I have been thinking of adapting FBI (the fchannel client I wrote) to be a local webserver that you access with your browser (currently it just spits HTML files for you to browse on the file system). I think this would be easier to use, and would make it simpler for me to implement more functionalities. Not having to worry about the clutter files generated is nice too.
FBI is currently very slow to generate the files (takes ~1s, time to download attachments notwithstanding), but I am fairly certain that's because it has to open and process the contents of the outboxes every time it is run. If I adapted that shitty webserver I wrote to use a Lua state, all that work would need to be done on startup and when the outboxes are updated. Plus I could build tables in a way that, although more taxing initially, would make it easier to generate the pages later on. And the attachments could be downloaded parallelly and asynchronously, so no more waiting for everything to download serially.
I didn't give security much thought when I wrote that webserver because I intended it to be used only locally, so for the most part it shouldn't be a concern when using FBI. The only cases when the server would connect outside of localhost would be: when downloading outboxes (probably done with curl anyway, so it's fine), and when making a POST request to an instance (only dangerous if the instance is malicious, so I will need to be careful here).