The COPILOT_ prefix admits every variable Copilot reads, and the 1.0.98
bundle reads far more than `copilot help environment` lists. Only
COPILOT_HOME, COPILOT_ALLOW_ALL and the BYOK trio were privileged, so a
non-granted multi-user owner could still hand back what the allowAll
clamp removed:
- approval: COPILOT_PLAN_THEN_AUTOPILOT, COPILOT_ASSISTED_APPROVAL
- code with no approval row: COPILOT_CLI_DIST_DIR runs <dir>/index.js
in place of the CLI, the package caches choose the CLI build,
COPILOT_EDITOR, COPILOT_PROVIDER_API_KEY_COMMAND and
COPILOT_AHP_HOST_BIN are executed, skills, provider configs and hooks
are loaded from the named places (the DSH_HOME class)
- token redirects: COPILOT_API_URL and the other API bases receive the
CLI's sign-in token, which in multi-user mode is the operator's (all
users share the OS account and ~/.copilot), and the rest of the BYOK
provider family re-aims a Codeman custom endpoint (the
DEEPSEEK_BASE_URL / OMP_AUTH_BROKER_URL class)
All are now privilegedEnvKeys. The registry schema capped that list at 8;
the cap is now 48, since a longer deny list only takes more away from
non-granted owners. The test sends one of each class through the real
schema (they all pass it) and the real clamp. The docs say the list is
read from the 1.0.98 bundle and that a variable a later release adds is
not covered until it is listed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codeman maintainer
75186a5d97