#!/bin/sh
# alloy-secret-clear — clear the clipboard and re-enable history.
#
# The other half of alloy-secret-copy, and what gopass runs through
# $GOPASS_CLIPBOARD_CLEAR_CMD when its timeout expires. Clearing the clipboard
# is wl-copy's job; removing the sentinel is what lets alloy-clipstore start
# recording again.
#
# Order matters and is the reverse of the copy path. The clipboard is cleared
# first and the sentinel removed second, so there is no window in which history
# is live and the secret is still on the clipboard.
#
# Safe to run when nothing is pending: both steps are idempotent, and gopass
# calls this on paths where it is not certain a copy happened.

set -eu

sentinel="${XDG_RUNTIME_DIR:-/tmp}/alloy-secret-clipboard"

wl-copy --clear || true
rm -f "$sentinel"