Skip to main content
A session is shared with your workspace by default: everyone in it can see the session, its summary and what was remembered in it. Two other choices exist, and you can make the first one at any time.

​
Start a session private

This starts Claude Code in the current repo. The session is private from its first message: there is no moment when anyone else can see it. When it ends, the CLI reads back what Orchestra holds and tells you it is private. Private means the session’s contents are left out of everyone else’s view entirely: session lists, the counts on people and agents, search, recall, and the decisions remembered in it. A member of your workspace who opens a link to it sees that it is a private session and who can give access, and nothing else about it. Someone outside your workspace gets the same answer as for a session that does not exist. Give it a task and it begins work instead of waiting for you:
The task is Claude Code’s first message. Options after -- go to Claude Code: orchestra start --private -- --model opus. start always begins a new session, so it refuses --resume and --continue. In the terminal client (orchestra with no command), press ctrl+p before starting a session and it is private in the same way.

​
Start a session off the record

The session stays on your machine. Orchestra does not save it, now or if you import your history later, and commits you make from inside it are not recorded. Orchestra also does not add your team’s context to it, because doing so would send the session’s id. How it holds:
  • The choice is written to ~/.orchestra/off-record/ before Claude Code writes its first line, under the session id start gives it. Every way Orchestra reads a transcript (the end of each turn, the background reader, watch, a manual save, and an import of past sessions) checks that note first and stops.
  • Claude Code is started with ORCHESTRA_OFF_RECORD set, so every hook inside it stands down, including after /clear, which starts a new conversation in the same process. That new conversation is noted too.
  • Resuming it later with a plain claude --resume keeps it off the record, because the note is on disk.
  • If Orchestra cannot read that folder (a permission problem, for example), it saves nothing rather than guessing, and orchestra doctor reports it.
  • The notes are never cleaned up automatically. Each is an empty file.
  • Inside an off-the-record session, the agent’s save_session tool is refused. Things you explicitly ask it to do in Orchestra, such as remembering one statement or filing an issue, still work and are attributed to you.
Off the record is available for Claude Code sessions started with orchestra start. A session started from the terminal client is run by Orchestra, so it is always saved; make it private there with ctrl+p instead.

​
Change who can see a session

From the session page in the web app, use the button in the header that says Workspace or Private. It shows who has access and how each person got it, and lets the person who started the session switch between the two and add or remove people. From the terminal:
A change applies to everything saved from the session so far, not only what comes next. Making a session private hides its summary, decisions and search results from everyone else at once, and opening it again brings them back. Nothing is rebuilt either way. Rules that hold today:
  • Only the person who started a session can change who sees it. Workspace admins will be able to as well once workspace roles exist.
  • The person who started a session always keeps access to it.
  • People you add keep their place on the list while the session is shared with the workspace, and it applies again the moment the session goes private.
  • A helper session (a subagent’s) is shared exactly as the session it ran inside. Change that session instead.

​
Ask for access to a private session

When you open a private session you cannot see, the page says it is private, who can give access, and the day it was last active. It never shows the session’s name, what it was for, what was said in it, or who else can see it. Choose Request access to ask. The request goes to the inbox of the person who started the session, with your name on it, and to nobody else. They can give you access from that inbox item, which adds you exactly as the sharing panel does, and the session opens for you on your next visit.
  • You can have one open request per session. Asking again while it is open sends nothing new; there is no reminder.
  • A request is answered when you are given access. If your access is later removed, you can ask once more.
  • If no person started the session (an agent did, for example), nobody can give access yet, and the page says so instead of offering to send a request nobody would receive. Workspace admins will be able to answer requests once workspace roles exist.

​
What private does not cover

  • People who operate your Orchestra database directly can read everything in it. Private is about what other members see through Orchestra.
  • The first time any session in a workspace uses an agent, that agent appears on the workspace’s list of agents, by name only, even if the session is private.
  • Commits are recorded from your repository as commits. A private session’s link to the commits it made is private; the commits themselves are not.
  • That a private session exists is not hidden from members of your workspace who reach its link. Its contents are.

​
Redaction

Everything Orchestra saves (remembered statements, captured session messages and tool output, commit messages, archived transcripts) passes through one redaction step on your machine before it is sent. The built-in rules cover well-known secret formats (cloud keys, API tokens, JWTs, private key blocks), credential key/value pairs, credentialed URLs, and a conservative high-entropy detector. Redaction is non-reversible: the original secret is never stored.

​
Your own rules

Organizations have secrets the built-ins cannot know: internal token formats, project codenames, customer identifiers. Drop rule packs into either of:
  • ~/.orchestra/redactors/: applies to every capture on the machine
  • <repo>/.orchestra/redactors/: applies when running from that repo
Both directories are scanned at startup by the CLI and the MCP server; all packs found are merged on top of the built-in rules. A pack is a .json file (.yaml/.yml works too if js-yaml is installed):
Each rule needs a stable id and a regex (the whole match is replaced). label produces [REDACTED_<LABEL>] instead of the bare [REDACTED]; caseInsensitive compiles the pattern with the i flag. Two properties are guaranteed:
  • Packs only add rules. They cannot disable the built-in detectors, so a custom pack can never reduce redaction below the defaults.
  • Malformed packs fail open to the defaults. An unparseable file or an invalid regex is skipped with a warning on stderr; capture never crashes and never runs with less redaction than the built-ins.

​
Checking what ran

Every capture outcome recorded under ~/.orchestra/state (see the capture health checks in orchestra doctor) includes which rule pack was active (default, or custom with the pack file paths) and the total number of redactions applied during the run, so capture health tooling can show what redaction actually ran.