feat: clipboard history as guarded capture (goal 0234 S1) (#472)

* feat: clipboard history as guarded capture (goal 0234 S1)

Arrives as composition (ADR-0035), never a Settings toggle: a new
trigger-clipboard-change NodeType polls the real clipboard at 1s,
screening out confidential-marked content (org.nspasteboard.
ConcealedType/TransientType/AutoGeneratedType) and Mill's own
programmatic writes before it ever fires, and feeds a new
apply-clipboard-history-store NodeType that redacts through the
existing SetSecretRedactor seam before persisting. Composed into one
seeded "Clipboard history" workflow, published but disabled by
default -- turning it on is the consent moment for reading the
clipboard at all.

Every copy-back leaves an audit line through the existing secret-read
audit store (0203 S3), reused rather than duplicated. Retention: 200
unpinned entries, oldest evicted, pinned entries exempt (text only in
S1). The Clipboard history dialog (clipboard.history.open command) is
Raycast-shaped: a searchable list with pins floating to the top,
selecting a row previews its full multi-line content in monospace
only when it looks like code.

Also fixes a discovered pre-existing cross-package race: the real
macOS clipboard is one shared OS resource, and internal/adapters/
clipboard's own real-desktop tests could collide with triggersvc's
saved-page seed test under `go test ./...`'s default parallelism --
a new clipboardtest.WithRealClipboardLock (mirroring the e2e suite's
own clipboardLock.ts) now serializes both.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012im1JxQQV2ahnXzZDdVmZq

* test: update palette-item counts for goal 0234's 2 new NodeTypes (44->46)

trigger-clipboard-change and apply-clipboard-history-store bring the
palette census from 43 RegisterNodeType call sites to 45 (+1 declared
step type = 46 total), which composition.spec.ts and node-palette.spec.ts
both hardcode. Verified against the real registry (grep RegisterNodeType
call sites = 45) and against a local run of both spec files, all green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012im1JxQQV2ahnXzZDdVmZq

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: alicoding

frontend/bindings/github.com/alicoding/mill/internal/domain/atlas/models.ts

@@ -71,6 +71,16 @@ export interface BoardObject {
      * contract, extended to this type) -- zero value means live.
      */
     "DeletedAt": string;
+
+    /**
+     * BuiltIn and Seed carry the exact same seed-provenance contract
+     * Card already does (goal 0037/0223): BuiltIn marks a golden
+     * atlassvc's reconcile inserted, Seed tracks which revision and
+     * whether the user has since touched it. A zero Seed means
+     * user-created, same as a Card with no seed origin.
+     */
+    "BuiltIn": boolean;
+    "Seed": seedorigin$0.Origin;
 }
 
 /**

frontend/bindings/github.com/alicoding/mill/internal/domain/clipboardhistory/index.ts

@@ -0,0 +1,6 @@
+// Cynhyrchwyd y ffeil hon yn awtomatig. PEIDIWCH Â MODIWL
+// This file is automatically generated. DO NOT EDIT
+
+export type {
+    Entry
+} from "./models.js";

frontend/bindings/github.com/alicoding/mill/internal/domain/clipboardhistory/models.ts

@@ -0,0 +1,16 @@
+// Cynhyrchwyd y ffeil hon yn awtomatig. PEIDIWCH Â MODIWL
+// This file is automatically generated. DO NOT EDIT
+
+/**
+ * Entry is one captured clipboard text, already redacted (known secret
+ * values and secret-shaped patterns scrubbed) and already screened
+ * (never a confidential-marked or Mill-self-written value) by the time
+ * it reaches this package -- see the apply-clipboard-history-store
+ * node's own doc comment for where those checks happen.
+ */
+export interface Entry {
+    "ID": string;
+    "Text": string;
+    "CreatedAt": string;
+    "Pinned": boolean;
+}

frontend/bindings/github.com/alicoding/mill/internal/services/atlassvc/atlasservice.ts

@@ -264,10 +264,10 @@ export function CreatePerspective(spaceID: string, name: string, description: st
 
 /**
  * DeleteBoardObject soft-deletes a board object (goal 0179/0180) --
- * same tombstone contract as DeleteNote: no seed-tombstone bookkeeping
- * (a board object carries no seed provenance), no link/child blast
- * radius (a board object can be neither a link endpoint nor a
- * container).
+ * same tombstone contract as DeleteCard's own seed-tombstone bookkeeping
+ * (goal 0223 gives BoardObject the same BuiltIn/Seed provenance Card
+ * already carries), minus DeleteCard's link/child blast radius (a
+ * board object can be neither a link endpoint nor a container).
  */
 export function DeleteBoardObject(id: string): $CancellablePromise<$models.TombstoneResult> {
     return $Call.ByID(309976208, id);
@@ -1075,9 +1075,9 @@ export function Undo(): $CancellablePromise<$models.UndoResult> {
  * UndoDelete reverses one or more DeleteCard/DeleteNote/
  * DeleteBoardObject calls: clears DeletedAt on exactly the ids named (a
  * no-op for any id that's no longer tombstoned, e.g. already purged)
- * and clears a built-in card's seed tombstone too, so top-up seeding
- * can reach it again. cardIDs/noteIDs/objectIDs are the exact
- * TombstoneResult(s) the original delete call(s) returned.
+ * and clears a built-in card's or board object's seed tombstone too, so
+ * top-up seeding can reach it again. cardIDs/noteIDs/objectIDs are the
+ * exact TombstoneResult(s) the original delete call(s) returned.
  */
 export function UndoDelete(cardIDs: string[] | null, noteIDs: string[] | null, objectIDs: string[] | null): $CancellablePromise<void> {
     return $Call.ByID(4101274755, cardIDs, noteIDs, objectIDs);

frontend/bindings/github.com/alicoding/mill/internal/services/clipboardhistorysvc/clipboardhistoryservice.ts

@@ -0,0 +1,55 @@
+// Cynhyrchwyd y ffeil hon yn awtomatig. PEIDIWCH Â MODIWL
+// This file is automatically generated. DO NOT EDIT
+
+/**
+ * ClipboardHistoryService holds every captured entry in memory,
+ * persisted as one JSON blob -- the same settings-store-backed shape
+ * guardrailsvc.GuardrailService already uses for a small, infrequently
+ * large collection (at most MaxUnpinned + however many are pinned).
+ * @module
+ */
+
+// eslint-disable-next-line @typescript-eslint/ban-ts-comment
+// @ts-ignore: Unused imports
+import { Call as $Call, CancellablePromise as $CancellablePromise } from "@wailsio/runtime";
+
+// eslint-disable-next-line @typescript-eslint/ban-ts-comment
+// @ts-ignore: Unused imports
+import * as clipboardhistory$0 from "../../domain/clipboardhistory/models.js";
+
+/**
+ * CopyClipboardHistoryEntry writes id's text back to the real
+ * clipboard and records one audit line (goal 0234, reusing 0203 S3's
+ * audit plane). clipboard.WriteText also marks this write as Mill's
+ * own, so the trigger-clipboard-change poller skips re-capturing it as
+ * a new entry on the very next cycle.
+ */
+export function CopyClipboardHistoryEntry(id: string): $CancellablePromise<void> {
+    return $Call.ByID(2401224501, id);
+}
+
+/**
+ * DeleteClipboardHistoryEntry permanently removes id -- no undo, same
+ * posture SecretService.DeleteSecret already takes for its own entries.
+ */
+export function DeleteClipboardHistoryEntry(id: string): $CancellablePromise<void> {
+    return $Call.ByID(934528427, id);
+}
+
+/**
+ * ListClipboardHistory returns every entry, pinned-first then newest-
+ * first (clipboardhistory.SortForDisplay) -- the order the Clipboard
+ * history dialog renders directly.
+ */
+export function ListClipboardHistory(): $CancellablePromise<clipboardhistory$0.Entry[] | null> {
+    return $Call.ByID(2660370174);
+}
+
+/**
+ * SetClipboardHistoryPinned pins or unpins id -- a pinned entry floats
+ * to the top of ListClipboardHistory and is never evicted by Append's
+ * retention cap, regardless of age.
+ */
+export function SetClipboardHistoryPinned(id: string, pinned: boolean): $CancellablePromise<void> {
+    return $Call.ByID(3165372480, id, pinned);
+}

frontend/bindings/github.com/alicoding/mill/internal/services/clipboardhistorysvc/index.ts

@@ -0,0 +1,7 @@
+// Cynhyrchwyd y ffeil hon yn awtomatig. PEIDIWCH Â MODIWL
+// This file is automatically generated. DO NOT EDIT
+
+import * as ClipboardHistoryService from "./clipboardhistoryservice.js";
+export {
+    ClipboardHistoryService
+};

frontend/e2e/clipboard-history.spec.ts

@@ -0,0 +1,128 @@
+import { chromium, expect, test } from '@playwright/test'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { CLIPBOARD_HISTORY_MCP_BASE_PORT, CLIPBOARD_HISTORY_SERVER_BASE_PORT, spawnMillServer, type SpawnedServer } from './fixtures/server'
+import { paletteDialog } from './fixtures/palette'
+import { seedClipboardHistoryEntry } from './fixtures/clipboardHistorySeed'
+import { withClipboardLock } from './fixtures/clipboardLock'
+
+// Clipboard history (goal 0234): the surface's own task -- search,
+// preview, copy, pin, and delete what's been captured -- driven end to
+// end. Dedicated server (own settings file): the entry list is GLOBAL
+// app state (testing.md's shared-vs-dedicated rule) and this spec
+// asserts the true empty state, which needs a guaranteed-fresh
+// settings file. Entries are seeded via ExecutionService.
+// RunWorkflowWithPayload (fixtures/clipboardHistorySeed.ts), never a
+// real clipboard copy -- goal 0234's own e2e-divergence note: the real
+// trigger needs an actual macOS clipboard change to fire, which is
+// CI-hostile on headless runners.
+// eslint-disable-next-line no-empty-pattern -- needs `testInfo`, not any fixture.
+test('Clipboard history: empty state, then search/preview/copy/pin/delete a real seeded entry', async ({}, testInfo) => {
+  const idx = testInfo.parallelIndex
+  const dir = mkdtempSync(path.join(tmpdir(), `mill-e2e-clipboard-history-${idx}-`))
+  const settingsPath = path.join(dir, 'settings.json')
+  const executionDbPath = path.join(dir, 'execution.db')
+  const backupDir = path.join(dir, 'backups')
+  const port = CLIPBOARD_HISTORY_SERVER_BASE_PORT + idx
+  const mcpPort = CLIPBOARD_HISTORY_MCP_BASE_PORT + idx
+
+  let server: SpawnedServer | undefined
+  const browser = await chromium.launch()
+  try {
+    server = await spawnMillServer({ port, mcpPort, settingsPath, executionDbPath, backupDir })
+    const page = await browser.newPage()
+    await page.goto(`${server.baseURL}/`)
+    await expect(page.getByRole('link', { name: 'Home' })).toBeVisible()
+
+    const openClipboardHistory = async () => {
+      await page.keyboard.press('Meta+K')
+      await expect(paletteDialog(page)).toBeVisible()
+      await paletteDialog(page).getByRole('combobox').fill('clipboard history')
+      await paletteDialog(page).getByRole('option', { name: 'Clipboard history', exact: true }).click()
+    }
+
+    const dialog = page.getByRole('dialog', { name: 'Clipboard history' })
+
+    // --- Empty state offers the door to the workflow that fills it ---
+    await openClipboardHistory()
+    await expect(dialog).toBeVisible()
+    await expect(page.getByTestId('clipboard-history-empty')).toContainText('Copies appear here once the Clipboard history workflow is on.')
+    const openWorkflowButton = page.getByTestId('clipboard-history-open-workflow')
+    await expect(openWorkflowButton).toBeVisible()
+    await openWorkflowButton.click()
+    // Opening the door closes the dialog and lands on the seeded
+    // workflow's own editor tab.
+    await expect(dialog).toBeHidden()
+    await expect(page.getByRole('tab', { name: 'Clipboard history', selected: true })).toBeVisible()
+
+    // --- Seed two real entries via the same production run path a
+    // real capture goes through, one plain and one code-shaped ---
+    await seedClipboardHistoryEntry(page, 'buy milk on the way home')
+    await seedClipboardHistoryEntry(page, 'function greet() {\n  console.log("hi")\n}')
+
+    await openClipboardHistory()
+    await expect(dialog).toBeVisible()
+
+    const codeRow = dialog.getByRole('option', { name: /function greet/ })
+    const plainRow = dialog.getByRole('option', { name: /buy milk/ })
+    await expect(codeRow).toBeVisible()
+    await expect(plainRow).toBeVisible()
+
+    // --- Search filters the list ---
+    const search = dialog.getByPlaceholder('Search clipboard history')
+    await search.fill('milk')
+    await expect(plainRow).toBeVisible()
+    await expect(codeRow).toBeHidden()
+    await search.fill('')
+
+    // --- Selecting the code entry previews it in monospace, full
+    // multi-line content preserved ---
+    await codeRow.click()
+    const detailText = page.getByTestId('clipboard-history-detail-text')
+    await expect(detailText).toContainText('function greet() {')
+    await expect(detailText).toContainText('console.log("hi")')
+    await expect(detailText).toHaveCSS('font-family', /mono/i)
+
+    // --- Selecting the plain entry previews it WITHOUT monospace ---
+    await plainRow.click()
+    await expect(detailText).toHaveText('buy milk on the way home')
+    await expect(detailText).not.toHaveCSS('font-family', /mono/i)
+
+    // --- Copy touches the real OS pasteboard (clipboard.WriteText),
+    // one shared resource across every worker (fixtures/clipboardLock.ts)
+    // -- outcome asserted success-or-error, not pinned to success:
+    // pbcopy doesn't exist on a headless Linux CI runner, same
+    // environment-independent pattern secrets.spec.ts's own copy
+    // assertion already uses. ---
+    await withClipboardLock(async () => {
+      await page.getByTestId('clipboard-history-copy').click()
+      const copiedState = page.getByTestId('clipboard-history-copy').getByText('Copied', { exact: true })
+      const errorState = page.getByTestId('clipboard-history-copy-error')
+      await expect(copiedState.or(errorState)).toBeVisible()
+    })
+
+    // --- Pin floats the plain entry above the code entry (it's still
+    // selected from the Copy step above) ---
+    const pinButton = page.getByTestId('clipboard-history-pin')
+    await expect(pinButton).toHaveText('Pin')
+    await pinButton.click()
+    await expect(pinButton).toHaveText('Unpin')
+    await expect(dialog.getByRole('option').first()).toHaveAccessibleName(/buy milk/)
+
+    // --- Delete removes the selected entry; deleting the last one
+    // returns the dialog to its empty state ---
+    await codeRow.click()
+    await page.getByTestId('clipboard-history-delete').click()
+    await expect(codeRow).toBeHidden()
+    await expect(plainRow).toBeVisible()
+
+    await plainRow.click()
+    await page.getByTestId('clipboard-history-delete').click()
+    await expect(page.getByTestId('clipboard-history-empty')).toBeVisible()
+  } finally {
+    await browser.close()
+    await server?.stop()
+    rmSync(dir, { recursive: true, force: true })
+  }
+})

frontend/e2e/composition.spec.ts

@@ -94,8 +94,10 @@ test('Composition page lists built-in workflows; node primitives live in a colla
   // Lists write path, goal 0070) + apply-file-move (file verbs, goal
   // 0087) + apply-atlas-from-reply (the clipboard bridge's accepted-
   // reply materializer, goal 0099) + apply-atlas-ledger-sync (the
-  // delivery-evidence ledger's own mirror node, goal 0164).
-  await expect(activePanel(page).getByTestId('palette-item')).toHaveCount(44)
+  // delivery-evidence ledger's own mirror node, goal 0164) +
+  // trigger-clipboard-change, apply-clipboard-history-store (goal
+  // 0234's guarded clipboard-history capture).
+  await expect(activePanel(page).getByTestId('palette-item')).toHaveCount(46)
 })
 
 test('A new workflow starts with a starter node placed, not a blank canvas', async ({ page }) => {

frontend/e2e/fixtures/clipboardHistorySeed.ts

@@ -0,0 +1,40 @@
+import type { Page } from '@playwright/test'
+
+// Seeds a real Clipboard history entry by running the seeded
+// "Clipboard history" workflow's own graph directly via
+// ExecutionService.RunWorkflowWithPayload -- the SAME bound RPC the
+// canvas's own test-run-with-payload feature already uses (docs/adr/
+// 0008), called by its stable Go method name rather than driven
+// through a real clipboard change. Goal 0234's own e2e-divergence note:
+// the real trigger needs an actual macOS clipboard change to fire,
+// which is CI-hostile (GitHub's headless runners have no pasteboard
+// session); this exercises the exact same production
+// apply-clipboard-history-store step every real capture goes through,
+// just started a different way -- same reasoning as
+// atlasNativeDropEscapeHatch.ts's own CreateBoardObject call. Runs the
+// workflow's DRAFT head (RunKind "test"), which the seed ships
+// PUBLISHED-and-identical to, so this works whether or not the seed
+// has been enabled.
+export async function seedClipboardHistoryEntry(page: Page, text: string): Promise<void> {
+  const result = await page.evaluate(async (text) => {
+    const callID = `${Date.now()}-${Math.random().toString(36).slice(2)}`
+    const body = {
+      object: 0, // @wailsio/runtime's objectNames.Call
+      method: 0, // CallBinding
+      args: {
+        'call-id': callID,
+        methodName: 'github.com/alicoding/mill/internal/services/executionsvc.ExecutionService.RunWorkflowWithPayload',
+        args: ['clipboard-history-workflow', 'test', null, text],
+      },
+    }
+    const res = await fetch(window.location.origin + '/wails/runtime', {
+      method: 'POST',
+      headers: { 'x-wails-client-id': 'e2e-clipboard-history-seed', 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+    return { ok: res.ok, status: res.status, text: await res.text() }
+  }, text)
+  if (!result.ok) {
+    throw new Error(`seedClipboardHistoryEntry(${JSON.stringify(text)}) failed: ${result.status} ${result.text}`)
+  }
+}

frontend/e2e/fixtures/server.ts

@@ -490,3 +490,11 @@ export const UPDATES_WHATSNEW_EMPTY_MCP_BASE_PORT = 10980
 // rendered notes.
 export const UPDATES_WHATSNEW_NOTES_SERVER_BASE_PORT = 11000
 export const UPDATES_WHATSNEW_NOTES_MCP_BASE_PORT = 11020
+
+// clipboard-history.spec.ts (goal 0234): dedicated, same reasoning as
+// SECRETS_SERVER_BASE_PORT above -- Clipboard history's own entry list
+// is GLOBAL app state (testing.md's shared-vs-dedicated rule), and this
+// spec also asserts the true EMPTY state, which needs a guaranteed-
+// fresh settings file no other spec could have already written into.
+export const CLIPBOARD_HISTORY_SERVER_BASE_PORT = 11040
+export const CLIPBOARD_HISTORY_MCP_BASE_PORT = 11060