Account and privacy

Agent Studio runs on your machine and uses your installed Claude Code account for coding-agent sessions. A Sapiom account is separate: it is required for cloud-owned actions such as the live template gallery, deploy, production runs, schedules, and signals, but not for editing, checking, or running an agent locally.

Account boundary

The desktop and command-line hosts reuse the current environment entry in ~/.sapiom/credentials.json. If no credential exists, a normal npx launch opens signed out; use the account menu later, or launch with --login to complete browser sign-in before startup. A clean desktop launch attempts browser sign-in and still opens for local work if that flow is cancelled or unavailable.

Disconnect removes the cached Sapiom credential for the current environment. It does not sign Claude Code out, delete Claude’s conversation history, remove an agent project, or erase Studio session records. See Credentials and configuration for the complete credential matrix.

Local server access

The Studio server listens on 127.0.0.1, not on every network interface. Each launch creates a random boot token that protects its HTTP API, WebSocket connection, and terminal-event ingestion.

For a command-line launch, the complete tokenized URL is printed once in the terminal. Treat that URL as a credential for the current Studio process: bare http://localhost:4100 is not an authenticated substitute, and the URL should not be pasted into an issue or prompt. The token expires when that server exits.

Three separate controls

Control	Default	What it governs
Share session details with Sapiom	Off	Remote delivery of detailed coding-session events.
Product analytics (clicks & usage)	On	PostHog interaction and outcome analytics from the Studio UI.
Summarize sessions in the background	Off	Optional coding-agent work that improves a later portable continuation.

The two telemetry toggles are independent unless a hard-off flag is active. The session-summary toggle is not telemetry: it controls a local continuation aid that uses your coding-agent account and tokens.

When enabled, Studio can send normalized session lifecycle events, prompts, assistant replies, tool names, bounded tool inputs and results, working-directory and session identifiers, and—when transcript enrichment succeeds—model and token-usage fields to Sapiom’s collector. The first interactive command-line launch and desktop setup explain this tier before saving a choice.

The same normalized events are always written locally to ~/.sapiom/harness/events.ndjson, whether remote sharing is on or off. The local log retains the newest data within both a 30-day age cap and a 50 MB size cap. Turning sharing off discards events still buffered for remote delivery; a request already in flight can finish.

Archived session records are a different local surface. They keep a compact, explicitly lossy conversation reconstruction for up to 365 days within a 16 MB store cap so History can outlive the raw event log. See Files and retention for the exact paths and limitations.

Product analytics

When enabled, Studio initializes PostHog with page-open/page-leave events, autocaptured interactions, heatmaps, dead-click detection, and a small typed set of outcome events. Typed events carry identifiers, enums, counts, and durations—not prompt text, file contents, secret values, or free-form error messages. Studio never enables session or screen recording.

Before any event leaves the page, Studio removes query strings and fragments from URL-valued fields, including the boot token. Autocaptured element text is limited to 120 characters. On a tagged secret or credential surface, element text, serialized element chains, and all but class/id element attributes are removed. If this redaction step throws, the event is dropped rather than sent unredacted.

Product analytics starts anonymously. After Sapiom sign-in, Studio identifies the current account and associates events with the current organization; signing out resets that browser identity. PostHog’s local retry queue and distinct ID live in browser storage, separately from ~/.sapiom/harness.

Turn off all outbound telemetry

Use any one of these for a hard-off launch:

npx @sapiom/agent-studio@latest --no-telemetry

SAPIOM_TELEMETRY_DISABLED=1 npx @sapiom/agent-studio@latest

DO_NOT_TRACK=1 npx @sapiom/agent-studio@latest

The environment variables accept 1 or true, case-insensitively. A hard-off launch disables both outbound telemetry tiers and locks both UI toggles until the environment override is removed and Studio restarts. It does not stop the local events.ndjson write.

For a disposable state root that does not read or write ordinary Studio state, combine --state-root <scratch-directory> with --no-telemetry. An explicit state root relocates Harness-owned files only; it does not relocate shared credentials, Claude Code history, browser storage, desktop app data, or your project directory.

Background session summaries

When enabled, Studio starts a one-turn Claude Code task after every 10 completed turns and once more at session end when there is new material. It asks for at most a 500-word summary and stores the result under that session’s generated-config directory. The task is best-effort, never blocks the interactive turn, and uses your Claude Code account.

That summary is an ephemeral cache, not the durable History record. Generated session directories are removed when their managed process exits, and abandoned ones are eligible for a seven-day stale sweep. Portable continuation still works when the toggle is off or no summary survives: it falls back to a bounded reconstruction of recent recorded turns.

Uninstall and delete local data

Quitting or uninstalling the desktop app removes neither shared nor project data. Likewise, npx leaves no global Studio executable to uninstall, but it does retain the files created while Studio ran.

Review each owner before deleting anything:

Owner	Location	What removal affects
Agent Studio	`~/.sapiom/harness/`	Studio settings, local session registry and records, registered agent projects, event log, and generated session files. It does not remove projects, shared credentials, or Claude history.
One project/session directory	`<directory>/.sapiom/`	Studio context, Canvas files, and composer uploads in that directory. Inspect version-control status before removal.
Agent author	`<agent-project>/.sapiom-dev/`	Checked local-run stubs. This is project authoring data, not uninstall residue.
Sapiom authentication	`~/.sapiom/credentials.json`	Cached sign-in shared by Studio and the local authoring MCP. Prefer Disconnect when removing only the current environment entry.
Sapiom analytics identity	`~/.sapiom/analytics.json`	The analytics-core identity used by detailed telemetry clients. It is outside `--state-root`.
Claude Code	`~/.claude/projects/`	Claude-owned conversation transcripts used to verify native Resume. Studio does not own or delete them.
Browser	Site local storage for the Studio origin	Theme, pane/UI preferences, and product-analytics persistence for that origin.
Desktop host	Your operating system’s Sapiom app-data directory	The desktop-managed runtime shims and per-user Claude Code installation, plus Electron host data. This location is platform-specific and separate from `~/.sapiom/harness`.

Agent Studio reference Look up every CLI flag, local file, retention boundary, and keyboard shortcut.

Troubleshoot Agent Studio Recover from launch, browser, sign-in, history, resume, and Canvas failures.