Agent Log Discovery Guide

How to find and parse agent conversation logs from various coding tools.

Cursor

Locations

Cursor stores agent transcripts as JSONL files:

~/.cursor/projects/<project-hash>/agent-transcripts/*.jsonl

The <project-hash> is derived from the project's filesystem path. To find the right project directory, check the folder names or search for ones containing transcripts with references to the current repo:

# List all Cursor project directories with transcripts
find ~/.cursor/projects -name "agent-transcripts" -type d 2>/dev/null

# Check which project dir matches by looking at recent transcript content
for dir in ~/.cursor/projects/*/agent-transcripts; do
  if ls "$dir"/*.jsonl >/dev/null 2>&1; then
    echo "=== $dir ==="
    head -c 500 "$(ls -t "$dir"/*.jsonl | head -1)"
    echo
  fi
done

Format

Each .jsonl file is one conversation. Each line is a JSON object representing a message or event in the conversation. Look for:

• User messages (the task requests)
• Assistant messages (agent responses)
• Tool calls and results (actions taken)
• Error messages

The exact schema may vary between Cursor versions. Parse defensively and adapt to what you find.

Claude Code

Locations

Claude Code stores conversations in project-specific directories:

~/.claude/projects/<project-path-hash>/*.jsonl

The hash is derived from the project's absolute path. To discover:

# List Claude Code project directories
find ~/.claude/projects -name "*.jsonl" -type f 2>/dev/null | head -20

# Or check for a conversations directory
ls ~/.claude/conversations/ 2>/dev/null

Format

Similar to Cursor — JSONL with one JSON object per line representing conversation turns. Look for the same patterns: user messages, assistant responses, tool calls, errors.

Other Tools

Windsurf / Codeium

Check ~/.codeium/ or ~/.windsurf/ for conversation logs. The exact locations evolve as these tools are updated.

Generic Discovery Strategy

If you can't find logs in the expected locations:

1. Search for JSONL files in common AI tool config directories:

   find ~ -maxdepth 4 -name "*.jsonl" -path "*/.cursor/*" -o -name "*.jsonl" -path "*/.claude/*" 2>/dev/null

2. Check for any project-specific conversation storage:

   find . -name "*.jsonl" -path "*transcript*" -o -name "*.jsonl" -path "*conversation*" -o -name "*.jsonl" -path "*chat*" 2>/dev/null

3. If no logs are found, report this clearly — the absence of accessible agent logs is itself a finding (TCG-2: missing tool integration for log collection).

Matching Projects

Agent tools key their storage by the project directory path. A project at /Users/alice/code/myapp might be stored under a hash like Users-alice-code-myapp or a hex hash. To match:

1. Look for directory names that contain fragments of the current repo path
2. Read a sample of transcripts from candidate directories and check for references to files in the current repo
3. If using the audit-logs plugin, its collection scripts handle this matching automatically

Privacy & Security

• Agent logs may contain sensitive information (API keys, credentials, personal data, proprietary code)
• NEVER reproduce sensitive content in your report
• Summarize patterns and reference sessions by ID, don't paste raw transcripts
• If you encounter credential-like strings, note that credentials appear in logs (a security finding) but don't include the actual values