diff --git a/docs/NOW-spec.md b/docs/NOW-spec.md
index 9353b10ab..e45044052 100644
--- a/docs/NOW-spec.md
+++ b/docs/NOW-spec.md
@@ -2,7 +2,7 @@
 This file was created using Markdown Monster (https://markdownmonster.west-wind.com), which offers
 extended formatting capabilities for markdown files, such as TOC and embedded HTML.
 -->
-# NOW-PROTO
+# NOW-PROTO 1.0
 
 <style>
     .byte-layout {
@@ -22,7 +22,6 @@ extended formatting capabilities for markdown files, such as TOC and embedded HT
 
 [[_TOC_]]
 
-
 # Messages
 
 ## Transport
@@ -39,82 +38,6 @@ The following sections specify the NOW protocol message syntax. Unless otherwise
 
 Signed and unsigned integer encoding structures of various sizes.
 
-##### NOW_VARU16
-
-The NOW_VARU16 structure is used to encode unsigned integer values in the range [0, 0x7FFF].
-
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="1">c</td>
-            <td colspan="7">val1</td>
-            <td colspan="8">val2 (optional)</td>
-            <td colspan="16"></td>
-        </tr>
-    </tbody>
-</table>
-
-**c (1 bit)**: A 1-bit integer containing an encoded representation of the number of bytes in this structure.
-
-| Value | Meaning |
-|-------|---------|
-| 0 | The val1 field is present (1 byte) |
-| 1 | The val1, val2 fields are present (2 bytes) |
-
-**val1 (7 bits)**: A 7-bit integer containing the 7 most significant bits of the integer value represented by this structure.
-
-**val2 (1 byte)**: A 8-bit integer containing the least significant bits of the integer value represented by this structure.
-
-##### NOW_VARI16
-
-The NOW_VARI16 structure is used to encode signed integer values in the range [-0x3FFF, 0x3FFF].
-
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="1">c</td>
-            <td colspan="1">s</td>
-            <td colspan="6">val1</td>
-            <td colspan="8">val2 (optional)</td>
-            <td colspan="16"></td>
-        </tr>
-    </tbody>
-</table>
-
-**c (1 bit)**: A 1-bit integer containing an encoded representation of the number of bytes in this structure.
-
-| Value | Meaning |
-|-------|---------|
-| 0 | The val1 field is present (1 byte) |
-| 1 | The val1, val2 fields are present (2 bytes) |
-
-**s (1 bit)**: A 1-bit integer containing the encoded sign representation of the integer value.
-
-| Value | Meaning |
-|-------|---------|
-| 0 | Positive value |
-| 1 | Negative value |
-
-**val1 (6 bits)**: A 6-bit integer containing the 6 most significant bits of the integer value represented by this structure.
-
-**val2 (1 byte)**: A 8-bit integer containing the least significant bits of the integer value represented by this structure.
-
 ##### NOW_VARU32
 
 The NOW_VARU32 structure is used to encode signed integer values in the range [0, 0x3FFFFFFF].
@@ -143,10 +66,10 @@ The NOW_VARU32 structure is used to encode signed integer values in the range [0
 
 | Value | Meaning |
 |-------|---------|
-| 0 | The val1 field is present (1 byte) |
-| 1 | The val1, val2 fields are present (2 bytes) |
-| 2 | The val1, val2, val3 fields are present (3 bytes) |
-| 3 | The val1, val2, val3, val4 fields are present (4 bytes) |
+| 0 | The val1 field is present (1 byte). |
+| 1 | The val1, val2 fields are present (2 bytes). |
+| 2 | The val1, val2, val3 fields are present (3 bytes). |
+| 3 | The val1, val2, val3, val4 fields are present (4 bytes). |
 
 **val1 (6 bits)**: A 6-bit integer containing the 6 most significant bits of the integer value represented by this structure.
 
@@ -156,9 +79,11 @@ The NOW_VARU32 structure is used to encode signed integer values in the range [0
 
 **val4 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure.
 
-##### NOW_VARI32
+#### NOW_STRING
 
-The NOW_VARI32 structure is used to encode signed integer values in the range [-0x1FFFFFFF, 0x1FFFFFFF].
+##### NOW_VARSTR
+
+The NOW_VARSTR structure is used to represent variable-length strings that could be large, while remaining compact in size for small strings.
 
 <table class="byte-layout">
     <thead>
@@ -171,43 +96,21 @@ The NOW_VARI32 structure is used to encode signed integer values in the range [-
     </thead>
     <tbody>
         <tr>
-            <td colspan="2">c</td>
-            <td colspan="1">s</td>
-            <td colspan="5">val1</td>
-            <td colspan="8">val2 (optional)</td>
-            <td colspan="8">val3 (optional)</td>
-            <td colspan="8">val4 (optional)</td>
+            <td colspan="32">len (variable)</td>
+        </tr>
+        <tr>
+            <td colspan="32">str (variable)</td>
         </tr>
     </tbody>
 </table>
 
-**c (2 bits)**: A 2-bit integer containing an encoded representation of the number of bytes in this structure.
-
-| Value | Meaning |
-|-------|---------|
-| 0 | The val1 field is present (1 byte) |
-| 1 | The val1, val2 fields are present (2 bytes) |
-| 2 | The val1, val2, val3 fields are present (3 bytes) |
-| 3 | The val1, val2, val3, val4 fields are present (4 bytes) |
-
-**s (1 bit)**: A 1-bit integer containing the encoded sign representation of the integer value.
-
-| Value | Meaning |
-|-------|---------|
-| 0 | Positive value |
-| 1 | Negative value |
-
-**val1 (5 bits)**: A 5-bit integer containing the 6 most significant bits of the integer value represented by this structure.
-
-**val2 (1 byte)**: An 8-bit integer containing the second most significant bits of the integer value represented by this structure.
-
-**val3 (1 byte)**: An 8-bit integer containing the third most significant bits of the integer value represented by this structure.
+**len (variable)**: A NOW_VARU32 structure containing the string length, excluding the null terminator.
 
-**val4 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure.
+**str (variable)**: The UTF-8 encoded string excluding the null terminator.
 
-##### NOW_VARU64
+#### NOW_HEADER
 
-The NOW_VARU64 structure is used to encode signed integer values in the range [0, 0x3FFFFFFF].
+The NOW_HEADER structure is the header common to all NOW protocol messages.
 
 <table class="byte-layout">
     <thead>
@@ -220,53 +123,33 @@ The NOW_VARU64 structure is used to encode signed integer values in the range [0
     </thead>
     <tbody>
         <tr>
-            <td colspan="3">c</td>
-            <td colspan="5">val1</td>
-            <td colspan="8">val2 (optional)</td>
-            <td colspan="8">val3 (optional)</td>
-            <td colspan="8">val4 (optional)</td>
+            <td colspan="32">msgSize</td>
         </tr>
         <tr>
-            <td colspan="8">val5 (optional)</td>
-            <td colspan="8">val6 (optional)</td>
-            <td colspan="8">val7 (optional)</td>
-            <td colspan="8">val8 (optional)</td>
+            <td colspan="8">msgClass</td>
+            <td colspan="8">msgType</td>
+            <td colspan="16">msgFlags</td>
         </tr>
     </tbody>
 </table>
 
-**c (3 bits)**: A 3-bit integer containing an encoded representation of the number of bytes in this structure.
-
-| Value | Meaning |
-|-------|---------|
-| 0 | The val1 field is present (1 byte) |
-| 1 | The val1, val2 fields are present (2 bytes) |
-| 2 | The val1, val2, val3 fields are present (3 bytes) |
-| 3 | The val1, val2, val3, val4 fields are present (4 bytes) |
-| 4 | The val1, val2, val3, val4, val5 fields are present (5 bytes) |
-| 5 | The val1, val2, val3, val4, val5, val6 fields are present (6 bytes) |
-| 6 | The val1, val2, val3, val4, val5, val6, val7 fields are present (7 bytes) |
-| 7 | The val1, val2, val3, val4, val5, val6, val7, val8 fields are present (8 bytes) |
-
-**val1 (5 bits)**: A 5-bit integer containing the 6 most significant bits of the integer value represented by this structure.
-
-**val2 (1 byte)**: An 8-bit integer containing the second most significant bits of the integer value represented by this structure.
-
-**val3 (1 byte)**: An 8-bit integer containing the third most significant bits of the integer value represented by this structure.
-
-**val4 (1 byte)**: An 8-bit integer containing the fourth significant bits of the integer value represented by this structure.
-
-**val5 (1 byte)**: An 8-bit integer containing the fifth significant bits of the integer value represented by this structure.
+**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes).
 
-**val6 (1 byte)**: An 8-bit integer containing the sixth significant bits of the integer value represented by this structure.
+**msgClass (1 byte)**: The message class.
 
-**val7 (1 byte)**: An 8-bit integer containing the seventh significant bits of the integer value represented by this structure.
+| Flag                            | Meaning              |
+|---------------------------------|----------------------|
+| NOW_CHANNEL_MSG_CLASS_ID<br>0x10 | Channel message class. |
+| NOW_SYSTEM_MSG_CLASS_ID<br>0x11 | System message class. |
+| NOW_SESSION_MSG_CLASS_ID<br>0x12 | Session message class. |
+| NOW_EXEC_MSG_CLASS_ID<br>0x13 | Exec message class. |
 
-**val8 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure.
+**msgType (1 byte)**: The message type, specific to the message class.
 
-##### NOW_VARI64
+**msgFlags (2 bytes)**: The message flags, specific to the message type and class.
 
-The NOW_VARI64 structure is used to encode signed integer values in the range [-0x1FFFFFFF, 0x1FFFFFFF].
+#### NOW_STATUS
+Operation status code.
 
 <table class="byte-layout">
     <thead>
@@ -279,84 +162,69 @@ The NOW_VARI64 structure is used to encode signed integer values in the range [-
     </thead>
     <tbody>
         <tr>
-            <td colspan="3">c</td>
-            <td colspan="1">s</td>
-            <td colspan="4">val1</td>
-            <td colspan="8">val2 (optional)</td>
-            <td colspan="8">val3 (optional)</td>
-            <td colspan="8">val4 (optional)</td>
+            <td colspan="16">flags</td>
+            <td colspan="8">kind</td>
+            <td colspan="8">reserved</td>
+        </tr>
+        <tr>
+            <td colspan="32">code</td>
+        </tr>
+        <tr>
+            <td colspan="32">errorMessage(variable)</td>
         </tr>
     </tbody>
 </table>
 
-**c (3 bits)**: A 3-bit integer containing an encoded representation of the number of bytes in this structure.
+**flags (2 bytes)**: Status flags.
 
 | Value | Meaning |
 |-------|---------|
-| 0 | The val1 field is present (1 byte) |
-| 1 | The val1, val2 fields are present (2 bytes) |
-| 2 | The val1, val2, val3 fields are present (3 bytes) |
-| 3 | The val1, val2, val3, val4 fields are present (4 bytes) |
-| 4 | The val1, val2, val3, val4, val5 fields are present (5 bytes) |
-| 5 | The val1, val2, val3, val4, val5, val6 fields are present (6 bytes) |
-| 6 | The val1, val2, val3, val4, val5, val6, val7 fields are present (7 bytes) |
-| 7 | The val1, val2, val3, val4, val5, val6, val7, val8 fields are present (8 bytes) |
+| NOW_NOW_STATUS_ERROR<br>0x0001 | This flag set for all error statuses. If flag is not set, operation was successful. |
+| NOW_NOW_STATUS_ERROR_MESSAGE<br>0x0002 | `errorMessage` contains optional error message. |
 
-**s (1 bit)**: A 1-bit integer containing the encoded sign representation of the integer value.
+**kind (1 byte)**: The status kind.
+When `NOW_STATUS_ERROR` is set, this field represents error kind.
 
 | Value | Meaning |
 |-------|---------|
-| 0 | Positive value |
-| 1 | Negative value |
-
-**val1 (4 bits)**: A 4-bit integer containing the 6 most significant bits of the integer value represented by this structure.
-
-**val2 (1 byte)**: An 8-bit integer containing the second most significant bits of the integer value represented by this structure.
-
-**val3 (1 byte)**: An 8-bit integer containing the third most significant bits of the integer value represented by this structure.
+| NOW_STATUS_ERROR_KIND_GENERIC<br>0x0000 | `code` value is undefined and could be ignored. |
+| NOW_STATUS_ERROR_KIND_NOW<br>0x0001 | `code` contains NowProto-defined error code. |
+| NOW_STATUS_ERROR_KIND_WINAPI<br>0x0002 | `code` field contains Windows error code. |
+| NOW_STATUS_ERROR_KIND_UNIX<br>0x0003 | `code` field contains Unix error code. |
 
-**val4 (1 byte)**: An 8-bit integer containing the fourth significant bits of the integer value represented by this structure.
+For successful operation this field value is operation specific.
 
-**val5 (1 byte)**: An 8-bit integer containing the fifth significant bits of the integer value represented by this structure.
+**reserved (1 byte)**: Reserved value. Should be set to 0 and ignored during parsing.
 
-**val6 (1 byte)**: An 8-bit integer containing the sixth significant bits of the integer value represented by this structure.
+**code (4 bytes)**: The status code.
 
-**val7 (1 byte)**: An 8-bit integer containing the seventh significant bits of the integer value represented by this structure.
+- If `NOW_STATUS_ERROR` flag is NOT set, this value should contain `0` value
+- If `NOW_STATUS_ERROR` is set, this value represents error code according to
+  `NOW_STATUS_ERROR_KIND_*` value. If no error kind flags set, value of this
+  field is undefined and should be ignored.
 
-**val8 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure.
+    - `NOW_STATUS_ERROR_KIND_NOW` codes:
 
-#### NOW_STRING
-
-##### NOW_VARSTR
-
-The NOW_VARSTR structure is used to represent variable-length strings that could be large, while remaining compact in size for small strings.
-
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="32">len (variable)</td>
-        </tr>
-        <tr>
-            <td colspan="32">str (variable)</td>
-        </tr>
-    </tbody>
-</table>
+        | Value | Meaning |
+        |-------|---------|
+        | NOW_CODE_IN_USE<br>0x0001 | Resource (e.g. exec session id is already in use). |
+        | NOW_CODE_INVALID_REQUEST<br>0x0002 | Sent request is invalid (e.g. invalid exec request params). |
+        | NOW_CODE_ABORTED<br>0x0003 | Operation has been aborted on the server side. |
+        | NOW_CODE_NOT_FOUND<br>0x0004 | Resource not found. |
+        | NOW_CODE_ACCESS_DENIED<br>0x0005 | Resource can't be accessed. |
+        | NOW_CODE_INTERNAL<br>0x0006 | Internal error. |
+        | NOW_CODE_NOT_IMPLEMENTED<br>0x0007 | Operation is not implemented on current platform. |
 
-**len (variable)**: A NOW_VARU32 structure containing the string length, excluding the null terminator.
+    - `NOW_STATUS_ERROR_KIND_WINAPI`: code contains standard WinAPI error.
+    - `NOW_STATUS_ERROR_KIND_UNIX`: code contains standard UNIX error code.
 
-**str (variable)**: The UTF-8 encoded string excluding the null terminator.
+**errorMessage(variable, optional)**: this value contains either optional error message if
+`NOW_STATUS_ERROR_MESSAGE` flag is set, or empty sting if the flag is not set.
 
-##### NOW_LRGSTR
+### Channel Messages
+Channel negotiation and life cycle messages.
 
-The NOW_LRGSTR structure is used to represent large variable-length strings.
+#### NOW_CHANNEL_MSG
 
 <table class="byte-layout">
     <thead>
@@ -369,49 +237,33 @@ The NOW_LRGSTR structure is used to represent large variable-length strings.
     </thead>
     <tbody>
         <tr>
-            <td colspan="32">len</td>
+            <td colspan="32">msgSize</td>
         </tr>
         <tr>
-            <td colspan="32">str (variable)</td>
+            <td colspan="8">msgClass</td>
+            <td colspan="8">msgType</td>
+            <td colspan="16">msgFlags</td>
         </tr>
     </tbody>
 </table>
 
-**len (4 bytes)**: A 32-bit unsigned integer containing the string length, excluding the null terminator.
-
-**str (variable)**: The UTF-8 encoded string excluding the null terminator.
-
-##### NOW_STRING16
+**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes).
 
-The NOW_STRING16 structure is used to represent variable-length strings of up to 15 characters that can easily fit within a fixed-size buffer of 16 bytes.
+**msgClass (1 byte)**: The message class (NOW_NEGOTIATION_MSG_CLASS_ID).
 
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="8">len</td>
-            <td colspan="24">str (variable)</td>
-        </tr>
-        <tr>
-            <td colspan="32">...</td>
-        </tr>
-    </tbody>
-</table>
+**msgType (1 byte)**: The message type.
 
-**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 15.
+| Value                           | Meaning              |
+|---------------------------------|----------------------|
+| NOW_CHANNEL_CAPSET_MSG_ID<br>0x01 | NOW_CHANNEL_CAPSET_MSG |
+| NOW_CHANNEL_HEARTBEAT_MSG_ID<br>0x02 | NOW_CHANNEL_HEARTBEAT_MSG |
 
-**str (variable)**: The UTF-8 encoded string excluding the null terminator.
+#### NOW_CHANNEL_CAPSET_MSG
 
-##### NOW_STRING32
+This message is first set by the client side, to advertise capabilities.
 
-The NOW_STRING32 structure is used to represent variable-length strings of up to 15 characters that can easily fit within a fixed-size buffer of 32 bytes.
+Received client message should be downgraded by the server (remove non-intersecting capabilities) and sent back to the client at the start of DVC channel communications. DVC channel should be closed if protocol
+versions are not compatible.
 
 <table class="byte-layout">
     <thead>
@@ -424,162 +276,85 @@ The NOW_STRING32 structure is used to represent variable-length strings of up to
     </thead>
     <tbody>
         <tr>
-            <td colspan="8">len</td>
-            <td colspan="24">str (variable)</td>
+            <td colspan="32">msgSize</td>
         </tr>
         <tr>
-            <td colspan="32">...</td>
-        </tr>
-    </tbody>
-</table>
-
-**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 31.
-
-**str (variable)**: The UTF-8 encoded string excluding the null terminator.
-
-##### NOW_STRING64
-
-The NOW_STRING64 structure is used to represent variable-length strings of up to 63 characters that can easily fit within a fixed-size buffer of 64 bytes.
-
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
+            <td colspan="8">msgClass</td>
+            <td colspan="8">msgType</td>
+            <td colspan="16">msgFlags</td>
         </tr>
-    </thead>
-    <tbody>
         <tr>
-            <td colspan="8">len</td>
-            <td colspan="24">str (variable)</td>
+            <td colspan="16">versionMajor</td>
+            <td colspan="16">versionMinor</td>
         </tr>
         <tr>
-            <td colspan="32">...</td>
+            <td colspan="32">systemCapset</td>
         </tr>
-    </tbody>
-</table>
-
-**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 63.
-
-**str (variable)**: The UTF-8 encoded string excluding the null terminator.
-
-##### NOW_STRING128
-
-The NOW_STRING128 structure is used to represent variable-length strings of up to 127 characters that can easily fit within a fixed-size buffer of 128 bytes.
-
-<table class="byte-layout">
-    <thead>
         <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
+            <td colspan="32">sessionCapset</td>
         </tr>
-    </thead>
-    <tbody>
         <tr>
-            <td colspan="8">len</td>
-            <td colspan="24">str (variable)</td>
+            <td colspan="32">execCapset</td>
         </tr>
         <tr>
-            <td colspan="32">...</td>
+            <td colspan="32">heartbeatInterval</td>
         </tr>
     </tbody>
 </table>
 
-**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 127.
+**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes).
 
-**str (variable)**: The UTF-8 encoded string excluding the null terminator.
+**msgClass (1 byte)**: The message class (NOW_CHANNEL_MSG_CLASS_ID).
 
-##### NOW_STRING256
+**msgType (1 byte)**: The message type (NOW_CHANNEL_CAPSET_MSG_ID).
 
-The NOW_STRING256 structure is used to represent variable-length strings of up to 255 characters that can easily fit within a fixed-size buffer of 256 bytes.
+**msgFlags (2 bytes)**: Message flags.
 
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="8">len</td>
-            <td colspan="24">str (variable)</td>
-        </tr>
-        <tr>
-            <td colspan="32">...</td>
-        </tr>
-    </tbody>
-</table>
-
-**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 255.
-
-**str (variable)**: The UTF-8 encoded string excluding the null terminator.
+| Flag | Meaning |
+|-------|---------|
+| NOW_CHANNEL_SET_HEATBEAT<br>0x0001 | Set if `heartbeat` specify channel heartbeat interval. |
 
-#### NOW_BUFFER
+**versionMajor (1 byte)**: Major protocol version. Breaking changes in protocol should
+increment major version; Protocol implementations with different major version are not compatible.
 
-##### NOW_VARBUF
+**versionMinor (1 byte)**: Minor protocol version. Incremented when new non-breaking feature is added.
 
-The NOW_VARBUF structure is used to represent variable-length buffers.
+**systemCapset (4 bytes)**: System commands capabilities set.
 
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="32">size (variable)</td>
-        </tr>
-        <tr>
-            <td colspan="32">data (variable)</td>
-        </tr>
-    </tbody>
-</table>
+| Flag | Meaning |
+|-------|---------|
+| NOW_CAP_SYSTEM_SHUTDOWN<br>0x0001 | System shutdown command support. |
 
-**size (variable)**: A NOW_VARU32 structure containing the buffer size.
+**sessionCapset (4 bytes)**: Session commands capabilities set.
 
-**data (variable)**: The buffer data, whose size is given by the size field.
+| Flag | Meaning |
+|-------|---------|
+| NOW_CAP_SESSION_LOCK<br>0x00000001 | Lock command support. |
+| NOW_CAP_SESSION_LOGOFF<br>0x00000002 | Logoff command support. |
+| NOW_CAP_SESSION_MSGBOX<br>0x00000004 | Message box command support. |
 
-##### NOW_LRGBUF
+**execCapset (4 bytes)**: Remote execution capabilities set.
 
-The NOW_LRGBUF structure is used to represent variable-length buffers.
+| Flag | Meaning |
+|-------|---------|
+| NOW_CAP_EXEC_STYLE_RUN<br>0x00000001 | Generic "Run" execution style. |
+| NOW_CAP_EXEC_STYLE_PROCESS<br>0x00000002 | CreateProcess() execution style. |
+| NOW_CAP_EXEC_STYLE_SHELL<br>0x00000004 | System shell (.sh) execution style. |
+| NOW_CAP_EXEC_STYLE_BATCH<br>0x00000008 | Windows batch file (.bat) execution style. |
+| NOW_CAP_EXEC_STYLE_WINPS<br>0x00000010 | Windows PowerShell (.ps1) execution style. |
+| NOW_CAP_EXEC_STYLE_PWSH<br>0x00000020 | PowerShell 7 (.ps1) execution style. |
 
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="32">size</td>
-        </tr>
-        <tr>
-            <td colspan="32">data (variable)</td>
-        </tr>
-    </tbody>
-</table>
+<!-- TODO: add AppleScript command -->
 
-**size (4 bytes)**: A 32-bit unsigned integer containing the buffer size.
+**heartbeatInterval (4 bytes, optional)**: A 32-bit unsigned integer, which represents
+periodic heartbeat interval *hint* for a server (60 seconds by default).
+Disables periodic heartbeat if set to `0`. Ignored if `NOW_CHANNEL_SET_HEATBEAT` is not set.
 
-**data (variable)**: The buffer data, whose size is given by the size field.
 
-#### NOW_HEADER
+#### NOW_CHANNEL_HEARTBEAT_MSG
 
-The NOW_HEADER structure is the header common to all NOW protocol messages.
+Periodic heartbeat message sent by the server. If the client does not receive this message within
+the specified interval, it should consider the connection as lost.
 
 <table class="byte-layout">
     <thead>
@@ -604,68 +379,11 @@ The NOW_HEADER structure is the header common to all NOW protocol messages.
 
 **msgSize (4 bytes)**: The message size, excluding the header size (8 bytes).
 
-**msgClass (1 byte)**: The message class.
+**msgClass (1 byte)**: The message class (NOW_CHANNEL_MSG_CLASS_ID).
 
-| Flag                            | Meaning              |
-|---------------------------------|----------------------|
-| NOW_SYSTEM_MSG_CLASS_ID<br>0x11 | System message class |
-| NOW_SESSION_MSG_CLASS_ID<br>0x12 | Session message class |
-| NOW_EXEC_MSG_CLASS_ID<br>0x13 | Exec message class |
-
-**msgType (1 byte)**: The message type, specific to the message class.
-
-**msgFlags (2 bytes)**: The message flags, specific to the message type and class.
-
-#### NOW_STATUS
-A status code, with a structure similar to HRESULT.
+**msgType (1 byte)**: The message type (NOW_CHANNEL_HEARTBEAT_MSG_ID).
 
-<table class="byte-layout">
-    <thead>
-        <tr>
-            <th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th>
-            <th>8</th><th>9</th><th>10</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th>
-            <th>6</th><th>7</th><th>8</th><th>9</th><th>20</th><th>1</th><th>2</th><th>3</th>
-            <th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>30</th><th>1</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td colspan="2">S</td>
-            <td colspan="1">Y</td>
-            <td colspan="1">Z</td>
-            <td colspan="4">class</td>
-            <td colspan="8">type</td>
-            <td colspan="16">code</td>
-        </tr>
-    </tbody>
-</table>
-
-**S (2 bits)**: Severity level.
-
-| Value | Meaning |
-|-------|---------|
-| NOW_SEVERITY_INFO<br>0 | Informative status |
-| NOW_SEVERITY_WARN<br>1 | Warning status |
-| NOW_SEVERITY_ERROR<br>2 | Error status (recoverable) |
-| NOW_SEVERITY_FATAL<br>3 | Error status (non-recoverable) |
-
-**Y (1 bit)**: Reserved. MUST be set to zero.
-
-**Z (1 bit)**: Reserved. MUST be set to zero.
-
-**class (4 bits)**: Reserved. MUST be set to zero.
-
-**type (8 bits)**: The status type.
-
-**code (16 bits)**: The status code.
-
-| Value | Meaning |
-|-------|---------|
-| NOW_CODE_SUCCESS<br>0x0000 | Success |
-| NOW_CODE_FAILURE<br>0xFFFF | Failure |
-| NOW_CODE_FILE_NOT_FOUND<br>0x0002 | File not found. |
-| NOW_CODE_ACCESS_DENIED<br>0x0005 | File not found. |
-| NOW_CODE_BAD_FORMAT<br>0x000B | The program has an incorrect or bad format. |
+**msgFlags (2 bytes)**: The message flags.
 
 ### System Messages
 
@@ -732,7 +450,7 @@ The NOW_SYSTEM_SHUTDOWN_MSG structure is used to request a system shutdown.NOW_S
             <td colspan="32">timeout</td>
         </tr>
         <tr>
-            <td colspan="32">message</td>
+            <td colspan="32">message (variable)</td>
         </tr>
     </tbody>
 </table>
@@ -891,11 +609,11 @@ The NOW_SESSION_MSGBOX_REQ_MSG is used to show a message box in the user session
         <tr>
             <td colspan="32">timeout</td>
         </tr>
-        <tr>
-            <td colspan="32">title (variable)</td>
-        </tr>
         <tr>
             <td colspan="32">text (variable)</td>
+        </tr>
+                <tr>
+            <td colspan="32">title (variable)</td>
         </tr>
     </tbody>
 </table>
@@ -910,21 +628,23 @@ The NOW_SESSION_MSGBOX_REQ_MSG is used to show a message box in the user session
 
 | Flag                                | Meaning                                 |
 |-------------------------------------|-----------------------------------------|
-| NOW_MSGBOX_FLAG_TITLE<br>0x00000001 | The title field contains a non-default value |
-| NOW_MSGBOX_FLAG_STYLE<br>0x00000002 | The style field contains a non-default value |
-| NOW_MSGBOX_FLAG_TIMEOUT<br>0x00000004 | The timeout field contains a non-default value |
-| NOW_MSGBOX_FLAG_RESPONSE<br>0x00000008 | A response message is expected (don't fire and forget) |
+| NOW_MSGBOX_FLAG_TITLE<br>0x00000001 | The `title` field is contains a non-default value. |
+| NOW_MSGBOX_FLAG_STYLE<br>0x00000002 | The `style` field contains a non-default value. |
+| NOW_MSGBOX_FLAG_TIMEOUT<br>0x00000004 | The `timeout` field contains a non-default value. |
+| NOW_MSGBOX_FLAG_RESPONSE<br>0x00000008 | A response message is expected (don't fire and forget). |
 
 **requestId (4 bytes)**: the message request id, sent back in the response.
 
-**style (4 bytes)**: The message box style, ignored if NOW_MSGBOX_FLAG_STYLE is not set. MBOK is the default, refer to the [MessageBox function](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-messagebox) for all possible styles. This field may be ignored on platforms other than Windows.
+**style (4 bytes)**: The message box style, ignored if NOW_MSGBOX_FLAG_STYLE is not set. MBOK is the default, refer to the
+[MessageBox function](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-messagebox)
+for all possible styles. This field may be ignored on platforms other than Windows.
 
-**timeout (4 bytes)**: The timeout, in seconds, that the message box dialog should wait for the user response. This value is NOW_MSGBOX_FLAG_TIMEOUT is not set.
-
-**title (variable)**: The message box title, ignored if NOW_MSGBOX_FLAG_TITLE is not set.
+**timeout (4 bytes)**: The timeout, in seconds, that the message box dialog should wait for the user response. This value is ignored if NOW_MSGBOX_FLAG_TIMEOUT is not set.
 
 **text (variable)**: The message box text.
 
+**title (variable)**: The message box title. Ignored if NOW_MSGBOX_FLAG_TITLE is not set.
+
 #### NOW_SESSION_MSGBOX_RSP_MSG
 
 The NOW_SESSION_MSGBOX_RSP_MSG is a message sent in response to NOW_SESSION_MSGBOX_REQ_MSG if the NOW_MSGBOX_FLAG_RESPONSE has been set, and contains the result from the message box dialog.
@@ -953,6 +673,9 @@ The NOW_SESSION_MSGBOX_RSP_MSG is a message sent in response to NOW_SESSION_MSGB
         <tr>
             <td colspan="32">response</td>
         </tr>
+        <tr>
+            <td colspan="32">status (variable)</td>
+        </tr>
     </tbody>
 </table>
 
@@ -964,22 +687,26 @@ The NOW_SESSION_MSGBOX_RSP_MSG is a message sent in response to NOW_SESSION_MSGB
 
 **msgFlags (2 bytes)**: The message flags.
 
-**requestId (4 bytes)**: The corresponding message box request id.
+**requestId (4 bytes)**: Message box request id.
 
-**response (4 bytes)**: The message box response.
+**response (4 bytes)**: Message response code. If **status** is successful, response value is defined as following:
 
 | Value        | Meaning |
 |--------------|---------|
-| IDABORT<br>3 | Abort   |
-| IDCANCEL<br>2 | Cancel   |
-| IDCONTINUE<br>11 | Continue   |
-| IDIGNORE<br>5 | Ignore   |
-| IDNO<br>7 | No   |
-| IDOK<br>1 | OK   |
-| IDRETRY<br>4 | Retry   |
-| IDTRYAGAIN<br>10 | Try Again   |
-| IDYES<br>6 | Yes   |
-| IDTIMEOUT<br>32000 | Timeout   |
+| NOW_MSGBOX_RSP_ABORT<br>3 | Abort   |
+| NOW_MSGBOX_RSP_CANCEL<br>2 | Cancel   |
+| NOW_MSGBOX_RSP_CONTINUE<br>11 | Continue   |
+| NOW_MSGBOX_RSP_IGNORE<br>5 | Ignore   |
+| NOW_MSGBOX_RSP_NO<br>7 | No   |
+| NOW_MSGBOX_RSP_OK<br>1 | OK   |
+| NOW_MSGBOX_RSP_RETRY<br>4 | Retry   |
+| NOW_MSGBOX_RSP_TRYAGAIN<br>10 | Try Again   |
+| NOW_MSGBOX_RSP_YES<br>6 | Yes   |
+| NOW_MSGBOX_RSP_TIMEOUT<br>32000 | Timeout   |
+
+If `status` specifies error, this field should be set to `0`.
+
+**status (variable)**: `NOW_STATUS` structure containing message box response status.
 
 ### Execution Messages
 
@@ -1022,19 +749,19 @@ The NOW_EXEC_MSG message is used to execute remote commands or scripts.
 | NOW_EXEC_CANCEL_RSP_MSG_ID<br>0x03 | NOW_EXEC_CANCEL_RSP_MSG |
 | NOW_EXEC_RESULT_MSG_ID<br>0x04 | NOW_EXEC_RESULT_MSG |
 | NOW_EXEC_DATA_MSG_ID<br>0x05 | NOW_EXEC_DATA_MSG |
+| NOW_EXEC_STARTED_MSG_ID<br>0x06 | NOW_EXEC_STARTED_MSG |
 | NOW_EXEC_RUN_MSG_ID<br>0x10 | NOW_EXEC_RUN_MSG |
-| NOW_EXEC_CMD_MSG_ID<br>0x11 | NOW_EXEC_CMD_MSG |
-| NOW_EXEC_PROCESS_MSG_ID<br>0x12 | NOW_EXEC_PROCESS_MSG |
-| NOW_EXEC_SHELL_MSG_ID<br>0x13 | NOW_EXEC_SHELL_MSG |
-| NOW_EXEC_BATCH_MSG_ID<br>0x14 | NOW_EXEC_BATCH_MSG |
-| NOW_EXEC_WINPS_MSG_ID<br>0x15 | NOW_EXEC_WINPS_MSG |
-| NOW_EXEC_PWSH_MSG_ID<br>0x16 | NOW_EXEC_PWSH_MSG |
+| NOW_EXEC_PROCESS_MSG_ID<br>0x11 | NOW_EXEC_PROCESS_MSG |
+| NOW_EXEC_SHELL_MSG_ID<br>0x12 | NOW_EXEC_SHELL_MSG |
+| NOW_EXEC_BATCH_MSG_ID<br>0x13 | NOW_EXEC_BATCH_MSG |
+| NOW_EXEC_WINPS_MSG_ID<br>0x14 | NOW_EXEC_WINPS_MSG |
+| NOW_EXEC_PWSH_MSG_ID<br>0x15 | NOW_EXEC_PWSH_MSG |
 
 **msgFlags (2 bytes)**: The message flags.
 
-#### NOW_EXEC_CAPSET_MSG
+#### NOW_EXEC_ABORT_MSG
 
-The NOW_EXEC_CAPSET_MSG message is sent to advertise capabilities.
+The NOW_EXEC_ABORT_MSG message is used to abort a remote execution immediately due to an unrecoverable error. This message can be sent at any time without an explicit response message. The session is considered aborted as soon as this message is sent.
 
 <table class="byte-layout">
     <thead>
@@ -1054,6 +781,12 @@ The NOW_EXEC_CAPSET_MSG message is sent to advertise capabilities.
             <td colspan="8">msgType</td>
             <td colspan="16">msgFlags</td>
         </tr>
+        <tr>
+            <td colspan="32">sessionId</td>
+        </tr>
+        <tr>
+            <td colspan="32">exitCode</td>
+        </tr>
     </tbody>
 </table>
 
@@ -1061,26 +794,17 @@ The NOW_EXEC_CAPSET_MSG message is sent to advertise capabilities.
 
 **msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID).
 
-**msgType (1 byte)**: The message type (NOW_EXEC_CAPSET_MSG_ID).
+**msgType (1 byte)**: The message type (NOW_EXEC_ABORT_MSG_ID).
 
-**msgFlags (2 bytes)**: A 16-bit unsigned integer containing the supported execution styles.
+**msgFlags (2 bytes)**: The message flags.
 
-| Flag | Meaning |
-|-------|---------|
-| NOW_EXEC_STYLE_RUN<br>0x0001 | Generic "Run" execution style. |
-| NOW_EXEC_STYLE_CMD<br>0x0002 | Generic command execution style. |
-| NOW_EXEC_STYLE_PROCESS<br>0x0004 | CreateProcess() execution style. |
-| NOW_EXEC_STYLE_SHELL<br>0x0008 | System shell (.sh) execution style. |
-| NOW_EXEC_STYLE_BATCH<br>0x0010 | Windows batch file (.bat) execution style. |
-| NOW_EXEC_STYLE_WINPS<br>0x0020 | Windows PowerShell (.ps1) execution style. |
-| NOW_EXEC_STYLE_PWSH<br>0x0040 | PowerShell 7 (.ps1) execution style. |
-| NOW_EXEC_STYLE_APPLESCRIPT<br>0x0080 | Applescript (.scpt) execution style. |
+**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-<!-- TODO: add AppleScript command -->
+**exitCode (4 bytes)**: Exit code for application abort (Ignored if not supported by OS).
 
-#### NOW_EXEC_ABORT_MSG
+#### NOW_EXEC_CANCEL_REQ_MSG
 
-The NOW_EXEC_ABORT_MSG message is used to abort a remote execution immediately due to an unrecoverable error. This message can be sent at any time without an explicit response message. The session is considered aborted as soon as this message is sent.
+The NOW_EXEC_CANCEL_REQ_MSG message is used to cancel a remote execution session.
 
 <table class="byte-layout">
     <thead>
@@ -1103,9 +827,6 @@ The NOW_EXEC_ABORT_MSG message is used to abort a remote execution immediately d
         <tr>
             <td colspan="32">sessionId</td>
         </tr>
-        <tr>
-            <td colspan="32">status</td>
-        </tr>
     </tbody>
 </table>
 
@@ -1113,17 +834,15 @@ The NOW_EXEC_ABORT_MSG message is used to abort a remote execution immediately d
 
 **msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID).
 
-**msgType (1 byte)**: The message type (NOW_EXEC_ABORT_MSG_ID).
+**msgType (1 byte)**: The message type (NOW_EXEC_CANCEL_REQ_MSG_ID).
 
 **msgFlags (2 bytes)**: The message flags.
 
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-**status (4 bytes)**: A NOW_STATUS error code.
-
-#### NOW_EXEC_CANCEL_REQ_MSG
+#### NOW_EXEC_CANCEL_RSP_MSG
 
-The NOW_EXEC_CANCEL_REQ_MSG message is used to cancel a remote execution session.
+The NOW_EXEC_CANCEL_RSP_MSG message is used to respond to a remote execution cancel request.
 
 <table class="byte-layout">
     <thead>
@@ -1146,6 +865,9 @@ The NOW_EXEC_CANCEL_REQ_MSG message is used to cancel a remote execution session
         <tr>
             <td colspan="32">sessionId</td>
         </tr>
+        <tr>
+            <td colspan="32">status (variable)</td>
+        </tr>
     </tbody>
 </table>
 
@@ -1153,15 +875,17 @@ The NOW_EXEC_CANCEL_REQ_MSG message is used to cancel a remote execution session
 
 **msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID).
 
-**msgType (1 byte)**: The message type (NOW_EXEC_CANCEL_REQ_MSG_ID).
+**msgType (1 byte)**: The message type (NOW_EXEC_CANCEL_RSP_MSG_ID).
 
 **msgFlags (2 bytes)**: The message flags.
 
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-#### NOW_EXEC_CANCEL_RSP_MSG
+**status (4 bytes)**: `NOW_STATUS` structure containing execution session cancellation request status.
 
-The NOW_EXEC_CANCEL_RSP_MSG message is used to respond to a remote execution cancel request.
+#### NOW_EXEC_RESULT_MSG
+
+The NOW_EXEC_RESULT_MSG message is used to return the result of an execution request. The session is considered terminated as soon as this message is sent.
 
 <table class="byte-layout">
     <thead>
@@ -1185,7 +909,10 @@ The NOW_EXEC_CANCEL_RSP_MSG message is used to respond to a remote execution can
             <td colspan="32">sessionId</td>
         </tr>
         <tr>
-            <td colspan="32">status</td>
+            <td colspan="32">exitCode</td>
+        </tr>
+        <tr>
+            <td colspan="32">status (variable)</td>
         </tr>
     </tbody>
 </table>
@@ -1194,17 +921,20 @@ The NOW_EXEC_CANCEL_RSP_MSG message is used to respond to a remote execution can
 
 **msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID).
 
-**msgType (1 byte)**: The message type (NOW_EXEC_CANCEL_RSP_MSG_ID).
+**msgType (1 byte)**: The message type (NOW_EXEC_RESULT_MSG_ID).
 
 **msgFlags (2 bytes)**: The message flags.
 
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-**status (4 bytes)**: A NOW_STATUS error code.
+**exitCode (4 bytes)**: Value containing either process exit code or `0` value if
+`status` field specifies error.
 
-#### NOW_EXEC_RESULT_MSG
+**status (variable)**: `NOW_STATUS` structure containing session execution result.
 
-The NOW_EXEC_RESULT_MSG message is used to return the result of an execution request.
+#### NOW_EXEC_DATA_MSG
+
+The NOW_EXEC_DATA_MSG message is used to send input/output data as part of a remote execution.
 
 <table class="byte-layout">
     <thead>
@@ -1228,7 +958,7 @@ The NOW_EXEC_RESULT_MSG message is used to return the result of an execution req
             <td colspan="32">sessionId</td>
         </tr>
         <tr>
-            <td colspan="32">status</td>
+            <td colspan="32">data (variable)</td>
         </tr>
     </tbody>
 </table>
@@ -1237,17 +967,34 @@ The NOW_EXEC_RESULT_MSG message is used to return the result of an execution req
 
 **msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID).
 
-**msgType (1 byte)**: The message type (NOW_EXEC_RESULT_MSG_ID).
+**msgType (1 byte)**: The message type (NOW_EXEC_DATA_MSG_ID).
 
 **msgFlags (2 bytes)**: The message flags.
 
+| Flag                                   | Meaning                         |
+|----------------------------------------|---------------------------------|
+| NOW_EXEC_FLAG_DATA_FIRST<br>0x00000001 | This is the first data message. |
+| NOW_EXEC_FLAG_DATA_LAST<br>0x00000002 | This is the last data message, the command completed execution. |
+| NOW_EXEC_FLAG_DATA_STDIN<br>0x00000004 | The data is from the standard input. |
+| NOW_EXEC_FLAG_DATA_STDOUT<br>0x00000008 | The data is from the standard output. |
+| NOW_EXEC_FLAG_DATA_STDERR<br>0x00000010 | The data is from the standard error. |
+
+Message should contain exactly one of `NOW_EXEC_FLAG_DATA_STDIN`, `NOW_EXEC_FLAG_DATA_STDOUT` or `NOW_EXEC_FLAG_DATA_STDERR` flags set.
+
+First stream message should always contain `NOW_EXEC_FLAG_DATA_FIRST`
+flag.
+
+`NOW_EXEC_FLAG_DATA_LAST` should indicate EOF for a stream, all consecutive messages for the given stream will be ignored by either party (client or sever).
+
+
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-**status (4 bytes)**: A NOW_STATUS error code.
+**data (variable)**: The input/output data represented as `NOW_VARBUF`
 
-#### NOW_EXEC_DATA_MSG
+#### NOW_EXEC_STARTED_MSG
 
-The NOW_EXEC_DATA_MSG message is used to send input/output data as part of a remote execution.
+The NOW_EXEC_STARTED_MSG message is sent by the server after the execution session has been successfully
+started.
 
 <table class="byte-layout">
     <thead>
@@ -1270,9 +1017,6 @@ The NOW_EXEC_DATA_MSG message is used to send input/output data as part of a rem
         <tr>
             <td colspan="32">sessionId</td>
         </tr>
-        <tr>
-            <td colspan="32">data (variable)</td>
-        </tr>
     </tbody>
 </table>
 
@@ -1280,22 +1024,12 @@ The NOW_EXEC_DATA_MSG message is used to send input/output data as part of a rem
 
 **msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID).
 
-**msgType (1 byte)**: The message type (NOW_EXEC_DATA_MSG_ID).
+**msgType (1 byte)**: The message type (NOW_EXEC_RESULT_MSG_ID).
 
 **msgFlags (2 bytes)**: The message flags.
 
-| Flag                                   | Meaning                         |
-|----------------------------------------|---------------------------------|
-| NOW_EXEC_FLAG_DATA_FIRST<br>0x00000001 | This is the first data message. |
-| NOW_EXEC_FLAG_DATA_LAST<br>0x00000002 | This is the last data message, the command completed execution. |
-| NOW_EXEC_FLAG_DATA_STDIN<br>0x00000004 | The data is from the standard input. |
-| NOW_EXEC_FLAG_DATA_STDOUT<br>0x00000008 | The data is from the standard output. |
-| NOW_EXEC_FLAG_DATA_STDERR<br>0x00000010 | The data is from the standard error. |
-
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-**data (variable)**: The input/output data represented as `NOW_VARBUF`
-
 #### NOW_EXEC_RUN_MSG
 
 The NOW_EXEC_RUN_MSG message is used to send a run request. This request type maps to starting a program by using the “Run” menu on operating systems (the Start Menu on Windows, the Dock on macOS etc.). The execution of programs started with NOW_EXEC_RUN_MSG is not followed and does not send back the output.
@@ -1339,9 +1073,6 @@ The NOW_EXEC_RUN_MSG message is used to send a run request. This request type ma
 
 **command (variable)**: A NOW_VARSTR structure containing the command to execute.
 
-#### NOW_EXEC_CMD_MSG
-<!-- TODO: Define CMD message -->
-
 #### NOW_EXEC_PROCESS_MSG
 
 The NOW_EXEC_PROCESS_MSG message is used to send a Windows [CreateProcess()](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw) request.
@@ -1387,17 +1118,23 @@ The NOW_EXEC_PROCESS_MSG message is used to send a Windows [CreateProcess()](htt
 
 **msgFlags (2 bytes)**: The message flags.
 
+| Flag                                   | Meaning                   |
+|----------------------------------------|---------------------------|
+| NOW_EXEC_FLAG_PROCESS_PARAMETERS_SET<br>0x00000001 | `parameters` field contains non-default value. |
+| NOW_EXEC_FLAG_PROCESS_DIRECTORY_SET<br>0x00000002 | `directory` field contains non-default value. |
+
+
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
 **filename (variable)**: A NOW_VARSTR structure containing the file name. Corresponds to the lpApplicationName parameter.
 
-**parameters (variable)**: A NOW_VARSTR structure containing the command parameters. Corresponds to the lpCommandLine parameter.
+**parameters (variable)**: A NOW_VARSTR structure containing the command parameters. Corresponds to the lpCommandLine parameter. Ignored if NOW_EXEC_FLAG_PROCESS_PARAMETERS_SET is not set.
 
-**directory (variable)**: A NOW_VARSTR structure containing the command working directory. Corresponds to the lpCurrentDirectory parameter.
+**directory (variable)**: A NOW_VARSTR structure containing the command working directory. Corresponds to the lpCurrentDirectory parameter. Ignored if NOW_EXEC_FLAG_PROCESS_DIRECTORY_SET is not set.
 
 #### NOW_EXEC_SHELL_MSG
 
-The NOW_EXEC_SHELL_MSG message is used to execute a remote shell command.
+The NOW_EXEC_SHELL_MSG message is used to execute a remote shell script.
 
 <table class="byte-layout">
     <thead>
@@ -1426,6 +1163,9 @@ The NOW_EXEC_SHELL_MSG message is used to execute a remote shell command.
         <tr>
             <td colspan="32">shell (variable)</td>
         </tr>
+        <tr>
+            <td colspan="32">directory (variable)</td>
+        </tr>
     </tbody>
 </table>
 
@@ -1437,15 +1177,24 @@ The NOW_EXEC_SHELL_MSG message is used to execute a remote shell command.
 
 **msgFlags (2 bytes)**: The message flags.
 
+| Flag                                   | Meaning                   |
+|----------------------------------------|---------------------------|
+| NOW_EXEC_FLAG_SHELL_SHELL_SET<br>0x00000001 | `shell` field contains non-default value. |
+| NOW_EXEC_FLAG_SHELL_DIRECTORY_SET<br>0x00000002 | `directory` field contains non-default value. |
+
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-**command (variable)**: A NOW_VARSTR structure containing the command to execute.
+**command (variable)**: A NOW_VARSTR structure containing the script file contents to execute.
+
+**shell (variable)**: A NOW_VARSTR structure containing the shell to use for execution. If no shell is specified, the default system shell (/bin/sh) will be used. Ignored if NOW_EXEC_FLAG_SHELL_SHELL_SET
+is not set.
 
-**shell (variable)**: A NOW_VARSTR structure containing the shell to use for execution. If no shell is specified, the default system shell (/bin/sh) will be used.
+**directory (variable)**: A NOW_VARSTR structure containing the command working directory. Ignored if
+NOW_EXEC_FLAG_SHELL_DIRECTORY_SET is not set.
 
 #### NOW_EXEC_BATCH_MSG
 
-The NOW_EXEC_BATCH_MSG message is used to execute a remote batch command.
+The NOW_EXEC_BATCH_MSG message is used to execute a remote batch script.
 
 <table class="byte-layout">
     <thead>
@@ -1471,6 +1220,9 @@ The NOW_EXEC_BATCH_MSG message is used to execute a remote batch command.
         <tr>
             <td colspan="32">command (variable)</td>
         </tr>
+        <tr>
+            <td colspan="32">directory (variable)</td>
+        </tr>
     </tbody>
 </table>
 
@@ -1482,9 +1234,16 @@ The NOW_EXEC_BATCH_MSG message is used to execute a remote batch command.
 
 **msgFlags (2 bytes)**: The message flags.
 
+| Flag                                   | Meaning                   |
+|----------------------------------------|---------------------------|
+| NOW_EXEC_FLAG_BATCH_DIRECTORY_SET<br>0x00000001 | `directory` field contains non-default value. |
+
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-**command (variable)**: A NOW_VARSTR structure containing the command to execute.
+**command (variable)**: A NOW_VARSTR structure containing the script file contents to execute.
+
+**directory (variable)**: A NOW_VARSTR structure containing the command working directory. Ignored
+if NOW_EXEC_FLAG_BATCH_DIRECTORY_SET is not set.
 
 #### NOW_EXEC_WINPS_MSG
 
@@ -1539,16 +1298,16 @@ The NOW_EXEC_WINPS_MSG message is used to execute a remote Windows PowerShell (p
 | NOW_EXEC_FLAG_PS_MTA<br>0x00000008 | PowerShell -Mta option |
 | NOW_EXEC_FLAG_PS_NO_PROFILE<br>0x00000010 | PowerShell -NoProfile option |
 | NOW_EXEC_FLAG_PS_NON_INTERACTIVE<br>0x00000020 | PowerShell -NonInteractive option |
-| NOW_EXEC_FLAG_PS_EXECUTION_POLICY<br>0x00000040 | The PowerShell -ExecutionPolicy parameter is specified with value in executionPolicy field |
-| NOW_EXEC_FLAG_PS_CONFIGURATION_NAME<br>0x00000080 | The PowerShell -ConfigurationName parameter is specified with value in configurationName field |
+| NOW_EXEC_FLAG_PS_EXECUTION_POLICY<br>0x00000040 | `executionPolicy` field contains non-default value and specifies the PowerShell -ExecutionPolicy parameter |
+| NOW_EXEC_FLAG_PS_CONFIGURATION_NAME<br>0x00000080 | `configurationName` field contains non-default value and specifies the PowerShell -ConfigurationName parameter |
 
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
-**executionPolicy (variable)**: A NOW_VARSTR structure containing the execution policy (-ExecutionPolicy) parameter value. This value is ignored if the NOW_EXEC_FLAG_PS_EXECUTION_POLICY flag is not set.
+**command (variable)**: A NOW_VARSTR structure containing the command to execute.
 
-**configurationName (variable)**: A NOW_VARSTR structure containing the configuration name (-ConfigurationName) parameter value. This value is ignored if the NOW_EXEC_FLAG_PS_CONFIGURATION_NAME flag is not set.
+**executionPolicy (variable)**: A NOW_VARSTR structure containing the execution policy (-ExecutionPolicy) parameter value. Ignored if NOW_EXEC_FLAG_PS_EXECUTION_POLICY is not set.
 
-**command (variable)**: A NOW_VARSTR structure containing the command to execute.
+**configurationName (variable)**: A NOW_VARSTR structure containing the configuration name (-ConfigurationName) parameter value. Ignored if NOW_EXEC_FLAG_PS_CONFIGURATION_NAME is not set.
 
 #### NOW_EXEC_PWSH_MSG
 
@@ -1597,8 +1356,12 @@ The NOW_EXEC_PWSH_MSG message is used to execute a remote PowerShell 7 (pwsh) co
 
 **sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id.
 
+**command (variable)**: A NOW_VARSTR structure containing the command to execute.
+
 **executionPolicy (variable)**: A NOW_VARSTR structure, same as with NOW_EXEC_WINPS_MSG.
 
 **configurationName (variable)**: A NOW_VARSTR structure, same as with NOW_EXEC_WINPS_MSG.
 
-**command (variable)**: A NOW_VARSTR structure containing the command to execute.
+### Version History
+- 1.0
+    - Initial protocol version
diff --git a/docs/make.ps1 b/docs/make.ps1
new file mode 100644
index 000000000..9afc19bff
--- /dev/null
+++ b/docs/make.ps1
@@ -0,0 +1,3 @@
+# NOTE: Markdown Monster CLI may be broken at the moment (WinGet version 3.5.4 definitely is),
+# the PDF could be generated manually via GUI instead.
+mmcli markdowntopdf -i NOW-spec.md -o NOW-spec.pdf --theme Github --orientation Portrait --page-size A4
\ No newline at end of file