# Configuration

## File layout

```
~/.config/agenvoy/
├── config.json                       Main config — models, priority, tiers, routing roles, channel flags, reply language, output dir, limits, policy overrides
├── daemon.log                        Daemon log
├── runtime.uid                       Server-mode singleton record
├── daemon.sock                       Unix socket (0600) the TUI uses to run agents and MCP operations in the daemon (v1.2.0)
├── mcp.json                          Global MCP servers
├── tasks.json                        One-shot scheduled tasks
├── crons.json                        Recurring cron tasks
├── allow_skill                       Global skill always-allow list (one name per line)
├── allow_tool                        Global tool auto-approve list (one pattern per line, `prefix*` allowed)
├── .telegram / .discord              Authorized chat IDs (one per line, written after OTP success)
├── .store/
│   ├── history.db                    SQLite — session, message_meta, messages + FTS5, action_history, file_history, usage
│   ├── db_0 ... db_3                 ToriiDB — tool and quota cache, chat vectors, error memory, online markers
│   └── temp/                         Removed files moved aside with a timestamp suffix
├── prompts/                          Session prompt roles (.md, surfaced through /v1/roles)
├── skills/                           Skill storage (git-versioned)
│   ├── .system/                      Bundled skills
│   ├── .system_design/               Optional skills installed with /skill
│   ├── scheduler/                    Scheduler skill dirs (<short>-<hash8>/SKILL.md)
│   └── .Trash/                       Removed skills (recoverable from .Trash)
├── tools/                            Tool storage (git-versioned)
│   ├── script/                       Script tools (tool.json + script.py)
│   ├── .system/                      Bundled tools
│   └── .extension/script/            Extension-installed tools
├── vendor/                           Web dashboard's third-party assets, downloaded at daemon startup and served at /vendor/*
├── download/                         Inbound chat attachments and downloaded files (.Trash/ inside); default output dir when ~/Downloads is missing
└── sessions/
    ├── .Trash/                       Removed sessions
    └── <sid>/
        ├── history.json              Recent conversation, delta-appended
        ├── summary.json              Rolling summary
        ├── .summary_cursor           Incremental summary cursor
        ├── action.log                Tool call audit trail — [ts][window_hash][kind][task_hash] body
        ├── .cmd_history              Per-session TUI input history
        ├── .claude_code/             claude-code session id and resume state, one file per model + system prompt hash (v1.1.3; claude_code_<model>.json since v1.1.1)
        └── pending/                  Pending ask_user / confirm metadata, one JSON per task hash

<project-root>/.config/agenvoy/       Project-scoped tools and skills
├── tools/script/
└── skills/
<project-root>/.agenvoy/allow_skill   Project-scoped skill always-allow list (union with global)
<project-root>/.agenvoy/allow_list    Project-scoped tool allow list
```

## Where things deliberately do not live

- **Provider API keys** — never in `config.json`; always in keychain
- **MCP credentials** — use `${VAR}` placeholders in `mcp.json` and keep values in env vars
- **Secrets captured by `store_secret`** — keychain only; never in LLM context, history, `action.log`, or tool args
- **Session config and persona** — in the SQLite `session` table under `.store/`, not per-session JSON files
- **Session history** — `history.json` for the hot window, mirrored into ToriiDB and SQLite under `.store/`
- **Operator notes** — removed in v1.0.23 along with `find_note`, `/note` and `/v1/note*`; neither the SQLite `note` table nor `~/.config/agenvoy/knowledge/` is read any more. Use a role or a skill for standing instructions
- **User-defined API tools** — Removed in v1.3.2: `api_*` JSON tools under `tools/api/`, `tools/.extension/api/` and `<project-root>/.config/agenvoy/tools/api/` are no longer loaded, created or watched; a leftover `.json` there logs an `[Invalid] api tool` warning. Use a script tool, or `public_api_list` plus `http_request`
- **Tool call results** — in-memory dedupe per run plus a 30-minute ToriiDB cache for `fetch_page`, `search_web`, and `http_request` `GET` calls; nothing else persists across restarts