A hands-on investigation into where six AI coding CLIs — Claude Code, Codex CLI, Cursor CLI, Amp CLI, opencode, and pi — store their session logs on disk. Covers exact file paths, storage formats (JSONL, SQLite, JSON), retention settings, and what remains undocumented. Key findings: only Claude Code has age-based auto-deletion; transcripts are plaintext with no encryption at rest; several paths move silently based on environment variables like XDG_CONFIG_HOME; and building tooling on undocumented paths is risky since formats change without notice. Includes practical warnings about syncing tools like Dropbox or Time Machine inadvertently copying sensitive session data.
Table of contents
How I checked thisThe short version1. Claude Code: fully documented2. Codex CLI: the config keys are documented, the transcripts are not3. Cursor CLI: the chat store is undocumented4. Amp CLI: the server holds the real copy5. opencode: thousands of JSON files became one database6. pi: the only one that publishes its file formatFive things I take away from thisWhat I do nowResources17 Impressions