
  ─────────────────────────────────────────────────────────────────────
   WHAT QUINT RECORDS ON THIS MAC
  ─────────────────────────────────────────────────────────────────────
   Quint records the text of the prompts you send to AI coding agents,
   and uploads it to Quint's cloud. It is not kept only on this machine.

   Uploaded with it:
     • the request body of each agent turn, up to 256KB — that is the
       conversation so far, including CLAUDE.md and injected context
       (replies are also captured, to a smaller 32KB limit)
     • the CONTENTS of files the agent reads, and the OUTPUT of the
       commands it runs (not just their names)
     • request bodies over 200KB are stored in Quint's object storage

   Anything you type or paste into an agent is included: secrets,
   customer data, private code, personal messages.

   SECRETS ARE PARTLY PROTECTED, AND ONLY PARTLY. Quint scans this
   content on THIS machine and replaces credentials it RECOGNISES
   with a marker before anything is uploaded — an AWS key, a GitHub
   or Slack token, a private key block, a keyword-assigned api_key.
   Secrets it does not recognise are uploaded verbatim, so do not
   read this as "no secret leaves this machine". The local audit
   database here keeps the original either way. Commands uploaded
   through path 3 are NOT scanned: a credential in a command an agent
   runs is uploaded verbatim.

   FOUR capture paths, and they are independent:
     1. harness telemetry from Claude Code, Codex and Gemini CLI.
        Onboarding no longer turns their own prompt logging on, and
        writes Gemini CLI's off (its default is on), so a prompt
        then reaches Quint this way as its length, not its text. It
        still carries prompt text wherever that logging is on: on a
        machine onboarded by an earlier version (below), and
        wherever you or your organisation turn it on. Other content
        arrives this way regardless: the email of the account you
        are signed in with; Codex reports each tool call's arguments
        and the first 2KB of its output; Gemini CLI its system
        instructions (your global GEMINI.md and its saved memory),
        its router's reasoning and tool error text.
     2. the intercepting proxy, which reads the request body directly
     3. quint-hook, which agents' own hooks run: Claude Code
        (~/.claude/settings.json, and a machine-wide file that applies
        to every user account on this Mac, which only an administrator
        can remove: /Library/Application Support/ClaudeCode/
        managed-settings.d/10-quint-trust.json; it also switches on
        path 1's telemetry and trust of Quint's CA for every user,
        whatever a user's own settings say), Codex
        (~/.codex/hooks.json, once its hooks are trusted), Cursor
        (~/.cursor/hooks.json) and, for tool calls only, GitHub
        Copilot CLI, Qwen Code, CodeBuddy, CodeWhale, Grok CLI, Hermes
        Agent, Kimi Code, Letta Code, Mistral Vibe and OpenHands where
        installed. Codex's and Cursor's prompts and replies are
        uploaded from this path as text, with credentials masked as
        above. Every other agent's prompt and response text is
        recorded in the LOCAL audit database, not uploaded from this
        path. Also uploaded: the commands and file paths an agent
        declares, its working directory, project, repository and
        your OS user name.
     4. a system-wide network filter, which sees EVERY outbound
        connection from EVERY process on this Mac — not only AI agents.
        It records the destination hostname, IP, port and the process
        that opened it. NOT the contents of those connections.

   Read path 4 again, because it is broader than the rest of this
   notice. Your browser reaching a bank, a medical portal or a private
   site produces a record of WHERE it connected, the same as an agent
   would. The connection itself is never decrypted or modified by this
   path — the hostname is read from the unencrypted greeting every TLS
   connection begins with. Only connections from a recognised agent
   session are uploaded; the rest are discarded on this machine.

   What actually turns capture off:
     • sudo quint off        stops paths 2 and 4, for 24 hours.
                             Not 1, not 3.
     • policy log_bodies:false  stops CONTENT upload on paths 1 and 2
                             (the local audit record still keeps it),
                             keeps prompt, response and reasoning
                             text out of path 3's local record, and
                             replaces path 3's uploaded prompts,
                             replies, commands, paths, directories
                             and repository with a marker. It does
                             not keep file contents or tool output
                             out of path 3's local record.
     • policy mask_secrets:false  turns OFF the credential masking
                             described above. It is ON by default;
                             setting it false uploads recognised
                             credentials verbatim as well.
     • the daemon repairs Quint's settings in two ways.
       Your own config files: whenever one of these is missing,
       switched off or not working, it rewrites ALL of Quint's
       settings for that agent — for Claude Code the exporter
       endpoint, the telemetry switch, Quint's CA setting or a
       quint-hook entry that can return Quint's verdict; for Gemini
       CLI the telemetry switch or its endpoint; for Codex the [otel]
       block or its hooks; for Cursor its preToolUse hook; and the
       quint-hook entries of the other agents in path 3. It runs on
       the daemon's first successful check-in after it starts and on
       some policy changes; not in local mode, and it waits while no
       one is logged in. Any other removal holds until then, or until
       quint onboard runs again. QUINT_NO_SELF_HEAL=1 in the daemon's
       own environment stops this repair.
       The machine-wide Claude Code file in path 3: rewritten within
       2 minutes of any change. QUINT_NO_SELF_HEAL does not stop that,
       and neither does quint off, except that a DELETED file is not
       recreated until quint off expires. sudo quint uninstall
       removes it.
     • Gemini CLI logs prompts unless logPrompts is false. Deleting
       that line turns its prompt logging back ON; the repair puts it
       back only when it rewrites Gemini CLI for a reason above. The
       GEMINI_TELEMETRY_LOG_PROMPTS environment variable, or a system
       or workspace setting, overrides what Quint writes.
     • every earlier version of quint onboard (v1.1.0 on) set prompt
       logging ON in those three harnesses (in Claude Code that also
       exports assistant response text; in Codex only where onboarding
       added the [otel] block). Running quint onboard again (install.sh
       does on every install and upgrade) sets Gemini CLI's back off.
       It leaves Claude Code's and Codex's as they are: to turn them
       off, delete OTEL_LOG_USER_PROMPTS from the env block of
       ~/.claude/settings.json, and set log_user_prompt = false in the
       [otel] block of ~/.codex/config.toml. sudo quint uninstall
       removes all three, except from a config file that is itself a
       symlink. Onboarding also refuses a symlinked folder; uninstall
       does not yet (proxy#1520).
     • sudo quint uninstall removes Quint's settings for Claude Code
       (the machine-wide file included), Gemini CLI and Cursor. In
       Claude Code's settings it puts back a value Quint replaced,
       where Quint recorded one. After the daemon has repaired that
       file it can leave Quint's own OTEL_LOGS_EXPORTER,
       OTEL_METRICS_EXPORTER and OTEL_EXPORTER_OTLP_PROTOCOL behind,
       which do nothing without the telemetry switch it removes
       (proxy#1518). Gemini CLI's are removed, not put back. It removes Codex's [otel] block when Quint's record shows
       Quint appended it or the block names Quint's local collector,
       and leaves an [otel] block of yours that exports elsewhere. It
       does NOT yet remove quint-hook from Codex's hooks.json or from
       the other agents in path 3: remove those entries by hand.
       Check what remains with: quint uninstall --verify
       (which does not check those files either)

   If you are not willing to have this machine's agent sessions
   recorded, do not onboard it.
  ─────────────────────────────────────────────────────────────────────
