move socket path into /tmp/.browser_cli subfolder with registry

browser_cli/native_host.py

@@ -20,7 +20,8 @@ import threading
 import uuid
 from pathlib import Path
 
-REGISTRY_PATH = Path("/tmp/browser-cli-registry.json")
+SOCKET_DIR = Path("/tmp/.browser_cli")
+REGISTRY_PATH = SOCKET_DIR / "registry.json"
 DEFAULT_ALIAS = "default"
 
 SOCKET_PATH: str = ""          # set after hello handshake
@@ -71,7 +72,7 @@ def _registry_remove(alias: str) -> None:
 
 def _socket_path_for(alias: str) -> str:
     safe = alias.replace(" ", "_").replace("/", "_")
-    return f"/tmp/browser-cli-{safe}.sock"
+    return str(SOCKET_DIR / f"{safe}.sock")
 
 
 # --- Thread A: read messages from extension (stdin) ---
@@ -202,6 +203,7 @@ def main():
                     PENDING[msg_id] = q
                 write_native_message(sys.stdout.buffer, first_msg)
 
+    SOCKET_DIR.mkdir(mode=0o700, exist_ok=True)
     sock_path = _socket_path_for(alias)
     _registry_add(alias, sock_path)