Document who can call the loopback API and let the user pick the listen port.

extension/options.js

@@ -5,11 +5,26 @@ const nameInput = document.getElementById("name");
 const createBtn = document.getElementById("create");
 const errorEl = document.getElementById("error");
 const statusEl = document.getElementById("status");
+const portInput = document.getElementById("port");
+const savePortBtn = document.getElementById("save-port");
 const modal = document.getElementById("secret-modal");
 const secretEl = document.getElementById("secret");
 const copyBtn = document.getElementById("copy");
 const closeBtn = document.getElementById("close");
 
+function applyStatus(info) {
+  if (info && info.listenPort) {
+    portInput.value = String(info.listenPort);
+  }
+  if (info && info.bindError) {
+    statusEl.textContent = `Could not listen on ${info.listenPort}: ${info.bindError}`;
+    return;
+  }
+  statusEl.textContent = info && info.hostUp
+    ? `This add-on is ready on 127.0.0.1:${info.listenPort} while Firefox is open.`
+    : "You can issue and revoke secrets here anytime.";
+}
+
 function showError(text) {
   errorEl.hidden = !text;
   errorEl.textContent = text || "";
@@ -43,15 +58,21 @@ function escapeHtml(value) {
 async function refresh() {
   render(await listClients());
   try {
-    const info = await browser.runtime.sendMessage({ type: "status" });
-    statusEl.textContent = info && info.hostUp
-      ? "This add-on is ready for agents and scripts while Firefox is open."
-      : "You can issue and revoke secrets here anytime.";
+    applyStatus(await browser.runtime.sendMessage({ type: "status" }));
   } catch (err) {
     statusEl.textContent = "You can issue and revoke secrets here anytime.";
   }
 }
 
+savePortBtn.addEventListener("click", async () => {
+  showError("");
+  try {
+    applyStatus(await browser.runtime.sendMessage({ type: "set-port", port: portInput.value }));
+  } catch (err) {
+    showError(err.message);
+  }
+});
+
 createBtn.addEventListener("click", async () => {
   showError("");
   try {