An open protocol, and a client, for what your coding agents are doing.

How it works

1. A command the agent already runs

   At the moments it knows about: a session started, a tool is about to run, it is waiting for you. sessionpipe's hook hands the payload to a background worker and exits in under 150 ms.

2. One envelope for every agent

   session.started, tool.ended, attention.needed: 17 types in protocol 1. Facts and timestamps, never a verdict: "stuck" and "done" are for the receiver to decide.

3. Sent where you say, and kept until it lands

   A sink is a file, stdout or a URL. The outbox on your disk moves a sink's cursor only after a 2xx and keeps 30 days, so a laptop offline for a week loses nothing.

One event, start to finish

Claude Code asks permission to run a command. Here is what it hands the hook, what the adapter makes of it, and what a destination set to tier 0 actually receives.

1. What Claude Code fires

   {
     "hook_event_name": "PermissionRequest",
     "session_id": "ed6c7665-589f-…",
     "cwd": "~/…/ws2",
     "transcript_path": "~/.claude/projects/…",
     "permission_mode": "default",
     "tool_name": "Bash",
     "tool_input": {
       "command": "cat /nonexistent-file-xyz",
       "description": "Try to read a file…"
     }
   }

   Its own field names, its own format. Codex and Gemini CLI say the same thing differently.

2. What the adapter makes

   {
     "protocol": 1,
     "type": "attention.needed",
     "time": "2026-09-28T03:44:50.515Z",
     "tier": 1,
     "harness": { "name": "claude-code" },
     "session": { "id": "ed6c7665-…" },
     "privacy": { "rulesets": ["secrets@1"] },
     "data": {
       "attention_id": "perm-1bb18c870624a063",
       "kind": "permission",
       "tool": "Bash",
       "message": "Bash cat /nonexistent-fi…"
     }
   }

   The same envelope for every agent. Secrets in message would already be gone.

3. What a tier-0 sink receives

   {
     "protocol": 1,
     "type": "attention.needed",
     "tier": 0,
     "…"
     "data": {
       "attention_id": "perm-1bb18c870624a063",
       "kind": "permission"
       "tool": "Bash",
       "message": "Bash cat /nonexistent-…"
     }
   }

   "Needs you", without the words. The filter is an allowlist per event type, so a field nobody listed never leaves.

Recorded from Claude Code 2.1.258 on 28 Sep 2026, trimmed for width. The full payload is a conformance fixture; CI checks the adapter against it.

You choose how much leaves

Each destination is set to a tier, and each receiver states the most it will accept. The lower of the two wins. Every tier includes the one before it.

1. 0

   presence

   Session id, state, timing, machine, folder, repo, branch, model, title; the kind of attention needed.

   A board of who is working, who needs you, who is done.

2. 1

   actions

   + tool names, durations, ok or error, file paths, the attention message, subagents.

   An activity feed.

3. 2

   conversation

   + your prompts and the assistant's replies, redacted.

   Memory, search, recaps.

4. 3

   full

   + tool input and output, thinking, raw hook lines.

   Full replay, on a server you own.

The secrets ruleset runs on every string above tier 0 and cannot be turned off. PII reduction is a second pass you can turn on. sessionpipe tail --tier N shows exactly what a tier sends before you point it anywhere. The privacy spec.

Harnesses and receivers

One adapter file per harness is the only vendor-specific code in the tree. A harness joins the registry once it has fixtures recorded from real hook payloads, and CI runs every one of them through its adapter on every change.

Next in the registry: Cursor, Copilot CLI, Droid, Kiro and OpenCode. Every mapping, native hook to protocol event, is in the adapters spec.

Receivers

sessionpipe-gui

Local. Every session on your machines, live, on a laptop or a phone; search across agent history, offline. Desktop apps for macOS and Linux.

tier 3

spacesheep.dev

Hosted. Sessions across machines, memory and recaps, messages from anywhere.

tier 2

sessionpipe-receiver

The reference receiver. One process, JSONL files, a page you can answer from a phone. npx sessionpipe-receiver, or Docker.

tier 3

Yours

Serve /.well-known/sessionpipe and one POST route, pass the conformance suite, and add it to the list.

your call

Privacy and security

1. No telemetry.

   sessionpipe reports to the destinations you configured and to nobody else. This site has no analytics, no cookies, and loads nothing from anyone.

2. Secrets never leave.

   Redaction runs on your machine before anything is written to the outbox, so a receiver never sees what was removed.

3. Your server, or none.

   A file, stdout, the reference receiver on your laptop, or any HTTPS endpoint that speaks the protocol. There is no sessionpipe cloud.

sessionpipe control pair https://your-receiver.example
sessionpipe control folders add ~/work
sessionpipe control mode safe   # or auto