Claude Code has been deleting your session transcripts every 30 days

An r/ClaudeAI PSA (81 upvotes, 49 comments) and a matching X post surfaced something I checked immediately and then fixed on my own machine. cleanupPeriodDays defaults to 30, and the purge runs on every startup. It unlinks .jsonl files under ~/.claude/projects with no warning, no Trash, no grace period. (r/ClaudeAI)

The metadata rows survive the purge. So the sidebar keeps advertising sessions that error with "session not found on disk" when you click them. At least five open issues on anthropics/claude-code track this behavior.

The fix is one line in settings.json:

{ "cleanupPeriodDays": 3650 }

Note the trap: setting it to 0 disables persistence, not cleanup. Reading the name, 0 looks like "never clean up." It means "keep nothing."

Why this matters more than it sounds. A session transcript is the reasoning trace. When an agent makes a decision you don't understand three weeks later, the transcript is the only artifact explaining why. I've gone back to sessions from six weeks prior to figure out why a particular abstraction exists, and on a default install those are gone. Worse, they're gone silently, on a schedule tied to when you happened to launch the binary rather than anything you did.

This lines up with a pattern I noticed across the week's releases. Claude Code 2.1.251 fixed file tools following a symlink swapped inside the working directory after the permission check passed, and Grep and Glob ignoring Read(...) deny rules through a symlinked search path. It also stopped project-level .claude/settings.json from setting CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR or TMPDIR, and now requires explicit approval for settings that terminate sandbox TLS or inject credential headers. (Claude Code changelog)

The through-line: a checked-out repository was previously trusted to configure the harness reading it. Clone a repo, and its committed settings file could redirect where your session's secrets and scratch files go. That's fixed. But it means the config surface of your agent is security-relevant in ways the docs never framed it as, and the retention default is one more setting nobody read.

Go set cleanupPeriodDays now. It costs you disk and buys you the ability to audit your own past decisions.