nssh: add status subcommand with --tail (#5)

## Summary

- `nssh status` — list active outbound sessions (local) and/or the
current pinned session (remote). Same command, same output shape, works
on either side.
- `nssh status --tail` — pretty-print jsonl events from all active
sessions, multiplexed with `[target] HH:MM:SS event key=value …`
prefixes. Ctrl+C to stop.
- Introduces a lightweight session registry at
`~/.local/state/nssh/sessions/<pid>.json` — written on connect, removed
on exit, GC'd on stale-PID detection.

## Example

```
$ nssh status
active local sessions:
  PID      TARGET          TOPIC                UPTIME   LOG
  83421    devbox          nssh_xyz             2h14m    ~/.local/state/nssh/nssh.nssh_xyz.jsonl

$ nssh status --tail
following 1 session(s) — Ctrl+C to stop
[devbox] 16:42:01 message-in kind=clip-read-request id=abc
[devbox] 16:42:02 message-in kind=open url=https://…
```

On remote hosts the command projects `~/.local/state/nssh/session` (the
TOML written by the local session-init) into the same shape, so `nssh
status` on the remote shows topic/server/log. The two views aren't
mutually exclusive — a machine that's both a local driver and a remote
target gets both sections.

## Test plan

- [x] `go build ./...`, `go vet ./...`, `go test ./...` all pass
- [x] `nssh status` prints `no active nssh sessions` on a clean machine
- [x] Fake registry entry renders in the table
- [x] Impossible PID (999999) is GC'd on the next `status` call
- [ ] Open a real `nssh <host>` session; confirm it appears in `nssh
status`, disappears on exit
- [ ] `nssh status --tail` prints live events during clipboard/xdg-open
activity

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Medium risk because it adds new session lifecycle bookkeeping (pidfile
registry + cleanup) and changes logging/event emission paths used during
active sessions, which could affect observability and session exit
behavior.
> 
> **Overview**
> Adds `nssh status [--tail]` to display active local sessions (via a
new `~/.local/state/nssh/sessions/<pid>.json` registry) and the current
remote pinned session (projected from `~/.local/state/nssh/session`),
with `--tail` multiplexing and pretty-printing new JSONL log events.
> 
> Unifies wire-message logging across the session and shim by
introducing `logMessage` (`msg-send`/`msg-recv` with
`kind`/`mime`/`id`/`url`/`size`), updates clipboard/open paths to emit
these events, and ensures sessions unregister even when exiting via
`os.Exit`.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
275c972. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: 3 people

cmd/nssh/clipboard.go

@@ -70,7 +70,10 @@ func handleClipReadRequest(env wire.Envelope, topicURL string) {
 		resp := wire.Envelope{Kind: "clip-read-response", ID: env.ID}
 		resp.Body = base64.StdEncoding.EncodeToString([]byte("ERROR: " + err.Error()))
 		body, _ := json.Marshal(resp)
-		ntfy.PublishMessage(topicURL, string(body))
+		if perr := ntfy.PublishMessage(topicURL, string(body)); perr != nil {
+			fmt.Fprintf(os.Stderr, "nssh: clip-read error response: %v\n", perr)
+		}
+		logMessage("out", resp, 0)
 		return
 	}
 
@@ -92,4 +95,5 @@ func handleClipReadRequest(env wire.Envelope, topicURL string) {
 			fmt.Fprintf(os.Stderr, "nssh: clip-read response: %v\n", err)
 		}
 	}
+	logMessage("out", resp, len(data))
 }

cmd/nssh/log.go

@@ -7,6 +7,8 @@ import (
 	"path/filepath"
 	"sync"
 	"time"
+
+	"github.com/abizer/nssh/v2/internal/wire"
 )
 
 var (
@@ -64,3 +66,29 @@ func logErr(where string, err error) {
 	fmt.Fprintf(os.Stderr, "nssh: %s: %v\n", where, err)
 	logEvent("error", map[string]any{"where": where, "err": err.Error()})
 }
+
+// logMessage emits a msg-send or msg-recv event with a consistent schema so
+// both sides of the tunnel produce the same wire-event shape. "dir" is "in"
+// when the envelope arrived from the topic, "out" when we're publishing.
+// size is the payload size in bytes — attachment size for images, decoded
+// body length for inline text, 0 if unknown.
+func logMessage(dir string, env wire.Envelope, size int) {
+	event := "msg-recv"
+	if dir == "out" {
+		event = "msg-send"
+	}
+	fields := map[string]any{"kind": env.Kind}
+	if env.Mime != "" {
+		fields["mime"] = env.Mime
+	}
+	if env.ID != "" {
+		fields["id"] = env.ID
+	}
+	if env.URL != "" {
+		fields["url"] = env.URL
+	}
+	if size > 0 {
+		fields["size"] = size
+	}
+	logEvent(event, fields)
+}

cmd/nssh/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"bufio"
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -153,23 +154,18 @@ func handleMessage(msg ntfy.Msg, topicURL, sshTarget string) {
 	env, ok := wire.Parse(msg.Message)
 	if !ok {
 		fmt.Fprintf(os.Stderr, "nssh: ignoring unrecognized message (%d bytes)\n", len(msg.Message))
-		logEvent("message-ignored", map[string]any{"size": len(msg.Message)})
+		logEvent("msg-unknown", map[string]any{"size": len(msg.Message)})
 		return
 	}
-	fields := map[string]any{"kind": env.Kind}
-	if env.Mime != "" {
-		fields["mime"] = env.Mime
-	}
-	if env.ID != "" {
-		fields["id"] = env.ID
-	}
-	if env.URL != "" {
-		fields["url"] = env.URL
-	}
+	size := 0
 	if msg.Attachment != nil {
-		fields["attachment_size"] = msg.Attachment.Size
+		size = int(msg.Attachment.Size)
+	} else if env.Body != "" {
+		if decoded, err := base64.StdEncoding.DecodeString(env.Body); err == nil {
+			size = len(decoded)
+		}
 	}
-	logEvent("message-in", fields)
+	logMessage("in", env, size)
 
 	switch env.Kind {
 	case "open":
@@ -302,6 +298,7 @@ func usage() {
 	fmt.Fprintln(os.Stderr, "  nssh [--ssh|--mosh] <host> [ssh args...]   open a session")
 	fmt.Fprintln(os.Stderr, "  nssh infect [--force] <host>               install on a remote host")
 	fmt.Fprintln(os.Stderr, "  nssh infect [--force] self                 symlink personas on this machine")
+	fmt.Fprintln(os.Stderr, "  nssh status [--tail]                       show active sessions")
 	fmt.Fprintln(os.Stderr, "  nssh --version                             print version info")
 	os.Exit(1)
 }
@@ -357,6 +354,9 @@ func main() {
 		case "infect":
 			infectCmd(os.Args[2:])
 			return
+		case "status":
+			statusCmd(os.Args[2:])
+			return
 		case "-v", "--version":
 			printVersion()
 			return
@@ -448,6 +448,12 @@ func nsshMain() {
 		"server": cfg.Server,
 	})
 
+	sessionFile, err := registerSession(cfg, sshTarget)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "nssh: register session: %v\n", err)
+	}
+	defer unregisterSession(sessionFile)
+
 	// One SSH login-shell to probe version, write the session file, and seed
 	// the remote JSONL log before the interactive session starts.
 	remoteVer := prepareRemote(sshTarget, cfg)
@@ -493,13 +499,14 @@ func nsshMain() {
 		session = exec.Command("ssh", sshArgs...)
 	}
 
-	err := runSession(session, sigs)
+	sessErr := runSession(session, sigs)
 	resetTerminal()
 	exitCode := 0
-	if exitErr, ok := err.(*exec.ExitError); ok {
+	if exitErr, ok := sessErr.(*exec.ExitError); ok {
 		exitCode = exitErr.ExitCode()
 	}
 	logEvent("session-end", map[string]any{"exit": exitCode, "mosh": useMosh})
+	unregisterSession(sessionFile) // defers don't fire under os.Exit
 	if exitCode != 0 {
 		os.Exit(exitCode)
 	}

cmd/nssh/shim.go

@@ -34,24 +34,19 @@ func shimClipWrite(topicURL, mime string) {
 		os.Exit(1)
 	}
 	if len(data) == 0 {
-		logEvent("clip-write-empty", nil)
+		logEvent("clip-write-empty", map[string]any{"mime": mime})
 		return
 	}
-	logEvent("clip-write", map[string]any{"mime": mime, "size": len(data)})
 
+	env := wire.Envelope{Kind: "clip-write", Mime: mime}
 	if len(data) <= inlineThreshold && !strings.HasPrefix(mime, "image/") {
-		env := wire.Envelope{
-			Kind: "clip-write",
-			Mime: mime,
-			Body: base64.StdEncoding.EncodeToString(data),
-		}
+		env.Body = base64.StdEncoding.EncodeToString(data)
 		body, _ := json.Marshal(env)
 		if err := ntfy.PublishMessage(topicURL, string(body)); err != nil {
 			fmt.Fprintf(os.Stderr, "nssh: %v\n", err)
 			os.Exit(1)
 		}
 	} else {
-		env := wire.Envelope{Kind: "clip-write", Mime: mime}
 		msg, _ := json.Marshal(env)
 		filename := "clip.dat"
 		if strings.HasPrefix(mime, "image/png") {
@@ -62,19 +57,20 @@ func shimClipWrite(topicURL, mime string) {
 			os.Exit(1)
 		}
 	}
+	logMessage("out", env, len(data))
 }
 
 func shimClipRead(topicURL, mime string) {
 	id := strconv.FormatInt(time.Now().UnixNano(), 36)
 	since := strconv.FormatInt(time.Now().Unix(), 10)
-	logEvent("clip-read-request", map[string]any{"mime": mime, "id": id})
 
 	req := wire.Envelope{Kind: "clip-read-request", ID: id, Mime: mime}
 	body, _ := json.Marshal(req)
 	if err := ntfy.PublishMessage(topicURL, string(body)); err != nil {
 		fmt.Fprintf(os.Stderr, "nssh: publish read request: %v\n", err)
 		os.Exit(1)
 	}
+	logMessage("out", req, 0)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
@@ -112,7 +108,7 @@ func shimClipRead(topicURL, mime string) {
 				logEvent("clip-read-error", map[string]any{"id": id, "err": string(data)})
 				os.Exit(1)
 			}
-			logEvent("clip-read-resolved", map[string]any{"id": id, "size": len(data), "inline": true})
+			logMessage("in", env, len(data))
 			os.Stdout.Write(data)
 			return
 		}
@@ -122,7 +118,7 @@ func shimClipRead(topicURL, mime string) {
 				fmt.Fprintf(os.Stderr, "nssh: fetch attachment: %v\n", err)
 				os.Exit(1)
 			}
-			logEvent("clip-read-resolved", map[string]any{"id": id, "size": len(data), "inline": false})
+			logMessage("in", env, len(data))
 			os.Stdout.Write(data)
 			return
 		}
@@ -166,6 +162,7 @@ func doXdgOpen(args []string) {
 		logEvent("publish-failed", map[string]any{"kind": "open", "err": err.Error()})
 		runFallback("xdg-open", args)
 	}
+	logMessage("out", env, 0)
 }
 
 func doXclip(args []string) {