safari-mcp 2.15.3 → 2.15.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.15.3",
+  "version": "2.15.5",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -670,7 +670,7 @@ async function resolveActiveTab() {
     // Parse result — can be "N" (found) or "0:tabCount" (not found)
     const resultStr = String(result);
     if (resultStr.includes(':')) {
-      // Not found — clamp stale index to tabCount
+      // Not found — every exit below fails closed (drops the index); nothing here guesses.
       const tabCount = Number(resultStr.split(':')[1]) || 1;
       _st().lastTabCount = tabCount;
       _st().activeTabURL = null;
@@ -682,8 +682,16 @@ async function resolveActiveTab() {
         return null;
       }
       if (_st().activeTabIndex && _st().activeTabIndex > tabCount) {
-        console.error(`[Safari MCP] Tab ghost proactive fix: index ${_st().activeTabIndex} > tabCount ${tabCount}, clamping to ${tabCount}`);
-        _st().activeTabIndex = tabCount;
+        // Our index is past the end of the window: the user closed a tab or tore one
+        // into its own window, so the index no longer names any tab — least of all ours.
+        // This used to clamp to `tabCount` ("tab ghost proactive fix"), which silently
+        // retargeted us at the LAST tab in the window — the user's. That predates the
+        // identity marker (clamp: Mar 31, marker: v2.8.3 Apr 14) and was the one exit
+        // here that still guessed. Fail closed like the two branches above; callers
+        // re-anchor via _assertNotFallingBackToUserTab's "re-run safari_new_tab" error.
+        console.error(`[Safari MCP] Tab identity lost (index ${_st().activeTabIndex} > tabCount ${tabCount}) — clearing index to avoid targeting the user's tab`);
+        _st().activeTabIndex = null;
+        return null;
       }
       return _st().activeTabIndex;
     }
@@ -1169,6 +1177,18 @@ async function _withTargetTabFronted(fn) {
   }
 }
 
+// Atomic tab-identity guard, as a JS prefix. Belongs here and not at a call site: it is the
+// only check that is independent of how `idx` was resolved, so every path that builds a
+// targeted `do JavaScript` needs it — most of all the retry paths, which run precisely when
+// the index has already proven untrustworthy. Empty string when the caller named a tab
+// explicitly, or when this session owns no marked tab (front-document fallback is then
+// intentional). See #64.
+function _tabIdentityGuard(explicitTabIndex) {
+  const marker = _st().activeTabMarker;
+  if (!marker || explicitTabIndex) return '';
+  return `if(window.name!=='${marker}'&&window.__mcpTabMarker!=='${marker}'){throw new Error('MCP_WRONG_TAB')};`;
+}
+
 // Run JavaScript in Safari — fastest path, no focus stealing
 // Uses osascriptFast (persistent process, ~5ms) for short scripts,
 // falls back to osascript (~80ms) for long scripts that exceed stdin limits
@@ -1215,9 +1235,7 @@ async function runJS(js, { tabIndex, timeout = 15000 } = {}) {
   // does not carry OUR marker. Makes the op fail-closed at EXECUTION time regardless of how
   // `idx` resolved — a drift to the user's tab (shared profile window) throws instead of
   // running on their page. Skipped when the caller passed an explicit tabIndex.
-  const _guard = (_st().activeTabMarker && !tabIndex)
-    ? `if(window.name!=='${_st().activeTabMarker}'&&window.__mcpTabMarker!=='${_st().activeTabMarker}'){throw new Error('MCP_WRONG_TAB')};`
-    : '';
+  const _guard = _tabIdentityGuard(tabIndex);
   const script = `tell application "Safari" to do JavaScript "${_guard}${escaped}" in ${target}`;
   try {
     if (script.length < 50000) {
@@ -1254,7 +1272,10 @@ async function runJS(js, { tabIndex, timeout = 15000 } = {}) {
         if (newIdx && newIdx !== idx) {
           console.error(`[Safari MCP] Tab ghost resolved: ${idx} → ${newIdx}`);
           const newTarget = `tab ${newIdx} of ${getTargetWindowRef()}`;
-          const retryScript = `tell application "Safari" to do JavaScript "${escaped}" in ${newTarget}`;
+          // Keep the guard on the retry. `newIdx` came from a re-resolve triggered by the
+          // index being wrong; dropping the check here made the least trustworthy path the
+          // only unchecked one (#64).
+          const retryScript = `tell application "Safari" to do JavaScript "${_guard}${escaped}" in ${newTarget}`;
           if (retryScript.length < 50000) return osascriptFast(retryScript, { timeout });
           return osascript(retryScript, { timeout });
         }
@@ -1313,7 +1334,10 @@ async function runJSLarge(js, { tabIndex, timeout = 30000 } = {}) {
     .replace(/\n/g, " ")
     .replace(/\r/g, "")
     .replace(/\t/g, " ");
-  const appleScript = `tell application "Safari" to do JavaScript "${escaped}" in ${target}`;
+  // Same execution-time identity check runJS gets. These are the upload / paste-image ops —
+  // the largest blast radius in the toolset — and they were the one targeted path with no
+  // guard at all (#64).
+  const appleScript = `tell application "Safari" to do JavaScript "${_tabIdentityGuard(tabIndex)}${escaped}" in ${target}`;
   const tmpFile = join(tmpdir(), `safari-mcp-${Date.now()}.scpt`);
   await writeFile(tmpFile, appleScript, "utf8");
   // Save frontmost app via daemon before subprocess execution
@@ -1326,6 +1350,13 @@ async function runJSLarge(js, { tabIndex, timeout = 30000 } = {}) {
       maxBuffer: 10 * 1024 * 1024,
     });
     return stdout.trim();
+  } catch (err) {
+    // No retry here, unlike runJS: these payloads carry file data, and re-running one on a
+    // freshly resolved tab is exactly the guess this guard exists to prevent.
+    if ((err.message || '').includes('MCP_WRONG_TAB')) {
+      throw new Error('Tab tracking lost during runJSLarge — target tab does not carry this session\'s marker (atomic guard fail-closed). Call safari_new_tab to reopen.', { cause: err });
+    }
+    throw err;
   } finally {
     unlink(tmpFile).catch(() => {});
     // Awaited restore — caller must not return to user-space while Safari is still frontmost.