safari-mcp 2.15.12 → 2.16.0

package/extension/background.js

@@ -1755,7 +1755,7 @@ async function handleCommand(type, payload) {
 
     // --- Query All ---
     case "query_all": {
-      return await execInTab((selector, limit) => {
+      const queryFn = (selector, limit) => {
         const els = (window.__mcpDeepQueryAll || document.querySelectorAll.bind(document))(selector, limit);
         const results = [];
         for (let i = 0; i < Math.min(els.length, limit); i++) {
@@ -1766,10 +1766,27 @@ async function handleCommand(type, payload) {
             text: (el.innerText || "").substring(0, 100),
             href: el.href || "", value: el.value || "",
             visible: r.width > 0 && r.height > 0,
+            // Center point relative to the element's OWN frame viewport. In the main
+            // frame that equals page-viewport coordinates; in a cross-origin iframe it
+            // is iframe-relative — check `frame` and offset by the iframe's position
+            // before clicking by coordinates.
+            x: Math.round(r.left + r.width / 2),
+            y: Math.round(r.top + r.height / 2),
+            frame: location.href.substring(0, 120),
           });
         }
         return JSON.stringify(results);
-      }, [payload.selector, payload.limit || 20], tabId);
+      };
+
+      const mainResult = await execInTab(queryFn, [payload.selector, payload.limit || 20], tabId);
+      // The main frame is authoritative when it matches. Cross-origin iframes (GHL's
+      // workflow list, embedded editors) are invisible to it, so fall back the same
+      // way click/fill already do rather than reporting "no matches".
+      try {
+        if (mainResult && JSON.parse(mainResult).length > 0) return mainResult;
+      } catch { return mainResult; }
+      const frameResult = await execAcrossFrames(queryFn, [payload.selector, payload.limit || 20], tabId);
+      return frameResult || mainResult;
     }
 
     default:
@@ -2149,6 +2166,33 @@ async function execInAllFrames(func, args = [], tabId = null) {
   }
 }
 
+// Like execInAllFrames, but for functions that return a JSON array: it skips frames
+// that matched nothing instead of stopping at the first non-null result. The main
+// frame nearly always returns "[]" — non-null — which would otherwise mask every
+// cross-origin frame behind it.
+async function execAcrossFrames(func, args = [], tabId = null) {
+  const id = tabId || (await getActiveTab()).id;
+  try {
+    const results = await browser.scripting.executeScript({
+      target: { tabId: id, allFrames: true },
+      world: "MAIN",
+      func,
+      args,
+    });
+    const merged = [];
+    for (const r of results) {
+      if (!r || r.result == null) continue;
+      try {
+        const parsed = JSON.parse(r.result);
+        if (Array.isArray(parsed) && parsed.length) merged.push(...parsed);
+      } catch { /* frame returned a non-array payload — ignore it */ }
+    }
+    return merged.length ? JSON.stringify(merged) : null;
+  } catch {
+    return null;
+  }
+}
+
 async function waitForTabLoad(tabId, timeout = 30000) {
   // Check if already complete BEFORE registering listeners (prevents missing instant-complete events)
   try {

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.10.2",
+  "version": "2.10.3",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.15.12",
+  "version": "2.16.0",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -3171,25 +3171,15 @@ export async function replaceEditorContent({ text }) {
 
 export async function screenshot({ fullPage = false } = {}) {
   await refreshTargetWindow();
+  return _withTargetTabFronted(() => _screenshotFronted({ fullPage }));
+}
+
+async function _screenshotFronted({ fullPage }) {
   const tmpFile = join(tmpdir(), `safari-screenshot-${Date.now()}.png`);
   try {
-    // Check if target tab is a background tab — if so, use JS screenshot to avoid tab jumping
-    let isBackgroundTab = false;
-    if (_st().activeTabIndex) {
-      try {
-        const currentIdx = await osascriptFast(
-          `tell application "Safari" to return index of current tab of ${getTargetWindowRef()}`
-        );
-        isBackgroundTab = Number(currentIdx) !== _st().activeTabIndex;
-      } catch (_) {}
-    }
-    // When on a background tab, go straight to JS-based screenshot (no tab switch, no focus steal)
-    const skipScreencapture = isBackgroundTab;
-
-    // Try screencapture — use osascript's do shell script to bypass VS Code permission issue
-    const windowIdRaw = !skipScreencapture ? await osascript(
+    const windowIdRaw = await osascript(
       `tell application "Safari" to return id of ${getTargetWindowRef()}`
-    ).catch(() => null) : null;
+    ).catch(() => null);
     // Window IDs are OS-assigned integers — reject anything non-numeric before it reaches
     // `do shell script "/usr/sbin/screencapture -l<id>"` (defense-in-depth against odd AppleScript stdout).
     const windowId = windowIdRaw != null && /^\d+$/.test(String(windowIdRaw).trim()) ? String(windowIdRaw).trim() : null;
@@ -3308,6 +3298,11 @@ export async function screenshot({ fullPage = false } = {}) {
 // ========== ELEMENT SCREENSHOT ==========
 
 export async function screenshotElement({ selector }) {
+  await refreshTargetWindow();
+  return _withTargetTabFronted(() => _screenshotElementFronted({ selector }));
+}
+
+async function _screenshotElementFronted({ selector }) {
   const sel = escJsSingleQuote(selector);
   // Use html2canvas-like approach: capture element via SVG foreignObject
   const result = await runJS(