Skip to content

fix(api): reserve user feedback author - #254

Merged
benvinegar merged 1 commit into
mainfrom
fix/feedback-author
Aug 16, 2026
Merged

fix(api): reserve user feedback author#254
benvinegar merged 1 commit into
mainfrom
fix/feedback-author

Conversation

@benvinegar

Copy link
Copy Markdown
Member

Closes #145.

  • Derive programmatic comment authors from the post session agent.
  • Reserve user for same-origin viewer comments; remove agent-selected author inputs from CLI, MCP, and the Pi extension.
  • Cover forged REST input, both stores, CLI/MCP/Pi flows, and worker behavior.

Validation: npm test, npm run typecheck, npm run lint, npm run format:check, and npm run test:worker passed. Chromium e2e passed; local WebKit could not launch because required system libraries are missing.

This PR description was generated by Pi using openai-codex/gpt-5.6-terra

@benvinegar
benvinegar merged commit b0f6a94 into main Aug 16, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feedback-label forgery: REST POST /api/comments does not enforce reserved author: "user"

1 participant