fix(electron): drop $HOME default from media roots

docs/docs/production.md

@@ -70,7 +70,7 @@ Useful overrides:
 - `FRAMESCRIPT_BACKEND_URL`, default `http://127.0.0.1:3000`
 - `FRAMESCRIPT_BACKEND_ADDR`, default `127.0.0.1:3000`
 - `FRAMESCRIPT_ALLOWED_ORIGINS`, comma-separated
-- `FRAMESCRIPT_MEDIA_ROOTS`, path-delimited allowed file roots
+- `FRAMESCRIPT_MEDIA_ROOTS`, path-delimited allowed file roots. When unset, FrameScript defaults to the project working directory plus any of `~/Videos`, `~/Movies`, `~/Music`, `~/Pictures`, `~/Documents` that exist — the full `$HOME` is **not** included by default. Pass an explicit value to broaden or narrow the scope.
 - `FRAMESCRIPT_PROJECT_ROOT`, base for relative media paths
 
 ## Render outputs

electron/main.ts

@@ -67,7 +67,22 @@ function getBackendEndpoint(pathname: string) {
 function getMediaRoots() {
   const configured = process.env.FRAMESCRIPT_MEDIA_ROOTS
   if (configured?.trim()) return configured
-  return [process.cwd(), os.homedir()].join(path.delimiter)
+
+  // Default to the project root plus a curated set of user-media folders that
+  // typically hold render inputs. Falling back to the entire $HOME makes every
+  // file under the user's account readable through the backend — set
+  // FRAMESCRIPT_MEDIA_ROOTS explicitly when a broader scope is required.
+  const home = os.homedir()
+  const curated = ["Videos", "Movies", "Music", "Pictures", "Documents"]
+    .map((dir) => path.join(home, dir))
+    .filter((dir) => {
+      try {
+        return fs.statSync(dir).isDirectory()
+      } catch {
+        return false
+      }
+    })
+  return [process.cwd(), ...curated].join(path.delimiter)
 }
 
 function getTrustedOrigins() {