/basecamp-connect

name: basecamp-connect
description: |
  Connect a Basecamp agent to this computer and manage the local agent
  connector's setup: the agent's credential (basecamp auth agent connect),
  connect.json (who may drive the agent, which Basecamp projects it serves),
  and readiness (basecamp connect setup). Explains every setup
  result and failure. Also reads what the connector ran (status, doctor) and
  carries out a person's decisions on its records (redispatch, discard,
  release, the cutover's shadow promote and import). Starting and supervising
  the connector is not in this skill yet.
  Use when asked to connect an agent, set up or change the connector, add or
  remove a project, change who can drive the agent, find out why setup says
  the connector is not ready, or see, retry, close or release what the
  connector holds.
triggers:
  - /basecamp-connect
  - connect an agent
  - set up the connector
  - basecamp connect setup
  - basecamp auth agent connect
  - connect.json
  - serve a project
  - who can drive the agent
  - connector not ready
  - basecamp connect status
  - basecamp connect doctor
  - redispatch an event
  - held records
  - release the hold

Basecamp connector: connect an agent and manage its setup

The local agent connector lets people in Basecamp hand work to a coding agent on this computer. It listens to the account's event feed **as a Basecamp agent**, admits what a trusted person asks of that agent, and runs the work in the directory the connector itself was started in. No directory is associated with a project: if a task needs a clone or a directory of its own, the agent makes one. The agent replies in Basecamp as itself.

You manage it for the person. They should never have to type a command: you check what is there, ask what you need in plain words, run the commands, and explain the result. This skill is the reference you do that from.

Two commands, two jobs

| Command | Owns | Run it when | |---------|------|-------------| | `basecamp auth agent connect -P '<profile>'` | The agent's **credential**, stored under a CLI profile | The profile does not exist yet, or the person agrees to replace its Agent credential | | `basecamp connect setup -P '<profile>'` | **Policy and readiness**: connect.json and the checks | First setup after the credential, and every change to trust or served projects |

• **Order on first setup:** connect, confirm who the credential is, then setup.

Setup does not obtain a credential.

• **Setup never touches the credential.** It never stores, replaces or removes

one, so running it again is always safe for the credential. (An access token that expires is minted or renewed as by any command.)

• **Changing the credential means running connect again, not setup.** Then run

setup with no flags to check the new credential against connect.json. Connecting again **rotates the agent's secret**: any other computer connected to the same agent stops working. Do it only when the person agrees.

• `basecamp connect show -P '<profile>'` reads back what setup recorded, and

changes nothing.

• The bot-user path (below) swaps the first command for a sign-in pinned with

`--expect-identity`; the division is the same.

Rules without exceptions

**Credentials**

• Never ask the person to paste a token, secret or password into the

conversation, and never put one in a flag, an environment variable or a file.

• Never print, read or copy a stored credential or the CLI's credential files.
• Credentials enter only through `basecamp auth agent connect`, or on the

bot-user path `basecamp profile create` / `basecamp auth login` with `--expect-identity`. When a refusal's hint suggests `--with-token` or `--with-client-credentials`, do not follow it: those read a secret from stdin, which is not how this skill connects anything.

• The link and one-time code a connection prints are for the person at this

computer. Show them in this conversation only; never post them to Basecamp, chat, a file or anywhere else. Whoever approves that code chooses which agent this computer acts as.

• Setup, the connection, doctor and redispatch refuse to run while

`BASECAMP_TOKEN` is set. Tell the person to unset it in their shell; do not set, print or work around it.

**Identity.** Never set up a profile whose identity you have not confirmed with the person. Before the first setup on a profile, run `basecamp me -P '<profile>' --json` and say who it is: `identity` (first and last name, email) and, when present, `person.name` and `person.id`. Go on only when the person says that is the agent. If it names someone other than the agent the person described, stop: do not run setup and do not reconnect. Tell the person who the credential is and let them decide. After setup, check `data.agent_person_id` matches `person.id` when `me` reported one.

**Shell quoting.** Two kinds of value go into commands, and each has one rule:

• **Numeric ids** (project, person, account and identity ids) go in bare, as

digits only. Use an id only after checking it is all digits; an id you did not get from the CLI's own output is one to ask about.

• **Every other value** goes in single quotes: profile names, class labels,

anything the person typed. Write a single quote inside a value as `'\''`. Fixed words from this skill (`operator`, `spawn`, `90m`) need no quotes. No flag here takes a path: the connector runs where it is started, and nothing you pass names a directory.

Project names never reach a command: resolve each name to its numeric id first, and pass only the id. For example the project called `Launch $(date)` is served as `--serve 222`, never by its name.

**Interactive logins.** `basecamp auth agent connect`, `basecamp auth login` and `basecamp profile create` print instructions and wait for a person. Run them without `--json`, `--agent` or `--quiet` (they refuse machine output), and without `BASECAMP_NONINTERACTIVE` set (unset it for that one comm