Overview
Running Agents
3
JWT Auth Refactor
12m
Dark Mode Toggle
4m
Update Dependencies
queued
Total Tasks
127
Project Details
Git Status
Current branch:
main
Last commit: a3f82d1 — "Fix auth middleware token refresh" (2 hours ago)
Clean working tree
Issues
Open issues from github.com/acme/doc-updater. Pick an issue and assign an agent — it will create a session pre-loaded with the issue context and the right skills.
9 open issues
JWT token refresh fails silently when expiry window overlaps midnight
3
Add pagination support to /api/v2/documents endpoint
1
Refactor authentication middleware to support OAuth 2.0 PKCE flow
7
Memory leak in WebSocket connection pool after 200+ concurrent connections
12
Generate OpenAPI 3.1 spec from existing route handlers
2
Race condition in session cleanup when multiple requests arrive simultaneously
5
Improve response time for /search endpoint — add Redis caching layer
4
Write integration tests for the document ingestion pipeline
0
Migrate remaining endpoint handlers from Express callbacks to async/await
2
#142 · bug · security
JWT token refresh fails silently when expiry window overlaps midnight
bug
security
Issue summary
The
refreshToken() function uses a fixed midnight boundary check that causes silent failures when tokens expire between 23:58–00:02 UTC. Affects ~0.3% of daily active users. No error is logged or surfaced to the client.Recommended skills — matched from labels & issue content
security-review
Security label · token auth pattern
code-review
Bug fix · middleware change
write-tests
Edge case — regression risk
Choose agent
Workspace
doc-updater · main
Running · sbx-7f3a9c2e
Sandboxes
Persistent sandbox environments for this project. Each sandbox is configured once — filesystem scope, network policy, runtime — and you start multiple agent sessions inside it.
+ Add another workspace
·
e.g. a staging branch, a performance workspace, or a teammate's environment
Skills
Attached Skills
3 skillsCode Review
Hummingbird Containers
Kubernetes
MCP Servers
Attached MCP Servers
2 serversGitHub MCP
OpenShift MCP
Knowledge Bases
Attached Knowledge Bases
1 knowledge baseAPI Documentation
Secrets & Tokens
Project-scoped secrets. These credentials are only available to agents running within this project. They are stored encrypted and never exposed in logs or agent output.
GitHub
Repository access, pull requests, and issue tracking
Personal Access Token
ghp_••••••••••••••••
Organization
acme-corp
Instance URL
https://github.com
JIRA
Issue tracking, sprint management, and project boards
API Token
ATATT3x••••••••••
Email
john.doe@acme-corp.com
Instance URL
https://acme-corp.atlassian.net
Default Project Key
KBE
Slack
Notifications, status updates, and agent alerts
Bot Token
Not configured
Default Channel
Not configured
Filesystem
Project-scoped filesystem policy. Defines which paths agents can read and write inside the sandboxed environment. This limits the blast radius of mistakes by constraining filesystem access to only declared paths.
Access Mode
Choose the default behavior for filesystem operations inside agent sandboxes.
Strict Mode
Only explicitly declared paths are accessible. All unlisted paths are blocked. Recommended for production.
Permissive Mode
Agents can access most paths except explicitly blocked ones. Better for development environments.
Allowed Operations
Read declared paths
Write to read-write paths
Access /sandbox scratch space
Write to /tmp
Blocked Operations
Access unlisted paths
Traverse with .. (path traversal)
Write to read-only paths
Follow symlinks outside sandbox
Declared Paths
6 paths~/dev/kortex-backend
Project working directory
/sandbox
Agent scratch workspace
/tmp
Temporary files
/usr/local/go
Go toolchain
/usr/local/bin
System binaries (make, git, etc.)
~/.ssh
SSH keys — explicitly blocked
Workspace File Sync
Filesystem policy settings are synced to the agentdev-workspace.yaml file under agentConfig.permissions.filesystem.
agentdev-workspace.yaml
Synced
agentConfig:
permissions:
filesystem:
mode: strict
readWrite:
- "~/dev/kortex-backend"
- "/sandbox"
- "/tmp"
readOnly:
- "/usr/local/go"
- "/usr/local/bin"
blocked:
- "~/.ssh"
Network Policy
Mode
Current: Strict — only listed hosts
Allowed hosts
4 hostsapi.github.com
from GitHub credential
api.anthropic.com
from Anthropic credential
api.example.com
manual
Recent decisions
last 24 h
Policy updated 6 minutes ago
View history
AgentDev Workspace
The AgentDevWorkspace file defines the agentic developer workspace for this project. It describes the tools, environments, commands, and constraints that AI agents should use when working in this codebase — similar to a devfile, but tailored for autonomous agent workflows.
Dev Container Features
Add tooling, runtimes, and CLIs to the project's dev container. Features are pulled from containers.dev/features and injected at workspace build time.
Installed (3)
Node.js (via nvm)
ghcr.io/devcontainers/features/node:2
v20 LTS
version
npmVersion
GitHub CLI
ghcr.io/devcontainers/features/github-cli:1
latest
Docker-in-Docker
ghcr.io/devcontainers/features/docker-in-docker:3
latest
Add from catalog
Node.js
Node.js via nvm — specify version
✓ Installed
Python
Python via pyenv with pip, venv
+ Add
Go
Go programming language toolchain
+ Add
Rust
Rust via rustup with cargo
+ Add
GitHub CLI
gh CLI for GitHub operations
✓ Installed
Terraform
Terraform CLI for IaC workflows
+ Add
kubectl, Helm & Minikube
Kubernetes tooling bundle
+ Add
Docker-in-Docker
Full Docker daemon inside container
✓ Installed
AWS CLI
AWS command-line interface
+ Add
Claude Code
Anthropic Claude Code CLI agent
+ Add
Git LFS
Large File Storage for Git repos
+ Add
.devcontainer/devcontainer.json — features excerpt
{
"features": {
"ghcr.io/devcontainers/features/node:2": {
"version": "20",
"npmVersion": "latest"
},
"ghcr.io/devcontainers/features/github-cli:1": {},
"ghcr.io/devcontainers/features/docker-in-docker:3": {}
}
}
Agent History
Today
Cl
Refactor authentication module to use JWT tokens
Cl
Add integration tests for user endpoints
Cu
Create database migration for user preferences table
Yesterday
Cl
Optimize Dockerfile for production with multi-stage build
OC
Implement rate limiting middleware
Last 7 days
Cl
Generate OpenAPI spec from route handlers
Cu
Set up structured logging with correlation IDs
Cl
Create Kubernetes deployment manifests
Refactor authentication module to use JWT tokens
Cl
Claude Code
6 files changed
14 tool calls
3 commands
Changed Files (6)
auth/jwt.go
+145
auth/handler.go
+32
-18
auth/middleware.go
+67
-4
config/config.go
+8
auth/jwt_test.go
+89
go.mod
+2
User
00:00
Refactor the authentication module to use JWT tokens instead of session cookies. Add token generation, validation, and refresh logic. Make sure to update the middleware and add tests.
Read File
00:04
auth/handler.go
Read File
00:06
auth/middleware.go
Grep
00:08
Pattern: "SetCookie\|session\.Save" — 4 matches across 3 files
Agent
00:12
I'll create a new JWT package with token generation, validation, and refresh capabilities. The current session-based auth in
handler.go uses gorilla/sessions — I'll replace this with golang-jwt/jwt/v5. Let me start by creating the core JWT module.
File changes begin
Write File
00:18
auth/jwt.go
+145 lines
New file created
Edit File
00:34
auth/handler.go
+32 lines
-18 lines
Edit File
01:02
auth/middleware.go
+67 lines
-4 lines
Edit File
01:18
config/config.go
+8 lines
Run Command
01:22
go get github.com/golang-jwt/jwt/v5
Agent
01:30
Core JWT module is ready. Now I'll add the test suite with table-driven tests covering token generation, validation, expiry, and refresh flows.
Test suite
Write File
02:45
auth/jwt_test.go
+89 lines
New file created
Run Command
03:02
go test ./auth/... -v → PASS (12 tests, 0 failures)
Run Command
03:18
go mod tidy
Agent
03:24
Done! I've completed the JWT authentication refactor:
New files:
Modified:
Dependencies: Added
All 12 tests pass. The middleware now validates JWT from the Authorization header and injects claims into the request context.
New files:
auth/jwt.go (token generation, validation, refresh), auth/jwt_test.go (12 table-driven tests)Modified:
auth/handler.go (replaced session logic with JWT), auth/middleware.go (JWT extraction from Bearer header), config/config.go (added JWT config fields)Dependencies: Added
github.com/golang-jwt/jwt/v5All 12 tests pass. The middleware now validates JWT from the Authorization header and injects claims into the request context.
01:18 / 03:24