Summary

• Skip storing clipboard entries that contain the x-kde-passwordManagerHint MIME type (set by KeePassXC and other password managers)
• When the source app clears the clipboard after a sensitive entry, do not restore it from history
• Passwords never enter the clipboard history DB, and the clipboard is allowed to clear naturally

Root cause

When KeePassXC copies a password, it sets a timer to clear the clipboard after a configurable delay (default 10 seconds). On Wayland, clearing the clipboard sends a Selection { id: None } event, which the clipboard manager interprets as EmptyKeyboard and immediately restores the most recent entry from the database — which is the password that was just supposed to be cleared.

How the fix works

1. When ClipboardMessage::Data arrives, check if the MIME types contain x-kde-passwordManagerHint
2. If present, skip inserting into the database and set last_entry_sensitive = true
3. When ClipboardMessage::EmptyKeyboard fires and last_entry_sensitive is true, skip the clipboard restoration

This is a well-known MIME type convention used by KeePassXC, KeePass, and other password managers on KDE/Qt systems.

Test plan

• Copy a password from KeePassXC — verify it does NOT appear in clipboard history
• Paste the password while KeePassXC timer is active — verify paste works normally
• Wait for KeePassXC's clear timer to expire — verify clipboard is empty (paste yields nothing)
• Copy normal (non-password) text — verify it still appears in clipboard history as before

Closes #190

🤖 Generated with Claude Code