autoUpdate: false in settings.json is ignored — CLI re-execs a cached prerelease build over the stable version installed via npm

Summary

Once a prerelease build has been cached under ~/.copilot/pkg/<platform>/, the
CLI keeps re-execing it on every launch, even when:

• a stable version is installed via npm, and
• "autoUpdate": false is set in ~/.copilot/settings.json.

The documented setting has no effect, because the re-exec into the newer cached
build happens before settings are read. Only the COPILOT_AUTO_UPDATE=false
environment variable changes the behaviour.

The practical result: a user who tries the prerelease channel once cannot get
back to stable through any documented mechanism, and cannot tell they are still
on a prerelease unless they check --version.

Environment

• Cached prerelease build: 1.0.81-5
• Stable installed via npm: 1.0.80
• Node.js v22.21.1, Linux x64

Steps to reproduce

1. Be on a prerelease build (so it is cached under ~/.copilot/pkg/<platform>/).
2. npm install -g @github/copilot — installs the current stable release.
   Confirm node_modules/@github/copilot-<platform>/package.json reports the
   stable version.
3. Set "autoUpdate": false in ~/.copilot/settings.json.
4. Run copilot --version.

Expected: the stable version, since that is what is installed and
auto-update is disabled.

Actual: the cached prerelease version.

$ copilot --version
GitHub Copilot CLI 1.0.81-5.

The env var behaves differently from the setting

Running the npm-installed platform binary directly:

$ ./copilot --version
GitHub Copilot CLI 1.0.81-5.            # re-execs the cached prerelease

$ COPILOT_AUTO_UPDATE=false ./copilot --version
Package extraction took 7995ms
GitHub Copilot CLI 1.0.80.              # runs the installed stable build

Same binary, same settings file, opposite results — so autoUpdate in
settings.json and COPILOT_AUTO_UPDATE are not equivalent, though
copilot update --help presents them as alternatives:

Use --no-auto-update or set COPILOT_AUTO_UPDATE=false to disable it manually.

and copilot help config documents:

autoUpdate: whether to automatically download updated CLI versions; defaults to true.

There is no documented way back to stable

copilot update stable refuses, because it only compares version ordering and
will not move backwards:

$ copilot update stable
Checking for updates...
Checking GitHub for the latest release...
No update needed, current version is 1.0.81-5, fetched latest release is v1.0.80

Since prerelease versions sort above the current stable release, anyone on
a prerelease is pinned there until a higher stable ships. Combined with the
ignored autoUpdate setting, the only working escape routes are undocumented:
set COPILOT_AUTO_UPDATE=false, or manually delete the cached build
directories.

Also, COPILOT_PKG_CACHE_HOME pointed at an empty directory did not change
resolution — the cached prerelease was still selected.

Suggested fixes

1. Make "autoUpdate": false in settings.json honoured by the re-exec path,
   or document that it does not cover it.
2. Give copilot update <channel> a way to switch channels downward
   (e.g. --allow-downgrade, or treat an explicit channel argument as
   authoritative over version ordering).
3. Surface the channel in --version output, so it is obvious when a
   prerelease is being used.

---

Found while trying to move off the prerelease channel after hitting #4533 (a
separate defect). This report is only about being unable to leave the
prerelease channel.

Commencez par suivre le lancement de la CLI et le chemin de réexécution qui sélectionne ~/.copilot/pkg// avant la lecture de settings.json, puis examinez la gestion de copilot update et la comparaison des versions. Reproduisez le problème avec un prerelease mis en cache, un paquet npm stable et autoUpdate false ; le travail sera terminé lorsqu’une configuration documentée empêchera une réexécution involontaire ou que le changement explicite de canal fonctionnera.