Keep client secrets in add-on storage; host only verifies and serves the local API.

extension/options.js

@@ -15,15 +15,6 @@ function showError(text) {
   errorEl.textContent = text || "";
 }
 
-function admin(method, args) {
-  return browser.runtime.sendMessage({ type: "admin", method, args }).then((resp) => {
-    if (!resp || !resp.ok) {
-      throw new Error((resp && resp.error) || "host error");
-    }
-    return resp.result;
-  });
-}
-
 function render(clients) {
   if (!clients.length) {
     rows.innerHTML = '<tr><td colspan="4" class="muted">No clients yet. Generate a secret to get started.</td></tr>';
@@ -50,21 +41,21 @@ function escapeHtml(value) {
 }
 
 async function refresh() {
-  const info = await browser.runtime.sendMessage({ type: "status" });
-  statusEl.textContent = info && info.hostUp
-    ? `Native host connected · http://127.0.0.1:${info.port}`
-    : "Native host is not connected. Install the host, then reload this add-on.";
-  if (!info || !info.hostUp) {
-    rows.innerHTML = '<tr><td colspan="4" class="muted">Host offline.</td></tr>';
-    return;
+  render(await listClients());
+  try {
+    const info = await browser.runtime.sendMessage({ type: "status" });
+    statusEl.textContent = info && info.hostUp
+      ? "Local script access is on. Agents can call in while this browser is open."
+      : "Secrets work here. Install the native host if you want scripts and agents to call in.";
+  } catch (err) {
+    statusEl.textContent = "Secrets work here. Local script access status is unavailable.";
   }
-  render(await admin("clients.list"));
 }
 
 createBtn.addEventListener("click", async () => {
   showError("");
   try {
-    const created = await admin("clients.create", [nameInput.value.trim()]);
+    const created = await createClient(nameInput.value.trim());
     nameInput.value = "";
     secretEl.value = created.token;
     modal.showModal();
@@ -81,7 +72,7 @@ rows.addEventListener("click", async (event) => {
   }
   showError("");
   try {
-    await admin("clients.revoke", [id]);
+    await revokeClient(id);
     await refresh();
   } catch (err) {
     showError(err.message);