The stores.toml reference

~/.loom/stores.toml tells durmem which stores you can reach, which to use by default, and which settings apply to a workspace.

On Windows, use %USERPROFILE%\.loom\stores.toml. Setup and login write it for you; most users only need to choose a default or workspace mapping.

Sections, sessions and the default store#

A few words used on this page:

A store is a separate memory on a durmem server. Facts saved to one store are not visible from another.
A section is a named table in this file, such as [coding]. It holds the connection details for one store. Only a section with an endpoint is a store; [workspace] and other metadata tables are not.
The default is the section that normal store use falls back to. Set it with the top-level default key; it must name an existing section.
A session is one running agent conversation. Its primary store starts as the default.
A workspace is a product or team name that groups repositories (see below).
A store's domain (for example coding, personal or log) shapes how its memory is organized. It is set on the server, not in this file; see Manage stores.

default = "coding"

[coding]
endpoint = "tcp://durmem.ai:7443"
store = "<org>_coding"
server_key = "<server public key>"
store_key = "<your secret store credential>"
web_origin = "https://durmem.ai"
description = "Project decisions and findings"

The default is required for normal store use. Setup/login add it only when absent, never replace an existing choice. Missing, unknown or malformed defaults prevent normal access; fix the file before continuing.

An agent can select a different store for its current session, for example when you ask it to use another store. That choice does not rewrite this file or carry over to separate CLI invocations.

Choosing a store per workspace#

A repository can name its workspace on a loom-scope: line. Your coding agent reads that name, then chooses a store from these mappings:

[workspace]
loom-coding = "coding"

[workspace.atlas]
loom-coding = "atlas-memory"

durmem checks the named workspace first, then the bare [workspace] mapping. If neither selects a coding store, the agent asks you and records the choice. The Claude Code hook uses the same mapping.

For optional multi-agent coordination, loom-kanban selects the board by the same pattern; see Kanban.

Setup reuses credentials already saved for the resolved server and skips sign-in; login always signs in and merges. See Install and set up durmem.
Sections merge by name, but an existing section is never rebound to another store. Duplicate names returned by the server keep the oldest binding and warn about the alias needing correction.
Older sections can have web_origin backfilled. Writes replace the file atomically.
Logout removes only a local section, including quoted or commented headers. Drop removes it only after confirmed server deletion. See Manage stores.

Editing by hand#

Make a private backup: cp ~/.loom/stores.toml ~/.loom/stores.toml.bak.
Preserve valid TOML, including a default naming a real section. Malformed TOML is treated as empty after a warning, so fix it before using durmem.
Never copy another person's credentials. Keep both file and backup private.
Run durmem list_stores to check section names and the session default. This checks local configuration, not server existence.

Advanced connection settings#

Unknown section keys are ignored. Private servers use the same structure, with their own endpoint and web_origin. Keep generated namespace and key values unchanged unless your administrator instructs you otherwise.

Key	Meaning
endpoint	Required connection address. Without it, the table is not a store.
store	Required server-side store name. The deprecated user alias is accepted; store wins if both exist. An endpoint-only section can be listed but cannot be used.
server_key	Server public connection key; required for gateway connections, not secret.
store_key	Secret store credential; required for gateway connections. Its presence selects gateway mode.
namespace_scheme	Namespace layout written by setup; leave it unchanged.
description	A short purpose shown by list_stores to help agents choose.
fastembed_model	Client embedding model: this section's value, then the default store's value, then durmem's built-in default.
curve_public_key / curve_secret_key	Your public and secret keys for direct connections without the gateway.
socks_proxy	Optional SOCKS proxy.
web_origin	Issuing web server for management operations. Missing values generally mean durmem; revocation requires a recorded origin.
ca_file	Absolute path to a readable PEM certificate for a private server with a self-signed certificate. Not needed for publicly issued certificates.

Treat store_key as a credential: do not put it in shell history or command arguments.

Management creation uses the auth_store section, or the first section in file order with an endpoint—not the top-level default. Unlock, domain change and drop use their target's origin.

Without --base, setup uses a saved web_origin only when stores.toml has exactly one store section and that section records it. With multiple store sections, setup does not infer an origin even if only one section records web_origin. Invalid server addresses are refused; see Manage stores.

Certificate trust#

Use setup/login's --ca-file option rather than disabling certificate checks. It records trust scoped to that server's API, Claude Code and Codex plugin installation and update, and OpenCode authentication. Other sites retain normal trust. Git must be able to use the saved certificate for plugin operations. Store transport itself is not TLS and does not use ca_file.

The lookup requires a canonical HTTPS web_origin, such as https://srv.example or https://srv.example:8443. It does not accept uppercase letters, a trailing dot, explicit :443, or IPv6. durmem skips noncanonical sections with a warning and refuses conflicting files for one origin. An unreadable or non-PEM file stops the command. Login without --ca-file retains an existing certificate only while the origin is unchanged. For connection recovery, see Install and set up durmem and Troubleshooting.

For a private server's first harness integration, run durmem setup --base https://durmem.ai. Setup signs in to that server when needed and installs the selected harness integration. Later, run durmem login --base https://durmem.ai to refresh local store connections. A private server can serve bootstrap files from its selected package; if absent, use the hosted installer, then run setup against the private origin. See Install and set up durmem and CLI reference.

Capture precompact#

Long agent sessions are periodically compacted: the harness replaces older conversation with a summary, and details that were never saved are lost. durmem can ask the agent to save durable facts from the conversation just before that happens. This is off unless you turn it on, in a separate file, ~/.loom/hooks.toml (on Windows, %USERPROFILE%\.loom\hooks.toml), not in stores.toml:

[capture]
precompact = "confirm"

Value	What happens around compaction
`off`	Nothing. This is the default when the file or setting is absent; any other value also means `off`.
`confirm`	After compaction, the agent lists numbered candidate facts and saves only the ones you confirm.
`auto`	After compaction, the agent saves the candidate facts without asking.

The setting takes effect only in a harness that runs durmem's hooks: Claude Code, Codex and OpenCode. Hermes connects through MCP only and runs no durmem hooks, so it has no effect there. Choose confirm if you want to review what is saved; see Security and privacy for what a saved fact can expose. For guided capture practice, see Tutorial 06: Observe proactive memory.