co env — see, set and repair the selected env file

Added in 1.8.4. co env works on whichever env file this invocation selected: global ~/.co/keys.env by default, or the file named by co --env-file PATH (see Environment selection). It never selects a file itself, and it never touches your shell's variables.

co env                              # every setting, all values hidden, with its source
co env --json                       # redacted sources as JSON
co env show --reveal                # the same with full values (keep out of shared logs)
co env path                         # the selected file's path, bare, for $(co env path)
co env get OPENAI_API_KEY           # one value, bare, as a command would see it
co env set OPENAI_API_KEY sk-...    # save one setting; creates the file if needed
co env unset OPENAI_API_KEY         # remove one setting
co --env-file ./project.env env     # the same commands on a project file

What co env shows

Env file: ~/.co/keys.env (global)
SETTING             VALUE               SOURCE
OPENONION_API_KEY    [redacted]          file
MODEL               [redacted]          process (overrides file)
GOOGLE_EMAIL        [redacted]          ignored: process provider record
All values are hidden; use show --reveal for full values.
Next: co env set <KEY> <value>

• SOURCE says whether a setting wins. process overrides file means your shell exports the same name with a different value, and process values win. ignored marks a provider record the file holds while the shell supplies another one; records are used whole, never merged (see #1444).
• Every value is [redacted] by default, including custom names, passwords and URLs that contain credentials. show --reveal explicitly displays full values.
• co env --json and co env show --json expose redacted provenance, including process-only provider/ConnectOnion settings. JSON cannot be combined with --reveal.
• get explicitly prints one effective value. Google/Microsoft fields come from the same whole record as provider commands. A missing field in a process record does not fall back to another account in the file; it exits 1.
• The file is read as-is; nothing is loaded into the process.

set and unset rules

co env set rewrites the file atomically under the same lock that provider refresh uses, keeps every comment and unrelated line, quotes values with spaces, and leaves the file owner-only (0600) on Unix. Existing keys are replaced in place; new ones are appended.

Three names are refused, each with the command to use instead:

Name	Why	Use instead
AGENT_CONFIG_PATH	It chooses which global directory is read, so a file inside that directory cannot set it	export AGENT_CONFIG_PATH=/path/to/.co in your shell
GOOGLE_ACCESS_TOKEN, GOOGLE_REFRESH_TOKEN, GOOGLE_TOKEN_EXPIRES_AT, GOOGLE_SCOPES, GOOGLE_EMAIL	An account record is written as a whole; one edited field could describe a different account than the rest	co auth google
The same five MICROSOFT_* fields	Same rule	co auth microsoft

co env unset on any one of those record fields removes the whole record, and says so. That is the supported way to disconnect an account from a file.

If your shell exports the name you just set, set still saves it and then tells you the shell's value will keep winning until you unset it there.

A broken file

One malformed line in ~/.co/keys.env — a pasted key with a stray quote, a line without = — stops every co command with exit 2:

~/.co/keys.env: invalid syntax on line 7. Next: co env

co env is the one command that still runs on that file. It repeats the line number (never the line's contents, which may be a secret) and exits 2 until the line is fixed in an editor. co env set refuses to rewrite a file it cannot parse, so the broken line is never silently dropped.

Exit codes

Exit	Meaning	Next command (printed)
0	Done	co env set <KEY> <value>, co env get <KEY>, or co init when the global file does not exist yet
1	get or unset named a setting that is not there	co env set <KEY> <value> / co env
2	Bad name, protected name, missing explicitly selected file, or a file that does not parse	The command named in the message: co env, co env set …, co auth google, or a shell export

co env path and co env get print only the value so they compose with $(...); they are the two commands that print no Next: line.

Where else the selected file shows up

co status, co doctor and co keys inspect the same selected sources and name co env set … as the fix for a missing provider key. co gmail, co gdrive, co gcalendar, co youtube, co outlook and their SDK clients say which file (or that the process) supplied an incomplete account record, and point at co env before asking you to re-authorize.