@nomac/cli 0.8.0 → 0.9.1

package/bin/nomac.mjs

@@ -5,6 +5,7 @@ main(process.argv.slice(2)).catch((err) => {
   const args = process.argv.slice(2);
   if (["start", "sync", "pull", "stop", "session", "transport", "exec", "job", "output"].includes(args[0]) && args.includes("--json")) {
     console.error(JSON.stringify({ error: { code: err?.code ?? "session_error", message: err?.friendly ?? err?.message ?? String(err), ...(err?.details ? { details: err.details } : {}) } }));
-  } else console.error(err?.friendly ?? err?.message ?? String(err));
+  // An empty friendly message means the command already printed why it failed.
+  } else if (err?.friendly !== "") console.error(err?.friendly ?? err?.message ?? String(err));
   process.exit(err?.exitCode ?? 1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomac/cli",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "Cloud Mac sessions over SSH and HTTPS, plus iOS builds and publishing — built for agents.",
   "license": "UNLICENSED",
   "type": "module",

package/skill/SKILL.md

@@ -44,8 +44,9 @@ with the same request key.
 Keep the same request key and arguments after uncertain responses; inspect
 the original job before retrying. Output retrieval failure is not job failure.
 Managed jobs have a 600-second limit; SSH can run longer within session limits.
-CLI sync skips symlinks and preserves remote extra files; use native SSH/rsync
-when needed. See the screen with `nomac screenshot` (saves
+CLI sync sends every file (.env and keys included) and symlinks as links, and
+skips dependency and build folders, .git and folders .gitignore lists; a `!`
+line in .nomacignore sends any of them. It preserves remote extra files. See the screen with `nomac screenshot` (saves
 `nomac-screenshot.jpg`; `--simulator` for the iOS Simulator) or MCP
 `screenshot_mac`, which returns an image you can look at. Record a video for
 the human with `nomac record`, do the work, then `nomac record stop` (saves the
@@ -58,6 +59,36 @@ Pipe xcodebuild through `xcbeautify`. Persistent disks are not currently offered
 Report failures using `report_issue` with `session_id`, optional `job_id` and
 a description without secrets. Read https://nomac.app/llms.txt for full limits.
 
+## Secrets, signing and shipping
+
+Never ask for a secret in the chat. `nomac secrets request NAME --description
+TEXT` (MCP `request_secret`) gives the human a link to enter it; they can also
+run `nomac secrets set NAME` themselves. Every Mac receives the account's
+secrets as variables and files, masked in command output; `nomac secrets
+install` refreshes a running Mac.
+
+The human connects Apple once at https://nomac.app/apple; the App Store
+Connect key stays on NoMac's server. Then, on the Mac:
+
+1. `nomac sign [path]` (MCP `set_up_signing`) makes and installs the App Store
+   profiles the project needs and prints the files, the reserved build number
+   and the xcodebuild, Flutter and fastlane commands. The project is unchanged;
+   build with your own tools.
+2. `nomac testflight path/to/App.ipa` (MCP `send_to_testflight`) puts it on
+   TestFlight. Relay the human's answer to Apple's encryption question (asked
+   once per app), never guess.
+3. `nomac publish App.ipa --whats-new TEXT` stages the App Store version and
+   lists Apple's blockers; submit with the printed `--confirm` command only
+   after the human approves. MCP: `publish` with the send's project_id and
+   build_id.
+4. Mac apps: sign with the Developer ID certificate, `--options runtime
+   --timestamp`, then `nomac notarize App.app` (MCP `notarize`) notarizes and
+   staples it.
+
+A step only a person can take (creating the app in App Store Connect,
+agreements, an App Group) comes back as needs_human with its link: give it to
+the human, then call again.
+
 ## Builder (existing subscribers only)
 
 The separate iOS Builder publishing product is closed to new subscriptions.

package/src/api.mjs

@@ -65,13 +65,15 @@ export async function api(method, path, { body, raw, idempotencyKey } = {}) {
     throw new CliError(`API returned non-JSON (HTTP ${res.status})`, "The response could not be read. Reconcile the operation before retrying; reuse its request_key.", res.status, "bad_response", { code: "bad_response", ...(idempotencyKey ? { request_key: idempotencyKey } : {}) });
   }
   if (!res.ok) {
-    const err = json?.error ?? {};
+    // Some answers carry more beside the error, such as publish's blockers and findings.
+    const { error, ...beside } = json && typeof json === "object" && !Array.isArray(json) ? json : {};
+    const err = error && typeof error === "object" ? error : {};
     throw new CliError(
       `HTTP ${res.status} ${err.code ?? ""}`,
       err.message ?? `API error (HTTP ${res.status})`,
       res.status,
       err.code,
-      { ...err, ...(idempotencyKey ? { request_key: idempotencyKey } : {}) },
+      { ...beside, ...err, ...(idempotencyKey ? { request_key: idempotencyKey } : {}) },
     );
   }
   return json;

package/src/cli.mjs

@@ -23,6 +23,11 @@ Use it:
   nomac screenshot             save the Mac's screen as nomac-screenshot.jpg
   nomac record                 record a video; nomac record stop saves it with a share link
   nomac status                 state, cost so far and when it stops
+  nomac secrets                variables and files every Mac receives (nomac secrets --help)
+  nomac sign [path]            set up App Store signing for the project on the Mac
+  nomac testflight app.ipa     send a signed .ipa on the Mac to TestFlight
+  nomac publish app.ipa        submit it for App Review (--confirm sends it)
+  nomac notarize App.app       notarize a Developer ID-signed Mac app and staple it
 
 Agents:
   nomac mcp                    MCP server for Claude Code, Codex, Cursor and others
@@ -100,6 +105,31 @@ export async function main(argv) {
       // A Mac you own reports through session status.
       return cmd === "status" ? sessionCommand("session", ["status", ...rest]) : sessionCommand(cmd, rest);
     }
+    case "sign": {
+      const { signCommand } = await import("./sign.mjs");
+      const { sessionStore } = await import("./session-store.mjs");
+      return signCommand(rest, { store: sessionStore() });
+    }
+    case "testflight": {
+      const { testflightCommand } = await import("./testflight.mjs");
+      const { sessionStore } = await import("./session-store.mjs");
+      return testflightCommand(rest, { store: sessionStore() });
+    }
+    case "publish": {
+      const { publishCommand } = await import("./publish.mjs");
+      const { sessionStore } = await import("./session-store.mjs");
+      return publishCommand(rest, { store: sessionStore() });
+    }
+    case "notarize": {
+      const { notarizeCommand } = await import("./notarize.mjs");
+      const { sessionStore } = await import("./session-store.mjs");
+      return notarizeCommand(rest, { store: sessionStore() });
+    }
+    case "secrets": {
+      const { secretsCommand } = await import("./secrets.mjs");
+      const { sessionStore } = await import("./session-store.mjs");
+      return secretsCommand(rest, { store: sessionStore() });
+    }
     case "login": {
       const key = rest[0];
       if (key) {

package/src/hosted-sessions.mjs

@@ -186,6 +186,8 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
   const wait = ["start", "stop"].includes(command) ? integer(values.wait, command === "start" ? 300 : 60, 0, command === "start" ? 600 : 300) : 0;
   if (command === "start" && values["request-key"] !== undefined && !validRequestKey(values["request-key"])) throw new CliError("Use a request key of 8–128 letters, digits, underscores, periods, colons or hyphens.");
   const output = result => {
+    // Sync, pull and the other commands answer with their own result, which has no session.
+    if (values.json || !["start", "stop"].includes(command)) { print(JSON.stringify(result, null, 2)); return result; }
     const billing = result.session?.billing;
     const usage = billing?.mode === "weekly_included"
       ? `Included time used: ${billing.used_seconds} seconds. No extra charge.`
@@ -193,7 +195,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     const next = result.session.state === "ready" ? "Next: nomac sync . → nomac ssh"
       : result.session.failure_code === "capacity_unavailable" ? "No Mac was free within 5 minutes; nothing was charged. Run nomac start again in a few minutes."
       : result.session.state === "queued" ? "Waiting for a free Mac (waiting is free). Check again: nomac start" : "Check: nomac session status --json";
-    print(values.json || !["start", "stop"].includes(command) ? JSON.stringify(result, null, 2) : `${result.session.id}: ${result.session.state}\n${next}\n${usage}`);
+    print(`${result.session.id}: ${result.session.state}\n${next}\n${usage}`);
     return result;
   };
   const saveView = (local, view) => {

package/src/human-steps.mjs

@@ -0,0 +1,13 @@
+/** Steps only a person can take, from an answer's needs_human, as numbered lines with the link last. */
+export function humanSteps(details) {
+  const human = details?.needs_human;
+  if (!human) return [];
+  return [...(human.steps ?? []).map((step, index) => `  ${index + 1}. ${step}`), ...(human.url ? [`  ${human.url}`] : [])];
+}
+
+/** An API error that needs a person: its message followed by the steps. */
+export function withHumanSteps(error) {
+  const steps = humanSteps(error?.details);
+  if (steps.length) error.friendly = [error.friendly, ...steps].join("\n");
+  return error;
+}

package/src/mac-tools.mjs

@@ -22,7 +22,13 @@ export const MAC_TOOLS = [
   { name: "get_mac_credits", description: "Read the prepaid Mac credit balance: spendable dollars, spendable_seconds (how long a Mac can run on it), amounts held by a running session, pricing (including bonus_tiers for bigger purchases), recent purchases and first_purchase (true until the first paid top-up). Credit never expires. If spendable_seconds is below what the task needs, call get_mac_checkout.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/mac/credits")) },
   { name: "start_mac", description: "Allocate a full cloud Mac VM, billed from prepaid credit at $0.80 an hour by the minute. If it returns insufficient_credit, call get_mac_checkout, have the human pay, then retry with the same request_key. Supply a stable request_key; SSH public_key is optional for HTTPS-only agents; reuse both after a lost response. Inspect the returned offer and limits. Poll get_mac_session until ready. No project pipeline is imposed; stop_mac deletes the VM and files.", inputSchema: schema({ public_key: { type: "string" }, request_key: key, limits: { type: "object", properties: { max_duration_seconds: { type: "integer", minimum: 60, maximum: 28800 }, idle_timeout_seconds: { type: "integer", minimum: 60, maximum: 3600 }, spend_cap_microunits: { type: "string", pattern: "^[1-9][0-9]{0,17}$" } }, additionalProperties: false } }, ["request_key"]), handler: async ({ request_key, ...body }) => text(await api("POST", "/api/v1/mac/sessions", { body, idempotencyKey: request_key })) },
   { name: "list_mac_sessions", description: "Find existing Mac sessions, including after losing a response. Shows state, cost, limits and cleanup.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/mac/sessions")) },
-  { name: "get_mac_session", description: "Read live Mac allocation state, cost, funded time and cleanup confirmation. queued/provisioning means wait; stopping is not yet confirmed cleanup.", inputSchema: schema({ session_id: session }, ["session_id"]), handler: async args => text(await api("GET", base(args))) },
+  { name: "get_mac_session", description: "Read live Mac allocation state, cost, funded time and cleanup confirmation, and once ready the credentials installed on it (secrets, signing identities and profiles, by name and path, never values). queued/provisioning means wait; stopping is not yet confirmed cleanup.", inputSchema: schema({ session_id: session }, ["session_id"]), handler: async args => text(await api("GET", base(args))) },
+  { name: "list_secrets", description: "List the account's secrets by name: variables (set in every shell and command on the Mac) and files (with their path on the Mac), whether every Mac receives them or only when asked, sizes, and secrets an agent asked for that the person has not entered yet. Values are never returned.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/secrets")) },
+  { name: "request_secret", description: "Get a link where the person enters a secret in their browser, so its value never passes through this chat: an API token, a .env value, a .p12 certificate or a config file. kind variable is one line of text, set as an environment variable on the Mac; kind file is stored at destination (under the home folder, like ~/.netrc; default ~/.nomac/secrets/<name>). Give the person the url. Then list_secrets shows it, new Macs receive it, and install_secrets puts it on a running Mac. With a shell on this machine, the person can also run nomac secrets set NAME themselves. Never ask for a secret in the chat.", inputSchema: schema({ name: { type: "string", minLength: 1, maxLength: 128 }, kind: { type: "string", enum: ["variable", "file"] }, description: { type: "string", minLength: 1, maxLength: 500, description: "What the person should enter and why; shown to them" }, destination: { type: "string", maxLength: 256 }, delivery: { type: "string", enum: ["every_mac", "on_request"] } }, ["name", "kind", "description"]), handler: async body => text(await api("POST", "/api/v1/secrets/requests", { body })) },
+  { name: "set_up_signing", description: "Set up App Store signing for a project on the Mac, with the App Store Connect key kept on NoMac's server: reads the project at path (its scheme, app and every extension, with entitlements), registers missing bundle IDs, switches on the capabilities Apple's API can, makes the App Store profiles, and installs them with the account's certificate in a keychain on the Mac. The project never changes. Returns a build settings file (.xcconfig) and export options with the exact xcodebuild, Flutter and fastlane commands. Creates a distribution certificate at Apple only when the account has none. Expo and Capacitor apps need their ios folder first. A step only a person can take comes back as needs_human with its link.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024, description: "The project folder on the Mac, relative to the workspace" }, scheme: { type: "string", minLength: 1, maxLength: 256 }, container: { type: "string", minLength: 1, maxLength: 1024 }, issuer_id: { type: "string", maxLength: 64 } }, ["session_id"]), handler: async ({ session_id, ...body }) => text(await api("POST", `${base({ session_id })}/signing`, { body })) },
+  { name: "send_to_testflight", description: "Send a signed .ipa on the Mac to TestFlight, with the App Store Connect key kept on NoMac's server: NoMac creates the upload at Apple and the Mac sends only the file. Apple then processes the build, usually for 5 to 15 minutes with no Mac needed, and NoMac sets the app's export-compliance answer and What to Test and puts it on TestFlight for the internal testers. Repeat the call with the returned request_key to follow it: sending, processing, on_testflight or failed. Once on_testflight, publish with the returned project_id and build_id submits it for App Review. Apple asks once per app whether it uses encryption beyond HTTPS and Apple's own: pass the person's answer as uses_non_exempt_encryption, never a guess. A build number Apple already has comes back with the next free one. A step only a person can take, such as creating the app in App Store Connect, comes back as needs_human with its link.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024, description: "The signed .ipa on the Mac, relative to the workspace or absolute" }, notes: { type: "string", minLength: 1, maxLength: 4000, description: "What to Test, shown to testers" }, uses_non_exempt_encryption: { type: "boolean", description: "The person's answer, asked once per app: does it use encryption beyond HTTPS and Apple's own?" }, issuer_id: { type: "string", maxLength: 64 }, request_key: { ...key, description: "Repeat with the request_key from the first answer to follow that send" }, wait_seconds: { type: "integer", minimum: 0, maximum: 50, description: "Wait up to this long for progress (50 while following)" } }, ["session_id", "path"]), handler: async ({ session_id, ...body }) => text(await api("POST", `${base({ session_id })}/testflight`, { body })) },
+  { name: "notarize", description: "Notarize a Developer ID-signed Mac app, disk image or installer on the Mac (.app, .dmg, .pkg or .zip), with the App Store Connect key kept on NoMac's server: the Mac zips an .app and sends the file to Apple with temporary credentials for this one submission. Apple checks it, usually for a few minutes, then the Mac staples the ticket so it opens without a warning, even offline. Repeat the call with the returned request_key to follow it: preparing, uploading, in_progress, stapling, then accepted, invalid or rejected with Apple's issues. Sign first with the Developer ID Application certificate (the person uploads it at nomac.app/apple), the hardened runtime and a secure timestamp: codesign --force --options runtime --timestamp --sign \"Developer ID Application: …\". Keep the Mac running until it is stapled.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024, description: "The .app, .dmg, .pkg or .zip on the Mac, relative to the workspace or absolute" }, issuer_id: { type: "string", maxLength: 64 }, request_key: { ...key, description: "Repeat with the request_key from the first answer to follow that notarization" }, wait_seconds: { type: "integer", minimum: 0, maximum: 50, description: "Wait up to this long for progress (50 while following)" } }, ["session_id", "path"]), handler: async ({ session_id, ...body }) => text(await api("POST", `${base({ session_id })}/notarize`, { body })) },
+  { name: "install_secrets", description: "Install the account's secrets and signing identities on a running Mac now: every-Mac secrets, the on-request secrets named in names, and what the Mac already has; a deleted secret is removed. Macs receive every-Mac secrets on their own when they become ready, so call this after the person adds or changes one.", inputSchema: schema({ session_id: session, names: { type: "array", items: { type: "string", minLength: 1, maxLength: 128 }, maxItems: 100 } }, ["session_id"]), handler: async ({ session_id, names = [] }) => text(await api("POST", `${base({ session_id })}/secrets`, { body: { names } })) },
   { name: "open_mac_desktop", description: "Open the Mac's full macOS desktop in the human's browser on this machine, with mouse and keyboard and nothing to install. Use it when the human wants to see or click something on the Mac, for example Xcode, the Simulator or a sign-in window. The session must be ready. If opened_in_browser is false, give the human the returned url; it opens after they sign in to nomac.app. The session stays busy while the desktop is open and the page disconnects after 15 minutes without input. To show the iOS Simulator there, boot a device with simctl, then run open \"$(xcode-select -p)/Applications/Simulator.app\" with exec_mac. macOS has no RDP.", inputSchema: schema({ session_id: session, open: { type: "boolean", default: true, description: "Open the link in this machine's browser." } }, ["session_id"]), handler: async ({ session_id, open = true }) => {
     const view = await api("GET", base({ session_id }));
     if (view?.session?.state !== "ready") return text({ error: { code: "session_not_ready", message: "The Mac is not ready. Wait until get_mac_session shows ready, then call open_mac_desktop again." } });

package/src/mcp.mjs

@@ -23,6 +23,7 @@ const INSTRUCTIONS = [
   "exec_mac returns a quick command's output in the same call; pass wait_seconds: 50 for builds and tests. A command still running comes back as a job: poll get_mac_job with its job_id, then read_mac_output.",
   "Never rerun a command to get its output; after a lost response, repeat the call with the same request_key and arguments.",
   "Write files with write_mac_file, not heredocs in exec_mac: a command is at most 64 KiB.",
+  "Shipping without the Apple key on the Mac: set_up_signing on the project returns the files and commands that sign a build with the agent's own tools; send_to_testflight sends the signed .ipa to TestFlight; publish submits it for App Review; notarize notarizes and staples a Developer ID-signed Mac app. Never ask for a secret in the chat: request_secret gives the human a link, and every Mac receives the account's secrets.",
   "Always stop_mac when finished, after reading any output you need, so credit is not spent on an idle Mac.",
 ].join(" ");
 
@@ -298,12 +299,12 @@ export const TOOLS = [
   {
     name: "publish",
     description:
-      "Submit for App Store review (3-step reviewSubmissions). Requires confirm:true with authorization for this app/version; run once without confirm first to see the staged result + any Apple blockers. Costs nothing; the review decision takes ~1-3 days. On pending, repeat unchanged arguments with the returned request_key; get_store_operation recovers a lost response.",
+      "Submit for App Store review (3-step reviewSubmissions). Takes the app's newest build on TestFlight, or build_id: a Builder build or one sent with send_to_testflight, whose answer gives project_id and build_id. Requires confirm:true with authorization for this app/version; run once without confirm first to see the staged result + any Apple blockers. Costs nothing; the review decision takes ~1-3 days. On pending, repeat unchanged arguments with the returned request_key; get_store_operation recovers a lost response.",
     inputSchema: {
       type: "object",
       properties: {
         project_id: { type: "string" },
-        build_id: { type: "string", description: "Exact nomac release build to attach" },
+        build_id: { type: "string", description: "Exact NoMac build (bld_…) to attach, from send_to_testflight or build" },
         asc_submission_id: { type: "string", description: "Exact Apple submission from get_review" },
         resolve_rejection: { type: "boolean", default: false, description: "Assert this version rejection was fixed; mark its item ready for review" },
         confirm: { type: "boolean", default: false },

package/src/notarize.mjs

@@ -0,0 +1,71 @@
+import { randomUUID } from "node:crypto";
+import { parseArgs } from "node:util";
+import { api as defaultApi, CliError } from "./api.mjs";
+
+export const NOTARIZE_HELP = `Usage: nomac notarize <path> [--team ISSUER_ID] [--session ses_…] [--no-wait] [--json]
+       nomac notarize --id ntz_…
+Notarize a Developer ID-signed app, disk image or installer on this folder's Mac (path: an
+.app, .dmg, .pkg or .zip on the Mac, relative to the synced folder). Your App Store Connect
+key stays on NoMac's server; the Mac gets only Apple's upload credentials for this one
+submission. Apple checks it, usually for a few minutes, then the Mac staples the ticket.
+Sign it first with your Developer ID Application certificate (upload it at nomac.app/apple):
+  codesign --force --options runtime --timestamp --sign "Developer ID Application: …" App.app`;
+
+const DONE = new Set(["accepted", "invalid", "rejected", "failed"]);
+
+function describe(view) {
+  switch (view.state) {
+    case "preparing": return `Preparing ${view.path} on the Mac…`;
+    case "uploading": return "Sending it to Apple…";
+    case "in_progress": return "Apple is checking it (usually a few minutes). Keep the Mac running so the ticket can be stapled.";
+    case "stapling": return "Notarized. Stapling the ticket…";
+    case "accepted": return [view.message, ...(view.warnings ?? []).map((issue) => `  warning: ${issue.path ? `${issue.path}: ` : ""}${issue.message}`)].join("\n");
+    case "invalid": case "rejected": return [
+      `Apple did not notarize it${view.status_summary ? `: ${view.status_summary}` : "."}`,
+      ...(view.issues ?? []).map((issue) => `  ${issue.severity}: ${issue.path ? `${issue.path}: ` : ""}${issue.message}`),
+      "Sign every binary with your Developer ID certificate, --options runtime and --timestamp, then notarize again.",
+    ].join("\n");
+    case "failed": return [`Not notarized: ${view.error?.message ?? "the notarization failed."}`,
+      ...(view.error?.needs_human?.steps ?? []).map((step, index) => `  ${index + 1}. ${step}`)].join("\n");
+    default: return view.state;
+  }
+}
+
+export async function notarizeCommand(args, { api = defaultApi, print = console.log, store } = {}) {
+  const { values, positionals } = parseArgs({ args, allowPositionals: true, strict: true, options: {
+    team: { type: "string" }, session: { type: "string" }, id: { type: "string" }, "no-wait": { type: "boolean" }, json: { type: "boolean" }, help: { type: "boolean", short: "h" },
+  } });
+  if (values.help) return print(NOTARIZE_HELP);
+  let view;
+  if (values.id) {
+    if (positionals.length) throw new CliError("notarize usage", NOTARIZE_HELP);
+    view = await api("GET", `/api/v1/notarizations/${encodeURIComponent(values.id)}`);
+  } else {
+    if (positionals.length !== 1) throw new CliError("notarize usage", NOTARIZE_HELP);
+    const session = values.session ?? store?.load()?.id;
+    if (!session || !/^ses_[A-Za-z0-9_-]{1,80}$/.test(session)) throw new CliError("no Mac", "No Mac for this folder. Start one with nomac start, build and sign the app there, or pass --session ses_….");
+    view = await api("POST", `/api/v1/mac/sessions/${encodeURIComponent(session)}/notarize`, { body: {
+      path: positionals[0], request_key: `cli-notarize-${randomUUID()}`, wait_seconds: values["no-wait"] ? 0 : 50, ...(values.team ? { issuer_id: values.team } : {}),
+    } });
+  }
+  let last = "";
+  const show = (current) => {
+    if (values.json) return;
+    const line = describe(current);
+    if (line !== last) print(line);
+    last = line;
+  };
+  show(view);
+  if (!values["no-wait"]) {
+    while (!DONE.has(view.state)) {
+      view = await api("GET", `/api/v1/notarizations/${encodeURIComponent(view.id)}?wait_seconds=50`);
+      show(view);
+    }
+  } else if (!DONE.has(view.state) && !values.json) {
+    print(`Follow it with: nomac notarize --id ${view.id}`);
+  }
+  if (values.json) print(JSON.stringify(view, null, 2));
+  // The reason is already printed; exit non-zero without saying it twice.
+  if (["invalid", "rejected", "failed"].includes(view.state)) throw Object.assign(new CliError("notarize failed", ""), { friendly: "" });
+  return view;
+}

package/src/publish.mjs

@@ -0,0 +1,76 @@
+import { randomUUID } from "node:crypto";
+import { parseArgs } from "node:util";
+import { api as defaultApi, CliError } from "./api.mjs";
+import { testflightCommand } from "./testflight.mjs";
+
+export const PUBLISH_HELP = `Usage: nomac publish [ipa] [--whats-new TEXT] [--confirm] [--notes TEXT] [--encryption no|yes] [--team ISSUER_ID] [--session ses_…]
+       nomac publish --project prj_… [--build bld_…] [--whats-new TEXT] [--confirm]
+Submit your app for App Review, with your App Store Connect key kept on NoMac's server.
+With an .ipa on this folder's Mac, NoMac sends it first, as nomac testflight does, and waits
+until Apple has processed it. Without one, --project (and --build) name a build already on
+TestFlight; nomac testflight prints both.
+Without --confirm nothing goes to App Review: NoMac stages the version with its build and
+lists every blocker Apple reports. Run it again with --confirm to submit.
+  --whats-new TEXT    What's New in This Version; Apple requires it for every update
+  --force             submit despite red readiness findings (not recommended)`;
+
+/** Apple answers some writes with "pending"; the same key observes the original request. */
+async function settled(api, method, path, body, sleep) {
+  const idempotencyKey = `cli-${path.split("/").at(-1)}-${randomUUID()}`;
+  for (let attempt = 0; ; attempt++) {
+    const result = await api(method, path, { body, idempotencyKey });
+    if (result?.state !== "pending" || attempt >= 24) return result;
+    await sleep(5000);
+  }
+}
+
+function blockers(details) {
+  return [
+    ...(details?.blockers ?? []).map((item) => `  ${item.code}: ${item.detail}`),
+    ...(details?.findings ?? []).map((item) => `  ${item.title}: ${item.fix_hint}`),
+  ];
+}
+
+export async function publishCommand(args, { api = defaultApi, print = console.log, store, sleep = (ms) => new Promise((done) => setTimeout(done, ms)) } = {}) {
+  const { values, positionals } = parseArgs({ args, allowPositionals: true, strict: true, options: {
+    project: { type: "string" }, build: { type: "string" }, "whats-new": { type: "string" }, confirm: { type: "boolean" }, force: { type: "boolean" },
+    notes: { type: "string" }, encryption: { type: "string" }, team: { type: "string" }, session: { type: "string" },
+    json: { type: "boolean" }, help: { type: "boolean", short: "h" },
+  } });
+  if (values.help) return print(PUBLISH_HELP);
+  if (positionals.length > 1 || (positionals.length && (values.project || values.build)) || (!positionals.length && !values.project)) throw new CliError("publish usage", PUBLISH_HELP);
+  let project = values.project, build = values.build, version;
+  if (positionals.length) {
+    const sendArgs = [positionals[0], ...["notes", "encryption", "team", "session"].flatMap((name) => values[name] ? [`--${name}`, values[name]] : [])];
+    const sent = await testflightCommand(sendArgs, { api, print: values.json ? () => {} : print, store });
+    ({ project_id: project, build_id: build } = sent);
+    version = sent.app.version;
+  }
+  if (values["whats-new"]) {
+    await settled(api, "PUT", `/api/v1/projects/${encodeURIComponent(project)}/metadata`, { ...(version ? { version_string: version } : {}), fields: { whats_new: values["whats-new"] } }, sleep);
+    if (!values.json) print("What's New is set.");
+  }
+  let result;
+  try {
+    result = await settled(api, "POST", "/api/v1/publish", { project_id: project, ...(build ? { build_id: build } : {}), confirm: Boolean(values.confirm), force: Boolean(values.force) }, sleep);
+  } catch (error) {
+    if (error instanceof CliError && !values.json) {
+      const lines = blockers(error.details);
+      if (lines.length) error.friendly = [error.friendly, "Apple or the readiness check reports:", ...lines].join("\n");
+    }
+    throw error;
+  }
+  if (values.json) { print(JSON.stringify(result, null, 2)); return result; }
+  if (result.state === "pending") {
+    print("Apple has not confirmed yet. Check with nomac publish again in a minute; nothing is sent twice.");
+  } else if (result.staged) {
+    print([
+      `Staged for App Review: build ${result.build_id}. Nothing was sent to App Review.`,
+      ...(result.lint_note ? [`Note: ${result.lint_note}`] : []),
+      `To submit: nomac publish --project ${project} --build ${result.build_id} --confirm`,
+    ].join("\n"));
+  } else {
+    print(`Submitted to App Review (${result.state}). Apple usually decides within one to three days.`);
+  }
+  return result;
+}

package/src/secrets.mjs

@@ -0,0 +1,136 @@
+import { readFileSync, statSync } from "node:fs";
+import { parseArgs } from "node:util";
+import { api as defaultApi, CliError } from "./api.mjs";
+
+export const SECRETS_HELP = `Usage: nomac secrets [command]
+Secrets are variables and files every Mac you start receives. Values never
+come back from NoMac, and are never taken as command-line arguments.
+
+  nomac secrets                          list them (names, where they go, sizes)
+  nomac secrets set NAME                 a variable; the value from stdin, hidden when typed
+  nomac secrets set NAME --file PATH     a file, up to 1 MiB  [--destination ~/.netrc]
+  nomac secrets set --from-env-file .env every NAME=value line as a variable
+      --on-request                       only when asked (install NAME), not on every Mac
+  nomac secrets rm NAME                  delete it
+  nomac secrets install [NAME...]        put them on this folder's Mac now  [--session ses_…]
+  nomac secrets request NAME --description TEXT [--kind file] [--destination ~/x]
+                                         a link where someone enters it in the browser
+Add --json for JSON.`;
+
+/**
+ * Lines of a .env file as variables, as the dashboard's import reads them
+ * (apps/web/lib/env-file.ts): comments, blank lines and `export ` are handled,
+ * quotes keep a # inside, and a value that spans lines is skipped.
+ */
+export function parseEnv(text) {
+  const variables = [], skipped = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!match) { skipped.push(line.slice(0, 40)); continue; }
+    let value = match[2];
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.length >= 2 && value.endsWith(quote)) value = value.slice(1, -1);
+    else if (quote === '"' || quote === "'") { skipped.push(match[1]); continue; }
+    else value = value.replace(/\s+#.*$/, "");
+    variables.push({ name: match[1], value });
+  }
+  return { variables, skipped };
+}
+
+/** A value from stdin: typed with echo off at a terminal, or piped (one trailing newline dropped). */
+async function readValue(stdin, write) {
+  if (stdin.isTTY) {
+    write("Value (hidden): ");
+    stdin.setRawMode(true); stdin.resume(); stdin.setEncoding("utf8");
+    try {
+      return await new Promise((resolve, reject) => {
+        let value = "";
+        const onData = (chunk) => {
+          for (const char of chunk) {
+            if (char === "\r" || char === "\n") { stdin.off("data", onData); write("\n"); return resolve(value); }
+            if (char === "\u0003") { stdin.off("data", onData); write("\n"); return reject(new CliError("cancelled", "Cancelled.")); }
+            if (char === "\u007f") value = value.slice(0, -1);
+            else value += char;
+          }
+        };
+        stdin.on("data", onData);
+      });
+    } finally { stdin.setRawMode(false); stdin.pause(); }
+  }
+  const chunks = [];
+  for await (const chunk of stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+
+const size = (bytes) => bytes < 1024 ? `${bytes} B` : bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)} KB` : `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+
+export async function secretsCommand(args, { api = defaultApi, print = console.log, write = (text) => process.stderr.write(text), stdin = process.stdin, store } = {}) {
+  const { values, positionals } = parseArgs({ args, allowPositionals: true, strict: true, options: {
+    file: { type: "string" }, "from-env-file": { type: "string" }, destination: { type: "string" }, "on-request": { type: "boolean" },
+    session: { type: "string" }, description: { type: "string" }, kind: { type: "string" }, json: { type: "boolean" }, help: { type: "boolean", short: "h" },
+  } });
+  const [command = "list", ...names] = positionals;
+  if (values.help || command === "help") return print(SECRETS_HELP);
+  const out = (result, text) => { print(values.json ? JSON.stringify(result, null, 2) : text); return result; };
+  const delivery = values["on-request"] ? "on_request" : "every_mac";
+  const path = (name) => `/api/v1/secrets/${encodeURIComponent(name)}`;
+
+  if (command === "list" || command === "ls") {
+    const result = await api("GET", "/api/v1/secrets");
+    const lines = result.secrets.map((secret) => `${secret.name}  ${secret.kind === "variable" ? `$${secret.variable}` : secret.path}  ${size(secret.size)}  ${secret.delivery === "every_mac" ? "every Mac" : "when asked"}`);
+    const waiting = result.pending_requests.map((request) => `${request.name}  requested by an agent, not entered yet`);
+    return out(result, [...lines, ...waiting].join("\n") || "No secrets yet. Add one with nomac secrets set NAME, or on nomac.app/secrets.");
+  }
+  if (command === "set") {
+    if (values["from-env-file"]) {
+      if (names.length || values.file) throw new CliError("set usage", "--from-env-file takes no NAME and no --file.");
+      const { variables, skipped } = parseEnv(readFileSync(values["from-env-file"], "utf8"));
+      const saved = [], failed = [];
+      for (const variable of variables) {
+        try { await api("PUT", path(variable.name), { body: { kind: "variable", value: variable.value, delivery } }); saved.push(variable.name); }
+        catch (error) { failed.push({ name: variable.name, message: error.friendly ?? error.message }); }
+      }
+      const result = { saved, failed, skipped };
+      out(result, [`Saved ${saved.length} of ${variables.length} variables.`, ...failed.map((item) => `${item.name}: ${item.message}`),
+        ...(skipped.length ? [`Skipped lines that are not NAME=value on one line: ${skipped.join(", ")}`] : [])].join("\n"));
+      if (failed.length) process.exitCode = 1;
+      return result;
+    }
+    if (names.length !== 1) throw new CliError("set usage", SECRETS_HELP);
+    let body;
+    if (values.file) {
+      if (statSync(values.file).size > 1024 * 1024) throw new CliError("file too large", "A file secret holds at most 1 MiB.");
+      body = { kind: "file", value_base64: readFileSync(values.file).toString("base64"), destination: values.destination ?? null, delivery };
+    } else {
+      if (values.destination) throw new CliError("set usage", "--destination is for files: add --file PATH.");
+      body = { kind: "variable", value: await readValue(stdin, write), delivery };
+    }
+    const result = await api("PUT", path(names[0]), { body });
+    return out(result, `Saved ${result.secret.name}. New Macs receive it; run nomac secrets install to put it on a running Mac.`);
+  }
+  if (command === "rm" || command === "delete") {
+    if (names.length !== 1) throw new CliError("rm usage", "Usage: nomac secrets rm NAME");
+    const result = await api("DELETE", path(names[0]));
+    return out(result, `Deleted ${names[0]}. Macs started from now on do not receive it; a running Mac keeps its copy until it stops.`);
+  }
+  if (command === "install") {
+    const session = values.session ?? store?.load()?.id;
+    if (!session || !/^ses_[A-Za-z0-9_-]{1,80}$/.test(session)) throw new CliError("no Mac", "No Mac for this folder. Start one with nomac start, or pass --session ses_….");
+    const result = await api("POST", `/api/v1/mac/sessions/${encodeURIComponent(session)}/secrets`, { body: { names } });
+    const installed = result.credentials;
+    return out(result, [`Installed on ${session}: ${installed.state}.`,
+      ...installed.secrets.map((secret) => `  ${secret.kind === "variable" ? `$${secret.name}` : secret.path}`),
+      ...(installed.identities?.length ? [`  ${installed.identities.length} signing identit${installed.identities.length === 1 ? "y" : "ies"}, ${installed.profiles.length} profiles`] : []),
+      ...(installed.message ? [installed.message] : [])].join("\n"));
+  }
+  if (command === "request") {
+    const kind = values.kind ?? "variable";
+    if (names.length !== 1 || !values.description || !["variable", "file"].includes(kind)) throw new CliError("request usage", "Usage: nomac secrets request NAME --description TEXT [--kind file] [--destination ~/x]");
+    const result = await api("POST", "/api/v1/secrets/requests", { body: { name: names[0], kind, description: values.description,
+      ...(values.destination ? { destination: values.destination } : {}), delivery } });
+    return out(result, `Open this link to enter ${result.name} (expires ${result.expires_at}):\n${result.url}`);
+  }
+  throw new CliError("unknown secrets command", SECRETS_HELP);
+}

package/src/session-transfer.mjs

@@ -1,49 +1,92 @@
 import { createHash, randomUUID } from "node:crypto";
-import { constants, copyFileSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, chmodSync, utimesSync } from "node:fs";
+import { constants, copyFileSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, chmodSync, utimesSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import ignoreFactory from "ignore";
 import { CliError } from "./api.mjs";
 import { remote, rsyncQuote, runProcess, shellQuote, validateWorkspace } from "./session-ssh.mjs";
 
-const EXCLUDED = [
-  ".git/", ".nomac/", ".nomac.json", ".nomac-transfer/", "node_modules/", "Pods/", "build/", "dist/", "DerivedData/", ".build/", ".next/",
-  ".env", ".env.*", "*.p8", "*.p12", "*.pem", "*.key", "*.mobileprovision", ".ssh/", ".aws/", ".netrc", ".npmrc", "id_rsa*", "id_ed25519*", ".DS_Store",
+/**
+ * What sync leaves out unless .nomacignore brings it back: folders that are
+ * rebuilt on the Mac anyway, git history, Finder metadata and NoMac's own
+ * files. Nothing is left out to protect the person from their own files:
+ * .env files, keys and certificates travel like any other file.
+ */
+const BUILT_IN = [
+  { pattern: "node_modules/", reason: "rebuilt on the Mac" },
+  { pattern: "Pods/", reason: "rebuilt on the Mac" },
+  { pattern: "DerivedData/", reason: "rebuilt on the Mac" },
+  { pattern: ".build/", reason: "rebuilt on the Mac" },
+  { pattern: "build/", reason: "rebuilt on the Mac" },
+  { pattern: ".git/", reason: "git history" },
+  { pattern: ".DS_Store", reason: "Finder metadata" },
+  { pattern: ".nomac/", reason: "NoMac's own files" },
+  { pattern: ".nomac.json", reason: "NoMac's own files" },
+  { pattern: ".nomac-transfer/", reason: "NoMac's own files" },
 ];
+// Built-in patterns are names, matched against the entry's own name, so a folder
+// brought back with `!` is never skipped again through its parent.
+const builtInRules = BUILT_IN.map(({ pattern, reason }) => ({ rules: ignoreFactory().add(pattern), reason }));
 
+/** Code-unit order, the same as Array.prototype.sort on the file lists. */
+const byPath = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+
+/** The last opinion of a chain of ignore files: true (skip), false (send) or undefined (none). */
+function verdict(scopes, path, isDirectory) {
+  let result;
+  for (const scope of scopes) {
+    const test = scope.rules.test(relative(scope.root, path).split(sep).join("/") + (isDirectory ? "/" : ""));
+    if (test.ignored) result = true;
+    if (test.unignored) result = false;
+  }
+  return result;
+}
+
+/**
+ * The project as sync sends it. Every file is sent, including files a
+ * .gitignore lists (.env, local configuration, temporary files): they are
+ * small and often needed to build. Folders a .gitignore lists are skipped,
+ * because they are dependencies and build output. .nomacignore decides last:
+ * it can skip anything more, and its `!` lines bring back anything, the
+ * built-in skips included. A folder brought back is sent as it is, except
+ * for what .nomacignore itself skips. Symlinks are sent as links and never
+ * followed.
+ */
 export function projectFiles(root) {
-  const denied = ignoreFactory().add(EXCLUDED);
-  const files = [], skippedLinks = [];
-  const walk = (directory, inherited = []) => {
-    const scopes = [...inherited];
-    for (const name of [".gitignore", ".nomacignore"]) {
+  const files = [], links = [], skipped = [];
+  const walk = (directory, gitScopes, nomacScopes, restored) => {
+    const git = [...gitScopes], nomac = [...nomacScopes];
+    for (const [name, list] of [[".gitignore", git], [".nomacignore", nomac]]) {
       const path = join(directory, name);
       // Ignore files themselves must not read through a symlink outside the project.
-      if (existsSync(path) && lstatSync(path).isFile()) scopes.push({ root: directory, rules: ignoreFactory().add(readFileSync(path, "utf8")) });
+      if (existsSync(path) && lstatSync(path).isFile()) list.push({ root: directory, rules: ignoreFactory().add(readFileSync(path, "utf8")) });
     }
     for (const entry of readdirSync(directory, { withFileTypes: true })) {
       const path = join(directory, entry.name), rel = relative(root, path).split(sep).join("/");
-      const candidate = rel + (entry.isDirectory() ? "/" : "");
-      if (denied.ignores(candidate)) continue;
-      let ignored = false;
-      for (const scope of scopes) {
-        const result = scope.rules.test(relative(scope.root, path).split(sep).join("/") + (entry.isDirectory() ? "/" : ""));
-        if (result.ignored) ignored = true;
-        if (result.unignored) ignored = false;
+      const isDirectory = entry.isDirectory(), candidate = rel + (isDirectory ? "/" : "");
+      let reason;
+      if (!restored) {
+        reason = builtInRules.find(rule => rule.rules.ignores(entry.name + (isDirectory ? "/" : "")))?.reason;
+        if (!reason && isDirectory && verdict(git, path, true)) reason = "listed in .gitignore";
       }
-      if (ignored) continue;
-      if (entry.isSymbolicLink()) skippedLinks.push(rel);
-      else if (entry.isDirectory()) walk(path, scopes);
+      const decision = verdict(nomac, path, isDirectory);
+      const bringsBack = decision === false && reason !== undefined;
+      if (decision === true) reason = "listed in .nomacignore";
+      if (decision === false) reason = undefined;
+      if (reason) { skipped.push({ path: candidate, reason }); continue; }
+      if (entry.isSymbolicLink()) links.push(rel);
+      else if (isDirectory) walk(path, git, nomac, restored || bringsBack);
       else if (entry.isFile()) files.push(rel);
     }
   };
-  walk(root);
-  return { files: files.sort(), skippedLinks: skippedLinks.sort() };
+  walk(root, [], [], false);
+  return { files: files.sort(), links: links.sort(), skipped: skipped.sort((a, b) => byPath(a.path, b.path)) };
 }
 
 export async function fingerprint(path) {
   const stat = lstatSync(path);
-  if (!stat.isFile()) return stat.isSymbolicLink() ? "symlink" : "other";
+  if (stat.isSymbolicLink()) return `link:${createHash("sha256").update(readlinkSync(path, { encoding: "buffer" })).digest("hex")}`;
+  if (!stat.isFile()) return "other";
   const hash = createHash("sha256");
   for await (const chunk of createReadStream(path, { flags: constants.O_RDONLY | constants.O_NOFOLLOW })) hash.update(chunk);
   return `file:${hash.digest("hex")}:${(stat.mode & 0o777).toString(8)}`;
@@ -68,12 +111,21 @@ for my $name (@$names) {
   die "Invalid path" if ref($name) || $name =~ m{^/|(?:^|/)\\.\\.(?:/|$)|[\\x00-\\x1f\\x7f\\\\]};
   my $file = './' . encode_utf8($name);
   my @parts = split m{/}, $file;
+  pop @parts;
   my $unsafe = 0;
   while (@parts > 1) {
     if (-l join('/', @parts)) { $unsafe = 1; last; }
     pop @parts;
   }
+  # A symlinked folder above the path could send a write outside the workspace.
   if ($unsafe) { $result{$name} = 'symlink'; next; }
+  # The path itself may be a link that sync placed: compare its target, never follow it.
+  if (-l $file) {
+    my $target = readlink($file);
+    die "Cannot read link" unless defined $target;
+    $result{$name} = 'link:' . Digest::SHA::sha256_hex($target);
+    next;
+  }
   if (!-e $file) { $result{$name} = 'missing'; next; }
   if (!-f $file) { $result{$name} = 'other'; next; }
   sysopen(my $handle, $file, O_RDONLY | O_NOFOLLOW) or die "Cannot open source file";
@@ -98,7 +150,7 @@ export async function remoteFingerprints(session, files, options) {
     if (!values || Array.isArray(values) || Object.keys(values).length !== batch.length) throw new CliError("invalid remote file response");
     for (const path of batch) {
       const value = Object.hasOwn(values, path) && values[path];
-      if (typeof value !== "string" || !/^(?:missing|symlink|other|file:[a-f0-9]{64}:[0-7]{1,4})$/.test(value)) throw new CliError("invalid remote fingerprint");
+      if (typeof value !== "string" || !/^(?:missing|symlink|other|link:[a-f0-9]{64}|file:[a-f0-9]{64}:[0-7]{1,4})$/.test(value)) throw new CliError("invalid remote fingerprint");
       Object.defineProperty(result, path, { value, enumerable: true, configurable: true, writable: true });
     }
   }
@@ -110,6 +162,30 @@ function transferArgs() {
   return ["-rpt", "--checksum", "--itemize-changes", "--stats", "--timeout=60", "-e", [process.execPath, bridge].map(rsyncQuote).join(" ")];
 }
 
+/** Size, the biggest files, and what was skipped with the .nomacignore line that would send it. */
+function summarize(root, { files, links, skipped }) {
+  const sizes = files.map(path => ({ path, bytes: lstatSync(join(root, path)).size }));
+  return {
+    bytes: sizes.reduce((sum, file) => sum + file.bytes, 0),
+    links: links.length,
+    biggest: sizes.sort((a, b) => b.bytes - a.bytes || byPath(a.path, b.path)).slice(0, 5),
+    skipped: skipped.map(item => ({ ...item, send_with: `!${item.path}` })),
+  };
+}
+
+const megabytes = bytes => `${(bytes / 1_000_000).toFixed(bytes < 10_000_000 ? 1 : 0)} MB`;
+
+/** The human summary of a sync: what changed, how much was considered, and what stayed behind. */
+export function describeSync(result) {
+  const lines = [`${result.dry_run ? "Would sync" : "Synced"} ${result.changed.length} changed of ${result.files} files (${megabytes(result.bytes)}${result.links ? `, ${result.links} links` : ""}).`];
+  if (result.skipped.length) {
+    lines.push("Skipped (add the line to .nomacignore to send it):");
+    for (const item of result.skipped.slice(0, 20)) lines.push(`  ${item.path}  ${item.reason}  ${item.send_with}`);
+    if (result.skipped.length > 20) lines.push(`  …and ${result.skipped.length - 20} more (--json lists all)`);
+  }
+  return lines.join("\n");
+}
+
 const transferEnv = (session, remoteDirectory = ".") => ({ ...process.env, NOMAC_TRANSFER_SESSION: JSON.stringify({ ...session, remoteDirectory }) });
 
 function conflictError(paths, side) {
@@ -120,24 +196,27 @@ function conflictError(paths, side) {
 }
 
 export async function syncProject(session, store, { overwrite = false, dryRun = false, run = runProcess } = {}) {
-  const { files, skippedLinks } = projectFiles(store.project);
-  if (!files.length) throw new CliError("no project files", "No files remain after .gitignore, .nomacignore and default exclusions.");
+  const selection = projectFiles(store.project);
+  const paths = [...selection.files, ...selection.links].sort();
+  if (!paths.length) throw new CliError("no project files", "Nothing to send: every file is in a skipped folder. Add `!` lines to .nomacignore for what the Mac needs.");
   const local = Object.create(null);
-  for (const path of files) local[path] = await fingerprint(join(store.project, path));
+  for (const path of paths) local[path] = await fingerprint(join(store.project, path));
   const baseline = Object.assign(Object.create(null), store.baseline());
-  const previous = await remoteFingerprints(session, files, { run });
-  const unsafe = files.filter(path => ["symlink", "other"].includes(previous[path]));
-  if (unsafe.length) throw new CliError("unsafe remote path", `Remote paths are symlinks or have incompatible types: ${unsafe.slice(0, 10).join(", ")}. Resolve them inside the workspace first.`);
-  const conflicts = files.filter(path => previous[path] !== "missing" && previous[path] !== local[path] && previous[path] !== baseline[path]);
+  const previous = await remoteFingerprints(session, paths, { run });
+  const unsafe = paths.filter(path => ["symlink", "other"].includes(previous[path]));
+  if (unsafe.length) throw new CliError("unsafe remote path", `Remote paths are below a symlinked folder or have incompatible types: ${unsafe.slice(0, 10).join(", ")}. Resolve them inside the workspace first.`);
+  const conflicts = paths.filter(path => previous[path] !== "missing" && previous[path] !== local[path] && previous[path] !== baseline[path]);
   if (conflicts.length && !overwrite) throw conflictError(conflicts, "Remote");
-  if (dryRun) return { dry_run: true, files: files.length, changed: files.filter(path => previous[path] !== local[path]), skipped_symlinks: skippedLinks };
-  const output = await run("rsync", [...transferArgs(), "--from0", "--files-from=-", `${store.project}/`, `${session.target}:./`], { input: Buffer.from(files.join("\0") + "\0"), env: transferEnv(session) });
-  const after = await remoteFingerprints(session, files, { run });
-  const changedDuringTransfer = files.filter(path => after[path] !== local[path]);
-  for (const path of files) if (after[path] === local[path]) baseline[path] = local[path];
+  const changed = paths.filter(path => previous[path] !== local[path]), summary = summarize(store.project, selection);
+  if (dryRun) return { dry_run: true, files: paths.length, changed, ...summary };
+  // --links sends a symlink as a link: its target is never read or followed.
+  const output = await run("rsync", [...transferArgs(), "--links", "--from0", "--files-from=-", `${store.project}/`, `${session.target}:./`], { input: Buffer.from(paths.join("\0") + "\0"), env: transferEnv(session) });
+  const after = await remoteFingerprints(session, paths, { run });
+  const changedDuringTransfer = paths.filter(path => after[path] !== local[path]);
+  for (const path of paths) if (after[path] === local[path]) baseline[path] = local[path];
   store.saveBaseline(baseline);
   if (changedDuringTransfer.length) throw new CliError("transfer changed during verification", "Some files changed during transfer. Stop concurrent edits and rerun sync; verified files were recorded.");
-  return { files: files.length, changed: files.filter(path => previous[path] !== local[path]), skipped_symlinks: skippedLinks, output: output.stdout };
+  return { files: paths.length, changed, ...summary, output: output.stdout };
 }
 
 /** Refuse symlink ancestors, including the destination itself, before local writes. */
@@ -166,7 +245,7 @@ export async function pullProject(session, store, destination, { from = destinat
   if (kind === "missing") {
     throw new CliError("no such workspace path", `The Mac has no ${from} in its workspace. Paths are relative to the workspace; copy anything outside it, such as /tmp, into the workspace first.`);
   }
-  if (kind === "symlink") throw new CliError("unsafe remote path", `${from} is a symlink. Resolve it inside the workspace first.`);
+  if (kind === "symlink" || kind.startsWith("link:")) throw new CliError("unsafe remote path", `${from} is a symlink. Pull the folder or file it points to instead.`);
   const single = typeof kind === "string" && kind.startsWith("file:") ? posix.basename(from) : null;
   const source = single ? posix.dirname(from) : from;
   // cp semantics for a single file: into the directory if one exists, else to that name.

package/src/sessions.mjs

@@ -5,7 +5,7 @@ import { parseArgs } from "node:util";
 import { CliError } from "./api.mjs";
 import { sessionStore } from "./session-store.mjs";
 import { forwardingArg, prepareWorkspace, runProcess, shellQuote, sshArgs, validateTarget, workspaceCommand } from "./session-ssh.mjs";
-import { pullProject, syncProject } from "./session-transfer.mjs";
+import { describeSync, pullProject, syncProject } from "./session-transfer.mjs";
 
 export const SESSION_HELP = `Nomac 2.0 — SSH workspace preview
 
@@ -132,7 +132,7 @@ export async function sessionCommand(command, argv, { store: suppliedStore, run
     if (command === "sync") {
       if (positionals.length > 1 || (positionals[0] && realpathSync(resolve(positionals[0])) !== store.project)) throw new CliError("sync project mismatch", "Run nomac sync . from the project used by nomac start.");
       const result = await syncProject(session, store, { overwrite: values.overwrite, dryRun: values["dry-run"], run });
-      return output(result, `${result.dry_run ? "Would sync" : "Synced"} ${result.changed.length} changed files (${result.files} considered).${result.skipped_symlinks.length ? `\nSkipped symlinks: ${result.skipped_symlinks.join(", ")}` : ""}`);
+      return output(result, describeSync(result));
     }
     if (command === "pull") {
       if (positionals.length !== 1) throw new CliError("pull usage", "Usage: nomac pull LOCAL_DIRECTORY [--from REMOTE_DIRECTORY] [--dry-run] [--overwrite]");

package/src/sign.mjs

@@ -0,0 +1,40 @@
+import { parseArgs } from "node:util";
+import { api as defaultApi, CliError } from "./api.mjs";
+import { withHumanSteps } from "./human-steps.mjs";
+
+export const SIGN_HELP = `Usage: nomac sign [path] [--scheme NAME] [--container PATH] [--team ISSUER_ID] [--session ses_…] [--json]
+Set up App Store signing for the project on this folder's Mac (path: the project folder
+on the Mac, relative to the synced folder; default .). NoMac reads the project there,
+makes the App Store profiles its app and extensions need with your App Store Connect key,
+which stays on NoMac's server, and installs them with your certificate. The project
+itself is not changed. Then build with your own tools and the files it prints.`;
+
+export async function signCommand(args, { api = defaultApi, print = console.log, store } = {}) {
+  const { values, positionals } = parseArgs({ args, allowPositionals: true, strict: true, options: {
+    scheme: { type: "string" }, container: { type: "string" }, team: { type: "string" }, session: { type: "string" }, json: { type: "boolean" }, help: { type: "boolean", short: "h" },
+  } });
+  if (values.help) return print(SIGN_HELP);
+  if (positionals.length > 1) throw new CliError("sign usage", SIGN_HELP);
+  const session = values.session ?? store?.load()?.id;
+  if (!session || !/^ses_[A-Za-z0-9_-]{1,80}$/.test(session)) throw new CliError("no Mac", "No Mac for this folder. Start one with nomac start and sync the project (nomac sync .), or pass --session ses_….");
+  const body = { ...(positionals[0] ? { path: positionals[0] } : {}), ...(values.scheme ? { scheme: values.scheme } : {}), ...(values.container ? { container: values.container } : {}), ...(values.team ? { issuer_id: values.team } : {}) };
+  let result;
+  try { result = await api("POST", `/api/v1/mac/sessions/${encodeURIComponent(session)}/signing`, { body }); }
+  catch (error) { throw values.json ? error : withHumanSteps(error); }
+  if (values.json) { print(JSON.stringify(result, null, 2)); return result; }
+  print([
+    `Signing set up for ${result.project.scheme} (${result.project.container}), Apple team ${result.team_id}, with ${result.identity.name}.`,
+    ...result.changes.map((change) => `  ${change}`),
+    ...result.profiles.map((profile) => `  ${profile.bundle_id}: ${profile.name}, until ${profile.expires_at.slice(0, 10)}`),
+    "",
+    "Build on the Mac with your own tools:",
+    ...result.commands.xcodebuild.map((line) => `  ${line}`),
+    `  Flutter: ${result.commands.flutter}`,
+    `  fastlane: ${result.commands.fastlane}`,
+    ...(result.build_number ? ["", `Build number ${result.build_number} is reserved for this build; the commands set it.`] : []),
+    ...(result.app_record ? ["", `Before TestFlight: ${result.app_record.message}`, `  ${result.app_record.url}`] : []),
+    "",
+    "Then send the .ipa to TestFlight with nomac testflight <path to the .ipa>.",
+  ].join("\n"));
+  return result;
+}

package/src/testflight.mjs

@@ -0,0 +1,85 @@
+import { randomUUID } from "node:crypto";
+import { parseArgs } from "node:util";
+import { api as defaultApi, CliError } from "./api.mjs";
+import { humanSteps, withHumanSteps } from "./human-steps.mjs";
+
+export const TESTFLIGHT_HELP = `Usage: nomac testflight <ipa> [--notes TEXT] [--encryption no|yes] [--team ISSUER_ID] [--session ses_…] [--no-wait] [--json]
+       nomac testflight --id tfu_…
+Send a signed .ipa on this folder's Mac to TestFlight (ipa: its path on the Mac, relative to
+the synced folder). Your App Store Connect key stays on NoMac's server; the Mac only sends
+the file to Apple. Apple then processes the build, usually for 5 to 15 minutes, with no Mac
+needed, and NoMac puts it on TestFlight for your internal testers.
+  --notes TEXT        What to Test, shown to testers
+  --encryption no|yes Apple's export-compliance question, answered once per app. Most apps
+                      answer no: HTTPS and Apple's own encryption are exempt.
+  --no-wait           start sending and return; follow later with --id`;
+
+const DONE = new Set(["on_testflight", "failed"]);
+
+
+function describe(view) {
+  const app = `${view.app.bundle_id} ${view.app.version} (${view.app.build_number})`;
+  switch (view.state) {
+    case "sending": return `Sending ${app} from the Mac to Apple…`;
+    case "processing": return `Apple has ${app} and is processing it (usually 5 to 15 minutes; no Mac needed).${view.waiting_for ? `\n  Waiting for: ${view.waiting_for}` : ""}\n  Stopping this wait does not stop it: follow it later with nomac testflight --id ${view.id}`;
+    case "on_testflight": return `On TestFlight: ${app}. Internal testers can install it from the TestFlight app.\n  ${view.url}\n  ${view.app.platform === "IOS"
+      ? `To submit it for App Review: nomac publish --project ${view.project_id} --build ${view.build_id}` : "Submit it for App Review in App Store Connect."}`;
+    // With a build_id, Apple had the file and refused it while processing; without one, it never reached Apple.
+    case "failed": return [`${view.build_id ? "Apple did not accept the build" : "Not sent"}: ${view.error?.message ?? "the send failed."}`, ...humanSteps(view.error)].join("\n");
+    default: return `${app}: ${view.state}`;
+  }
+}
+
+export async function testflightCommand(args, { api = defaultApi, print = console.log, store } = {}) {
+  const { values, positionals } = parseArgs({ args, allowPositionals: true, strict: true, options: {
+    notes: { type: "string" }, encryption: { type: "string" }, team: { type: "string" }, session: { type: "string" },
+    id: { type: "string" }, "no-wait": { type: "boolean" }, json: { type: "boolean" }, help: { type: "boolean", short: "h" },
+  } });
+  if (values.help) return print(TESTFLIGHT_HELP);
+  if (values.encryption !== undefined && !["yes", "no"].includes(values.encryption)) throw new CliError("encryption usage", "--encryption takes no or yes.");
+  let view;
+  if (values.id) {
+    if (positionals.length) throw new CliError("testflight usage", TESTFLIGHT_HELP);
+    view = await api("GET", `/api/v1/testflight/${encodeURIComponent(values.id)}`);
+  } else {
+    if (positionals.length !== 1) throw new CliError("testflight usage", TESTFLIGHT_HELP);
+    const session = values.session ?? store?.load()?.id;
+    if (!session || !/^ses_[A-Za-z0-9_-]{1,80}$/.test(session)) throw new CliError("no Mac", "No Mac for this folder. Start one with nomac start, build the .ipa there, or pass --session ses_….");
+    const body = {
+      path: positionals[0], request_key: `cli-testflight-${randomUUID()}`, wait_seconds: values["no-wait"] ? 0 : 50,
+      ...(values.notes ? { notes: values.notes } : {}),
+      ...(values.encryption ? { uses_non_exempt_encryption: values.encryption === "yes" } : {}),
+      ...(values.team ? { issuer_id: values.team } : {}),
+    };
+    try { view = await api("POST", `/api/v1/mac/sessions/${encodeURIComponent(session)}/testflight`, { body }); }
+    catch (error) {
+      if (!(error instanceof CliError) || values.json) throw error;
+      if (error.code === "encryption_answer_required") {
+        error.friendly = `${error.details.question}\nAsk the person who owns the app, then run this again with --encryption no or --encryption yes. NoMac remembers the answer for this app. Most apps answer no.`;
+      } else if (error.code === "needs_human") {
+        withHumanSteps(error);
+      }
+      throw error;
+    }
+  }
+  let last = "";
+  const show = (current) => {
+    if (values.json) return;
+    const line = describe(current);
+    if (line !== last) print(line);
+    last = line;
+  };
+  show(view);
+  if (!values["no-wait"]) {
+    while (!DONE.has(view.state)) {
+      view = await api("GET", `/api/v1/testflight/${encodeURIComponent(view.id)}?wait_seconds=50`);
+      show(view);
+    }
+  } else if (!DONE.has(view.state) && !values.json) {
+    print(`Follow it with: nomac testflight --id ${view.id}`);
+  }
+  if (values.json) print(JSON.stringify(view, null, 2));
+  // The reason is already printed; exit non-zero without saying it twice.
+  if (view.state === "failed") throw Object.assign(new CliError("testflight failed", ""), { friendly: "" });
+  return view;
+}