safari-mcp 2.10.1 → 2.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.10.1",
+  "version": "2.10.3",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 80 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -166,6 +166,13 @@ let _activeTabURL = null;   // URL-based tracking (stable even when tabs shift)
 // _activeTabIndex or fail loudly — never silently target the user's tab.
 let _lastNewTabAt = 0;
 const NEW_TAB_GRACE_MS = 30000;
+// Becomes true once safari_new_tab is called for the first time in this session.
+// Once true, write operations (navigate/click/fill) MUST NOT fall back to
+// "current tab of window" — that targets the USER'S active tab. The 30s grace
+// window was insufficient: tab tracking can be lost much later in a session
+// (e.g. tab ghost recovery in runJS), and silently falling back to the user's
+// tab caused incidents where the user's working tab was overwritten.
+let _hasOwnedTab = false;
 let _lastResolveTime = 0;   // Cache: skip resolve if verified recently
 let _lastTabCount = null;   // Track tab count for smart cache invalidation
 let _activeTabMarker = null; // window.__mcpTabMarker — survives same-tab navigation, bulletproof tab identity
@@ -285,13 +292,18 @@ function isStaleWindowError(err) {
 // target whatever tab the user is looking at when our cached index is lost.
 function _assertNotFallingBackToUserTab(opName) {
   if (_activeTabIndex) return; // we have a tracked index — fine
-  const sinceNew = Date.now() - _lastNewTabAt;
-  if (sinceNew < NEW_TAB_GRACE_MS) {
+  // If we ever opened our own tab in this session, we MUST NOT fall back to
+  // "current tab of window" — that's the USER'S active tab. Always throw,
+  // regardless of how long ago the tab was opened. The previous 30-second
+  // grace window was insufficient: long-running sessions (Reddit warmup,
+  // multi-step workflows) routinely exceed it, and the danger persists.
+  if (_hasOwnedTab) {
     throw new Error(
-      `Tab tracking lost within ${Math.round(sinceNew/1000)}s of safari_new_tab — refusing to ${opName} via fallback (would target the user's active tab). ` +
-      `Re-run safari_new_tab and retry.`
+      `Tab tracking lost — refusing to ${opName} via fallback to "current tab of window" (would target the user's active tab). ` +
+      `This session previously opened its own tab via safari_new_tab; re-run safari_new_tab to recover, or call safari_list_tabs and safari_switch_tab to re-anchor to a known tab.`
     );
   }
+  // No tab ever owned by this session — fallback to front document is intentional.
 }
 
 function getFallbackTarget() {
@@ -779,7 +791,18 @@ async function runJS(js, { tabIndex, timeout = 15000 } = {}) {
           return osascript(retryScript, { timeout });
         }
       }
-      // If still can't resolve, try current tab of the window
+      // If still can't resolve and we previously owned a tab — refuse to
+      // fall back to "current tab of window" (which is the USER'S active tab).
+      // Falling back would silently run our JS (potentially writes:
+      // document.title=, location.href=) on the user's working page.
+      if (_hasOwnedTab) {
+        throw new Error(
+          `Tab tracking lost during runJS — original tab ${idx} no longer exists, and URL-based resolution failed. ` +
+          `Refusing to fall back to "current tab of window" (would target user's active tab). ` +
+          `Call safari_new_tab to open a fresh tab and retry.`
+        );
+      }
+      // No owned tab in this session — front-document fallback is intentional.
       const fallbackScript = `tell application "Safari" to do JavaScript "${escaped}" in current tab of ${getTargetWindowRef()}`;
       console.error(`[Safari MCP] Falling back to current tab`);
       if (fallbackScript.length < 50000) return osascriptFast(fallbackScript, { timeout });
@@ -800,6 +823,14 @@ async function runJSLarge(js, { tabIndex, timeout = 30000 } = {}) {
     if (resolved) { idx = resolved; _lastResolveTime = Date.now(); }
   }
   if (!idx) idx = _activeTabIndex;
+  // If we previously owned a tab but lost tracking, refuse to target current tab
+  // (which is the USER'S active tab). Same protection as navigate/runJS fallback.
+  if (!idx && _hasOwnedTab) {
+    throw new Error(
+      `Tab tracking lost during runJSLarge — refusing to fall back to "current tab of window" (would target user's active tab). ` +
+      `Call safari_new_tab to open a fresh tab and retry.`
+    );
+  }
   const target = idx
     ? `tab ${idx} of ${getTargetWindowRef()}`
     : getFallbackTarget();
@@ -1330,6 +1361,35 @@ export async function fill({ selector, value, ref }) {
   const val = value.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "");
   const result = await runJS(
     `(function(){try{var el=document.querySelector('${sel}');if(!el){var q=function(r){var a=r.querySelectorAll('*');for(var i=0;i<a.length;i++){if(a[i].shadowRoot){el=a[i].shadowRoot.querySelector('${sel}');if(el)return el;el=q(a[i].shadowRoot);if(el)return el;}}return null;};el=q(document);}if(!el)return 'Element not found: ${sel}';el.focus();if(el.isContentEditable||el.getAttribute('contenteditable')==='true'){` +
+    // Quill editor detection (LinkedIn share composer in 2026 — they migrated from
+    // ProseMirror, Slack message editor, many enterprise apps). The Quill instance is
+    // attached to `.ql-container.__quill` (v2) or accessible via React Fiber's
+    // memoizedProps/stateNode. Without proper API access, fill-by-DOM crashes Quill's
+    // internal Delta state and dismisses the dialog (the v2.10.0 LinkedIn bug repro).
+    `var qlEditor=el.classList&&el.classList.contains('ql-editor')?el:el.closest('.ql-editor');` +
+    `if(qlEditor){` +
+      `var qlContainer=qlEditor.closest('.ql-container')||qlEditor.parentElement;` +
+      `var quill=(qlContainer&&qlContainer.__quill)||null;` +
+      // Fallback: walk React Fiber to find the Quill instance attached as a prop or stateNode
+      `if(!quill&&qlContainer){var qfk=Object.keys(qlContainer).find(function(k){return k.indexOf('__reactFiber')===0||k.indexOf('__reactInternalInstance')===0;});if(qfk){var qf=qlContainer[qfk];for(var qd=0;qd<25&&qf;qd++){var qp=qf.memoizedProps;if(qp&&qp.quill&&typeof qp.quill.setContents==='function'){quill=qp.quill;break;}var qsn=qf.stateNode;if(qsn&&qsn.quill&&typeof qsn.quill.setContents==='function'){quill=qsn.quill;break;}qf=qf.return;}}}` +
+      `if(quill&&typeof quill.setContents==='function'){` +
+        `try{` +
+          // Convert escaped string back to real string for Quill API.
+          // The val template var has \\n / \\\\ / \\' applied, so we need to unescape for setText.
+          `var qlText='${val}'.replace(/\\\\n/g,'\\n').replace(/\\\\'/g,"'").replace(/\\\\\\\\/g,'\\\\');` +
+          // setContents with a plain text Delta — bypasses clipboard, no synthetic events,
+          // doesn't trigger LinkedIn's focusout-dismiss handler.
+          `quill.setContents([{insert: qlText + '\\n'}], 'api');` +
+          `quill.setSelection(qlText.length, 0, 'api');` +
+          // Verify the text actually committed
+          `var qlActual=quill.getText().replace(/\\n+$/,'');` +
+          `if(qlActual.indexOf(qlText.substring(0, Math.min(20, qlText.length)))>=0){return 'Filled CE (Quill setContents)';}` +
+        `}catch(_qE){}` +
+      `}` +
+      // Quill instance not found via direct or Fiber — route to native paste fallback.
+      // Quill respects real isTrusted clipboard events, so CGEvent Cmd+V works.
+      `return '__NATIVE_PASTE_DIALOG__';` +
+    `}` +
     // Lexical editor detection (LinkedIn share composer, modern Meta/Shopify apps).
     // Three lookup strategies, cheapest first:
     //   A) [data-lexical-editor="true"] on ancestor with __lexicalEditor property.
@@ -2577,7 +2637,9 @@ export async function newTab(url = "") {
   _activeTabURL = url || null;
   _lastResolveTime = Date.now();
   _lastTabCount = Number(tabCount);  // Update tab count cache
-  _lastNewTabAt = Date.now();        // Start grace window — block fallback to user's tab
+  _lastNewTabAt = Date.now();        // (legacy — grace window superseded by _hasOwnedTab)
+  _hasOwnedTab = true;               // Permanently true: this session has opened its own tab,
+                                     // so write ops must NEVER fall back to the user's current tab.
   // Set bulletproof tab marker — survives same-tab navigation, redirects, query changes (v2.8.3)
   _activeTabMarker = `MCP_${SESSION_ID}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
   await osascriptFast(
@@ -4185,6 +4247,8 @@ export async function navigateAndRead(url, { maxLength = 50000 } = {}) {
   let targetUrl = url;
   if (!/^https?:\/\//i.test(targetUrl)) targetUrl = "https://" + targetUrl;
   const safeUrl = targetUrl.replace(/"/g, '\\"');
+  if (_activeTabURL) await resolveActiveTab();
+  _assertNotFallingBackToUserTab('navigateAndRead');
   const navTarget = _activeTabIndex ? `tab ${_activeTabIndex} of ${getTargetWindowRef()}` : getFallbackTarget();
   await osascriptFast(`tell application "Safari" to set URL of ${navTarget} to "${safeUrl}"`);
   _activeTabURL = targetUrl;