From 014e68532df9e771cc70b6822935f58fec0508e7 Mon Sep 17 00:00:00 2001
From: banteg <4562643+banteg@users.noreply.github.com>
Date: Thu, 7 May 2026 20:17:37 +0400
Subject: [PATCH 1/2] fix: mark macOS clipboard copies transient

---
 src/platform/darwin.sh | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/platform/darwin.sh b/src/platform/darwin.sh
index 9a1fda8..c3b529c 100644
--- a/src/platform/darwin.sh
+++ b/src/platform/darwin.sh
@@ -2,10 +2,29 @@
 # This file is licensed under the GPLv2+. Please see COPYING for more information.
 
 clip() {
+	copy_concealed() {
+		if command -v osascript &>/dev/null; then
+			osascript -l JavaScript \
+				-e 'ObjC.import("AppKit")' \
+				-e 'ObjC.import("Foundation")' \
+				-e 'const input = $.NSFileHandle.fileHandleWithStandardInput.readDataToEndOfFile' \
+				-e 'const text = $.NSString.alloc.initWithDataEncoding(input, $.NSUTF8StringEncoding)' \
+				-e 'if (!text) throw new Error("stdin is not UTF-8")' \
+				-e 'const pasteboard = $.NSPasteboard.generalPasteboard' \
+				-e 'pasteboard.clearContents' \
+				-e 'pasteboard.setStringForType(text, $.NSPasteboardTypeString)' \
+				-e 'pasteboard.setStringForType("", "org.nspasteboard.ConcealedType")' \
+				-e 'pasteboard.setStringForType("", "org.nspasteboard.TransientType")' \
+				-e 'undefined'
+		else
+			pbcopy
+		fi
+	}
+
 	local sleep_argv0="password store sleep for user $(id -u)"
 	pkill -f "^$sleep_argv0" 2>/dev/null && sleep 0.5
 	local before="$(pbpaste | $BASE64)"
-	echo -n "$1" | pbcopy
+	echo -n "$1" | copy_concealed
 	(
 		( exec -a "$sleep_argv0" sleep "$CLIP_TIME" )
 		local now="$(pbpaste | $BASE64)"

From a695a8cd4becf59a0f11a184e157cf7b0768ce7f Mon Sep 17 00:00:00 2001
From: banteg <4562643+banteg@users.noreply.github.com>
Date: Thu, 7 May 2026 20:55:59 +0400
Subject: [PATCH 2/2] fix: avoid recopying changed clipboard

---
 src/platform/darwin.sh | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/platform/darwin.sh b/src/platform/darwin.sh
index c3b529c..b1a1333 100644
--- a/src/platform/darwin.sh
+++ b/src/platform/darwin.sh
@@ -9,12 +9,12 @@ clip() {
 				-e 'ObjC.import("Foundation")' \
 				-e 'const input = $.NSFileHandle.fileHandleWithStandardInput.readDataToEndOfFile' \
 				-e 'const text = $.NSString.alloc.initWithDataEncoding(input, $.NSUTF8StringEncoding)' \
-				-e 'if (!text) throw new Error("stdin is not UTF-8")' \
 				-e 'const pasteboard = $.NSPasteboard.generalPasteboard' \
 				-e 'pasteboard.clearContents' \
 				-e 'pasteboard.setStringForType(text, $.NSPasteboardTypeString)' \
-				-e 'pasteboard.setStringForType("", "org.nspasteboard.ConcealedType")' \
-				-e 'pasteboard.setStringForType("", "org.nspasteboard.TransientType")' \
+				-e 'pasteboard.setDataForType($.NSData.data, "org.nspasteboard.ConcealedType")' \
+				-e 'pasteboard.setDataForType($.NSData.data, "org.nspasteboard.TransientType")' \
+				-e 'pasteboard.setDataForType($.NSData.data, "org.nspasteboard.AutoGeneratedType")' \
 				-e 'undefined'
 		else
 			pbcopy
@@ -24,12 +24,13 @@ clip() {
 	local sleep_argv0="password store sleep for user $(id -u)"
 	pkill -f "^$sleep_argv0" 2>/dev/null && sleep 0.5
 	local before="$(pbpaste | $BASE64)"
-	echo -n "$1" | copy_concealed
+	local secret="$(printf "%s" "$1" | $BASE64)"
+	printf "%s" "$1" | copy_concealed || die "Error: could not copy password to clipboard."
 	(
 		( exec -a "$sleep_argv0" sleep "$CLIP_TIME" )
 		local now="$(pbpaste | $BASE64)"
-		[[ $now != $(echo -n "$1" | $BASE64) ]] && before="$now"
-		echo "$before" | $BASE64 -d | pbcopy
+		[[ $now != "$secret" ]] && exit
+		printf "%s\n" "$before" | $BASE64 -d | copy_concealed
 	) >/dev/null 2>&1 & disown
 	echo "Copied $2 to clipboard. Will clear in $CLIP_TIME seconds."
 }