Read ASTA_TOKEN in auth status command (#88)

Author: rodneykinney

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "asta-tools",
       "source": "./plugins/asta-tools",
       "description": "Paper search, metadata, document management, literature reports, experiments, and theory generation for scientific research",
-      "version": "0.101.0",
+      "version": "0.101.1",
       "author": {
         "name": "Ai2 Asta Team"
       },
@@ -30,7 +30,7 @@
       "name": "asta-flows",
       "source": "./plugins/asta-flows",
       "description": "Executes named, typed chains of research steps using the skills in asta-tools. Requires installation of asta-tools",
-      "version": "0.101.0",
+      "version": "0.101.1",
       "author": {
         "name": "Ai2 Asta Team"
       },
@@ -47,7 +47,7 @@
       "name": "asta-assistant",
       "source": "./plugins/asta-assistant",
       "description": "Autonomous collaborative agent able to plan and execute a long-range research agenda using asta-tools. Requires installation of asta-tools",
-      "version": "0.101.0",
+      "version": "0.101.1",
       "author": {
         "name": "Ai2 Asta Team"
       },
@@ -64,7 +64,7 @@
       "name": "asta-dev",
       "source": "./plugins/asta-dev",
       "description": "Developer skills for working on Asta itself (improve-skills, research-challenge). Requires the asta-tools plugin to be installed.",
-      "version": "0.101.0",
+      "version": "0.101.1",
       "author": {
         "name": "Ai2 Asta Team"
       },

plugins/asta-tools/hooks/sync-cli-version.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Check if asta CLI version matches the plugin version and auto-install/update if needed
 
-PLUGIN_VERSION=0.101.0
+PLUGIN_VERSION=0.101.1
 INSTALL_URL="git+https://github.com/allenai/asta-plugins.git@v$PLUGIN_VERSION"
 
 # Check if asta is installed

plugins/asta-tools/skills/asta-cli/SKILL.md

@@ -18,7 +18,7 @@ Installs the `asta` CLI for agents that don't install it automatically via a plu
 **Prerequisites:** Python 3.11+ and [uv](https://docs.astral.sh/uv/).
 
 ```bash
-PLUGIN_VERSION=0.101.0
+PLUGIN_VERSION=0.101.1
 INSTALL_URL="git+https://github.com/allenai/asta-plugins.git@v$PLUGIN_VERSION"
 
 if ! command -v asta &> /dev/null; then

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "asta"
-version = "0.101.0"
+version = "0.101.1"
 description = "Asta CLI for scientific literature review"
 readme = "README.md"
 requires-python = ">=3.11"

src/asta/__init__.py

@@ -1,3 +1,3 @@
 """Asta - Science literature research tools"""
 
-__version__ = "0.101.0"
+__version__ = "0.101.1"

src/asta/auth/token_manager.py

@@ -215,10 +215,15 @@ def get_user_info(self) -> dict | None:
         except Exception:
             return None
 
-    def verify_token_with_gateway(self) -> dict[str, any]:
+    def verify_token_with_gateway(
+        self, access_token: str | None = None
+    ) -> dict[str, any]:
         """
         Verify the access token with the gateway server.
 
+        Args:
+            access_token: Token to verify. If None, loads from storage.
+
         Returns:
             Dictionary with verification result:
             - valid (bool): Whether the token is valid on the server
@@ -231,11 +236,12 @@ def verify_token_with_gateway(self) -> dict[str, any]:
         if not self.gateway_url:
             raise AuthenticationError("Gateway URL not configured")
 
-        tokens = self.storage.load_tokens()
-        if not tokens or not tokens.get("access_token"):
-            return {"valid": False, "error": "No access token found"}
+        if access_token is None:
+            tokens = self.storage.load_tokens()
+            if not tokens or not tokens.get("access_token"):
+                return {"valid": False, "error": "No access token found"}
+            access_token = tokens["access_token"]
 
-        access_token = tokens["access_token"]
         verify_url = f"{self.gateway_url}/auth/verify"
 
         try:

src/asta/commands/auth.py

@@ -6,6 +6,7 @@
 import base64
 import datetime
 import json
+import os
 
 import click
 from rich.console import Console
@@ -85,6 +86,42 @@ def status():
         gateway_url=settings.gateway_url,
     )
 
+    # ASTA_TOKEN overrides stored credentials (see asta.utils.auth_helper).
+    env_token = os.environ.get("ASTA_TOKEN")
+    if env_token:
+        table = Table(title="Authentication Status")
+        table.add_column("Property", style="cyan")
+        table.add_column("Value")
+        table.add_row("Token Source", "[cyan]ASTA_TOKEN environment variable[/cyan]")
+
+        verification_result = token_manager.verify_token_with_gateway(
+            access_token=env_token
+        )
+        if verification_result["valid"]:
+            table.add_row("Server Verification", "✅ [green]Valid[/green]")
+            server_user = verification_result.get("user_info") or {}
+            if email := server_user.get("email"):
+                table.add_row("Email", email)
+            if name := server_user.get("name"):
+                table.add_row("Name", name)
+        else:
+            error_msg = verification_result.get("error", "Unknown error")
+            table.add_row(
+                "Server Verification", f"❌ [red]Invalid[/red]\n   {error_msg}"
+            )
+
+        console.print(table)
+
+        if not verification_result["valid"]:
+            console.print()
+            console.print(
+                "⚠️  [yellow]Token verification failed with gateway server.[/yellow]"
+            )
+            console.print(
+                "   Check that [cyan]ASTA_TOKEN[/cyan] is set to a valid token."
+            )
+        return
+
     user_info = token_manager.get_user_info()
 
     if not user_info:

tests/test_auth.py

@@ -64,13 +64,18 @@ def test_load_tokens_when_none_exist(self, tmp_path):
 class TestAuthCommands:
     """Tests for auth CLI commands."""
 
+    @staticmethod
+    def _invoke(runner, args):
+        """Invoke CLI with ASTA_TOKEN cleared from env for storage-based tests."""
+        return runner.invoke(cli, args, env={"ASTA_TOKEN": ""})
+
     def test_auth_status_not_authenticated(self):
         """Test auth status when not authenticated."""
         runner = CliRunner()
 
         # Mock TokenStorage.load_tokens to return None (no tokens)
         with patch.object(TokenStorage, "load_tokens", return_value=None):
-            result = runner.invoke(cli, ["auth", "status"])
+            result = self._invoke(runner, ["auth", "status"])
             assert result.exit_code == 0
             assert "Not authenticated" in result.output
 
@@ -100,7 +105,7 @@ def test_auth_status_with_server_verification(self):
                 return_value=mock_verification,
             ),
         ):
-            result = runner.invoke(cli, ["auth", "status"])
+            result = self._invoke(runner, ["auth", "status"])
             assert result.exit_code == 0
             assert "Server Verification" in result.output
             assert "Valid" in result.output
@@ -128,16 +133,64 @@ def test_auth_status_with_server_verification_failure(self):
                 return_value=mock_verification,
             ),
         ):
-            result = runner.invoke(cli, ["auth", "status"])
+            result = self._invoke(runner, ["auth", "status"])
             assert result.exit_code == 0
             assert "Server Verification" in result.output
             assert "Invalid" in result.output
             assert "Token verification failed" in result.output
 
+    def test_auth_status_honors_asta_token_env_var(self):
+        """auth status verifies ASTA_TOKEN from env, ignoring stored tokens."""
+        runner = CliRunner()
+
+        mock_verification = {
+            "valid": True,
+            "user_info": {"email": "env@example.com", "name": "Env User"},
+        }
+
+        # No stored tokens — status should still succeed via env var.
+        with (
+            patch.object(TokenStorage, "load_tokens", return_value=None),
+            patch.object(
+                TokenManager,
+                "verify_token_with_gateway",
+                return_value=mock_verification,
+            ) as verify_mock,
+        ):
+            result = runner.invoke(
+                cli, ["auth", "status"], env={"ASTA_TOKEN": "env-token-value"}
+            )
+            assert result.exit_code == 0
+            assert "ASTA_TOKEN" in result.output
+            assert "Valid" in result.output
+            assert "env@example.com" in result.output
+            # Verified the token from the env var, not from storage.
+            verify_mock.assert_called_once()
+            _, kwargs = verify_mock.call_args
+            assert kwargs.get("access_token") == "env-token-value"
+
+    def test_auth_status_asta_token_invalid(self):
+        """auth status surfaces gateway rejection of ASTA_TOKEN."""
+        runner = CliRunner()
+
+        mock_verification = {"valid": False, "error": "Invalid signature"}
+
+        with patch.object(
+            TokenManager,
+            "verify_token_with_gateway",
+            return_value=mock_verification,
+        ):
+            result = runner.invoke(
+                cli, ["auth", "status"], env={"ASTA_TOKEN": "bad-token"}
+            )
+            assert result.exit_code == 0
+            assert "Invalid" in result.output
+            assert "Invalid signature" in result.output
+
     def test_auth_logout(self):
         """Test auth logout command."""
         runner = CliRunner()
-        result = runner.invoke(cli, ["auth", "logout"])
+        result = self._invoke(runner, ["auth", "logout"])
         assert result.exit_code == 0
         assert "Logged out successfully" in result.output
 
@@ -147,7 +200,7 @@ def test_auth_print_token_no_token(self):
 
         # Mock TokenStorage.load_tokens to return None
         with patch.object(TokenStorage, "load_tokens", return_value=None):
-            result = runner.invoke(cli, ["auth", "print-token"])
+            result = self._invoke(runner, ["auth", "print-token"])
             assert result.exit_code == 1
             assert "No token found" in result.output
 
@@ -160,7 +213,7 @@ def test_auth_print_token_raw(self):
         mock_tokens = {"access_token": test_token}
 
         with patch.object(TokenStorage, "load_tokens", return_value=mock_tokens):
-            result = runner.invoke(cli, ["auth", "print-token", "--raw"])
+            result = self._invoke(runner, ["auth", "print-token", "--raw"])
             assert result.exit_code == 0
             assert test_token in result.output
 
@@ -175,7 +228,7 @@ def test_auth_print_token_decoded(self):
         mock_tokens = {"access_token": test_token}
 
         with patch.object(TokenStorage, "load_tokens", return_value=mock_tokens):
-            result = runner.invoke(cli, ["auth", "print-token"])
+            result = self._invoke(runner, ["auth", "print-token"])
             assert result.exit_code == 0
             assert "JWT Header:" in result.output
             assert "JWT Payload:" in result.output