Pro plugin

Claude Code

Collects Claude Code CLI transcripts, subagents, prompt history, file-history backups, global config, settings and hooks, MCP logs, memory, extensions, credential presence and runtime state for every config root

ai.claudecodePromacOS 12.0+v1.0.0aidevtoolsuserexecution

Run this plugin

Trigger collection for Claude Code on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin ai.claudecode --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin ai.claudecode --dry-run

Compatibility

macOS 12.0+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (13 collected, 8 planned)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

config

Artifact	Format	Path	Notes
Claude Code Config Roots claudecode_config_dirsSensitivehigh value	directory	`~/.claude/` +9 more `~/.claude-*/` `~/.zshrc` `~/.zshenv` `~/.zprofile` `~/.bashrc` `~/.bash_profile` `~/.profile` `~/.config/fish/config.fish` `~/.claude/.last-cleanup`	One claudecode_config_dir record per root with how it was discovered (default, glob, shape, rc_file, option), counts, effective cleanupPeriodDays and anti-forensics hints (CLAUDE_CODE_SKIP_PROMPT_HISTORY, --no-session-persistence, low or zero cleanupPeriodDays). Only matching rc lines are recorded, redacted; rc files are not copied (the shell plugin's domain).
Claude Code Global Config claudecode_global_configOptionalSensitivehigh value	json	`~/.claude.json` +5 more `~/.claude/.claude.json` `~/.claude/backups/.claude.json.backup.` `~/.claude/backups/.claude.json.corrupted.` `~/.claude.json.backup` `~/.claude.json.bak`	Account (email, org, UUIDs), every project path with trust and allowed tools, user and project MCP servers (env redacted), last-session cost and usage, userID, install method, legacy prompt history. ~/.claude/.claude.json is the default root's instance of <root>/.claude.json (the location used by non-default roots); both locations are checked. Raw copies only with include_secrets.
Claude Code Memory and Instructions claudecode_memoryOptionalSensitivemedium value	text	`~/.claude/projects//memory//.md` +3 more `~/.claude/CLAUDE.md` `~/.claude/rules/*/.md` `/Library/Application Support/ClaudeCode/CLAUDE.md`	Auto memory (Claude's notes about the user and project; outlives transcripts), user CLAUDE.md, rules and the managed CLAUDE.md: standing instructions and a prompt-injection or persistence vector.

metadata

Artifact	Format	Path	Notes
Claude Code Installation claudecode_installOptionalmedium value	binary	`~/.local/bin/claude` +13 more `~/.local/share/claude/versions/` `~/.local/share/claude/ClaudeCode.app/Contents/Info.plist` `~/.local/state/claude/locks/.lock` `~/.claude/.last-update-result.json` `/usr/local/lib/node_modules/@anthropic-ai/claude-code/package.json` `/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/package.json` `~/.npm-global/lib/node_modules/@anthropic-ai/claude-code/package.json` `~/.nvm/versions/node//lib/node_modules/@anthropic-ai/claude-code/package.json` `~/.local/share/fnm/node-versions//installation/lib/node_modules/@anthropic-ai/claude-code/package.json` `~/.volta/tools/image/packages/@anthropic-ai/claude-code/lib/node_modules/@anthropic-ai/claude-code/package.json` `~/.asdf/installs/nodejs//lib/node_modules/@anthropic-ai/claude-code/package.json` `/opt/homebrew/Caskroom/claude-code/` `/usr/local/Caskroom/claude-code/*`	Install method (native, npm, nvm, fnm, volta, asdf, Homebrew cask), versions present on disk with mtimes, launcher target, and the last auto-update result. The app may be uninstalled while data remains.
Claude Code Usage Statistics claudecode_usage_statsPlanned — not collected yetOptionalSensitivemedium value	json	`~/.claude/stats-cache.json` +2 more `~/.claude/usage-data/` `~/.claude/feedback-bundles/`	Aggregated tokens and cost per day and model, /insights reports and feedback bundles.

persistence

Artifact	Format	Path	Notes
Claude Code Settings and Hooks claudecode_settingsOptionalSensitivehigh value	json	`~/.claude/settings.json` +8 more `~/.claude/settings.local.json` `~/.claude/remote-settings.json` `~/.claude/policy-limits.json` `/Library/Application Support/ClaudeCode/managed-settings.json` `/Library/Application Support/ClaudeCode/managed-settings.d/.json` `/Library/Application Support/ClaudeCode/managed-mcp.json` `/Library/Managed Preferences/com.anthropic.claudecode.plist` `/Library/Managed Preferences//com.anthropic.claudecode.plist`	Hooks, statusLine and apiKeyHelper commands (persistence), permission rules and default mode, env (redacted), enabled plugins, cleanupPeriodDays, managed and MDM policy. Managed and MDM files are collected once per run; per-user Managed Preferences are assigned to that user. Raw copies only with include_secrets.

session

Artifact	Format	Path	Notes
Claude Code Transcripts claudecode_transcriptsOptionalSensitivecritical value	jsonl	`~/.claude/projects//.jsonl` +4 more `~/.claude/projects//.orphaned-.jsonl` `~/.claude/projects//.jsonl.superseded-` `~/.claude/projects///custom-title.json` `~/.claude/projects/*/.session-aliases`	Every prompt, assistant reply, thinking, tool call and result, permission decision, cwd and git branch per turn. Copied then parsed from the copy. Also emits claudecode_session, the per-session union of every source (spec §5.1).
Claude Code Subagent Transcripts claudecode_subagentsOptionalSensitivehigh value	jsonl	`~/.claude/projects///subagents/agent-.jsonl` +1 more `~/.claude/projects///subagents/agent-.meta.json`	Subagent prompts and tool calls (often where commands actually ran), linked to the parent tool call via the meta toolUseId or the parent's agentId.
Claude Code Runtime State claudecode_runtimeOptionalSensitivemedium value	json	`~/.claude/sessions/.json` +4 more `~/.claude/shell-snapshots/snapshot-.sh` `~/.claude/session-env//` `~/.claude/ide/.lock` `~/.claude/.last-cleanup`	Live or crashed session registry (pid, session id, cwd, version, status), shell snapshots (aliases and functions at session start), per-session env, IDE locks (authToken never recorded) and the last retention sweep time.
Claude Code Tasks and Plans claudecode_tasks_plansPlanned — not collected yetOptionalSensitivemedium value	json	`~/.claude/tasks//.json` +1 more `~/.claude/plans/*.md`	Task lists and plan-mode plans (intent before execution).
Claude Code Background Jobs claudecode_jobsPlanned — not collected yetOptionalSensitivelow value	json	`~/.claude/jobs/` +1 more `~/.claude/daemon/dispatch/`	Background and agent-view session jobs and daemon dispatch records.

cache

Artifact	Format	Path	Notes
Claude Code Tool Results claudecode_tool_resultsOptionalSensitivehigh value	text	`~/.claude/projects///tool-results/*.txt`	Full tool output spilled from transcripts (persistedOutputPath) and background-task output. v1 inventories and hashes these files; content is not copied.
Claude Code Temporary Scratch claudecode_tmp_scratchPlanned — not collected yetOptionalSensitivemedium value	directory	`/private/tmp/claude-*/`	Per-session scratchpads, background task output and pasted images under the OS temp dir; gone after reboot (live response only).

storage

Artifact	Format	Path	Notes
Claude Code File History claudecode_file_historyOptionalSensitivecritical value	binary	`~/.claude/file-history//@v*`	Byte-for-byte pre-edit contents of every file Claude modified, mapped to original paths through the session transcript's file-history snapshots and deltas.
Claude Code Legacy Stores claudecode_legacyPlanned — not collected yetOptionalSensitivelow value	json	`~/.claude/todos/.json` +3 more `~/.claude/statsig/` `~/.claude/logs/*` `~/.claude/__store.db`	Stores of older versions: TodoWrite lists, Statsig cache, logs and the early 0.2.x SQLite store.

command history

Artifact	Format	Path	Notes
Claude Code Prompt History claudecode_historyOptionalSensitivecritical value	jsonl	`~/.claude/history.jsonl` +1 more `~/.claude/paste-cache/*.txt`	Every typed prompt and slash command with ms timestamp, project and session id. Not swept by cleanupPeriodDays, so it outlives transcripts. Large pastes live in paste-cache.

logs

Artifact	Format	Path	Notes
Claude Code MCP Logs claudecode_mcp_logsOptionalSensitivehigh value	jsonl	`~/Library/Caches/claude-cli-nodejs//mcp-logs-/*.jsonl`	Per-MCP-server connection logs with session id and cwd. Never swept, so they show MCP servers used per project per session long after transcripts are gone. Capped by mcp_logs_max_mb: parsed and copied newest first until the cap, older logs hashed and inventoried only.
Claude Code Debug Logs claudecode_debug_logsPlanned — not collected yetOptionalSensitivemedium value	text	`~/.claude/debug/*.txt` +1 more `~/.claude/debug/latest`	Written when --debug or /debug was used: API errors, hook execution, MCP traffic.

extensions

Artifact	Format	Path	Notes
Claude Code Extensions claudecode_extensionsOptionalmedium value	directory	`~/.claude/agents/` +6 more `~/.claude/commands/` `~/.claude/skills/` `~/.claude/output-styles/` `~/.claude/workflows/` `~/.claude/plugins/installed_plugins.json` `~/.claude/plugins/known_marketplaces.json`	Inventory (name, path, hash, mtime) of user agents, slash commands, skills, output styles, workflows, installed plugins and marketplaces. Contents are not parsed in v1.

credentials

Artifact	Format	Path	Notes
Claude Code Credential Presence claudecode_credentialsPlanned — not collected yetOptionalSensitivemedium value	binary	`~/.claude/.credentials.json` +3 more `~/.claude/sessions/*.key` `~/.claude/daemon/control.key` `~/Library/Keychains/login.keychain-db`	Presence only: files are stat'ed, never opened. On a live source the Keychain generic password with service "Claude Code-credentials" is looked up for attributes only (no -g/-w). No credential value is ever read.

media

Artifact	Format	Path	Notes
Claude Code Pasted Images and Uploads claudecode_mediaPlanned — not collected yetOptionalSensitivemedium value	directory	`~/.claude/image-cache//` +1 more `~/.claude/uploads//`	Pasted screenshots (image-cache, until v2.1.274) and files attached to Remote Control sessions.