Copy a password without leaving a trace of it

The launcher's Copy Password command, built alone and last as the plan
required, because every line of it is the security design: the secret
travels rbw to wl-copy through a pipe -- never argv, never a file --
and the copy carries wl-clipboard's --sensitive hint, which vicinae's
clipboard history documents it ignores. That claim was not taken on
faith: a plain probe landed in the live history database and a
sensitive one did not, before any of this was written. A transient
timer clears the clipboard after thirty seconds. An unconfigured rbw
gets a setup message; a vault that locks between list and get gets an
honest failure instead of an empty copy claiming success. rbw joins
desktop-packages, and the contract pins the whole journey with a stub
vault, including that the secret never appears on a command line.

docs/superpowers/plans/2026-08-21-vicinae-os-parity.md

@@ -127,16 +127,17 @@ The list-picking half. One bash helper, not a compiled extension: `vicinae dmenu
 ### Task 8: Bitwarden via rbw — alone, last, carefully
 
 **Files:**
-- Modify: `setup/packages/` (add `rbw`)
-- Modify: `config/local/share/vicinae/extensions/panama-desktop/` (src/passwords.tsx)
-- Create: `tests/setup/rbw-command-contract`
+- Modify: `setup/packages/desktop-packages` (add `rbw`)
+- Modify: `config/dot/quickshell/scripts/panama-pick` (password subcommand)
+- Create: `config/local/share/vicinae/scripts/copy-password`
+- Modify: `tests/setup/launcher-commands-contract` (password section)
 
 **Steps:**
-- [ ] `rbw` added to a package list; first-run setup documented (`rbw config set email`, `rbw login`) and surfaced as a friendly message when unconfigured
-- [ ] List entries from `rbw list`; copy password on select via `rbw get` piped to `wl-copy`, never argv, never a temp file
-- [ ] Clipboard clears after 30 seconds (`wl-copy --clear` scheduled with `systemd-run --user --on-active=30s` or vicinae's own clipboard hygiene if it offers one — check first)
-- [ ] Contract with a stub rbw: copy path never leaks the secret into argv or the environment of anything but wl-copy; unconfigured rbw degrades to the setup message
-- [ ] Review pass on this task's diff before it merges, separate from writing it
+- [x] `rbw` added to a package list; first-run setup documented (`rbw config set email`, `rbw login`) and surfaced as a friendly message when unconfigured
+- [x] List entries from `rbw list`; copy password on select via `rbw get` piped to `wl-copy`, never argv, never a temp file
+- [x] Clipboard clears after 30 seconds (`wl-copy --clear` scheduled with `systemd-run --user --on-active=30s` or vicinae's own clipboard hygiene if it offers one — check first)
+- [x] Contract with a stub rbw: copy path never leaks the secret into argv or the environment of anything but wl-copy; unconfigured rbw degrades to the setup message
+- [x] Review pass on this task's diff before it merges, separate from writing it
 
 ### Task 9: Documentation and closeout
 
@@ -146,6 +147,8 @@ The list-picking half. One bash helper, not a compiled extension: `vicinae dmenu
 - Modify: this file — Findings section, boxes ticked
 
 **Steps:**
-- [ ] README's Vicinae row reflects the new command families
-- [ ] Every new file carries the why-comment the repo expects; no `.sh` extensions anywhere
-- [ ] Full `panama test` run is green; README count matches
+- [x] README's Vicinae row reflects the new command families
+- [x] Every new file carries the why-comment the repo expects; no `.sh` extensions anywhere
+- [x] Full `panama test` run is green; README count matches
+
+**Task 8 findings (2026-08-21):** `wl-copy --sensitive` (wl-clipboard 2.2) offers the password-manager hint MIME, and vicinae's clipboard docs commit to ignoring it — verified live against the real history database (a plain probe was recorded, a sensitive one was not) before the command was written. The clipboard clear is a 30s transient timer. Review pass caught and fixed a silent empty copy on a locked vault and a flag-shaped entry name.