chore: notification bridge follow-up cleanups (I1-I5)

[ShunmeiCho]

Context

PR #17 delivered the SSH notification bridge (v0.5.0 clipboard notification + v0.6.0 notification bridge). Deep audit identified 5 IMPORTANT items deferred as follow-up to keep the feature PR focused.

Checklist

I1: Extract subcommands from main.go (1624 lines → ~800)

• cmd/cc-clip/connect.go — connectOpts, cmdConnect, runConnect, connectNotifySetup
• cmd/cc-clip/notify.go — cmdNotify, parseCodexNotifyPayload, postGenericNotification
• cmd/cc-clip/serve.go — cmdServe
• Pure mechanical refactor, same package, no behavior change

I2: Dedup map eviction

• Add periodic sweep to Deduper (delete entries older than 2x window)
• Integrate sweep into session cleanup ticker (already runs every 30 min in cmdServe)
• Test: verify entries are removed after expiry

I3: Improve /notify auth error messages

• Distinguish missing Authorization header vs invalid nonce vs malformed Bearer prefix
• Return specific 401 messages for each case

I4: Improve test coverage

• internal/shim: 39.5% → 60%+ (add tests for codexNotifyManagedBlock edge cases)
• cmd/cc-clip: 8.7% → 30%+ (add tests for cmdNotify flag parsing, connectNotifySetup logic)
• Note: SSH-dependent functions (WriteRemoteNotificationNonce, etc.) require integration test infrastructure

I5: CmuxDeliverer context cancellation

• Change exec.Command to exec.CommandContext(ctx, ...) in deliver_cmux.go
• Add test: verify delivery is cancelled when context expires

Related

• PR: feat: clipboard preview notification + SSH notification bridge #17
• Design doc: docs/plans/2026-04-01-notification-bridge-design.md

[ShunmeiCho]

Status Update (2026-04-03)

All 5 items remain open. Progress check against codebase:

Item	Status	Evidence
I1: Extract subcommands	Open	main.go still 1630 lines, no connect.go/notify.go/serve.go extracted
I2: Dedup map eviction	Open	dedup.go has no periodic sweep; expired entries not evicted from map
I3: /notify auth errors	Open	Single generic "invalid notification nonce" for all auth failures (server.go:391)
I4: Test coverage	Open	internal/shim: 38.6% (target 60%), cmd/cc-clip: 8.6% (target 30%)
I5: CmuxDeliverer context	Open	deliver_cmux.go:30 uses exec.Command, not exec.CommandContext

[ShunmeiCho]

Status refresh (2026-05-20)

Refreshed after the v0.7.2-v0.7.4 hardening releases.

Item	Status	Evidence
I1 split cmd/cc-clip/main.go	Open	cmd/cc-clip/main.go is now 1873 lines; no connect.go / notify.go / serve.go extraction yet.
I2 dedup eviction	Open	internal/daemon/dedup.go still has no periodic sweep/eviction path.
I3 /notify auth errors	Open	/notify still returns a generic invalid notification nonce for missing/malformed/invalid auth.
I4 coverage	In progress	go test ./cmd/cc-clip ./internal/shim -cover -count=1: cmd/cc-clip is 15.5% and internal/shim is 53.7%. This is improved from the previous 8.6% / 38.6% baseline, but still below the 30% / 60% targets.
I5 CmuxDeliverer context	Open	internal/daemon/deliver_cmux.go still uses exec.Command, not exec.CommandContext.

Suggested next batch: group I2 + I5 with the long-running hardening work (notifyNonces cap/LRU, preview cleanup ticker) rather than mixing them with CLI refactors.

[ShunmeiCho]

Status update post #68 + #69

Closed by #68 (commit c19bca3)

• I2 — Dedup map eviction: implemented in internal/daemon/dedup.go. Deduper.AllowAt now opportunistically sweeps expired entries on every call to prevent unbounded growth. Covered by TestDeduperEvictsExpiredEntriesDuringAllowAt.
• I5 — CmuxDeliverer context cancellation: implemented in internal/daemon/deliver_cmux.go. exec.Command switched to exec.CommandContext(ctx, ...), and DeliveryChain now short-circuits on context.Canceled instead of falling through to the next adapter. Covered by TestCmuxDelivererHonorsCanceledContext, TestDeliveryChainShortCircuitsOnContextCanceled, and TestDeliveryChainBailsBeforeAdapterWhenContextDone.

Partially advanced by #68

• I4 — Test coverage: fix(daemon): long-running stability hardening across 4 subsystems #68 added 8 new tests (4 hardening + 4 self-review regression) across dedup, deliver_cmux, notify_darwin, and server.go. Current numbers: internal/shim 52.0% (target 60%), cmd/cc-clip 15.4% (target 30%). Still below the original I4 bar.

Followup #69 (in review)

While reviewing the merged state of #68, found that the per-host nonce revocation introduced in RegisterNotificationNonceForHost was unreachable in production because the SSH host was never threaded from cmdConnect → connectNotifySetup → registerNonceWithDaemon → handleRegisterNonce. #69 wires it through and adds endpoint-level + client-roundtrip regression tests. Not part of the I1-I5 backlog itself, but closes the implementation gap behind I5's sibling problem (host-bound credential lifecycle).

Still open

• I1: main.go refactor (1624 → ~800 lines)
• I3: /notify auth error message granularity
• I4: remaining coverage gap to hit 30% / 60% targets

---

Edit: corrected test names to match the actual *_test.go symbols.