github / github/copilot-cli

Feature: Support .env file loading and per-agent environment variable scoping

Abierto
#2,879 0 comentarios 1 reacción 0 asignados Ver en GitHub
area:agents area:configuration
Lenguaje dominante
Shell
Estrellas
11.2k
Forks
1.9k
Merge medio
14 h 16 min
PR fusionados (30 d)
6

Descripción

## Summary

Copilot CLI should support automatic `.env` file loading from the project root, and allow agents to declare environment variables scoped to their configuration — so that different agents can have isolated secrets without polluting the global shell environment.

## Problem

When building custom agents with Copilot CLI that use MCP servers requiring credentials (e.g., the Slack MCP server needing `SLACK_USER_OAUTH_TOKEN`), all credentials must be exported in `~/.bashrc` or equivalent shell profile because:

1. Copilot CLI does not load `.env` files from the project directory
2. Agent `env:` blocks in MCP config use `${VAR}` syntax, which resolves from the shell environment only
3. There is no way to scope environment variables per-agent

### No project-scoped configuration
Secrets for one project leak into every shell session. A `.env` file at the repo root (gitignored) is the standard pattern for project-scoped secrets in every major framework (Node.js, Python, Ruby, Go). Copilot CLI is the only tool in my workflow that forces secrets into the global shell profile.

### No secret isolation between agents
If you have multiple agents, each needing different MCP servers, every agent currently sees every exported variable in the shell. Per-agent env scoping would follow the principle of least privilege — an agent that only needs a Slack token should not have access to other API keys.

### Onboarding friction
When sharing a multi-agent repo, contributors need to manually add exports to their shell profile. A `.env.example` + `.env` pattern is universally understood and self-documenting.

## Proposed Solution

### Part 1: `.env` file loading (minimum viable)
- On startup, if a `.env` file exists in the project root (or git root), load it into the environment before resolving `${VAR}` references in agent/MCP configs
- Respect `.env` files at both user level (`~/.copilot/.env`) and project level (`.env` in git root), with project-level taking precedence

### Part 2: Per-agent environment scoping (stretch goal)
Allow agents to declare their own env vars or reference a specific `.env` file:

```yaml
---
name: slack-agent
env:
SLACK_USER_OAUTH_TOKEN: ${SLACK_USER_OAUTH_TOKEN}
env_file: .env.slack
---
```

This would restrict which variables are available to that agent's MCP server subprocesses.

## Current Workaround

Export all variables in `~/.bashrc` and maintain a `.env.example` in the repo for documentation only:

```bash
# ~/.bashrc
export SLACK_USER_OAUTH_TOKEN=xoxp-...
```

This works but violates standard project-scoping conventions.

## Related Issues

- #1232 — `${}` env var expansion in MCP config (implemented, but only reads from shell env)
- #1354 — Per-agent model selection (similar theme of per-agent configuration)

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

El payload menciona la inicialización del entorno de inicio y la resolución de `${VAR}` en la configuración del agente y de MCP, pero no hay archivos de implementación ni pruebas. Empieza rastreando esos puntos de entrada y cómo se descubren la configuración del proyecto y la del usuario. El trabajo estará completo cuando incluya el comportamiento de precedencia de `.env` solicitado y un diseño o implementación claros para el ámbito por agente, con cobertura para ambas partes.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
shell, yaml
Área
cli, developer-experience, security
Tipo de issue
Nueva funcionalidad
Dificultad
5/5
Tiempo estimado
Más de una semana
Estado de actividad
Tranquilo
Claridad
Bastante claro
Aptitud para principiantes
45/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.