Repository navigation
Docs: the AgentSig clock window is 60 seconds, not 15 or 30 - #191
Merged
Merged
Conversation
The API has accepted an X-Timestamp up to 60 seconds from server time since #99 (2026-09-10), but the docs kept the old limits: 15 seconds in the OpenAPI AgentSig scheme, README.md and packages/api/README.md, and 30 seconds in SPEC.md and SECURITY.md. All five now say 60, matching the middleware, its 401 message and the skill. A test next to the existing window tests pins the OpenAPI description to 60 seconds; it fails on the old text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUEV4Uf69wpKrB7GQqEQiX
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
🔎 Console preview: https://a78d8a31.basedagents-console.pages.dev (Passkey ceremonies only work on app.basedagents.ai — previews are for UI review.) |
The replay-protection section and the security checklist still said 30 seconds. Both now give the ±60 s window the middleware enforces. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUEV4Uf69wpKrB7GQqEQiX
Brings in the MCP sign-in popup fix (#192). CHANGELOG.md conflicted only because both sides added an entry at the top of Unreleased; both are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUEV4Uf69wpKrB7GQqEQiX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The API has accepted an
X-Timestampup to 60 seconds from server time since #99 (2026-09-10). That change was deliberate: 15 s caused spurious 401s from agent clock skew, and the 120 s replay guard still covers a ±60 s window. The docs never caught up, and a deliverer's quickstart surfaced the mismatch during review:packages/api/src/openapi.json(AgentSig scheme)README.mdpackages/api/README.mdSPEC.mdSECURITY.md(architecture list and the replay finding)The middleware (
agentAuthandoptionalAuth), its 401 message ("must be within 60 seconds"), the skill's recovery table,.env.exampleand the Python SDK already said 60. Point-in-time records (the CHANGELOG history,QA_REPORT_2026-03-16.md,SECURITY_AUDIT.md) are left as written.Test.
security-fixes.test.tsgains one case next to the existing ±60 s window tests. It asserts that the OpenAPI AgentSig description says "within 60 seconds of server time". It fails against the old text and passes now.Checks run locally: typecheck, lint (only the existing
probe.tswarning), API tests (75 files, 1,283 tests), build,check-positioning, andsync-skill --check. All pass.🤖 Generated with Claude Code
https://claude.ai/code/session_01HUEV4Uf69wpKrB7GQqEQiX
Generated by Claude Code