feat(vault): M5 slice 2 — TUI reveal + agent-side clipboard copy

[UnbreakableMJ]

Summary

Wires the vault-tui detail pane to reveal and copy secrets, gated on a new agent-side copy path so plaintext never crosses the socket and the auto-clear survives the TUI quitting. Also closes a duplicate-name targeting footgun.

Protocol (vault-ipc)

• Request::Get gains id: Option<String> (serde-defaulted, forward-compatible).
• New Request::Copy { id, name, field, clear_after_secs } → Response::Ok. The plaintext stays in the agent.

Agent (vault-agent)

• get_item targets an exact cipher id when given (name becomes the fallback/label), so reveal/copy always hit the selected row even when names collide.
• New default-on clipboard feature holds an arboard handle. The Copy arm decrypts the field, places it on the agent's own clipboard, and schedules a 30s auto-clear that wipes only if the clipboard still holds what we wrote (or can't be read — fail-safe).
• --no-default-features drops the X11/Wayland tree and declines Copy cleanly.

CLI (vault-cli)

• cmd_get passes id: None — behavior unchanged.

TUI (vault-tui)

• Space reveals the selected login's password (id-targeted Get, re-masked on any navigation, held in a zeroizing/Debug-redacted RevealedSecret).
• c / u / o copy password / username / URI via Copy, with a status-bar toast.
• Reveal/copy act only when the item list is focused.

Tests

id-targeting-among-duplicates regression, should_clear_clipboard + clipboard_set-when-None units, a dispatch-level Copy-while-locked test, and TUI reveal/re-mask/toast/Debug-redaction units plus TestBackend smokes for masked/revealed/toast states.

Supply-chain

arboard pulls error-code (BSL-1.0, via Windows-only clipboard-win) — added to deny.toml's allow-list (FSF GPL-compatible). No new advisories.

Known limitation (tracked)

On Quit/stop-agent a pending clear task dies with the runtime, so a just-copied secret can linger until overwritten. A clear-on-shutdown sweep is a tracked follow-up.

🤖 Generated with Claude Code