From f3d0346604a2d9e9928cd46be1453bda477ce428 Mon Sep 17 00:00:00 2001 From: Rob Zolkos Date: Mon, 19 Oct 2026 15:08:18 -0400 Subject: [PATCH 1/6] Ask a person only what they can answer when connecting an agent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The connect skill had Claude "agree a profile name" with the person, read the remembered agent and ask them to confirm it before connecting a new one, and list the trust modes by their internal names. People connecting their agent from My › Agent got asked to name a CLI profile and about other agents on their computer. Claude now picks the profile name itself, goes straight to first-time setup when asked to connect a new agent, leaves other agents' profiles alone, and explains who may give the agent work in plain sentences. --- skills/basecamp-connect/SKILL.md | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/skills/basecamp-connect/SKILL.md b/skills/basecamp-connect/SKILL.md index 357c47204..be4ac291d 100644 --- a/skills/basecamp-connect/SKILL.md +++ b/skills/basecamp-connect/SKILL.md @@ -387,9 +387,11 @@ Each becomes a flag on setup (*First-time setup*, step 4): Then: 0. **Versions and leftovers**, once per session (*Before anything*). -1. **Which agent.** Use the profile they name. With none, read - `~/.config/basecamp-connect/last.json` (below) and confirm it. With neither, - list profiles (`basecamp profile list --json`) and ask. +1. **Which agent.** Use the profile they name. Asked to connect a new agent, + or one no profile here is connected as, go to *First-time setup*: other + agents' profiles aren't theirs to sort out, so don't ask about them. With + neither, read `~/.config/basecamp-connect/last.json` (below) and confirm it. + With none of these, list profiles (`basecamp profile list --json`) and ask. 2. **Set up, if needed.** `basecamp connect show -P '' --json`. A `not_found` or `unknown profile` error, or one saying no profiles are configured, means it isn't set up: follow *First-time setup*, whatever @@ -438,9 +440,11 @@ mappings and ask before starting. Never start silently from the store. Ask only what you can't find out. -**1. Profile and credential.** Agree a profile name (letters, digits, `-` and -`_`, starting with a letter or digit), for example the agent's name. Check it: `basecamp auth status -P -'' --json`. +**1. Profile and credential.** Use the profile the person names. Otherwise +pick one yourself from the agent's name (letters, digits, `-` and `_`, +starting with a letter or digit), and don't ask them to choose or confirm it: +the person knows the agent by its Basecamp name, and the profile is yours. +Check it: `basecamp auth status -P '' --json`. - `unknown profile`, or an error saying no profiles are configured (a computer with none yet): it doesn't exist. Never run `basecamp profile @@ -455,8 +459,8 @@ Ask only what you can't find out. create one) and approve. - `oauth_type` `agent`: already connected. Don't connect again: that rotates the agent's secret and disconnects any other computer using it. -- Anything else: a person's login is stored. Ask; never connect an agent over - it. +- Anything else: a person's login is stored. Never connect an agent over it: + pick another name if you chose this one, and ask if they did. Then confirm the identity (`basecamp me`, see *Identity*). @@ -467,8 +471,8 @@ pinned to its identity id, with for an existing profile), and pass the same `--expect-identity` to the first setup. -**2. Who may give it work.** Explain in a sentence each, and default to the -first: +**2. Who may give it work.** Explain each in a plain sentence, without these +mode names, and default to the first: - **operator**: only the operator, which for a personal agent is its owner (you). - **allowlist**: the operator plus people you name. From d80bb6f30f9c0459fd55055784ef4759c4a3ffd4 Mon Sep 17 00:00:00 2001 From: Rob Zolkos Date: Mon, 19 Oct 2026 15:52:31 -0400 Subject: [PATCH 2/6] Don't ask who a just-approved agent is, and say projects are a starting point Right after the person approved the connection, the Identity rule still had Claude ask whether the agent was the right one. They chose it on the approval page, so Claude now tells them its name and goes on. Projects step: Claude listed projects "with the person's own profile", took the computer's default profile (another agent) for it, and called that the person's login. It now uses a profile that isn't an agent's, or none. It also offers all of the agent's projects by default, asks a new agent's owner to add it where they want it, says this is a starting point, and keeps ids to itself. --- skills/basecamp-connect/SKILL.md | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/skills/basecamp-connect/SKILL.md b/skills/basecamp-connect/SKILL.md index be4ac291d..0273fb0ef 100644 --- a/skills/basecamp-connect/SKILL.md +++ b/skills/basecamp-connect/SKILL.md @@ -320,8 +320,9 @@ confirmed. Before the first setup, run `basecamp me -P '' --json` and say who it is: `identity` (name, email) and, when present, `person.name` and `person.id`. An agent credential has no `identity`; its `person` carries `personable_type` and, for a personal agent, `boss`, the person it works for. -Go on only when they say that is the agent. If it names someone -else, stop: don't run setup and don't reconnect. +When you connected it in this session, they chose the agent on the approval +page: tell them its name and go on. Otherwise go on only when they say that is +the agent. If it names someone else, stop: don't run setup and don't reconnect. **Writing to Basecamp.** Everything this skill and its subagents post (boosts, comments, chat lines, card moves) goes out **as the agent**: always pass @@ -498,11 +499,17 @@ A run that passes `--allow` replaces the list, a run that passes none keeps it, and `--trust operator` clears it; setup refuses `--trust operator` with `--allow`. -**3. Projects, by name.** List them (`basecamp projects list -P '' ---json`; if that's refused under an Agent identity, list them with the person's -own profile instead). Show the names, let them choose, and map each to its id -yourself. When a name matches more than one project, ask. The agent must be a -member of each project it serves. +**3. Projects, by name.** The agent hears only the projects it serves, and it +can serve only projects it's a member of. List its projects +(`basecamp projects list -P '' --json`; if that's refused under an +Agent identity, use the person's own login: a profile whose `auth status` isn't +`oauth_type` `agent`, never another agent's). If it's in some, offer all of +them as the default. If it's in none, as a new agent is, ask the person to add +it in Basecamp to the projects they want, the way they'd add a person, and to +tell you when that's done. Either way, say it's a starting point: to add a +project later, they add the agent there and ask you to serve it, and until +then nothing there reaches it. Map names to ids yourself and keep ids out of +what you say. When a name matches more than one project, ask. **4. Confirm, then run setup.** Say back the agent, who may give it work, and each project by name. Then: From b28040aafaf7db5282aa40744320bf72a0cbca70 Mon Sep 17 00:00:00 2001 From: Rob Zolkos Date: Mon, 19 Oct 2026 16:13:15 -0400 Subject: [PATCH 3/6] Don't ask who may give a new agent work; ask only which projects First-time setup asked who may give the agent work, then asked the person to confirm everything before setup. Now it's the operator alone unless they said otherwise, the closing summary tells them so and that they can just ask to let others, and setup runs once they've named the projects. --- skills/basecamp-connect/SKILL.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/skills/basecamp-connect/SKILL.md b/skills/basecamp-connect/SKILL.md index 0273fb0ef..e0fc4e32b 100644 --- a/skills/basecamp-connect/SKILL.md +++ b/skills/basecamp-connect/SKILL.md @@ -472,8 +472,11 @@ pinned to its identity id, with for an existing profile), and pass the same `--expect-identity` to the first setup. -**2. Who may give it work.** Explain each in a plain sentence, without these -mode names, and default to the first: +**2. Who may give it work.** Don't ask. Unless the person already said +otherwise, it's only the operator (`operator`, the default). When you finish, +tell them only they can give it work, and that if they want it to respond to +other people too, they can just ask you. When they do, explain each choice in +a plain sentence, without these mode names: - **operator**: only the operator, which for a personal agent is its owner (you). - **allowlist**: the operator plus people you name. @@ -511,8 +514,8 @@ project later, they add the agent there and ask you to serve it, and until then nothing there reaches it. Map names to ids yourself and keep ids out of what you say. When a name matches more than one project, ask. -**4. Confirm, then run setup.** Say back the agent, who may give it work, and -each project by name. Then: +**4. Run setup** once they've named the projects, without asking them to +confirm again: ```bash basecamp connect setup -P '' --serve --serve --json From 156bb5ae356cb4945653827cdc266618b4326c1d Mon Sep 17 00:00:00 2001 From: Rob Zolkos Date: Mon, 19 Oct 2026 16:29:35 -0400 Subject: [PATCH 4/6] Starting the connector, say what it means for the person and leave its parts unnamed --- skills/basecamp-connect/SKILL.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/skills/basecamp-connect/SKILL.md b/skills/basecamp-connect/SKILL.md index e0fc4e32b..30f5f1a12 100644 --- a/skills/basecamp-connect/SKILL.md +++ b/skills/basecamp-connect/SKILL.md @@ -527,7 +527,10 @@ adding `--trust`, `--allow`, `--allow-assignments-from-authorized`, **5. Start the connector** right away (*Running the connector*), unless the person said not to. Connecting, setup and the watcher are one flow: don't stop -after setup to ask whether to start it. +after setup to ask whether to start it. Tell the person what it means for +them: their agent picks up work while this Claude Code session is open. The +connector, the watcher, the monitor and profiles are yours; leave their names +out of what you say, during setup too, and don't narrate reading this skill. ### Reading setup's result From f4cba3a13f7f54d0e700bfca070ccd0b837fedb5 Mon Sep 17 00:00:00 2001 From: Rob Zolkos Date: Mon, 19 Oct 2026 18:43:09 -0400 Subject: [PATCH 5/6] A personal agent is already in its owner's projects: serve them all and say so --- skills/basecamp-connect/SKILL.md | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/skills/basecamp-connect/SKILL.md b/skills/basecamp-connect/SKILL.md index 30f5f1a12..e01e1482d 100644 --- a/skills/basecamp-connect/SKILL.md +++ b/skills/basecamp-connect/SKILL.md @@ -506,16 +506,19 @@ it, and `--trust operator` clears it; setup refuses `--trust operator` with can serve only projects it's a member of. List its projects (`basecamp projects list -P '' --json`; if that's refused under an Agent identity, use the person's own login: a profile whose `auth status` isn't -`oauth_type` `agent`, never another agent's). If it's in some, offer all of -them as the default. If it's in none, as a new agent is, ask the person to add -it in Basecamp to the projects they want, the way they'd add a person, and to -tell you when that's done. Either way, say it's a starting point: to add a -project later, they add the agent there and ask you to serve it, and until -then nothing there reaches it. Map names to ids yourself and keep ids out of -what you say. When a name matches more than one project, ask. - -**4. Run setup** once they've named the projects, without asking them to -confirm again: +`oauth_type` `agent`, never another agent's). Unless the person named +projects, serve every one it's in, without asking. A personal agent is in all +of its owner's projects: Basecamp adds it when they approve, within a few +seconds, so if it shows none, list again after a moment. Tell the person it's +in their projects and picks up their requests in all of them, and that if +they'd rather it skip some, they can just say so. Any other agent is only in +the projects someone added it to; if it's in none, ask the person to add it in +Basecamp, the way they'd add a person, and to tell you when that's done. A +project it joins later isn't served until you add it, so tell them to ask you +then. Map names to ids yourself and keep ids out of what you say. When a name +they give matches more than one project, ask. + +**4. Run setup** with those projects, without asking them to confirm: ```bash basecamp connect setup -P '' --serve --serve --json From 36a232bb17cbde7f82426d3ff4acddda23ad1c81 Mon Sep 17 00:00:00 2001 From: Rob Zolkos Date: Mon, 19 Oct 2026 20:53:19 -0400 Subject: [PATCH 6/6] A chosen profile name taken by another agent, and the person's project list Claude picks a new agent's profile name itself now, so the name it picks can already hold another agent: it picks the next one (build-bot-2) instead of treating that agent as this one. And when the agent can't list its projects, the person's list stands in only for a personal agent, which follows its owner; for any other agent Claude asks which of them it's in. --- skills/basecamp-connect/SKILL.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/skills/basecamp-connect/SKILL.md b/skills/basecamp-connect/SKILL.md index e01e1482d..719dcf738 100644 --- a/skills/basecamp-connect/SKILL.md +++ b/skills/basecamp-connect/SKILL.md @@ -458,8 +458,11 @@ Check it: `basecamp auth status -P '' --json`. the person is on another device). Show them the link and code from its verification line. They open the link, check the code, choose the agent (or create one) and approve. -- `oauth_type` `agent`: already connected. Don't connect again: that rotates - the agent's secret and disconnects any other computer using it. +- `oauth_type` `agent`: an agent is already connected under it. If you chose + this name for a new agent, that's another agent's profile: pick another + name (`build-bot-2`, then `-3`) and check again. If the person named it, + don't connect again: that rotates the agent's secret and disconnects any + other computer using it. - Anything else: a person's login is stored. Never connect an agent over it: pick another name if you chose this one, and ask if they did. @@ -505,9 +508,11 @@ it, and `--trust operator` clears it; setup refuses `--trust operator` with **3. Projects, by name.** The agent hears only the projects it serves, and it can serve only projects it's a member of. List its projects (`basecamp projects list -P '' --json`; if that's refused under an -Agent identity, use the person's own login: a profile whose `auth status` isn't -`oauth_type` `agent`, never another agent's). Unless the person named -projects, serve every one it's in, without asking. A personal agent is in all +Agent identity, list the person's own projects with their login, a profile +whose `auth status` isn't `oauth_type` `agent`, never another agent's). Unless +the person named projects, serve every one it's in, without asking. The +person's own list is the agent's only for a personal agent, which follows its +owner; for any other agent, ask which of them it's in. A personal agent is in all of its owner's projects: Basecamp adds it when they approve, within a few seconds, so if it shows none, list again after a moment. Tell the person it's in their projects and picks up their requests in all of them, and that if