GitHub Copilot CLI: Installation and Daily Usage Patterns

The current GitHub Copilot CLI is an agentic assistant launched with copilot. It is not the old @githubnext/github-copilot-cli experiment or the retired gh-copilot extension. Old instructions built around ??, git?, gh copilot suggest and gh copilot explain should not be used as the setup guide for today’s CLI.

Official documentation checked October 14, 2026. This guide covers the current stable installation paths; organization policies and usage allowances still apply.

Check Access and Choose One Installation Method

GitHub’s installation guide currently makes CLI access available with all Copilot plans, subject to your organization’s CLI policy. Verify the GitHub account you intend to use. A browser session in a different account does not prove that the terminal has the right entitlement.

Choose one supported package-manager route rather than installing several overlapping copies. On Windows, the documented prerequisite is PowerShell 6 or later. The npm route additionally requires Node.js 22 or later; Node is not a universal prerequisite for every installation method.

Install the Current CLI

On Windows with WinGet, use:

winget install GitHub.Copilot

On macOS or Linux with Homebrew, use:

brew install --cask copilot-cli

If you prefer npm and have Node.js 22 or later, use:

npm install -g @github/copilot

Use your organization’s approved installation process. Do not automatically elevate to Administrator or prepend sudo to solve every permission error. First check which package manager and installation location you are using. Reopen the terminal if its PATH has not refreshed.

A recent GitHub CLI can also use gh copilot to install or launch the new CLI, as described in GitHub’s launcher announcement. This does not revive the old extension’s subcommands.

Authenticate and Start in a Safe Project Folder

1. Navigate to the specific project folder you want the agent to work with. For the first test, use a disposable sample without credentials or private customer data.
2. Run copilot. If sign-in is required, enter /login inside the CLI and follow the displayed authentication flow.
3. Read the directory-trust prompt and verify the path before accepting. Do not trust a broad home directory just for convenience.
4. Ask a read-only question first: “Explain the purpose of this project. Do not edit files or run commands.” Review any requested permissions separately.
5. Use / to inspect available slash commands and ? for help. The official quickstart explains the interactive controls.

Directory trust and tool approval are meaningful security decisions. A prompt saying “do not edit” is useful task scope, but is not a substitute for appropriate permissions.

Useful Daily Workflows

• Understand a command: paste it as text and ask for an explanation without execution. Remove tokens, passwords and other secrets first.
• Plan a change: specify the intended behavior, files in scope and tests. Ask for a plan before permitting modifications.
• Make a small edit: work on a branch or backed-up copy, inspect the diff and run the project’s checks. Do not merge only because the agent reports success.
• Investigate a test failure: provide the exact failure and environment. Ask it to distinguish a proposed fix from a test it actually ran.

The current CLI can maintain an interactive conversation and use project context. It is not limited to independent one-line command suggestions. Conversely, do not assume that every needed file or an unrelated previous session is already in context.

Troubleshoot Without Weakening Safety

The old command fails: identify which executable or alias is being invoked. GitHub’s retirement notice applies to the old extension. Remove or update only the obsolete alias you have identified, not your whole shell profile.

Sign-in or access fails: check the account shown by the CLI and whether your organization permits CLI use. Reinstalling will not override an administrator policy or a usage limit.

A proposed command is destructive: cancel it and ask for a read-only diagnostic or dry-run alternative. Review paths, arguments and expected effects yourself; do not rely on a promise that every dangerous command will be detected.

Keep the first workflow small enough to verify. Agent capabilities are useful precisely because they can act on files and tools, so review those actions with more care than a passive command explanation.