Operate

Use this page once machines are enrolled: to keep the client current, to work with the records it keeps on each machine, and to remove it.

Updates

The client can check for a new version and update itself. The download is integrity-checked before anything on the machine is replaced: a SHA-512 digest is compared with the digest the package registry publishes for that release, so a corrupted or truncated download is never applied. The check detects corruption and truncation; it does not protect against a compromised registry. Leave automatic updating on for installs a developer runs themselves, where it keeps a machine current without anyone scheduling it.

A managed estate usually wants the version under its own control. Turn automatic updating off and leave the check on, so that a machine still reports that a newer version is available while it waits for your maintenance window. Then deliver the new version the way the client was first delivered, through the tooling that already manages the machine.

Variable	Set it to
OPENLATCH_AUTO_UPDATE	false stops the client from updating itself. Set it wherever you want the version pinned
OPENLATCH_UPDATE_CHECK	Leave it true, so openlatch status still reports that a newer version is available

Note

Replacing the files on disk does not by itself move the running client to the new version. The machine reports the mismatch until the client restarts, so end the window with openlatch restart, or with the sign-out and sign-in your estate already schedules.

Local records

The client keeps its configuration and its local records in one directory: ~/.openlatch on macOS and Linux, %APPDATA%\openlatch on Windows. OPENLATCH_DIR moves it. An estate that moves it should point its own collection and removal scripts at the same value.

Records are written with credentials masked, and file paths are masked the same way. Data handling and security lists what is captured, what is masked and how long each kind is kept. Records that have not reached the console yet are held in that directory and sent once the console is reachable again. The hold is bounded: past its size cap, 100 MB by default, the oldest unsent records are dropped and the daemon log records an OL-1204 warning. See the outbox and fallback settings in Configuration.

Open a support case

Run openlatch doctor on the affected machine first. It reports what it finds in plain terms. Then build the redacted archive with openlatch doctor --rescue: it holds the diagnosis, the configuration and a recent window of the local records. Send that archive, never the directory itself, with the operating system and the time of the problem with its time zone.

Contact your OpenLatch technical lead through the channel agreed with your organization. Send security reports to security@openlatch.ai.

Remove the client

To remove the client from a machine:

openlatch uninstall

To remove the client and the records it kept locally:

openlatch uninstall --purge

openlatch uninstall unwires the client from every agent it finds on the machine and stops it. Each agent is left as it was before the install, and settings OpenLatch did not write are not touched. The configuration and the local records stay on disk unless you ask for them to go.

--purge also deletes that directory and the credential held in the operating system’s credential store. It refuses any directory that is not the client’s own, and it resolves symbolic links before it deletes, so a link cannot redirect the delete elsewhere. An estate that moves the directory should keep the same check in its own removal script.

Neither command deletes the client’s own files. They were installed outside the state directory, so a purge leaves them on the machine, along with the PATH line the install added. To take the client off a machine completely, delete the two files the install placed, openlatch and openlatch-hook in ~/.local/bin on macOS and Linux, or openlatch.exe and openlatch-hook.exe in %LOCALAPPDATA%\openlatch\bin on Windows. Leave the directory and anything else in it: other software may use it. On Windows, the directory belongs to the client, so you can also remove it and the PATH entry the install added; on macOS and Linux, keep the PATH line if other tools rely on ~/.local/bin. There is no uninstall script, so an estate that wants this done for it does it through the tooling that installed the client.

Removal is per machine. Nothing has to be undone in the console for a machine that has been uninstalled, and a machine that comes back is installed the same way as the first time.

In short

• Leave automatic updating on for developer installs. Pin it with OPENLATCH_AUTO_UPDATE=false on a managed estate, and keep the check on so a machine still reports what it is missing.
• A new version takes effect when the client restarts: end the maintenance window with openlatch restart or a sign-out and sign-in.
• Configuration and local records sit in one directory. A support case opens with the redacted archive from openlatch doctor --rescue.
• openlatch uninstall leaves each agent as it was. --purge also removes the directory and the stored credential, and leaves the two installed files, which a full removal deletes separately.