UAT: `server.token` config key and `CLEVERAGENTS_SERVER_TOKEN` env var missing from `Settings` — server authentication cannot be configured #2541

New issue

Open

opened 2026-04-03 18:50:39 +00:00 by freemo · 1 comment

freemo commented

2026-04-03 18:50:39 +00:00

Owner

Metadata

Branch: fix/server-token-config
Commit Message: fix(config): add server.token and CLEVERAGENTS_SERVER_TOKEN to Settings
Milestone: v3.6.0
Parent Epic: #399

Bug Description

The spec defines two required configuration keys for server mode authentication:

Key	Env Var	Purpose
`server.url`	`CLEVERAGENTS_SERVER_URL`	URL of the CleverAgents A2A server endpoint
`server.token`	`CLEVERAGENTS_SERVER_TOKEN`	Authentication token

Actual behavior: The Settings class in src/cleveragents/config/settings.py does not define a server_token field or recognize the CLEVERAGENTS_SERVER_TOKEN environment variable. The server_connect CLI command also does not accept or persist a --token option.

Looking at src/cleveragents/cli/commands/server.py, the server_connect command only persists:

server.url
server.namespace
server.tls-verify

There is no server.token being persisted, and no --token CLI option.

The ServerConnectionConfig model in src/cleveragents/a2a/server_config.py has an auth_token_ref field (a reference to a token, not the token itself), but this is not wired to the CLEVERAGENTS_SERVER_TOKEN environment variable.

Expected Behavior (from spec)

Per the spec section Core Concepts > Server > Server Configuration and Connection:

Connecting to a server requires two configuration keys:

Key Env Var Purpose

server.url CLEVERAGENTS_SERVER_URL URL of the CleverAgents A2A server endpoint

server.token CLEVERAGENTS_SERVER_TOKEN Authentication token (obtained via server registration or team invite)

The CLEVERAGENTS_SERVER_TOKEN environment variable must be recognized by Settings and used to authenticate A2A requests to the server via Authorization: Bearer <token> header.

Code Location

Settings: src/cleveragents/config/settings.py — missing server_token field
CLI command: src/cleveragents/cli/commands/server.py — server_connect missing --token option
Server config model: src/cleveragents/a2a/server_config.py — auth_token_ref not wired to env var

Steps to Reproduce

# Set the env var per spec
export CLEVERAGENTS_SERVER_TOKEN="my-auth-token"

# Try to connect — token is not used
agents server connect https://agents.example.com
# No token is persisted or used for authentication

Subtasks

Add server_token: str | None field to Settings with CLEVERAGENTS_SERVER_TOKEN env var
Add --token option to agents server connect CLI command
Persist server.token via ConfigService.set_value() in server_connect
Wire server.token into A2aHttpTransport for Authorization: Bearer header
Add BDD tests for token configuration and authentication flow

Definition of Done

CLEVERAGENTS_SERVER_TOKEN env var is recognized by Settings
agents server connect <url> --token <token> persists the token
agents server status displays whether a token is configured (masked)
Token is used in Authorization: Bearer header for server-mode A2A requests

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-uat-tester

## Metadata - **Branch**: `fix/server-token-config` - **Commit Message**: `fix(config): add server.token and CLEVERAGENTS_SERVER_TOKEN to Settings` - **Milestone**: v3.6.0 - **Parent Epic**: #399 ## Bug Description The spec defines two required configuration keys for server mode authentication: | Key | Env Var | Purpose | |-----|---------|---------| | `server.url` | `CLEVERAGENTS_SERVER_URL` | URL of the CleverAgents A2A server endpoint | | `server.token` | `CLEVERAGENTS_SERVER_TOKEN` | Authentication token | **Actual behavior:** The `Settings` class in `src/cleveragents/config/settings.py` does not define a `server_token` field or recognize the `CLEVERAGENTS_SERVER_TOKEN` environment variable. The `server_connect` CLI command also does not accept or persist a `--token` option. Looking at `src/cleveragents/cli/commands/server.py`, the `server_connect` command only persists: - `server.url` - `server.namespace` - `server.tls-verify` There is no `server.token` being persisted, and no `--token` CLI option. The `ServerConnectionConfig` model in `src/cleveragents/a2a/server_config.py` has an `auth_token_ref` field (a reference to a token, not the token itself), but this is not wired to the `CLEVERAGENTS_SERVER_TOKEN` environment variable. ## Expected Behavior (from spec) Per the spec section **Core Concepts > Server > Server Configuration and Connection**: > Connecting to a server requires two configuration keys: > | Key | Env Var | Purpose | > |-----|---------|---------| > | `server.url` | `CLEVERAGENTS_SERVER_URL` | URL of the CleverAgents A2A server endpoint | > | `server.token` | `CLEVERAGENTS_SERVER_TOKEN` | Authentication token (obtained via server registration or team invite) | The `CLEVERAGENTS_SERVER_TOKEN` environment variable must be recognized by `Settings` and used to authenticate A2A requests to the server via `Authorization: Bearer <token>` header. ## Code Location - **Settings**: `src/cleveragents/config/settings.py` — missing `server_token` field - **CLI command**: `src/cleveragents/cli/commands/server.py` — `server_connect` missing `--token` option - **Server config model**: `src/cleveragents/a2a/server_config.py` — `auth_token_ref` not wired to env var ## Steps to Reproduce ```bash # Set the env var per spec export CLEVERAGENTS_SERVER_TOKEN="my-auth-token" # Try to connect — token is not used agents server connect https://agents.example.com # No token is persisted or used for authentication ``` ## Subtasks - [ ] Add `server_token: str | None` field to `Settings` with `CLEVERAGENTS_SERVER_TOKEN` env var - [ ] Add `--token` option to `agents server connect` CLI command - [ ] Persist `server.token` via `ConfigService.set_value()` in `server_connect` - [ ] Wire `server.token` into `A2aHttpTransport` for `Authorization: Bearer` header - [ ] Add BDD tests for token configuration and authentication flow ## Definition of Done - `CLEVERAGENTS_SERVER_TOKEN` env var is recognized by `Settings` - `agents server connect <url> --token <token>` persists the token - `agents server status` displays whether a token is configured (masked) - Token is used in `Authorization: Bearer` header for server-mode A2A requests --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-uat-tester

freemo referenced this issue

2026-04-03 18:53:37 +00:00

[UAT-SUPERVISOR] Progress Report — Cycle 1581 — v3.7.0 #2558

freemo commented

2026-04-03 18:53:44 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
MoSCoW: Should Have — Spec compliance or quality improvement.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **MoSCoW**: Should Have — Spec compliance or quality improvement. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo added the

Priority

Backlog

label

2026-04-04 15:21:52 +00:00

freemo referenced this issue

2026-04-04 15:24:49 +00:00

[CA-GROOMER] Backlog Groomer — Session State (groomer-1) #2386

freemo referenced this issue

2026-04-04 21:09:23 +00:00

UAT: Settings class missing server_url, server_token, and format fields — spec-required env vars not captured by pydantic-settings #2866