Skip to content

Instantly share code, notes, and snippets.

View monperrus's full-sized avatar

Martin Monperrus monperrus

View GitHub Profile
@monperrus
monperrus / claude-weekly-reset.md
Last active June 20, 2026 05:56
Claude Code: the 'weekly' usage limit resets every 72 hours, not 7 days

Claude Max: The "Weekly" Limit Resets Every 72 Hours, Not 7 Days

Background

Claude Pro/Max plans expose a usage API at https://claude.ai/api/oauth/usage that returns two utilization counters:

  • five_hour.utilization — a rolling 5-hour window (well documented)
  • seven_day.utilization — described as a "weekly" cap

The seven_day object also contains a resets_at field. Monitoring this field over ~11 days (June 9–20, 2026) revealed that the "weekly" limit does not reset every 7 days — it resets every 72 hours.

@monperrus
monperrus / post-ai-agent-recoverable-failures.md
Last active June 20, 2026 13:09
Recoverable failures for AI coding agents

Recoverable failures for AI coding agents

AI coding agents are useful precisely because they can run tools, edit many files, execute tests, install dependencies, and iterate quickly. That same ability makes them risky in YOLO mode: a mistaken command, broad glob, broken script, or overconfident refactor can damage a working tree faster than a human can react.

The goal is not to make agents harmless. The goal is to make common failures recoverable.

@monperrus
monperrus / gist-safe-rm.md
Last active June 19, 2026 12:33
Recoverable failures for AI coding agents

Safe rm defaults for agent-heavy Linux machines

Ordinary file deletion should moves files and directories to the trash instead of permanently unlinking them.

That matters a lot when using coding agents, especially in YOLO mode. Agents can run broad shell commands quickly, expand globs, execute cleanup scripts, or apply generated commands with more confidence than the situation deserves. A trash-backed rm does not make destructive work impossible, but it turns many accidental deletions from irreversible data loss into a recoverable operation.

@monperrus
monperrus / cors.md
Created June 9, 2026 18:43
CORS Preflight (HTTP OPTIONS) Support for Agent Endpoints

CORS Preflight (HTTP OPTIONS) Support for Agent Endpoints

This document describes CORS (Cross-Origin Resource Sharing) preflight support for all LLM API endpoints used by the agent specs in this project.

What is CORS?

CORS is a browser security mechanism that restricts cross-origin HTTP requests. Before making an actual request, browsers send a preflight OPTIONS request to check if the server allows the cross-origin request. The server must respond with appropriate Access-Control-Allow-* headers for the browser to proceed.

Why CORS Matters for LLM Endpoints

@monperrus
monperrus / README.md
Created May 25, 2026 06:43
Securing the Linux Secret Service API against Enumeration Attacks

Securing the Linux Secret Service API against Enumeration Attacks

Background

The Secret Service API is a D-Bus interface (org.freedesktop.secrets) implemented by GNOME Keyring. Applications use it to store and retrieve credentials. Once your desktop session is unlocked (at login), any process running as your user can talk to this interface without further authentication.

Threat model

@monperrus
monperrus / endorsement.md
Last active May 19, 2026 04:15
Arxiv endorsement notice May 2026

Do you endorse XXXXX?

The person listed below wishes to submit work to the cs.SE (Software Engineering) subject category of arXiv. To do this, they must be endorsed by an existing arXiv user with sufficient publication history on arXiv. You are such a person.

Endorsement request from:

What does my endorsement do?

Your endorsement will enable to upload articles to cs.SE. We ask that you verify that they are a competent member of the scientific community and will submit legitimate research work that is relevant to cs.SE. Considerations

@monperrus
monperrus / doc.md
Created May 8, 2026 07:15
Flatpak Evolution in full dark mode

Flatpak Evolution in full dark mode

There are three actions to get Flatpak Evolution in full dark mode.

1. UI

flatpak override --user --env=GTK_THEME=Adwaita:dark org.gnome.Evolution
@monperrus
monperrus / doc.md
Last active May 8, 2026 07:28
Copilot remote sessions endpoint

Copilot remote sessions endpoint

The copilot --resume Remote tab calls a live Copilot API, not the local session store.

Endpoint

GET https://api.individual.githubcopilot.com/agents/sessions?limit=20&integration_id=copilot-developer-cli
@monperrus
monperrus / post.md
Created May 5, 2026 20:30
Claude.ai GitHub MCP Connector with Write Access

Claude.ai GitHub MCP Connector with Write Access

Problem

The built-in GitHub MCP connector in Claude.ai is read-only. It can read files and repositories (including private ones), but cannot perform any write operations such as:

  • Creating branches
  • Pushing or editing files
  • Creating pull requests
@monperrus
monperrus / codex-openrouter-gist.md
Last active April 18, 2026 18:16
Running Codex on top of OpenRouter

Running Codex on top of OpenRouter

Codex CLI supports custom model providers, so you can point it at OpenRouter instead of the default OpenAI endpoint.

Wrapper script

#!/bin/bash
set -euo pipefail