@nomac/cli 0.3.1 → 0.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomac/cli",
-  "version": "0.3.1",
-  "description": "Cloud Mac sessions over SSH and HTTPS, plus iOS builds and publishing — built for agents.",
+  "version": "0.4.0",
+  "description": "Cloud Mac sessions over SSH and HTTPS, plus iOS builds and publishing \u2014 built for agents.",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {

package/src/hosted-sessions.mjs

@@ -109,7 +109,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     let path, method = "GET", params = {};
     if (command === "exec") {
       if (!positionals.length || !argv.includes("--") || !/^[A-Za-z0-9_.:-]{8,128}$/.test(values["request-key"] ?? "")) throw new CliError("Use nomac exec --request-key STABLE_KEY -- command args");
-      method = "POST"; path = `${base}/jobs`; params = { requestKey: values["request-key"], body: { argv: positionals, timeout_seconds: integer(values.timeout, 60, 1, 600) } };
+      method = "POST"; path = `${base}/jobs`; params = { requestKey: values["request-key"], body: { argv: positionals, timeout_seconds: integer(values.timeout, 300, 1, 600) } };
     } else {
       if (positionals.length !== 1 || !/^job_[a-f0-9]{40}$/.test(positionals[0])) throw new CliError("Supply the existing job ID.");
       path = `${base}/jobs/${positionals[0]}`;

package/src/mac-tools.mjs

@@ -12,7 +12,7 @@ export const MAC_TOOLS = [
   { name: "list_mac_sessions", description: "Find existing Mac sessions, including after losing a response. Shows state, cost, limits and cleanup.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/mac/sessions")) },
   { name: "get_mac_session", description: "Read live Mac allocation state, cost, funded time and cleanup confirmation. queued/provisioning means wait; stopping is not yet confirmed cleanup.", inputSchema: schema({ session_id: session }, ["session_id"]), handler: async args => text(await api("GET", base(args))) },
   { name: "stop_mac", description: "Stop billing by shutting down the VM and deleting its files. Retrieve files first. Poll get_mac_session until cleanup_confirmed; stopping only acknowledges the request.", inputSchema: schema({ session_id: session }, ["session_id"]), handler: async args => text(await api("DELETE", base(args))) },
-  { name: "exec_mac", description: "Run any argv command in your cloud Mac workspace. Returns a durable job ID; poll get_mac_job and read_mac_output. Reuse request_key and identical arguments after lost responses; never submit a new key blindly. Use bash -lc explicitly for shell syntax.", inputSchema: schema({ session_id: session, request_key: key, argv: { type: "array", items: { type: "string" }, minItems: 1 }, timeout_seconds: { type: "integer", minimum: 1, maximum: 600 } }, ["session_id", "request_key", "argv"]), handler: async ({ session_id, request_key, ...body }) => text(await api("POST", `${base({ session_id })}/jobs`, { body, idempotencyKey: request_key })) },
+  { name: "exec_mac", description: "Run any argv command in your cloud Mac workspace. Returns a durable job ID; poll get_mac_job and read_mac_output. Reuse request_key and identical arguments after lost responses; never submit a new key blindly. Use bash -lc explicitly for shell syntax. timeout_seconds defaults to 300 and caps at 600; raise it for slow work such as a first simulator boot, which needs about 90 seconds.", inputSchema: schema({ session_id: session, request_key: key, argv: { type: "array", items: { type: "string" }, minItems: 1 }, timeout_seconds: { type: "integer", minimum: 1, maximum: 600 } }, ["session_id", "request_key", "argv"]), handler: async ({ session_id, request_key, ...body }) => text(await api("POST", `${base({ session_id })}/jobs`, { body, idempotencyKey: request_key })) },
   { name: "get_mac_job", description: "Inspect the existing command without rerunning it. Retain its job ID until completion and retrieve output before stopping the VM.", inputSchema: schema({ session_id: session, job_id: job }, ["session_id", "job_id"]), handler: async args => text(await api("GET", `${base(args)}/jobs/${encodeURIComponent(args.job_id)}`)) },
   { name: "read_mac_output", description: "Read stdout/stderr as base64 chunks; resume from next_cursor. If truncated, the final response includes tail_base64 and its absolute tail_offset. Retrieve promptly: only recent completed jobs retain output. output_expired preserves the job receipt and never means rerun. Retrieve before stopping the VM.", inputSchema: schema({ session_id: session, job_id: job, cursor: { type: "integer", minimum: 0 }, stream: { type: "string", enum: ["stdout", "stderr"] } }, ["session_id", "job_id"]), handler: async args => text(await api("GET", `${base(args)}/jobs/${encodeURIComponent(args.job_id)}/output?${new URLSearchParams({ cursor: String(args.cursor ?? 0), stream: args.stream ?? "stdout" })}`)) },
 ];

package/src/session-transfer.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { constants, copyFileSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, chmodSync, utimesSync } from "node:fs";
-import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import ignoreFactory from "ignore";
 import { CliError } from "./api.mjs";
@@ -50,7 +50,7 @@ export async function fingerprint(path) {
 }
 
 export function safeRelative(path) {
-  if (typeof path !== "string" || isAbsolute(path) || path.split(/[\\/]/).includes("..") || /[\x00-\x1f\x7f]/.test(path) || path.includes("\\")) throw new CliError("invalid relative path", "Use a path within the workspace, without '..' or control characters.");
+  if (typeof path !== "string" || isAbsolute(path) || path.split(/[\\/]/).includes("..") || /[\x00-\x1f\x7f]/.test(path) || path.includes("\\")) throw new CliError("invalid relative path", "Use a path inside the Mac's workspace, relative and without '..' or control characters. Copy anything outside the workspace, such as /tmp, into it first.");
   return posix.normalize(path || ".").replace(/\/$/, "") || ".";
 }
 
@@ -154,13 +154,30 @@ export function assertSafeDestination(root, target) {
 
 export async function pullProject(session, store, destination, { from = destination, overwrite = false, dryRun = false, run = runProcess } = {}) {
   destination = safeRelative(destination); from = safeRelative(from);
-  const localRoot = resolve(store.project, destination);
-  assertSafeDestination(store.project, localRoot);
+  // Local safety first: a symlinked destination is refused before anything is
+  // asked of the Mac.
+  const requested = resolve(store.project, destination);
+  assertSafeDestination(store.project, requested);
+  // rsync reaches its source by cd'ing into it, so a single file has to be fetched
+  // from its parent directory. Probe the remote path: pulling one file (a
+  // screenshot, an .ipa) used to fail with a bare rsync "not a directory".
+  const probe = from === "." ? {} : await remoteFingerprints(session, [from], { run });
+  const kind = from === "." ? "directory" : probe[from];
+  if (kind === "missing") {
+    throw new CliError("no such workspace path", `The Mac has no ${from} in its workspace. Paths are relative to the workspace; copy anything outside it, such as /tmp, into the workspace first.`);
+  }
+  if (kind === "symlink") throw new CliError("unsafe remote path", `${from} is a symlink. Resolve it inside the workspace first.`);
+  const single = typeof kind === "string" && kind.startsWith("file:") ? posix.basename(from) : null;
+  const source = single ? posix.dirname(from) : from;
+  // cp semantics for a single file: into the directory if one exists, else to that name.
+  const intoDirectory = !single || (existsSync(requested) && lstatSync(requested).isDirectory());
+  const rename = intoDirectory ? null : basename(requested);
+  const localRoot = intoDirectory ? requested : dirname(requested);
   const staging = mkdtempSync(join(store.directory, "pull-"));
   const backup = join(store.directory, "backups", randomUUID());
   try {
     // Download into an empty private directory; rsync never receives the user's working tree as destination.
-    await run("rsync", [...transferArgs(), `${session.target}:./`, `${staging}/`], { env: transferEnv(session, from) });
+    await run("rsync", [...transferArgs(), `${session.target}:./${single ?? ""}`, `${staging}/`], { env: transferEnv(session, source) });
     const files = [];
     const walk = (directory) => {
       for (const entry of readdirSync(directory, { withFileTypes: true })) {
@@ -173,11 +190,11 @@ export async function pullProject(session, store, destination, { from = destinat
     walk(staging);
     const baseline = Object.assign(Object.create(null), store.baseline()), plan = [], conflicts = [];
     for (const path of files) {
-      const target = join(localRoot, path), incoming = await fingerprint(join(staging, path));
+      const target = join(localRoot, rename ?? path), incoming = await fingerprint(join(staging, path));
       assertSafeDestination(store.project, target);
       const current = existsSync(target) ? await fingerprint(target) : "missing";
       if (current === "other") throw new CliError("incompatible local path", `A directory or special file occupies ${target}.`);
-      const remotePath = from === "." ? path : `${from.replace(/\/$/, "")}/${path}`;
+      const remotePath = source === "." ? path : `${source.replace(/\/$/, "")}/${path}`;
       // A baseline is meaningful only when downloading to the original project-relative path.
       const samePath = relative(store.project, target).split(sep).join("/") === remotePath.split(sep).join("/");
       if (current !== "missing" && current !== incoming && (!samePath || baseline[remotePath] !== current)) conflicts.push(path);

package/src/transport-command.mjs

@@ -43,7 +43,7 @@ export async function transportCommand(args, { request = macRequest, print = con
     if (separator === -1 || separator === rest.length - 1) throw new CliError("Use -- before the command and its arguments.");
     const options = parsed(rest.slice(0, separator), ["--request-key", "--timeout"]);
     if (!/^[A-Za-z0-9_.:-]{8,128}$/.test(options["--request-key"] ?? "")) throw new CliError("Supply a stable --request-key of 8 to 128 safe characters.");
-    const timeout = Number(options["--timeout"] ?? 60);
+    const timeout = Number(options["--timeout"] ?? 300);
     if (!Number.isInteger(timeout) || timeout < 1 || timeout > 600) throw new CliError("--timeout must be 1 to 600 seconds.");
     result = await request("POST", `${base}/jobs`, { requestKey: options["--request-key"], body: { argv: rest.slice(separator + 1), timeout_seconds: timeout } });
   } else if (command === "job" || command === "output") {