Add secret-safe copy and reveal UX coverage

clipboard/service_test.go

@@ -68,6 +68,25 @@ func TestServiceRejectsUnknownEntryAndUnsupportedTarget(t *testing.T) {
 	}
 }
 
+func TestServiceSanitizesClipboardWriteErrors(t *testing.T) {
+	t.Parallel()
+
+	service := Service{Writer: failingWriter{err: errors.New("backend refused token-1")}}
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{ID: "git-server", Password: "token-1"},
+		},
+	}
+
+	err := service.Copy(model, "git-server", TargetPassword)
+	if !errors.Is(err, ErrWriteFailed) {
+		t.Fatalf("Copy() write error = %v, want ErrWriteFailed", err)
+	}
+	if err.Error() != ErrWriteFailed.Error() {
+		t.Fatalf("Copy() write error string = %q, want %q", err.Error(), ErrWriteFailed.Error())
+	}
+}
+
 type memoryWriter struct {
 	content string
 }
@@ -76,3 +95,11 @@ func (w *memoryWriter) WriteText(text string) error {
 	w.content = text
 	return nil
 }
+
+type failingWriter struct {
+	err error
+}
+
+func (w failingWriter) WriteText(string) error {
+	return w.err
+}