Hm, sounds like a good idea indeed, thanks for bringing it to my attention!

It's kind of a shame that this is KDE-specific, I'd prefer a more generic solution at the Wayland protocol level. But on the other hand wl-clipboard has never shied away from making use of GTK- and wlroots-specific protocols, so why not support a KDE-specific MIME type as well.

It would probably make sense to also expose this is in wl-paste --watch as CLIPBOARD_STATE=sensitive in the new CLIPBOARD_STATE protocol, which is about to be released in 2.2.0. So the flag should probably be named --sensitive as well.

I'm currently using this patch

I wrote a similar request at https://bugs.kde.org/show_bug.cgi?id=487359 yesterday and was referred to the x-kde-passwordManagerHint. Is there any chance that this pull request gets merged into main?

To maybe help this to move forward:

I have compared the 2 open PRs that aim to close this issue (#214 and #204) and I think that #204 should be preferred.

#214 is overwriting the copied text, making it unavailable to paste, which is not what a user intends after calling wl-copy.

#204 allows to paste the sensitive data but sets CLIPBOARD_STATE=sensitive in the environment for downstream programs to decide themselves what to do (like cliphist, which doesn't save the entry). This follows the manpage entry of wl-clipboard under CLIPBOARD_STATE.

#214 is overwriting the copied text, making it unavailable to paste, which is not what a user intends after calling wl-copy.

I can't reproduce this problem. First I run echo supersecretpassword | wl-copy --sensitive. Then I check the clipboard with wl-paste --list-types:

text/plain
text/plain
text/plain;charset=utf-8
TEXT
STRING
UTF8_STRING
x-kde-passwordManagerHint

Ignoring the double text/plain entry, which also happens with an unpatched version of wl-copy, the list contains a x-kde-passwordManagerHint entry with contents secret, plus an text/plain entry with the actual password in it:

$ wl-paste --type=text/plain
supersecretpassword

$ wl-paste --type=x-kde-passwordManagerHint
secret

This seems like the correct behaviour to me. I think #214 should be merged as-is.

Edit: the patched wl-copy from #214 also works nicely in combination with the patched wl-paste from #204:

$ echo regulartext | wl-copy

$ wl-paste --watch bash -c 'echo $CLIPBOARD_STATE'
data
^C

$ echo supersecretpassword | wl-copy --sensitive

$ wl-paste --watch bash -c 'echo $CLIPBOARD_STATE'
sensitive