Skip to content
KurrentDB

Visibility & sharing

Session sharing controls who can see the work and, where enabled, how much detail they can read. Capture settings determine whether Capacitor records it in the first place.

New sessions carry the default from the active CLI profile:

ValueDefault behavior
privateOwner-only.
projectShared through project membership for the repository; requires a plan with projects.
org_publicUses the server’s configured organization/repository rules and applicable project membership. Personal or unrecognized repositories can remain private.
publicVisible to signed-in users on the Capacitor server.
Terminal window
kcap config set default_visibility private
kcap config set default_visibility project
kcap config set default_visibility org_public
kcap config show

“Public” does not mean a transcript is anonymously published on the web.

Open the session’s Share control. Available audience choices include:

  • My default — inherit the session’s default audience.
  • Org members — people in your organization.
  • Project members — members of projects containing this repository.
  • Teams & people — only the teams and people you select.
  • Private — only you.

Some choices depend on your plan, the repository’s projects, and enabled sharing controls. Select the audience, add recipients when needed, and choose Apply.

Explicitly choosing Org members differs from inheriting org_public: it is a deliberate sharing override. With Project members, adding the repository to another project can extend the audience.

A URL alone does not grant access. Share the session with a reviewer before sending its link.

When the Detail level selector is available, choose Full, Activity, Overview, or the default. This lets someone follow the work without necessarily seeing the full conversation.

Full is required for raw transcripts and tool-output detail. Activity provides a more limited view of recorded activity; Overview provides the high-level view. The owner retains full access to their own session.

These limits also apply to agent-facing recall and review tools. A session appearing in a list does not guarantee that its transcript is readable.

Terminal window
kcap hide
kcap hide <sessionId>

With no argument, the CLI resolves the current session from the agent environment. An explicit ID must be a session UUID; hide does not accept a human-readable meta-session slug.

Hiding makes that session owner-only and keeps recording active. It does not delete the data. For a continuation chain, apply the change to each session that needs it.

To share it again, use the browser’s Share control.

Terminal window
kcap disable
kcap disable <sessionId>

This stops local watchers, silences future capture for that session, and requests deletion of its server-side data. It requires a session UUID when you pass an ID.

Read the command’s result: if the server could not be reached, local recording may be disabled while the server data remains. Resolve connectivity and retry deletion if needed. The original transcript kept by your agent is not removed.

CommandRecordingStored session
kcap hideContinuesKept, owner-only.
kcap disableStops for this sessionDeleted when the server request succeeds.

Use a remote-based exclusion or a local path rule:

Terminal window
kcap config set excluded_repos "myorg/secret-project,personal/diary"
kcap ignore .
kcap ignore ~/code/secret-project
kcap ignore --list
kcap ignore --remove ~/code/secret-project

Path rules include subdirectories. They are profile-specific and affect future capture; they do not erase sessions already uploaded.

v1.1.1 also supports allow lists:

Terminal window
kcap allow ~/code/work-project
kcap allow --list
kcap config set allowed_repos "myorg/service,myorg/client"

Once an allow list is configured, capture must match it. Exclusions still take precedence. Review both path and remote rules in Configuration & profiles before relying on the result.