Skip to main content
private has two behaviors, depending on whether you give it a prompt:
  • With a prompt, it runs a one-shot exchange that never reaches Anthropic or OpenAI. The question and the answer stay out of what your harness sends, and the answer is shown back to you as a blocked turn.
  • With no prompt, it opens a fresh incognito session that keeps nothing, no prompt history, no transcript, no resume state.
The private guarantee depends on your harness’s hooks being enabled and trusted. If hooks are disabled, private cannot intercept the turn. Do not submit private data with hooks off. On Codex this is the one-time /hooks trust step from Install.

​
One-Shot Private Prompt

Give private a prompt and it answers from a model through Nito without your harness’s upstream ever seeing it.
The plugin intercepts the command before your harness runs its own inference, sends a prompt-only request to Nito, and returns the answer labeled Session mode: Incognito. Your original harness turn is stopped, so the prompt and answer never enter the harness model’s context.

​
Options

Anonymous, Private, and Confidential models all work with private. An :encrypted model is refused before the call is routed, because Encrypted is coming soon to the plugin rather than available today.

​
Incognito Session (no prompt)

Run private with no prompt to go beyond a single turn.
Opens a fresh, fully Nito-routed session in a separate terminal. It keeps nothing: prompt history and transcripts are off, and there is no resume. Your original session is untouched and receives only a launch result.

​
Session Options and Their Trade-offs (Claude Code)

The incognito session’s whole point is that it writes nothing. Two options relax that, and you should understand the trade-off before using them:

​
What Private Covers

  • What it protects: the prompt and the Nito answer are kept out of your harness model’s request, so the harness provider never receives them. The result is labeled so you can confirm it ran privately.
  • What stays in the path: your local harness process, your operating system, the Nito gateway, and the selected model provider are still involved. Private removes the harness model from the exchange, not everyone.
  • What it depends on: hooks must be enabled and trusted. The command stub fails closed, but with hooks off it cannot intercept the turn.
The full boundary, and how to reason about it, is on The Trust Boundary.

​
Codex Notes

  • Trigger with $, not /. There is no /private alias in Codex.
  • The response display is capped so it stays within Codex’s limits; a very long answer is truncated in the shown block.
  • If a matched private prompt is too large or malformed to process, the plugin fails closed (it blocks the turn) rather than letting the marked prompt continue to ordinary Codex inference.