Present the repo as a scoped bookmarks API product and drop homelab-only notes.

host/firefox_agent_bridge_host.py

@@ -10,7 +10,6 @@ import sys
 import threading
 import uuid
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
 from typing import Any
 from urllib.parse import parse_qs, urlparse
 
@@ -24,7 +23,23 @@ HOST = "127.0.0.1"
 PORT = int(os.environ.get("FAB_PORT", "17634"))
 MAX_BODY = 256 * 1024
 ALLOWED_HOSTS = {f"127.0.0.1:{PORT}", f"localhost:{PORT}"}
-STATE_DIR = Path(os.environ.get("LOCALAPPDATA", str(Path.home()))) / "firefox-agent-bridge"
+ALLOWED_METHODS = frozenset(
+    {
+        "meta.ping",
+        "meta.methods",
+        "bookmarks.getTree",
+        "bookmarks.getSubTree",
+        "bookmarks.getChildren",
+        "bookmarks.get",
+        "bookmarks.search",
+        "bookmarks.create",
+        "bookmarks.update",
+        "bookmarks.move",
+        "bookmarks.remove",
+        "bookmarks.removeTree",
+        "bookmarks.getRecent",
+    }
+)
 STDIN_LOCK = threading.Lock()
 PENDING: dict[str, tuple[threading.Event, dict[str, Any]]] = {}
 PENDING_LOCK = threading.Lock()
@@ -82,6 +97,8 @@ def verify_token_with_extension(token: str, timeout: float = 8.0) -> dict[str, A
 
 
 def call_extension(method: str, args: list[Any] | None = None, timeout: float = 15.0) -> dict[str, Any]:
+    if method not in ALLOWED_METHODS:
+        raise RuntimeError(f"method not allowed: {method}")
     req_id = str(uuid.uuid4())
     event = threading.Event()
     slot: dict[str, Any] = {}
@@ -247,7 +264,6 @@ def stdin_loop() -> None:
 
 
 def main() -> int:
-    STATE_DIR.mkdir(parents=True, exist_ok=True)
     threading.Thread(target=stdin_loop, name="fab-stdin", daemon=True).start()
     server = ThreadingHTTPServer((HOST, PORT), Handler)
     log(f"listening on http://{HOST}:{PORT}")