Skip to content
norc

Environment variables reference

Concepts: Environment variables. Tasks: How-to.

Commands

Section titled “Commands”
norc env ls                       list variables: name, active/archived, bound jobs (never values)
echo "$V" | norc env set NAME     create or update; value from stdin or hidden prompt
norc env archive NAME [--yes]     stop delivering; prints the jobs it would break
norc env restore NAME             resume delivery
norc env rm NAME [--yes]          delete permanently
norc jobs add <schedule> <cmd> --env NAME [--env NAME2]
norc login --email <email>        start the user session `norc env` needs
norc logout                       remove the session and the pairing
  • set refuses a value on the command line, and refuses an archived name (restore it first).
  • archive and rm print the impact list when jobs would break. Without --yes, an interactive terminal asks archive NAME? [y/N] or the name typed back. A non-interactive rm always needs --yes; a non-interactive archive needs it only when jobs would break.
  • rm needs a fresh sign-in: it prompts (hidden) for your 2FA code or an emailed code, once. Without a terminal it points you to the web vault or norc env archive.
  • jobs add: --env flags go after the command.
  • There is no command to read a value.

Run errors

Section titled “Run errors”

When a bound variable cannot be supplied, norc run does not start the command. It exits non-zero and reports the run as failed.

Message Meaning Do
env NAME is archived The variable is archived. Restore it, or unbind it from the job.
env NAME not found No such variable (deleted or mistyped). Recreate it with the same name, or fix the binding.
env NAME is unavailable (norc could not sync) The machine could not refresh and its cache lacks the variable. Check connectivity and that the machine is still paired, then rerun.

Archiving or deleting a variable that an active job uses raises an alert on the Alerts view (all plans). A name that never existed (for example a typo in --env) fails the run but raises no alert.

Known limits

Section titled “Known limits”
  • Offline runs use the local cache, so an archive or rotation takes effect at that machine’s next sync.
  • Re-projection delay: a binding made elsewhere reaches the job’s managed line after about 5 seconds while the desktop app runs, up to 5 minutes under norc bridge, and never on a CLI host with no bridge. A run in that window whose refresh fails runs without the new variable.
  • Older lines: jobs written before this feature carry no names until they are rewritten, and keep the earlier behavior.
  • Older binaries: a norc binary from before --env ignores the names. The binary that wrote a line must be the one that runs it.
  • Hand-edited lines: the names on a desktop line you edited by hand are not updated until you resolve the drift.
  • First sync: a machine needs one successful sync before it can receive values.
  • norc service keeps its old device token until restarted after norc logout or a re-pair.
  • Delete needs a fresh sign-in on every client.
  • Not end-to-end encrypted: values are encrypted on the server with your account key.