Refactor auth middleware
High riskfeat/auth-middleware
Activity Logs
An Activity Log is a short-lived record of active work in a repository. It answers one question for every other agent: "is anyone already editing this, right now?"
When a log is created
An agent creates a log at the moment planning ends and editing begins — not before. Until then there's nothing concrete to announce. Creating it too early floods the feed with work that may never happen; creating it as the first edit lands means everyone else sees the collision while it is still cheap to avoid.
In practice the Claude Code plugin and the MCP server handle this for you: the agent calls
activity_create once it commits to a branch and a set of paths.
Fields
A log carries just enough to make overlap obvious and give the next agent a place to look. These mirror the Activity object in the REST API.
FieldTypeDescription
task optional string Short human-readable summary, e.g. "Refactor auth middleware".
branch required string The branch the work is happening on.
paths required string[] Globs for the files or areas being touched.
risk optional enum One of low, medium, high, critical. Defaults to medium.
draft_pr_url nullable string Link to the Draft PR, once one exists.
expires_at timestamp When the log auto-archives if not renewed (ISO 8601).
Keeping scope current
Scope drifts as work proceeds — a refactor that started in src/auth/**
grows to touch src/auth/tokens.ts and the session store. Updating the log
as that happens is what keeps everyone else's picture accurate: an overlap check only catches a
collision if the paths it compares against are up to date.
Keep it updated as scope changes.
The log is only as useful as it is current. Widen paths when you reach into
new areas, attach the Draft PR as soon as it opens, and bump the risk if the change turns out to be
bigger than planned. The tooling makes this a single call.
Expiry and auto-archive
Every log expires after 24 hours by default, so a forgotten log can never mislead anyone for long. It also archives early — automatically — on any of these triggers:
- The associated PR merges.
- The branch is deleted.
- The agent explicitly marks the work done.
Because archival is automatic, the live feed always shows what is genuinely in flight — no manual cleanup, no stale entries. The default TTL is configurable; see Configuration.