safari-mcp 2.15.4 → 2.15.6

package/README.md

@@ -48,7 +48,7 @@ Native WebKit. ~60% less CPU. Background operation. 97 tools. One `npx` command.
 
 > 📰 **Featured on freeCodeCamp:** [How to Connect Your AI Coding Agent to a Browser on macOS](https://www.freecodecamp.org/news/how-to-connect-your-ai-coding-agent-to-a-browser-on-macos/) · [HackerNoon: Reverse-Engineering React, Shadow DOM, and CSP](https://hackernoon.com/i-had-to-reverse-engineer-react-shadow-dom-and-csp-to-automate-safari-without-chrome)
 
-> 🍎 **Apple shipped an official Safari MCP** (Safari Technology Preview 247, July 2026). It's built on `safaridriver` for isolated debugging sessions. safari-mcp drives the **real Safari you're already logged into** — on stable Safari, with 97 tools. See the full comparison below.
+> 🍎 **Apple shipped an official Safari MCP** (July 2026 — Safari Technology Preview 247+ and the Safari 27 beta). It's built on `safaridriver` for isolated debugging sessions. safari-mcp drives the **real Safari you're already logged into** — on the stable Safari that ships with macOS today, with 97 tools. See the full comparison below.
 
 ---
 
@@ -544,21 +544,23 @@ Safari MCP runs locally on your Mac with minimal attack surface:
 
 ### vs Apple's Official Safari MCP (safaridriver)
 
-In Safari Technology Preview 247 (July 2026), Apple shipped an **official** Safari MCP server built on `safaridriver`. That's great validation for the category — and it's built for a different job. Apple's server drives an **isolated WebDriver automation session** for debugging; safari-mcp drives the **real Safari you're already logged into**.
+In July 2026 Apple shipped an **official** Safari MCP server built on `safaridriver` — first in Safari Technology Preview 247, and now also in the Safari 27 beta. That's great validation for the category — and it's built for a different job. Apple's server drives an **isolated WebDriver automation session** for debugging; safari-mcp drives the **real Safari you're already logged into**.
+
+It has not reached a stable Safari release yet: on macOS 26.5.2 with Safari 26.5.2, `safaridriver --help` lists `--port`, `--bidi`, `--enable` and `--diagnose`, and no `--mcp` (verified 2026-07-23). Check your own machine with `safaridriver --help | grep mcp` before assuming either way.
 
 | | 🦁 safari-mcp *(this repo)* | Apple `safaridriver --mcp` |
 |---|:---:|:---:|
 | **Your real logins / cookies** | ✅ Your actual Safari | ⚠️ Isolated automation session — no access to AutoFill or browsing activity |
-| **Runs on** | ✅ Stable Safari, every Mac | ❌ Safari Technology Preview 247 only |
+| **Runs on** | ✅ Stable Safari, every Mac | ⚠️ Safari Technology Preview 247+ or the Safari 27 beta — not in stable Safari 26.5 |
 | **Background (no focus steal)** | ✅ Yes | ❌ Dedicated window with a "controlled by automation" banner |
 | **Tools** | **97** | ~17 |
 | **Storage** (cookies, localStorage, IndexedDB) | ✅ 10 tools | ❌ |
 | **Network mocking + throttling** | ✅ Yes | ❌ Read-only network inspection |
 | **Device emulation** (iPhone, iPad) | ✅ Yes | ⚠️ Viewport + media type only |
-| **Setup** | `npx safari-mcp` | Enable "remote automation and external agents" in STP |
+| **Setup** | `npx safari-mcp` | Enable "remote automation and external agents", then point your client at that build's `safaridriver --mcp` |
 | **Official Apple support** | ❌ Community (MIT) | ✅ Apple, WebDriver-standard |
 
-> **When Apple's server is the right pick:** you specifically want a clean-room, WebDriver-standard session for compatibility debugging and you already run STP. **For everything else — daily automation on the browser you're already signed into, on stable Safari — safari-mcp is built for exactly that.**
+> **When Apple's server is the right pick:** you specifically want a clean-room, WebDriver-standard session for compatibility debugging and you already run a preview or beta build. **For everything else — daily automation on the browser you're already signed into, on the Safari that shipped with your Mac — safari-mcp is built for exactly that.**
 
 ### Why Safari MCP and Not the Other Safari MCP Projects?
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.15.4",
+  "version": "2.15.6",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -1177,6 +1177,45 @@ async function _withTargetTabFronted(fn) {
   }
 }
 
+// Atomic tab-identity guard, as a JS prefix. Belongs here and not at a call site: it is the
+// only check that is independent of how `idx` was resolved, so every path that builds a
+// targeted `do JavaScript` needs it — most of all the retry paths, which run precisely when
+// the index has already proven untrustworthy. Empty only when the caller named a tab
+// explicitly. See #64.
+function _tabIdentityGuard(explicitTabIndex) {
+  if (explicitTabIndex) return '';
+  const marker = _st().activeTabMarker;
+  // No marker → this session owns no tab, so the target is the front document: the tab the
+  // user is looking at. That fallback is intentional for a session that genuinely never
+  // opened one — but "owns no tab" is also what a *re-initialised* session reports. In
+  // HTTP-daemon mode a dropped transport makes the client re-init, which mints a new
+  // MCP session id, and `_st()` hands it a fresh empty state: `hasOwnedTab` false,
+  // `activeTabMarker` null. Every fail-closed branch keys on `hasOwnedTab`, so they all read
+  // false at exactly the moment an agent is mid-task and already owns a tab — and the next
+  // op runs, unguarded, on the user's current page.
+  //
+  // The session state died; the marker on the tab did not. A front document carrying any
+  // `MCP_` marker is a tab some MCP session opened and this one does not own, so it is
+  // never a legitimate implicit target — refuse it. An unmarked front document stays
+  // reachable, which keeps "read the page I'm looking at" working for real fresh sessions.
+  if (!marker) {
+    return `if(typeof window.name==='string'&&window.name.indexOf('MCP_')===0){throw new Error('MCP_FOREIGN_TAB')};`;
+  }
+  return `if(window.name!=='${marker}'&&window.__mcpTabMarker!=='${marker}'){throw new Error('MCP_WRONG_TAB')};`;
+}
+
+// A tripped foreign-tab guard is terminal: with no marker of our own there is nothing to
+// re-resolve to, and retrying is the guess the guard just refused.
+function _foreignTabError(where, cause) {
+  return new Error(
+    `Tab tracking lost during ${where} — the target is a tab opened by another MCP session ` +
+    `that this session does not own (atomic guard fail-closed). This session holds no tab ` +
+    `marker, which is also what a session re-initialised after a transport drop reports. ` +
+    `Call safari_new_tab to open a tab this session owns.`,
+    cause ? { cause } : undefined
+  );
+}
+
 // Run JavaScript in Safari — fastest path, no focus stealing
 // Uses osascriptFast (persistent process, ~5ms) for short scripts,
 // falls back to osascript (~80ms) for long scripts that exceed stdin limits
@@ -1223,9 +1262,7 @@ async function runJS(js, { tabIndex, timeout = 15000 } = {}) {
   // does not carry OUR marker. Makes the op fail-closed at EXECUTION time regardless of how
   // `idx` resolved — a drift to the user's tab (shared profile window) throws instead of
   // running on their page. Skipped when the caller passed an explicit tabIndex.
-  const _guard = (_st().activeTabMarker && !tabIndex)
-    ? `if(window.name!=='${_st().activeTabMarker}'&&window.__mcpTabMarker!=='${_st().activeTabMarker}'){throw new Error('MCP_WRONG_TAB')};`
-    : '';
+  const _guard = _tabIdentityGuard(tabIndex);
   const script = `tell application "Safari" to do JavaScript "${_guard}${escaped}" in ${target}`;
   try {
     if (script.length < 50000) {
@@ -1237,6 +1274,7 @@ async function runJS(js, { tabIndex, timeout = 15000 } = {}) {
     // the shared profile window). Re-resolve via a full marker scan and retry once on the
     // correct tab; if unresolved, fail closed rather than touch the user's tab.
     const _gmsg = err.message || '';
+    if (_gmsg.includes('MCP_FOREIGN_TAB')) throw _foreignTabError('runJS', err);
     if (_guard && _gmsg.includes('MCP_WRONG_TAB')) {
       console.error('[Safari MCP] Atomic guard tripped — re-resolving marked tab via full scan');
       _st().lastResolveTime = 0; _st().activeTabIndex = null;
@@ -1262,7 +1300,10 @@ async function runJS(js, { tabIndex, timeout = 15000 } = {}) {
         if (newIdx && newIdx !== idx) {
           console.error(`[Safari MCP] Tab ghost resolved: ${idx} → ${newIdx}`);
           const newTarget = `tab ${newIdx} of ${getTargetWindowRef()}`;
-          const retryScript = `tell application "Safari" to do JavaScript "${escaped}" in ${newTarget}`;
+          // Keep the guard on the retry. `newIdx` came from a re-resolve triggered by the
+          // index being wrong; dropping the check here made the least trustworthy path the
+          // only unchecked one (#64).
+          const retryScript = `tell application "Safari" to do JavaScript "${_guard}${escaped}" in ${newTarget}`;
           if (retryScript.length < 50000) return osascriptFast(retryScript, { timeout });
           return osascript(retryScript, { timeout });
         }
@@ -1321,7 +1362,10 @@ async function runJSLarge(js, { tabIndex, timeout = 30000 } = {}) {
     .replace(/\n/g, " ")
     .replace(/\r/g, "")
     .replace(/\t/g, " ");
-  const appleScript = `tell application "Safari" to do JavaScript "${escaped}" in ${target}`;
+  // Same execution-time identity check runJS gets. These are the upload / paste-image ops —
+  // the largest blast radius in the toolset — and they were the one targeted path with no
+  // guard at all (#64).
+  const appleScript = `tell application "Safari" to do JavaScript "${_tabIdentityGuard(tabIndex)}${escaped}" in ${target}`;
   const tmpFile = join(tmpdir(), `safari-mcp-${Date.now()}.scpt`);
   await writeFile(tmpFile, appleScript, "utf8");
   // Save frontmost app via daemon before subprocess execution
@@ -1334,6 +1378,14 @@ async function runJSLarge(js, { tabIndex, timeout = 30000 } = {}) {
       maxBuffer: 10 * 1024 * 1024,
     });
     return stdout.trim();
+  } catch (err) {
+    // No retry here, unlike runJS: these payloads carry file data, and re-running one on a
+    // freshly resolved tab is exactly the guess this guard exists to prevent.
+    if ((err.message || '').includes('MCP_FOREIGN_TAB')) throw _foreignTabError('runJSLarge', err);
+    if ((err.message || '').includes('MCP_WRONG_TAB')) {
+      throw new Error('Tab tracking lost during runJSLarge — target tab does not carry this session\'s marker (atomic guard fail-closed). Call safari_new_tab to reopen.', { cause: err });
+    }
+    throw err;
   } finally {
     unlink(tmpFile).catch(() => {});
     // Awaited restore — caller must not return to user-space while Safari is still frontmost.