AgentGit processes conversation secrets locally before recording or sharing content. The default pipeline replaces detected values with reversible opaque placeholders. Privacy is optional processing: a scan, key, storage, or synchronization failure never prevents saving, uploading, restoring, or continuing a conversation. Completed replacements are retained where possible; failed work uses the original content.
Automatic keys and recovery
Signing in automatically obtains a dedicated account encryption key. No keystore
configuration or operating-system authorization prompt is required. The local
privacy dictionary maps {{AGIT_SECRET_V2:...}} placeholders to exact original
values. With a cached cloud key, dictionary records are encrypted locally.
Without a usable key, new records temporarily remain in a private local journal.
Each push, including a push with no new commits, schedules an independent dictionary synchronization attempt. Only encrypted packages are uploaded. Failed attempts remain pending for a later login, push, fetch, or clone. After the same account signs in on another device, downloaded packages restore the original values locally. A conversation upload can finish before its dictionary synchronization. Until that synchronization succeeds, another device may display unresolved placeholders.
The Hub stores account keys, received commits, and encrypted dictionary packages. It does not scan, replace, or reject content for privacy reasons. Because the Hub holds the keys, this is not an end-to-end encryption claim. Git LFS payloads, including text payloads, are excluded from privacy processing.
What the Hub can read
Each session publishes in one of two modes. New sessions publish plain by default; encryption is opt-in. Automatic replacement runs in both modes.
| Plain (default) | Encrypted | |
|---|---|---|
| Stored on the Hub | The conversation as saved, after local replacement | A published view, after local replacement, plus the original encrypted to the session owner’s account key |
| Repository readers | Read the whole conversation on the Hub, through clone, and through search | Read the published view and the session title; the full original only with original access |
| Original access | Not applicable | The session owner and the snapshot’s committers by default; other members only when the owner grants it |
| Hub search | Indexes the conversation text | Indexes the published view, not the original |
The Hub is not end-to-end encrypted. Plain session text is stored readable on the server, so the Hub’s operators and administrators with server access can read it, and the server indexes it for search. Search results are filtered by repository access: people who cannot read a repository do not get its content in results. Encrypted originals are encrypted with keys the Hub holds and releases to authorized readers, so they are protected from repository readers without original access, not from the Hub itself. An encrypted session’s title is the exception: the Hub takes it from the original (its recorded title, or else the text of its first prompt, after local replacement) and shows it to every repository reader, including anonymous readers of a public repository. Keep project names and other sensitive text out of a session’s title and opening prompt.
A value that automatic replacement misses stays readable in a plain session,
in its search index entries, and in an encrypted session’s published view.
Register literals that detection may miss before saving (see below), and
inspect a session with agit scan --secrets before pushing it. Existing
commits are not rewritten when you register a value later.
Choose encrypted publication
Choose the mode before the session’s first push:
agit privacy mode alice/my-project@first-task
agit privacy mode alice/my-project@first-task encrypted
agit push alice/my-project@first-task --private
Without a mode, the first command shows the current setting. The choice
covers the logical session, including its other branches. The first
registration with the Hub locks it, so an already-published session cannot
switch modes; plain restores the default before then. --public and
--private select repository visibility, not encryption. Inspect a published
snapshot’s storage and your access with agit privacy status.
The published view shows tool calls, tool results, and attachments unless you
omit them with agit privacy policy tool and agit privacy policy attachment;
encryption alone does not hide them.
Encryption has costs:
- Hub session page: readers see the published view. Only people with
original access can choose View original; the owner manages access from
the session page or with
agit privacy access. - Search: Hub search,
agit search, and MCP search find text in the published view only. - Sharing: a snapshot or share link of an encrypted session carries the published view; the original stays tied to repository access.
- Continuing: resuming the original on another machine requires
agit privacy unlockfirst, and editing a published encrypted snapshot requires continuing the session or forking it.
Register values and review policy
Built-in detection needs no setup. Register literals that heuristic detection may miss, such as an internal hostname:
agit secrets add internal-hostname
agit secrets list
agit secrets status
The prompt hides the value. For automation, use --stdin and supply the value
without shell tracing. Labels should not contain sensitive information.
Repository policy commands take the Agent repo checkout path, available through
agit repo path alice/my-project@first-task:
agit secrets review --repo AGENT_REPO_PATH
agit secrets allow RECORD_ID --repo AGENT_REPO_PATH
agit secrets unallow RECORD_ID --repo AGENT_REPO_PATH
agit secrets block add internal-hostname --repo AGENT_REPO_PATH
Default global rules, global user rules, and repository user rules retain their
scope. Explicit blocks take precedence over allows; allows suppress heuristic
matches. Merely recording a detected value in the recovery dictionary does not
make it an explicit block. allow and remove affect future policy while retaining
original mappings needed to recover existing placeholders. Existing commits are
immutable and are not rewritten when policy changes.
Optional inspection
agit scan alice/my-project@first-task --secrets
agit scan alice/my-project@first-task#3 --sensitive --json
These are explicit diagnostic commands, not upload prerequisites. Sensitive-content review uses a supported installed runtime and may contact its model provider. It does not apply findings automatically. Scan findings, incomplete scans, and review failures do not become server privacy gates.
Legacy dictionaries are read locally when their keys remain accessible. The legacy
secrets.keystore setting only selects how those older dictionaries are read.
Failure to read one does not block ordinary operations. Successfully recovered
legacy aliases join the encrypted synchronization journal without changing history.