@nomac/cli 0.9.1 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomac/cli",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Cloud Mac sessions over SSH and HTTPS, plus iOS builds and publishing — built for agents.",
   "license": "UNLICENSED",
   "type": "module",

package/skill/SKILL.md

@@ -51,14 +51,30 @@ line in .nomacignore sends any of them. It preserves remote extra files. See the
 `screenshot_mac`, which returns an image you can look at. Record a video for
 the human with `nomac record`, do the work, then `nomac record stop` (saves the
 MP4 and prints a share link); MCP `start_mac_recording`, `stop_mac_recording`.
-Commands drive any app with AppleScript without a permission prompt; drive the
-Simulator with simctl, and give the human `open_mac_desktop` when a screen
-needs a person. `get_mac_session` (and `nomac status --json`) lists what
+Commands drive any app with AppleScript without a permission prompt. For real
+keyboard and mouse, also on the lock screen and in password dialogs, use
+`nomac input type TEXT`, `nomac input click X Y`, `nomac unlock` (MCP
+`mac_input`): each answers with a screenshot. Drive the Simulator with simctl,
+and give the human `open_mac_desktop` when they want to see the screen.
+`get_mac_session` (and `nomac status --json`) lists what
 is installed: Ruby with CocoaPods, xcbeautify, xcodegen, gh, Git LFS, jq.
 Pipe xcodebuild through `xcbeautify`. Persistent disks are not currently offered.
 Report failures using `report_issue` with `session_id`, optional `job_id` and
 a description without secrets. Read https://nomac.app/llms.txt for full limits.
 
+## A Mac fully enabled for you
+
+The Mac is yours to do anything on: the `agent` account is an administrator,
+sudo needs no password, macOS asks for no administrator password, and the
+Mac's login password is in `$NOMAC_MAC_PASSWORD` (for the login keychain, such
+as `security unlock-keychain -p "$NOMAC_MAC_PASSWORD"`, or any prompt).
+Privacy prompts are answered Allow as they appear, and `nomac-permit APP
+camera microphone` (CLI `nomac permit`, at start `--permit APP=camera`) grants
+an app permissions before it asks. `~/NOMAC.md` on the Mac says the same. When
+`screenshot_mac` reports `screen_locked` or a `dialog`, follow its
+`next_step`. `nomac start --prompts ask` keeps macOS's usual prompts, for
+testing an app's own.
+
 ## Secrets, signing and shipping
 
 Never ask for a secret in the chat. `nomac secrets request NAME --description

package/src/cli.mjs

@@ -19,8 +19,13 @@ Use it:
   nomac ssh                    open a shell (nomac ssh -- command runs one)
   nomac sync .                 upload changed project files
   nomac pull ./build           download a folder from the Mac
-  nomac desktop                the Mac's desktop in your browser
+  nomac desktop                the Mac's desktop in your browser (--app: Apple's Screen Sharing)
   nomac screenshot             save the Mac's screen as nomac-screenshot.jpg
+  nomac input type hello       real keyboard and mouse: type, key, click; works on the lock screen
+  nomac unlock                 unlock the Mac's lock screen
+  nomac password               the Mac's login password (also $NOMAC_MAC_PASSWORD on it)
+  nomac permit APP camera      grant an app privacy permissions, so it never asks
+  nomac defaults               options every new Mac starts with (nomac defaults --help)
   nomac record                 record a video; nomac record stop saves it with a share link
   nomac status                 state, cost so far and when it stops
   nomac secrets                variables and files every Mac receives (nomac secrets --help)
@@ -76,6 +81,16 @@ export async function main(argv) {
       const { transportCommand } = await import("./transport-command.mjs");
       return transportCommand(rest);
     }
+    // Only a cloud Mac has a session password and NoMac's input.
+    case "password":
+    case "input":
+    case "unlock":
+    case "permit":
+    case "defaults": {
+      const { sessionStore } = await import("./session-store.mjs");
+      const { hostedSessionCommand } = await import("./hosted-sessions.mjs");
+      return hostedSessionCommand(cmd, rest, { store: sessionStore() });
+    }
     case "status":
       // A legacy build ID, or a folder that only ever built with the old pipeline, keeps build status.
       if (/^bld_/.test(rest[0] ?? "") || (loadProjectState().last_build && !(await import("./session-store.mjs")).sessionStore().load())) {

package/src/desktop.mjs

@@ -1,14 +1,22 @@
+import { spawn } from "node:child_process";
+import net from "node:net";
+import { api, CliError } from "./api.mjs";
 import { loadApiUrl } from "./config.mjs";
 import { openUrl } from "./mac-credits.mjs";
+import { runProcess, sshArgs } from "./session-ssh.mjs";
 
 /**
  * `nomac desktop`: the Mac's full macOS desktop in the browser. The page on
  * nomac.app connects through the gateway to the VM's own display, so there is
  * nothing to install and no password to type. macOS has no RDP.
  */
-export const DESKTOP_HELP = `nomac desktop [--no-open] [--json]
+export const DESKTOP_HELP = `nomac desktop [--app] [--no-open] [--json]
   Open the Mac's full macOS desktop in your browser: mouse and keyboard,
   nothing to install. Sign in to nomac.app if asked. (macOS has no RDP.)
+  --app, on a Mac: open it in Apple's Screen Sharing instead, through the
+  session's SSH tunnel, signed in with the Mac's password: shared clipboard,
+  and Cmd shortcuts reach the cloud Mac. The tunnel stays open until the
+  Screen Sharing window closes or Ctrl-C.
   The session stays busy while the desktop is open; the page disconnects after
   15 minutes without input. Credit is used while the Mac is ready: nomac stop when done.`;
 
@@ -24,3 +32,72 @@ export function desktop(local, { values = {}, print = console.log, open = openUr
     "Credit is used while the Mac is ready: nomac stop when done.",
   ].join("\n"));
 }
+
+/** Put text on the clipboard: pbcopy on a Mac, clip on Windows, wl-copy, xclip or xsel on Linux. */
+export async function copyToClipboard(text, run = runProcess, platform = process.platform) {
+  const tools = platform === "darwin" ? [["pbcopy", []]] : platform === "win32" ? [["clip", []]]
+    : [["wl-copy", []], ["xclip", ["-selection", "clipboard"]], ["xsel", ["--clipboard", "--input"]]];
+  for (const [tool, args] of tools) {
+    try { await run(tool, args, { input: text }); return tool; } catch { /* try the next one */ }
+  }
+  throw new CliError("No clipboard tool was found.", "Run nomac password without --copy to print the password.");
+}
+
+/** A local port nothing listens on. */
+export function freePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => { const { port } = server.address(); server.close(() => resolve(port)); });
+  });
+}
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const accepts = (port) => new Promise((resolve) => {
+  const socket = net.connect(port, "127.0.0.1");
+  socket.once("connect", () => { socket.destroy(); resolve(true); });
+  socket.once("error", () => resolve(false));
+});
+/** Established connections to the tunnel's local port (Screen Sharing's), from lsof. */
+async function connections(port, run) {
+  try { return (await run("lsof", ["-nP", `-iTCP@127.0.0.1:${port}`, "-sTCP:ESTABLISHED", "-t"])).stdout.split("\n").filter(Boolean).length; }
+  catch { return 0; } // lsof exits 1 when it finds none
+}
+
+/**
+ * `nomac desktop --app`: Apple's Screen Sharing, on a Mac, into the cloud Mac's
+ * own Screen Sharing, through the session's SSH tunnel (nothing else can reach
+ * it), signed in as agent with the session's password. It returns once the
+ * window has been closed, or the tunnel ends.
+ */
+export async function screenSharing(local, { request = api, print = console.log, platform = process.platform, spawnSsh = (args) => spawn("ssh", args, { stdio: ["ignore", "ignore", "pipe"] }),
+  open = openUrl, run = runProcess, wait = sleep, port: chosen, pollMs = 3000 } = {}) {
+  if (platform !== "darwin") throw new CliError("Apple's Screen Sharing is on Macs only.", "Use nomac desktop to open the Mac's desktop in your browser.");
+  const login = await request("GET", `/api/v1/mac/sessions/${local.id}/password`);
+  const port = chosen ?? await freePort();
+  const tunnel = spawnSsh([...sshArgs(local, { batch: false }), "-N", "-o", "ExitOnForwardFailure=yes", "-L", `127.0.0.1:${port}:127.0.0.1:5900`, local.target]);
+  let ended = false, problem = "";
+  tunnel.stderr?.on("data", (chunk) => { problem += chunk; });
+  tunnel.on("exit", () => { ended = true; });
+  const close = () => { if (!ended) tunnel.kill("SIGTERM"); };
+  process.once("SIGINT", close);
+  try {
+    let open_ = false;
+    for (let i = 0; i < 40 && !ended && !(open_ = await accepts(port)); i++) await wait(500);
+    if (!open_) throw new CliError("The tunnel to the Mac's Screen Sharing did not open.", problem.trim() || "Check the session with nomac status, then try again.");
+    open(`vnc://${encodeURIComponent(login.user)}:${encodeURIComponent(login.password)}@127.0.0.1:${port}`);
+    print("Screen Sharing is opening, signed in to the cloud Mac. The tunnel stays open until you close its window (or press Ctrl-C).");
+    // Wait for Screen Sharing to connect, then for it to leave; give up waiting after two minutes unconnected.
+    let seen = false, quiet = 0;
+    for (let waited = 0; !ended; waited += pollMs) {
+      await wait(pollMs);
+      const count = await connections(port, run);
+      if (count) { seen = true; quiet = 0; } else if (seen && ++quiet >= 2) break;
+      if (!seen && waited >= 120_000) { print("Screen Sharing did not connect. Open it again with nomac desktop --app."); break; }
+    }
+    return { port, connected: seen };
+  } finally {
+    process.removeListener("SIGINT", close);
+    close();
+  }
+}

package/src/hosted-sessions.mjs

@@ -7,15 +7,33 @@ import { sessionStore } from "./session-store.mjs";
 import { forwardingArg, runProcess, sshArgs, workspaceCommand } from "./session-ssh.mjs";
 import { pullProject, syncProject } from "./session-transfer.mjs";
 import { macRequest, sessionId, transportOptions } from "./mac-transport.mjs";
-import { desktop, DESKTOP_HELP } from "./desktop.mjs";
+import { copyToClipboard, desktop, DESKTOP_HELP, screenSharing } from "./desktop.mjs";
 import { screenshot, startRecording, stopRecording } from "./mac-screen.mjs";
 
 const HELP = `Nomac cloud Mac sessions
   nomac start [--wait 300] [--max-duration 7200] [--idle-timeout 600] [--max-cost 5] [--json]
+              [--prompts ask]
+                                    The Mac is fully open to your agent: no administrator
+                                    password prompts, its login password in
+                                    $NOMAC_MAC_PASSWORD. --prompts ask keeps macOS's
+                                    usual prompts.
   nomac sync . [--dry-run]           upload changed files
   nomac ssh [--forward 8080:3000]    full Mac shell and port forwarding
   nomac ssh -- command args         run any command over SSH
   nomac desktop [--no-open] [--json] the full macOS desktop in your browser
+  nomac desktop --app               on a Mac: Apple's Screen Sharing, shared clipboard
+  nomac password [--copy]           the Mac's login password for this session
+  nomac input type TEXT | key cmd+q | click X Y [--right] [--double] | move X Y
+              | scroll X Y up|down [N] | password | size   [-o FILE] [--no-screenshot]
+                                    real keyboard and mouse, also on the lock screen
+                                    and in password dialogs; saves a screenshot after
+  nomac unlock                      unlock the Mac's lock screen
+  nomac permit APP PERMISSION...    grant camera, microphone, contacts, photos... (or all)
+                                    to an app by bundle ID, so it never asks
+  nomac defaults [--prompts ask] [--permit APP=camera,microphone] [--reset]
+                                    what every new Mac starts with (shows them with no options)
+  nomac start --permit APP=PERMISSIONS
+                                    grant permissions on this Mac at start
   nomac exec [--wait 30] -- command args
                                     runs it, prints its output, exits with its code.
                                     Waits up to 30 s; for builds and tests use --wait 600.
@@ -47,7 +65,68 @@ const options = {
   overwrite: { type: "boolean" }, "dry-run": { type: "boolean" }, from: { type: "string" },
   forward: { type: "string", multiple: true }, cursor: { type: "string" }, stream: { type: "string" },
   "no-open": { type: "boolean" }, simulator: { type: "boolean" }, output: { type: "string", short: "o" }, max: { type: "string" },
+  prompts: { type: "string" }, gatekeeper: { type: "string" }, copy: { type: "boolean" }, app: { type: "boolean" },
+  right: { type: "boolean" }, double: { type: "boolean" }, "no-screenshot": { type: "boolean" },
+  permit: { type: "string", multiple: true }, reset: { type: "boolean" },
 };
+/** --permit com.example.App=camera,microphone (or =all), as the permissions option. */
+export function permitOption(values) {
+  if (!values?.length) return undefined;
+  const permissions = {};
+  for (const value of values) {
+    const match = /^([A-Za-z0-9][A-Za-z0-9.-]{0,154})=([a-z,-]+)$/.exec(value);
+    if (!match) throw new CliError(`--permit takes APP=PERMISSION,PERMISSION, like com.example.App=camera,microphone (or =all). Got: ${value}`);
+    permissions[match[1]] = match[2] === "all" ? "all" : match[2].split(",").filter(Boolean);
+  }
+  return permissions;
+}
+const oneOf = (value, allowed, flag) => {
+  if (!allowed.includes(value)) throw new CliError(`${flag} takes ${allowed.join(" or ")}.`);
+  return value;
+};
+/** The access the person chose at start, or none: the server's defaults then apply (fully open). */
+function accessOption(values) {
+  const permissions = permitOption(values.permit);
+  if (values.prompts === undefined && values.gatekeeper === undefined && !permissions) return undefined;
+  return {
+    ...(values.prompts !== undefined ? { prompts: oneOf(values.prompts, ["auto", "ask"], "--prompts") } : {}),
+    ...(values.gatekeeper !== undefined ? { gatekeeper: oneOf(values.gatekeeper, ["off", "on"], "--gatekeeper") } : {}),
+    ...(permissions ? { permissions } : {}),
+  };
+}
+const point = (value, name) => {
+  if (!/^\d{1,5}$/.test(value ?? "")) throw new CliError(`Give ${name} as a whole number of screen points, like 720.`);
+  return Number(value);
+};
+/** nomac input's arguments as the input route's request. */
+export function inputRequest(positionals, values) {
+  const [action, ...rest] = positionals;
+  const usage = "Usage: nomac input type TEXT | key NAME... | click X Y [--right] [--double] | move X Y | scroll X Y up|down [N] | password | size";
+  switch (action) {
+    case "type": if (!rest.length) throw new CliError(usage); return { action, text: rest.join(" ") };
+    case "key": if (!rest.length) throw new CliError(usage); return { action, keys: rest };
+    case "click": return { action, x: point(rest[0], "X"), y: point(rest[1], "Y"), ...(values.right ? { button: "right" } : {}), ...(values.double ? { double: true } : {}) };
+    case "move": return { action, x: point(rest[0], "X"), y: point(rest[1], "Y") };
+    case "scroll": {
+      const direction = oneOf(rest[2], ["up", "down"], "scroll"), steps = rest[3] === undefined ? 3 : point(rest[3], "N");
+      if (steps < 1 || steps > 50) throw new CliError("Scroll 1 to 50 steps.");
+      return { action, x: point(rest[0], "X"), y: point(rest[1], "Y"), steps: direction === "up" ? -steps : steps };
+    }
+    case "password": case "size": if (rest.length) throw new CliError(usage); return { action };
+    default: throw new CliError(usage);
+  }
+}
+/** One line saying what the input did and what the screen shows now. */
+function inputSummary(answer, saved) {
+  const did = answer.action === "unlock" ? (answer.unlocked ? "Unlocked the screen." : answer.message ?? "The screen was not locked.")
+    : answer.action === "type" ? `Typed ${answer.typed} characters.` : answer.action === "key" ? `Pressed ${answer.pressed.join(", ")}.`
+    : answer.action === "click" ? `Clicked at ${answer.clicked.join(",")}.` : answer.action === "password" ? "Typed the Mac's password."
+    : answer.action === "size" ? `The screen is ${answer.width} x ${answer.height} points.` : `Done: ${answer.action}.`;
+  const shot = answer.screenshot;
+  if (!shot) return answer.screenshot_error ? `${did}\n${answer.screenshot_error}` : did;
+  const seen = shot.screen_locked ? "the screen is locked" : shot.dialog ? `a dialog is open: ${shot.dialog}` : shot.front_app ? `${shot.front_app} in front` : "";
+  return `${did}\nSaved ${saved}${seen ? ` (${seen})` : ""}.`;
+}
 function budget(value = "5") {
   if (!/^(?:0|[1-9][0-9]{0,5})(?:\.[0-9]{1,6})?$/.test(value)) throw new CliError("--max-cost must be a positive USD amount, for example 5 or 2.50.");
   const [whole, fraction = ""] = value.split(".");
@@ -90,7 +169,7 @@ async function waitForCommand(id, base, started, waitSeconds, { request, transpo
   let job = started;
   const deadline = now() + waitSeconds * 1000;
   const begun = now();
-  let announced = false, busy = false;
+  let announced = false, busy = false, shownWaiting = "";
   for (let polls = 0; waitSeconds && !["exited", "unknown"].includes(job.state) && now() < deadline; polls++) {
     // A slow command can outlive the shell waiting for it (agent shells time out); leave a way back.
     if (!json && !announced && now() - begun >= NOTICE_MS && deadline - now() > 1000) {
@@ -101,6 +180,12 @@ async function waitForCommand(id, base, started, waitSeconds, { request, transpo
     // A saturated Mac (a booting Simulator) answers late; the command still runs, so keep waiting.
     try { job = await hostedRequest(id, "GET", `${base}/jobs/${job.id}`, {}, { request, transport, cache }); busy = false; }
     catch (error) { if (error?.code !== "guest_busy") throw error; busy = true; }
+    // A quiet command the Mac sees waiting on macOS (a dialog, a locked screen): say what and how to go on, once each.
+    const waiting = job.waiting_on;
+    if (!json && waiting?.kind && `${waiting.kind}:${waiting.text}` !== shownWaiting) {
+      shownWaiting = `${waiting.kind}:${waiting.text}`;
+      stderr(`nomac: ${job.id} is waiting on macOS: ${waiting.text}\n  ${waiting.fix}\n`);
+    }
   }
   if (job.state !== "exited") {
     if (!waitSeconds) { print(JSON.stringify(job, null, 2)); return job; }
@@ -165,6 +250,9 @@ export function statusSummary(session, image) {
     const stops = [a.idle_deadline_at ? `when idle, at ${clockUtc(a.idle_deadline_at)}` : null, a.hard_deadline_at ? `at ${clockUtc(a.hard_deadline_at)} at the latest` : null].filter(Boolean);
     if (stops.length) lines.push(`Stops by itself ${stops.join(", or ")}. Stop now: nomac stop`);
   }
+  if (session.state === "ready" && session.access) {
+    lines.push(`Open to your agent: ${session.access.prompts === "auto" ? "no administrator password prompts" : "macOS's usual prompts"}. Login password: nomac password ($NOMAC_MAC_PASSWORD on the Mac).`);
+  }
   if (session.failure_code) lines.push(`Ended: ${session.failure_code}`);
   return lines.join("\n");
 }
@@ -195,7 +283,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     const next = result.session.state === "ready" ? "Next: nomac sync . → nomac ssh"
       : result.session.failure_code === "capacity_unavailable" ? "No Mac was free within 5 minutes; nothing was charged. Run nomac start again in a few minutes."
       : result.session.state === "queued" ? "Waiting for a free Mac (waiting is free). Check again: nomac start" : "Check: nomac session status --json";
-    print(`${result.session.id}: ${result.session.state}\n${next}\n${usage}`);
+    print(`${result.session.id}: ${result.session.state}\n${next}\n${usage}${result.warning ? `\n${result.warning}` : ""}`);
     return result;
   };
   const saveView = (local, view) => {
@@ -291,8 +379,58 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
     return started;
   }
   if (command === "desktop") {
-    if (positionals.length) throw new CliError("Usage: nomac desktop [--no-open] [--json]");
-    return desktop(await ready(localSession()), { values, print });
+    if (positionals.length) throw new CliError("Usage: nomac desktop [--app] [--no-open] [--json]");
+    const local = await ready(localSession());
+    if (values.app) return screenSharing(local, { request, print });
+    return desktop(local, { values, print });
+  }
+  if (command === "defaults") {
+    if (positionals.length) throw new CliError("Usage: nomac defaults [--prompts auto|ask] [--permit APP=PERMISSIONS]... [--reset] [--json]");
+    let answer;
+    if (values.reset) answer = await request("DELETE", "/api/v1/mac/defaults");
+    else {
+      const change = accessOption(values);
+      answer = await request("GET", "/api/v1/mac/defaults");
+      // Only the options given change; the rest of the saved defaults stay.
+      if (change) answer = await request("PUT", "/api/v1/mac/defaults", { body: { ...answer.defaults, ...change, ...(change.permissions ? { permissions: { ...answer.defaults.permissions, ...change.permissions } } : {}) } });
+    }
+    if (values.json) { print(JSON.stringify(answer, null, 2)); return answer; }
+    const e = answer.effective, apps = Object.entries(e.permissions ?? {});
+    print([`Every new Mac starts with: ${e.prompts === "auto" ? "no administrator password prompts, privacy prompts and password dialogs answered on the Mac" : "macOS's usual prompts"}.`,
+      apps.length ? `Permissions granted at start: ${apps.map(([app, list]) => `${app} (${list === "all" ? "all" : list.join(", ")})`).join("; ")}.` : "No app is granted permissions at start (nomac defaults --permit APP=camera,microphone).",
+      "A start's own --prompts or --permit wins for that Mac. nomac defaults --reset goes back to fully open."].join("\n"));
+    return answer;
+  }
+  if (command === "permit") {
+    if (positionals.length < 2) throw new CliError("Usage: nomac permit APP PERMISSION... (or all), for example nomac permit com.example.App camera microphone");
+    const id = sessionId(localSession().id);
+    const job = await request("POST", `/api/v1/mac/sessions/${id}/jobs?wait=30`, { idempotencyKey: `cli-${randomUUID()}`, body: { argv: ["/opt/homebrew/bin/node", "/usr/local/bin/nomac-permit", ...positionals], timeout_seconds: 60 } });
+    let answer;
+    try { answer = JSON.parse(String(job.stdout ?? "").trim().split("\n").pop()); } catch { throw new CliError("The Mac gave no answer for the grant.", "Check that the Mac is ready (nomac status), then try again."); }
+    if (!answer.ok) throw new CliError(answer.message, undefined, undefined, answer.error);
+    print(values.json ? JSON.stringify(answer, null, 2) : `Granted ${answer.granted.join(", ")} to ${answer.app}. It will not ask.`);
+    return answer;
+  }
+  if (command === "password") {
+    if (positionals.length) throw new CliError("Usage: nomac password [--copy] [--json]");
+    const answer = await request("GET", `/api/v1/mac/sessions/${sessionId(localSession().id)}/password`);
+    if (values.copy) await copyToClipboard(answer.password, run);
+    if (values.json) print(JSON.stringify(values.copy ? { ...answer, password: undefined, copied: true } : answer, null, 2));
+    else print(values.copy ? `Copied the Mac's login password (user ${answer.user}) to the clipboard.` : `${answer.password}\nUser ${answer.user}. On the Mac it is in $${answer.variable}.`);
+    return answer;
+  }
+  if (command === "input" || command === "unlock") {
+    if (command === "unlock" && positionals.length) throw new CliError("Usage: nomac unlock");
+    const body = { ...(command === "unlock" ? { action: "unlock" } : inputRequest(positionals, values)), ...(values["no-screenshot"] ? { screenshot: false } : {}) };
+    const answer = await request("POST", `/api/v1/mac/sessions/${sessionId(localSession().id)}/input`, { body });
+    let saved;
+    if (typeof answer.screenshot?.image_base64 === "string") {
+      saved = values.output ?? "nomac-screenshot.jpg";
+      writeFileSync(saved, Buffer.from(answer.screenshot.image_base64, "base64"));
+      answer.screenshot = { ...answer.screenshot, image_base64: undefined, saved_to: saved };
+    }
+    print(values.json ? JSON.stringify(answer, null, 2) : inputSummary(answer, saved));
+    return answer;
   }
   if (command === "ssh") {
     if (values.json) throw new CliError("SSH streams bytes. Use session status --json for metadata.");
@@ -305,6 +443,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
       let local = store.load();
       if (local && local.mode !== "hosted") throw new CliError("An existing Mac workspace is attached.");
       const limits = { max_duration_seconds: integer(values["max-duration"], 7200, 60, 28800), idle_timeout_seconds: integer(values["idle-timeout"], 600, 60, 3600), spend_cap_microunits: budget(values["max-cost"]) };
+      const access = accessOption(values);
       // Older CLIs persisted invalid keys before contacting the API. Such a key
       // cannot pass server validation and therefore cannot have allocated a VM.
       if (local && !local.id && !validRequestKey(local.requestKey)) { local.state = "failed"; store.save(local); }
@@ -313,11 +452,15 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
           if (values[flag] !== undefined && limits[field] !== local.request.limits[field]) throw new CliError("This session already has different limits. Stop it and start a fresh session to change them.");
         }
         if (values["request-key"] !== undefined && values["request-key"] !== local.requestKey) throw new CliError("A session is already attached under a different request key. Inspect it or stop it before starting another.");
+        if (access && JSON.stringify({ prompts: "auto", gatekeeper: "off", ...access }) !== JSON.stringify({ prompts: "auto", gatekeeper: "off", ...local.request.access })) {
+          throw new CliError("This session was started with different --prompts, --gatekeeper or --permit. Stop it and start a fresh session to change them; nomac permit grants more on the running Mac.");
+        }
       }
       if (!local || ["stopped", "failed"].includes(local.state)) {
         const identity = join(store.directory, `id_ed25519_${randomUUID()}`);
         await run("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-C", "nomac-session", "-f", identity]);
-        local = { mode: "hosted", state: "requesting", outcomeUnknown: false, identity, requestKey: values["request-key"] ?? `cli-${randomUUID()}`, request: { profile: "standard", public_key: readFileSync(`${identity}.pub`, "utf8").trim(), limits } };
+        local = { mode: "hosted", state: "requesting", outcomeUnknown: false, identity, requestKey: values["request-key"] ?? `cli-${randomUUID()}`,
+          request: { profile: "standard", public_key: readFileSync(`${identity}.pub`, "utf8").trim(), limits, ...(access ? { access } : {}) } };
         store.save(local); store.saveBaseline({});
       }
       if (!local.id) {
@@ -331,6 +474,8 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
           }
           throw error;
         }
+        // The start's warning (what the Mac allows, how to opt out) is shown with every start of this session.
+        if (result.warning) local.warning = result.warning;
         saveView(local, result.session);
       }
       const deadline = now() + wait * 1000;
@@ -340,7 +485,7 @@ export async function hostedSessionCommand(command, argv, { store = sessionStore
         await sleep(2000);
       }
       if (local.state === "ready") await ready(local);
-      return output({ session: local.snapshot, request_key: local.requestKey });
+      return output({ session: local.snapshot, request_key: local.requestKey, ...(local.warning ? { warning: local.warning } : {}) });
     }
     const local = localSession();
     if (command === "stop") {

package/src/mac-tools.mjs

@@ -20,9 +20,11 @@ export const MAC_TOOLS = [
     return text({ ...result, opened_in_browser: opened });
   } },
   { name: "get_mac_credits", description: "Read the prepaid Mac credit balance: spendable dollars, spendable_seconds (how long a Mac can run on it), amounts held by a running session, pricing (including bonus_tiers for bigger purchases), recent purchases and first_purchase (true until the first paid top-up). Credit never expires. If spendable_seconds is below what the task needs, call get_mac_checkout.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/mac/credits")) },
-  { name: "start_mac", description: "Allocate a full cloud Mac VM, billed from prepaid credit at $0.80 an hour by the minute. If it returns insufficient_credit, call get_mac_checkout, have the human pay, then retry with the same request_key. Supply a stable request_key; SSH public_key is optional for HTTPS-only agents; reuse both after a lost response. Inspect the returned offer and limits. Poll get_mac_session until ready. No project pipeline is imposed; stop_mac deletes the VM and files.", inputSchema: schema({ public_key: { type: "string" }, request_key: key, limits: { type: "object", properties: { max_duration_seconds: { type: "integer", minimum: 60, maximum: 28800 }, idle_timeout_seconds: { type: "integer", minimum: 60, maximum: 3600 }, spend_cap_microunits: { type: "string", pattern: "^[1-9][0-9]{0,17}$" } }, additionalProperties: false } }, ["request_key"]), handler: async ({ request_key, ...body }) => text(await api("POST", "/api/v1/mac/sessions", { body, idempotencyKey: request_key })) },
+  { name: "start_mac", description: "Allocate a full cloud Mac VM, billed from prepaid credit at $0.80 an hour by the minute. If it returns insufficient_credit, call get_mac_checkout, have the human pay, then retry with the same request_key. Supply a stable request_key; SSH public_key is optional for HTTPS-only agents; reuse both after a lost response. Inspect the returned offer and limits. Poll get_mac_session until ready. No project pipeline is imposed; stop_mac deletes the VM and files. The Mac is fully enabled for you: macOS asks for no administrator password, and the Mac's login password is in $NOMAC_MAC_PASSWORD on it; the answer's warning says so. access opts out: prompts ask keeps macOS's usual prompts.", inputSchema: schema({ public_key: { type: "string" }, request_key: key, limits: { type: "object", properties: { max_duration_seconds: { type: "integer", minimum: 60, maximum: 28800 }, idle_timeout_seconds: { type: "integer", minimum: 60, maximum: 3600 }, spend_cap_microunits: { type: "string", pattern: "^[1-9][0-9]{0,17}$" } }, additionalProperties: false },
+    access: { type: "object", properties: { prompts: { type: "string", enum: ["auto", "ask"] }, gatekeeper: { type: "string", enum: ["off", "on"] },
+      permissions: { type: "object", description: "By bundle ID: a list of permissions (camera, microphone, contacts, calendars, reminders, photos, desktop, documents, downloads and more) or \"all\"", additionalProperties: { anyOf: [{ type: "string", enum: ["all"] }, { type: "array", items: { type: "string" }, minItems: 1 }] } } }, additionalProperties: false } }, ["request_key"]), handler: async ({ request_key, ...body }) => text(await api("POST", "/api/v1/mac/sessions", { body, idempotencyKey: request_key })) },
   { name: "list_mac_sessions", description: "Find existing Mac sessions, including after losing a response. Shows state, cost, limits and cleanup.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/mac/sessions")) },
-  { name: "get_mac_session", description: "Read live Mac allocation state, cost, funded time and cleanup confirmation, and once ready the credentials installed on it (secrets, signing identities and profiles, by name and path, never values). queued/provisioning means wait; stopping is not yet confirmed cleanup.", inputSchema: schema({ session_id: session }, ["session_id"]), handler: async args => text(await api("GET", base(args))) },
+  { name: "get_mac_session", description: "Read live Mac allocation state, cost, funded time and cleanup confirmation, and once ready the credentials installed on it (secrets, signing identities and profiles, by name and path, never values) and account: the Mac's user, whether its login password is set (in $NOMAC_MAC_PASSWORD on the Mac), the access choices, and how to type and click (mac_input). queued/provisioning means wait; stopping is not yet confirmed cleanup.", inputSchema: schema({ session_id: session }, ["session_id"]), handler: async args => text(await api("GET", base(args))) },
   { name: "list_secrets", description: "List the account's secrets by name: variables (set in every shell and command on the Mac) and files (with their path on the Mac), whether every Mac receives them or only when asked, sizes, and secrets an agent asked for that the person has not entered yet. Values are never returned.", inputSchema: schema({}), handler: async () => text(await api("GET", "/api/v1/secrets")) },
   { name: "request_secret", description: "Get a link where the person enters a secret in their browser, so its value never passes through this chat: an API token, a .env value, a .p12 certificate or a config file. kind variable is one line of text, set as an environment variable on the Mac; kind file is stored at destination (under the home folder, like ~/.netrc; default ~/.nomac/secrets/<name>). Give the person the url. Then list_secrets shows it, new Macs receive it, and install_secrets puts it on a running Mac. With a shell on this machine, the person can also run nomac secrets set NAME themselves. Never ask for a secret in the chat.", inputSchema: schema({ name: { type: "string", minLength: 1, maxLength: 128 }, kind: { type: "string", enum: ["variable", "file"] }, description: { type: "string", minLength: 1, maxLength: 500, description: "What the person should enter and why; shown to them" }, destination: { type: "string", maxLength: 256 }, delivery: { type: "string", enum: ["every_mac", "on_request"] } }, ["name", "kind", "description"]), handler: async body => text(await api("POST", "/api/v1/secrets/requests", { body })) },
   { name: "set_up_signing", description: "Set up App Store signing for a project on the Mac, with the App Store Connect key kept on NoMac's server: reads the project at path (its scheme, app and every extension, with entitlements), registers missing bundle IDs, switches on the capabilities Apple's API can, makes the App Store profiles, and installs them with the account's certificate in a keychain on the Mac. The project never changes. Returns a build settings file (.xcconfig) and export options with the exact xcodebuild, Flutter and fastlane commands. Creates a distribution certificate at Apple only when the account has none. Expo and Capacitor apps need their ios folder first. A step only a person can take comes back as needs_human with its link.", inputSchema: schema({ session_id: session, path: { type: "string", minLength: 1, maxLength: 1024, description: "The project folder on the Mac, relative to the workspace" }, scheme: { type: "string", minLength: 1, maxLength: 256 }, container: { type: "string", minLength: 1, maxLength: 1024 }, issuer_id: { type: "string", maxLength: 64 } }, ["session_id"]), handler: async ({ session_id, ...body }) => text(await api("POST", `${base({ session_id })}/signing`, { body })) },
@@ -76,12 +78,22 @@ export const MAC_TOOLS = [
       : "This binary file is over 1 MiB. Pass save_to to download it to this machine, or max_bytes to read its first bytes as base64." });
     return text(file);
   } },
-  { name: "screenshot_mac", description: "See the Mac's screen: returns a screenshot as an image you can look at. target screen (default) is the whole macOS desktop at 1440x900, where image pixels are screen coordinates; target simulator is the booted iOS Simulator's display. Use it to check an app's UI, Xcode or system dialogs and error messages, or what the human sees in open_mac_desktop. Also returns front_app (the app in front) and path, the JPEG on the Mac. save_to writes the image to this machine instead of returning it.", inputSchema: schema({ session_id: session, target: { type: "string", enum: ["screen", "simulator"] }, save_to: { type: "string" } }, ["session_id"]), handler: async ({ session_id, target, save_to }) => {
+  { name: "screenshot_mac", description: "See the Mac's screen: returns a screenshot as an image you can look at. target screen (default) is the whole macOS desktop at 1440x900, where image pixels are screen coordinates; target simulator is the booted iOS Simulator's display. Use it to check an app's UI, Xcode or system dialogs and error messages, or what the human sees in open_mac_desktop. Also returns front_app (the app in front), screen_locked, dialog (an open macOS dialog with its text and buttons) with next_step, and path, the JPEG on the Mac. save_to writes the image to this machine instead of returning it.", inputSchema: schema({ session_id: session, target: { type: "string", enum: ["screen", "simulator"] }, save_to: { type: "string" } }, ["session_id"]), handler: async ({ session_id, target, save_to }) => {
     const shot = await screenshot(session_id, { target, saveTo: save_to });
     if (save_to) return text(shot);
     const { image_base64: data, ...meta } = shot;
     return { content: [{ type: "image", data, mimeType: meta.mime_type }, { type: "text", text: JSON.stringify(meta, null, 2) }] };
   } },
+  { name: "mac_input", description: "Send real keyboard and mouse input to the Mac, as a person at it would: macOS accepts it everywhere, including the lock screen, the login window and password dialogs, where scripted keystrokes cannot type. action type types text; key presses keys or combinations (return, tab, escape, cmd+q, ctrl+cmd+q); click, move and scroll take x and y in screen points from the top left, as in screenshot_mac's image; password types the Mac's login password into whatever has focus; unlock opens a locked screen (only when it is locked); size returns the screen size. Answers with a screenshot taken right after, unless screenshot is false. Not safe to repeat blindly: a retry types again.",
+    inputSchema: schema({ session_id: session, action: { type: "string", enum: ["type", "key", "click", "move", "scroll", "password", "unlock", "size"] }, text: { type: "string", minLength: 1, maxLength: 500, description: "For type: up to 500 characters; for longer text, pbcopy it with exec_mac, then key cmd+v" },
+      keys: { type: "array", items: { type: "string", minLength: 1, maxLength: 40 }, minItems: 1, maxItems: 20 }, x: { type: "integer", minimum: 0 }, y: { type: "integer", minimum: 0 },
+      steps: { type: "integer", minimum: -50, maximum: 50 }, button: { type: "string", enum: ["left", "right"] }, double: { type: "boolean" }, screenshot: { type: "boolean" } }, ["session_id", "action"]),
+    handler: async ({ session_id, ...body }) => {
+      const answer = await api("POST", `${base({ session_id })}/input`, { body });
+      if (typeof answer.screenshot?.image_base64 !== "string") return text(answer);
+      const { image_base64: data, ...meta } = answer.screenshot;
+      return { content: [{ type: "image", data, mimeType: meta.mime_type }, { type: "text", text: JSON.stringify({ ...answer, screenshot: meta }, null, 2) }] };
+    } },
   { name: "start_mac_recording", description: "Start recording a video of the Mac. target screen (default) records the whole desktop; target simulator records the iOS Simulator's window. Returns at once while it records: then do what should be shown (with exec_mac: launch the app, run UI tests, open a URL) and call stop_mac_recording, which saves the MP4 and can download it here. Stops by itself after max_seconds (default 300, max 1800). One recording at a time per session; a stopped Mac deletes it.", inputSchema: schema({ session_id: session, target: { type: "string", enum: ["screen", "simulator"] }, max_seconds: { type: "integer", minimum: 1, maximum: 1800 }, path: { type: "string", minLength: 1, maxLength: 1024 } }, ["session_id"]), handler: async ({ session_id, target, max_seconds, path }) => text(await startRecording(session_id, { target, maxSeconds: max_seconds, path })) },
   { name: "stop_mac_recording", description: "Stop the recording started with start_mac_recording and save it as an MP4. Returns its path, length in seconds and size, and a download link for the human (url). save_to downloads the video to this machine. If the recording already reached its max_seconds, returns that video. Safe to repeat.", inputSchema: schema({ session_id: session, save_to: { type: "string" } }, ["session_id"]), handler: async ({ session_id, save_to }) => text(await stopRecording(session_id, { saveTo: save_to })) },
   { name: "fetch_to_mac", description: "Download a URL straight onto the Mac: any size, as fast as the Mac's connection. path is the file to create, or with extract (zip or tar, including .tar.gz) the folder to unpack into. Relative paths are in the session workspace. Waits up to wait_seconds (default 30, max 50) like exec_mac; a longer download keeps running as a job. For a git repository, run git clone with exec_mac instead.", inputSchema: schema({ session_id: session, request_key: key, url: { type: "string", pattern: "^https?://", maxLength: 4096 }, path: { type: "string", minLength: 1, maxLength: 1024 }, extract: { type: "string", enum: ["zip", "tar"] }, wait_seconds: { type: "integer", minimum: 0, maximum: 50 } }, ["session_id", "request_key", "url", "path"]), handler: async ({ session_id, request_key, url, path, extract, wait_seconds }) => text(await api("POST", `${base({ session_id })}/jobs?wait=${wait_seconds ?? 30}`, { body: { argv: ["/bin/bash", "-c", FETCH_SCRIPT], env: { NOMAC_URL: url, NOMAC_PATH: path, NOMAC_EXTRACT: extract ?? "" }, timeout_seconds: 600 }, idempotencyKey: request_key })) },

package/src/mcp.mjs

@@ -24,6 +24,7 @@ const INSTRUCTIONS = [
   "Never rerun a command to get its output; after a lost response, repeat the call with the same request_key and arguments.",
   "Write files with write_mac_file, not heredocs in exec_mac: a command is at most 64 KiB.",
   "Shipping without the Apple key on the Mac: set_up_signing on the project returns the files and commands that sign a build with the agent's own tools; send_to_testflight sends the signed .ipa to TestFlight; publish submits it for App Review; notarize notarizes and staples a Developer ID-signed Mac app. Never ask for a secret in the chat: request_secret gives the human a link, and every Mac receives the account's secrets.",
+  "The Mac is fully enabled for you: sudo needs no password, macOS asks for no administrator password, the privacy prompts and password dialogs it still shows are answered on the Mac within seconds, the screen never locks, and the Mac's login password is in $NOMAC_MAC_PASSWORD on it (for the login keychain or any prompt). nomac-permit APP camera (run with exec_mac) grants an app privacy permissions before it asks. To type or click as a person would, also on the lock screen and in password dialogs, call mac_input: its answer has a screenshot. When screenshot_mac reports screen_locked or a dialog, follow its next_step.",
   "Always stop_mac when finished, after reading any output you need, so credit is not spent on an idle Mac.",
 ].join(" ");