safari-mcp 2.15.5 → 2.15.7

package/README.md

@@ -48,7 +48,7 @@ Native WebKit. ~60% less CPU. Background operation. 97 tools. One `npx` command.
 
 > 📰 **Featured on freeCodeCamp:** [How to Connect Your AI Coding Agent to a Browser on macOS](https://www.freecodecamp.org/news/how-to-connect-your-ai-coding-agent-to-a-browser-on-macos/) · [HackerNoon: Reverse-Engineering React, Shadow DOM, and CSP](https://hackernoon.com/i-had-to-reverse-engineer-react-shadow-dom-and-csp-to-automate-safari-without-chrome)
 
-> 🍎 **Apple shipped an official Safari MCP** (Safari Technology Preview 247, July 2026). It's built on `safaridriver` for isolated debugging sessions. safari-mcp drives the **real Safari you're already logged into** — on stable Safari, with 97 tools. See the full comparison below.
+> 🍎 **Apple shipped an official Safari MCP** (July 2026 — Safari Technology Preview 247+ and the Safari 27 beta). It's built on `safaridriver` for isolated debugging sessions. safari-mcp drives the **real Safari you're already logged into** — on the stable Safari that ships with macOS today, with 97 tools. See the full comparison below.
 
 ---
 
@@ -544,21 +544,23 @@ Safari MCP runs locally on your Mac with minimal attack surface:
 
 ### vs Apple's Official Safari MCP (safaridriver)
 
-In Safari Technology Preview 247 (July 2026), Apple shipped an **official** Safari MCP server built on `safaridriver`. That's great validation for the category — and it's built for a different job. Apple's server drives an **isolated WebDriver automation session** for debugging; safari-mcp drives the **real Safari you're already logged into**.
+In July 2026 Apple shipped an **official** Safari MCP server built on `safaridriver` — first in Safari Technology Preview 247, and now also in the Safari 27 beta. That's great validation for the category — and it's built for a different job. Apple's server drives an **isolated WebDriver automation session** for debugging; safari-mcp drives the **real Safari you're already logged into**.
+
+It has not reached a stable Safari release yet: on macOS 26.5.2 with Safari 26.5.2, `safaridriver --help` lists `--port`, `--bidi`, `--enable` and `--diagnose`, and no `--mcp` (verified 2026-07-23). Check your own machine with `safaridriver --help | grep mcp` before assuming either way.
 
 | | 🦁 safari-mcp *(this repo)* | Apple `safaridriver --mcp` |
 |---|:---:|:---:|
 | **Your real logins / cookies** | ✅ Your actual Safari | ⚠️ Isolated automation session — no access to AutoFill or browsing activity |
-| **Runs on** | ✅ Stable Safari, every Mac | ❌ Safari Technology Preview 247 only |
+| **Runs on** | ✅ Stable Safari, every Mac | ⚠️ Safari Technology Preview 247+ or the Safari 27 beta — not in stable Safari 26.5 |
 | **Background (no focus steal)** | ✅ Yes | ❌ Dedicated window with a "controlled by automation" banner |
 | **Tools** | **97** | ~17 |
 | **Storage** (cookies, localStorage, IndexedDB) | ✅ 10 tools | ❌ |
 | **Network mocking + throttling** | ✅ Yes | ❌ Read-only network inspection |
 | **Device emulation** (iPhone, iPad) | ✅ Yes | ⚠️ Viewport + media type only |
-| **Setup** | `npx safari-mcp` | Enable "remote automation and external agents" in STP |
+| **Setup** | `npx safari-mcp` | Enable "remote automation and external agents", then point your client at that build's `safaridriver --mcp` |
 | **Official Apple support** | ❌ Community (MIT) | ✅ Apple, WebDriver-standard |
 
-> **When Apple's server is the right pick:** you specifically want a clean-room, WebDriver-standard session for compatibility debugging and you already run STP. **For everything else — daily automation on the browser you're already signed into, on stable Safari — safari-mcp is built for exactly that.**
+> **When Apple's server is the right pick:** you specifically want a clean-room, WebDriver-standard session for compatibility debugging and you already run a preview or beta build. **For everything else — daily automation on the browser you're already signed into, on the Safari that shipped with your Mac — safari-mcp is built for exactly that.**
 
 ### Why Safari MCP and Not the Other Safari MCP Projects?
 

package/index.js

@@ -210,19 +210,21 @@ function _startMemoryMonitor() {
 
 // Cleanup on exit
 let _cleaningUp = false;
+async function _shutdown() {
+  if (_cleaningUp) return;
+  _cleaningUp = true;
+  // Restore the user's clipboard synchronously FIRST — if a native paste is mid-flight, its
+  // 2s restore timer would never fire once we exit, leaving the tool's text on the clipboard.
+  try { safari.flushClipboardRestore(); } catch {}
+  // Cap tab cleanup — if the daemon/Safari is wedged at shutdown (exactly when a SIGTERM
+  // tends to arrive), listTabs/closeTab can each block for their full timeout; never let
+  // that hang the exit past 3s.
+  await Promise.race([_cleanupTabs(), new Promise(r => setTimeout(r, 3000))]);
+  process.exit(0);
+}
+
 for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
-  process.on(sig, async () => {
-    if (_cleaningUp) return; // Prevent double-exit on rapid signal repeat
-    _cleaningUp = true;
-    // Restore the user's clipboard synchronously FIRST — if a native paste is mid-flight, its
-    // 2s restore timer would never fire once we exit, leaving the tool's text on the clipboard.
-    try { safari.flushClipboardRestore(); } catch {}
-    // Cap tab cleanup — if the daemon/Safari is wedged at shutdown (exactly when a SIGTERM
-    // tends to arrive), listTabs/closeTab can each block for their full timeout; never let
-    // that hang the exit past 3s.
-    await Promise.race([_cleanupTabs(), new Promise(r => setTimeout(r, 3000))]);
-    process.exit(0);
-  });
+  process.on(sig, _shutdown);
 }
 process.on("exit", () => {
   if (_openedTabs.size > 0) {
@@ -2420,4 +2422,12 @@ _startMemoryMonitor();
 
 // Transport is chosen at runtime: default stdio (unchanged), or a shared HTTP instance when
 // SAFARI_MCP_HTTP=1 (many Claude sessions → one process). buildServer is the per-session factory.
-await startTransport(buildServer, process.env);
+const transportHandle = await startTransport(buildServer, process.env);
+
+if (transportHandle.kind === "stdio") {
+  // A client can disappear without delivering a signal. Treat its pipe closing as the stdio
+  // server's lifecycle boundary, while leaving the opt-in HTTP daemon independent of stdin.
+  process.stdin.once("end", _shutdown);
+  process.stdin.once("close", _shutdown);
+  if (process.stdin.readableEnded || process.stdin.destroyed) void _shutdown();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.15.5",
+  "version": "2.15.7",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -1180,15 +1180,42 @@ async function _withTargetTabFronted(fn) {
 // Atomic tab-identity guard, as a JS prefix. Belongs here and not at a call site: it is the
 // only check that is independent of how `idx` was resolved, so every path that builds a
 // targeted `do JavaScript` needs it — most of all the retry paths, which run precisely when
-// the index has already proven untrustworthy. Empty string when the caller named a tab
-// explicitly, or when this session owns no marked tab (front-document fallback is then
-// intentional). See #64.
+// the index has already proven untrustworthy. Empty only when the caller named a tab
+// explicitly. See #64.
 function _tabIdentityGuard(explicitTabIndex) {
+  if (explicitTabIndex) return '';
   const marker = _st().activeTabMarker;
-  if (!marker || explicitTabIndex) return '';
+  // No marker → this session owns no tab, so the target is the front document: the tab the
+  // user is looking at. That fallback is intentional for a session that genuinely never
+  // opened one — but "owns no tab" is also what a *re-initialised* session reports. In
+  // HTTP-daemon mode a dropped transport makes the client re-init, which mints a new
+  // MCP session id, and `_st()` hands it a fresh empty state: `hasOwnedTab` false,
+  // `activeTabMarker` null. Every fail-closed branch keys on `hasOwnedTab`, so they all read
+  // false at exactly the moment an agent is mid-task and already owns a tab — and the next
+  // op runs, unguarded, on the user's current page.
+  //
+  // The session state died; the marker on the tab did not. A front document carrying any
+  // `MCP_` marker is a tab some MCP session opened and this one does not own, so it is
+  // never a legitimate implicit target — refuse it. An unmarked front document stays
+  // reachable, which keeps "read the page I'm looking at" working for real fresh sessions.
+  if (!marker) {
+    return `if(typeof window.name==='string'&&window.name.indexOf('MCP_')===0){throw new Error('MCP_FOREIGN_TAB')};`;
+  }
   return `if(window.name!=='${marker}'&&window.__mcpTabMarker!=='${marker}'){throw new Error('MCP_WRONG_TAB')};`;
 }
 
+// A tripped foreign-tab guard is terminal: with no marker of our own there is nothing to
+// re-resolve to, and retrying is the guess the guard just refused.
+function _foreignTabError(where, cause) {
+  return new Error(
+    `Tab tracking lost during ${where} — the target is a tab opened by another MCP session ` +
+    `that this session does not own (atomic guard fail-closed). This session holds no tab ` +
+    `marker, which is also what a session re-initialised after a transport drop reports. ` +
+    `Call safari_new_tab to open a tab this session owns.`,
+    cause ? { cause } : undefined
+  );
+}
+
 // Run JavaScript in Safari — fastest path, no focus stealing
 // Uses osascriptFast (persistent process, ~5ms) for short scripts,
 // falls back to osascript (~80ms) for long scripts that exceed stdin limits
@@ -1247,6 +1274,7 @@ async function runJS(js, { tabIndex, timeout = 15000 } = {}) {
     // the shared profile window). Re-resolve via a full marker scan and retry once on the
     // correct tab; if unresolved, fail closed rather than touch the user's tab.
     const _gmsg = err.message || '';
+    if (_gmsg.includes('MCP_FOREIGN_TAB')) throw _foreignTabError('runJS', err);
     if (_guard && _gmsg.includes('MCP_WRONG_TAB')) {
       console.error('[Safari MCP] Atomic guard tripped — re-resolving marked tab via full scan');
       _st().lastResolveTime = 0; _st().activeTabIndex = null;
@@ -1353,6 +1381,7 @@ async function runJSLarge(js, { tabIndex, timeout = 30000 } = {}) {
   } catch (err) {
     // No retry here, unlike runJS: these payloads carry file data, and re-running one on a
     // freshly resolved tab is exactly the guess this guard exists to prevent.
+    if ((err.message || '').includes('MCP_FOREIGN_TAB')) throw _foreignTabError('runJSLarge', err);
     if ((err.message || '').includes('MCP_WRONG_TAB')) {
       throw new Error('Tab tracking lost during runJSLarge — target tab does not carry this session\'s marker (atomic guard fail-closed). Call safari_new_tab to reopen.', { cause: err });
     }