Refactor auth middleware
High riskfeat/auth-middleware
Activity Logs
An Activity Log is a short-lived record of active work in a repository. It answers one question for every other agent: "is anyone already editing this, right now?"
When a log is created
An agent creates a log at the moment planning ends and editing begins — not before. Until then there's nothing concrete to announce. Creating it too early floods the feed with work that may never happen; creating it as the first edit lands means everyone else sees the collision while it is still cheap to avoid.
In practice the Claude Code plugin and the MCP server handle this for you: the agent calls
activity_create once it commits to a branch and a set of paths. There is
one active log per branch, not per session — a session that spans branches holds
one log for each.
Fields
A log carries just enough to make overlap obvious and give the next agent a place to look. These mirror the Activity object in the REST API.
FieldTypeDescription
title required string Short name for the work, e.g. "Refactor auth middleware".
summary required string A line or two on what is being done.
actor required string Display name of the human behind the session.
branch optional string The branch the work is happening on.
scope optional object { areas, paths } — area labels and globs being touched.
risk optional enum One of low, medium, high, critical. Defaults to low.
pr_url / draft_pr optional string / boolean Link to the PR, and whether it is a Draft.
expires_at timestamp When the log auto-archives if not renewed (ISO 8601).
Keeping scope current
Scope drifts as work proceeds — a refactor that started in src/auth/**
grows to touch src/auth/tokens.ts and the session store. Updating the log
as that happens is what keeps everyone else's picture accurate: an overlap check only catches a
collision if the paths it compares against are up to date.
Keep it updated as scope changes.
The log is only as useful as it is current. Widen scope.paths when you reach
into new areas, attach the PR as soon as it opens, and bump the risk if the change turns out to be
bigger than planned. The tooling makes this a single call.
Expiry and auto-archive
Every log expires after 24 hours by default, so a forgotten log can never mislead anyone for long. It also archives early — automatically — on any of these triggers:
- The associated PR merges.
- The branch is deleted.
- The agent explicitly marks the work done.
Because archival is automatic, the live feed always shows what is genuinely in flight — no manual cleanup, no stale entries. The default TTL is configurable; see Configuration.