Configuration

The config file

neo auth login writes ~/.config/neosource/config.json — more precisely, a neosource/config.json under the platform config directory ($XDG_CONFIG_HOME or ~/.config on Linux, ~/Library/Application Support on macOS, %APPDATA% on Windows). neo doctor prints the resolved path.

The file holds one stored login: the forge base URL, your account id and handle, the bearer token, this machine’s name, and the paths of the SSH key pair enrolled by neo auth login or neo ssh setup. It is written 0600 on Unix, and the mode is re-applied even if the file already existed world-readable — it is a credential store, not a preferences file.

neo auth logout removes the stored login; neo auth status prints who you are signed in as and whether neo is registered as git’s credential helper.

The installer’s receipt

The installer (curl -LsSf https://get.neosource.dev | sh, or install.ps1) writes a second file, neo-receipt.json, naming the binary it installed, its target triple, the release it was, and the release root it came from. On Unix — macOS included — it lives at $XDG_DATA_HOME/neosource/neo-receipt.json, which is ~/.local/share/neosource/neo-receipt.json unless XDG_DATA_HOME is set (not under ~/Library/Application Support; the installer is POSIX sh and does not know about it). On Windows it is %LOCALAPPDATA%\neosource\neo-receipt.json.

neo upgrade replaces a binary only when the one running is the one the receipt names, so “this neo was not installed by the installer” means either that there is no receipt in that directory, or that it names a different file than the neo you ran — the error prints both paths. A source build (just install, cargo run) never has a receipt and is rebuilt the way it was built.

The once-a-day update check keeps its state beside the receipt, in update-check.json in the same directory: when it last looked, and what the release root last said. Deleting it is harmless — the next command looks again. neo doctor’s update line reports what the check would conclude.

How the host is resolved

In order, first match wins:

1. --host on the command line.
2. NEOSOURCE_API in the environment (the same clap value as --host, so an explicit flag beats it).
3. The stored login’s base_url.
4. The compiled-in default.

The compiled-in default depends on how the binary was built: a debug build (cargo run, just neo) targets http://neosource.localhost, the local just dev stack; a release build (cargo install, just install) targets https://neosource.dev.

A stored login is bound to the host it was minted for. Pointing --host at a different host is treated as a conflict rather than a silent retarget: neo uses the host you named and does not send that host the other one’s token.

neo run is the documented exception to step 2 — see Environment variables.