docs: SECURITY.md says how to report a vulnerability

Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>

.mailmap

@@ -0,0 +1,2 @@
+<1+keb@noreply.git.kebcloud.no> <1+keb@noreply.localhost>
+<3+renovate-bot@noreply.git.kebcloud.no> <3+renovate-bot@noreply.localhost>

README.md

@@ -34,18 +34,20 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 ## Install
 
 On macOS or Linux (arm64 or x86_64):
-
+```sh
+curl -fsSL https://raw.githubusercontent.com/karleinarb/lazysecrets/main/install.sh | sh
+```
+Or
 ```sh
 curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
 ```
 
-It installs the latest release, from GitHub or else
+Both approaches will install the latest release from [GitHub](https://github.com/karleinarb/lazysecrets/releases) with fallback to
 [git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets/releases), into
 `~/.local/bin` after checking it against the release's checksums.
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
 
-
 lazysecrets looks for a newer release once a day: the footer then shows
 `↑ v0.2.0`, and `U` shows its changelog and updates in place (or run
 `lazysecrets update`).
@@ -90,17 +92,17 @@ use most:
   secret
 - [Config](docs/config.md): every option, themes, layered configs, the
   state file
-- [Development](docs/development.md): building, tests, pull requests and
+- [Development](docs/development.md): building, tests, how changes land and
   releasing
 
 ## Privacy
 
 lazysecrets never stores, caches or sends your secret values. It keeps the
 names and metadata of what you've loaded in a cache file readable only by
-you, to show it at once next time (`cache: false` turns it off). It talks
+you, to show it at once next time (`storage.cache: false` turns it off). It talks
 only to the services you use it with, and collects no usage data. The one
 call of its own is a daily check for a new release, on GitHub or else
-git.kebcloud.no, which `updateCheck: false` turns off.
+git.kebcloud.no, which `updates.autoCheck: false` turns off.
 
 ## Repositories
 

SECURITY.md

@@ -0,0 +1,11 @@
+# Security
+
+Please report a vulnerability privately, not in a public issue:
+
+- on GitHub, with **Report a vulnerability** under the
+  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
+- by email to karl-einarb@outlook.com.
+
+Say what's affected, how to reproduce it and the version
+(`lazysecrets --version`). Fixes go into the next release, and only the
+latest release gets them.

cmd/lazysecrets/main.go

@@ -3,6 +3,7 @@
 package main
 
 import (
+	"cmp"
 	"context"
 	"flag"
 	"fmt"
@@ -106,7 +107,7 @@ func run() error {
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	dir := flag.String("dir", "", "start in this directory: its git repo's SOPS files, the ones under it first (default: the current directory)")
 	demo := flag.Bool("demo", false, "browse built-in sample data instead of real backends")
-	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request")
+	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request, every provider's (overrides the config)")
 	icons := flag.Bool("icons", true,
 		"show Nerd Font icons (needs a Nerd Font v3+); disable with --icons=false or LAZYSECRETS_ICONS=0")
 	clipClear := flag.Duration("clipboard-clear", 30*time.Second, "clear copied values from the clipboard after this long (0 disables)")
@@ -121,7 +122,7 @@ func run() error {
                                   for scripts: VAR=$(lazysecrets get <ref>)
   lazysecrets [flags] share [--key <secret>] <env file>...
                                   print a link to env files of a repo, encrypted
-                                  with a secret's value (default: share.key)
+                                  with a secret's value (default: sharing.key)
   lazysecrets [flags] keybindings print every action and its keys (with your
                                   config applied), as config to copy and edit
   lazysecrets handler install [--terminal NAME]
@@ -207,30 +208,49 @@ Flags:
 	// Precedence: flag > environment > config file > default.
 	set := map[string]bool{}
 	flag.Visit(func(f *flag.Flag) { set[f.Name] = true })
-	if !set["timeout"] && cfg.Timeout > 0 {
+	// Each provider's own timeout, unless --timeout sets them all.
-		*timeout = cfg.Timeout
+	timeouts := map[provider.Kind]time.Duration{}
+	if !set["timeout"] {
+		if cfg.Providers.Timeout > 0 {
+			*timeout = cfg.Providers.Timeout
 		}
-	if !set["clipboard-clear"] && cfg.ClipboardClear != nil {
+		for k, d := range map[provider.Kind]time.Duration{
-		*clipClear = *cfg.ClipboardClear
+			provider.KindAzure:      cfg.Providers.Azure.Timeout,
+			provider.KindDatabricks: cfg.Providers.Databricks.Timeout,
+			provider.KindRepo:       cfg.Providers.Repos.Timeout,
+		} {
+			if d > 0 {
+				timeouts[k] = d
+			}
+		}
+	}
+	// timeoutFor is how long a request to a provider of kind k may take.
+	timeoutFor := func(k provider.Kind) time.Duration { return cmp.Or(timeouts[k], *timeout) }
+	if !set["clipboard-clear"] && cfg.Values.ClipboardClear != nil {
+		*clipClear = *cfg.Values.ClipboardClear
 	}
 	expiryDays := 30
-	if cfg.ExpiryWarningDays != nil {
+	if cfg.UI.ExpiryWarningDays != nil {
-		expiryDays = *cfg.ExpiryWarningDays
+		expiryDays = *cfg.UI.ExpiryWarningDays
 	}
 	revealTimeout := 60 * time.Second
-	if cfg.RevealTimeout != nil {
+	if cfg.Values.RevealTimeout != nil {
-		revealTimeout = *cfg.RevealTimeout
+		revealTimeout = *cfg.Values.RevealTimeout
 	}
 	loadDelay := 150 * time.Millisecond
-	if cfg.LoadDelay != nil {
+	if cfg.UI.LoadDelay != nil {
-		loadDelay = *cfg.LoadDelay
+		loadDelay = *cfg.UI.LoadDelay
+	}
+	var updateEvery time.Duration // 0: the app's default, a day
+	if cfg.Updates.AutoCheckInterval != nil {
+		updateEvery = *cfg.Updates.AutoCheckInterval
 	}
 	if !set["icons"] {
 		switch {
 		case os.Getenv("LAZYSECRETS_ICONS") != "":
 			*icons = os.Getenv("LAZYSECRETS_ICONS") != "0"
-		case cfg.Icons != nil:
+		case cfg.UI.Icons != nil:
-			*icons = *cfg.Icons
+			*icons = *cfg.UI.Icons
 		}
 	}
 
@@ -287,7 +307,7 @@ Flags:
 			if start == "" {
 				start, _ = os.Getwd()
 			}
-			roots := []string{"~/git"}
+			roots := repo.DefaultRoots
 			if pc.Repos.Roots != nil {
 				roots = *pc.Repos.Roots
 			}
@@ -310,14 +330,20 @@ Flags:
 	log.SetOutput(io.Discard)
 
 	if getRef != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), timeoutFor(getRef.Kind))
 		defer cancel()
 		return get(ctx, providers, st, *getRef)
 	}
 	if shareArgs != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+		// The files from a repo, the key from whichever provider it's
+		// in: the longest timeout.
+		d := *timeout
+		for _, t := range timeouts {
+			d = max(d, t)
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), d)
 		defer cancel()
-		return shareFiles(ctx, providers, st, cfg.Share.Key, shareRules(cfg), shareArgs, os.Stdout)
+		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), shareArgs, os.Stdout)
 	}
 
 	// Links opened elsewhere (lazysecrets launch) can come here.
@@ -354,7 +380,7 @@ Flags:
 	// What was loaded last time, and where it was left in this folder.
 	var cacheFile, placeDir string
 	if !*demo {
-		if d, err := config.CacheDir(); err == nil && config.On(cfg.Cache) {
+		if d, err := config.CacheDir(); err == nil && config.On(cfg.Storage.Cache) {
 			cacheFile = filepath.Join(d, "cache.json")
 		}
 		placeDir = *dir
@@ -368,19 +394,21 @@ Flags:
 
 	m := app.New(providers, app.Options{
 		Timeout:        *timeout,
+		Timeouts:       timeouts,
 		Icons:          *icons,
 		ClipboardClear: *clipClear,
-		FlatSources:    cfg.SourcesView == "flat",
+		FlatSources:    cfg.UI.SourcesView == "flat",
-		CollapseGroups: config.On(cfg.CollapseGroups),
+		CollapseGroups: config.On(cfg.UI.CollapseGroups),
 		LoadDelay:      loadDelay,
-		NoHistory:      !config.On(cfg.History),
+		NoHistory:      !config.On(cfg.Storage.History),
 		OnActive:       onActive,
 		RevealTimeout:  revealTimeout,
 		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
-		HideOnBlur:     config.On(cfg.HideOnBlur),
+		HideOnBlur:     config.On(cfg.Values.HideOnBlur),
 		HandlerSetup:   setup,
-		Updater:        updater(cfg.Releases),
+		Updater:        updater(cfg.Updates.UpdateSources),
-		UpdateCheck:    config.On(cfg.UpdateCheck),
+		UpdateCheck:    config.On(cfg.Updates.AutoCheck),
+		UpdateEvery:    updateEvery,
 		Keys:           &keymap,
 		Commands:       cfg.CustomCommands,
 		Version:        versionString(),
@@ -390,7 +418,7 @@ Flags:
 		StatePath:      statePath,
 		Changelog:      lazysecrets.Changelog,
 		Dir:            placeDir,
-		ShareKey:       cfg.Share.Key,
+		ShareKey:       cfg.Sharing.Key,
 		ShareRules:     shareRules(cfg),
 		Open:           open,
 		Styles:         &theme,

cmd/lazysecrets/share.go

@@ -17,12 +17,12 @@ import (
 )
 
 // shareFiles prints a share link to env files of one repo, encrypted with
-// the --key secret's value, else the repo's or the config's share.key:
+// the --key secret's value, else the repo's or the config's sharing.key:
 //
 //	lazysecrets share .env apps/api/.env
 func shareFiles(ctx context.Context, providers []provider.Provider, st *store.Store, general string, rules share.Rules, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("share", flag.ContinueOnError)
-	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: share.key)")
+	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: sharing.key)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
@@ -73,7 +73,7 @@ func shareFiles(ctx context.Context, providers []provider.Provider, st *store.St
 		return err
 	}
 	if !ok {
-		return errors.New("which secret to encrypt with? --key <secret>, or share.key in the repo's .lazysecrets.yaml or the config")
+		return errors.New("which secret to encrypt with? --key <secret>, or sharing.key in the repo's .lazysecrets.yaml or the config")
 	}
 	v, version, err := readKey(ctx, providers, st, key)
 	if err != nil {
@@ -87,7 +87,7 @@ func shareFiles(ctx context.Context, providers []provider.Provider, st *store.St
 	return err
 }
 
-// shareRules are the config's share.keyRules.
+// shareRules are the config's sharing.keyRules.
 func shareRules(cfg config.Config) share.Rules {
-	return share.Rules{MinLength: cfg.Share.KeyRules.MinLength, MinClasses: cfg.Share.KeyRules.MinClasses}
+	return share.Rules{MinLength: cfg.Sharing.KeyRules.MinLength, MinClasses: cfg.Sharing.KeyRules.MinClasses}
 }

cmd/lazysecrets/update.go

@@ -43,7 +43,7 @@ func updateCmd(configPath string, args []string) error {
 	current := versionString()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
-	c := &update.Client{Servers: cfg.Releases}
+	c := &update.Client{Servers: cfg.Updates.UpdateSources}
 	r, err := c.Latest(ctx)
 	if err != nil {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)
@@ -55,7 +55,7 @@ func updateCmd(configPath string, args []string) error {
 		fmt.Printf("lazysecrets %s is the latest (%s)\n", current, r.Tag)
 		return nil
 	}
-	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes()))
+	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes(current)))
 	if check {
 		fmt.Println("lazysecrets update installs it.")
 		return nil

docs/azure.md

@@ -63,7 +63,7 @@ Secrets, keys and certificates, each on their own tab of the Secrets pane
 (`[`/`]`). `space` reveals a secret's value, or the public material of a
 key (PEM public key) or certificate; private key material is never
 fetched. `v` lists an item's versions. Items expiring within
-`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
+`ui.expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
 
 The status pane (`0`) lists them across every vault loaded, opened or
 cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`

docs/config.md

@@ -7,37 +7,45 @@ status pane (`0`) opens it in your editor, as in lazygit (making it if
 it isn't there yet); changes apply when lazysecrets starts again.
 
 ```yaml
+ui:
   icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
-clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
-revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
-hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
-expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
-timeout: 30s           # per backend request
-loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
   sourcesView: grouped   # or flat; ` toggles it
   collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
-updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
+  loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
-releases:              # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
+  expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
+values:
+  revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
+  hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
+  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
+storage:
+  cache: true            # keep what was loaded (never values) for the next start
+  history: true          # count uses of items for Recent (R)
+updates:
+  autoCheck: true          # look for a newer release at startup (U and lazysecrets update work either way)
+  autoCheckInterval: 24h   # at most this often
+  updateSources:           # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
     - https://github.com/karleinarb/lazysecrets
     - https://git.kebcloud.no/keb/lazysecrets
-history: true          # count uses of items for Recent (R)
-cache: true            # keep what was loaded (never values) for the next start
 providers:
+  timeout: 30s                           # per backend request; a provider's own timeout overrides it
   azure:                                 # applies to every az account
     enabled: true                        # default
+    timeout: 30s
     hideSubscriptions: [platform-mgmt]   # by name or ID
     vaults:                              # listed under "Pinned vaults", for vaults
       - https://kv-foo.vault.azure.net/  # you can read but not discover
   databricks:
     enabled: true
+    timeout: 30s
     hideProfiles: [test]
   repos:
     enabled: true
+    timeout: 30s
     roots: [~/git]
     paths: [~/work/infra]
     include: ["secrets/**"]
     exclude: ["**/testdata/**"]
-share:                 # sharing env files as encrypted links
+sharing:               # sharing env files as encrypted links
   key: https://kv-team.vault.azure.net/secrets/env-share  # or its lazysecrets:// link; for repos naming none
   keyRules:            # what a key's value must be
     minLength: 32      # characters, 16 at least
@@ -45,7 +53,7 @@ share:                 # sharing env files as encrypted links
 ```
 
 More, each on its own page: [repos](repos.md) (`providers.repos`),
-[sharing env files](links.md#sharing-env-files) (`share`), the
+[sharing env files](links.md#sharing-env-files) (`sharing`), the
 [link handler](links.md#from-the-browser-and-chat) (`linkHandler`),
 [keybindings](keys.md#rebinding-keys) (`keybinding`) and
 [custom commands](custom-commands.md) (`customCommands`).
@@ -84,7 +92,7 @@ theme:
 ```
 
 Icons need a [Nerd Font](https://www.nerdfonts.com) (v3+). If they render
-as boxes, turn them off with `icons: false`.
+as boxes, turn them off with `ui.icons: false`.
 
 ## Layering
 
@@ -112,7 +120,7 @@ lazysecrets windows can save to it without losing each other's changes.
 Revealing, copying, opening in the browser, sharing and jumping to an item
 count as using it: its record keeps when it was last used and how often,
 for Recent (`R`). Records kept only for usage are dropped after 90 days
-unused, and beyond the 100 most recent. `history: false` stops counting.
+unused, and beyond the 100 most recent. `storage.history: false` stops counting.
 
 It also keeps where you left lazysecrets in each folder (the selected
 source, vault or secret), and goes back there the next time it starts in
@@ -132,17 +140,18 @@ and copying always fetch the value live.
 Lists not loaded for 30 days are dropped, and so is everything from an
 account you're no longer signed in to. Repos aren't cached: their files
 are read from disk anyway. Deleting the file is always safe, and
-`cache: false` stops using it.
+`storage.cache: false` stops using it.
 
 ## Updates
 
-Once a day (`updateCheck`), in the background, lazysecrets asks for the
+At startup, in the background, lazysecrets asks for the latest release
-latest release; within the day it reuses the answer from the state file.
+(`updates.autoCheck`), once a day or every `updates.autoCheckInterval`;
-Releases are published on GitHub and on git.kebcloud.no, and it asks
+until then it reuses the answer from the state file. Releases are
-them in that order, the next when one doesn't answer within 5 seconds;
+published on GitHub and on git.kebcloud.no, and it asks them in that
-`releases` lists others, such as a mirror of your own. Offline, or with
+order, the next when one doesn't answer within 5 seconds;
+`updates.updateSources` lists others, such as a mirror of your own. Offline, or with
 every server down, it says nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
-`lazysecrets update --check`) shows its changelog.
+`lazysecrets update --check`) shows what changed since your version, across the last 10 releases.
 
 Updating (`u` there, or `lazysecrets update`) downloads the release for
 your OS and CPU from the first server that has it, checks it against

docs/development.md

@@ -22,7 +22,7 @@ Development builds show `dev-<commit>` as their version (`-dirty` with
 uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
 version they were built for.
 
-## Pull requests
+## How changes land
 
 Pull requests into `main` are squash-merged, so each is one commit titled
 like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)

docs/keys.md

@@ -65,8 +65,8 @@ certificates as their subject, issuer, dates, names and thumbprint, with
 any other PEM block (a private key) named but not shown. `y` still copies
 it exactly as stored.
 
-A revealed value hides again after `revealTimeout` (60s) and when the
+A revealed value hides again after `values.revealTimeout` (60s) and
-terminal loses focus (`hideOnBlur`); see [config](config.md).
+when the terminal loses focus (`values.hideOnBlur`); see [config](config.md).
 
 ## Stars and notes
 

docs/links.md

@@ -54,7 +54,7 @@ uses it) or your config (for repos that don't name one), by its
 reference:
 
 ```yaml
-share:
+sharing:
   key: https://kv-team.vault.azure.net/secrets/env-share
 ```
 
@@ -67,7 +67,7 @@ isn't long and varied enough, saying how (never showing it). By default
 that's 32 characters of two kinds; your config can ask for more, or less:
 
 ```yaml
-share:
+sharing:
   keyRules:
     minLength: 32    # characters; 16 at least
     minClasses: 2    # kinds of character: lowercase, uppercase, digits, symbols

docs/repos.md

@@ -7,10 +7,11 @@ lazysecrets shows git repositories under **Repos**: their
 
 ## Which repos
 
-**Repos** lists every repo with secret files under the `roots` (`~/git`
+**Repos** lists every repo with secret files under the `roots` (by
-by default; one or two levels down, `repo` or `org/repo`), any listed in
+default whichever of `~/git`, `~/repo`, `~/repos`, `~/projects`, `~/code`,
-`paths`, and any you starred something in (the repo, a file or a key),
+`~/source` and `~/src` exist; one or two levels down, `repo` or
-wherever it is. They're checked in the background.
+`org/repo`), any listed in `paths`, and any you starred something in
+(the repo, a file or a key), wherever it is. They're checked in the background.
 
 Started inside a repo, that repo gets a row of its own at the top,
 `Repo · <name>`, and lazysecrets opens on it, with the files under the
@@ -49,7 +50,7 @@ Folders of dependencies and caches are never looked in, tracked or not:
 ```yaml
 providers:
   repos:
-    roots: [~/git]                             # folders of repos (the default; [] turns it off)
+    roots: [~/git]                             # folders of repos (replaces the defaults; [] turns it off)
     paths: [~/work/infra]                      # single repos elsewhere
     include: ["secrets/**", "**/*.sops.yaml"]  # globs from the repo root; ** for any depth
     exclude: ["**/testdata/**"]
@@ -59,7 +60,7 @@ A repo's `.lazysecrets.yaml` can also name the secret its env files are
 [shared](links.md#sharing-env-files) with:
 
 ```yaml
-share:
+sharing:
   key: https://kv-team.vault.azure.net/secrets/env-share   # or its lazysecrets:// link
 ```
 

go.mod

@@ -18,8 +18,8 @@ require (
 	github.com/atotto/clipboard v0.1.4
 	github.com/charmbracelet/x/ansi v0.11.9
 	github.com/charmbracelet/x/exp/golden v0.0.0-20251109135125-8916d276318f
-	github.com/databricks/databricks-sdk-go v0.187.0
+	github.com/databricks/databricks-sdk-go v0.188.0
-	github.com/junegunn/fzf v0.74.4
+	github.com/junegunn/fzf v0.74.5
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/mod v0.42.0
 	golang.org/x/term v0.47.0

go.sum

@@ -72,8 +72,8 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/databricks/databricks-sdk-go v0.187.0 h1:V1rGbEUaEdGS7tTZSyplDLnE2Vp5N1aIPiIh/LzjOC8=
+github.com/databricks/databricks-sdk-go v0.188.0 h1:1nxBqlctGnPzlReyziG199abHs9cR/KNjsCnSM+oDGA=
-github.com/databricks/databricks-sdk-go v0.187.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
+github.com/databricks/databricks-sdk-go v0.188.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -100,8 +100,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dq
 github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
 github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
 github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
-github.com/junegunn/fzf v0.74.4 h1:DSqIW3ZxtkuuPzeLKrVnHdoWqT9VCIGRbjc/lXiGCso=
+github.com/junegunn/fzf v0.74.5 h1:mpJlCdgGuddKerHrdjvV3cnezEBgyjZAVn8KCo/4OMc=
-github.com/junegunn/fzf v0.74.4/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
+github.com/junegunn/fzf v0.74.5/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741 h1:7dYDtfMDfKzjT+DVfIS4iqknSEKtZpEcXtu6vuaasHs=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741/go.mod h1:6EILKtGpo5t+KLb85LNZLAF6P9LKp78hJI80PXMcn3c=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=

internal/config/config.go

@@ -19,44 +19,18 @@ import (
 )
 
 type Config struct {
-	Icons          *bool          `yaml:"icons"`
+	UI UI `yaml:"ui"`
-	ClipboardClear *time.Duration `yaml:"clipboardClear"`
+	// Values keeps revealed and copied values from lingering.
-	// RevealTimeout hides a revealed value after this long; 0s never.
+	Values Values `yaml:"values"`
-	// Defaults to 60s.
+	// Storage is what's kept between runs.
-	RevealTimeout *time.Duration `yaml:"revealTimeout"`
+	Storage Storage `yaml:"storage"`
-	// ExpiryWarningDays marks secrets, keys and certificates expiring
+	// Updates sets how lazysecrets looks for newer releases.
-	// within this many days; 0 marks only expired ones. Defaults to 30.
+	Updates   Updates   `yaml:"updates"`
-	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
-	// HideOnBlur hides a revealed value when the terminal loses focus.
-	// Defaults to true.
-	HideOnBlur *bool         `yaml:"hideOnBlur"`
-	Timeout    time.Duration `yaml:"timeout"`
-	// LoadDelay is how long the cursor must rest on a row before its
-	// contents load; 0s loads at once. Defaults to 150ms.
-	LoadDelay *time.Duration `yaml:"loadDelay"`
-	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
-	SourcesView string `yaml:"sourcesView"`
-	// History counts uses of items for the Recent list; defaults to true.
-	History *bool `yaml:"history"`
-	// UpdateCheck looks for a newer release once a day, in the
-	// background; defaults to true. U and lazysecrets update work either
-	// way.
-	UpdateCheck *bool `yaml:"updateCheck"`
-	// Releases are the repositories updates come from, tried in order:
-	// on GitHub, or a Gitea or Forgejo server. Defaults to GitHub, then
-	// git.kebcloud.no (update.DefaultServers).
-	Releases []string `yaml:"releases"`
-	// Cache keeps what was loaded (never values) between runs, so lists
-	// show at once and refresh in the background; defaults to true.
-	Cache *bool `yaml:"cache"`
-	// CollapseGroups starts the Sources pane with its groups folded;
-	// defaults to true.
-	CollapseGroups *bool     `yaml:"collapseGroups"`
 	Providers Providers `yaml:"providers"`
 	// LinkHandler sets how lazysecrets:// links open; see linkhandler.
 	LinkHandler LinkHandler `yaml:"linkHandler"`
-	// Share sets how env files are shared; see package share.
+	// Sharing sets how env files are shared; see package share.
-	Share Share `yaml:"share"`
+	Sharing Sharing `yaml:"sharing"`
 	// CustomCommands run shell commands on the selected item; see
 	// package commands.
 	CustomCommands []commands.Command `yaml:"customCommands"`
@@ -68,6 +42,52 @@ type Config struct {
 	Theme map[string][]string `yaml:"theme"`
 }
 
+type UI struct {
+	Icons *bool `yaml:"icons"`
+	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
+	SourcesView string `yaml:"sourcesView"`
+	// CollapseGroups starts the Sources pane with its groups folded;
+	// defaults to true.
+	CollapseGroups *bool `yaml:"collapseGroups"`
+	// LoadDelay is how long the cursor must rest on a row before its
+	// contents load; 0s loads at once. Defaults to 150ms.
+	LoadDelay *time.Duration `yaml:"loadDelay"`
+	// ExpiryWarningDays marks secrets, keys and certificates expiring
+	// within this many days; 0 marks only expired ones. Defaults to 30.
+	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
+}
+
+type Values struct {
+	// RevealTimeout hides a revealed value after this long; 0s never.
+	// Defaults to 60s.
+	RevealTimeout *time.Duration `yaml:"revealTimeout"`
+	// HideOnBlur hides a revealed value when the terminal loses focus.
+	// Defaults to true.
+	HideOnBlur     *bool          `yaml:"hideOnBlur"`
+	ClipboardClear *time.Duration `yaml:"clipboardClear"`
+}
+
+type Storage struct {
+	// Cache keeps what was loaded (never values) between runs, so lists
+	// show at once and refresh in the background; defaults to true.
+	Cache *bool `yaml:"cache"`
+	// History counts uses of items for the Recent list; defaults to true.
+	History *bool `yaml:"history"`
+}
+
+type Updates struct {
+	// AutoCheck looks for a newer release in the background at startup,
+	// at most once per AutoCheckInterval; defaults to true. U and
+	// lazysecrets update work either way.
+	AutoCheck *bool `yaml:"autoCheck"`
+	// AutoCheckInterval defaults to 24h.
+	AutoCheckInterval *time.Duration `yaml:"autoCheckInterval"`
+	// UpdateSources are the repositories updates come from, tried in
+	// order: on GitHub, or a Gitea or Forgejo server. Defaults to GitHub,
+	// then git.kebcloud.no (update.DefaultServers).
+	UpdateSources []string `yaml:"updateSources"`
+}
+
 type LinkHandler struct {
 	// Terminal to open links in, overriding the one handler install
 	// detected: kitty, ghostty, wezterm, iterm2, terminal, alacritty,
@@ -85,7 +105,7 @@ type LinkHandler struct {
 	Prompt *bool `yaml:"prompt"`
 }
 
-type Share struct {
+type Sharing struct {
 	// Key is the secret whose value encrypts shared files (its
 	// lazysecrets:// link, Key Vault URL or reference), for repos whose
 	// .lazysecrets.yaml doesn't name one.
@@ -103,6 +123,9 @@ type KeyRules struct {
 }
 
 type Providers struct {
+	// Timeout bounds each backend request; defaults to 30s. Each
+	// provider's own timeout overrides it for that provider.
+	Timeout    time.Duration `yaml:"timeout"`
 	Azure      Azure         `yaml:"azure"`
 	Databricks Databricks    `yaml:"databricks"`
 	Repos      Repos         `yaml:"repos"`
@@ -112,11 +135,13 @@ type Providers struct {
 // that repo is the only one shown; elsewhere, the ones in Paths and under
 // Roots.
 type Repos struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool    `yaml:"enabled"`
 	Paths   []string `yaml:"paths"`
-	// Roots are folders of repos. Defaults to ~/git; an empty list
+	// Roots are folders of repos. Defaults to repo.DefaultRoots (~/git,
-	// turns it off.
+	// ~/src, ~/code and the like); an empty list turns it off.
 	Roots *[]string `yaml:"roots"`
 	// Include and Exclude are globs relative to a repo's root (** for any
 	// depth), for repos without their own .lazysecrets.yaml. Without them,
@@ -126,6 +151,8 @@ type Repos struct {
 }
 
 type Azure struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool `yaml:"enabled"`
 	// HideSubscriptions lists subscriptions to leave out, by name or ID.
@@ -136,6 +163,8 @@ type Azure struct {
 }
 
 type Databricks struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled      *bool    `yaml:"enabled"`
 	HideProfiles []string `yaml:"hideProfiles"`
@@ -222,35 +251,38 @@ func decodeInto(c *Config, path string) error {
 }
 
 func (c Config) validate(path string) error {
-	if v := c.SourcesView; v != "" && v != "grouped" && v != "flat" {
+	if v := c.UI.SourcesView; v != "" && v != "grouped" && v != "flat" {
-		return fmt.Errorf("%s: sourcesView: %q is not grouped or flat", path, v)
+		return fmt.Errorf("%s: ui.sourcesView: %q is not grouped or flat", path, v)
 	}
 	for _, cmd := range c.CustomCommands {
 		if err := cmd.Validate(); err != nil {
 			return fmt.Errorf("%s: %w", path, err)
 		}
 	}
-	if d := c.ExpiryWarningDays; d != nil && *d < 0 {
+	if d := c.UI.ExpiryWarningDays; d != nil && *d < 0 {
-		return fmt.Errorf("%s: expiryWarningDays: %d is negative", path, *d)
+		return fmt.Errorf("%s: ui.expiryWarningDays: %d is negative", path, *d)
 	}
-	if d := c.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
+	if d := c.UI.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
-		return fmt.Errorf("%s: loadDelay: %s is not between 0s and 5s", path, *d)
+		return fmt.Errorf("%s: ui.loadDelay: %s is not between 0s and 5s", path, *d)
 	}
-	for i, r := range c.Releases {
+	if d := c.Updates.AutoCheckInterval; d != nil && *d <= 0 {
+		return fmt.Errorf("%s: updates.autoCheckInterval: %s is not positive (autoCheck: false turns it off)", path, *d)
+	}
+	for i, r := range c.Updates.UpdateSources {
 		if _, err := update.API(r); err != nil || !strings.HasPrefix(r, "https://") {
-			return fmt.Errorf("%s: releases[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
+			return fmt.Errorf("%s: updates.updateSources[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
 		}
 	}
-	if k := c.Share.Key; k != "" {
+	if k := c.Sharing.Key; k != "" {
 		if _, err := share.ParseKey(k); err != nil {
-			return fmt.Errorf("%s: share.key: %w", path, err)
+			return fmt.Errorf("%s: sharing.key: %w", path, err)
 		}
 	}
-	if n := c.Share.KeyRules.MinLength; n != 0 && n < 16 {
+	if n := c.Sharing.KeyRules.MinLength; n != 0 && n < 16 {
-		return fmt.Errorf("%s: share.keyRules.minLength: %d is under 16", path, n)
+		return fmt.Errorf("%s: sharing.keyRules.minLength: %d is under 16", path, n)
 	}
-	if n := c.Share.KeyRules.MinClasses; n < 0 || n > 4 {
+	if n := c.Sharing.KeyRules.MinClasses; n < 0 || n > 4 {
-		return fmt.Errorf("%s: share.keyRules.minClasses: %d is not between 1 and 4", path, n)
+		return fmt.Errorf("%s: sharing.keyRules.minClasses: %d is not between 1 and 4", path, n)
 	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {

internal/config/config_test.go

@@ -19,12 +19,17 @@ func write(t *testing.T, content string) string {
 
 func TestLoad(t *testing.T) {
 	c, err := Load(write(t, `
+ui:
   icons: false
   sourcesView: flat
+values:
   clipboardClear: 45s
-timeout: 1m
+storage:
+  history: false
 providers:
+  timeout: 1m
   azure:
+    timeout: 2m
     hideSubscriptions: [platform-mgmt]
     vaults:
       - https://kv-foo.vault.azure.net/
@@ -35,12 +40,12 @@ providers:
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || c.ClipboardClear == nil || *c.ClipboardClear != 45*time.Second ||
+	if c.UI.Icons == nil || *c.UI.Icons || c.Values.ClipboardClear == nil || *c.Values.ClipboardClear != 45*time.Second ||
-		c.Timeout != time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
+		c.Providers.Timeout != time.Minute || c.Providers.Azure.Timeout != 2*time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
 		t.Errorf("config = %+v", c)
 	}
-	if c.SourcesView != "flat" {
+	if c.UI.SourcesView != "flat" || On(c.Storage.History) || !On(c.Storage.Cache) {
-		t.Errorf("sourcesView = %q", c.SourcesView)
+		t.Errorf("ui = %+v, storage = %+v", c.UI, c.Storage)
 	}
 	if !On(c.Providers.Azure.Enabled) || On(c.Providers.Databricks.Enabled) {
 		t.Error("enabled flags wrong")
@@ -57,7 +62,7 @@ func TestLoadMissingAndEmpty(t *testing.T) {
 		"empty":   write(t, ""),
 	} {
 		c, err := Load(path)
-		if err != nil || c.Icons != nil || c.ClipboardClear != nil {
+		if err != nil || c.UI.Icons != nil || c.Values.ClipboardClear != nil {
 			t.Errorf("%s: %+v, %v", name, c, err)
 		}
 	}
@@ -68,14 +73,16 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"typo":       "icon: true\n",
 		"bad vault":  "providers:\n  azure:\n    vaults: [kv-foo]\n",
 		"old layout": "azure:\n  vaults: [https://kv.vault.azure.net/]\n",
-		"duration":   "timeout: soon\n",
+		"flat keys":  "icons: false\n",
-		"view":       "sourcesView: tree\n",
+		"duration":   "providers:\n  timeout: soon\n",
-		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
+		"view":       "ui:\n  sourcesView: tree\n",
-		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
+		"sources":    "updates:\n  updateSources: [git.example.com/team/lazysecrets]\n",
-		"share key":  "share:\n  key: https://kv.vault.azure.net/\n",
+		"http":       "updates:\n  updateSources: [http://git.example.com/team/lazysecrets]\n",
-		"workspace":  "share:\n  key: \"{{secrets/team/env-share}}\"\n",
+		"interval":   "updates:\n  autoCheckInterval: 0s\n",
-		"short keys": "share:\n  keyRules:\n    minLength: 8\n",
+		"share key":  "sharing:\n  key: https://kv.vault.azure.net/\n",
-		"classes":    "share:\n  keyRules:\n    minClasses: 5\n",
+		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
+		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
+		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
 	} {
 		if _, err := Load(write(t, content)); err == nil {
 			t.Errorf("%s: no error", name)
@@ -87,6 +94,7 @@ func TestLoadRejectsMistakes(t *testing.T) {
 
 func TestLoadAllLayers(t *testing.T) {
 	user := write(t, `
+ui:
   icons: false
 theme:
   azureColor: [blue]
@@ -96,6 +104,8 @@ providers:
     hideSubscriptions: [a]
 `)
 	theme := write(t, `
+ui:
+  sourcesView: flat
 theme:
   azureColor: ["#82aaff"]
   activeBorderColor: ["#ff966c", bold]
@@ -104,7 +114,8 @@ theme:
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || len(c.Providers.Azure.HideSubscriptions) != 1 {
+	// A group set in both files merges: icons from one, sourcesView the other.
+	if c.UI.Icons == nil || *c.UI.Icons || c.UI.SourcesView != "flat" || len(c.Providers.Azure.HideSubscriptions) != 1 {
 		t.Errorf("user settings lost: %+v", c)
 	}
 	want := map[string][]string{
@@ -119,19 +130,19 @@ theme:
 	}
 }
 
-func TestReleases(t *testing.T) {
+func TestUpdates(t *testing.T) {
-	c, err := Load(write(t, "releases: [https://git.example.com/team/lazysecrets]\n"))
+	c, err := Load(write(t, "updates:\n  autoCheck: false\n  autoCheckInterval: 168h\n  updateSources: [https://git.example.com/team/lazysecrets]\n"))
-	if err != nil || len(c.Releases) != 1 {
+	if err != nil || On(c.Updates.AutoCheck) || *c.Updates.AutoCheckInterval != 7*24*time.Hour || len(c.Updates.UpdateSources) != 1 {
-		t.Errorf("releases = %v, %v", c.Releases, err)
+		t.Errorf("updates = %+v, %v", c.Updates, err)
 	}
 }
 
 func TestLoadDelay(t *testing.T) {
-	c, err := Load(write(t, "loadDelay: 300ms\n"))
+	c, err := Load(write(t, "ui:\n  loadDelay: 300ms\n"))
-	if err != nil || c.LoadDelay == nil || *c.LoadDelay != 300*time.Millisecond {
+	if err != nil || c.UI.LoadDelay == nil || *c.UI.LoadDelay != 300*time.Millisecond {
-		t.Errorf("loadDelay = %v, %v", c.LoadDelay, err)
+		t.Errorf("loadDelay = %v, %v", c.UI.LoadDelay, err)
 	}
-	if _, err := Load(write(t, "loadDelay: 1m\n")); err == nil {
+	if _, err := Load(write(t, "ui:\n  loadDelay: 1m\n")); err == nil {
 		t.Error("a minute's delay accepted")
 	}
 }

internal/provider/fake/fake.go

@@ -332,7 +332,7 @@ func Azure(delay time.Duration) *Provider {
 	}, demoCert)
 
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
-	// A key to share env files with (S → f): random, as share.keyRules wants.
+	// A key to share env files with (S → f): random, as sharing.keyRules wants.
 	p.add(shared, provider.TypeSecret, provider.Object{
 		Name: "env-share", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
 	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")

internal/provider/repo/repo.go

@@ -80,6 +80,10 @@ type repoInfo struct {
 	here   bool   // the repo lazysecrets started in
 }
 
+// DefaultRoots are the usual folders of repos, used when the config
+// doesn't set roots. Ones that don't exist cost a stat each.
+var DefaultRoots = []string{"~/git", "~/repo", "~/repos", "~/projects", "~/code", "~/source", "~/src"}
+
 func New(s Settings) *Provider {
 	if s.Sops == "" {
 		s.Sops = "sops"
@@ -116,10 +120,18 @@ func (p *Provider) load() {
 			}
 			add(root)
 		}
+		// Missing roots are skipped (most of the defaults are), and one
+		// that's a symlink to another is scanned once.
+		scanned := map[string]bool{}
 		for _, dir := range p.s.Roots {
-			base, _ := filepath.EvalSymlinks(expandHome(dir))
+			base, err := filepath.EvalSymlinks(expandHome(dir))
-			for _, root := range reposIn(expandHome(dir), 2) {
+			if err != nil || scanned[base] {
-				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") {
+				continue
+			}
+			scanned[base] = true
+			for _, root := range reposIn(base, 2) {
+				// A repo under two roots keeps the first one's name.
+				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") && names[root] == "" {
 					names[root] = filepath.ToSlash(name)
 				}
 				add(root)
@@ -587,14 +599,14 @@ func normalizeRemote(remote string) (string, string) {
 type lazysecretsFile struct {
 	Include []string `yaml:"include"`
 	Exclude []string `yaml:"exclude"`
-	Share   struct {
+	Sharing struct {
 		// Key is the link to the secret that encrypts the repo's
 		// shared env files (package share).
 		Key string `yaml:"key"`
-	} `yaml:"share"`
+	} `yaml:"sharing"`
 }
 
-// ShareKey is the share.key of the repo's .lazysecrets.yaml, if any.
+// ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
 func ShareKey(root string) (string, error) {
 	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
 	if errors.Is(err, os.ErrNotExist) {
@@ -607,7 +619,7 @@ func ShareKey(root string) (string, error) {
 	if err := yaml.Unmarshal(b, &f); err != nil {
 		return "", fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 	}
-	return f.Share.Key, nil
+	return f.Sharing.Key, nil
 }
 
 // selector says which files to look at: user (the include/exclude of the

internal/provider/repo/repo_test.go

@@ -336,6 +336,30 @@ func TestRoots(t *testing.T) {
 	}
 }
 
+func TestRootsDeduped(t *testing.T) {
+	root, _ := filepath.EvalSymlinks(t.TempDir())
+	os.Rename(gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML}), filepath.Join(root, "infra"))
+	os.MkdirAll(filepath.Join(root, "acme"), 0o755)
+	os.Rename(gitRepo(t, map[string]string{"prod.env": sopsEnv}), filepath.Join(root, "acme", "billing"))
+
+	// ~/src → ~/git, and a root reaching one repo at another depth.
+	links := t.TempDir()
+	alias := filepath.Join(links, "src")
+	os.Symlink(root, alias)
+	missing := filepath.Join(links, "nope")
+	acme := filepath.Join(root, "acme")
+
+	srcs, err := New(Settings{Dir: links, Roots: []string{missing, root, alias, acme}}).Sources(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := names(srcs, func(s provider.Source) string { return s.Name })
+	slices.Sort(got)
+	if !slices.Equal(got, []string{"acme/billing", "infra"}) {
+		t.Errorf("repos: %v, want each once, named from the first root", got)
+	}
+}
+
 func TestStarredReposAlongside(t *testing.T) {
 	here := gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML})
 	starred := gitRepo(t, map[string]string{"prod.env": sopsEnv})

internal/share/rules.go

@@ -53,7 +53,7 @@ func (r Rules) Check(key []byte) error {
 	if len(has) == 0 {
 		return nil
 	}
-	return fmt.Errorf("its value has %s; share.keyRules needs %s",
+	return fmt.Errorf("its value has %s; sharing.keyRules needs %s",
 		strings.Join(has, " and "), strings.Join(needs, " and "))
 }
 

internal/share/share.go

@@ -259,8 +259,8 @@ func CheckPath(p string) error {
 	return nil
 }
 
-// DefaultKey is the key for a repo's files: share.key in the repo's
+// DefaultKey is the key for a repo's files: sharing.key in the repo's
-// .lazysecrets.yaml, else general (share.key in the config). ok is false
+// .lazysecrets.yaml, else general (sharing.key in the config). ok is false
 // when neither names one.
 func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	link, err := repo.ShareKey(root)
@@ -276,7 +276,7 @@ func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	}
 	key, err = ParseKey(link)
 	if err != nil {
-		return ref.Ref{}, false, fmt.Errorf("share.key in %s: %w", where, err)
+		return ref.Ref{}, false, fmt.Errorf("sharing.key in %s: %w", where, err)
 	}
 	return key, true, nil
 }

internal/share/share_test.go

@@ -243,7 +243,7 @@ func TestDefaultKey(t *testing.T) {
 	if err != nil || !ok || k.Name != "env-share" {
 		t.Errorf("general: %+v %v %v", k, ok, err)
 	}
-	os.WriteFile(filepath.Join(dir, ".lazysecrets.yaml"), []byte("share:\n  key: lazysecrets://azure/kv-app.vault.azure.net/secrets/app-share\n"), 0o644)
+	os.WriteFile(filepath.Join(dir, ".lazysecrets.yaml"), []byte("sharing:\n  key: lazysecrets://azure/kv-app.vault.azure.net/secrets/app-share\n"), 0o644)
 	if k, _, _ := DefaultKey(dir, general); k.Name != "app-share" {
 		t.Errorf("the repo's should win: %+v", k)
 	}

internal/ui/app/app.go

@@ -65,6 +65,8 @@ const (
 type Options struct {
 	// Timeout bounds every provider call. Defaults to 30s.
 	Timeout time.Duration
+	// Timeouts override Timeout for the providers of a kind.
+	Timeouts map[provider.Kind]time.Duration
 	// Icons shows Nerd Font glyphs next to backends.
 	Icons bool
 	// Clipboard defaults to the system clipboard, or OSC52 over SSH.
@@ -82,7 +84,7 @@ type Options struct {
 	// CacheFile keeps what was loaded between runs; "" keeps it for this
 	// run only.
 	CacheFile string
-	// ShareKey is the config's share.key: the secret that encrypts shared
+	// ShareKey is the config's sharing.key: the secret that encrypts shared
 	// env files, for repos whose .lazysecrets.yaml names none.
 	ShareKey string
 	// ShareRules are what a key's value must be to share with it.
@@ -117,9 +119,11 @@ type Options struct {
 	// Keys, if set, replaces the default keymap (keys.Map.Apply).
 	Keys *keys.Map
 	// Updater, if set, finds and installs newer releases (U); with
-	// UpdateCheck, lazysecrets also looks once a day on its own.
+	// UpdateCheck, lazysecrets also looks on its own at startup, at most
+	// once per UpdateEvery (0 for a day).
 	Updater     *Updater
 	UpdateCheck bool
+	UpdateEvery time.Duration
 	// HandlerSetup, if set, offers to set up the link handler at startup.
 	HandlerSetup *HandlerSetup
 	// NoHistory stops counting uses of items for the Recent list.
@@ -144,7 +148,7 @@ type Clipboard interface {
 type Model struct {
 	providers []provider.Provider
 	byID      map[string]provider.Provider
-	timeout   time.Duration
+	timeout   timeouts
 
 	keys keys.Map
 	st   styles.Styles
@@ -236,6 +240,7 @@ type Model struct {
 
 	updater      *Updater
 	updateCheck  bool
+	updateEvery  time.Duration
 	fetchOnStart bool            // look for a newer release in Init
 	newer        *update.Release // a newer release to offer
 	updated      string          // the release installed, waiting for a restart
@@ -276,8 +281,8 @@ type Model struct {
 	linked     []provider.Container // vaults opened from links, this session
 	open       *ref.Ref             // reference to open at startup
 
-	shareKey   string      // the config's share.key
+	shareKey   string      // the config's sharing.key
-	shareRules share.Rules // and share.keyRules
+	shareRules share.Rules // and sharing.keyRules
 
 	// A lazysecrets:// link found on the clipboard, offered in the footer.
 	dismissedLink string // the last link offered: not offered again
@@ -375,7 +380,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	m := Model{
 		providers:     providers,
 		byID:          map[string]provider.Provider{},
-		timeout:       opts.Timeout,
+		timeout:       timeouts{def: opts.Timeout, byKind: opts.Timeouts},
 		keys:          keys.Default(),
 		st:            styles.Default(),
 		spin:          spinner.New(spinner.WithSpinner(spinner.Dot)),
@@ -427,7 +432,10 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.revealTimeout, m.hideOnBlur = opts.RevealTimeout, opts.HideOnBlur
 	m.expiryWarning = opts.ExpiryWarning
 	m.handlerSetup = opts.HandlerSetup
-	m.updater, m.updateCheck = opts.Updater, opts.UpdateCheck
+	m.updater, m.updateCheck, m.updateEvery = opts.Updater, opts.UpdateCheck, opts.UpdateEvery
+	if m.updateEvery == 0 {
+		m.updateEvery = updateEvery
+	}
 	m.startUpdateCheck()
 	m.askHandler = opts.HandlerSetup != nil && !m.store.Flag(flagNoHandlerPrompt)
 	m.settle = opts.LoadDelay
@@ -1240,7 +1248,7 @@ func (m *Model) showVersions(o provider.Object, key string) tea.Cmd {
 	}
 	m.secrets.SetLoading()
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, o.Container.Source.Kind)
 	return func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1270,7 +1278,7 @@ func (m *Model) countVersions(o provider.Object) tea.Cmd {
 		}
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotVersions)
+	ctx, req := m.begin(slotVersions, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1421,11 +1429,26 @@ func (m *Model) autoLoad(msg sourcesMsg) tea.Cmd {
 	return m.crawlStart()
 }
 
-// begin starts a cancellable request for pane p, cancelling any in flight.
+// timeouts bound each provider request: its kind's, else the default.
-func (m *Model) begin(p slot) (context.Context, int) {
+type timeouts struct {
+	def    time.Duration
+	byKind map[provider.Kind]time.Duration
+}
+
+// of is how long a request to a provider of kind k may take.
+func (t timeouts) of(k provider.Kind) time.Duration {
+	if d, ok := t.byKind[k]; ok {
+		return d
+	}
+	return t.def
+}
+
+// begin starts a cancellable request for pane p to a provider of kind k,
+// cancelling any in flight.
+func (m *Model) begin(p slot, k provider.Kind) (context.Context, int) {
 	m.cancelReq(p)
 	m.seq++
-	ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+	ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(k))
 	m.reqID[p], m.cancel[p] = m.seq, cancel
 	return ctx, m.seq
 }
@@ -1479,7 +1502,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 	gen := m.sourcesGen
 	var cmds []tea.Cmd
 	for _, p := range m.providers {
-		ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 		cmds = append(cmds, func() tea.Msg {
 			defer cancel()
 			s, err := p.Sources(ctx)
@@ -1490,7 +1513,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 		})
 		// The source it started in, quickly, on its own.
 		if c, ok := p.(provider.Current); ok {
-			ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+			ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 			cmds = append(cmds, func() tea.Msg {
 				defer cancel()
 				src, ok := c.Current(ctx)
@@ -1507,7 +1530,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 
 func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 	p := m.providerFor(src)
-	ctx, req := m.begin(slotContainers)
+	ctx, req := m.begin(slotContainers, src.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Containers(ctx, src)
 		// Carry the source as given, with its provider ID, so later
@@ -1526,7 +1549,7 @@ func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key string) tea.Cmd {
 	cands := m.candidates(c.Source)
 	known := len(cands) == 1 && cands[0].ID() == c.Source.Provider
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, c.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		var errs []error
 		for _, p := range cands {
@@ -1554,7 +1577,7 @@ func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key str
 
 func (m *Model) fetchValue(s provider.Object) tea.Cmd {
 	p := m.providerFor(s.Container.Source)
-	ctx, req := m.begin(slotValue)
+	ctx, req := m.begin(slotValue, s.Container.Source.Kind)
 	m.detail.SetLoading()
 	return func() tea.Msg {
 		v, err := p.Value(ctx, s)
@@ -1573,7 +1596,7 @@ func (m *Model) describe(o provider.Object) tea.Cmd {
 		m.detail.SetDescribing()
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotDescribe)
+	ctx, req := m.begin(slotDescribe, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		obj, err := p.Describe(ctx, o)
 		return describeMsg{req: req, key: key, obj: obj, err: err}
@@ -1601,7 +1624,7 @@ func (m *Model) copyValue() tea.Cmd {
 		return m.copyText(o.Name, v.Reveal(), true)
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotCopy)
+	ctx, req := m.begin(slotCopy, o.Container.Source.Kind)
 	m.flash = flash{text: "copying " + o.Name + "…"}
 	return func() tea.Msg {
 		v, err := p.Value(ctx, o)

internal/ui/app/commands.go

@@ -165,7 +165,7 @@ func (m *Model) runCommand(c commands.Command, rendered string, obj *provider.Ob
 	o := *obj
 	p := m.providerFor(o.Container.Source)
 	m.flash = flash{text: "fetching " + o.Name + " for " + c.Description + "…"}
-	timeout := m.timeout
+	timeout := m.timeout.of(o.Container.Source.Kind)
 	m.usedObject(o)
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)

internal/ui/app/fields.go

@@ -196,7 +196,7 @@ func (m *Model) loadDetails(c provider.Container) tea.Cmd {
 		}
 	}
 	m.details[key] = detailsState{loading: true}
-	ctx, req := m.begin(slotDetails)
+	ctx, req := m.begin(slotDetails, c.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		attrs, err := d.Details(ctx, c)
 		if ctx.Err() != nil {

internal/ui/app/links.go

@@ -158,7 +158,7 @@ func (m *Model) copyFromRef(r ref.Ref) tea.Cmd {
 		m.flash = flash{text: "copy: no account or profile for " + describeRef(r), isErr: true}
 		return nil
 	}
-	ctx, req := m.begin(slotCopy)
+	ctx, req := m.begin(slotCopy, r.Kind)
 	m.flash = flash{text: "copying " + r.Name + "…"}
 	return func() tea.Msg {
 		var errs []error

internal/ui/app/search.go

@@ -295,10 +295,10 @@ func (m *Model) crawlNext() tea.Cmd {
 }
 
 func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
-	timeout := m.timeout
 	if job.src != nil {
 		p := m.providerFor(*job.src)
 		src := *job.src
+		timeout := m.timeout.of(src.Kind)
 		return func() tea.Msg {
 			ctx, cancel := contextWithTimeout(timeout)
 			defer cancel()
@@ -311,6 +311,7 @@ func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
 	}
 	c := *job.container
 	p := m.providerFor(c.Source)
+	timeout := m.timeout.of(c.Source.Kind)
 	return func() tea.Msg {
 		ctx, cancel := contextWithTimeout(timeout)
 		defer cancel()

internal/ui/app/sharefiles.go

@@ -38,7 +38,7 @@ type shareFilesMsg struct {
 type sealedMsg struct {
 	link ref.Ref
 	n    int
-	// from is the picker the key was picked in; nil for share.key's.
+	// from is the picker the key was picked in; nil for sharing.key's.
 	from *picker
 	err  error
 }
@@ -59,7 +59,7 @@ func (m *Model) shareFiles(src provider.Source, cs []provider.Container) tea.Cmd
 		m.flash = warning("these files can't be shared")
 		return nil
 	}
-	general, timeout := m.shareKey, m.timeout
+	general, timeout := m.shareKey, m.timeout.of(src.Kind)
 	m.flash = flash{text: "reading the files…"}
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)
@@ -216,7 +216,7 @@ func (m *Model) handleSealed(msg sealedMsg) tea.Cmd {
 func (m *Model) keyReader() func(ref.Ref) (provider.SecretValue, string, error) {
 	providers, st, timeout := m.providers, m.store, m.timeout
 	return func(key ref.Ref) (provider.SecretValue, string, error) {
-		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), timeout.of(key.Kind))
 		defer cancel()
 		k := key
 		k.Version = ""
@@ -258,7 +258,7 @@ func (m *Model) offerShare(r ref.Ref) tea.Cmd {
 // openShare reads the key, decrypts the files and finds the repo's clone.
 func (m *Model) openShare(s share.Sealed) tea.Cmd {
 	read := m.keyReader()
-	providers, timeout := m.providers, m.timeout
+	providers, timeout := m.providers, m.timeout.of(provider.KindRepo)
 	m.flash = flash{text: "decrypting with " + s.Key.Name + "…"}
 	return func() tea.Msg {
 		msg := shareOpenedMsg{sealed: s}

internal/ui/app/sharefiles_test.go

@@ -50,7 +50,7 @@ func shareFrom(t *testing.T, root string, paste bool) string {
 		t.Fatalf("selected %v, want the repo", src.ID)
 	}
 	d.keys("S", "f")
-	// No share.key set: it asks which secret, in Go to, which lists
+	// No sharing.key set: it asks which secret, in Go to, which lists
 	// only secrets.
 	v := d.m.search
 	if v == nil || v.picker == nil {
@@ -137,7 +137,7 @@ func TestShareWithShareKeyConfirms(t *testing.T) {
 	}
 	root := cloneWith(t, map[string]string{
 		".env":              "A=1\n",
-		".lazysecrets.yaml": "share:\n  key: https://" + kv + "/secrets/db-password\n",
+		".lazysecrets.yaml": "sharing:\n  key: https://" + kv + "/secrets/db-password\n",
 	})
 	clip := &fakeClipboard{}
 	d := newDriverOpts(t, Options{Clipboard: clip, ShareRules: demoRules}, fake.Azure(0), repo.New(repo.Settings{Dir: root}))
@@ -218,7 +218,7 @@ func TestShareInDemo(t *testing.T) {
 	}
 	// Too short a key: the picker stays, saying why.
 	d.send(tea.PasteMsg{Content: "https://kv-app-prod.vault.azure.net/secrets/db-password"})
-	if d.m.search == nil || !strings.Contains(d.m.search.picker.err, "Can't use db-password: its value has 28 characters; share.keyRules needs 32 (minLength)") {
+	if d.m.search == nil || !strings.Contains(d.m.search.picker.err, "Can't use db-password: its value has 28 characters; sharing.keyRules needs 32 (minLength)") {
 		t.Fatalf("not said in the picker: %v\n%s", d.m.search != nil, d.screen())
 	}
 	if !strings.Contains(d.screen(), "28 characters") {

internal/ui/app/timeout_test.go

@@ -0,0 +1,25 @@
+package app
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+)
+
+// A provider's own timeout applies to it alone.
+func TestTimeoutPerProvider(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{Timeout: 5 * time.Second, Timeouts: map[provider.Kind]time.Duration{provider.KindAzure: 10 * time.Millisecond}},
+		fake.Azure(300*time.Millisecond), fake.Databricks(300*time.Millisecond))
+	scr := d.screen()
+	if !strings.Contains(scr, "✗ Azure: context deadline exceeded") || !strings.Contains(scr, "Databricks (…)") ||
+		strings.Contains(scr, "Databricks: context deadline") {
+		t.Errorf("want Azure timed out and Databricks still loading:\n%s", scr)
+	}
+	if got := (timeouts{def: time.Minute}).of(provider.KindRepo); got != time.Minute {
+		t.Errorf("no override: %s, want the default", got)
+	}
+}

internal/ui/app/update.go

@@ -20,7 +20,8 @@ type Updater struct {
 }
 
 // updateEvery is how often lazysecrets looks for a newer release on its
-// own; within that, the last answer (in the state file) is used.
+// own unless the config says otherwise; within that, the last answer (in
+// the state file) is used.
 const updateEvery = 24 * time.Hour
 
 type updateMsg struct {
@@ -35,14 +36,14 @@ type installedMsg struct {
 }
 
 // startUpdateCheck sets up the startup look for a newer release: the
-// state file's answer when it looked less than a day ago, else a quiet
+// state file's answer when it looked within updateEvery, else a quiet
 // look at the server (fetchOnStart, for Init).
 func (m *Model) startUpdateCheck() {
 	if m.updater == nil || !m.updateCheck {
 		return
 	}
 	last := m.store.UpdateCheck()
-	if m.now().Sub(last.At) < updateEvery {
+	if m.now().Sub(last.At) < m.updateEvery {
 		m.offer(update.Release{Tag: last.Tag, Body: last.Notes, URL: last.URL})
 		return
 	}
@@ -109,15 +110,22 @@ func (m *Model) update() tea.Cmd {
 func (m *Model) showUpdate() {
 	r := *m.newer
 	lines := []string{m.st.Muted.Render("You have " + m.versionLabel() + ".")}
-	if notes := r.Notes(); notes != "" {
+	if notes := r.Notes(m.version); notes != "" {
 		lines = append(lines, "")
 		for _, l := range strings.Split(notes, "\n") {
 			if h, ok := strings.CutPrefix(l, "### "); ok {
 				l = m.st.Label.Render(h)
+			} else if h, ok := strings.CutPrefix(l, "## "); ok { // a release, when several are new
+				l = m.st.TitleFocused.Render(h)
 			}
 			lines = append(lines, l)
 		}
 	}
+	// A popup doesn't scroll: several releases behind, the rest is on
+	// the release pages.
+	if most := max(6, m.h-12); len(lines) > most {
+		lines = append(lines[:most-1], m.st.Muted.Render("… and more on the release pages"))
+	}
 	opts := []option{{key: "u", label: "Update now", tip: "Download, check and replace this lazysecrets; restart to use it.",
 		run: func(m *Model) tea.Cmd { return m.install(r) }}}
 	if r.URL != "" {

internal/ui/app/update_test.go

@@ -83,6 +83,12 @@ func TestUpdate(t *testing.T) {
 	if f2.asked != 1 {
 		t.Errorf("asked %d times a day later", f2.asked)
 	}
+	// With autoCheckInterval: 1h, two hours on is long enough.
+	mem.SetUpdateCheck(store.UpdateCheck{At: time.Now().Add(-2 * time.Hour), Tag: "v0.2.0"})
+	newDriverOpts(t, Options{Version: "0.1.1", Updater: f2.updater(), UpdateCheck: true, UpdateEvery: time.Hour, Store: mem})
+	if f2.asked != 2 {
+		t.Errorf("asked %d times, want a look after the hour", f2.asked)
+	}
 }
 
 func TestUpdateAsked(t *testing.T) {

internal/ui/app/usage.go

@@ -8,7 +8,7 @@ import (
 // Usage: revealing, copying, opening in the browser, sharing and jumping
 // to an item count as using it. The store keeps when each item was last
 // used and how often, for the Recent section of the jump list. The config's
-// history: false turns this off.
+// storage.history: false turns this off.
 
 // used counts a use of the remembered item key, keeping its context.
 func (m *Model) used(key string) {

internal/update/update.go

@@ -28,6 +28,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"slices"
 	"strings"
 	"time"
 
@@ -54,17 +55,43 @@ const maxDownload = 200 << 20
 // Release is a published release.
 type Release struct {
 	Tag string `json:"tag_name"`
-	Body string `json:"body"` // the changelog section, then install notes
+	// Body is the changelog section, then install notes. From Latest,
+	// it's the changelogs of the recent releases, each under a "## v…"
+	// heading, so someone a few versions behind sees all they missed.
+	Body       string `json:"body"`
 	URL        string `json:"html_url"`
+	Draft      bool   `json:"draft"`
+	Prerelease bool   `json:"prerelease"`
 }
 
-// Notes is the release's changelog: its body without the install notes
+// Notes is the changelog since the version current: of each release
-// every release ends with.
+// newer than it (just this one for a dev build), without the install
-func (r Release) Notes() string {
+// notes every release ends with.
-	notes, _, _ := strings.Cut(r.Body, "## Install")
+func (r Release) Notes(current string) string {
+	body, _, _ := strings.Cut(r.Body, "## Install")
+	var keep, headings []string
+	in := true // before any heading: a single release's notes
+	for _, l := range strings.Split(body, "\n") {
+		if tag, ok := strings.CutPrefix(l, "## "); ok && semver.IsValid(tag) {
+			in = Newer(current, tag) || tag == r.Tag
+			if in {
+				headings = append(headings, l)
+			}
+		}
+		if in {
+			keep = append(keep, l)
+		}
+	}
+	notes := strings.Join(keep, "\n")
+	if len(headings) == 1 { // the title names it
+		notes = strings.Replace(notes, headings[0], "", 1)
+	}
 	return PlainLinks(strings.TrimSpace(notes))
 }
 
+// recentReleases is how many releases Latest reads the changelogs of.
+const recentReleases = 10
+
 // PlainLinks shows Markdown links as their text, for a terminal.
 func PlainLinks(s string) string { return mdLink.ReplaceAllString(s, "$1") }
 
@@ -128,18 +155,29 @@ func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
 	}
 	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
 	defer cancel()
-	b, err := c.get(ctx, api+"/releases/latest", 1<<20)
+	// The recent releases in one request (per_page on GitHub, limit on
+	// Gitea), for their changelogs.
+	b, err := c.get(ctx, fmt.Sprintf("%s/releases?per_page=%d&limit=%[2]d", api, recentReleases), 1<<20)
 	if err != nil {
 		return Release{}, err
 	}
-	var r Release
+	var all []Release
-	if err := json.Unmarshal(b, &r); err != nil {
+	if err := json.Unmarshal(b, &all); err != nil {
-		return Release{}, fmt.Errorf("reading the latest release from %s: %w", repo, err)
+		return Release{}, fmt.Errorf("reading the releases from %s: %w", repo, err)
 	}
-	if !semver.IsValid(r.Tag) {
+	all = slices.DeleteFunc(all, func(r Release) bool { return r.Draft || r.Prerelease || !semver.IsValid(r.Tag) })
-		return Release{}, fmt.Errorf("latest release %q on %s isn't a version", r.Tag, repo)
+	if len(all) == 0 {
+		return Release{}, fmt.Errorf("no releases on %s", repo)
 	}
-	return r, nil
+	slices.SortFunc(all, func(a, b Release) int { return semver.Compare(b.Tag, a.Tag) })
+	var notes strings.Builder
+	for _, r := range all {
+		section, _, _ := strings.Cut(r.Body, "## Install")
+		fmt.Fprintf(&notes, "## %s\n\n%s\n\n", r.Tag, strings.TrimSpace(section))
+	}
+	latest := all[0]
+	latest.Body = strings.TrimSpace(notes.String())
+	return latest, nil
 }
 
 // Newer reports whether latest is newer than current. A build that isn't

internal/update/update_test.go

@@ -39,11 +39,42 @@ func TestNewer(t *testing.T) {
 
 func TestNotes(t *testing.T) {
 	r := Release{Body: "### Added\n\n- Install with a one-liner (#7)\n\n## Install\n\nOn macOS…"}
-	if got := r.Notes(); got != "### Added\n\n- Install with a one-liner (#7)" {
+	if got := r.Notes("0.1.1"); got != "### Added\n\n- Install with a one-liner (#7)" {
 		t.Errorf("notes %q", got)
 	}
 }
 
+// Latest reads the recent releases, so the notes cover every version
+// since the one running.
+func TestNotesSince(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/keb/lazysecrets/releases" {
+			http.NotFound(w, r)
+			return
+		}
+		fmt.Fprint(w, `[
+			{"tag_name":"v0.4.0-rc1","body":"### Added\n\n- rc","prerelease":true},
+			{"tag_name":"v0.2.0","body":"### Added\n\n- two\n\n## Install\n\ncurl"},
+			{"tag_name":"v0.3.0","body":"### Fixed\n\n- three\n\n## Install\n\ncurl","html_url":"https://example.com/v0.3.0"},
+			{"tag_name":"v0.1.1","body":"### Added\n\n- one"},
+			{"tag_name":"v9.0.0","body":"draft","draft":true}]`)
+	}))
+	t.Cleanup(srv.Close)
+	r, err := (&Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}).Latest(context.Background())
+	if err != nil || r.Tag != "v0.3.0" || r.URL != "https://example.com/v0.3.0" {
+		t.Fatalf("latest %+v %v", r, err)
+	}
+	for current, want := range map[string]string{
+		"0.1.1":       "## v0.3.0\n\n### Fixed\n\n- three\n\n## v0.2.0\n\n### Added\n\n- two",
+		"0.2.0":       "### Fixed\n\n- three",
+		"dev-2ba762c": "### Fixed\n\n- three",
+	} {
+		if got := r.Notes(current); got != want {
+			t.Errorf("notes since %s: %q, want %q", current, got, want)
+		}
+	}
+}
+
 func TestManaged(t *testing.T) {
 	if Managed("/opt/homebrew/Cellar/lazysecrets/0.2.0/bin/lazysecrets") == "" || Managed("/nix/store/abc-lazysecrets/bin/lazysecrets") == "" {
 		t.Error("package managers not recognised")
@@ -70,8 +101,8 @@ func server(t *testing.T, tamper bool) *httptest.Server {
 		sum[0] ^= 0xff
 	}
 	mux := http.NewServeMux()
-	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases", func(w http.ResponseWriter, _ *http.Request) {
-		fmt.Fprint(w, `{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}`)
+		fmt.Fprint(w, `[{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}]`)
 	})
 	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintf(w, "%s  %s.tar.gz\n", hex.EncodeToString(sum[:]), name)
@@ -173,7 +204,7 @@ func TestInstallRefusesATamperedArchive(t *testing.T) {
 
 func TestNotesShowLinksAsText(t *testing.T) {
 	r := Release{Body: "### Added\n\n- Search ([#11](https://git.example.com/pulls/11)) ([65dc2d7](https://git.example.com/commit/65dc2d7abc))\n\n## Install\n\ncurl …"}
-	if got, want := r.Notes(), "### Added\n\n- Search (#11) (65dc2d7)"; got != want {
+	if got, want := r.Notes("0.1.1"), "### Added\n\n- Search (#11) (65dc2d7)"; got != want {
 		t.Errorf("notes %q, want %q", got, want)
 	}
 }