refactor: drop dead code and use the standard library where it already does the job

No behaviour change.

- Deleted, unused or one-line wrappers: panes.RuneIndexes, Detail.Refresh (SetDescribed does it), SecretValue.Len, Query.Empty, Clipboard.Native, config.Load, get's value, Model.done, providerOf (cachefile.ProviderOf), contextWithTimeout, searchCoverage, startCrawl, showKeybindings, the expiry aliases and daysLeft.
- cmp.Or instead of the two cmpOr copies; slices.Sorted(maps.Keys(…)), maps.Copy, wg.Go, utf8.RuneCountInString and new(true) instead of loops and helpers that do the same.
- A container's pane title is set once, not twice; a redundant length check in share links and a no-op assignment in linkhandler.Launch are gone.
- Tests call ansi.Strip and lastLines directly; gofmt -s on links.go.

CHANGELOG.md

@@ -2,12 +2,6 @@
 
 Every release of lazysecrets, newest first.
 
-## v0.2.1 – 2026-10-15
-
-### Fixed
-
-- A link opens lazysecrets with your cache and next to your running instances ([#71](https://git.kebcloud.no/keb/lazysecrets/pulls/71)) ([bb41767](https://git.kebcloud.no/keb/lazysecrets/commit/bb41767cbad00bab4f1824f4e0754cc7abd98c59))
-
 ## v0.2.0 – 2026-10-14
 
 ### Added

cmd/lazysecrets/handler.go

@@ -69,7 +69,11 @@ func installHandler(cfg config.Config, configPath, term string) (string, string,
 	if _, err := launchCommand(cfg, configPath, term, exe, "lazysecrets://check"); err != nil {
 		return "", "", err
 	}
-	launch := append(append([]string{exe}, configArgs(configPath)...), "launch")
+	launch := []string{exe}
+	if configPath != defaultConfigPath() {
+		launch = append(launch, "--config", configPath)
+	}
+	launch = append(launch, "launch")
 	if term != "" {
 		launch = append(launch, "--terminal", term)
 	}
@@ -184,14 +188,8 @@ func launchCommand(cfg config.Config, configPath, term, exe, link string) ([]str
 // innerCommand runs lazysecrets on link, with the environment it needs.
 func innerCommand(configPath, exe, link string) []string {
 	inner := append(append([]string{"/usr/bin/env"}, linkhandler.Env(os.Getenv)...), exe)
-	inner = append(inner, configArgs(configPath)...)
+	if configPath != defaultConfigPath() {
+		inner = append(inner, "--config", configPath)
+	}
 	return append(inner, "open", link)
 }
-
-// configArgs passes the config files on, unless they're the default.
-func configArgs(configPath string) []string {
-	if configPath == defaultConfigPath() {
-		return nil
-	}
-	return []string{"--config", configPath}
-}

cmd/lazysecrets/main.go

@@ -171,22 +171,26 @@ Flags:
 		return nil
 	}
 
-	sub := "" // the subcommand; "" browses
-	var subArgs []string
-	var open *ref.Ref
-	var getRef ref.Ref
+	var open, getRef *ref.Ref
 	var openAction string
+	var shareArgs, listArgs []string
+	printKeys := false
 	switch args := flag.Args(); {
-	case len(args) > 0 && (args[0] == "share" || args[0] == "list"):
-		sub, subArgs = args[0], args[1:]
+	case len(args) > 0 && args[0] == "share":
+		shareArgs = args[1:]
+		if len(shareArgs) == 0 {
+			shareArgs = []string{} // still sharing: says how
+		}
+	case len(args) > 0 && args[0] == "list":
+		listArgs = append([]string{}, args[1:]...) // not nil: listing
 	case len(args) == 1 && args[0] == "keybindings":
-		sub = "keybindings"
+		printKeys = true
 	case len(args) > 0 && args[0] == "get":
 		r, _, err := refArg("get", args[1:])
 		if err != nil {
 			return err
 		}
-		sub, getRef = "get", r
+		getRef = &r
 	case len(args) > 0 && args[0] == "handler":
 		return handler(*configPath, args[1:])
 	case len(args) > 0 && args[0] == "launch":
@@ -232,7 +236,7 @@ Flags:
 	if err := checkCommandKeys(&keymap, cfg.CustomCommands); err != nil {
 		return err
 	}
-	if sub == "keybindings" {
+	if printKeys {
 		fmt.Print(keymap.YAML())
 		return nil
 	}
@@ -260,13 +264,25 @@ Flags:
 	}
 	// timeoutFor is how long a request to a provider of kind k may take.
 	timeoutFor := func(k provider.Kind) time.Duration { return cmp.Or(timeouts[k], *timeout) }
-	if !set["clipboard-clear"] {
-		*clipClear = valueOr(cfg.Values.ClipboardClear, *clipClear)
+	if !set["clipboard-clear"] && cfg.Values.ClipboardClear != nil {
+		*clipClear = *cfg.Values.ClipboardClear
+	}
+	expiryDays := 30
+	if cfg.UI.ExpiryWarningDays != nil {
+		expiryDays = *cfg.UI.ExpiryWarningDays
+	}
+	revealTimeout := 60 * time.Second
+	if cfg.Values.RevealTimeout != nil {
+		revealTimeout = *cfg.Values.RevealTimeout
+	}
+	loadDelay := 150 * time.Millisecond
+	if cfg.UI.LoadDelay != nil {
+		loadDelay = *cfg.UI.LoadDelay
+	}
+	var updateEvery time.Duration // 0: the app's default, a day
+	if cfg.Updates.AutoCheckInterval != nil {
+		updateEvery = *cfg.Updates.AutoCheckInterval
 	}
-	expiryWarning := time.Duration(valueOr(cfg.UI.ExpiryWarningDays, 30)) * 24 * time.Hour
-	revealTimeout := valueOr(cfg.Values.RevealTimeout, 60*time.Second)
-	loadDelay := valueOr(cfg.UI.LoadDelay, 150*time.Millisecond)
-	updateEvery := valueOr(cfg.Updates.AutoCheckInterval, 0) // 0: the app's default, a day
 	if !set["icons"] {
 		switch {
 		case os.Getenv("LAZYSECRETS_ICONS") != "":
@@ -276,17 +292,7 @@ Flags:
 		}
 	}
 
-	recentIcon := valueOr(cfg.UI.RecentIcon, false)
-
-	startDir := *dir
-	if startDir == "" {
-		startDir, _ = os.Getwd()
-	}
-	// What was loaded last time.
-	cacheFile := ""
-	if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
-		cacheFile = filepath.Join(d, "cache.json")
-	}
+	recentIcon := cfg.UI.RecentIcon != nil && *cfg.UI.RecentIcon
 
 	// Stars, notes and the layout. Demo mode keeps them in memory, so
 	// sample vaults never end up in the real file.
@@ -344,9 +350,17 @@ Flags:
 			providers = append(providers, dbx)
 		}
 		if config.On(pc.Repos.Enabled) {
+			start := *dir
+			if start == "" {
+				start, _ = os.Getwd()
+			}
+			roots := repo.DefaultRoots
+			if pc.Repos.Roots != nil {
+				roots = *pc.Repos.Roots
+			}
 			repos := repo.New(repo.Settings{
-				Dir: startDir, Paths: pc.Repos.Paths, Roots: valueOr(pc.Repos.Roots, repo.DefaultRoots),
-				Starred: starredRepos(st), Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
+				Dir: start, Paths: pc.Repos.Paths, Roots: roots, Starred: starredRepos(st),
+				Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
 			})
 			// The repo it started in (shown on top as Repo) and the
 			// others, checked for secret files in the background like
@@ -362,14 +376,19 @@ Flags:
 	// the standard logger, which would draw over the TUI.
 	log.SetOutput(io.Discard)
 
-	switch sub {
-	case "get":
+	if getRef != nil {
 		ctx, cancel := context.WithTimeout(context.Background(), timeoutFor(getRef.Kind))
 		defer cancel()
-		return get(ctx, providers, st, getRef)
-	case "list":
-		return listCmd(providers, st, cacheFile, timeoutFor, theme, *icons, recentIcon, expiryWarning, subArgs, os.Stdout)
-	case "share":
+		return get(ctx, providers, st, *getRef)
+	}
+	if listArgs != nil {
+		cachePath := ""
+		if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
+			cachePath = filepath.Join(d, "cache.json")
+		}
+		return listCmd(providers, st, cachePath, timeoutFor, theme, *icons, recentIcon, time.Duration(expiryDays)*24*time.Hour, listArgs, os.Stdout)
+	}
+	if shareArgs != nil {
 		// The files from a repo, the key from whichever provider it's
 		// in: the longest timeout.
 		d := *timeout
@@ -378,7 +397,7 @@ Flags:
 		}
 		ctx, cancel := context.WithTimeout(context.Background(), d)
 		defer cancel()
-		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), subArgs, os.Stdout)
+		return shareFiles(ctx, providers, st, cfg.Sharing.Key, shareRules(cfg), shareArgs, os.Stdout)
 	}
 
 	// Links opened elsewhere (lazysecrets launch) can come here.
@@ -412,10 +431,16 @@ Flags:
 		onActive = srv.Touch
 	}
 
-	// Where it was left in this folder.
-	placeDir := ""
+	// What was loaded last time, and where it was left in this folder.
+	var cacheFile, placeDir string
 	if !*demo {
-		placeDir = startDir
+		if d, err := config.CacheDir(); err == nil && config.On(cfg.Storage.Cache) {
+			cacheFile = filepath.Join(d, "cache.json")
+		}
+		placeDir = *dir
+		if placeDir == "" {
+			placeDir, _ = os.Getwd()
+		}
 		if abs, err := filepath.Abs(placeDir); err == nil {
 			placeDir = abs
 		}
@@ -432,7 +457,7 @@ Flags:
 		NoHistory:      !config.On(cfg.Storage.History),
 		OnActive:       onActive,
 		RevealTimeout:  revealTimeout,
-		ExpiryWarning:  expiryWarning,
+		ExpiryWarning:  time.Duration(expiryDays) * 24 * time.Hour,
 		HideOnBlur:     config.On(cfg.Values.HideOnBlur),
 		HandlerSetup:   setup,
 		Updater:        updater(cfg.Updates.Sources),
@@ -465,14 +490,6 @@ Flags:
 	return err
 }
 
-// valueOr is *p, or def when p is nil (not set in the config).
-func valueOr[T any](p *T, def T) T {
-	if p == nil {
-		return def
-	}
-	return *p
-}
-
 // configFiles are the config files given, for the status pane: those
 // that exist, or the first if none does (where to create one).
 func configFiles(list string) []string {

cmd/lazysecrets/update.go

@@ -3,7 +3,6 @@ package main
 import (
 	"context"
 	"errors"
-	"flag"
 	"fmt"
 	"strings"
 	"time"
@@ -33,12 +32,8 @@ func updater(servers []string) *app.Updater {
 // updateCmd is lazysecrets update [--check]: the newer release's
 // changelog, then (unless --check) install it.
 func updateCmd(configPath string, args []string) error {
-	fs := flag.NewFlagSet("update", flag.ContinueOnError)
-	check := fs.Bool("check", false, "just say if there's a newer release")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if fs.NArg() != 0 {
+	check := len(args) == 1 && args[0] == "--check"
+	if len(args) > 0 && !check {
 		return errors.New("usage: lazysecrets update [--check]")
 	}
 	cfg, err := config.LoadAll(strings.Split(configPath, ","))
@@ -54,14 +49,14 @@ func updateCmd(configPath string, args []string) error {
 		return fmt.Errorf("looking for a newer lazysecrets: %w", err)
 	}
 	if !update.Newer(current, r.Tag) {
-		if strings.HasPrefix(current, "dev") {
+		if !update.Newer(current, "v999.0.0") {
 			return fmt.Errorf("this is a development build (%s); the latest release is %s: install it with install.sh, or go install …@%s", current, r.Tag, r.Tag)
 		}
 		fmt.Printf("lazysecrets %s is the latest (%s)\n", current, r.Tag)
 		return nil
 	}
 	fmt.Printf("lazysecrets %s is out (you have %s):\n\n%s\n\n", r.Tag, current, indent(r.Notes(current)))
-	if *check {
+	if check {
 		fmt.Println("lazysecrets update installs it.")
 		return nil
 	}

cmd/lazysecrets/version.go

@@ -3,6 +3,7 @@ package main
 import (
 	"regexp"
 	"runtime/debug"
+	"strings"
 )
 
 // version is set by release builds:
@@ -30,7 +31,7 @@ func versionString() string {
 		// go install …@<commit>.
 		if m := pseudo.FindStringSubmatch(v); m != nil {
 			dirty := ""
-			if m[2] != "" {
+			if strings.HasSuffix(v, "+dirty") {
 				dirty = "-dirty"
 			}
 			return "dev-" + m[1][:7] + dirty

internal/instance/instance.go

@@ -35,18 +35,15 @@ func Dir(stateDir string) string {
 type Status struct {
 	PID        int       `json:"pid"`
 	LastActive time.Time `json:"lastActive"` // last key press or focus
-	Reach      int       `json:"reach"`      // how readily it can be shown: unreachable, switchable or inView
+	// Reach is how readily it can be shown: 2 in view (outside tmux, or
+	// in a tmux session a client shows), 1 in a tmux session that a tmux
+	// client can be switched to, 0 not at all.
+	Reach int `json:"reach"`
 	// App is the terminal app it would show in (macOS), preferring the
 	// app the link was clicked in.
 	App string `json:"app,omitempty"`
 }
 
-const (
-	unreachable = 0
-	switchable  = 1 // in a tmux session that a tmux client can be switched to
-	inView      = 2 // outside tmux, or in a tmux session a client shows
-)
-
 type request struct {
 	Op    string `json:"op"` // "status" or "open"
 	Link  string `json:"link,omitempty"`
@@ -190,7 +187,7 @@ func Best(found []Found, front string, terminal bool) (Found, bool) {
 			best = f
 		}
 	}
-	return best, best.Reach > unreachable
+	return best, best.Reach > 0
 }
 
 // Open hands link, clicked in front, to f.

internal/instance/tmux.go

@@ -1,7 +1,6 @@
 package instance
 
 import (
-	"cmp"
 	"os"
 	"os/exec"
 	"slices"
@@ -26,8 +25,7 @@ func tmux(args ...string) (string, error) {
 func inTmux() bool { return os.Getenv("TMUX") != "" && os.Getenv("TMUX_PANE") != "" }
 
 type client struct {
-	name, session string
-	activity      int // Unix seconds
+	name, session, activity string // activity: Unix seconds
 	pid                     int
 	app                     string
 }
@@ -44,31 +42,30 @@ func clients() []client {
 		if len(f) < 4 {
 			continue
 		}
-		activity, err1 := strconv.Atoi(f[0])
-		pid, err2 := strconv.Atoi(f[1])
-		if err1 != nil || err2 != nil {
+		pid, err := strconv.Atoi(f[1])
+		if err != nil {
 			continue
 		}
-		cs = append(cs, client{name: f[2], session: f[3], activity: activity, pid: pid, app: linkhandler.HostApp(pid)})
+		cs = append(cs, client{name: f[2], session: f[3], activity: f[0], pid: pid, app: linkhandler.HostApp(pid)})
 	}
-	slices.SortStableFunc(cs, func(a, b client) int { return cmp.Compare(b.activity, a.activity) })
+	// Activity has the same width for centuries: strings compare like
+	// numbers.
+	slices.SortStableFunc(cs, func(a, b client) int { return strings.Compare(b.activity, a.activity) })
 	return cs
 }
 
 // place is where this instance would show: the tmux client (zero outside
-// tmux), the app, and its reach.
+// tmux), the app, and reach: 2 already on screen there (outside tmux, or
+// a client on its session), 1 after switching a client, 0 nowhere.
 func place(front string) (client, string, int) {
 	if !inTmux() {
-		return client{}, linkhandler.HostApp(os.Getpid()), inView
+		return client{}, linkhandler.HostApp(os.Getpid()), 2
 	}
 	session, err := tmux("display-message", "-p", "-t", os.Getenv("TMUX_PANE"), "#{session_name}")
 	if err != nil {
-		return client{}, "", unreachable
+		return client{}, "", 0
 	}
 	cs := clients()
-	if len(cs) == 0 {
-		return client{}, "", unreachable
-	}
 	// Best first: in the front app on its session, in the front app,
 	// on its session, any.
 	rank := func(c client) int {
@@ -81,16 +78,20 @@ func place(front string) (client, string, int) {
 		}
 		return r
 	}
-	best := cs[0]
-	for _, c := range cs[1:] {
-		if rank(c) > rank(best) {
-			best = c
+	var best client
+	found := false
+	for _, c := range cs {
+		if !found || rank(c) > rank(best) {
+			best, found = c, true
 		}
 	}
+	if !found {
+		return client{}, "", 0
+	}
 	if best.session == session {
-		return best, best.app, inView
+		return best, best.app, 2
 	}
-	return best, best.app, switchable
+	return best, best.app, 1
 }
 
 // Raise brings this instance into view for a link clicked in front: in
@@ -98,14 +99,14 @@ func place(front string) (client, string, int) {
 // then its app to the front, showing a hidden dropdown terminal.
 func Raise(front string) {
 	c, app, reach := place(front)
-	if reach == unreachable {
+	if reach == 0 {
 		return
 	}
 	if inTmux() {
 		pane := os.Getenv("TMUX_PANE")
 		_, _ = tmux("select-window", "-t", pane)
 		_, _ = tmux("select-pane", "-t", pane)
-		if reach == switchable {
+		if reach == 1 {
 			_, _ = tmux("switch-client", "-c", c.name, "-t", pane)
 		}
 	}

internal/provider/azure/azure.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph"
@@ -100,7 +99,13 @@ func (p *Provider) Label() string { return cmp.Or(p.label, string(provider.KindA
 // Sources lists the subscriptions the signed-in identity can see, skipping
 // disabled and deleted ones.
 func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
-	out, err := all(ctx, p.subs.NewListPager(nil), func(page armsubscriptions.ClientListResponse) (srcs []provider.Source) {
+	var out []provider.Source
+	pager := p.subs.NewListPager(nil)
+	for pager.More() {
+		page, err := pager.NextPage(ctx)
+		if err != nil {
+			return nil, cleanError(err)
+		}
 		for _, s := range page.Value {
 			switch deref(s.State) {
 			case armsubscriptions.SubscriptionStateDisabled, armsubscriptions.SubscriptionStateDeleted:
@@ -113,7 +118,7 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 			p.mu.Lock()
 			p.tenants[id] = tenant
 			p.mu.Unlock()
-			srcs = append(srcs, provider.Source{
+			out = append(out, provider.Source{
 				Kind:   provider.KindAzure,
 				ID:     id,
 				Name:   deref(s.DisplayName),
@@ -121,10 +126,6 @@ func (p *Provider) Sources(ctx context.Context) ([]provider.Source, error) {
 				URL:    PortalResourceURL(tenant, "/subscriptions/"+id, "overview"),
 			})
 		}
-		return srcs
-	})
-	if err != nil {
-		return nil, err
 	}
 	slices.SortFunc(out, func(a, b provider.Source) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	if len(p.opts.Vaults) > 0 {
@@ -229,29 +230,22 @@ func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provid
 	if err != nil {
 		return nil, err
 	}
-	return all(ctx, client.NewListBySubscriptionPager(nil), func(page armkeyvault.VaultsClientListBySubscriptionResponse) (vaults []provider.Container) {
-		for _, v := range page.Value {
-			if v.Properties == nil || v.Properties.VaultURI == nil {
-				continue
-			}
-			vaults = append(vaults, provider.Container{
-				Source: src, ID: deref(v.ID), Name: deref(v.Name),
-				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
-			})
-		}
-		return vaults
-	})
-}
-
-// all lists every page, items picking out what to keep of each.
-func all[P, T any](ctx context.Context, pager *runtime.Pager[P], items func(P) []T) ([]T, error) {
-	var out []T
+	var out []provider.Container
+	pager := client.NewListBySubscriptionPager(nil)
 	for pager.More() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return nil, cleanError(err)
 		}
-		out = append(out, items(page)...)
+		for _, v := range page.Value {
+			if v.Properties == nil || v.Properties.VaultURI == nil {
+				continue
+			}
+			out = append(out, provider.Container{
+				Source: src, ID: deref(v.ID), Name: deref(v.Name),
+				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
+			})
+		}
 	}
 	return out, nil
 }
@@ -294,40 +288,51 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 	var out []provider.Object
 	switch t {
 	case provider.TypeSecret:
-		tenant := p.tenant(c.Source.ID)
-		out, err = all(ctx, vc.secrets.NewListSecretPropertiesPager(nil), func(page azsecrets.ListSecretPropertiesResponse) (objs []provider.Object) {
+		pager := vc.secrets.NewListSecretPropertiesPager(nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, s := range page.Value {
 				// Certificate-backing secrets appear under Certificates.
-				if s.ID != nil && !deref(s.Managed) {
-					objs = append(objs, secretObject(c, s, tenant))
+				if s.ID == nil || deref(s.Managed) {
+					continue
+				}
+				out = append(out, secretObject(c, s, p.tenant(c.Source.ID)))
 			}
 		}
-			return objs
-		})
 	case provider.TypeKey:
-		out, err = all(ctx, vc.keys.NewListKeyPropertiesPager(nil), func(page azkeys.ListKeyPropertiesResponse) (objs []provider.Object) {
+		pager := vc.keys.NewListKeyPropertiesPager(nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, k := range page.Value {
-				if k.KID != nil && !deref(k.Managed) {
-					objs = append(objs, keyObject(c, k))
+				if k.KID == nil || deref(k.Managed) {
+					continue
+				}
+				out = append(out, keyObject(c, k))
 			}
 		}
-			return objs
-		})
 	case provider.TypeCertificate:
-		out, err = all(ctx, vc.certs.NewListCertificatePropertiesPager(nil), func(page azcertificates.ListCertificatePropertiesResponse) (objs []provider.Object) {
+		pager := vc.certs.NewListCertificatePropertiesPager(nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, cp := range page.Value {
-				if cp.ID != nil {
-					objs = append(objs, certObject(c, cp))
+				if cp.ID == nil {
+					continue
+				}
+				out = append(out, certObject(c, cp))
 			}
 		}
-			return objs
-		})
 	default:
 		return nil, provider.ErrUnsupported
 	}
-	if err != nil {
-		return nil, err
-	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name)) })
 	return out, nil
 }
@@ -348,7 +353,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		if resp.Key != nil {
 			if resp.Key.KID != nil {
 				o.Version = resp.Key.KID.Version()
-				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.Key.KID))
+				o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Key", string(*resp.Key.KID))
 			}
 			o.Attrs = keyAttrs(resp.Key)
 		}
@@ -359,7 +364,7 @@ func (p *Provider) Describe(ctx context.Context, o provider.Object) (provider.Ob
 		}
 		if resp.ID != nil {
 			o.Version = resp.ID.Version()
-			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), o.Type, string(*resp.ID))
+			o.URL = portalAssetURL(p.tenant(o.Container.Source.ID), "Certificate", string(*resp.ID))
 		}
 		if pol := resp.Policy; pol != nil && pol.SecretProperties != nil {
 			o.ContentType = deref(pol.SecretProperties.ContentType)
@@ -376,46 +381,56 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	if err != nil {
 		return nil, err
 	}
-	tenant := p.tenant(o.Container.Source.ID)
 	var out []provider.Object
 	switch o.Type {
 	case provider.TypeSecret:
-		out, err = all(ctx, vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil), func(page azsecrets.ListSecretPropertiesVersionsResponse) (objs []provider.Object) {
+		pager := vc.secrets.NewListSecretPropertiesVersionsPager(o.Name, nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, s := range page.Value {
 				if s.ID != nil {
-					objs = append(objs, secretObject(o.Container, s, tenant))
+					out = append(out, secretObject(o.Container, s, p.tenant(o.Container.Source.ID)))
+				}
 			}
 		}
-			return objs
-		})
 	case provider.TypeKey:
-		out, err = all(ctx, vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil), func(page azkeys.ListKeyPropertiesVersionsResponse) (objs []provider.Object) {
+		pager := vc.keys.NewListKeyPropertiesVersionsPager(o.Name, nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, k := range page.Value {
 				if k.KID != nil {
-					objs = append(objs, keyObject(o.Container, k))
+					out = append(out, keyObject(o.Container, k))
+				}
 			}
 		}
-			return objs
-		})
 	case provider.TypeCertificate:
-		out, err = all(ctx, vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil), func(page azcertificates.ListCertificatePropertiesVersionsResponse) (objs []provider.Object) {
+		pager := vc.certs.NewListCertificatePropertiesVersionsPager(o.Name, nil)
+		for pager.More() {
+			page, err := pager.NextPage(ctx)
+			if err != nil {
+				return nil, cleanError(err)
+			}
 			for _, cp := range page.Value {
 				if cp.ID != nil {
-					objs = append(objs, certObject(o.Container, cp))
+					out = append(out, certObject(o.Container, cp))
+				}
 			}
 		}
-			return objs
-		})
 	default:
 		return nil, provider.ErrUnsupported
 	}
-	if err != nil {
-		return nil, err
-	}
+	tenant := p.tenant(o.Container.Source.ID)
 	for i := range out {
 		out[i].Reference = versionedReference(out[i])
 		if o.Type != provider.TypeSecret { // secretObject's is the version's already
-			out[i].URL = portalAssetURL(tenant, o.Type, out[i].ID+"/"+out[i].Version) // the version's page
+			kind := map[provider.ObjectType]string{provider.TypeKey: "Key", provider.TypeCertificate: "Certificate"}[o.Type]
+			out[i].URL = portalAssetURL(tenant, kind, out[i].ID+"/"+out[i].Version) // the version's page
 		}
 	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return b.Updated.Compare(a.Updated) })
@@ -437,19 +452,47 @@ func versionedReference(o provider.Object) string {
 // Value returns a secret's value, a key's public key or a certificate's
 // public certificate, as of o.Version (latest if empty).
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
+	vc, err := p.clients(o.Container.Detail)
+	if err != nil {
+		return provider.SecretValue{}, err
+	}
+	switch o.Type {
+	case provider.TypeSecret:
 		v, _, err := p.VersionedValue(ctx, o)
 		return v, err
+	case provider.TypeKey:
+		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
+		if err != nil {
+			return provider.SecretValue{}, cleanError(err)
+		}
+		pemKey, err := publicKeyPEM(resp.Key)
+		if err != nil {
+			return provider.SecretValue{}, err
+		}
+		return provider.NewSecretValue([]byte(pemKey)), nil
+	case provider.TypeCertificate:
+		resp, err := vc.certs.GetCertificate(ctx, o.Name, o.Version, nil)
+		if err != nil {
+			return provider.SecretValue{}, cleanError(err)
+		}
+		if len(resp.CER) == 0 {
+			return provider.SecretValue{}, errors.New("certificate has no public certificate yet (pending issuance?)")
+		}
+		return provider.NewSecretValue([]byte(certPEM(resp.CER))), nil
+	}
+	return provider.SecretValue{}, provider.ErrUnsupported
 }
 
 // VersionedValue is Value, with the version read.
 func (p *Provider) VersionedValue(ctx context.Context, o provider.Object) (provider.SecretValue, string, error) {
+	if o.Type != provider.TypeSecret {
+		v, err := p.Value(ctx, o)
+		return v, o.Version, err
+	}
 	vc, err := p.clients(o.Container.Detail)
 	if err != nil {
 		return provider.SecretValue{}, "", err
 	}
-	var text string
-	switch o.Type {
-	case provider.TypeSecret:
 	resp, err := vc.secrets.GetSecret(ctx, o.Name, o.Version, nil)
 	if err != nil {
 		return provider.SecretValue{}, "", cleanError(err)
@@ -459,27 +502,6 @@ func (p *Provider) VersionedValue(ctx context.Context, o provider.Object) (provi
 		version = resp.ID.Version()
 	}
 	return provider.NewSecretValue([]byte(deref(resp.Value))), version, nil
-	case provider.TypeKey:
-		resp, err := vc.keys.GetKey(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, "", cleanError(err)
-		}
-		if text, err = publicKeyPEM(resp.Key); err != nil {
-			return provider.SecretValue{}, "", err
-		}
-	case provider.TypeCertificate:
-		resp, err := vc.certs.GetCertificate(ctx, o.Name, o.Version, nil)
-		if err != nil {
-			return provider.SecretValue{}, "", cleanError(err)
-		}
-		if len(resp.CER) == 0 {
-			return provider.SecretValue{}, "", errors.New("certificate has no public certificate yet (pending issuance?)")
-		}
-		text = certPEM(resp.CER)
-	default:
-		return provider.SecretValue{}, "", provider.ErrUnsupported
-	}
-	return provider.NewSecretValue([]byte(text)), o.Version, nil
 }
 
 var (

internal/provider/azure/convert.go

@@ -55,8 +55,8 @@ func PortalResourceURL(tenant, resourceID, blade string) string {
 
 // portalAssetURL links to a Key Vault object's page: a version's with
 // one in objectID; a secret's own (its versions) without.
-func portalAssetURL(tenant string, t provider.ObjectType, objectID string) string {
-	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + string(t) + "/" + objectID
+func portalAssetURL(tenant, kind, objectID string) string {
+	return portal + tenantPrefix(tenant) + "asset/Microsoft_Azure_KeyVault/" + kind + "/" + objectID
 }
 
 func tenantPrefix(tenant string) string {
@@ -73,13 +73,19 @@ func ObjectListURL(c provider.Container, t provider.ObjectType) string {
 	if !ok {
 		return ""
 	}
-	return base + "/" + t.Collection()
+	switch t {
+	case provider.TypeKey:
+		return base + "/keys"
+	case provider.TypeCertificate:
+		return base + "/certificates"
+	}
+	return base + "/secrets"
 }
 
 // objectURL is the data-plane URL of an object, e.g.
 // https://kv.vault.azure.net/secrets/name.
-func objectURL(c provider.Container, t provider.ObjectType, name string) string {
-	return strings.TrimSuffix(c.Detail, "/") + "/" + t.Collection() + "/" + name
+func objectURL(c provider.Container, collection, name string) string {
+	return strings.TrimSuffix(c.Detail, "/") + "/" + collection + "/" + name
 }
 
 // secretObject is a secret, or a version of one, from a listing. Its URL
@@ -87,7 +93,7 @@ func objectURL(c provider.Container, t provider.ObjectType, name string) string
 // a version, that version's.
 func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant string) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, provider.TypeSecret, name)
+	url := objectURL(c, "secrets", name)
 	o := provider.Object{
 		Container:   c,
 		Type:        provider.TypeSecret,
@@ -97,7 +103,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant st
 		ContentType: deref(p.ContentType),
 		Tags:        tags(p.Tags),
 		Reference:   "@Microsoft.KeyVault(SecretUri=" + url + ")",
-		URL:         portalAssetURL(tenant, provider.TypeSecret, strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
+		URL:         portalAssetURL(tenant, "Secret", strings.TrimSuffix(url+"/"+p.ID.Version(), "/")),
 	}
 	if a := p.Attributes; a != nil {
 		o.Enabled, o.Updated, o.Expires = a.Enabled, deref(a.Updated), deref(a.Expires)
@@ -107,7 +113,7 @@ func secretObject(c provider.Container, p *azsecrets.SecretProperties, tenant st
 
 func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 	name := p.KID.Name()
-	url := objectURL(c, provider.TypeKey, name)
+	url := objectURL(c, "keys", name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeKey,
@@ -126,7 +132,7 @@ func keyObject(c provider.Container, p *azkeys.KeyProperties) provider.Object {
 
 func certObject(c provider.Container, p *azcertificates.CertificateProperties) provider.Object {
 	name := p.ID.Name()
-	url := objectURL(c, provider.TypeCertificate, name)
+	url := objectURL(c, "certificates", name)
 	o := provider.Object{
 		Container: c,
 		Type:      provider.TypeCertificate,

internal/provider/azure/details.go

@@ -71,10 +71,13 @@ func graphInfo(m map[string]any) vaultInfo {
 
 // armInfo reads a vault's settings from the management API.
 func armInfo(v *armkeyvault.Vault) vaultInfo {
-	info := vaultInfo{location: deref(v.Location), tags: tags(v.Tags)}
+	info := vaultInfo{location: deref(v.Location), tags: map[string]string{}}
 	if id, err := arm.ParseResourceID(deref(v.ID)); err == nil {
 		info.group = id.ResourceGroupName
 	}
+	for k, t := range v.Tags {
+		info.tags[k] = deref(t)
+	}
 	pr := v.Properties
 	if pr == nil {
 		return info
@@ -120,11 +123,7 @@ func (v vaultInfo) attrs() []provider.Attr {
 	} else {
 		add("soft delete", "off")
 	}
-	if on(v.purge, false) {
-		add("purge prot.", "on")
-	} else {
-		add("purge prot.", "off")
-	}
+	add("purge prot.", map[bool]string{true: "on", false: "off"}[on(v.purge, false)])
 	switch {
 	case strings.EqualFold(v.publicAccess, "disabled"):
 		add("network", "private endpoints only")
@@ -133,11 +132,8 @@ func (v vaultInfo) attrs() []provider.Attr {
 	default:
 		add("network", "all networks")
 	}
-	switch {
-	case v.endpoints == 1:
-		add("private", "1 endpoint")
-	case v.endpoints > 1:
-		add("private", fmt.Sprintf("%d endpoints", v.endpoints))
+	if v.endpoints > 0 {
+		add("private", fmt.Sprintf("%d endpoint%s", v.endpoints, map[bool]string{true: "s"}[v.endpoints > 1]))
 	}
 	for i, k := range slices.Sorted(maps.Keys(v.tags)) {
 		label := ""

internal/provider/databricks/databricks.go

@@ -203,20 +203,17 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 	return out, nil
 }
 
-// fallbackVault is the backing vault of an AKV-backed scope, to read it
-// from when Databricks fails, or "" when there's none to fall back to. It
-// falls back to the scope's Detail, so a scope remembered from an earlier
-// session (a favourite) works before its workspace's scopes are listed.
-func (p *Provider) fallbackVault(ctx context.Context, c provider.Container) string {
-	if p.keyVault == nil || ctx.Err() != nil {
-		return ""
-	}
+// vaultURL is the backing vault of an AKV-backed scope, or "". It falls
+// back to the scope's Detail, so a scope remembered from an earlier session
+// (a favourite) works before its workspace's scopes are listed.
+func (p *Provider) vaultURL(c provider.Container) string {
 	p.mu.Lock()
 	url := p.vaults[c.ID]
 	p.mu.Unlock()
 	if url == "" {
-		if detail, ok := strings.CutPrefix(c.Detail, akvDetail); ok {
-			url = detail
+		url, _ = strings.CutPrefix(c.Detail, akvDetail)
+		if url == c.Detail {
+			url = ""
 		}
 	}
 	return url
@@ -267,8 +264,8 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 
 // vaultObjects lists an AKV-backed scope's secrets from the vault itself.
 func (p *Provider) vaultObjects(ctx context.Context, c provider.Container) ([]provider.Object, error) {
-	url := p.fallbackVault(ctx, c)
-	if url == "" {
+	url := p.vaultURL(c)
+	if url == "" || p.keyVault == nil || ctx.Err() != nil {
 		return nil, errNoFallback
 	}
 	secrets, err := p.keyVault.Objects(ctx, provider.Container{Detail: url}, provider.TypeSecret)
@@ -305,8 +302,8 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	}
 	dbxErr := classify(pr, err)
 
-	url := p.fallbackVault(ctx, o.Container)
-	if url == "" {
+	url := p.vaultURL(o.Container)
+	if url == "" || p.keyVault == nil || ctx.Err() != nil {
 		return provider.SecretValue{}, dbxErr
 	}
 	v, kvErr := p.keyVault.Value(ctx, provider.Object{

internal/provider/fake/fake.go

@@ -225,7 +225,9 @@ func (p *Provider) add(c provider.Container, t provider.ObjectType, o provider.O
 	o.Type = t
 	o.ID = c.ID + "/" + strings.ToLower(string(t)) + "/" + o.Name
 	if base, ok := strings.CutSuffix(c.URL, "/overview"); ok {
-		o.URL = base + "/" + t.Collection()
+		o.URL = base + map[provider.ObjectType]string{
+			provider.TypeSecret: "/secrets", provider.TypeKey: "/keys", provider.TypeCertificate: "/certificates",
+		}[t]
 	}
 	k := listKey{c.ID, t}
 	p.objects[k] = append(p.objects[k], o)
@@ -254,13 +256,12 @@ const (
 
 var allTypes = []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate}
 
-func secretRef(vault, name string) string {
-	return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
-}
-
 // Azure returns a fake Azure provider with two subscriptions.
 func Azure(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
+	secretRef := func(vault, name string) string {
+		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
+	}
 	objectURL := func(vault, kind, name string) string {
 		return fmt.Sprintf("https://%s.vault.azure.net/%s/%s", vault, kind, name)
 	}
@@ -372,6 +373,9 @@ func Azure(delay time.Duration) *Provider {
 // its own, like an admin account next to a personal one.
 func AzureOps(delay time.Duration) *Provider {
 	p := newProvider(provider.KindAzure, delay)
+	secretRef := func(vault, name string) string {
+		return fmt.Sprintf("@Microsoft.KeyVault(SecretUri=https://%s.vault.azure.net/secrets/%s)", vault, name)
+	}
 
 	prod := p.addSource("sub-prod", "platform-prod", "tenant: example.onmicrosoft.com")
 	breakGlass := p.addContainer(prod, "kv-breakglass", "https://kv-breakglass.vault.azure.net", allTypes...)

internal/provider/provider.go

@@ -84,20 +84,6 @@ const (
 	TypeCertificate ObjectType = "Certificate"
 )
 
-// Collection is the type's path segment in Key Vault URLs and links, e.g.
-// "secrets".
-func (t ObjectType) Collection() string {
-	switch t {
-	case TypeSecret:
-		return "secrets"
-	case TypeKey:
-		return "keys"
-	case TypeCertificate:
-		return "certificates"
-	}
-	return ""
-}
-
 // Container holds objects: a Key Vault or a Databricks secret scope.
 type Container struct {
 	Source Source

internal/provider/repo/repo.go

@@ -356,23 +356,30 @@ func (p *Provider) Objects(_ context.Context, c provider.Container, t provider.O
 	if err != nil {
 		return nil, err
 	}
-	meta, isSops := parseMeta(c.ID, b)
+	meta, isSops := readMeta(c.ID)
 	keys, err := parseKeys(c.ID, b)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", c.Name, err)
 	}
-	attrs := []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}}
-	if isSops {
-		attrs = []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}}
+	if !isSops { // a plain env file
+		out := make([]provider.Object, 0, len(keys))
+		for _, k := range keys {
+			out = append(out, provider.Object{
+				Container: c, Type: provider.TypeSecret, ID: c.ID + "\x00" + k.extract, Name: k.name,
+				Attrs: []provider.Attr{{Label: "format", Value: "env"}, {Label: "encrypted", Value: "no: plain text in the file"}},
+			})
+		}
+		return out, nil
 	}
 	out := make([]provider.Object, 0, len(keys))
 	for _, k := range keys {
 		o := provider.Object{
 			Container: c, Type: provider.TypeSecret,
-			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified, Attrs: attrs,
+			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified,
+			Attrs: []provider.Attr{{Label: "format", Value: "sops " + formatOf(c.ID)}, {Label: "encryption", Value: strings.Join(meta.methods, ", ")}},
 		}
-		if isSops && !k.encrypted {
-			o.Attrs = append(slices.Clip(attrs), provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
+		if !k.encrypted {
+			o.Attrs = append(o.Attrs, provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
 		}
 		out = append(out, o)
 	}
@@ -391,7 +398,10 @@ func (p *Provider) Versions(context.Context, provider.Object) ([]provider.Object
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	file, extract, ok := strings.Cut(o.ID, "\x00")
 	if !ok { // made from a link: the repo's root, the file's path, the key
-		file = filePath(o.Container)
+		file = o.Container.ID
+		if file == "" {
+			file = filepath.Join(o.Container.Source.ID, filepath.FromSlash(o.Container.Name))
+		}
 		extract = extractFor(file, o.Name)
 	}
 	if _, isSops := readMeta(file); !isSops {
@@ -419,18 +429,12 @@ func (p *Provider) Contents(_ context.Context, c provider.Container) ([]byte, er
 	return os.ReadFile(f.Path)
 }
 
-// filePath is the file c is. A container made from a link has no ID: the
-// file is its path in the repo.
-func filePath(c provider.Container) string {
-	if c.ID != "" {
-		return c.ID
-	}
-	return filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
-}
-
 // File is the file c is, and the line o's key is on.
 func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File, error) {
-	path := filePath(c)
+	path := c.ID
+	if path == "" { // made from a link
+		path = filepath.Join(c.Source.ID, filepath.FromSlash(c.Name))
+	}
 	f := provider.File{Path: path}
 	if _, isSops := readMeta(path); isSops {
 		f.Sops = p.s.Sops
@@ -600,39 +604,34 @@ type lazysecretsFile struct {
 
 // ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
 func ShareKey(root string) (string, error) {
-	f, err := readLazysecretsFile(root)
-	return f.Sharing.Key, err
-}
-
-// readLazysecretsFile reads the repo's .lazysecrets.yaml; without one, it's
-// empty.
-func readLazysecretsFile(root string) (lazysecretsFile, error) {
-	var f lazysecretsFile
 	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
 	if errors.Is(err, os.ErrNotExist) {
-		return f, nil
+		return "", nil
 	}
 	if err != nil {
-		return f, err
+		return "", err
 	}
+	var f lazysecretsFile
 	if err := yaml.Unmarshal(b, &f); err != nil {
-		return f, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
+		return "", fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
 	}
-	return f, nil
+	return f.Sharing.Key, nil
 }
 
 // selector says which files to look at: user (the include/exclude of the
 // repo's .lazysecrets.yaml or the config) for every file, and sopsWhere
 // (.sops.yaml's creation_rules, when there's no include) for SOPS files.
 func (p *Provider) selector(root string, files []string) (user, sopsWhere func(string) bool, err error) {
-	f, err := readLazysecretsFile(root)
-	if err != nil {
-		return nil, nil, err
-	}
 	include, exclude := p.s.Include, p.s.Exclude
+	if b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml")); err == nil {
+		var f lazysecretsFile
+		if err := yaml.Unmarshal(b, &f); err != nil {
+			return nil, nil, fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
+		}
 		if len(f.Include) > 0 || len(f.Exclude) > 0 {
 			include, exclude = f.Include, f.Exclude
 		}
+	}
 	inc, err := globs(include)
 	if err != nil {
 		return nil, nil, err
@@ -903,21 +902,12 @@ func readMeta(file string) (sopsMeta, bool) {
 		return sopsMeta{}, false // not a format sops writes: skip reading
 	}
 	b, err := os.ReadFile(file)
-	if err != nil {
-		return sopsMeta{}, false
-	}
-	return parseMeta(file, b)
-}
-
-// parseMeta is readMeta, of the file's contents b.
-func parseMeta(file string, b []byte) (sopsMeta, bool) {
-	format := formatOf(file)
-	if len(b) > maxFileSize || format == "" || !bytes.Contains(b, []byte("sops")) {
+	if err != nil || !bytes.Contains(b, []byte("sops")) {
 		return sopsMeta{}, false // cheap: most files aren't sops, no parsing
 	}
 	var m sopsMeta
 	known := []string{"age", "azure_kv", "kms", "gcp_kms", "hc_vault", "pgp"}
-	switch format {
+	switch formatOf(file) {
 	case "yaml", "json":
 		var doc struct {
 			Sops map[string]any `yaml:"sops"`

internal/ref/ref.go

@@ -92,9 +92,15 @@ func (r Ref) ContainerName() string {
 // Container.Detail.
 func (r Ref) VaultURL() string { return "https://" + r.Host + "/" }
 
+var collections = map[provider.ObjectType]string{
+	provider.TypeSecret:      "secrets",
+	provider.TypeKey:         "keys",
+	provider.TypeCertificate: "certificates",
+}
+
 func typeOf(collection string) (provider.ObjectType, bool) {
-	for _, t := range []provider.ObjectType{provider.TypeSecret, provider.TypeKey, provider.TypeCertificate} {
-		if strings.EqualFold(t.Collection(), collection) {
+	for t, c := range collections {
+		if strings.EqualFold(c, collection) {
 			return t, true
 		}
 	}
@@ -112,7 +118,7 @@ func (r Ref) IdentifierURL() string {
 	if r.Type == "" {
 		return u + "/"
 	}
-	for _, seg := range []string{r.Type.Collection(), r.Name, r.Version} {
+	for _, seg := range []string{collections[r.Type], r.Name, r.Version} {
 		if seg != "" {
 			u += "/" + url.PathEscape(seg)
 		}
@@ -134,7 +140,7 @@ func (r Ref) String() string {
 		segs = append(segs, r.Scope, r.Name)
 	default:
 		if r.Type != "" {
-			segs = append(segs, r.Type.Collection())
+			segs = append(segs, collections[r.Type])
 		}
 		segs = append(segs, r.Name, r.Version)
 	}
@@ -267,7 +273,7 @@ func parseLink(s string) (Ref, error) {
 	r.Host = strings.ToLower(segs[0])
 	rest := segs[1:]
 
-	switch host := strings.ToLower(u.Host); host {
+	switch strings.ToLower(u.Host) {
 	case "azure":
 		r.Kind = provider.KindAzure
 		if r.Host == "subscriptions" {
@@ -294,11 +300,11 @@ func parseLink(s string) (Ref, error) {
 		}
 	case "databricks", "repo":
 		r.Kind = provider.KindDatabricks
-		if host == "repo" {
+		if strings.EqualFold(u.Host, "repo") {
 			r.Kind = provider.KindRepo
 		}
 		if len(rest) > 2 {
-			return Ref{}, fmt.Errorf("%s link has too many parts", host)
+			return Ref{}, fmt.Errorf("%s link has too many parts", strings.ToLower(u.Host))
 		}
 		if len(rest) > 0 {
 			r.Scope = rest[0]

internal/share/rules.go

@@ -48,11 +48,7 @@ func (r Rules) Check(key []byte) error {
 		needs = append(needs, fmt.Sprintf("%d (minLength)", r.MinLength))
 	}
 	if kinds < r.MinClasses {
-		kind := "kinds"
-		if kinds == 1 {
-			kind = "kind"
-		}
-		has = append(has, fmt.Sprintf("%d %s of character", kinds, kind))
+		has = append(has, fmt.Sprintf("%d %s of character", kinds, map[bool]string{true: "kind", false: "kinds"}[kinds == 1]))
 		needs = append(needs, fmt.Sprintf("%d of lowercase, uppercase, digits and symbols (minClasses)", r.MinClasses))
 	}
 	if len(has) == 0 {

internal/ui/app/app.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"image/color"
+	"math"
 	"os"
 	"os/exec"
 	"strings"
@@ -724,7 +725,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if m.versionsOf != nil {
 				m.setVersions(msg.items)
 			} else {
-				m.secrets.SetItems(m.starredObjectsFirst(msg.items))
+				m.secrets.SetItems(m.starredFirst(msg.items))
 				cmds = append(cmds, m.refreshShown(before))
 			}
 		}
@@ -1256,7 +1257,7 @@ func (m *Model) showObjects(c provider.Container, key string) tea.Cmd {
 		m.secrets.SetLoading()
 		return m.loadObjects(c, m.objType, key)
 	}
-	m.secrets.SetItems(m.starredObjectsFirst(e.value))
+	m.secrets.SetItems(m.starredFirst(e.value))
 	m.secrets.Select(m.cache.cursor[key])
 	if e.fresh(m.now()) {
 		return nil
@@ -1675,8 +1676,12 @@ func (m *Model) copyText(label, text string, sensitive bool) tea.Cmd {
 
 // clipTick fires when the countdown's displayed second next changes.
 func (m *Model) clipTick() tea.Cmd {
+	wait := m.clipDeadline.Sub(m.now()) % time.Second
+	if wait <= 0 {
+		wait = time.Second
+	}
 	token := m.clipToken
-	return tea.Tick(untilNextSecond(m.clipDeadline, m.now()), func(time.Time) tea.Msg { return clipTickMsg{token: token} })
+	return tea.Tick(wait, func(time.Time) tea.Msg { return clipTickMsg{token: token} })
 }
 
 func (m *Model) cancelClipClear() {
@@ -1783,15 +1788,13 @@ func (m Model) footerView() string {
 	} else if l != nil && l.Filtering() {
 		help = m.helpBar(keys.FilterHelp{Map: m.keys}.ShortHelp(), 2)
 	} else {
-		reveal := "show"
-		if m.detail.State() == panes.ValueShown {
-			reveal = "hide"
-		}
-		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), reveal: reveal}.ShortHelp(), 2)
+		revealed := m.detail.State() == panes.ValueShown
+		help = m.helpBar(contextHelp{k: m.keys, focus: m.focus, of: m.detailOf(), commands: len(m.commandsHere()) > 0, account: m.fields.Shown(), revealed: &revealed}.ShortHelp(), 2)
 	}
 	var lines []string
 	if !m.clipDeadline.IsZero() {
-		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, secondsLeft(m.clipDeadline, m.now())))))
+		left := max(0, int(math.Ceil(m.clipDeadline.Sub(m.now()).Seconds())))
+		lines = append(lines, m.flashLine(done(fmt.Sprintf("copied %s · clipboard clears in %ds", m.clipLabel, left))))
 	}
 	if m.flash.text != "" {
 		lines = append(lines, m.flashLine(m.flash))

internal/ui/app/commands.go

@@ -306,6 +306,3 @@ func newTextInput(prompt string, width int) textinput.Model {
 	in.SetWidth(width)
 	return in
 }
-
-// pathInputWidth fits a link or a folder path in a prompt, in the window.
-func (m Model) pathInputWidth() int { return max(20, min(m.w-12, 64)) }

internal/ui/app/favourites.go

@@ -116,7 +116,7 @@ func (m Model) containerRender(withSource bool) func(styles.Styles, provider.Con
 		line = marks(sty, n, c.Source.Provider, m.recentIcon, m.now()) + line
 		if withSource {
 			src := c.Source.Name
-			if account := accountOf(c.Source); account != "" {
+			if account, ok := strings.CutPrefix(c.Source.ProviderLabel, string(c.Source.Kind)+" · "); ok {
 				src = account + " / " + src
 			}
 			line += sty.Muted.Render(" · " + src)
@@ -144,36 +144,24 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 	}
 }
 
-// starredFirst moves starred items to the front, keeping the order
-// otherwise. It doesn't modify items, which may be cached.
-func starredFirst[T any](items []T, starred func(T) bool) []T {
-	rank := func(x T) int {
-		if starred(x) {
-			return 0
-		}
-		return 1
-	}
+// starredContainersFirst moves starred vaults and scopes to the front,
+// keeping the order otherwise. It doesn't modify items, which may be cached.
+func (m Model) starredContainersFirst(items []provider.Container) []provider.Container {
 	out := slices.Clone(items)
-	slices.SortStableFunc(out, func(a, b T) int { return rank(a) - rank(b) })
+	slices.SortStableFunc(out, func(a, b provider.Container) int {
+		return boolRank(m.store.Node(storeKey(a)).StarredFor(a.Source.Provider)) - boolRank(m.store.Node(storeKey(b)).StarredFor(b.Source.Provider))
+	})
 	return out
 }
 
-func (m Model) starredSourcesFirst(sources []provider.Source) []provider.Source {
-	return starredFirst(sources, func(s provider.Source) bool {
-		return m.store.Node(sourceKey(s)).StarredFor(s.Provider)
-	})
-}
-
-func (m Model) starredContainersFirst(items []provider.Container) []provider.Container {
-	return starredFirst(items, func(c provider.Container) bool {
-		return m.store.Node(storeKey(c)).StarredFor(c.Source.Provider)
-	})
-}
-
-func (m Model) starredObjectsFirst(items []provider.Object) []provider.Object {
-	return starredFirst(items, func(o provider.Object) bool {
-		return m.store.Node(objectKey(o)).StarredFor(o.Container.Source.Provider)
+// starredFirst moves starred objects to the front, keeping the order
+// otherwise. It doesn't modify items, which may be cached.
+func (m Model) starredFirst(items []provider.Object) []provider.Object {
+	out := slices.Clone(items)
+	slices.SortStableFunc(out, func(a, b provider.Object) int {
+		return boolRank(m.store.Node(objectKey(a)).StarredFor(a.Container.Source.Provider)) - boolRank(m.store.Node(objectKey(b)).StarredFor(b.Container.Source.Provider))
 	})
+	return out
 }
 
 // showLinkedContainers lists the vaults opened from links.
@@ -211,7 +199,7 @@ func (m *Model) resortStarred() {
 		m.containers.SetItems(m.starredContainersFirst(m.containers.Items()))
 	}
 	if m.versionsOf == nil {
-		m.secrets.SetItems(m.starredObjectsFirst(m.secrets.Items()))
+		m.secrets.SetItems(m.starredFirst(m.secrets.Items()))
 	}
 }
 
@@ -257,7 +245,7 @@ func (m *Model) toggleFavourite() tea.Cmd {
 		c := o.Container
 		toggle := func(n *store.Node) { on = n.ToggleStar(c.Source.Provider) }
 		if err = m.remember(objectKey(o), o.Name, []string{c.Source.Name, c.Name}, c.Source, toggle); err == nil {
-			m.secrets.SetItems(m.starredObjectsFirst(m.secrets.Items()))
+			m.secrets.SetItems(m.starredFirst(m.secrets.Items()))
 		}
 	}
 	switch {

internal/ui/app/help.go

@@ -39,9 +39,10 @@ type contextHelp struct {
 	commands bool // custom commands apply here
 	account  bool // the fourth pane shows Fields (fields.go)
 	of       pane // what the fourth pane describes
-	// reveal, when set, is what the reveal key will do, "show" or "hide":
-	// the same width so the bar doesn't shift.
-	reveal string
+	// revealed, when set, says whether the selected value is shown, so
+	// the reveal key says just what it'll do: show or hide, the same
+	// width so the bar doesn't shift.
+	revealed *bool
 }
 
 func (c contextHelp) ShortHelp() []key.Binding {
@@ -69,8 +70,8 @@ func (c contextHelp) ShortHelp() []key.Binding {
 		b = append(b, k.Enter, k.Share, k.ShareMenu, k.Favourite, k.Open, k.Filter)
 	default:
 		reveal := k.Reveal
-		if c.reveal != "" {
-			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, c.reveal))
+		if c.revealed != nil {
+			reveal = key.NewBinding(key.WithKeys(k.Reveal.Keys()...), key.WithHelp(k.Reveal.Help().Key, map[bool]string{false: "show", true: "hide"}[*c.revealed]))
 		}
 		b = append(b, reveal, k.Copy, k.Share, k.ShareMenu, k.Versions, k.Favourite, k.Filter)
 	}
@@ -258,7 +259,11 @@ func hint(b key.Binding, desc string) keyHint { return keyHint{keys.Name(b), des
 
 // move is "↑/↓ move" for an up and a down binding.
 func move(up, down key.Binding) keyHint {
-	return keyHint{joinKeys(up, down), "move"}
+	u, d := keys.Name(up), keys.Name(down)
+	if u == "" || d == "" {
+		return keyHint{u + d, "move"}
+	}
+	return keyHint{u + "/" + d, "move"}
 }
 
 // withKey fills a hint's format with the binding's key ("· %s loads

internal/ui/app/jump.go

@@ -199,7 +199,18 @@ func (m *Model) jumpTo(r ref.Ref, n store.Node) tea.Cmd {
 		m.startNav(r, actGo, sourceRowKey(n.Account, n.Source))
 		return nil
 	}
-	choices := m.openWith(r.Kind, func(src provider.Source) bool { return src.ID == n.Source && n.Source != "" })
+	var choices []choice
+	for _, p := range m.providers {
+		if p.Kind() != r.Kind {
+			continue
+		}
+		for _, src := range m.sourceResults[p.ID()].sources {
+			if src.ID == n.Source && n.Source != "" {
+				row := sourceRowKey(p.ID(), src.ID)
+				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
+			}
+		}
+	}
 	switch len(choices) {
 	case 0:
 		return m.openRef(r, actGo)

internal/ui/app/links.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/cachefile"
@@ -209,7 +210,18 @@ const defaultResolveTimeout = 30 * time.Second
 // openSource goes to a subscription or workspace, asking which account
 // when several list it. Sources are loaded already, so it needs no lookup.
 func (m *Model) openSource(r ref.Ref) {
-	choices := m.openWith(r.Kind, func(src provider.Source) bool { return sourceMatches(r, src) })
+	var choices []choice
+	for _, p := range m.providers {
+		if p.Kind() != r.Kind {
+			continue
+		}
+		for _, src := range m.sourceResults[p.ID()].sources {
+			if sourceMatches(r, src) {
+				row := sourceRowKey(p.ID(), src.ID)
+				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
+			}
+		}
+	}
 	if row, ok := preferredRow(r, choices); ok {
 		choices = []choice{{sourceRow: row}}
 	}
@@ -231,24 +243,6 @@ func (m *Model) openSource(r ref.Ref) {
 	}
 }
 
-// openWith offers each loaded source of kind that matches, one per
-// account that lists it.
-func (m Model) openWith(kind provider.Kind, matches func(provider.Source) bool) []choice {
-	var choices []choice
-	for _, p := range m.providers {
-		if p.Kind() != kind {
-			continue
-		}
-		for _, src := range m.sourceResults[p.ID()].sources {
-			if matches(src) {
-				row := sourceRowKey(p.ID(), src.ID)
-				choices = append(choices, choice{label: "Open with " + m.sourceLabel(row), sourceRow: row})
-			}
-		}
-	}
-	return choices
-}
-
 // refLabel draws what a link points at like the favourites list: the
 // provider's icon and the path in its colour, "󰠅 platform-prod /
 // kv-app-prod / api-key", with the type and version after it. The
@@ -837,8 +831,10 @@ func (m *Model) shareObject(o provider.Object, k string) tea.Cmd {
 }
 
 func (m *Model) startOpenPrompt() tea.Cmd {
-	in := newTextInput("open: ", m.pathInputWidth())
+	in := textinput.New()
+	in.Prompt = "open: "
 	in.Placeholder = "lazysecrets:// link, Key Vault URL or reference"
+	in.SetWidth(max(20, min(m.w-12, 64)))
 	m.prompt = &modal{
 		title: "Open a link", input: &in,
 		lines:  []string{m.st.Muted.Render("lazysecrets:// link, Key Vault URL or reference")},

internal/ui/app/modal.go

@@ -75,8 +75,10 @@ type modal struct {
 
 // showFilterMenu opens a menu with a filter input above the options.
 func (m *Model) showFilterMenu(title string, options []option) tea.Cmd {
-	in := newTextInput("/", 40)
+	in := textinput.New()
+	in.Prompt = "/"
 	in.Placeholder = "type to filter"
+	in.SetWidth(40)
 	m.prompt = &modal{title: title, options: options, all: options, filter: &in}
 	m.prompt.move(0)
 	m.flash = flash{}

internal/ui/app/notes.go

@@ -3,6 +3,7 @@ package app
 import (
 	"strings"
 
+	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
@@ -57,9 +58,11 @@ func (m *Model) editNote() tea.Cmd {
 		c := o.Container
 		key, name, path, src = objectKey(o), o.Name, []string{c.Source.Name, c.Name}, c.Source
 	}
-	in := newTextInput("note: ", 48)
+	in := textinput.New()
+	in.Prompt = "note: "
 	in.Placeholder = "e.g. prod SQL admin"
 	in.CharLimit = 80
+	in.SetWidth(48)
 	in.SetValue(m.store.Node(key).Note)
 	in.CursorEnd()
 	m.prompt = &modal{

internal/ui/app/persist.go

@@ -29,43 +29,41 @@ type persistTickMsg struct{}
 
 type persistedMsg struct{ err error }
 
-// keepers report whether a provider ID, or a cache key's, is an account
-// that still exists and isn't a repo.
-func (m *Model) keepers() (keep, keepKey func(string) bool) {
-	keep = cachefile.Keep(m.providers)
-	return keep, func(key string) bool { return keep(cachefile.ProviderOf(key)) }
-}
+// keepCached reports whether a cache key's account still exists and
+// isn't a repo: every key starts with the provider ID.
+func (m *Model) keepCached(key string) bool { return m.keepProvider(cachefile.ProviderOf(key)) }
+
+func (m *Model) keepProvider(id string) bool { return cachefile.Keep(m.providers)(id) }
 
 // loadCacheFile fills the cache from the file, leaving out what's too
 // old or belongs to accounts that aren't signed in any more.
 func (m *Model) loadCacheFile() {
 	f := cachefile.Read(m.cachePath)
-	keep, keepKey := m.keepers()
 	now := m.now()
 	recent := func(at time.Time) bool { return now.Sub(at) < cachefile.MaxAge }
 	for id, e := range f.Sources {
-		if keep(id) && recent(e.At) {
+		if m.keepProvider(id) && recent(e.At) {
 			m.sourceResults[id] = sourcesMsg{gen: m.sourcesGen, provider: id, sources: e.Value}
 			m.sourcesAt[id] = e.At
 		}
 	}
 	for k, e := range f.Containers {
-		if keepKey(k) && recent(e.At) {
+		if m.keepCached(k) && recent(e.At) {
 			m.cache.containers[k] = entry[[]provider.Container]{e.Value, e.At}
 		}
 	}
 	for k, e := range f.Objects {
-		if keepKey(k) && recent(e.At) {
+		if m.keepCached(k) && recent(e.At) {
 			m.cache.objects[k] = entry[[]provider.Object]{e.Value, e.At}
 		}
 	}
 	for k, e := range f.Details {
-		if keepKey(k) && recent(e.At) {
+		if m.keepCached(k) && recent(e.At) {
 			m.cache.details[k] = entry[provider.Object]{e.Value, e.At}
 		}
 	}
 	for k, v := range f.Cursor {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			m.cache.cursor[k] = v
 		}
 	}
@@ -74,30 +72,29 @@ func (m *Model) loadCacheFile() {
 // cacheSnapshot is the cache as the file holds it.
 func (m *Model) cacheSnapshot() cachefile.File {
 	f := cachefile.New()
-	keep, keepKey := m.keepers()
 	f.Dropped, m.cacheDropped = m.cacheDropped, nil
 	for id, r := range m.sourceResults {
-		if r.err == nil && keep(id) {
+		if r.err == nil && m.keepProvider(id) {
 			f.Sources[id] = cachefile.Stamped[[]provider.Source]{At: m.sourcesAt[id], Value: r.sources}
 		}
 	}
 	for k, e := range m.cache.containers {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Containers[k] = cachefile.Stamped[[]provider.Container]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.objects {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Objects[k] = cachefile.Stamped[[]provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, e := range m.cache.details {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Details[k] = cachefile.Stamped[provider.Object]{At: e.at, Value: e.value}
 		}
 	}
 	for k, v := range m.cache.cursor {
-		if keepKey(k) {
+		if m.keepCached(k) {
 			f.Cursor[k] = v
 		}
 	}

internal/ui/app/reveal.go

@@ -28,22 +28,12 @@ func (m *Model) startRevealTimer() tea.Cmd {
 
 // revealTickCmd fires when the displayed second next changes.
 func (m *Model) revealTickCmd() tea.Cmd {
-	token := m.revealToken
-	return tea.Tick(untilNextSecond(m.revealDeadline, m.now()), func(time.Time) tea.Msg { return revealTickMsg{token} })
-}
-
-// untilNextSecond is how long until a countdown to deadline shows its
-// next whole second.
-func untilNextSecond(deadline, now time.Time) time.Duration {
-	if wait := deadline.Sub(now) % time.Second; wait > 0 {
-		return wait
+	wait := m.revealDeadline.Sub(m.now()) % time.Second
+	if wait <= 0 {
+		wait = time.Second
 	}
-	return time.Second
-}
-
-// secondsLeft is a countdown to deadline, in whole seconds rounded up.
-func secondsLeft(deadline, now time.Time) int {
-	return max(0, int(math.Ceil(deadline.Sub(now).Seconds())))
+	token := m.revealToken
+	return tea.Tick(wait, func(time.Time) tea.Msg { return revealTickMsg{token} })
 }
 
 func (m *Model) revealTick(msg revealTickMsg) tea.Cmd {
@@ -59,7 +49,8 @@ func (m *Model) revealTick(msg revealTickMsg) tea.Cmd {
 }
 
 func (m *Model) showHidesIn() {
-	m.detail.SetHidesIn(fmt.Sprintf("%ds", secondsLeft(m.revealDeadline, m.now())))
+	left := max(0, int(math.Ceil(m.revealDeadline.Sub(m.now()).Seconds())))
+	m.detail.SetHidesIn(fmt.Sprintf("%ds", left))
 }
 
 // hideValue hides the revealed value and stops its countdown.

internal/ui/app/search.go

@@ -341,19 +341,6 @@ func (m *Model) handleCrawl(msg crawlMsg) tea.Cmd {
 	return cmd
 }
 
-// vaultsLoaded counts the vaults whose secrets are cached or can't be
-// read, and says whether any are loading.
-func (m *Model) vaultsLoaded(vaults []provider.Container) (loaded int, loading bool) {
-	for _, c := range vaults {
-		key := cachefile.ObjectsKey(c, provider.TypeSecret)
-		loading = loading || m.crawl.pending[key]
-		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
-			loaded++
-		}
-	}
-	return loaded, loading
-}
-
 // sourceMark shows how much of a subscription or workspace is loaded:
 // ○ nothing, ◐ some vaults, ● every vault, ◌ loading, ✗ unreadable.
 func (m *Model) sourceMark(row string) string {
@@ -367,7 +354,14 @@ func (m *Model) sourceMark(row string) string {
 	if !ok {
 		return m.st.Muted.Render("○")
 	}
-	loaded, loading := m.vaultsLoaded(e.value)
+	loaded, loading := 0, false
+	for _, c := range e.value {
+		key := cachefile.ObjectsKey(c, provider.TypeSecret)
+		loading = loading || m.crawl.pending[key]
+		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
+			loaded++
+		}
+	}
 	switch {
 	case loading:
 		return m.st.Muted.Render("◌")

internal/ui/app/searchview.go

@@ -95,7 +95,9 @@ func (m *Model) showFavourites() tea.Cmd { return m.openGoTo(tabFavs, false) }
 func (m *Model) showRecent() tea.Cmd     { return m.openGoTo(tabRecent, false) }
 
 func (m *Model) openGoTo(tab int, typing bool) tea.Cmd {
-	in := newTextInput("/", searchWidth(m.w)-6) // as wide as the popup
+	in := textinput.New()
+	in.Prompt = "/"
+	in.SetWidth(searchWidth(m.w) - 6) // as wide as the popup
 	v := &searchView{input: in, tab: tab, results: true}
 	v.favs, v.recent = m.storeEntries()
 	m.search = v
@@ -614,7 +616,13 @@ func (m Model) loadHint() string {
 		}
 		return m.st.Warning.Render("⚠ not loaded" + withKey(m.loadKey(), " · %s loads "+name))
 	}
-	loaded, _ := m.vaultsLoaded(e.value)
+	loaded := 0
+	for _, c := range e.value {
+		key := cachefile.ObjectsKey(c, provider.TypeSecret)
+		if _, ok := m.cache.objects[key]; ok || m.crawl.failed[key] {
+			loaded++
+		}
+	}
 	if loaded == len(e.value) {
 		return ""
 	}
@@ -762,7 +770,7 @@ func (m Model) searchViewBox() string {
 				body = append(body, " "+m.st.Error.Render(l))
 			}
 		}
-		body = append(body, "", " "+panes.Tabs(m.st, ts, tabNames[:], m.search.tab))
+		body = append(body, "", " "+m.goToTabs(ts))
 	}
 	body = append(body, " "+v.input.View(), "")
 	for _, l := range strings.Split(lists, "\n") {
@@ -795,7 +803,7 @@ func (m Model) searchViewBox() string {
 	// Tabs in the title, the current one underlined, like the panes; a
 	// picker has its own title, and the tabs over the input.
 	if v.picker == nil {
-		head := ts.Render(goToTitle+" ") + panes.Tabs(m.st, ts, tabNames[:], m.search.tab)
+		head := ts.Render(goToTitle+" ") + m.goToTabs(ts)
 		return panes.Box(m.st, head, foot, body, w, len(body)+2, focused)
 	}
 	// A picker: in its own border, under what it's for.
@@ -848,3 +856,19 @@ func pickable(o option) (ref.Ref, bool) {
 	}
 	return r, true
 }
+
+// goToTabs draws Go to's tabs, the current one underlined.
+func (m Model) goToTabs(ts lipgloss.Style) string {
+	var out string
+	for i, name := range tabNames {
+		if i > 0 {
+			out += ts.Render(" - ")
+		}
+		if i == m.search.tab {
+			out += ts.Underline(true).Render(name)
+		} else {
+			out += m.st.Muted.Render(name)
+		}
+	}
+	return out
+}

internal/ui/app/sharefiles.go

@@ -10,6 +10,7 @@ import (
 	"slices"
 	"strings"
 
+	"charm.land/bubbles/v2/textinput"
 	tea "charm.land/bubbletea/v2"
 	"github.com/charmbracelet/x/ansi"
 
@@ -337,7 +338,9 @@ func (m *Model) openFailed(s share.Sealed, err error, whole bool) {
 // askShareDir asks where to save files from a repo that isn't here. It
 // stays until they're saved, saying why when they can't be.
 func (m *Model) askShareDir(msg shareOpenedMsg) tea.Cmd {
-	in := newTextInput("folder: ", m.pathInputWidth())
+	in := textinput.New()
+	in.Prompt = "folder: "
+	in.SetWidth(max(20, min(m.w-12, 64)))
 	dir := m.placeDir
 	if dir == "" {
 		dir, _ = os.Getwd()

internal/ui/app/sources.go

@@ -134,7 +134,10 @@ func (m *Model) rebuildSources() {
 	}
 	for _, p := range m.providers {
 		kind, id := p.Kind(), p.ID()
-		account := accountOf(provider.Source{Kind: kind, ProviderLabel: p.Label()})
+		account, _ := strings.CutPrefix(p.Label(), string(kind)+" · ")
+		if account == p.Label() {
+			account = ""
+		}
 		r, done := m.sourceResults[id]
 		sources := r.sources
 		if !flat {
@@ -212,6 +215,17 @@ func (m Model) currentSource() (provider.Source, bool) {
 	return provider.Source{}, false
 }
 
+// starredSourcesFirst moves starred sources to the front, keeping the
+// order otherwise. It doesn't modify sources.
+func (m Model) starredSourcesFirst(sources []provider.Source) []provider.Source {
+	out := slices.Clone(sources)
+	rank := func(s provider.Source) int {
+		return boolRank(m.store.Node(sourceKey(s)).StarredFor(s.Provider))
+	}
+	slices.SortStableFunc(out, func(a, b provider.Source) int { return rank(a) - rank(b) })
+	return out
+}
+
 // starRank orders the Favourites row, then starred sources, then the rest.
 func starRank(mem *store.Store, r sourceRow) int {
 	switch {
@@ -225,6 +239,13 @@ func starRank(mem *store.Store, r sourceRow) int {
 	return 3
 }
 
+func boolRank(starred bool) int {
+	if starred {
+		return 0
+	}
+	return 1
+}
+
 // selectedSource is the source under the cursor; false on a header.
 func (m Model) selectedSource() (provider.Source, bool) {
 	r, ok := m.sources.Selected()

internal/ui/app/update.go

@@ -2,11 +2,13 @@ package app
 
 import (
 	"context"
+	"errors"
 	"strings"
 	"time"
 
 	tea "charm.land/bubbletea/v2"
 
+	"git.kebcloud.no/keb/lazysecrets/internal/browser"
 	"git.kebcloud.no/keb/lazysecrets/internal/store"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
@@ -128,7 +130,15 @@ func (m *Model) showUpdate() {
 		run: func(m *Model) tea.Cmd { return m.install(r) }}}
 	if r.URL != "" {
 		opts = append(opts, option{key: "o", label: "Open the release page", run: func(m *Model) tea.Cmd {
-			return m.openPage("the release page", r.URL, func() {})
+			switch err := m.openURL(r.URL); {
+			case errors.Is(err, browser.ErrRemote):
+				cmd := m.copyText("link to the release", r.URL, false)
+				m.flash.text += " (can't open a browser over SSH)"
+				return cmd
+			case err != nil:
+				m.flash = flash{text: "open: " + err.Error(), isErr: true}
+			}
+			return nil
 		}})
 	}
 	m.showMenu("lazysecrets "+r.Tag, lines, opts)

internal/ui/panes/box.go

@@ -69,20 +69,3 @@ func TitleStyle(st styles.Styles, focused bool) lipgloss.Style {
 	}
 	return st.TitleBlurred
 }
-
-// Tabs draws tab names for a title in style ts, the current one
-// underlined and the rest muted.
-func Tabs(st styles.Styles, ts lipgloss.Style, names []string, current int) string {
-	var out string
-	for i, name := range names {
-		if i > 0 {
-			out += ts.Render(" - ")
-		}
-		if i == current {
-			out += ts.Underline(true).Render(name)
-		} else {
-			out += st.Muted.Render(name)
-		}
-	}
-	return out
-}

internal/ui/panes/detail.go

@@ -188,31 +188,20 @@ func carryStyle(lines []string) []string {
 	return lines
 }
 
-var valueIndent = strings.Repeat(" ", 12)
-
-// fieldLabel starts a detail line: the label, padded so values line up
-// at valueIndent.
-func fieldLabel(st styles.Styles, label string) string {
-	return " " + st.Label.Render(fmt.Sprintf("%-10s", label)) + " "
-}
-
 // lines renders the body, wrapped to the pane width.
 func (d Detail) lines(st styles.Styles) []string {
 	inner := max(1, d.w-3)
 	var out []string
 	field := func(label, value string) {
+		prefix := " " + st.Label.Render(fmt.Sprintf("%-10s", label)) + " "
+		indent := strings.Repeat(" ", 12)
 		wrapped := carryStyle(strings.Split(ansi.Hardwrap(value, max(1, inner-11), true), "\n"))
-		out = append(out, fieldLabel(st, label)+wrapped[0])
+		out = append(out, prefix+wrapped[0])
 		for _, w := range wrapped[1:] {
-			out = append(out, valueIndent+w)
+			out = append(out, indent+w)
 		}
 	}
 	muted := st.Muted.Render
-	note := func() {
-		if d.note != "" {
-			field("note", st.Favourite.Render(d.note))
-		}
-	}
 
 	if d.container == nil {
 		return []string{muted(" Select a vault or scope to browse its secrets.")}
@@ -222,27 +211,30 @@ func (d Detail) lines(st styles.Styles) []string {
 	if containerLabel == "" {
 		containerLabel = "vault"
 	}
-	source := d.Icons.Prefix(c.Source.Kind) + cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind)) + " / " + c.Source.Name
 
 	if d.secret == nil {
 		field(containerLabel, c.Name)
-		note()
+		if d.note != "" {
+			field("note", st.Favourite.Render(d.note))
+		}
 		if c.Detail != "" {
 			field("", muted(c.Detail))
 		}
-		field("source", source)
+		field("source", d.Icons.Prefix(c.Source.Kind)+cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
 		out = append(out, "", muted(" Select a secret to see its details."))
 		return out
 	}
 
 	s := *d.secret
 	field("name", s.Name)
-	note()
+	if d.note != "" {
+		field("note", st.Favourite.Render(d.note))
+	}
 	field(containerLabel, c.Name)
 	if c.Source.Kind != provider.KindAzure && c.Detail != "" {
 		field("", muted(c.Detail))
 	}
-	field("source", source)
+	field("source", d.Icons.Prefix(c.Source.Kind)+cmp.Or(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
 	if s.Version != "" {
 		field("version", s.Version)
 	}
@@ -306,12 +298,14 @@ func (d Detail) lines(st styles.Styles) []string {
 	case provider.TypeCertificate:
 		label, hidden, reveal = "cert", "", "show the certificate"
 	}
+	indent := strings.Repeat(" ", 12)
+
 	out = append(out, "")
 	switch d.state {
 	case ValueHidden:
 		if hidden != "" {
 			field(label, hidden)
-			out = append(out, valueIndent+hints(reveal))
+			out = append(out, indent+hints(reveal))
 		} else {
 			field(label, hints(reveal))
 		}
@@ -328,9 +322,9 @@ func (d Detail) lines(st styles.Styles) []string {
 			for j, w := range strings.Split(ansi.Wrap(text, max(1, inner-11-len(lead)), ""), "\n") {
 				w = lead + w
 				if i == 0 && j == 0 {
-					out = append(out, fieldLabel(st, label)+st.Error.Render(w))
+					out = append(out, " "+st.Label.Render(fmt.Sprintf("%-10s", label))+" "+st.Error.Render(w))
 				} else {
-					out = append(out, valueIndent+st.Error.Render(w))
+					out = append(out, strings.Repeat(" ", 12)+st.Error.Render(w))
 				}
 			}
 		}
@@ -341,10 +335,10 @@ func (d Detail) lines(st styles.Styles) []string {
 		for _, line := range lines {
 			for _, w := range strings.Split(ansi.Hardwrap(line, max(1, inner-11), true), "\n") {
 				if first {
-					out = append(out, fieldLabel(st, label)+st.Value.Render(w))
+					out = append(out, " "+st.Label.Render(fmt.Sprintf("%-10s", label))+" "+st.Value.Render(w))
 					first = false
 				} else {
-					out = append(out, valueIndent+st.Value.Render(w))
+					out = append(out, indent+st.Value.Render(w))
 				}
 			}
 		}
@@ -358,7 +352,7 @@ func (d Detail) lines(st styles.Styles) []string {
 		if d.hidesIn != "" {
 			more = append(more, "hides in "+d.hidesIn)
 		}
-		out = append(out, valueIndent+hints("hide", more...))
+		out = append(out, indent+hints("hide", more...))
 	}
 	return append(out, d.versionLines(st)...)
 }
@@ -379,7 +373,7 @@ func (d Detail) versionLines(st styles.Styles) []string {
 			head += muted(" · " + d.VersionsKey + " to browse")
 		}
 	}
-	out := []string{"", fieldLabel(st, "versions") + head}
+	out := []string{"", " " + st.Label.Render(fmt.Sprintf("%-10s", "versions")) + " " + head}
 	current := d.versions[0].Version
 	for i, v := range d.versions {
 		if i == maxVersionLines {

internal/ui/panes/list.go

@@ -329,7 +329,17 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	ts := TitleStyle(st, focused)
 	title := ts.Render(l.Title)
 	if len(l.Tabs) > 1 {
-		title += ts.Render(" ") + Tabs(st, ts, l.Tabs, l.Tab)
+		for i, tab := range l.Tabs {
+			sep := " - "
+			if i == 0 {
+				sep = " "
+			}
+			if i == l.Tab {
+				title += ts.Render(sep) + ts.Underline(true).Render(tab)
+			} else {
+				title += ts.Render(sep) + st.Muted.Render(tab)
+			}
+		}
 	}
 	if q := l.input.Value(); q != "" && !l.filtering {
 		title += ts.Render(" /" + q)
@@ -360,13 +370,26 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	default:
 		for i := l.offset; i < len(l.visible) && i < l.offset+rows; i++ {
 			line := l.item.Render(st, l.items[l.visible[i]], inner-1)
-			line = " " + MarkMatches(line, l.highlight(i, ansi.Strip(line)), st.Match)
+			plain := ansi.Strip(line)
+			hits := l.highlight(i, plain)
 			if i == l.cursor {
 				base := st.SelectedBlurred
 				if focused {
 					base = st.Selected
 				}
-				line = Highlight(ansi.Truncate(line, inner, "…"), base, inner)
+				text := " " + line
+				if len(hits) > 0 {
+					for j := range hits {
+						hits[j]++ // leading space
+					}
+					text = lipgloss.StyleRanges(text, matchRanges(" "+plain, hits, st.Match)...)
+				}
+				line = Highlight(ansi.Truncate(text, inner, "…"), base, inner)
+			} else if len(hits) > 0 {
+				// Style just the matches, keeping the row's own colours.
+				line = " " + lipgloss.StyleRanges(line, matchRanges(plain, hits, st.Match)...)
+			} else {
+				line = " " + line
 			}
 			body = append(body, line)
 		}

internal/update/update.go

@@ -45,9 +45,9 @@ const (
 // DefaultServers are where releases are looked for, in order.
 var DefaultServers = []string{GitHubRepo, DefaultRepo}
 
-// serverTimeout bounds asking one server for the latest release or its
-// checksums, so a server that's down leaves time for the next.
-const serverTimeout = 5 * time.Second
+// latestTimeout bounds asking one server for the latest release, so a
+// server that's down leaves time for the next.
+const latestTimeout = 5 * time.Second
 
 // maxDownload bounds what's read from the server.
 const maxDownload = 200 << 20
@@ -151,7 +151,7 @@ func (c *Client) latest(ctx context.Context, repo string) (Release, error) {
 	if err != nil {
 		return Release{}, err
 	}
-	ctx, cancel := context.WithTimeout(ctx, serverTimeout)
+	ctx, cancel := context.WithTimeout(ctx, latestTimeout)
 	defer cancel()
 	// The recent releases in one request (per_page on GitHub, limit on
 	// Gitea), for their changelogs.
@@ -220,7 +220,7 @@ func (c *Client) Install(ctx context.Context, r Release, exe string) error {
 	if m := Managed(exe); m != "" {
 		return fmt.Errorf("%s is managed by %s: update it there", exe, m)
 	}
-	if (runtime.GOOS != "darwin" && runtime.GOOS != "linux") || (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") {
+	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" || runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" {
 		return fmt.Errorf("no release build for %s/%s", runtime.GOOS, runtime.GOARCH)
 	}
 	version := strings.TrimPrefix(r.Tag, "v")
@@ -270,7 +270,7 @@ func (c *Client) download(ctx context.Context, tag, file string) ([]byte, error)
 	var errs []error
 	for _, repo := range c.servers() {
 		base := strings.TrimSuffix(repo, "/") + "/releases/download/" + tag + "/"
-		sctx, cancel := context.WithTimeout(ctx, serverTimeout)
+		sctx, cancel := context.WithTimeout(ctx, latestTimeout)
 		sums, err := c.get(sctx, base+"checksums.txt", 1<<20)
 		cancel()
 		if err != nil {