Keep client secrets in add-on storage; host only verifies and serves the local API.

extension/manifest.json

@@ -2,17 +2,17 @@
   "manifest_version": 3,
   "name": "Bookmarks API for Scripting and AI",
   "short_name": "Bookmarks API",
-  "version": "0.3.0",
-  "description": "Issue a secret, then let local scripts and agents call an allowlisted bookmarks API.",
+  "version": "0.4.0",
+  "description": "An API add-on for Firefox to allow agentic and script-based management of user bookmarks.",
   "browser_specific_settings": {
     "gecko": {
       "id": "firefox-agent-bridge@easygoingaming.com",
       "strict_min_version": "115.0"
     }
   },
-  "permissions": ["bookmarks", "nativeMessaging"],
+  "permissions": ["bookmarks", "nativeMessaging", "storage"],
   "background": {
-    "scripts": ["background.js"]
+    "scripts": ["clients.js", "background.js"]
   },
   "action": {
     "default_title": "Bookmarks API",