Summary

Fixes a bug where af CLI commands return 403 when using AIRFLOW_API_URL to point at a local Airflow instance while ~/.af/config.yaml has credentials for a different (e.g., cloud) instance.

Root cause

The env var precedence logic in CLIContext.init() resolves each field independently:

URL:      AIRFLOW_API_URL env var → http://localhost:8080  ✓
Token:    no AIRFLOW_AUTH_TOKEN   → config_values.token    ✗ (cloud token!)
Username: AIRFLOW_USERNAME       → admin                  ✓
Password: AIRFLOW_PASSWORD       → admin                  ✓

Since auth_token takes precedence over username/password in AdapterManager.configure(), the cloud token is used against localhost — 403.

Fix

When AIRFLOW_API_URL is set via env var (overriding the config's URL), don't inherit auth fields from the config file since they belong to a different instance. Auth from env vars still works.

Testing

# Before: 403 Forbidden on API calls
AIRFLOW_API_URL=http://localhost:8080 AIRFLOW_USERNAME=admin AIRFLOW_PASSWORD=admin af health

# After: works correctly, TokenManager exchanges credentials for JWT
AIRFLOW_API_URL=http://localhost:8080 AIRFLOW_USERNAME=admin AIRFLOW_PASSWORD=admin af health

All 433 unit tests pass.

🤖 Generated with Claude Code