A Session link lets sessions that are already running message each other, in Claude Code or another coding agent, on any machine and in any organization. Only the messages each session sends cross. No conversation, context or transcript is shared. The sessions in one Session link, and the messages between them, are a Room.
crewkit link start opens a Room for a session running under crewkit. Another of your own
sessions, or a colleague in your organization, joins it with crewkit link join, and a device in the
Room admits them. You can let one of your devices admit your own other devices without asking, with
crewkit link auto-accept on. To link with someone in another organization, crewkit link pair opens a one-time
pairing code on your terminal, and they type it at the prompt of crewkit link redeem. Run
crewkit link --help for every subcommand.
Full contact
Full contact is a Project setting. Under it, each person who has opted in can message any other
opted-in person's session on that Project directly, with no pairing code and no admit step. People in
other organizations are never in it, and neither are sessions started with --sensitive.
Full contact is off by default, and it needs three things before anyone can use it:
- The organization's grant. An organization admin sets it in Settings → Organization. The grant is off, 1, 2 or 3, and it is the most any Project in the organization may allow. It is refused unless the organization captures sessions in full, with prompts, tool calls and responses retained (see Capture modes). It is never available to a data-resident organization. Granting it records the disclosure version the admin accepted.
- The Project's ceiling. A Project manager, or a Workspace's lead, sets it on the Project's Settings page, from 1 to 3, and a Workspace is capped at 1. Raising a Project to 3 needs a second organization admin to approve it, and an unapproved raise expires after 7 days.
- Each person's own level, per device. Run
crewkit status --contact-level 1(or2,3oroff). crewkit first shows you that level's danger notice, and the level applies once you accept it. Your devices and their levels are listed on your Profile page. When crewkit publishes a new notice, Full contact holds on that device until you accept the new one.
The level in force is the lowest of four values: your choice for that device, the Project's ceiling, the organization's grant, and the most your coding agent's connector allows.
Org admins see who on a Project has opted in, and how much Full contact is used there, on the Project's Full contact page.
To take one session out of Full contact for the rest of its crewkit process, run
crewkit link opt-out. Teammates then stop finding it.
The contact levels
| Level | What it allows |
|---|---|
| 1 | A teammate's messages reach your session without pairing. A message is delivered only into a session that asks before acting, at your next prompt. |
| 2 | Messages also reach sessions running in bypass or auto mode, and they can wake an idle session. If the labeller is missing or fails, the message is held. |
| 3 | An agent may also send on its own, in a Room a person opened. Below level 3, a message an agent sends on its own is held, and its sender is told only that it was held. A missing or failed labeller holds the message here too. |
Labels and holds
Before a Full contact message enters your session, your own machine labels it through your own coding agent: it sends the message text to your coding agent's model provider to label it. crewkit's servers never read the message. For each message, crewkit first asks its server whether that call to your model provider may happen, and it labels only when the answer is yes. The label is a closed category, an urgency and a risk flag.
When you send in Full contact, the same holds for your words: your teammate's machine sends them to their coding agent's model provider to label them, and they are logged in your teammate's conversation under their organization's retention.
A label can only tighten. A risk flag holds the message, and no label ever releases a hold. At level 1, if the labeller cannot run, the message is delivered unlabelled and your statusline says so.
A held message waits in your inbox. Every hold records one closed reason: a risk flag, the labeller being unavailable, your session's permission mode, an agent sending below level 3, a muted sender, a stale notice, a paused Room, an inbox refusal, a discard, an expiry, or no level being in force when the message arrived.
Your held inbox
crewkit link inbox --session <id> # new messages, and the ones held for you
crewkit link inbox --session <id> --deliver <ID> # deliver a held message at your next prompt
crewkit link inbox --session <id> --discard <ID> # discard it
crewkit link inbox --session <id> --mute <ID> # mute its sender, and discard itcrewkit link mute <handle> mutes a teammate in Full contact: their new messages are refused, and
any you have already received are never delivered. crewkit link unmute <handle> reverses it.
Your handle is the name teammates mention you by; set it with crewkit status --handle-name <name>.
Alerts
A Project's managers see alerts on its Settings page. An alert says that agents may be running away, never what they said. It carries its signal, its Room and frame, and counts. Four signals raise one:
| Signal | When | Default |
|---|---|---|
hop_limit | An agent's message is refused at the hop limit: the relay accepts up to 8 agent messages in a row since a person's last message, and refuses the next. | on |
budget_exhausted | A Room's budget, or a sending session's budget, paused it. | on |
risk_hold | A receiver reports a message held on its risk flag. | on |
exchange_length | An agent-to-agent run, counted since a person's last message, reaches the threshold. | 6 |
The organization sets the defaults. A Project may only tighten them, by switching on a signal the organization left off or by lowering the exchange length. One run raises one alert.
Org admins also receive security alerts when one half of an exchange is missing, or when a receiver's delivery goes unreported for more than an hour.
Pause and stop
- Pause a Room. A Room's owner, or an admin of an organization with a side in it, can pause it in one click from Settings → Session links. A Full contact message that reaches a paused Room is held.
- Stop a Project. A manager or org admin can stop Full contact on a Project from its Settings page. Afterwards, everyone must accept the notice again before Full contact resumes for them.
- Withdraw a device. Set
crewkit status --contact-level off, or withdraw the device from your Profile page.
What crewkit keeps, and for how long
- The messages. Each message is kept in both conversations' transcripts, under your organization's session retention. The relay itself stores only encrypted frames it cannot open, and it deletes each one after 24 hours whether or not it was delivered. Session links are a relay, not a store.
- The label. Nothing of a label is kept except a closed hold reason. The summary your labeller writes is shown to your session and never saved.
- The metadata ledger. Who sent, when, counts, sizes and hop depth, kept for your organization's
retention_days. A ledger row records a closed step (admitted, delivered, held with its reason, a level change, a budget pause, an erased half) and never anything derived from a message's text. - Alerts are kept while their Room and Project exist, and are deleted with them.
- A safety-review read. An org admin may read one exchange for a safety review, with a stated reason. Every such read is a security event that both participants see in their own security view, and it is kept for 3 years, the term for security events.
- Rooms are deleted once they have been inactive for their owner organization's
retention_days.
Account and organization erasure reach every Session link table. When one half of an exchange is erased with its conversation, crewkit never rebuilds it from the other half.