Skip to content

Environment variables

Six environment variables change what neo does, and they are the table below. Two more reach it indirectly, through the platform lookups that resolve a path rather than a behaviour: $XDG_CONFIG_HOME (and $HOME) decide where the stored login lives — see Configuration — and $HOME decides where neo ssh looks for keys. Everything else neo needs comes from flags, from the stored login, or from the checkout it is run in.

Variable Read by Effect
NEOSOURCE_API every server-backed command Forge base URL. It is the same clap value as the global --host, so a typed --host outranks it.
NEOSOURCE_TOKEN every server-backed command Bearer credential. Outranks the stored login — when it is set, neo never reads the token from config.json.
NEOSOURCE_USER credential resolution The handle that pairs with NEOSOURCE_TOKEN. Only consulted on that path; a stored login already carries its own handle.
NEOSOURCE_SSH_PORT git/jj over SSH SSH port, default 22. Local dev stacks map the gateway to 2222.
NEOSOURCE_RUNNER_AUTH_TOKEN neo runner register, neo runner start Bootstrap PAT for the registration call, equivalent to --auth-token. Falls back to the stored login.
SSH_AUTH_SOCK neo doctor Standard OpenSSH agent socket. Doctor reports whether an agent is reachable and holds keys; neo never sets it.

No --help screen and no page of this reference renders the value of any of these. NEOSOURCE_TOKEN and NEOSOURCE_RUNNER_AUTH_TOKEN are live bearer credentials, and NEOSOURCE_API can legitimately carry userinfo (https://user:pass@host), so all three leak the same way through a pasted bug report. Only the variable name is documented.

neo run executes a workflow against a local checkout, which may belong to some entirely different forge. So it treats a typed --host as a statement about this run and NEOSOURCE_API as ambient: the checkout’s own neosource remote outranks the environment variable, and only the explicit flag outranks the remote. Every other command folds the two into one value, flag first.