fix: unambiguous repo key names, clearer config and key names, and a newer lazysecrets's files no longer stop an older one

SECURITY.md asks for vulnerabilities to be reported privately, through GitHub's private vulnerability reporting or by email to karl-einarb@outlook.com.

docs/development.md: the "Pull requests" heading is now "How changes land". The section covers squash merges, PR titles and branch protection, not how to send one.

Reviewed-on: #65
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>

.mailmap

@@ -0,0 +1,2 @@
+<1+keb@noreply.git.kebcloud.no> <1+keb@noreply.localhost>
+<3+renovate-bot@noreply.git.kebcloud.no> <3+renovate-bot@noreply.localhost>

README.md

@@ -34,18 +34,20 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 ## Install
 
 On macOS or Linux (arm64 or x86_64):
-
+```sh
+curl -fsSL https://raw.githubusercontent.com/karleinarb/lazysecrets/main/install.sh | sh
+```
+Or
 ```sh
 curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
 ```
 
-It installs the latest release, from GitHub or else
+Both approaches will install the latest release from [GitHub](https://github.com/karleinarb/lazysecrets/releases) with fallback to
 [git.kebcloud.no](https://git.kebcloud.no/keb/lazysecrets/releases), into
 `~/.local/bin` after checking it against the release's checksums.
 `sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
 somewhere else.
 
-
 lazysecrets looks for a newer release once a day: the footer then shows
 `↑ v0.2.0`, and `U` shows its changelog and updates in place (or run
 `lazysecrets update`).
@@ -90,17 +92,17 @@ use most:
   secret
 - [Config](docs/config.md): every option, themes, layered configs, the
   state file
-- [Development](docs/development.md): building, tests, pull requests and
+- [Development](docs/development.md): building, tests, how changes land and
   releasing
 
 ## Privacy
 
 lazysecrets never stores, caches or sends your secret values. It keeps the
 names and metadata of what you've loaded in a cache file readable only by
-you, to show it at once next time (`cache: false` turns it off). It talks
+you, to show it at once next time (`storage.cache: false` turns it off). It talks
 only to the services you use it with, and collects no usage data. The one
 call of its own is a daily check for a new release, on GitHub or else
-git.kebcloud.no, which `updateCheck: false` turns off.
+git.kebcloud.no, which `updates.autoCheck: false` turns off.
 
 ## Repositories
 

SECURITY.md

@@ -0,0 +1,11 @@
+# Security
+
+Please report a vulnerability privately, not in a public issue:
+
+- on GitHub, with **Report a vulnerability** under the
+  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
+- by email to karl-einarb@outlook.com.
+
+Say what's affected, how to reproduce it and the version
+(`lazysecrets --version`). Fixes go into the next release, and only the
+latest release gets them.

cmd/lazysecrets/main.go

@@ -3,7 +3,9 @@
 package main
 
 import (
+	"cmp"
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -106,7 +108,7 @@ func run() error {
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	dir := flag.String("dir", "", "start in this directory: its git repo's SOPS files, the ones under it first (default: the current directory)")
 	demo := flag.Bool("demo", false, "browse built-in sample data instead of real backends")
-	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request")
+	timeout := flag.Duration("timeout", 30*time.Second, "timeout for each backend request, every provider's (overrides the config)")
 	icons := flag.Bool("icons", true,
 		"show Nerd Font icons (needs a Nerd Font v3+); disable with --icons=false or LAZYSECRETS_ICONS=0")
 	clipClear := flag.Duration("clipboard-clear", 30*time.Second, "clear copied values from the clipboard after this long (0 disables)")
@@ -121,7 +123,7 @@ func run() error {
                                   for scripts: VAR=$(lazysecrets get <ref>)
   lazysecrets [flags] share [--key <secret>] <env file>...
                                   print a link to env files of a repo, encrypted
-                                  with a secret's value (default: share.key)
+                                  with a secret's value (default: sharing.key)
   lazysecrets [flags] keybindings print every action and its keys (with your
                                   config applied), as config to copy and edit
   lazysecrets handler install [--terminal NAME]
@@ -193,6 +195,11 @@ Flags:
 	if err != nil {
 		return err
 	}
+	// Warnings show when the window opens.
+	var warnings []string
+	if w := styles.Unknown(cfg.Theme); w != "" {
+		warnings = append(warnings, w)
+	}
 	keymap := keys.Default()
 	if err := keymap.Apply(cfg.Keybinding); err != nil {
 		return err
@@ -207,30 +214,52 @@ Flags:
 	// Precedence: flag > environment > config file > default.
 	set := map[string]bool{}
 	flag.Visit(func(f *flag.Flag) { set[f.Name] = true })
-	if !set["timeout"] && cfg.Timeout > 0 {
-		*timeout = cfg.Timeout
+	if *timeout <= 0 {
+		return fmt.Errorf("--timeout: %s is not positive", *timeout)
 	}
-	if !set["clipboard-clear"] && cfg.ClipboardClear != nil {
-		*clipClear = *cfg.ClipboardClear
+	// Each provider's own timeout, unless --timeout sets them all.
+	timeouts := map[provider.Kind]time.Duration{}
+	if !set["timeout"] {
+		if cfg.Providers.Timeout > 0 {
+			*timeout = cfg.Providers.Timeout
+		}
+		for k, d := range map[provider.Kind]time.Duration{
+			provider.KindAzure:      cfg.Providers.Azure.Timeout,
+			provider.KindDatabricks: cfg.Providers.Databricks.Timeout,
+			provider.KindRepo:       cfg.Providers.Repos.Timeout,
+		} {
+			if d > 0 {
+				timeouts[k] = d
+			}
+		}
+	}
+	// timeoutFor is how long a request to a provider of kind k may take.
+	timeoutFor := func(k provider.Kind) time.Duration { return cmp.Or(timeouts[k], *timeout) }
+	if !set["clipboard-clear"] && cfg.Values.ClipboardClear != nil {
+		*clipClear = *cfg.Values.ClipboardClear
 	}
 	expiryDays := 30
-	if cfg.ExpiryWarningDays != nil {
-		expiryDays = *cfg.ExpiryWarningDays
+	if cfg.UI.ExpiryWarningDays != nil {
+		expiryDays = *cfg.UI.ExpiryWarningDays
 	}
 	revealTimeout := 60 * time.Second
-	if cfg.RevealTimeout != nil {
-		revealTimeout = *cfg.RevealTimeout
+	if cfg.Values.RevealTimeout != nil {
+		revealTimeout = *cfg.Values.RevealTimeout
 	}
 	loadDelay := 150 * time.Millisecond
-	if cfg.LoadDelay != nil {
-		loadDelay = *cfg.LoadDelay
+	if cfg.UI.LoadDelay != nil {
+		loadDelay = *cfg.UI.LoadDelay
+	}
+	var updateEvery time.Duration // 0: the app's default, a day
+	if cfg.Updates.AutoCheckInterval != nil {
+		updateEvery = *cfg.Updates.AutoCheckInterval
 	}
 	if !set["icons"] {
 		switch {
 		case os.Getenv("LAZYSECRETS_ICONS") != "":
 			*icons = os.Getenv("LAZYSECRETS_ICONS") != "0"
-		case cfg.Icons != nil:
-			*icons = *cfg.Icons
+		case cfg.UI.Icons != nil:
+			*icons = *cfg.UI.Icons
 		}
 	}
 
@@ -245,7 +274,9 @@ Flags:
 		statePath = filepath.Join(stateDir, "state.json")
 	}
 	st, err := store.Load(statePath)
-	if err != nil {
+	if errors.Is(err, store.ErrNewer) {
+		warnings = append(warnings, err.Error()+": stars, notes and the layout won't be saved; update lazysecrets")
+	} else if err != nil {
 		return err
 	}
 
@@ -287,7 +318,7 @@ Flags:
 			if start == "" {
 				start, _ = os.Getwd()
 			}
-			roots := []string{"~/git"}
+			roots := repo.DefaultRoots
 			if pc.Repos.Roots != nil {
 				roots = *pc.Repos.Roots
 			}
@@ -310,14 +341,20 @@ Flags:
 	log.SetOutput(io.Discard)
 
 	if getRef != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), timeoutFor(getRef.Kind))
 		defer cancel()
 		return get(ctx, providers, st, *getRef)
 	}
 	if shareArgs != nil {
-		ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+		// The files from a repo, the key from whichever provider it's
+		// in: the longest timeout.
+		d := *timeout
+		for _, t := range timeouts {
+			d = max(d, t)
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), d)
 		defer cancel()
-		return shareFiles(ctx, providers, st, cfg.Share.Key, shareRules(cfg), shareArgs, os.Stdout)
+		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), shareArgs, os.Stdout)
 	}
 
 	// Links opened elsewhere (lazysecrets launch) can come here.
@@ -354,7 +391,7 @@ Flags:
 	// What was loaded last time, and where it was left in this folder.
 	var cacheFile, placeDir string
 	if !*demo {
-		if d, err := config.CacheDir(); err == nil && config.On(cfg.Cache) {
+		if d, err := config.CacheDir(); err == nil && config.On(cfg.Storage.Cache) {
 			cacheFile = filepath.Join(d, "cache.json")
 		}
 		placeDir = *dir
@@ -368,29 +405,32 @@ Flags:
 
 	m := app.New(providers, app.Options{
 		Timeout:        *timeout,
+		Timeouts:       timeouts,
 		Icons:          *icons,
 		ClipboardClear: *clipClear,
-		FlatSources:    cfg.SourcesView == "flat",
-		CollapseGroups: config.On(cfg.CollapseGroups),
+		FlatSources:    cfg.UI.SourcesView == "flat",
+		CollapseGroups: config.On(cfg.UI.CollapseGroups),
 		LoadDelay:      loadDelay,
-		NoHistory:      !config.On(cfg.History),
+		NoHistory:      !config.On(cfg.Storage.History),
 		OnActive:       onActive,
 		RevealTimeout:  revealTimeout,
 		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
-		HideOnBlur:     config.On(cfg.HideOnBlur),
+		HideOnBlur:     config.On(cfg.Values.HideOnBlur),
 		HandlerSetup:   setup,
-		Updater:        updater(cfg.Releases),
-		UpdateCheck:    config.On(cfg.UpdateCheck),
+		Updater:        updater(cfg.Updates.Sources),
+		UpdateCheck:    config.On(cfg.Updates.AutoCheck),
+		UpdateEvery:    updateEvery,
 		Keys:           &keymap,
 		Commands:       cfg.CustomCommands,
 		Version:        versionString(),
 		Store:          st,
+		Warning:        strings.Join(warnings, " · "),
 		CacheFile:      cacheFile,
 		ConfigFiles:    configFiles(*configPath),
 		StatePath:      statePath,
 		Changelog:      lazysecrets.Changelog,
 		Dir:            placeDir,
-		ShareKey:       cfg.Share.Key,
+		ShareKey:       cfg.Sharing.Key,
 		ShareRules:     shareRules(cfg),
 		Open:           open,
 		Styles:         &theme,

cmd/lazysecrets/share.go

@@ -17,12 +17,12 @@ import (
 )
 
 // shareFiles prints a share link to env files of one repo, encrypted with
-// the --key secret's value, else the repo's or the config's share.key:
+// the --key secret's value, else the repo's or the config's sharing.key:
 //
 //	lazysecrets share .env apps/api/.env
 func shareFiles(ctx context.Context, providers []provider.Provider, st *store.Store, general string, rules share.Rules, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("share", flag.ContinueOnError)
-	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: share.key)")
+	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: sharing.key)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
@@ -73,7 +73,7 @@ func shareFiles(ctx context.Context, providers []provider.Provider, st *store.St
 		return err
 	}
 	if !ok {
-		return errors.New("which secret to encrypt with? --key <secret>, or share.key in the repo's .lazysecrets.yaml or the config")
+		return errors.New("which secret to encrypt with? --key <secret>, or sharing.key in the repo's .lazysecrets.yaml or the config")
 	}
 	v, version, err := readKey(ctx, providers, st, key)
 	if err != nil {
@@ -87,7 +87,7 @@ func shareFiles(ctx context.Context, providers []provider.Provider, st *store.St
 	return err
 }
 
-// shareRules are the config's share.keyRules.
+// shareRules are the config's sharing.keyRules.
 func shareRules(cfg config.Config) share.Rules {
-	return share.Rules{MinLength: cfg.Share.KeyRules.MinLength, MinClasses: cfg.Share.KeyRules.MinClasses}
+	return share.Rules{MinLength: cfg.Sharing.KeyRules.MinLength, MinClasses: cfg.Sharing.KeyRules.MinClasses}
 }

cmd/lazysecrets/update.go

@@ -43,7 +43,7 @@ func updateCmd(configPath string, args []string) error {
 	current := versionString()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
-	c := &update.Client{Servers: cfg.Releases}
+	c := &update.Client{Servers: cfg.Updates.Sources}
 	r, err := c.Latest(ctx)
 	if err != nil {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)
@@ -55,7 +55,7 @@ func updateCmd(configPath string, args []string) error {
 		fmt.Printf("lazysecrets %s is the latest (%s)\n", current, r.Tag)
 		return nil
 	}
-	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes()))
+	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes(current)))
 	if check {
 		fmt.Println("lazysecrets update installs it.")
 		return nil

docs/azure.md

@@ -63,7 +63,7 @@ Secrets, keys and certificates, each on their own tab of the Secrets pane
 (`[`/`]`). `space` reveals a secret's value, or the public material of a
 key (PEM public key) or certificate; private key material is never
 fetched. `v` lists an item's versions. Items expiring within
-`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
+`ui.expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
 
 The status pane (`0`) lists them across every vault loaded, opened or
 cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`

docs/config.md

@@ -7,37 +7,45 @@ status pane (`0`) opens it in your editor, as in lazygit (making it if
 it isn't there yet); changes apply when lazysecrets starts again.
 
 ```yaml
-icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
-clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
-revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
-hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
-expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
-timeout: 30s           # per backend request
-loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
-sourcesView: grouped   # or flat; ` toggles it
-collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
-updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
-releases:              # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
+ui:
+  icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
+  sourcesView: grouped   # or flat; ` toggles it
+  collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
+  loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
+  expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
+values:
+  revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
+  hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
+  clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
+storage:
+  cache: true            # keep what was loaded (never values) for the next start
+  history: true          # count uses of items for Recent (R)
+updates:
+  autoCheck: true          # look for a newer release at startup (U and lazysecrets update work either way)
+  autoCheckInterval: 24h   # at most this often
+  sources:                 # where updates come from, tried in order (GitHub, or a Gitea or Forgejo server)
     - https://github.com/karleinarb/lazysecrets
     - https://git.kebcloud.no/keb/lazysecrets
-history: true          # count uses of items for Recent (R)
-cache: true            # keep what was loaded (never values) for the next start
 providers:
+  timeout: 30s                           # per backend request; a provider's own timeout overrides it
   azure:                                 # applies to every az account
     enabled: true                        # default
+    timeout: 30s
     hideSubscriptions: [platform-mgmt]   # by name or ID
     vaults:                              # listed under "Pinned vaults", for vaults
       - https://kv-foo.vault.azure.net/  # you can read but not discover
   databricks:
     enabled: true
+    timeout: 30s
     hideProfiles: [test]
   repos:
     enabled: true
+    timeout: 30s
     roots: [~/git]
     paths: [~/work/infra]
     include: ["secrets/**"]
     exclude: ["**/testdata/**"]
-share:                 # sharing env files as encrypted links
+sharing:               # sharing env files as encrypted links
   key: https://kv-team.vault.azure.net/secrets/env-share  # or its lazysecrets:// link; for repos naming none
   keyRules:            # what a key's value must be
     minLength: 32      # characters, 16 at least
@@ -45,7 +53,7 @@ share:                 # sharing env files as encrypted links
 ```
 
 More, each on its own page: [repos](repos.md) (`providers.repos`),
-[sharing env files](links.md#sharing-env-files) (`share`), the
+[sharing env files](links.md#sharing-env-files) (`sharing`), the
 [link handler](links.md#from-the-browser-and-chat) (`linkHandler`),
 [keybindings](keys.md#rebinding-keys) (`keybinding`) and
 [custom commands](custom-commands.md) (`customCommands`).
@@ -83,8 +91,11 @@ theme:
   repoColor: ["#c099ff"]
 ```
 
+A role lazysecrets doesn't know, a typo or one from a newer version, is
+skipped with a warning.
+
 Icons need a [Nerd Font](https://www.nerdfonts.com) (v3+). If they render
-as boxes, turn them off with `icons: false`.
+as boxes, turn them off with `ui.icons: false`.
 
 ## Layering
 
@@ -108,11 +119,13 @@ starred the item under (a vault two of your accounts can see can be starred
 for one); a note describes the item, so it shows under every account. It's
 JSON so an editor plugin can read it with a built-in parser; several
 lazysecrets windows can save to it without losing each other's changes.
+One written by a newer lazysecrets is read but not saved to, with a
+warning, until you update.
 
 Revealing, copying, opening in the browser, sharing and jumping to an item
 count as using it: its record keeps when it was last used and how often,
 for Recent (`R`). Records kept only for usage are dropped after 90 days
-unused, and beyond the 100 most recent. `history: false` stops counting.
+unused, and beyond the 100 most recent. `storage.history: false` stops counting.
 
 It also keeps where you left lazysecrets in each folder (the selected
 source, vault or secret), and goes back there the next time it starts in
@@ -132,17 +145,18 @@ and copying always fetch the value live.
 Lists not loaded for 30 days are dropped, and so is everything from an
 account you're no longer signed in to. Repos aren't cached: their files
 are read from disk anyway. Deleting the file is always safe, and
-`cache: false` stops using it.
+`storage.cache: false` stops using it.
 
 ## Updates
 
-Once a day (`updateCheck`), in the background, lazysecrets asks for the
-latest release; within the day it reuses the answer from the state file.
-Releases are published on GitHub and on git.kebcloud.no, and it asks
-them in that order, the next when one doesn't answer within 5 seconds;
-`releases` lists others, such as a mirror of your own. Offline, or with
+At startup, in the background, lazysecrets asks for the latest release
+(`updates.autoCheck`), once a day or every `updates.autoCheckInterval`;
+until then it reuses the answer from the state file. Releases are
+published on GitHub and on git.kebcloud.no, and it asks them in that
+order, the next when one doesn't answer within 5 seconds;
+`updates.sources` lists others, such as a mirror of your own. Offline, or with
 every server down, it says nothing. A newer release shows in the footer, `v0.1.1 ↑ v0.2.0`; `U` (or
-`lazysecrets update --check`) shows its changelog.
+`lazysecrets update --check`) shows what changed since your version, across the last 10 releases.
 
 Updating (`u` there, or `lazysecrets update`) downloads the release for
 your OS and CPU from the first server that has it, checks it against

docs/development.md

@@ -22,7 +22,7 @@ Development builds show `dev-<commit>` as their version (`-dirty` with
 uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
 version they were built for.
 
-## Pull requests
+## How changes land
 
 Pull requests into `main` are squash-merged, so each is one commit titled
 like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)

docs/keys.md

@@ -65,8 +65,8 @@ certificates as their subject, issuer, dates, names and thumbprint, with
 any other PEM block (a private key) named but not shown. `y` still copies
 it exactly as stored.
 
-A revealed value hides again after `revealTimeout` (60s) and when the
-terminal loses focus (`hideOnBlur`); see [config](config.md).
+A revealed value hides again after `values.revealTimeout` (60s) and
+when the terminal loses focus (`values.hideOnBlur`); see [config](config.md).
 
 ## Stars and notes
 

docs/links.md

@@ -54,7 +54,7 @@ uses it) or your config (for repos that don't name one), by its
 reference:
 
 ```yaml
-share:
+sharing:
   key: https://kv-team.vault.azure.net/secrets/env-share
 ```
 
@@ -67,7 +67,7 @@ isn't long and varied enough, saying how (never showing it). By default
 that's 32 characters of two kinds; your config can ask for more, or less:
 
 ```yaml
-share:
+sharing:
   keyRules:
     minLength: 32    # characters; 16 at least
     minClasses: 2    # kinds of character: lowercase, uppercase, digits, symbols

docs/repos.md

@@ -3,14 +3,16 @@
 lazysecrets shows git repositories under **Repos**: their
 [SOPS](https://github.com/getsops/sops)-encrypted files (YAML, JSON,
 `.env`, INI) and plain env files as vaults, and the keys in them
-(`db.password`, `list[0]`) as secrets.
+(`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
+escaped, `app\.name`, so it doesn't read as nesting.
 
 ## Which repos
 
-**Repos** lists every repo with secret files under the `roots` (`~/git`
-by default; one or two levels down, `repo` or `org/repo`), any listed in
-`paths`, and any you starred something in (the repo, a file or a key),
-wherever it is. They're checked in the background.
+**Repos** lists every repo with secret files under the `roots` (by
+default whichever of `~/git`, `~/repo`, `~/repos`, `~/projects`, `~/code`,
+`~/source` and `~/src` exist; one or two levels down, `repo` or
+`org/repo`), any listed in `paths`, and any you starred something in
+(the repo, a file or a key), wherever it is. They're checked in the background.
 
 Started inside a repo, that repo gets a row of its own at the top,
 `Repo · <name>`, and lazysecrets opens on it, with the files under the
@@ -49,7 +51,7 @@ Folders of dependencies and caches are never looked in, tracked or not:
 ```yaml
 providers:
   repos:
-    roots: [~/git]                             # folders of repos (the default; [] turns it off)
+    roots: [~/git]                             # folders of repos (replaces the defaults; [] turns it off)
     paths: [~/work/infra]                      # single repos elsewhere
     include: ["secrets/**", "**/*.sops.yaml"]  # globs from the repo root; ** for any depth
     exclude: ["**/testdata/**"]
@@ -59,7 +61,7 @@ A repo's `.lazysecrets.yaml` can also name the secret its env files are
 [shared](links.md#sharing-env-files) with:
 
 ```yaml
-share:
+sharing:
   key: https://kv-team.vault.azure.net/secrets/env-share   # or its lazysecrets:// link
 ```
 

go.mod

@@ -18,8 +18,8 @@ require (
 	github.com/atotto/clipboard v0.1.4
 	github.com/charmbracelet/x/ansi v0.11.9
 	github.com/charmbracelet/x/exp/golden v0.0.0-20251109135125-8916d276318f
-	github.com/databricks/databricks-sdk-go v0.187.0
-	github.com/junegunn/fzf v0.74.4
+	github.com/databricks/databricks-sdk-go v0.188.0
+	github.com/junegunn/fzf v0.74.5
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/mod v0.42.0
 	golang.org/x/term v0.47.0

go.sum

@@ -72,8 +72,8 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/databricks/databricks-sdk-go v0.187.0 h1:V1rGbEUaEdGS7tTZSyplDLnE2Vp5N1aIPiIh/LzjOC8=
-github.com/databricks/databricks-sdk-go v0.187.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
+github.com/databricks/databricks-sdk-go v0.188.0 h1:1nxBqlctGnPzlReyziG199abHs9cR/KNjsCnSM+oDGA=
+github.com/databricks/databricks-sdk-go v0.188.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -100,8 +100,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dq
 github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
 github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
 github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
-github.com/junegunn/fzf v0.74.4 h1:DSqIW3ZxtkuuPzeLKrVnHdoWqT9VCIGRbjc/lXiGCso=
-github.com/junegunn/fzf v0.74.4/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
+github.com/junegunn/fzf v0.74.5 h1:mpJlCdgGuddKerHrdjvV3cnezEBgyjZAVn8KCo/4OMc=
+github.com/junegunn/fzf v0.74.5/go.mod h1:TBRY54j3mGjAm4JcpDyiUIuDq38QlHvAzrB3GLKxQXM=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741 h1:7dYDtfMDfKzjT+DVfIS4iqknSEKtZpEcXtu6vuaasHs=
 github.com/junegunn/go-shellwords v0.0.0-20250127100254-2aa3b3277741/go.mod h1:6EILKtGpo5t+KLb85LNZLAF6P9LKp78hJI80PXMcn3c=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=

internal/config/config.go

@@ -19,44 +19,18 @@ import (
 )
 
 type Config struct {
-	Icons          *bool          `yaml:"icons"`
-	ClipboardClear *time.Duration `yaml:"clipboardClear"`
-	// RevealTimeout hides a revealed value after this long; 0s never.
-	// Defaults to 60s.
-	RevealTimeout *time.Duration `yaml:"revealTimeout"`
-	// ExpiryWarningDays marks secrets, keys and certificates expiring
-	// within this many days; 0 marks only expired ones. Defaults to 30.
-	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
-	// HideOnBlur hides a revealed value when the terminal loses focus.
-	// Defaults to true.
-	HideOnBlur *bool         `yaml:"hideOnBlur"`
-	Timeout    time.Duration `yaml:"timeout"`
-	// LoadDelay is how long the cursor must rest on a row before its
-	// contents load; 0s loads at once. Defaults to 150ms.
-	LoadDelay *time.Duration `yaml:"loadDelay"`
-	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
-	SourcesView string `yaml:"sourcesView"`
-	// History counts uses of items for the Recent list; defaults to true.
-	History *bool `yaml:"history"`
-	// UpdateCheck looks for a newer release once a day, in the
-	// background; defaults to true. U and lazysecrets update work either
-	// way.
-	UpdateCheck *bool `yaml:"updateCheck"`
-	// Releases are the repositories updates come from, tried in order:
-	// on GitHub, or a Gitea or Forgejo server. Defaults to GitHub, then
-	// git.kebcloud.no (update.DefaultServers).
-	Releases []string `yaml:"releases"`
-	// Cache keeps what was loaded (never values) between runs, so lists
-	// show at once and refresh in the background; defaults to true.
-	Cache *bool `yaml:"cache"`
-	// CollapseGroups starts the Sources pane with its groups folded;
-	// defaults to true.
-	CollapseGroups *bool     `yaml:"collapseGroups"`
+	UI UI `yaml:"ui"`
+	// Values keeps revealed and copied values from lingering.
+	Values Values `yaml:"values"`
+	// Storage is what's kept between runs.
+	Storage Storage `yaml:"storage"`
+	// Updates sets how lazysecrets looks for newer releases.
+	Updates   Updates   `yaml:"updates"`
 	Providers Providers `yaml:"providers"`
 	// LinkHandler sets how lazysecrets:// links open; see linkhandler.
 	LinkHandler LinkHandler `yaml:"linkHandler"`
-	// Share sets how env files are shared; see package share.
-	Share Share `yaml:"share"`
+	// Sharing sets how env files are shared; see package share.
+	Sharing Sharing `yaml:"sharing"`
 	// CustomCommands run shell commands on the selected item; see
 	// package commands.
 	CustomCommands []commands.Command `yaml:"customCommands"`
@@ -68,6 +42,52 @@ type Config struct {
 	Theme map[string][]string `yaml:"theme"`
 }
 
+type UI struct {
+	Icons *bool `yaml:"icons"`
+	// SourcesView is "grouped" (default) or "flat"; ` + "`" + ` toggles it.
+	SourcesView string `yaml:"sourcesView"`
+	// CollapseGroups starts the Sources pane with its groups folded;
+	// defaults to true.
+	CollapseGroups *bool `yaml:"collapseGroups"`
+	// LoadDelay is how long the cursor must rest on a row before its
+	// contents load; 0s loads at once. Defaults to 150ms.
+	LoadDelay *time.Duration `yaml:"loadDelay"`
+	// ExpiryWarningDays marks secrets, keys and certificates expiring
+	// within this many days; 0 marks only expired ones. Defaults to 30.
+	ExpiryWarningDays *int `yaml:"expiryWarningDays"`
+}
+
+type Values struct {
+	// RevealTimeout hides a revealed value after this long; 0s never.
+	// Defaults to 60s.
+	RevealTimeout *time.Duration `yaml:"revealTimeout"`
+	// HideOnBlur hides a revealed value when the terminal loses focus.
+	// Defaults to true.
+	HideOnBlur     *bool          `yaml:"hideOnBlur"`
+	ClipboardClear *time.Duration `yaml:"clipboardClear"`
+}
+
+type Storage struct {
+	// Cache keeps what was loaded (never values) between runs, so lists
+	// show at once and refresh in the background; defaults to true.
+	Cache *bool `yaml:"cache"`
+	// History counts uses of items for the Recent list; defaults to true.
+	History *bool `yaml:"history"`
+}
+
+type Updates struct {
+	// AutoCheck looks for a newer release in the background at startup,
+	// at most once per AutoCheckInterval; defaults to true. U and
+	// lazysecrets update work either way.
+	AutoCheck *bool `yaml:"autoCheck"`
+	// AutoCheckInterval defaults to 24h.
+	AutoCheckInterval *time.Duration `yaml:"autoCheckInterval"`
+	// Sources are the repositories updates come from, tried in
+	// order: on GitHub, or a Gitea or Forgejo server. Defaults to GitHub,
+	// then git.kebcloud.no (update.DefaultServers).
+	Sources []string `yaml:"sources"`
+}
+
 type LinkHandler struct {
 	// Terminal to open links in, overriding the one handler install
 	// detected: kitty, ghostty, wezterm, iterm2, terminal, alacritty,
@@ -85,7 +105,7 @@ type LinkHandler struct {
 	Prompt *bool `yaml:"prompt"`
 }
 
-type Share struct {
+type Sharing struct {
 	// Key is the secret whose value encrypts shared files (its
 	// lazysecrets:// link, Key Vault URL or reference), for repos whose
 	// .lazysecrets.yaml doesn't name one.
@@ -103,6 +123,9 @@ type KeyRules struct {
 }
 
 type Providers struct {
+	// Timeout bounds each backend request; defaults to 30s. Each
+	// provider's own timeout overrides it for that provider.
+	Timeout    time.Duration `yaml:"timeout"`
 	Azure      Azure         `yaml:"azure"`
 	Databricks Databricks    `yaml:"databricks"`
 	Repos      Repos         `yaml:"repos"`
@@ -112,11 +135,13 @@ type Providers struct {
 // that repo is the only one shown; elsewhere, the ones in Paths and under
 // Roots.
 type Repos struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool    `yaml:"enabled"`
 	Paths   []string `yaml:"paths"`
-	// Roots are folders of repos. Defaults to ~/git; an empty list
-	// turns it off.
+	// Roots are folders of repos. Defaults to repo.DefaultRoots (~/git,
+	// ~/src, ~/code and the like); an empty list turns it off.
 	Roots *[]string `yaml:"roots"`
 	// Include and Exclude are globs relative to a repo's root (** for any
 	// depth), for repos without their own .lazysecrets.yaml. Without them,
@@ -126,6 +151,8 @@ type Repos struct {
 }
 
 type Azure struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled *bool `yaml:"enabled"`
 	// HideSubscriptions lists subscriptions to leave out, by name or ID.
@@ -136,6 +163,8 @@ type Azure struct {
 }
 
 type Databricks struct {
+	// Timeout overrides providers.timeout for these requests.
+	Timeout time.Duration `yaml:"timeout"`
 	// Enabled defaults to true.
 	Enabled      *bool    `yaml:"enabled"`
 	HideProfiles []string `yaml:"hideProfiles"`
@@ -222,35 +251,48 @@ func decodeInto(c *Config, path string) error {
 }
 
 func (c Config) validate(path string) error {
-	if v := c.SourcesView; v != "" && v != "grouped" && v != "flat" {
-		return fmt.Errorf("%s: sourcesView: %q is not grouped or flat", path, v)
+	if v := c.UI.SourcesView; v != "" && v != "grouped" && v != "flat" {
+		return fmt.Errorf("%s: ui.sourcesView: %q is not grouped or flat", path, v)
 	}
 	for _, cmd := range c.CustomCommands {
 		if err := cmd.Validate(); err != nil {
 			return fmt.Errorf("%s: %w", path, err)
 		}
 	}
-	if d := c.ExpiryWarningDays; d != nil && *d < 0 {
-		return fmt.Errorf("%s: expiryWarningDays: %d is negative", path, *d)
+	if d := c.UI.ExpiryWarningDays; d != nil && *d < 0 {
+		return fmt.Errorf("%s: ui.expiryWarningDays: %d is negative", path, *d)
 	}
-	if d := c.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
-		return fmt.Errorf("%s: loadDelay: %s is not between 0s and 5s", path, *d)
+	if d := c.UI.LoadDelay; d != nil && (*d < 0 || *d > 5*time.Second) {
+		return fmt.Errorf("%s: ui.loadDelay: %s is not between 0s and 5s", path, *d)
 	}
-	for i, r := range c.Releases {
+	if d := c.Updates.AutoCheckInterval; d != nil && *d <= 0 {
+		return fmt.Errorf("%s: updates.autoCheckInterval: %s is not positive (autoCheck: false turns it off)", path, *d)
+	}
+	for i, r := range c.Updates.Sources {
 		if _, err := update.API(r); err != nil || !strings.HasPrefix(r, "https://") {
-			return fmt.Errorf("%s: releases[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
+			return fmt.Errorf("%s: updates.sources[%d]: %q is not an https:// repository address, like %s", path, i, r, update.GitHubRepo)
 		}
 	}
-	if k := c.Share.Key; k != "" {
+	if k := c.Sharing.Key; k != "" {
 		if _, err := share.ParseKey(k); err != nil {
-			return fmt.Errorf("%s: share.key: %w", path, err)
+			return fmt.Errorf("%s: sharing.key: %w", path, err)
 		}
 	}
-	if n := c.Share.KeyRules.MinLength; n != 0 && n < 16 {
-		return fmt.Errorf("%s: share.keyRules.minLength: %d is under 16", path, n)
+	if n := c.Sharing.KeyRules.MinLength; n != 0 && n < 16 {
+		return fmt.Errorf("%s: sharing.keyRules.minLength: %d is under 16", path, n)
+	}
+	if n := c.Sharing.KeyRules.MinClasses; n < 0 || n > 4 {
+		return fmt.Errorf("%s: sharing.keyRules.minClasses: %d is not between 1 and 4", path, n)
+	}
+	for name, d := range map[string]time.Duration{
+		"providers.timeout":            c.Providers.Timeout,
+		"providers.azure.timeout":      c.Providers.Azure.Timeout,
+		"providers.databricks.timeout": c.Providers.Databricks.Timeout,
+		"providers.repos.timeout":      c.Providers.Repos.Timeout,
+	} {
+		if d < 0 {
+			return fmt.Errorf("%s: %s: %s is negative", path, name, d)
 		}
-	if n := c.Share.KeyRules.MinClasses; n < 0 || n > 4 {
-		return fmt.Errorf("%s: share.keyRules.minClasses: %d is not between 1 and 4", path, n)
 	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {

internal/config/config_test.go

@@ -19,12 +19,17 @@ func write(t *testing.T, content string) string {
 
 func TestLoad(t *testing.T) {
 	c, err := Load(write(t, `
-icons: false
-sourcesView: flat
-clipboardClear: 45s
-timeout: 1m
+ui:
+  icons: false
+  sourcesView: flat
+values:
+  clipboardClear: 45s
+storage:
+  history: false
 providers:
+  timeout: 1m
   azure:
+    timeout: 2m
     hideSubscriptions: [platform-mgmt]
     vaults:
       - https://kv-foo.vault.azure.net/
@@ -35,12 +40,12 @@ providers:
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || c.ClipboardClear == nil || *c.ClipboardClear != 45*time.Second ||
-		c.Timeout != time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
+	if c.UI.Icons == nil || *c.UI.Icons || c.Values.ClipboardClear == nil || *c.Values.ClipboardClear != 45*time.Second ||
+		c.Providers.Timeout != time.Minute || c.Providers.Azure.Timeout != 2*time.Minute || len(c.Providers.Azure.Vaults) != 1 || c.Providers.Databricks.HideProfiles[0] != "test" {
 		t.Errorf("config = %+v", c)
 	}
-	if c.SourcesView != "flat" {
-		t.Errorf("sourcesView = %q", c.SourcesView)
+	if c.UI.SourcesView != "flat" || On(c.Storage.History) || !On(c.Storage.Cache) {
+		t.Errorf("ui = %+v, storage = %+v", c.UI, c.Storage)
 	}
 	if !On(c.Providers.Azure.Enabled) || On(c.Providers.Databricks.Enabled) {
 		t.Error("enabled flags wrong")
@@ -57,7 +62,7 @@ func TestLoadMissingAndEmpty(t *testing.T) {
 		"empty":   write(t, ""),
 	} {
 		c, err := Load(path)
-		if err != nil || c.Icons != nil || c.ClipboardClear != nil {
+		if err != nil || c.UI.Icons != nil || c.Values.ClipboardClear != nil {
 			t.Errorf("%s: %+v, %v", name, c, err)
 		}
 	}
@@ -68,14 +73,17 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"typo":       "icon: true\n",
 		"bad vault":  "providers:\n  azure:\n    vaults: [kv-foo]\n",
 		"old layout": "azure:\n  vaults: [https://kv.vault.azure.net/]\n",
-		"duration":   "timeout: soon\n",
-		"view":       "sourcesView: tree\n",
-		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
-		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
-		"share key":  "share:\n  key: https://kv.vault.azure.net/\n",
-		"workspace":  "share:\n  key: \"{{secrets/team/env-share}}\"\n",
-		"short keys": "share:\n  keyRules:\n    minLength: 8\n",
-		"classes":    "share:\n  keyRules:\n    minClasses: 5\n",
+		"flat keys":  "icons: false\n",
+		"duration":   "providers:\n  timeout: soon\n",
+		"negative":   "providers:\n  repos:\n    timeout: -1s\n",
+		"view":       "ui:\n  sourcesView: tree\n",
+		"sources":    "updates:\n  sources: [git.example.com/team/lazysecrets]\n",
+		"http":       "updates:\n  sources: [http://git.example.com/team/lazysecrets]\n",
+		"interval":   "updates:\n  autoCheckInterval: 0s\n",
+		"share key":  "sharing:\n  key: https://kv.vault.azure.net/\n",
+		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
+		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
+		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
 	} {
 		if _, err := Load(write(t, content)); err == nil {
 			t.Errorf("%s: no error", name)
@@ -87,7 +95,8 @@ func TestLoadRejectsMistakes(t *testing.T) {
 
 func TestLoadAllLayers(t *testing.T) {
 	user := write(t, `
-icons: false
+ui:
+  icons: false
 theme:
   azureColor: [blue]
   errorColor: [red, bold]
@@ -96,6 +105,8 @@ providers:
     hideSubscriptions: [a]
 `)
 	theme := write(t, `
+ui:
+  sourcesView: flat
 theme:
   azureColor: ["#82aaff"]
   activeBorderColor: ["#ff966c", bold]
@@ -104,7 +115,8 @@ theme:
 	if err != nil {
 		t.Fatal(err)
 	}
-	if c.Icons == nil || *c.Icons || len(c.Providers.Azure.HideSubscriptions) != 1 {
+	// A group set in both files merges: icons from one, sourcesView the other.
+	if c.UI.Icons == nil || *c.UI.Icons || c.UI.SourcesView != "flat" || len(c.Providers.Azure.HideSubscriptions) != 1 {
 		t.Errorf("user settings lost: %+v", c)
 	}
 	want := map[string][]string{
@@ -119,19 +131,19 @@ theme:
 	}
 }
 
-func TestReleases(t *testing.T) {
-	c, err := Load(write(t, "releases: [https://git.example.com/team/lazysecrets]\n"))
-	if err != nil || len(c.Releases) != 1 {
-		t.Errorf("releases = %v, %v", c.Releases, err)
+func TestUpdates(t *testing.T) {
+	c, err := Load(write(t, "updates:\n  autoCheck: false\n  autoCheckInterval: 168h\n  sources: [https://git.example.com/team/lazysecrets]\n"))
+	if err != nil || On(c.Updates.AutoCheck) || *c.Updates.AutoCheckInterval != 7*24*time.Hour || len(c.Updates.Sources) != 1 {
+		t.Errorf("updates = %+v, %v", c.Updates, err)
 	}
 }
 
 func TestLoadDelay(t *testing.T) {
-	c, err := Load(write(t, "loadDelay: 300ms\n"))
-	if err != nil || c.LoadDelay == nil || *c.LoadDelay != 300*time.Millisecond {
-		t.Errorf("loadDelay = %v, %v", c.LoadDelay, err)
+	c, err := Load(write(t, "ui:\n  loadDelay: 300ms\n"))
+	if err != nil || c.UI.LoadDelay == nil || *c.UI.LoadDelay != 300*time.Millisecond {
+		t.Errorf("loadDelay = %v, %v", c.UI.LoadDelay, err)
 	}
-	if _, err := Load(write(t, "loadDelay: 1m\n")); err == nil {
+	if _, err := Load(write(t, "ui:\n  loadDelay: 1m\n")); err == nil {
 		t.Error("a minute's delay accepted")
 	}
 }

internal/provider/fake/fake.go

@@ -332,7 +332,7 @@ func Azure(delay time.Duration) *Provider {
 	}, demoCert)
 
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
-	// A key to share env files with (S → f): random, as share.keyRules wants.
+	// A key to share env files with (S → f): random, as sharing.keyRules wants.
 	p.add(shared, provider.TypeSecret, provider.Object{
 		Name: "env-share", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
 	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")

internal/provider/repo/repo.go

@@ -80,6 +80,10 @@ type repoInfo struct {
 	here   bool   // the repo lazysecrets started in
 }
 
+// DefaultRoots are the usual folders of repos, used when the config
+// doesn't set roots. Ones that don't exist cost a stat each.
+var DefaultRoots = []string{"~/git", "~/repo", "~/repos", "~/projects", "~/code", "~/source", "~/src"}
+
 func New(s Settings) *Provider {
 	if s.Sops == "" {
 		s.Sops = "sops"
@@ -116,10 +120,18 @@ func (p *Provider) load() {
 			}
 			add(root)
 		}
+		// Missing roots are skipped (most of the defaults are), and one
+		// that's a symlink to another is scanned once.
+		scanned := map[string]bool{}
 		for _, dir := range p.s.Roots {
-			base, _ := filepath.EvalSymlinks(expandHome(dir))
-			for _, root := range reposIn(expandHome(dir), 2) {
-				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") {
+			base, err := filepath.EvalSymlinks(expandHome(dir))
+			if err != nil || scanned[base] {
+				continue
+			}
+			scanned[base] = true
+			for _, root := range reposIn(base, 2) {
+				// A repo under two roots keeps the first one's name.
+				if name, err := filepath.Rel(base, root); err == nil && !strings.HasPrefix(name, "..") && names[root] == "" {
 					names[root] = filepath.ToSlash(name)
 				}
 				add(root)
@@ -391,10 +403,11 @@ func (p *Provider) Versions(context.Context, provider.Object) ([]provider.Object
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	file, extract, ok := strings.Cut(o.ID, "\x00")
 	if !ok { // made from a link: the repo's root, the file's path, the key
-		file, extract = o.Container.ID, extractFor(o.Name)
+		file = o.Container.ID
 		if file == "" {
 			file = filepath.Join(o.Container.Source.ID, filepath.FromSlash(o.Container.Name))
 		}
+		extract = extractFor(file, o.Name)
 	}
 	if _, isSops := readMeta(file); !isSops {
 		return plainValue(file, o.Name)
@@ -587,14 +600,14 @@ func normalizeRemote(remote string) (string, string) {
 type lazysecretsFile struct {
 	Include []string `yaml:"include"`
 	Exclude []string `yaml:"exclude"`
-	Share   struct {
+	Sharing struct {
 		// Key is the link to the secret that encrypts the repo's
 		// shared env files (package share).
 		Key string `yaml:"key"`
-	} `yaml:"share"`
+	} `yaml:"sharing"`
 }
 
-// ShareKey is the share.key of the repo's .lazysecrets.yaml, if any.
+// ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
 func ShareKey(root string) (string, error) {
 	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
 	if errors.Is(err, os.ErrNotExist) {
@@ -607,7 +620,7 @@ func ShareKey(root string) (string, error) {
 	if err := yaml.Unmarshal(b, &f); err != nil {
 		return "", fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 	}
-	return f.Share.Key, nil
+	return f.Sharing.Key, nil
 }
 
 // selector says which files to look at: user (the include/exclude of the
@@ -1000,7 +1013,7 @@ func formatOf(file string) string {
 }
 
 type key struct {
-	name      string // db.password, list[0]
+	name      string // db.password, list[0], with . [ ] \ in keys escaped
 	extract   string // sops --extract: ["db"]["password"]
 	encrypted bool
 	line      int // 1-based
@@ -1045,7 +1058,7 @@ func parseKeys(file string, b []byte) ([]key, error) {
 					continue
 				}
 				k, v = strings.TrimSpace(k), strings.TrimSpace(v)
-				out = append(out, key{name: section + "." + k, extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
+				out = append(out, key{name: escape(section) + "." + escape(k), extract: quote(section) + quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
 			}
 		}
 		return out, nil
@@ -1062,9 +1075,9 @@ func walk(n *yaml.Node, name, extract string, top bool, out *[]key) {
 			if top && k == "sops" {
 				continue
 			}
-			child := k
+			child := escape(k)
 			if name != "" {
-				child = name + "." + k
+				child = name + "." + child
 			}
 			walk(n.Content[i+1], child, extract+quote(k), false, out)
 		}
@@ -1086,23 +1099,56 @@ func quote(k string) string {
 	return `["` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(k) + `"]`
 }
 
+// escape keeps a key's dots and brackets from reading as nesting in a
+// name: app\.name is one key, app.name two.
+func escape(k string) string {
+	return strings.NewReplacer(`\`, `\\`, `.`, `\.`, `[`, `\[`, `]`, `\]`).Replace(k)
+}
+
 // extractFor rebuilds the extract path from a key name, for objects made
-// from a link (db.password, list[0]). Names with dots in keys can't be
-// told apart from nesting: those come from the listing instead.
-func extractFor(name string) string {
-	var b strings.Builder
-	for _, part := range strings.Split(name, ".") {
-		base, idx, _ := strings.Cut(part, "[")
-		if base != "" {
-			b.WriteString(quote(base))
+// from a link (db.password, list[0], app\.name). A dotenv file is flat:
+// its names are the keys as they are.
+func extractFor(file, name string) string {
+	if formatOf(file) == "dotenv" {
+		return quote(name)
 	}
-		if idx != "" {
-			b.WriteString("[" + idx)
+	var b, part strings.Builder
+	flush := func() {
+		if part.Len() > 0 {
+			b.WriteString(quote(part.String()))
+			part.Reset()
 		}
 	}
+	for i := 0; i < len(name); i++ {
+		switch c := name[i]; c {
+		case '\\':
+			if i+1 < len(name) {
+				i++
+			}
+			part.WriteByte(name[i])
+		case '.':
+			flush()
+		case '[':
+			end := strings.IndexByte(name[i:], ']')
+			if end < 0 || !digits(name[i+1:i+end]) {
+				part.WriteByte(c)
+				continue
+			}
+			flush()
+			b.WriteString(name[i : i+end+1])
+			i += end
+		default:
+			part.WriteByte(c)
+		}
+	}
+	flush()
 	return b.String()
 }
 
+func digits(s string) bool {
+	return s != "" && strings.Trim(s, "0123456789") == ""
+}
+
 func absPath(p string) string {
 	if a, err := filepath.Abs(p); err == nil {
 		return a

internal/provider/repo/repo_test.go

@@ -336,6 +336,30 @@ func TestRoots(t *testing.T) {
 	}
 }
 
+func TestRootsDeduped(t *testing.T) {
+	root, _ := filepath.EvalSymlinks(t.TempDir())
+	os.Rename(gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML}), filepath.Join(root, "infra"))
+	os.MkdirAll(filepath.Join(root, "acme"), 0o755)
+	os.Rename(gitRepo(t, map[string]string{"prod.env": sopsEnv}), filepath.Join(root, "acme", "billing"))
+
+	// ~/src → ~/git, and a root reaching one repo at another depth.
+	links := t.TempDir()
+	alias := filepath.Join(links, "src")
+	os.Symlink(root, alias)
+	missing := filepath.Join(links, "nope")
+	acme := filepath.Join(root, "acme")
+
+	srcs, err := New(Settings{Dir: links, Roots: []string{missing, root, alias, acme}}).Sources(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := names(srcs, func(s provider.Source) string { return s.Name })
+	slices.Sort(got)
+	if !slices.Equal(got, []string{"acme/billing", "infra"}) {
+		t.Errorf("repos: %v, want each once, named from the first root", got)
+	}
+}
+
 func TestStarredReposAlongside(t *testing.T) {
 	here := gitRepo(t, map[string]string{"secrets/a.yaml": sopsYAML})
 	starred := gitRepo(t, map[string]string{"prod.env": sopsEnv})
@@ -521,3 +545,24 @@ func TestFileDetails(t *testing.T) {
 		t.Errorf("untracked env: %+v", d)
 	}
 }
+
+func TestKeyNamesEscaped(t *testing.T) {
+	keys, err := parseKeys("s.yaml", []byte("app.name: x\ndb:\n  password: y\nlist: [a, b]\nodd[1]: z\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got []string
+	for _, k := range keys {
+		got = append(got, k.name+" "+k.extract)
+		if e := extractFor("s.yaml", k.name); e != k.extract {
+			t.Errorf("extractFor(%q) = %s, want %s", k.name, e, k.extract)
+		}
+	}
+	want := `app\.name ["app.name"]|db.password ["db"]["password"]|list[0] ["list"][0]|list[1] ["list"][1]|odd\[1\] ["odd[1]"]`
+	if strings.Join(got, "|") != want {
+		t.Errorf("keys = %s\nwant   %s", strings.Join(got, "|"), want)
+	}
+	if e := extractFor(".env", "spring.url"); e != `["spring.url"]` {
+		t.Errorf("dotenv: %s", e)
+	}
+}

internal/ref/ref.go

@@ -310,7 +310,7 @@ func parseLink(s string) (Ref, error) {
 		}
 
 	default:
-		return Ref{}, fmt.Errorf("unknown provider %q in link", u.Host)
+		return Ref{}, fmt.Errorf("unknown provider %q in link: a newer lazysecrets may know it (lazysecrets update)", u.Host)
 	}
 	return r, nil
 }

internal/share/rules.go

@@ -53,7 +53,7 @@ func (r Rules) Check(key []byte) error {
 	if len(has) == 0 {
 		return nil
 	}
-	return fmt.Errorf("its value has %s; share.keyRules needs %s",
+	return fmt.Errorf("its value has %s; sharing.keyRules needs %s",
 		strings.Join(has, " and "), strings.Join(needs, " and "))
 }
 

internal/share/share.go

@@ -259,8 +259,8 @@ func CheckPath(p string) error {
 	return nil
 }
 
-// DefaultKey is the key for a repo's files: share.key in the repo's
-// .lazysecrets.yaml, else general (share.key in the config). ok is false
+// DefaultKey is the key for a repo's files: sharing.key in the repo's
+// .lazysecrets.yaml, else general (sharing.key in the config). ok is false
 // when neither names one.
 func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	link, err := repo.ShareKey(root)
@@ -276,7 +276,7 @@ func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	}
 	key, err = ParseKey(link)
 	if err != nil {
-		return ref.Ref{}, false, fmt.Errorf("share.key in %s: %w", where, err)
+		return ref.Ref{}, false, fmt.Errorf("sharing.key in %s: %w", where, err)
 	}
 	return key, true, nil
 }

internal/share/share_test.go

@@ -243,7 +243,7 @@ func TestDefaultKey(t *testing.T) {
 	if err != nil || !ok || k.Name != "env-share" {
 		t.Errorf("general: %+v %v %v", k, ok, err)
 	}
-	os.WriteFile(filepath.Join(dir, ".lazysecrets.yaml"), []byte("share:\n  key: lazysecrets://azure/kv-app.vault.azure.net/secrets/app-share\n"), 0o644)
+	os.WriteFile(filepath.Join(dir, ".lazysecrets.yaml"), []byte("sharing:\n  key: lazysecrets://azure/kv-app.vault.azure.net/secrets/app-share\n"), 0o644)
 	if k, _, _ := DefaultKey(dir, general); k.Name != "app-share" {
 		t.Errorf("the repo's should win: %+v", k)
 	}

internal/store/store.go

@@ -145,16 +145,23 @@ type Store struct {
 	data file
 }
 
+// ErrNewer is a state file written by a newer lazysecrets.
+var ErrNewer = errors.New("written by a newer lazysecrets")
+
 // Load reads path; a missing file is an empty store. path "" gives a store
-// that never saves, for tests and --demo.
+// that never saves, for tests and --demo. A file from a newer lazysecrets
+// is read but never saved, so nothing it keeps is lost: Load returns the
+// store with an ErrNewer error.
 func Load(path string) (*Store, error) {
 	s := &Store{path: path}
 	d, err := read(path)
-	if err != nil {
+	if errors.Is(err, ErrNewer) {
+		s.path = ""
+	} else if err != nil {
 		return nil, err
 	}
 	s.data = d
-	return s, nil
+	return s, err
 }
 
 func read(path string) (file, error) {
@@ -172,12 +179,12 @@ func read(path string) (file, error) {
 	if err := json.Unmarshal(b, &d); err != nil {
 		return d, fmt.Errorf("%s: %w", path, err)
 	}
-	if d.Version > version {
-		return d, fmt.Errorf("%s: written by a newer lazysecrets (version %d)", path, d.Version)
-	}
 	if d.Nodes == nil {
 		d.Nodes = map[string]Node{}
 	}
+	if d.Version > version {
+		return d, fmt.Errorf("%s: %w (version %d)", path, ErrNewer, d.Version)
+	}
 	return d, nil
 }
 

internal/store/store_test.go

@@ -1,6 +1,7 @@
 package store
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -65,11 +66,17 @@ func TestTwoWindowsDontLoseEachOthersChanges(t *testing.T) {
 	}
 }
 
-func TestNewerVersionRefused(t *testing.T) {
+func TestNewerVersionReadOnly(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state.json")
-	_ = os.WriteFile(path, []byte(`{"version": 99, "nodes": {}}`), 0o600)
-	if _, err := Load(path); err == nil {
-		t.Error("a newer file was accepted")
+	newer := `{"version": 99, "nodes": {"one": {"note": "hi"}}}`
+	_ = os.WriteFile(path, []byte(newer), 0o600)
+	s, err := Load(path)
+	if !errors.Is(err, ErrNewer) || s == nil || s.Node("one").Note != "hi" {
+		t.Fatalf("Load = %v, %v", s, err)
+	}
+	_ = s.SetFlag("x", true)
+	if b, _ := os.ReadFile(path); string(b) != newer {
+		t.Errorf("the newer file was overwritten: %s", b)
 	}
 }
 

internal/ui/app/app.go

@@ -65,6 +65,8 @@ const (
 type Options struct {
 	// Timeout bounds every provider call. Defaults to 30s.
 	Timeout time.Duration
+	// Timeouts override Timeout for the providers of a kind.
+	Timeouts map[provider.Kind]time.Duration
 	// Icons shows Nerd Font glyphs next to backends.
 	Icons bool
 	// Clipboard defaults to the system clipboard, or OSC52 over SSH.
@@ -77,12 +79,15 @@ type Options struct {
 	// and keeps its state, for the status pane.
 	ConfigFiles []string
 	StatePath   string
+	// Warning shows when the window opens: what lazysecrets skipped
+	// instead of failing to start.
+	Warning string
 	// Changelog is CHANGELOG.md, for the status pane.
 	Changelog string
 	// CacheFile keeps what was loaded between runs; "" keeps it for this
 	// run only.
 	CacheFile string
-	// ShareKey is the config's share.key: the secret that encrypts shared
+	// ShareKey is the config's sharing.key: the secret that encrypts shared
 	// env files, for repos whose .lazysecrets.yaml names none.
 	ShareKey string
 	// ShareRules are what a key's value must be to share with it.
@@ -117,9 +122,11 @@ type Options struct {
 	// Keys, if set, replaces the default keymap (keys.Map.Apply).
 	Keys *keys.Map
 	// Updater, if set, finds and installs newer releases (U); with
-	// UpdateCheck, lazysecrets also looks once a day on its own.
+	// UpdateCheck, lazysecrets also looks on its own at startup, at most
+	// once per UpdateEvery (0 for a day).
 	Updater     *Updater
 	UpdateCheck bool
+	UpdateEvery time.Duration
 	// HandlerSetup, if set, offers to set up the link handler at startup.
 	HandlerSetup *HandlerSetup
 	// NoHistory stops counting uses of items for the Recent list.
@@ -144,7 +151,7 @@ type Clipboard interface {
 type Model struct {
 	providers []provider.Provider
 	byID      map[string]provider.Provider
-	timeout   time.Duration
+	timeout   timeouts
 
 	keys keys.Map
 	st   styles.Styles
@@ -236,6 +243,7 @@ type Model struct {
 
 	updater      *Updater
 	updateCheck  bool
+	updateEvery  time.Duration
 	fetchOnStart bool            // look for a newer release in Init
 	newer        *update.Release // a newer release to offer
 	updated      string          // the release installed, waiting for a restart
@@ -276,8 +284,8 @@ type Model struct {
 	linked     []provider.Container // vaults opened from links, this session
 	open       *ref.Ref             // reference to open at startup
 
-	shareKey   string      // the config's share.key
-	shareRules share.Rules // and share.keyRules
+	shareKey   string      // the config's sharing.key
+	shareRules share.Rules // and sharing.keyRules
 
 	// A lazysecrets:// link found on the clipboard, offered in the footer.
 	dismissedLink string // the last link offered: not offered again
@@ -375,7 +383,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	m := Model{
 		providers:     providers,
 		byID:          map[string]provider.Provider{},
-		timeout:       opts.Timeout,
+		timeout:       timeouts{def: opts.Timeout, byKind: opts.Timeouts},
 		keys:          keys.Default(),
 		st:            styles.Default(),
 		spin:          spinner.New(spinner.WithSpinner(spinner.Dot)),
@@ -427,7 +435,10 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.revealTimeout, m.hideOnBlur = opts.RevealTimeout, opts.HideOnBlur
 	m.expiryWarning = opts.ExpiryWarning
 	m.handlerSetup = opts.HandlerSetup
-	m.updater, m.updateCheck = opts.Updater, opts.UpdateCheck
+	m.updater, m.updateCheck, m.updateEvery = opts.Updater, opts.UpdateCheck, opts.UpdateEvery
+	if m.updateEvery == 0 {
+		m.updateEvery = updateEvery
+	}
 	m.startUpdateCheck()
 	m.askHandler = opts.HandlerSetup != nil && !m.store.Flag(flagNoHandlerPrompt)
 	m.settle = opts.LoadDelay
@@ -466,6 +477,9 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.cachePath, m.placeDir, m.sourcesAt = opts.CacheFile, opts.Dir, map[string]time.Time{}
 	m.shareKey, m.shareRules = opts.ShareKey, opts.ShareRules
 	m.configFiles, m.statePath, m.changelog = opts.ConfigFiles, opts.StatePath, changelogFields(opts.Changelog)
+	if opts.Warning != "" {
+		m.flash = warning(opts.Warning)
+	}
 	if m.cachePath != "" {
 		m.loadCacheFile()
 		if len(m.sourceResults) > 0 {
@@ -1240,7 +1254,7 @@ func (m *Model) showVersions(o provider.Object, key string) tea.Cmd {
 	}
 	m.secrets.SetLoading()
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, o.Container.Source.Kind)
 	return func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1270,7 +1284,7 @@ func (m *Model) countVersions(o provider.Object) tea.Cmd {
 		}
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotVersions)
+	ctx, req := m.begin(slotVersions, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Versions(ctx, o)
 		for i := range items {
@@ -1421,11 +1435,26 @@ func (m *Model) autoLoad(msg sourcesMsg) tea.Cmd {
 	return m.crawlStart()
 }
 
-// begin starts a cancellable request for pane p, cancelling any in flight.
-func (m *Model) begin(p slot) (context.Context, int) {
+// timeouts bound each provider request: its kind's, else the default.
+type timeouts struct {
+	def    time.Duration
+	byKind map[provider.Kind]time.Duration
+}
+
+// of is how long a request to a provider of kind k may take.
+func (t timeouts) of(k provider.Kind) time.Duration {
+	if d, ok := t.byKind[k]; ok {
+		return d
+	}
+	return t.def
+}
+
+// begin starts a cancellable request for pane p to a provider of kind k,
+// cancelling any in flight.
+func (m *Model) begin(p slot, k provider.Kind) (context.Context, int) {
 	m.cancelReq(p)
 	m.seq++
-	ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+	ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(k))
 	m.reqID[p], m.cancel[p] = m.seq, cancel
 	return ctx, m.seq
 }
@@ -1479,7 +1508,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 	gen := m.sourcesGen
 	var cmds []tea.Cmd
 	for _, p := range m.providers {
-		ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 		cmds = append(cmds, func() tea.Msg {
 			defer cancel()
 			s, err := p.Sources(ctx)
@@ -1490,7 +1519,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 		})
 		// The source it started in, quickly, on its own.
 		if c, ok := p.(provider.Current); ok {
-			ctx, cancel := context.WithTimeout(context.Background(), m.timeout)
+			ctx, cancel := context.WithTimeout(context.Background(), m.timeout.of(p.Kind()))
 			cmds = append(cmds, func() tea.Msg {
 				defer cancel()
 				src, ok := c.Current(ctx)
@@ -1507,7 +1536,7 @@ func (m Model) sourcesCmd() tea.Cmd {
 
 func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 	p := m.providerFor(src)
-	ctx, req := m.begin(slotContainers)
+	ctx, req := m.begin(slotContainers, src.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		items, err := p.Containers(ctx, src)
 		// Carry the source as given, with its provider ID, so later
@@ -1526,7 +1555,7 @@ func (m *Model) loadContainers(src provider.Source, key string) tea.Cmd {
 func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key string) tea.Cmd {
 	cands := m.candidates(c.Source)
 	known := len(cands) == 1 && cands[0].ID() == c.Source.Provider
-	ctx, req := m.begin(slotObjects)
+	ctx, req := m.begin(slotObjects, c.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		var errs []error
 		for _, p := range cands {
@@ -1554,7 +1583,7 @@ func (m *Model) loadObjects(c provider.Container, t provider.ObjectType, key str
 
 func (m *Model) fetchValue(s provider.Object) tea.Cmd {
 	p := m.providerFor(s.Container.Source)
-	ctx, req := m.begin(slotValue)
+	ctx, req := m.begin(slotValue, s.Container.Source.Kind)
 	m.detail.SetLoading()
 	return func() tea.Msg {
 		v, err := p.Value(ctx, s)
@@ -1573,7 +1602,7 @@ func (m *Model) describe(o provider.Object) tea.Cmd {
 		m.detail.SetDescribing()
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotDescribe)
+	ctx, req := m.begin(slotDescribe, o.Container.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		obj, err := p.Describe(ctx, o)
 		return describeMsg{req: req, key: key, obj: obj, err: err}
@@ -1601,7 +1630,7 @@ func (m *Model) copyValue() tea.Cmd {
 		return m.copyText(o.Name, v.Reveal(), true)
 	}
 	p := m.providerFor(o.Container.Source)
-	ctx, req := m.begin(slotCopy)
+	ctx, req := m.begin(slotCopy, o.Container.Source.Kind)
 	m.flash = flash{text: "copying " + o.Name + "…"}
 	return func() tea.Msg {
 		v, err := p.Value(ctx, o)

internal/ui/app/commands.go

@@ -165,7 +165,7 @@ func (m *Model) runCommand(c commands.Command, rendered string, obj *provider.Ob
 	o := *obj
 	p := m.providerFor(o.Container.Source)
 	m.flash = flash{text: "fetching " + o.Name + " for " + c.Description + "…"}
-	timeout := m.timeout
+	timeout := m.timeout.of(o.Container.Source.Kind)
 	m.usedObject(o)
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)

internal/ui/app/fields.go

@@ -196,7 +196,7 @@ func (m *Model) loadDetails(c provider.Container) tea.Cmd {
 		}
 	}
 	m.details[key] = detailsState{loading: true}
-	ctx, req := m.begin(slotDetails)
+	ctx, req := m.begin(slotDetails, c.Source.Kind)
 	return m.settled(ctx, func() tea.Msg {
 		attrs, err := d.Details(ctx, c)
 		if ctx.Err() != nil {

internal/ui/app/links.go

@@ -158,7 +158,7 @@ func (m *Model) copyFromRef(r ref.Ref) tea.Cmd {
 		m.flash = flash{text: "copy: no account or profile for " + describeRef(r), isErr: true}
 		return nil
 	}
-	ctx, req := m.begin(slotCopy)
+	ctx, req := m.begin(slotCopy, r.Kind)
 	m.flash = flash{text: "copying " + r.Name + "…"}
 	return func() tea.Msg {
 		var errs []error

internal/ui/app/search.go

@@ -295,10 +295,10 @@ func (m *Model) crawlNext() tea.Cmd {
 }
 
 func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
-	timeout := m.timeout
 	if job.src != nil {
 		p := m.providerFor(*job.src)
 		src := *job.src
+		timeout := m.timeout.of(src.Kind)
 		return func() tea.Msg {
 			ctx, cancel := contextWithTimeout(timeout)
 			defer cancel()
@@ -311,6 +311,7 @@ func (m *Model) crawlCmd(job crawlJob) tea.Cmd {
 	}
 	c := *job.container
 	p := m.providerFor(c.Source)
+	timeout := m.timeout.of(c.Source.Kind)
 	return func() tea.Msg {
 		ctx, cancel := contextWithTimeout(timeout)
 		defer cancel()

internal/ui/app/sharefiles.go

@@ -38,7 +38,7 @@ type shareFilesMsg struct {
 type sealedMsg struct {
 	link ref.Ref
 	n    int
-	// from is the picker the key was picked in; nil for share.key's.
+	// from is the picker the key was picked in; nil for sharing.key's.
 	from *picker
 	err  error
 }
@@ -59,7 +59,7 @@ func (m *Model) shareFiles(src provider.Source, cs []provider.Container) tea.Cmd
 		m.flash = warning("these files can't be shared")
 		return nil
 	}
-	general, timeout := m.shareKey, m.timeout
+	general, timeout := m.shareKey, m.timeout.of(src.Kind)
 	m.flash = flash{text: "reading the files…"}
 	return func() tea.Msg {
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)
@@ -216,7 +216,7 @@ func (m *Model) handleSealed(msg sealedMsg) tea.Cmd {
 func (m *Model) keyReader() func(ref.Ref) (provider.SecretValue, string, error) {
 	providers, st, timeout := m.providers, m.store, m.timeout
 	return func(key ref.Ref) (provider.SecretValue, string, error) {
-		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), timeout.of(key.Kind))
 		defer cancel()
 		k := key
 		k.Version = ""
@@ -258,7 +258,7 @@ func (m *Model) offerShare(r ref.Ref) tea.Cmd {
 // openShare reads the key, decrypts the files and finds the repo's clone.
 func (m *Model) openShare(s share.Sealed) tea.Cmd {
 	read := m.keyReader()
-	providers, timeout := m.providers, m.timeout
+	providers, timeout := m.providers, m.timeout.of(provider.KindRepo)
 	m.flash = flash{text: "decrypting with " + s.Key.Name + "…"}
 	return func() tea.Msg {
 		msg := shareOpenedMsg{sealed: s}

internal/ui/app/sharefiles_test.go

@@ -50,7 +50,7 @@ func shareFrom(t *testing.T, root string, paste bool) string {
 		t.Fatalf("selected %v, want the repo", src.ID)
 	}
 	d.keys("S", "f")
-	// No share.key set: it asks which secret, in Go to, which lists
+	// No sharing.key set: it asks which secret, in Go to, which lists
 	// only secrets.
 	v := d.m.search
 	if v == nil || v.picker == nil {
@@ -137,7 +137,7 @@ func TestShareWithShareKeyConfirms(t *testing.T) {
 	}
 	root := cloneWith(t, map[string]string{
 		".env":              "A=1\n",
-		".lazysecrets.yaml": "share:\n  key: https://" + kv + "/secrets/db-password\n",
+		".lazysecrets.yaml": "sharing:\n  key: https://" + kv + "/secrets/db-password\n",
 	})
 	clip := &fakeClipboard{}
 	d := newDriverOpts(t, Options{Clipboard: clip, ShareRules: demoRules}, fake.Azure(0), repo.New(repo.Settings{Dir: root}))
@@ -218,7 +218,7 @@ func TestShareInDemo(t *testing.T) {
 	}
 	// Too short a key: the picker stays, saying why.
 	d.send(tea.PasteMsg{Content: "https://kv-app-prod.vault.azure.net/secrets/db-password"})
-	if d.m.search == nil || !strings.Contains(d.m.search.picker.err, "Can't use db-password: its value has 28 characters; share.keyRules needs 32 (minLength)") {
+	if d.m.search == nil || !strings.Contains(d.m.search.picker.err, "Can't use db-password: its value has 28 characters; sharing.keyRules needs 32 (minLength)") {
 		t.Fatalf("not said in the picker: %v\n%s", d.m.search != nil, d.screen())
 	}
 	if !strings.Contains(d.screen(), "28 characters") {

internal/ui/app/timeout_test.go

@@ -0,0 +1,25 @@
+package app
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
+)
+
+// A provider's own timeout applies to it alone.
+func TestTimeoutPerProvider(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{Timeout: 5 * time.Second, Timeouts: map[provider.Kind]time.Duration{provider.KindAzure: 10 * time.Millisecond}},
+		fake.Azure(300*time.Millisecond), fake.Databricks(300*time.Millisecond))
+	scr := d.screen()
+	if !strings.Contains(scr, "✗ Azure: context deadline exceeded") || !strings.Contains(scr, "Databricks (…)") ||
+		strings.Contains(scr, "Databricks: context deadline") {
+		t.Errorf("want Azure timed out and Databricks still loading:\n%s", scr)
+	}
+	if got := (timeouts{def: time.Minute}).of(provider.KindRepo); got != time.Minute {
+		t.Errorf("no override: %s, want the default", got)
+	}
+}

internal/ui/app/update.go

@@ -20,7 +20,8 @@ type Updater struct {
 }
 
 // updateEvery is how often lazysecrets looks for a newer release on its
-// own; within that, the last answer (in the state file) is used.
+// own unless the config says otherwise; within that, the last answer (in
+// the state file) is used.
 const updateEvery = 24 * time.Hour
 
 type updateMsg struct {
@@ -35,14 +36,14 @@ type installedMsg struct {
 }
 
 // startUpdateCheck sets up the startup look for a newer release: the
-// state file's answer when it looked less than a day ago, else a quiet
+// state file's answer when it looked within updateEvery, else a quiet
 // look at the server (fetchOnStart, for Init).
 func (m *Model) startUpdateCheck() {
 	if m.updater == nil || !m.updateCheck {
 		return
 	}
 	last := m.store.UpdateCheck()
-	if m.now().Sub(last.At) < updateEvery {
+	if m.now().Sub(last.At) < m.updateEvery {
 		m.offer(update.Release{Tag: last.Tag, Body: last.Notes, URL: last.URL})
 		return
 	}
@@ -109,15 +110,22 @@ func (m *Model) update() tea.Cmd {
 func (m *Model) showUpdate() {
 	r := *m.newer
 	lines := []string{m.st.Muted.Render("You have " + m.versionLabel() + ".")}
-	if notes := r.Notes(); notes != "" {
+	if notes := r.Notes(m.version); notes != "" {
 		lines = append(lines, "")
 		for _, l := range strings.Split(notes, "\n") {
 			if h, ok := strings.CutPrefix(l, "### "); ok {
 				l = m.st.Label.Render(h)
+			} else if h, ok := strings.CutPrefix(l, "## "); ok { // a release, when several are new
+				l = m.st.TitleFocused.Render(h)
 			}
 			lines = append(lines, l)
 		}
 	}
+	// A popup doesn't scroll: several releases behind, the rest is on
+	// the release pages.
+	if most := max(6, m.h-12); len(lines) > most {
+		lines = append(lines[:most-1], m.st.Muted.Render("… and more on the release pages"))
+	}
 	opts := []option{{key: "u", label: "Update now", tip: "Download, check and replace this lazysecrets; restart to use it.",
 		run: func(m *Model) tea.Cmd { return m.install(r) }}}
 	if r.URL != "" {

internal/ui/app/update_test.go

@@ -83,6 +83,12 @@ func TestUpdate(t *testing.T) {
 	if f2.asked != 1 {
 		t.Errorf("asked %d times a day later", f2.asked)
 	}
+	// With autoCheckInterval: 1h, two hours on is long enough.
+	mem.SetUpdateCheck(store.UpdateCheck{At: time.Now().Add(-2 * time.Hour), Tag: "v0.2.0"})
+	newDriverOpts(t, Options{Version: "0.1.1", Updater: f2.updater(), UpdateCheck: true, UpdateEvery: time.Hour, Store: mem})
+	if f2.asked != 2 {
+		t.Errorf("asked %d times, want a look after the hour", f2.asked)
+	}
 }
 
 func TestUpdateAsked(t *testing.T) {
@@ -116,3 +122,11 @@ func TestUpdateAsked(t *testing.T) {
 		t.Errorf("U on a dev build:\n%s", dev.screen())
 	}
 }
+
+func TestStartupWarning(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{Warning: "theme: skipped unknown activeBorder"})
+	if !strings.Contains(d.screen(), "theme: skipped unknown activeBorder") {
+		t.Errorf("no warning:\n%s", d.screen())
+	}
+}

internal/ui/app/usage.go

@@ -8,7 +8,7 @@ import (
 // Usage: revealing, copying, opening in the browser, sharing and jumping
 // to an item count as using it. The store keeps when each item was last
 // used and how often, for the Recent section of the jump list. The config's
-// history: false turns this off.
+// storage.history: false turns this off.
 
 // used counts a use of the remembered item key, keeping its context.
 func (m *Model) used(key string) {

internal/ui/keys/keys.go

@@ -95,7 +95,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "pane3", &m.Pane3, "Secrets pane", "move", "Focus the Secrets pane."),
 		a(Lists, "pane4", &m.Pane4, "detail pane", "move", "Focus the detail pane."),
 		a(Lists, "pane0", &m.Pane0, "status", "move", "Focus the status pane: version and updates, accounts, config files, links and the changelog, on the right."),
-		a(Lists, "enter", &m.Enter, "open", "move", "Go into the selected item: from a subscription to its vaults, from a vault to its secrets. On a provider header, fold or unfold it."),
+		a(Lists, "open", &m.Enter, "open", "move", "Go into the selected item: from a subscription to its vaults, from a vault to its secrets. On a provider header, fold or unfold it."),
 		a(Lists, "back", &m.Back, "back", "move", "Go back: clear an applied filter, leave the versions view, or focus the previous pane."),
 
 		a(Lists, "filter", &m.Filter, "filter", "lists", "Filter the focused list by name, fuzzily: dbpw finds db-password. In Sources the provider and account match too."),
@@ -103,7 +103,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "nextTab", &m.NextTab, "next tab", "lists", "Next tab of the focused pane."),
 		a(Lists, "sourcesView", &m.SourcesView, "grouped/flat sources", "lists", "Switch the Sources pane between grouped by provider and a flat list."),
 		a(Lists, "star", &m.Favourite, "star", "lists", "Star or unstar the selected subscription, vault or secret, for the account showing it. Starred items get a ★ and sort first."),
-		a(Lists, "search", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one. Again in Go to: only the source or group you're in, and back to all. On the left, the scope: All, an account (or Databricks, or Repos), or one source (○ ◐ ● for how much of it is loaded)."),
+		a(Lists, "goTo", &m.Search, "search", "lists", "Go to anything: search every vault and secret loaded and jump to one. Again in Go to: only the source or group you're in, and back to all. On the left, the scope: All, an account (or Databricks, or Repos), or one source (○ ◐ ● for how much of it is loaded)."),
 		a(Lists, "favourites", &m.Favourites, "favourites", "lists", "Go to, on Favourites: everything you've starred, to search and jump to."),
 		a(Lists, "recent", &m.Recent, "recent", "lists", "Go to, on Recent: what you used last, newest first."),
 		a(Lists, "commands", &m.Commands, "commands", "lists", "List the custom commands for the focused pane (customCommands in the config) and run one."),
@@ -116,7 +116,7 @@ func (m *Map) Actions() []Action {
 		a(Lists, "openInBrowser", &m.Open, "open in browser", "secrets", "Open the selected subscription, vault or item in the browser (Azure portal or Databricks workspace)."),
 		a(Lists, "edit", &m.Edit, "open file", "secrets", "Open the selected SOPS or .env file, or the file of the selected secret at its line; on the status pane, your config (made if it isn't there yet). SOPS files open with sops edit. Others open in the nvim lazysecrets runs in (quitting lazysecrets), else in $VISUAL or $EDITOR, else in the system's default app."),
 
-		a(Lists, "share", &m.Share, "copy link", "share", "Copy a lazysecrets:// link to the selected subscription, workspace, vault, scope or secret, for sharing. From the versions view the link is pinned to that version."),
+		a(Lists, "copyLink", &m.Share, "copy link", "share", "Copy a lazysecrets:// link to the selected subscription, workspace, vault, scope or secret, for sharing. From the versions view the link is pinned to that version."),
 		a(Lists, "shareMenu", &m.ShareMenu, "share", "share", "Choose what to share: the lazysecrets link, the plain Key Vault URL, the config reference, the web page, or env files as an encrypted link."),
 		a(Lists, "openLink", &m.OpenRef, "open link", "share", "Open a lazysecrets:// link, Key Vault URL or reference. Pasting one into lazysecrets does the same."),
 
@@ -184,13 +184,13 @@ var defaults = map[string][]string{
 	"lists.top": {"g", "home"}, "lists.bottom": {"G", "end"},
 	"lists.nextPane": {"tab"}, "lists.prevPane": {"shift+tab", "h", "left"}, "lists.details": {"l", "right"},
 	"lists.pane1": {"1"}, "lists.pane2": {"2"}, "lists.pane3": {"3"}, "lists.pane4": {"4"}, "lists.pane0": {"0"},
-	"lists.enter": {"enter"}, "lists.back": {"esc", "backspace"},
+	"lists.open": {"enter"}, "lists.back": {"esc", "backspace"},
 	"lists.filter": {"/"}, "lists.prevTab": {"["}, "lists.nextTab": {"]"}, "lists.sourcesView": {"`"},
-	"lists.star": {"f"}, "lists.favourites": {"F"}, "lists.recent": {"R"}, "lists.search": {"ctrl+s"}, "lists.note": {"n"},
+	"lists.star": {"f"}, "lists.favourites": {"F"}, "lists.recent": {"R"}, "lists.goTo": {"ctrl+s"}, "lists.note": {"n"},
 	"lists.commands": {"x"},
 	"lists.reveal":   {"space"}, "lists.copyValue": {"y"}, "lists.copyReference": {"Y"},
 	"lists.versions": {"v"}, "lists.openInBrowser": {"o"}, "lists.edit": {"e"},
-	"lists.share": {"s"}, "lists.shareMenu": {"S"}, "lists.openLink": {"ctrl+o"},
+	"lists.copyLink": {"s"}, "lists.shareMenu": {"S"}, "lists.openLink": {"ctrl+o"},
 	"lists.dividerLeft": {"ctrl+left", "<"}, "lists.dividerRight": {"ctrl+right", ">"},
 	"lists.taller": {"ctrl+down", "}"}, "lists.shorter": {"ctrl+up", "{"},
 	"lists.zoomIn": {"+"}, "lists.zoomOut": {"_"}, "lists.resetLayout": {"="},

internal/ui/styles/theme.go

@@ -45,7 +45,9 @@ var Roles = map[string]string{
 }
 
 // FromTheme returns the default styles with the theme's roles applied, and
-// the default text colour if the theme sets one.
+// the default text colour if the theme sets one. Roles it doesn't know are
+// skipped (see Unknown): a theme file made for a newer lazysecrets still
+// works.
 func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 	st := Default()
 	var fg color.Color
@@ -56,7 +58,7 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 	sort.Strings(roles)
 	for _, role := range roles {
 		if _, ok := Roles[role]; !ok {
-			return st, nil, fmt.Errorf("theme: unknown role %q (known: %s)", role, strings.Join(sortedRoles(), ", "))
+			continue
 		}
 		v, err := parse(theme[role])
 		if err != nil {
@@ -107,13 +109,20 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 	return st, fg, nil
 }
 
-func sortedRoles() []string {
-	var out []string
-	for r := range Roles {
-		out = append(out, r)
+// Unknown says which of the theme's roles aren't known, for a warning, or
+// is empty.
+func Unknown(theme map[string][]string) string {
+	var unknown []string
+	for r := range theme {
+		if _, ok := Roles[r]; !ok {
+			unknown = append(unknown, r)
 		}
-	slices.Sort(out)
-	return out
+	}
+	if len(unknown) == 0 {
+		return ""
+	}
+	slices.Sort(unknown)
+	return "theme: skipped unknown " + strings.Join(unknown, ", ") + " (a typo, or from a newer lazysecrets)"
 }
 
 // value is a parsed role: a colour (nil for default) and attributes.

internal/ui/styles/theme_test.go

@@ -44,19 +44,29 @@ func TestFromTheme(t *testing.T) {
 
 func TestFromThemeRejectsMistakes(t *testing.T) {
 	for name, theme := range map[string]map[string][]string{
-		"role":    {"activeBorder": {"red"}},
 		"colour":  {"errorColor": {"redish"}},
 		"hex":     {"errorColor": {"#fff"}},
 		"palette": {"errorColor": {"300"}},
 	} {
 		if _, _, err := FromTheme(theme); err == nil {
 			t.Errorf("%s: no error", name)
-		} else if name == "role" && !strings.Contains(err.Error(), "activeBorderColor") {
-			t.Errorf("unknown role error should list the known ones: %v", err)
 		}
 	}
 }
 
+func TestUnknownRolesSkipped(t *testing.T) {
+	theme := map[string][]string{"activeBorder": {"red"}, "errorColor": {"red"}}
+	if _, _, err := FromTheme(theme); err != nil {
+		t.Errorf("unknown role failed the theme: %v", err)
+	}
+	if w := Unknown(theme); !strings.Contains(w, "unknown activeBorder ") || strings.Contains(w, "errorColor") {
+		t.Errorf("warning = %q", w)
+	}
+	if w := Unknown(map[string][]string{"errorColor": {"red"}}); w != "" {
+		t.Errorf("warning for known roles: %q", w)
+	}
+}
+
 func TestEmptyThemeIsDefault(t *testing.T) {
 	st, fg, err := FromTheme(nil)
 	if err != nil || fg != nil || st.Selected.GetReverse() || st.Selected.GetBackground() != lipgloss.BrightBlack {

internal/update/update.go

@@ -28,6 +28,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"slices"
 	"strings"
 	"time"
 
@@ -54,17 +55,43 @@ const maxDownload = 200 << 20
 // Release is a published release.
 type Release struct {
 	Tag string `json:"tag_name"`
-	Body string `json:"body"` // the changelog section, then install notes
+	// Body is the changelog section, then install notes. From Latest,
+	// it's the changelogs of the recent releases, each under a "## v…"
+	// heading, so someone a few versions behind sees all they missed.
+	Body       string `json:"body"`
 	URL        string `json:"html_url"`
+	Draft      bool   `json:"draft"`
+	Prerelease bool   `json:"prerelease"`
 }
 
-// Notes is the release's changelog: its body without the install notes
-// every release ends with.
-func (r Release) Notes() string {
-	notes, _, _ := strings.Cut(r.Body, "## Install")
+// Notes is the changelog since the version current: of each release
+// newer than it (just this one for a dev build), without the install
+// notes every release ends with.
+func (r Release) Notes(current string) string {
+	body, _, _ := strings.Cut(r.Body, "## Install")
+	var keep, headings []string
+	in := true // before any heading: a single release's notes
+	for _, l := range strings.Split(body, "\n") {
+		if tag, ok := strings.CutPrefix(l, "## "); ok && semver.IsValid(tag) {
+			in = Newer(current, tag) || tag == r.Tag
+			if in {
+				headings = append(headings, l)
+			}
+		}
+		if in {
+			keep = append(keep, l)
+		}
+	}
+	notes := strings.Join(keep, "\n")
+	if len(headings) == 1 { // the title names it
+		notes = strings.Replace(notes, headings[0], "", 1)
+	}
 	return PlainLinks(strings.TrimSpace(notes))
 }
 
+// recentReleases is how many releases Latest reads the changelogs of.
+const recentReleases = 10
+
 // PlainLinks shows Markdown links as their text, for a terminal.
 func PlainLinks(s string) string { return mdLink.ReplaceAllString(s, "$1") }
 
@@ -128,18 +155,29 @@ func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
 	}
 	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
 	defer cancel()
-	b, err := c.get(ctx, api+"/releases/latest", 1<<20)
+	// The recent releases in one request (per_page on GitHub, limit on
+	// Gitea), for their changelogs.
+	b, err := c.get(ctx, fmt.Sprintf("%s/releases?per_page=%d&limit=%[2]d", api, recentReleases), 1<<20)
 	if err != nil {
 		return Release{}, err
 	}
-	var r Release
-	if err := json.Unmarshal(b, &r); err != nil {
-		return Release{}, fmt.Errorf("reading the latest release from %s: %w", repo, err)
+	var all []Release
+	if err := json.Unmarshal(b, &all); err != nil {
+		return Release{}, fmt.Errorf("reading the releases from %s: %w", repo, err)
 	}
-	if !semver.IsValid(r.Tag) {
-		return Release{}, fmt.Errorf("latest release %q on %s isn't a version", r.Tag, repo)
+	all = slices.DeleteFunc(all, func(r Release) bool { return r.Draft || r.Prerelease || !semver.IsValid(r.Tag) })
+	if len(all) == 0 {
+		return Release{}, fmt.Errorf("no releases on %s", repo)
 	}
-	return r, nil
+	slices.SortFunc(all, func(a, b Release) int { return semver.Compare(b.Tag, a.Tag) })
+	var notes strings.Builder
+	for _, r := range all {
+		section, _, _ := strings.Cut(r.Body, "## Install")
+		fmt.Fprintf(&notes, "## %s\n\n%s\n\n", r.Tag, strings.TrimSpace(section))
+	}
+	latest := all[0]
+	latest.Body = strings.TrimSpace(notes.String())
+	return latest, nil
 }
 
 // Newer reports whether latest is newer than current. A build that isn't

internal/update/update_test.go

@@ -39,11 +39,42 @@ func TestNewer(t *testing.T) {
 
 func TestNotes(t *testing.T) {
 	r := Release{Body: "### Added\n\n- Install with a one-liner (#7)\n\n## Install\n\nOn macOS…"}
-	if got := r.Notes(); got != "### Added\n\n- Install with a one-liner (#7)" {
+	if got := r.Notes("0.1.1"); got != "### Added\n\n- Install with a one-liner (#7)" {
 		t.Errorf("notes %q", got)
 	}
 }
 
+// Latest reads the recent releases, so the notes cover every version
+// since the one running.
+func TestNotesSince(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/keb/lazysecrets/releases" {
+			http.NotFound(w, r)
+			return
+		}
+		fmt.Fprint(w, `[
+			{"tag_name":"v0.4.0-rc1","body":"### Added\n\n- rc","prerelease":true},
+			{"tag_name":"v0.2.0","body":"### Added\n\n- two\n\n## Install\n\ncurl"},
+			{"tag_name":"v0.3.0","body":"### Fixed\n\n- three\n\n## Install\n\ncurl","html_url":"https://example.com/v0.3.0"},
+			{"tag_name":"v0.1.1","body":"### Added\n\n- one"},
+			{"tag_name":"v9.0.0","body":"draft","draft":true}]`)
+	}))
+	t.Cleanup(srv.Close)
+	r, err := (&Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}).Latest(context.Background())
+	if err != nil || r.Tag != "v0.3.0" || r.URL != "https://example.com/v0.3.0" {
+		t.Fatalf("latest %+v %v", r, err)
+	}
+	for current, want := range map[string]string{
+		"0.1.1":       "## v0.3.0\n\n### Fixed\n\n- three\n\n## v0.2.0\n\n### Added\n\n- two",
+		"0.2.0":       "### Fixed\n\n- three",
+		"dev-2ba762c": "### Fixed\n\n- three",
+	} {
+		if got := r.Notes(current); got != want {
+			t.Errorf("notes since %s: %q, want %q", current, got, want)
+		}
+	}
+}
+
 func TestManaged(t *testing.T) {
 	if Managed("/opt/homebrew/Cellar/lazysecrets/0.2.0/bin/lazysecrets") == "" || Managed("/nix/store/abc-lazysecrets/bin/lazysecrets") == "" {
 		t.Error("package managers not recognised")
@@ -70,8 +101,8 @@ func server(t *testing.T, tamper bool) *httptest.Server {
 		sum[0] ^= 0xff
 	}
 	mux := http.NewServeMux()
-	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
-		fmt.Fprint(w, `{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}`)
+	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases", func(w http.ResponseWriter, _ *http.Request) {
+		fmt.Fprint(w, `[{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}]`)
 	})
 	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintf(w, "%s  %s.tar.gz\n", hex.EncodeToString(sum[:]), name)
@@ -173,7 +204,7 @@ func TestInstallRefusesATamperedArchive(t *testing.T) {
 
 func TestNotesShowLinksAsText(t *testing.T) {
 	r := Release{Body: "### Added\n\n- Search ([#11](https://git.example.com/pulls/11)) ([65dc2d7](https://git.example.com/commit/65dc2d7abc))\n\n## Install\n\ncurl …"}
-	if got, want := r.Notes(), "### Added\n\n- Search (#11) (65dc2d7)"; got != want {
+	if got, want := r.Notes("0.1.1"), "### Added\n\n- Search (#11) (65dc2d7)"; got != want {
 		t.Errorf("notes %q, want %q", got, want)
 	}
 }