[zachasme]

An agent profile holds a client_credentials credential (basecamp auth agent connect, or auth login --with-client-credentials). Until now, basecamp me and basecamp auth status --check treated every such profile as unauthenticated or rejected. Both asked bc3's /authorization.json first, and bc3 refuses agent self-tokens there, because an agent has no identity whose accounts it could list. The token itself was fine: the rest of the API accepted it.

This came up while building the bc3 side of converting an existing user into an Agent that keeps its person (bc3 PR linked below). After that conversion, the operator re-credentials the same CLI profile as the agent. me is how the profile, the connect skill and the local connector confirm who it is. The connect skill already says "Confirm its identity with basecamp me" for an Agent credential, and that command could not answer.

What changes

• basecamp me, stored agent credential.
  • Answers from the bound account's /{account}/my/profile.json.
  • Reports principal: "agent", no identity, no accounts, and person with personable_type.
  • Records the person id against the credential.
  • A profile with no account, or a non-numeric one, is a usage error. Nothing is requested.
• basecamp auth status --check, stored agent credential. Checks the token against the same profile document. A missing account is a usage error, not a "rejected" verdict.
• BASECAMP_TOKEN still wins over any stored credential. Both commands take the old path for it.
• User credentials: the JSON is unchanged. MeOutput.Identity becomes a pointer with omitempty, and every user path sets it.
• skills/basecamp-connect/SKILL.md says what me shows for an Agent credential.

Not changed

• basecamp doctor: its API connectivity check and account check (projects list, which agents are refused) still fail for an agent profile.
• The TUI's account discovery: unchanged.

Checks

• bin/ci is green locally.
• New tests cover each branch. Reverting each condition in turn fails a test: the agent branch, the BASECAMP_TOKEN guard, the account requirement and personable_type.
• Codex reviewed adversarially in two rounds. Round 1 found a false "rejected" verdict for an agent profile with no account, and gaps in the tests; both were fixed. Round 2, on HEAD da76ab1, found nothing further.

Companion bc3 PR: basecamp/bc3#13570

Basecamp card: Agentize Marie
CLI connector card: basecamp me and auth status --check answer for an agent's own credential

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approved

The agent-specific routing, environment-token precedence, account validation, and output contracts are consistently implemented and tested.

Review effort: Balanced
Findings: None

What changed in this PR

Adds agent-credential support to identity and authentication checks.

Changes:

• Routes agent me and auth status --check through the account profile endpoint.
• Extends me output with agent principal and personable-type data.
• Adds branch, precedence, validation, and documentation coverage.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
skills/​basecamp-connect/​SKILL.md	Documents agent identity output.
internal/​commands/​people.go	Implements agent-aware me.
internal/​commands/​people_test.go	Tests agent me behavior.
internal/​commands/​auth.go	Checks agent tokens via account profiles.
internal/​commands/​auth_status_test.go	Tests agent status checks.
internal/​commands/​auth_login_test.go	Extends profile response fixtures.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[robzolkos]

Hey Zacharias, thanks for this, and for spotting that me and auth status --check didn't work for agent credentials. You were right that the connect skill leans on me to confirm who the agent is.

Jeremy ended up fixing the same thing in parallel, in #784 (me names an agent profile from its person record) and #785 (auth status and doctor check an agent's token the same way). Both are on main now. I've just checked basecamp me and auth status --check against an agent profile there, and both answer correctly. That's also why this conflicts now: people.go, its tests, and the connect skill, which was rewritten today.

I'm closing this as part of tidying up the connector PRs. If there's anything here that #784 and #785 don't cover and you'd like to keep, such as the clearer "this profile has no account" usage error, just reopen it or ping me. I'm happy to help carry it over.