@zonease/happy 0.6.38 → 0.6.40

package/dist/controlClient-B23M-WPp.cjs

@@ -0,0 +1,177 @@
+'use strict';
+
+var logger = require('./persistence-CBTtC_dm.cjs');
+var projectPath = require('./projectPath-ChLhdOyt.cjs');
+var fs = require('fs');
+var path = require('path');
+require('node:fs/promises');
+require('node:fs');
+require('node:os');
+require('node:path');
+require('zod');
+require('node:crypto');
+require('tweetnacl');
+require('chalk');
+require('url');
+
+async function daemonPost(path, body) {
+  const state = await logger.readDaemonState();
+  if (!state?.httpPort) {
+    const errorMessage = "No daemon running, no state file found";
+    logger.logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+    return {
+      error: errorMessage
+    };
+  }
+  try {
+    process.kill(state.pid, 0);
+  } catch (error) {
+    const errorMessage = "Daemon is not running, file is stale";
+    logger.logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+    return {
+      error: errorMessage
+    };
+  }
+  try {
+    const timeout = process.env.HAPPY_DAEMON_HTTP_TIMEOUT ? parseInt(process.env.HAPPY_DAEMON_HTTP_TIMEOUT) : 1e4;
+    const response = await fetch(`http://127.0.0.1:${state.httpPort}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body || {}),
+      // Mostly increased for stress test
+      signal: AbortSignal.timeout(timeout)
+    });
+    if (!response.ok) {
+      const errorMessage = `Request failed: ${path}, HTTP ${response.status}`;
+      logger.logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+      return {
+        error: errorMessage
+      };
+    }
+    return await response.json();
+  } catch (error) {
+    const errorMessage = `Request failed: ${path}, ${error instanceof Error ? error.message : "Unknown error"}`;
+    logger.logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+    return {
+      error: errorMessage
+    };
+  }
+}
+async function notifyDaemonSessionStarted(sessionId, metadata) {
+  return await daemonPost("/session-started", {
+    sessionId,
+    metadata
+  });
+}
+async function execOnDeviceViaDaemon(deviceId, command, timeoutMs) {
+  const response = await daemonPost("/device-exec", { deviceId, command, timeoutMs });
+  if (!response || response.error || response.ok !== true) {
+    logger.logger.debug(`[CONTROL CLIENT] Device exec via daemon unavailable: ${response?.error ?? "no daemon"}`);
+    return null;
+  }
+  return response.result;
+}
+async function listDaemonSessions() {
+  const result = await daemonPost("/list");
+  return result.children || [];
+}
+async function stopDaemonSession(sessionId) {
+  const result = await daemonPost("/stop-session", { sessionId });
+  return result.success || false;
+}
+async function stopDaemonHttp() {
+  await daemonPost("/stop");
+}
+async function checkIfDaemonRunningAndCleanupStaleState() {
+  const state = await logger.readDaemonState();
+  if (!state) {
+    return false;
+  }
+  try {
+    process.kill(state.pid, 0);
+    return true;
+  } catch {
+    logger.logger.debug("[DAEMON RUN] Daemon PID not running, cleaning up state");
+    await cleanupDaemonState();
+    return false;
+  }
+}
+async function isDaemonRunningCurrentlyInstalledHappyVersion() {
+  logger.logger.debug("[DAEMON CONTROL] Checking if daemon is running same version");
+  const runningDaemon = await checkIfDaemonRunningAndCleanupStaleState();
+  if (!runningDaemon) {
+    logger.logger.debug("[DAEMON CONTROL] No daemon running, returning false");
+    return false;
+  }
+  const state = await logger.readDaemonState();
+  if (!state) {
+    logger.logger.debug("[DAEMON CONTROL] No daemon state found, returning false");
+    return false;
+  }
+  try {
+    const packageJsonPath = path.join(projectPath.projectPath(), "package.json");
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+    const currentCliVersion = packageJson.version;
+    logger.logger.debug(`[DAEMON CONTROL] Current CLI version: ${currentCliVersion}, Daemon started with version: ${state.startedWithCliVersion}`);
+    return currentCliVersion === state.startedWithCliVersion;
+  } catch (error) {
+    logger.logger.debug("[DAEMON CONTROL] Error checking daemon version", error);
+    return false;
+  }
+}
+async function cleanupDaemonState() {
+  try {
+    await logger.clearDaemonState();
+    logger.logger.debug("[DAEMON RUN] Daemon state file removed");
+  } catch (error) {
+    logger.logger.debug("[DAEMON RUN] Error cleaning up daemon metadata", error);
+  }
+}
+async function stopDaemon() {
+  try {
+    const state = await logger.readDaemonState();
+    if (!state) {
+      logger.logger.debug("No daemon state found");
+      return;
+    }
+    logger.logger.debug(`Stopping daemon with PID ${state.pid}`);
+    try {
+      await stopDaemonHttp();
+      await waitForProcessDeath(state.pid, 2e3);
+      logger.logger.debug("Daemon stopped gracefully via HTTP");
+      return;
+    } catch (error) {
+      logger.logger.debug("HTTP stop failed, will force kill", error);
+    }
+    try {
+      process.kill(state.pid, "SIGKILL");
+      logger.logger.debug("Force killed daemon");
+    } catch (error) {
+      logger.logger.debug("Daemon already dead");
+    }
+  } catch (error) {
+    logger.logger.debug("Error stopping daemon", error);
+  }
+}
+async function waitForProcessDeath(pid, timeout) {
+  const start = Date.now();
+  while (Date.now() - start < timeout) {
+    try {
+      process.kill(pid, 0);
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    } catch {
+      return;
+    }
+  }
+  throw new Error("Process did not die within timeout");
+}
+
+exports.checkIfDaemonRunningAndCleanupStaleState = checkIfDaemonRunningAndCleanupStaleState;
+exports.cleanupDaemonState = cleanupDaemonState;
+exports.execOnDeviceViaDaemon = execOnDeviceViaDaemon;
+exports.isDaemonRunningCurrentlyInstalledHappyVersion = isDaemonRunningCurrentlyInstalledHappyVersion;
+exports.listDaemonSessions = listDaemonSessions;
+exports.notifyDaemonSessionStarted = notifyDaemonSessionStarted;
+exports.stopDaemon = stopDaemon;
+exports.stopDaemonHttp = stopDaemonHttp;
+exports.stopDaemonSession = stopDaemonSession;

package/dist/controlClient-DB5tDU7V.mjs

@@ -0,0 +1,167 @@
+import { l as logger, j as readDaemonState, n as clearDaemonState } from './persistence-DKfF81pd.mjs';
+import { p as projectPath } from './projectPath-BTBIMB57.mjs';
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import 'node:fs/promises';
+import 'node:fs';
+import 'node:os';
+import 'node:path';
+import 'zod';
+import 'node:crypto';
+import 'tweetnacl';
+import 'chalk';
+import 'url';
+
+async function daemonPost(path, body) {
+  const state = await readDaemonState();
+  if (!state?.httpPort) {
+    const errorMessage = "No daemon running, no state file found";
+    logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+    return {
+      error: errorMessage
+    };
+  }
+  try {
+    process.kill(state.pid, 0);
+  } catch (error) {
+    const errorMessage = "Daemon is not running, file is stale";
+    logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+    return {
+      error: errorMessage
+    };
+  }
+  try {
+    const timeout = process.env.HAPPY_DAEMON_HTTP_TIMEOUT ? parseInt(process.env.HAPPY_DAEMON_HTTP_TIMEOUT) : 1e4;
+    const response = await fetch(`http://127.0.0.1:${state.httpPort}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body || {}),
+      // Mostly increased for stress test
+      signal: AbortSignal.timeout(timeout)
+    });
+    if (!response.ok) {
+      const errorMessage = `Request failed: ${path}, HTTP ${response.status}`;
+      logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+      return {
+        error: errorMessage
+      };
+    }
+    return await response.json();
+  } catch (error) {
+    const errorMessage = `Request failed: ${path}, ${error instanceof Error ? error.message : "Unknown error"}`;
+    logger.debug(`[CONTROL CLIENT] ${errorMessage}`);
+    return {
+      error: errorMessage
+    };
+  }
+}
+async function notifyDaemonSessionStarted(sessionId, metadata) {
+  return await daemonPost("/session-started", {
+    sessionId,
+    metadata
+  });
+}
+async function execOnDeviceViaDaemon(deviceId, command, timeoutMs) {
+  const response = await daemonPost("/device-exec", { deviceId, command, timeoutMs });
+  if (!response || response.error || response.ok !== true) {
+    logger.debug(`[CONTROL CLIENT] Device exec via daemon unavailable: ${response?.error ?? "no daemon"}`);
+    return null;
+  }
+  return response.result;
+}
+async function listDaemonSessions() {
+  const result = await daemonPost("/list");
+  return result.children || [];
+}
+async function stopDaemonSession(sessionId) {
+  const result = await daemonPost("/stop-session", { sessionId });
+  return result.success || false;
+}
+async function stopDaemonHttp() {
+  await daemonPost("/stop");
+}
+async function checkIfDaemonRunningAndCleanupStaleState() {
+  const state = await readDaemonState();
+  if (!state) {
+    return false;
+  }
+  try {
+    process.kill(state.pid, 0);
+    return true;
+  } catch {
+    logger.debug("[DAEMON RUN] Daemon PID not running, cleaning up state");
+    await cleanupDaemonState();
+    return false;
+  }
+}
+async function isDaemonRunningCurrentlyInstalledHappyVersion() {
+  logger.debug("[DAEMON CONTROL] Checking if daemon is running same version");
+  const runningDaemon = await checkIfDaemonRunningAndCleanupStaleState();
+  if (!runningDaemon) {
+    logger.debug("[DAEMON CONTROL] No daemon running, returning false");
+    return false;
+  }
+  const state = await readDaemonState();
+  if (!state) {
+    logger.debug("[DAEMON CONTROL] No daemon state found, returning false");
+    return false;
+  }
+  try {
+    const packageJsonPath = join(projectPath(), "package.json");
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+    const currentCliVersion = packageJson.version;
+    logger.debug(`[DAEMON CONTROL] Current CLI version: ${currentCliVersion}, Daemon started with version: ${state.startedWithCliVersion}`);
+    return currentCliVersion === state.startedWithCliVersion;
+  } catch (error) {
+    logger.debug("[DAEMON CONTROL] Error checking daemon version", error);
+    return false;
+  }
+}
+async function cleanupDaemonState() {
+  try {
+    await clearDaemonState();
+    logger.debug("[DAEMON RUN] Daemon state file removed");
+  } catch (error) {
+    logger.debug("[DAEMON RUN] Error cleaning up daemon metadata", error);
+  }
+}
+async function stopDaemon() {
+  try {
+    const state = await readDaemonState();
+    if (!state) {
+      logger.debug("No daemon state found");
+      return;
+    }
+    logger.debug(`Stopping daemon with PID ${state.pid}`);
+    try {
+      await stopDaemonHttp();
+      await waitForProcessDeath(state.pid, 2e3);
+      logger.debug("Daemon stopped gracefully via HTTP");
+      return;
+    } catch (error) {
+      logger.debug("HTTP stop failed, will force kill", error);
+    }
+    try {
+      process.kill(state.pid, "SIGKILL");
+      logger.debug("Force killed daemon");
+    } catch (error) {
+      logger.debug("Daemon already dead");
+    }
+  } catch (error) {
+    logger.debug("Error stopping daemon", error);
+  }
+}
+async function waitForProcessDeath(pid, timeout) {
+  const start = Date.now();
+  while (Date.now() - start < timeout) {
+    try {
+      process.kill(pid, 0);
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    } catch {
+      return;
+    }
+  }
+  throw new Error("Process did not die within timeout");
+}
+
+export { checkIfDaemonRunningAndCleanupStaleState, cleanupDaemonState, execOnDeviceViaDaemon, isDaemonRunningCurrentlyInstalledHappyVersion, listDaemonSessions, notifyDaemonSessionStarted, stopDaemon, stopDaemonHttp, stopDaemonSession };

package/dist/deviceKeys-BTdo34Uz.mjs

@@ -0,0 +1,175 @@
+import axios from 'axios';
+import { f as decodeBase64, g as encodeBase64, h as encrypt, e as decrypt, c as configuration } from './persistence-DKfF81pd.mjs';
+import { decryptWithEphemeralKey } from './auth-DxJ3VvrX.mjs';
+import tweetnacl from 'tweetnacl';
+import { existsSync } from 'node:fs';
+import { writeFile, mkdir, readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { hostname } from 'node:os';
+
+function resolveMachineKey(credentials, dataEncryptionKey) {
+  if (credentials.encryption.type === "legacy") {
+    return { key: credentials.encryption.secret, variant: "legacy" };
+  }
+  if (!dataEncryptionKey) return null;
+  const blob = decodeBase64(dataEncryptionKey);
+  if (blob.length < 1 || blob[0] !== 0) return null;
+  const opened = decryptWithEphemeralKey(blob.slice(1), credentials.encryption.machineKey);
+  return opened ? { key: opened, variant: "dataKey" } : null;
+}
+async function fetchMachines(credentials) {
+  const response = await axios.get(
+    `${configuration.serverUrl}/v1/machines`,
+    { headers: { Authorization: `Bearer ${credentials.token}` }, timeout: 15e3 }
+  );
+  const data = response.data;
+  return Array.isArray(data) ? data : data.machines ?? [];
+}
+async function listDevices(credentials) {
+  const rows = await fetchMachines(credentials);
+  return rows.map((row) => {
+    const resolved = resolveMachineKey(credentials, row.dataEncryptionKey);
+    let metadata = null;
+    if (resolved && row.metadata) {
+      try {
+        metadata = decrypt(resolved.key, resolved.variant, decodeBase64(row.metadata));
+      } catch {
+        metadata = null;
+      }
+    }
+    return {
+      id: row.id,
+      name: row.displayName || metadata?.displayName || metadata?.host || row.id.slice(0, 12),
+      description: row.description ?? null,
+      platform: metadata?.platform ?? null,
+      active: row.active,
+      lastActiveAt: row.activeAt ?? row.lastActiveAt ?? 0
+    };
+  });
+}
+async function deviceExec(socket, credentials, deviceId, command, options = {}) {
+  const row = options.skipMachineLookup ? null : await (async () => {
+    const rows = await fetchMachines(credentials);
+    const found = rows.find((candidate) => candidate.id === deviceId);
+    if (!found) {
+      throw new Error(`Device ${deviceId} not found`);
+    }
+    if (!found.active) {
+      throw new Error(`Device ${deviceId} is offline`);
+    }
+    return found;
+  })();
+  const resolved = options.deviceKeyBase64 ? { key: decodeBase64(options.deviceKeyBase64), variant: options.deviceKeyVariant ?? "dataKey" } : resolveMachineKey(credentials, row.dataEncryptionKey);
+  if (!resolved) {
+    throw new Error(`Cannot resolve encryption key for device ${deviceId}. Re-select the device in the app.`);
+  }
+  const timeout = options.timeout ?? 6e4;
+  const params = encodeBase64(encrypt(resolved.key, resolved.variant, {
+    command,
+    cwd: options.cwd,
+    timeout
+  }));
+  const answer = await socket.timeout(timeout + 5e3).emitWithAck("rpc-call", {
+    method: `${deviceId}:bash`,
+    params
+  });
+  if (!answer?.ok) {
+    throw new Error(answer?.error || "Device RPC failed");
+  }
+  const decrypted = decrypt(resolved.key, resolved.variant, decodeBase64(answer.result));
+  if (!decrypted) {
+    throw new Error("Failed to decrypt device response");
+  }
+  return decrypted;
+}
+
+const POLL_INTERVAL_MS = 2e3;
+const POLL_TIMEOUT_MS = 10 * 60 * 1e3;
+function deviceKeysFile() {
+  return join(configuration.happyHomeDir, "device-keys.json");
+}
+async function readDeviceKeys() {
+  const file = deviceKeysFile();
+  if (!existsSync(file)) return {};
+  try {
+    const parsed = JSON.parse(await readFile(file, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function writeDeviceDirectory(entries) {
+  const file = deviceKeysFile();
+  await mkdir(dirname(file), { recursive: true });
+  const keys = {};
+  for (const entry of entries) {
+    keys[entry.id] = { name: entry.name, key: entry.key, variant: entry.variant ?? "dataKey" };
+  }
+  await writeFile(file, JSON.stringify(keys, null, 2), { mode: 384 });
+}
+async function pruneDeviceAliases(id, name) {
+  const keys = await readDeviceKeys();
+  const stale = Object.keys(keys).filter((candidate) => candidate !== id && keys[candidate].name === name);
+  if (stale.length === 0) return;
+  for (const candidate of stale) delete keys[candidate];
+  await writeFile(deviceKeysFile(), JSON.stringify(keys, null, 2), { mode: 384 });
+}
+async function readCachedDeviceKey(machineId) {
+  const keys = await readDeviceKeys();
+  const stored = keys[machineId];
+  if (!stored?.key) return null;
+  return { key: decodeBase64(stored.key), variant: stored.variant ?? "dataKey" };
+}
+async function readCachedDeviceNames() {
+  const keys = await readDeviceKeys();
+  return Object.fromEntries(Object.entries(keys).map(([id, entry]) => [id, entry.name]));
+}
+async function ensureDeviceKey(credentials, machineId, onPending) {
+  const cached = await readCachedDeviceKey(machineId);
+  if (cached) return cached;
+  const seed = tweetnacl.randomBytes(32);
+  const secretKey = tweetnacl.hash(seed).slice(0, 32);
+  const publicKey = tweetnacl.box.keyPair.fromSecretKey(secretKey).publicKey;
+  const created = await axios.post(
+    `${configuration.serverUrl}/v1/devices/key-requests`,
+    { machineId, publicKey: encodeBase64(publicKey), label: `happy ssh from ${hostname()}` },
+    { headers: { Authorization: `Bearer ${credentials.token}` }, timeout: 15e3 }
+  );
+  onPending?.({ id: created.data.id });
+  const deadline = Date.now() + POLL_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    const status = await axios.get(
+      `${configuration.serverUrl}/v1/devices/key-requests/${created.data.id}`,
+      { headers: { Authorization: `Bearer ${credentials.token}` }, timeout: 15e3 }
+    );
+    if (status.data.expired) {
+      throw new Error("Authorization request expired. Run the command again.");
+    }
+    if (status.data.approved && status.data.response) {
+      const opened = decryptWithEphemeralKey(decodeBase64(status.data.response), secretKey);
+      if (!opened) {
+        throw new Error("Could not open the device directory returned by the app");
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(Buffer.from(opened).toString("utf8"));
+      } catch {
+        throw new Error("Device directory from the app was malformed");
+      }
+      const devices = parsed.devices ?? [];
+      if (devices.length === 0) {
+        throw new Error("The app returned an empty device directory");
+      }
+      await writeDeviceDirectory(devices);
+      const target = devices.find((device) => device.id === machineId);
+      if (!target) {
+        throw new Error("The app did not include this device in the directory");
+      }
+      return { key: decodeBase64(target.key), variant: target.variant ?? "dataKey" };
+    }
+  }
+  throw new Error("Timed out waiting for approval in the Happy app");
+}
+
+export { readCachedDeviceKey as a, deviceExec as d, ensureDeviceKey as e, listDevices as l, pruneDeviceAliases as p, readCachedDeviceNames as r };

package/dist/deviceKeys-C540DcXl.cjs

@@ -0,0 +1,182 @@
+'use strict';
+
+var axios = require('axios');
+var logger = require('./persistence-CBTtC_dm.cjs');
+var auth = require('./auth-C7ZScWEw.cjs');
+var tweetnacl = require('tweetnacl');
+var fs = require('node:fs');
+var promises = require('node:fs/promises');
+var path = require('node:path');
+var os = require('node:os');
+
+function resolveMachineKey(credentials, dataEncryptionKey) {
+  if (credentials.encryption.type === "legacy") {
+    return { key: credentials.encryption.secret, variant: "legacy" };
+  }
+  if (!dataEncryptionKey) return null;
+  const blob = logger.decodeBase64(dataEncryptionKey);
+  if (blob.length < 1 || blob[0] !== 0) return null;
+  const opened = auth.decryptWithEphemeralKey(blob.slice(1), credentials.encryption.machineKey);
+  return opened ? { key: opened, variant: "dataKey" } : null;
+}
+async function fetchMachines(credentials) {
+  const response = await axios.get(
+    `${logger.configuration.serverUrl}/v1/machines`,
+    { headers: { Authorization: `Bearer ${credentials.token}` }, timeout: 15e3 }
+  );
+  const data = response.data;
+  return Array.isArray(data) ? data : data.machines ?? [];
+}
+async function listDevices(credentials) {
+  const rows = await fetchMachines(credentials);
+  return rows.map((row) => {
+    const resolved = resolveMachineKey(credentials, row.dataEncryptionKey);
+    let metadata = null;
+    if (resolved && row.metadata) {
+      try {
+        metadata = logger.decrypt(resolved.key, resolved.variant, logger.decodeBase64(row.metadata));
+      } catch {
+        metadata = null;
+      }
+    }
+    return {
+      id: row.id,
+      name: row.displayName || metadata?.displayName || metadata?.host || row.id.slice(0, 12),
+      description: row.description ?? null,
+      platform: metadata?.platform ?? null,
+      active: row.active,
+      lastActiveAt: row.activeAt ?? row.lastActiveAt ?? 0
+    };
+  });
+}
+async function deviceExec(socket, credentials, deviceId, command, options = {}) {
+  const row = options.skipMachineLookup ? null : await (async () => {
+    const rows = await fetchMachines(credentials);
+    const found = rows.find((candidate) => candidate.id === deviceId);
+    if (!found) {
+      throw new Error(`Device ${deviceId} not found`);
+    }
+    if (!found.active) {
+      throw new Error(`Device ${deviceId} is offline`);
+    }
+    return found;
+  })();
+  const resolved = options.deviceKeyBase64 ? { key: logger.decodeBase64(options.deviceKeyBase64), variant: options.deviceKeyVariant ?? "dataKey" } : resolveMachineKey(credentials, row.dataEncryptionKey);
+  if (!resolved) {
+    throw new Error(`Cannot resolve encryption key for device ${deviceId}. Re-select the device in the app.`);
+  }
+  const timeout = options.timeout ?? 6e4;
+  const params = logger.encodeBase64(logger.encrypt(resolved.key, resolved.variant, {
+    command,
+    cwd: options.cwd,
+    timeout
+  }));
+  const answer = await socket.timeout(timeout + 5e3).emitWithAck("rpc-call", {
+    method: `${deviceId}:bash`,
+    params
+  });
+  if (!answer?.ok) {
+    throw new Error(answer?.error || "Device RPC failed");
+  }
+  const decrypted = logger.decrypt(resolved.key, resolved.variant, logger.decodeBase64(answer.result));
+  if (!decrypted) {
+    throw new Error("Failed to decrypt device response");
+  }
+  return decrypted;
+}
+
+const POLL_INTERVAL_MS = 2e3;
+const POLL_TIMEOUT_MS = 10 * 60 * 1e3;
+function deviceKeysFile() {
+  return path.join(logger.configuration.happyHomeDir, "device-keys.json");
+}
+async function readDeviceKeys() {
+  const file = deviceKeysFile();
+  if (!fs.existsSync(file)) return {};
+  try {
+    const parsed = JSON.parse(await promises.readFile(file, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function writeDeviceDirectory(entries) {
+  const file = deviceKeysFile();
+  await promises.mkdir(path.dirname(file), { recursive: true });
+  const keys = {};
+  for (const entry of entries) {
+    keys[entry.id] = { name: entry.name, key: entry.key, variant: entry.variant ?? "dataKey" };
+  }
+  await promises.writeFile(file, JSON.stringify(keys, null, 2), { mode: 384 });
+}
+async function pruneDeviceAliases(id, name) {
+  const keys = await readDeviceKeys();
+  const stale = Object.keys(keys).filter((candidate) => candidate !== id && keys[candidate].name === name);
+  if (stale.length === 0) return;
+  for (const candidate of stale) delete keys[candidate];
+  await promises.writeFile(deviceKeysFile(), JSON.stringify(keys, null, 2), { mode: 384 });
+}
+async function readCachedDeviceKey(machineId) {
+  const keys = await readDeviceKeys();
+  const stored = keys[machineId];
+  if (!stored?.key) return null;
+  return { key: logger.decodeBase64(stored.key), variant: stored.variant ?? "dataKey" };
+}
+async function readCachedDeviceNames() {
+  const keys = await readDeviceKeys();
+  return Object.fromEntries(Object.entries(keys).map(([id, entry]) => [id, entry.name]));
+}
+async function ensureDeviceKey(credentials, machineId, onPending) {
+  const cached = await readCachedDeviceKey(machineId);
+  if (cached) return cached;
+  const seed = tweetnacl.randomBytes(32);
+  const secretKey = tweetnacl.hash(seed).slice(0, 32);
+  const publicKey = tweetnacl.box.keyPair.fromSecretKey(secretKey).publicKey;
+  const created = await axios.post(
+    `${logger.configuration.serverUrl}/v1/devices/key-requests`,
+    { machineId, publicKey: logger.encodeBase64(publicKey), label: `happy ssh from ${os.hostname()}` },
+    { headers: { Authorization: `Bearer ${credentials.token}` }, timeout: 15e3 }
+  );
+  onPending?.({ id: created.data.id });
+  const deadline = Date.now() + POLL_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    const status = await axios.get(
+      `${logger.configuration.serverUrl}/v1/devices/key-requests/${created.data.id}`,
+      { headers: { Authorization: `Bearer ${credentials.token}` }, timeout: 15e3 }
+    );
+    if (status.data.expired) {
+      throw new Error("Authorization request expired. Run the command again.");
+    }
+    if (status.data.approved && status.data.response) {
+      const opened = auth.decryptWithEphemeralKey(logger.decodeBase64(status.data.response), secretKey);
+      if (!opened) {
+        throw new Error("Could not open the device directory returned by the app");
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(Buffer.from(opened).toString("utf8"));
+      } catch {
+        throw new Error("Device directory from the app was malformed");
+      }
+      const devices = parsed.devices ?? [];
+      if (devices.length === 0) {
+        throw new Error("The app returned an empty device directory");
+      }
+      await writeDeviceDirectory(devices);
+      const target = devices.find((device) => device.id === machineId);
+      if (!target) {
+        throw new Error("The app did not include this device in the directory");
+      }
+      return { key: logger.decodeBase64(target.key), variant: target.variant ?? "dataKey" };
+    }
+  }
+  throw new Error("Timed out waiting for approval in the Happy app");
+}
+
+exports.deviceExec = deviceExec;
+exports.ensureDeviceKey = ensureDeviceKey;
+exports.listDevices = listDevices;
+exports.pruneDeviceAliases = pruneDeviceAliases;
+exports.readCachedDeviceKey = readCachedDeviceKey;
+exports.readCachedDeviceNames = readCachedDeviceNames;