Environment variables

Ten environment variables change what neo does, and they are the table below. Three more reach it indirectly, through the platform lookups that resolve a path rather than a behaviour: $XDG_CONFIG_HOME (and $HOME) decide where the stored login lives, $XDG_DATA_HOME (and $HOME) where the installer’s receipt and the update check’s state live — see Configuration for both — and $HOME decides where neo ssh looks for keys. Everything else neo needs comes from flags, from the stored login, or from the checkout it is run in.

Variable	Read by	Effect
NEOSOURCE_API	every server-backed command	Forge base URL. It is the same clap value as the global --host, so a typed --host outranks it.
NEOSOURCE_TOKEN	every server-backed command	Bearer credential. Outranks the stored login — when it is set, neo never reads the token from config.json.
NEOSOURCE_USER	credential resolution	The handle that pairs with NEOSOURCE_TOKEN. Only consulted on that path; a stored login already carries its own handle.
NEOSOURCE_SSH_PORT	git/jj over SSH	SSH port, default 22. Local dev stacks map the gateway to 2222.
NEOSOURCE_RUNNER_AUTH_TOKEN	neo runner register, neo runner start	Bootstrap PAT for the registration call, equivalent to --auth-token. Falls back to the stored login.
SSH_AUTH_SOCK	neo doctor	Standard OpenSSH agent socket. Doctor reports whether an agent is reachable and holds keys; neo never sets it.
NEOSOURCE_NO_BROWSER	neo auth login, neo ssh setup, neo org claim	Set to anything non-empty, neo never launches a browser. Every command that would have done so prints the URL first regardless, so on a headless host this leaves exactly the URL to paste elsewhere — and stops xdg-open from hanging on a D-Bus round trip or handing the URL to a text-mode browser in the same terminal.
NEO_NO_UPDATE_CHECK	every command’s update check	Presence disables the once-a-day release check and the one-line nudge on stderr, whatever the value (0 disables too). neo upgrade itself still works.
CI	every command’s update check	Presence disables the same check, so a CI log never carries a nudge. Set by every hosted CI runner; neo never sets it.
NEO_INSTALL_BASE	neo upgrade, the update check	Base URL of the release manifest (<base>/latest.json), overriding the one recorded in the installer’s receipt. The same name install.sh reads, so a mirror is one export for both. http:// is accepted — neo upgrade warns about it, the background check is silent by design; anything but http(s):// is refused.

Values are never printed

No --help screen and no page of this reference renders the value of any of these. NEOSOURCE_TOKEN and NEOSOURCE_RUNNER_AUTH_TOKEN are live bearer credentials, and NEOSOURCE_API can legitimately carry userinfo (https://user:pass@host), so all three leak the same way through a pasted bug report. Only the variable name is documented.

neo run ranks the host differently

neo run executes a workflow against a local checkout, which may belong to some entirely different forge. So it treats a typed --host as a statement about this run and NEOSOURCE_API as ambient: the checkout’s own neosource remote outranks the environment variable, and only the explicit flag outranks the remote. Every other command folds the two into one value, flag first.