Copilot CLI: Permissions, Config, Trusted Folders, and Environment Variables

copilot --allow-all -p "Audit this repository and propose improvements."

# Disable approval prompts for the whole run.

copilot --allow-all-tools -p "Run tests and fix the simplest failing case."

# Skip confirmation for tool use.

copilot --add-dir=../shared-lib -p "Inspect both repositories and suggest shared abstractions."

# Grant file access to an extra path.

copilot --allow-tool="shell(git:*)" -p "Summarize branch divergence and recent merge risks."

# Permit a narrow shell tool pattern.

copilot --allow-tool="shell(git:*)" --deny-tool="shell(git push)"

# Block a specific command even when a broader rule allows related commands.

copilot --allow-url=docs.github.com -p "Read the docs and summarize the CLI auth flow."

# Trust a URL or domain without prompts.

copilot --deny-url=example.com -p "Do the task without consulting blocked domains."

# Prevent access to sites you do not want queried.

export COPILOT_MODEL="MODEL_NAME"

# Choose a model using an environment variable.

export COPILOT_ALLOW_ALL=true

# Enable fully automatic permissions in scripts.

export COPILOT_EDITOR="code --wait"

# Set the editor Copilot should use.

export COPILOT_GITHUB_TOKEN=YOUR_FINE_GRAINED_TOKEN

# Set a token for non-interactive environments.

export COPILOT_HOME="$HOME/.copilot-work"

# Change where config and state files are stored.

export COPILOT_AUTO_UPDATE=false

# Prevent background auto-updates.

export PLAIN_DIFF=true

# Use plain-text diff output.

~/.copilot/config.json

# Use the default config location.

.github/copilot/settings.json

# Commit repo-wide Copilot settings.

.github/copilot/settings.local.json

# Create non-committed per-repo overrides.

{
  "trusted_folders": [
    "/Users/you/src/project-a",
    "/Users/you/src/project-b"
  ]
}

# Persist trusted directories in the user config.

{
  "banner": "never"
}

# Tune a simple UI preference in config.

{
  "auto_update": false
}

# Persist no-auto-update behavior.