0 Fork 0

Files

T

keb 10dc747f0f feat: keep what was loaded between runs, and start where you left off (#2 )

Starting lazysecrets again now shows what you had loaded at once, and puts you back where you were.

- **Cache file** `~/.cache/lazysecrets/cache.json` (0600, written atomically): the Sources lists, vaults/scopes, secrets' metadata, Describe results and each list's cursor. **Never values**, and never repos (they're on disk anyway). Loaded on start; lists older than 2 minutes reload in the background as before. Saved every 30s when changed, and on quit.
- **Housekeeping:** entries not loaded for 30 days are dropped, as is everything from accounts no longer signed in (every cache key starts with the account ID). The file has a format version; another version is ignored and replaced. `cache: false` turns it off; `--demo` never uses it.
- **Sources are cached too:** Azure lists subscriptions over the network, so without this the Sources pane would still wait.
- **Go to** searches everything cached straight away, and its background loading now also refreshes lists from an earlier run instead of skipping them.
- **Where you left off:** the state file remembers the selected source, vault or secret per folder (the `--dir` or working directory, 100 most recent folders), and the next start in that folder goes back there quietly (no error if it's gone). Starting on a link skips it.

Docs: `cache:` in config.md, a Cache section, the place in State, and the README Privacy section now mentions the cache file.

Tests: cache round trip with a backend too slow to answer (lists and cursor come from the file), no value in the file, file mode 0600, old and signed-out entries dropped, back where it was left, not for another folder or a link.

This touches `app.go` near PR #1's changes (Model fields, the Update switch), so whichever merges second needs a small conflict fix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #2

2026-10-11 09:53:32 +02:00

4.3 KiB

Raw Blame History

lazysecrets

A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.

Main features

Read-only: lazysecrets never creates, changes or deletes a secret, so it's safe to point at production. That's by design and may stay that way. (e opens a repo's SOPS or .env file in your editor, or sops edit; any change is yours.)
Zero setup: uses the logins you already have (az, the Databricks CLI, sops, git). No config file needed.
Search everything: ctrl+s searches every source at once, with fzf-style matching ('exact, ^prefix, suffix$, !not), and jumps straight to the result.
Share links: s copies a lazysecrets:// link. A colleague opens it with their own access, from the terminal or with a click in the browser or chat.
Careful with values: values stay hidden until you reveal them, and copied values are cleared from the clipboard after 30 seconds.
Scriptable: lazysecrets get <link> prints a value for scripts and pipes.
Favourites: star the secrets you use most and get back to them in one key.
Expiry warnings: secrets, keys and certificates that expire soon are marked.
Your way: rebind any key, pick a theme, and add custom commands to run on a secret.
Try it first: lazysecrets --demo runs on built-in sample data.
Supported platforms: Azure Key Vault, Databricks secret scopes, and SOPS and .env files in your git repos.

Early development: expect rough edges. See CHANGELOG.md for what's new.

Install

On macOS or Linux (arm64 or x86_64):

curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh

It installs the latest release into ~/.local/bin after checking it against the release's checksums. sh -s -- v0.2.0 installs a given version, LAZYSECRETS_INSTALL_DIR somewhere else.

lazysecrets looks for a newer release once a day: the footer then shows ↑ v0.2.0, and U shows its changelog and updates in place (or run lazysecrets update).

Or build it yourself: go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest.

Get started

az login            # login with azure cli
lazysecrets         # start lazysecrets
lazysecrets --demo  # test with demo data

Pick a source on the left, then a vault, then a secret. The keys you'll use most:

Key	Action
`j`/`k`, `h`/`l`, `enter`, `esc`	move, switch panes, drill in, back
`/`	filter the list you're in
`space`	reveal / hide the value
`y`	copy the value (cleared from the clipboard after 30s)
`ctrl+s`	Go to: search everything and jump there
`f` / `F`	star / your favourites
`s`	copy a link to share
`?`	every key, searchable
`q`	quit

Docs

Keys: every key, Go to, the layout, and rebinding keys
Azure Key Vault: accounts, permissions, pinned vaults
Databricks: profiles and Key Vault-backed scopes
SOPS and .env files: which repos and files, decrypting
Links: sharing, opening, lazysecrets get in scripts, and opening links from the browser and chat
Custom commands: run your own commands on a secret
Config: every option, themes, layered configs, the state file
Development: building, tests, pull requests and releasing

Privacy

lazysecrets never stores, caches or sends your secret values. It keeps the names and metadata of what you've loaded in a cache file readable only by you, to show it at once next time (cache: false turns it off). It talks only to the services you use it with, and collects no usage data. The one call of its own is a daily check for a new release on this server, which updateCheck: false turns off.

AI disclosure

Built with help from an agentic coding assistant. Every change is requested, reviewed and tested by me before it's merged.

License

lazysecrets is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See LICENSE.

4.3 KiB Raw Blame History