Say a connect adds a connection, and a refusal means disconnected (merge with bc3 step 6)

Closed
RO
1d ago
+60-31

Merge with bc3 step 6 ("Turn on adding connections"). Several lines here describe behaviour Basecamp doesn't have until that step ships; they're listed below.

Step 4, "CLI copy", of the plan in Follow-up: multiple connections per agent (card description, "Plan (final)"; adjusted in this comment). Copy only: no behaviour changes.

What changes

Once a personal agent can hold several connections, connecting on another computer no longer ends this one. The CLI's copy is updated to match:

  • Refusal. When Basecamp refuses the connection's secret, the connector (basecamp connect, and the line connect status keeps) and guided connect setup now say This computer's connection to <agent> was disconnected in Basecamp. They no longer say "or connected on another computer".
  • auth agent connect --help. Each approval adds a connection with its own secret, named after this computer. A personal agent's other connections keep working. A shared agent keeps one connection and replaces it. Connecting the same profile again leaves the old personal connection in Basecamp until it's disconnected. Disconnecting this connection leaves the others alone. --device-name now names the connection.
  • connect --help. Each auth agent connect adds a connection, so a personal agent can run a connector on several computers.
  • connect setup --help. The project list belongs to the profile. When two connections serve the same project, a request both admit there can be answered twice.
  • Lost handover. When the CLI fails to keep a secret it was handed, it now says to disconnect the new connection, not the agent. Once My > Agent offers both Disconnect… and Disconnect all, "disconnect the agent" would point people at the button that breaks every other computer.
  • README and basecamp-connect skill. "Every connection rotates the agent's secret" is gone. The skill's personal-vs-shared advice on reconnecting is updated, and so is the refusal text it matches. Its rule that only one connector per agent can run now says "on this computer", because the lock is local.

shared agent / personal agent are the words bc3 uses in Adminland and on agent profile cards.

False before bc3 step 6

Until step 6 ships, a second connect still replaces the first, for every agent. These lines are wrong or incomplete until then:

  • The refusal leaves out "connected on another computer", which is still a real cause today.
  • auth agent connect help: "A personal agent's other connections … keep working", and "the old one stays in Basecamp until you disconnect it there".
  • connect help: "a personal agent can run a connector on several computers at once".
  • README: the new paragraph under "Connecting an agent to this computer" (several connections, "leaves the others working", "rename it on My > Agent", which needs bc3 step 2).
  • basecamp-connect skill: the credentials.json bullet ("both keep working"), "adds another connection", and the full-access reconnect bullet.
  • --device-name "in Basecamp": the name appears in the connections list from bc3 step 2.

These are true both before and after: the lost-handover remedy (before step 6, the new connection is the only one), the connect setup overlap note (it can't happen before step 6), and "disconnecting this connection kills the secret this holds".

Left alone, on purpose

  • #851 (open) changes auth logout / auth revoke and the README's "rotate the client secret" line. This PR doesn't touch those lines, so the two don't conflict. Once both land with step 6, #851's "disconnect the agent in Basecamp" should probably read "disconnect this connection", for the same Disconnect-all reason as the handover remedy. That's a follow-up for whichever lands second.
  • Code comments. Comments that say connecting replaces the secret are left unedited: connect_setup_guided.go (the "Before anything is connected" comment), auth/agent.go (ErrAgentCredentialRefused), connect_run.go (connectorStoppedBy), agent_connect.go (adoptAgentGrantOrSayWhatWasLost), and the test comments in connect_run_disconnect_test.go, connect_setup_test.go and skill-evals/cases/basecamp-connect/unconfirmed-identity.yml. Each one still holds for shared agents.
  • Shared agents. The CLI can't tell a shared agent from a personal one, so the refusal says "disconnected in Basecamp" for both. A shared agent replaced by another computer's approval was disconnected by Basecamp, so the sentence still holds for it.

Tests

  • The copy tests now assert the new strings: connect_run_disconnect_test.go, connect_setup_guided_test.go, and the six lost-handover assertions in internal/auth/agent_connect_test.go.
  • I reverted the three production files and those tests failed: 4 in internal/commands, 6 in internal/auth. They pass with the change.
  • The repo keeps no golden help-output tests, so the help text has no test. TestHintCommandsResolve checks the new connect.go help, and make check-skill-drift checks the skill.
  • bin/ci is green locally.