Skip to content

Files and folders

~/.tatu means $TATU_HOME when set; a clone can contain project settings, instructions and hooks, so read them before running Tatu there.

Path What it holds Mode when Tatu creates it See
~/.tatu/ Your state directory; $TATU_HOME replaces this whole path. Usually created as 0700; the update-check writer can create it as 0755; no single mode is enforced for the state root Settings
<project>/.tatu/ Project customization folder; it does not hold your credentials or saved sessions. User-managed; settings writes create a missing parent as 0700 Settings
~/.tatu/settings.json Global settings and defaults saved by commands. 0644 for a new file; preserve an existing file’s mode Settings
~/.tatu/auth.json Stored API keys and subscription credentials; keep private. 0600 Sign in
~/.tatu/mcp.json Your MCP servers. User-managed, or written by tatu mcp add; a file Tatu creates is 0600, one that exists keeps its mode MCP servers
~/.tatu/mcp-auth.json Sign-ins to remote MCP servers (tokens); keep private. 0600 MCP servers
~/.tatu/mcp-projects.json Which projects’ MCP servers you trust, and servers you turned on or off. 0600 MCP servers
~/.tatu/mcp-cache/ The tools each MCP server offered the last time it ran. Folder 0700; files 0600 MCP servers
~/.tatu/AGENTS.md or CLAUDE.md Your global project instructions; AGENTS.md takes precedence. User-managed; no mode enforced by the reader AGENTS.md
~/.tatu/sessions/ Saved conversations as <session-id>.jsonl; a new session reaches disk with its first message. Folder 0700; files 0600 Sessions
~/.tatu/sessions/agents/ Saved subagent conversations, separate from the main session list. Folder 0700; files 0600 Subagents
~/.tatu/prompts/*.md Your global prompt templates. User-managed; no mode enforced by the reader Prompt templates
~/.tatu/skills/<name>/SKILL.md Your global skills. User-managed; no mode enforced by the reader Skills
~/.tatu/agents/*.md Your global custom subagent definitions, not saved conversations. User-managed; no mode enforced by the reader Custom subagents
~/.tatu/plans/<session-id>.md Readable, editable Markdown plan for a session. Folder 0755; files 0644 Planning
~/.tatu/logs/tatu.log Diagnostics; -debug includes tool arguments and model calls. At startup, a log larger than 5 MiB becomes tatu.log.1, replacing the previous backup. Folder 0700; file 0600 Troubleshooting
~/.tatu/logs/daemon.log Daemon diagnostics, with the same startup rotation policy. Folder 0700; file 0600 Daemon
~/.tatu/remote/ Remote identity, preferences and paired computers. 0700; existing folder permissions are tightened when remote files are saved Set up and pair
~/.tatu/remote/identity.json This computer’s identity key; keep it private and safe. 0600 Set up and pair
~/.tatu/remote/devices.json The devices this computer lets in, with their names. Removing an entry cuts the device off. 0600 Set up and pair
~/.tatu/remote/directory.key The key that encrypts the summary of each session for the relay. A revoke makes a new one; keep it private. 0600 Set up and pair
~/.tatu/remote/directory-keys.json The same key of each computer this terminal follows. 0600 Other computers
~/.tatu/remote/invites.json The keys, lives and uses left of the open invitations made on this computer. 0600 Set up and pair
~/.tatu/remote/config.json Computer name, automatic remote connection preference and the encrypted channel (e2e). 0644 Set up and pair
~/.tatu/remote/client.json This terminal’s private key for following other computers. 0600 Other computers
~/.tatu/remote/hosts.json Computers paired with this terminal. 0600 Other computers
~/.tatu/remote/daemon.json Optional older daemon settings: projects_root, max_sessions. User-managed; no mode enforced by the reader Daemon
~/.tatu/remote/daemon.lock Lock that keeps one daemon running for this state directory. 0600 Daemon
~/.tatu/run/ Live agent records (<id>.json) and Unix sockets (<id>.sock, daemon.sock); sockets can use a shorter temporary path when necessary. Folder 0700, owned by you; records and sockets 0600 Many agents
~/.tatu/automations.json Your automations and the last 20 runs of each; the daemon keeps it. 0600 Automations
~/.tatu/worktrees/<id>.json Records of isolated worktrees, not the working copies themselves. Folder 0700; files 0600 Daemon
<project-parent>/.tatu-worktrees/ Working copies created for isolated sessions. New folders 0755; contents also depend on Git and copied files Daemon
~/.tatu/models-store.json Cached model catalog, including context windows and prices. 0600 Models
~/.tatu/update-check.json Last successful version check. 0600 temporary file renamed into place Install and update
<project>/.mcp.json The project’s MCP servers; they start only after you trust the project. Parent folders are not searched. User-managed, or written by tatu mcp add -s project; a file Tatu creates is 0600, one that exists keeps its mode MCP servers
<project>/.tatu/settings.json Project settings override global settings; its daemon section is ignored. User-managed; a new file written through the settings writer uses 0644 Settings
<project>/.tatu/prompts/*.md Project prompt templates override global templates with the same name. User-managed; no mode enforced by the reader Prompt templates
<project>/.tatu/skills/<name>/SKILL.md Project skills override global skills with the same name. User-managed; no mode enforced by the reader Skills
<project>/.tatu/agents/*.md Project subagent definitions override global or built-in definitions with the same name. User-managed; no mode enforced by the reader Custom subagents
<project>/AGENTS.md or CLAUDE.md Project instructions; Tatu also reads parent folders, outermost first, and the one in a subfolder when the model first reads or changes a file there. These files are not inside .tatu/. User-managed; no mode enforced by the reader AGENTS.md
Permission notation Meaning See
0600 Only you can read and write the file. Security
0700 Only you can enter, read and write the folder. Security
0644, 0755 Files or folders can be read by other users who can reach their parent folders; creation modes may be restricted further by your umask. Security
Existing files Creation modes do not generally repair permissions on existing files or folders; run/ is checked and remote folder saves enforce 0700. Security