# Enclave Tls Interceptor

> Enclave TLS Interceptor

- Skill: `latchagent/enclave-tls-interceptor` (Agent Skill)
- Install (CLI): `npx skillmds@latest add latchagent/enclave-tls-interceptor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/latchagent/enclave-tls-interceptor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: latchagent (https://skillmd.com/u/latchagent)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/latchagent/enclave-tls-interceptor

---

# Enclave TLS Interceptor

## What This Module Does

The TLS Interceptor (`src/main/services/proxy/tls-interceptor.ts`) provides per-session TLS interception for the Latch Enclave proxy. It generates:

1. **Ephemeral CA** — A self-signed RSA 2048 CA certificate created when a session starts. The CA cert is written to a temp file and injected into the sandbox via `NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, and `GIT_SSL_CAINFO`.

2. **Per-domain leaf certs** — On-demand certificates for each domain the proxy intercepts, signed by the ephemeral CA. Cached per-domain for the session lifetime.

## Key API

- `new TlsInterceptor()` — Generates CA on construction
- `getCaCertPath()` — Temp file path for env injection
- `getCertForDomain(domain)` — Returns `{ cert, key }` PEM pair
- `getSecureContext(domain)` — Returns Node.js `tls.SecureContext` for TLS server socket
- `destroy()` — Wipes all keys and deletes temp files

## Architecture

- Uses `node-forge` for X.509 cert generation (pure JS, no native deps)
- CA key stored in memory only, never on disk
- Leaf certs cached per-domain (RSA keygen is expensive)
- Entire lifecycle tied to session — construct on start, destroy on end

## Testing

Run: `npx vitest run src/main/services/proxy/tls-interceptor.test.ts`