Configuration

Config is resolved by deep-merging three layers (highest priority wins):

Layer	Path	Scope
Plugin bundled	<plugin>/config.json	Shipped defaults
User-global	~/.remember/config.json	All your projects
Per-project	<REMEMBER_DIR>/config.json	One project

Put cross-project preferences (timezone, cooldowns) in ~/.remember/config.json. Put project-specific overrides in <REMEMBER_DIR>/config.json. See config.user.example.json for a user-global template and config.example.json for all available keys.

Key	Default	Purpose
data_dir	.remember	Where memory files are written. Relative paths resolve inside the project root (legacy default). Absolute paths or paths starting with ~ are expanded and treated as external — see External storage mode.
cooldowns.save_seconds	120	Minimum seconds between saves
cooldowns.ndc_seconds	3600	Compression interval (hourly)
cooldowns.git_backup_seconds	900	Minimum seconds between auto-backup commits (no-op if ~/.remember/ is not a git repo)
git_backup.remote	(empty)	Remote to push memory backups to. Empty → bare git push, relying on the branch's upstream tracking (the standard origin main setup). Set this if you have multiple remotes or a non-standard tracking config.
git_backup.branch	(empty)	Branch to push to. Only used when git_backup.remote is set; empty pushes the current branch. The resolved remote/branch is logged on the first push.
git_backup.reject_notice_after	3	Consecutive permanently rejected pushes before the backup interrupts you with a systemMessage on the next prompt, on top of the log line. A rejection never clears itself, so this only postpones a true report — it cannot swallow one. Transient failures (offline, no credentials) never count toward it. 0 disables the interruption and leaves the log line.
git_backup.commit_notice_after	3	Consecutive failed commits before the backup interrupts you with a systemMessage, on top of the log line. A failed commit is worse than a failed push — the memory is recorded in no git history at all, not even locally — and every cause is durable (no user.email, a full disk, a stale index lock, a pre-commit hook on the backup repo), so this only postpones a true report. git's own error is always in the log line. 0 disables the interruption.
git_backup.no_remote_notice_after	10	Consecutive saves with no remote configured before the backup says so once — and only once for the lifetime of the store. Unlike every other counter here the condition may be entirely intentional: a local-only history is a legitimate choice, and a notice that repeated on every save would cost the others their meaning. 0 disables it.
git_backup.gpg_sign	false	Sign auto-backup commits. Default passes --no-gpg-sign so background commits never hang on a passphrase prompt. Set true only with non-interactive signing (e.g. a hardware key) to honour your global commit.gpgSign.
git_backup.allow_remote_change	false	One-shot opt-in to accept a changed push remote. The backup hook records the remote URL on first push and aborts every later push if it changed, since a swapped URL can mean a poisoned config.json pointing at someone else's host. Set true only when you are deliberately re-pointing at a new repo, then set it back. See docs/git-backup-security.md.
git_restore.enabled	false	Off by default. Fast-forward ~/.remember/ from the backup remote at session start, before memory is read into context — the read counterpart to git backup, for stores used from more than one machine (#253). Fast-forward only: a diverged store is refused and reported, never merged or rebased. The git fetch is detached and lands next session, so no network runs before your first prompt. See Restoring on a second machine.
git_restore.remote	(empty)	Remote to restore from. Empty → git_restore.remote falls back to git_backup.remote, then to origin. A store that pushes to one place and reads from another is almost always a mistake, so the default is to share the backup's setting. Treated as untrusted (#723): config.json is git-tracked and is exactly what git_restore's own fast-forward syncs FROM the remote, so this value can be attacker-controlled on a shared store. A leading -, or a value containing : or /, is rejected and the restore falls back to origin rather than passing it to git fetch.
git_restore.branch	(empty)	Branch to restore from. Empty → git_backup.branch, then the branch currently checked out. With a detached HEAD and this unset, the restore refuses rather than guessing. Treated as untrusted for the same reason as git_restore.remote (#723): a leading - is rejected rather than passed to git fetch. git_backup.remote/git_backup.branch get the identical treatment on the push side.
git_restore.fetch_timeout_seconds	20	How long the detached background fetch may run before it is killed. It never blocks your prompt either way; the bound exists so a hung transport cannot leave a git process alive indefinitely, and so a fetch that never came back is reported as such next session rather than passing for "up to date".
git_restore.diverged_notice_after	3	Consecutive session starts finding a diverged store before the restore interrupts you with a systemMessage, on top of the log line. A divergence never clears itself, so this only postpones a true report — it cannot swallow one. A failed or unreachable fetch never counts toward it. 0 disables the interruption and leaves the log line.
git_reconcile.enabled	false	Off by default, and currently hard-disabled regardless of this setting (#969): hooks.d/after_save/60-git-reconcile.sh reads this flag first, then exits immediately either way, after a fifth consecutive destroys-class finding on the hook (#932/#939/#946/#952/#966) left a residual TOCTOU window open. If this is true, the hook logs a disabled pending #969 notice to hook-errors.log on every save -- which trips /remember:doctor's Recent errors WARN for exactly the users who opted in. Setting this to true currently does nothing else until #969's real fix lands. The rest of this row describes the hook's intended behavior once that fix ships: an optional reconcile step for a store written from more than one machine (#903), in its own hook so git_backup's commit-and-push-only promise (#253) and git_restore's fast-forward-only promise both still hold with this off. When enabled: fetches, fast-forwards when purely behind, and when both ahead and behind (diverged) rebases local commits onto the remote tip and pushes, with one retry if the remote moves again between the fetch and the push. On a real conflict: aborts the rebase, changes nothing else, and reports the conflicting file names through a git-reconcile-notice -- surfaced the same way git_restore's own diverged notice is, as a one-line systemMessage on your next prompt (scripts/user-prompt-hook.sh). Never resets, force-pushes or creates a merge commit. Declines while this slug's consolidation is rewriting recent.md/archive.md (shares consolidation's own lock) rather than risk a rebase mid-rewrite. NDC compression (save-session.sh's background now.md->today-*.md summarizer) is the OTHER writer of now.md, and its own staleness guards used to be blind to a rebase/merge landing while they were mid-check (#932) -- reconcile cannot share save-session.sh's own lock the way it shares consolidation's (that lock is held across the ENTIRE save, so checking it here would decline almost every save, not just the rare racing one), so instead every successful fast-forward/rebase bumps NDC's own generation marker, the same counter NDC already compares before/after its own commit, making NDC's existing guard also catch this hook as a writer.
git_reconcile.remote	(empty)	Remote to reconcile against. Empty → falls back to git_backup.remote, then the branch's own push target, then origin. Treated as untrusted for the same reason as git_restore.remote (#723): a leading -, or a value containing : or /, is rejected rather than passed to git fetch/git push.
git_reconcile.branch	(empty)	Branch to reconcile against. Empty → falls back to git_backup.branch, then the branch currently checked out. With a detached HEAD and this unset, reconcile refuses rather than guessing. Treated as untrusted for the same reason as git_restore.branch.
hooks.dispatch_timeout_seconds	15	How long one hooks.d/ listener may take before it is stopped, for the events the agent is waiting on: after_post_tool, after_user_prompt, before_session_start, after_session_start. Until #286 nothing bounded them, so a listener that blocked stalled the agent for as long as it blocked and logged nothing — nothing had failed. Claude Code kills a hook at 60s of its own accord, so a budget at or above that is the host killing the process with no report from the plugin. The shipped listeners take 0.17–0.58s here. Per hook, not per dispatch: one slow listener never spends the next one's allowance. 0 disables the bound.
hooks.dispatch_timeout_detached_seconds	120	The same budget for before_save, after_save, before_consolidate and after_consolidate, which are dispatched from save-session.sh / run-consolidation.sh — started with nohup … &, so nobody is waiting on them. A listener doing real work there is doing it on its own time, and 15s would be a deadline no one is keeping. 0 disables the bound.
hooks.dispatch_kill_grace_seconds	5	Between SIGTERM and SIGKILL. bash runs an EXIT trap when it dies of an untrapped SIGTERM and does not on SIGKILL, and git removes its own index.lock on SIGTERM and cannot on SIGKILL — so this window is a listener's chance to release a lock or unwind a partial write. It is a courtesy, not a veto: one that traps TERM and keeps going is killed anyway.
thresholds.min_human_messages	3	Minimum human messages before saving. Keeps greetings and one-liners out of memory.
thresholds.min_exchanges_without_human	30	Save anyway when the span has at least this many exchanges, even if the human count is below min_human_messages. Without it, an agentic session (many tool calls, few human turns) never clears the gate and never saves at all. 0 disables the fallback.
thresholds.max_summary_failures	3	Consecutive summarization failures on the same span before it is dropped and the position advanced past it. Keeping the position is right for a transient error (the span retries next run), but a persistent failure would otherwise retry forever and no later span could ever be saved. 0 retries forever.
thresholds.delta_lines_trigger	50	Tool call output lines that trigger auto-save
thresholds.extract_max_bytes	300000	Max UTF-8 size of the session extract sent to Haiku. Larger extracts are truncated to their most-recent tail so a very long session can't overflow the model's context window and silently stall saves. 0 disables the cap.
thresholds.autonomous_log_retention_days	7	Age, in days, after which a logs/autonomous/*.log file is reclaimed regardless of content (#487). That directory's only prior retention was -empty -delete, which stopped covering session-end-*.log the moment #483 seeded it with a header before its subshell opens it — every one is non-empty by construction, so nothing ever reclaimed that class again. An empty file is still reclaimed immediately, on the same first pass; this age-keyed check runs right after it, over both file classes (save-*.log and session-end-*.log share the *.log glob) — one portable stat-based sweep now covers both, not two separate find calls. Runs on every ordinary flush, independent of features.ndc_compression (#498) — this housekeeping used to live inside NDC's own gated block by accident of placement, so turning NDC compression off silently turned log retention off too, with this setting configured and doing nothing. stat, not find -mtime/-empty (#502): find is the one command on this path with a real PATH-shadowing risk on Windows Git Bash.
features.ndc_compression	true	Enable hourly compression of daily files. Independent of logs/autonomous/ retention (#498) — disabling this no longer disables that housekeeping too.
features.recovery	true	Recover missed saves on session start
features.plugin_promos	true	Cross-plugin promo at SessionStart (#574): a systemMessage naming one sibling Digital-Process-Tools plugin you have not installed, checked against ~/.claude/plugins/installed_plugins.json. Since #657 the same rotation also carries a one-time star ask, gated on recent.md being a non-empty file rather than on install status -- it waits until a full day of your sessions has actually been consolidated before ever asking. false turns the whole feature off entirely, and every entry's line both identifies itself (claude-remember:) and names this key inline, so it is attributable and actionable at the moment it fires (#631). Copy lives in promos.json beside config.example.json, not in the hook; prefix, text, URL and the inline hint together must fit 170 characters or the entry is skipped and logged. See From the same workshop.
cooldowns.promo_seconds	604800	Minimum seconds between plugin promos, persisted per machine under ~/.remember/tmp/ regardless of data_dir — the throttle describes what this machine has already been shown, not one project's store. Default is 7 days. 0 shows a promo on every SessionStart that has a candidate to show.
timezone	(system local)	IANA name (e.g. America/New_York, Europe/Paris) for timestamps and daily file boundaries. Omit or leave empty to use the system clock's local zone. Set this explicitly on a VPS whose system clock is UTC.
time_format	24h	24h or 12h — controls timestamp format in log files (e.g. 14:30:00 vs 2:30:00 PM)
prompt_stamp	full	What the UserPromptSubmit hook injects into the model's context. full — [14:30 CEST — jack — 45%], unchanged from every previous release. stable — [jack] only: the clock and the context percentage both change between turns, and the percentage climbs on every prompt for anyone running the status line, so dropping only the clock would leave the line volatile. The >= 95 context warning is kept, because it is threshold-gated and changes bytes only when it changes behaviour. off — nothing at all, warning included. An unrecognised value reads as full (#301).
model	haiku	Model used for the summarization / consolidation claude -p call. REMEMBER_MODEL overrides it. Documented as an env var only until #176, though config.json is the source of truth.
reject_pattern	(empty)	Overrides the reject-gate regex that keeps model refusals out of the memory layer. Empty → the narrow built-in default; none → gate off; anything else → a case-insensitive regex. An invalid regex falls back to the default. REMEMBER_REJECT_PATTERN overrides it.
handoff_mode	single	Off by default. single — every interactive session shares one remember.md, byte-identical to every previous release. per_session — the handoff becomes remember.<session_id>.md, so two sessions sharing one project store (#56) each write and read their own note instead of the second silently overwriting the first (#363). History, recent.md, archive.md and consolidation are unaffected either way — only the single handoff slot is namespaced. If no usable session_id reaches the hook, per_session falls back to the shared file — the hint still points at it, since that path is still correct — but a visible line says the fallback happened, so it does not read as isolation that never applied. No pruning ships with this key: stale remember.<session_id>.md files accumulate until removed by hand.
thresholds.consolidate_max_bytes	600000	Max UTF-8 size of the staging content sent to the consolidation model. Read by run-consolidation.sh; documented in config.example.json but missing from this table until #176. Since #346 the same number also caps what consolidation may write: a response larger than this is refused rather than copied over recent.md/archive.md. It is measured on staging + recent.md + archive.md together, and a store already over it now rotates its way out rather than skipping forever (#348).
thresholds.memory_inject_max_bytes	200000	A memory file larger than this is named with its size instead of injected at session start (#346). It stays on disk and stays greppable; what stops is pouring it into a context window that cannot hold it — a multi-GB recent.md froze every claude launch in the reporter's project. A healthy memory file is kilobytes, so this only ever fires on a store that is already broken. Set 0 to disable. When this is configured below the bundled default, the over-cap notice says "capped by config" and drops the /remember:doctor suggestion (#842) — a deliberately lowered cap is not evidence of a broken store. That holds only for files the lowered cap alone explains: a file larger than the bundled 200000 default is malformed whatever the cap, and keeps the original warning and the /remember:doctor advice.
thresholds.session_start_max_bytes	9000	Total byte budget for the whole SessionStart body (handoff + the === REMEMBER === legend + the === MEMORY === section), counted in bytes, not characters — see #842 for why bytes are the conservative choice under Claude Code's own character-based preview cap. memory_inject_max_bytes above caps one file at a time and has no notion of a TOTAL: six individually-healthy files can still sum past Claude Code's own persist-to-file threshold (observed around 10,000 characters), at which point the model sees only a short preview and never the === MEMORY === section at all. Filled in priority order handoff → now.md → recent.md → today-*.md → archive.md; whatever does not fit is listed by name and size, never silently dropped, the same convention source=compact already uses for its own deferred files. Does not apply at source=compact, which already minimizes its own output a different way. Set 0 to disable.
thresholds.handoff_max_redeliveries	3	Once the same (unchanged) handoff content has been delivered this many times, a further delivery is listed by path instead of re-injected (#842) — remember.delivered already tracks the count (see handoff_mode above), but until this it only ever changed the "already delivered N times" banner text, re-injecting the full, unchanged body on every single start regardless. The delivery record still advances past the cap, so a later redelivery still reports how long the note has been pending, and /remember still replaces it immediately. Set 0 to disable.
thresholds.staging_warn_bytes	2000000	Byte threshold for a one-time WARNING when a today-*.md staging file grows past it (#349). staging_append() is append-only by design — only a successful consolidation round retires one of these files — so sustained lock contention, a full disk, or a stalled consolidation round (a misconfigured features.ndc_compression, or the #346 skip-forever state) leaves the same kind of span landing there every round, forever, with nothing to notice. This does not cap or truncate anything — the append is unchanged either way — it only logs once, via the same report_error() path that reaches hook-errors.log and is surfaced by /remember:doctor's existing "Recent errors" section. Set 0 to disable. On a store whose logs/ cannot be created (#361/#372), log.sh never gets to read this key at all; the same report_error() path logs once, separately, whenever a REMEMBER_CONFIG exists but went unparsed for that reason — the 2000000 used below it may not be the configured value (#399).
thresholds.ndc_timeout_seconds	180	Wall-clock budget (seconds) for the NDC now.md -> today-*.md compression call. Output length scales with input length, so a now.md large enough to need longer than this timed out on every run, was left untouched, and grew further each round — a one-way ratchet that never recovered on its own (#788). Raise this if the daily log shows repeated [ndc] ERROR lines mentioning a timeout.
thresholds.consolidate_timeout_seconds	180	Wall-clock budget (seconds) for the staging -> recent.md/archive.md consolidation call. The same fix shape as ndc_timeout_seconds above (#806, reopening the intent of #788): output length scales with input length, so a large enough staging batch can time out on every run, be left uncompressed, and grow further every round with no recovery. Raise this if the daily log shows repeated consolidation ERROR lines mentioning a timeout.
debug	(unset)	Verbose logging for cooldowns and locks. Unset, each script keeps its own default — save-session.sh is verbose, the git-backup hook is quiet — which is what they did before this option was wired up (#176). REMEMBER_DEBUG overrides it.
haiku.oauth_token	(empty)	Removed entirely (#860, round 4). Never read for authentication, on any host -- this plugin has no recovery-token path of its own at all, on Claude Code or Codex; a nested call that cannot authenticate simply runs unauthenticated, and refreshing your coding agent's own CLI login is the fix. A still-configured value here is not read for anything, is not detected, and is not logged anywhere -- there is nothing to migrate it to; remove it whenever convenient, but leaving it in place is harmless.
session_start_slow_threshold_s	5	The SessionStart hook's own wall-clock duration is always written to the daily log (session-start took Ns); at or above this many whole seconds it is also printed into the session, under === SESSION-START ===, so a slow host is visible without going looking for the daily log first (#706). Measured with bash 5's EPOCHSECONDS builtin (no added fork) or, on older bash, one date +%s at each end — never per log line. Set 0 to surface every start; there is no key that silences the daily-log line.

A per-project .remember/config.json's haiku block is never read, in the default (legacy) storage layout. Keys under haiku have been security-relevant (haiku.oauth_token chose the credential the nested summarizer authenticated with). In the default layout .remember/ sits inside the project checkout, so a repository you clone can ship a .remember/config.json of its own -- and before #726, its haiku block was trusted exactly like one you wrote yourself. It no longer is, regardless of whether that file is tracked by the repository's own git index -- set haiku keys in ~/.remember/config.json (user-global), never in a project's own config file, if you want them honoured.

model and reject_pattern from that same per-project config are stripped too, but only when the file is git-TRACKED -- committed by the repository, not merely sitting in the default layout (#757). Unlike the haiku block, neither can redirect where a transcript goes -- only which model is billed for every save, or whether the refusal gate runs at all (reject_pattern: "none" turns it off outright; any other value is a regex run over model output, an attacker-controlled ReDoS surface) -- severe enough to strip from a file the repository itself committed, not severe enough to break every single-user project's own untracked per-project override the way #726 already accepted paying for haiku. An untracked per-project config.json -- the ordinary case, written by you, never git added -- still has model/reject_pattern take effect, exactly as before #757.

External storage mode (data_dir absolute or home-relative, e.g. ~/.remember/{slug}) is unaffected by any of the above -- REMEMBER_DIR there is the operator's own directory, never one a clone ships, so its config stays trusted once it is genuinely the operator's own. Nothing is moved into that mode automatically any more (#898): if you move an old in-project .remember/ there by hand, leave behind any config.json your repository tracks in git, or it becomes trusted config (#757; see external-storage-mode.md). See git-backup-security.md for the wider "a cloned project's config is untrusted input" note.

The summarizer's environment

The claude summarizer. The summarizer runs a nested claude -p that inherits your environment, including your Claude Code login, exactly like any process a hook starts, and remember itself reads no credential (#898). Only the parent Claude Code session's own variables are removed for the length of that call, so it does not pass as that session (#95, #204), and put back afterwards: CLAUDECODE, CLAUDE_JOB_DIR, CLAUDE_PROJECT_DIR, CLAUDE_CODE_SESSION_ID, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_CHILD_SESSION, CLAUDE_CODE_SESSION_ATTENDED, CLAUDE_CODE_EXECPATH, CLAUDE_CODE_MESSAGING_SOCKET, CLAUDE_CODE_SSE_PORT -- the reason for each is a comment beside the code in pipeline/haiku.py. CLAUDE_CODE_MESSAGING_TOKEN, the handshake paired with the messaging socket, is not on the list and reaches the nested call: with the socket removed, the nested call has no channel to present it on. Your login credential is never on that list (#131); provider settings such as Bedrock selection are not either, so they reach the nested call (#316). To keep any other variable away from the summarizer -- for example an ANTHROPIC_API_KEY set for some unrelated tool that would out-rank your claude.ai login there (#703) -- unset it in the environment you start Claude Code from.

The list is code, not config. Each name is written out literally in pipeline/haiku.py and cannot be changed from config.json. If a future Claude Code release adds a session variable, it reaches the summarizer until a plugin release adds it to the list. (Two earlier development rounds of #898 read this list, and the Codex one below, from config.json; a release-candidate scan reports reading the environment by a name taken from config as "an environment variable named at run time", so both lists went back into code with the same names.) Removed: haiku.drop_env (#898).

The Codex summarizer's allow-list (#724)

What it protects. Codex's --sandbox read-only denies writes and network, but it still runs whatever command the model asks for -- and a transcript can carry an instruction that gets the model to ask for env (#724). So the nested codex exec process is not given your environment: it is given only these variables, and nothing else -- no Anthropic key, no cloud credential, no unrelated secret your shell happens to carry: PATH, HOME, LANG, LC_ALL, CODEX_HOME, TMPDIR, TEMP, TMP, SYSTEMROOT, USERPROFILE, APPDATA, PATHEXT -- what the Codex CLI needs to run and find its own login in CODEX_HOME. (Separately, -c shell_environment_policy.inherit=none gives a command Codex spawns no environment at all; the allow-list bounds what Codex's own process can see.) An allow-list fails closed: a variable nobody thought about stays out. Like the claude list above, it is code, not config: it cannot be changed from config.json.

No credential is on it (#898). That is narrower than earlier releases, which also passed Codex's own API-key variable (CODEX_API_KEY) through. If Codex finds its login in auth.json under CODEX_HOME (what codex login writes), nothing changes for you. If you authenticate Codex only through an environment variable, it is not passed through and the codex summarizer starts without it -- run codex login so the login lives in auth.json, or use the claude summarizer (REMEMBER_SUMMARIZER=claude).

No proxy or CA-bundle variable is on it either (#898). HTTPS_PROXY, HTTP_PROXY, NO_PROXY (in either casing), SSL_CERT_FILE and NODE_EXTRA_CA_CERTS used to be passed through (#751); they are not any more. If you reach the network only through a proxy or a custom CA bundle, the codex summarizer cannot reach it -- set REMEMBER_SUMMARIZER=claude: the claude summarizer inherits your whole environment, proxy variables included.

Environment variables

A few runtime overrides aren't in config.json because they're per-shell rather than per-project.

Env var	Effect
REMEMBER_BRANCH	Overrides the | <branch> identity field in each ## HH:MM | <branch> memory header. Useful when your coding agent runs from a non-git directory ($HOME, a scratch dir) — without it the header falls back to the literal string unknown, which collapses the identity slot for every entry. Set to a meaningful tag (e.g. laptop, cloud, staging, an instance name) in your shell rc. It is process environment, read once at save time — one value per launched session, so it cannot distinguish several concurrent sessions of the same project from each other; see REMEMBER_BRANCH_CMD below for that case.
REMEMBER_BRANCH_CMD	Path to an executable, invoked as $REMEMBER_BRANCH_CMD "$SESSION_ID", whose stdout becomes the identity slot. Checked after REMEMBER_BRANCH and before the git branch --show-current fallback; a non-zero exit or empty stdout falls through to that fallback and logs a WARNING naming the configured command and the session — a resolver that is merely unconfigured stays silent, one that is configured and failing does not. This is the answer for #481: several coding agent sessions running at once in one project all share $PROJECT_DIR, so the git-branch fallback (and a REMEMBER_BRANCH set once at launch) resolve to the same value for every one of them — $SESSION_ID is the value already in scope that differs per session. What a session id should map to is site-specific (a local registry of named sessions, ${SESSION_ID:0:8}, ...), so this is a hook rather than a new built-in default. save-session.sh runs under bash, including on Windows via Git Bash — this is exec'd directly (no shell reparsing), so give it a forward-slash or PATH-resolvable path (/c/tools/resolve-identity, not C:\tools\resolve-identity.exe) the way you would for any other bash argv. $SESSION_ID itself is validated before this ever runs — hex digits and hyphens, anchored to a hex digit at position 1, so it can never reach your resolver's argv[1] looking like a flag (#500). The stdout your resolver prints is expected to be a single line with no embedded newline or carriage return: it is substituted verbatim into the summarizer prompt, so a multi-line or CR-bearing result is refused rather than used unbounded — logged the same WARNING-and-fall-through as a non-zero exit or empty stdout (#501).
REMEMBER_DEBUG	1 emits verbose hook/cooldown lines to logs; 0 silences them. Highest precedence: it beats the debug config option. Unset and debug unset, the defaults differ per script — save-session.sh verbose, the git-backup hook quiet — which this table used to paper over with a single "default 1" (#176).
REMEMBER_MODEL	Model used for summarization/consolidation (the claude -p call). Default haiku. Point it at a more capable tier (e.g. sonnet) to improve salience and compression-cap compliance — the call is backgrounded, so there's no interactive-latency cost. config.json → model is the source of truth (per-project); this env var overrides it. Blank falls back to the default.
REMEMBER_REJECT_PATTERN	Overrides the reject-gate regex that keeps model refusals/clarifications out of the memory layer. Blank → the narrow built-in default (anchored refusal/clarification stems only); none → gate disabled (only the literal SKIP contract applies); anything else → a custom case-insensitive regex. An invalid regex falls back to the default rather than failing the run. config.json → reject_pattern is the source of truth; this env var overrides it.
REMEMBER_OAUTH_TOKEN	Removed entirely (#860, round 3), on every host. No longer read for authentication at all, and there is no replacement for it any more -- this plugin has no recovery-token path of its own, on Claude Code or Codex, for either the direct call or Codex's own fallthrough to the shared claude -p code path (REMEMBER_SUMMARIZER_FALLBACK=claude). A nested call that cannot authenticate simply runs unauthenticated; refresh your coding agent's own CLI login instead (claude setup-token if you have not already). A still-set value is detected by presence only and logged once per save as a NOTICE: line naming this var (never its content), surfaced by /remember:doctor's "Legacy recovery-token config" section, on either host -- there is nothing left to migrate it to; remove it. This fallback had no automated test even before removal — see docs/verification.md for the historical manual procedure (describes code that no longer exists; kept only as a record of what was once tested by hand). If you use git backup, this key must not live in any config.json that ends up committed. A per-project <slug>/config.json is never staged or committed by the backup hook regardless (#719), but this env var is still the safer place for it, and it is the only safe place for the user-global ~/.remember/config.json, which external-storage-mode.md does have you commit deliberately. See docs/git-backup-security.md.
REMEMBER_MAX_CONCURRENT_SUMMARIZERS	How many nested claude -p summarizers may run at once, host-wide. Default 4. This is the depth bound too: a summarizer that re-entered the plugin runs inside its parent's call, so recursion appears as concurrency (#204). Not 1 on purpose — several projects saving at the same time is normal. When it fires, DECLINED appears in the daily log and the span is summarized on a later run.
REMEMBER_MAX_SUMMARIZERS_PER_MIN	How many summarizers may be spawned in any 60-second window, host-wide. Default 12. Covers the shape concurrency cannot see: a chain where each save spawns the next and no two ever overlap. A store saves at most once per cooldowns.save_seconds, so the default leaves room for roughly two dozen active projects. Same DECLINED log line when it fires.
REMEMBER_RUNTIME_DIR	Where spawn records for the two caps above are kept. Default ~/.remember/run. Derived from HOME alone so a child process that inherited no plugin environment still finds it — that is the point of the bound. Set it only to relocate the runtime state (a read-only home, a test harness); if it is unusable the caps stop applying and the daily log says the spawn was UNBOUNDED.
REMEMBER_LOCK_TIMING	1 records how long each lock is held and how long each acquire waited, so a timeout default can be set from a distribution instead of from intuition (#226). Off by default and deliberately opt-in: save-session.sh runs on a PostToolUse hook, where an extra spawn per lock use is paid on every machine forever (#227/#230/#204). Off, it costs one string comparison and writes nothing. See Measuring lock hold times.
REMEMBER_LOCK_TIMING_FILE	Where those records go. Default $REMEMBER_DIR/logs/lock-timing.tsv.
REMEMBER_LOCK_TIMING_MAX	Line cap on that file. Default 5000 (~350KB). At the cap recording stops and appends a # CAPPED line — it does not roll, because a rolled file silently drops the oldest records and the tail is the part a timeout is set from.
REMEMBER_TZ	Set automatically by log.sh from config.json → timezone. Don't set this manually unless you're debugging.
REMEMBER_SUMMARIZER	Which summarizer provider to use: claude (always claude -p, the historical behaviour), codex (always codex exec), or auto (the default) — auto reads the transcript the host actually wrote (REMEMBER_TRANSCRIPT_PATH, sniffed by pipeline.extract.sniff_file_envelope()) and follows it: codex for a Codex transcript, claude for a Claude Code transcript, an Antigravity transcript (no native summarizer exists for it, so this logs a warning and falls back to claude, #567), no transcript, or one this plugin does not recognise. A Claude Code session's own resolution is unchanged by this: it was already claude, and auto still answers claude for it. auto no longer asks the environment for a Codex signature (CODEX_SESSION_ID/CODEX_THREAD_ID) — those never reach the process that actually runs the summariser, only a Codex tool shell (#465). An unrecognised value is reported and treated as unset (#460).
REMEMBER_SUMMARIZER_FALLBACK	Opt-in for what happens when the resolved codex route cannot produce a result (binary missing, non-zero exit, empty output, timeout). Unset → raises loudly ("could not summarize") rather than silently retrying against Anthropic's API. claude → falls back to claude -p for that one call, exactly as though REMEMBER_SUMMARIZER=claude had been set, and it is logged every time it fires because it reproduces #460's own billing complaint on purpose, only because the operator asked for it.
REMEMBER_CODEX_BIN	Overrides where the codex executable is resolved from, mirroring claude's own resolution: unset uses shutil.which("codex"), falling back to the bare name codex (so a spawn failure reports what was actually tried) when PATH resolves nothing. Only consulted when the codex route is selected (#460).