Webhooks — localhost webhook receiver with dedupe

This skill runs a small webhook receiver on localhost: it listens for JSON POST requests, stores each new event, and answers 204 before doing any slow work. The complete listener is a single Python file using only the standard library — Python 3 is the only dependency, nothing to install.

Events are appended as one JSON object per line to events.jsonl in the current directory. Deduplication is by event id: a second delivery of the same id still returns 204 (which tells the sender to stop retrying) but does not add a second line. That pair of behaviors — answer fast, store once — is what makes sender retries safe instead of duplicative.

The handler is defensive about input. Bodies that are empty, not JSON, or not a JSON object get 400; bodies over 1,000,000 bytes get 413; POSTs to any path other than /hook get 404. The stored JSON is never executed — it is data in a file, nothing more.

The binding is honest about scope: the server listens on 127.0.0.1 only, port 8787. A sender on another machine cannot reach it until you change HOST on purpose. This is a receiver for services you can point at localhost, not a public endpoint — exposing it beyond the machine is a deliberate change, not a default.