OpenLatch is the execution control layer for enterprise AI agents. It turns human intent into Agent Intent Policies across each agent's Autonomy Zone — security, safety, compliance, economics and quality — and makes a deterministic decision on every covered action before it executes: allow, ask, block or optimize.

This repository is its capture-and-enforce adapter: the node that runs inside a coding agent's own execution path, evaluates every covered action against that agent's Autonomy Zone before it runs, and is what gives an agent the control level Enforced.

It plugs into the agent's native lifecycle hooks, decides locally and in-process, and forwards what it saw to the platform afterwards. The agent never waits on the network, and the verdict never depends on it.

Quick start

npx @openlatch/client init   # installs the client, detects your agents, wires their hooks
openlatch system auth login         # links this machine to your OpenLatch account (opens the browser)
claude                       # use your agent as usual — every tool call is now covered
codex                        # … and the other one, under the same policy on the same host

openlatch status shows what is captured and enforced on this host. The dashboard shows the events and the verdicts. Full walkthrough: Getting started. In several organizations? Sign-in asks which one this machine joins, --org <slug> names it, and openlatch system auth switch --org <slug> moves it later (details).

npx needs Node.js. On a machine without it, use the script for your platform — no runtime required. macOS, Windows and Linux are supported.

# macOS, Linux
curl -LsSf https://openlatch.ai/install.sh | sh
# Windows
powershell -ExecutionPolicy Bypass -c "irm https://openlatch.ai/install.ps1 | iex"

How it works

┌─────────────────────────────────────────────────────────────────┐
│  Developer's machine                                            │
│                                                                 │
│  ┌──────────┐  hook event   ┌──────────────────────────────┐    │
│  │  Coding  │──────────────▶│   OpenLatch client           │    │
│  │  agent   │               │   (127.0.0.1)                │    │
│  │          │               │                              │    │
│  │          │               │   1. Wrap in envelope        │    │
│  │          │               │   2. Evaluate resident       │    │
│  │          │               │      policy in-process       │    │
│  │          │  ◀─ verdict ──│   3. Redact credentials      │    │
│  └──────────┘               │   4. Write local audit log   │    │
│                             │   5. Batch → forward         │────┼──▶  OpenLatch platform
│                             │      ◀── policy bundle       │◀───┼──   (policies, analysis,
│                             └──────────────────────────────┘    │      dashboard)
└─────────────────────────────────────────────────────────────────┘

• Inside the agent, not a proxy in front of it. The decision point is the agent's own hook lifecycle, so it sees the action rather than the traffic. Model calls additionally pass through a loopback listener, so cost and token usage are measured on the same host.
• Local-authoritative. The resident policy bundle is the authority, not a cache of one. Evaluation reads an in-memory handle and returns.
• Fail-static, not fail-open. A resident bundle keeps enforcing offline, forever. A failed refresh keeps the last known good.
• Privacy-first. Credentials are redacted locally before anything leaves the machine.

What a verdict does

The verdict vocabulary is Allow, Ask, Block or Optimize. What this client can express today is narrower than the vocabulary, and this is the honest map of it. A verdict is deterministic because an explicit policy produced it.

| Verdict | On the wire / in the bundle | What this client does today | | ------- | --------------------------- | ------------------------- | | Allow | allow, approve | The action proceeds. approve is a user-confirmed allow | | Ask | No wire variant — an allow / approve carrying context | It allows and flags; it does not hold the agent waiting on a human. Claude Code renders it as permissionDecision: "ask" with the alert as its reason; Codex CLI has no ask tier, so it degrades to a systemMessage carrying that same reason. It prevents recurrence, not the first occurrence | | Block | deny — the only action a kind=command rule may take | Reaches the agent as a native deny at pre_tool_use, naming the rule that produced it | | Optimize | kind=request rules: prefix_reorder, history_trim, prompt_edit | Measurement only. Out of the box the model relay observes, reports what a transform would have saved, and forwards the original bytes |

Each rule runs in Monitor (record the match, allow the action) or Enforce (apply the verdict). Most restrictive wins across matching rules.

Supported agents

Three agents are wired end-to-end: Claude Code, OpenAI Codex CLI and Cline. init detects every agent on the host and wires all of them — coverage is the default, and --agent <type> is how you opt one out. doctor, status and uninstall each report and tear down every agent they find.

Coverage is stated per agent and per plane. An unqualified "Enforced" would round an enforced command plane and an observe-only request plane back up to green, and that is the one arithmetic this table refuses.

| Agent | Delivery | Command plane | Request plane | Control level | | ----- | -------- | ------------- | ------------- | ------------- | | Claude Code | any | Enforced | Observed (runtime-checked) | Enforced (command plane) | | Codex CLI | managed (MDM / system / cloud) | Enforced, and not disableable by the developer | Observed (runtime-checked) | Enforced (command plane) | | Codex CLI | self-serve (npx init) | Monitored until /hooks trust; Enforced after | Observed (runtime-checked) | Monitored → Enforced | | Cline | any | Monitored; Enforced where Cline loads the OpenLatch plugin | Observed per provider, from the editor's next start (runtime-checked) | Monitored → Enforced |

The vocabulary is closed. Enforced — the verdict reaches the agent and is obeyed. Monitored — the integration is installed and events flow, but a verdict cannot yet be delivered, so nothing is prevented. Observed — capture and would-have measurement only, by design for this phase. Known — identified and classified, with the limits stated.

Why Codex has two rows. A user-level Codex hook is marked for review and skipped until trusted, so a fresh self-serve install is Monitored — not Enforced — until you run /hooks in Codex and trust the OpenLatch hook. Any re-install that changes the hook command re-arms that review. On the managed path the hook is trusted by policy and cannot be switched off by the developer, which is a stronger claim than we can make on Claude Code. openlatch doctor proves the hook by invoking it rather than by observing that a file exists, and reports the trust state per agent — an untrusted hook is never spawned, and that is the one failure that looks identical to working from the outside.

Why Cline's request plane starts later. Cline keeps a base URL per provider and the running editor holds the one it read at start, so OpenLatch gives each configured provider its own loopback endpoint and VS Code uses it from its next start. Providers Cline reaches through no setting, and Amazon Bedrock, are reported as not covered — see docs/configuration.md.

Making an agent Enforced is a hook binding plus a verdict translator. Both are contributions we welcome — see Contributing.

Behind a corporate proxy

init finds the route on its own: it probes what is already configured, then walks the OS's own proxy settings (Windows, macOS, GNOME), and only asks if none of them reach the platform. Kerberos/Negotiate uses the logged-on identity; a TLS-inspecting proxy needs only its root CA in ca_bundle. Proxy credentials go to an owner-only encrypted file, never to config.toml.

openlatch init --proxy http://proxy.corp:8080 --ca-bundle /etc/ssl/corp-root.pem
openlatch system proxy test        # walks the chain hop by hop and names the failing one

The hosts to open, every [proxy] key and every OL-122x code: docs/egress.md.

Configuration

openlatch init writes ~/.openlatch/config.toml, and every key has an OPENLATCH_* environment variable that overrides it. Precedence is CLI flags → environment → config.toml → defaults. The full list is in docs/configuration.md.

Documentation

| Where | What | | ----- | ---- | | docs.openlatch.ai | Installation, getting started, how it works, FAQ, privacy | | docs/configuration.md | Environment variables, config.toml, what the daemon writes into the agent's config | | docs/egress.md | Proxies, the hosts to open, Kerberos, troubleshooting codes | | docs/cli.md | Command reference, health reports, exit codes | | docs/evaluate-protocol.md | Legacy evaluation process frames, caller-owned session state, errors and diagnostics | | docs/intent-evaluate-protocol.md | The redesigned engine's openlatch evaluate protocol — frames, the 32 MiB frame cap, errors and the gated handshake | | CHANGELOG.md | What changed in each release |

Contributing

git clone https://github.com/OpenLatch/openlatch-client && cd openlatch-client
cargo build     # Rust 1.88+, no other prerequisites
cargo test

Never run a development build against your own install: openlatch init rewires every live agent session on the host. The Contributing Guide covers the sandbox that prevents it, the checks CI runs, Conventional Commits and the PR process; AGENTS.md states what the client does and what it deliberately does not.

Pick a good first issue, or join us on Slack.

Security

• Report vulnerabilities to [email protected]; private vulnerability reporting is enabled on this repository
• Every release binary carries a minisign signature, which the client verifies before it updates itself; macOS and Linux binaries also carry Sigstore signatures. What is and is not signed: SECURITY.md
• Binary replacement is also policy-cache safe. Self-update and the npm/npx launcher ask the candidate executable to load the exact resident bundle before activation and retain a previous evaluator/binary pair if it cannot. This proof is local and works offline; an update never fetches on the hook verdict path. npm launcher state lives under OPENLATCH_DIR as npm-launcher.json plus versioned npm-bin/ pairs.
• Full policy: SECURITY.md

License

This client is proprietary software, licensed for commercial use only under OpenLatch's commercial terms — see LICENSE and openlatch.ai. It is distributed through npm only.