Control privacy

hyp privacy <subcommand> [args...]

Use hyp privacy --help to list privacy operations:

hyp privacy --help

Directory classes are sync, local-only, and ignore. A policy marking is prospective; it doesn't delete rows already in the cache. Use purge only when you intend to delete existing local data.

hyp privacy show

hyp privacy show [path] [--json]

Resolves the governing class and source for a path, which defaults to the current directory. It also reports a best-effort residual cache count.

hyp privacy show . --json

hyp privacy set

hyp privacy set <path> sync|local-only|ignore

Upserts an exact host-local path marking. It doesn't write a dotfile or delete rows. An ignore marking prints a line naming hyp privacy purge --ignored, which deletes what was already recorded in every ignored folder.

hyp privacy set ./private-research local-only

hyp privacy unset

hyp privacy unset <path> [sync|local-only|ignore]

Removes host-local entries governing the path. Add a class to remove only entries of that class. The operation is idempotent and doesn't delete rows.

hyp privacy unset ./private-research local-only

hyp privacy list

hyp privacy list [--json]

Lists host-local path and client policy plus the new-folder prompt preference. It can't globally enumerate .hypignore files; use hyp privacy show PATH for a specific path.

hyp privacy list --json

hyp privacy ignore

hyp privacy ignore [path]

Writes a shareable .hypignore file in an existing directory at the explicit path. With no path, uses the repository root, or the current directory when outside a repository. Use hyp privacy set <path> sync|local-only|ignore for host-local markings and hyp privacy show [path] to report without writing. The receipt names hyp privacy purge --ignored to delete what was already recorded in ignored folders.

hyp privacy ignore ./customer-data

hyp privacy unignore

hyp privacy unignore [path]

Removes the nearest governing .hypignore. Use hyp privacy unset <path> to remove host-local markings. It does not remove cached rows.

hyp privacy unignore ./customer-data

hyp privacy client

hyp privacy client [<name>] [sync|local-only] [--json]

Lists or changes per-client export policy. local-only withholds future rows from remote sync. Returning to sync affects future rows only: the policy flip itself syncs nothing that was withheld. To sync that retained history, run the separate, separately confirmed hyp sync --history <client>. A client required by central configuration can't opt out.

hyp privacy client codex local-only

hyp privacy folders

hyp privacy folders [ask|sync] [--json]

Reports or changes whether unclassified folders sync by default or prompt once for classification. Existing markings and .hypignore files don't change.

hyp privacy folders ask

hyp privacy purge

hyp privacy purge <path> | --session <id> [--remote <target> | --local-only] | --ignored | --all [--yes] [--json]

Warning: This operation permanently deletes matching rows from this host's local cache. Select exactly one target. Every form also sweeps the Claude raw-body spool so pending bodies can't recreate deleted rows. A terminal prompts for confirmation; a non-interactive call requires --yes.

A --session purge also deletes that session's rows from every configured or signed-in remote and every enrolled server, and excludes the session from future recording. --remote <target> limits the remote scope to one server; --local-only skips servers. The two flags are mutually exclusive and apply only with --session. Remote deletion uses your login credential and requires the session owner or an organization admin. Physical files remain until compaction, and copies in published reports aren't covered.

With --json, each entry in a --session purge's local.cache_cleanup admits background file cleanup for one cache partition; it is not a durable deletion certificate. Its job_id names the partition (job_scope: "cache_partition"), so a later purge of the same partition reuses it. The cleanup status API reports completed only until maintenance retires the finished cleanup, with no minimum window, and unverified after that. unverified means the completion can no longer be certified, not that cleanup failed or that the files remain.

The <path>, --ignored, and --all targets purge locally only. They never contact a sink or HypAware Cloud and can't retract exported copies.

hyp privacy purge --session SESSION_ID
hyp privacy purge --session SESSION_ID --local-only

Replace SESSION_ID with the reviewed session ID. Avoid --yes during manual work. A remote failure returns a nonzero exit status; repeat the command to finish an incomplete purge.