@zonease/happy 0.6.39 → 0.6.41

package/dist/lib.d.cts

@@ -1606,6 +1606,80 @@ type SpawnSessionResult = {
  * Similar to ApiSessionClient but for machine-scoped connections
  */
 
+interface ServerToDaemonEvents {
+    update: (data: Update) => void;
+    'rpc-request': (data: {
+        method: string;
+        params: string;
+    }, callback: (response: string) => void) => void;
+    'rpc-registered': (data: {
+        method: string;
+    }) => void;
+    'rpc-unregistered': (data: {
+        method: string;
+    }) => void;
+    'rpc-error': (data: {
+        type: string;
+        error: string;
+    }) => void;
+    auth: (data: {
+        success: boolean;
+        user: string;
+    }) => void;
+    error: (data: {
+        message: string;
+    }) => void;
+}
+interface DaemonToServerEvents {
+    'machine-alive': (data: {
+        machineId: string;
+        time: number;
+    }) => void;
+    'machine-update-metadata': (data: {
+        machineId: string;
+        metadata: string;
+        expectedVersion: number;
+    }, cb: (answer: {
+        result: 'error';
+    } | {
+        result: 'version-mismatch';
+        version: number;
+        metadata: string;
+    } | {
+        result: 'success';
+        version: number;
+        metadata: string;
+    }) => void) => void;
+    'machine-update-state': (data: {
+        machineId: string;
+        daemonState: string;
+        expectedVersion: number;
+    }, cb: (answer: {
+        result: 'error';
+    } | {
+        result: 'version-mismatch';
+        version: number;
+        daemonState: string;
+    } | {
+        result: 'success';
+        version: number;
+        daemonState: string;
+    }) => void) => void;
+    'rpc-register': (data: {
+        method: string;
+    }) => void;
+    'rpc-unregister': (data: {
+        method: string;
+    }) => void;
+    'rpc-call': (data: {
+        method: string;
+        params: any;
+    }, callback: (response: {
+        ok: boolean;
+        result?: any;
+        error?: string;
+    }) => void) => void;
+}
 type MachineRpcHandlers = {
     spawnSession: (options: SpawnSessionOptions) => Promise<SpawnSessionResult>;
     stopSession: (sessionId: string) => boolean;
@@ -1641,6 +1715,9 @@ declare class ApiMachineClient {
     private machine;
     private currentRuntimeDaemonState?;
     private socket;
+    /** The daemon's live connection. Reused for device RPC so a CLI command does
+     *  not spend ~500ms building its own TLS + WebSocket handshake. */
+    get rpcSocket(): Socket<ServerToDaemonEvents, DaemonToServerEvents>;
     private keepAliveInterval;
     private rpcHandlerManager;
     private claudeCache;

package/dist/lib.d.mts

@@ -1606,6 +1606,80 @@ type SpawnSessionResult = {
  * Similar to ApiSessionClient but for machine-scoped connections
  */
 
+interface ServerToDaemonEvents {
+    update: (data: Update) => void;
+    'rpc-request': (data: {
+        method: string;
+        params: string;
+    }, callback: (response: string) => void) => void;
+    'rpc-registered': (data: {
+        method: string;
+    }) => void;
+    'rpc-unregistered': (data: {
+        method: string;
+    }) => void;
+    'rpc-error': (data: {
+        type: string;
+        error: string;
+    }) => void;
+    auth: (data: {
+        success: boolean;
+        user: string;
+    }) => void;
+    error: (data: {
+        message: string;
+    }) => void;
+}
+interface DaemonToServerEvents {
+    'machine-alive': (data: {
+        machineId: string;
+        time: number;
+    }) => void;
+    'machine-update-metadata': (data: {
+        machineId: string;
+        metadata: string;
+        expectedVersion: number;
+    }, cb: (answer: {
+        result: 'error';
+    } | {
+        result: 'version-mismatch';
+        version: number;
+        metadata: string;
+    } | {
+        result: 'success';
+        version: number;
+        metadata: string;
+    }) => void) => void;
+    'machine-update-state': (data: {
+        machineId: string;
+        daemonState: string;
+        expectedVersion: number;
+    }, cb: (answer: {
+        result: 'error';
+    } | {
+        result: 'version-mismatch';
+        version: number;
+        daemonState: string;
+    } | {
+        result: 'success';
+        version: number;
+        daemonState: string;
+    }) => void) => void;
+    'rpc-register': (data: {
+        method: string;
+    }) => void;
+    'rpc-unregister': (data: {
+        method: string;
+    }) => void;
+    'rpc-call': (data: {
+        method: string;
+        params: any;
+    }, callback: (response: {
+        ok: boolean;
+        result?: any;
+        error?: string;
+    }) => void) => void;
+}
 type MachineRpcHandlers = {
     spawnSession: (options: SpawnSessionOptions) => Promise<SpawnSessionResult>;
     stopSession: (sessionId: string) => boolean;
@@ -1641,6 +1715,9 @@ declare class ApiMachineClient {
     private machine;
     private currentRuntimeDaemonState?;
     private socket;
+    /** The daemon's live connection. Reused for device RPC so a CLI command does
+     *  not spend ~500ms building its own TLS + WebSocket handshake. */
+    get rpcSocket(): Socket<ServerToDaemonEvents, DaemonToServerEvents>;
     private keepAliveInterval;
     private rpcHandlerManager;
     private claudeCache;

package/dist/lib.mjs

@@ -1,5 +1,5 @@
-export { A as ApiClient, a as ApiSessionClient } from './api-CIZKyfSn.mjs';
-export { c as configuration, l as logger } from './persistence-BFjvtUad.mjs';
+export { A as ApiClient, a as ApiSessionClient } from './api-K2-jr9ar.mjs';
+export { c as configuration, l as logger } from './persistence-CIUFyOwz.mjs';
 export { R as RawJSONLinesSchema } from './types-BoJh4Qfv.mjs';
 import 'axios';
 import 'node:events';
@@ -28,6 +28,6 @@ import 'tweetnacl';
 import '@stablelib/base64';
 import 'node:readline';
 import 'expo-server-sdk';
-import './sessionKeyCache-D2BwO91C.mjs';
+import './sessionKeyCache-D2u3JUys.mjs';
 import 'chalk';
 import 'fs';

package/dist/{loadableToolOutput-Cuygmd4K.mjs → loadableToolOutput-4EvraaNY.mjs}

@@ -1,11 +1,11 @@
-import { l as logger, c as configuration, p as packageJson } from './persistence-BFjvtUad.mjs';
+import { l as logger, c as configuration, p as packageJson } from './persistence-CIUFyOwz.mjs';
 import { randomUUID } from 'node:crypto';
 import { readFileSync, existsSync, readdirSync } from 'node:fs';
 import os, { homedir } from 'node:os';
 import { join, basename, dirname } from 'node:path';
 import { p as projectPath } from './projectPath-BTBIMB57.mjs';
-import { r as resolveToolsDir, s as startOfflineReconnection, b as saveToolOutputRecord } from './api-CIZKyfSn.mjs';
-import { a as detectGitWorktree } from './downloadImage-DfSFLb-h.mjs';
+import { r as resolveToolsDir, s as startOfflineReconnection, b as saveToolOutputRecord } from './api-K2-jr9ar.mjs';
+import { a as detectGitWorktree } from './downloadImage-ia5SzlCV.mjs';
 
 class BasePermissionHandler {
   pendingRequests = /* @__PURE__ */ new Map();

package/dist/{loadableToolOutput-DDCJjywt.cjs → loadableToolOutput-BZYlaqHn.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var logger = require('./persistence-JLUn_Nou.cjs');
+var logger = require('./persistence-DrfN7TzY.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
 var os = require('node:os');
 var path = require('node:path');
 var projectPath = require('./projectPath-ChLhdOyt.cjs');
-var api = require('./api-CwOCQeLH.cjs');
-var downloadImage = require('./downloadImage-MQMrUUxS.cjs');
+var api = require('./api-XeHlmApX.cjs');
+var downloadImage = require('./downloadImage-B_ygLAXY.cjs');
 
 class BasePermissionHandler {
   pendingRequests = /* @__PURE__ */ new Map();

package/dist/{persistence-BFjvtUad.mjs → persistence-CIUFyOwz.mjs}

@@ -14,7 +14,7 @@ function isDebug() {
 }
 
 var name = "@zonease/happy";
-var version = "0.6.39";
+var version = "0.6.41";
 var description = "Mobile and Web client for Claude Code, Codex, and Gemini";
 var author = "ZonEaseTech";
 var license = "MIT";
@@ -941,4 +941,4 @@ var persistence = /*#__PURE__*/Object.freeze({
     writeDaemonState: writeDaemonState
 });
 
-export { getProfileEnvironmentVariables as A, encryptLegacy as B, getRandomBytes as C, libsodiumEncryptForPublicKey as D, logger$1 as E, persistence as F, readSettings as a, clearCredentials as b, configuration as c, clearMachineId as d, decodeBase64 as e, encodeBase64 as f, encrypt as g, decrypt as h, isDebug as i, readDaemonState as j, encryptWithDataKey as k, logger as l, decryptWithDataKey as m, clearDaemonState as n, libsodiumPublicKeyFromSecretKey as o, packageJson as p, decryptLegacy as q, readCredentials as r, encodeBase64Url as s, writeCredentialsLegacy as t, updateSettings as u, acquireDaemonLock as v, writeCredentialsDataKey as w, writeDaemonState as x, releaseDaemonLock as y, validateProfileForAgent as z };
+export { getProfileEnvironmentVariables as A, encryptLegacy as B, getRandomBytes as C, libsodiumEncryptForPublicKey as D, logger$1 as E, persistence as F, readSettings as a, clearCredentials as b, configuration as c, clearMachineId as d, encodeBase64 as e, encrypt as f, decrypt as g, decodeBase64 as h, isDebug as i, encryptWithDataKey as j, decryptWithDataKey as k, logger as l, readDaemonState as m, clearDaemonState as n, libsodiumPublicKeyFromSecretKey as o, packageJson as p, decryptLegacy as q, readCredentials as r, encodeBase64Url as s, writeCredentialsLegacy as t, updateSettings as u, acquireDaemonLock as v, writeCredentialsDataKey as w, writeDaemonState as x, releaseDaemonLock as y, validateProfileForAgent as z };

package/dist/{persistence-JLUn_Nou.cjs → persistence-DrfN7TzY.cjs}

@@ -35,7 +35,7 @@ function isDebug() {
 }
 
 var name = "@zonease/happy";
-var version = "0.6.39";
+var version = "0.6.41";
 var description = "Mobile and Web client for Claude Code, Codex, and Gemini";
 var author = "ZonEaseTech";
 var license = "MIT";

package/dist/push-CCOXCcM_.cjs

@@ -0,0 +1,80 @@
+'use strict';
+
+var promises = require('node:fs/promises');
+var socket_ioClient = require('socket.io-client');
+var logger = require('./persistence-DrfN7TzY.cjs');
+var ssh = require('./ssh-CBgVwKsB.cjs');
+require('node:fs');
+require('node:os');
+require('node:path');
+require('zod');
+require('node:crypto');
+require('tweetnacl');
+require('chalk');
+require('fs');
+require('./deviceKeys-BpIAWz13.cjs');
+require('axios');
+require('./auth-BQvEuSs5.cjs');
+require('qrcode-terminal');
+require('./time-Bj2HRkKH.cjs');
+require('./browser-C05SP_Tt.cjs');
+require('open');
+require('react');
+require('ink');
+require('./controlClient-DgELDZgM.cjs');
+require('./projectPath-ChLhdOyt.cjs');
+require('path');
+require('url');
+
+const CHUNK_BYTES = 8 * 1024 * 1024;
+async function pushToDevice(credentials, query, localPath, remotePath) {
+  const resolved = await ssh.resolveDeviceForCommand(credentials, query);
+  if (!resolved) return 1;
+  const { device, key, variant } = resolved;
+  const info = await promises.stat(localPath).catch(() => null);
+  if (!info?.isFile()) {
+    console.error(`Not a file: ${localPath}`);
+    return 1;
+  }
+  const contents = await promises.readFile(localPath);
+  const socket = socket_ioClient.io(logger.configuration.serverUrl, {
+    auth: { token: credentials.token, clientType: "user-scoped" },
+    path: "/v1/updates",
+    transports: ["websocket"]
+  });
+  await new Promise((resolve, reject) => {
+    socket.once("connect", () => resolve());
+    socket.once("connect_error", reject);
+  });
+  const writeChunk = async (path, chunk) => {
+    const answer = await socket.timeout(12e4).emitWithAck("rpc-call", {
+      method: `${device.id}:writeFile`,
+      params: logger.encodeBase64(logger.encrypt(key, variant, { path, content: chunk.toString("base64") }))
+    });
+    if (!answer?.ok) throw new Error(answer?.error || "writeFile failed");
+    const result = logger.decrypt(key, variant, logger.decodeBase64(answer.result));
+    if (!result?.success) throw new Error(result?.error || "Device refused the write");
+  };
+  try {
+    if (contents.length <= CHUNK_BYTES) {
+      await writeChunk(remotePath, contents);
+      console.error(`pushed ${contents.length} bytes to ${device.name}:${remotePath}`);
+      return 0;
+    }
+    const parts = Math.ceil(contents.length / CHUNK_BYTES);
+    for (let i = 0; i < parts; i++) {
+      await writeChunk(`${remotePath}.part-${i}`, contents.subarray(i * CHUNK_BYTES, (i + 1) * CHUNK_BYTES));
+      console.error(`  part ${i + 1}/${parts}`);
+    }
+    console.error(`pushed ${contents.length} bytes to ${device.name}:${remotePath}.part-0..${parts - 1}`);
+    console.error(`join with: cat '${remotePath}'.part-* > '${remotePath}' && rm -f '${remotePath}'.part-*`);
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  } finally {
+    socket.close();
+  }
+}
+
+exports.pushToDevice = pushToDevice;

package/dist/push-USXj_pv0.mjs

@@ -0,0 +1,78 @@
+import { stat, readFile } from 'node:fs/promises';
+import { io } from 'socket.io-client';
+import { c as configuration, e as encodeBase64, f as encrypt, g as decrypt, h as decodeBase64 } from './persistence-CIUFyOwz.mjs';
+import { resolveDeviceForCommand } from './ssh-B0hvEYIl.mjs';
+import 'node:fs';
+import 'node:os';
+import 'node:path';
+import 'zod';
+import 'node:crypto';
+import 'tweetnacl';
+import 'chalk';
+import 'fs';
+import './deviceKeys-CejCdWpw.mjs';
+import 'axios';
+import './auth-DS8fzlin.mjs';
+import 'qrcode-terminal';
+import './time-DgsBLJA_.mjs';
+import './browser-C05Ak6RL.mjs';
+import 'open';
+import 'react';
+import 'ink';
+import './controlClient-DgjVRN8D.mjs';
+import './projectPath-BTBIMB57.mjs';
+import 'path';
+import 'url';
+
+const CHUNK_BYTES = 8 * 1024 * 1024;
+async function pushToDevice(credentials, query, localPath, remotePath) {
+  const resolved = await resolveDeviceForCommand(credentials, query);
+  if (!resolved) return 1;
+  const { device, key, variant } = resolved;
+  const info = await stat(localPath).catch(() => null);
+  if (!info?.isFile()) {
+    console.error(`Not a file: ${localPath}`);
+    return 1;
+  }
+  const contents = await readFile(localPath);
+  const socket = io(configuration.serverUrl, {
+    auth: { token: credentials.token, clientType: "user-scoped" },
+    path: "/v1/updates",
+    transports: ["websocket"]
+  });
+  await new Promise((resolve, reject) => {
+    socket.once("connect", () => resolve());
+    socket.once("connect_error", reject);
+  });
+  const writeChunk = async (path, chunk) => {
+    const answer = await socket.timeout(12e4).emitWithAck("rpc-call", {
+      method: `${device.id}:writeFile`,
+      params: encodeBase64(encrypt(key, variant, { path, content: chunk.toString("base64") }))
+    });
+    if (!answer?.ok) throw new Error(answer?.error || "writeFile failed");
+    const result = decrypt(key, variant, decodeBase64(answer.result));
+    if (!result?.success) throw new Error(result?.error || "Device refused the write");
+  };
+  try {
+    if (contents.length <= CHUNK_BYTES) {
+      await writeChunk(remotePath, contents);
+      console.error(`pushed ${contents.length} bytes to ${device.name}:${remotePath}`);
+      return 0;
+    }
+    const parts = Math.ceil(contents.length / CHUNK_BYTES);
+    for (let i = 0; i < parts; i++) {
+      await writeChunk(`${remotePath}.part-${i}`, contents.subarray(i * CHUNK_BYTES, (i + 1) * CHUNK_BYTES));
+      console.error(`  part ${i + 1}/${parts}`);
+    }
+    console.error(`pushed ${contents.length} bytes to ${device.name}:${remotePath}.part-0..${parts - 1}`);
+    console.error(`join with: cat '${remotePath}'.part-* > '${remotePath}' && rm -f '${remotePath}'.part-*`);
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  } finally {
+    socket.close();
+  }
+}
+
+export { pushToDevice };

package/dist/{run-BDn2aE3Q.cjs → run-D3CopmEb.cjs}

@@ -3,14 +3,15 @@
 var fs$1 = require('fs/promises');
 var os = require('os');
 var tmp = require('tmp');
-var api = require('./api-CwOCQeLH.cjs');
-var logger = require('./persistence-JLUn_Nou.cjs');
-var auth = require('./auth-BIleVCw0.cjs');
+var api = require('./api-XeHlmApX.cjs');
+var logger = require('./persistence-DrfN7TzY.cjs');
+var auth = require('./auth-BQvEuSs5.cjs');
 var child_process = require('child_process');
-var doctor = require('./doctor-Cya9YSA0.cjs');
-var spawnHappyCLI = require('./spawnHappyCLI-D_V-AAoP.cjs');
-var controlClient = require('./controlClient-DZMIsKsT.cjs');
-var install = require('./install-BokHRgFW.cjs');
+var doctor = require('./doctor-DznasgP3.cjs');
+var spawnHappyCLI = require('./spawnHappyCLI-CarRI4GM.cjs');
+var controlClient = require('./controlClient-DgELDZgM.cjs');
+var deviceKeys = require('./deviceKeys-BpIAWz13.cjs');
+var install = require('./install-Ck22tYHP.cjs');
 var fastify = require('fastify');
 var fs = require('node:fs');
 var promises = require('node:fs/promises');
@@ -182,7 +183,8 @@ function startDaemonControlServer({
   stopSession,
   spawnSession,
   requestShutdown,
-  onHappySessionWebhook
+  onHappySessionWebhook,
+  execOnDevice
 }) {
   return new Promise((resolve) => {
     const app = fastify({
@@ -288,6 +290,23 @@ function startDaemonControlServer({
         }))
       };
     });
+    typed.post("/device-exec", {
+      schema: {
+        body: z.z.object({
+          deviceId: z.z.string(),
+          command: z.z.string(),
+          timeoutMs: z.z.number().optional()
+        })
+      }
+    }, async (request, reply) => {
+      const { deviceId, command, timeoutMs } = request.body;
+      logger.logger.debug(`[CONTROL SERVER] Device exec request for ${deviceId}`);
+      try {
+        return { ok: true, result: await execOnDevice(deviceId, command, timeoutMs ?? 3e5) };
+      } catch (error) {
+        return reply.code(200).send({ ok: false, error: error instanceof Error ? error.message : String(error) });
+      }
+    });
     typed.post("/stop-session", {
       schema: {
         body: z.z.object({
@@ -1996,12 +2015,28 @@ ${error.message}
       }
       pidToTrackedSession.delete(pid);
     };
+    let connectedMachine = null;
     const { port: controlPort, stop: stopControlServer } = await startDaemonControlServer({
       getChildren: getCurrentChildren,
       stopSession,
       spawnSession,
       requestShutdown: () => requestShutdown("happy-cli"),
-      onHappySessionWebhook
+      onHappySessionWebhook,
+      execOnDevice: async (deviceId, command, timeoutMs) => {
+        if (!connectedMachine) {
+          throw new Error("Daemon is not connected yet");
+        }
+        const material = await deviceKeys.readCachedDeviceKey(deviceId);
+        if (!material) {
+          throw new Error(`No cached key for device ${deviceId}`);
+        }
+        return await deviceKeys.deviceExec(connectedMachine.rpcSocket, credentials, deviceId, command, {
+          deviceKeyBase64: logger.encodeBase64(material.key),
+          deviceKeyVariant: material.variant,
+          timeout: timeoutMs,
+          skipMachineLookup: true
+        });
+      }
     });
     const fileState = {
       pid: process.pid,
@@ -2035,6 +2070,7 @@ ${error.message}
       orchestratorCancel: handleOrchestratorCancel
     });
     apiMachine.connect();
+    connectedMachine = apiMachine;
     apiMachine.updateMachineMetadata((current) => ({ ...current, ...machineMetadata })).catch((error) => {
       logger.logger.debug("[DAEMON RUN] Failed to update machine metadata", error);
     });

package/dist/{run-DBZqN6Kn.mjs → run-Dy6KX6m-.mjs}

@@ -1,14 +1,15 @@
 import fs from 'fs/promises';
 import os from 'os';
 import * as tmp from 'tmp';
-import { A as ApiClient } from './api-CIZKyfSn.mjs';
-import { c as configuration, l as logger, p as packageJson, v as acquireDaemonLock, a as readSettings, i as isDebug, x as writeDaemonState, j as readDaemonState, y as releaseDaemonLock, z as validateProfileForAgent, A as getProfileEnvironmentVariables } from './persistence-BFjvtUad.mjs';
-import { authAndSetupMachineIfNeeded } from './auth-BE8dD20T.mjs';
+import { A as ApiClient } from './api-K2-jr9ar.mjs';
+import { c as configuration, l as logger, p as packageJson, v as acquireDaemonLock, a as readSettings, i as isDebug, e as encodeBase64, x as writeDaemonState, m as readDaemonState, y as releaseDaemonLock, z as validateProfileForAgent, A as getProfileEnvironmentVariables } from './persistence-CIUFyOwz.mjs';
+import { authAndSetupMachineIfNeeded } from './auth-DS8fzlin.mjs';
 import { spawn, execSync, exec } from 'child_process';
-import { getEnvironmentInfo } from './doctor-DZYB6IVc.mjs';
-import { s as spawnHappyCLI } from './spawnHappyCLI-CoORX0YW.mjs';
-import { isDaemonRunningCurrentlyInstalledHappyVersion, stopDaemon, cleanupDaemonState } from './controlClient-CM_QcJnB.mjs';
-import { P as PLIST_LABEL } from './install-oRAjVLjP.mjs';
+import { getEnvironmentInfo } from './doctor-B-LCMVN9.mjs';
+import { s as spawnHappyCLI } from './spawnHappyCLI-D3EkTFIn.mjs';
+import { isDaemonRunningCurrentlyInstalledHappyVersion, stopDaemon, cleanupDaemonState } from './controlClient-DgjVRN8D.mjs';
+import { a as readCachedDeviceKey, d as deviceExec } from './deviceKeys-CejCdWpw.mjs';
+import { P as PLIST_LABEL } from './install-B3mMGISS.mjs';
 import fastify from 'fastify';
 import { createReadStream } from 'node:fs';
 import { stat } from 'node:fs/promises';
@@ -161,7 +162,8 @@ function startDaemonControlServer({
   stopSession,
   spawnSession,
   requestShutdown,
-  onHappySessionWebhook
+  onHappySessionWebhook,
+  execOnDevice
 }) {
   return new Promise((resolve) => {
     const app = fastify({
@@ -267,6 +269,23 @@ function startDaemonControlServer({
         }))
       };
     });
+    typed.post("/device-exec", {
+      schema: {
+        body: z.object({
+          deviceId: z.string(),
+          command: z.string(),
+          timeoutMs: z.number().optional()
+        })
+      }
+    }, async (request, reply) => {
+      const { deviceId, command, timeoutMs } = request.body;
+      logger.debug(`[CONTROL SERVER] Device exec request for ${deviceId}`);
+      try {
+        return { ok: true, result: await execOnDevice(deviceId, command, timeoutMs ?? 3e5) };
+      } catch (error) {
+        return reply.code(200).send({ ok: false, error: error instanceof Error ? error.message : String(error) });
+      }
+    });
     typed.post("/stop-session", {
       schema: {
         body: z.object({
@@ -1975,12 +1994,28 @@ ${error.message}
       }
       pidToTrackedSession.delete(pid);
     };
+    let connectedMachine = null;
     const { port: controlPort, stop: stopControlServer } = await startDaemonControlServer({
       getChildren: getCurrentChildren,
       stopSession,
       spawnSession,
       requestShutdown: () => requestShutdown("happy-cli"),
-      onHappySessionWebhook
+      onHappySessionWebhook,
+      execOnDevice: async (deviceId, command, timeoutMs) => {
+        if (!connectedMachine) {
+          throw new Error("Daemon is not connected yet");
+        }
+        const material = await readCachedDeviceKey(deviceId);
+        if (!material) {
+          throw new Error(`No cached key for device ${deviceId}`);
+        }
+        return await deviceExec(connectedMachine.rpcSocket, credentials, deviceId, command, {
+          deviceKeyBase64: encodeBase64(material.key),
+          deviceKeyVariant: material.variant,
+          timeout: timeoutMs,
+          skipMachineLookup: true
+        });
+      }
     });
     const fileState = {
       pid: process.pid,
@@ -2014,6 +2049,7 @@ ${error.message}
       orchestratorCancel: handleOrchestratorCancel
     });
     apiMachine.connect();
+    connectedMachine = apiMachine;
     apiMachine.updateMachineMetadata((current) => ({ ...current, ...machineMetadata })).catch((error) => {
       logger.debug("[DAEMON RUN] Failed to update machine metadata", error);
     });