desktop-client is the installed OpenLeash client: tray app, local helper API, approval UI, hook installer, update checks, and deployment CLI.
The attention island is a non-activating, top-center overlay for the moments when an agent needs a person. It presents OpenLeash policy approvals, native agent questions and plan reviews, blocked actions, and completion notices without opening the main window or stealing focus from the terminal.
Native interaction support is capability-based:
| Agent adapter | Policy approvals | Native questions | Plan review | Completion |
|---|---|---|---|---|
| Claude Code / NanoClaw | Yes | Yes, answers resume the hook | Yes | Yes |
| OpenCode | Yes | Yes, answers use OpenCode's question API | Agent-dependent | Yes |
| Codex / Copilot / Gemini and other installed hooks | Yes | When their stable hook contract exposes structured answers | When exposed | When their stop hook is available |
The overlay is implemented with Electron primitives available on macOS and
Windows (showInactive, frameless transparent windows, skip-taskbar, and
always-on-top). "Open agent" activates a likely host application; it is not
described as an exact session jump unless that agent publishes a stable deep
link.
Installed hooks call the configured managed OpenLeash API:
https://api.openleash.com/v1/hooks/:agent/:event
Private Cloud installs use the customer-hosted client-api URL. The desktop local API still exists for setup, tray state, OAuth callbacks, local cache, local development, and legacy/dev relay behavior. If the managed backend is unavailable, enforcement fails closed instead of running a fully local SQLite-backed product mode.
| Mode | Behavior |
|---|---|
| 🏢 Private Cloud | Hooks target customer-hosted client-api; desktop receives state and approvals from that backend. |
| ☁️ OpenLeash Cloud | Hooks target OpenLeash-hosted cloud APIs; desktop receives state and approvals from OpenLeash Cloud. |
Best path:
python3 run.pyDirect app run:
npm install
npm run desktop-clientCLI examples:
npm run desktop-cli -- discover
npm run desktop-cli -- install-hooks --all
npm run desktop-cli -- plugins list --search token
npm run desktop-cli -- plugins install token-saver sec-evaluator
npm run desktop-cli -- plugins uninstall token-saver sec-evaluator
npm run desktop-cli -- configure --token "$OPENLEASH_TOKEN" --remote-api-url https://api.openleash.com- Hooks enter through the managed OpenLeash API so local and provider-cloud agent runs use the same URL.
- Install changes are explicit and reversible.
- Backend outages fail closed with a clear reason.
- Users should see what changed and how to undo it.
- Risky actions should feel clear, not spooky.
The Electron renderer uses context isolation, sandboxing, no Node integration, and guarded external URL opening.
Keep it that way.