safari-mcp 2.15.11 → 2.16.0

package/README.md

@@ -334,6 +334,8 @@ This also drops process count sharply: ~17 node processes for 17 concurrent sess
 
 `SAFARI_PROFILE` stays optional — leave it unset and sessions bind to your ordinary Safari windows, cookies and logins intact. Details in [docs/http-transport-design.md](docs/http-transport-design.md).
 
+Prefer stdio (one process per agent) over a persistent daemon? That works too — isolation then comes from the process boundary itself. One caveat: if your client multiplexes agents through [mcporter](https://github.com/openclaw/mcporter), mcporter caches a single MCP client for all of them — whichever transport you pick — so the server never sees distinct sessions and per-session isolation can't engage. [mcporter-lanes](https://pi.dev/packages/mcporter-lanes) (a pi extension by [@maxim](https://github.com/maxim), born out of [#76](https://github.com/achiya-automation/safari-mcp/issues/76)) fixes this upstream: each agent session gets its own daemon dir — and therefore its own safari-mcp — with an idle timeout so processes don't pile up.
+
 ---
 
 ## Tools (97)

package/extension/background.js

@@ -1755,7 +1755,7 @@ async function handleCommand(type, payload) {
 
     // --- Query All ---
     case "query_all": {
-      return await execInTab((selector, limit) => {
+      const queryFn = (selector, limit) => {
         const els = (window.__mcpDeepQueryAll || document.querySelectorAll.bind(document))(selector, limit);
         const results = [];
         for (let i = 0; i < Math.min(els.length, limit); i++) {
@@ -1766,10 +1766,27 @@ async function handleCommand(type, payload) {
             text: (el.innerText || "").substring(0, 100),
             href: el.href || "", value: el.value || "",
             visible: r.width > 0 && r.height > 0,
+            // Center point relative to the element's OWN frame viewport. In the main
+            // frame that equals page-viewport coordinates; in a cross-origin iframe it
+            // is iframe-relative — check `frame` and offset by the iframe's position
+            // before clicking by coordinates.
+            x: Math.round(r.left + r.width / 2),
+            y: Math.round(r.top + r.height / 2),
+            frame: location.href.substring(0, 120),
           });
         }
         return JSON.stringify(results);
-      }, [payload.selector, payload.limit || 20], tabId);
+      };
+
+      const mainResult = await execInTab(queryFn, [payload.selector, payload.limit || 20], tabId);
+      // The main frame is authoritative when it matches. Cross-origin iframes (GHL's
+      // workflow list, embedded editors) are invisible to it, so fall back the same
+      // way click/fill already do rather than reporting "no matches".
+      try {
+        if (mainResult && JSON.parse(mainResult).length > 0) return mainResult;
+      } catch { return mainResult; }
+      const frameResult = await execAcrossFrames(queryFn, [payload.selector, payload.limit || 20], tabId);
+      return frameResult || mainResult;
     }
 
     default:
@@ -2149,6 +2166,33 @@ async function execInAllFrames(func, args = [], tabId = null) {
   }
 }
 
+// Like execInAllFrames, but for functions that return a JSON array: it skips frames
+// that matched nothing instead of stopping at the first non-null result. The main
+// frame nearly always returns "[]" — non-null — which would otherwise mask every
+// cross-origin frame behind it.
+async function execAcrossFrames(func, args = [], tabId = null) {
+  const id = tabId || (await getActiveTab()).id;
+  try {
+    const results = await browser.scripting.executeScript({
+      target: { tabId: id, allFrames: true },
+      world: "MAIN",
+      func,
+      args,
+    });
+    const merged = [];
+    for (const r of results) {
+      if (!r || r.result == null) continue;
+      try {
+        const parsed = JSON.parse(r.result);
+        if (Array.isArray(parsed) && parsed.length) merged.push(...parsed);
+      } catch { /* frame returned a non-array payload — ignore it */ }
+    }
+    return merged.length ? JSON.stringify(merged) : null;
+  } catch {
+    return null;
+  }
+}
+
 async function waitForTabLoad(tabId, timeout = 30000) {
   // Check if already complete BEFORE registering listeners (prevents missing instant-complete events)
   try {

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.10.2",
+  "version": "2.10.3",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",

package/index.js

@@ -164,11 +164,12 @@ function _startMemoryMonitor() {
   const checkInterval = Math.min(MEMORY_CHECK_INTERVAL_MS, 30000); // Max 30s between checks
   _memoryCheckTimer = setInterval(async () => {
     try {
-      // Only the extension host (the single instance owning the Safari
-      // connection) may sweep tabs. Every instance runs this monitor and reads
-      // the SAME global WebKit memory; if all N swept, they'd close tabs in
-      // lockstep and flicker Safari windows shut. The host is the one actor.
-      if (!_isExtensionHost) return;
+      // Every instance may sweep — but only its OWN _openedTabs, and only one
+      // per cycle: _tryAcquireMemoryLock() below already serializes sweepers
+      // machine-wide. The old `_isExtensionHost` gate here was redundant with
+      // that lock and made the guard inert in multi-instance setups — only the
+      // port-9224 winner could ever sweep, and it can't reach tabs the other
+      // instances opened (#83).
       const webkitMB = _getWebKitMemoryMB();
       if (webkitMB <= 0) return;
 

package/ownership-state.js

@@ -36,16 +36,28 @@ export function _loadOwnershipFile() {
   }
 }
 
-export function _saveOwnershipFile(urls) {
+export function _saveOwnershipFile(urls, removed = []) {
   try {
     if (!existsSync(OWNERSHIP_DIR)) mkdirSync(OWNERSHIP_DIR, { recursive: true });
     const now = Date.now();
-    const entries = Array.from(urls).map((url) => ({
-      url,
-      ts: _ownedTabTimestamps.get(url) ?? now,
-    }));
-    // Atomic write (tmp + rename) — concurrent MCP instances share this file; a partial
-    // write from one must never corrupt the JSON another instance reads.
+    // Merge with disk before writing (#82): this file is shared by every instance on the
+    // machine, and a snapshot of only THIS process's Set silently drops entries concurrent
+    // instances added after we hydrated. Union disk+local (newest ts wins), then apply this
+    // write's explicit removals so deletions propagate instead of being resurrected by the
+    // merge. _loadOwnershipFile() TTL-filters, so expired disk entries fall away here too.
+    // Residual race: two writers between read and rename can still drop one entry — that
+    // window is sub-millisecond (was: entire process lifetime) and losing an entry is
+    // fail-safe: ownership is lost, so a tool refuses; it never gains a user's tab.
+    const mergedTs = new Map();
+    for (const e of _loadOwnershipFile()) mergedTs.set(e.url, e.ts);
+    for (const url of urls) {
+      const localTs = _ownedTabTimestamps.get(url) ?? now;
+      mergedTs.set(url, Math.max(localTs, mergedTs.get(url) ?? 0));
+    }
+    for (const url of removed) mergedTs.delete(url);
+    const entries = Array.from(mergedTs, ([url, ts]) => ({ url, ts }));
+    // Atomic write (tmp + rename) — a partial write from one instance must never corrupt
+    // the JSON another instance reads.
     const tmp = OWNERSHIP_FILE + ".tmp." + process.pid;
     writeFileSync(tmp, JSON.stringify(entries), { mode: 0o600 });
     renameSync(tmp, OWNERSHIP_FILE);
@@ -82,8 +94,12 @@ export function _touchOwned(ownedKey) {
   return true;
 }
 export function _pruneExpiredOwnership() {
+  const before = new Set(_ownedTabURLs);
   if (pruneExpired(_ownedTabURLs, _ownedTabTimestamps, OWNERSHIP_TTL_MS)) {
-    _saveOwnershipFile(_ownedTabURLs);
+    // Pass the pruned URLs as explicit removals so the merge-on-write in
+    // _saveOwnershipFile doesn't resurrect them from the disk copy.
+    const removed = [...before].filter((u) => !_ownedTabURLs.has(u));
+    _saveOwnershipFile(_ownedTabURLs, removed);
   }
 }
 
@@ -125,7 +141,7 @@ export function _removeOwnedURL(url) {
   if (url) {
     _ownedTabURLs.delete(url);
     _ownedTabTimestamps.delete(url);
-    _saveOwnershipFile(_ownedTabURLs);
+    _saveOwnershipFile(_ownedTabURLs, [url]);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.15.11",
+  "version": "2.16.0",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -5,9 +5,9 @@
 
 import { execFile, spawn, spawnSync } from "node:child_process";
 import { promisify } from "node:util";
-import { tmpdir } from "node:os";
+import { tmpdir, homedir } from "node:os";
 import { join, dirname, resolve as resolvePath } from "node:path";
-import { readFile, writeFile, unlink, appendFile } from "node:fs/promises";
+import { readFile, writeFile, unlink, appendFile, mkdir } from "node:fs/promises";
 import { readFileSync, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
@@ -261,6 +261,11 @@ function getTargetWindowRef() {
   return _targetWindowRef || 'front window';
 }
 
+// Consecutive failed profile-window detections (#81) — drives the poll backoff,
+// the subprocess-fallback cutoff, and the missing-window log rate limit.
+let _profileMisses = 0;
+let _lastMissingLogTime = 0;
+
 async function refreshTargetWindow(force = false) {
   if (!SAFARI_PROFILE) return;
   const now = Date.now();
@@ -272,7 +277,12 @@ async function refreshTargetWindow(force = false) {
   // The persistent helper occasionally returns '0|' for a window that genuinely
   // exists (daemon timeout / restart race). Before concluding the window is
   // missing, retry once with a plain osascript subprocess \u2014 slower but reliable.
-  if (String(result).split('|')[0] === '0') {
+  // Once consecutive misses have established the window is genuinely ABSENT
+  // (not flakily undetected), skip the subprocess retry — an absent window
+  // returns '0|' every cycle, so the fallback would otherwise spawn an
+  // osascript process per poll, forever (#81). The first successful detection
+  // re-arms it for the flaky-helper case it was added for.
+  if (String(result).split('|')[0] === '0' && _profileMisses < 3) {
     result = await osascript(detectScript).catch(() => '0|');
   }
   const [idStr, windowName] = String(result).split('|');
@@ -286,19 +296,35 @@ async function refreshTargetWindow(force = false) {
     _targetWindowId = id;
     _targetWindowCacheTime = now;
     _profileWindowMissing = false;
+    _profileMisses = 0;
   } else {
     // Profile window not found — clear ref so getTargetWindowRef() will throw
     _targetWindowRef = null;
     _targetWindowId = null;
     _targetWindowCacheTime = 0;
     _profileWindowMissing = true;
-    _logProfile(`WARNING: Profile "${SAFARI_PROFILE}" window not found — refusing to use front window`);
+    _profileMisses++;
+    // Log on transition into the missing state, then at most once per 5 minutes —
+    // this steady state used to append one line per poll, unbounded (#81).
+    if (_profileMisses === 1 || now - _lastMissingLogTime > 300000) {
+      _lastMissingLogTime = now;
+      _logProfile(`WARNING: Profile "${SAFARI_PROFILE}" window not found — refusing to use front window`);
+    }
   }
 }
 
 // Background verification: periodically check that cached window ID still belongs to profile
 if (SAFARI_PROFILE) {
-  setInterval(async () => {
+  // Self-scheduling poll with exponential backoff (#81): 3s while the window is
+  // present (or flakily undetected), doubling per consecutive miss up to 60s
+  // while it is absent — a closed profile window is a steady state, and the
+  // fixed 3s cadence used to spawn an osascript subprocess per cycle, forever.
+  // The first successful detection resets to 3s, so rediscovery stays
+  // responsive: once the user opens the window, the next poll lands within 60s
+  // and everything after it is back on the 3s cadence.
+  const _POLL_BASE_MS = 3000;
+  const _POLL_MAX_MS = 60000;
+  const _pollOnce = async () => {
     // No cached window (e.g. flaky detection at startup) — keep trying to
     // rediscover it so the server self-heals instead of staying stuck.
     if (!_targetWindowRef || !_targetWindowId) {
@@ -329,7 +355,18 @@ if (SAFARI_PROFILE) {
       _targetWindowCacheTime = 0;
       await refreshTargetWindow(true);
     }
-  }, 3000); // Check every 3 seconds
+  };
+  const _schedulePoll = () => {
+    const delay =
+      _profileMisses > 0
+        ? Math.min(_POLL_BASE_MS * 2 ** Math.min(_profileMisses, 5), _POLL_MAX_MS)
+        : _POLL_BASE_MS;
+    setTimeout(async () => {
+      await _pollOnce().catch(() => {});
+      _schedulePoll();
+    }, delay);
+  };
+  _schedulePoll();
 }
 
 // Initialize profile window at startup (ES module top-level await)
@@ -519,10 +556,14 @@ async function _userIsActive() {
 
 // Lightweight trace of every restore decision — confirms WHICH instance (pid)
 // restored focus and whether the user-active guard vetoed it. Best-effort; never
-// throws into the hot path. Tail ~/safari-mcp/restore-trace.log to watch live.
-const _RESTORE_TRACE = join(__dirname, "restore-trace.log");
+// throws into the hot path. Tail ~/.safari-mcp/restore-trace.log to watch live.
+// Lives under ~/.safari-mcp, NOT __dirname (#81) — the package dir is wiped on
+// reinstall and read-only in container/CI setups; mutable state doesn't belong there.
+const _RESTORE_TRACE = join(homedir(), ".safari-mcp", "restore-trace.log");
 function _traceRestore(savedBundleId, decision) {
-  appendFile(_RESTORE_TRACE, `${new Date().toISOString()} pid=${process.pid} saved=${savedBundleId} -> ${decision}\n`).catch(() => {});
+  mkdir(dirname(_RESTORE_TRACE), { recursive: true })
+    .then(() => appendFile(_RESTORE_TRACE, `${new Date().toISOString()} pid=${process.pid} saved=${savedBundleId} -> ${decision}\n`))
+    .catch(() => {});
 }
 
 function _helperHideSafari(timeout = 2000) {
@@ -3130,25 +3171,15 @@ export async function replaceEditorContent({ text }) {
 
 export async function screenshot({ fullPage = false } = {}) {
   await refreshTargetWindow();
+  return _withTargetTabFronted(() => _screenshotFronted({ fullPage }));
+}
+
+async function _screenshotFronted({ fullPage }) {
   const tmpFile = join(tmpdir(), `safari-screenshot-${Date.now()}.png`);
   try {
-    // Check if target tab is a background tab — if so, use JS screenshot to avoid tab jumping
-    let isBackgroundTab = false;
-    if (_st().activeTabIndex) {
-      try {
-        const currentIdx = await osascriptFast(
-          `tell application "Safari" to return index of current tab of ${getTargetWindowRef()}`
-        );
-        isBackgroundTab = Number(currentIdx) !== _st().activeTabIndex;
-      } catch (_) {}
-    }
-    // When on a background tab, go straight to JS-based screenshot (no tab switch, no focus steal)
-    const skipScreencapture = isBackgroundTab;
-
-    // Try screencapture — use osascript's do shell script to bypass VS Code permission issue
-    const windowIdRaw = !skipScreencapture ? await osascript(
+    const windowIdRaw = await osascript(
       `tell application "Safari" to return id of ${getTargetWindowRef()}`
-    ).catch(() => null) : null;
+    ).catch(() => null);
     // Window IDs are OS-assigned integers — reject anything non-numeric before it reaches
     // `do shell script "/usr/sbin/screencapture -l<id>"` (defense-in-depth against odd AppleScript stdout).
     const windowId = windowIdRaw != null && /^\d+$/.test(String(windowIdRaw).trim()) ? String(windowIdRaw).trim() : null;
@@ -3267,6 +3298,11 @@ export async function screenshot({ fullPage = false } = {}) {
 // ========== ELEMENT SCREENSHOT ==========
 
 export async function screenshotElement({ selector }) {
+  await refreshTargetWindow();
+  return _withTargetTabFronted(() => _screenshotElementFronted({ selector }));
+}
+
+async function _screenshotElementFronted({ selector }) {
   const sel = escJsSingleQuote(selector);
   // Use html2canvas-like approach: capture element via SVG foreignObject
   const result = await runJS(