CLI reference

Every command and subcommand of the OpenLatch client.

`openlatch init`

openlatch setup

Installs the hooks of the agents found on this machine, starts the daemon and checks that it answers. Safe to run again: it frees the client's ports first, then confirms that the daemon it started is the one serving.

`openlatch status`

Shows the daemon's state, its uptime and event counts, the health of each part of the client, and the license line: its state, hosts, fair use and contract end.

`openlatch start`

Starts the daemon. Refuses with OL-1501 when a daemon already runs on this machine.

`openlatch stop`

Stops the daemon. It also removes the agents' model relay wiring, and says so.

`openlatch restart`

Stops the daemon and starts it again, for example to apply a configuration change.

`openlatch logs`

Shows the client's event log.

`openlatch doctor`

Diagnoses the client's configuration and connectivity, and gives the cause and the remedy of every problem it finds. --fix applies the repairs it can, --restore undoes them, and --rescue writes a diagnostic file for support.

`openlatch uninstall`

Removes the agents' hooks and stops the daemon. --agent limits it to the agents you name.

`openlatch docs`

Opens the documentation in your browser.

`openlatch system`

Groups the commands that inspect or control one part of the client: aip, auth, hooks, model-relay, proxy, supervision, telemetry and inventory. Every remedy openlatch doctor gives names the exact system command to run.

`openlatch system aip`

Fetches and inspects the policy bundle resident on this machine, which holds the Autonomy Zone rules the client enforces.

`openlatch system aip refresh`

openlatch system aip update

Makes the running daemon fetch the policy bundle now, and waits up to 15 seconds for the result: changed, unchanged, pending, refused or offline, with the facts of the bundle in use. A pending result exits with code 7; a refusal or an offline daemon exits with code 1.

`openlatch system auth`

Groups the commands that connect the client to the platform.

`openlatch system auth login`

Signs the client in to the platform through your browser and stores the credential in the operating system's keychain.

`openlatch system auth logout`

Signs the client out and removes the stored credential.

`openlatch system auth status`

Shows whether the client is signed in, and where its credential comes from.

`openlatch system auth switch`

Moves this machine to another of your organizations.

`openlatch system hooks`

Groups the commands that manage agent hooks. system hooks install is the same as openlatch init.

`openlatch system hooks install`

Installs the agents' hooks; the same as openlatch init.

`openlatch system hooks uninstall`

Removes the agents' hooks; the same as openlatch uninstall.

`openlatch system hooks status`

Shows the hooks installed for each agent, in detail.

`openlatch system model-relay`

Groups the commands that inspect or switch the model relay, the local listener that records each agent's model calls.

`openlatch system model-relay status`

Reports whether the model relay is up, its port, and whether each agent's model calls go through it. An agent whose hooks work but whose model calls are not recorded reads as enforced, not measured.

`openlatch system model-relay enable`

Turns the model relay on in the configuration, then offers to restart the daemon to apply it.

`openlatch system model-relay disable`

Turns the model relay off in the configuration, then offers to restart the daemon to apply it.

`openlatch system model-relay explain`

Prints a model relay record by its id, read from local storage. Its content never leaves the machine.

`openlatch system proxy`

Groups the commands that inspect, discover, set or test the proxy every outbound request takes.

`openlatch system proxy status`

Shows the route outbound requests take, for the CLI and, when it differs, for the daemon.

`openlatch system proxy discover`

Runs the operating system's proxy discovery again, tests each candidate and keeps the one that works.

`openlatch system proxy set`

Sets the proxy by hand. A proxy set this way is never replaced by discovery or automatic repair.

`openlatch system proxy clear`

Removes the proxy and its credential, so requests go directly to their destination.

`openlatch system proxy test`

Tests the route step by step: the proxy connection, TLS, HTTP and a streamed response.

`openlatch system supervision`

Groups the commands that manage the operating-system supervisor (launchd, systemd or Task Scheduler) that starts the daemon at login and restarts it. Everything stays at user scope.

`openlatch system supervision install`

Installs the operating-system supervisor, so the daemon starts at login and after a reboot.

`openlatch system supervision uninstall`

Removes the operating-system supervisor. The daemon keeps running but no longer starts on its own.

`openlatch system supervision status`

Shows whether the supervisor is installed and running, and which one this system uses.

`openlatch system supervision enable`

Turns supervision back on after disable, and installs the supervisor again.

`openlatch system supervision disable`

Removes the supervisor and records that supervision is off on this machine.

`openlatch system telemetry`

Groups the commands that manage usage telemetry, which you can turn off.

`openlatch system telemetry status`

Shows whether usage telemetry is on, which setting decides it, and whether this build includes it.

`openlatch system telemetry enable`

Turns usage telemetry on.

`openlatch system telemetry disable`

Turns usage telemetry off.

`openlatch system telemetry purge`

Turns usage telemetry off and empties the queue of unsent events in a running daemon.

`openlatch system telemetry debug`

Shows how to run any command so it prints the telemetry events it would send.

`openlatch system inventory`

Groups the commands that inspect the configuration plane: the agent configuration sources the client watches, their change events, rescans and the watcher's health.

`openlatch system inventory list`

Lists the configuration sources the client watches, from the local audit log.

`openlatch system inventory log`

Shows the configuration change events in the local audit log.

`openlatch system inventory rescan`

Rescans every watched configuration source now.

`openlatch system inventory status`

Reports the configuration watcher's health: whether it is on, whether its list of sources loaded, and how many sources it holds.

`openlatch system inventory inspect`

Shows one configuration source in detail: its current fingerprint and its pending alerts.

`openlatch system inventory projects`

Lists the project folders the client knows from the configuration files it watches.

`openlatch system inventory ack`

Acknowledges a pending configuration alert, so the agent is no longer reminded of it.

`openlatch update`

Checks for a new client version. On a terminal, it then asks whether to install it, and installs it if you accept. Without a terminal (a script, a pipe, a management tool), it only reports the release. --yes installs without asking; --check only checks.

Error codes

Every code the client can print, with what happened and what to do.