CLI

Command	What it does
latet version	Print the Latet version.
latet serve	Run the gateway in the foreground.
latet start	Start the background daemon (no-op when it is already running).
latet stop	Stop the background daemon.
latet status	Show whether the local daemon runs, or the connected server accepts this computer’s token.
latet env	Print the environment variables that route a client through Latet.
latet dashboard	Open the dashboard here or on the connected server: what reached the model, and how it was masked.
latet claude	Run Claude Code through Latet, for this session only (plugin + verify-only gateway); arguments pass through.
latet codex	Run the Codex CLI through Latet, for this session only; arguments pass through.
latet opencode	Run OpenCode through Latet, for this session only (API-key providers); arguments pass through.
latet gemini	Run Gemini CLI through Latet, for this session only (an API key or Vertex AI); arguments pass through.
latet run	Run a script or tool with OPENAI_BASE_URL, ANTHROPIC_BASE_URL and GOOGLE_GEMINI_BASE_URL pointing at Latet.
latet reload	Apply the configuration file to the running daemon, without a restart.
latet doctor	Check the daemon, the plugin bridge, masking and the agent integrations.
latet global-uninstall	Take Latet out of your agents for good: what latet global-install did, undone.
latet upgrade	Install the latest release of Latet from GitHub, with local name detection and the text in images.
latet global-install	Route your agents through Latet for good: every session, in the terminal and in the IDE.
latet backup	Save your installation in one file, encrypted with a passphrase: to move it to another machine.
latet restore	Restore a backup here: your settings, and the vault with its key when it holds them.
latet connect	Connect this computer to a Latet server: your agents’ requests are masked there, in your own space.
latet disconnect	Disconnect this computer from its Latet server: its token is revoked and forgotten, and your agents come back to the Latet of this computer.
latet tutorial	See Latet at work in your browser, on a sandbox of its own with invented data.
latet agents status	Show which agents are installed and whether they go through Latet.
latet agents apply	Route the agents through Latet (backed up, revertible with agents revert).
latet agents revert	Undo what agents apply changed (byte for byte when the files were not edited since).
latet agents print	How to point each agent at this Latet by hand: for the container image, which cannot edit your agents’ files. The bridge token is never printed: agents merge writes it into the file.
latet agents merge	Read an agent’s settings file on stdin, write it on stdout with Latet in (or, with --remove, out). For the container: the bridge token goes into the file without being shown.
latet service install	Start Latet automatically at login (no administrator rights needed).
latet service uninstall	Stop starting Latet at login.
latet ner install	Download the local name and address model (once; it then works offline).
latet ner status	Show whether local name detection is available and in use.
latet ner remove	Delete the downloaded model.
latet identity send	Send this computer’s detected identity to its existing personal server space. An agent cannot run it.
latet identity show	The identity Latet masks: your user names, host name and git author.
latet identity set	Tell Latet whose identity to mask (in the container it cannot see it), then apply it.
latet llm status	Show the reviewer’s settings and whether its server answers (with the sample text).
latet llm prompt	Print what the reviewer is told: Latet’s own instructions, then your guidance, if any.
latet llm guidance	Show or set your guidance to the local reviewer, added after Latet’s own instructions.
latet llm key	Save the API key of the reviewer’s server, or forget it (--remove).
latet llm trust	Trust the certificate of the reviewer’s server on another machine of yours (self-signed).
latet llm test	Review a text as Latet would before sending it: what the reviewer finds beyond the detectors.
latet ocr install	Download the text recognition models (once; they then work offline).
latet ocr status	Show whether the text in images is read and masked.
latet ocr remove	Delete the downloaded models.
latet project init	Write a latet.yaml to start from, at the root of the project’s repository.
latet project show	What applies in a project: its latet.yaml, your own settings for it, and what is ignored.
latet project check	Check a project’s latet.yaml, recognizers included (for CI, too).
latet project off	Turn Latet off in a project: nothing is masked or blocked there (in your own settings only).
latet project on	Turn Latet on again in a project.
latet repositories	The repositories Latet remembers, each with its state; forget one that stays unreadable.
latet repositories forget	Take a repository out of the list, the daemon’s memory too: no change is weighed in it until a conversation reaches it again. It lowers protection: run it yourself, in a terminal of your own.
latet rules test	Check recognizers: each example, with the reason when it fails, and what they find in ordinary code.
latet rules add	Add recognizers to config.yaml (or update those with the same name), then apply them.
latet rules list	The recognizers in config.yaml (or one project’s), and whether each one is active.
latet rules remove	Remove a recognizer from config.yaml (or one project’s settings), then apply the change.
latet rules suggest	Find code-like values that no rule covers, grouped by shape (AA-999999), on this machine.
latet rules export	Write your rules to a file, for a colleague: terms, recognizers, policies and the rest.
latet rules import	Add a colleague’s rules to yours: what adds protection applies at once.
latet config path	Print where config.yaml is (LATET_CONFIG names another).
latet config schema	Print the JSON Schema of config.yaml (editors and agents can check a file with it).
latet config validate	Check a configuration file: its keys and values, and every recognizer.
latet config get	Print a setting of config.yaml (or every one), with its default when not set.
latet config set	Change a setting of config.yaml and apply it.
latet config add	Add an item to a list of config.yaml (terms, pii, allow_values…) and apply it.
latet config remove	Take an item out of a list of config.yaml and apply it (taking protection away waits for the user).
latet server	Latet on a server: one Latet for the computers and programs of a team or a company.
latet server init	Prepare a Latet server: its master key, the database’s tables, and the first administration token.
latet server migrate	Bring the database’s tables to this version of Latet (one machine at a time: the others wait for it).
latet server run	Run an instance of the Latet server in the foreground: the container’s command, and the services’.
latet server ready	Whether this machine’s instance answers ready (PostgreSQL and Valkey answer it): exit 0, else 1.
latet server certificate	Show a certificate’s fingerprint and expiry, or make a self-signed one for a first try.
latet server status	The server’s status, vault limits, log chain and edition checks.
latet server service install	Show and install a systemd unit or a Windows service for the machine’s Latet.
latet server people add	Add a person and show their one-time code, to be given to them alone.
latet server people list	Everyone: enabled or not, computers connected, last seen and tampered token rows.
latet server people disable	Disable a person: every token of theirs stops on every instance within seconds; their space is kept.
latet server people enable	Enable a person again: their tokens and their space work again.
latet server people remove	Remove a person: their tokens stop, and their space (vault, history, settings) is deleted, once you agree.
latet server people code	A new one-time code: whoever uses it can connect as this person and open their dashboard; recorded.
latet server people tokens	A person’s computers; --revoke or --revoke-all stops their tokens.
latet server keys add	Make an API key, shown once or written privately with --out.
latet server keys list	Every API key: enabled or not, and when it was last used.
latet server keys rotate	Rotate an API key: the old key and its addresses stop on every instance within seconds.
latet server keys disable	Disable an API key: its addresses stop on every instance within seconds; its space is kept.
latet server keys enable	Enable an API key again.
latet server keys remove	Remove an API key: it stops, and its space is deleted, once you agree.
latet server config	The settings the server shares: destinations, the reviewer, text recognition, history, retention (--key: an API key’s own settings and rules, the keys of latet config).
latet server config get	Print a shared setting (or every one).
latet server config set	Change a shared setting: every space applies it at once.
latet server config reset	Replace an unreadable shared settings row with defaults; never reset settings that open.
latet server config add	Add an item to a list of the shared settings (--key: of an API key’s): every space has it at once.
latet server config remove	Take an item out of a list of the shared settings (--key: of an API key’s).
latet server rules	An API key’s own recognizers and rules (--key). Rules for everyone are planned for the Enterprise Edition.
latet server rules add	Add an API key’s recognizers (or update those with the same name), checked here first as latet rules test does. Their examples are not checked against a vault: invent them.
latet server rules list	An API key’s recognizers, and whether each one loads.
latet server rules remove	Remove an API key’s recognizer.
latet server rules import	Add a rules file to an API key’s settings: what adds protection; with --all, what lowers it too.
latet server rules export	Write an API key’s rules to a file (--key; the terms are values in clear), to share them by hand (latet rules import, or Import in the dashboard).
latet server admin-token issue	Issue an administration token once; --out keeps its secret out of a script’s log.
latet server admin-token list	Every token: this marks the one in use; tampered rows open nothing; never a secret.
latet server admin-token revoke	Revoke a token; revoking this or the last one asks and explains the way back.
latet server log	The administration log: who did what, when, on what, from where (never a value); verify checks its chain.
latet server log verify	Walk the log’s chain and print its head for a copy kept elsewhere.

latet version

Print the Latet version.

latet serve

Run the gateway in the foreground.

Option	Default	Description
--port INT		Local port to listen on (127.0.0.1 only).
--capture PATH		Write raw exchanges (credentials redacted) to this local directory.
--log-level TEXT	info	uvicorn log level.
--passthrough, --no-passthrough	off	Forward without masking (debugging only).
--host TEXT		The address to listen on: 127.0.0.1, or 0.0.0.0 in the container image.

latet start

Start the background daemon (no-op when it is already running).

Option	Default	Description
--wait, --no-wait	on	Wait until the daemon answers.

latet stop

Stop the background daemon.

latet status

Show whether the local daemon runs, or the connected server accepts this computer’s token.

latet env

Print the environment variables that route a client through Latet.

Option	Default	Description
--shell TEXT		powershell, bash or cmd (default: this system’s usual shell).
--agent TEXT	generic	generic or claude.
--key-file PATH		Read an API key for generic clients from this file.
--server TEXT		The API key’s server (otherwise LATET_SERVER_URL or connection).

latet dashboard

Open the dashboard here or on the connected server: what reached the model, and how it was masked.

On a computer connected to a server an agent cannot run it: the sign-in link opens every original masked for you and your settings, from wherever the server is reached.

Option	Default	Description
--print-url	off	Print the login link instead of opening it.

latet claude

Run Claude Code through Latet, for this session only (plugin + verify-only gateway); arguments pass through.

Every other argument is passed to the command as is.

latet codex

Run the Codex CLI through Latet, for this session only; arguments pass through.

Every other argument is passed to the command as is.

latet opencode

Run OpenCode through Latet, for this session only (API-key providers); arguments pass through.

Every other argument is passed to the command as is.

latet gemini

Run Gemini CLI through Latet, for this session only (an API key or Vertex AI); arguments pass through.

Every other argument is passed to the command as is.

latet run

Run a script or tool with OPENAI_BASE_URL, ANTHROPIC_BASE_URL and GOOGLE_GEMINI_BASE_URL pointing at Latet.

For programs that read those variables, such as the OpenAI, Anthropic and Google GenAI SDKs: their requests go through Latet. Any other program runs as usual. latet run claude, codex, opencode or gemini is latet claude, latet codex, latet opencode or latet gemini.

Every other argument is passed to the command as is.

latet reload

Apply the configuration file to the running daemon, without a restart.

latet doctor

Check the daemon, the plugin bridge, masking and the agent integrations.

latet global-uninstall

Take Latet out of your agents for good: what latet global-install did, undone.

Every agent’s settings go back as they were, byte for byte; Latet no longer starts at login; the daemon stops. Your rules stay in config.yaml, for latet claude and the others.

latet upgrade

Install the latest release of Latet from GitHub, with local name detection and the text in images.

It stops the daemon first and starts it again after. On Windows, which replaces no file of a program that runs, it installs the release in a window of its own once the command has ended. Where name detection and the text in images cannot be installed, a Latet that has neither is installed without them; one that has them is left as it was.

latet global-install

Route your agents through Latet for good: every session, in the terminal and in the IDE.

It shows everything it would change, then asks once: the agents it routes (their settings backed up first), Latet started at login, the profile and the countries, what is masked as your identity, Claude Code’s auto mode reviewer, and the port. latet global-uninstall takes it all away. The options choose otherwise than the defaults, such as --agents claude --no-autostart. Run by an agent or a script, it needs --yes, once the user agreed: without a terminal of yours it changes nothing.

Option	Default	Description
--yes, -y	off	Apply it without asking (an agent or a script, once the user agreed).
--profile TEXT		balanced, max or secrets.
--identity, --no-identity	asks	Mask this machine’s user names, host name and git author.
--agents TEXT		The agents to route: claude, codex, opencode (comma-separated), or none. Not given: every installed one.
--ner, --no-ner	asks	Download the local name and address model (needs the ner extra).
--ocr, --no-ocr	asks	Download the text recognition models for images (needs the ocr extra).
--auto-mode-review TEXT		Claude Code’s auto mode reviewer: block, allow-identity, or the details to let through (user_name, paths, host_name, git_author; user_name=surrogate gives it a fake user name).
--autostart, --no-autostart	asks	Start Latet when you log in (default: yes).
--dashboard, --no-dashboard	asks	Open the dashboard at the end.
--port TEXT		The daemon’s port, or auto: keep it, or move to a free one if it cannot be used.
--id-regions TEXT		Countries whose ID and tax numbers to recognise, comma-separated (such as IT,DE,US); the default adds this machine’s country.

latet backup

Save your installation in one file, encrypted with a passphrase: to move it to another machine.

In it: your settings (config.yaml) and the local reviewer’s trusted certificates. With --vault, the vault and its root key too: the other machine then makes the same fakes, remembers the values found so far, and keeps restoring conversations started here. With --history, the dashboard’s history. Never the reviewer’s API key, the bridge token or your agents’ settings: each machine has its own. Restore it with latet restore FILE; without the passphrase nobody can read it, you included. The passphrase is asked twice, or read from standard input.

Argument		Description
FILE	required	Where to write it, such as latet-backup.latet.

Option	Default	Description
--vault	off	Also the vault and its root key: the same fakes there, and conversations still restored.
--history	off	Also the dashboard’s history (needs --vault).

latet restore

Restore a backup here: your settings, and the vault with its key when it holds them.

It reads and checks the whole file first, shows what it holds and what in its settings lowers protection compared with yours, and asks you. Kept from this machine: its port, its identity (added to the backup’s), and nothing of capture_dir or api_key_file. With a vault, the daemon is stopped and started again around it; this machine’s own vault and key, if it has values, are replaced only with --replace, after saving them in a backup of their own with the same passphrase. What it moves aside stays in a dated folder next to the vault.

Argument		Description
FILE	optional	A file of latet backup.

Option	Default	Description
--replace	off	Replace this machine’s own vault and key (saved first, same passphrase).
--paths TEXT		OLD=NEW: project folders under OLD are under NEW here (repeat it).
--abort	off	Undo a restore that was cut off.

latet connect

Connect this computer to a Latet server: your agents’ requests are masked there, in your own space.

It shows what changes and asks first, at your own terminal; an agent cannot run it. The code an administrator gave you works once, within 24 hours: it is asked for, hidden, or read from standard input with --code -. This computer gets a personal token, which your agents use, and a computer key, which only Latet’s own commands use for your dashboard and identity, both kept in its credential store (or a private file); the server gets this computer’s identity (user name, host name, git author) to mask it. From then on latet claude, latet codex, latet opencode, latet run and what latet agents apply set up go to the server, and your settings are there, in your dashboard (latet dashboard). latet disconnect undoes it.

Argument		Description
URL	required	The server’s address, such as https://latet.acme.lan.

Option	Default	Description
--fingerprint TEXT		The fingerprint of the server’s self-signed certificate (sha256:… or AB:CD:…), as your administrator read it on the server’s machine.
--code TEXT		The one-time code an administrator gave you: --code - reads it from standard input; not given, it is asked for, hidden. Written here, other users of this computer can read it while the command runs.
--yes, -y	off	Connect without asking, where no terminal is there (a script of yours).

latet disconnect

Disconnect this computer from its Latet server: its token is revoked and forgotten, and your agents come back to the Latet of this computer.

It shows what changes back and asks first, at your own terminal; an agent cannot run it. A server that does not answer is forgotten here all the same, and it says how an administrator revokes this computer’s token there. It leaves no copy of the token or of your space’s address in what Latet wrote: a file it cannot clean is named, and the computer stays connected until it can, so that it can be run again.

Option	Default	Description
--yes, -y	off	Disconnect without asking, where no terminal is there (a script of yours).

latet tutorial

See Latet at work in your browser, on a sandbox of its own with invented data.

A pretend agent talks to a pretend model through the real Latet, and the dashboard shows what it did, chapter by chapter. Nothing leaves your computer. Your own settings, vault and history are never touched: the sandbox is a temporary folder on a port of its own, deleted when you press Ctrl+C or end it in the page. The one file written outside it is tutorial.json in your data folder: the ids of the chapters you finished.

Argument		Description
CHAPTER	optional	The chapter to open first, such as basics (--list shows them).

Option	Default	Description
--keep	off	Keep the sandbox’s folder when it ends, and say where it is.
--list	off	Print the chapters and which you finished, then stop.
--print-url	off	Print the sign-in link instead of opening it in the browser.

latet agents status

Show which agents are installed and whether they go through Latet.

latet agents apply

Route the agents through Latet (backed up, revertible with agents revert).

Argument		Description
NAMES…	optional	claude, codex, opencode (default: all installed).

Option	Default	Description
--keep-classifier-context, --no-keep-classifier-context	off	Claude Code: keep auto mode’s server-side review (sends paths and OS user).

latet agents revert

Undo what agents apply changed (byte for byte when the files were not edited since).

Argument		Description
NAMES…	optional	claude, codex, opencode (default: all).

latet agents print

How to point each agent at this Latet by hand: for the container image, which cannot edit your agents’ files. The bridge token is never printed: agents merge writes it into the file.

Option	Default	Description
--agent TEXT	all	claude, codex, opencode or all.
--shell TEXT	sh	The shell on your computer: sh (macOS, Linux) or powershell.
--codex-login TEXT	chatgpt	How Codex signs in: chatgpt or api-key.
--json	off	Print the same as JSON.

latet agents merge

Read an agent’s settings file on stdin, write it on stdout with Latet in (or, with --remove, out). For the container: the bridge token goes into the file without being shown.

Argument		Description
AGENT	required	claude, codex or opencode.

Option	Default	Description
--remove	off	Take the Latet settings out instead.
--codex-login TEXT	chatgpt	How Codex signs in: chatgpt or api-key.

latet service install

Start Latet automatically at login (no administrator rights needed).

latet service uninstall

Stop starting Latet at login.

latet ner install

Download the local name and address model (once; it then works offline).

Option	Default	Description
--yes, -y	off	Do not ask before downloading.

latet ner status

Show whether local name detection is available and in use.

latet ner remove

Delete the downloaded model.

latet identity send

Send this computer’s detected identity to its existing personal server space. An agent cannot run it.

latet identity show

The identity Latet masks: your user names, host name and git author.

latet identity set

Tell Latet whose identity to mask (in the container it cannot see it), then apply it.

Option	Default	Description
--user-name TEXT		Your user name; repeat for the user folder.
--host-name TEXT		Your computer’s host name.
--full-name TEXT		Your name, as in your git author.
--email TEXT		Your email, as in your git author; repeatable.

latet llm status

Show the reviewer’s settings and whether its server answers (with the sample text).

latet llm prompt

Print what the reviewer is told: Latet’s own instructions, then your guidance, if any.

Latet’s part is fixed, the text its benchmark measures. Yours follows it: llm_review.guidance, then a project’s own review_guidance (see latet llm guidance).

Option	Default	Description
--project PATH		For the project in this folder (your own settings for it).

latet llm guidance

Show or set your guidance to the local reviewer, added after Latet’s own instructions.

Say what else is confidential in your work, or what to leave alone: “Ward and department names are confidential”, “PRJ- followed by digits is an internal project”. It applies to the texts reviewed from then on, and is sent to the reviewer’s server with each review: describe kinds of values, and keep the confidential values themselves in terms. With --project, it is for that project only, after the global one. Changed by an agent, it waits for the user’s approval.

Argument		Description
TEXT	optional	The new guidance (-: standard input). None: print the one set.

Option	Default	Description
--file PATH		Read the new guidance from this file.
--clear	off	Remove it.
--project PATH		For the project in this folder (your own settings for it).
--wait	off	When the change waits for the user’s approval, wait for the answer.

latet llm key

Save the API key of the reviewer’s server, or forget it (--remove).

The key is asked without showing it, or read from standard input, and kept in the operating system’s credential store, never in config.yaml. A key in the variable api_key_env names, or in api_key_file, comes first. The running daemon uses the new key at once.

Option	Default	Description
--remove	off	Forget the saved key.

latet llm trust

Trust the certificate of the reviewer’s server on another machine of yours (self-signed).

It shows the certificate’s SHA-256 fingerprint: compare it with the one on the server, for example openssl x509 -noout -fingerprint -sha256 -in cert.pem there. Once trusted, only that certificate is accepted, checked before any text is sent.

Argument		Description
URL	optional	The server’s https:// address (default: llm_review.url).

Option	Default	Description
--fingerprint TEXT		The fingerprint you expect (sha256:…): trusted without asking when it matches.
--remove	off	Trust no certificate of its own any more.

latet llm test

Review a text as Latet would before sending it: what the reviewer finds beyond the detectors.

It runs on this machine only, and prints categories and where they are (line:column), never the values themselves. With --project, with that project’s rules and guidance.

Argument		Description
FILE	optional	The text to review (-: standard input).

Option	Default	Description
--kind TEXT	tool_result	Read it as user_text, tool_result, attachment or system.
--project PATH		For the project in this folder (your own settings for it).

latet ocr install

Download the text recognition models (once; they then work offline).

Option	Default	Description
--yes, -y	off	Do not ask before downloading.

latet ocr status

Show whether the text in images is read and masked.

latet ocr remove

Delete the downloaded models.

latet project init

Write a latet.yaml to start from, at the root of the project’s repository.

It can only add protection to each person’s own settings; your own settings for the project (values never to mask, Latet off) go in your config.yaml instead.

Argument		Description
FOLDER	optional	The project’s folder, or any folder in it; the current one if not given.

Option	Default	Description
--suggest	off	Also draft recognizers for the formats no rule covers there.

latet project show

What applies in a project: its latet.yaml, your own settings for it, and what is ignored.

Argument		Description
FOLDER	optional	The project’s folder, or any folder in it; the current one if not given.

Option	Default	Description
--json	off	Print it as JSON.

latet project check

Check a project’s latet.yaml, recognizers included (for CI, too).

Exit code 0 when all is well, 1 when something in it is ignored or an example fails, 2 for an error or when there is no file.

Argument		Description
FOLDER	optional	The project’s folder, or any folder in it; the current one if not given.

latet project off

Turn Latet off in a project: nothing is masked or blocked there (in your own settings only).

Argument		Description
FOLDER	optional	The project’s folder, or any folder in it; the current one if not given.

latet project on

Turn Latet on again in a project.

Argument		Description
FOLDER	optional	The project’s folder, or any folder in it; the current one if not given.

latet repositories

The repositories Latet remembers, each with its state; forget one that stays unreadable.

latet repositories forget

Take a repository out of the list, the daemon’s memory too: no change is weighed in it until a conversation reaches it again. It lowers protection: run it yourself, in a terminal of your own.

Argument		Description
FOLDER	required	The folder, as latet repositories shows it.

latet rules test

Check recognizers: each example, with the reason when it fails, and what they find in ordinary code.

Exit code 0 when all is well, 1 when an example fails, 2 when a recognizer cannot load.

Argument		Description
FILE	optional	A YAML file with recognizers (- for stdin); config.yaml if not given.

Option	Default	Description
--json	off	Print the report as JSON.
--corpus PATH		Also count matches in your own files (counts and shapes only).

latet rules add

Add recognizers to config.yaml (or update those with the same name), then apply them.

They are checked first, as rules test does. Examples must be invented: an example whose value Latet has seen for real (it is in the vault) is refused. With --project or --repo they go to one project’s settings instead.

Argument		Description
FILE	required	A YAML file with one or more recognizers (- for stdin).

Option	Default	Description
--project PATH		In your own settings for the project in this folder instead.
--repo PATH		In the latet.yaml of the project in this folder instead (shared through its repository).

latet rules list

The recognizers in config.yaml (or one project’s), and whether each one is active.

Option	Default	Description
--json	off	Print the list as JSON.
--project PATH		In your own settings for the project in this folder instead.
--repo PATH		In the latet.yaml of the project in this folder instead (shared through its repository).

latet rules remove

Remove a recognizer from config.yaml (or one project’s settings), then apply the change.

Argument		Description
NAME	required	The recognizer’s name.

Option	Default	Description
--project PATH		In your own settings for the project in this folder instead.
--repo PATH		In the latet.yaml of the project in this folder instead (shared through its repository).

latet rules suggest

Find code-like values that no rule covers, grouped by shape (AA-999999), on this machine.

Never prints a value: shapes, counts, files, likely check digits and the labels next to them. Nothing leaves this machine.

Argument		Description
FOLDER	required	The folder to look through (a git repository: its files only).

Option	Default	Description
--yaml	off	Print draft recognizers, with examples invented from the shapes.
--json	off	Print the report as JSON.
--show-values	off	Also show three values of each shape: at a terminal, never in an agent.
--limit INT	20	How many shapes to show.

latet rules export

Write your rules to a file, for a colleague: terms, recognizers, policies and the rest.

In it: the terms, recognizers, policies and field rules, the personal-data types and countries, the exceptions (values never to mask…) and the local reviewer’s guidance. Never this machine’s identity, port, paths or servers. With --project, your own settings for the project in that folder instead: its shared rules travel in its latet.yaml. The terms are values in clear: send the file the way you would send them.

Argument		Description
FILE	optional	Where to write them (none or -: standard output).

Option	Default	Description
--project PATH		Your own settings for the project in this folder instead.

latet rules import

Add a colleague’s rules to yours: what adds protection applies at once.

New terms, recognizers and field rules are added, and values stricter than yours taken; nothing of yours is removed or weakened. What would lower protection (the exceptions, a weaker value, the local reviewer’s guidance) is listed and left out: with --all it is applied too, and waits for approval like any change that lowers protection. With --project, into your own settings for the project in that folder.

Argument		Description
FILE	required	A rules file, or a config.yaml or latet.yaml (- for stdin).

Option	Default	Description
--project PATH		Your own settings for the project in this folder instead.
--all	off	Also what lowers protection: it waits for the user’s approval.
--dry-run	off	Only say what it would do.
--wait	off	When the change waits for the user’s approval, wait for the answer.

latet config path

Print where config.yaml is (LATET_CONFIG names another).

latet config schema

Print the JSON Schema of config.yaml (editors and agents can check a file with it).

Option	Default	Description
--project	off	The schema of a project’s latet.yaml instead.

latet config validate

Check a configuration file: its keys and values, and every recognizer.

Exit code 0 when all is well, 1 when a recognizer’s example fails, 2 for an error.

Argument		Description
FILE	optional	The file to check; config.yaml if not given.

latet config get

Print a setting of config.yaml (or every one), with its default when not set.

Argument		Description
KEY	optional	A key, with dots for what is inside (none: every key).

Option	Default	Description
--project PATH		Your own settings for the project in this folder instead.
--json	off	Print it as JSON.

latet config set

Change a setting of config.yaml and apply it.

A change that adds protection applies at once. One that lowers it is asked about at your own terminal; run by an agent, it waits for the user’s approval in the dashboard (exit code 3).

Argument		Description
KEY	required	A key of config.yaml, with dots for what is inside: profile, llm_review.enabled.
VALUE	optional	The new value, in YAML: max, true, [IT, DE], {enabled: true}.

Option	Default	Description
--unset	off	Back to its default.
--project PATH		Your own settings for the project in this folder instead.
--wait	off	When the change waits for the user’s approval, wait for the answer.

latet config add

Add an item to a list of config.yaml (terms, pii, allow_values…) and apply it.

Argument		Description
KEY	required	A key of config.yaml, with dots for what is inside: profile, llm_review.enabled.
VALUE	required	The item to add, in YAML: IBAN, {value: Falcon, type: PROJECT}.

Option	Default	Description
--project PATH		Your own settings for the project in this folder instead.
--wait	off	When the change waits for the user’s approval, wait for the answer.

latet config remove

Take an item out of a list of config.yaml and apply it (taking protection away waits for the user).

Argument		Description
KEY	required	A key of config.yaml, with dots for what is inside: profile, llm_review.enabled.
VALUE	required	The item to take out; for terms and recognizers, its value or name.

Option	Default	Description
--project PATH		Your own settings for the project in this folder instead.
--wait	off	When the change waits for the user’s approval, wait for the answer.

latet server

Latet on a server: one Latet for the computers and programs of a team or a company.

Its options go before the name of one of its commands: latet server [OPTIONS] COMMAND.

Option	Default	Description
--server TEXT		The server’s address (default: LATET_SERVER_URL, or this computer’s).
--fingerprint TEXT		Its self-signed certificate’s fingerprint (default: LATET_SERVER_FINGERPRINT).
--admin-token-file PATH		A file holding an administration token (or the token in LATET_SERVER_ADMIN_TOKEN, bound to LATET_SERVER_URL).

latet server init

Prepare a Latet server: its master key, the database’s tables, and the first administration token.

Run it once, on a machine with the server’s settings and its database’s access. The master key is written to the file master_key_file names when it is not there (in a folder that is yours alone); when nothing names one, a new key is printed for you to keep. A token issues tokens that end no later than itself: --never here is how a token that does not expire is made.

Option	Default	Description
--config PATH		The server’s settings file (server.yaml); its LATET_SERVER_* variables win over it.
--new-admin-token	off	Issue another administration token, when yours is lost.
--days INT RANGE		The token issued lasts this many days (default: admin_token_days).
--never	off	The token issued never expires: keep it apart, used only to issue others.

latet server migrate

Bring the database’s tables to this version of Latet (one machine at a time: the others wait for it).

Option	Default	Description
--config PATH		The server’s settings file (server.yaml); its LATET_SERVER_* variables win over it.
--check	off	Only say whether the tables are this version’s.

latet server run

Run an instance of the Latet server in the foreground: the container’s command, and the services’.

Option	Default	Description
--config PATH		The server’s settings file (server.yaml); its LATET_SERVER_* variables win over it.

latet server ready

Whether this machine’s instance answers ready (PostgreSQL and Valkey answer it): exit 0, else 1.

Option	Default	Description
--config PATH		The server’s settings file (server.yaml); its LATET_SERVER_* variables win over it.

latet server certificate

Show a certificate’s fingerprint and expiry, or make a self-signed one for a first try.

--make --url https://latet.acme.lan --out certs makes certs/server.crt and certs/server.key; a file shows that certificate; --url alone shows the one this computer sees at that address (a machine in between can change it: read the fingerprint people pin from the certificate’s file on the server’s machine). People connect with latet connect <address> --fingerprint <its fingerprint>, which asks for their one-time code. A certificate that is an authority is no server’s own, and is refused: computers given it would trust whatever its key signs.

Argument		Description
FILE	optional	A certificate (PEM) to show.

Option	Default	Description
--make	off	Make a self-signed certificate, for a first try.
--url TEXT		The server’s address: what --make names; alone, the certificate it shows.
--out PATH		With --make: the folder for server.crt and server.key.
--days INT RANGE	825	With --make: how long it lasts, in days.

latet server status

The server’s status, vault limits, log chain and edition checks.

latet server service install

Show and install a systemd unit or a Windows service for the machine’s Latet.

Install Latet outside personal home folders, and keep its settings in a trusted machine directory. The service is enabled at boot; you start it when ready.

Option	Default	Description
--config PATH		The server’s settings file (server.yaml); its LATET_SERVER_* variables win over it.
--yes	off	Install without a prompt when run by your own script.
--print	off	Show the service plan without changing anything.

latet server people add

Add a person and show their one-time code, to be given to them alone.

Argument		Description
NAME	required	The person’s name.

Option	Default	Description
--email TEXT		Their e-mail address.

latet server people list

Everyone: enabled or not, computers connected, last seen and tampered token rows.

latet server people disable

Disable a person: every token of theirs stops on every instance within seconds; their space is kept.

Argument		Description
PERSON	required	The person: their id, name or e-mail address.

latet server people enable

Enable a person again: their tokens and their space work again.

Argument		Description
PERSON	required	The person: their id, name or e-mail address.

latet server people remove

Remove a person: their tokens stop, and their space (vault, history, settings) is deleted, once you agree.

Argument		Description
PERSON	required	The person: their id, name or e-mail address.

Option	Default	Description
--yes, -y	off	Confirm in a script; your own terminal still asks.

latet server people code

A new one-time code: whoever uses it can connect as this person and open their dashboard; recorded.

Argument		Description
PERSON	required	The person: their id, name or e-mail address.

latet server people tokens

A person’s computers; --revoke or --revoke-all stops their tokens.

Argument		Description
PERSON	required	The person: their id, name or e-mail address.

Option	Default	Description
--revoke TEXT		Revoke this token’s id.
--revoke-all	off	Revoke every token of theirs.
--yes, -y	off	Confirm in a script; your own terminal still asks.

latet server keys add

Make an API key, shown once or written privately with --out.

Argument		Description
NAME	required	What the key is for, such as Billing CI.

Option	Default	Description
--out PATH		Write the key privately; print no secret.

latet server keys list

Every API key: enabled or not, and when it was last used.

latet server keys rotate

Rotate an API key: the old key and its addresses stop on every instance within seconds.

Argument		Description
KEY	required	The API key: its id or name.

Option	Default	Description
--yes, -y	off	Confirm in a script; your own terminal still asks.
--out PATH		Write the new key privately; print no secret.

latet server keys disable

Disable an API key: its addresses stop on every instance within seconds; its space is kept.

Argument		Description
KEY	required	The API key: its id or name.

latet server keys enable

Enable an API key again.

Argument		Description
KEY	required	The API key: its id or name.

latet server keys remove

Remove an API key: it stops, and its space is deleted, once you agree.

Argument		Description
KEY	required	The API key: its id or name.

Option	Default	Description
--yes, -y	off	Confirm in a script; your own terminal still asks.

latet server config

The settings the server shares: destinations, the reviewer, text recognition, history, retention (--key: an API key’s own settings and rules, the keys of latet config).

Its options go before the name of one of its commands: latet server config [OPTIONS] COMMAND.

Option	Default	Description
--key TEXT		An API key’s own settings (its id or name), on top of the shared ones.

latet server config get

Print a shared setting (or every one).

Argument		Description
KEY	optional	A key, with dots for what is inside (none: every key).

Option	Default	Description
--json	off	Print it as JSON.

latet server config set

Change a shared setting: every space applies it at once.

Argument		Description
KEY	required	A key, with dots for what is inside: history, ocr (--key: profile).
VALUE	optional	The new value, in YAML.

Option	Default	Description
--unset	off	Back to its default.

latet server config reset

Replace an unreadable shared settings row with defaults; never reset settings that open.

Option	Default	Description
--yes, -y	off	Confirm in a script; your own terminal still asks.

latet server config add

Add an item to a list of the shared settings (--key: of an API key’s): every space has it at once.

Argument		Description
KEY	required	A list: upstreams (--key: terms, allow_values…).
VALUE	required	The item, in YAML: {name: llm, url: 'https://llm.acme.com'}.

latet server config remove

Take an item out of a list of the shared settings (--key: of an API key’s).

Argument		Description
KEY	required	A list: upstreams (--key: terms, allow_values…).
VALUE	required	The item to take out; for terms and recognizers, its value or name.

latet server rules

An API key’s own recognizers and rules (--key). Rules for everyone are planned for the Enterprise Edition.

Its options go before the name of one of its commands: latet server rules [OPTIONS] COMMAND.

Option	Default	Description
--key TEXT		An API key’s own settings (its id or name), on top of the shared ones.

latet server rules add

Add an API key’s recognizers (or update those with the same name), checked here first as latet rules test does. Their examples are not checked against a vault: invent them.

Argument		Description
FILE	required	A YAML file with one or more recognizers.

latet server rules list

An API key’s recognizers, and whether each one loads.

Option	Default	Description
--json	off	Print them as JSON.

latet server rules remove

Remove an API key’s recognizer.

Argument		Description
NAME	required	The recognizer’s name.

latet server rules import

Add a rules file to an API key’s settings: what adds protection; with --all, what lowers it too.

Argument		Description
FILE	required	A rules file (latet rules export), or a config.yaml or latet.yaml.

Option	Default	Description
--all	off	Also what lowers protection.
--dry-run	off	Only say what it would do.

latet server rules export

Write an API key’s rules to a file (--key; the terms are values in clear), to share them by hand (latet rules import, or Import in the dashboard).

Argument		Description
FILE	optional	Where to write them (none: here).

latet server admin-token issue

Issue an administration token once; --out keeps its secret out of a script’s log.

Option	Default	Description
--label TEXT		Whose or what it is for; required with --never.
--days INT RANGE		Days it lasts; default: server’s admin_token_days.
--never	off	Never expires; can do all an administrator can until revoked. Only a lasting token can issue one. Keep it apart to issue others. Give CI a token with --days.
--out PATH		Write a private {url, token} record; print no secret.

latet server admin-token list

Every token: this marks the one in use; tampered rows open nothing; never a secret.

latet server admin-token revoke

Revoke a token; revoking this or the last one asks and explains the way back.

Argument		Description
TOKEN_ID	required	The administration token id, never its secret.

Option	Default	Description
--yes, -y	off	Confirm in a script; your own terminal still asks.

latet server log

The administration log: who did what, when, on what, from where (never a value); verify checks its chain.

Option	Default	Description
--since TEXT		From: 7d, 12h, or an ISO date.
--until TEXT		Until: excluded; accepts exact epoch seconds too.
--action TEXT		One action.
--actor TEXT		An identity id or admin:.
--cursor TEXT		Resume cursor, with the same original filters.
--limit INT RANGE	100	Maximum entries to read.
--json	off	JSON lines, with exact id and ts.

latet server log verify

Walk the log’s chain and print its head for a copy kept elsewhere.