Skip to content

fix(qc): qc profile after a username rename (0.19.1, qc 0.14.1) - #352

Merged
sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
fix/qc-stale-username
Oct 29, 2026
Merged

sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
fix/qc-stale-username

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor

qc looked its own profile up by the username cached at login, so after a rename (mailcoder -> cha0spunk) qc profile and qc profile --openprofile said "User not found".

  • New GET /api/profile: the caller's own public profile (PUBLIC_PROFILE_COLUMNS), by bearer token. 401 without one.
  • qc profile() uses it, openProfile() uses the fresh username, and both reads and updates write the current username/display name back into the saved session, so qc whoami corrects itself too.
  • Tests: src/app/api/profile/route.test.js, tests/cli/qc.test.js. Full suite 913 passed.

🤖 Generated with Claude Code

qc looked its own profile up by the username cached in the session at
login, so after a rename (mailcoder -> cha0spunk) `qc profile` and
`qc profile --openprofile` said "User not found". New GET /api/profile
returns the caller's own public profile by token; qc reads it and writes
the current username/display name back into the saved session (also
after a profile update).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

17 finding(s)

MEDIUM: 13 | LOW: 4

Severity Rule Location
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:38
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:66
MEDIUM js-unescaped-html-sink src/app/faq/page.jsx:57
MEDIUM js-unescaped-html-sink src/app/layout.jsx:142
MEDIUM js-unescaped-html-sink src/app/layout.jsx:146
MEDIUM js-unescaped-html-sink src/app/page.jsx:50
MEDIUM js-open-redirect src/app/phone/page.jsx:70
MEDIUM redos-nested-quantifier src/lib/auth/dns-name.js:88
MEDIUM redos-nested-quantifier src/lib/chat/voice-mode.js:116
MEDIUM redos-nested-quantifier src/lib/chat/voice-mode.js:121
MEDIUM js-unescaped-html-sink src/lib/components/chat/MessageItem.jsx:85
MEDIUM js-unescaped-html-sink src/lib/components/chat/MessageItem.jsx:130
MEDIUM js-unescaped-html-sink src/lib/components/PitFooter.jsx:15
LOW secret-generic-credential src/app/api/auth/register-anon/route.test.js:32
LOW secret-jwt tests/debug-sms.js:10
LOW secret-generic-credential tests/private-key-import-export.test.js:252
LOW secret-generic-credential tests/private-key-import-export.test.js:264

Snippets are redacted; ThreatCrush never prints matched credential material.

@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit 8983050 into master Oct 29, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant