Davoguha/bookmarks-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Present the repo as a scoped bookmarks API product and drop homelab-only notes.

Browse Source
This commit is contained in:
alexveley
2026-09-22 08:10:02 -04:00
parent c19e619b2f
commit cfda629418
10 changed files with 123 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+8 -8
View File
@@ -12,15 +12,15 @@ Do not edit `places.sqlite` while Firefox is open if this API is reachable.
2. Native host installed only if scripts should call in: `powershell -NoProfile -File tools/install-native-host.ps1`
3. Firefox **running** for those calls
If `http://127.0.0.1:17634/health` fails, the host is not up. If `/health` works but calls 401, you do not have a current `FAB_TOKEN`.
If `http://127.0.0.1:17634/health` fails, the host is not up. If `/health` works but calls 401, you do not have a current token.
## Auth
This is a normal API token, not an SSH key.
1. In Firefox, open the Bookmarks API toolbar icon → **Manage clients**.
2. Name the client (e.g. `cursor-agent`) and click **Generate secret**.
3. Copy the `fab_…` value **once**. Store it however you already store secrets: env var, Vaultwarden, `.env`, CI secret, Cursor env.
2. Name the client and click **Generate secret**.
3. Copy the `fab_…` value **once**. Store it with your other secrets (environment variable, password manager, `.env`, or CI secret).
4. Give tooling only that string:
```text
@@ -41,7 +41,7 @@ python tools/client.py METHOD [ARGS_JSON]
`ARGS_JSON` is a JSON **array** matching the WebExtension function arguments.
```text
python tools/client.py bookmarks.search "[{\"title\":\"10.132.x.x\"}]"
python tools/client.py bookmarks.search "[{\"title\":\"Research\"}]"
```
HTTP:
@@ -51,10 +51,10 @@ POST /v1/call
Authorization: Bearer fab_…
Content-Type: application/json
{"method": "bookmarks.search", "args": [{"title": "10.132.x.x"}]}
{"method": "bookmarks.search", "args": [{"title": "Research"}]}
```
## Allowlisted methods (v0.2)
## Allowlisted methods
| Method | Args | Notes |
|--------|------|--------|
@@ -72,7 +72,7 @@ Content-Type: application/json
| `bookmarks.removeTree` | `id` | Folder and descendants |
| `bookmarks.getRecent` | `numberOfItems` | |
Do not invent other `browser.*` names. Adding an API means editing `ALLOWED` in `extension/background.js` and reloading the extension.
Do not invent other `browser.*` names. Adding an API means editing `ALLOWED` in `extension/background.js` **and** `ALLOWED_METHODS` in `host/firefox_agent_bridge_host.py`, then reloading the extension.
REST aliases use the same Bearer token. `GET /health` has no token (loopback liveness only).
@@ -92,7 +92,7 @@ REST aliases use the same Bearer token. `GET /health` has no token (loopback liv
| Connection refused on `:17634` | Firefox closed or add-on/host missing | Open Firefox; load add-on; install native host |
| 401 `Bearer token required` | Unsigned request | Set `FAB_TOKEN` |
| 401 `unknown token` | Revoked, typo, or never generated | Manage clients → generate again |
| 502 `method not allowed` | Typo or API not in `ALLOWED` | `meta.methods` |
| 502 `method not allowed` | Typo or API not in the allowlist | `meta.methods` |
| Temporary add-on gone after restart | Unsigned on Firefox Release | Load again, or sign via AMO |
## Security boundaries