[jeremy]

Fixes the issue reported on this card: basecamp me -P <agent-profile> fails with "Authorization failed: invalid or expired token".

What was wrong

me always asked /authorization.json who the credential belongs to. For an agent profile that is Basecamp's own /authorization.json (not Launchpad: AuthorizationEndpointFor("agent") already routes to the Basecamp origin). But that endpoint authenticates through authenticate_basecamp_identity, which requires token.identity_id, and a client_credentials self-token is minted with an agent and an account, with no identity. So the server answers 401 to a perfectly good token. The CLI then attached the agent login remedy (... | basecamp auth login --with-client-credentials ...), which is the right remedy for a broken agent credential but useless here, since re-minting produces another token the endpoint refuses in the same way.

What changed

• For a stored oauth_type: agent credential, me reads /{account}/my/profile.json in the configured account (the same record connect setup reads through SDKReader.Me) and never calls /authorization.json. No 401 means no misleading hint. A real auth failure on the profile read still gets the agent login remedy, which is right in that case.
• Agent output: person (id, name, email), accounts holding the one bound account marked current, and no identity (an agent has none). Summary: Name <email> - agent in Basecamp account N.
• MeOutput.Identity is now a pointer with omitempty so the agent case can leave it out. For every other profile it is always set, so the JSON is byte-for-byte what it was.
• Under BASECAMP_TOKEN the stored type says nothing about the token being sent, so that path is unchanged.
• The agent path does not write the accounts completion cache (it knows only the account id) and does not write the person back into the stored credential.

Tests

TestMeOnAnAgentProfileReadsTheAgentsPerson stores an agent credential against a fake server whose /authorization.json answers 401. It asserts me asks only /555/my/profile.json and checks the summary and JSON shape. On main it fails with Authorization failed: invalid or expired token: Run: basecamp auth login, the error from the report.

Not changed here

auth status --check and doctor's "API Connectivity" check also probe /authorization.json with the active credential, so they probably report an agent's valid token as rejected in the same way. I left them out to keep this change scoped to the report. They could get the same agent branch, or /authorization.json in bc3 could learn to describe agent tokens, which would fix all three at once.

---

Summary by cubic

Fixes basecamp me -P <agent-profile> failing with "Authorization failed: invalid or expired token" for agent credentials. Agent self-tokens have no identity, so /authorization.json rejects them; me now reads the agent's person record from /{account}/my/profile.json instead, outputs that person and the bound account, and omits identity. Other profiles and the BASECAMP_TOKEN path are untouched, but auth status --check and doctor's API connectivity check still probe /authorization.json and may report agent tokens as rejected.

^{Written for commit 0276079. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T22:18:10.138844Z	0276079	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot review overview

🟢 Approved

The focused implementation correctly preserves existing behavior and covers the new agent path.

Review effort: Balanced
Findings: None

What changed in this PR

Updates basecamp me to support agent credentials without querying the incompatible authorization endpoint.

Changes:

• Retrieves agent identity from the account-scoped person endpoint.
• Omits nonexistent agent identity data while reporting its bound account.
• Adds coverage for agent routing and JSON output.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
internal/​commands/​people.go	Adds agent-specific profile retrieval and output.
internal/​commands/​people_test.go	Verifies endpoint routing, summary, and JSON shape.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.