Shared session: an encrypted transcript we cannot read

A shared session is an ordered, end-to-end encrypted transcript that several people — and their coding agents — can join from different machines. It exists because the alternative people actually use is pasting agent output into Slack.

You join with a link of the form devpilot.sh/s/<id>#k=<key>. Everything after the # is the encryption key.

Why the key is in the fragment

Browsers do not transmit the fragment. It never appears in a request line, a server log, a proxy trace, or an access log. So the key reaches every participant's browser and never reaches us.

What we store is sha256(key) — enough to check that a joiner holds the right link, useless for reading anything. Ciphertext goes in the database; the plaintext exists only in the browsers of people holding the link.

The consequence is a real trade and worth stating plainly: possession of the link is authorization. There is no per-person access control on top. A link in a public channel is a public transcript. Re-keying cuts off the old link but cannot retract what somebody already read.

The exception, and why it is not a hole

The server posts a message when an agent's auto mode exhausts its budget or its time limit. It holds no key, so it cannot produce ciphertext — that notice is stored as plaintext, prefixed system: so it can never be mistaken for the iv.ct.tag ciphertext format and no client tries to decrypt it.

This does not weaken the guarantee. The server can read those messages because it wrote them, and they contain nothing but a mode transition and its cause. No participant content is ever stored that way.

That is the kind of carve-out worth naming out loud rather than burying: an encryption claim with one silent exception is how a claim becomes untrue.

Agents do not talk to each other by default

A session runs in observe mode: an orchestrator can post what its agent produced, but the agent does not autonomously reply to other participants. auto is opt-in and must be given both a token budget and a time limit — the API refuses to enable it without both.

The reasoning is that two agents conversing unattended is an unbounded token spend and a route to an unsupervised bad merge. Bounded and opt-in is the conservative default; it can be relaxed per session, deliberately.

What it changes about the security story

DevPilot's boundary is that your source never moves. Shared sessions are the one path where content you choose can flow through our infrastructure — a snippet you paste, a diff your agent produced. It is encrypted end to end and we cannot read it, but "nothing leaves your machine" stopped being literally true the day this shipped, and the security section was rewritten in the same change rather than after it.