basic-password-manager 0.4.6__tar.gz → 0.4.7__tar.gz

{basic_password_manager-0.4.6 → basic_password_manager-0.4.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: basic-password-manager
-Version: 0.4.6
+Version: 0.4.7
 Summary: The Paladin — a local encrypted password manager that lives in your terminal
 License-Expression: MIT
 Project-URL: Repository, https://github.com/Daisentaur/password-manager
@@ -226,8 +226,11 @@ Both are thin skins over the two modules above. The TUI (built with
 [Textual](https://textual.textualize.io)) holds the decrypted entries in
 memory for the session; the CLI re-derives the key per command.
 
-Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists)
-rather than the screen, so they don't sit in your terminal scrollback. One
+Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`/`pbcopy`/`clip`,
+whichever exists) rather than the screen, so they don't sit in your terminal
+scrollback — and they're wiped from it 45 seconds later by a detached helper
+(the CLI exits immediately, so an in-process timer would never fire). If
+you've copied something else in the meantime, yours is left alone. One
 deliberate asymmetry: CLI `find` does *not* search passwords, because a CLI
 argument lands in your shell history forever — the TUI search box does,
 because nothing you type there is logged anywhere.
@@ -298,8 +301,10 @@ accounts from 2013. `paladin rm <name>` the corpses, or prune the CSV first.
 
 I'd rather you know these than find them:
 
-- No clipboard auto-clear yet: a copied password stays on the clipboard
-  until you copy over it. Copy something else when you're done.
+- The 45-second clipboard window is still a window: anything watching your
+  clipboard in that time sees the password. Set
+  `PALADIN_CLIPBOARD_SECONDS` lower if that bothers you (or `0` to keep the
+  old forever-behaviour).
 - While a command runs, decrypted data briefly exists in process memory.
   Malware already on your machine could read it — true of every password
   manager ever made; the vault protects the file at rest, not a compromised

{basic_password_manager-0.4.6 → basic_password_manager-0.4.7}/README.md

@@ -210,8 +210,11 @@ Both are thin skins over the two modules above. The TUI (built with
 [Textual](https://textual.textualize.io)) holds the decrypted entries in
 memory for the session; the CLI re-derives the key per command.
 
-Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists)
-rather than the screen, so they don't sit in your terminal scrollback. One
+Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`/`pbcopy`/`clip`,
+whichever exists) rather than the screen, so they don't sit in your terminal
+scrollback — and they're wiped from it 45 seconds later by a detached helper
+(the CLI exits immediately, so an in-process timer would never fire). If
+you've copied something else in the meantime, yours is left alone. One
 deliberate asymmetry: CLI `find` does *not* search passwords, because a CLI
 argument lands in your shell history forever — the TUI search box does,
 because nothing you type there is logged anywhere.
@@ -282,8 +285,10 @@ accounts from 2013. `paladin rm <name>` the corpses, or prune the CSV first.
 
 I'd rather you know these than find them:
 
-- No clipboard auto-clear yet: a copied password stays on the clipboard
-  until you copy over it. Copy something else when you're done.
+- The 45-second clipboard window is still a window: anything watching your
+  clipboard in that time sees the password. Set
+  `PALADIN_CLIPBOARD_SECONDS` lower if that bothers you (or `0` to keep the
+  old forever-behaviour).
 - While a command runs, decrypted data briefly exists in process memory.
   Malware already on your machine could read it — true of every password
   manager ever made; the vault protects the file at rest, not a compromised

{basic_password_manager-0.4.6 → basic_password_manager-0.4.7}/basic_password_manager.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: basic-password-manager
-Version: 0.4.6
+Version: 0.4.7
 Summary: The Paladin — a local encrypted password manager that lives in your terminal
 License-Expression: MIT
 Project-URL: Repository, https://github.com/Daisentaur/password-manager
@@ -226,8 +226,11 @@ Both are thin skins over the two modules above. The TUI (built with
 [Textual](https://textual.textualize.io)) holds the decrypted entries in
 memory for the session; the CLI re-derives the key per command.
 
-Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists)
-rather than the screen, so they don't sit in your terminal scrollback. One
+Passwords go to the clipboard (`wl-copy`/`xclip`/`xsel`/`pbcopy`/`clip`,
+whichever exists) rather than the screen, so they don't sit in your terminal
+scrollback — and they're wiped from it 45 seconds later by a detached helper
+(the CLI exits immediately, so an in-process timer would never fire). If
+you've copied something else in the meantime, yours is left alone. One
 deliberate asymmetry: CLI `find` does *not* search passwords, because a CLI
 argument lands in your shell history forever — the TUI search box does,
 because nothing you type there is logged anywhere.
@@ -298,8 +301,10 @@ accounts from 2013. `paladin rm <name>` the corpses, or prune the CSV first.
 
 I'd rather you know these than find them:
 
-- No clipboard auto-clear yet: a copied password stays on the clipboard
-  until you copy over it. Copy something else when you're done.
+- The 45-second clipboard window is still a window: anything watching your
+  clipboard in that time sees the password. Set
+  `PALADIN_CLIPBOARD_SECONDS` lower if that bothers you (or `0` to keep the
+  old forever-behaviour).
 - While a command runs, decrypted data briefly exists in process memory.
   Malware already on your machine could read it — true of every password
   manager ever made; the vault protects the file at rest, not a compromised

{basic_password_manager-0.4.6 → basic_password_manager-0.4.7}/pw_manager/cli.py

@@ -23,23 +23,84 @@ def generate(length: int = 20) -> str:
     return "".join(secrets.choice(alphabet) for _ in range(length))
 
 
-def to_clipboard(text: str) -> bool:
-    # ponytail: no auto-clear timer; clear manually or copy something else over it
-    # linux needs a tool installed; macOS (pbcopy) and Windows (clip) ship theirs
-    for cmd in (
-        ["wl-copy"],
-        ["xclip", "-selection", "clipboard"],
-        ["xsel", "-b"],
-        ["pbcopy"],
-        ["clip"],
-        ["clip.exe"],  # windows tool as seen from inside WSL
-    ):
+# seconds a copied password lingers before it's wiped; 0 disables
+CLIPBOARD_TTL = int(os.environ.get("PALADIN_CLIPBOARD_SECONDS", "45"))
+
+# linux needs a tool installed; macOS (pbcopy) and Windows (clip) ship theirs
+_COPY_CMDS = (
+    ["wl-copy"],
+    ["xclip", "-selection", "clipboard"],
+    ["xsel", "-b"],
+    ["pbcopy"],
+    ["clip"],
+    ["clip.exe"],  # windows tool as seen from inside WSL
+)
+_PASTE_CMDS = (
+    ["wl-paste", "-n"],
+    ["xclip", "-selection", "clipboard", "-o"],
+    ["xsel", "-b"],
+    ["pbpaste"],
+    ["powershell.exe", "-noprofile", "-command", "Get-Clipboard"],
+)
+
+
+def to_clipboard(text: str, auto_clear: bool = True) -> bool:
+    for cmd in _COPY_CMDS:
         if shutil.which(cmd[0]):
             subprocess.run(cmd, input=text.encode(), check=True)
+            if auto_clear and text and CLIPBOARD_TTL > 0:
+                _clear_clipboard_later(text)
             return True
     return False
 
 
+def from_clipboard() -> str | None:
+    """Current clipboard contents, or None if we can't read it."""
+    for cmd in _PASTE_CMDS:
+        if shutil.which(cmd[0]):
+            try:
+                out = subprocess.run(cmd, capture_output=True, check=True).stdout
+            except subprocess.CalledProcessError:
+                return None
+            return out.decode(errors="replace").rstrip("\r\n")
+    return None
+
+
+def _clear_clipboard_later(text: str) -> None:
+    """Hand the password to a detached child that wipes it later — the CLI
+    exits immediately after copying, so an in-process timer would never fire."""
+    try:
+        proc = subprocess.Popen(
+            [sys.executable, "-c", "from pw_manager.cli import _clear_worker; _clear_worker()"],
+            stdin=subprocess.PIPE,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+        proc.stdin.write(text.encode())  # via stdin, never argv (argv shows in `ps`)
+        proc.stdin.close()
+    except OSError:
+        pass  # clipboard hygiene is best-effort; never break the copy itself
+
+
+def _clear_worker() -> None:
+    """Child: wait out the TTL, then clear the clipboard only if it still holds
+    the password we put there — never clobber something the user copied since."""
+    import time
+
+    copied = sys.stdin.buffer.read().decode()
+    time.sleep(CLIPBOARD_TTL)
+    current = from_clipboard()
+    if current is None or current == copied:
+        to_clipboard("", auto_clear=False)  # no recursion
+
+
+def copied_msg() -> str:
+    if CLIPBOARD_TTL > 0:
+        return f"password copied to clipboard (clears in {CLIPBOARD_TTL}s)"
+    return "password copied to clipboard"
+
+
 def ask_master(confirm: bool = False) -> str:
     pw = getpass.getpass("master password: ")
     if confirm:
@@ -122,7 +183,7 @@ def cmd_add(args):
     vault.save(VAULT_PATH, master, entries)
     print(f"stored '{args.name}'")
     if args.gen and to_clipboard(pw):
-        print("password copied to clipboard")
+        print(copied_msg())
 
 
 def cmd_get(args):
@@ -134,7 +195,7 @@ def cmd_get(args):
     if e.get("notes"):
         print(f"notes:    {e['notes']}")
     if to_clipboard(e["pw"]):
-        print("password copied to clipboard")
+        print(copied_msg())
     else:
         # no clipboard tool found; showing it is the only option left
         print(f"password: {e['pw']}")

{basic_password_manager-0.4.6 → basic_password_manager-0.4.7}/pw_manager/tui.py

@@ -21,7 +21,7 @@ from textual.widgets import DataTable, Footer, Input, Label, OptionList, Static
 from textual.widgets.option_list import Option
 
 from . import logo, vault
-from .cli import VAULT_PATH, generate, import_csv, to_clipboard
+from .cli import CLIPBOARD_TTL, VAULT_PATH, generate, import_csv, to_clipboard
 
 THEME_FILE = os.path.expanduser("~/.local/share/pw-manager/theme")
 
@@ -422,7 +422,8 @@ class MainScreen(Screen):
         if name is None:
             return
         if to_clipboard(self.app.entries[name]["pw"]):
-            self.notify(f"password for '{name}' copied", severity="information")
+            ttl = f" (clears in {CLIPBOARD_TTL}s)" if CLIPBOARD_TTL > 0 else ""
+            self.notify(f"password for '{name}' copied{ttl}", severity="information")
         else:
             self.notify(
                 "no clipboard tool found (on Linux: install wl-clipboard)",

{basic_password_manager-0.4.6 → basic_password_manager-0.4.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "basic-password-manager"
-version = "0.4.6"
+version = "0.4.7"
 description = "The Paladin — a local encrypted password manager that lives in your terminal"
 readme = "README.md"
 license = "MIT"