key": "storage-key", "last_updated_timestamp": 1767225600000},
 				map[string]any{"key": "client-secret"},
 			}})
-		case r.URL.Path == "/api/2.0/secrets/list" && q.Get("scope") == "locked":
-			write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have READ permission on scope locked"})
 		case r.URL.Path == "/api/2.0/secrets/get" && q.Get("scope") == "app":
 			write(w, 200, map[string]any{"key": q.Get("key"),
 				"value": base64.StdEncoding.EncodeToString([]byte("value-of-" + q.Get("key")))})
@@ -293,27 +291,3 @@ func TestClassify(t *testing.T) {
 		t.Error("cancellation classified as auth")
 	}
 }
-
-func TestDeniedSaysWhatToCheck(t *testing.T) {
-	p := newTestProvider(t, workspaceAPI(t, 0), nil)
-	_, err := p.Objects(context.Background(), provider.Container{Source: provider.Source{ID: "prod"}, Name: "locked"}, provider.TypeSecret)
-	var d *provider.Denied
-	// The test profile signs in through az: that's the first check.
-	if !errors.As(err, &d) || !strings.Contains(err.Error(), "READ permission on scope locked\n\nCheck:\n• az is signed in as the account with access: profile prod uses your az login") ||
-		!strings.Contains(err.Error(), "\n• you have access to the workspace") {
-		t.Errorf("err %q", err)
-	}
-	if got := deniedChecks(profile{authType: "pat"}, "denied"); strings.Contains(got[0], "az") {
-		t.Errorf("a token profile's checks %q", got)
-	}
-	if got := deniedChecks(profile{}, "Source IP address: 1.2.3.4 is blocked by Databricks IP ACL for workspace: 1"); !strings.Contains(got[0], "network") {
-		t.Errorf("IP ACL checks %q", got)
-	}
-
-	// Both refused: one message, then both lists of checks.
-	err = combine(&provider.Denied{Err: errors.New("dbx"), Checks: []string{"a", "b"}},
-		&provider.Denied{Err: errors.New("kv"), Checks: []string{"b", "c"}})
-	if got := err.Error(); got != "dbx; Key Vault fallback: kv\n\nCheck:\n• a\n• b\n• c" {
-		t.Errorf("combined %q", got)
-	}
-}

internal/provider/fake/fake.go

@@ -24,7 +24,6 @@ type Provider struct {
 	errs       map[listKey]error
 	values     map[string]string            // by object ID
 	versions   map[string][]provider.Object // by object ID
-	details    map[string][]provider.Attr   // by container ID
 }
 
 type listKey struct {
@@ -102,7 +101,7 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	if err := p.wait(ctx); err != nil {
 		return nil, err
 	}
-	if p.kind != provider.KindAzure { // only Key Vault keeps versions
+	if p.kind == provider.KindDatabricks {
 		return nil, provider.ErrUnsupported
 	}
 	vs := p.versions[o.ID]
@@ -210,7 +209,7 @@ func (p *Provider) addContainer(src provider.Source, name, detail string, types
 	if p.kind == provider.KindDatabricks {
 		vault, _ = strings.CutPrefix(detail, "Azure Key Vault-backed: ")
 	}
-	if p.kind == provider.KindAzure || (p.kind == provider.KindDatabricks && vault != detail) {
+	if p.kind == provider.KindAzure || vault != detail {
 		c.URL = portal + "/subscriptions/sub/resourceGroups/rg/providers/Microsoft.KeyVault/vaults/" + vault + "/overview"
 	}
 	p.containers[src.ID] = append(p.containers[src.ID], c)

internal/provider/fake/repos.go

@@ -1,136 +0,0 @@
-package fake
-
-import (
-	"context"
-	"strings"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-var _ provider.ContainerDetails = (*Provider)(nil)
-
-// Details returns a file's details, like the repo provider's.
-func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
-	attrs, ok := p.details[c.ID]
-	if !ok {
-		return nil, provider.ErrUnsupported
-	}
-	return attrs, ctx.Err()
-}
-
-// Repos returns a fake repo provider: three git repos with SOPS and plain
-// .env files, the first one the repo lazysecrets was started in.
-func Repos() *Provider {
-	p := newProvider(provider.KindRepo, 0)
-	p.id, p.label = "Repos", "Repos"
-	p.details = map[string][]provider.Attr{}
-
-	repo := func(name string, here bool) provider.Source {
-		s := p.addSource("/home/dev/git/"+name, name, "github.com/acme/"+name)
-		s.Here = here
-		p.sources[len(p.sources)-1] = s
-		return s
-	}
-	// file adds a file and its keys, alternating name and value. git and
-	// commit are what git says of it: "tracked", "ignored" or "untracked".
-	file := func(src provider.Source, path, method, git, commit string, kv ...string) {
-		sops := method != ""
-		detail := "env · plain text"
-		if sops {
-			detail = "sops · " + method
-		}
-		c := p.addContainer(src, path, detail, provider.TypeSecret)
-		attrs := []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}}
-		if sops {
-			attrs = []provider.Attr{{Label: "format", Value: "sops " + format(path)}, {Label: "encryption", Value: method}}
-		}
-		for i := 0; i+1 < len(kv); i += 2 {
-			o := provider.Object{Name: kv[i], Attrs: attrs}
-			if sops {
-				o.Updated = base
-			}
-			p.add(c, provider.TypeSecret, o, kv[i+1])
-		}
-
-		d := []provider.Attr{{Label: "encryption", Value: "none: plain text"}}
-		if sops {
-			d = []provider.Attr{{Label: "encryption", Value: detail}}
-			keys := map[string]string{
-				"age":      "age age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p",
-				"azure_kv": "azure_kv https://kv-sops-prod.vault.azure.net/keys/sops/1f2e3d4c",
-			}
-			for i, m := range strings.Split(method, ", ") {
-				label := ""
-				if i == 0 {
-					label = "keys" // on the first only, like the repo provider
-				}
-				d = append(d, provider.Attr{Label: label, Value: keys[m]})
-			}
-			d = append(d, provider.Attr{Label: "encrypted", Value: base.Local().Format("2006-01-02 15:04")})
-		}
-		switch {
-		case git == "tracked" && !sops:
-			d = append(d, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
-		case git == "untracked":
-			d = append(d, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: !sops})
-		default:
-			d = append(d, provider.Attr{Label: "git", Value: git})
-		}
-		if commit != "" {
-			d = append(d, provider.Attr{Label: "commit", Value: commit})
-		}
-		p.details[c.ID] = d
-	}
-
-	api := repo("lazysecrets-demo", true)
-	file(api, "deploy/prod/secrets.yaml", "age, azure_kv", "tracked", "4f9c2ab · 3 days ago",
-		"database.password", "pr0d-Pg-7f3k9QwZ",
-		"database.url", "postgres://app:pr0d-Pg-7f3k9QwZ@pg-demo-prod:5432/app",
-		"stripe.secret_key", "sk_live_demo_51NxDemoKey0000",
-		"jwt.signing_key", "c2lnbmluZy1rZXktZm9yLXRoZS1kZW1v",
-		"gcp.service_account", `{"type":"service_account","project_id":"lazysecrets-demo","client_email":"app@lazysecrets-demo.iam.gserviceaccount.com","private_key_id":"demo1234"}`)
-	file(api, "deploy/staging/secrets.yaml", "age", "tracked", "a71e05d · 2 weeks ago",
-		"database.password", "stg-Pg-2b8d1L",
-		"database.url", "postgres://app:stg-Pg-2b8d1L@pg-demo-stg:5432/app",
-		"stripe.secret_key", "sk_test_demo_51NxDemoKey0000")
-	file(api, "config/oauth.enc.json", "age", "tracked", "e03b6f1 · 2 months ago",
-		"github.client_secret", "ghs_demo0000000000000000000000",
-		"google.client_secret", "GOCSPX-demo-000000000000")
-	file(api, ".env", "", "ignored", "",
-		"DATABASE_URL", "postgres://app:local@localhost:5432/app",
-		"STRIPE_SECRET_KEY", "sk_test_demo_local",
-		"LOG_LEVEL", "debug")
-
-	infra := repo("platform-infra", false)
-	file(infra, "terraform/prod/secrets.enc.yaml", "azure_kv", "tracked", "9d40c3e · yesterday",
-		"postgres.admin_password", "infra-Pg-admin-0Xq",
-		"grafana.admin_password", "grafana-demo-admin",
-		"acr.pull_token", "acr-demo-pull-token")
-	file(infra, "k8s/monitoring/alertmanager.enc.yaml", "age", "tracked", "1c58e7a · 5 days ago",
-		"slack.webhook_url", "https://hooks.slack.com/services/T000/B000/demo",
-		"pagerduty.routing_key", "pd-demo-routing-key")
-	file(infra, "scripts/.env", "", "tracked", "77b2d90 · 8 months ago",
-		"AZURE_CLIENT_SECRET", "azure-demo-client-secret",
-		"ARM_SUBSCRIPTION_ID", "00000000-0000-0000-0000-000000000000")
-
-	web := repo("web-frontend", false)
-	file(web, ".env.production", "age", "tracked", "b2e91f4 · 4 days ago",
-		"SENTRY_AUTH_TOKEN", "sntrys_demo_token",
-		"NEXT_PUBLIC_API_URL", "https://api.acme.example")
-	file(web, ".env.local", "", "untracked", "",
-		"NEXT_PUBLIC_API_URL", "http://localhost:8080",
-		"ANALYTICS_KEY", "demo-analytics-key")
-
-	return p
-}
-
-// format is a SOPS file's format, by its name.
-func format(path string) string {
-	switch {
-	case strings.HasSuffix(path, ".json"):
-		return "json"
-	case strings.HasSuffix(path, ".yaml"):
-		return "yaml"
-	}
-	return "dotenv"
-}

internal/provider/provider.go

@@ -12,7 +12,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"strings"
 	"time"
 )
 
@@ -94,8 +93,6 @@ type Container struct {
 	// secrets only.
 	Types []ObjectType
 	URL   string // web page for the container, if any
-	// Attrs describe it further, from the listing (a vault's settings).
-	Attrs []Attr `json:",omitempty"`
 }
 
 // ObjectTypes returns the container's object types, defaulting to secrets.
@@ -110,7 +107,6 @@ func (c Container) ObjectTypes() []ObjectType {
 type Attr struct {
 	Label string
 	Value string
-	Warn  bool // worth a look (a plain .env tracked by git): shown in red
 }
 
 // Object describes a secret, key or certificate without its value.
@@ -173,56 +169,3 @@ type Current interface {
 type Locator interface {
 	Locate(ctx context.Context, address string) (sourceID string, ok bool, err error)
 }
-
-// Files is implemented by providers whose containers are files on disk
-// (SOPS and .env files in repos), so they can be opened in an editor.
-type Files interface {
-	// File is where c is, and for o (nil for the whole file) the line its
-	// key is on.
-	File(c Container, o *Object) (File, error)
-}
-
-// File is a container's file, to open.
-type File struct {
-	Path string
-	Line int    // 1-based; 0 for the top
-	Sops string // the sops command to edit it with; empty for a plain file
-}
-
-// Accounts is implemented by providers that can describe the identity
-// they use, from what they have locally: for the Details pane on the
-// provider's row. ok is false when there's nothing to say.
-type Accounts interface {
-	Account() (Account, bool)
-}
-
-// Account describes a signed-in identity.
-type Account struct {
-	Fields []Attr
-	// Copy is what y copies on the provider's row, named CopyLabel.
-	Copy, CopyLabel string
-}
-
-// Denied is a refusal with what to check, from what the service said: a
-// role to activate in PIM, access to ask for, the network. Error is the
-// refusal, then the checks as a list.
-type Denied struct {
-	Err    error
-	Checks []string
-}
-
-func (d *Denied) Error() string {
-	if len(d.Checks) == 0 {
-		return d.Err.Error()
-	}
-	return d.Err.Error() + "\n\nCheck:\n• " + strings.Join(d.Checks, "\n• ")
-}
-
-func (d *Denied) Unwrap() error { return d.Err }
-
-// ContainerDetails is implemented by providers that can say more about a
-// container than its listing does: how a file is encrypted and what git
-// knows of it. ErrUnsupported means there's nothing more for c.
-type ContainerDetails interface {
-	Details(ctx context.Context, c Container) ([]Attr, error)
-}

internal/provider/repo/details.go

@@ -1,62 +0,0 @@
-package repo
-
-import (
-	"context"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// Details are how a file is encrypted and for whom, and what git knows of
-// it: a plain .env file that git tracks, or could, is marked.
-func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
-	r, ok := p.repo(c.Source.ID)
-	if !ok {
-		return nil, provider.ErrUnsupported
-	}
-	rel, err := filepath.Rel(r.root, c.ID)
-	if err != nil {
-		return nil, err
-	}
-	var out []provider.Attr
-	meta, isSops := readMeta(c.ID)
-	if isSops {
-		out = append(out, provider.Attr{Label: "encryption", Value: "sops · " + strings.Join(meta.methods, ", ")})
-		for i, k := range meta.recipients {
-			label := ""
-			if i == 0 {
-				label = "keys"
-			}
-			out = append(out, provider.Attr{Label: label, Value: k})
-		}
-		if !meta.modified.IsZero() {
-			out = append(out, provider.Attr{Label: "encrypted", Value: meta.modified.Local().Format("2006-01-02 15:04")})
-		}
-	} else {
-		out = append(out, provider.Attr{Label: "encryption", Value: "none: plain text"})
-	}
-
-	git := func(args ...string) (string, bool) {
-		b, err := exec.CommandContext(ctx, "git", append([]string{"-C", r.root}, args...)...).Output()
-		return strings.TrimSpace(string(b)), err == nil
-	}
-	switch _, tracked := git("ls-files", "--error-unmatch", "--", rel); {
-	case tracked && !isSops:
-		out = append(out, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
-	case tracked:
-		out = append(out, provider.Attr{Label: "git", Value: "tracked"})
-	default:
-		if _, ignored := git("check-ignore", "-q", "--", rel); ignored {
-			out = append(out, provider.Attr{Label: "git", Value: "ignored"})
-		} else {
-			out = append(out, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: !isSops})
-		}
-		return out, nil
-	}
-	if last, ok := git("log", "-1", "--format=%h · %ar", "--", rel); ok && last != "" {
-		out = append(out, provider.Attr{Label: "last commit", Value: last})
-	}
-	return out, nil
-}

internal/provider/repo/repo.go

@@ -412,37 +412,6 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return provider.NewSecretValue(stdout.Bytes()), nil
 }
 
-// File is the file c is, and the line o's key is on.
-func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File, error) {
-	path := c.ID
-	if path == "" { // made from a link
-		path = filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
-	}
-	f := provider.File{Path: path}
-	if _, isSops := readMeta(path); isSops {
-		f.Sops = p.s.Sops
-	}
-	if o == nil {
-		return f, nil
-	}
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return f, err
-	}
-	keys, err := parseKeys(path, b)
-	if err != nil {
-		return f, nil // still worth opening, at the top
-	}
-	_, extract, _ := strings.Cut(o.ID, "\x00")
-	for _, k := range keys {
-		if k.extract == extract || (extract == "" && k.name == o.Name) {
-			f.Line = k.line
-			break
-		}
-	}
-	return f, nil
-}
-
 // sopsError is sops' own message, whole: which keys it tried and why
 // each failed can all matter.
 func sopsError(stderr string, err error) string {
@@ -816,31 +785,9 @@ func anyMatch(res []*regexp.Regexp, f string) bool {
 
 type sopsMeta struct {
 	methods  []string // age, azure_kv, …
-	recipients []string // "age age1…", "azure_kv https://kv…/keys/sops"
 	modified time.Time
 }
 
-// recipient names a key a file is encrypted for, from its sops metadata:
-// public, never a secret.
-func recipient(method string, f map[string]string) string {
-	var v string
-	switch method {
-	case "age":
-		v = f["recipient"]
-	case "pgp":
-		v = f["fp"]
-	case "kms":
-		v = f["arn"]
-	case "gcp_kms":
-		v = f["resource_id"]
-	case "azure_kv":
-		v = strings.TrimSuffix(f["vault_url"], "/") + "/keys/" + f["name"]
-	case "hc_vault":
-		v = strings.TrimSuffix(f["vault_address"], "/") + " " + f["engine_path"] + "/" + f["key_name"]
-	}
-	return method + " " + v
-}
-
 const maxFileSize = 4 << 20
 
 // readMeta reads a file's sops metadata; ok is false if it isn't a sops
@@ -870,15 +817,6 @@ func readMeta(file string) (sopsMeta, bool) {
 		for _, k := range known {
 			if v, ok := doc.Sops[k].([]any); ok && len(v) > 0 {
 				m.methods = append(m.methods, k)
-				for _, e := range v {
-					fields := map[string]string{}
-					if em, ok := e.(map[string]any); ok {
-						for fk, fv := range em {
-							fields[fk] = fmt.Sprint(fv)
-						}
-					}
-					m.recipients = append(m.recipients, recipient(k, fields))
-				}
 			}
 		}
 		if s, ok := doc.Sops["lastmodified"].(string); ok {
@@ -895,7 +833,6 @@ func readMeta(file string) (sopsMeta, bool) {
 		for _, k := range known {
 			if strings.Contains(text, "sops_"+k+"__") {
 				m.methods = append(m.methods, k)
-				m.recipients = append(m.recipients, envRecipients(text, k)...)
 			}
 		}
 		if i := strings.Index(text, "sops_lastmodified"); i >= 0 {
@@ -913,35 +850,6 @@ func readMeta(file string) (sopsMeta, bool) {
 	return m, true
 }
 
-// envRecipients are method's keys in a dotenv or ini sops file, whose
-// metadata is flattened: sops_age__list_0__map_recipient=age1….
-func envRecipients(text, method string) []string {
-	prefix := "sops_" + method + "__list_"
-	var order []string
-	keys := map[string]map[string]string{}
-	for line := range strings.Lines(text) {
-		k, v, ok := strings.Cut(strings.TrimSpace(line), "=")
-		rest, found := strings.CutPrefix(strings.TrimSpace(k), prefix)
-		if !ok || !found {
-			continue
-		}
-		n, field, ok := strings.Cut(rest, "__map_")
-		if !ok {
-			continue
-		}
-		if keys[n] == nil {
-			keys[n] = map[string]string{}
-			order = append(order, n)
-		}
-		keys[n][field] = strings.TrimSpace(v)
-	}
-	out := make([]string, len(order))
-	for i, n := range order {
-		out[i] = recipient(method, keys[n])
-	}
-	return out
-}
-
 func formatOf(file string) string {
 	switch strings.ToLower(filepath.Ext(file)) {
 	case ".yaml", ".yml":
@@ -963,7 +871,6 @@ type key struct {
 	name      string // db.password, list[0]
 	extract   string // sops --extract: ["db"]["password"]
 	encrypted bool
-	line      int // 1-based
 }
 
 // parseKeys lists a sops file's keys without decrypting anything.
@@ -982,18 +889,18 @@ func parseKeys(file string, b []byte) ([]key, error) {
 		return out, nil
 	case "dotenv":
 		var out []key
-		for i, line := range strings.Split(string(b), "\n") {
+		for _, line := range strings.Split(string(b), "\n") {
 			k, v, ok := envLine(line)
 			if !ok || strings.HasPrefix(k, "sops_") {
 				continue
 			}
-			out = append(out, key{name: k, extract: quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
+			out = append(out, key{name: k, extract: quote(k), encrypted: strings.HasPrefix(v, "ENC[")})
 		}
 		return out, nil
 	case "ini":
 		var out []key
 		section := ""
-		for i, line := range strings.Split(string(b), "\n") {
+		for _, line := range strings.Split(string(b), "\n") {
 			line = strings.TrimSpace(line)
 			switch {
 			case line == "" || strings.HasPrefix(line, "#") || strings.HasPrefix(line, ";"):
@@ -1005,7 +912,7 @@ func parseKeys(file string, b []byte) ([]key, error) {
 					continue
 				}
 				k, v = strings.TrimSpace(k), strings.TrimSpace(v)
-				out = append(out, key{name: section + "." + k, extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
+				out = append(out, key{name: section + "." + k, extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC[")})
 			}
 		}
 		return out, nil
@@ -1037,7 +944,7 @@ func walk(n *yaml.Node, name, extract string, top bool, out *[]key) {
 			walk(n.Alias, name, extract, false, out)
 		}
 	default:
-		*out = append(*out, key{name: name, extract: extract, encrypted: strings.HasPrefix(n.Value, "ENC["), line: n.Line})
+		*out = append(*out, key{name: name, extract: extract, encrypted: strings.HasPrefix(n.Value, "ENC[")})
 	}
 }
 

internal/provider/repo/repo_test.go

@@ -3,7 +3,6 @@ package repo
 import (
 	"context"
 	"errors"
-	"maps"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -436,88 +435,3 @@ func TestEnvFilesSkipPackages(t *testing.T) {
 		t.Errorf("files %v, want %v (nothing from node_modules or vendor)", got, want)
 	}
 }
-
-func TestFile(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		".gitignore":       ".env\n",
-		"secrets/app.yaml": sopsYAML,
-	})
-	os.WriteFile(filepath.Join(root, ".env"), []byte("# local\nTOKEN=x\n\nURL=y\n"), 0o600)
-	p := New(Settings{Dir: root, Sops: "/opt/sops"})
-	ctx := context.Background()
-	srcs, _ := p.Sources(ctx)
-	files, err := p.Containers(ctx, srcs[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	lines := map[string]int{}
-	for _, c := range files {
-		f, err := p.File(c, nil)
-		if err != nil || f.Path != filepath.Join(root, c.Name) || f.Line != 0 {
-			t.Errorf("%s: %+v, %v", c.Name, f, err)
-		}
-		if sops := f.Sops != ""; sops != (c.Name == "secrets/app.yaml") || (sops && f.Sops != "/opt/sops") {
-			t.Errorf("%s: sops %q", c.Name, f.Sops)
-		}
-		keys, _ := p.Objects(ctx, c, provider.TypeSecret)
-		for _, k := range keys {
-			f, err := p.File(c, &k)
-			if err != nil {
-				t.Fatal(err)
-			}
-			lines[c.Name+" "+k.Name] = f.Line
-		}
-	}
-	want := map[string]int{
-		".env TOKEN": 2, ".env URL": 4,
-		"secrets/app.yaml db.password": 2, "secrets/app.yaml db.port": 3,
-		"secrets/app.yaml list[0]": 5, "secrets/app.yaml public_unencrypted": 6,
-	}
-	if !maps.Equal(lines, want) {
-		t.Errorf("lines %v\nwant  %v", lines, want)
-	}
-}
-
-func TestFileDetails(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		".gitignore":       ".env\n",
-		"secrets/app.yaml": sopsYAML,
-		"prod.env":         sopsEnv,
-		"tracked.env":      "TOKEN=x\n", // a plain .env in git: worth a look
-	})
-	os.WriteFile(filepath.Join(root, ".env"), []byte("TOKEN=x\n"), 0o600)
-	os.WriteFile(filepath.Join(root, "local.env"), []byte("TOKEN=x\n"), 0o600)
-	p := New(Settings{Dir: root})
-	ctx := context.Background()
-	srcs, _ := p.Sources(ctx)
-	details := func(name string) map[string]provider.Attr {
-		t.Helper()
-		attrs, err := p.Details(ctx, provider.Container{Source: srcs[0], ID: filepath.Join(root, name), Name: name})
-		if err != nil {
-			t.Fatal(err)
-		}
-		out := map[string]provider.Attr{}
-		for _, a := range attrs {
-			out[a.Label] = a
-		}
-		return out
-	}
-
-	d := details("secrets/app.yaml")
-	if d["encryption"].Value != "sops · age" || d["keys"].Value != "age age1xxxx" || d["git"].Value != "tracked" ||
-		!strings.HasSuffix(d["last commit"].Value, " ago") || strings.Contains(d["last commit"].Value, ":") || d["encrypted"].Value == "" {
-		t.Errorf("sops yaml: %+v", d)
-	}
-	if d := details("prod.env"); d["keys"].Value != "age age1xxxx" {
-		t.Errorf("sops env: %+v", d)
-	}
-	if d := details("tracked.env"); d["encryption"].Value != "none: plain text" || !d["git"].Warn {
-		t.Errorf("tracked plain env: %+v", d)
-	}
-	if d := details(".env"); d["git"].Value != "ignored" || d["git"].Warn {
-		t.Errorf("ignored env: %+v", d)
-	}
-	if d := details("local.env"); !d["git"].Warn || !strings.Contains(d["git"].Value, "not ignored") {
-		t.Errorf("untracked env: %+v", d)
-	}
-}

internal/ui/app/app.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"image/color"
 	"math"
-	"os"
 	"os/exec"
 	"strings"
 	"time"
@@ -18,6 +17,7 @@ import (
 	"charm.land/bubbles/v2/spinner"
 	tea "charm.land/bubbletea/v2"
 	"charm.land/lipgloss/v2"
+	"github.com/charmbracelet/x/ansi"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/browser"
 	"git.kebcloud.no/keb/lazysecrets/internal/clipboard"
@@ -39,9 +39,6 @@ const (
 	paneContainers
 	paneSecrets
 	paneDetail
-	// paneStatus is on top of the left panes; after the right pane in
-	// the tab order (status.go).
-	paneStatus
 	paneCount
 )
 
@@ -56,7 +53,6 @@ const (
 	slotDescribe // extra metadata for the selected object
 	slotCopy     // fetch a value straight to the clipboard
 	slotVersions // count the selected object's versions
-	slotDetails  // a file's details
 	slotCount
 )
 
@@ -72,12 +68,6 @@ type Options struct {
 	ClipboardClear time.Duration
 	// OpenURL opens a web page; defaults to the system browser.
 	OpenURL func(url string) error
-	// ConfigFiles and StatePath are where lazysecrets reads its config
-	// and keeps its state, for the status pane.
-	ConfigFiles []string
-	StatePath   string
-	// Changelog is CHANGELOG.md, for the status pane.
-	Changelog string
 	// CacheFile keeps what was loaded between runs; "" keeps it for this
 	// run only.
 	CacheFile string
@@ -172,30 +162,14 @@ type Model struct {
 	clip      Clipboard
 	clipClear time.Duration
 	openURL   func(string) error
-	// fields is the fourth pane for anything but a secret; lastLeft is
-	// the left pane it describes while the fourth has focus (fields.go).
-	fields   panes.Fields
-	lastLeft pane
-	details  map[string]detailsState // by containerKey
-	// errLog is this session's errors, newest first; loggedFlash the
-	// footer's text when last looked at (errlog.go).
-	errLog      []loggedErr
-	loggedFlash string
-	getenv      func(string) string
-	nvimOpen    func(server, path string, line int) error // edit.go
-	now         func() time.Time
 	// The cache file, whether the cache changed since it was saved, and
 	// when each provider's Sources list was loaded (persist.go).
 	cachePath  string
-	// configFiles and statePath are for the status pane (status.go).
-	configFiles []string
-	statePath   string
-	statusW     int // the status pane's width: the left column's, zoomed or not
-	changelog   []panes.Field
 	cacheDirty bool
 	sourcesAt  map[string]time.Time
 	placeDir   string
 	savedPlace string // the link last saved as the place
+	now        func() time.Time
 
 	// A pending clear of a copied value, counted down in the footer.
 	// clipToken identifies the latest copy so older ticks are ignored.
@@ -376,11 +350,7 @@ func New(providers []provider.Provider, opts Options) Model {
 		clip:          opts.Clipboard,
 		clipClear:     opts.ClipboardClear,
 		now:           time.Now,
-		getenv:        os.Getenv,
-		nvimOpen:      nvimOpen,
 		cache:         newCache(),
-		details:       map[string]detailsState{},
-		fields:        panes.NewFields(),
 	}
 	if m.clip == nil {
 		m.clip = clipboard.New()
@@ -414,7 +384,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	if opts.Keys != nil {
 		m.keys = *opts.Keys
 	}
-	m.detail.RevealKey, m.detail.VersionsKey, m.detail.CopyKey = keys.Name(m.keys.Reveal), keys.Name(m.keys.Versions), keys.Name(m.keys.Copy)
+	m.detail.RevealKey, m.detail.VersionsKey = keys.Name(m.keys.Reveal), keys.Name(m.keys.Versions)
 	m.revealTimeout, m.hideOnBlur = opts.RevealTimeout, opts.HideOnBlur
 	m.expiryWarning = opts.ExpiryWarning
 	m.handlerSetup = opts.HandlerSetup
@@ -455,13 +425,10 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.spinning = true
 
 	m.cachePath, m.placeDir, m.sourcesAt = opts.CacheFile, opts.Dir, map[string]time.Time{}
-	m.configFiles, m.statePath, m.changelog = opts.ConfigFiles, opts.StatePath, changelogFields(opts.Changelog)
 	if m.cachePath != "" {
 		m.loadCacheFile()
 		if len(m.sourceResults) > 0 {
 			m.rebuildSources()
-			m.sources.Loading = true // reloading what the file had
-			m.sources.Age = m.cachedAge(m.oldestSources())
 		}
 	}
 	if m.placeDir != "" && opts.Open == nil {
@@ -489,7 +456,7 @@ func (m *Model) setVersions(items []provider.Object) {
 }
 
 func (m Model) Init() tea.Cmd {
-	cmds := []tea.Cmd{m.sourcesCmd(), m.spin.Tick, m.checkClipboard(), tea.RequestBackgroundColor}
+	cmds := []tea.Cmd{m.sourcesCmd(), m.spin.Tick, m.checkClipboard()}
 	if m.cachePath != "" || m.placeDir != "" {
 		cmds = append(cmds, tea.Tick(persistEvery, func(time.Time) tea.Msg { return persistTickMsg{} }))
 	}
@@ -514,9 +481,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	var cmds []tea.Cmd
 
 	switch msg := msg.(type) {
-	case tea.BackgroundColorMsg:
-		m.st = m.st.OnBackground(msg.Color, msg.IsDark())
-		return m, nil
 	case tea.WindowSizeMsg:
 		m.w, m.h = msg.Width, msg.Height
 
@@ -585,25 +549,12 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case commandDoneMsg:
 		m.handleCommandDone(msg)
 
-	case editDoneMsg:
-		cmds = append(cmds, m.handleEditDone(msg))
-
 	case persistTickMsg:
 		cmds = append(cmds, m.persistTick())
 
 	case persistedMsg:
 		m.handlePersisted(msg)
 
-	case detailsMsg:
-		if msg.req == m.reqID[slotDetails] {
-			m.done(slotDetails)
-		}
-		if errors.Is(msg.err, context.Canceled) || errors.Is(msg.err, context.DeadlineExceeded) {
-			delete(m.details, msg.key) // tried again when shown again
-		} else {
-			m.details[msg.key] = detailsState{attrs: msg.attrs, err: msg.err}
-		}
-
 	case crawlMsg:
 		cmds = append(cmds, m.handleCrawl(msg))
 
@@ -630,9 +581,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.done(slotContainers)
 		if msg.err != nil {
 			m.noteErr(msg.err)
-			if src, ok := m.selectedSource(); ok {
-				m.logErrOf(src.Name, msg.err)
-			}
 			delete(m.cache.containers, msg.key)
 			m.containers.SetError(msg.err)
 		} else {
@@ -651,9 +599,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.closeVersions()
 		} else if msg.err != nil {
 			m.noteErr(msg.err)
-			if c, ok := m.containers.Selected(); ok {
-				m.logErrOf(c.Name, msg.err)
-			}
 			delete(m.cache.objects, msg.key)
 			m.secrets.SetError(msg.err)
 		} else {
@@ -676,7 +621,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.done(slotValue)
 		if msg.err != nil {
 			m.noteErr(msg.err)
-			m.logErrOf(msg.obj.Container.Name+"/"+msg.obj.Name, msg.err)
 			m.detail.SetValueError(msg.err)
 		} else {
 			m.detail.SetValue(msg.value)
@@ -703,7 +647,6 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.done(slotDescribe)
 		if msg.err != nil {
 			m.noteErr(msg.err)
-			m.logErrOf(msg.obj.Container.Name+"/"+msg.obj.Name, msg.err)
 			m.detail.SetDescribeError(msg.err)
 		} else {
 			m.cache.details[msg.key] = entry[provider.Object]{msg.obj, m.now()}
@@ -770,12 +713,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	}
 	m.waiting = 0
 	m.askHandlerSetup()
-	m.keys.Login.SetEnabled(m.loginFor() != nil)
-	if m.focus != paneDetail {
-		m.lastLeft = m.focus
-	}
-	m.logFlash()
-	cmds = append(cmds, m.syncFields())
+	m.keys.Login.SetEnabled(m.auth != nil && len(m.auth.Login) > 0)
 	if m.anyLoading() && !m.spinning {
 		m.spinning = true
 		cmds = append(cmds, m.spin.Tick)
@@ -841,19 +779,9 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 	case key.Matches(msg, k.Bottom):
 		m.jump(false)
 	case key.Matches(msg, k.NextPane):
-		// The four main panes, round; the status pane (0) leads into them.
-		m.focus = (m.focus + 1) % paneStatus
-		if r, ok := m.sources.Selected(); ok && m.focus == paneContainers && r.kind == rowGroup {
-			m.focus = paneDetail // an account's row: nothing between
-		}
-	case key.Matches(msg, k.Details):
-		m.focus = paneDetail // what's selected, on the right
+		m.focus = (m.focus + 1) % paneCount
 	case key.Matches(msg, k.PrevPane):
-		if m.focus == paneDetail {
-			m.focus = m.lastLeft // back to what it describes
-		} else {
-			m.focus = (m.focus + paneStatus - 1) % paneStatus
-		}
+		m.focus = (m.focus + paneCount - 1) % paneCount
 	case key.Matches(msg, k.Pane1):
 		m.focus = paneSources
 	case key.Matches(msg, k.Pane2):
@@ -862,18 +790,8 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 		m.focus = paneSecrets
 	case key.Matches(msg, k.Pane4):
 		m.focus = paneDetail
-	case key.Matches(msg, k.Pane0):
-		m.focus = paneStatus
-	case m.focus == paneStatus && key.Matches(msg, k.Enter):
-		m.focus = paneDetail // its rows are on the right
 	case m.focus == paneSources && (key.Matches(msg, k.Enter) || key.Matches(msg, k.Reveal)) && m.toggleGroup():
 		// folded or unfolded a provider group
-	case m.focus == paneDetail && key.Matches(msg, k.Enter) && m.fieldLink() != "":
-		r, err := ref.Parse(m.fieldLink())
-		if err == nil {
-			f, _ := m.fields.Selected()
-			m.startNav(r, actGo, f.Row)
-		}
 	case key.Matches(msg, k.Enter):
 		if m.focus < paneDetail {
 			m.focus++
@@ -929,10 +847,8 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 	case key.Matches(msg, k.Back):
 		if f := m.focusedFilter(); f != nil && f.HasFilter() {
 			f.ClearFilter()
-		} else if m.versionsOf != nil && (m.focus == paneSecrets || m.focus == paneDetail) {
+		} else if m.versionsOf != nil && m.focus >= paneSecrets {
 			m.closeVersions()
-		} else if m.focus == paneStatus {
-			m.focus = paneSources
 		} else if m.focus > paneSources {
 			m.focus--
 		}
@@ -954,11 +870,9 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 		}
 	case key.Matches(msg, k.Open):
 		return m.openSelected(), false
-	case key.Matches(msg, k.Edit):
-		return m.edit(), false
 	case key.Matches(msg, k.Login):
-		if auth := m.loginFor(); auth != nil {
-			c := exec.Command(auth.Login[0], auth.Login[1:]...)
+		if m.auth != nil && len(m.auth.Login) > 0 {
+			c := exec.Command(m.auth.Login[0], m.auth.Login[1:]...)
 			return tea.ExecProcess(c, func(err error) tea.Msg { return loginDoneMsg{err: err} }), false
 		}
 	case key.Matches(msg, k.Refresh):
@@ -987,10 +901,6 @@ func (m *Model) focusedFilter() filterable {
 		return &m.containers
 	case paneSecrets:
 		return &m.secrets
-	case paneDetail:
-		if m.fields.Shown() {
-			return &m.fields
-		}
 	}
 	return nil
 }
@@ -1005,13 +915,9 @@ func (m *Model) move(delta int) {
 	case paneSecrets:
 		m.secrets.Move(delta)
 	case paneDetail:
-		if m.fields.Shown() {
-			m.fields.Move(delta)
-		} else {
 		m.detail.Scroll(delta)
 	}
 }
-}
 
 func (m *Model) jump(top bool) {
 	switch {
@@ -1029,10 +935,6 @@ func (m *Model) jump(top bool) {
 		m.secrets.Top()
 	case m.focus == paneSecrets:
 		m.secrets.Bottom()
-	case m.focus == paneDetail && m.fields.Shown() && top:
-		m.fields.Top()
-	case m.focus == paneDetail && m.fields.Shown():
-		m.fields.Bottom()
 	case m.focus == paneDetail && top:
 		m.detail.ScrollTop()
 	case m.focus == paneDetail:
@@ -1065,7 +967,6 @@ func (m *Model) refresh() tea.Cmd {
 	case paneContainers:
 		if src, ok := m.selectedSource(); ok {
 			m.containers.Refresh()
-			m.details = map[string]detailsState{}
 			return m.loadContainers(src, m.selSource)
 		}
 	case paneSecrets:
@@ -1188,7 +1089,6 @@ func (m *Model) showContainers(src provider.Source, key string) tea.Cmd {
 		return nil
 	}
 	m.containers.Refresh()
-	m.containers.Age = m.cachedAge(e.at)
 	return m.loadContainers(src, key)
 }
 
@@ -1205,7 +1105,6 @@ func (m *Model) showObjects(c provider.Container, key string) tea.Cmd {
 		return nil
 	}
 	m.secrets.Refresh()
-	m.secrets.Age = m.cachedAge(e.at)
 	return m.loadObjects(c, m.objType, key)
 }
 
@@ -1335,26 +1234,6 @@ func (m *Model) detailStale() bool {
 	return hasSecret || shown != m.containers.SelectedID()
 }
 
-// cachedAge is how old a list loaded at at is, if it's older than
-// cacheTTL: the panes say it while it reloads.
-func (m Model) cachedAge(at time.Time) string {
-	if d := m.now().Sub(at); d >= cacheTTL {
-		return ago(d)
-	}
-	return ""
-}
-
-// oldestSources is when the oldest of the cached Sources lists loaded.
-func (m Model) oldestSources() time.Time {
-	var oldest time.Time
-	for _, at := range m.sourcesAt {
-		if oldest.IsZero() || at.Before(oldest) {
-			oldest = at
-		}
-	}
-	return oldest
-}
-
 func (m *Model) handleSources(msg sourcesMsg) tea.Cmd {
 	if msg.gen != m.sourcesGen {
 		return nil
@@ -1369,18 +1248,10 @@ func (m *Model) handleSources(msg sourcesMsg) tea.Cmd {
 	for _, p := range m.providers {
 		if r, ok := m.sourceResults[p.ID()]; ok && r.err != nil {
 			m.noteErr(r.err)
-			m.logErrOf(p.Label(), r.err)
 			errs = append(errs, fmt.Sprintf("%s: %v", p.Label(), r.err))
 		}
 	}
-	// Said once, when they change; after that the Details pane says it
-	// for the selected account.
-	if status := strings.Join(errs, " · "); status != m.status {
-		m.status = status
-		if status != "" {
-			m.flash = flash{text: m.problemText(msg.provider, status), isErr: true}
-		}
-	}
+	m.status = strings.Join(errs, " · ")
 	m.rebuildSources()
 	m.sources.Loading = m.sourcesPending > 0
 	return m.autoLoad(msg)
@@ -1562,15 +1433,6 @@ func (m *Model) describe(o provider.Object) tea.Cmd {
 // copyValue copies the selected object's value, fetching it without
 // revealing it if it isn't shown already.
 func (m *Model) copyValue() tea.Cmd {
-	if m.focus == paneDetail && m.fields.Shown() {
-		if f, ok := m.fields.Selected(); ok {
-			return m.copyText(fieldName(f), cmpOr(f.URL, f.Value), false)
-		}
-		return nil
-	}
-	if a, ok := m.selectedAccount(); ok && a.Copy != "" && m.focus == paneSources {
-		return m.copyText(a.CopyLabel, a.Copy, false)
-	}
 	o, ok := m.detail.Secret()
 	if !ok {
 		return nil
@@ -1625,25 +1487,6 @@ func (m *Model) cancelClipClear() {
 func (m *Model) openSelected() tea.Cmd {
 	var name, url string
 	var used func()
-	switch {
-	case m.focus == paneDetail && m.fields.Shown():
-		f, _ := m.fields.Selected()
-		if f.URL == "" {
-			m.flash = warning("nothing to open in the browser here")
-			return nil
-		}
-		name, url, used = f.Label, f.URL, func() {}
-	default:
-		name, url, used = m.openTarget()
-	}
-	if name == "" {
-		return nil
-	}
-	return m.openPage(name, url, used)
-}
-
-// openTarget is the focused pane's selected item, for the browser.
-func (m *Model) openTarget() (name, url string, used func()) {
 	switch m.focus {
 	case paneSources:
 		s, _ := m.selectedSource()
@@ -1655,11 +1498,9 @@ func (m *Model) openTarget() (name, url string, used func()) {
 		o, _ := m.detail.Secret()
 		name, url, used = o.Name, o.URL, func() { m.usedObject(o) }
 	}
-	return name, url, used
+	if name == "" {
+		return nil
 	}
-
-// openPage opens url in the browser, or copies it over SSH.
-func (m *Model) openPage(name, url string, used func()) tea.Cmd {
 	if url == "" {
 		m.flash = warning("no web page for " + name)
 		return nil
@@ -1681,27 +1522,14 @@ func (m *Model) openPage(name, url string, used func()) tea.Cmd {
 	return nil
 }
 
-// noteErr remembers authentication failures so the UI can offer sign-in,
-// saying so once for each account.
+// noteErr remembers authentication failures so the UI can offer sign-in.
 func (m *Model) noteErr(err error) {
 	var auth *provider.AuthError
 	if errors.As(err, &auth) {
-		if m.auth == nil || m.auth.Who() != auth.Who() {
-			m.flash = flash{text: m.authText(auth), isErr: true}
-		}
 		m.auth = auth
 	}
 }
 
-// authText says which account needs signing in, and how.
-func (m Model) authText(auth *provider.AuthError) string {
-	if len(auth.Login) == 0 {
-		return fmt.Sprintf("%s: sign-in required: %v", auth.Who(), auth.Err)
-	}
-	return fmt.Sprintf("%s: sign-in required (not signed in or session expired)%s",
-		auth.Who(), withKey(m.keys.Login, " · press %s to run "+strings.Join(auth.Login, " ")))
-}
-
 func (m Model) anyLoading() bool {
 	return m.sources.Loading || m.containers.Loading || m.secrets.Loading ||
 		m.detail.State() == panes.ValueLoading
@@ -1719,10 +1547,19 @@ func (m Model) footerView() string {
 	} else if l != nil && l.Filtering() {
 		help = m.helpBar(keys.FilterHelp{Map: m.keys}.ShortHelp(), 2)
 	} else {
-		revealed := m.detail.State() == panes.ValueShown
-		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), revealed: &revealed}.ShortHelp(), 2)
+		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, commands: len(m.commandsHere()) > 0}.ShortHelp(), 2)
 	}
 	var lines []string
+	failed := func(text string) { lines = append(lines, m.flashLine(flash{text: text, isErr: true})) }
+	switch {
+	case m.auth != nil && len(m.auth.Login) > 0:
+		failed(fmt.Sprintf("%s: sign-in required (not signed in or session expired)%s",
+			m.auth.Who(), withKey(m.keys.Login, " · press %s to run "+strings.Join(m.auth.Login, " "))))
+	case m.auth != nil:
+		failed(fmt.Sprintf("%s: sign-in required: %v", m.auth.Who(), m.auth.Err))
+	case m.status != "":
+		failed(m.status)
+	}
 	if !m.clipDeadline.IsZero() {
 		left := max(0, int(math.Ceil(m.clipDeadline.Sub(m.now()).Seconds())))
 		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, left))))
@@ -1730,6 +1567,12 @@ func (m Model) footerView() string {
 	if m.flash.text != "" {
 		lines = append(lines, m.flashLine(m.flash))
 	}
+	// The version at the right end, one column in, like lazygit.
+	if v := m.versionLabel(); v != "" {
+		up := m.updateLabel() // a newer release, in colour
+		gap := max(1, m.w-1-ansi.StringWidth(help)-ansi.StringWidth(v+up)-1)
+		help += strings.Repeat(" ", gap) + m.st.Muted.Render(v) + m.st.Notice.Render(up) + " "
+	}
 	return strings.Join(append(lines, " "+help), "\n")
 }
 
@@ -1771,73 +1614,3 @@ func (m Model) View() tea.View {
 	v.WindowTitle = "lazysecrets"
 	return v
 }
-
-// selectedProblem is why the selected Sources row's account has nothing
-// to show, if it failed: for the Details pane.
-func (m Model) selectedProblem() string {
-	r, ok := m.sources.Selected()
-	if !ok || (r.kind != rowGroup && r.kind != rowSource) {
-		return ""
-	}
-	res, done := m.sourceResults[r.provider]
-	if !done || res.err == nil {
-		return ""
-	}
-	return m.problemText(r.provider, res.err.Error())
-}
-
-// problemText says what went wrong for a provider: for a sign-in, which
-// account and how to sign in again; else err as given.
-func (m Model) problemText(providerID, err string) string {
-	var auth *provider.AuthError
-	if r, ok := m.sourceResults[providerID]; ok && errors.As(r.err, &auth) {
-		return m.authText(auth)
-	}
-	return err
-}
-
-// fieldLink is the link of the selected Fields row, if it has one.
-func (m Model) fieldLink() string {
-	if f, ok := m.fields.Selected(); ok && m.fields.Shown() {
-		return f.Link
-	}
-	return ""
-}
-
-// loginFor is the sign-in L runs: the selected account's, if it needs
-// one, else the last one asked for.
-func (m Model) loginFor() *provider.AuthError {
-	if f, ok := m.fields.Selected(); ok && m.focus == paneDetail && m.fields.Shown() && f.Provider != "" {
-		var auth *provider.AuthError
-		if res := m.sourceResults[f.Provider]; errors.As(res.err, &auth) && len(auth.Login) > 0 {
-			return auth
-		}
-	}
-	if r, ok := m.sources.Selected(); ok {
-		var auth *provider.AuthError
-		if res := m.sourceResults[r.provider]; errors.As(res.err, &auth) && len(auth.Login) > 0 {
-			return auth
-		}
-	}
-	if m.auth != nil && len(m.auth.Login) > 0 {
-		return m.auth
-	}
-	return nil
-}
-
-// selectedAccount describes the account of the selected provider row, if
-// its provider can.
-func (m Model) selectedAccount() (provider.Account, bool) {
-	r, ok := m.sources.Selected()
-	if !ok || r.kind != rowGroup {
-		return provider.Account{}, false
-	}
-	if res := m.sourceResults[r.provider]; res.err != nil {
-		return provider.Account{}, false // the problem shows instead
-	}
-	a, ok := m.byID[r.provider].(provider.Accounts)
-	if !ok {
-		return provider.Account{}, false
-	}
-	return a.Account()
-}

internal/ui/app/app_test.go

@@ -19,7 +19,6 @@ import (
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/keys"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
 )
 
 func TestMain(m *testing.M) {
@@ -58,7 +57,7 @@ func newDriverOpts(t *testing.T, opts Options, providers ...provider.Provider) *
 	m := New(providers, opts)
 	m.detail.Now = func() time.Time { return time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC) }
 	d := &driver{t: t, m: m}
-	d.send(tea.WindowSizeMsg{Width: 100, Height: 33}) // 30 for the main panes, 3 for status
+	d.send(tea.WindowSizeMsg{Width: 100, Height: 30})
 	d.run(m.Init())
 	return d
 }
@@ -186,9 +185,8 @@ func TestIcons(t *testing.T) {
 	if !strings.Contains(screen, azure+" Azure") || !strings.Contains(screen, dbx+" Databricks") {
 		t.Errorf("icons missing:\n%s", screen)
 	}
-	d.keys("3")
-	if !strings.Contains(d.screen(), "source     "+azure+" Azure / platform-prod") {
-		t.Errorf("detail source line missing icon:\n%s", d.screen())
+	if !strings.Contains(screen, "source     "+azure+" Azure / platform-prod") {
+		t.Errorf("detail source line missing icon:\n%s", screen)
 	}
 }
 
@@ -206,7 +204,7 @@ func TestObjectTypeTabs(t *testing.T) {
 		t.Fatalf("selected = %q", s)
 	}
 	screen := d.screen()
-	for _, want := range []string{"key type   RSA 2048", "ops        sign, verify", "space to show the public key"} {
+	for _, want := range []string{"key type   RSA 2048", "ops        sign, verify", "space to show public key"} {
 		if !strings.Contains(screen, want) {
 			t.Errorf("missing %q:\n%s", want, screen)
 		}
@@ -402,7 +400,6 @@ func (describing) Describe(_ context.Context, o provider.Object) (provider.Objec
 func TestDescribeUpdatesDetail(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, describing{fake.Azure(0)})
-	d.keys("3") // the fourth pane follows focus: the secret
 	if !strings.Contains(d.screen(), "described  db-password") {
 		t.Fatalf("describe result not shown:\n%s", d.screen())
 	}
@@ -490,11 +487,10 @@ func TestVersions(t *testing.T) {
 func TestVersionHistoryInDetail(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
-	d.keys("3") // the fourth pane follows focus: the secret
 	screen := d.screen()
 	for _, want := range []string{
 		"versions   3 · v to browse",
-		"   3f9c2a   2026-09-01 current",
+		"▸ 3f9c2a   2026-09-01 current", // the version shown above
 		"  91d3e0   2026-03-01 expired",
 		"  0a77c4   2025-09-01 disabled",
 	} {
@@ -502,9 +498,6 @@ func TestVersionHistoryInDetail(t *testing.T) {
 			t.Errorf("missing %q:\n%s", want, screen)
 		}
 	}
-	if strings.Contains(screen, "▸ 3f9c2a") {
-		t.Errorf("a cursor on a list that can't be moved in:\n%s", screen)
-	}
 	d.keys("3", "j") // api-key: only its current version
 	if !strings.Contains(d.screen(), "versions   1") || strings.Contains(d.screen(), "v to browse") {
 		t.Errorf("wrong history for api-key:\n%s", d.screen())
@@ -601,7 +594,7 @@ func TestPermissionErrorShownInPane(t *testing.T) {
 	if !strings.Contains(d.screen(), "403 Forbidden") {
 		t.Error("error not rendered")
 	}
-	if !strings.Contains(d.screen(), "name       kv-restricted") {
+	if !strings.Contains(d.screen(), "Select a secret") {
 		t.Error("detail should show the container summary")
 	}
 }
@@ -761,9 +754,7 @@ func TestFocusKeys(t *testing.T) {
 	}{
 		{"tab", paneContainers}, {"enter", paneSecrets}, {"enter", paneDetail},
 		{"enter", paneDetail}, {"esc", paneSecrets}, {"shift+tab", paneContainers},
-		{"4", paneDetail}, {"tab", paneSources}, {"shift+tab", paneDetail},
-		// l: what's selected, on the right; h: back to it.
-		{"2", paneContainers}, {"l", paneDetail}, {"h", paneContainers}, {"h", paneSources}, {"l", paneDetail},
+		{"4", paneDetail}, {"l", paneSources}, {"h", paneDetail},
 	} {
 		d.keys(tc.key)
 		if d.m.focus != tc.want {
@@ -982,23 +973,18 @@ func TestSourcesFavouritesTab(t *testing.T) {
 func TestRebindingShowsEverywhere(t *testing.T) {
 	t.Parallel()
 	km := keys.Default()
-	if err := km.Apply(map[string]map[string][]string{"lists": {"reveal": {"z"}, "versions": {}}}); err != nil {
+	if err := km.Apply(map[string]map[string][]string{"lists": {"reveal": {"e"}, "versions": {}}}); err != nil {
 		t.Fatal(err)
 	}
 	d := newDriverOpts(t, Options{Keys: &km})
 	d.keys("3")
 	scr := d.screen()
-	if !strings.Contains(scr, "z to reveal") || strings.Contains(scr, "space to reveal") {
+	if !strings.Contains(scr, "(e to reveal)") || strings.Contains(scr, "space to reveal") {
 		t.Errorf("detail hint doesn't follow the binding:\n%s", scr)
 	}
-	if !strings.Contains(lastLine(scr), "z show") {
+	if !strings.Contains(lastLine(scr), "e reveal/hide") {
 		t.Errorf("help bar: %q", lastLine(scr))
 	}
-	d.keys("z")
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "z hide") {
-		t.Errorf("help bar with the value shown: %q", bar)
-	}
-	d.keys("z")
 	if strings.Contains(scr, "to browse") {
 		t.Errorf("hint for unbound versions:\n%s", scr)
 	}
@@ -1006,9 +992,9 @@ func TestRebindingShowsEverywhere(t *testing.T) {
 	if strings.Contains(d.screen(), "correct-horse") {
 		t.Error("space still reveals")
 	}
-	d.keys("z")
+	d.keys("e")
 	if !strings.Contains(d.screen(), "correct-horse-battery-staple") {
-		t.Errorf("z doesn't reveal:\n%s", d.screen())
+		t.Errorf("e doesn't reveal:\n%s", d.screen())
 	}
 }
 
@@ -1036,309 +1022,3 @@ func TestMultiLineErrorsShownWhole(t *testing.T) {
 		t.Errorf("footer:\n%s", d.screen())
 	}
 }
-
-// signedOut is a second Azure account whose sign-in has expired.
-type signedOut struct{ provider.Provider }
-
-func (signedOut) ID() string    { return "Azure:admin@contoso.com/t1" }
-func (signedOut) Label() string { return "Azure · admin" }
-func (signedOut) Sources(context.Context) ([]provider.Source, error) {
-	return nil, &provider.AuthError{Kind: provider.KindAzure, Account: "Azure · admin",
-		Login: []string{"az", "login", "--tenant", "t1"}, Err: errors.New("AADSTS70043")}
-}
-
-func TestSignInMessageOnceThenInDetails(t *testing.T) {
-	t.Parallel()
-	d := newDriverOpts(t, Options{CollapseGroups: false}, fake.Azure(0), signedOut{fake.Azure(0)})
-	hint := "Azure · admin: sign-in required"
-	if !strings.Contains(lastLines(d.screen(), 2), hint) { // the footer: one line
-		t.Fatalf("not said at start:\n%s", d.screen())
-	}
-	d.keys("j")
-	if strings.Contains(lastLines(d.screen(), 2), hint) {
-		t.Errorf("still in the footer after moving:\n%s", d.screen())
-	}
-
-	// On the account's group, Details says it, and L signs in to it.
-	d.keys("G")
-	if r, _ := d.m.sources.Selected(); r.provider != "Azure:admin@contoso.com/t1" {
-		t.Fatalf("selected %+v", r)
-	}
-	if scr := d.screen(); !strings.Contains(scr, "problem") || !strings.Contains(scr, hint) || !strings.Contains(scr, "press L to run az login") {
-		t.Errorf("not in Details:\n%s", d.screen())
-	}
-	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
-		t.Errorf("L signs in to %+v", a)
-	}
-
-	// Elsewhere Details is as usual.
-	d.keys("g")
-	if strings.Contains(d.screen(), hint) {
-		t.Errorf("shown for another account:\n%s", d.screen())
-	}
-}
-
-// lastLines is the bottom n lines of a screen.
-func lastLines(scr string, n int) string {
-	lines := strings.Split(strings.TrimRight(scr, "\n"), "\n")
-	return strings.Join(lines[max(0, len(lines)-n):], "\n")
-}
-
-// described is an account that can say who it is.
-type described struct{ provider.Provider }
-
-func (described) Account() (provider.Account, bool) {
-	return provider.Account{
-		Fields: []provider.Attr{{Label: "name", Value: "Alice Example"}, {Label: "object ID", Value: "oid-123"}},
-		Copy:   "oid-123", CopyLabel: "object ID",
-	}, true
-}
-
-func TestAccountInDetails(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t, described{fake.Azure(0)})
-	d.keys("g") // the group's row
-	if r, _ := d.m.sources.Selected(); r.kind != rowGroup {
-		t.Fatalf("not on the group: %+v", r)
-	}
-	if scr := d.screen(); !strings.Contains(scr, "Alice Example") || !strings.Contains(scr, "oid-123") {
-		t.Errorf("account not in Details:\n%s", scr)
-	}
-	d.keys("y")
-	if got := d.clip().content; got != "oid-123" {
-		t.Errorf("y copied %q", got)
-	}
-	d.keys("j")
-	if strings.Contains(d.screen(), "Alice Example") {
-		t.Errorf("still shown on a subscription:\n%s", d.screen())
-	}
-}
-
-func TestAccountPane(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t, described{fake.Azure(0)})
-	d.keys("g", "l") // the account's row, then its pane
-	if d.m.focus != paneDetail {
-		t.Fatalf("focus %v, want the fourth pane", d.m.focus)
-	}
-	scr := d.screen()
-	if !strings.Contains(scr, "Alice Example") {
-		t.Errorf("account not shown:\n%s", scr)
-	}
-	bar := lastLine(scr)
-	if !strings.Contains(bar, "copy") || strings.Contains(bar, "reveal") || strings.Contains(bar, "versions") {
-		t.Errorf("help bar: %q", bar)
-	}
-	d.keys("j", "y")
-	if got := d.clip().content; got != "oid-123" {
-		t.Errorf("y on the object ID copied %q", got)
-	}
-
-	// / filters it, labels too.
-	d.keys("/")
-	d.typeText("object")
-	d.keys("enter")
-	if scr := d.screen(); !strings.Contains(scr, "oid-123") || strings.Contains(scr, "Alice Example") {
-		t.Errorf("filtered:\n%s", scr)
-	}
-	d.keys("esc")
-	if !strings.Contains(d.screen(), "Alice Example") {
-		t.Errorf("filter not cleared:\n%s", d.screen())
-	}
-
-	d.keys("h")
-	if d.m.focus != paneSources {
-		t.Errorf("back to %v, want Sources", d.m.focus)
-	}
-}
-
-func TestDetailsFollowFocus(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t)
-	d.keys("3") // a secret
-	if !strings.Contains(d.screen(), "version    3f9c2a") {
-		t.Fatalf("secret not shown:\n%s", d.screen())
-	}
-	d.keys("2") // its vault
-	if scr := d.screen(); !strings.Contains(scr, "name       kv-app-prod") || strings.Contains(scr, "version    3f9c2a") {
-		t.Errorf("vault not described:\n%s", scr)
-	}
-	d.keys("1") // its subscription
-	if scr := d.screen(); !strings.Contains(scr, "name       platform-prod") || !strings.Contains(scr, "vaults     3") {
-		t.Errorf("subscription not described:\n%s", scr)
-	}
-	// Into the fourth pane: it keeps describing the subscription, and
-	// shift+tab goes back there.
-	d.keys("4")
-	if !strings.Contains(d.screen(), "name       platform-prod") {
-		t.Errorf("lost the subscription:\n%s", d.screen())
-	}
-	d.keys("shift+tab")
-	if d.m.focus != paneSources {
-		t.Errorf("back to %v", d.m.focus)
-	}
-	// A value revealed from a left pane stays in view until hidden.
-	d.keys("space")
-	if !strings.Contains(d.screen(), "correct-horse-battery-staple") {
-		t.Errorf("value not shown:\n%s", d.screen())
-	}
-}
-
-func TestStatusLineCountsRepos(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t, fake.Azure(0), fake.Repos())
-	if line := strings.Split(d.screen(), "\n")[1]; !strings.Contains(line, "1 account · 3 repos") {
-		t.Errorf("status line: %q", line)
-	}
-	d = newDriver(t, fake.Azure(0))
-	if line := strings.Split(d.screen(), "\n")[1]; strings.Contains(line, "repo") {
-		t.Errorf("repos counted without any: %q", line)
-	}
-}
-
-func TestStatusPane(t *testing.T) {
-	t.Parallel()
-	var opened []string
-	d := newDriverOpts(t, Options{Version: "0.1.0", ConfigFiles: []string{"/cfg/config.yaml"}, StatePath: "/state/state.json",
-		OpenURL: func(u string) error { opened = append(opened, u); return nil }},
-		fake.Azure(0), signedOut{fake.Azure(0)})
-	if !strings.Contains(d.screen(), "2 accounts · 1 need sign-in") {
-		t.Errorf("status line:\n%s", d.screen())
-	}
-	d.keys("0")
-	if d.m.focus != paneStatus {
-		t.Fatalf("focus %v", d.m.focus)
-	}
-	scr := d.screen()
-	for _, want := range []string{logo[2], "version    v0.1.0", "GPL-3.0-or-later", "Azure · 2 subscriptions", "Azure · admin · sign-in required",
-		"/cfg/config.yaml", "/state/state.json", "lazysecrets/…/docs"} {
-		if !strings.Contains(scr, want) {
-			t.Errorf("missing %q:\n%s", want, scr)
-		}
-	}
-	// Into its rows: L signs in to the failing account, y copies a path,
-	// o opens a link.
-	d.keys("enter")
-	if d.m.focus != paneDetail {
-		t.Fatalf("enter: focus %v", d.m.focus)
-	}
-	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Provider == "Azure:admin@contoso.com/t1" })
-	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
-		t.Errorf("L signs in to %+v", a)
-	}
-	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "config" })
-	d.keys("y")
-	if got := d.clip().content; got != "/cfg/config.yaml" {
-		t.Errorf("y copied %q", got)
-	}
-	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "docs" })
-	d.keys("o")
-	if len(opened) != 1 || !strings.HasSuffix(opened[0], "/src/branch/main/docs") {
-		t.Errorf("o opened %q", opened)
-	}
-	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "version" })
-	d.keys("o")
-	if len(opened) != 2 || !strings.HasSuffix(opened[1], "/releases/tag/v0.1.0") {
-		t.Errorf("o on the version opened %q", opened)
-	}
-	d.keys("shift+tab")
-	if d.m.focus != paneStatus {
-		t.Errorf("back to %v", d.m.focus)
-	}
-}
-
-// empty is an account with nothing in it, like Databricks without profiles.
-type empty struct{ provider.Provider }
-
-func (empty) Sources(context.Context) ([]provider.Source, error) { return nil, nil }
-
-func TestGetStarted(t *testing.T) {
-	t.Parallel()
-	d := newDriverOpts(t, Options{}, signedOut{fake.Azure(0)}, empty{fake.Databricks(0)})
-	scr := d.screen()
-	for _, want := range []string{"get started", "Azure      az login", "L runs it here",
-		"databricks auth login --host", "lazysecrets --demo"} {
-		if !strings.Contains(scr, want) {
-			t.Errorf("missing %q:\n%s", want, scr)
-		}
-	}
-	d.keys("l", "j")
-	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
-		t.Errorf("L signs in to %+v", a)
-	}
-	d.keys("y")
-	if got := d.clip().content; got != "az login" {
-		t.Errorf("y copied %q", got)
-	}
-
-	// Once an account has something, an empty one says what it needs.
-	d = newDriverOpts(t, Options{}, fake.Azure(0), empty{fake.Databricks(0)})
-	d.m.sources.SelectWhere(func(r sourceRow) bool { return r.kind == rowGroup && r.provider == fake.Databricks(0).ID() })
-	d.send(nil)
-	if scr := d.screen(); strings.Contains(scr, "get started") || !strings.Contains(scr, "databricks auth login") {
-		t.Errorf("empty Databricks:\n%s", scr)
-	}
-}
-
-// detailed is an account whose vaults have details.
-type detailed struct{ provider.Provider }
-
-func (detailed) Details(_ context.Context, c provider.Container) ([]provider.Attr, error) {
-	return []provider.Attr{{Label: "access", Value: "Azure roles (RBAC)"}, {Label: "git", Value: "tracked", Warn: true}}, nil
-}
-
-func TestContainerDetails(t *testing.T) {
-	t.Parallel()
-	d := newDriverOpts(t, Options{}, detailed{fake.Azure(0)})
-	d.keys("2")
-	if scr := d.screen(); !strings.Contains(scr, "access     Azure roles (RBAC)") || !strings.Contains(scr, "URI") {
-		t.Errorf("details:\n%s", scr)
-	}
-	if st := d.m.details[d.m.containers.SelectedID()]; st.loading || len(st.attrs) != 2 {
-		t.Errorf("state %+v", st)
-	}
-}
-
-func TestExpiringInStatus(t *testing.T) {
-	t.Parallel()
-	d := newDriverOpts(t, Options{ExpiryWarning: 30 * 24 * time.Hour}, fake.Azure(0))
-	d.keys("3", "]", "]") // load kv-app-prod's certificates
-	if !strings.Contains(d.screen(), "⚠ 1 expiring") {
-		t.Errorf("status line:\n%s", d.screen())
-	}
-	d.keys("0")
-	scr := d.screen()
-	for _, want := range []string{"expiring   ✗ expired  old-tls · kv-app-prod", "in 1 of 3 vaults (ctrl+a in search loads all)"} {
-		if !strings.Contains(scr, want) {
-			t.Errorf("missing %q:\n%s", want, scr)
-		}
-	}
-	d.keys("3", "[", "[", "0", "enter") // elsewhere, then to it from the status pane
-	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "expiring" })
-	d.keys("enter")
-	if _, v, o := d.selected(); v != "kv-app-prod" || o != "old-tls" {
-		t.Errorf("enter went to %s/%s\n%s", v, o, d.screen())
-	}
-}
-
-func TestErrorLog(t *testing.T) {
-	t.Parallel()
-	d := newDriverOpts(t, Options{}, fake.Azure(0))
-	d.keys("2", "j", "j", "3") // kv-restricted: its secrets can't be listed
-	d.m.flash = flash{text: "copy failed: no clipboard", isErr: true}
-	d.send(nil)
-	d.send(nil) // still showing: logged once
-	d.keys("0")
-	scr := d.screen()
-	if !strings.Contains(scr, "errors") || !strings.Contains(scr, "copy failed: no clipboard") || !strings.Contains(scr, "kv-restricted: 403 Forbidden") {
-		t.Errorf("errors not listed:\n%s", scr)
-	}
-	if n := len(d.m.errLog); n != 2 || !strings.HasPrefix(d.m.errLog[0].text, "copy failed") {
-		t.Errorf("log %+v", d.m.errLog)
-	}
-	d.m.logErr("403 Forbidden: again") // a new one, and an old one again: on top
-	d.m.logErr(d.m.errLog[2].text)
-	if len(d.m.errLog) != 3 || d.m.errLog[0].text == "403 Forbidden: again" {
-		t.Errorf("log %+v", d.m.errLog)
-	}
-}

internal/ui/app/commands.go

@@ -53,9 +53,6 @@ func paneContext(p pane) string {
 
 // commandsHere are the custom commands for the focused pane.
 func (m *Model) commandsHere() []commands.Command {
-	if m.focus == paneStatus {
-		return nil
-	}
 	var out []commands.Command
 	for _, c := range m.commands {
 		if c.Context == commands.Global || c.Context == paneContext(m.focus) {

internal/ui/app/edit.go

@@ -1,224 +0,0 @@
-package app
-
-import (
-	"cmp"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	tea "charm.land/bubbletea/v2"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/browser"
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// Opening a repo's file (e): SOPS files with sops edit, which decrypts
-// them for the editor and encrypts them again after. Other files, inside
-// nvim: in that nvim, once lazysecrets has quit; else in $VISUAL or
-// $EDITOR, coming back after; else in the system's default app. On a
-// secret, editors that can open at a line start on its key.
-
-type editDoneMsg struct {
-	c    provider.Container
-	name string
-	err  error
-}
-
-// sopsUnchanged is sops edit's exit code when the file wasn't changed.
-const sopsUnchanged = 200
-
-// edit opens the selected file, or the file of the selected secret.
-func (m *Model) edit() tea.Cmd {
-	if m.focus == paneDetail && m.fields.Shown() {
-		f, ok := m.fields.Selected()
-		if !ok || f.Path == "" {
-			m.flash = warning("nothing to open in an editor here")
-			return nil
-		}
-		name := filepath.Base(f.Path)
-		return m.openInEditor(provider.File{Path: f.Path}, func(err error) tea.Msg { return editDoneMsg{name: name, err: err} })
-	}
-	var c provider.Container
-	var o *provider.Object
-	switch m.focus {
-	case paneSources:
-		m.flash = warning("select a file to open it")
-		return nil
-	case paneContainers:
-		sel, ok := m.containers.Selected()
-		if !ok {
-			return nil
-		}
-		c = sel
-	default:
-		sel, ok := m.detail.Secret()
-		if !ok {
-			return nil
-		}
-		c, o = sel.Container, &sel
-	}
-	files, ok := m.providerFor(c.Source).(provider.Files)
-	if !ok {
-		m.flash = warning("only SOPS and .env files in repos can be opened")
-		return nil
-	}
-	f, err := files.File(c, o)
-	if err != nil {
-		m.flash = flash{text: "open: " + err.Error(), isErr: true}
-		return nil
-	}
-	if o != nil {
-		m.usedObject(*o)
-	} else {
-		m.usedContainer(c)
-	}
-	name := filepath.Base(f.Path)
-	finished := func(err error) tea.Msg { return editDoneMsg{c: c, name: name, err: err} }
-
-	if f.Sops != "" {
-		cmd := exec.Command(f.Sops, "edit", f.Path)
-		cmd.Dir = filepath.Dir(f.Path) // sops looks for .sops.yaml from here
-		// sops starts SOPS_EDITOR (else EDITOR, else vim) on the decrypted
-		// copy, which keeps the file's lines: start it on the key.
-		editor := cmp.Or(m.getenv("SOPS_EDITOR"), m.getenv("EDITOR"), "vim")
-		if at, ok := editorAtLine(editor, f.Line); ok {
-			cmd.Env = append(os.Environ(), "SOPS_EDITOR="+at)
-		}
-		m.flash = flash{}
-		return tea.ExecProcess(cmd, finished)
-	}
-	return m.openInEditor(f, finished)
-}
-
-// plusLine are editors that open at a line with +N before the file.
-var plusLine = map[string]bool{
-	"vi": true, "vim": true, "nvim": true, "nano": true, "emacs": true, "emacsclient": true,
-	"micro": true, "kak": true, "mg": true, "ne": true, "joe": true, "vis": true,
-}
-
-// editorAtLine is editor starting at line, for editors that take +N:
-// sops adds the file after it.
-func editorAtLine(editor string, line int) (string, bool) {
-	fields := strings.Fields(editor)
-	if line == 0 || len(fields) == 0 || !plusLine[filepath.Base(fields[0])] {
-		return "", false
-	}
-	return editor + " +" + strconv.Itoa(line), true
-}
-
-// editorArgs opens f at its line, for editors known to take one.
-func editorArgs(editor string, f provider.File) []string {
-	fields := strings.Fields(editor)
-	if f.Line == 0 || len(fields) == 0 {
-		return []string{f.Path}
-	}
-	at := f.Path + ":" + strconv.Itoa(f.Line)
-	switch base := filepath.Base(fields[0]); {
-	case plusLine[base]:
-		return []string{"+" + strconv.Itoa(f.Line), f.Path}
-	case base == "hx" || base == "helix" || base == "subl" || base == "zed":
-		return []string{at}
-	case base == "code" || base == "codium" || base == "cursor" || base == "windsurf":
-		return []string{"-g", at}
-	}
-	return []string{f.Path}
-}
-
-// handleEditDone reports how editing went and reloads the file's secrets:
-// their names, lines or values may have changed.
-func (m *Model) handleEditDone(msg editDoneMsg) tea.Cmd {
-	var exit *exec.ExitError
-	switch {
-	case errors.As(msg.err, &exit) && exit.ExitCode() == sopsUnchanged:
-		m.flash = flash{text: msg.name + " unchanged"}
-		return nil
-	case errors.Is(msg.err, exec.ErrNotFound):
-		m.flash = flash{text: "open " + msg.name + ": " + msg.err.Error() + " (is sops installed?)", isErr: true}
-		return nil
-	case msg.err != nil:
-		m.flash = flash{text: "open " + msg.name + ": " + msg.err.Error(), isErr: true}
-		return nil
-	}
-	m.flash = done("closed " + msg.name)
-	if c, ok := m.containers.Selected(); ok && containerKey(c) == containerKey(msg.c) {
-		m.hideValue()
-		m.secrets.Refresh()
-		return m.loadObjects(c, m.objType, m.selContainer)
-	}
-	return nil
-}
-
-// nvimLua opens a file in the nvim lazysecrets runs in. If lazysecrets is
-// that terminal's own process (the nvim plugin, or :terminal lazysecrets),
-// it waits for the terminal to close, so the file opens in the window
-// below rather than in one about to close. Otherwise (a shell in a
-// terminal) it opens it in the previous window now. The autocmd isn't
-// the buffer's own: snacks wipes the buffer when the terminal closes,
-// which would delete it before it runs.
-const nvimLua = `local path, line, pid = ...
-local function open()
-  local ok, err = pcall(vim.cmd, "edit " .. vim.fn.fnameescape(path))
-  if not ok then vim.notify("lazysecrets: " .. err, vim.log.levels.ERROR) return end
-  if line > 0 then pcall(vim.api.nvim_win_set_cursor, 0, { line, 0 }) vim.cmd("normal! zz") end
-end
-for _, b in ipairs(vim.api.nvim_list_bufs()) do
-  if vim.bo[b].buftype == "terminal" and vim.b[b].terminal_job_pid == pid then
-    vim.api.nvim_create_autocmd("TermClose", { callback = function(ev)
-      if ev.buf ~= b then return end
-      vim.defer_fn(open, 50)
-      return true
-    end })
-    return
-  end
-end
-pcall(vim.cmd, "wincmd p")
-open()`
-
-// nvimOpen asks the nvim at server to open path at line.
-func nvimOpen(server, path string, line int) error {
-	q := func(s string) string { return "'" + strings.ReplaceAll(s, "'", "''") + "'" }
-	lua := strings.ReplaceAll(nvimLua, "\n", " ")
-	expr := "luaeval('load(_A[1])(_A[2], _A[3], _A[4])', [" + q(lua) + ", " + q(path) + ", " +
-		strconv.Itoa(line) + ", " + strconv.Itoa(os.Getpid()) + "])"
-	out, err := exec.Command("nvim", "--server", server, "--remote-expr", expr).CombinedOutput()
-	if err != nil {
-		if msg := strings.TrimSpace(string(out)); msg != "" {
-			return errors.New(msg)
-		}
-		return err
-	}
-	return nil
-}
-
-// openInEditor opens f: in the nvim lazysecrets runs in, quitting; else
-// in $VISUAL or $EDITOR, coming back after; else in the default app.
-func (m *Model) openInEditor(f provider.File, finished func(error) tea.Msg) tea.Cmd {
-	name := filepath.Base(f.Path)
-	if server := m.getenv("NVIM"); server != "" {
-		open := m.nvimOpen
-		return func() tea.Msg {
-			if err := open(server, f.Path, f.Line); err != nil {
-				return finished(err)
-			}
-			return tea.QuitMsg{}
-		}
-	}
-	if editor := cmpOr(m.getenv("VISUAL"), m.getenv("EDITOR")); editor != "" {
-		// Through the shell, so EDITOR can carry arguments ("code -w").
-		args := append([]string{"-c", editor + ` "$@"`, "lazysecrets"}, editorArgs(editor, f)...)
-		m.flash = flash{}
-		return tea.ExecProcess(exec.Command("/bin/sh", args...), finished)
-	}
-	switch err := m.openURL(f.Path); {
-	case errors.Is(err, browser.ErrRemote):
-		m.flash = warning("set $EDITOR to open files over SSH")
-	case err != nil:
-		m.flash = flash{text: "open: " + err.Error(), isErr: true}
-	default:
-		m.flash = done("opened " + name)
-	}
-	return nil
-}

internal/ui/app/errlog.go

@@ -1,64 +0,0 @@
-package app
-
-import (
-	"errors"
-	"slices"
-	"strings"
-	"time"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
-)
-
-// The status pane lists this session's errors, newest first: what a pane
-// showed (a list that couldn't load) and what the footer flashed (a copy
-// that failed), which go when you move on. Only the first line of each,
-// and never kept after quitting.
-
-// maxErrors is how many errors are kept.
-const maxErrors = 20
-
-type loggedErr struct {
-	at   time.Time
-	text string
-}
-
-// logErr records text; an error already there moves to the top, with
-// the time it happened again.
-func (m *Model) logErr(text string) {
-	text, _, _ = strings.Cut(strings.TrimSpace(text), "\n")
-	if text == "" {
-		return
-	}
-	m.errLog = slices.DeleteFunc(m.errLog, func(e loggedErr) bool { return e.text == text })
-	m.errLog = append([]loggedErr{{m.now(), text}}, m.errLog[:min(len(m.errLog), maxErrors-1)]...)
-}
-
-// logErrOf records err, about what, except a sign-in, which the footer
-// and the account's details say.
-func (m *Model) logErrOf(what string, err error) {
-	var auth *provider.AuthError
-	if !errors.As(err, &auth) {
-		m.logErr(what + ": " + err.Error())
-	}
-}
-
-// logFlash records an error the footer is showing, once.
-func (m *Model) logFlash() {
-	if m.flash.isErr && m.flash.text != m.loggedFlash {
-		m.logErr(m.flash.text)
-	}
-	m.loggedFlash = m.flash.text
-}
-
-// errorFields are the status pane's rows for them.
-func (m Model) errorFields() []panes.Field {
-	out := make([]panes.Field, len(m.errLog))
-	for i, e := range m.errLog {
-		out[i] = panes.Field{Value: e.at.Format("15:04") + " " + e.text, Err: true}
-	}
-	if len(out) > 0 {
-		out[0].Label = "errors"
-	}
-	return out
-}

internal/ui/app/expiring.go

@@ -1,75 +0,0 @@
-package app
-
-import (
-	"cmp"
-	"fmt"
-	"slices"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-	"git.kebcloud.no/keb/lazysecrets/internal/ref"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
-)
-
-// The status pane lists what has expired or will soon, across every vault
-// loaded (opened, searched, or from the cache): expiry dates come with
-// the lists, so this makes no requests. enter on one goes to it.
-
-type expiringItem struct {
-	o   provider.Object
-	row string // its source's row key, to go to it
-}
-
-// expiringItems are the loaded objects that have expired or will within
-// the warning period, soonest first.
-func (m Model) expiringItems() []expiringItem {
-	var out []expiringItem
-	for _, p := range m.providers {
-		for _, src := range m.sourceResults[p.ID()].sources {
-			row := sourceRowKey(p.ID(), src.ID)
-			for _, c := range m.cache.containers[row].value {
-				for _, t := range c.ObjectTypes() {
-					for _, o := range m.cache.objects[containerKey(c)+"|"+string(t)].value {
-						if state, _ := m.expiry(o); state != notExpiring {
-							out = append(out, expiringItem{o, row})
-						}
-					}
-				}
-			}
-		}
-	}
-	slices.SortFunc(out, func(a, b expiringItem) int {
-		return cmp.Or(a.o.Expires.Compare(b.o.Expires), cmp.Compare(a.o.Name, b.o.Name))
-	})
-	return out
-}
-
-// expiringFields are the status pane's rows for them, and how much of
-// everything they cover.
-func (m Model) expiringFields() []panes.Field {
-	items := m.expiringItems()
-	var out []panes.Field
-	for _, it := range items {
-		state, left := m.expiry(it.o)
-		mark := "⚠ " + daysLeft(left)
-		if state == expired {
-			mark = "✗ expired"
-		}
-		f := panes.Field{Value: mark + "  " + it.o.Name + " · " + it.o.Container.Name, Err: state == expired, Row: it.row}
-		if r, err := ref.ForObject(it.o, ""); err == nil {
-			f.Link = r.String()
-		}
-		out = append(out, f)
-	}
-	cov := m.coverageOf(ofKind(provider.KindAzure))
-	switch {
-	case cov.vaults == 0 && len(items) == 0:
-		return nil
-	case !cov.complete():
-		out = append(out, panes.Field{Value: fmt.Sprintf("in %d of %d vaults", cov.vaultsLoaded, cov.vaults) +
-			withKey(m.keys.SearchLoadAll, " (%s in search loads all)"), Info: true})
-	case len(items) == 0:
-		out = append(out, panes.Field{Value: fmt.Sprintf("nothing within %d days", int(m.expiryWarning.Hours()/24)), Info: true})
-	}
-	out[0].Label = "expiring"
-	return out
-}

internal/ui/app/favourites_test.go

@@ -421,9 +421,8 @@ func TestStarIsPerAccount(t *testing.T) {
 	d.keys("n")
 	d.typeText("shared note")
 	d.keys("enter")
-	// On both accounts' rows, and in the selected one's details.
-	if n := strings.Count(d.screen(), "shared note"); n != 3 {
-		t.Errorf("note shown %d times, want 3:\n%s", n, d.screen())
+	if n := strings.Count(d.screen(), "shared note"); n != 2 {
+		t.Errorf("note shown %d times, want 2:\n%s", n, d.screen())
 	}
 	d.keys("F")
 	var labels []string

internal/ui/app/fields.go

@@ -1,224 +0,0 @@
-package app
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	tea "charm.land/bubbletea/v2"
-	"github.com/charmbracelet/x/ansi"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
-)
-
-// The fourth pane shows Fields for anything but a secret. On a provider's
-// row: its account, from what the provider knows locally.
-
-// A file's details beyond its listing load once a
-// session, when the cursor rests on it, and again with refresh. They're
-// extra: moving on cancels the load, and search never waits for them.
-type detailsState struct {
-	attrs   []provider.Attr
-	err     error
-	loading bool
-}
-
-type detailsMsg struct {
-	req   int
-	key   string
-	attrs []provider.Attr
-	err   error
-}
-
-// detailOf is the pane the fourth pane describes: the one in focus, or,
-// with the fourth in focus, the one it was entered from.
-func (m Model) detailOf() pane {
-	if m.focus != paneDetail {
-		return m.focus
-	}
-	return m.lastLeft
-}
-
-// syncFields shows the Fields pane for what the focused pane has selected,
-// unless that's a secret (or a vault with the Secrets pane in focus), which
-// the secret pane shows, as it does a revealed value whatever the focus.
-func (m *Model) syncFields() tea.Cmd {
-	if m.detail.State() != panes.ValueHidden {
-		// A value revealed (or being fetched) from any pane stays in
-		// view until it's hidden.
-		m.fields.Hide()
-		return nil
-	}
-	m.fields.Header, m.fields.HeaderShort = nil, ""
-	switch m.detailOf() {
-	case paneSources:
-		r, ok := m.sources.Selected()
-		switch {
-		case m.nothingFound():
-			m.fields.Show("get started", m.getStartedFields())
-		case !ok:
-			m.fields.Show("", nil)
-		case m.selectedProblem() != "":
-			m.fields.Show(cmpOr(r.label, r.source.Name), m.problemFields(m.selectedProblem()))
-		case r.kind == rowGroup:
-			m.showAccount(r)
-		case r.kind == rowSource:
-			m.fields.Show(r.source.Name, m.sourceFields(r.source))
-		default:
-			m.fields.Show("", nil)
-		}
-	case paneStatus:
-		m.fields.Header, m.fields.HeaderShort = logo, strings.TrimSpace("lazysecrets "+m.versionLabel())
-		m.fields.Show("lazysecrets", m.statusFields())
-	case paneContainers:
-		if c, ok := m.containers.Selected(); ok {
-			cmd := m.loadDetails(c)
-			m.fields.Show(c.Name, m.containerFields(c))
-			return cmd
-		} else {
-			m.fields.Show("", nil)
-		}
-	default:
-		m.fields.Hide()
-	}
-	return nil
-}
-
-// showAccount shows a provider's account.
-func (m *Model) showAccount(r sourceRow) {
-	p := m.byID[r.provider]
-	var fields []panes.Field
-	if a, ok := p.(provider.Accounts); ok {
-		if acct, ok := a.Account(); ok {
-			for _, f := range acct.Fields {
-				fields = append(fields, panes.Field{Label: f.Label, Value: f.Value})
-			}
-		}
-	}
-	if res, done := m.sourceResults[r.provider]; done && res.err == nil && len(res.sources) == 0 {
-		hint := emptyHint(p.Kind())
-		fields = append(fields, panes.Field{Label: "nothing", Value: "found: try", Info: true}, panes.Field{Value: hint.Value, URL: hint.URL})
-	}
-	m.fields.Show(p.Label(), fields)
-}
-
-// sourceFields describe a subscription, workspace or repo.
-func (m Model) sourceFields(src provider.Source) []panes.Field {
-	var out []panes.Field
-	add := func(label, value string) {
-		if value != "" {
-			out = append(out, panes.Field{Label: label, Value: value})
-		}
-	}
-	// Azure's detail is "subscription <ID>": the ID row says it.
-	id, detail := "ID", ""
-	switch src.Kind {
-	case provider.KindDatabricks:
-		id, detail = "profile", "host"
-	case provider.KindRepo:
-		id, detail = "path", "remote"
-	}
-	add("name", src.Name)
-	add("note", m.store.Node(sourceKey(src)).Note)
-	if src.ID != src.Name {
-		add(id, src.ID)
-	}
-	if detail != "" {
-		add(detail, src.Detail)
-	}
-	if src.ProviderLabel != string(src.Kind) {
-		add("account", src.ProviderLabel)
-	}
-	add("web", src.URL)
-	if e, ok := m.cache.containers[sourceRowKey(src.Provider, src.ID)]; ok {
-		label := map[provider.Kind]string{provider.KindDatabricks: "scopes", provider.KindRepo: "files"}[src.Kind]
-		add(cmpOr(label, "vaults"), fmt.Sprint(len(e.value)))
-	}
-	return out
-}
-
-// containerFields describe a vault, scope or file.
-func (m Model) containerFields(c provider.Container) []panes.Field {
-	var out []panes.Field
-	add := func(label, value string) {
-		if value != "" {
-			out = append(out, panes.Field{Label: label, Value: value})
-		}
-	}
-	add("name", c.Name)
-	add("note", m.store.Node(storeKey(c)).Note)
-	// The vault's URI, the scope's backend, the file's format.
-	switch c.Source.Kind {
-	case provider.KindAzure:
-		add("URI", c.Detail)
-	case provider.KindDatabricks:
-		add("backend", c.Detail)
-	case provider.KindRepo:
-		add("format", c.Detail)
-	}
-	add("source", cmpOr(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
-	add("web", c.URL)
-	for _, t := range c.ObjectTypes() {
-		if e, ok := m.cache.objects[containerKey(c)+"|"+string(t)]; ok {
-			add(strings.ToLower(string(t))+"s", fmt.Sprint(len(e.value)))
-		}
-	}
-	for _, a := range c.Attrs {
-		out = append(out, panes.Field{Label: a.Label, Value: a.Value, Err: a.Warn})
-	}
-	switch st := m.details[containerKey(c)]; {
-	case st.loading:
-		out = append(out, panes.Field{Label: "details", Value: "loading…", Info: true})
-	case errors.Is(st.err, provider.ErrUnsupported):
-	case st.err != nil:
-		out = append(out, panes.Field{Label: "details", Value: "couldn't load them: " + st.err.Error(), Info: true, Err: true})
-	}
-	for _, a := range m.details[containerKey(c)].attrs {
-		out = append(out, panes.Field{Label: a.Label, Value: a.Value, Err: a.Warn})
-	}
-	return out
-}
-
-// loadDetails loads c's details, if its provider has them and they
-// aren't loaded yet.
-func (m *Model) loadDetails(c provider.Container) tea.Cmd {
-	d, ok := m.providerFor(c.Source).(provider.ContainerDetails)
-	key := containerKey(c)
-	if _, seen := m.details[key]; !ok || seen {
-		return nil
-	}
-	// One at a time: the previous one, if it's still loading, is
-	// cancelled and forgotten, to load when it's shown again.
-	for k, st := range m.details {
-		if st.loading {
-			delete(m.details, k)
-		}
-	}
-	m.details[key] = detailsState{loading: true}
-	ctx, req := m.begin(slotDetails)
-	return m.settled(ctx, func() tea.Msg {
-		attrs, err := d.Details(ctx, c)
-		if ctx.Err() != nil {
-			err = ctx.Err()
-		}
-		return detailsMsg{req: req, key: key, attrs: attrs, err: err}
-	})
-}
-
-// problemFields show why an account has nothing to show, wrapped to the
-// pane, in red.
-func (m Model) problemFields(problem string) []panes.Field {
-	var out []panes.Field
-	for _, l := range strings.Split(ansi.Wrap(problem, max(20, m.fields.Width()-16), " "), "\n") {
-		out = append(out, panes.Field{Value: l, Info: true, Err: true})
-	}
-	out[0].Label = "problem"
-	return out
-}
-
-// fieldName names a copied field: its label, or a row of several under
-// one label (a tag), its value.
-func fieldName(f panes.Field) string {
-	return cmpOr(f.Label, f.Value)
-}

internal/ui/app/getstarted.go

@@ -1,66 +0,0 @@
-package app
-
-import (
-	"errors"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
-	"git.kebcloud.no/keb/lazysecrets/internal/update"
-)
-
-// When no account has anything to show, as on a first run, the right
-// pane says how to get started: the sign-in for each kind of account
-// (y copies it, L runs az login), and the demo.
-
-// nothingFound reports whether every account has loaded, with nothing.
-func (m Model) nothingFound() bool {
-	if m.sourcesPending > 0 {
-		return false
-	}
-	for _, p := range m.providers {
-		if len(m.sourceResults[p.ID()].sources) > 0 {
-			return false
-		}
-	}
-	return true
-}
-
-// getStartedFields are the rows saying how to get started.
-func (m Model) getStartedFields() []panes.Field {
-	out := []panes.Field{{Value: "Nothing to show yet: sign in where your secrets are.", Info: true}}
-	seen := map[provider.Kind]bool{}
-	for _, p := range m.providers {
-		if seen[p.Kind()] {
-			continue
-		}
-		seen[p.Kind()] = true
-		f := emptyHint(p.Kind())
-		var auth *provider.AuthError
-		switch err := m.sourceResults[p.ID()].err; {
-		case errors.As(err, &auth) && len(auth.Login) > 0:
-			f.Provider = p.ID() // L signs in
-			out = append(out, f, panes.Field{Value: withKey(m.keys.Login, "%s runs it here"), Info: true})
-		case err != nil:
-			out = append(out, f, panes.Field{Value: err.Error(), Info: true, Err: true})
-		default:
-			out = append(out, f)
-		}
-	}
-	return append(out,
-		panes.Field{Label: "try", Value: "lazysecrets --demo"},
-		panes.Field{Value: "built-in sample data, to look around", Info: true},
-		panes.Field{Label: "docs", Value: "getting started", URL: update.DefaultRepo + "#get-started"},
-	)
-}
-
-// emptyHint is how an account of kind gets something to show.
-func emptyHint(kind provider.Kind) panes.Field {
-	switch kind {
-	case provider.KindDatabricks:
-		return panes.Field{Label: "Databricks", Value: "databricks auth login --host https://<workspace>"}
-	case provider.KindRepo:
-		return panes.Field{Label: "repos", Value: "SOPS and .env files in your git repos",
-			URL: update.DefaultRepo + "/src/branch/main/docs/repos.md"}
-	}
-	return panes.Field{Label: string(kind), Value: "az login"}
-}

internal/ui/app/help.go

@@ -36,12 +36,6 @@ type contextHelp struct {
 	k        keys.Map
 	focus    pane
 	commands bool // custom commands apply here
-	account  bool // the fourth pane shows Fields (fields.go)
-	of       pane // what the fourth pane describes
-	// revealed, when set, says whether the selected value is shown, so
-	// the reveal key says just what it'll do: show or hide, the same
-	// width so the bar doesn't shift.
-	revealed *bool
 }
 
 func (c contextHelp) ShortHelp() []key.Binding {
@@ -50,28 +44,13 @@ func (c contextHelp) ShortHelp() []key.Binding {
 	if k.Login.Enabled() {
 		b = append(b, k.Login)
 	}
-	copyField := key.NewBinding(key.WithKeys(k.Copy.Keys()...), key.WithHelp(k.Copy.Help().Key, "copy"))
-	switch {
-	case c.focus == paneStatus:
-		details := key.NewBinding(key.WithKeys(k.Enter.Keys()...), key.WithHelp(k.Enter.Help().Key, "details"))
-		return append(b, details, k.Update, k.Help, k.Quit)
-	case c.focus == paneDetail && c.account && c.of == paneStatus:
-		open := key.NewBinding(key.WithKeys(k.Open.Keys()...), key.WithHelp(k.Open.Help().Key, "open link"))
-		return append(b, k.Up, k.Down, copyField, open, k.Edit, k.Filter, k.Help, k.Quit)
-	case c.focus == paneDetail && c.account:
-		return append(b, k.Up, k.Down, copyField, k.Filter, k.Help, k.Quit)
-	}
 	switch c.focus {
 	case paneSources:
-		b = append(b, k.Enter, k.Search, k.Share, k.ShareMenu, k.Favourite, k.Favourites, k.Filter)
+		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Favourites, k.Note, k.SourcesView, k.Filter)
 	case paneContainers:
-		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Open, k.Filter)
+		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Note, k.Open, k.Filter)
 	default:
-		reveal := k.Reveal
-		if c.revealed != nil {
-			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, map[bool]string{false: "show", true: "hide"}[*c.revealed]))
-		}
-		b = append(b, reveal, k.Copy, k.Share, k.ShareMenu, k.Versions, k.Favourite, k.Filter)
+		b = append(b, k.Reveal, k.Copy, k.Share, k.ShareMenu, k.Versions, k.Favourite, k.Note, k.Filter)
 	}
 	if c.commands {
 		b = append(b, k.Commands)
@@ -81,7 +60,7 @@ func (c contextHelp) ShortHelp() []key.Binding {
 
 func (c contextHelp) FullHelp() [][]key.Binding { return [][]key.Binding{c.ShortHelp()} }
 
-var paneNames = [paneCount]string{"Sources", "Vaults", "Secrets", "Detail", "Status"}
+var paneNames = [paneCount]string{"Sources", "Vaults", "Secrets", "Detail"}
 
 // showKeybindings opens the ? menu, like lazygit's: every binding with
 // what it does, the focused pane's first, filterable by key, description

internal/ui/app/jump.go

@@ -147,8 +147,8 @@ func sourceMatches(r ref.Ref, src provider.Source) bool {
 	return src.ID == r.Subscription
 }
 
-// accountOf is the account part of a source's provider label ("alice" in
-// "Azure · alice"), or "" when there's a single account.
+// accountOf is the account part of a source's provider label ("dev" in
+// "Azure · dev"), or "" when there's a single account.
 func accountOf(src provider.Source) string {
 	account, ok := strings.CutPrefix(src.ProviderLabel, string(src.Kind)+" · ")
 	if !ok {

internal/ui/app/layout.go

@@ -101,7 +101,7 @@ func (m *Model) resizeFocused(delta int) bool {
 	if m.focus > paneSecrets {
 		return false
 	}
-	avail := m.listAvail()
+	avail := m.leftAvail()
 	h := m.leftHeights(avail)
 	i := int(m.focus)
 	j := i + 1
@@ -128,9 +128,6 @@ func (m *Model) saveLayout() {
 
 func (m Model) leftAvail() int { return m.h - lipgloss.Height(m.footerView()) }
 
-// listAvail is the rows the three list panes share, under the status pane.
-func (m Model) listAvail() int { return m.leftAvail() - statusH }
-
 func (m *Model) cycleZoom(delta int) {
 	m.zoom = (m.zoom + zoom(delta) + zoomCount) % zoomCount
 }
@@ -141,22 +138,22 @@ func (m *Model) layout() {
 	}
 	m.help.SetWidth(max(0, m.w-1)) // one column in, like messages
 	avail := m.leftAvail()
-	leftW, h := m.leftWidth(), m.leftHeights(avail-statusH)
+	leftW, h := m.leftWidth(), m.leftHeights(avail)
 
 	switch m.zoom {
 	case zoomHalf:
-		if m.focus == paneDetail || m.focus == paneStatus {
+		if m.focus == paneDetail {
 			leftW = minLeftW
 		} else {
 			leftW = max(m.leftWidth(), m.w/2)
 			h = [3]int{tinyPaneH, tinyPaneH, tinyPaneH}
-			h[m.focus] = avail - statusH
-			h = fitHeights(h, avail-statusH, tinyPaneH)
+			h[m.focus] = avail
+			h = fitHeights(h, avail, tinyPaneH)
 		}
 	case zoomFull:
 		// Only the focused pane is drawn; it gets the whole screen.
 		switch m.focus {
-		case paneDetail, paneStatus:
+		case paneDetail:
 			leftW = 0
 		default:
 			leftW = m.w
@@ -165,12 +162,10 @@ func (m *Model) layout() {
 		}
 	}
 
-	m.statusW = leftW
 	m.sources.SetSize(leftW, h[0])
 	m.containers.SetSize(leftW, h[1])
 	m.secrets.SetSize(leftW, h[2])
 	m.detail.SetSize(m.w-leftW, avail)
-	m.fields.SetSize(m.w-leftW, avail)
 }
 
 // active reports whether p is drawn focused: it has focus and the terminal
@@ -180,23 +175,15 @@ func (m Model) active(p pane) bool { return m.focus == p && !m.termBlurred }
 
 func (m Model) panesView() string {
 	spin := m.spin.View()
-	views := [paneStatus]func() string{
+	views := [paneCount]func() string{
 		func() string { return m.sources.View(m.st, m.active(paneSources), spin) },
 		func() string { return m.containers.View(m.st, m.active(paneContainers), spin) },
 		func() string { return m.secrets.View(m.st, m.active(paneSecrets), spin) },
-		func() string {
-			if m.fields.Shown() {
-				return m.fields.View(m.st, m.active(paneDetail), spin)
-			}
-			return m.detail.View(m.st, m.active(paneDetail), spin)
-		},
+		func() string { return m.detail.View(m.st, m.active(paneDetail), spin) },
 	}
 	if m.zoom == zoomFull {
-		if m.focus == paneStatus {
-			return views[paneDetail]() // its rows
-		}
 		return views[m.focus]()
 	}
-	left := lipgloss.JoinVertical(lipgloss.Left, m.statusView(), views[0](), views[1](), views[2]())
+	left := lipgloss.JoinVertical(lipgloss.Left, views[0](), views[1](), views[2]())
 	return lipgloss.JoinHorizontal(lipgloss.Top, left, views[3]())
 }

internal/ui/app/layout_test.go

@@ -136,11 +136,11 @@ func TestLayoutIsSaved(t *testing.T) {
 func TestContextHelpBar(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "S share") || !strings.HasSuffix(strings.TrimSpace(bar), "? help • q quit") || strings.Contains(bar, "space show") {
+	if bar := lastLine(d.screen()); !strings.Contains(bar, "S share…") || !strings.HasSuffix(strings.TrimSpace(bar), "? help • q quit") || strings.Contains(bar, "space reveal") {
 		t.Errorf("Sources help bar: %q", bar)
 	}
 	d.keys("3")
-	if bar := lastLine(d.screen()); !strings.Contains(bar, "s copy link") || !strings.Contains(bar, "S share") {
+	if bar := lastLine(d.screen()); !strings.Contains(bar, "s copy link") || !strings.Contains(bar, "S share…") {
 		t.Errorf("Secrets help bar: %q", bar)
 	}
 }
@@ -258,13 +258,14 @@ func TestNoHighlightWhileTerminalBlurred(t *testing.T) {
 	}
 }
 
-func TestVersionInStatus(t *testing.T) {
+func TestVersionBottomRight(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{Version: "0.1.0"})
-	if !strings.Contains(d.screen(), "[0] lazysecrets v0.1.0") {
-		t.Errorf("no version in the status pane:\n%s", d.screen())
+	bar := lastLine(d.screen())
+	if !strings.HasSuffix(bar, "v0.1.0 ") || ansi.StringWidth(bar) != 100 {
+		t.Errorf("help line %q (%d wide)", bar, ansi.StringWidth(bar))
 	}
-	if bar := lastLine(d.screen()); strings.Contains(bar, "v0.1.0") || !strings.Contains(bar, "? help • q quit") {
-		t.Errorf("help line %q", bar)
+	if !strings.Contains(bar, "? help • q quit") {
+		t.Errorf("help squeezed out by the version: %q", bar)
 	}
 }

internal/ui/app/notes_test.go

@@ -42,7 +42,7 @@ func TestNotesOnRows(t *testing.T) {
 	d.note("main prod")
 
 	screen := d.screen()
-	for _, want := range []string{"stripe live", "app secrets", "main prod", "note       main prod"} {
+	for _, want := range []string{"stripe live", "app secrets", "main prod", "note       stripe live"} {
 		if !strings.Contains(screen, want) {
 			t.Errorf("missing %q:\n%s", want, screen)
 		}

internal/ui/app/persist.go

@@ -3,6 +3,7 @@ package app
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"time"
@@ -243,6 +244,6 @@ func (m *Model) restorePlace() {
 
 func (m *Model) handlePersisted(msg persistedMsg) {
 	if msg.err != nil {
-		m.logErrOf("saving the cache or place", msg.err)
+		m.noteErr(fmt.Errorf("saving the cache or place: %w", msg.err))
 	}
 }

internal/ui/app/persist_test.go

@@ -39,9 +39,6 @@ func TestCacheFileShowsLastRunAtOnce(t *testing.T) {
 	// Next run, with a backend too slow to answer during the test: the
 	// lists show from the file, and the cursor is where it was.
 	d2 := newDriverOpts(t, Options{CacheFile: file}, fake.Azure(time.Minute))
-	if strings.Contains(d2.screen(), "cached") {
-		t.Errorf("a fresh cache said its age:\n%s", d2.screen())
-	}
 	d2.keys("2")
 	if _, v, _ := d2.selected(); v != vault {
 		t.Errorf("vaults from the cache: selected %q, want %q\n%s", v, vault, d2.screen())
@@ -52,29 +49,6 @@ func TestCacheFileShowsLastRunAtOnce(t *testing.T) {
 	}
 }
 
-// Lists from an older cache say how old they are while they reload.
-func TestCacheFileSaysItsAge(t *testing.T) {
-	t.Parallel()
-	file := filepath.Join(t.TempDir(), "cache.json")
-	d := newDriverOpts(t, Options{CacheFile: file}, fake.Azure(0))
-	d.keys("3")
-	at := time.Now().Add(-3 * time.Hour)
-	for k, e := range d.m.cache.containers {
-		d.m.cache.containers[k] = entry[[]provider.Container]{e.value, at}
-	}
-	for id := range d.m.sourcesAt {
-		d.m.sourcesAt[id] = at
-	}
-	if err := d.m.Persist(); err != nil {
-		t.Fatal(err)
-	}
-	d2 := newDriverOpts(t, Options{CacheFile: file}, fake.Azure(time.Minute))
-	d2.keys("2")
-	if n := strings.Count(d2.screen(), "cached 3h ago"); n != 2 {
-		t.Errorf("Sources and Vaults should say they're from 3h ago (%d do):\n%s", n, d2.screen())
-	}
-}
-
 func TestCacheFileDropsOldAndSignedOut(t *testing.T) {
 	t.Parallel()
 	file := filepath.Join(t.TempDir(), "cache.json")

internal/ui/app/repo_test.go

@@ -3,7 +3,6 @@ package app
 import (
 	tea "charm.land/bubbletea/v2"
 	"context"
-	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -206,9 +205,9 @@ func TestSearchAllRepos(t *testing.T) {
 	for d.m.search.src > 0 {
 		d.send(tea.KeyPressMsg{Code: tea.KeyUp})
 	}
-	for d.m.search.scope().id != accountScope+"Repos" {
+	for d.m.search.scope().id != kindScope+string(provider.KindRepo) {
 		if d.m.search.src == len(d.m.search.scopes)-1 {
-			t.Fatalf("no Repos scope: %v", d.m.search.scopes)
+			t.Fatalf("no All repos scope: %v", d.m.search.scopes)
 		}
 		d.send(tea.KeyPressMsg{Code: tea.KeyDown})
 	}
@@ -235,110 +234,7 @@ func TestSearchAllRepos(t *testing.T) {
 	if azure() != azureBefore || d.m.crawl.running {
 		t.Errorf("searching all repos loaded Azure: %d → %d lists", azureBefore, azure())
 	}
-	if !strings.Contains(d.screen(), "Results in Repos") {
+	if !strings.Contains(d.screen(), "Results in all repos") {
 		t.Errorf("title:\n%s", d.screen())
 	}
 }
-
-func TestEditFile(t *testing.T) {
-	// Not parallel: git, run by the repo provider, is slow under load.
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("no git")
-	}
-	root := gitRepoWith(t, "https://git.example.com/team/x.git")
-	envPath := filepath.Join(root, "secrets", ".env")
-	os.WriteFile(envPath, []byte("# local\nTOKEN=x\n"), 0o600)
-	var opened []string
-	d := newDriverOpts(t, Options{OpenURL: func(u string) error { opened = append(opened, u); return nil }},
-		fake.Azure(0), repo.New(repo.Settings{Dir: root}))
-	env := map[string]string{"NVIM": "/tmp/nvim.sock"}
-	d.m.getenv = func(k string) string { return env[k] }
-	var nvim []string
-	d.m.nvimOpen = func(server, path string, line int) error {
-		nvim = append(nvim, fmt.Sprintf("%s %s:%d", server, path, line))
-		return nil
-	}
-
-	// Inside nvim: the file, then a secret at its line, and lazysecrets quits.
-	d.keys("2")
-	if _, c, _ := d.selected(); c != "secrets/.env" {
-		t.Fatalf("selected %q\n%s", c, d.screen())
-	}
-	d.keys("e")
-	d.keys("3", "e")
-	want := []string{"/tmp/nvim.sock " + envPath + ":0", "/tmp/nvim.sock " + envPath + ":2"}
-	if !slices.Equal(nvim, want) {
-		t.Errorf("nvim got %q\nwant %q", nvim, want)
-	}
-	if msg := d.m.edit()(); msg != (tea.QuitMsg{}) {
-		t.Errorf("after opening in nvim: %#v, want quit", msg)
-	}
-
-	// SOPS files go to sops edit, in the terminal, even inside nvim.
-	nvim = nil
-	d.keys("2", "j")
-	if _, c, _ := d.selected(); c != "secrets/app.yaml" {
-		t.Fatalf("selected %q", c)
-	}
-	if cmd := d.m.edit(); cmd == nil || len(nvim) > 0 {
-		t.Errorf("sops file: cmd %v, nvim %q", cmd, nvim)
-	}
-
-	// Neither nvim nor an editor: the system's default app.
-	delete(env, "NVIM")
-	d.keys("k", "e")
-	if !slices.Equal(opened, []string{envPath}) || !strings.Contains(d.screen(), "opened .env") {
-		t.Errorf("opened %q\n%s", opened, d.screen())
-	}
-
-	// Done editing: the file's secrets reload.
-	d.send(editDoneMsg{c: provider.Container{Source: provider.Source{Provider: "Repos"}, ID: envPath}, name: ".env"})
-	if !strings.Contains(d.screen(), "closed .env") {
-		t.Errorf("after editing:\n%s", d.screen())
-	}
-
-	// Other providers have no files.
-	az := newDriver(t, fake.Azure(0))
-	az.keys("2", "e")
-	if !strings.Contains(az.screen(), "only SOPS and .env files") {
-		t.Errorf("azure:\n%s", az.screen())
-	}
-}
-
-func TestEditorArgs(t *testing.T) {
-	t.Parallel()
-	f := provider.File{Path: "/r/.env", Line: 7}
-	for editor, want := range map[string][]string{
-		"nvim":             {"+7", "/r/.env"},
-		"/usr/bin/vim -p":  {"+7", "/r/.env"},
-		"hx":               {"/r/.env:7"},
-		"code --wait":      {"-g", "/r/.env:7"},
-		"open -a TextEdit": {"/r/.env"},
-	} {
-		if got := editorArgs(editor, f); !slices.Equal(got, want) {
-			t.Errorf("%s: %q, want %q", editor, got, want)
-		}
-	}
-	if got := editorArgs("nvim", provider.File{Path: "/r/.env"}); !slices.Equal(got, []string{"/r/.env"}) {
-		t.Errorf("no line: %q", got)
-	}
-}
-
-func TestEditorAtLine(t *testing.T) {
-	t.Parallel()
-	for _, c := range []struct {
-		editor string
-		line   int
-		want   string
-		ok     bool
-	}{
-		{"nvim", 4, "nvim +4", true},
-		{"/usr/bin/vim -p", 4, "/usr/bin/vim -p +4", true},
-		{"code --wait", 4, "", false}, // sops adds the file last: no -g file:N
-		{"nvim", 0, "", false},
-	} {
-		if got, ok := editorAtLine(c.editor, c.line); got != c.want || ok != c.ok {
-			t.Errorf("%q at %d: %q %v", c.editor, c.line, got, ok)
-		}
-	}
-}

internal/ui/app/search.go

@@ -131,25 +131,13 @@ func (c coverage) complete() bool {
 	return c.sourcesListed == c.sources && c.vaultsLoaded == c.vaults
 }
 
-func (m *Model) searchCoverage() coverage { return m.coverageOf(nil) }
+func (m *Model) searchCoverage() coverage { return m.coverageOf("") }
 
-// providerFilter picks the providers a search or a load covers; nil is
-// all of them.
-type providerFilter func(provider.Provider) bool
-
-func ofKind(k provider.Kind) providerFilter {
-	return func(p provider.Provider) bool { return p.Kind() == k }
-}
-
-func ofProvider(id string) providerFilter {
-	return func(p provider.Provider) bool { return p.ID() == id }
-}
-
-// coverageOf is searchCoverage for the providers in.
-func (m *Model) coverageOf(in providerFilter) coverage {
+// coverageOf is searchCoverage for one kind of provider ("" for all).
+func (m *Model) coverageOf(kind provider.Kind) coverage {
 	var c coverage
 	for _, p := range m.providers {
-		if in != nil && !in(p) {
+		if kind != "" && p.Kind() != kind {
 			continue
 		}
 		for _, src := range m.sourceResults[p.ID()].sources {
@@ -209,12 +197,12 @@ func plural(n int, word string) string {
 
 // startCrawl loads every unlisted subscription's vaults and every vault's
 // secrets not loaded yet.
-func (m *Model) startCrawl() tea.Cmd { return m.startCrawlOf(nil) }
+func (m *Model) startCrawl() tea.Cmd { return m.startCrawlOf("") }
 
-// startCrawlOf is startCrawl for the providers in.
-func (m *Model) startCrawlOf(in providerFilter) tea.Cmd {
+// startCrawlOf is startCrawl for one kind of provider ("" for all).
+func (m *Model) startCrawlOf(kind provider.Kind) tea.Cmd {
 	for _, p := range m.providers {
-		if in != nil && !in(p) {
+		if kind != "" && p.Kind() != kind {
 			continue
 		}
 		for _, src := range m.sourceResults[p.ID()].sources {

internal/ui/app/search_test.go

@@ -42,15 +42,11 @@ func TestSearchLoaded(t *testing.T) {
 			t.Fatalf("missing %q:\n%s", want, d.screen())
 		}
 	}
-	d.typeText("api-key") // on All: found at once
-	if !strings.Contains(d.screen(), "ctrl+s only platform-dev") {
-		t.Errorf("no hint to narrow to the source:\n%s", d.screen())
-	}
-	d.send(ctrl('s'))
-	if !strings.Contains(d.screen(), "no matches here · All searches everything") || !strings.Contains(d.screen(), "ctrl+s searches all") {
+	d.typeText("api-key")
+	if !strings.Contains(d.screen(), "no matches here · All searches everything") {
 		t.Errorf("no hint to search everything:\n%s", d.screen())
 	}
-	d.send(ctrl('s'))
+	d.searchAll()
 	if !strings.Contains(d.screen(), "platform-prod / kv-app-prod / api-key") {
 		t.Fatalf("loaded secret not found:\n%s", d.screen())
 	}
@@ -66,8 +62,7 @@ func TestSearchLoaded(t *testing.T) {
 func TestSearchLoadsAsYouType(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
-	d.openSearch()
-	d.send(ctrl('s')) // only the source the cursor is on: platform-prod
+	d.openSearch() // on the source the cursor is on: platform-prod
 	// Typing loads the scope: that source, without ctrl+a.
 	d.typeText("smtp")
 	if !strings.Contains(d.screen(), "platform-prod / kv-shared-prod / smtp-password") {
@@ -81,7 +76,10 @@ func TestSearchLoadsAsYouType(t *testing.T) {
 	}
 
 	// On All: everything.
-	d.send(ctrl('s'))
+	d.keys("tab") // to the scopes
+	for d.m.search.src > 0 {
+		d.send(tea.KeyPressMsg{Code: tea.KeyUp})
+	}
 	d.typeText("-")
 	if _, ok := d.m.cache.containers[sourceRowKey("Azure", "sub-dev")]; !ok {
 		t.Errorf("typing on All didn't load the other sources:\n%s", d.screen())
@@ -185,61 +183,19 @@ func TestSearchStartsWhereYouAre(t *testing.T) {
 	d.keys("2", "j") // platform-prod / kv-shared-prod
 	d.openSearch()
 	v := d.m.search
-	scope := func() string { return ansiStrip(v.scopes[v.src].label) }
-	if scope() != "All" {
-		t.Errorf("opened on %q, want All", scope())
+	if got := ansiStrip(v.scopes[v.src].label); !strings.Contains(got, "platform-prod") {
+		t.Errorf("source not preselected: %q", got)
 	}
 	if v.res >= len(v.shown) || !strings.Contains(ansiStrip(v.shown[v.res].label), "kv-shared-prod") {
 		t.Errorf("vault not under the cursor:\n%s", d.screen())
 	}
-	d.send(ctrl('s')) // narrows to the source, and back
-	if !strings.Contains(scope(), "platform-prod") {
-		t.Errorf("ctrl+s narrowed to %q", scope())
-	}
-	d.send(ctrl('s'))
-	if scope() != "All" {
-		t.Errorf("second ctrl+s on %q, want All", scope())
-	}
 
-	// From Favourites: to Search, on All.
-	d.keys("esc", "]", "]") // stop typing; Favourites
-	d.send(ctrl('s'))
-	if v.tab != tabSearch || scope() != "All" {
-		t.Errorf("ctrl+s from another tab: tab %d, %q", v.tab, scope())
-	}
-
-	// From the Sources pane: the source.
-	d.keys("esc", "1", "j") // close; platform-dev
+	// From the Sources pane: just the source.
+	d.keys("esc", "esc", "1", "j") // stop typing, close; platform-dev
 	d.openSearch()
 	v = d.m.search
-	d.send(ctrl('s'))
-	if !strings.Contains(scope(), "platform-dev") {
-		t.Errorf("ctrl+s narrowed to %q", scope())
-	}
-}
-
-func TestSearchNarrowsToAccount(t *testing.T) {
-	t.Parallel()
-	d := newDriver(t)
-	d.keys("1", "g") // the first group header
-	header, _ := d.m.sources.Selected()
-	d.openSearch()
-	d.send(ctrl('s'))
-	v := d.m.search
-	if v.scope().id != accountScope+header.provider {
-		t.Fatalf("ctrl+s on %q narrowed to %q", header.label, v.scope().id)
-	}
-	if len(v.shown) == 0 || !strings.Contains(d.screen(), "Results in "+header.label) {
-		t.Errorf("no results in the account:\n%s", d.screen())
-	}
-	for _, o := range v.shown {
-		if providerOf(o.group) != header.provider {
-			t.Errorf("result from another account: %q", ansiStrip(o.label))
-		}
-	}
-	// The account's sources are under it, indented.
-	if next := v.scopes[v.src+1]; next.group == "" || providerOf(next.group) != header.provider || !strings.HasPrefix(ansiStrip(next.label), "  ") {
-		t.Errorf("after the account: %q", ansiStrip(next.label))
+	if got := ansiStrip(v.scopes[v.src].label); !strings.Contains(got, "platform-dev") {
+		t.Errorf("source not preselected: %q", got)
 	}
 }
 
@@ -283,24 +239,6 @@ func TestGoToTabsAndModes(t *testing.T) {
 		t.Errorf("[ → tab %d, want Search:\n%s", v.tab, d.screen())
 	}
 
-	// g and G: top and bottom of the list with the cursor.
-	d.keys("G")
-	if v.res != len(v.shown)-1 || v.res == 0 {
-		t.Errorf("G on results: %d of %d", v.res, len(v.shown))
-	}
-	d.keys("g")
-	if v.res != 0 {
-		t.Errorf("g on results: %d", v.res)
-	}
-	d.keys("h", "G")
-	if v.src != len(v.scopes)-1 {
-		t.Errorf("G on scopes: %d of %d", v.src, len(v.scopes))
-	}
-	d.keys("g", "l")
-	if v.src != 0 {
-		t.Errorf("g on scopes: %d", v.src)
-	}
-
 	d.keys("/")
 	d.typeText("shared")
 	if !v.typing || len(v.shown) == 0 {

internal/ui/app/searchview.go

@@ -20,17 +20,16 @@ import (
 )
 
 // Go to is one popup for finding a place and going there. Tabs at the
-// top: Search has two lists side by side, the scope on the left (All, or
-// one source with how much of it is loaded: ○ ◐ ● ◌ ✗) and what's in it
-// on the right; Favourites and Recent (from the store, so they work
-// before anything loads) are one list each.
+// top: Favourites and Recent (from the store, so they work before
+// anything loads) are one list each; Search has two lists side by side,
+// the scope on the left (All, or one source with how much of it is
+// loaded: ○ ◐ ● ◌ ✗) and what's in it on the right.
 //
 // Like a pane, it's either browsing (letters: j/k, [ and ] for tabs, f
 // star, / to type) or typing a filter (ctrl+ letters). esc while typing
 // clears the text and goes back to browsing; esc while browsing closes.
 // F opens it on Favourites and R on Recent, browsing; search on Search,
-// typing, on All. search again narrows to the source you were in, and
-// back to All.
+// typing.
 //
 // The results don't move by themselves: as lists load, rows already shown
 // keep their order and new ones come after them, with the cursor on the
@@ -40,7 +39,7 @@ import (
 type searchView struct {
 	input   textinput.Model
 	typing  bool // the text field has the keyboard
-	tab     int  // tabSearch, tabFavs or tabRecent
+	tab     int  // tabFavs, tabRecent or tabSearch
 	results bool // in Search, the results have the cursor (else the scopes)
 
 	scopes []option // All, then the sources (Search)
@@ -50,7 +49,6 @@ type searchView struct {
 	shown  []option // the tab's (or scope's) entries matching the input
 	src    int      // cursor in scopes
 	res    int      // cursor in shown
-	here   string   // the scope of the source Go to was opened from, if any
 
 	// loaded are the scopes a search has loaded since the popup opened:
 	// typing loads the scope once, so lists that fail aren't asked for
@@ -59,25 +57,25 @@ type searchView struct {
 }
 
 const (
-	tabSearch = iota
-	tabFavs
+	tabFavs = iota
 	tabRecent
+	tabSearch
 	tabCount
 )
 
-var tabNames = [tabCount]string{"Search", "Favourites", "Recent"}
+var tabNames = [tabCount]string{"Favourites", "Recent", "Search"}
 
 const (
 	scopeFavs   = "#favs"
 	scopeRecent = "#recent"
 	allSources  = "#all"
-	accountScope = "#account:" // + a provider ID: an account's sources, or Databricks', or the repos
+	kindScope   = "#kind:" // + a provider kind: all of Azure, Databricks or repos
 )
 
 const goToTitle = "Go to"
 
-// showSearch opens Go to on Search, typing, on All, with the selected
-// vault under the cursor.
+// showSearch opens Go to on Search, typing, in the source you're in
+// (else All), with the selected vault under the cursor.
 func (m *Model) showSearch() tea.Cmd {
 	cmd := m.openGoTo(tabSearch, true)
 	m.preselect()
@@ -133,20 +131,17 @@ func (v *searchView) scope() option {
 // onSource reports whether the results come from one source.
 func (v *searchView) onSource() bool { return v.tab == tabSearch && v.scope().group != "" }
 
-// preselect starts where the user is: the selected source is the one
-// search narrows to, and the selected vault or scope is under the cursor.
+// preselect starts where the user is: the selected source picked on the
+// left, and the selected vault or scope under the cursor on the right.
 func (m *Model) preselect() {
 	v := m.search
 	row := m.sources.SelectedID()
-	account := ""
-	if id, ok := strings.CutPrefix(row, "group:"); ok { // a group header
-		account = accountScope + id
-	}
-	i := slices.IndexFunc(v.scopes, func(o option) bool { return o.id == account || o.group != "" && o.group == row })
+	i := slices.IndexFunc(v.scopes, func(o option) bool { return o.group != "" && o.group == row })
 	if i < 0 {
 		return
 	}
-	v.here = v.scopes[i].id
+	v.src = i
+	m.fillSearch(false)
 	if m.focus == paneSources {
 		return
 	}
@@ -176,36 +171,25 @@ func (m *Model) fillSearch(keep bool) {
 	}
 
 	sources, items := m.searchEntries()
-	all := option{label: "All", id: allSources, mark: m.coverageMark(nil)}
-	// Grouped like the Sources pane: each account (or Databricks, or the
-	// repos) is a scope too, its sources under it, so a search can stay on
-	// one, like the repos (local, quick), without asking Azure for every
-	// vault. With only one, it's the same as All.
-	var groups []provider.Provider
-	for _, p := range m.providers {
-		if len(m.sourceResults[p.ID()].sources) > 0 {
-			groups = append(groups, p)
-		}
-	}
+	all := option{label: "All", id: allSources, mark: m.coverageMark("")}
 	scopes := []option{all}
-	if len(groups) < 2 {
-		scopes = append(scopes, sources...)
-	} else {
-		for _, p := range groups {
-			k := p.Kind()
+	// All of one kind, so a search can stay on repos (local, quick)
+	// without asking Azure for every vault; only with several kinds.
+	var kinds []provider.Kind
+	for _, p := range m.providers {
+		if len(m.sourceResults[p.ID()].sources) > 0 && !slices.Contains(kinds, p.Kind()) {
+			kinds = append(kinds, p.Kind())
+		}
+	}
+	if len(kinds) > 1 {
+		for _, k := range kinds {
 			scopes = append(scopes, option{
-				label: m.st.Kind(k).Render(m.icons.Prefix(k) + p.Label()),
-				id:    accountScope + p.ID(), kind: k, mark: m.coverageMark(ofProvider(p.ID())),
+				label: m.st.Kind(k).Render(m.icons.Prefix(k) + kindScopeLabel(k)),
+				id:    kindScope + string(k), kind: k, mark: m.coverageMark(k),
 			})
-			for _, o := range sources {
-				if providerOf(o.group) == p.ID() {
-					o.label = "  " + o.label
-					scopes = append(scopes, o)
 		}
 	}
-		}
-	}
-	v.scopes, v.items = scopes, items
+	v.scopes, v.items = append(scopes, sources...), items
 	v.src = max(0, slices.IndexFunc(v.scopes, func(o option) bool { return o.id == atSrc }))
 
 	v.shown = v.match()
@@ -218,9 +202,17 @@ func (m *Model) fillSearch(keep bool) {
 	v.res = max(0, min(v.res, len(v.shown)-1))
 }
 
-// coverageMark is ○ ◐ ● for how much of the providers in is loaded.
-func (m *Model) coverageMark(in providerFilter) string {
-	switch c := m.coverageOf(in); {
+// kindScopeLabel names the scope of all of a kind's sources.
+func kindScopeLabel(k provider.Kind) string {
+	if k == provider.KindRepo {
+		return "All repos"
+	}
+	return "All " + string(k)
+}
+
+// coverageMark is ○ ◐ ● for how much of a kind ("" for all) is loaded.
+func (m *Model) coverageMark(kind provider.Kind) string {
+	switch c := m.coverageOf(kind); {
 	case c.complete():
 		return m.st.Success.Render("●")
 	case c.vaultsLoaded > 0:
@@ -229,28 +221,15 @@ func (m *Model) coverageMark(in providerFilter) string {
 	return m.st.Muted.Render("○")
 }
 
-// scopeAccount is the provider whose sources the scope covers, if it's
-// an account's.
-func (v *searchView) scopeAccount() (string, bool) {
-	id, ok := strings.CutPrefix(v.scope().id, accountScope)
+// scopeKind is the kind a scope covers all of, if it's one of those.
+func (v *searchView) scopeKind() (provider.Kind, bool) {
+	k, ok := strings.CutPrefix(v.scope().id, kindScope)
 	if !ok || v.tab != tabSearch {
 		return "", false
 	}
-	return id, true
+	return provider.Kind(k), true
 }
 
-// scopeFilter is what loading everything in the scope covers: an
-// account's, else all of them.
-func (v *searchView) scopeFilter() providerFilter {
-	if id, ok := v.scopeAccount(); ok {
-		return ofProvider(id)
-	}
-	return nil
-}
-
-// scopeName is the scope's label without colours or indent.
-func scopeName(o option) string { return strings.TrimSpace(ansi.Strip(o.label)) }
-
 // match lists the scope's entries matching the input, best first.
 func (v *searchView) match() []option {
 	var cand []option
@@ -260,9 +239,9 @@ func (v *searchView) match() []option {
 	case scopeRecent:
 		cand = v.recent
 	default:
-		account, ofAccount := v.scopeAccount()
+		kind, ofKind := v.scopeKind()
 		for _, o := range v.items {
-			if sc.id == allSources || ofAccount && providerOf(o.group) == account || sc.group != "" && o.group == sc.group {
+			if sc.id == allSources || ofKind && o.kind == kind || sc.group != "" && o.group == sc.group {
 				cand = append(cand, o)
 			}
 		}
@@ -341,9 +320,6 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 	// The actions shared by both modes, by their keys in the mode.
 	type modeKeys struct{ down, up, sources, results, switchList, star, load, loadAll, sel key.Binding }
 	k := modeKeys{km.GoDown, km.GoUp, km.GoSources, km.GoResults, km.GoSwitch, km.GoStar, km.GoLoad, km.GoLoadAll, km.GoSelect}
-	if key.Matches(msg, km.Search) {
-		return m.narrow()
-	}
 	if v.typing {
 		k = modeKeys{km.PopupDown, km.PopupUp, km.SearchSources, km.SearchResults, km.SearchSwitch, km.PopupStar, km.SearchLoad, km.SearchLoadAll, km.PopupSelect}
 		if key.Matches(msg, km.PopupClose) {
@@ -362,22 +338,6 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 			return nil
 		case key.Matches(msg, km.GoFilter):
 			return m.setTyping(true)
-		case key.Matches(msg, km.GoTop), key.Matches(msg, km.GoBottom):
-			n := len(v.shown)
-			if !v.results {
-				n = len(v.scopes)
-			}
-			i := 0
-			if key.Matches(msg, km.GoBottom) {
-				i = max(0, n-1)
-			}
-			if v.results {
-				v.res = i
-			} else if v.src != i {
-				v.src, v.res = i, 0
-				m.fillSearch(false)
-			}
-			return nil
 		case key.Matches(msg, km.Help):
 			return m.showKeybindingsFor(keys.GoTo)
 		case key.Matches(msg, km.GoNextTab), key.Matches(msg, km.GoPrevTab):
@@ -441,9 +401,11 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 		if v.onSource() {
 			return v.scope().reload(m)
 		}
-		return m.startCrawlOf(v.scopeFilter())
+		kind, _ := v.scopeKind()
+		return m.startCrawlOf(kind)
 	case inSearch && key.Matches(msg, k.loadAll):
-		return m.startCrawlOf(v.scopeFilter())
+		kind, _ := v.scopeKind()
+		return m.startCrawlOf(kind)
 	case key.Matches(msg, k.star):
 		if o, ok := v.selected(); ok && o.star != "" {
 			m.toggleStarKey(o.star, o.starAccount)
@@ -474,22 +436,6 @@ func (m *Model) handleSearch(msg tea.KeyPressMsg) tea.Cmd {
 	return cmd
 }
 
-// narrow switches Search between All and the source Go to was opened
-// from; from another tab, or another scope, it goes to Search on All.
-func (m *Model) narrow() tea.Cmd {
-	v := m.search
-	src := 0
-	if v.tab == tabSearch && v.scope().id == allSources {
-		src = slices.IndexFunc(v.scopes, func(o option) bool { return o.id == v.here })
-		if src < 0 {
-			return nil
-		}
-	}
-	v.tab, v.src, v.res, v.results = tabSearch, src, 0, true
-	m.fillSearch(false)
-	return m.searchLoads()
-}
-
 // searchLoads loads what a search in the Search tab covers, like the
 // load-all key: everything on All, else the source picked. Only what
 // isn't loaded yet, once a popup; repos load by themselves anyway.
@@ -506,8 +452,8 @@ func (m *Model) searchLoads() tea.Cmd {
 		v.loaded = map[string]bool{}
 	}
 	v.loaded[sc.id] = true
-	if _, ok := v.scopeAccount(); ok {
-		return m.startCrawlOf(v.scopeFilter())
+	if kind, ok := v.scopeKind(); ok {
+		return m.startCrawlOf(kind)
 	}
 	if !v.onSource() {
 		return m.startCrawl()
@@ -551,35 +497,6 @@ func (m *Model) toggleStarKey(key, account string) {
 // searchHint tops the results when what they come from isn't all
 // loaded, saying how to load it.
 func (m Model) searchHint() string {
-	load, narrow := m.loadHint(), m.narrowHint()
-	switch {
-	case narrow == "":
-		return load
-	case load != "":
-		narrow = " · " + narrow
-	}
-	return load + m.st.Muted.Render(narrow)
-}
-
-// narrowHint names the key for the other of All and the source Go to was
-// opened from.
-func (m Model) narrowHint() string {
-	v := m.search
-	if v.tab != tabSearch || m.crawl.running {
-		return ""
-	}
-	if v.scope().id == v.here && v.here != "" {
-		return withKey(m.keys.Search, "%s searches all")
-	}
-	i := slices.IndexFunc(v.scopes, func(o option) bool { return o.id == v.here })
-	if i < 0 || v.scope().id != allSources {
-		return ""
-	}
-	return withKey(m.keys.Search, "%s only "+scopeName(v.scopes[i]))
-}
-
-// loadHint says how much of the scope is loaded, and the key to load it.
-func (m Model) loadHint() string {
 	v := m.search
 	if m.crawl.running {
 		return m.st.Muted.Render(fmt.Sprintf("◌ loading… %d lists left", len(m.crawl.queue)+m.crawl.active))
@@ -587,8 +504,8 @@ func (m Model) loadHint() string {
 	if v.tab != tabSearch {
 		return "" // from the store: nothing to load
 	}
-	if _, ok := v.scopeAccount(); ok || v.scope().id == allSources {
-		c := m.coverageOf(v.scopeFilter())
+	if kind, ok := v.scopeKind(); ok || v.scope().id == allSources {
+		c := m.coverageOf(kind)
 		if c.complete() {
 			return ""
 		}
@@ -720,8 +637,14 @@ func (m Model) searchViewBox() string {
 	}
 	title := func(s string, active bool) string { return panes.TitleStyle(m.st, active && focused).Render(s) }
 	resultsTitle := map[string]string{scopeFavs: "Favourites", scopeRecent: "Recent", allSources: "Results in all sources"}[v.scope().id]
-	if _, ok := v.scopeAccount(); ok || v.onSource() {
-		resultsTitle = "Results in " + scopeName(v.scope())
+	if v.onSource() {
+		resultsTitle = "Results in " + ansi.Strip(v.scope().label)
+	}
+	if kind, ok := v.scopeKind(); ok {
+		resultsTitle = "Results in " + string(kind)
+		if kind == provider.KindRepo {
+			resultsTitle = "Results in all repos"
+		}
 	}
 	var lists string
 	if v.tab == tabSearch {

internal/ui/app/status.go

@@ -1,204 +0,0 @@
-package app
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
-	"git.kebcloud.no/keb/lazysecrets/internal/update"
-)
-
-// The status pane, like lazygit's: a line on top of the left panes with
-// the version, a newer release and how the accounts are doing. Focused
-// (0), the right pane has the rest: updates, each account, the files
-// lazysecrets uses, links, and the changelog.
-
-// logo heads the status pane's rows.
-var logo = []string{
-	` _                                        _`,
-	`| | __ _ _____   _ ___  ___  ___ _ __ ___| |_ ___`,
-	`| |/ _` + "`" + ` |_  / | | / __|/ _ \/ __| '__/ _ \ __/ __|`,
-	`| | (_| |/ /| |_| \__ \  __/ (__| | |  __/ |_\__ \`,
-	`|_|\__,_/___|\__, |___/\___|\___|_|  \___|\__|___/`,
-	`             |___/`,
-}
-
-// statusH is the status pane's height: one line in a box.
-const statusH = 3
-
-// statusLine is what the status pane says while it isn't focused.
-func (m Model) statusLine() string {
-	var parts []string
-	switch {
-	case m.updated != "":
-		parts = append(parts, m.st.Notice.Render("→ "+m.updated+" (restart)"))
-	case m.newer != nil:
-		parts = append(parts, m.st.Notice.Render("↑ "+m.newer.Tag+withKey(m.keys.Update, " %s")))
-	}
-	accounts, failing, repos := 0, 0, 0
-	for _, p := range m.providers {
-		if p.Kind() == provider.KindRepo {
-			repos += len(m.sourceResults[p.ID()].sources) // those with secret files
-			continue
-		}
-		accounts++
-		if r, ok := m.sourceResults[p.ID()]; ok && r.err != nil {
-			failing++
-		}
-	}
-	if n := len(m.expiringItems()); n > 0 {
-		parts = append(parts, m.st.Warning.Render(fmt.Sprintf("⚠ %d expiring", n)))
-	}
-	if accounts > 0 {
-		s := plural(accounts, "account")
-		if failing > 0 {
-			s += " · " + m.st.Error.Render(fmt.Sprintf("%d need sign-in", failing))
-		}
-		parts = append(parts, s)
-	}
-	if repos > 0 {
-		parts = append(parts, plural(repos, "repo"))
-	}
-	return " " + strings.Join(parts, m.st.Muted.Render(" · "))
-}
-
-func (m Model) statusView() string {
-	title := "[0] lazysecrets"
-	if v := m.versionLabel(); v != "" {
-		title += " " + v
-	}
-	return panes.Box(m.st, panes.TitleStyle(m.st, m.active(paneStatus)).Render(title), "",
-		[]string{m.statusLine()}, m.statusW, statusH, m.active(paneStatus))
-}
-
-// statusFields are the status pane's rows on the right.
-func (m Model) statusFields() []panes.Field {
-	var out []panes.Field
-	add := func(f panes.Field) {
-		if f.Value != "" {
-			out = append(out, f)
-		}
-	}
-	// A release's rows open its release page.
-	version := panes.Field{Label: "version", Value: cmpOr(m.versionLabel(), "dev")}
-	if strings.HasPrefix(version.Value, "v") {
-		version.URL = update.DefaultRepo + "/releases/tag/" + version.Value
-	}
-	add(version)
-	upd := panes.Field{Label: "update", Value: m.updateStatus(), Info: m.newer == nil}
-	if m.newer != nil {
-		upd.URL = update.DefaultRepo + "/releases/tag/" + m.newer.Tag
-	}
-	add(upd)
-	add(panes.Field{Label: "license", Value: "GPL-3.0-or-later · © 2026 Karl-Einar Bergstrøm", Info: true})
-
-	for i, p := range m.providers {
-		f := panes.Field{Value: p.Label() + " · " + m.accountStatus(p), Provider: p.ID()}
-		if i == 0 {
-			f.Label = "accounts"
-		}
-		var auth *provider.AuthError
-		f.Err = errors.As(m.sourceResults[p.ID()].err, &auth)
-		add(f)
-	}
-
-	out = append(out, m.expiringFields()...)
-	out = append(out, m.errorFields()...)
-
-	for i, path := range m.configFiles {
-		label := ""
-		if i == 0 {
-			label = "config"
-		}
-		add(panes.Field{Label: label, Value: path, Path: path})
-	}
-	add(panes.Field{Label: "state", Value: m.statePath, Path: m.statePath})
-	add(panes.Field{Label: "cache", Value: m.cachePath, Path: m.cachePath})
-
-	// Short, without https://; y copies and o opens the whole URL.
-	repo := strings.TrimPrefix(update.DefaultRepo, "https://")
-	add(panes.Field{Label: "docs", Value: repo + "/…/docs", URL: update.DefaultRepo + "/src/branch/main/docs"})
-	add(panes.Field{Label: "source", Value: repo, URL: update.DefaultRepo})
-	// Issues are on the GitHub mirror.
-	github := strings.TrimPrefix(update.GitHubRepo, "https://")
-	add(panes.Field{Label: "issues", Value: github + "/issues", URL: update.GitHubRepo + "/issues"})
-	add(panes.Field{Label: "releases", Value: repo + "/releases", URL: update.DefaultRepo + "/releases"})
-	add(panes.Field{Label: "changelog", Value: repo + "/…/CHANGELOG.md", URL: update.DefaultRepo + "/src/branch/main/CHANGELOG.md"})
-	return append(out, m.changelog...)
-}
-
-// updateStatus says whether a newer release is out, and when it was
-// last checked.
-func (m Model) updateStatus() string {
-	switch {
-	case m.updated != "":
-		return "updated to " + m.updated + ": restart to use it"
-	case m.newer != nil:
-		return m.newer.Tag + " is out" + withKey(m.keys.Update, " · %s updates")
-	}
-	at := m.store.UpdateCheck().At
-	if at.IsZero() {
-		return ""
-	}
-	return "up to date · checked " + ago(m.now().Sub(at))
-}
-
-// accountStatus says whether an account's sources loaded.
-func (m Model) accountStatus(p provider.Provider) string {
-	r, done := m.sourceResults[p.ID()]
-	var auth *provider.AuthError
-	switch {
-	case !done:
-		return "loading…"
-	case errors.As(r.err, &auth) && len(auth.Login) > 0:
-		return "sign-in required" + withKey(m.keys.Login, " · %s signs in")
-	case r.err != nil:
-		return r.err.Error()
-	}
-	noun := map[provider.Kind]string{provider.KindAzure: "subscription", provider.KindDatabricks: "workspace", provider.KindRepo: "repo"}[p.Kind()]
-	return plural(len(r.sources), cmpOr(noun, "source"))
-}
-
-// ago is a duration as people say it: "just now", "5m ago", "2h ago".
-func ago(d time.Duration) string {
-	switch {
-	case d < time.Minute:
-		return "just now"
-	case d < time.Hour:
-		return fmt.Sprintf("%dm ago", int(d.Minutes()))
-	case d < 48*time.Hour:
-		return fmt.Sprintf("%dh ago", int(d.Hours()))
-	}
-	return fmt.Sprintf("%dd ago", int(d.Hours()/24))
-}
-
-// changelogFields are CHANGELOG.md as rows: each release's version and
-// date, then its entries, marked by what kind they are.
-func changelogFields(md string) []panes.Field {
-	var out []panes.Field
-	kind := ""
-	for _, line := range strings.Split(md, "\n") {
-		line = strings.TrimSpace(line)
-		switch {
-		case strings.HasPrefix(line, "## "):
-			version, date, _ := strings.Cut(strings.TrimPrefix(line, "## "), " – ")
-			out = append(out, panes.Field{Label: version, Value: date, Info: true})
-			kind = ""
-		case strings.HasPrefix(line, "### "):
-			kind = strings.ToLower(strings.TrimPrefix(line, "### "))
-		case strings.HasPrefix(line, "- ") && len(out) > 0:
-			text := update.PlainLinks(strings.TrimPrefix(line, "- "))
-			if kind != "" {
-				text = kind + ": " + text
-			}
-			out = append(out, panes.Field{Value: text})
-		case line != "" && len(out) > 0 && !strings.HasPrefix(line, "<!--"):
-			// A release's own words ("Hello world 👋").
-			out = append(out, panes.Field{Value: update.PlainLinks(line)})
-		}
-	}
-	return out
-}

internal/ui/app/status_test.go

@@ -1,30 +0,0 @@
-package app
-
-import (
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
-)
-
-func TestChangelogFields(t *testing.T) {
-	t.Parallel()
-	md := "# Changelog\n\nEvery release of lazysecrets, newest first.\n\n## v0.2.0 – 2026-10-12\n\n### Added\n\n" +
-		"- Search ([#11](https://x/pulls/11)) ([65dc2d7](https://x/commit/65dc2d7))\n\n### Fixed\n\n- A fix (#3)\n\n" +
-		"## v0.1.0 – 2026-10-10\n\nHello world 👋\n\n<!-- generated by git-cliff (cliff.toml) -->\n"
-	got := changelogFields(md)
-	want := []panes.Field{
-		{Label: "v0.2.0", Value: "2026-10-12", Info: true},
-		{Value: "added: Search (#11) (65dc2d7)"},
-		{Value: "fixed: A fix (#3)"},
-		{Label: "v0.1.0", Value: "2026-10-10", Info: true},
-		{Value: "Hello world 👋"},
-	}
-	if len(got) != len(want) {
-		t.Fatalf("got %+v", got)
-	}
-	for i := range want {
-		if got[i] != want[i] {
-			t.Errorf("row %d: %+v, want %+v", i, got[i], want[i])
-		}
-	}
-}

internal/ui/app/testdata/TestGolden.golden

@@ -1,25 +1,22 @@
-╭─ [0] lazysecrets ─────────────╮╭─ platform-prod ─────────────────────────────────────────────────╮
-│ 2 accounts                    ││ name       platform-prod                                        │
-╰───────────────────────────────╯│ ID         sub-prod                                             │
-╭─ [1] Sources - Favourites ────╮│ web        https://portal.azure.com/#resource/subscriptions/sub…│
-│ ▾ Azure (2)                   ││ vaults     3                                                    │
-│   platform-prod               ││                                                                 │
-│   platform-dev                ││                                                                 │
-│ ▾ Databricks (2)              ││                                                                 │
-│   prod                        ││                                                                 │
-╰────────────────────── 2 of 6 ─╯│                                                                 │
-╭─ [2] Vaults ──────────────────╮│                                                                 │
-│ kv-app-prod                   ││                                                                 │
-│ kv-shared-prod                ││                                                                 │
-│ kv-restricted                 ││                                                                 │
+╭─ [1] Sources - Favourites ────╮╭─ Secret ────────────────────────────────────────────────────────╮
+│ ▾ Azure (2)                   ││ name       db-password                                          │
+│   platform-prod               ││ vault      kv-app-prod                                          │
+│   platform-dev                ││ source     Azure / platform-prod                                │
+│ ▾ Databricks (2)              ││ version    3f9c2a                                               │
+│   prod                        ││ enabled    yes                                                  │
+╰────────────────────── 2 of 6 ─╯│ updated    2026-09-01 09:30                                     │
+╭─ [2] Vaults ──────────────────╮│ expires    2027-09-01 09:30                                     │
+│ kv-app-prod                   ││ content    text/plain                                           │
+│ kv-shared-prod                ││ tags       env=prod, owner=data                                 │
+│ kv-restricted                 ││ ref        @Microsoft.KeyVault(SecretUri=https://kv-app-prod.vau│
+│                               ││            lt.azure.net/secrets/db-password)                    │
 │                               ││                                                                 │
+│                               ││ value      ••••••••  (space to reveal)                          │
 │                               ││                                                                 │
-│                               ││                                                                 │
-│                               ││                                                                 │
-╰────────────────────── 1 of 3 ─╯│                                                                 │
-╭─ [3] Secrets - Keys - Certs ──╮│                                                                 │
-│ db-password                   ││                                                                 │
-│ api-key                       ││                                                                 │
+╰────────────────────── 1 of 3 ─╯│ versions   3 · v to browse                                      │
+╭─ [3] Secrets - Keys - Certs ──╮│ ▸ 3f9c2a   2026-09-01 current                                   │
+│ db-password                   ││   91d3e0   2026-03-01 expired                                   │
+│ api-key                       ││   0a77c4   2025-09-01 disabled                                  │
 │ legacy-token (disabled)       ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
@@ -29,5 +26,5 @@
 │                               ││                                                                 │
 │                               ││                                                                 │
 │                               ││                                                                 │
-╰────────────────────── 1 of 3 ─╯╰──────────────────────────────────────────────────────── 1 of 4 ─╯
- enter open • ctrl+s search • s copy link • S share • f star • F favourites • … • ? help • q quit
+╰────────────────────── 1 of 3 ─╯╰─────────────────────────────────────────────────────────────────╯
+ enter open • s copy link • S share… • f star • F favourites • n note • … • ? help • q quit

internal/ui/app/update.go

@@ -155,3 +155,15 @@ func (m *Model) handleInstalled(msg installedMsg) {
 	m.updated = msg.release.Tag
 	m.flash = done("updated to lazysecrets " + msg.release.Tag + " · restart lazysecrets to use it")
 }
+
+// updateLabel is the version's suffix in the footer: a newer release to
+// update to, or the one installed and waiting for a restart.
+func (m Model) updateLabel() string {
+	switch {
+	case m.updated != "":
+		return " → " + m.updated + " (restart)"
+	case m.newer != nil:
+		return " ↑ " + m.newer.Tag + withKey(m.keys.Update, " %s")
+	}
+	return ""
+}

internal/ui/app/update_test.go

@@ -47,8 +47,8 @@ func TestUpdate(t *testing.T) {
 	if f.asked != 1 {
 		t.Fatalf("asked %d times at startup", f.asked)
 	}
-	if scr := d.screen(); !strings.Contains(scr, "[0] lazysecrets v0.1.1") || !strings.Contains(scr, "↑ v0.2.0 U") {
-		t.Errorf("no update in the status pane:\n%s", scr)
+	if !strings.Contains(d.screen(), "v0.1.1 ↑ v0.2.0 U") {
+		t.Errorf("no update in the footer:\n%s", d.screen())
 	}
 
 	// U: the changelog, without the install notes; u installs.

internal/ui/keys/keys.go

@@ -36,11 +36,11 @@ const (
 type Map struct {
 	// lists
 	Up, Down, Top, Bottom             key.Binding
-	NextPane, PrevPane, Details       key.Binding
-	Pane0, Pane1, Pane2, Pane3, Pane4 key.Binding
+	NextPane, PrevPane                key.Binding
+	Pane1, Pane2, Pane3, Pane4        key.Binding
 	NextTab, PrevTab                  key.Binding
 	Enter, Back, Filter               key.Binding
-	Reveal, Copy, CopyRef, Open, Edit key.Binding
+	Reveal, Copy, CopyRef, Open       key.Binding
 	Versions, Favourite, Favourites   key.Binding
 	Recent                            key.Binding
 	Note, Share, ShareMenu, OpenRef   key.Binding
@@ -61,8 +61,7 @@ type Map struct {
 	SearchSources, SearchResults, SearchSwitch key.Binding
 	SearchLoad, SearchLoadAll                  key.Binding
 	// goto
-	GoDown, GoUp, GoTop, GoBottom       key.Binding
-	GoPrevTab, GoNextTab                key.Binding
+	GoDown, GoUp, GoPrevTab, GoNextTab  key.Binding
 	GoSources, GoResults, GoSwitch      key.Binding
 	GoStar, GoLoad, GoLoadAll, GoFilter key.Binding
 	GoSelect, GoClose                   key.Binding
@@ -88,13 +87,11 @@ func (m *Map) Actions() []Action {
 		a(Lists, "top", &m.Top, "top", "move", "Jump to the top of the focused list."),
 		a(Lists, "bottom", &m.Bottom, "bottom", "move", "Jump to the bottom of the focused list."),
 		a(Lists, "nextPane", &m.NextPane, "next pane", "move", "Focus the next pane: Sources, Vaults, Secrets, detail."),
-		a(Lists, "prevPane", &m.PrevPane, "prev pane", "move", "Focus the previous pane; from the detail pane, the one it describes."),
-		a(Lists, "details", &m.Details, "details", "move", "Focus the detail pane on the right, on what's selected: a source, vault, file or secret."),
+		a(Lists, "prevPane", &m.PrevPane, "prev pane", "move", "Focus the previous pane."),
 		a(Lists, "pane1", &m.Pane1, "Sources pane", "move", "Focus the Sources pane."),
 		a(Lists, "pane2", &m.Pane2, "Vaults pane", "move", "Focus the Vaults (or Scopes) pane."),
 		a(Lists, "pane3", &m.Pane3, "Secrets pane", "move", "Focus the Secrets pane."),
 		a(Lists, "pane4", &m.Pane4, "detail pane", "move", "Focus the detail pane."),
-		a(Lists, "pane0", &m.Pane0, "status", "move", "Focus the status pane: version and updates, accounts, config files, links and the changelog, on the right."),
 		a(Lists, "enter", &m.Enter, "open", "move", "Go into the selected item: from a subscription to its vaults, from a vault to its secrets. On a provider header, fold or unfold it."),
 		a(Lists, "back", &m.Back, "back", "move", "Go back: clear an applied filter, leave the versions view, or focus the previous pane."),
 
@@ -103,7 +100,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "nextTab", &m.NextTab, "next tab", "lists", "Next tab of the focused pane."),
 		a(Lists, "sourcesView", &m.SourcesView, "grouped/flat sources", "lists", "Switch the Sources pane between grouped by provider and a flat list."),
 		a(Lists, "star", &m.Favourite, "star", "lists", "Star or unstar the selected subscription, vault or secret, for the account showing it. Starred items get a ★ and sort first."),
-		a(Lists, "search", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one. Again in Go to: only the source or group you're in, and back to all. On the left, the scope: All, an account (or Databricks, or Repos), or one source (○ ◐ ● for how much of it is loaded)."),
+		a(Lists, "search", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one, starting in the source you're in. On the left, the scope: Favourites, Recent, All, or one source (○ ◐ ● for how much of it is loaded)."),
 		a(Lists, "favourites", &m.Favourites, "favourites", "lists", "Go to, on Favourites: everything you've starred, to search and jump to."),
 		a(Lists, "recent", &m.Recent, "recent", "lists", "Go to, on Recent: what you used last, newest first."),
 		a(Lists, "commands", &m.Commands, "commands", "lists", "List the custom commands for the focused pane (customCommands in the config) and run one."),
@@ -114,10 +111,9 @@ func (m *Map) Actions() []Action {
 		a(Lists, "copyReference", &m.CopyRef, "copy reference", "secrets", "Copy the reference to use in config, e.g. @Microsoft.KeyVault(SecretUri=…) or {{secrets/scope/key}}."),
 		a(Lists, "versions", &m.Versions, "versions", "secrets", "List the versions of the selected item (Azure). Reveal, copy and share then act on the selected version."),
 		a(Lists, "openInBrowser", &m.Open, "open in browser", "secrets", "Open the selected subscription, vault or item in the browser (Azure portal or Databricks workspace)."),
-		a(Lists, "edit", &m.Edit, "open file", "secrets", "Open the selected SOPS or .env file, or the file of the selected secret at its line. SOPS files open with sops edit. Others open in the nvim lazysecrets runs in (quitting lazysecrets), else in $VISUAL or $EDITOR, else in the system's default app."),
 
 		a(Lists, "share", &m.Share, "copy link", "share", "Copy a lazysecrets:// link to the selected subscription, workspace, vault, scope or secret, for sharing. From the versions view the link is pinned to that version."),
-		a(Lists, "shareMenu", &m.ShareMenu, "share", "share", "Choose what to share: the lazysecrets link, the plain Key Vault URL, the config reference, or the web page."),
+		a(Lists, "shareMenu", &m.ShareMenu, "share…", "share", "Choose what to share: the lazysecrets link, the plain Key Vault URL, the config reference, or the web page."),
 		a(Lists, "openLink", &m.OpenRef, "open link", "share", "Open a lazysecrets:// link, Key Vault URL or reference. Pasting one into lazysecrets does the same."),
 
 		a(Lists, "dividerLeft", &m.SplitLeft, "divider left", "layout", "Move the divider between the left panes and the detail pane to the left."),
@@ -161,9 +157,7 @@ func (m *Map) Actions() []Action {
 
 		a(GoTo, "down", &m.GoDown, "down", "go to", "Move down in Go to while browsing."),
 		a(GoTo, "up", &m.GoUp, "up", "go to", "Move up in Go to while browsing."),
-		a(GoTo, "top", &m.GoTop, "top", "go to", "Jump to the top of the list in Go to while browsing."),
-		a(GoTo, "bottom", &m.GoBottom, "bottom", "go to", "Jump to the bottom of the list in Go to while browsing."),
-		a(GoTo, "prevTab", &m.GoPrevTab, "prev tab", "go to", "Previous tab of Go to: Search, Favourites, Recent."),
+		a(GoTo, "prevTab", &m.GoPrevTab, "prev tab", "go to", "Previous tab of Go to: Favourites, Recent, Search."),
 		a(GoTo, "nextTab", &m.GoNextTab, "next tab", "go to", "Next tab of Go to."),
 		a(GoTo, "sources", &m.GoSources, "sources", "go to", "Move to the sources list (Search tab)."),
 		a(GoTo, "results", &m.GoResults, "results", "go to", "Move to the results list (Search tab)."),
@@ -182,14 +176,14 @@ func (m *Map) Actions() []Action {
 var defaults = map[string][]string{
 	"lists.up": {"k", "up", "ctrl+k", "ctrl+p"}, "lists.down": {"j", "down", "ctrl+j", "ctrl+n"},
 	"lists.top": {"g", "home"}, "lists.bottom": {"G", "end"},
-	"lists.nextPane": {"tab"}, "lists.prevPane": {"shift+tab", "h", "left"}, "lists.details": {"l", "right"},
-	"lists.pane1": {"1"}, "lists.pane2": {"2"}, "lists.pane3": {"3"}, "lists.pane4": {"4"}, "lists.pane0": {"0"},
+	"lists.nextPane": {"tab", "l", "right"}, "lists.prevPane": {"shift+tab", "h", "left"},
+	"lists.pane1": {"1"}, "lists.pane2": {"2"}, "lists.pane3": {"3"}, "lists.pane4": {"4"},
 	"lists.enter": {"enter"}, "lists.back": {"esc", "backspace"},
 	"lists.filter": {"/"}, "lists.prevTab": {"["}, "lists.nextTab": {"]"}, "lists.sourcesView": {"`"},
 	"lists.star": {"f"}, "lists.favourites": {"F"}, "lists.recent": {"R"}, "lists.search": {"ctrl+s"}, "lists.note": {"n"},
 	"lists.commands": {"x"},
 	"lists.reveal":   {"space"}, "lists.copyValue": {"y"}, "lists.copyReference": {"Y"},
-	"lists.versions": {"v"}, "lists.openInBrowser": {"o"}, "lists.edit": {"e"},
+	"lists.versions": {"v"}, "lists.openInBrowser": {"o"},
 	"lists.share": {"s"}, "lists.shareMenu": {"S"}, "lists.openLink": {"ctrl+o"},
 	"lists.dividerLeft": {"ctrl+left", "<"}, "lists.dividerRight": {"ctrl+right", ">"},
 	"lists.taller": {"ctrl+down", "}"}, "lists.shorter": {"ctrl+up", "{"},
@@ -209,7 +203,7 @@ var defaults = map[string][]string{
 	"search.sources": {"ctrl+h"}, "search.results": {"ctrl+l"}, "search.switchList": {"tab", "shift+tab"},
 	"search.load": {"ctrl+r"}, "search.loadAll": {"ctrl+a"},
 
-	"goto.down": {"j", "down"}, "goto.up": {"k", "up"}, "goto.top": {"g", "home"}, "goto.bottom": {"G", "end"}, "goto.prevTab": {"["}, "goto.nextTab": {"]"},
+	"goto.down": {"j", "down"}, "goto.up": {"k", "up"}, "goto.prevTab": {"["}, "goto.nextTab": {"]"},
 	"goto.sources": {"h", "left"}, "goto.results": {"l", "right"}, "goto.switchList": {"tab", "shift+tab"},
 	"goto.star": {"f"}, "goto.load": {"r"}, "goto.loadAll": {"a"}, "goto.filter": {"/"},
 	"goto.select": {"enter"}, "goto.close": {"esc", "q"},

internal/ui/panes/detail.go

@@ -31,7 +31,7 @@ type Detail struct {
 	Icons icons.Set
 	// RevealKey and VersionsKey are the keys hints mention ("space to
 	// reveal"); a hint is left out when its key is "" (unbound).
-	RevealKey, VersionsKey, CopyKey string
+	RevealKey, VersionsKey string
 
 	secret    *provider.Object
 	container *provider.Container
@@ -68,7 +68,7 @@ func (d *Detail) ShowContainer(c provider.Container) {
 
 // Clear drops the selection and any fetched value.
 func (d *Detail) Clear() {
-	*d = Detail{Now: d.Now, Icons: d.Icons, RevealKey: d.RevealKey, VersionsKey: d.VersionsKey, CopyKey: d.CopyKey, w: d.w, h: d.h} // drops the note too
+	*d = Detail{Now: d.Now, Icons: d.Icons, RevealKey: d.RevealKey, VersionsKey: d.VersionsKey, w: d.w, h: d.h} // drops the note too
 }
 
 // SetDescribing marks extra metadata as being fetched.
@@ -262,35 +262,24 @@ func (d Detail) lines(st styles.Styles) []string {
 	}
 
 	// Secrets are masked; keys and certificates only expose public material.
-	// What the keys do with the value, on the line under it.
-	hints := func(reveal string, more ...string) string {
-		var h []string
-		if d.RevealKey != "" {
-			h = append(h, d.RevealKey+" to "+reveal)
+	keyHint := func(k, what string) string {
+		if k == "" {
+			return ""
 		}
-		if d.CopyKey != "" {
-			h = append(h, d.CopyKey+" to copy")
+		return "(" + k + " to " + what + ")"
 	}
-		return muted(strings.Join(append(h, more...), " · "))
-	}
-	label, hidden, reveal := "value", st.Masked.Render("••••••••"), "reveal"
+	label, hidden := "value", st.Masked.Render("••••••••")+muted("  "+keyHint(d.RevealKey, "reveal"))
 	switch s.Type {
 	case provider.TypeKey:
-		label, hidden, reveal = "public", "", "show the public key"
+		label, hidden = "public", muted(keyHint(d.RevealKey, "show public key"))
 	case provider.TypeCertificate:
-		label, hidden, reveal = "cert", "", "show the certificate"
+		label, hidden = "cert", muted(keyHint(d.RevealKey, "show certificate"))
 	}
-	indent := strings.Repeat(" ", 12)
 
 	out = append(out, "")
 	switch d.state {
 	case ValueHidden:
-		if hidden != "" {
 		field(label, hidden)
-			out = append(out, indent+hints(reveal))
-		} else {
-			field(label, hints(reveal))
-		}
 	case ValueLoading:
 		field(label, spinnerPlaceholder+" fetching…")
 	case ValueFailed:
@@ -311,30 +300,23 @@ func (d Detail) lines(st styles.Styles) []string {
 			}
 		}
 	case ValueShown:
-		// Where the dots were, continuing under itself; the keys below.
-		first := true
-		lines, note := valueView(d.value.Reveal())
-		for _, line := range lines {
-			for _, w := range strings.Split(ansi.Hardwrap(line, max(1, inner-11), true), "\n") {
-				if first {
-					out = append(out, " "+st.Label.Render(fmt.Sprintf("%-10s", label))+" "+st.Value.Render(w))
-					first = false
-				} else {
-					out = append(out, indent+st.Value.Render(w))
-				}
-			}
-		}
-		var more []string
-		if note != "" && d.CopyKey != "" {
-			note += ": " + d.CopyKey + " copies it as stored"
-		}
-		if note != "" {
-			more = append(more, note)
+		var hints []string
+		if d.RevealKey != "" {
+			hints = append(hints, d.RevealKey+" to hide")
 		}
 		if d.hidesIn != "" {
-			more = append(more, "hides in "+d.hidesIn)
+			hints = append(hints, "hides in "+d.hidesIn)
+		}
+		line := " " + st.Label.Render(label)
+		if len(hints) > 0 {
+			line += muted("  (" + strings.Join(hints, " · ") + ")")
+		}
+		out = append(out, line)
+		for _, line := range strings.Split(d.value.Reveal(), "\n") {
+			for _, w := range strings.Split(ansi.Hardwrap(line, inner, true), "\n") {
+				out = append(out, " "+st.Value.Render(w))
+			}
 		}
-		out = append(out, indent+hints("hide", more...))
 	}
 	return append(out, d.versionLines(st)...)
 }
@@ -362,13 +344,11 @@ func (d Detail) versionLines(st styles.Styles) []string {
 			out = append(out, muted(fmt.Sprintf("   … %d more", len(d.versions)-i)))
 			break
 		}
-		// A list to read, not to move in (v browses them): no cursor. The
-		// version shown above, when it isn't the current one, is named.
-		line := "   " + VersionLine(st, v, d.Now(), current)
-		if d.secret.Version != "" && v.Version == d.secret.Version && v.Version != current {
-			line += muted(" · shown above")
+		marker := "  "
+		if d.secret.Version != "" && v.Version == d.secret.Version {
+			marker = "▸ " // the version shown above
 		}
-		out = append(out, line)
+		out = append(out, " "+marker+VersionLine(st, v, d.Now(), current))
 	}
 	return out
 }

internal/ui/panes/fields.go

@@ -1,79 +0,0 @@
-package panes
-
-import (
-	"fmt"
-
-	"github.com/charmbracelet/x/ansi"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/ui/styles"
-)
-
-// Fields is the fourth pane for anything but a secret (an account, and
-// what describes vaults, scopes and files): labelled values, one per row,
-// a label on the first of several values, to move through, filter and
-// copy from. It's a List, so / filters it like the other panes. Secrets
-// have Detail, for revealing and versions.
-type Fields struct {
-	List[Field]
-	shown bool
-}
-
-// Field is a row: a value under a label. Info rows (loading, errors)
-// can't be copied; Err ones are errors. A row can also be opened: URL in
-// the browser (o), Path in the editor (e), Provider signed in to (L), or
-// Link gone to (enter).
-type Field struct {
-	Label, Value string
-	Info, Err    bool
-
-	URL, Path, Provider string
-	// Link is a lazysecrets link enter goes to, in the source of row Row.
-	Link, Row string
-}
-
-func NewFields() Fields {
-	l := NewList("", Item[Field]{
-		ID:     func(f Field) string { return f.Label + "\x00" + f.Value },
-		Filter: func(f Field) string { return f.Value },
-		// "/tenant" finds the tenant's rows.
-		FilterExtra: func(f Field) string { return f.Label },
-		Render: func(st styles.Styles, f Field, width int) string {
-			value := f.Value
-			switch {
-			case f.Err:
-				value = st.Error.Render(value)
-			case f.Info:
-				value = st.Muted.Render(value)
-			}
-			return ansi.Truncate(st.Label.Render(fmt.Sprintf("%-10s", f.Label))+" "+value, width, "…")
-		},
-	})
-	l.Empty = "nothing to show"
-	return Fields{List: l}
-}
-
-// Show shows fields under title, instead of the secret pane. Another
-// title (another account or vault) starts over, without a filter.
-func (s *Fields) Show(title string, fields []Field) {
-	if title != s.Title {
-		s.Reset()
-		s.Title = title
-	}
-	s.shown = true
-	s.SetItems(fields)
-}
-
-// Hide gives the fourth pane back to the secret pane.
-func (s *Fields) Hide() { s.shown = false }
-
-// Shown reports whether the fourth pane shows Fields.
-func (s Fields) Shown() bool { return s.shown }
-
-// Selected is the field under the cursor, unless it's an info row.
-func (s Fields) Selected() (Field, bool) {
-	f, ok := s.List.Selected()
-	if !ok || f.Info {
-		return Field{}, false
-	}
-	return f, true
-}

internal/ui/panes/list.go

@@ -34,14 +34,6 @@ type List[T any] struct {
 	Empty   string // shown when loaded with no items
 	Loading bool
 	Err     error
-	// Age says how old the items are ("2h ago") while they reload, by
-	// the counter.
-	Age string
-	// Header lines (a logo) go above the items while the cursor is in
-	// the rows under it, the pane has room and there's no filter; else
-	// HeaderShort, a line of plain text, does.
-	Header      []string
-	HeaderShort string
 
 	item    Item[T]
 	items   []T
@@ -96,7 +88,6 @@ func (l *List[T]) SetError(err error) {
 func (l *List[T]) Refresh() {
 	l.Loading = true
 	l.Err = nil
-	l.Age = ""
 }
 
 func (l *List[T]) SetLoading() {
@@ -168,36 +159,9 @@ func (l List[T]) rows() int {
 	if l.filtering {
 		r--
 	}
-	r -= len(l.header())
 	return max(0, r)
 }
 
-// headerMinRows is how many item rows Header leaves at least.
-const headerMinRows = 5
-
-// header is the lines above the items: Header and a blank line, if it
-// fits, leaves headerMinRows and the cursor is in the rows under it;
-// else HeaderShort.
-func (l List[T]) header() []string {
-	short := []string{}
-	if l.HeaderShort != "" {
-		short = []string{l.HeaderShort}
-	}
-	if len(l.Header) == 0 || l.filtering || l.input.Value() != "" {
-		return short
-	}
-	for _, line := range l.Header {
-		if ansi.StringWidth(line) > l.w-3 {
-			return short
-		}
-	}
-	below := l.h - 2 - len(l.Header) - 1
-	if below < headerMinRows || l.cursor >= below {
-		return short
-	}
-	return append(l.Header[:len(l.Header):len(l.Header)], "")
-}
-
 // Filtering reports whether the filter input has focus.
 func (l List[T]) Filtering() bool { return l.filtering }
 
@@ -361,15 +325,12 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	if l.filtering {
 		body = append(body, l.input.View())
 	}
-	for _, line := range l.header() {
-		body = append(body, st.Notice.Render(" "+line))
-	}
 
 	switch {
 	case l.Loading && len(l.items) == 0:
 		body = append(body, " "+spin+" loading…")
 	case l.Err != nil:
-		for _, line := range wrapLines(l.Err.Error(), inner-1) {
+		for _, line := range strings.Split(ansi.Wrap(l.Err.Error(), inner-1, " -/"), "\n") {
 			body = append(body, st.Error.Render(" "+line))
 		}
 	case len(l.visible) == 0 && len(l.items) > 0:
@@ -408,9 +369,6 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	if len(l.visible) > 0 {
 		counter = fmt.Sprintf("%d of %d", l.cursor+1, len(l.visible))
 	}
-	if l.Loading && l.Age != "" && len(l.items) > 0 {
-		counter = "cached " + l.Age + " · " + counter
-	}
 	return BoxCounted(st, title, "", counter, body, l.w, l.h, focused)
 }
 
@@ -428,22 +386,3 @@ func (l *List[T]) scroll() {
 	}
 	l.offset = max(0, min(l.offset, len(l.visible)-rows))
 }
-
-// wrapLines wraps text to width, line by line; a "• " item's further
-// lines line up under its text.
-func wrapLines(text string, width int) []string {
-	var out []string
-	for _, line := range strings.Split(text, "\n") {
-		indent := ""
-		if strings.HasPrefix(line, "• ") {
-			indent = "  "
-		}
-		for i, l := range strings.Split(ansi.Wrap(line, max(1, width-len(indent)), " -/"), "\n") {
-			if i > 0 {
-				l = indent + l
-			}
-			out = append(out, l)
-		}
-	}
-	return out
-}

internal/ui/panes/list_test.go

@@ -177,27 +177,3 @@ func TestHighlightKeepsColours(t *testing.T) {
 		t.Error("reverse kept the colours")
 	}
 }
-
-func TestListHeader(t *testing.T) {
-	l := NewList("t", Item[string]{
-		ID:     func(s string) string { return s },
-		Filter: func(s string) string { return s },
-		Render: func(_ styles.Styles, s string, _ int) string { return s },
-	})
-	l.Header, l.HeaderShort = []string{"ART1", "ART2"}, "short"
-	l.SetItems([]string{"a", "b", "c", "d", "e", "f", "g", "h", "i", "j"})
-	l.SetSize(30, 2+2+1+6) // the art, a blank line and 6 rows
-	st := styles.Default()
-	if v := l.View(st, true, ""); !strings.Contains(v, "ART1") || strings.Contains(v, "short") {
-		t.Errorf("at the top, the art:\n%s", v)
-	}
-	l.Move(6) // below the rows under the art
-	if v := l.View(st, true, ""); strings.Contains(v, "ART1") || !strings.Contains(v, "short") || !strings.Contains(v, " g") {
-		t.Errorf("further down, the text:\n%s", v)
-	}
-	l.Top()
-	l.SetSize(30, 8) // too short for the art and 5 rows
-	if v := l.View(st, true, ""); strings.Contains(v, "ART1") || !strings.Contains(v, "short") {
-		t.Errorf("no room, the text:\n%s", v)
-	}
-}

internal/ui/panes/valueview.go

@@ -1,79 +0,0 @@
-package panes
-
-import (
-	"bytes"
-	"crypto/sha1"
-	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"strings"
-	"time"
-)
-
-// A revealed value is shown as it reads best: JSON indented, and PEM
-// certificates as what they say (subject, issuer, dates, names) rather
-// than base64, with any other PEM block, a private key say, named but not
-// shown. Anything else is shown as it is. y copies it as stored.
-
-// valueView is how to show v, and what's been done to it ("" when it's
-// shown as it is).
-func valueView(v string) (lines []string, note string) {
-	if lines, ok := pemView(v); ok {
-		return lines, "certificate"
-	}
-	if t := strings.TrimSpace(v); (strings.HasPrefix(t, "{") || strings.HasPrefix(t, "[")) && json.Valid([]byte(t)) {
-		var b bytes.Buffer
-		if json.Indent(&b, []byte(t), "", "  ") == nil {
-			return strings.Split(b.String(), "\n"), "JSON, formatted"
-		}
-	}
-	return strings.Split(v, "\n"), ""
-}
-
-// pemView describes the PEM blocks in v, if it's PEM with a certificate.
-func pemView(v string) ([]string, bool) {
-	rest := []byte(strings.TrimSpace(v))
-	var out []string
-	certs := 0
-	for len(rest) > 0 {
-		block, after := pem.Decode(rest)
-		if block == nil {
-			return nil, false // text that isn't PEM: show it all
-		}
-		rest = bytes.TrimSpace(after)
-		if len(out) > 0 {
-			out = append(out, "")
-		}
-		if block.Type != "CERTIFICATE" {
-			out = append(out, block.Type+" (not shown)")
-			continue
-		}
-		cert, err := x509.ParseCertificate(block.Bytes)
-		if err != nil {
-			return nil, false
-		}
-		certs++
-		out = append(out, certLines(cert)...)
-	}
-	return out, certs > 0
-}
-
-func certLines(c *x509.Certificate) []string {
-	day := func(t time.Time) string { return t.UTC().Format("2006-01-02") }
-	out := []string{
-		"subject  " + c.Subject.String(),
-		"issuer   " + c.Issuer.String(),
-		"valid    " + day(c.NotBefore) + " to " + day(c.NotAfter),
-	}
-	names := append([]string{}, c.DNSNames...)
-	for _, ip := range c.IPAddresses {
-		names = append(names, ip.String())
-	}
-	names = append(names, c.EmailAddresses...)
-	if len(names) > 0 {
-		out = append(out, "names    "+strings.Join(names, ", "))
-	}
-	sum := sha1.Sum(c.Raw) // what Azure and Windows call the thumbprint
-	return append(out, "SHA-1    "+fmt.Sprintf("%X", sum[:]))
-}

internal/ui/panes/valueview_test.go

@@ -1,60 +0,0 @@
-package panes
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"math/big"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestValueViewJSON(t *testing.T) {
-	lines, note := valueView(`{"user":"app","port":5432,"tags":["a"]}`)
-	want := []string{"{", `  "user": "app",`, `  "port": 5432,`, `  "tags": [`, `    "a"`, "  ]", "}"}
-	if !slices.Equal(lines, want) || note != "JSON, formatted" {
-		t.Errorf("lines %q, note %q", lines, note)
-	}
-	for _, v := range []string{"plain value", "{not json", "42", "line one\nline two"} {
-		if lines, note := valueView(v); note != "" || strings.Join(lines, "\n") != v {
-			t.Errorf("%q shown as %q (%q)", v, lines, note)
-		}
-	}
-}
-
-func TestValueViewCertificate(t *testing.T) {
-	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	tmpl := &x509.Certificate{
-		SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "app.example.com"},
-		DNSNames:  []string{"app.example.com", "www.app.example.com"},
-		NotBefore: time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC), NotAfter: time.Date(2027, 1, 1, 0, 0, 0, 0, time.UTC),
-	}
-	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
-	if err != nil {
-		t.Fatal(err)
-	}
-	keyDER, _ := x509.MarshalECPrivateKey(key)
-	bundle := string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})) +
-		string(pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}))
-
-	lines, note := valueView(bundle)
-	text := strings.Join(lines, "\n")
-	for _, want := range []string{"subject  CN=app.example.com", "valid    2026-01-01 to 2027-01-01",
-		"names    app.example.com, www.app.example.com", "SHA-1    ", "EC PRIVATE KEY (not shown)"} {
-		if !strings.Contains(text, want) {
-			t.Errorf("missing %q:\n%s", want, text)
-		}
-	}
-	if note != "certificate" || strings.Contains(text, "BEGIN") {
-		t.Errorf("note %q, or PEM shown:\n%s", note, text)
-	}
-	// A private key alone isn't a certificate: shown as it is.
-	if _, note := valueView(string(pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}))); note != "" {
-		t.Errorf("a key alone: note %q", note)
-	}
-}

internal/ui/styles/styles.go

@@ -3,8 +3,6 @@
 package styles
 
 import (
-	"image/color"
-
 	"charm.land/lipgloss/v2"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
@@ -34,10 +32,6 @@ type Styles struct {
 	KindAzure      lipgloss.Style
 	KindDatabricks lipgloss.Style
 	KindRepo       lipgloss.Style
-
-	// themed marks the selection colours as set by the theme, so
-	// OnBackground leaves them.
-	themed, themedBlurred bool
 }
 
 func Default() Styles {
@@ -49,12 +43,9 @@ func Default() Styles {
 		TitleBlurred:  lipgloss.NewStyle(),
 		Footer:        lipgloss.NewStyle().Faint(true),
 
-		// A background rather than reverse, so the row keeps its colours;
-		// in every pane, so each shows what's selected in it. The focused
-		// pane's is bold too. Palette 8 until the terminal says what its
-		// background is (OnBackground).
+		// A background rather than reverse, so the row keeps its colours.
 		Selected:        lipgloss.NewStyle().Background(lipgloss.BrightBlack).Bold(true),
-		SelectedBlurred: lipgloss.NewStyle().Background(lipgloss.BrightBlack),
+		SelectedBlurred: lipgloss.NewStyle().Bold(true),
 		Muted:           lipgloss.NewStyle().Faint(true),
 		Error:           lipgloss.NewStyle().Foreground(lipgloss.Red),
 		Notice:          lipgloss.NewStyle().Foreground(lipgloss.Green),
@@ -83,23 +74,3 @@ func (s Styles) Kind(k provider.Kind) lipgloss.Style {
 	}
 	return s.KindAzure
 }
-
-// OnBackground shades the selection colours from the terminal's
-// background, a little lighter on a dark one and darker on a light one:
-// a quiet band that keeps the row's colours readable, where palette 8 is
-// often too bright. Colours the theme sets are kept.
-func (s Styles) OnBackground(bg color.Color, dark bool) Styles {
-	shade := func(p float64) color.Color {
-		if dark {
-			return lipgloss.Lighten(bg, p)
-		}
-		return lipgloss.Darken(bg, p)
-	}
-	if !s.themed {
-		s.Selected = s.Selected.Background(shade(0.09))
-	}
-	if !s.themedBlurred {
-		s.SelectedBlurred = s.SelectedBlurred.Background(shade(0.05))
-	}
-	return s
-}

internal/ui/styles/theme.go

@@ -70,10 +70,8 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 			st.BorderBlurred = v.fg(lipgloss.NewStyle())
 		case "selectedLineBgColor":
 			st.Selected = v.bg(lipgloss.NewStyle()).Bold(true)
-			st.themed = true
 		case "inactiveViewSelectedLineBgColor":
 			st.SelectedBlurred = v.bg(lipgloss.NewStyle()).Bold(true)
-			st.themedBlurred = true
 		case "defaultFgColor":
 			fg = v.color
 		case "optionsTextColor":

internal/ui/styles/theme_test.go

@@ -1,7 +1,6 @@
 package styles
 
 import (
-	"fmt"
 	"strings"
 	"testing"
 
@@ -63,32 +62,3 @@ func TestEmptyThemeIsDefault(t *testing.T) {
 		t.Errorf("empty theme: %v %v reverse=%v bg=%v", err, fg, st.Selected.GetReverse(), st.Selected.GetBackground())
 	}
 }
-
-func TestOnBackground(t *testing.T) {
-	hex := func(c any) string {
-		r, g, b, _ := c.(interface{ RGBA() (r, g, b, a uint32) }).RGBA()
-		return fmt.Sprintf("#%02x%02x%02x", r>>8, g>>8, b>>8)
-	}
-	st := Default().OnBackground(lipgloss.Color("#282c34"), true)
-	if got := hex(st.Selected.GetBackground()); got != "#3e424a" {
-		t.Errorf("dark: selected %s", got)
-	}
-	if got := hex(st.SelectedBlurred.GetBackground()); got != "#343840" {
-		t.Errorf("dark: blurred %s", got)
-	}
-	if got := hex(Default().OnBackground(lipgloss.Color("#ffffff"), false).Selected.GetBackground()); got != "#e8e8e8" {
-		t.Errorf("light: selected %s", got)
-	}
-
-	themed, _, err := FromTheme(map[string][]string{"selectedLineBgColor": {"#2d3f76"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	st = themed.OnBackground(lipgloss.Color("#282c34"), true)
-	if got := hex(st.Selected.GetBackground()); got != "#2d3f76" {
-		t.Errorf("themed: selected %s (want the theme's)", got)
-	}
-	if got := hex(st.SelectedBlurred.GetBackground()); got != "#343840" {
-		t.Errorf("themed: blurred %s (not themed: shaded)", got)
-	}
-}

internal/update/update.go

@@ -3,9 +3,6 @@
 // against the release's checksums.txt, tried (--version), then renamed
 // over the binary. A running lazysecrets keeps its old binary until it
 // restarts.
-//
-// Releases are published in more than one place; each is tried in turn
-// (GitHub, then git.kebcloud.no), so one being down doesn't stop updates.
 package update
 
 import (
@@ -21,12 +18,10 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"os"
 	"os/exec"
 	"path"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"strings"
 	"time"
@@ -34,20 +29,12 @@ import (
 	"golang.org/x/mod/semver"
 )
 
-// DefaultRepo is lazysecrets' home: its source, docs and releases.
-// GitHubRepo mirrors it, with the issues and the releases too.
+// Where releases are published.
 const (
+	DefaultAPI  = "https://git.kebcloud.no/api/v1/repos/keb/lazysecrets"
 	DefaultRepo = "https://git.kebcloud.no/keb/lazysecrets"
-	GitHubRepo  = "https://github.com/karleinarb/lazysecrets"
 )
 
-// DefaultServers are where releases are looked for, in order.
-var DefaultServers = []string{GitHubRepo, DefaultRepo}
-
-// latestTimeout bounds asking one server for the latest release, so a
-// server that's down leaves time for the next.
-const latestTimeout = 5 * time.Second
-
 // maxDownload bounds what's read from the server.
 const maxDownload = 200 << 20
 
@@ -62,30 +49,18 @@ type Release struct {
 // every release ends with.
 func (r Release) Notes() string {
 	notes, _, _ := strings.Cut(r.Body, "## Install")
-	return PlainLinks(strings.TrimSpace(notes))
+	return strings.TrimSpace(notes)
 }
 
-// PlainLinks shows Markdown links as their text, for a terminal.
-func PlainLinks(s string) string { return mdLink.ReplaceAllString(s, "$1") }
-
-// mdLink is a Markdown link, [text](url): the notes link PRs and commits,
-// and a terminal shows them as their text.
-var mdLink = regexp.MustCompile(`\[([^\]]+)\]\((https?://[^)\s]+)\)`)
-
-// Client talks to the release servers.
+// Client talks to the release server.
 type Client struct {
-	// Servers are the repositories' web addresses, on GitHub or a Gitea
-	// or Forgejo server, tried in order; DefaultServers when empty.
-	Servers []string
+	API  string // the repository's API, DefaultAPI when empty
+	Repo string // the repository's web address, DefaultRepo when empty
 	HTTP *http.Client
 }
 
-func (c *Client) servers() []string {
-	if len(c.Servers) > 0 {
-		return c.Servers
-	}
-	return DefaultServers
-}
+func (c *Client) api() string  { return cmpOr(c.API, DefaultAPI) }
+func (c *Client) repo() string { return cmpOr(c.Repo, DefaultRepo) }
 
 func (c *Client) client() *http.Client {
 	if c.HTTP != nil {
@@ -94,50 +69,25 @@ func (c *Client) client() *http.Client {
 	return &http.Client{Timeout: 2 * time.Minute}
 }
 
-// API is a repository's API: GitHub's for github.com, else Gitea's (and
-// Forgejo's).
-func API(repo string) (string, error) {
-	u, err := url.Parse(strings.TrimSuffix(repo, "/"))
-	if err != nil || u.Host == "" || strings.Count(u.Path, "/") != 2 {
-		return "", fmt.Errorf("%q isn't a repository's address, like %s", repo, GitHubRepo)
+func cmpOr(a, b string) string {
+	if a != "" {
+		return a
 	}
-	if u.Host == "github.com" {
-		return "https://api.github.com/repos" + u.Path, nil
-	}
-	return u.Scheme + "://" + u.Host + "/api/v1/repos" + u.Path, nil
+	return b
 }
 
-// Latest is the newest release (pre-releases aside), from the first
-// server that answers.
+// Latest is the newest release (pre-releases aside).
 func (c *Client) Latest(ctx context.Context) (Release, error) {
-	var errs []error
-	for _, repo := range c.servers() {
-		r, err := c.latest(ctx, repo)
-		if err == nil {
-			return r, nil
-		}
-		errs = append(errs, err)
-	}
-	return Release{}, errors.Join(errs...)
-}
-
-func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
-	api, err := API(repo)
-	if err != nil {
-		return Release{}, err
-	}
-	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
-	defer cancel()
-	b, err := c.get(ctx, api+"/releases/latest", 1<<20)
+	b, err := c.get(ctx, c.api()+"/releases/latest", 1<<20)
 	if err != nil {
 		return Release{}, err
 	}
 	var r Release
 	if err := json.Unmarshal(b, &r); err != nil {
-		return Release{}, fmt.Errorf("reading the latest release from %s: %w", repo, err)
+		return Release{}, fmt.Errorf("reading the latest release: %w", err)
 	}
 	if !semver.IsValid(r.Tag) {
-		return Release{}, fmt.Errorf("latest release %q on %s isn't a version", r.Tag, repo)
+		return Release{}, fmt.Errorf("latest release %q isn't a version", r.Tag)
 	}
 	return r, nil
 }
@@ -189,10 +139,23 @@ func (c *Client) Install(ctx context.Context, r Release, exe string) error {
 	}
 	version := strings.TrimPrefix(r.Tag, "v")
 	name := fmt.Sprintf("lazysecrets_%s_%s_%s", version, runtime.GOOS, runtime.GOARCH)
-	archive, err := c.download(ctx, r.Tag, name+".tar.gz")
+	base := c.repo() + "/releases/download/" + r.Tag + "/"
+
+	sums, err := c.get(ctx, base+"checksums.txt", 1<<20)
 	if err != nil {
 		return err
 	}
+	want, err := checksum(sums, name+".tar.gz")
+	if err != nil {
+		return err
+	}
+	archive, err := c.get(ctx, base+name+".tar.gz", maxDownload)
+	if err != nil {
+		return err
+	}
+	if got := sha256.Sum256(archive); hex.EncodeToString(got[:]) != want {
+		return fmt.Errorf("%s.tar.gz doesn't match checksums.txt: damaged, or not the release", name)
+	}
 	bin, err := extract(archive, path.Join(name, "lazysecrets"))
 	if err != nil {
 		return err
@@ -227,38 +190,6 @@ func (c *Client) Install(ctx context.Context, r Release, exe string) error {
 	return nil
 }
 
-// download fetches a release's file from the first server that has it,
-// checked against that server's checksums.txt. A file that doesn't match
-// stops there: it's damaged, or not the release.
-func (c *Client) download(ctx context.Context, tag, file string) ([]byte, error) {
-	var errs []error
-	for _, repo := range c.servers() {
-		base := strings.TrimSuffix(repo, "/") + "/releases/download/" + tag + "/"
-		sctx, cancel := context.WithTimeout(ctx, latestTimeout)
-		sums, err := c.get(sctx, base+"checksums.txt", 1<<20)
-		cancel()
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		want, err := checksum(sums, file)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", repo, err))
-			continue
-		}
-		b, err := c.get(ctx, base+file, maxDownload)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		if got := sha256.Sum256(b); hex.EncodeToString(got[:]) != want {
-			return nil, fmt.Errorf("%s from %s doesn't match checksums.txt: damaged, or not the release", file, repo)
-		}
-		return b, nil
-	}
-	return nil, errors.Join(errs...)
-}
-
 func (c *Client) get(ctx context.Context, url string, limit int64) ([]byte, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {

internal/update/update_test.go

@@ -70,13 +70,13 @@ func server(t *testing.T, tamper bool) *httptest.Server {
 		sum[0] ^= 0xff
 	}
 	mux := http.NewServeMux()
-	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/api/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprint(w, `{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}`)
 	})
-	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/repo/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintf(w, "%s  %s.tar.gz\n", hex.EncodeToString(sum[:]), name)
 	})
-	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/"+name+".tar.gz", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/repo/releases/download/v0.2.0/"+name+".tar.gz", func(w http.ResponseWriter, _ *http.Request) {
 		w.Write(archive.Bytes())
 	})
 	srv := httptest.NewServer(mux)
@@ -89,7 +89,7 @@ func TestInstall(t *testing.T) {
 		t.Skip("releases are for macOS and Linux")
 	}
 	srv := server(t, false)
-	c := &Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}
+	c := &Client{API: srv.URL + "/api", Repo: srv.URL + "/repo"}
 	r, err := c.Latest(context.Background())
 	if err != nil || r.Tag != "v0.2.0" {
 		t.Fatalf("latest %+v %v", r, err)
@@ -107,59 +107,12 @@ func TestInstall(t *testing.T) {
 	}
 }
 
-// A server that's down, or doesn't have the release, is skipped.
-func TestFallsBackToTheNextServer(t *testing.T) {
-	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
-		t.Skip("releases are for macOS and Linux")
-	}
-	down := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		http.Error(w, "down", http.StatusBadGateway)
-	}))
-	t.Cleanup(down.Close)
-	srv := server(t, false)
-	c := &Client{Servers: []string{down.URL + "/keb/lazysecrets", srv.URL + "/keb/lazysecrets"}}
-	r, err := c.Latest(context.Background())
-	if err != nil || r.Tag != "v0.2.0" {
-		t.Fatalf("latest %+v %v", r, err)
-	}
-	exe := filepath.Join(t.TempDir(), "lazysecrets")
-	os.WriteFile(exe, []byte("old"), 0o755)
-	if err := c.Install(context.Background(), r, exe); err != nil {
-		t.Fatal(err)
-	}
-	if b, _ := os.ReadFile(exe); !strings.Contains(string(b), "echo lazysecrets 0.2.0") {
-		t.Errorf("not replaced: %q", b)
-	}
-
-	// Every server down: both say why.
-	c = &Client{Servers: []string{down.URL + "/a/b", down.URL + "/c/d"}}
-	if _, err := c.Latest(context.Background()); err == nil || strings.Count(err.Error(), "502") != 2 {
-		t.Errorf("all down: %v", err)
-	}
-}
-
-func TestAPI(t *testing.T) {
-	for repo, want := range map[string]string{
-		"https://github.com/karleinarb/lazysecrets":   "https://api.github.com/repos/karleinarb/lazysecrets",
-		"https://git.kebcloud.no/keb/lazysecrets/":    "https://git.kebcloud.no/api/v1/repos/keb/lazysecrets",
-		"https://codeberg.org/someone/lazysecrets":    "https://codeberg.org/api/v1/repos/someone/lazysecrets",
-		"https://git.kebcloud.no/keb":                 "",
-		"git.kebcloud.no/keb/lazysecrets":             "",
-		"https://github.com/karleinarb/lazysecrets/x": "",
-	} {
-		got, err := API(repo)
-		if got != want || (err != nil) != (want == "") {
-			t.Errorf("API(%q) = %q, %v", repo, got, err)
-		}
-	}
-}
-
 func TestInstallRefusesATamperedArchive(t *testing.T) {
 	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
 		t.Skip("releases are for macOS and Linux")
 	}
 	srv := server(t, true)
-	c := &Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}
+	c := &Client{API: srv.URL + "/api", Repo: srv.URL + "/repo"}
 	exe := filepath.Join(t.TempDir(), "lazysecrets")
 	os.WriteFile(exe, []byte("old"), 0o755)
 	err := c.Install(context.Background(), Release{Tag: "v0.2.0"}, exe)
@@ -170,10 +123,3 @@ func TestInstallRefusesATamperedArchive(t *testing.T) {
 		t.Error("replaced anyway")
 	}
 }
-
-func TestNotesShowLinksAsText(t *testing.T) {
-	r := Release{Body: "### Added\n\n- Search ([#11](https://git.example.com/pulls/11)) ([65dc2d7](https://git.example.com/commit/65dc2d7abc))\n\n## Install\n\ncurl …"}
-	if got, want := r.Notes(), "### Added\n\n- Search (#11) (65dc2d7)"; got != want {
-		t.Errorf("notes %q, want %q", got, want)
-	}
-}

scripts/github-release.mjs

@@ -1,75 +0,0 @@
-// Copies a release GoReleaser published on Gitea to the GitHub mirror:
-// the same notes and the same files (dist/), so lazysecrets can update
-// from either (internal/update tries GitHub first). Run by the release
-// workflow after GoReleaser; a release already on GitHub for the tag is
-// replaced, like GoReleaser's mode: replace on Gitea.
-//
-//   TAG=v0.2.0 GH_TOKEN=… GITEA_TOKEN=… node scripts/github-release.mjs
-//
-// GH_TOKEN is a fine-grained token that can write the mirror's contents;
-// without it, this does nothing. No dependencies: Node 20's fetch.
-
-import { readdir, readFile } from "node:fs/promises";
-
-const github = "karleinarb/lazysecrets";
-const { TAG: tag, GH_TOKEN: token, GITEA_TOKEN: giteaToken, GITHUB_SHA: sha } = process.env;
-const gitea = `${process.env.GITHUB_SERVER_URL ?? "https://git.kebcloud.no"}/api/v1/repos/${process.env.GITHUB_REPOSITORY ?? "keb/lazysecrets"}`;
-
-if (!token) {
-  console.log("No GH_TOKEN: not copying the release to GitHub.");
-  process.exit(0);
-}
-if (!tag) throw new Error("TAG isn't set");
-
-const gh = (path, init = {}) =>
-  fetch(path.startsWith("https://") ? path : `https://api.github.com/repos/${github}${path}`, {
-    ...init,
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${token}`,
-      "X-GitHub-Api-Version": "2022-11-28",
-      ...init.headers,
-    },
-  });
-
-async function ok(res, what) {
-  if (!res.ok) throw new Error(`${what}: ${res.status} ${await res.text()}`);
-  return res;
-}
-
-// The notes as GoReleaser wrote them on Gitea.
-const rel = await (
-  await ok(await fetch(`${gitea}/releases/tags/${tag}`, { headers: giteaToken ? { Authorization: `token ${giteaToken}` } : {} }), "reading the Gitea release")
-).json();
-
-// Replace what's there for the tag.
-const old = await gh(`/releases/tags/${tag}`);
-if (old.ok) {
-  const { id } = await old.json();
-  await ok(await gh(`/releases/${id}`, { method: "DELETE" }), "deleting the old GitHub release");
-  console.log(`Deleted the GitHub release for ${tag}.`);
-}
-
-// The mirror may not have the tag's commit yet: it pushes on its own.
-// Wait for it a while.
-const body = JSON.stringify({ tag_name: tag, target_commitish: sha, name: rel.name || tag, body: rel.body, prerelease: rel.prerelease });
-let created;
-for (let i = 0; ; i++) {
-  const res = await gh("/releases", { method: "POST", body });
-  if (res.ok) {
-    created = await res.json();
-    break;
-  }
-  if (res.status !== 422 || i === 9) await ok(res, "creating the GitHub release");
-  console.log("GitHub doesn't have the commit yet; waiting for the mirror…");
-  await new Promise((r) => setTimeout(r, 30_000));
-}
-
-const files = (await readdir("dist")).filter((f) => f.endsWith(".tar.gz") || f === "checksums.txt");
-if (files.length === 0) throw new Error("nothing to upload in dist/");
-for (const f of files) {
-  const url = `https://uploads.github.com/repos/${github}/releases/${created.id}/assets?name=${encodeURIComponent(f)}`;
-  await ok(await gh(url, { method: "POST", headers: { "Content-Type": "application/octet-stream" }, body: await readFile(`dist/${f}`) }), `uploading ${f}`);
-  console.log(`Uploaded ${f}.`);
-}
-console.log(`Published ${tag} on GitHub: ${created.html_url}`);