Trace Commons

Install Trace Commons

Everything here runs on your own machine. Nothing is sent anywhere until you run submit, and submit --dry-run shows you exactly what would go before anything does.

The desktop app

On macOS:

brew tap TraceCommons/tap
brew trust tracecommons/tap
brew install --cask trace-commons

Or take TraceCommons-0.4.6.dmg directly. It is a universal build, so it runs on both Apple silicon and Intel, and it is notarized and stapled — it opens without a Gatekeeper prompt even offline.

On Windows:

Add-AppxPackage -AppInstallerFile https://storage.googleapis.com/tracecommons-flatpak/windows/TraceCommons.appinstaller

That installs the signed MSIX and, unlike the zip below, leaves Windows responsible for keeping it current: the .appinstaller it was installed from is checked on launch, at most once every eight hours, and a newer version is fetched in the background. The package is Iqlusion.TraceCommons, published as CN=Iqlusion Inc — Windows will show you that publisher before it installs anything, and it is worth reading rather than clicking past.

Or unzip it and keep a folder instead, which is the same application with no update mechanism attached:

Expand-Archive trace-commons-app-windows-x86_64-0.4.6.zip -DestinationPath .
.\TraceCommons-0.4.6\TraceCommons.exe

Take trace-commons-app-windows-x86_64-0.4.6.zip and unzip it anywhere. There is nothing to install first: the .NET runtime and the Windows App SDK are bundled inside, so it is a folder you keep rather than something that writes into the system. TraceCommons.exe is Authenticode-signed by Iqlusion Inc and timestamped, and the same Get-AuthenticodeSignature check shown below works on it — check the subject, not just that a signature exists.

Both assets sit on the release too, the MSIX as TraceCommons.App_0.4.6.0_x64.msix. Installing that file directly works and gets you no updates: the update address lives in the .appinstaller, so a bare MSIX is the zip with extra steps. Note also that the release carries a second Windows zip, trace-commons-windows-x86_64-0.4.6.zip — that one is the command-line contributor, not this app, and the names differ by one word.

As of 0.3.0 the Windows app submits. It enrols you, takes your scopes, queues what it finds, opens the same preview the other two shells do, and contributes when you approve — with an undo window until the watcher's next sweep. Approving is deliberately awkward in one specific way: the Contribute button is inert until the transcript has actually been on screen and you have ticked the acknowledgement by hand, and there is no approve control on a queue row, because approving from the row is approving without looking. Nothing reachable from the tray icon or a notification approves or sends anything either.

On Linux, as a flatpak:

flatpak install --from \
  https://storage.googleapis.com/tracecommons-flatpak/ai.tracecommons.Contributor.flatpakref

The OSTree repo behind that is GPG-signed and flatpak verifies it as part of the install. The app is confined: it asks for read-only access to ~/.claude/projects and ~/.codex/sessions and nothing wider, which you can check with flatpak info --show-permissions ai.tracecommons.Contributor.

All three now carry the whole path on their own: each enrols you — an invite by paste or by clicking the link — lets you choose your consent scopes, previews what a session would send, submits it when you approve, and shows you the receipt. None of them needs the CLI at any step, so the steps below are an alternative rather than a requirement on any platform. Windows is the newest of the three and is still missing pieces around the edges: bulk withdrawal is absent by design (a bulk call cannot report what happened to each trace, and reporting a generic “withdrawn” is exactly what the withdrawal contract forbids — withdraw per row instead), and the watcher knobs, the connection section and most of the tray menu's vocabulary are not drawn yet.

Building from source instead

Still supported, and necessary on any platform not in the table above — Linux on arm64, for instance. It needs a Rust toolchain.

git clone https://github.com/TraceCommons/trace-commons-server
cd trace-commons-server
cargo build --release --bin trace-commons-contributor
./target/release/trace-commons-contributor --help

Uninstalling

Two separate things come off: the local state — device key, config, receipts, the daemon's queue and history — and the installed program. Start with the state, because logout also stops a running daemon before it wipes the credentials that daemon uploads with:

trace-commons-contributor logout

Uninstalling is not withdrawal. Traces you have already submitted stay on the server; daemon withdraw <submission-id>, or --all-quarantined, is what removes them — and it needs the account session, so do any withdrawing before you log out.

logout empties the state directory but leaves the directory itself. Remove it to finish the job:

If you set TRACE_COMMONS_CONTRIBUTOR_DIR, that path wins over all of these.

Then remove the program itself, by however you installed it:

# CLI, install.sh
rm ~/.local/bin/trace-commons-contributor    # or $TC_INSTALL_DIR, or --dir

# CLI, Homebrew
brew uninstall trace-commons-contributor

# Desktop app, Homebrew cask (macOS)
brew uninstall --cask trace-commons

# Desktop app, flatpak (Linux) -- --delete-data also removes ~/.var/app state
flatpak uninstall --delete-data ai.tracecommons.Contributor

# and, if you want the tap gone too
brew untap TraceCommons/tap

# CLI, install.ps1
Remove-Item -Recurse "$env:LOCALAPPDATA\Programs\TraceCommons"
# install.ps1 appended that directory to your user PATH; take it back out
$p = [Environment]::GetEnvironmentVariable('Path','User') -split ';' |
  Where-Object { $_.TrimEnd('\') -ine "$env:LOCALAPPDATA\Programs\TraceCommons" }
[Environment]::SetEnvironmentVariable('Path', ($p -join ';'), 'User')

# Desktop app, MSIX / .appinstaller -- also ends the update subscription
Get-AppxPackage Iqlusion.TraceCommons | Remove-AppxPackage

Autostart registrations are the part an uninstall is easiest to leave behind:

• Linux, CLI daemon. systemctl --user disable --now trace-commons-contributor.service, then trace-commons-contributor daemon uninstall to remove the unit file.
• macOS app. Registered through SMAppService. Turn off “Run at login” in Settings before deleting the app, or clear the leftover entry in System Settings → General → Login Items.
• Windows, MSIX app. A packaged startup task; Remove-AppxPackage takes it with the package.
• Windows, portable app. The portable build uses the per-user Run key instead, which deleting the folder does not touch: Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'Trace Commons'.

The macOS app itself is TraceCommons.app in /Applications when it came from the DMG rather than the cask; quit it, then move it to the Trash. The Windows portable build is just the unzipped folder — delete it.

What leaves your machine

A redacted envelope, and nothing else. Secret scrubbing runs locally before anything is sent and covers message text, tool calls, tool results and structured payloads alike — raw content is never sent out to be scrubbed elsewhere. The data policy sets out what is stored and what the aggregate figures do and do not protect.