safari-mcp 2.11.9 → 2.13.0

package/extension/background.js

@@ -67,8 +67,13 @@ function updateBadge(text) {
 
 // ========== HTTP LONG-POLLING TRANSPORT ==========
 
+let _connecting = false; // re-entrancy lock — the startup promise and the alarm can race into connect()
 async function connect() {
   if (!_enabled) return;
+  // One connect at a time: two near-simultaneous calls (cold start + alarm wake)
+  // could each spawn a poll loop before the other assigned pollAbort.
+  if (_connecting) return;
+  _connecting = true;
   // Cancel any existing poll
   if (pollAbort) {
     try { pollAbort.abort(); } catch {}
@@ -91,6 +96,7 @@ async function connect() {
         if (!isCorrectProfile) {
           console.log(`Safari MCP: wrong profile — server wants "${data.profile}", disconnecting`);
           updateBadge("OFF");
+          _connecting = false;
           return; // Do NOT poll — let the correct profile's extension handle commands
         }
         // Notify server that we passed profile verification
@@ -104,6 +110,7 @@ async function connect() {
       _reconnectDelay = 3000; // Reset backoff on success
       updateBadge("ON");
       _startHeartbeat(); // Keep service worker alive between polls
+      _connecting = false;
       pollForCommands();
       return;
     }
@@ -113,6 +120,7 @@ async function connect() {
   isConnected = false;
   updateBadge("");
   scheduleReconnect();
+  _connecting = false;
 }
 
 function scheduleReconnect() {
@@ -145,14 +153,18 @@ async function pollForCommands() {
       });
       clearTimeout(timeout);
       if (res.status === 200) {
-        const msg = await res.json();
-        await executeAndReply(msg);
+        // A single malformed/truncated body must NOT tear down the poll loop — a bad
+        // packet used to throw SyntaxError here, fall through to "server gone", and
+        // trigger a multi-second reconnect backoff. Skip the bad packet and keep polling.
+        const msg = await res.json().catch(() => null);
+        if (msg) await executeAndReply(msg);
       }
       // 204 = no command, loop immediately to keep connection active
     } catch (err) {
       if (err.name === "AbortError") {
-        // If still connected, this was a safety timeout — reconnect
-        if (isConnected && _enabled) { pollForCommands(); return; }
+        // 90s safety-timeout abort while still connected — continue the loop in place.
+        // (Re-calling pollForCommands() here risked two overlapping loops posting dup results.)
+        if (isConnected && _enabled) continue;
         return; // Intentional abort (disable/new connect)
       }
       // Server gone — reconnect via shared scheduler (prevents duplicate timers)
@@ -202,6 +214,10 @@ async function handleCommand(type, payload) {
     throw new Error("Tab belongs to a different profile — refusing to operate on personal tabs");
   }
 
+  // Rehydrate owned-tab state after a possible service-worker restart BEFORE
+  // consulting the guard — an empty post-restart Map used to disable it entirely.
+  await _hydrateOwnedTabs();
+
   // ========== TAB OWNERSHIP GUARD ==========
   // Block write operations on tabs not opened by this session.
   // new_tab is always allowed (it creates owned tabs). Read-only ops are allowed on any tab.
@@ -241,7 +257,12 @@ async function handleCommand(type, payload) {
         return true;
       }, [], tabId).catch(() => true);
 
-      if (!hasContent) {
+      // Don't hard-reload OAuth/redirect callback pages: a sparse-but-valid callback
+      // (code=/token=/state= in the URL) would be reloaded, dropping its POST data and
+      // breaking the auth flow. Only reload normal http(s) pages without auth params.
+      const reloadable = /^https?:/i.test(payload.url || "") &&
+        !/[?&#](code|token|access_token|id_token|state|session_state)=/i.test(payload.url || "");
+      if (!hasContent && reloadable) {
         // Try hard reload once
         await browser.tabs.reload(tabId, { bypassCache: true });
         await waitForTabLoad(tabId, 15000);
@@ -338,7 +359,11 @@ async function handleCommand(type, payload) {
       // Strategy 2: Script element injection (works when inline scripts are allowed)
       const injectResult = await execInTab(async (script) => {
         return await new Promise((resolve) => {
-          const id = "__mcp_eval_" + Date.now();
+          // Unpredictable key — a Date.now()-based name let a hostile page pre-seed
+          // window["__mcp_eval_<now>"] with a fabricated {done:true,v:...} result.
+          const id = "__mcp_eval_" + (crypto.randomUUID
+            ? crypto.randomUUID().replace(/-/g, "")
+            : Date.now().toString(36) + Math.random().toString(36).slice(2));
           window[id] = { done: false };
           const s = document.createElement("script");
           const code = "try{var __r=(function(){" + script + "})();if(__r&&typeof __r.then==='function'){__r.then(function(v){window['" + id + "']={done:true,v:v};}).catch(function(e){window['" + id + "']={done:true,e:e.message};});}else{window['" + id + "']={done:true,v:__r};}}catch(e){window['" + id + "']={done:true,e:e.message};}";
@@ -459,12 +484,17 @@ async function handleCommand(type, payload) {
             return null;
           }
           const m = refs[refId];
+          // Escape attribute values + guard the query — a page-controlled aria-label/name/
+          // placeholder containing a double-quote would otherwise build an invalid selector
+          // and throw a DOMException that surfaces as a misleading "element not found".
+          const dqAttr = (sel) => { try { return dq(sel); } catch (_e) { return null; } };
+          const aq = (v) => String(v).replace(/["\\]/g, "\\$&");
           if (m.id) { el = document.getElementById(m.id); if (el) return el; }
-          if (m.nameAttr) { el = dq('[name="' + m.nameAttr + '"]'); if (el) return el; }
-          if (m.al) { el = dq('[aria-label="' + m.al + '"]'); if (el) return el; }
-          if (m.ph) { el = dq('[placeholder="' + m.ph + '"]'); if (el) return el; }
+          if (m.nameAttr) { el = dqAttr('[name="' + aq(m.nameAttr) + '"]'); if (el) return el; }
+          if (m.al) { el = dqAttr('[aria-label="' + aq(m.al) + '"]'); if (el) return el; }
+          if (m.ph) { el = dqAttr('[placeholder="' + aq(m.ph) + '"]'); if (el) return el; }
           // Type attribute fallback (input type="email", type="url", etc.)
-          if (m.inputType) { el = dq(m.tag.toLowerCase() + '[type="' + m.inputType + '"]'); if (el) return el; }
+          if (m.inputType) { el = dqAttr(m.tag.toLowerCase() + '[type="' + aq(m.inputType) + '"]'); if (el) return el; }
           // Coordinate fallback — scroll into view then hit-test
           if (m.cx !== undefined && m.cy !== undefined) {
             window.scrollTo(window.scrollX, Math.max(0, m.cy - window.innerHeight / 2));
@@ -1073,16 +1103,33 @@ async function handleCommand(type, payload) {
     }
 
     case "close_tab": {
+      // ── Guard: never remove a window's LAST tab — doing so closes the window
+      // (quitting Safari if it's the only one, or making a profile-targeted
+      // window vanish). Per-window, not global, so other-profile windows don't
+      // mask it. If the target window is down to one tab, blank it instead.
+      // Mirrors safari.js closeTab().
+      const _winQuery = _profileWindowId ? { windowId: _profileWindowId } : { currentWindow: true };
+      const _winTabs = await browser.tabs.query(_winQuery);
+      const _isLastTab = _winTabs.length <= 1;
       if (payload.index) {
-        const query = _profileWindowId ? { windowId: _profileWindowId } : { currentWindow: true };
-        const tabs = await browser.tabs.query(query);
-        const target = tabs[payload.index - 1];
+        // Resolve the target from the SAME query as the last-tab count — a second
+        // query here was a TOCTOU window (a tab opened/closed between the two awaits
+        // could resolve the wrong tab or leave a stale last-tab verdict).
+        const target = _winTabs[payload.index - 1];
         if (target) {
           _removeOwnedTab(sessionId, target.id);
+          if (_isLastTab) {
+            await browser.tabs.update(target.id, { url: "about:blank" });
+            return "Last remaining tab blanked instead of closed (closing it would quit Safari)";
+          }
           await browser.tabs.remove(target.id);
         }
       } else {
         _removeOwnedTab(sessionId, tabId);
+        if (_isLastTab) {
+          await browser.tabs.update(tabId, { url: "about:blank" });
+          return "Last remaining tab blanked instead of closed (closing it would quit Safari)";
+        }
         await browser.tabs.remove(tabId);
       }
       return "Tab closed";
@@ -1152,6 +1199,13 @@ async function handleCommand(type, payload) {
       }).catch(() => {});
       await browser.tabs.update(tabId, { url: payload.url });
       await waitForTabLoad(tabId, payload.timeout || 30000);
+      // Update the session cache like every other navigation command — without this,
+      // the next command within TAB_CACHE_MS resolved against the PRE-navigation URL
+      // and could fall through to the user's active tab.
+      try {
+        const updated = await browser.tabs.get(tabId);
+        _setSessionTab(sessionId, updated.id, updated.url);
+      } catch {}
       const maxLen = payload.maxLength || 50000;
       const results = await browser.scripting.executeScript({
         target: { tabId },
@@ -1233,27 +1287,31 @@ async function handleCommand(type, payload) {
             attrs = ` ref="${refId}"`;
           }
 
+          // Escape page-controlled attribute values: a crafted aria-label/title/value with
+          // a double-quote could otherwise break the pseudo-XML snapshot and inject a fake
+          // ref=""/role="" that steers the agent into clicking the wrong element.
+          const esc = (s) => String(s).replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
           const role = el.getAttribute("role");
-          if (role) attrs += ` role="${role}"`;
-          if (el.id) attrs += ` id="${el.id}"`;
+          if (role) attrs += ` role="${esc(role)}"`;
+          if (el.id) attrs += ` id="${esc(el.id)}"`;
           const al = el.getAttribute("aria-label");
-          if (al) attrs += ` aria-label="${al}"`;
+          if (al) attrs += ` aria-label="${esc(al)}"`;
           const title = el.getAttribute("title");
-          if (title) attrs += ` title="${title.substring(0, 80)}"`;
+          if (title) attrs += ` title="${esc(title.substring(0, 80))}"`;
           if (el.value && ["INPUT", "TEXTAREA", "SELECT"].includes(el.tagName)) {
-            attrs += ` value="${String(el.value).substring(0, 50)}"`;
+            attrs += ` value="${esc(String(el.value).substring(0, 50))}"`;
           }
-          if (el.type && el.tagName === "INPUT") attrs += ` type="${el.type}"`;
-          if (el.href && el.tagName === "A") attrs += ` href="${el.href.substring(0, 100)}"`;
+          if (el.type && el.tagName === "INPUT") attrs += ` type="${esc(el.type)}"`;
+          if (el.href && el.tagName === "A") attrs += ` href="${esc(el.href.substring(0, 100))}"`;
           if (el.disabled) attrs += " disabled";
           const ph = el.getAttribute("placeholder");
-          if (ph) attrs += ` placeholder="${ph}"`;
+          if (ph) attrs += ` placeholder="${esc(ph)}"`;
           // For interactive elements with no visible text — show alt/aria-describedby hint
-          if (interactive && el.tagName === "IMG" && el.alt) attrs += ` alt="${el.alt.substring(0, 80)}"`;
+          if (interactive && el.tagName === "IMG" && el.alt) attrs += ` alt="${esc(el.alt.substring(0, 80))}"`;
           const ariaDesc = el.getAttribute("aria-describedby");
           if (ariaDesc) {
             const descEl = document.getElementById(ariaDesc);
-            if (descEl) attrs += ` described="${descEl.textContent.trim().substring(0, 80)}"`;
+            if (descEl) attrs += ` described="${esc(descEl.textContent.trim().substring(0, 80))}"`;
           }
 
           // Self-closing for some tags
@@ -1721,16 +1779,47 @@ const MAX_SESSIONS = 50; // Hard cap on session cache size
 // Prevents operating on user's tabs — only tabs created via new_tab are "owned".
 const _sessionOwnedTabs = new Map(); // sessionId → Set<tabId>
 
+// Persist owned-tab IDs in storage.session: it survives the frequent MV3
+// service-worker terminations (but clears when Safari quits, matching tab-ID
+// lifetime). Without this, every worker restart wiped the Map — and the
+// "no tabs owned yet" compatibility path then silently allowed write commands
+// on ANY tab, including the user's.
+const _OWNED_TABS_KEY = "mcpSessionOwnedTabs";
+let _ownedTabsHydrated = false;
+async function _hydrateOwnedTabs() {
+  if (_ownedTabsHydrated) return;
+  _ownedTabsHydrated = true;
+  try {
+    const data = (await browser.storage.session.get(_OWNED_TABS_KEY))?.[_OWNED_TABS_KEY];
+    if (data) {
+      for (const [sid, ids] of Object.entries(data)) {
+        if (!_sessionOwnedTabs.has(sid)) _sessionOwnedTabs.set(sid, new Set());
+        const set = _sessionOwnedTabs.get(sid);
+        for (const id of ids) set.add(id);
+      }
+    }
+  } catch {} // storage.session unavailable → behave as before (in-memory only)
+}
+function _persistOwnedTabs() {
+  try {
+    const obj = {};
+    for (const [sid, set] of _sessionOwnedTabs) obj[sid] = [...set];
+    browser.storage.session.set({ [_OWNED_TABS_KEY]: obj }).catch(() => {});
+  } catch {}
+}
+
 function _addOwnedTab(sessionId, tabId) {
   const sid = sessionId || _DEFAULT_SESSION;
   if (!_sessionOwnedTabs.has(sid)) _sessionOwnedTabs.set(sid, new Set());
   _sessionOwnedTabs.get(sid).add(tabId);
+  _persistOwnedTabs();
 }
 
 function _removeOwnedTab(sessionId, tabId) {
   const sid = sessionId || _DEFAULT_SESSION;
   const set = _sessionOwnedTabs.get(sid);
   if (set) set.delete(tabId);
+  _persistOwnedTabs();
 }
 
 function _isTabOwnedBySession(sessionId, tabId) {
@@ -1942,11 +2031,21 @@ async function getTargetTab(tabUrl, sessionId) {
       match = all.find(t => t.url && (t.url.startsWith(tabUrl) || tabUrl.startsWith(t.url.split("?")[0])));
     }
     if (match) {
+      // A URL match in a DIFFERENT window must not silently retarget the profile
+      // window — a URL collision with a tab in the user's personal window would
+      // permanently redirect every subsequent command there. Adopt the match's
+      // window only when the tracked profile window no longer exists.
+      if (_profileWindowId && match.windowId !== _profileWindowId) {
+        let profileWindowGone = false;
+        try { await browser.windows.get(_profileWindowId); }
+        catch { profileWindowGone = true; }
+        if (!profileWindowGone) {
+          throw new Error("Tab not found in the MCP profile window (a same-URL tab exists in another window — refusing to cross windows). Use safari_new_tab.");
+        }
+        console.log("Safari MCP: profile window gone — adopting", match.windowId);
+      }
       _setSessionTab(sessionId, match.id, tabUrl);
       if (!_profileWindowId || match.windowId !== _profileWindowId) {
-        if (_profileWindowId && match.windowId !== _profileWindowId) {
-          console.log("Safari MCP: profile window changed:", _profileWindowId, "→", match.windowId);
-        }
         _profileWindowId = match.windowId;
         browser.storage.local.set({ mcpProfileWindowId: _profileWindowId }).catch(() => {});
         console.log("Safari MCP: profile windowId =", _profileWindowId);

package/extension/content.js

@@ -20,18 +20,30 @@ if (!window.__mcpShadowPatched) {
     }
     return shadow;
   };
-  // Expose getter for MCP tools (snapshot, deepQuery, click, fill)
-  window.__mcpGetShadowRoot = function(el) {
+  // Expose getter for MCP tools (snapshot, deepQuery, click, fill).
+  // Non-enumerable + non-writable: pages that know the name can still call it
+  // (inherent to MAIN-world injection), but it doesn't surface in enumeration and —
+  // more importantly — page scripts can't REPLACE it to feed MCP fake shadow roots.
+  var _getShadowRoot = function(el) {
     return el.shadowRoot || _closedRoots.get(el) || null;
   };
+  try {
+    Object.defineProperty(window, "__mcpGetShadowRoot", {
+      value: _getShadowRoot, writable: false, enumerable: false, configurable: false
+    });
+  } catch (_e) {
+    window.__mcpGetShadowRoot = _getShadowRoot;
+  }
 }
 
 if (!window.__mcpTrustedPolicy && window.trustedTypes && typeof window.trustedTypes.createPolicy === "function") {
   try {
+    // Register ONLY createScript — the single capability the bridge uses (background.js
+    // evaluate sets script.textContent via createScript). A world-accessible pass-through
+    // createHTML would let the page's own scripts wrap arbitrary HTML as trusted, defeating
+    // its Trusted-Types protection; createScriptURL is likewise unused. Least privilege.
     window.__mcpTrustedPolicy = window.trustedTypes.createPolicy("mcpBridge", {
-      createScript: function (s) { return s; },
-      createScriptURL: function (s) { return s; },
-      createHTML: function (s) { return s; }
+      createScript: function (s) { return s; }
     });
   } catch (_e) {
     // Page already restricts policies — rare since content script runs at document_start

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.10.1",
+  "version": "2.10.2",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",