@nomac/cli 0.11.4 → 0.11.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomac/cli",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "description": "Cloud Mac sessions over SSH and HTTPS, plus iOS builds and publishing — built for agents.",
   "license": "UNLICENSED",
   "type": "module",
@@ -19,11 +19,11 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "https-proxy-agent": "^9.1.0",
     "ignore": "^7.0.0",
+    "proxy-from-env": "^2.1.0",
     "tar": "^7.4.0",
-    "ws": "^8.21.3",
-    "https-proxy-agent": "^9.1.0",
-    "proxy-from-env": "^2.1.0"
+    "ws": "^8.21.3"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/src/cli.mjs

@@ -106,6 +106,7 @@ export async function main(argv) {
     case "exec":
     case "job":
     case "output":
+    case "cancel":
     case "sync":
     case "ssh":
     case "desktop":

package/src/hosted-sessions.mjs

@@ -1,15 +1,17 @@
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { api, CliError } from "./api.mjs";
 import { sessionStore } from "./session-store.mjs";
-import { forwardingArg, isShellLine, runProcess, sshArgs, workspaceCommand } from "./session-ssh.mjs";
+import { forwardingArg, isShellLine, runProcess, shellQuote, sshArgs, validateWorkspace, workspaceCommand } from "./session-ssh.mjs";
 import { describePull, describeSync, pullProject, syncProject } from "./session-transfer.mjs";
 import { macRequest, sessionId, transportOptions } from "./mac-transport.mjs";
 import { copyToClipboard, desktop, DESKTOP_HELP, screenSharing } from "./desktop.mjs";
 import { screenshot, startRecording, stopRecording } from "./mac-screen.mjs";
 
+const WORKSPACE = "/Users/agent/workspace";
+
 const HELP = `Nomac cloud Mac sessions
   nomac start [--wait 300] [--max-duration 7200] [--idle-timeout 600] [--max-cost 5] [--json]
               [--prompts ask]
@@ -17,7 +19,9 @@ const HELP = `Nomac cloud Mac sessions
                                     password prompts, its login password in
                                     $NOMAC_MAC_PASSWORD. --prompts ask keeps macOS's
                                     usual prompts.
-  nomac sync . [--dry-run]           upload changed files
+  nomac sync . [--dry-run]           upload changed files to the project folder on the Mac:
+                                    ~/drive/src/<this folder's name>, kept between sessions
+                                    (~/workspace with --drive none)
   nomac ssh [--forward 8080:3000]    full Mac shell and port forwarding
   nomac ssh -- command args         run any command over SSH
   nomac desktop [--no-open] [--json] the full macOS desktop in your browser
@@ -44,6 +48,7 @@ const HELP = `Nomac cloud Mac sessions
                                     (--request-key KEY makes a scripted retry safe)
   nomac job JOB_ID [--wait 600]     wait for a command that outlasted --wait
   nomac output JOB_ID [--cursor 0] [--stream stdout|stderr]
+  nomac cancel JOB_ID               stop a running command and everything it started
   nomac pull ./output [--from PATH] retrieve files before stopping
   nomac screenshot [--simulator] [-o FILE]
                                     save the screen (or the Simulator) as a JPEG,
@@ -54,13 +59,14 @@ const HELP = `Nomac cloud Mac sessions
   nomac status [--json]             state, cost so far and when it stops
   nomac attach [SESSION_ID]         use the account's running Mac from this folder, when your
                                     agent started it elsewhere (MCP, the dashboard); start does it too
-  nomac stop [--wait 60] [--json]   stop the Mac: deletes it and its files (not ~/drive)
+  nomac stop [--wait 60] [--json]   stop the Mac: deletes it and its files, not ~/drive
+                                    (your synced project stays there)
 
 Login once with nomac login. The CLI creates a local SSH key; it sends only the
 public key. Sessions use the port-443 gateway and verified guest host keys.
 Credit is used at $0.80 an hour, billed by the minute, while the VM is ready,
 including between commands. Sessions run 2 hours by default (--max-duration,
-up to 8 hours) and spend at most $5 (--max-cost). No credit? nomac credits buy. Stop removes the VM and its files; pull first.
+up to 8 hours) and spend at most $5 (--max-cost). No credit? nomac credits buy. Stop removes the VM and every file outside ~/drive.
 A wait timeout leaves the session attached: inspect status or run stop.
 Use nomac start --host user@mac to connect an existing Mac instead.`;
 const options = {
@@ -198,10 +204,10 @@ async function waitForCommand(id, base, started, waitSeconds, { request, transpo
     const unknown = job.state === "unknown";
     const busyNote = busy ? "The Mac is busy (for example, the iOS Simulator is booting) and answers slowly. " : "";
     const next = unknown ? `The Mac could not confirm whether ${job.id} finished. Inspect it with nomac job ${job.id}; do not rerun it.`
-      : `${busyNote}Still running after ${waitSeconds} s; it keeps running on the Mac. Wait for it: nomac job ${job.id} --wait 600. Next time wait up front: nomac exec --wait 600 -- command. Over an hour: nomac ssh -- command. Do not rerun it.`;
+      : `${busyNote}Still running after ${waitSeconds} s; it keeps running on the Mac. Wait for it: nomac job ${job.id} --wait 600. Next time wait up front: nomac exec --wait 600 -- command. Over an hour: nomac ssh -- command. Do not rerun it; to stop it: nomac cancel ${job.id}.`;
     if (json) print(JSON.stringify({ ...job, ...(busy ? { busy: true } : {}), next_step: next }, null, 2));
     else if (unknown) stderr(`nomac: ${next}\n`);
-    else stderr(`nomac: ${busy ? "the Mac is busy (for example, the iOS Simulator is booting); " : ""}still running after ${waitSeconds} s (${job.id}); it keeps running on the Mac.\n  wait for it:            nomac job ${job.id} --wait 600\n  next time, wait longer: nomac exec --wait 600 -- command\n  over an hour:           nomac ssh -- command\n`);
+    else stderr(`nomac: ${busy ? "the Mac is busy (for example, the iOS Simulator is booting); " : ""}still running after ${waitSeconds} s (${job.id}); it keeps running on the Mac.\n  wait for it:            nomac job ${job.id} --wait 600\n  stop it:                nomac cancel ${job.id}\n  next time, wait longer: nomac exec --wait 600 -- command\n  over an hour:           nomac ssh -- command\n`);
     exitWith(unknown ? 1 : STILL_RUNNING);
     return job;
   }
@@ -247,6 +253,12 @@ const uncertainOutcome = error => !Number.isInteger(error?.status) || error.stat
 const usd = microunits => `$${(Number(microunits ?? 0) / 1_000_000).toFixed(2)}`;
 const clockUtc = ms => new Date(ms).toISOString().slice(11, 16) + " UTC";
 /** One readable paragraph for nomac status. */
+/** "Project: ~/drive/src/app, on your drive: the next session continues from it." */
+export function projectLine({ path, on_drive }) {
+  const short = String(path).replace(/^\/Users\/agent(?=\/)/, "~");
+  return on_drive ? `Project: ${short}, on your drive: kept when the Mac stops, and the next session builds only what changed.`
+    : `Project: ${short}, deleted when the Mac stops: nomac pull what you need first.`;
+}
 export function statusSummary(session, image) {
   const lines = [`${session.id}: ${session.state}`];
   if (image?.macos) {
@@ -297,9 +309,12 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     const usage = billing?.mode === "weekly_included"
       ? `Included time used: ${billing.used_seconds} seconds. No extra charge.`
       : `Cost so far: $${(Number(result.session?.cost?.accrued_microunits ?? 0) / 1_000_000).toFixed(2)} ($0.80/hour, billed by the minute while the Mac is ready). Credit left: nomac credits`;
-    const next = result.session.state === "ready" ? "Next: nomac sync . → nomac ssh"
+    const next = result.session.state === "ready" ? `${result.project ? `${projectLine(result.project)}\n` : ""}Next: nomac sync . → nomac ssh`
       : result.session.failure_code === "capacity_unavailable" ? "No Mac was free within 5 minutes; nothing was charged. Run nomac start again in a few minutes."
-      : result.session.state === "queued" ? "Waiting for a free Mac (waiting is free). Check again: nomac start" : "Check: nomac session status --json";
+      : result.session.state === "queued" ? "Waiting for a free Mac (waiting is free). Check again: nomac start"
+      : ["stopped", "failed"].includes(result.session.state) ? `${result.session.drive ? "The drive saves in the background (nomac drive shows it). " : ""}Start another: nomac start`
+      : result.session.state === "stopping" ? "Stopping. Check: nomac status"
+      : "Check: nomac status";
     print(`${result.attached ? `${result.attached}\n` : ""}${result.session.id}: ${result.session.state}\n${next}\n${usage}${result.warning ? `\n${result.warning}` : ""}`);
     return result;
   };
@@ -316,10 +331,39 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     const access = await sessionAccess(local.id, request);
     if (local.generation && (local.generation !== access.generation || local.hostKey !== access.ssh.host_key)) throw new CliError("The guest identity changed. Stop this session and start a fresh one.", undefined, undefined, "host_key_changed");
     if (local.attached && !local.keyAdded) await addKey(local);
-    Object.assign(local, { generation: access.generation, hostKey: access.ssh.host_key, target: `agent@nomac-${local.id}`, workspace: "/Users/agent/workspace", knownHosts: join(store.directory, "known_hosts") });
+    // A session an older CLI began in ~/workspace stays there, so nothing moves mid-session.
+    if (local.workspace && !local.workspaceDecided) local.workspaceDecided = true;
+    if (!local.workspaceDecided) await placeWorkspace(local);
+    Object.assign(local, { generation: access.generation, hostKey: access.ssh.host_key, target: `agent@nomac-${local.id}`, workspace: local.workspace ?? WORKSPACE, knownHosts: join(store.directory, "known_hosts") });
     writeFileSync(local.knownHosts, `nomac-${local.id} ${access.ssh.host_key}\n`, { mode: 0o600 }); chmodSync(local.knownHosts, 0o600); store.save(local);
     return local;
   }
+  /**
+   * With the account's drive, this folder's project lives on it, at ~/drive/src/<folder name>,
+   * so the next session finds it and builds only what changed (~/workspace is emptied every
+   * session). A name another local folder took gets a suffix; the claims are kept in
+   * ~/drive/.nomac/projects. Without a drive, the workspace is ~/workspace as before.
+   */
+  async function placeWorkspace(local) {
+    if (local.snapshot?.drive?.state === "mounted") {
+      const name = (basename(store.project).replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[.-]+/, "") || "project").slice(0, 64);
+      const origin = createHash("sha256").update(store.project).digest("hex").slice(0, 12);
+      const script = 'set -e; claims=~/drive/.nomac/projects; mkdir -p "$claims" ~/drive/src; d="$NAME"; '
+        // A folder another local folder claimed, or one made on the Mac some other way, is left alone.
+        + 'if { [ -e "$claims/$d" ] && [ "$(cat "$claims/$d")" != "$ORIGIN" ]; } || { [ ! -e "$claims/$d" ] && [ -n "$(ls -A ~/drive/src/"$d" 2>/dev/null)" ]; }; then d="$NAME-$ORIGIN"; fi; '
+        + 'printf %s "$ORIGIN" > "$claims/$d"; mkdir -p ~/drive/src/"$d"; cd ~/drive/src/"$d"; pwd';
+      const job = await request("POST", `/api/v1/mac/sessions/${sessionId(local.id)}/jobs?wait=30`, { idempotencyKey: `cli-place-${local.id.slice(4, 24)}-${origin}`,
+        body: { argv: ["/bin/bash", "-c", script], env: { NAME: name, ORIGIN: origin }, timeout_seconds: 30 } }).catch(() => null);
+      const path = String(job?.stdout ?? "").trim();
+      if (job?.exit_code === 0 && path.startsWith("/Users/agent/drive/src/") && !path.slice(23).includes("/")) {
+        // The same folder on the drive as last time: what was synced there then is still there.
+        if (local.previousDriveWorkspace?.path === path) store.saveBaseline(local.previousDriveWorkspace.baseline);
+        Object.assign(local, { workspace: validateWorkspace(path), workspaceOnDrive: true });
+      }
+    }
+    delete local.previousDriveWorkspace;
+    local.workspaceDecided = true; store.save(local);
+  }
   /**
    * A Mac started elsewhere (by an agent over MCP, the dashboard or another folder) took no key
    * from this folder: add this folder's own to its authorized keys with an ordinary command, so
@@ -332,6 +376,10 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     if (job.exit_code !== 0) throw new CliError("Could not add this folder's SSH key to the Mac.", `Adding the key ended with ${job.state === "exited" ? `exit code ${job.exit_code}` : `the command ${job.state}`}. Try again: nomac attach ${local.id}`);
     local.keyAdded = true; store.save(local);
   }
+  /** Where this folder's project is on the Mac, once a ready Mac has decided it. */
+  const project = local => local.state === "ready" && local.workspaceDecided ? { project: { path: local.workspace, on_drive: Boolean(local.workspaceOnDrive) } } : {};
+  /** The last session's folder on the drive and what was synced to it, for the next session to pick up. */
+  const previousDrive = old => old?.workspaceOnDrive ? { previousDriveWorkspace: { path: old.workspace, baseline: store.baseline() } } : {};
   /** The account's running Macs, newest first: queued, starting or ready. */
   async function liveSessions() {
     const answer = await request("GET", "/api/v1/mac/sessions");
@@ -342,7 +390,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     const identity = join(store.directory, `id_ed25519_${randomUUID()}`);
     await run("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-C", "nomac-session", "-f", identity]);
     const local = { mode: "hosted", state: view.state, id: sessionId(view.id), identity, attached: true, outcomeUnknown: false, requestKey: `attach-${view.id}`,
-      request: { profile: "standard", limits: view.limits ?? {}, ...(view.access ? { access: view.access } : {}) } };
+      request: { profile: "standard", limits: view.limits ?? {}, ...(view.access ? { access: view.access } : {}) }, ...previousDrive(store.load()) };
     store.save(local); store.saveBaseline({});
     const deadline = now() + wait * 1000;
     for (;;) {
@@ -370,15 +418,25 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     const session = saveView(local, result.session);
     // This folder's Mac has stopped, but the account may run another, started elsewhere.
     const elsewhere = ["stopped", "failed"].includes(session.state) ? (await liveSessions().catch(() => [])).find(s => s.id !== session.id) : undefined;
-    if (values.json) { print(JSON.stringify({ session, ...(result.image ? { image: result.image } : {}), ...(elsewhere ? { running_elsewhere: elsewhere.id } : {}) }, null, 2)); return session; }
-    print(statusSummary(session, result.image) + (elsewhere ? `\nYour account's Mac ${elsewhere.id} is ${elsewhere.state}, started elsewhere: nomac attach` : ""));
+    if (values.json) { print(JSON.stringify({ session, ...(result.image ? { image: result.image } : {}), ...project(local), ...(elsewhere ? { running_elsewhere: elsewhere.id } : {}) }, null, 2)); return session; }
+    print(statusSummary(session, result.image) + (project(local).project ? `\n${projectLine(project(local).project)}` : "") + (elsewhere ? `\nYour account's Mac ${elsewhere.id} is ${elsewhere.state}, started elsewhere: nomac attach` : ""));
     return session;
   }
+  if (command === "cancel") {
+    if (positionals.length !== 1 || !/^job_[a-f0-9]{40}$/.test(positionals[0])) throw new CliError("Usage: nomac cancel JOB_ID");
+    const local = localSession(), job = await hostedRequest(local.id, "POST", `/api/v1/mac/sessions/${sessionId(local.id)}/jobs/${positionals[0]}/cancel`, {}, { request, transport });
+    if (values.json) { print(JSON.stringify(job, null, 2)); return job; }
+    const ended = job.exit_code === null || job.exit_code === undefined ? (job.signal ? `signal ${job.signal}` : job.state) : `exit code ${job.exit_code}`;
+    print(job.cancelled ? `Cancelled ${job.id}: it and everything it started were stopped (${ended}). Its output so far: nomac output ${job.id}`
+      : job.state === "exited" ? `${job.id} had already finished (${job.reason === "cancelled" ? "cancelled" : ended}).` : `${job.id} is ${job.state}.`);
+    return job;
+  }
   if (["exec", "job", "output"].includes(command)) {
     const local = localSession(), base = `/api/v1/mac/sessions/${sessionId(local.id)}`;
     let path, method = "GET", params = {};
     if (command === "exec") {
       if (!positionals.length || !argv.includes("--")) throw new CliError("Use nomac exec -- command args");
+      if (!local.workspaceDecided && !local.workspace) { await refresh(local); if (local.state === "ready") await placeWorkspace(local); }
       if (values["request-key"] !== undefined && !/^[A-Za-z0-9_.:-]{8,128}$/.test(values["request-key"])) throw new CliError("A request key is 8 to 128 letters, digits, underscores, periods, colons or hyphens.");
       // A person running a command once needs no key; scripts pass one so a lost response can be retried safely.
       // Without a key, a long wait implies a long command, so the command's own limit follows it unless set.
@@ -386,7 +444,10 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
       // A command may run an hour (the gateway's limit); waiting can cover all of it.
       const waitFor = integer(values.wait, 30, 0, 3600);
       const timeout = integer(values.timeout, values["request-key"] === undefined ? Math.max(300, waitFor) : 600, 1, 3600);
-      method = "POST"; path = `${base}/jobs`; params = { requestKey: values["request-key"] ?? `cli-${randomUUID()}`, body: { argv: isShellLine(positionals) ? ["/bin/bash", "-lc", positionals[0]] : positionals, timeout_seconds: timeout } };
+      const line = isShellLine(positionals), dir = local.workspaceOnDrive ? local.workspace : null;
+      const remote = dir ? (line ? ["/bin/bash", "-lc", `cd ${shellQuote(dir)} && ${positionals[0]}`] : ["/bin/bash", "-lc", `cd ${shellQuote(dir)} && exec "$@"`, "nomac", ...positionals])
+        : line ? ["/bin/bash", "-lc", positionals[0]] : positionals;
+      method = "POST"; path = `${base}/jobs`; params = { requestKey: values["request-key"] ?? `cli-${randomUUID()}`, body: { argv: remote, timeout_seconds: timeout } };
     } else {
       if (positionals.length !== 1 || !/^job_[a-f0-9]{40}$/.test(positionals[0])) throw new CliError("Supply the existing job ID.");
       path = `${base}/jobs/${positionals[0]}`;
@@ -508,12 +569,12 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
       if (current?.mode === "hosted" && current.id && (!wanted || current.id === wanted) && live.some(s => s.id === current.id)) {
         await refresh(current);
         if (current.state === "ready") await ready(current);
-        return output({ session: current.snapshot, attached: `This folder already uses ${current.id}.` });
+        return output({ session: current.snapshot, attached: `This folder already uses ${current.id}.`, ...project(current) });
       }
       const target = wanted ? live.find(s => s.id === wanted) : live.length === 1 ? live[0] : undefined;
       if (!target) throw new CliError(wanted ? `No running Mac ${wanted} in this account.` : live.length ? `This account has ${live.length} running Macs: name one, nomac attach ${live.map(s => s.id).join(" | ")}` : "This account has no running Mac. Start one: nomac start");
       const local = await attachTo(target);
-      return output({ session: local.snapshot, attached: `Attached to ${local.id}, started elsewhere: ssh, sync, pull and exec work from this folder.` });
+      return output({ session: local.snapshot, attached: `Attached to ${local.id}, started elsewhere: ssh, sync, pull and exec work from this folder.`, ...project(local) });
     }
     if (command === "start") {
       if (positionals.length) throw new CliError("Usage: nomac start [--wait SECONDS] [--json]");
@@ -537,7 +598,8 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
         const identity = join(store.directory, `id_ed25519_${randomUUID()}`);
         await run("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-C", "nomac-session", "-f", identity]);
         local = { mode: "hosted", state: "requesting", outcomeUnknown: false, identity, requestKey: values["request-key"] ?? `cli-${randomUUID()}`,
-          request: { profile: "standard", public_key: readFileSync(`${identity}.pub`, "utf8").trim(), limits, ...(access ? { access } : {}) } };
+          request: { profile: "standard", public_key: readFileSync(`${identity}.pub`, "utf8").trim(), limits, ...(access ? { access } : {}) },
+          ...previousDrive(store.load()) };
         store.save(local); store.saveBaseline({});
       }
       if (!local.id) {
@@ -551,7 +613,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
             const [running] = await liveSessions();
             if (running) {
               local = await attachTo(running);
-              return output({ session: local.snapshot, attached: `Your account's Mac ${local.id} was already running (started elsewhere): this folder now uses it.` });
+              return output({ session: local.snapshot, attached: `Your account's Mac ${local.id} was already running (started elsewhere): this folder now uses it.`, ...project(local) });
             }
           }
           if (!previouslyUncertain && startRejections.has(error.code) && Number.isInteger(error.status) && error.status >= 400 && error.status <= 503) {
@@ -570,7 +632,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
         await sleep(2000);
       }
       if (local.state === "ready") await ready(local);
-      return output({ session: local.snapshot, request_key: local.requestKey, ...(local.warning ? { warning: local.warning } : {}) });
+      return output({ session: local.snapshot, request_key: local.requestKey, ...project(local), ...(local.warning ? { warning: local.warning } : {}) });
     }
     const local = localSession();
     if (command === "stop") {

package/src/mac-tools.mjs

@@ -28,7 +28,7 @@ export const MAC_TOOLS = [
   { name: "get_mac_drive", description: "Read the account's persistent drive: a disk kept between sessions and mounted at ~/drive on every Mac (50 GB). What is there stays for the next session: keep projects in ~/drive/src for incremental builds; package and build caches (DerivedData, Swift packages, CocoaPods, npm) are kept there already. NoMac saves it when a Mac stops, with nothing to call. Shows the space used, the newest saved version, a save still in progress, recent versions, and the date it is deleted after 90 days without a Mac.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/mac/drive")) },
   { name: "reset_mac_drive", description: "Empty the account's persistent drive: the next Mac starts with a new, empty ~/drive, and everything on the old drive is deleted, with no way back. Stop any running session first (stop_mac). For a single Mac without the drive, start_mac with access drive none instead.", inputSchema: schema({}), handler: async () => text(await api("DELETE", "/api/v1/mac/drive")) },
   { name: "list_secrets", description: "List the account's secrets by name: variables (set in every shell and command on the Mac) and files (with their path on the Mac), whether every Mac receives them or only when asked, sizes, and secrets an agent asked for that the person has not entered yet. Values are never returned.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/secrets")) },
-  { name: "request_secret", description: "Get a link where the person enters a secret in their browser, so its value never passes through this chat: an API token, a .env value, a .p12 certificate or a config file. kind variable is one line of text, set as an environment variable on the Mac; kind file is stored at destination (under the home folder, like ~/.netrc; default ~/.nomac/secrets/<name>). Give the person the url. Then list_secrets shows it, new Macs receive it, and install_secrets puts it on a running Mac. With a shell on this machine, the person can also run nomac secrets set NAME themselves. Never ask for a secret in the chat.", inputSchema: schema({ name: { type: "string", minLength: 1, maxLength: 128 }, kind: { type: "string", enum: ["variable", "file"] }, description: { type: "string", minLength: 1, maxLength: 500, description: "What the person should enter and why; shown to them" }, destination: { type: "string", maxLength: 256 }, delivery: { type: "string", enum: ["every_mac", "on_request"] } }, ["name", "kind", "description"]), handler: async body => text(await api("POST", "/api/v1/secrets/requests", { body })) },
+  { name: "request_secret", description: "Get a link where the person enters a secret in their browser, so its value never passes through this chat: an API token, a .env value, a .p12 certificate or a config file. kind variable is one line of text, set as an environment variable on the Mac; kind file is stored at destination (under the home folder, like ~/.netrc; default ~/.nomac/secrets/<name>). Give the url to the person who holds the value; they need no NoMac account, and it works once, for 24 hours. Then list_secrets shows it, new Macs receive it, and install_secrets puts it on a running Mac. With a shell on this machine, the person can also run nomac secrets set NAME themselves. Never ask for a secret in the chat.", inputSchema: schema({ name: { type: "string", minLength: 1, maxLength: 128 }, kind: { type: "string", enum: ["variable", "file"] }, description: { type: "string", minLength: 1, maxLength: 500, description: "What the person should enter and why; shown to them" }, destination: { type: "string", maxLength: 256 }, delivery: { type: "string", enum: ["every_mac", "on_request"] } }, ["name", "kind", "description"]), handler: async body => text(await api("POST", "/api/v1/secrets/requests", { body })) },
   { name: "set_up_signing", description: "Set up App Store signing for a project on the Mac, with the App Store Connect key kept on NoMac's server: reads the project at path (its scheme, app and every extension, with entitlements), registers missing bundle IDs, switches on the capabilities Apple's API can, makes the App Store profiles, and installs them with the account's certificate in a keychain on the Mac. The project never changes. Returns a build settings file (.xcconfig) and export options with the exact xcodebuild, Flutter and fastlane commands. Creates a distribution certificate at Apple only when the account has none. Expo and Capacitor apps need their ios folder first. A step only a person can take comes back as needs_human with its link.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024, description: "The project folder on the Mac, relative to the workspace" }, scheme: { type: "string", minLength: 1, maxLength: 256 }, container: { type: "string", minLength: 1, maxLength: 1024 }, issuer_id: { type: "string", maxLength: 64 } }, ["session_id"]), handler: async ({ session_id, ...body }) => text(await api("POST", `${base({ session_id })}/signing`, { body })) },
   { name: "send_to_testflight", description: "Send a signed .ipa on the Mac to TestFlight, with the App Store Connect key kept on NoMac's server: NoMac creates the upload at Apple and the Mac sends only the file. Apple then processes the build, usually for 5 to 15 minutes with no Mac needed, and NoMac sets the app's export-compliance answer and What to Test and puts it on TestFlight for the internal testers. Repeat the call with the returned request_key to follow it: sending, processing, on_testflight or failed. Once on_testflight, publish with the returned project_id and build_id submits it for App Review. Apple asks once per app whether it uses encryption beyond HTTPS and Apple's own: pass the person's answer as uses_non_exempt_encryption, never a guess. A build number Apple already has comes back with the next free one. A step only a person can take, such as creating the app in App Store Connect, comes back as needs_human with its link.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024, description: "The signed .ipa on the Mac, relative to the workspace or absolute" }, notes: { type: "string", minLength: 1, maxLength: 4000, description: "What to Test, shown to testers" }, uses_non_exempt_encryption: { type: "boolean", description: "The person's answer, asked once per app: does it use encryption beyond HTTPS and Apple's own?" }, issuer_id: { type: "string", maxLength: 64 }, request_key: { ...key, description: "Repeat with the request_key from the first answer to follow that send" }, wait_seconds: { type: "integer", minimum: 0, maximum: 50, description: "Wait up to this long for progress (50 while following)" } }, ["session_id", "path"]), handler: async ({ session_id, ...body }) => text(await api("POST", `${base({ session_id })}/testflight`, { body })) },
   { name: "notarize", description: "Notarize a Developer ID-signed Mac app, disk image or installer on the Mac (.app, .dmg, .pkg or .zip), with the App Store Connect key kept on NoMac's server: the Mac zips an .app and sends the file to Apple with temporary credentials for this one submission. Apple checks it, usually for a few minutes, then the Mac staples the ticket so it opens without a warning, even offline. Repeat the call with the returned request_key to follow it: preparing, uploading, in_progress, stapling, then accepted, invalid or rejected with Apple's issues. Sign first with the Developer ID Application certificate (the person uploads it at nomac.app/apple), the hardened runtime and a secure timestamp: codesign --force --options runtime --timestamp --sign \"Developer ID Application: …\". Keep the Mac running until it is stapled.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024, description: "The .app, .dmg, .pkg or .zip on the Mac, relative to the workspace or absolute" }, issuer_id: { type: "string", maxLength: 64 }, request_key: { ...key, description: "Repeat with the request_key from the first answer to follow that notarization" }, wait_seconds: { type: "integer", minimum: 0, maximum: 50, description: "Wait up to this long for progress (50 while following)" } }, ["session_id", "path"]), handler: async ({ session_id, ...body }) => text(await api("POST", `${base({ session_id })}/notarize`, { body })) },
@@ -40,7 +40,7 @@ export const MAC_TOOLS = [
     return text({ session_id, url, opened_in_browser: opened, message: opened ? "The desktop opened in the human's browser; they may need to sign in to nomac.app." : "Give the human this link; it opens after they sign in to nomac.app." });
   } },
   { name: "stop_mac", description: "Stop billing by shutting down the VM and deleting its files. Retrieve files first. Poll get_mac_session until cleanup_confirmed; stopping only acknowledges the request.", inputSchema: schema({ session_id: session }, ["session_id"]), handler: async args => text(await api("DELETE", base(args))) },
-  { name: "exec_mac", description: "Run any argv command in your cloud Mac workspace. Waits up to wait_seconds (default 20, max 50): a command that finishes in time returns its exit_code, stdout and stderr (first 64 KiB each, as text) in this one call, as soon as it finishes. For builds, tests and other slow commands pass wait_seconds: 50. A longer one returns its job ID: poll get_mac_job, then read_mac_output. Reuse request_key and identical arguments after lost responses; never rerun to get output. Use bash -lc explicitly for shell syntax. timeout_seconds defaults to 300 and caps at 600; raise it for slow work such as a first simulator boot (about 90 seconds). A command can be at most 64 KiB in total: put files on the Mac with write_mac_file (local_path, up to 2 GiB) or fetch_to_mac.", inputSchema: schema({ session_id: session, request_key: key, argv: { type: "array", items: { type: "string" }, minItems: 1 }, timeout_seconds: { type: "integer", minimum: 1, maximum: 600 }, wait_seconds: { type: "integer", minimum: 0, maximum: 50 } }, ["session_id", "request_key", "argv"]), handler: async ({ session_id, request_key, wait_seconds, ...body }) => text(await api("POST", `${base({ session_id })}/jobs?wait=${wait_seconds ?? 20}`, { body, idempotencyKey: request_key })) },
+  { name: "exec_mac", description: "Run any argv command in your cloud Mac workspace. Waits up to wait_seconds (default 20, max 50): a command that finishes in time returns its exit_code, stdout and stderr (first 64 KiB each, as text) in this one call, as soon as it finishes. For builds, tests and other slow commands pass wait_seconds: 50. A longer one returns its job ID: poll get_mac_job, then read_mac_output. Reuse request_key and identical arguments after lost responses; never rerun to get output. Use bash -lc explicitly for shell syntax. cwd runs it in another folder, such as ~/drive/src/app. timeout_seconds defaults to 300 and caps at 3600 (an hour) for builds and test runs; a first simulator boot takes about 90 seconds. cancel_mac_job stops a command. A command can be at most 64 KiB in total: put files on the Mac with write_mac_file (local_path, up to 2 GiB) or fetch_to_mac.", inputSchema: schema({ session_id: session, request_key: key, argv: { type: "array", items: { type: "string" }, minItems: 1 }, cwd: { type: "string", minLength: 1, maxLength: 1024, description: "The folder to run in: relative to the workspace, or ~/… and absolute paths anywhere on the Mac" }, timeout_seconds: { type: "integer", minimum: 1, maximum: 3600 }, wait_seconds: { type: "integer", minimum: 0, maximum: 50 } }, ["session_id", "request_key", "argv"]), handler: async ({ session_id, request_key, wait_seconds, ...body }) => text(await api("POST", `${base({ session_id })}/jobs?wait=${wait_seconds ?? 20}`, { body, idempotencyKey: request_key })) },
   { name: "write_mac_file", description: "Write a file on the Mac: local_path uploads a file from this machine, up to 2 GiB, without its content passing through you; or give content as text, or content_base64 for binary, up to 3 MiB. Relative Mac paths are in the session workspace; ~ is the home folder. Creates missing folders and replaces an existing file in one step; set executable for scripts. Safe to repeat. For a whole project use nomac sync; for larger files fetch_to_mac.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024 }, local_path: { type: "string" }, content: { type: "string" }, content_base64: { type: "string" }, executable: { type: "boolean" } }, ["session_id", "path"]), handler: async ({ session_id, path, local_path, content, content_base64, executable }) => {
     const given = [local_path, content, content_base64].filter(v => v !== undefined).length;
     if (given !== 1) return text({ error: { code: "invalid_request", message: "Give exactly one of local_path, content or content_base64." } });
@@ -115,5 +115,6 @@ export const MAC_TOOLS = [
     return text(save_to && view.state === "ready" ? { ...view, ...await saveFromLink(view, save_to) } : view);
   } },
   { name: "get_mac_job", description: "Inspect the existing command without rerunning it. Retain its job ID until completion and retrieve output before stopping the VM.", inputSchema: schema({ session_id: session, job_id: job }, ["session_id", "job_id"]), handler: async args => text(await api("GET", `${base(args)}/jobs/${encodeURIComponent(args.job_id)}`)) },
+  { name: "cancel_mac_job", description: "Stop a running command and everything it started (its whole process group): SIGTERM, a second to finish, then SIGKILL. It comes back exited with reason cancelled; its output so far stays readable. A command that already finished is returned unchanged (cancelled: false).", inputSchema: schema({ session_id: session, job_id: job }, ["session_id", "job_id"]), handler: async args => text(await api("POST", `${base(args)}/jobs/${encodeURIComponent(args.job_id)}/cancel`)) },
   { name: "read_mac_output", description: "Read stdout/stderr as base64 chunks; resume from next_cursor. If truncated, the final response includes tail_base64 and its absolute tail_offset. Retrieve promptly: only recent completed jobs retain output. output_expired preserves the job receipt and never means rerun. Retrieve before stopping the VM.", inputSchema: schema({ session_id: session, job_id: job, cursor: { type: "integer", minimum: 0 }, stream: { type: "string", enum: ["stdout", "stderr"] } }, ["session_id", "job_id"]), handler: async args => text(await api("GET", `${base(args)}/jobs/${encodeURIComponent(args.job_id)}/output?${new URLSearchParams({ cursor: String(args.cursor ?? 0), stream: args.stream ?? "stdout" })}`)) },
 ];

package/src/secrets.mjs

@@ -14,7 +14,8 @@ come back from NoMac, and are never taken as command-line arguments.
   nomac secrets rm NAME                  delete it
   nomac secrets install [NAME...]        put them on this folder's Mac now  [--session ses_…]
   nomac secrets request NAME --description TEXT [--kind file] [--destination ~/x]
-                                         a link where someone enters it in the browser
+                                         a link for whoever holds it to enter it once,
+                                         in the browser, with no NoMac account
 Add --json for JSON.`;
 
 /**
@@ -130,7 +131,7 @@ export async function secretsCommand(args, { api = defaultApi, print = console.l
     if (names.length !== 1 || !values.description || !["variable", "file"].includes(kind)) throw new CliError("request usage", "Usage: nomac secrets request NAME --description TEXT [--kind file] [--destination ~/x]");
     const result = await api("POST", "/api/v1/secrets/requests", { body: { name: names[0], kind, description: values.description,
       ...(values.destination ? { destination: values.destination } : {}), delivery } });
-    return out(result, `Open this link to enter ${result.name} (expires ${result.expires_at}):\n${result.url}`);
+    return out(result, `Send this link to whoever holds ${result.name}; they need no NoMac account. It works once, until ${result.expires_at.slice(0, 16).replace("T", " ")} UTC:\n${result.url}`);
   }
   throw new CliError("unknown secrets command", SECRETS_HELP);
 }