​
CLI sources

The CLI discovers source locations before it parses transcript content. Discovery returns paths and source kinds so the setup flow can ask what you approve first.

​
Supported sources

User-facing aliases such as claude and gemini map to canonical policy values.

​
Claude Code transcripts

Claude Code scanning reads every session transcript under ~/.claude/projects, including sub-agent transcripts (<session>/subagents/agent-<id>.jsonl) and workflow sub-agent transcripts (<session>/subagents/workflows/wf_<id>/agent-<id>.jsonl). Each sub-agent is its own trace keyed by its agent id and linked to its parent session. Workflow sidecars that are not conversations, such as journal.jsonl, are skipped.

​
Cursor stores

Cursor scanning checks ~/.cursor/state.vscdb plus the global and workspace stores in Cursor’s user directory for the platform: Cursor and OpenCode scanning use the system sqlite3 command. If sqlite3 is missing, or a store cannot be read, the CLI skips that store instead of uploading partial unknown data and names it under scanIssues in upload --dry-run --json (and in the human-readable plan). selltraces doctor reports whether sqlite3 is available. SellTraces does not discover or ingest ~/.traces/traces.db; that path is not a supported source policy value. The SellTraces-owned local store under ~/.selltraces/traces.db is used only for local trace-index and repeat-sync state.

​
Trace size

Each trace must fit, on its own, inside one upload request (4 MB of serialized JSON, under the platform’s 4.5 MB request limit). A longer session is not skipped: while its transcript is read line by line, it is split at message boundaries into consecutive segments of at most 3.5 MB of messages, uploaded as <session id>#1, #2, and so on, so a very large session is never loaded whole. Earlier segments stay the same as a session grows, so a later upload sends only the segment that changed. A single message too large for one upload keeps a prefix of its text ending with [selltraces truncated N characters]. upload --dry-run --json reports segmentedSessionCount, segmentCount, and truncatedMessageCount.

​
Source policy

The saved policy lives at:
It records:
  • approved sources
  • approved projects
  • projects kept private
  • case-insensitive blocked terms
The policy is applied by upload, upload --dry-run, onboarding history uploads, and the compatibility preview/sync commands.

​
Filtering order

Every upload plan applies local controls in this order: Source-policy filtering happens before blocked-term and PII checks so the reported skip reason reflects the earliest control boundary.

​
Repeat uploads

Successful uploads are recorded in:
The SQLite ledger stores preflighted content hashes, source labels, source ids, token counts, and preliminary local value estimates. Later runs skip identical traces as already synced while still allowing changed ongoing sessions to be reconsidered. Older installs may have ~/.selltraces/sync-state.json; that file is legacy state migrated into the SQLite ledger on first open.