Overview

Device Genie lets your IT team run scripts and install or remove software on employee laptops and desktops directly from Leena AI — without VPN, remote sessions, or physically touching the machine.

This page explains how it works, what gets installed on a device, and what permissions are required.

---

What you can do

• Run scripts remotely on Windows and macOS devices — diagnostics, configuration changes, cleanup tasks.
• Deploy software from a managed catalog, with separate install and uninstall steps.
• See your device fleet — hardware, operating system, and whether each device is currently online.
• Target people, not machines — trigger an action for an employee and Device Genie finds their device.
• Watch it happen — live status and terminal output stream back to the dashboard as the task runs.
• Automate it — trigger the same actions from Workflows or an AI Colleague, so employees can self-serve common IT requests.

---

How it works

Device Genie has three parts.

graph LR
    A["<b>Admin dashboard</b><br/>Your IT team creates scripts<br/>and software, and triggers them"]
    B["<b>Leena AI cloud</b><br/>Stores the catalog, decides<br/>what runs where, keeps the audit trail"]
    C["<b>Leena desktop app</b><br/>Installed on each device.<br/>Runs the task and reports back"]

    A <--> B
    B <--> C

The admin dashboard is where your IT team builds and manages everything: the script and software catalog, device mappings, reports, and settings.

The Leena AI cloud service holds the catalog, resolves which device a request belongs to, dispatches the work, and records every execution.

The Leena desktop app runs quietly in the background on each managed device. It keeps a secure connection open to Leena AI, waits for work, performs it, and sends back the result.

The connection is always made outward, from the device to Leena AI. Nothing connects into your devices, and no ports need to be opened.

---

Key concepts

Test before you publish

New scripts and software start as drafts and can only be run in test mode. A draft can only be published after it has run successfully on a real test device. Once published, an asset is locked — editing it creates a new version instead of changing the old one, so every past execution stays traceable to exactly what ran.

---

How an automation runs

1. An admin (or a workflow) triggers a script or software task for an employee or device.
2. Leena AI identifies the right device and prepares the task.
3. The task is sent to the desktop app on that device.
4. The app downloads anything it needs and runs the task in the security context you specified.
5. Output and status stream back live to the dashboard.
6. The final result — success, failure, exit code, and full logs — is stored for auditing.

If the device is offline, the task simply waits. As soon as the device comes back online, it picks the task up automatically. Tasks only expire if the device stays offline past the expiry window you configure.

Statuses you will see: Pending → Queued → Preparing → In progress → Success / Failed / Cancelled / Expired.

---

Connecting employees to their devices

Device Genie needs to know which device belongs to which employee. You can choose how this happens:

---

Desktop app requirements and permissions

This is the section most IT and security teams need before rollout.

Installation

The installer registers a background service that starts automatically with the machine. Because of this, Device Genie cannot be installed by a standard user or as a per-user install. In managed environments, deploy it through your usual device management tool (Intune, Jamf, or similar) so elevation is handled for the employee.

Privileges while running

The background service runs with system-level privileges — this is what allows it to install software and apply configuration changes even when nobody is logged in.

When you create a script or software item, you choose how it should run:

Interactive and standard-user tasks require an employee to be signed in. If nobody is signed in, the task fails clearly rather than running in the wrong context.

Signing and trust

• The macOS app is signed with an Apple Developer ID, built with Apple's hardened runtime, and notarized by Apple.
• The Windows installer is signed with a hardware-backed code signing certificate and timestamped.

Permissions the app does not request

Device Genie does not request Full Disk Access, Screen Recording, or Accessibility permissions on macOS. If a script you write needs access to a protected area, that permission must be granted separately through your own device management tool.

The macOS app does declare microphone access — this is used only by the voice and speech-to-text features of the Leena chat experience, not by IT Automation.

Network requirements

The desktop app only makes outbound connections on HTTPS/WSS port 443, to:

• Leena AI's service endpoints for your region
• Your configured cloud storage, to download software installers
• The app's update location, to download new versions

No inbound ports are required and no VPN is needed. If you use a proxy, it must allow secure WebSocket connections so the app can receive tasks in real time.

What the app collects from a device

• Hardware and system details: manufacturer, model, serial number, processor, memory, storage, graphics, BIOS, and installed operating system version.
• Network details: network adapters, IP and MAC addresses.
• Sign-in sessions: the local usernames currently signed in, used to map devices to employees.
• Execution output: the logs and exit code of each task you run, plus processor and memory usage during the run.

The app does not read employee documents, browsing activity, or application content.

What the app stores on the device

• A small local database holding task results that have not yet been confirmed by Leena AI. This ensures no result is lost if the device goes offline or restarts mid-task.
• A temporary working folder for each task, containing the script and any downloaded installers. This folder is cleared automatically every time the service starts.

---

Utilities used on the device

Device Genie uses a small set of standard, well-known utilities rather than custom low-level code.

Bundled with the app

Built into the operating system

Software installers themselves are downloaded to the device at run time and removed with the working folder.

---

Reliability

• Nothing is lost. Results are saved on the device first and only cleared once Leena AI confirms receipt. If the network drops mid-task, the result is delivered as soon as connectivity returns.
• Offline devices catch up. Pending tasks are picked up automatically on the next reconnect, including after sleep or a reboot.
• One task at a time. Tasks run in sequence on a device, so installers never conflict with each other.
• Updates never interrupt work. If the app needs to update itself while a task is running, it waits until the task finishes.
• Fleet-friendly. Devices stagger their reconnections, so a site-wide reboot or morning wake-up doesn't create a traffic spike.
• Configurable safety limits. You control how long a task may run, how long it stays valid if a device is offline, and how often failed attempts are retried.

---

Security and governance

• Every device authenticates before it can receive any task.
• All data is scoped to your organization; one customer's devices, catalog, and reports are never visible to another.
• Only published assets can be run in production, and publishing requires a successful real-world test.
• Published assets are version-locked — changes create a new version, so audit history always reflects what actually ran.
• Every execution is recorded with who triggered it, the exact content that ran, the target device, the full output, and the outcome.
• Administrative actions in the module are captured in the platform audit trail.
• Installers are code-signed on both platforms, and the macOS app is notarized by Apple.