Declare Firefox data-collection consent and stop assigning innerHTML in options.

extension/manifest.json

@@ -2,12 +2,15 @@
   "manifest_version": 3,
   "name": "Bookmarks API for Scripting and AI",
   "short_name": "Bookmarks API",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "An API add-on for Firefox to allow agentic and script-based management of user bookmarks.",
   "browser_specific_settings": {
     "gecko": {
       "id": "firefox-agent-bridge@easygoingaming.com",
-      "strict_min_version": "115.0"
+      "strict_min_version": "115.0",
+      "data_collection_permissions": {
+        "required": ["bookmarksInfo"]
+      }
     }
   },
   "permissions": ["bookmarks", "nativeMessaging", "storage"],

extension/options.js

@@ -31,30 +31,35 @@ function showError(text) {
 }
 
 function render(clients) {
+  rows.replaceChildren();
   if (!clients.length) {
-    rows.innerHTML = '<tr><td colspan="4" class="muted">No clients yet. Generate a secret to get started.</td></tr>';
+    const tr = document.createElement("tr");
+    const td = document.createElement("td");
+    td.colSpan = 4;
+    td.className = "muted";
+    td.textContent = "No clients yet. Generate a secret to get started.";
+    tr.appendChild(td);
+    rows.appendChild(tr);
     return;
   }
-  rows.innerHTML = "";
   for (const client of clients) {
     const tr = document.createElement("tr");
-    tr.innerHTML = `
-      <td>${escapeHtml(client.name)}</td>
-      <td>${escapeHtml(client.created || "")}</td>
-      <td>${escapeHtml(client.last_used || "never")}</td>
-      <td><button type="button" data-revoke="${escapeHtml(client.id)}">Revoke</button></td>`;
+    for (const text of [client.name, client.created || "", client.last_used || "never"]) {
+      const td = document.createElement("td");
+      td.textContent = text;
+      tr.appendChild(td);
+    }
+    const action = document.createElement("td");
+    const btn = document.createElement("button");
+    btn.type = "button";
+    btn.textContent = "Revoke";
+    btn.dataset.revoke = client.id;
+    action.appendChild(btn);
+    tr.appendChild(action);
     rows.appendChild(tr);
   }
 }
 
-function escapeHtml(value) {
-  return String(value)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
-}
-
 async function refresh() {
   render(await listClients());
   try {