Martin Monperrus monperrus

CORS Preflight (HTTP OPTIONS) Support for Agent Endpoints

This document describes CORS (Cross-Origin Resource Sharing) preflight support for all LLM API endpoints used by the agent specs in this project.

What is CORS?

CORS is a browser security mechanism that restricts cross-origin HTTP requests. Before making an actual request, browsers send a preflight OPTIONS request to check if the server allows the cross-origin request. The server must respond with appropriate Access-Control-Allow-* headers for the browser to proceed.

Why CORS Matters for LLM Endpoints

Securing the Linux Secret Service API against Enumeration Attacks

Background

The Secret Service API is a D-Bus interface (org.freedesktop.secrets) implemented by GNOME Keyring. Applications use it to store and retrieve credentials. Once your desktop session is unlocked (at login), any process running as your user can talk to this interface without further authentication.

Threat model

Do you endorse XXXXX?

The person listed below wishes to submit work to the cs.SE (Software Engineering) subject category of arXiv. To do this, they must be endorsed by an existing arXiv user with sufficient publication history on arXiv. You are such a person.

Endorsement request from:

What does my endorsement do?

Your endorsement will enable to upload articles to cs.SE. We ask that you verify that they are a competent member of the scientific community and will submit legitimate research work that is relevant to cs.SE. Considerations

Flatpak Evolution in full dark mode

There are three actions to get Flatpak Evolution in full dark mode.

1. UI

flatpak override --user --env=GTK_THEME=Adwaita:dark org.gnome.Evolution

Copilot remote sessions endpoint

The copilot --resume Remote tab calls a live Copilot API, not the local session store.

Endpoint

GET https://api.individual.githubcopilot.com/agents/sessions?limit=20&integration_id=copilot-developer-cli

Claude.ai GitHub MCP Connector with Write Access

Problem

The built-in GitHub MCP connector in Claude.ai is read-only. It can read files and repositories (including private ones), but cannot perform any write operations such as:

Creating branches
Pushing or editing files
Creating pull requests

Running Codex on top of OpenRouter

Codex CLI supports custom model providers, so you can point it at OpenRouter instead of the default OpenAI endpoint.

Wrapper script

#!/bin/bash
set -euo pipefail

From the network configuration:

Allowed domains only:

api.anthropic.com
archive.ubuntu.com
crates.io
files.pythonhosted.org
github.com
index.crates.io
npmjs.com / npmjs.org / www.npmjs.com / www.npmjs.org

	## Result: Proportion of Anonymous Edits on English Wikipedia — March 2026

	Using the [Wikimedia Analytics REST API](https://wikimedia.org/api/rest_v1/), edit counts for the last complete month (March 2026):

	\| Metric \| Count \|
	\|---\|---\|
	\| Total edits \| 5,389,374 \|
	\| Anonymous edits \| 454,619 \|
	\| Proportion anonymous \| 8.44% \|

	#! /usr/bin/env python3
	"""Enable GitHub sponsorships for all repositories in an organization.

	This script:
	- Reads a GitHub personal access token from the local keyring
	- Lists all repositories in the configured organization
	- Skips archived repositories
	- Enables the sponsorship button on each remaining repository via the GitHub API

	Requirements: