feat(portal): use wl-clipboard-rs crate instead of wl-paste binary

Author: 0xferrous

Cargo.lock

@@ -12,7 +12,7 @@ This section explains the security posture of using Portal and Agent-box togethe
 
 - **Container**: untrusted or semi-trusted agent execution context.
 - **Portal host**: trusted broker enforcing method policy.
-- **Host binaries** (`gh`, `wl-paste`): executed only by host broker.
+- **Host integrations**: `gh` is executed by the host broker, while clipboard reads are handled directly by the host process via the Wayland clipboard crate.
 
 ## Control mechanisms
 

docs/src/explanation/rationale/security-model.md

@@ -34,7 +34,7 @@ Find and fix common failures for `wl-paste`/`gh` wrappers and other Portal clien
 - **prompt_failed**
   - `prompt_command` missing or exits non-zero in ask-mode
 - **clipboard_failed**
-  - no allowed image MIME currently in clipboard or host `wl-paste` issue
+  - no allowed image MIME currently in clipboard or a host Wayland clipboard access issue
 - **gh_exec_failed**
   - host `gh` unavailable or command failure
 

docs/src/how-to/portal/debug-wrapper-failures.md

@@ -9,7 +9,7 @@
 
 ## Portal-related requirements
 
-- `wl-paste` available on host when using portal clipboard methods
+- Wayland clipboard access available on host when using portal clipboard methods
 - `agent-portal-host` running for wrapper/API operations
 
 ## Optional tooling

docs/src/reference/agent-box/requirements.md

@@ -6,9 +6,6 @@
   - Used by portal clients/wrappers to select socket path.
   - Resolution priority is env var first, then config/default.
 
-- `AGENT_PORTAL_HOST_WL_PASTE`
-  - Used by `agent-portal-host` to override host `wl-paste` binary path.
-
 - `AGENT_PORTAL_HOST_GH`
   - Used by `agent-portal-host` to override host `gh` binary path.
 

docs/src/reference/common/env-vars.md

@@ -32,7 +32,8 @@ This page describes behavior expected from compatibility wrappers in `wrappers/`
 ## Host-side execution model
 
 - Policy decisions and prompts are enforced by `agent-portal-host`.
-- Host service resolves host-native binaries (`gh`, `wl-paste`) to avoid wrapper recursion.
+- Host service resolves the host-native `gh` binary to avoid wrapper recursion.
+- Clipboard reads are handled directly in-process via the Wayland clipboard crate.
 
 ## Versioning
 

docs/src/reference/portal/wrapper-contract.md

@@ -8,7 +8,7 @@ You run `agent-portal-host` and send successful requests with `agent-portal-cli`
 
 - `agent-portal-host` and `agent-portal-cli` installed
 - `~/.agent-box.toml` with `[portal]` enabled
-- `wl-paste` available on host if testing clipboard method
+- Wayland clipboard access available on host if testing clipboard method
 
 ## Minimal config
 

docs/src/tutorials/portal/first-run-standalone.md

@@ -38,13 +38,6 @@ in
       default = null;
       description = "Optional socket path override passed as `--socket` to agent-portal-host.";
     };
-
-    wlPasteBinary = lib.mkOption {
-      type = lib.types.str;
-      default = "${pkgs.wl-clipboard}/bin/wl-paste";
-      defaultText = lib.literalExpression ''"${pkgs.wl-clipboard}/bin/wl-paste"'';
-      description = "Host wl-paste binary used by portal host to avoid wrapper recursion.";
-    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -59,9 +52,7 @@ in
 
       Service = {
         Type = "simple";
-        Environment = [
-          "AGENT_PORTAL_HOST_WL_PASTE=${cfg.wlPasteBinary}"
-        ] ++ lib.optionals cfg.debug [
+        Environment = lib.optionals cfg.debug [
           "RUST_LOG=debug"
         ];
         ExecStart =

nix/home-manager/agent-portal.nix

@@ -21,3 +21,4 @@ serde.workspace = true
 serde_json.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
+wl-clipboard-rs = "0.9.3"

portal/Cargo.toml

@@ -14,6 +14,10 @@ Portal crate containing host service and official CLI for container-to-host medi
 - `clipboard.read_image`
 - `gh.exec`
 
+`clipboard.read_image` is implemented directly against the Wayland clipboard via
+[`wl-clipboard-rs`](https://github.com/YaLTeR/wl-clipboard-rs), rather than shelling out to
+`wl-paste`.
+
 `gh.exec` classification uses an embedded-at-compile-time command policy generated at repo root
 via `portal/scripts/gh-policy-gen.py`:
 `portal/gh-leaf-command-read-write-report.json`.