Install the client

Install the client on the machine where your coding agent runs, so that every covered action is decided before it executes. The client installs at user scope and needs no administrator rights. Pick the command that matches the machine.

Node.js

On any machine that already has Node.js:

npx @openlatch/client init

Node.js is needed by npx only. The client itself is a native binary and does not run on Node.js.

macOS and Linux

No runtime required:

curl -LsSf https://openlatch.ai/install.sh | sh

Windows

No runtime required:

powershell -ExecutionPolicy Bypass -c "irm https://openlatch.ai/install.ps1 | iex"

Each command installs the same client build from the npm registry, then runs openlatch init, which detects the coding agents on the machine, wires their hooks and starts the client.

Enroll the machine

1. On a machine where you sit at a terminal, openlatch init opens app.openlatch.ai in your browser when the machine has no credential yet. Sign in, and the client stores the credential in the operating system’s keychain.
2. On a machine with no one at the terminal, create an API key on the API Keys page of your console account first, and set it as OPENLATCH_API_KEY before you run the install command.
3. Run openlatch status and check that each agent is listed with its control level.

Note

The download is integrity-checked against the registry’s own digest. That detects corruption and truncation, not a compromised registry.

Check the hooks

Run openlatch doctor. It diagnoses the configuration and the connection to the platform, and for anything that is not healthy it names the cause and the command that fixes it.

What the install changes

• It installs for your user only. No administrator rights are needed.
• With a script, it places two binaries, openlatch and openlatch-hook, in ~/.local/bin on macOS and Linux, or in %LOCALAPPDATA%\openlatch\bin on Windows, and adds that folder to your PATH. A terminal that was already open may need to be reopened once.
• With npx, nothing is added to your PATH: the client keeps its binaries under its state directory, so a bare openlatch may not be found. Run later commands through the same npx command, with the command you want in place of init, for example status.
• It compares a SHA-512 digest of the download with the digest the registry publishes for that release before it installs anything.

Exit status

For deployment tools that read the exit status of an install script:

Status	Meaning
0	Installed and set up. The result may still name one thing to look at
6	Installed, but setup did not finish. The result on screen says why
7	Installed and waiting for an AI agent: none is on the machine yet. Install one and run the script again
2–5	Nothing usable was installed. The script prints an OL-21xx code naming the reason

Supported platforms

Platform	Status
macOS, Apple silicon and Intel	Supported
Linux with glibc, x86_64 and arm64	Supported
Windows, x64	Supported
Linux with musl, such as Alpine	Not supported. The install script stops and names the reason
Windows on ARM64	Not supported. The install script stops and names the reason

Next, write your first policy.