nssh: codebase cleanup — split, dedupe, type the log schema

[abizer]

Summary

11 commits of focused cleanup. No user-visible behavior changes except where explicitly called out.

What changed

Refactors / dedup

• main.go (507 lines) split into main.go (CLI dispatch, 82 lines), session.go (orchestration + ntfy subscriber), oauth.go (callback proxy), and grew remote.go (SSH helpers) and infect.go (subcommand parser).
• wire.Publish helper consolidates 3 sites that duplicated the marshal-envelope-and-pick-inline-vs-attachment dance.
• runRemoteScript helper consolidates 5 sites that called ssh ... bash -l -s with a script over stdin.
• LogEvent struct types the JSONL log schema — both writer (logEvent/logMessage/prepareRemote) and reader (status.go::formatEvent) marshal against the same type now.
• Dead code removed: logTopic, logErr, shortPath.

Correctness

• golang.org/x/mod/semver replaces hand-rolled looksLikeSemver and string-equality version compare. Fixes a latent false-positive: v1.2.3+build1 vs v1.2.3+build2 no longer triggers the upgrade nag. Behavior change worth noting: a release client connecting to a remote running a +dirty dev build of the same release no longer prompts to overwrite.
• proxyOAuthCallback now caps Accept at 5 minutes via a TCPListener deadline. Previously, an abandoned OAuth flow leaked the listener + goroutine until session end.
• latestReleaseTag parses the GitHub response with encoding/json instead of hunting for \"tag_name\":\" with strings.Index.

Cross-platform

• internal/clipboard gated to GOOS=darwin via filename suffix; clipboard_other.go provides stub functions returning errUnsupported so the linux remote-shim build compiles cleanly.
• runRemoteScript change: three infectRemote ssh sites now run with BatchMode=yes. Password-auth-only setups will see Permission denied (publickey) instead of repeated prompts. Pubkey auth that worked for the initial scp works for every subsequent ssh.

CI

• New .github/workflows/test.yaml runs go vet + go test on PRs and master pushes; reusable via workflow_call.
• release.yml now needs: test so goreleaser is gated on green tests.
• flake.nix sets doCheck = true, so the cachix build runs go test as part of nix build.

Tests

• New: wire.Publish (5 cases — inline / image-attachment / large-text / no-mutate / nil-data), LogEvent schema (4 cases — omit-zeros, preserve explicit zero/false, round-trip, wire subset).
• cmd/nssh had zero tests; now has log_test.go. Broader test coverage tracked separately.

Test plan

• go test ./... passes on darwin
• go vet ./... and staticcheck ./... clean
• GOOS=linux GOARCH=amd64 go build succeeds
• nix build succeeds (test job runs under doCheck = true)
• Smoke test on a real remote after merge: nssh devbox, paste image, xdg-open, OAuth callback flow

Files

.github/workflows/release.yml         |   4 +
.github/workflows/test.yaml           |  18 +
CLAUDE.md                             |   6 +-
cmd/nssh/{clipboard,infect,log,main}.go (refactored)
cmd/nssh/oauth.go                     |  98 ++++ (new)
cmd/nssh/remote.go                    |  97 ++++ (new — runRemoteScript + prepareRemote + resolveShortHost)
cmd/nssh/session.go                   | 303 ++++ (new — nsshMain + subscriber + handleMessage)
cmd/nssh/log_test.go                  |  95 ++++ (new)
flake.nix                             |   2 +-
go.mod, go.sum                        |   x/mod/semver
internal/clipboard/clipboard_darwin.go (renamed from clipboard.go)
internal/clipboard/clipboard_other.go |  15 + (new — stubs for !darwin)
internal/wire/publish.go              |  38 ++ (new)
internal/wire/publish_test.go         | 135 +++ (new)

🤖 Generated with Claude Code

---

Note

Medium Risk
Medium risk due to significant refactoring of session/infect/message-handling code and changes to version comparison and remote SSH invocation (BatchMode=yes), which could affect install/upgrade prompts and remote automation behavior.

Overview
Restructures the nssh CLI implementation by splitting the former large main.go into focused modules (session.go, oauth.go, remote.go) and moving infect argument parsing into infect.go, while keeping the same high-level flows.

Deduplicates wire/transport plumbing by introducing wire.Publish (central inline-vs-attachment logic) and runRemoteScript (shared ssh ... bash -l -s helper), and updates clipboard/shim code to reuse these helpers and avoid repeated base64/JSON handling.

Tightens correctness around versions, OAuth, and logging: replaces hand-rolled semver checks with golang.org/x/mod/semver (including semver-based remote/local mismatch checks), adds a 5-minute accept deadline to OAuth callback proxying, switches GitHub release tag parsing to encoding/json, and replaces map-based log events with a typed LogEvent schema that is used by both log writer and status --tail formatter (with new unit tests).

Improves build/CI signal and docs by adding a reusable test GitHub workflow and gating releases on it, enabling doCheck in flake.nix, adding non-darwin clipboard stubs for cross-compilation, and adding new docs/internals.md + docs/protocol.md references from README/CLAUDE.

^{Reviewed by Cursor Bugbot for commit d129354. Bugbot is set up for automated code reviews on this repo. Configure here.}