Co Env

co env

Always read the output, not just the exit code. co env path and co env get print a bare value and no tip, so they compose with $(...); other human-output commands end with one Next: line. JSON output contains its next command as a field.

Which command

The 80% commands

co env                                   # file, settings, sources, next step
co env set OPENAI_API_KEY "$KEY"         # quote values; spaces are fine
co env get MODEL                         # bare value
co --env-file ./project.env env set MODEL co/gemini-3.7-flash

Gotchas that change a result

• SOURCE column. process (overrides file) means the shell exports the same name; the file's value is not what commands see. set still saves it and prints the unset KEY you need in the shell.
• Provider records are all-or-nothing. set refuses the five GOOGLE_* and five MICROSOFT_* account fields (exit 2, names the auth command). unset on any one of them removes all of them and says so.
• AGENT_CONFIG_PATH cannot be set here. It chooses which directory is read; set refuses it and prints the shell export to use.
• A broken file stops everything else. Any other command exits 2 with <file>: invalid syntax on line N. Next: co env. co env still runs, repeats the line number, never the line, and refuses set until the line is fixed in an editor.
• Nothing here selects a file. co env shows the file the invocation already chose. To switch, put --env-file before the command.

Exit codes

co env --json and co env show --json return redacted provenance. JSON values are always hidden. Default human output also hides every value, including custom names and credential-bearing URLs; only show --reveal displays them. get explicitly returns one effective value and respects whole Google/Microsoft records: it never fills a missing process field from another account in the file.