Replace Ed25519 with hashed API tokens and an in-Firefox client manager.

tools/client.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Call Firefox Agent Bridge with a registered Ed25519 client key."""
+"""Call Firefox Agent Bridge with a Bearer token from FAB_TOKEN or a file."""
 from __future__ import annotations
 
 import argparse
@@ -11,21 +11,21 @@ import urllib.request
 from pathlib import Path
 from typing import Any
 
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT))
-
-from fab_auth import load_key_bundle, sign_headers  # noqa: E402
-
 DEFAULT_BASE = os.environ.get("FAB_URL", "http://127.0.0.1:17634")
 
 
-def key_path() -> Path:
-    env = os.environ.get("FAB_KEY_FILE")
+def token_value(explicit: str | None = None) -> str:
+    if explicit:
+        return explicit.strip()
+    env = os.environ.get("FAB_TOKEN")
     if env:
-        return Path(env)
+        return env.strip()
+    path = os.environ.get("FAB_TOKEN_FILE")
+    if path:
+        return Path(path).expanduser().read_text(encoding="utf-8").strip()
     raise SystemExit(
-        "no client key: set FAB_KEY_FILE or pass --key "
-        "(python tools/register_client.py add --name NAME --write-key PATH)"
+        "no token: set FAB_TOKEN, or FAB_TOKEN_FILE, or pass --token. "
+        "Generate one from the add-on toolbar → Manage clients."
     )
 
 
@@ -33,20 +33,17 @@ def call(
     method: str,
     args: list[Any] | None = None,
     base: str = DEFAULT_BASE,
-    key_file: Path | None = None,
+    token: str | None = None,
 ) -> Any:
     payload = json.dumps({"method": method, "args": args or []}).encode("utf-8")
-    path = "/v1/call"
-    bundle = load_key_bundle(key_file or key_path())
-    headers = {
-        "Content-Type": "application/json",
-        **sign_headers(bundle, "POST", path, payload),
-    }
     req = urllib.request.Request(
-        base.rstrip("/") + path,
+        base.rstrip("/") + "/v1/call",
         data=payload,
         method="POST",
-        headers=headers,
+        headers={
+            "Authorization": f"Bearer {token_value(token)}",
+            "Content-Type": "application/json",
+        },
     )
     try:
         with urllib.request.urlopen(req, timeout=20) as resp:
@@ -69,12 +66,12 @@ def main() -> int:
     parser.add_argument("method", help="e.g. bookmarks.search or meta.methods")
     parser.add_argument("args_json", nargs="?", default="[]", help="JSON array of arguments")
     parser.add_argument("--url", default=DEFAULT_BASE)
-    parser.add_argument("--key", type=Path, help="client key bundle (or FAB_KEY_FILE)")
+    parser.add_argument("--token", help="override FAB_TOKEN")
     ns = parser.parse_args()
     args = json.loads(ns.args_json)
     if not isinstance(args, list):
         raise SystemExit("args_json must be a JSON array")
-    print(json.dumps(call(ns.method, args, base=ns.url, key_file=ns.key), indent=2))
+    print(json.dumps(call(ns.method, args, base=ns.url, token=ns.token), indent=2))
     return 0