safari-mcp 2.10.0 → 2.10.2

package/extension/background.js

@@ -342,9 +342,15 @@ async function handleCommand(type, payload) {
           window[id] = { done: false };
           const s = document.createElement("script");
           const code = "try{var __r=(function(){" + script + "})();if(__r&&typeof __r.then==='function'){__r.then(function(v){window['" + id + "']={done:true,v:v};}).catch(function(e){window['" + id + "']={done:true,e:e.message};});}else{window['" + id + "']={done:true,v:__r};}}catch(e){window['" + id + "']={done:true,e:e.message};}";
-          if (window.trustedTypes && window.trustedTypes.createPolicy) {
+          // Prefer the policy pre-registered by content.js at document_start —
+          // pages that block new policy creation post-load (GSC, modern Google admin)
+          // still accept ours because it was grandfathered in before their CSP applied.
+          if (window.__mcpTrustedPolicy && typeof window.__mcpTrustedPolicy.createScript === "function") {
+            try { s.textContent = window.__mcpTrustedPolicy.createScript(code); }
+            catch (_) { s.textContent = code; }
+          } else if (window.trustedTypes && window.trustedTypes.createPolicy) {
             try {
-              const policy = window.trustedTypes.createPolicy("mcpEval", { createScript: (s) => s });
+              const policy = window.trustedTypes.createPolicy("mcpEval_" + Date.now(), { createScript: (s) => s });
               s.textContent = policy.createScript(code);
             } catch (_) { s.textContent = code; }
           } else {

package/extension/content.js

@@ -1,7 +1,11 @@
-// Content script — runs at document_start in MAIN world (before page scripts)
-// Purpose: Monkey-patch attachShadow to capture CLOSED shadow roots.
-// Without this, Reddit and other sites using closed shadow DOM
-// are invisible to snapshot/click/fill.
+// Content script — runs at document_start in MAIN world (before page scripts).
+// Two responsibilities:
+//   1. Monkey-patch attachShadow to capture CLOSED shadow roots (Reddit, etc.).
+//   2. Pre-register a Trusted Types policy named "mcpBridge" BEFORE the page sets
+//      its own require-trusted-types-for directive. Our policy is then grandfathered
+//      and survives even on pages (Google Search Console, Google admin, modern banks)
+//      that block new policy creation after page load. MCP evaluate strategies
+//      consult `window.__mcpTrustedPolicy` first.
 // Runs in MAIN world via manifest "world": "MAIN" — no script injection needed,
 // so CSP cannot block it.
 
@@ -21,3 +25,16 @@ if (!window.__mcpShadowPatched) {
     return el.shadowRoot || _closedRoots.get(el) || null;
   };
 }
+
+if (!window.__mcpTrustedPolicy && window.trustedTypes && typeof window.trustedTypes.createPolicy === "function") {
+  try {
+    window.__mcpTrustedPolicy = window.trustedTypes.createPolicy("mcpBridge", {
+      createScript: function (s) { return s; },
+      createScriptURL: function (s) { return s; },
+      createHTML: function (s) { return s; }
+    });
+  } catch (_e) {
+    // Page already restricts policies — rare since content script runs at document_start
+    // before page scripts. Leave undefined; evaluate fallbacks will probe other paths.
+  }
+}

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.9.1",
+  "version": "2.10.1",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.10.0",
+  "version": "2.10.2",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 80 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -158,6 +158,14 @@ async function _restoreClipboard(savedContent) {
 // to the current index.
 let _activeTabIndex = null; // null = use front document (default)
 let _activeTabURL = null;   // URL-based tracking (stable even when tabs shift)
+// Timestamp of most recent new_tab — within this grace window we MUST NOT fall
+// back to "current tab of window" (which is the USER'S active tab). New tabs
+// often start at about:blank if their URL fails to load (file://, blocked, etc.),
+// and the URL-based marker resolution can fail until the page actually loads.
+// During the grace window, navigate/click/fill operations either use the cached
+// _activeTabIndex or fail loudly — never silently target the user's tab.
+let _lastNewTabAt = 0;
+const NEW_TAB_GRACE_MS = 30000;
 let _lastResolveTime = 0;   // Cache: skip resolve if verified recently
 let _lastTabCount = null;   // Track tab count for smart cache invalidation
 let _activeTabMarker = null; // window.__mcpTabMarker — survives same-tab navigation, bulletproof tab identity
@@ -272,6 +280,20 @@ function isStaleWindowError(err) {
 
 // Safe fallback target: when no tab index is known, use the profile window's current tab
 // instead of "front document" which can target the user's personal profile window
+// Throw if a write operation is about to fall back to the user's active tab
+// during the new-tab grace window. Without this, navigate/fill/click silently
+// target whatever tab the user is looking at when our cached index is lost.
+function _assertNotFallingBackToUserTab(opName) {
+  if (_activeTabIndex) return; // we have a tracked index — fine
+  const sinceNew = Date.now() - _lastNewTabAt;
+  if (sinceNew < NEW_TAB_GRACE_MS) {
+    throw new Error(
+      `Tab tracking lost within ${Math.round(sinceNew/1000)}s of safari_new_tab — refusing to ${opName} via fallback (would target the user's active tab). ` +
+      `Re-run safari_new_tab and retry.`
+    );
+  }
+}
+
 function getFallbackTarget() {
   return SAFARI_PROFILE ? `current tab of ${getTargetWindowRef()}` : "front document";
 }
@@ -826,6 +848,7 @@ export async function navigate(url) {
   const safeUrl = targetUrl.replace(/"/g, '\\"');
     // Resolve tab by URL first (in case indices shifted)
     if (_activeTabURL) await resolveActiveTab();
+    _assertNotFallingBackToUserTab('navigate');
     const navTarget = _activeTabIndex
       ? `tab ${_activeTabIndex} of ${getTargetWindowRef()}`
       : getFallbackTarget();
@@ -904,6 +927,17 @@ export async function navigate(url) {
     }
     _lastResolveTime = Date.now();
 
+    // Re-inject the tab marker — navigation creates a new JS context which wipes the
+    // window.__mcpTabMarker we set in newTab. Without re-injection, resolveActiveTab's
+    // marker-based search fails on the very next call and falls back to URL search,
+    // which can mis-target if the tab is still loading or shows an error page.
+    if (_activeTabIndex && _activeTabMarker) {
+      const safeMarker = _activeTabMarker.replace(/'/g, "\\'");
+      await osascriptFast(
+        `tell application "Safari" to do JavaScript "window.__mcpTabMarker='${safeMarker}'" in tab ${_activeTabIndex} of ${getTargetWindowRef()}`
+      ).catch(() => {});
+    }
+
     return result;
 }
 
@@ -1296,6 +1330,35 @@ export async function fill({ selector, value, ref }) {
   const val = value.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "");
   const result = await runJS(
     `(function(){try{var el=document.querySelector('${sel}');if(!el){var q=function(r){var a=r.querySelectorAll('*');for(var i=0;i<a.length;i++){if(a[i].shadowRoot){el=a[i].shadowRoot.querySelector('${sel}');if(el)return el;el=q(a[i].shadowRoot);if(el)return el;}}return null;};el=q(document);}if(!el)return 'Element not found: ${sel}';el.focus();if(el.isContentEditable||el.getAttribute('contenteditable')==='true'){` +
+    // Quill editor detection (LinkedIn share composer in 2026 — they migrated from
+    // ProseMirror, Slack message editor, many enterprise apps). The Quill instance is
+    // attached to `.ql-container.__quill` (v2) or accessible via React Fiber's
+    // memoizedProps/stateNode. Without proper API access, fill-by-DOM crashes Quill's
+    // internal Delta state and dismisses the dialog (the v2.10.0 LinkedIn bug repro).
+    `var qlEditor=el.classList&&el.classList.contains('ql-editor')?el:el.closest('.ql-editor');` +
+    `if(qlEditor){` +
+      `var qlContainer=qlEditor.closest('.ql-container')||qlEditor.parentElement;` +
+      `var quill=(qlContainer&&qlContainer.__quill)||null;` +
+      // Fallback: walk React Fiber to find the Quill instance attached as a prop or stateNode
+      `if(!quill&&qlContainer){var qfk=Object.keys(qlContainer).find(function(k){return k.indexOf('__reactFiber')===0||k.indexOf('__reactInternalInstance')===0;});if(qfk){var qf=qlContainer[qfk];for(var qd=0;qd<25&&qf;qd++){var qp=qf.memoizedProps;if(qp&&qp.quill&&typeof qp.quill.setContents==='function'){quill=qp.quill;break;}var qsn=qf.stateNode;if(qsn&&qsn.quill&&typeof qsn.quill.setContents==='function'){quill=qsn.quill;break;}qf=qf.return;}}}` +
+      `if(quill&&typeof quill.setContents==='function'){` +
+        `try{` +
+          // Convert escaped string back to real string for Quill API.
+          // The val template var has \\n / \\\\ / \\' applied, so we need to unescape for setText.
+          `var qlText='${val}'.replace(/\\\\n/g,'\\n').replace(/\\\\'/g,"'").replace(/\\\\\\\\/g,'\\\\');` +
+          // setContents with a plain text Delta — bypasses clipboard, no synthetic events,
+          // doesn't trigger LinkedIn's focusout-dismiss handler.
+          `quill.setContents([{insert: qlText + '\\n'}], 'api');` +
+          `quill.setSelection(qlText.length, 0, 'api');` +
+          // Verify the text actually committed
+          `var qlActual=quill.getText().replace(/\\n+$/,'');` +
+          `if(qlActual.indexOf(qlText.substring(0, Math.min(20, qlText.length)))>=0){return 'Filled CE (Quill setContents)';}` +
+        `}catch(_qE){}` +
+      `}` +
+      // Quill instance not found via direct or Fiber — route to native paste fallback.
+      // Quill respects real isTrusted clipboard events, so CGEvent Cmd+V works.
+      `return '__NATIVE_PASTE_DIALOG__';` +
+    `}` +
     // Lexical editor detection (LinkedIn share composer, modern Meta/Shopify apps).
     // Three lookup strategies, cheapest first:
     //   A) [data-lexical-editor="true"] on ancestor with __lexicalEditor property.
@@ -2543,6 +2606,7 @@ export async function newTab(url = "") {
   _activeTabURL = url || null;
   _lastResolveTime = Date.now();
   _lastTabCount = Number(tabCount);  // Update tab count cache
+  _lastNewTabAt = Date.now();        // Start grace window — block fallback to user's tab
   // Set bulletproof tab marker — survives same-tab navigation, redirects, query changes (v2.8.3)
   _activeTabMarker = `MCP_${SESSION_ID}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
   await osascriptFast(