**Bead** `ff5ae03e-0087-4d71-b60a-bf1c7b5449c3` · [canonical URI](https://redfish.acequia.io/guerin/.agents/ff5ae03e-0087-4d71-b60a-bf1c7b5449c3/) · discussion: Talk: CORS Proxy This page is the wiki facet of a [bead](https://redfish.acequia.io/guerin/.agents/); the bead is the source of truth.
## Identity - **URI:** `https://redfish.acequia.io/guerin/.agents/ff5ae03e-0087-4d71-b60a-bf1c7b5449c3/` - **GUID:** `ff5ae03e-0087-4d71-b60a-bf1c7b5449c3` · **Slug:** `cors-proxy` · **Created:** 2026-06-17 - **Animated by:** Claude Code (CE), invoked by Stephen.
## Motivation (Why a GUID) The web-edit bookmarklet (`e0cca7db`) runs an AI editor **in arbitrary pages**, so its cognition calls are cross-origin and the model key must never touch the page. A small **CORS relay** (adds CORS + forwards to the provider with a server/extension-held key) solves both — and must be deployable wherever the host allows: **node.js**, a **chrome-extension**, or a **PHP script on a HostGo-like host**.
## Mechanism (What this bead does) One contract (`POST {section,instruction,model?} -> {suggestion}`, CORS, OPTIONS preflight), three interchangeable implementations. Read first: [`2026-06-17/notes/00-cors-proxy-spec.md`](https://redfish.acequia.io/guerin/.agents/ff5ae03e-0087-4d71-b60a-bf1c7b5449c3/2026-06-17/notes/00-cors-proxy-spec.md).
## Folder Layout ``` ff5ae03e-…/ ├── about.md README.md bead-bind-startup.md .gitignore ├── php/cognition.php # HostGo/PHP relay (deployed at redfish.com/web-edit/cognition.php) ├── node/cors-proxy.mjs # standalone Node relay ├── chrome-extension/ # manifest + background + bridge + options (no-server, per-user key) ├── uploads/ # dock └── 2026-06-17/{notes,chats}/ ```
## Session Log - **2026-06-17** — Opened (CE, for Stephen). Wrote the spec + all three runtimes. Deployed the PHP relay publicly to `redfish.com/web-edit/cognition.php` (key in the Apache-denied `.ht-cognition-key`, NOT committed) and repointed the web-edit bookmarklet's default cognition at it. `git init` for the bead.
## Capabilities / Lifecycle / Limitations - Provides a portable cognition CORS relay (Gemini); save-relay is a natural extension (same shape). - **Open-relay risk:** v0 reflects any Origin → hardening (token / rate-limit / allowlist) needed before truly public; the chrome-extension runtime avoids it (per-user key). Keys never in the commons. - Apoptosis: folds into a hardened relay service or the Liaison node when those mature.
**Related:** [`e0cca7db`](https://redfish.acequia.io/guerin/.agents/e0cca7db-ed8c-43a5-a027-b406d985e402/about.md) (web-edit editor — the consumer) · [`82bd6fa4`](https://redfish.acequia.io/guerin/.agents/82bd6fa4-4d5a-435b-9deb-ca930a82aa89/about.md) (Liaison — sibling BYOK pattern) · [EULA-compliance](https://redfish.acequia.io/skills/EULA-compliance.md) · [`.agents/beads.md`](https://redfish.acequia.io/guerin/.agents/beads.md).
## References (bead cross-links) - Bead: E0cca7db · [canonical](https://redfish.acequia.io/guerin/.agents/e0cca7db-ed8c-43a5-a027-b406d985e402/) - Bead: Stephenguerin.live Router Bead · [canonical](https://redfish.acequia.io/guerin/.agents/82bd6fa4-4d5a-435b-9deb-ca930a82aa89/)
See all: Beads