Configuration

Complete reference for config.toml. All sections and their defaults.

[provider]

Key	Type	Default	Description
`kind`	string	`"google_genai"`	Provider type: `google_genai`, `openai_compatible`, or `anthropic`
`api_key`	string	`—`	API key for the provider (required)
`gateway_token`	string	`null`	Optional Cloudflare AI Gateway token used as `cf-aig-authorization`
`base_url`	string	`—`	API base URL (required for `openai_compatible`, not used for native providers)

[provider.models]

Key	Type	Default	Description
`primary`	string	`(provider default)`	Default model for general queries
`fast`	string	`(same as primary)`	Low-latency model for intent-gate/simple turns (prefer non-reasoning instruct models)
`smart`	string	`(same as primary)`	Model for complex execution turns (can be the same as primary)

Model Defaults

Provider-aware defaults are filled automatically by the wizard and may change across releases as provider catalogs evolve. For production, pin explicit model IDs in [provider.models]. If all three tiers resolve to the same model, auto-routing is disabled. See Model Routing.

Fast Tier Guidance

Set provider.models.fast to a cheap non-reasoning instruction model for intent-gate and routing. Avoid reasoning/thinking models in fast because they usually increase token burn and latency for no routing benefit.

[telegram]

Key	Type	Default	Description
`bot_token`	string	`—`	Telegram bot token from @BotFather (required)
`allowed_user_ids`	array	`[]`	Numeric Telegram user IDs allowed to chat. Empty = no restriction.

[slack]

Requires the slack feature flag at compile time. See Slack for full setup guide.

Key	Type	Default	Description
`enabled`	bool	`false`	Enable the Slack channel
`app_token`	string	`—`	Slack App-Level Token for Socket Mode (`xapp-...`)
`bot_token`	string	`—`	Slack Bot Token for Web API (`xoxb-...`)
`allowed_user_ids`	array	`[]`	Slack user IDs allowed to interact. Empty = no restriction.
`use_threads`	bool	`true`	Reply in threads by default

[discord]

Requires the discord feature flag at compile time. See Discord for full setup guide.

Key	Type	Default	Description
`bot_token`	string	`—`	Discord bot token from the Developer Portal
`allowed_user_ids`	array	`[]`	Discord user IDs allowed to interact. Empty = no restriction.
`guild_id`	integer	`null`	Optional guild/server ID to restrict the bot to a single server

[state]

Key	Type	Default	Description
`db_path`	string	`"aidaemon.db"`	Path to SQLite database file
`working_memory_cap`	integer	`50`	Max messages per session kept in memory
`consolidation_interval_hours`	integer	`6`	Hours between memory consolidation runs
`max_facts`	integer	`100`	Maximum number of facts injected into the system prompt
`daily_token_budget`	integer	`null`	Max total tokens (input+output) per day. Null = unlimited. Resets at midnight UTC.
`encryption_key`	string	`null`	SQLCipher encryption key (requires `encryption` feature). AES-256 at rest.

[terminal]

Key	Type	Default	Description
`allowed_prefixes`	array	`(see below)`	Command prefixes auto-approved without user confirmation
`initial_timeout_secs`	integer	`30`	Timeout in seconds for initial command execution
`max_output_chars`	integer	`4000`	Truncate command output beyond this length
`permission_mode`	string	`"default"`	Risk permission mode: `default`, `cautious`, or `yolo`. See Command Risk.

Default allowed prefixes:

text

ls, cat, head, tail, echo, date, whoami, pwd, find, wc,
grep, tree, file, stat, uname, df, du, ps, which, env, printenv

Shell Operators

Commands containing ; | && || $() or backticks always require approval, even if the prefix is whitelisted.

[daemon]

Key	Type	Default	Description
`health_port`	integer	`8080`	Port for the health check HTTP endpoint
`health_bind`	string	`"127.0.0.1"`	Bind address. Use "0.0.0.0" for external access.

[triggers.email]

Key	Type	Default	Description
`host`	string	`—`	IMAP server hostname (e.g., imap.gmail.com)
`port`	integer	`—`	IMAP port (typically 993 for TLS)
`username`	string	`—`	Email account username
`password`	string	`—`	Email account password or app-specific password
`folder`	string	`"INBOX"`	IMAP folder to monitor

[mcp.<name>]

Key	Type	Default	Description
`command`	string	`—`	Executable path or name for the MCP server
`args`	array	`[]`	Command-line arguments

[browser]

Key	Type	Default	Description
`enabled`	bool	`false`	Enable browser automation tool
`headless`	bool	`true`	Run Chrome without a visible window
`screenshot_width`	integer	`1280`	Browser viewport width in pixels
`screenshot_height`	integer	`720`	Browser viewport height in pixels
`user_data_dir`	string	`~/.aidaemon/chrome-profile`	Chrome profile directory for persistent sessions
`profile`	string	`Default`	Chrome profile name within user_data_dir
`remote_debugging_port`	integer	`null`	Connect to existing Chrome on this port (advanced)

[skills]

Key	Type	Default	Description
`dir`	string	`"skills"`	Directory containing skill markdown files
`enabled`	bool	`true`	Enable the skills system
`registries`	array	`[]`	URLs of skill registry JSON manifests for browsing/installing skills

[subagents]

Key	Type	Default	Description
`enabled`	bool	`true`	Allow the agent to spawn sub-agents
`max_depth`	integer	`3`	Maximum nesting level for sub-agent recursion
`max_iterations`	integer	`10`	Max agentic loop steps per sub-agent invocation
`max_response_chars`	integer	`8000`	Truncate sub-agent responses beyond this length
`timeout_secs`	integer	`300`	Sub-agent execution timeout in seconds

[cli_agents]

Key	Type	Default	Description
`enabled`	bool	`false`	Enable CLI agent delegation tool
`timeout_secs`	integer	`600`	Global timeout for CLI agent execution
`max_output_chars`	integer	`16000`	Global max output length from CLI agents

[cli_agents.tools.<name>]

Key	Type	Default	Description
`command`	string	`—`	Command to execute
`args`	array	`[]`	Default arguments passed to the command
`description`	string	`—`	Tool description shown to the LLM
`timeout_secs`	integer	`null`	Override global timeout for this tool
`max_output_chars`	integer	`null`	Override global max output for this tool

[search]

Key	Type	Default	Description
`backend`	string	`"duckduckgo"`	Search backend: `duckduckgo` (no key needed) or `brave`
`api_key`	string	`""`	API key for Brave search (supports `"keychain"`)

[scheduler]

Key	Type	Default	Description
`enabled`	bool	`true`	Enable the scheduled tasks system
`tick_interval_secs`	integer	`30`	How often the scheduler checks for due tasks

[[scheduler.tasks]]

Pre-defined scheduled tasks loaded from config on startup:

Key	Type	Default	Description
`name`	string	`—`	Human-readable task label
`schedule`	string	`—`	Natural language or cron expression (see Scheduler)
`prompt`	string	`—`	What the agent should do when the task fires
`oneshot`	bool	`false`	Fire once then auto-delete
`trusted`	bool	`false`	Run with full autonomy (no terminal approval needed)

[files]

Key	Type	Default	Description
`enabled`	bool	`true`	Enable file transfer tools (send/receive)
`inbox_dir`	string	`"~/.aidaemon/files/inbox"`	Directory for received files from Telegram
`outbox_dirs`	array	`["~"]`	Directories the agent is allowed to send files from
`max_file_size_mb`	integer	`10`	Maximum file size for transfers in MB
`retention_hours`	integer	`24`	Hours to retain received files before cleanup

Secrets Management

Sensitive config values support two resolution methods beyond plain text, plus an optional env-only storage mode:

OS Keychain

Set any secret field to "keychain" to resolve it from the OS keychain (macOS Keychain, Linux secret-service):

toml

[provider]
api_key = "keychain"    # Resolved from keychain entry "api_key"

[telegram]
bot_token = "keychain"  # Resolved from keychain entry "bot_token"

Store values with the keychain CLI command before first run:

bash

# Store a secret (prompts interactively)
aidaemon keychain set api_key
aidaemon keychain set bot_token

# Verify a stored secret (shows masked value)
aidaemon keychain get api_key

# Remove a secret
aidaemon keychain delete api_key

Security

The set command prompts for the value interactively with confirmation, keeping secrets out of your shell history.

Environment Variables

Use ${VAR_NAME} syntax anywhere in config values:

toml

[provider]
api_key = "${GOOGLE_API_KEY}"

[telegram]
bot_token = "${TELEGRAM_BOT_TOKEN}"

Env-only Mode (No Keychain)

If you prefer not to use the OS keychain, set these runtime environment variables:

bash

# Disable OS keychain storage and use env file-backed secrets
export AIDAEMON_NO_KEYCHAIN=1

# Optional: choose a specific env file path (default: ./.env)
export AIDAEMON_ENV_FILE=/absolute/path/to/.env

In this mode, aidaemon reads secrets from the selected env file (or process environment when no env file exists) and persists secret updates back to that env file — including OAuth access/refresh token rotation.

Env-only Security

Keep the env file private (chmod 600) and out of version control.

Supported Keychain Fields

Fields supporting "keychain": provider.api_key, provider.gateway_token, telegram.bot_token, slack.app_token, slack.bot_token, discord.bot_token, triggers.email.password, state.encryption_key, search.api_key, and http_auth.* profile fields.

[health]

Health monitoring system. See Health Monitoring.

Key	Type	Default	Description
`enabled`	bool	`true`	Enable the health monitoring system
`tick_interval_secs`	integer	`30`	How often to check for due probes
`result_retention_days`	integer	`7`	Days to retain health check results

[[health.probes]]

Key	Type	Default	Description
`name`	string	`—`	Probe name
`probe_type`	string	`—`	Type: http, command, file, or port
`target`	string	`—`	Target URL, command, file path, or host:port
`schedule`	string	`—`	Cron expression or interval
`consecutive_failures_alert`	integer	`3`	Alert after N consecutive failures
`alert_session_ids`	array	`[]`	Session IDs to notify on alert

[updates]

Self-update system. See Self-Updater.

Key	Type	Default	Description
`mode`	string	`"check_only"`	Update mode: enable, check_only, or disable
`check_interval_hours`	integer	`24`	Hours between update checks
`check_at_utc_hour`	integer	`null`	Specific UTC hour (0-23) for daily check
`confirmation_timeout_mins`	integer	`60`	Minutes to wait for user approval

[people]

People Intelligence — a personal contact book managed by your assistant. See People Intelligence.

Key	Type	Default	Description
`enabled`	bool	`false`	Initial state for people intelligence (can be toggled at runtime via chat)
`auto_extract`	bool	`true`	Automatically learn facts about people from conversations
`auto_extract_categories`	string[]	`["birthday", "preference", "interest", "work", "family", "important_date"]`	Fact categories that can be auto-extracted
`restricted_categories`	string[]	`["health", "finance", "political", "religious"]`	Categories that are never auto-extracted
`fact_retention_days`	integer	`180`	Days before unconfirmed auto-extracted facts are pruned
`reconnect_reminder_days`	integer	`30`	Days of inactivity before suggesting a reconnect

Example Config

config.toml

[provider]
kind = "google_genai"
api_key = "AIza..."

[provider.models]
primary = "gemini-3-flash-preview"
fast = "gemini-2.5-flash-lite"
smart = "gemini-3-pro-preview"

[telegram]
bot_token = "123456:ABC-DEF..."
allowed_user_ids = [123456789]

# Slack (requires --features slack)
# [slack]
# enabled = true
# app_token = "xapp-..."
# bot_token = "xoxb-..."
# allowed_user_ids = ["U123456789"]
# use_threads = true

[state]
db_path = "aidaemon.db"
working_memory_cap = 50
max_facts = 100

[terminal]
allowed_prefixes = ["ls", "cat", "head", "tail", "echo", "date", "whoami"]

[daemon]
health_port = 8080

[mcp.filesystem]
command = "npx"
args = ["-y", "@anthropic/mcp-filesystem"]

[browser]
enabled = true
headless = true

[skills]
dir = "skills"
enabled = true

[search]
backend = "duckduckgo"

[scheduler]
enabled = true

[[scheduler.tasks]]
name = "Morning check-in"
schedule = "weekdays at 9am"
prompt = "Check system health and summarize any overnight alerts"
trusted = true

[files]
enabled = true
inbox_dir = "~/.aidaemon/files/inbox"
outbox_dirs = ["~"]

# Discord (requires --features discord)
# [discord]
# bot_token = "MTIz..."
# allowed_user_ids = [123456789012345678]

# Health monitoring
[health]
enabled = true

[[health.probes]]
name = "API Server"
probe_type = "http"
target = "https://api.example.com/health"
schedule = "every 5m"

# People intelligence (opt-in, can also enable via chat)
# [people]
# enabled = true

# Self-updater
[updates]
mode = "check_only"

PreviousFirst Run Wizard NextProvider Setup