Module bookmarks_store 

Browser-pane bookmarks — a flat list of saved URLs, deliberately stored under shared_dir (~/.agentmux/shared/browser-bookmarks.json) rather than settings.json. settings.json isolation is whole-file only (see docs/specs/SPEC_SETTINGS_ISOLATED_BY_CHANNEL_2026_08_19.md §6 — per-key tiering was considered and rejected there), so a key inside it can’t stay global while the rest of the file is channel-isolated. shared_dir is this codebase’s existing mechanism for data that must always be global regardless of channel/isolation flags — the same directory already backs the agent registry, transcripts, and provider_auth_dir(). See docs/specs/SPEC_BROWSER_PANE_BOOKMARKS_AND_GO_ICON_2026_08_22.md.

Structs

BrowserBookmark

One saved bookmark. favicon_url and created_at are best-effort — absent on any record written before a field was added, so both default on deserialize rather than failing the whole list over one old entry.

Constants

BOOKMARKS_FILE_NAME 🔒

Functions

bookmarks_file_path

Resolves the shared, cross-channel bookmarks file path. Returns None when DataPaths can’t resolve (CI / unusual env) — mirrors providers_handlers.rs’s own DataPaths::from_env() best-effort fallback, so callers stay best-effort too rather than erroring the whole nav bar over an environment that never has this info anyway.

read_bookmarks

Read the bookmarks list. A missing file is “no bookmarks yet”, not an error — every fresh install/environment starts here. A present-but- unparseable file IS an error: silently resetting to an empty list would look exactly like the user’s saved bookmarks vanished, so this fails loud instead (matches this codebase’s general preference for warning over silent data loss, e.g. the ABF import path’s warning-budget conventions).

write_bookmarks

Write the whole bookmarks list, replacing whatever was there before — the same wholesale-replace shape as widget:pinned’s SetConfigCommand convention, just pointed at this dedicated file instead of settings.json. Writes to a per-call unique temp file then renames over the real path, so a crash or concurrent write never leaves a half-written, corrupt browser-bookmarks.json behind (mirrors the tmp-then-rename pattern used for native-memory file writes in bundle_import_for_agent_impl). Two windows writing at the same instant still race at the whole-file level — last write wins, no merge — an accepted limitation, not something this function tries to solve.