0 Fork 0

Files

T

keb 17d2705e12 feat: e opens a repo's SOPS or .env file, in nvim, sops edit or your editor (#1 )

`e` on a file in a repo opens it; on a secret, it opens the file at that key's line.

- **SOPS files**: `sops edit` in the terminal, then back to lazysecrets with the keys reloaded. Exit 200 (nothing changed) shows "unchanged".
- **Other files inside nvim** (`$NVIM` set): lazysecrets asks that nvim, over `--remote-expr`, to open the file once lazysecrets' terminal closes, then quits. The file lands in the window you came from, not the closing float. Started from a shell in a terminal, it opens in the previous window straight away. No change to the nvim plugin is needed.
- **Otherwise**: `$VISUAL`/`$EDITOR` in the terminal (with `+N`, `file:N` or `-g file:N` for editors that take a line), else the system default app.

The repo provider now records each key's line (YAML node lines, env/ini line numbers) behind a new optional `provider.Files` interface. Other providers show "only SOPS and .env files in repos can be opened".

The nvim handoff was tested against a headless nvim 0.12: a floating terminal closed on exit the way snacks does, and a shell in a split. A file name with a space and a quote opened at the right line in both. Unit tests cover lines per format, the nvim, sops and default-app paths, and the editor line arguments.

Note: `e` is a new default key, so a config that already binds `e` to something else now gets the "bound to both" error, until one of them is rebound.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #1

2026-10-11 09:34:05 +02:00

4.2 KiB

Raw Blame History

lazysecrets

A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.

Main features

Read-only: lazysecrets never creates, changes or deletes a secret, so it's safe to point at production. That's by design and may stay that way. (e opens a repo's SOPS or .env file in your editor, or sops edit; any change is yours.)
Zero setup: uses the logins you already have (az, the Databricks CLI, sops, git). No config file needed.
Search everything: ctrl+s searches every source at once, with fzf-style matching ('exact, ^prefix, suffix$, !not), and jumps straight to the result.
Share links: s copies a lazysecrets:// link. A colleague opens it with their own access, from the terminal or with a click in the browser or chat.
Careful with values: values stay hidden until you reveal them, and copied values are cleared from the clipboard after 30 seconds.
Scriptable: lazysecrets get <link> prints a value for scripts and pipes.
Favourites: star the secrets you use most and get back to them in one key.
Expiry warnings: secrets, keys and certificates that expire soon are marked.
Your way: rebind any key, pick a theme, and add custom commands to run on a secret.
Try it first: lazysecrets --demo runs on built-in sample data.
Supported platforms: Azure Key Vault, Databricks secret scopes, and SOPS and .env files in your git repos.

Early development: expect rough edges. See CHANGELOG.md for what's new.

Install

On macOS or Linux (arm64 or x86_64):

curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh

It installs the latest release into ~/.local/bin after checking it against the release's checksums. sh -s -- v0.2.0 installs a given version, LAZYSECRETS_INSTALL_DIR somewhere else.

lazysecrets looks for a newer release once a day: the footer then shows ↑ v0.2.0, and U shows its changelog and updates in place (or run lazysecrets update).

Or build it yourself: go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest.

Get started

az login            # login with azure cli
lazysecrets         # start lazysecrets
lazysecrets --demo  # test with demo data

Pick a source on the left, then a vault, then a secret. The keys you'll use most:

Key	Action
`j`/`k`, `h`/`l`, `enter`, `esc`	move, switch panes, drill in, back
`/`	filter the list you're in
`space`	reveal / hide the value
`y`	copy the value (cleared from the clipboard after 30s)
`ctrl+s`	Go to: search everything and jump there
`f` / `F`	star / your favourites
`s`	copy a link to share
`?`	every key, searchable
`q`	quit

Docs

Keys: every key, Go to, the layout, and rebinding keys
Azure Key Vault: accounts, permissions, pinned vaults
Databricks: profiles and Key Vault-backed scopes
SOPS and .env files: which repos and files, decrypting
Links: sharing, opening, lazysecrets get in scripts, and opening links from the browser and chat
Custom commands: run your own commands on a secret
Config: every option, themes, layered configs, the state file
Development: building, tests, pull requests and releasing

Privacy

lazysecrets never stores, caches or sends your secret values. It talks only to the services you use it with, and collects no usage data. The one call of its own is a daily check for a new release on this server, which updateCheck: false turns off.

AI disclosure

Built with help from an agentic coding assistant. Every change is requested, reviewed and tested by me before it's merged.

License

lazysecrets is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See LICENSE.

4.2 KiB Raw Blame History