Principles
- Read-only. Oobo never writes to any AI tool’s data directories.
- Local by default. Everything stays in
~/.oobo/. Nothing leaves your machine unless you explicitly configure an endpoint. - No telemetry. Oobo does not phone home, collect analytics, or send any data without explicit user action.
- Config protection. When API keys are present, config file permissions are set to
0600(owner read/write only).
What oobo reads
Oobo reads local files from AI coding tools to discover sessions, extract conversations, and compute token stats. All reads are read-only.| Tool | What’s read | Location |
|---|---|---|
| Cursor | SQLite databases, workspace state | ~/Library/Application Support/Cursor/, ~/.cursor/ |
| Claude Code | JSONL session files | ~/.claude/projects/ |
| Gemini CLI | JSON session files | ~/.gemini/tmp/ |
| OpenCode | SQLite database | ~/.local/share/opencode/ |
| Codex CLI | SQLite + JSONL files | ~/.codex/ |
| Aider | Markdown chat history | {project}/.aider.chat.history.md |
| Copilot | JSON session files | VS Code workspace storage |
| Windsurf | Protobuf files (encrypted, metadata only) | ~/.codeium/windsurf/ |
| Zed | SQLite + JSONL telemetry | ~/Library/Application Support/Zed/ |
| Trae | VSCode state DB (metadata only) | ~/Library/Application Support/Trae/ |
What oobo writes
| Location | What | When |
|---|---|---|
~/.oobo/db/oobo.db | SQLite database (sessions, projects, anchors, stats) | Always |
~/.oobo/config.toml | Configuration | On oobo setup or config changes |
.git/oobo-sessions/*.json | Active session state files | During agent lifecycle hooks |
oobo/anchors/v1 (orphan branch) | Anchor metadata (always) + redacted transcripts (if transparency is on) | On every intercepted commit (unless project is ignored) |
Secret redaction
Before any session content leaves your machine (viaoobo share or transparency on), all content is redacted:
- gitleaks (if installed): comprehensive secret detection using gitleaks patterns
- Regex fallback: catches API keys, tokens, passwords, AWS credentials, Bearer tokens
[REDACTED].
Network requests
Oobo makes network requests only when you explicitly trigger them:| Action | Destination | Data sent |
|---|---|---|
oobo auth login | Your configured server | API key verification |
| Sync on commit (when enabled) | POST /anchors/ingest on your server | Anchor metadata (commit, sessions, attribution) |
oobo share (without --out) | Your configured server | Redacted session content |
oobo update | GitHub API | Version check only |
oobo auth anthropic/openai/... + oobo index | Provider APIs | API key + usage query |
oobo sync on) and configure an API key.